5 Regola /etc/hosts

Quindi modifichiamo /etc/hosts. Rendilo simile a questo:

vi /etc/hosts

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
192.168.0.100   server1.example.com     server1

::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

È importante aggiungere una riga per server1.example.com e rimuovere server1.example.com e server1 dalla riga 127.0.0.1.

6 Configura il firewall

(Puoi saltare questo capitolo se hai già disabilitato il firewall al termine dell'installazione di base del sistema.)

Voglio installare ISPConfig alla fine di questo tutorial che viene fornito con il proprio firewall. Ecco perché ora disabilito il firewall Fedora predefinito. Naturalmente, sei libero di lasciarlo acceso e configurarlo secondo le tue esigenze (ma in seguito non dovresti usare nessun altro firewall in quanto molto probabilmente interferirà con il firewall Fedora).

Corri

system-config-firewall

e disabilitare il firewall.

Per verificare che il firewall sia stato davvero disabilitato, puoi eseguire

iptables -L 

dopo. L'output dovrebbe essere simile a questo:

[[email protected] ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source              destinazione

Chain FORWARD (policy ACCEPT)
target prot opt sorgente              destinazione

CHAIN OUTPUT (policy ACCEPT)
target     prot opt source              destinazione
[[email protected] ~]#

7 Disattiva SELinux

SELinux è un'estensione di sicurezza di Fedora che dovrebbe fornire una sicurezza estesa. Secondo me non è necessario per configurare un sistema sicuro e di solito causa più problemi che vantaggi (pensaci dopo aver fatto una settimana di risoluzione dei problemi perché alcuni servizi non funzionavano come previsto, e quindi scopri che era tutto ok, solo SELinux stava causando il problema). Pertanto lo disabilito (questo è un must se vuoi installare ISPConfig in un secondo momento).

Modifica /etc/selinux/config e imposta SELINUX=disabled:

vi /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

Successivamente dobbiamo riavviare il sistema:

reboot

8 Installa del software

Per prima cosa importiamo le chiavi GPG per i pacchetti software:

rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY*

Successivamente aggiorniamo i nostri pacchetti esistenti sul sistema:

yum update

Ora installiamo alcuni pacchetti software che saranno necessari in seguito:

yum groupinstall 'Development Tools'

yum groupinstall 'Development Libraries'

9 quota su journal

(Se hai scelto uno schema di partizionamento diverso dal mio, devi modificare questo capitolo in modo che la quota si applichi alle partizioni dove ne hai bisogno.)

Per installare quota, eseguiamo questo comando:

yum install quota

Modifica /etc/fstab e aggiungi ,usrjquota=aquota.user,grpjquota=aquota.group,jqfmt=vfsv0 alla partizione / (/dev/mapper/vg_server1-lv_root):

vi /etc/fstab

#
# /etc/fstab
# Created by anaconda on Wed May 25 15:57:24 2011
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
/dev/mapper/vg_server1-lv_root /                       ext4    defaults,usrjquota=aquota.user,grpjquota=aquota.group,jqfmt=vfsv0        1 1
UUID=366ba6a7-7e68-4ec9-9743-4b02dd105180 /boot                   ext4    defaults        1 2
/dev/mapper/vg_server1-lv_swap swap                    swap    defaults        0 0
tmpfs                   /dev/shm                tmpfs   defaults        0 0
devpts                  /dev/pts                devpts  gid=5,mode=620  0 0
sysfs                   /sys                    sysfs   defaults        0 0
proc                    /proc                   proc    defaults        0 0

Quindi esegui

mount -o remount /

quotacheck -avugm
quotaon -avug

per abilitare la quota.

10 Installa Apache, MySQL, phpMyAdmin

Tutto questo può essere installato con un solo comando:

yum install ntp httpd mysql-server php php-mysql php-mbstring php-mcrypt phpMyAdmin

Il server perfetto - Fedora 15 x86_64 [ISPConfig 3] - Pagina 4

11 Installa Courier-IMAP, Courier-Authlib e Maildrop

Sfortunatamente non ci sono pacchetti rpm per Courier-IMAP, Courier-Authlib e Maildrop, quindi dobbiamo costruirli noi stessi.

Per prima cosa rimuovi Dovecot (Fedora 15 viene fornito con Dovecot 2.x; sfortunatamente, ISPConfig 3 supporta Dovecot 1.2.x, ma non 2.x):

yum remove dovecot dovecot-mysql 

Quindi installa i prerequisiti necessari per creare pacchetti rpm Courier:

yum install rpm-build gcc mysql-devel openssl-devel cyrus-sasl-devel pkgconfig zlib-devel pcre-devel openldap-devel postgresql-devel expect libtool-ltdl-devel openldap-servers libtool gdbm-devel pam-devel gamin-devel libidn-devel 

I pacchetti RPM non dovrebbero essere compilati come root; Courier-imap rifiuterà anche di compilare se rileva che la compilazione viene eseguita come utente root. Pertanto ora creiamo un normale account utente (falko in questo esempio) e gli diamo una password:

useradd -m -s /bin/bash falko
passwd falko

Avremo bisogno del comando sudo in seguito in modo che l'utente falko possa compilare e installare i pacchetti rpm. Ma prima, dobbiamo consentire a falko di eseguire tutti i comandi usando sudo:

Corri

visudo

Nel file che si apre c'è una riga radice ALL=(ALL) ALL. Aggiungi una linea simile per falko appena sotto quella linea:

[...]
## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
falko   ALL=(ALL)       ALL
[...]

