DNS hijacking (Prevention) Guide 4 Plugin Script (PHP) Cpanel

This topic is empty.

Post

December 14, 2024 at 5:56 pm

Quote

Weekend Wiki

Keymaster

To create a small tool that can be integrated as a plugin for cPanel, you’ll typically use PHP along with the cPanel API to automate and manage tasks like adding SPF, DKIM, and DMARC records. Here’s a simplified version of how such a plugin could work:

1. Plugin Script (PHP)

Create a PHP file to handle the addition of security headers and DNS records for email security (SPF, DKIM, DMARC).

<?php
// cPanel Plugin to manage email security headers

// Example function to add SPF record
function add_spf_record($domain, $spf_value) {
    // Using cPanel API to add a DNS record
    $url = 'https://yourcpanelserver:2083/json-api/cpanel?user=username&module=DNS&domain=' . $domain . '&record=TXT&value=' . urlencode($spf_value);
    $response = file_get_contents($url);
    return $response;
}

// Example function to add DKIM record
function add_dkim_record($domain, $dkim_value) {
    // Using cPanel API to add DKIM DNS record
    $url = 'https://yourcpanelserver:2083/json-api/cpanel?user=username&module=DNS&domain=' . $domain . '&record=TXT&value=' . urlencode($dkim_value);
    $response = file_get_contents($url);
    return $response;
}

// Example function to add DMARC record
function add_dmarc_record($domain, $dmarc_value) {
    // Using cPanel API to add DMARC DNS record
    $url = 'https://yourcpanelserver:2083/json-api/cpanel?user=username&module=DNS&domain=' . $domain . '&record=TXT&value=' . urlencode($dmarc_value);
    $response = file_get_contents($url);
    return $response;
}

// Add SPF, DKIM, and DMARC for a specific domain
$domain = "example.com";  // Replace with actual domain
add_spf_record($domain, "v=spf1 include:_spf.example.com -all");
add_dkim_record($domain, "v=DKIM1; k=rsa; p=public_key_here");
add_dmarc_record($domain, "v=DMARC1; p=reject; rua=mailto:[email protected]");

echo "Email security records added successfully!";
?>

2. Integrating the Plugin in cPanel

Create a plugin folder inside /usr/local/cpanel/base/frontend/paper_lantern/ (or the appropriate theme you’re using).
Add the PHP file into the plugin folder.
Optionally, add a UI interface to allow users to input their domain and trigger the functions.

3. UI (HTML & PHP)

You can create a simple form in your plugin folder to interact with this tool:

<!DOCTYPE html>
<html>
<head>
    <title>Email Security Plugin</title>
</head>
<body>
    <h2>Add Email Security Records (SPF, DKIM, DMARC)</h2>
    <form method="POST">
        Domain: <input type="text" name="domain" required>
        <br>
        <input type="submit" value="Add Records">
    </form>

    <?php
    if ($_SERVER['REQUEST_METHOD'] == 'POST') {
        $domain = $_POST['domain'];

        // Call the functions to add the DNS records
        add_spf_record($domain, "v=spf1 include:_spf.example.com -all");
        add_dkim_record($domain, "v=DKIM1; k=rsa; p=public_key_here");
        add_dmarc_record($domain, "v=DMARC1; p=reject; rua=mailto:[email protected]");

        echo "<p>Email security records have been added for " . htmlspecialchars($domain) . ".</p>";
    }
    ?>
</body>
</html>

4. Installation

Place these files in the cPanel plugin directory.
Ensure that your cPanel API access is correctly configured.
You can also configure additional features such as automatic key generation for DKIM.

Important Notes:

You need API access to your cPanel server, which involves setting up your cPanel user and enabling API calls.

Make sure you sanitize inputs properly to avoid security vulnerabilities like SQL injection or other malicious activities when adding domains or records.To add email security headers like SPF, DKIM, and DMARC for Apache and NGINX, you can’t directly modify the DNS settings within their config files, as these are DNS-level configurations. However, you can add HTTP headers for general email security or protection against certain attacks.Here’s how to add security layers in Apache and NGINX config files:

Apache Configuration Example

<VirtualHost *:443>
    ServerName example.com

    # SSL/TLS Configuration
    SSLEngine on
    SSLCertificateFile /path/to/certificate.crt
    SSLCertificateKeyFile /path/to/private.key
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite HIGH:!aNULL:!MD5:!3DES
    SSLHonorCipherOrder on

    # Email Security Headers (informational, DNS is still required)
    Header always set X-Mailer "SPF/DKIM/DMARC Secured"

    # HSTS (HTTP Strict Transport Security)
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

    # Content Security Policies (CSP)
    Header always set Content-Security-Policy "default-src 'self';"

    DocumentRoot "/var/www/example.com"
    <Directory "/var/www/example.com">
        AllowOverride None
        Require all granted
    </Directory>
</VirtualHost>

NGINX Configuration Example

server {
    listen 443 ssl;
    server_name example.com;

    # SSL/TLS Configuration
    ssl_certificate /path/to/certificate.crt;
    ssl_certificate_key /path/to/private.key;

    # Email Security Headers (informational, DNS is still required)
    add_header X-Mailer "SPF/DKIM/DMARC Secured" always;

    # HSTS (HTTP Strict Transport Security)
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    # Content Security Policies (CSP)
    add_header Content-Security-Policy "default-src 'self';" always;

    root /var/www/example.com;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }
}

DNS Records (SPF, DKIM, and DMARC)

SPF: Add this as a TXT record in your DNS provider’s management interface.
```
v=spf1 include:_spf.example.com -all
```
DKIM: Generate a public/private key pair and add the public key to your DNS as a TXT record.
```
v=DKIM1; k=rsa; p=public_key_here
```

DMARC: Set up DMARC policy in DNS.

v=DMARC1; p=reject; rua=mailto:[email protected]

Final Notes:

While adding email security headers to Apache and NGINX enhances the HTTP layer security, the actual SPF, DKIM, and DMARC configurations must still be handled via DNS management.

You must be logged in to reply to this topic.