ISPconfig: Difference between revisions

From ICO wiki
Jump to navigationJump to search
 
(32 intermediate revisions by the same user not shown)
Line 4: Line 4:


=Sissejuhatus=
=Sissejuhatus=
ISPConfig on vabavaraline sisumajutuse juhtpaneel Linuxile. Sellega on võimalik hallata mitmeid servereid ühest juhtpaneelist. Võimaldab veebiserveri, meiliserveri, DNS serveri haldamist, virtualiseerimist ja andmete sünkroonse dubleerimise konfiguratsiooni (andmete peegeldamist) arvutivõrgus ning klasterdamist.  
ISPConfig on vabavaraline sisumajutuse juhtpaneel Linuxile. Sellega on võimalik hallata mitmeid servereid ühest juhtpaneelist. Võimaldab veebiserveri, meiliserveri, DNS serveri haldamist, virtualiseerimist ja andmete sünkroonse dubleerimise konfiguratsiooni (andmete peegeldamist) arvutivõrgus ning klasterdamist. [1]
Sellel tarkvaral on 4 sisselogimise taset: administraatori, edasimüüja, kliendi ja e-maili kasutaja tase. 


Sellel tarkvaral on 3 sisselogimise taset: administraatori, edasimüüja ja kliendi tase.  [1]
==Millele on ISPconfig toetatud?==
==Millele on ISPconfig toetatud?==
Toetatud tarkvara:
Toetatud tarkvara:
Line 30: Line 30:


*Veendu, et oled administraatori õigustes sudo –i
*Veendu, et oled administraatori õigustes sudo –i
*Tee kindlaks, kas OpenSSH on paigaldatud apt-cache policy openssh-server
*Tee kindlaks, kas OpenSSH on paigaldatud  
<source lang="bash">
apt-cache policy openssh-server
</source>
Kui ei ole, siis  
Kui ei ole, siis  
<source lang="bash">
<source lang="bash">
Line 52: Line 55:
</source>
</source>


*Nano /etc/hosts failis tuleb ära määrata server
*nano /etc/hosts failis tuleb ära määrata server
<source lang="bash">
<source lang="bash">
127.0.0.1      localhost
127.0.0.1      localhost
Line 113: Line 116:
[3]
[3]


==Postfix’i, Dovecot’o, MySQL’i, phpMyAdmin’i, rkhunter’i, binutils’i paigaldus==
==Postfix’i, Dovecot’i, MySQL’i, phpMyAdmin’i, rkhunter’i, binutils’i paigaldus==
*Postfix’i paigalduseks on vaja peatada ja eemaldada sendmail
*Postfix’i paigalduseks on vaja peatada ja eemaldada sendmail
<source lang="bash">
<source lang="bash">
Line 169: Line 172:
</source>   
</source>   


*Kuna on vaja, et MySql oleks ühenduses kõikide sisenditega, mitte ainult localhost’iga, seepärast on vajalik  nano /etc/mysql/my.cnf välja kommenteerida bind-address = 127.0.0.1
*Kuna on vaja, et MySql oleks ühenduses kõikide sisenditega, mitte ainult localhost’ga, seepärast on vajalik  nano /etc/mysql/my.cnf välja kommenteerida bind-address = 127.0.0.1
<source lang="bash">
<source lang="bash">
nano /etc/mysql/my.cnf
nano /etc/mysql/my.cnf
Line 181: Line 184:
</source>   
</source>   


*Seejärel on vaja MySQL’ile taaskäivitus teha:
*Seejärel on vaja MySQL’le taaskäivitus teha:
<source lang="bash">
<source lang="bash">
service mysql restart
service mysql restart
</source>   
</source>   


*Nüüd tuleb kindlaks teha, kas värgundus on lubatud.
*Nüüd tuleb kindlaks teha, kas võrgundus on lubatud.
<source lang="bash">
<source lang="bash">
netstat -tap | grep mysql
netstat -tap | grep mysql
Line 204: Line 207:
apt-get install amavisd-new spamassassin clamav clamav-daemon zoo unzip bzip2 arj nomarch lzop cabextract apt-listchanges libnet-ldap-perl libauthen-sasl-perl clamav-docs daemon libio-string-perl libio-socket-ssl-perl libnet-ident-perl zip libnet-dns-perl
apt-get install amavisd-new spamassassin clamav clamav-daemon zoo unzip bzip2 arj nomarch lzop cabextract apt-listchanges libnet-ldap-perl libauthen-sasl-perl clamav-docs daemon libio-string-perl libio-socket-ssl-perl libnet-ident-perl zip libnet-dns-perl
</source>   
</source>   
See on vajalik sisukontrolliks, et ei tuleks viiruseid või rämpsposti.


*ISPConfig 3 kasutab amavisd mis laeb SpamAssassin filtri jooksvalt, seepärast on parem kui SpamAssassin oleks peatatud, et RAM’i ruumi vabastada.
*ISPConfig 3 kasutab amavisd, mis laeb SpamAssassin filtri jooksvalt, seepärast on parem, kui SpamAssassin oleks peatatud, et RAM’i ruumi vabastada.
<source lang="bash">
<source lang="bash">
service spamassassin stop
service spamassassin stop
update-rc.d -f spamassassin remove
update-rc.d -f spamassassin remove
</source>
</source>
[4]


