interworx-primer


Interworx – Lets Scratch the Inner Surface
By: Jackie Craig Sparks :: 9/22/2011 :: [email protected] ::  336.790.2126

	I'm wanting to write about Interworx control panel. It's a rather slick looking control panel, it is comparable to Cpanel. On the outside, but on the inside it is totally different than cpanel. Cpanel is based off of Perl while interworx appears to be mostly proboard and shell scripts etc. And Interworx thinks that ioncode encoding their system is a good thing(BOOO) . While Cpanel doesn't. So I give a lot of props to Cpanel.
Services
	Interworx uses daemon tools to handle the stability and control of keeping services running for the most part, it still uses traditional /etc/init.d/ scripts for a lot of services, bringing them up and down. Interworx takes advantage of the DJ Bernstein suite of services, Qmail, Tinydns, daemontools.

/service/ - holds all the links to the daemons used, smtp, imap, dnscache, pop3,
{/service/run, /service/log/run} – holds are the run scripts that svcan processes to init the daemons

/var/ - holds multiple daemons and some of the symbolic links from service point here – proftp, qmail, tinydns, vpopmail
/var/qmail/ - Mail services Interworx uses qmail for its MTA which is actually really cool.
/var/djbdns - DNS services. These services are tinydns, the actual DNS server then there is dnscache. DJ Bernstein implemented these services separately because he saw a problem with BIND.  They would exploit the cache and gain access to the DNS server and vice versa. So he created them as separate entities.
/var/proftpd – holds the ftpserver files
/var/vpopmail – the system that enables Qmail to handle virtual domains that is controlled by a mysql database.
/var/vpopmail/bin/ - This folder is the location of the executables that you are able to control adding domains , users, etc. But interworx uses a database map and if you add users / domains from the command line you will not be able to administer them from the web control panel.
/etc/apf/ - Where all the firewall scripts and rules are stored.
/chroot/ - This is a jailshell for users and applications.

Firewall
APF is a really nice firewall plugin with interworx. It is one of the few core items that can be modified somewhat. If you want to modify the way the firewall starts or what it does you can so in the bash script located @ /etc/apf/apf
Adding fwsnort and fail2ban capabilities
	fwsnort is a program made and provided for free by CipherDyne @ http://cipherdyne.org/fwsnort/ . This application is great it takes advantage of the SNORT intrusion detection system rule set. It will download the latest snort rule set and convert them into firewall rules. On my friends server we have incorporated this program into his setup. This is how.
 root@bigbird:~#wget http://cipherdyne.org/fwsnort/download/fwsnort-1.6.tar.bz2
root@bigbird:~#tar jxf fwsnort-1.6.tar.bz2
root@bigbird:~#cd fwsnort-1.6
root@bigbird:/root/fwsnort-1.6/#./install.pl (follow the on screen instructions)
root@bigbird:/root/fwsnort-1.6/#fwsnort --update
root@bigbird:/root/fwsnort-1.6/#crontab -e

Add the following lines to your crontab
* 1 * * * /usr/sbin/fwsnort --update
5 1 * * *  /usr/sbin/fwsnort
10 1 * * * * /usr/sbin/fwsnort --Flush --no-ipt-INPUT --no-ipt-OUTPUT –no-ipt-FORWARD
15 1 * * * * /etc/fwsnort/fwsnort.sh


	fail2ban is a great program for detecting and blocking brute force attacks. We can install it by adding the yum repository for a easy auto-magic install.

root@bigbird:~#wget HTTP://download.fedoraproject.org/pub/epel/5/i386/epel-release-5-3.noarch.rpm
root@bigbird:~#rpm -i ./epel-release-5-3.noarch.rpm
root@bigbird:~#yum install fail2ban
root@bigbird:~#chkconfig –add  fail2ban
root@bigbird:~#chkconfig –level 3 fail2ban

Add the following to the /etc/apf/apf shell script
#These will go right under the copy right message at the top
IPT="/sbin/iptables"

fail2ban_conf="/etc/fail2ban/jail.conf"
fail2banparse=`cat ${fail2ban_conf} | grep  '\[name=[a-zA-Z0-9\]\{1,10\}'| sed -e 's/=/ /g' -e 's/\[/ /g' -e 's/\,//g' | grep -v 'sendmail' | awk '{ print $4 }'|uniq`


#The following line will go right around line:176 – that should be right at the end of  the apf firewall #script this makes sure interworx apf reloads the script when the firewall is reloaded.
/etc/fwsnort/fwsnort.sh
for i in $fail2banparse; do
        $IPT -N fail2ban-${i}
        $IPT -A fail2ban-${i} -j RETURN
        $IPT -I INPUT -j fail2ban-${i}
done

Logging
/service/{daemon}/log/ - holds log files for the specific daemons. On a fresh installation of interworx these are not rotated.
/var/log/ - holds all the basic daemon and system logs. Log rotation is setup for most all these files except /var/log/maillog
Log rotation can be setup using in the /etc/logrotate.d directory
Log rotate scripts

====/etc/logrotate.d/daemontools====
/service/smtp-ssl/log/main/\@40000000* /service/tinydns-208.86.251.63/log/main/current {
	weekly
	rotate 52
	compress
	missingok
	notifempty
	sharedscripts
}

/service/tinydns-208.86.251.63/log/main/\@40000000* /service/tinydns-208.86.251.63/log/main/current {
	weekly
	rotate 52
	compress
	missingok
	notifempty
	sharedscripts
}

/service/tinydns-208.86.251.64/log/main/\@40000000* /service/tinydns-208.86.251.64/log/main/current {
	weekly
	rotate 52
	compress
	missingok
	notifempty
	sharedscripts
}

/service/imap4/log/main/\@40000000* /service/imap4/log/main/current {
	weekly
 	rotate 52
	compress
	missingok
	notifempty
	sharedscripts
}

/service/imap4-ssl/log/main/\@40000000* /service/imap4-ssl/log/main/current {
	weekly
 	rotate 52
	compress
	missingok
	notifempty
	sharedscripts
}

/service/pop3/log/main/\@40000000* /service/pop3/log/main/current {
	weekly
	rotate 52
	compress
	missingok
	notifempty
	sharedscripts
}

/service/pop3-ssl/log/main/\@40000000* /service/pop3-ssl/log/main/current {
	weekly
	rotate 52
	compress
	missingok
	notifempty
	sharedscripts
}

/service/send/log/main/\@40000000* /service/send/log/main/current {
	weekly
	rotate 52
	compress
	missingok
	notifempty
	sharedscripts
}

/service/smtp/log/main/\@40000000* /service/smtp/log/main/current {
	weekly
	rotate 52
	compress
	missingok
	notifempty
	sharedscripts
}

/service/smtp2/log/main/\@40000000* /service/smtp2/log/main/current {
	weekly
	rotate 52
	compress
	missingok
	notifempty
	sharedscripts
}

/service/supervise/log/main/\@40000000* /service/supervise/log/main/current {
	weekly
	rotate 52
	compress
	missingok
	notifempty
	sharedscripts
}

/service/teamspeak/log/main/\@40000000* /service/teamspeak/log/main/current {
	weekly
	rotate 52
	compress
	missingok
	notifempty
	sharedscripts
}

/service/axfrdns-208.86.251.63/log/main/\@40000000* /service/axfrdns-208.86.251.63/log/main/current {
	weekly
	rotate 52
	compress
	missingok
	notifempty
	sharedscripts
}
====EOF====