The OpenBaseDir can only be set to the "Home Directory" or the "Document Root". It would be nice to have a third option to set it manually. For example: Magento needs only it's pub directory to be accessible via Apache (DocumentRoot), but PHP needs access to all files in the "Mangento Root" (OpenBaseDir). Currently I must give it access to all files under the home directory of the user.

Description

Allows Admin and Customer to create a CAA DNS entry, stating that only letsencrypt.org is allowed to issue a certificate for said domain.

Type of change

• [ ] Bug fix (non-breaking change which fixes an issue)
• [x] New feature (non-breaking change which adds functionality)
• [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
• [ ] This change requires a documentation update

How Has This Been Tested?

Locally

Test Configuration:

• Distribution: Debian GNU/Linux 10 (buster)
• Webserver: apache2/2.4.38-3
• PHP: 7.3.7-1+0~20190710.40+debian10~1.gbp032aec

Checklist:

• [x] I have performed a self-review of my own code
• [x] I have commented my code, particularly in hard-to-understand areas
• [ ] I have made corresponding changes to the documentation
• [x] My changes generate no new warnings
• [ ] I have added tests that prove my fix is effective or that my feature works
• [] New and existing unit tests pass locally with my changes

Description

In #564 its asked to allow CIDR and netmask of mysql host net validation and saving.

Fixes #564

Type of change

• [x] New feature (non-breaking change which adds functionality)
• [x] This change requires a documentation update (Possibly. I've changed description field and it should be clear from there to admins.) (Only english and german)

How Has This Been Tested?

Locally, with cidr and netmask syntax. Values: 172.23.0.5,172.23.0.5,100.127.0.0/255.255.0.0,10.10.10.10/16,1.1.1.1/16,1.1.1.1/4

(which becomes 172.23.0.5,172.23.0.5,100.127.0.0/255.255.0.0,10.10.10.10/255.255.0.0,1.1.1.1/255.255.0.0,1.1.1.1/240.0.0.0)

CIDR is converted to netmask at saving process, since MySQL allows netmask syntax only.

• [x] Added values in backend (admin account)
• [x] Checked user privilages via mysql workbench. The values are positivly validated.
• [x] Checked if subnet validation is allowed by mysql, by trying to login with a test user with a specific subnet via phpmyadmin.

Test Configuration:

• Distribution: Docker (ddev)
• Webserver: nginx/1.14.2
• PHP: 7.2.16-1+0~20190307202415.17+stretch~1.gbpa7be82
• Tested against 0.10.0-rc1 (DB: 201904250)

Checklist:

• [x] I have performed a self-review of my own code
• [x] I have commented my code, particularly in hard-to-understand areas
• [ ] I have made corresponding changes to the documentation
• [x] My changes generate no new warnings
• [ ] I have added tests that prove my fix is effective or that my feature works
• [ ] New and existing unit tests pass locally with my changes

I've only touched english and german localization, since I do not speak other languages. Therefore, for completions sake, we should ask native speakers to translate the string in $lng['serversettings']['mysql_access_host']['description'] .

Describe the bug Backups is not creating, i can't find any backup archives or files. Only this: /backup/.tmp/mysql all folders is emply

My task

System information

• Froxlor version: 0.10.35.1-1 (DB: 202112310)
• Web server: nginx
• DNS server: Bind
• POP/IMAP server: Courier/Dovecot
• SMTP server: postfix/exim
• FTP server: proftpd
• OS/Version: Ubuntu 20.04

To Reproduce Steps to reproduce the behavior:

1. Create the task with folder /backup
2. Waiting when cron task is execute
3. Check the backup folder /var/customers/webs/USER/backup
4. backup folder is empty , only .tmp and mysql folder

backups is enabled for customers

The Problem The command Domains.update gives no respone and print nothing into the logs. The only error i get is in the PHP-Logfiles and this is the error:

[Tue Jul 19 15:49:29.049919 2022] [php7:error] [pid 346328] [client X.X.X.X:X] PHP Fatal error:  Uncaught Error: [] operator not supported for strings in /var/www/froxlor/lib/Froxlor/Api/Commands/Domains.php:1329\nStack trace:\n#0 /var/www/froxlor/api.php(50): Froxlor\\Api\\Commands\\Domains->update()\n#1 {main}\n  thrown in /var/www/froxlor/lib/Froxlor/Api/Commands/Domains.php on line 1329

It seems like, the error comes from this code part.