== Apache2, PHP5, phpMyAdmin, FCGI, suExec, Pear ja mcrypt paigaldus==
== Apache2, PHP5, phpMyAdmin, FCGI, suExec, Pear ja mcrypt paigaldus==
Line 238: Line 243:
</source>   
</source>   


ja välja kommenteerida <FilesMatch "\.ph(p3?|tml)$"> sektsioon ja lisada rida AddType application/x-httpd-suphp .php .php3 .php4 .php5 .phtml – vastasel korral kõik PHP failed jooksevad SuPHP kaudu:
ja välja kommenteerida <FilesMatch "\.ph(p3?|tml)$"> sektsioon ja lisada rida AddType application/x-httpd-suphp .php .php3 .php4 .php5 .phtml – vastasel korral kõik PHP failid jooksevad SuPHP kaudu:
<source lang="bash">
<source lang="bash">
<IfModule mod_suphp.c>
<IfModule mod_suphp.c>
Line 282: Line 287:
<source lang="bash">
<source lang="bash">
service apache2 restart
service apache2 restart
</source>
</source>
[4]


 
==Xcache==
==Xcache==


Xcache on PHP opcode püüdja, püüdmaks ja optimeerimaks PHP vahekoodi.
Xcache on PHP opcode püüdja, püüdmaks ja optimeerimaks PHP vahekoodi.
Line 300: Line 305:
</source>   
</source>   
[4]
[4]
==PureFTPd ja Quota paigaldus==
==PureFTPd ja Quota paigaldus==


Line 333: Line 339:
</source>   
</source>   
<source lang="bash">
<source lang="bash">
Country Name (2 letter code) [AU]: <-- Enter your Country Name (e.g., "DE").
Country Name (2 letter code) [AU]: <-- Enter  
State or Province Name (full name) [Some-State]: <-- Enter your State or Province Name.
State or Province Name (full name) [Some-State]: <-- Enter
Locality Name (eg, city) []: <-- Enter your City.
Locality Name (eg, city) []: <-- Enter  
Organization Name (eg, company) [Internet Widgits Pty Ltd]: <-- Enter your Organization Name (e.g., the name of your company).
Organization Name (eg, company) [Internet Widgits Pty Ltd]: <-- Enter  
Organizational Unit Name (eg, section) []: <-- Enter your Organizational Unit Name (e.g. "IT Department").
Organizational Unit Name (eg, section) []: <-- Enter  
Common Name (eg, YOUR name) []: <-- puppet.planet.zz
Common Name (eg, YOUR name) []: <-- puppet.planet.zz
Email Address []: <-- Enter your Email Address.
Email Address []: <-- Enter  
</source>   
</source>   


Line 376: Line 382:
quotacheck -avugm  
quotacheck -avugm  
quotaon –avug
quotaon –avug
</source>
</source>
[5]


==BIND DNS Serveri paigaldus==
==BIND DNS Serveri paigaldus==
Line 383: Line 390:
<source lang="bash">
<source lang="bash">
apt-get install bind9 dnsutils
apt-get install bind9 dnsutils
</source>
</source>
[5]


==Vlogger’i, Webalizer’i ja AWstats’i paigaldus==
==Vlogger’i, Webalizer’i ja AWstats’i paigaldus==
Line 400: Line 408:
# Generate static reports:
# Generate static reports:
#10 03 * * * www-data [ -x /usr/share/awstats/tools/buildstatic.sh ] && /usr/share/awstats/tools/buildstatic.sh
#10 03 * * * www-data [ -x /usr/share/awstats/tools/buildstatic.sh ] && /usr/share/awstats/tools/buildstatic.sh
</source>
</source>
[5]


==Fail2ban’i paigaldamine==
==Fail2ban’i paigaldamine==
Line 436: Line 445:
</source>   
</source>   


Seejärel on vaja luua 2 filtri faili:
Seejärel on vaja luua kaks filtri faili:
<source lang="bash">
<source lang="bash">
nano /etc/fail2ban/filter.d/pureftpd.conf
nano /etc/fail2ban/filter.d/pureftpd.conf
Line 466: Line 475:


==SquirrelMail’i paigaldus==
==SquirrelMail’i paigaldus==
Selle kaudu on võimalik hiljem otse näha kõiki e-poste, mis tuleb veebilehtede kaudu.


*Käsureal paigaldada
*Käsureal paigaldada
Line 499: Line 510:
Command >> <-- D  
Command >> <-- D  


 
[...]
SquirrelMail Configuration : Read: config.php
---------------------------------------------------------
While we have been building SquirrelMail, we have discovered some
preferences that work better with some servers that don't work so
well with others. If you select your IMAP server, this option will
set some pre-defined settings for that server.
 
Please note that you will still need to go through and make sure
everything is correct.  This does not change everything.  There are
only a few settings that this will change.  


Please select your IMAP server:  
Please select your IMAP server:  
Line 526: Line 527:
Command >> <-- dovecot  
Command >> <-- dovecot  


 
[...]
SquirrelMail Configuration : Read: config.php
---------------------------------------------------------
While we have been building SquirrelMail, we have discovered some
preferences that work better with some servers that don't work so
well with others. If you select your IMAP server, this option will
set some pre-defined settings for that server.
 
Please note that you will still need to go through and make sure
everything is correct.  This does not change everything.  There are
only a few settings that this will change.  


