Letsencrypt host error

liamgibbins · May 15, 2022, 3:19pm

Hi guys maybe you can help with this little issue.

I ran v-add-letsencrypt-host and I get 400 error.

So I went to https://letsdebug.net/ to find the problem that its having and I got:

[NoRecords](https://letsdebug.net/panel.eve-lbs-studio.co.uk/1037221#NoRecords-Fatal)

FATAL

No valid A or AAAA records could be ultimately resolved for panel.eve-lbs-studio.co.uk. This means that Let's Encrypt would not be able to to connect to your domain to perform HTTP validation, since it would not know where to connect to.

No A or AAAA records found.

So after that I tried adding a DNS Zone in the dns section of the panel for panel.eve-lbs-studio.co.uk and I got the error:

Error: Web domain eve-lbs-studio.co.uk exists

I get the same error when trying to add a dns zone via command line.

liamgibbins · May 15, 2022, 3:23pm

I should probably add that there is no domain or dns record that has panel.eve-lbs-studio.co.uk apart from the domain in the admin account (no dns was created by default for the domain upon installation).

eris · May 15, 2022, 3:46pm

Does the domain:
eve-lbs-studio.co.uk exists?

eris · May 15, 2022, 3:59pm

https://docs.hestiacp.com/admin_docs/settings.html#what-does-the-policy-enforce-subdomain-ownership-mean

liamgibbins · May 16, 2022, 10:37am

Thank you eris that sounds like that is the issue, didnt see that in the docs, will have a go soon currently nowhere near my pc …

Yhank you

eris · May 16, 2022, 10:39am

It is related to an security “bug”

github.com/hestiacp/hestiacp

[BUG] Any user can create a subdomain for any domain using the HestiaCP DNS server even for other users.

opened 01:40AM - 15 Feb 21 UTC

closed 10:12AM - 28 Feb 21 UTC

KuJoe

bug security

**Describe the bug** Any user can create a subdomain for any domain on the serv…er and create content using that domain. The Add Web Domain button does not validate whether or not the domain created is a subdomain for a domain already on the server. If user1 owns domain1.com and uses the nameservers for the HestiaCP server, user2 on the same server can create any subdomain for domain1.com and upload any content they want and act like they own the domain. As long as both users are on the same server and the domain is being managed by the same DNS server. This can be a problem for shared hosting environments. Additionally users can send e-mail from this subdomain which would appear legitimate for most e-mail clients since the SPF and DKIM records would be valid. **To Reproduce** What steps did you take when the issue occured? 1. Point domain to the HestiaCP server using the nameservers. 2. Add the TLD to one user using the Add Web Domain. 3. Add a subdomain of the TLD to another user using the Add Web Domain and check "Create DNS Zone". 4. View both domains in a browser. **Expected behavior** Throw an error if the user tries to add a subdomain using the Add Web Domain form if the TLD exists for another user (alternatively make a checkbox to enforce this or not). NOTE: Please do not enforce this for command line and API calls since some shared hosts give out free subdomains. Enforcing this at a user level (i.e. the PHP form) would be a better option. **Operating system:** Ubuntu 20.04 LTS **Hestia Control Panel version:** v1.3.2 **Additional context** DirectAdmin has added a checkbox to their settings for this, might be a better solution: ![image](https://user-images.githubusercontent.com/1040086/107896560-9da01b00-6f04-11eb-8723-fdfbf6e6f27c.png) (Link to DA feature request for further info: https://www.directadmin.com/features.php?id=925) For additional reference, here's an old thread from VestaCP with 2 possible solutions (mine being the worst of the 2): https://forum.vestacp.com/viewtopic.php?f=13&t=9175

It would be a bad idea to allow user A create webmail.userb.com and then again access to the email accounts with a spoofing method

liamgibbins · May 16, 2022, 1:43pm

its a private server for personal use.

I thought I would also mention that the command “v-delete-web-domain-allow-users user domain.com” didn’t work so I reinstalled from a snapshot and unchecked the option Enforce subdomain ownership in the configure server page and that worked.

I set the admin user to only access via local IP, its only me using the panel on my small home server mainly for learning purposes but I do host a couple of my websites on it.

eris · May 16, 2022, 1:48pm

In the settings there is an “option” disable enforce domain owner ship

Disable it and it will work as intented

system · June 15, 2022, 1:49pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.