System information

• Froxlor version: newest
• Web server: apache2
• PHP 7.4.30

To Reproduce

1. Set up PHP 7.4.30
2. Call command Domains.update

Summary

I just encountered the following scenario when adding a new entry to my MySQL-Access-Hosts under Settings > System settings > MySQL-Access-Hosts:

System information

• PHP version: 7.2.19-0ubuntu0.18.04.2 (FPM-FCGI)
• MySQL version: 5.7.27-0ubuntu0.18.04.1
• Web server: apache2
• FTP server: proftpd
• OS/Version: Ubuntu 18.04

Steps to reproduce

1. Goto Settings > System settings > MySQL-Access-Hosts
2. Add a new entry (seperated by a comma, no whitespace)
3. Click on "Save"
4. Error message pops up (see attached image below)

Expected behavior

1. Settings should apply normally, new privileges should be granted to existing databases

Actual behavior

1. User encounters the following error screen:
2. When refreshing the page, the entry is still in the text box, when clicking on "Save" a second time, the new settings get applied successfully
3. Databases prior to this change are not affected by the new entry in the MySQL-Access-Hosts

Something I observed after looking at the Froxlor system log is that even after clicking "Save" the second time (so the settings get applied without an error screen), the database privileges won't get granted for existing databases. Only new databases created after applying the new MySQL-Access-Hosts entry are affected by this change. Existing databases stay untouched no matter what.

Is there a way to complete installation from cli

I wan't to automatically install/configure my servers with saltstack. Is there a way to create all config files, the upgrade process and installation from cli

php /var/www/froxlor/scripts/installation.php --configFile=/etc/froxlor/config.json

and in the config json are the paramaters needed for installation like mysql root password and so on?

Hello,

when I try to change a setting regarding an existing IP in a private range (10.x.x.x) the webinterface gives me a "wrong IP" error.

As said the IP already was added earlier and I just wanted to change something (SSL path).

Regards,

Af0x

#Summary

I recently changed my Froxlor host's main IPv4 address. Within this change I recognized all mysql-db users created by froxlor got deleted. oO Luckily NOT the databases just the users got deleted. Also: not the froxlor user (but this is also a not froxlor-created one) Luckily I just had 6 of them and could recreate them by my apps setting (took a while to look them up). But if this is a regression maybe this could be harmful to bigger set ups.

I remember, all the db users had granted HOST permission entries for localhost as well as the host's IPv4 I recently deleted.

In my change I guess there are 2 possible causes:

1. Deleting IP-adresses in admin_ipsandports.php?page=ipsandports. After unchecking all Domains' usage of the IP I could delete the IP in that admin panel. If there is a query also deleting database users using that IP maybe you will find the issue there.

2. But I guess the issue is here: admin_settings.php?page=overview&part=system. After deleting the IP I had to change the Systems IP-address to the new one and choose new defaults. But hitting the SAVE button errors me that "MySQL-Access-Hosts" can't be empty. SO possibly before 0.10.x this setting wasn't set? So I set it up to "localhost" and saved successfully. Maybe there is a query deleting all users somehow by making a change here?

After that everything looked good in first view but in second all applications that use Mariadb/mysql had connection problems and I found out all users were deleted. eek.

I will try to reproduce it in a playground setup but you should consider looking at it.

System information

• Froxlor version: 0.10.5 (DB: 201910200)
• Web server: apache2 (Debian Buster)
• POP/IMAP server: Dovecot
• SMTP server: postfix
• FTP server: proftpd
• OS/Version: Debian Buster
• DB Version: MariaDB Ver 15.1 Distrib 10.3.17-MariaDB

Steps to reproduce

1. install froxlor 0.9x set use ipv4
2. create database user
3. upgrade to froxlor 0.10.5
4. set up new ip v4
5. delete old ip
6. go to admin_settings.php?page=overview&part=system and reconfigure new default IP
7. also set (empty) MySQL-Access-Hosts to localhost
8. see mysql users got deleted!? (unconfirmed yet)

Expected behavior

MySQL Users are kept and maybe just the new entry of MySQL-Access-Hosts is granted.

Actual behavior

MySQL Users got deleted from database.

Log files/log entries

sadly nothing but ad some point of time I got a lot of "[Warning] Access denied for user 'dbuser6'@'localhost' (using password: YES)" in my mysql.error log.

Hello,

i wanted to propose to start a discussion about increased account security. U2F is one (of many) possible standards securing website logins with a second factor. Some big companies like Google, Facebook, etc. already support that. So my proposal is, to include that feature into Froxlor to provide to interested users the possibility to secure their account.

There could also be a new admin feature, which allows to force users to use second factor authentication.

Best regards Matthias

Summary

I created a TXT record in Froxlors DNS Editor for DKIM. The 2048bit key is longer than 255 characters. The zone-file that the DNS Editor creates causes a syntax error and thus bind will not serve the zone anymore.

Long TXT records need to be split into multiple lines like this:

a9d04665528b593d263a6e5256648c99._domainkey IN  1800 TXT (
     "k=rsa;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz2/ZfhxSI/A"
     "bqgh0amM8ylrlosirWeKShUhq7fg12aYmRwOqq9hIzO0Fcz1BzfgHVu6HU++rC5"
     "QoUK0JQK/nk4jwkDgvG2di2ZYmAvEbY/VeiK1x/TG0p1Iczr2k6Bj0gEAb/YGD2"
     "YbwrwAi4bDXwoPsYuuNn9TB3jjyWKu/dvOsqhff1/4Wc+FkOi0ClvgrXiklN28X"
     "TLjyjSyU794ntIoegXxrfwcwkhfPMvuqcnhfIC0Z8L71M4WR4SoHyNHVfBtNlUv"
     "VNROiXlMxtxnNQvfViSwz6LC8bYIxeAba3hSXPTChKu3qZtfR0o3jFwEWAfLQdg"
     "Ixler0jMEoAyJmfQIDAQAB")