Please select your IMAP server:  
Please select your IMAP server:  
Line 551: Line 542:


     quit        = Do not change anything  
     quit        = Do not change anything  
Command >> dovecot  
Command >> dovecot  


Line 613: Line 605:
</source>   
</source>   


*Nüüd kofigureerin SquirrelMail’i nii et seda saaks kasutada oma veebilehes, mis on loodud läbi ISPConfig’i kasutades /squirrelmail  või /webmail aliasi.
*Nüüd kofigureerin SquirrelMail’i nii, et seda saaks kasutada oma veebilehes, mis on loodud läbi ISPConfig’i kasutades /squirrelmail  või /webmail aliasi.
*SquirrelMail'i Apache konfiguratsioon on failis /etc/squirrelmail/apache.conf, aga see fail pole laetud Apache poolt, sest see pole /etc/apache2/conf-available/ kaustas. Seepärast loome symlingi nimega squirrelmail.conf  kausta /etc/apache2/conf-available/ mis viitab /etc/squirrelmail/apache.conf ja seejärel teen Apachele uuesti laadimise:
*SquirrelMail'i Apache konfiguratsioon on failis /etc/squirrelmail/apache.conf, aga see fail pole laetud Apache poolt, sest see pole /etc/apache2/conf-available/ kaustas. Seepärast loome symlingi nimega squirrelmail.conf  kausta /etc/apache2/conf-available/ mis viitab /etc/squirrelmail/apache.conf ja seejärel teen Apachele uuesti laadimise:
<source lang="bash">
<source lang="bash">
Line 623: Line 615:
*Nüüd tuleb avada /etc/apache2/conf-available/squirrelmail.conf
*Nüüd tuleb avada /etc/apache2/conf-available/squirrelmail.conf
<source lang="bash">
<source lang="bash">
Nano /etc/apache2/conf-available/squirrelmail.conf
nano /etc/apache2/conf-available/squirrelmail.conf
</source>   
</source>   
Ja lisada järgmised read <Directory/usr/share/squirrelmail></Directory>  konteinerisse, mis teeb kindlaks, et mod_php on kasutusel SquirrelMail’i pääsemiseks.
Ja lisada järgmised read <Directory/usr/share/squirrelmail></Directory>  konteinerisse, mis teeb kindlaks, et mod_php on kasutusel SquirrelMail’i pääsemiseks.
Line 667: Line 659:
</source>   
</source>   
Nüüd /etc/apache2/conf-available/squirrelmail.conf defineerib aliase nimega /squirrelmail mis viitab SquirrelMail'i paigaldamise asukohale /usr/share/squirrelmail.
Nüüd /etc/apache2/conf-available/squirrelmail.conf defineerib aliase nimega /squirrelmail mis viitab SquirrelMail'i paigaldamise asukohale /usr/share/squirrelmail.
[6]


==ISPConfig 3 paigaldus==
==ISPConfig 3 paigaldus==
Line 683: Line 677:
php -q install.php
php -q install.php
</source>   
</source>   
See alustab ISPConfig 3 paigaldust. Paigaldaja konfigureerib kõik teenused nagu Postfix’i, Dovecot’i, jne. ISPConfig’le sobivaks automaatselt.
See alustab ISPConfig 3 paigaldust. Paigaldaja konfigureerib kõik teenused nagu Postfix’i, Dovecot’i, jne ISPConfig’le sobivaks automaatselt. Küsimutele võib lihtsalt ENTER vajutada.
<source lang="bash">
>> Initial configuration


Operating System: 14.04 UNKNOWN
Kui paigaldamine on lõpuni viidud, siis on võimalik paigaldajal lasta SSL vhost tekitada ISPConfig’i juhtpaneelile, nii et ISPConfig’i on võimalik minna kasutades https:// -i  http:// asemel. Selleks on vaja järgmisele küsimusele panna lihtsalt ENTER: Do you want a secure (SSL) connection to the ISPConfig web interface (y,n) [y]:.


    Following will be a few questions for primary configuration so be careful.
Pärast esimest sisselogimist ISPConfig’i admin admin’iga, mis on vaikimisi kasutaja ja parool, võiks turvalisuse huvides parooli ära vahetada.
    Default values are in [brackets] and can be accepted with <ENTER>.
    Tap in "quit" (without the quotes) to stop the installer.  


Sinna saab nüüd sisse logida lehelt:


Select language (en,de) [en]: <-- ENTER
http(s)://puppet.planet.zz:8080/ või http(s):// 192.168.56.200:8080/


Installation mode (standard,expert) [standard]: <-- ENTER
[6]
 
Full qualified hostname (FQDN) of the server, eg server1.domain.tld  [server1.example.com]: <-- ENTER
 
MySQL server hostname [localhost]: <-- ENTER
 
MySQL root username [root]: <-- ENTER
 
MySQL root password []: <-- student
 
MySQL database to create [dbispconfig]: <-- ENTER
 
MySQL charset [utf8]: <-- ENTER
 
Generating a 4096 bit RSA private key
............................................................................++
.....................++
writing new private key to 'smtpd.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]: <-- ENTER
State or Province Name (full name) [Some-State]: <-- ENTER
Locality Name (eg, city) []: <-- ENTER
Organization Name (eg, company) [Internet Widgits Pty Ltd]: <-- ENTER
Organizational Unit Name (eg, section) []: <-- ENTER
Common Name (e.g. server FQDN or YOUR name) []: <-- ENTER
Email Address []: <-- ENTER
Configuring Jailkit
Configuring Dovecot
Configuring Spamassassin
Configuring Amavisd
Configuring Getmail
Configuring Pureftpd
Configuring BIND
Configuring Apache
Configuring Vlogger
Configuring Apps vhost
Configuring Bastille Firewall
Configuring Fail2ban
Installing ISPConfig
ISPConfig Port [8080]: <-- ENTER
 
Do you want a secure (SSL) connection to the ISPConfig web interface (y,n) [y]: <-- ENTER
 
