ISPConfig 3.0.5 RC 1 released for testing

You're willing to say that it is not the best way?
A simple check in the database can be avoided this kind of fault who can compromise the security of all the host ?
With this vulnerability everyone can make a phishing page and really realistic and with a guaranteed result

 

Yes, but this method has many defects :
-It's take too many times to the admin and to the client maybe he needs to deploy its site NOW
-It is the same thing because the admin dont necessarily know that it is the domain of this or this client ... unless if he looks at the whois or contact the customer which will take much more time

I think the problem can be resolved easily and without 1000 lines of code, simply by checking the domain name thanks to a Regex + SQL query and it is done ... like the vast majority of hosts !

 

We are not all domains provider

This is not what i said ! You can do a very simple SQL query find there are a another website with the same domain so first come first served.
And no this is not better than a human but it's take less time and it's better when you haven't this option checked.

This is not wat i said, i said that with a Regex+SQL you can see if a domain is already used IN YOU SERVER, and this is logic no ?
Although this is not what I said, yes there's a regex that it allows you to do this and it is extremely simple regex you can do it in 15 minutes (Okey the script need to download a whois page from a whois provider (XML: HTML or anything else) and you perse it using regex to find the name after this you use a condition and it's done) but this is not what i say to do, what i say to do is to simply check if a domain is already used by another clients if we haven't check the option of limited domain, yeah okey it's not betted than a human but it's fast the same

 

Okey, but this is so in every host, so this is not a defect and this is not the problem but the problem is that you can make :
- panel-secure-phishing.yourhoster.com
- panel-secure-phishing.aclient.com
And it's work perfectly with every domain, THIS is what i am talking about

 

Okey
Oh and before I forget, you do a great job, really !

 

Hi,

How to remove the "APS installer" menu and the backup tab on the client control panel ?

Best regards

 

ISP 3.0.5 RC not starting up on Debian Wheezy

I just installed a testing environment based on http://www.howtoforge.com/perfect-server-debian-squeeze-with-bind-and-dovecot-ispconfig-3 upgraded to Debian Wheezy. Installation went fine without any errors, but ISPConfig interface is not accessible afterwards on port 8080. I simply get

in the browser and Apache error log states only:

Code:

[Sun Jan 13 18:37:23 2013] [error] [client 87.163.xxx.xxx] client denied by server configuration: /var/www/, referer: http://host.example.com:8080/

I first thought it might be a php-fcgi issue and activated the mod_php section in 000-ispconfig.vhost following the comment in
http://www.howtoforge.com/forums/showpost.php?p=290143&postcount=18, but after doing that I only get an 500 internal server error stating the following in the error.log:

Code:

[Sun Jan 13 18:40:53 2013] [error] [client 87.163.xxx.xxx] PHP Warning:  require_once(/usr/local/ispconfig/interface/lib/config.inc.php): failed to open stream: Permission denied in /usr/local/ispconfig/interface/web/index.php on line 31, referer: http://host.example.com:8080/
[Sun Jan 13 18:40:53 2013] [error] [client 87.163.xxx.xxx] PHP Fatal error:  require_once(): Failed opening required '../lib/config.inc.php' (include_path='.:/usr/share/php:/usr/share/pear') in /usr/local/ispconfig/interface/web/index.php on line 31, referer: http://host.example.com:8080/

Any Ideas what's going wrong here? Other vHosts / redirects to symlinks as e.g. /phpmyadmin or /squirrelmail work fine.

 

OK, meanwhile I discovered some things on my own:

Compared to http://www.howtoforge.com/perfect-server-debian-squeeze-with-bind-and-dovecot-ispconfig-3 it seems to be required in Wheezy to manually enable libapache2-mod-fcgid to make ISP with 000-ispconfig.vhost work:

Code:

a2enmod fcgid 
/etc/init.d/apache2 restart

In addition to that (and completely independent from the problem above) also the following dovecot packages need to be installed on Wheezy: dovecot-mysql dovecot-sieve.

Nevertheless, what I'm still struggeling with: Why does the commenting in of the mod_php section in 000-ispconfig.vhost not work. Is there a access rights issue for apache or a different default symlink handling in Wheezy?

 

Hy all.

How do I enable db backup?




Thx.

 

go to databases select your DB et in the menu you juste have to select le website to associate to it.
and the next backup will have a db saved