The Perfect Server -
The Perfect Server -
14 Set MySQL Passwords And Configure phpMyAdmin
Start MySQL:
chkconfig --levels 235 mysqld on /etc/init.d/mysqld start
Then set passwords for the MySQL root account:
mysqladmin -u root password yourrootsqlpassword mysqladmin -h server1.example.com -u root password yourrootsqlpassword
Now we configure phpMyAdmin. We change the Apache configuration so that phpMyAdmin allows connections not just from localhost (by commenting out the <Directory "/usr/share/phpmyadmin"> stanza):
vi /etc/httpd/conf.d/phpmyadmin.conf
# # Web application to manage MySQL # #<Directory "/usr/share/phpmyadmin"> # Order Deny,Allow # Deny from all # Allow from 127.0.0.1 #</Directory> Alias /phpmyadmin /usr/share/phpmyadmin Alias /phpMyAdmin /usr/share/phpmyadmin Alias /mysqladmin /usr/share/phpmyadmin |
|---|
Next we change the authentication in phpMyAdmin from cookie to http:
vi /usr/share/phpmyadmin/config.inc.php
[...] /* Authentication type */ $cfg['Servers'][$i]['auth_type'] = 'http'; [...] |
|---|
Then we create the system startup links for Apache and start it:
chkconfig --levels 235 httpd on /etc/init.d/httpd start
Now you can direct your browser to http://server1.example.com/phpmyadmin/ or http://192.168.0.100/phpmyadmin/ and log in with the user name root and your new root MySQL password.
15 Install Amavisd-new, SpamAssassin And ClamAV
To install amavisd-new, spamassassin and clamav, run the following command:
yum install amavisd-new spamassassin clamav clamd unzip bzip2 unrar perl-DBD-mysql
Then we start freshclam, amavisd, and clamd...
chkconfig --levels 235 amavisd on chkconfig --levels 235 clamd on /usr/bin/freshclam /etc/init.d/amavisd start /etc/init.d/clamd start
... and create some necessary directories:
mkdir /var/run/amavisd /var/spool/amavisd /var/spool/amavisd/tmp /var/spool/amavisd/db chown amavis /var/run/amavisd /var/spool/amavisd /var/spool/amavisd/tmp /var/spool/amavisd/db
16 Installing Apache2 With mod_php, mod_fcgi/PHP5, And suPHP
ISPConfig 3 allows you to use mod_php, mod_fcgi/PHP5, cgi/PHP5, and suPHP on a per website basis.
mod_fcgid is not available in the official CentOS repositories, but there's a package for CentOS 5.x in the centos.karan.org testing repository. We enable the repository as follows:
cd /etc/yum.repos.d/ wget http://centos.karan.org/kbsingh-CentOS-Extras.repo
Next we open /etc/yum.repos.d/kbsingh-CentOS-Extras.repo...
vi /etc/yum.repos.d/kbsingh-CentOS-Extras.repo
... and set gpgcheck to 0 and enabled to 1 in the [kbs-CentOS-Testing] section:
[...] [kbs-CentOS-Testing] name=CentOS.Karan.Org-EL$releasever - Testing gpgcheck=0 gpgkey=http://centos.karan.org/RPM-GPG-KEY-karan.org.txt enabled=1 baseurl=http://centos.karan.org/el$releasever/extras/testing/$basearch/RPMS/ |
|---|
Afterwards we can install Apache2with mod_php5, mod_fcgid, and PHP5:
yum install php php-devel php-gd php-imap php-ldap php-mysql php-odbc php-pear php-xml php-xmlrpc php-eaccelerator php-mbstring php-mcrypt php-mhash php-mssql php-snmp php-soap php-tidy curl curl-devel perl-libwww-perl ImageMagick libxml2 libxml2-devel mod_fcgid php-cli httpd-devel
Next we open /etc/php.ini...