Generating RSA private key, 4096 bit long modulus
..........++
......++
e is 65537 (0x10001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]: <-- ENTER
State or Province Name (full name) [Some-State]: <-- ENTER
Locality Name (eg, city) []: <-- ENTER
Organization Name (eg, company) [Internet Widgits Pty Ltd]: <-- ENTER
Organizational Unit Name (eg, section) []: <-- ENTER
Common Name (e.g. server FQDN or YOUR name) []: <-- ENTER
Email Address []: <-- ENTER
 
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: <-- ENTER
An optional company name []: <-- ENTER
writing RSA key
Configuring DBServer
Installing ISPConfig crontab
no crontab for root
no crontab for getmail
Restarting services ...
Rather than invoking init scripts through /etc/init.d, use the service(8)
utility, e.g. service mysql restart
 
Since the script you are attempting to invoke has been converted to an
Upstart job, you may also use the stop(8) and then start(8) utilities,
e.g. stop mysql ; start mysql. The restart(8) utility is also available.
mysql stop/waiting
mysql start/running, process 2817
* Stopping Postfix Mail Transport Agent postfix
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
  ...done.
* Starting Postfix Mail Transport Agent postfix
postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
/usr/sbin/postconf: warning: /etc/postfix/main.cf: undefined parameter: virtual_mailbox_limit_maps
  ...done.
Stopping amavisd: amavisd-new.
Starting amavisd: amavisd-new.
* Stopping ClamAV daemon clamd
  ...done.
* Starting ClamAV daemon clamd
  ...done.
Rather than invoking init scripts through /etc/init.d, use the service(8)
utility, e.g. service dovecot restart
 
Since the script you are attempting to invoke has been converted to an
Upstart job, you may also use the stop(8) and then start(8) utilities,
e.g. stop dovecot ; start dovecot. The restart(8) utility is also available.
dovecot stop/waiting
dovecot start/running, process 3962
* Restarting web server apache2
[Fri Apr 26 00:55:00 2013] [warn] NameVirtualHost *:443 has no VirtualHosts
[Fri Apr 26 00:55:00 2013] [warn] NameVirtualHost *:80 has no VirtualHosts
[Fri Apr 26 00:55:01 2013] [warn] NameVirtualHost *:443 has no VirtualHosts
[Fri Apr 26 00:55:01 2013] [warn] NameVirtualHost *:80 has no VirtualHosts
... waiting    ...done.
Restarting ftp server: Running: /usr/sbin/pure-ftpd-mysql-virtualchroot -l mysql:/etc/pure-ftpd/db/mysql.conf -l pam -A -b -u 1000 -D -H -Y 1 -E -8 UTF-8 -O clf:/var/log/pure-ftpd/transfer.log -B
Installation completed.
</source> 
 
Nüüd on võimalik paigaldajal lasta SSL vhost tekitada ISPConfig’i juhtpaneelilel, nii et ISPConfig’i on võimalik minna kasutades https:// -i  http:// asemel. Selleks on vaja järgmisele küsimusele panna lihtsalt enter: Do you want a secure (SSL) connection to the ISPConfig web interface (y,n) [y]:.
 
Pärast esimest sisselogimist ISPConfig’i admin admin’iga võiks parooli ära vahetada.


Sinna saab sisse logida lehelt:
=Kokkuvõte=


http(s)://puppet.planet.zz:8080/ või http(s):// 192.168.56.200:8080/
ISPconfig on väga hea tööriist, mille kaudu on võimalik kiirelt ja lihtsalt hallata oma erinevaid servereid ja teostada virtualiseerimist. Selle kaudu saab kergelt luua uusi kasutajaid ja neile vastavaid õigusi anda. ISPconfig toetab väga erinevaid teenuseid ning on mitmekülgne. Sobib ka algajale.
[6]


=Kasutatud materjalid=
=Kasutatud materjalid=

Latest revision as of 18:43, 12 January 2015

Autor: Maarja-Liisa Tammepõld

Rühm: A31

Sissejuhatus

ISPConfig on vabavaraline sisumajutuse juhtpaneel Linuxile. Sellega on võimalik hallata mitmeid servereid ühest juhtpaneelist. Võimaldab veebiserveri, meiliserveri, DNS serveri haldamist, virtualiseerimist ja andmete sünkroonse dubleerimise konfiguratsiooni (andmete peegeldamist) arvutivõrgus ning klasterdamist. [1]

Sellel tarkvaral on 3 sisselogimise taset: administraatori, edasimüüja ja kliendi tase. [1]

Millele on ISPconfig toetatud?

Toetatud tarkvara:

  • HTTP: Apache2 and nginx
  • SMTP: Postfix
  • POP3/IMAP: Courier and Dovecot
  • FTP: PureFTPd
  • DNS: BIND ja MyDNS
  • Andmebaas: MySQL
  • Statistika: Webalizer ja AWStats
  • Virtualiseerimine: OpenVZ

Toetatud Linuxi Operatsioonisüsteemidele:

  • Debian 5 – 7 ja Debian Testing
  • Ubuntu 8.10 – 14.10
  • CentOS 5.2 – 7.0
  • Fedora 10 and 12 - 15
  • OpenSuSE 11.1 – 13.2

[2]

Paigaldus

Oma ülesannet lahendasin Puppeti kaudu, kasutades kooliserverit elab.itcollege.ee keskkonnas. Tegin kindlaks, et paigaldatud oli Ubuntu 14.04 versioon ja sellest lähtuvalt teen oma dokumentatsiooni.

