Storing/Onderhoud

Op maandag 1 februari 2016 zullen wij de volgende upgrades door gaan voeren op onze webservers:

• Upgrade MySQL van 5.6.17 naar 5.7.10
• Upgrade PHP  5.4.27 naar PHP 5.6.17
• Upgrade Apache/2 2.27 naar 4.18

Dit onderhoud is nodig in verband met enkele kwetsbaarheden in de software en end-of-life status van de versies die wij draaien.

Gelieve uw eigen software / scripts te controleren op compatibiliteit met deze nieuwe versies.

Zojuist hebben wij een upgrade geïnstalleerd van het DirectAdmin control panel. Versie 1.48.0 is hierbij vervangen door versie 1.48.3. Hiermee zijn enkele problemen verholpen (bugfix) en nieuwe mogelijkheden geïntroduceerd (features).

Een uitgebreide opsomming van de wijzigingen vindt u hier:

06/27/15 Version 1.483

• Broken cacert file [bugfix]
• incorrect day for strftime on FreeBSD [bugfix]

06/25/15 Version 1.482

• Restore not finding all ca root certs [bugfix]
• php-mail.log parsed incorrectly for evaled code [bugfix]
• Login: Session cookie may expire early if either client or server have wrong time [bugfix]
• Segfault on two-step auth [bugfix]

06/22/15 Version 1.481

• Add all remaining mysql user privileges options (SKINS)(LANG) [feature]
• Read optimization for ConfigFile class when only single item needed [feature]
• Prevent Reseller from unsuspending User if Admin suspended it (LANG) [feature]
• @reboot for User cronjobs (SKINS) [feature]
• CustomBuild 2.0 slim-down [feature]
• cron_set_pre.sh [feature]
• Two-Step Authentication (SKINS)(LANG) [feature]
• CMD_API_COMMENTS [feature]
• Reset Zone now passes USERNAME and PACKAGE tokens [bugfix]
• Update to addip regarding preferred_lft for IPv6 [bugfix]
• prevent da-popb4smtp from running twice [bugfix]
• WordPress Brute Force Monitor to check redirect status [bugfix]
• /home/user/imap restore not set to group mail [bugfix]
• Better input filtering (SECURITY) [bugfix]
• old_public_html_link=0 causes broken .htaccess [bugfix]
• Set session expiry [bugfix]

Zojuist hebben wij een upgrade geinstalleerd van het DirectAdmin control panel. Versie 1.45.2 is hierbij vervangen door versie 1.46.3. Hiermee zijn enkele problemen verholpen (bugfix) en nieuwe mogelijkheden geïntroduceerd (features).

Een uitgebreide opsomming van de wijzigingen vindt u hier:

10/24/14 Version 1.463
Show bad zone if named-checkzone fails [feature]
Ability to change the 1000 email limit send notification [feature]
Domain selector on certain pages (SKINS) [feature]
Custom httpd config to show raw templates (SKINS) [feature]
Template Diff for custom templates CMD_TEMPLATE_DIFF (SKINS)(LANG) [feature]
Ability to merge old inbox imap folders to new folders [feature]
CMD_API_EMAIL_USAGE to show all sends [feature]
typo in the custom fpm/httpd pages [bugfix]
Add DKIM when zone is reset [bugfix]
Rounducbe Backup/Restore: pipe both stderr stdout to DA [bugfix]
Restore Security Question options [bugfix]
ip_blacklist check done before ssl handshake [bugfix]
Backup error with blank line [bugfix]
Php-fpm reload on CentOS 7 [bugfix]
SSLv3 Poodle (SECURITY) [bugfix]

09/26/14 Version 1.462
backup_roundcube.php has write error for php 5.3 [feature]
incorrect exec return values [bugfix]

09/24/14 Version 1.461
reseller_destroy_pre.sh [feature]
More Apache/Nginx custom template tokens (SKINS) [feature]
Only show the last X bytes of the brute_log_entries.list (SKINS) [feature]
domains and domainowners to be set to 640 in the set_permissions.sh [bugfix]
MySQL optimize/check/repair options did nothing [bugfix]
Error restoring reseller’s package packagenme: nsubdomains=unlimited is not a number [bugfix]
Hide SSL/CGI/PHP checkboxes for domain, if User is not allowed to use them (SKINS) [bugfix]

