Kloxo

Last updated
Kloxo
Developer(s) LxCenter
Stable release
6.1.19
Repository github.com/lxcenter/kloxo
Written in PHP
Platform Linux
Type Control panel
License AGPL v3
Website www.lxcenter.org   OOjs UI icon edit-ltr-progressive.svg

Kloxo (formerly known as Lxadmin) was a free and open-source [1] web hosting control panel for the Red Hat and CentOS Linux distributions. [2] As of October 2017, the project has been unmaintained with a number of unresolved issues, and the project's website is offline.

Contents

Kloxo allows the host administrators to run a combination of lighttpd or Apache with djbdns or BIND, and provides a graphical interface to switch between these programs without losing data. Kloxo Enterprise can transparently move web/mail/dns from one server running Apache to another running lighttpd. It was formerly considered to be a good free alternative to cPanel hosting control panel.

Kloxo comes integrated with Installapp, which is a bundle of approximately 130 web applications that can be installed to the hosted websites. It is supported by Installatron [3] – a third-party application installer (similar to Fantastico) as a plugin.

As of October 2017 the whole LxCenter website appears to be down with only the GitHub repository (and some forks) remaining with the last notable changes being three years old.

Lxadmin/Kloxo name change

Due to concerns about the appropriation[ clarification needed ] of the name (Lxadmin) the name was replaced with Kloxo. There was an outcry from users as the name change involved a complete upgrade of file structures and it was about two weeks before there was an upgrade script for hosting companies.[ citation needed ]

Security issues

In early June 2009, security related blogs and websites posted details of security loopholes in LxAdmin/Kloxo. Around this time, another piece of software created by the same vendor – HyperVM – was rumored to have been exploited in a massive attack at the British VAserv budget webhosting company. Crackers deleted the content of 100,000 hosted websites in one go, after gaining root access to the system. A detailed timeline of these events was posted several months later.


It is widely acknowledged by the hacker(s) and parties involved that the core exploit had to do with the administrator of those VPS's reusing the same password on all installs, and not utilizing the SSL security feature. Experts believe that this led to the transmission of the password in plain text, allowing hackers to sniff and exploit the host. [4]

In early 2012 the message "DO NOT INSTALL THESE APPS. The applications included in InstallApp are outrageously out of date, and contain known and public security vulnerabilities. Enabling this feature on a live server exposes your server and users to serious security flaws" showed prominently at the top of the InstallApp page. This message was still there in January 2014.

In late 2012, a local privilege escalation exploit was found in Kloxo's lxsuexec and lxrestart programs, allowing an attacker to elevate privileges to root.

Project history

While Kloxo initially started as a proprietary control panel, Internal issues arose within the company after the death of its CEO. [5] [6] It was later announced on July 10, 2009, that Kloxo and HyperVM would be continued in an open source consortium to be formed by Arthur Thornton, Danny Terweij, and S Bhargava. However, on October 25, 2009, Arthur Thornton officially resigned as the lead developer of Kloxo and HyperVM. Following his resignation, the HyperVM and Kloxo source code was officially released to the public. Arthur Thornton resumed his work on Kloxo and HyperVM in the background in mid-February 2010. As of May 2010, he is now back in the public and should soon be back full-time, though not as lead developer. Andre Allen became Project Manager at LxCenter in late February 2010, at the decision of Danny Terweij.

A fork of the project was created by Mustafa Ramadhan, entitled Kloxo_MR. Work was begun in late 2012 to add extra features to the project.

In September 2020, a new fork called Kloxo Next Generation (KloxoNG) was released as an upgrade pathway for existing Kloxo_MR users. KloxoNG is a rebuild of Kloxo_MR using the Fedora Copr build system. Later releases have included bug fixes and added support for PHP 7.4. Future releases will include further bug fixes, upgrades of the core packages and support for EL8 servers.

Related Research Articles

<span class="mw-page-title-main">OpenSSL</span> Open-source implementation of the SSL and TLS protocols

OpenSSL is a software library for applications that provide secure communications over computer networks against eavesdropping, and identify the party at the other end. It is widely used by Internet servers, including the majority of HTTPS websites.

<span class="mw-page-title-main">Webmin</span> Web-based control panel for Unix-like systems

Webmin is a web-based server management control panel for Unix-like systems. Webmin allows the user to configure operating system internals, such as users, disk quotas, services and configuration files, as well as modify and control open-source apps, such as BIND, Apache HTTP Server, PHP, and MySQL.

cPanel is web hosting control panel software developed by cPanel, L.L.C. It provides a graphical interface (GUI) and automation tools designed to simplify the process of hosting a web site to the website owner or the "end user". It enables administration through a standard web browser using a three-tier structure. While cPanel is limited to managing a single hosting account, cPanel & WHM allows the administration of the entire server.

<span class="mw-page-title-main">Greasemonkey</span> Userscript manager extension for Firefox

Greasemonkey is a userscript manager made available as a Mozilla Firefox extension. It enables users to install scripts that make on-the-fly changes to web page content after or before the page is loaded in the browser.

<span class="mw-page-title-main">Django (web framework)</span> Python web framework

Django is a free and open-source, Python-based web framework that runs on a web server. It follows the model–template–views (MTV) architectural pattern. It is maintained by the Django Software Foundation (DSF), an independent organization established in the US as a 501(c)(3) non-profit.