  • Veendu, et oled administraatori õigustes sudo –i
  • Tee kindlaks, kas OpenSSH on paigaldatud
apt-cache policy openssh-server

Kui ei ole, siis

apt-get install ssh openssh-server
  • Serverile tuleb määrata staatiline IP aadress. Selleks tuleb minna nano /etc/network/interfaces
auto eth0
iface eth1 inet static
        address 192.168.56.200
        netmask 255.255.255.0
        network 192.168.56.200
        broadcast 192.168.56.255
        gateway 192.168.56.254
        dns-nameservers 192.168.1.254 8.8.8.8
  • Nüüd tuleb võrgule tuleb teha restart
service networking restart
  • nano /etc/hosts failis tuleb ära määrata server
127.0.0.1       localhost
127.0.1.1       puppet.planet.zz        server
192.168.56.200	uppet.planet.zz        puppet
  • Käsureal käivitada , et määrata serverile õige nimi
echo puppet > /etc/hostname 
service hostname restart
  • Näitab serveri nime ja serverit.
hostname 
hostname –f
  • Operatsioonisüsteemi tarkvaravaramu nimekirja uuendamine
apt-get update
  • Olemasoleva (juba paigaldatud) tarkvara uuendamine
apt-get upgrade
  • Seejärel võiks süsteemile reboot teha
reboot
  • Vaikimisi olev shell (default shell) tuleks ära muuta

/bin/sh on sümlink /bin/dash’ile, kuigi vaja on /bin/bash’i, mitte /bin/dash’i. Seepärast tuleb teha nii:

dpkg-reconfigure dash

Ja valikuks tuleb panna:

Use dash as the default system shell (/bin/sh)? <-- No

Vastasel juhul ISPConfig’i paigaldus ei lähe tööle.

  • AppArmor’i võiks välja lülitada. See on turvalisuse laiendus, kuid hakkab hiljem probleeme tekitama ISPConfig’i töö toimimisele.
service apparmor stop 
update-rc.d -f apparmor remove 
apt-get remove apparmor apparmor-utils
  • Süsteemi kell oleks vaja ära sünkroniseerida. Selleks on vaja paigaldada ntp ntpdate.
apt-get install ntp ntpdate

[3]

Postfix’i, Dovecot’i, MySQL’i, phpMyAdmin’i, rkhunter’i, binutils’i paigaldus

  • Postfix’i paigalduseks on vaja peatada ja eemaldada sendmail
service sendmail stop; update-rc.d -f sendmail remove
  • Nüüd saab paigaldada Postfix’i, Dovecot’i, MySQL’i, rkhunter’I ja binutils’i selle käsureaga:
apt-get install postfix postfix-mysql postfix-doc mysql-client mysql-server openssl getmail4 rkhunter binutils dovecot-imapd dovecot-pop3d dovecot-mysql dovecot-sieve sudo
  • Seejärel tulevad sellised küsimused:
New password for the MySQL "root" user: <--student
Repeat password for the MySQL "root" user: <-- student
General type of mail configuration: <-- Internet Site 
Self-signed SSL sertificate: yes
Hostname: localhost
System mail name: <-- puppet.planet.zz
  • Järgmisena on vaja avada TLS/SSL ja määrata õiged pordid Postfix’is.
  • Selleks nano /etc/postfix/master.cf

Seal on vaja submission ja smtps sektsioonid välja kommenteerida ja lisada rida -o smtpd_client_restrictions=permit_sasl_authenticated,reject mõlemasse sektsiooni. Teha nii:

[...]
submission inet n       -       -       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
smtps     inet  n       -       -       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o smtpd_reject_unlisted_recipient=no
#  -o smtpd_client_restrictions=$mua_client_restrictions
#  -o smtpd_helo_restrictions=$mua_helo_restrictions
#  -o smtpd_sender_restrictions=$mua_sender_restrictions
#  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
[...]
  • Seejärel taaskäivitada Postfix
service postfix restart
  • Kuna on vaja, et MySql oleks ühenduses kõikide sisenditega, mitte ainult localhost’ga, seepärast on vajalik nano /etc/mysql/my.cnf välja kommenteerida bind-address = 127.0.0.1
nano /etc/mysql/my.cnf
[...]
# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
#bind-address           = 127.0.0.1
[...]
  • Seejärel on vaja MySQL’le taaskäivitus teha:
service mysql restart
  • Nüüd tuleb kindlaks teha, kas võrgundus on lubatud.
netstat -tap | grep mysql

Tulem peaks välja nägema selline:

root@server1:~# netstat -tap | grep mysql 
tcp        0      0 *:mysql                 *:*                     LISTEN      21298/mysqld 
root@server1:~#


==Amavisd-new, SpamAssassin ja Clamav paigaldus ==
  • Et käivitada amavisd-new, SpamAssassin, and ClamAV, on vaja käsureale lisada:
apt-get install amavisd-new spamassassin clamav clamav-daemon zoo unzip bzip2 arj nomarch lzop cabextract apt-listchanges libnet-ldap-perl libauthen-sasl-perl clamav-docs daemon libio-string-perl libio-socket-ssl-perl libnet-ident-perl zip libnet-dns-perl

See on vajalik sisukontrolliks, et ei tuleks viiruseid või rämpsposti.

