Broke the server while securing the admin panel

Discussion in 'Installation/Configuration' started by schwim, Jan 3, 2021.

  1. schwim

    schwim Member

    Hi there!

    I had just finished the perfect Debian 10 setup, which worked perfectly but while following this tutorial, I broke the http access to the server and for the life of me, I can't figure out what I did wrong. The only warning I got was the at the very last step, where apache2 refused to restart. Up until that point, all responses to commands were as expected. I've got this to go by and would be very appreciative if someone could lead me toward a resolution:

     
  2. schwim

    schwim Member

    I've gone back over every step to ensure I didn't clip any commands and I've found something odd, I've used both mobaxterm and the terminal to edit in incron file as per this instruction in the how-to

    So I paste the following into -e:
    Code:
    /etc/letsencrypt/archive/$(hostname -f)/ IN_MODIFY ./etc/init.d/le_ispc_pem.sh
    
    But when I run -e again to look at it, it shows this:
    Code:
    /etc/letsencrypt/archive/$(hostname     IN_ALL_EVENTS   IN_MODIFY ./etc/init.d/le_ispc_pem.sh
    
    I have no idea if this is the issue but I can't get it to honor what I'm entering into the file. Every time I open it back up, it's the modified entry above. I tried replacing '$(hostname -f)' with the actual server.server.com but it still doesn't work. I even tried replacing '$(hostname -f)' with the server.server.com value but I still can't start/restart apache2.

    Can someone tell me where I'm going wrong and what I need to do to bring the service back up?
     
  3. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    You have to replace $(hostname -f) with the hostname used for your server. I guess this used to work but I had the same issue when following that tutorial a few months ago.

    @till, it should be changed in the guide.
     
  4. schwim

    schwim Member

    Hi there th0m and thanks for the help!

    As indicated above I did try that in the incron file but the apache server still fails to start, I am guessing because of the previous breaking of the instructions. What do I need to do to get apache working again?
     
  5. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    Rerun this but replace $(hostname -f) with your hostname. Then start apache
    Code:
    ln -s /etc/letsencrypt/live/$(hostname -f)/fullchain.pem ispserver.crt
    ln -s /etc/letsencrypt/live/$(hostname -f)/privkey.pem ispserver.key
    Code:
    systemctl start apache2
     
  6. schwim

    schwim Member

    I ran the two commands, replacing with my actual hostname -f, starting apache2 still fails:

     
  7. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    What is the output of
    Code:
    ls -la /usr/local/ispconfig/interface/ssl
    ?
     
  8. schwim

    schwim Member

     
  9. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    And the output of
    Code:
    ls -la /etc/letsencrypt/live/adolf.schwimserver3.com
    ?
     
  10. schwim

    schwim Member

    No such file or directory. How would I rebiuld that?
     
  11. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    Did you create the site adolf.schwimserver3.com and enable Let's Encrypt?
     
  12. schwim

    schwim Member

    Yes I did, both schwimserver3.com and adolf.schwimserver3.com resolved properly under https before I followed the tutorial to secure the admin panel.
     
  13. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    Are they both the same site, where one is a alias domain?
    What is the content of /etc/letsencrypt/live ?
     
  14. schwim

    schwim Member

    I did not create an alias, they were two separate sites created via the admin panel. Both resolved without showing any https errors.

    /etc/letsencrypt/live is an empty file.
     
  15. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    Ah, I see. You are using acme.sh instead of certbot, so the certificates are in a different location. The certs will be in /root/.acme.sh/ instead of /etc/letsencrypt/live. So replace that in your commands and it will work.

    I prefer the manual method myself aswell, but it is possible to let the installer create a cert for the panel and other services. You can still do this by running
    Code:
    ispconfig_update.sh --force
    and selecting yes for creating a new cert.
     
  16. schwim

    schwim Member

    Ok, so before I do any more damage, you're saying to create a new cert, then rerun the entire how-to, replacing hostname -f with the actual fqdn ,replacing /etc/letsencrypt/live with /root/.acme.sh?
     
  17. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    You can do 2 things:
    - Run the update script and let it create a cert for you
    OR
    - Go through the howto again, replace /etc/letsencrypt/live with /root/.acme.sh and $(hostname -f) with adolf.schwimserver3.com, and when done, start apache
     
  18. schwim

    schwim Member

    Ok, I ran the update script, chose to backup then reconfigure services, then recreate the ssl cert. Apache is working and schwimserver3.com, adolf.schwimserver.com and adolf.schwimserver3.com:8080 are all resolving securely without issue or errors.

    With the problems I had, will this create issues down the road when the cert update script is supposed to run or am I good to go now do you think?
     
  19. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    No, but it would be good to remove the incron rule you created.
     
  20. schwim

    schwim Member

    ok, I removed
    from incron, leaving it empty. Will I need to manually update 8080's certs when they expire now?
     

Share This Page