Ora siamo pronti per costruire il nostro pacchetto rpm. Prima diventa l'utente falko:

su falko

Quindi creiamo il nostro ambiente di costruzione:

mkdir $HOME/rpm
mkdir $HOME/rpm/SOURCES
mkdir $HOME/rpm/SPECS
mkdir $HOME/rpm/BUILD
mkdir $HOME/rpm/BUILDROOT
mkdir $HOME/rpm/SRPMS
mkdir $HOME/rpm/RPMS
mkdir $HOME/rpm/RPMS/i386
mkdir $HOME/rpm/RPMS/x86_64

echo "%_topdir $HOME/rpm" >> $HOME/.rpmmacros

Ora creiamo una directory di download e scarichiamo i file sorgente da http://www.courier-mta.org/download.php:

mkdir $HOME/download
cd $HOME/download

wget https://sourceforge.net/projects/courier/files/authlib/0.63.0/courier-authlib-0.63.0.tar.bz2/download
wget https://sourceforge.net/projects/courier /files/imap/4.8.1/courier-imap-4.8.1.tar.bz2/download
wget https://sourceforge.net/projects/courier/files/maildrop/2.5.4/maildrop-2.5 .4.tar.bz2/scarica

(Potresti chiederti perché non scarico la versione più recente di Courier-imap - 4.9.3 al momento della stesura di questo articolo - ma ne uso una precedente - 4.8.1. Questo perché 4.9.3 non è riuscito a costruire sul mio sistema , mentre 4.8.1 funziona bene.)

Ora (sempre in $HOME/downloads) possiamo costruire corriere-authlib:

sudo rpmbuild -ta courier-authlib-0.63.0.tar.bz2

Dopo il processo di compilazione, i pacchetti rpm possono essere trovati in /root/rpmbuild/RPMS/x86_64 (/root/rpmbuild/RPMS/i686 se sei su un sistema i686). Il comando

sudo ls -l /root/rpmbuild/RPMS/x86_64

mostra i pacchetti rpm disponibili:

[[email protected] downloads]$ sudo ls -l /root/rpmbuild/RPMS/x86_64
total 520
-rw-r--r-- 1 root root 123448 25 maggio 18:06 courier -authlib-0.63.0-1.fc15.x86_64.rpm
-rw-r--r-- 1 root root 265144 25 maggio 18:06 courier-authlib-debuginfo-0.63.0-1.fc15. x86_64.rpm
-rw-r--r-- 1 root root  34876 25 maggio 18:06 courier-authlib-devel-0.63.0-1.fc15.x86_64.rpm
-rw-r --r-- 1 root root  17448 25 maggio 18:06 courier-authlib-ldap-0.63.0-1.fc15.x86_64.rpm
-rw-r--r-- 1 root root  13808 25 maggio 18:06 courier-authlib-mysql-0.63.0-1.fc15.x86_64.rpm
-rw-r--r-- 1 root root 13020 25 maggio 18:06 courier-authlib-pgsql-0.63. 0-1.fc15.x86_64.rpm
-rw-r--r-- 1 root root   8276 25 maggio 18:06 courier-authlib-pipe-0.63.0-1.fc15.x86_64.rpm
-rw-r--r-- 1 root root  34108 25 maggio 18:06 courier-authlib-userdb-0.63.0-1.fc15.x86_64.rpm
[[email protected] downloads]$

Seleziona quelli che desideri installare e installali in questo modo:

sudo rpm -ivh /root/rpmbuild/RPMS/x86_64/courier-authlib-0.63.0-1.fc15.x86_64.rpm /root/rpmbuild/RPMS/x86_64/courier-authlib-mysql-0.63.0-1.fc15.x86_64.rpm /root/rpmbuild/RPMS/x86_64/courier-authlib-devel-0.63.0-1.fc15.x86_64.rpm

Ora torniamo alla nostra directory dei download:

cd $HOME/downloads

Esegui i seguenti comandi per creare le directory richieste/modificare i permessi delle directory (perché altrimenti il ​​processo di compilazione per Courier-Imap avrà esito negativo):

sudo mkdir /var/cache/ccache/tmp
sudo chmod o+rwx /var/cache/ccache/
sudo chmod 777 /var/cache/ccache/tmp

Ora esegui di nuovo rpmbuild, questa volta senza sudo, altrimenti la compilazione fallirà perché è stata eseguita come root:

rpmbuild -ta courier-imap-4.8.1.tar.bz2

Dopo il processo di compilazione, i pacchetti rpm possono essere trovati in $HOME/rpm/RPMS/x86_64 ($HOME/rpm/RPMS/i686 se sei su un sistema i686):

cd $HOME/rpm/RPMS/x86_64

Il comando

ls -l

mostra i pacchetti rpm disponibili:

[[email protected] x86_64]$ ls -l
totale 1708
-rw-rw-r-- 1 falko falko  596432 25 maggio 18:33 courier-imap-4.8.1-2.15.x86_64 .rpm
-rw-rw-r-- 1 falko falko 1149328 25 maggio 18:33 courier-imap-debuginfo-4.8.1-2.15.x86_64.rpm
[[email protected] x86_64] $

Puoi installare corriere-imap in questo modo:

sudo rpm -ivh courier-imap-4.8.1-2.15.x86_64.rpm

Ora torniamo alla nostra directory dei download:

cd $HOME/downloads

ed esegui di nuovo rpmbuild, questa volta per creare un pacchetto maildrop:

sudo rpmbuild -ta maildrop-2.5.4.tar.bz2

Dopo il processo di compilazione, i pacchetti rpm possono essere trovati in /root/rpmbuild/RPMS/x86_64 (/root/rpmbuild/RPMS/i686 se sei su un sistema i686). Il comando

sudo ls -l /root/rpmbuild/RPMS/x86_64

mostra i pacchetti rpm disponibili:

[[email protected] downloads]$ sudo ls -l /root/rpmbuild/RPMS/x86_64
total 1628
-rw-r--r-- 1 root root 123448 25 maggio 18:06 courier -authlib-0.63.0-1.fc15.x86_64.rpm
-rw-r--r-- 1 root root 265144 25 maggio 18:06 courier-authlib-debuginfo-0.63.0-1.fc15. x86_64.rpm
-rw-r--r-- 1 root root  34876 25 maggio 18:06 courier-authlib-devel-0.63.0-1.fc15.x86_64.rpm
-rw-r --r-- 1 root root  17448 25 maggio 18:06 courier-authlib-ldap-0.63.0-1.fc15.x86_64.rpm
-rw-r--r-- 1 root root  13808 25 maggio 18:06 courier-authlib-mysql-0.63.0-1.fc15.x86_64.rpm
-rw-r--r-- 1 root root 13020 25 maggio 18:06 courier-authlib-pgsql-0.63. 0-1.fc15.x86_64.rpm
-rw-r--r-- 1 root root   8276 25 maggio 18:06 courier-authlib-pipe-0.63.0-1.fc15.x86_64.rpm
-rw-r--r-- 1 root root  34108 25 maggio 18:06 courier-authlib-userdb-0.63.0-1.fc15.x86_64.rpm
-rw-r--r-- 1 root 278520 25 maggio 18:50 maildrop-2.5.4-1.15.x86_64.rpm
-rw-r--r-- 1 root 685672 25 maggio 18:50 maildrop-debuginfo-2.5.4 -1.15.x86_64.rpm
-rw-r--r-- 1 root root  99924 25 maggio 18:50 maildrop-devel-2.5.4-1.15.x86_64.rpm
-rw-r- -r-- 1 root root  63968 25 maggio 18:50 maildrop-man-2.5.4-1.15.x86_64.rpm
[[email protected] downloads]$

Ora puoi installare maildrop in questo modo:

sudo rpm -ivh /root/rpmbuild/RPMS/x86_64/maildrop-2.5.4-1.15.x86_64.rpm

Dopo aver compilato e installato tutti i pacchetti necessari, puoi diventare di nuovo root digitando

exit

12 Installa Postfix

Postfix può essere installato come segue:

yum install postfix

Quindi disattiva Sendmail e avvia Postfix e MySQL:

chkconfig --levels 235 mysqld su
/etc/init.d/mysqld start

chkconfig sendmail off
chkconfig --levels 235 postfix on
/etc/init.d/sendmail stop
/etc/init.d/postfix start

13 Installa Getmail

Getmail può essere installato come segue:

yum install getmail

14 Imposta password MySQL e configura phpMyAdmin

Imposta le password per l'account root MySQL:

 mysql_secure_installation 

[[email protected] ~]# mysql_secure_installation




NOTA: L'ESECUZIONE DI TUTTE LE PARTI DI QUESTO SCRIPT È CONSIGLIATA PER TUTTI MySQL
      SERVER IN PRODUZIONE UTILIZZO! PER FAVORE, LEGGERE ATTENTAMENTE OGNI PASSO!


Per accedere a MySQL per proteggerlo, avremo necessità della password
corrente per l'utente root. Se hai appena installato MySQL e
non hai impostato la password root, la password sarà vuota,
quindi dovresti premere invio qui.

Invio password corrente per la radice (inserire per nessuno): <-- INVIO
OK, password utilizzata con successo, andare avanti...

L'impostazione della password di radice garantisce che nessuno possa accedere a MySQL
utente root senza l'autorizzazione appropriata.

Impostare la password root? [S/n] <-- ENTER
Nuova password: <-- yourrootsqlpassword
Reinserire nuova password: <-- yourrootsqlpassword
Password aggiornata con successo!
Ricaricamento tabelle privilegi. .
 ... Successo!


Per impostazione predefinita, un'installazione MySQL ha un utente anonimo, consentendo a chiunque
di accedere a MySQL senza deve avere un account utente creato per
loro. Questo è destinato solo a test e a rendere l'installazione
andare un po' più agevole. Dovresti rimuoverli prima di trasferirti in un ambiente di produzione.

Rimuovere utenti anonimi? [S/n] <-- ENTER
 ... Successo!

Normalmente, a root dovrebbe essere consentito di connettersi da 'localhost'. Questo
garantisce che qualcuno non riesca a indovinare la password root dalla rete.

Disconsentire l'accesso root da remoto? [S/n] <-- ENTER
 ... Successo!

Per impostazione predefinita, MySQL viene con un database denominato 'test' a cui chiunque può
accedere. Questo è anche destinato solo a test, e dovrebbe essere rimosso
prima di trasferirsi in un ambiente di produzione.

Rimuovere database di test e accedere ad esso? [S/n] <-- ENTER
 - Dropping database di test...
 ... Successo!
 - Rimozione privilegi sul database di test...
 ... Successo !

Ricaricare le tabelle di privilegi garantirà che tutte le modifiche apportate finora
diventeranno immediatamente effettive.

Ricaricare le tabelle privilegi adesso? [S/n] <-- ENTER
 ... Successo!

Pulizia ...