  • ISPConfig 3 kasutab amavisd, mis laeb SpamAssassin filtri jooksvalt, seepärast on parem, kui SpamAssassin oleks peatatud, et RAM’i ruumi vabastada.
service spamassassin stop
update-rc.d -f spamassassin remove

[4]

Apache2, PHP5, phpMyAdmin, FCGI, suExec, Pear ja mcrypt paigaldus

  • Apache2, PHP5, phpMyAdmin, FCGI, suExec, Pear ja mcrypt on võimalik paigaldada sisestades käsureale:
apt-get install apache2 apache2-doc apache2-utils libapache2-mod-php5 php5 php5-common php5-gd php5-mysql php5-imap phpmyadmin php5-cli php5-cgi libapache2-mod-fcgid apache2-suexec php-pear php-auth php5-mcrypt mcrypt php5-imagick imagemagick libapache2-mod-suphp libruby libapache2-mod-python php5-curl php5-intl php5-memcache php5-memcached php5-ming php5-ps php5-pspell php5-recode php5-snmp php5-sqlite php5-tidy php5-xmlrpc php5-xsl memcached snmp
  • PHP5 mcrypt’I moodul tuleb lubada manuaalselt, selleks:
php5enmod mcrypt

Ja tuleb vastata järgmisetele küsimustele nii:

Web server to reconfigure automatically: <-- apache2 
Configure database for phpmyadmin with dbconfig-common? <-- No
  • Seejärel käivitada käsuteal järgmised käsklused, et lubada Apache mooduleid suexec, rewrite, ssl, actions ja ka (dav, dav_fs, ja auth_digest kui on soov kasutada WebDAV’i):
a2enmod suexec rewrite ssl actions include cgi
a2enmod dav_fs dav auth_digest

Seejärel avada nano /etc/apache2/mods-available/suphp.conf...

nano /etc/apache2/mods-available/suphp.conf

ja välja kommenteerida <FilesMatch "\.ph(p3?|tml)$"> sektsioon ja lisada rida AddType application/x-httpd-suphp .php .php3 .php4 .php5 .phtml – vastasel korral kõik PHP failid jooksevad SuPHP kaudu:

<IfModule mod_suphp.c>
    #<FilesMatch "\.ph(p3?|tml)$">
    #    SetHandler application/x-httpd-suphp
    #</FilesMatch>
        AddType application/x-httpd-suphp .php .php3 .php4 .php5 .phtml
        suPHP_AddHandler application/x-httpd-suphp

    <Directory />
        suPHP_Engine on
    </Directory>

    # By default, disable suPHP for debian packaged web applications as files
    # are owned by root and cannot be executed by suPHP because of min_uid.
    <Directory /usr/share>
        suPHP_Engine off
    </Directory>

# # Use a specific php config file (a dir which contains a php.ini file)
#       suPHP_ConfigPath /etc/php5/cgi/suphp/
# # Tells mod_suphp NOT to handle requests with the type <mime-type>.
#       suPHP_RemoveHandler <mime-type>
</IfModule>
  • Seejärel teha apache2’le taaskäivitus.
service apache2 restart
  • Kui on vajadus Ruby faile .rb laiendusega hoiustada oma loodud veebilehtedele läbi ISPConfig’i, siis on vajalik välja kommenteerida rida application/x-ruby rb failis /etc/mime.types:
nano /etc/mime.types
[...]
#application/x-ruby                             rb
[...]
  • Seejärel taaskäivitada apache2
service apache2 restart

[4]

Xcache

Xcache on PHP opcode püüdja, püüdmaks ja optimeerimaks PHP vahekoodi.

  • Selle paigaldamiseks
apt-get install php5-xcache
  • Ja seejärel on vaja jällegi apache2’le taaskäivitus teha
service apache2 restart

[4]

PureFTPd ja Quota paigaldus

  • Selle paigaldus käib järgmiselt:
apt-get install pure-ftpd-common pure-ftpd-mysql quota quotatool
nano /etc/default/pure-ftpd-common
  • Ja tuleb jälgida, et algolek oleks seatud sandalone’ks ja VIRTUALCHROOT=true:
[...]
STANDALONE_OR_INETD=standalone
[...]
VIRTUALCHROOT=true
[...]

FTP on väga ebakindel protokoll, sest kõik paroolid ja andmed on edastatud selge tekstina. TLS-iga on võimalik kogu see suhtlus ära krüpteerida, mis teeb FTP turvalisemaks.

  • FTP ja TLS sessiooni lubamiseks, on vaja teha järgmist:
echo 1 > /etc/pure-ftpd/conf/TLS
  • TLS’i kasutamiseks on vaja genereerida SSL sertifikaat. Seda võib teha siin /etc/ssl/private/ , kuid esmalt on vaja see asukoht luua.
mkdir -p /etc/ssl/private/
  • SSL-i genereerimine:
openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem
Country Name (2 letter code) [AU]: <-- Enter 
State or Province Name (full name) [Some-State]: <-- Enter  
Locality Name (eg, city) []: <-- Enter 
Organization Name (eg, company) [Internet Widgits Pty Ltd]: <-- Enter 
Organizational Unit Name (eg, section) []: <-- Enter 
Common Name (eg, YOUR name) []: <-- puppet.planet.zz
Email Address []: <-- Enter
  • Õiguste muutmine SSL sertifikaadi puhul:
chmod 600 /etc/ssl/private/pure-ftpd.pem
  • Seejärel on vaja teha PureFTP-le taaskäivitus
service pure-ftpd-mysql restart
  • Seejärel on vaja muuta /etc/fstab’i sisu.
nano /etc/fstab
# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
/dev/mapper/puppet--vg-root /               ext4    errors=remount-ro,usrjquota$
# / was on /dev/sda1 during installation
UUID=07114cfb-f3f8-4a00-bd9a-184357062b78 /               ext4    noatime,error$
  • Quota lubamiseks:
mount -o remount /

quotacheck -avugm 
quotaon –avug

[5]