DreamHost is a Los Angeles-based web hosting provider and domain name registrar. It is owned by New Dream Network, LLC, founded in 1996 by Dallas Bethune, Josh Jones, Michael Rodriguez and Sage Weil, undergraduate students at Harvey Mudd College in Claremont, California, and registered in 1997 by Michael Rodriguez. DreamHost began hosting customers' sites in 1997. In May 2012, DreamHost spun off Inktank. Inktank is a professional services and support company for the open source Ceph file system. In November 2014, DreamHost spun off Akanda, an open source network virtualization project. As of February 2016, Dreamhost employs about 200 people and has close to 400,000 customers.

<span class="mw-page-title-main">Roundcube</span> Open-source web-based IMAP email client

Roundcube is a web-based IMAP email client. Roundcube's most prominent feature is the pervasive use of Ajax technology. Roundcube is free and open-source software subject to the terms of the GNU General Public License (GPL-3.0-or-later), with exceptions for skins and plugins.

<span class="mw-page-title-main">HackThisSite</span> Organization

HackThisSite.org, commonly referred to as HTS, is an online hacking and security website founded by Jeremy Hammond. The site is maintained by members of the community after he left the organization. It aims to provide users with a way to learn and practice basic and advanced "hacking" skills through a series of challenges in a safe and legal environment. The organization has a user base of over a million, though the number of active members is believed to be much lower. The most users online at the same time was 19,950 on February 5, 2018 at 2:46 a.m. CT.

DirectAdmin is a graphical web-based web hosting control panel allowing administration of websites through a web browser. The software is configurable to enable standalone, reseller, and shared web hosting from a single instance. DirectAdmin also permits management of server tasks and upgrades to package software from within the control panel - simplifying server and hosting configuration.

Jira is a proprietary product developed by Atlassian that allows bug tracking, issue tracking and agile project management. Jira is used by a large number of clients and users globally for project, time, requirements, task, bug, change, code, test, release, sprint management.

Heroku is a cloud platform as a service (PaaS) supporting several programming languages. As one of the first cloud platforms, Heroku has been in development since June 2007, when it supported only the Ruby programming language, but now also supports Java, Node.js, Scala, Clojure, Python, PHP, and Go. For this reason, Heroku is said to be a polyglot platform as it has features for a developer to build, run and scale applications in a similar manner across most of these languages. Heroku was acquired by Salesforce in 2010 for $212 million.

NS Basic is a family of development tools developed and commercially marketed by NSB Corporation in Toronto, Ontario, Canada for iOS, Android, Microsoft Windows, MacOS, Linux, BlackBerry OS, WebOS, Newton OS, Palm OS, Windows CE and Windows Mobile.

Review Board is a web-based collaborative code review tool, available as free software under the MIT License.

NehoX Game Panel was a web-based game server hosting control panel to help easily manage game servers. NehoX is designed to simplify the process to deploy, automate, and maintain game servers and remote servers. NehoX automates the installation process and the remote server installation process at the click of a button to enable administrators to add additional servers and fully control everything from the master server.

<span class="mw-page-title-main">Google Authenticator</span> Two-step verification app

Google Authenticator is a software-based authenticator by Google. It implements multi-factor authentication services using the time-based one-time password and HMAC-based one-time password, for authenticating users of software applications.

<span class="mw-page-title-main">ProFTPD</span> Open-source FTP server software

ProFTPD is an FTP server. ProFTPD is Free and open-source software, compatible with Unix-like systems and Microsoft Windows . Along with vsftpd and Pure-FTPd, ProFTPD is among the most popular FTP servers in Unix-like environments today. Compared to those, which focus e.g. on simplicity, speed or security, ProFTPD's primary design goal is to be a highly feature rich FTP server, exposing a large amount of configuration options to the user.

<span class="mw-page-title-main">AlternC</span>

AlternC is a set of open-source Web Hosting server management software for Linux/UNIX-like systems, whose aim is to promote self hosting by individuals or small structures, and provide its users with an easy web-based interface to manage a web and mail server.

Cloudbleed was a Cloudflare buffer overflow disclosed by Project Zero on February 17, 2017. Cloudflare's code disclosed the contents of memory that contained the private information of other customers, such as HTTP cookies, authentication tokens, HTTP POST bodies, and other sensitive data. As a result, data from Cloudflare customers was leaked to all other Cloudflare customers that had access to server memory. This occurred, according to numbers provided by Cloudflare at the time, more than 18,000,000 times before the problem was corrected. Some of the leaked data was cached by search engines.

<span class="mw-page-title-main">Bitwarden</span> Open-source password manager

Bitwarden is a freemium open-source password management service that stores sensitive information, such as website credentials, in an encrypted vault. The platform offers a variety of client applications, including a web interface, desktop applications, browser extensions, mobile apps, and a command-line interface. Bitwarden offers a free US or European cloud-hosted service as well as the ability to self-host.

Froxlor is a free and open-source web hosting control panel which originated from the SysCP project. It is released under the terms of the GNU General Public License v2.0.

References

  1. ↑ "Kloxo". GitHub . 19 March 2022.
  2. ↑ "Waltern", LxCenter Staff (29 September 2010). "Can i install kloxo on debian vps?". LxCenter Forum. Archived from the original on 27 July 2011. Retrieved 6 November 2010.
  3. ↑ "Install Installatron on a Kloxo/LxAdmin server". Installatron web site.
  4. ↑ "Hacker explains attack". 9 June 2009.
  5. ↑ "Webhost hack wipes out data for 100,000". The Register .
  6. ↑ "Techie hangs himself in HSR Layout". The Times Of India. 9 June 2009.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.