Securing ACCESS to ISPCONFIG

Hi I will guide you to use Ispconfig 3 PANEL in a secure environment.

The first thing we're going to do is disabling the access to ispconfig panel trough all the domains.

Second, I'm going to explain you what you should do to install a valid SSL certificate under ISPCONFIG instalation.

We will Also manage the ERROR 400 BAD REQUEST if you access ispconfig with http://

Main Information :
Operating System - Linux, Debian
Web Server - Apache 2
SSL certs - Enom.com - The most economic SSL panel i found is 11$ years aprox, it only validates a domain or subdomain
IP addresses to make virtual servers in apache with custom SSL.

Lets Start


1. Obtaining necessary files
First of all, download all the files under /etc/apache2/sites-available/
and store them in a folder, make a secure backup.

In a normal ispconfig installation, the .vhosts file of apache2 configuration come with virtualhost *:80 (so that all ip's respond to the domains), that is ok in normal cases, we want a secure environment so we will change all this.

So imagine actually we have 10.10.10.10 as common ip, and we want to use 11.11.11.11 as IP for the ISPCONFIG PANEL to use SSL.

2. Modifications
We First should change all the client .vhost files changing

Code:

<VirtualHost *:80>

for

Code:

<VirtualHost 10.10.10.10:80>

Open ispconfig.vhost file and add Listen 11.11.11.11:ispconfigport on the top, and change the virtual host like this :

Code:

<VirtualHost 11.11.11.11:port>
ErrorDocument 400 /error.html
  ServerAdmin webmaster@localhost
  ServerName panel.domain.com

In error.html, you must upload that file to /usr/local/ispconfig/interface/web/
That file should contain a window.location = https://panel.yourdomain.com, to redirect http connections to your panel, instead of showing a 400BAD request error.


Now we are going to ensure that SSL is disabled for the rest of the domains, i had problems with that, so check it.
Open file /etc/apache2/ports.conf and make it look to something like this :

Code:

NameVirtualHost 10.10.10.10:80
Listen 80

<IfModule mod_ssl.c>
</IfModule>

3. DNS RECORD

Now you should add a new A RECORD in your DNS pointing to 11.11.11.11, example.
A panel.domain.com 11.11.11.11


4. SSL certificate
Generate the SSL certificate like explained in this post, Remember the common name must be the subdomain panel.domain.com !!!!

When you generated it, go to Enom.com and add your CSR and generate the Secure Certificate. Enom will send you a certificate.crt, you must copy it to /usr/local/ispconfig/interface/ssl/, also upload intermediate.crt provided by enom.com.

Once you have all the cert files correctly uploaded, open the ispconfig.vhost file again and edit, ssl section as follows :

Code:

<IfModule mod_ssl.c>
  # SSL Configuration
 SSLEngine On
 SSLCertificateFile /usr/local/ispconfig/interface/ssl/ispserver.crt
 SSLCertificateKeyFile /usr/local/ispconfig/interface/ssl/ispserver.key
 SSLCertificateChainFile /usr/local/ispconfig/interface/ssl/intermedio.crt
    </IfModule>

Restart apache with
/etc/init.d/apache2 restart
You are done, now your clients should access the panel trough your https://panel.domain.com: port, with the secure SSL cert, also they can access their webmail and phpmyadmin in a secure environment https://panel.domain.com: port/phpmyadmin, and https://panel.domain.com: port/webmail if you configured your apache files correctly before

IF apache2 crashes, Check the logs, if necessary I can help.

Thank you for Reading

 

Hi Till,

I cannot use Ispconfig to manage ispconfig.vhost file... that's why I used the manual way

I normally like making things manually, that's why I have Ispconfig, cause it doenst move files to other custom and hidden places like plesk or others.
Dont you think its much better ?¿

 

HMM, important for me to know it so I dont loose the CERTS.
So what would you do? modify only sites-enabled ?¿

 

Yes, I Followed 99% of your guide, only change is the SSL provider.
Thank you for help, plz remember my priv message, I'm waiting your reply!!