BIND DNS Serveri paigaldus

  • BIND’i on võimalik paigaldada järgmiselt:
apt-get install bind9 dnsutils

[5]

Vlogger’i, Webalizer’i ja AWstats’i paigaldus

  • Seda on võimalik paigaldada järgmiselt:
apt-get install vlogger webalizer awstats geoip-database libclass-dbi-mysql-perl
Seejärel tuleb avada/etc/cron.d/awstats ja välja kommenteerida kogu faili sisu:
nano /etc/cron.d/awstats
#MAILTO=root

#*/10 * * * * www-data [ -x /usr/share/awstats/tools/update.sh ] && /usr/share/awstats/tools/update.sh

# Generate static reports:
#10 03 * * * www-data [ -x /usr/share/awstats/tools/buildstatic.sh ] && /usr/share/awstats/tools/buildstatic.sh

[5]

Fail2ban’i paigaldamine

See pole kohustuslik, kuid soovitatav ISPConfi logide näitamiseks.

apt-get install fail2ban

Selleks, et fail2ban monitooriks PureFTPd ja Dovecot’i, on vaja luua fail /etc/fail2ban/jail.local:

nano /etc/fail2ban/jail.local
[pureftpd]
enabled  = true
port     = ftp
filter   = pureftpd
logpath  = /var/log/syslog
maxretry = 3

[dovecot-pop3imap]
enabled = true
filter = dovecot-pop3imap
action = iptables-multiport[name=dovecot-pop3imap, port="pop3,pop3s,imap,imaps", protocol=tcp]
logpath = /var/log/mail.log
maxretry = 5

[postfix-sasl]
enabled  = true
port     = smtp
filter   = postfix-sasl
logpath  = /var/log/mail.log
maxretry = 3

Seejärel on vaja luua kaks filtri faili:

nano /etc/fail2ban/filter.d/pureftpd.conf
[Definition]
failregex = .*pure-ftpd: \(.*@<HOST>\) \[WARNING\] Authentication failed for user.*
ignoreregex =
nano /etc/fail2ban/filter.d/dovecot-pop3imap.conf
[Definition]
failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed|Aborted login \(\d+ authentication attempts).*rip=(?P<host>\S*),.*
ignoreregex =

postfix-sasl faili on vaja lisada veel:

echo "ignoreregex =" >> /etc/fail2ban/filter.d/postfix-sasl.conf

Pärast seda on vaja fail2ban’ile teha taaskäivitus:

service fail2ban restart

[5]

SquirrelMail’i paigaldus

Selle kaudu on võimalik hiljem otse näha kõiki e-poste, mis tuleb veebilehtede kaudu.

  • Käsureal paigaldada
apt-get install squirrelmail
  • Konfigureerida SquirrelMail
squirrelmail-configure
  • SquirrelMail’ile tuleb öelda, et me kasutame Dovevecot-IMAP/-POP3:
SquirrelMail Configuration : Read: config.php (1.4.0) 
--------------------------------------------------------- 
Main Menu -- 
1.  Organization Preferences 
2.  Server Settings 
3.  Folder Defaults 
4.  General Options 
5.  Themes 
6.  Address Books 
7.  Message of the Day (MOTD) 
8.  Plugins 
9.  Database 
10. Languages 

D.  Set pre-defined settings for specific IMAP servers 

C   Turn color on 
S   Save data 
Q   Quit 

Command >> <-- D 

[...]

Please select your IMAP server: 
    bincimap    = Binc IMAP server 
    courier     = Courier IMAP server 
    cyrus       = Cyrus IMAP server 
    dovecot     = Dovecot Secure IMAP server 
    exchange    = Microsoft Exchange IMAP server 
    hmailserver = hMailServer 
    macosx      = Mac OS X Mailserver 
    mercury32   = Mercury/32 
    uw          = University of Washington's IMAP server 
    gmail       = IMAP access to Google mail (Gmail) accounts 

    quit        = Do not change anything 
Command >> <-- dovecot 

[...]

Please select your IMAP server: 
    bincimap    = Binc IMAP server 
    courier     = Courier IMAP server 
    cyrus       = Cyrus IMAP server 
    dovecot     = Dovecot Secure IMAP server 
    exchange    = Microsoft Exchange IMAP server 
    hmailserver = hMailServer 
    macosx      = Mac OS X Mailserver 
    mercury32   = Mercury/32 
    uw          = University of Washington's IMAP server 
    gmail       = IMAP access to Google mail (Gmail) accounts 

    quit        = Do not change anything 

Command >> dovecot 

              imap_server_type = dovecot 
         default_folder_prefix = <none> 
                  trash_folder = Trash 
                   sent_folder = Sent 
                  draft_folder = Drafts 
            show_prefix_option = false 
          default_sub_of_inbox = false 
show_contain_subfolders_option = false 
            optional_delimiter = detect 
                 delete_folder = false 

Press any key to continue... <-- press a key 


SquirrelMail Configuration : Read: config.php (1.4.0) 
--------------------------------------------------------- 
Main Menu -- 
1.  Organization Preferences 
2.  Server Settings 
3.  Folder Defaults 
4.  General Options 
5.  Themes 
6.  Address Books 
7.  Message of the Day (MOTD) 
8.  Plugins 
9.  Database 
10. Languages 

