.gitignore

 .DS_Store
+/nbproject/private/
\ No newline at end of file

LICENSE

-Copyright (c) 2007-2016, Till Brehm, ISPConfig UG
+Copyright (c) 2007-2017, Till Brehm, ISPConfig UG
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without modification,

docs/hardening/README.md

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+
+This folder contains examples for further ISPC hardening (done by NwSEC)
+
+
+Currently, these are:
+
+
+
+anti-bruteforce         WordPress Login Anti-Bruteforce via fail2ban
+
+postfix-ldap            Query for valid recipients via LDAP in a transparent
+                        setup routing mails e.g. to the internal server
+                        
+                        
+                        
+All these examples have been productively tested and implemented on various
+Debian/GNU Linux based systems.
+
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
\ No newline at end of file

docs/hardening/anti-bruteforce/README.md

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+
+
+This is an example to block WordPress Login Bruteforce Attacks. Further
+description can also be found @ https://blog.nwsec.de/wordpress/?p=1112
+
+
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
\ No newline at end of file

docs/hardening/anti-bruteforce/jail.local

+#
+# This goes into (or at the end of) /etc/fail2ban/jail.local
+#
+[wp-auth]
+ enabled = true
+ filter = wp-auth
+ action = iptables-multiport[name=wp-auth, port="http,https"]
+ logpath = /var/log/ispconfig/httpd/*/*.log
+ bantime = 1200
+ maxretry = 5

docs/hardening/anti-bruteforce/wp-auth.conf

+#
+# This goes into /etc/fail2ban/filter.d/wp-auth.conf
+#
+[Definition]
+ failregex = ^<HOST> .* "POST /wp-login.php
\ No newline at end of file

docs/hardening/postfix-ldap/README.md

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+
+If mails get transparently forwarded to another mailserver, a mechanism to block
+mail for invalid recipients makes sense, and drastically increaes the well-known
+backscatter problem.
+
+LDAP queries are used to check for valid recipients, and forwards the mail, if
+an entry for the user is found.
+
+For this to work, on Debian/GNU Linux, you also have to install postfix-ldap by
+
+apt install postfix-ldap
+
+
+Further information can be found @ https://blog.nwsec.de/wordpress/?p=1031
+
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
\ No newline at end of file

docs/hardening/postfix-ldap/add_to_main.cf

+#
+# This goes into /etc/postfix/main.cf in the section relay_recipient_maps
+#
+relay_recipient_maps = hash:/etc/postfix/relay_recipients, ldap:/etc/postfix/ldap-aliases.cf
\ No newline at end of file

docs/hardening/postfix-ldap/ldap-aliases.cf

+server_host = x.x.x.x
+search_base = ou=xxx, dc=xxx, dc=xx
+version = 3
+timeout = 10
+leaf_result_attribute = mail
+bind_dn = user@domain
+bind_pw = userpassword
+query_filter = (mail=%s) 
+result_attribute = mail, addressToForward
\ No newline at end of file

install/dist/conf/centos52.conf.php

@@ -118,6 +118,10 @@ $conf['mailman']['installed'] = false; // will be detected automatically during
 $conf['mailman']['config_dir'] = '/etc/mailman';
 $conf['mailman']['init_script'] = 'mailman';
 
+//* mlmmj
+$conf['mlmmj']['installed'] = false; // will be detected automatically during installation
+$conf['mlmmj']['config_dir'] = '/etc/mlmmj';
+
 //* Getmail
 $conf['getmail']['installed'] = false; // will be detected automatically during installation
 $conf['getmail']['config_dir'] = '/etc/getmail';

install/dist/conf/centos53.conf.php

@@ -118,6 +118,10 @@ $conf['mailman']['installed'] = false; // will be detected automatically during
 $conf['mailman']['config_dir'] = '/etc/mailman';
 $conf['mailman']['init_script'] = 'mailman';
 
+//* mlmmj
+$conf['mlmmj']['installed'] = false; // will be detected automatically during installation
+$conf['mlmmj']['config_dir'] = '/etc/mlmmj';
+
 //* Getmail
 $conf['getmail']['installed'] = false; // will be detected automatically during installation
 $conf['getmail']['config_dir'] = '/etc/getmail';

install/dist/conf/centos70.conf.php

@@ -118,6 +118,10 @@ $conf['mailman']['installed'] = false; // will be detected automatically during
 $conf['mailman']['config_dir'] = '/etc/mailman';
 $conf['mailman']['init_script'] = 'mailman';
 