vi /etc/php.ini
... and change the error reporting (so that notices aren't shown any longer) and add cgi.fix_pathinfo = 1 at the end of the file:
[...] ;error_reporting = E_ALL error_reporting = E_ALL & ~E_NOTICE [...] cgi.fix_pathinfo = 1 |
|---|
Next we install suPHP:
cd /tmp wget http://www.suphp.org/download/suphp-0.7.0.tar.gz tar xvfz suphp-0.7.0.tar.gz cd suphp-0.7.0/ ./configure --prefix=/usr --sysconfdir=/etc --with-apr=/usr/bin/apr-1-config --with-apxs=/usr/sbin/apxs --with-apache-user=apache --with-setid-mode=owner --with-php=/usr/bin/php-cgi --with-logfile=/var/log/httpd/suphp_log --enable-SUPHP_USE_USERGROUP=yes make make install
Then we add the suPHP module to our Apache configuration...
vi /etc/httpd/conf.d/suphp.conf
LoadModule suphp_module modules/mod_suphp.so |
|---|
... and create the file /etc/suphp.conf as follows:
vi /etc/suphp.conf
[global] ;Path to logfile logfile=/var/log/httpd/suphp.log ;Loglevel loglevel=info ;User Apache is running as webserver_user=apache ;Path all scripts have to be in docroot=/ ;Path to chroot() to before executing script ;chroot=/mychroot ; Security options allow_file_group_writeable=true allow_file_others_writeable=false allow_directory_group_writeable=true allow_directory_others_writeable=false ;Check wheter script is within DOCUMENT_ROOT check_vhost_docroot=true ;Send minor error messages to browser errors_to_browser=false ;PATH environment variable env_path=/bin:/usr/bin ;Umask to set, specify in octal notation umask=0077 ; Minimum UID min_uid=100 ; Minimum GID min_gid=100 [handlers] ;Handler for php-scripts x-httpd-suphp="php:/usr/bin/php-cgi" ;Handler for CGI-scripts x-suphp-cgi="execute:!self" |
|---|
Finally we restart Apache:
/etc/init.d/httpd restart
17 Install PureFTPd
PureFTPd can be installed with the following command:
yum install pure-ftpd
Then create the system startup links and start PureFTPd:
chkconfig --levels 235 pure-ftpd on /etc/init.d/pure-ftpd start
18 Install MyDNS
We can install MyDNS as follows:
wget http://mydns.bboy.net/download/mydns-mysql-1.1.0-1.i386.rpm rpm -ivh mydns-mysql-1.1.0-1.i386.rpm
When the system boots, MyDNS must be started after MySQL. The MySQL startup link has the priority 64 on CentOS, so the MyDNS startup link must have a priority between 65 and 99. Therefore we open the MyDNS init script...
vi /etc/init.d/mydns
... and change
[...] # chkconfig: 345 52 50 [...] |
|---|
to
[...] # chkconfig: 345 65 50 [...] |
|---|
Then we create the startup links:
chkconfig --levels 235 mydns on
We don't start MyDNS now because it must be configured first - this will be done automatically by the ISPConfig 3 installer later on.
19 Install Vlogger And Webalizer
Vlogger and webalizer can be installed as follows:
yum install webalizer perl-DateTime-Format-HTTP perl-DateTime-Format-Builder
cd /tmp wget http://n0rp.chemlab.org/vlogger/vlogger-1.3.tar.gz tar xvfz vlogger-1.3.tar.gz mv vlogger-1.3/vlogger /usr/sbin/ rm -rf vlogger*
20 Install Jailkit
Jailkit is needed only if you want to chroot SSH users. It can be installed as follows (important: Jailkit must be installed before ISPConfig - it cannot be installed afterwards!):
cd /tmp wget http://olivier.sessink.nl/jailkit/jailkit-2.5.tar.gz tar xvfz jailkit-2.5.tar.gz cd jailkit-2.5 ./configure make make install rm -rf jailkit-2.5*
21 Install fail2ban
This is optional but recommended, because the ISPConfig monitor tries to show the log:
yum install fail2ban
chkconfig --levels 235 fail2ban on /etc/init.d/fail2ban start
22 Install rkhunter
rkhunter can be installed as follows:
yum install rkhunter