Fatto! Se hai completato tutti i passaggi precedenti, l'installazione di MySQL
dovrà essere protetta.

Grazie per aver utilizzato MySQL!


[esempio @unixlinux.online ~]#

Ora configuriamo phpMyAdmin. Cambiamo la configurazione di Apache in modo che phpMyAdmin consenta connessioni non solo da localhost (commentando la stanza ):

vi /etc/httpd/conf.d/phpMyAdmin.conf

# phpMyAdmin - Web based MySQL browser written in php
#
# Allows only localhost by default
#
# But allowing phpMyAdmin to anyone other than localhost should be considered
# dangerous unless properly secured by SSL

Alias /phpMyAdmin /usr/share/phpMyAdmin
Alias /phpmyadmin /usr/share/phpMyAdmin

#<Directory /usr/share/phpMyAdmin/>
#   Order Deny,Allow
#   Deny from All
#   Allow from 127.0.0.1
#   Allow from ::1
#</Directory>

<Directory /usr/share/phpMyAdmin/setup/>
   Order Deny,Allow
   Deny from All
   Allow from 127.0.0.1
   Allow from ::1
</Directory>

# These directories do not require access over HTTP - taken from the original
# phpMyAdmin upstream tarball
#
<Directory /usr/share/phpMyAdmin/libraries/>
    Order Deny,Allow
    Deny from All
    Allow from None
</Directory>

<Directory /usr/share/phpMyAdmin/setup/lib/>
    Order Deny,Allow
    Deny from All
    Allow from None
</Directory>

# This configuration prevents mod_security at phpMyAdmin directories from
# filtering SQL etc.  This may break your mod_security implementation.
#
#<IfModule mod_security.c>
#    <Directory /usr/share/phpMyAdmin/>
#        SecRuleInheritance Off
#    </Directory>
#</IfModule>

Quindi creiamo i collegamenti di avvio del sistema per Apache e lo avviamo:

chkconfig --levels 235 httpd su
/etc/init.d/httpd start

Ora puoi indirizzare il tuo browser a http://server1.example.com/phpmyadmin/ o http://192.168.0.100/phpmyadmin/ e accedere con il nome utente root e la tua nuova password MySQL di root.

Il server perfetto - Fedora 15 x86_64 [ISPConfig 3] - Pagina 5

15 Installa Amavisd-new, SpamAssassin e ClamAV

Per installare amavisd-new, spamassassin e clamav, eseguire il comando seguente:

yum install amavisd-new spamassassin clamav clamav-data clamav-server clamav-update unzip bzip2 perl-DBD-mysql

Quando abbiamo installato ClamAV, è stato installato un cron job che tenta di aggiornare il database dei virus ClamAV ogni tre ore. Ma funziona solo se lo abilitiamo in /etc/sysconfig/freshclam e /etc/freshclam.conf:

vi /etc/sysconfig/freshclam

Commenta la riga FRESHCLAM_DELAY alla fine:

## When changing the periodicity of freshclam runs in the crontab,
## this value must be adjusted also. Its value is the timespan between
## two subsequent freshclam runs in minutes. E.g. for the default
##
## | 0 */3 * * *  ...
##
## crontab line, the value is 180 (minutes).
# FRESHCLAM_MOD=

## A predefined value for the delay in seconds. By default, the value is
## calculated by the 'hostid' program. This predefined value guarantees
## constant timespans of 3 hours between two subsequent freshclam runs.
##
## This option accepts two special values:
## 'disabled-warn'  ...  disables the automatic freshclam update and
##                         gives out a warning
## 'disabled'       ...  disables the automatic freshclam silently
# FRESHCLAM_DELAY=


### !!!!! REMOVE ME !!!!!!
### REMOVE ME: By default, the freshclam update is disabled to avoid
### REMOVE ME: network access without prior activation
#FRESHCLAM_DELAY=disabled-warn  # REMOVE ME

vi /etc/freshclam.conf

Commenta la riga di esempio:

[...]
# Comment or remove the line below.
#Example
[...]

Quindi iniziamo freshclam, amavisd e clamd...

sa-update
chkconfig --levels 235 amavisd su
chkconfig --levels 235 clamd.amavisd su
/usr/bin/freshclam
/etc/init.d/amavisd start
/etc/init.d/clamd.amavisd start

Quindi fai questo:

rm -f /var/spool/amavisd/clamd.sock
mkdir /var/run/clamav.amavisd /var/run/clamd.amavisd /var/run/amavisd
chown amavis /var/run /clamav.amavisd
chown amavis /var/run/clamd.amavisd
chown amavis /var/run/amavisd
ln -sf /var/spool/amavisd/clamd.sock /var/ run/clamav.amavisd/clamd.sock
ln -sf /var/spool/amavisd/clamd.sock /var/run/clamd.amavisd/clamd.sock
/etc/init.d/clamd .amavisd riavvia

Fedora 15 ha una directory /run per la memorizzazione dei dati di runtime. /run è ora un tmpfs, e /var/run e /var/lock sono ora collegati a /run e /run/lock da tmpfs, e quindi svuotati al riavvio (vedi https://docs.fedoraproject.org/en -US/Fedora/15/html/Release_Notes/sect-Release_Notes-Changes_for_SysAdmin.html per maggiori dettagli).