D.  Set pre-defined settings for specific IMAP servers 

C   Turn color on 
S   Save data 
Q   Quit 

Command >> <-- S 


SquirrelMail Configuration : Read: config.php (1.4.0) 
--------------------------------------------------------- 
Main Menu -- 
1.  Organization Preferences 
2.  Server Settings 
3.  Folder Defaults 
4.  General Options 
5.  Themes 
6.  Address Books 
7.  Message of the Day (MOTD) 
8.  Plugins 
9.  Database 
10. Languages 

D.  Set pre-defined settings for specific IMAP servers 

C   Turn color on 
S   Save data 
Q   Quit 

Command >> <-- Q
  • Nüüd kofigureerin SquirrelMail’i nii, et seda saaks kasutada oma veebilehes, mis on loodud läbi ISPConfig’i kasutades /squirrelmail või /webmail aliasi.
  • SquirrelMail'i Apache konfiguratsioon on failis /etc/squirrelmail/apache.conf, aga see fail pole laetud Apache poolt, sest see pole /etc/apache2/conf-available/ kaustas. Seepärast loome symlingi nimega squirrelmail.conf kausta /etc/apache2/conf-available/ mis viitab /etc/squirrelmail/apache.conf ja seejärel teen Apachele uuesti laadimise:
cd /etc/apache2/conf-available/ 
ln -s ../../squirrelmail/apache.conf squirrelmail.conf 
service apache2 reload
  • Nüüd tuleb avada /etc/apache2/conf-available/squirrelmail.conf
nano /etc/apache2/conf-available/squirrelmail.conf

Ja lisada järgmised read <Directory/usr/share/squirrelmail></Directory> konteinerisse, mis teeb kindlaks, et mod_php on kasutusel SquirrelMail’i pääsemiseks.

[...]
<Directory /usr/share/squirrelmail>
  Options FollowSymLinks
  <IfModule mod_php5.c>
    AddType application/x-httpd-php .php
    php_flag magic_quotes_gpc Off
    php_flag track_vars On
    php_admin_flag allow_url_fopen Off
    php_value include_path .
    php_admin_value upload_tmp_dir /var/lib/squirrelmail/tmp
    php_admin_value open_basedir /usr/share/squirrelmail:/etc/squirrelmail:/var/lib/squirrelmail:/etc/hostname:/etc/mailname
    php_flag register_globals off
  </IfModule>
  <IfModule mod_dir.c>
    DirectoryIndex index.php
  </IfModule>

  # access to configtest is limited by default to prevent information leak
  <Files configtest.php>
    order deny,allow
    deny from all
    allow from 127.0.0.1
  </Files>
</Directory>
[...]
  • Loon kausta mkdir /var/lib/squirrelmail/tmp
  • Määran omanikuks www-data:
chown www-data /var/lib/squirrelmail/tmp
  • Luban squirrelmail’i koos apache2-ga
a2enconf squirrelmail
  • Laen apache2 uuesti
service apache2 reload

Nüüd /etc/apache2/conf-available/squirrelmail.conf defineerib aliase nimega /squirrelmail mis viitab SquirrelMail'i paigaldamise asukohale /usr/share/squirrelmail.

[6]

ISPConfig 3 paigaldus

Kui eeltöö tehtud, siis saan ISPConfig 3 paigalduse juurde asuda.

Selleks:

cd /tmp 
wget http://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gz 
tar xfz ISPConfig-3-stable.tar.gz 
cd ispconfig3_install/install/

Ja seejärel:

php -q install.php

See alustab ISPConfig 3 paigaldust. Paigaldaja konfigureerib kõik teenused nagu Postfix’i, Dovecot’i, jne ISPConfig’le sobivaks automaatselt. Küsimutele võib lihtsalt ENTER vajutada.

Kui paigaldamine on lõpuni viidud, siis on võimalik paigaldajal lasta SSL vhost tekitada ISPConfig’i juhtpaneelile, nii et ISPConfig’i on võimalik minna kasutades https:// -i http:// asemel. Selleks on vaja järgmisele küsimusele panna lihtsalt ENTER: Do you want a secure (SSL) connection to the ISPConfig web interface (y,n) [y]:.

Pärast esimest sisselogimist ISPConfig’i admin admin’iga, mis on vaikimisi kasutaja ja parool, võiks turvalisuse huvides parooli ära vahetada.

Sinna saab nüüd sisse logida lehelt:

http(s)://puppet.planet.zz:8080/ või http(s):// 192.168.56.200:8080/

[6]

Kokkuvõte

ISPconfig on väga hea tööriist, mille kaudu on võimalik kiirelt ja lihtsalt hallata oma erinevaid servereid ja teostada virtualiseerimist. Selle kaudu saab kergelt luua uusi kasutajaid ja neile vastavaid õigusi anda. ISPconfig toetab väga erinevaid teenuseid ning on mitmekülgne. Sobib ka algajale.

Kasutatud materjalid

[1] http://www.ispconfig.org/page/en/ispconfig.html

[2] http://www.ispconfig.org/page/en/ispconfig/services-and-functions.html

[3] http://www.howtoforge.com/perfect-server-ubuntu-14.04-apache2-php-mysql-pureftpd-bind-dovecot-ispconfig-3-p3

[4] http://www.howtoforge.com/perfect-server-ubuntu-14.04-apache2-php-mysql-pureftpd-bind-dovecot-ispconfig-3-p4

[5] http://www.howtoforge.com/perfect-server-ubuntu-14.04-apache2-php-mysql-pureftpd-bind-dovecot-ispconfig-3-p5

[6] http://www.howtoforge.com/perfect-server-ubuntu-14.04-apache2-php-mysql-pureftpd-bind-dovecot-ispconfig-3-p6