GDPR for dedicated Server

[fullfatdesigns]

Hi

I've been reading up on GDPR to advise our client on changes to their websites, but I'm after peoples view on what we need to do on our server.

We have a dedicated server with about 20 websites on which back-ups to Amazon S3 every night (keeps 2 weeks worth). The whm/cpanel is on a https and if all the sites are switched to https (some are anyway), is there anything else I need to put in place?

Just after peoples views as I couldn't seem to find any guide for the actual server, just what to do on the websites.

Thanks
Wayne

 

[Infopro]

This new blog post may be of some use to you:
General Data Protection Regulation and cPanel | cPanel Blog

 

[fullfatdesigns]

Brilliant, thank you. I'll check it out. I didn't think to search the main site, only searched the forums.

 

[james1985]

The blog doesn’t really explain how to make a cPanel server GDPR compliant unless I missed something?

Do you have a full rundown of tweaks and changes that need to be made to comply with the legislation passed some time ago??

I was under the impression that all backups need to be encrypted where stored?

Also I feel the email system is lacking security, for example if a cPanel login was compromised, you can easily click and view peoples emails in cPanel? Shouldn’t the email system be more secure? Even against server admins, Ask for the password? Even encrypted? A lot of personal information can be held in emails, with cPanel, one click and you can see all emails in plain text In webmail.

Many Admin teams as we know are located outside the EU and with the new legislation bringing in the tightening of data leaving the EU, is it possible to help secure clients data on the server from such security risks?

 

[cPanelMichael]

Hello @james1985,

Here are a couple of quotes from the blog post related to how you can approach GDPR compliance for your own company:

Where can I get more information about GDPR and my compliance obligations?
The GDPR itself is here. The European Union has created an information portal here. A number of companies provide consulting services that help with different aspects of your compliance process. While cPanel doesn’t recommend any particular approach to GDPR compliance, your lawyer or regulatory advisor may be able to point you to resources that are helpful.

How does cPanel & WHM facilitate compliance with GDPR?
cPanel & WHM is intentionally a highly configurable software product. Because every customer’s determination about what is required for it to become GDPR compliant is unique, there is not a particular way that our products create compliance with GDPR, or any other law or regulation. We are committed to working with our customers and partners to understand how their compliance activities are facilitated by our products, and ways our products can help them reach compliance.

As far as encrypted backups and emails, those are not direct features offered with the cPanel & WHM product at this time, but you can find discussion of such features with potential solutions at:

Backups - encryption of backups (symmetric and asymmetric)
Email storage encryption

Thank you.

 

[lorio]

The blog doesn’t really explain how to make a cPanel server GDPR compliant unless I missed something? Do you have a full rundown of tweaks and changes that need to be made to comply with the legislation passed some time ago??

The GDPR is not 100% the same in every European country. Local law can overrule same passages. cPanel Inc. has to first ensure they get their stuff right (e.g what gets transmitted from every cPanel/WHM installation towards cPanel Inc.). The most complex thing seem to be able to export everything you saved about person and hand it over to that person at any point. That is the right of every user hitting a server.

The most basic thing cPanel could offer would be a tool, which removes IPs from logs. Or shortens IPs or replaces IPs with hashes.
E.g. scripts like this https://www.privacyfoundation.ch/en/services/anonip.html

You can see such tools around web analytics tools for years to be in compliance with certain European countries. GDPR makes the IP address a personal data of the user (even when the IP is assigned dynamically via the ISP of a user).

You will see more and more threads here in the future.
E.g. GDPR and Statistical Analytics

European webhosting companies which base their business on cPanel or other controlpanels will need to invest more time to customize the setups or demand features.

 

[cPanelMichael]

The most basic thing cPanel could offer would be a tool, which removes IPs from logs. Or shortens IPs or replaces IPs with hashes.

Hi @lorio,

Thank you for taking the time to provide us with feedback on this topic. I encourage you to open a feature request for this at:

Submit A Feature Request

Note that our feature request website is currently undergoing maintenance, but should resume functioning soon.