Ciò significa che dopo un riavvio, le directory /var/run/clamav.amavisd, /var/run/clamd.amavisd e /var/run/amavisd che abbiamo appena creato non esisteranno più, e quindi clamd e amavisd saranno non si avvia. Quindi creiamo ora il file /etc/tmpfiles.d/amavisd.conf che creerà queste directory all'avvio del sistema (vedi http://0pointer.de/public/systemd-man/tmpfiles.d.html per maggiori dettagli):

vi /etc/tmpfiles.d/amavisd.conf

D /var/run/clamav.amavisd 0755 amavis root -
D /var/run/clamd.amavisd 0755 amavis root -
D /var/run/amavisd 0755 amavis root -

16 Installazione di mod_php, mod_fcgi/PHP5 e suPHP

ISPConfig 3 consente di utilizzare mod_php, mod_fcgi/PHP5, cgi/PHP5 e suPHP in base al sito Web.

Possiamo installare Apache2 con mod_php5, mod_fcgid e PHP5 come segue:

yum install php php-devel php-gd php-imap php-ldap php-mysql php-odbc php-pear php-xml php-xmlrpc php-mbstring php-mcrypt php-mssql php-snmp php-soap php-tidy curl curl-devel perl-libwww-perl ImageMagick libxml2 libxml2-devel mod_fcgid php-cli httpd-devel

Quindi apriamo /etc/php.ini...

vi /etc/php.ini

... e cambia la segnalazione degli errori (in modo che gli avvisi non vengano più mostrati) e decommenta cgi.fix_pathinfo=1:

[...]
;error_reporting = E_ALL & ~E_DEPRECATED
error_reporting = E_ALL & ~E_NOTICE
[...]
; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI.  PHP's
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
; what PATH_INFO is.  For more information on PATH_INFO, see the cgi specs.  Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec.  A setting
; of zero causes PHP to behave as before.  Default is 1.  You should fix your scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; http://www.php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo
cgi.fix_pathinfo=1
[...]

Quindi installiamo suPHP:

cd /tmp
wget http://www.suphp.org/download/suphp-0.7.1.tar.gz
tar xvfz suphp-0.7.1.tar.gz
cd suphp -0.7.1/
./configure --prefix=/usr --sysconfdir=/etc --with-apr=/usr/bin/apr-1-config --with-apxs=/usr/sbin /apxs --with-apache-user=apache --with-setid-mode=owner --with-php=/usr/bin/php-cgi --with-logfile=/var/log/httpd/suphp_log -- enable-SUPHP_USE_USERGROUP=yes
make
make install

Then we add the suPHP module to our Apache configuration...

vi /etc/httpd/conf.d/suphp.conf

LoadModule suphp_module modules/mod_suphp.so

... and create the file /etc/suphp.conf as follows:

vi /etc/suphp.conf

[global]
;Path to logfile
logfile=/var/log/httpd/suphp.log

;Loglevel
loglevel=info

;User Apache is running as
webserver_user=apache

;Path all scripts have to be in
docroot=/

;Path to chroot() to before executing script
;chroot=/mychroot

; Security options
allow_file_group_writeable=true
allow_file_others_writeable=false
allow_directory_group_writeable=true
allow_directory_others_writeable=false

;Check wheter script is within DOCUMENT_ROOT
check_vhost_docroot=true

;Send minor error messages to browser
errors_to_browser=false

;PATH environment variable
env_path=/bin:/usr/bin

;Umask to set, specify in octal notation
umask=0077

; Minimum UID
min_uid=100

; Minimum GID
min_gid=100

[handlers]
;Handler for php-scripts
x-httpd-suphp="php:/usr/bin/php-cgi"

;Handler for CGI-scripts
x-suphp-cgi="execute:!self"

Finally we restart Apache:

/etc/init.d/httpd restart

16.1 Ruby

Starting with version 3.0.3, ISPConfig 3 has built-in support for Ruby. Instead of using CGI/FastCGI, ISPConfig depends on mod_ruby being available in the server's Apache.

For Fedora 15, there's no mod_ruby package available, so we must compile it ourselves. First we install some prerequisites:

yum install ruby ruby-devel

Next we download and install mod_ruby as follows:

cd /tmp
wget http://modruby.net/archive/mod_ruby-1.3.0.tar.gz
tar zxvf mod_ruby-1.3.0.tar.gz
cd mod_ruby-1.3.0/
./configure.rb --with-apr-includes=/usr/include/apr-1
make
make install

Finally we must add the mod_ruby module to the Apache configuration, so we create the file /etc/httpd/conf.d/ruby.conf...

vi /etc/httpd/conf.d/ruby.conf

LoadModule ruby_module modules/mod_ruby.so
RubyAddPath /1.8

... and restart Apache:

/etc/init.d/httpd restart

(If you leave out the RubyAddPath /1.8 directive, you will see errors like the following ones in Apache's error log when you call Ruby files:

[Thu May 26 02:05:05 2011] [error] mod_ruby:ruby:0:in `require':no such file to load -- apache/ruby-run (LoadError)
[Thu May 26 02:05:05 2011] [error] mod_ruby:failed to require apache/ruby-run
[Thu May 26 02:05:05 2011] [error] mod_ruby:error in ruby

)

16.2 WebDAV

WebDAV should already be enabled, but to check this, open /etc/httpd/conf/httpd.conf and make sure that the following three modules are active:

vi /etc/httpd/conf/httpd.conf

[...]
LoadModule auth_digest_module modules/mod_auth_digest.so
[...]
LoadModule dav_module modules/mod_dav.so
[...]
LoadModule dav_fs_module modules/mod_dav_fs.so
[...]