+//* mlmmj
+$conf['mlmmj']['installed'] = false; // will be detected automatically during installation
+$conf['mlmmj']['config_dir'] = '/etc/mlmmj';
+
 //* Getmail
 $conf['getmail']['installed'] = false; // will be detected automatically during installation
 $conf['getmail']['config_dir'] = '/etc/getmail';

install/dist/conf/centos72.conf.php

@@ -118,6 +118,10 @@ $conf['mailman']['installed'] = false; // will be detected automatically during
 $conf['mailman']['config_dir'] = '/etc/mailman';
 $conf['mailman']['init_script'] = 'mailman';
 
+//* mlmmj
+$conf['mlmmj']['installed'] = false; // will be detected automatically during installation
+$conf['mlmmj']['config_dir'] = '/etc/mlmmj';
+
 //* Getmail
 $conf['getmail']['installed'] = false; // will be detected automatically during installation
 $conf['getmail']['config_dir'] = '/etc/getmail';

install/dist/conf/debian40.conf.php

@@ -120,6 +120,10 @@ $conf['mailman']['installed'] = false; // will be detected automatically during
 $conf['mailman']['config_dir'] = '/etc/mailman';
 $conf['mailman']['init_script'] = 'mailman';
 
+//* mlmmj
+$conf['mlmmj']['installed'] = false; // will be detected automatically during installation
+$conf['mlmmj']['config_dir'] = '/etc/mlmmj';
+
 //* Getmail
 $conf['getmail']['installed'] = false; // will be detected automatically during installation
 $conf['getmail']['config_dir'] = '/etc/getmail';

install/dist/conf/debian60.conf.php

@@ -120,6 +120,10 @@ $conf['mailman']['installed'] = false; // will be detected automatically during
 $conf['mailman']['config_dir'] = '/etc/mailman';
 $conf['mailman']['init_script'] = 'mailman';
 
+//* mlmmj
+$conf['mlmmj']['installed'] = false; // will be detected automatically during installation
+$conf['mlmmj']['config_dir'] = '/etc/mlmmj';
+
 //* Getmail
 $conf['getmail']['installed'] = false; // will be detected automatically during installation
 $conf['getmail']['config_dir'] = '/etc/getmail';

install/dist/conf/debian90.conf.php

 <?php
 
 /*
-Copyright (c) 2016, Till Brehm, ISPConfig UG
+Copyright (c) 2017, Till Brehm, projektfarm Gmbh
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without modification,
@@ -101,7 +101,7 @@ $conf['web']['apps_vhost_group'] = 'ispapps';
 //* Fastcgi
 $conf['fastcgi']['fastcgi_phpini_path'] = '/etc/php/7.0/cgi/';
 $conf['fastcgi']['fastcgi_starter_path'] = '/var/www/php-fcgi-scripts/[system_user]/';
-$conf['fastcgi']['fastcgi_bin'] = '/usr/bin/php-cgi';
+$conf['fastcgi']['fastcgi_bin'] = '/usr/bin/php-cgi7.0';
 
 //* Postfix
 $conf['postfix']['installed'] = false; // will be detected automatically during installation
@@ -170,7 +170,7 @@ $conf['mydns']['init_script'] = 'mydns';
 //* PowerDNS
 $conf['powerdns']['installed'] = false; // will be detected automatically during installation
 $conf['powerdns']['database'] = 'powerdns';
-$conf["powerdns"]["config_dir"] = '/etc/powerdns/pdns.d';
+$conf['powerdns']['config_dir'] = '/etc/powerdns/pdns.d';
 $conf['powerdns']['init_script'] = 'pdns';
 
 //* BIND DNS Server
@@ -230,5 +230,4 @@ $conf['cron']['wget'] = '/usr/bin/wget';
 $conf['xmpp']['installed'] = false;
 $conf['xmpp']['init_script'] = 'metronome';
 
-
 ?>

install/dist/conf/debiantesting.conf.php

@@ -120,6 +120,10 @@ $conf['mailman']['installed'] = false; // will be detected automatically during
 $conf['mailman']['config_dir'] = '/etc/mailman';
 $conf['mailman']['init_script'] = 'mailman';
 
+//* mlmmj
+$conf['mlmmj']['installed'] = false; // will be detected automatically during installation
+$conf['mlmmj']['config_dir'] = '/etc/mlmmj';
+
 //* Getmail
 $conf['getmail']['installed'] = false; // will be detected automatically during installation
 $conf['getmail']['config_dir'] = '/etc/getmail';