09/14/14 Version 1.46
add roundcube db data to backup/restore [feature]
BFM ignore attempts on suspended accounts [feature]
pigz for parallel process backup [feature]
custom config for nginx_proxy editing (SKINS) [feature]
phpMyAdmin added to Brute Force Monitor (MANUAL CHANGE) [feature]
Allow javascript auto-logout to be cleared (SKINS) [feature]
XFS quotas [feature]
Translation files for email level password change, ftp, and vacation messages (LANG) [feature]
Ability to include special characters in random password generation (SKINS) [feature]
SSL_TEMPLATE token for all apache/nginx templates [feature]
Per-User php-fpmXX.conf customization (SKINS) [feature]
Removed HAVE_PHP1_FPM_OLD from templates (TEMPLATES) [feature]
Ability to edit dns zone through Login-As even if User doesn’t have access (SKINS) [feature]
Also notify Resellers of their User’s email overuage [feature]
Include php script name is highest send count and ability to automatically chmod to 0 (TEMPLATES) [feature]
Better backup tracking for User data [feature]
DNSSEC: DS records for subdomain delegation & User Level DNSSEC (SKINS) (TEMPLATES) [feature]
nginx proxy to disable proxy_buffering by default (TEMPLATES) [feature]
PHP-fpm: safemode: only main domain control open_basedir [feature]
Add the SpamAssassin Whitelist to the domain filter to also whitelist SPAM Fitlter (TEMPLATES) [feature]
CB2.0: Move htaccess/user.ini block to webapps.conf (TEMPLATES) [feature]
Give warning if package inode set between 1-200 [feature]
Update session time on plugin calls [bugfix]
Nginx to have included nginx_php.conf to fix proected directories (TEMPLATES) [bugfix]
Php selector for CB2 mod_php/CLI and suphp (TEMPLATES) [bugfix]
Restores to/from different IPv4/IPv6 types cause duplicate dns records (IMPORTANT RESTORE CHANGES) [bugfix]
Reduce permissions on system files (SECURITY) [bugfix]
Duplicate AuthType Basic in .htaccess [bugfix]
Ensure fpm/fastcgi/suphp are disabled with domain php setting [bugfix]
SHA-256 requests were generating self-signed certificates & removed 1024 bit keys (SKINS) [bugfix]
If custom private_html link, keep custom value on restore [bugfix]
DNSKEY keys may have different format for CentOS 5 [bugfix]
Nginx password protected directories and redirects (TEMPLATES) [bugfix]
Duplicate use of internal text in one string caused segfault [bugfix]
Workaround for Chrome autofill (SKINS) [bugfix]
Reseller to be limited when editing own data without overselling [bugfix]
Reseller restore without overselling and without unlimited domains hits domain limit [bugfix]
Typo in reseller_run_as [bugfix]

07/01/14 Version 1.454
dataskq pipe issue prevent restores [bugfix]

06/30/14 Version 1.453
Admin will override subdomain_owner_check [feature]
Ability to force no sorting in a table [feature]
Alias CMD_API_SUBDOMAIN for CMD_API_SUBDOMAINS [feature]
New log file: login.log [feature]
Support up to 4096 bit key for SSL certificates (SKINS) [feature]
Plugins to have the ability to run as a specified User [feature]
SHA-256 for certificates (SKINS) [feature]
Better pipes for plugins [feature]
Message System, Manage Tickets, Plugin Updates, Licenses/Udpates to show count box (SKINS) [feature]
Changed default numservers=10 for new installs [feature]
Plugins to be allowed to set a timeout [feature]
Random passwords now have a random length [feature]
exim.pl 17 and updated exim.conf (Manual changes) [feature]
If force_hostname is used, set that domain in message/ticket notifications [feature]
all_backups_post.sh to know if there were errors [feature]
Added roundcube and squirrelmail to the BFM [feature]
catch proftpd requests for task.queue when pure-ftpd is being [bugfix]
Hidden button “Update disk usage” was broken (SKINS) [bugfix]
DA thinks it finds Roundcube 0.1 for 1.0.1 and chmods to 0 [bugfix]
DDNSSEC showing expiry for some formats [bugfix]
Change default connect_timeout to 20 and drop expired pre-connections [bugfix]
Add “dns” to backup_options.list [bugfix]
Only restore domains in the backup [bugfix]
output from domain_destory_post.sh and user_destroy_post.sh to be displayed [bugfix]

In verband met de “Heartbleed” kwetsbaarheid welke recent in het nieuws is gekomen zullen wij in de nacht van 15 op 16 april spoedonderhoud gaan uitvoeren op onze webservers.

Naast het dichten van de kwetsbaarheden in OpenSSL zullen tevens de laatste OS patches geïnstalleerd worden en software geüpdatet worden

• Webserver: Apache 2.2.27 (was 2.2.23)
• Webserver: PHP 5.4.27 (was 5.3.27)
• Database: MySQL 5.6.17 (was 5.5.30)
• FTP: ProFDPD 1.3.4d (was 1.3.4b)
• Mailserver: Exim 4.8.2 (was 4.80.1)
• Mailserver: Dovecot 2.2.12 (was 2.1.1)

Meer informatie: http://www.trosradar.nl/uitzending/artikelen/detail/article/hoe-werkt-misbruik-via-heartbleed/