If you have to modify /etc/httpd/conf/httpd.conf, don't forget to restart Apache afterwards:

/etc/init.d/httpd restart 

17 Install PureFTPd

PureFTPd can be installed with the following command:

yum install pure-ftpd

Then create the system startup links and start PureFTPd:

chkconfig --levels 235 pure-ftpd on
/etc/init.d/pure-ftpd start

Now we configure PureFTPd to allow FTP and TLS sessions. FTP is a very insecure protocol because all passwords and all data are transferred in clear text. By using TLS, the whole communication can be encrypted, thus making FTP much more secure.

OpenSSL is needed by TLS; to install OpenSSL, we simply run:

yum install openssl

Open /etc/pure-ftpd/pure-ftpd.conf...

vi /etc/pure-ftpd/pure-ftpd.conf

If you want to allow FTP and TLS sessions, set TLS to 1:

[...]
# This option can accept three values :
# 0 : disable SSL/TLS encryption layer (default).
# 1 : accept both traditional and encrypted sessions.
# 2 : refuse connections that don't use SSL/TLS security mechanisms,
#     including anonymous sessions.
# Do _not_ uncomment this blindly. Be sure that :
# 1) Your server has been compiled with SSL/TLS support (--with-tls),
# 2) A valid certificate is in place,
# 3) Only compatible clients will log in.

TLS                      1
[...]

In order to use TLS, we must create an SSL certificate. I create it in /etc/ssl/private/, therefore I create that directory first:

mkdir -p /etc/ssl/private/

Afterwards, we can generate the SSL certificate as follows:

openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem

Country Name (2 letter code) [XX]:<-- Enter your Country Name (e.g., "DE").
State or Province Name (full name) []:<-- Enter your State or Province Name.
Locality Name (eg, city) [Default City]:<-- Enter your City.
Organization Name (eg, company) [Default Company Ltd]:<-- Enter your Organization Name (e.g., the name of your company).
Organizational Unit Name (eg, section) []:<-- Enter your Organizational Unit Name (e.g. "IT Department").
Common Name (eg, your name or your server's hostname) []:<-- Enter the Fully Qualified Domain Name of the system (e.g. "server1.example.com").
Email Address []:<-- Enter your Email Address.

Change the permissions of the SSL certificate:

chmod 600 /etc/ssl/private/pure-ftpd.pem

Finally restart PureFTPd:

 /etc/init.d/pure-ftpd restart

Questo è tutto. You can now try to connect using your FTP client; however, you should configure your FTP client to use TLS.

18 Install BIND

We can install BIND as follows:

yum install bind bind-utils

Next open /etc/sysconfig/named...

vi /etc/sysconfig/named

... and comment out the ROOTDIR=/var/named/chroot line:

# BIND named process options
# ~~~~~~~~~~~~~~~~~~~~~~~~~~
# Currently, you can use the following options:
#
# ROOTDIR="/var/named/chroot"  --  will run named in a chroot environment.
#                            you must set up the chroot environment
#                            (install the bind-chroot package) before
#                            doing this.
#       NOTE:
#         Those directories are automatically mounted to chroot if they are
#         empty in the ROOTDIR directory. It will simplify maintenance of your
#         chroot environment.
#          - /var/named
#          - /etc/pki/dnssec-keys
#          - /etc/named
#          - /usr/lib64/bind or /usr/lib/bind (architecture dependent)
#
#         Those files are mounted as well if target file doesn't exist in
#         chroot.
#          - /etc/named.conf
#          - /etc/rndc.conf
#          - /etc/rndc.key
#          - /etc/named.rfc1912.zones
#          - /etc/named.dnssec.keys
#          - /etc/named.iscdlv.key
#
#       Don't forget to add "$AddUnixListenSocket /var/named/chroot/dev/log"
#       line to your /etc/rsyslog.conf file. Otherwise your logging becomes
#       broken when rsyslogd daemon is restarted (due update, for example).
#
# OPTIONS="whatever"     --  These additional options will be passed to named
#                            at startup. Don't add -t here, use ROOTDIR instead.
#
# KEYTAB_FILE="/dir/file"    --  Specify named service keytab file (for GSS-TSIG)
#
# DISABLE_ZONE_CHECKING  -- By default, initscript calls named-checkzone
#                           utility for every zone to ensure all zones are
#                           valid before named starts. If you set this option
#                           to 'yes' then initscript doesn't perform those
#                           checks.
#ROOTDIR=/var/named/chroot

Then we create the startup links:

chkconfig --levels 235 named on

We don't start BIND now because it must be configured first - this will be done automatically by the ISPConfig 3 installer later on.

19 Install Vlogger, Webalizer, And AWStats

Vlogger, webalizer, and AWStats can be installed as follows:

yum install webalizer awstats perl-DateTime-Format-HTTP perl-DateTime-Format-Builder

cd /tmp
wget http://n0rp.chemlab.org/vlogger/vlogger-1.3.tar.gz
tar xvfz vlogger-1.3.tar.gz
mv vlogger-1.3/vlogger /usr/sbin/
rm -rf vlogger*

20 Install Jailkit

Jailkit is needed only if you want to chroot SSH users. It can be installed as follows (important:Jailkit must be installed before ISPConfig - it cannot be installed afterwards!):

cd /tmp
wget http://olivier.sessink.nl/jailkit/jailkit-2.14.tar.gz
tar xvfz jailkit-2.14.tar.gz
cd jailkit-2.14
./configure
make
make install
cd ..
rm -rf jailkit-2.14*

