{"id":89,"date":"2013-05-28T19:18:56","date_gmt":"2013-05-28T18:18:56","guid":{"rendered":"http:\/\/blog.beufa.net\/?p=89"},"modified":"2013-05-28T19:18:56","modified_gmt":"2013-05-28T18:18:56","slug":"apache-et-roundcube-securisation-et-obfuscation-de-version","status":"publish","type":"post","link":"https:\/\/beufa.net\/fr\/blog\/apache-et-roundcube-securisation-et-obfuscation-de-version\/","title":{"rendered":"Apache et Roundcube, s\u00e9curisation et obfuscation de version"},"content":{"rendered":"<p>Apr\u00e8s installation d&#8217;un serveur de mail pour remplacer Google Apps sur mon domaine perso, j&#8217;ai trouv\u00e9 que Roundcube \u00e9tait le seul webmail qui me plaisait \u00e0 peu pr\u00e8s.<\/p>\n<p>Quelques tips et tricks sur la s\u00e9curisation de Apache \/ PHP et Roundcube, pas sur les serveurs Postfix \/ Dovecot, qui je l&#8217;esp\u00e8re, viendront ici alimenter le blog avec du fail2ban &#8230;<\/p>\n<ul>\n<li>Configuration du vHost et s\u00e9curisation dossiers &#8220;sensibles&#8221;<\/li>\n<\/ul>\n<pre class=\"brush:shell\">&lt;VirtualHost *:443&gt;\n        ServerAdmin postmaster@beufa.net\n        ServerName  x.beufa.net\n        DocumentRoot \/var\/www\/x\n        SSLEngine on\n        SSLCipherSuite ALL:!ADH:RC4+SHA:+HIGH:+MEDIUM:+LOW:+EXP:+eNULL\n        SSLProtocol all -SSLv2\n        SSLStrictSNIVHostCheck on\n        SSLOptions StrictRequire\n        SSLCertificateFile     cert.pem\n        SSLCertificateKeyFile  cert.pem\n        #GnuTLSEnable on \n        #GnuTLSPriorities SECURE:!ANON-DH:!MD5\n        #GnuTLSCertificateFile cert.pem\n        #GnuTLSKeyFile cert.pem\n        #GnuTLSCertificateChainFile cert.pem\n        #GnuTLSCACertificatePath \/\n\n        &lt;Directory \/var\/www\/roundcube&gt;\n                Options FollowSymLinks MultiViews\n                AllowOverride All\n                Order allow,deny\n                allow from all\n        &lt;\/Directory&gt;\n\n        &lt;Directory \/var\/www\/roundcube\/config&gt;\n                Options -FollowSymLinks\n                AllowOverride None\n        &lt;\/Directory&gt;\n\n        &lt;Directory \/var\/www\/roundcube\/temp&gt;\n                Options -FollowSymLinks\n                AllowOverride None\n        &lt;\/Directory&gt;\n\n        &lt;Directory \/var\/www\/roundcube\/logs&gt;\n                Options -FollowSymLinks\n                AllowOverride None\n                Order allow,deny\n                Deny from all\n        &lt;\/Directory&gt;\n\n        &lt;Directory \/var\/www\/roundcube\/plugins\/enigma\/home&gt;\n                Options -FollowSymLinks\n                AllowOverride None\n                Order allow,deny\n                Deny from all\n        &lt;\/Directory&gt;\n\n        # Possible values include: debug, info, notice, warn, error, crit,\n        # alert, emerg.\n        LogLevel warn\n\n        ErrorLog ${APACHE_LOG_DIR}\/05.x.beufa.net_error.log\n        CustomLog ${APACHE_LOG_DIR}\/05.x.beufa.net_access.log combined\n\n&lt;\/VirtualHost&gt;<\/pre>\n<ul>\n<li>Supprimer les headers de mail PHP verbeux dans <em>\/etc\/php5\/apache2\/php.ini<\/em><\/li>\n<\/ul>\n<pre class=\"brush:shell\">; Decides whether PHP may expose the fact that it is installed on the server\n; (e.g. by adding its signature to the Web server header).  It is no security\n; threat in any way, but it makes it possible to determine whether you use PHP\n; on your server or not.\n; http:\/\/php.net\/expose-php\nexpose_php = Off\n; Add X-PHP-Originating-Script: that will include uid of the script followed by the filename\n; Example for Roundcube : X-PHP-Originating-Script: 33:main.inc in each mail sent \nmail.add_x_header = Off<\/pre>\n<ul>\n<li>Avoir des logs Apache \/ PHP dans un fichier sp\u00e9cifique<\/li>\n<\/ul>\n<pre class=\"brush:shell\">; The path to a log file that will log all mail() calls. Log entries include\n; the full path of the script, line number, To address and headers.\n;mail.log = \/var\/log\/mail.apache-php.log<\/pre>\n<p>Bient\u00f4t d&#8217;autres tips sur le couple Postfix \/ Dovecot \/ Roundcube !<\/p>","protected":false},"excerpt":{"rendered":"<p>Apr\u00e8s installation d&#8217;un serveur de mail pour remplacer Google Apps sur mon domaine perso, j&#8217;ai trouv\u00e9 que Roundcube \u00e9tait le seul webmail qui me plaisait&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/beufa.net\/fr\/blog\/apache-et-roundcube-securisation-et-obfuscation-de-version\/\">Continue reading<span class=\"screen-reader-text\">Apache et Roundcube, s\u00e9curisation et obfuscation de version<\/span><\/a><\/div>","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,25,27],"tags":[33,34,49,67,74,87,88],"class_list":["post-89","post","type-post","status-publish","format-standard","hentry","category-linux","category-securite-2","category-webapps","tag-apache","tag-apps","tag-google","tag-php","tag-roundcube","tag-webapplis","tag-webmail","entry"],"_links":{"self":[{"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/posts\/89","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/comments?post=89"}],"version-history":[{"count":0,"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/posts\/89\/revisions"}],"wp:attachment":[{"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/media?parent=89"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/categories?post=89"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/beufa.net\/fr\/wp-json\/wp\/v2\/tags?post=89"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}