Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - Vinayak

Pages: [1] 2 3
1
Information / Re: Roundcube big security issue.
« on: February 08, 2024, 09:04:14 PM »
As I am still trying to fix this, I am wondering whether cwpsrv/nginx is blocking access to these log and other crucial files or not.

Any idea where to check the configuration/directives for cwpsrv/nginx to make sure on this issue?

Or some other mechanism is in use to secure such files and path?

2
Information / Re: Roundcube big security issue.
« on: February 05, 2024, 05:40:24 AM »
As I mentioned in my previous post, on my production servers AlmaLinux is updated to release 8.9 (Midnight Oncilla)
 & CWPpro version to 0.9.8.1174. I update my servers on regular basis.

For AlmaLinux GPG Keys, below is the result of command "rpm -q gpg-pubkey-ced7258b-6525146f"

gpg-pubkey-ced7258b-6525146f

This shows latest GPG Keys are installed & trusted.




3
Information / Re: Roundcube big security issue.
« on: February 04, 2024, 07:24:10 PM »
My production versions where I found this issue initially were

AlmaLinux release 8.8
CWPpro version: 0.9.8.1160

Current versions
Distro Name: AlmaLinux release 8.9 (Midnight Oncilla)
CWPpro version: 0.9.8.1174

I will apply update on one of these server, let's see if the issue is fixed or not.

4
Information / Re: Roundcube big security issue.
« on: February 04, 2024, 05:55:12 PM »
So, I applied the Roundcube 1.5.6 update on my CentOS 7 test server as per Sandeep's instructions, update was seamless and without errors, but the issue of exposed log files is still there.

These URLs are still not secure, they are still exposed to public.
https://cpanel.domain.com/roundcube/logs/errors.log
https://cpanel.domain.com/webmail/logs/errors.log

https://host.domain.com:2031/roundcube/logs/errors.log
https://webmail.domain.com//logs/errors.log

5
Information / Re: Roundcube big security issue.
« on: February 03, 2024, 08:57:15 PM »
I did a CentOS 7 install just to check if the issue is there too.

I understand that issue is with the version of RoundCube, but then other panels have not shown same behaviour.

Solution must come from CWP officially, else patch work may break things in future.

Any idea, how CWP future update will handle the scenario if update is applied today using Sandeep B's solution?

Also, any one tested this solution on AlmaLinux release 8.x and up ?

6
Information / Re: Roundcube big security issue.
« on: February 03, 2024, 05:19:14 PM »
Same issue on fresh install

CentOS Linux release 7.9.2009 (Core)
CWPpro version: 0.9.8.1174

7
Information / Re: Roundcube big security issue.
« on: February 03, 2024, 05:00:31 PM »
This issue still persists with CWPpro version: 0.9.8.1174 and no working solution to fix it.

8
Information / Re: Roundcube big security issue.
« on: July 28, 2023, 11:17:19 PM »
cd /scripts
./mail_roundcube_update
Note that you don't want to do this if you've manually updated to roundcube 1.5.3 per Sandeep's instructions. The "logic" of the roundcube update script does not take into account the currently installed version and will merrily blow away a newer 1.5.x install and install 1.4.11 instead.

Thanks for the heads up, but mine is default setup, webmail is running fine.

As per my earlier post result of
cd /scripts
./mail_roundcube_update
Was
Roundcube is already up-to-date

Current version is
Roundcube Webmail IMAP Client
Version 1.4.11

And these URLs are not secure, all servers are exposed.
https://cpanel.domain.com/roundcube/logs/errors.log
https://cpanel.domain.com/webmail/logs/errors.log

https://host.domain.com:2031/roundcube/logs/errors.log
https://webmail.domain.com//logs/errors.log

Entry in /usr/local/cwpsrv/var/services/roundcube/logs/.htaccess

# deny webserver access to this directory
<ifModule mod_authz_core.c>
    Require all denied
</ifModule>
<ifModule mod_authz_core.c>
    Deny from all
</ifModule>

Owner & group for /usr/local/cwpsrv/var/services/roundcube/logs/ and all files within.
Owner: cwpsvc
Group: cwpsvc

9
Information / Re: Roundcube big security issue.
« on: July 28, 2023, 08:52:22 PM »
Some additional information

This too is not secure
https://host.domain.com:2031/roundcube/logs/errors.log

And is this Owner/Group correct? Because whatever domain is used, same errors.log get downloaded.
Quote
Owner: cwpsvc
Group: cwpsvc
/usr/local/cwpsrv/var/services/roundcube/logs/errors.log

And this is happening in multiple servers, not just one.

10
Information / Re: Roundcube big security issue.
« on: July 28, 2023, 08:34:40 PM »
Just checked a couple domains.
Got either a permission denied by cwpsrv or a 403.

Hop into the CLI via SSH or Terminal

cd /scripts
./mail_roundcube_update
exit


Then in CWP, goto User Accounts -> Fix Permissions

Select the user (domain)
Check -> Fix Permissions
Check -> Internal Server Error

Followed above suggestion to the letter, but no use.

Some additional info.

Quote
cd /scripts
./mail_roundcube_update
Last metadata expiration check: 0:13:24 ago on Sat Jul 29 01:45:42 2023.
Dependencies resolved.
Nothing to do.
Complete!


###############################
Roundcube is already up-to-date
###############################

AlmaLinux release 8.8
CWPpro version: 0.9.8.1160

11
Information / Roundcube big security issue.
« on: July 28, 2023, 08:04:51 AM »
How do we secure these logs

https://cpanel.domain.com/roundcube/logs/errors.log
https://cpanel.domain.com/webmail/logs/errors.log

And all other files withing the logs folder.

Any one visiting above URLs (replace domain.com with your actual domain) can download these log files and use them for exploitation.

I can see there is one .htaccess file, but it's not being honoured by the cwp webserver, in my case Apache.

12
DKIM / Re: How to implement 2048 bit DKIM keys on CWP servers.
« on: March 20, 2023, 04:03:30 AM »
When setting up an account/domain, what part/script of CWP handles generation and setting up of DKIM?

I would like CWP to automatically generate/implement 2048 bit DKIM keys by default.

Also is there a way to replace all existing 1024 bit records with 2048 bit DKIM keys?

13
DKIM / Re: How to implement 2048 bit DKIM keys on CWP servers.
« on: March 19, 2023, 05:52:13 AM »
My question is not about installing and configuring DKIM, my question is about how to implement 2048 bit DKIM keys by default on Control Web Panel servers.

14
DKIM / How to implement 2048 bit DKIM keys on CWP servers.
« on: March 09, 2023, 04:59:12 PM »
Any documentation or know how for implementing 2048 bit DKIM keys by default on Control Web Panel servers?

National Institute of Standards and Technology (NIST) recommends 2048 bit keys for DomainKeys Identified Mail (DKIM), so does a client of mine on a CWP VPS dedicated to this client only.

So is there a way to make 2048 bit DKIM keys installed by default on all accounts?

15
So, I submitted a ticket for this issue, I was told this could be due to forwarders, forwarders/alias may be having some restricted special character or something due to which, this is happening.

In my case it was a cPanel to CWP migration.

I took a backup of forwarders, alias table in postfix database (use phpMyAdmin or from command line).

Deleted all forwarders from admin panel as suggested by support and list email accounts in user panel started working.

Added forwarders back, manually this time, all is working fine.

Hopefully this may help someone facing similar issue.

Pages: [1] 2 3