Source of this example

System information

• Froxlor version: 0.9.38.7-1+wheezy1
• Web server: apache2
• DNS server: Bind
• POP/IMAP server: Courier
• SMTP server: postfix
• FTP server: proftpd
• OS/Version: Debian Wheezy

Steps to reproduce

1. Enable Nameserver for some domain
2. Open the DNS Editor
3. Create a new TXT record with more than 255 characters

Expected behavior

1. A zone file with correct syntax should be created
2. Bind should reload without problem
3. The zone should still be served by bind

Actual behavior

1. A zone file with syntax error is created
2. Bind reloads, detects syntax error
3. Bind stops serving the zone

Log files/log entries

syslog:

Aug 25 11:02:31 host3 named[17684]: dns_rdata_fromtext: /etc/bind/domains/myzone.de.zone:5: syntax error
Aug 25 11:02:31 host3 named[17684]: zone myzone.de/IN: loading from master file /etc/bind/domains/myzone.de.zone failed: syntax error
Aug 25 11:02:31 host3 named[17684]: zone myzone.de/IN: not loaded due to errors.
Aug 25 11:02:31 host3 named[17684]: reloading zones succeeded

Proposed solution

1. Froxlor should split long records as explained above
2. Froxlor could check the generated zone file with named-checkzone to make sure no faulty zone gets loaded

I am using froxlor 0.10.37 to manage my own domains. I created a small simple mailing list by specifying several forwarders for the mailing list address. The forwarded mails are rejected by some providers because SPF check fails. SPF entry is checked against the value of the return-path header. Postfix replaces the return-path header by the original senders address. The only appropriate way to solve this issue seems to rewrite the return-path header by a postfix after-queue filter. Postfix is providing a simple example but maybe someone already has filter to share. I can't be the only facing that issue.

System information

• Froxlor version: $0.10.37/$gitSHA1
• Web server: apache2.4
• POP/IMAP server: Dovecot
• SMTP server: postfix 3.5.13
• OS/Version: Debian 10

Steps to reproduce

1. create an e-mail address like [email protected]
2. forward this address to an external address like [email protected]
3. send an e-mail from another external ([email protected]) address to the created one ([email protected])

Expected behavior

1. return-path header should belong to the domain of the created (e.g. [email protected])

Actual behavior

1. return-path header is rewritten by postfix after header_checks to [email protected]
2. e-mail might be rejected by mail.external2.com due to SPF mismatch between example.com and external2.com

Is your feature request related to a problem? Please describe.

I keep having the problem that certificates are not renewed. I just don't know why.

Describe the solution you'd like

A check of the expiry date of the certificates and if a certificate expires in X days send email to the admin.

Describe alternatives you've considered

The alternative would be that the customer report that his certificate has expired and then be angry.

Describe the solution you would like to see It should be possible for admins & resellers to create offsite backups for customers. It is planned that customer data, web space, databases and email accounts can be backed up to an external server.

Additional context Accordingly, it should be possible to completely backup customers and then back them up to external servers, in case of emergency, a complete restore should be possible.

This feature could also be used to move customers to another froxlor server more easily.

Planned interfaces for transfer are: S3, SFTP, FTPS, Local

Note This will be a post-release feature for 2.x

Description

Add a setting to pass the --reloadcmd to acme.sh

Fixes #822

Type of change

• [x] New feature (non-breaking change which adds functionality)

Description

Begin of Integrating rspamd, mainly as dkim signer, but also to form a simple install routine. The plan is to decouple some of the code generation that seems a bit too tight coupled. (For me DKIM is just a record that should be added to the zone file)

I really use the bind integration, thats why its quiet important to me.

Also added DMARC in the fasion of the global SPF record.

I currently run that fork and branch, on my instance.

WIP

As i already marked that one as WIP, i hope to get some feedback, if i apply to the expected coding style. (Im a java guy, thats why you will probably find many abstract classes on the road down)

Open Questions

• How to correctly mark conflicting config parts?

It's required to manipulate some of the dovecot configs, is there a way i can mark them that they have to be run after the main installation?

Fixes #662 Related To #619 #867 #708

Type of change

Please delete options that are not relevant.

• [ ] Bug fix (non-breaking change which fixes an issue)
• [x] New feature (non-breaking change which adds functionality)
• [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
• [ ] This change requires a documentation update

How Has This Been Tested?

TODO

Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration

• [ ] Test A
• [ ] Test B

Test Configuration:

• Distribution: debian-bullseye
• Webserver: Apache/2.4.51
• PHP: 7.4

Checklist:

TODO

• [ ] I have performed a self-review of my own code
• [ ] I have commented my code, particularly in hard-to-understand areas
• [ ] I have made corresponding changes to the documentation
• [ ] My changes generate no new warnings
• [ ] I have added tests that prove my fix is effective or that my feature works
• [ ] New and existing unit tests pass locally with my changes