Thank you.

 

[DennisMidjord]

The most basic thing cPanel could offer would be a tool, which removes IPs from logs. Or shortens IPs or replaces IPs with hashes.
E.g. scripts like this Anonip | Swiss Privacy Foundation

Is this really required now? Should the IP be removed from the log files?
Seems like a very bad idea.

 

[Dan70]

as I understand it, at least we have to tell visitors how long we store data and for what...and IP is "personal" data, even though only governments - and guys like facebook and google - can put a name behind an IP - I cannot

 

[lorio]

Hi @lorio,
Thank you for taking the time to provide us with feedback on this topic. I encourage you to open a feature request for this at:

Since a lot of data is lost there, I no longer feel encouraged to use the feature request tool at the moment.

Since GDPR is around the corner, I have the feeling the European cPanel Reseller will see a reaction in the market.

 

[lorio]

and IP is "personal" data, even though only governments - and guys like facebook and google - can put a name behind an IP - I cannot

Think about static IPs.

But GDPR is not preventing storing everything. You need a reason and you need to protect the data. And prove that you protect the data.

I see to areas with a high priority:
1. Logfiles: I would like to see a way, to limit and control storage of IP data in cPanel. E.g. store seven days and after that delete IP or make a hash.
2. Encryption on backuproutines (PublicKey-Encryption and symmetric encryption as an option).

To make this happen you need to change core routines of cPanel/WHM. So no quick change overnight.

E.g. Wordpress has recognized the need for change at the core.
gdpr-compliance – Make WordPress Core

cPanel/WHM is a a collection of software. So a lot more work to get everything under control.

 

[cPanelMichael]

Since a lot of data is lost there, I no longer feel encouraged to use the feature request tool at the moment.

Hi @lorio,

I can understand the sentiment, but I do want to note that additional redundancy is now in place to help prevent that from happening again in the future. If there were any specific feature requests that you opened or contributed to in the past that no longer exist, let me know and we'll work on getting those added back on your behalf.

Thank you.

 

[uk01]

Hi I've just had a call from an IT client. He has asked many questions regarding encryption of emails for GDPR compliance. I'm sure this applies to many people and I can't find a definitive answer.

If a website has https, the web visitor enters their data, it's encrypted and sent via PHP to EXIM/Dovecot and into the users inbox, where they then use an email client to read it (SSL on).

1 - The email logs store ip addresses which is identifiable info, I said that GDPR does not say we can't store data, only that there needs to be transparency how long for.

More importantly...

2 - The emails are stored unencrypted in the users mail folder. My client asked if his account was compromised could the hacker read the emails, ie they could upload the mail folder to another server and read all the emails (with a permission change)

I pointed out that the way EXIM works is not going to change overnight because of GDPR and that we cannot change open source software which is built into Cpanel to make it GDPR compliant, we can only highlight this with our software providers, who are also responsible, ie Cpanel.

3 - If data is stored in a mysql data base are you encrypting my database?
My answer - We supply mysql as part of your hosting package, mysql is again open source software, we supply the "service".
But, he said, you are responsible for the data as a data processor. You should be encrypting my database and emails to be compliant.

4 - Are all backups in the EU, luckily we do have all backups locally or in the EU. He didn't raise the question of encrypted backups, but I"m sure this one will come soon!
Again, yes, we are the data processors but can't encrypt if the tools we have do not give us that functionality.

It seems hosting companies are being loaded with all this but the tools to meet obligations are not actually available if you use Cpanel? Or are the obligations being over emphasised because the customers are passing the buck?

We do all we can do with the tools we have and are very vigilant on security, we already do so much the customers don't care to pay for. Noone cares about backups until they lose their sites, they don't actually want to pay for anything extra, ie hourly backups, but then demand the backups are encrypted.

I'm sure this is sending everyone in twist, appreciate comments!

 

[uk01]

ps when will I get opt in from the nigerian spammer who says I can have half of his million pounds?

 

[cPanelMichael]

Hello @uk01,

I've merged your post into this thread.

Thank you.