21 Install fail2ban

This is optional but recommended, because the ISPConfig monitor tries to show the log:

yum install fail2ban

chkconfig --levels 235 fail2ban on
/etc/init.d/fail2ban start

22 Install rkhunter

rkhunter can be installed as follows:

yum install rkhunter

The Perfect Server - Fedora 15 x86_64 [ISPConfig 3] - Page 6

23 Install SquirrelMail

To install the SquirrelMail webmail client, run...

yum install squirrelmail

... and restart Apache:

/etc/init.d/httpd restart

Then configure SquirrelMail:

/usr/share/squirrelmail/config/conf.pl

We must tell SquirrelMail that we are using Courier-IMAP/-POP3:

SquirrelMail Configuration : Read: config.php (1.4.0)
---------------------------------------------------------
Main Menu --
1.  Organization Preferences
2.  Server Settings
3.  Folder Defaults
4.  General Options
5.  Themes
6.  Address Books
7.  Message of the Day (MOTD)
8.  Plugins
9.  Database
10. Languages

D.  Set pre-defined settings for specific IMAP servers

C   Turn color off
S   Save data
Q   Quit

Command >> <-- D


SquirrelMail Configuration : Read: config.php
---------------------------------------------------------
While we have been building SquirrelMail, we have discovered some
preferences that work better with some servers that don't work so
well with others.  If you select your IMAP server, this option will
set some pre-defined settings for that server.

Please note that you will still need to go through and make sure
everything is correct.  This does not change everything.  There are
only a few settings that this will change.

Please select your IMAP server:
    bincimap    = Binc IMAP server
    courier     = Courier IMAP server
    cyrus       = Cyrus IMAP server
    dovecot     = Dovecot Secure IMAP server
    exchange    = Microsoft Exchange IMAP server
    hmailserver = hMailServer
    macosx      = Mac OS X Mailserver
    mercury32   = Mercury/32
    uw          = University of Washington's IMAP server
    gmail       = IMAP access to Google mail (Gmail) accounts

    quit        = Do not change anything
Command >> <-- courier


SquirrelMail Configuration : Read: config.php
---------------------------------------------------------
While we have been building SquirrelMail, we have discovered some
preferences that work better with some servers that don't work so
well with others.  If you select your IMAP server, this option will
set some pre-defined settings for that server.

Please note that you will still need to go through and make sure
everything is correct.  This does not change everything.  There are
only a few settings that this will change.

Please select your IMAP server:
    bincimap    = Binc IMAP server
    courier     = Courier IMAP server
    cyrus       = Cyrus IMAP server
    dovecot     = Dovecot Secure IMAP server
    exchange    = Microsoft Exchange IMAP server
    hmailserver = hMailServer
    macosx      = Mac OS X Mailserver
    mercury32   = Mercury/32
    uw          = University of Washington's IMAP server
    gmail       = IMAP access to Google mail (Gmail) accounts

    quit        = Do not change anything
Command >> courier

              imap_server_type = courier
         default_folder_prefix = INBOX.
                  trash_folder = Trash
                   sent_folder = Sent
                  draft_folder = Drafts
            show_prefix_option = false
          default_sub_of_inbox = false
show_contain_subfolders_option = false
            optional_delimiter = .
                 delete_folder = true

Press any key to continue... <-- press ENTER


SquirrelMail Configuration : Read: config.php (1.4.0)
---------------------------------------------------------
Main Menu --
1.  Organization Preferences
2.  Server Settings
3.  Folder Defaults
4.  General Options
5.  Themes
6.  Address Books
7.  Message of the Day (MOTD)
8.  Plugins
9.  Database
10. Languages

D.  Set pre-defined settings for specific IMAP servers

C   Turn color off
S   Save data
Q   Quit

Command >> <--S


SquirrelMail Configuration : Read: config.php (1.4.0)
---------------------------------------------------------
Main Menu --
1.  Organization Preferences
2.  Server Settings
3.  Folder Defaults
4.  General Options
5.  Themes
6.  Address Books
7.  Message of the Day (MOTD)
8.  Plugins
9.  Database
10. Languages

D.  Set pre-defined settings for specific IMAP servers

C   Turn color off
S   Save data
Q   Quit

Command >> <--Q

One last thing we need to do is modify the file /etc/squirrelmail/config_local.php and comment out the $default_folder_prefix variable - if you don't do this, you will see the following error message in SquirrelMail after you've logged in:Query:CREATE "Sent" Reason Given:Invalid mailbox name.

vi /etc/squirrelmail/config_local.php

<?php

/**
 * Local config overrides.
 *
 * You can override the config.php settings here.
 * Don't do it unless you know what you're doing.
 * Use standard PHP syntax, see config.php for examples.
 *
 * @copyright &copy; 2002-2006 The SquirrelMail Project Team
 * @license http://opensource.org/licenses/gpl-license.php GNU Public License
 * @version $Id$
 * @package squirrelmail
 * @subpackage config
 */

//$default_folder_prefix                = '';
?>

Now you can type in http://server1.example.com/webmail or http://192.168.0.100/webmail in your browser to access SquirrelMail.

24 Install ISPConfig 3

To install ISPConfig 3 from the latest released version, do this:

cd /tmp
wget http://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gz
tar xfz ISPConfig-3-stable.tar.gz
cd ispconfig3_install/install/

The next step is to run

php -q install.php

This will start the ISPConfig 3 installer:

[[email protected] install]# php -q install.php


--------------------------------------------------------------------------------
 _____ ___________   _____              __ _         ____
|_   _/  ___| ___ \ /  __ \            / _(_)       /__  \
  | | \ `--.| |_/ / | /  \/ ___  _ __ | |_ _  __ _    _/ /
  | | `--. \  __/  | | / _ \| '_ \| _| |/ _` | |_ |
 _| |_/\__/ / | | \__/\ (_) | | | | | | | (_| | ___\ \
 \___/\____/\_|      \____/\___/|_| |_|_| |_|\__, | \____/
                                              __/ |
                                             |___/
--------------------------------------------------------------------------------


>> Initial configuration

Operating System: Redhat or compatible, unknown version.

