GDPR for dedicated Server

The blog doesn’t really explain how to make a cPanel server GDPR compliant unless I missed something?

Do you have a full rundown of tweaks and changes that need to be made to comply with the legislation passed some time ago??

I was under the impression that all backups need to be encrypted where stored?

Also I feel the email system is lacking security, for example if a cPanel login was compromised, you can easily click and view peoples emails in cPanel? Shouldn’t the email system be more secure? Even against server admins, Ask for the password? Even encrypted? A lot of personal information can be held in emails, with cPanel, one click and you can see all emails in plain text In webmail.

Many Admin teams as we know are located outside the EU and with the new legislation bringing in the tightening of data leaving the EU, is it possible to help secure clients data on the server from such security risks?

 

The GDPR is not 100% the same in every European country. Local law can overrule same passages. cPanel Inc. has to first ensure they get their stuff right (e.g what gets transmitted from every cPanel/WHM installation towards cPanel Inc.). The most complex thing seem to be able to export everything you saved about person and hand it over to that person at any point. That is the right of every user hitting a server.

The most basic thing cPanel could offer would be a tool, which removes IPs from logs. Or shortens IPs or replaces IPs with hashes.
E.g. scripts like this https://www.privacyfoundation.ch/en/services/anonip.html

You can see such tools around web analytics tools for years to be in compliance with certain European countries. GDPR makes the IP address a personal data of the user (even when the IP is assigned dynamically via the ISP of a user).

You will see more and more threads here in the future.
E.g. GDPR and Statistical Analytics

European webhosting companies which base their business on cPanel or other controlpanels will need to invest more time to customize the setups or demand features.

 

Is this really required now? Should the IP be removed from the log files?
Seems like a very bad idea.

 

as I understand it, at least we have to tell visitors how long we store data and for what...and IP is "personal" data, even though only governments - and guys like facebook and google - can put a name behind an IP - I cannot

 

Since a lot of data is lost there, I no longer feel encouraged to use the feature request tool at the moment.

Since GDPR is around the corner, I have the feeling the European cPanel Reseller will see a reaction in the market.

 

Think about static IPs.

But GDPR is not preventing storing everything. You need a reason and you need to protect the data. And prove that you protect the data.

I see to areas with a high priority:
1. Logfiles: I would like to see a way, to limit and control storage of IP data in cPanel. E.g. store seven days and after that delete IP or make a hash.
2. Encryption on backuproutines (PublicKey-Encryption and symmetric encryption as an option).

To make this happen you need to change core routines of cPanel/WHM. So no quick change overnight.

E.g. Wordpress has recognized the need for change at the core.
gdpr-compliance – Make WordPress Core

cPanel/WHM is a a collection of software. So a lot more work to get everything under control.

 

Hi I've just had a call from an IT client. He has asked many questions regarding encryption of emails for GDPR compliance. I'm sure this applies to many people and I can't find a definitive answer.

If a website has https, the web visitor enters their data, it's encrypted and sent via PHP to EXIM/Dovecot and into the users inbox, where they then use an email client to read it (SSL on).

1 - The email logs store ip addresses which is identifiable info, I said that GDPR does not say we can't store data, only that there needs to be transparency how long for.

More importantly...

2 - The emails are stored unencrypted in the users mail folder. My client asked if his account was compromised could the hacker read the emails, ie they could upload the mail folder to another server and read all the emails (with a permission change)

I pointed out that the way EXIM works is not going to change overnight because of GDPR and that we cannot change open source software which is built into Cpanel to make it GDPR compliant, we can only highlight this with our software providers, who are also responsible, ie Cpanel.

3 - If data is stored in a mysql data base are you encrypting my database?
My answer - We supply mysql as part of your hosting package, mysql is again open source software, we supply the "service".
But, he said, you are responsible for the data as a data processor. You should be encrypting my database and emails to be compliant.

4 - Are all backups in the EU, luckily we do have all backups locally or in the EU. He didn't raise the question of encrypted backups, but I"m sure this one will come soon!
Again, yes, we are the data processors but can't encrypt if the tools we have do not give us that functionality.

It seems hosting companies are being loaded with all this but the tools to meet obligations are not actually available if you use Cpanel? Or are the obligations being over emphasised because the customers are passing the buck?

We do all we can do with the tools we have and are very vigilant on security, we already do so much the customers don't care to pay for. Noone cares about backups until they lose their sites, they don't actually want to pay for anything extra, ie hourly backups, but then demand the backups are encrypted.

I'm sure this is sending everyone in twist, appreciate comments!

 

ps when will I get opt in from the nigerian spammer who says I can have half of his million pounds?