    Following will be a few questions for primary configuration so be careful.
    Default values are in [brackets] and can be accepted with .
    Tap in "quit" (without the quotes) to stop the installer.


Select language (en,de) [en]: <-- ENTER

Installation mode (standard,expert) [standard]: <-- ENTER

Full qualified hostname (FQDN) of the server, eg server1.domain.tld  [server1.example.com]: <-- ENTER

MySQL server hostname [localhost]: <-- ENTER

MySQL root username [root]: <-- ENTER

MySQL root password []:  <-- yourrootsqlpassword

MySQL database to create [dbispconfig]: <-- ENTER

MySQL charset [utf8]: <-- ENTER

Generating a 2048 bit RSA private key
......+++
...............+++
writing new private key to 'smtpd.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]: <-- ENTER
State or Province Name (full name) []: <-- ENTER
Locality Name (eg, city) [Default City]: <-- ENTER
Organization Name (eg, company) [Default Company Ltd]: <-- ENTER
Organizational Unit Name (eg, section) []: <-- ENTER
Common Name (eg, your name or your server's hostname) []: <-- E NTER
Email Address []: <-- ENTER
Configuring Jailkit
Configuring SASL
Configuring PAM
Configuring Courier
Configuring Spamassassin
Configuring Amavisd
Configuring Getmail
Configuring Pureftpd
Configuring BIND
Configuring Apache
Configuring Vlogger
Configuring Apps vhost
Configuring Firewall
Installing ISPConfig
ISPConfig Port [8080]: <-- ENTER

Configuring DBServer
Installing ISPConfig crontab
no crontab for root
no crontab for getmail
Restarting services ...
Restarting mysqld (via systemctl):                         [  OK  ]
Restarting postfix (via systemctl):                        [  OK  ]
Restarting saslauthd (via systemctl):                      [  OK  ]
Restarting amavisd (via systemctl):                        [  OK  ]
Restarting clamd.amavisd (via systemctl):                  [  OK  ]
Stopping Courier authentication services: authdaemond
Starting Courier authentication services: authdaemond
Stopping Courier-IMAP server: imap imap-ssl pop3 pop3-ssl
Starting Courier-IMAP server: imap generating-SSL-certificate... imap-ssl pop3 generating-SSL-certificate... pop3-ssl
Stopping Courier-IMAP server: imap imap-ssl pop3 pop3-ssl
Starting Courier-IMAP server: imap imap-ssl pop3 pop3-ssl
Stopping Courier-IMAP server: imap imap-ssl pop3 pop3-ssl
Starting Courier-IMAP server: imap imap-ssl pop3 pop3-ssl
Stopping Courier-IMAP server: imap imap-ssl pop3 pop3-ssl
Starting Courier-IMAP server: imap imap-ssl pop3 pop3-ssl
Restarting httpd (via systemctl):                          [  OK  ]
Restarting pure-ftpd (via systemctl):                      [  OK  ]
Installation completed.
[[email protected] install]#

Il programma di installazione configura automaticamente tutti i servizi sottostanti, quindi non è necessaria alcuna configurazione manuale.

Afterwards you can access ISPConfig 3 under http://server1.example.com:8080/ or http://192.168.0.100:8080/. Accedi con il nome utente admin e la password admin (dovresti cambiare la password predefinita dopo il primo accesso):

The system is now ready to be used.

24.1 ISPConfig 3 Manual

In order to learn how to use ISPConfig 3, I strongly recommend to download the ISPConfig 3 Manual.

On about 300 pages, it covers the concept behind ISPConfig (admin, resellers, clients), explains how to install and update ISPConfig 3, includes a reference for all forms and form fields in ISPConfig together with examples of valid inputs, and provides tutorials for the most common tasks in ISPConfig 3. It also lines out how to make your server more secure and comes with a troubleshooting section at the end.

24.2 ISPConfig Monitor App For Android

With the ISPConfig Monitor App, you can check your server status and find out if all services are running as expected. You can check TCP and UDP ports and ping your servers. In addition to that you can use this app to request details from servers that have ISPConfig installed (please note that the minimum installed ISPConfig 3 version with support for the ISPConfig Monitor App is 3.0.3.3! ); these details include everything you know from the Monitor module in the ISPConfig Control Panel (e.g. services, mail and system logs, mail queue, CPU and memory info, disk usage, quota, OS details, RKHunter log, etc.), and of course, as ISPConfig is multiserver-capable, you can check all servers that are controlled from your ISPConfig master server.

For download and usage instructions, please visit http://www.ispconfig.org/ispconfig-3/ispconfig-monitor-app-for-android/.

25 Links

• Fedora:http://fedoraproject.org/
• Network Device Naming:http://fedoraproject.org/wiki/Features/ConsistentNetworkDeviceNaming
• /run directory:https://docs.fedoraproject.org/en-US/Fedora/15/html/Release_Notes/sect-Release_Notes-Changes_for_SysAdmin.html
• tmpfiles.d:http://0pointer.de/public/systemd-man/tmpfiles.d.html
• ISPConfig:http://www.ispconfig.org/