Cheap VPS & Xen Server

Residential Proxy Network - Hourly & Monthly Packages

The Perfect Server – Fedora 15 x86_64 [ISPConfig 3]


This tutorial shows how to prepare a Fedora 15 server (x86_64) for the installation of ISPConfig 3, and how to install ISPConfig 3. ISPConfig 3 is a webhosting control panel that allows you to configure the following services through a web browser: Apache web server, Postfix mail server, MySQL, BIND nameserver, PureFTPd, SpamAssassin, ClamAV, and many more.

Please note that this setup does not work for ISPConfig 2! It is valid for ISPConfig 3 only!

I do not issue any guarantee that this will work for you!

 

1 Requirements

To install such a system you will need the following:

  • Download the Fedora 15 DVD iso image from a mirror near you (the list of mirrors can be found here: http://mirrors.fedoraproject.org/publiclist/Fedora/15/), e.g. http://ftp.tu-chemnitz.de/pub/linux/fedora/linux/releases/15/Fedora/x86_64/iso/Fedora-15-x86_64-DVD.iso
  • an Internet connection…

 

2 Preliminary Note

In this tutorial I use the hostname server1.example.com with the IP address 192.168.0.100 and the gateway 192.168.0.1. These settings might differ for you, so you have to replace them where appropriate.

Please make sure that the system that you want to upgrade has more than 600 MB of RAM – otherwise the system might hang when it tries to boot with the following message:

Trying to unpack rootfs image as initramfs…

 

3 Install The Base System

Boot from your Fedora 15 DVD. Select Install a new system or upgrade an existing system:

1

It can take a long time to test the installation media so we skip this test here:

2

Choose your language next:

3

Select your keyboard layout:

4

I assume that you use a locally attached hard drive, so you should select Basic Storage Devices here:

5

As we want a fresh Fedora installation, click on the Yes, discard any data button next:

6

Fill in the hostname of the server:

7

Choose your time zone:

8

Give root a password:

9

Next we do the partitioning. Select Replace Existing Linux System(s). This will give you a small /boot partition and a large / partition which is fine for our purposes:

10

Select Write Changes to Disk:

11

The hard drive is being formatted:

12

Now we select the software we want to install. Uncheck Graphical Desktop and check Web Server instead. Then check Customize now. Afterwards, select the additional repositories Fedora 15 – x86_64 and Fedora 15 – x86_64 – Updates (if you are on an i686 system, the names are probably Fedora 15 – i686 and Fedora 15 – i686 – Updates):

13

As the last two repositories need an Internet connection, a new window pops up where you have to configure your network card. Select your network card and click on OK:

14

Go to the Wired tab, select the network interface (please note that Fedora 15 uses BIOS names for devices, that’s why your network card is named like p3p1 instead of eth0 – we will change that later on; you can find more info about this on http://fedoraproject.org/wiki/Features/ConsistentNetworkDeviceNaming) and click on Edit…:

15

Mark the Connect automatically checkbox and go to the IPv4 Settings tab and select Manual in the Method drop-down menu. Fill in one, two, or three nameservers (separated by comma) in the DNS servers field (e.g. 8.8.8.8,8.8.4.4), then click on the Add button next to the Addresses area:

16

Now give your network card a static IP address and netmask (in this tutorial I’m using the IP address 192.168.0.100 and netmask 255.255.255.0 for demonstration purposes; if you are not sure about the right values, http://www.subnetmask.info might help you). Also fill in your gateway (e.g. 192.168.0.1) and click on the Save… button:

17

Next click on Close in the Network Connections window:

18

The details for the last two repositories should now be retrieved, and the checkboxes in front of them should be marked. Click on Next:

19

Now we must select the package groups we want to install. Select Editors, Text-based Internet, Development Libraries, Development Tools, DNS Name Server, FTP Server, Mail Server, MySQL Database, Server Configuration Tools, Web Server, Administration Tools, Base, Hardware Support, Java, System Tools (unselect all other package groups) and click on Next:

20

The installation begins. This will take a few minutes:

21

Finally, the installation is complete, and you can remove your DVD from the computer and reboot it:

22

After the reboot, log in as root.

I want to install ISPConfig at the end of this tutorial which comes with its own firewall. That’s why I disable the default Fedora firewall now. Of course, you are free to leave it on and configure it to your needs (but then you shouldn’t use any other firewall later on as it will most probably interfere with the Fedora firewall).

Run…

system-config-firewall

… and disable the firewall. Hit OK afterwards:

23

Confirm your choice by selecting Yes:

24

If you did not configure your network card during the installation (because you did not select the additional online repositories), you can do that now. Run…

system-config-network

… and go to Device configuration:

25

Select your network interface (as I mentioned earlier, Fedora 15 uses BIOS device names, so the network card should be named something like p3p1 – we will change that soon so that it’s named eth0):

26

Then fill in your network details – disable DHCP and fill in a static IP address, a netmask, and your gateway, then hit Ok:

27

Next select Save:

28

You can also specify additional nameservers. Select DNS configuration:

29

Now you can fill in additional nameservers and hit Ok:

30

Hit Save&Quit afterwards:

31

You should run

ifconfig

now to check if the installer got your IP address right:

[root@server1 ~]# ifconfig
lo        Link encap:Local Loopback
inet addr:127.0.0.1  Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING  MTU:16436  Metric:1
RX packets:2 errors:0 dropped:0 overruns:0 frame:0
TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:100 (100.0 b)  TX bytes:100 (100.0 b)

p3p1      Link encap:Ethernet  HWaddr 00:0C:29:15:60:FA
inet addr:192.168.0.100  Bcast:192.168.0.255  Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe15:60fa/64 Scope:Link
UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
RX packets:40 errors:0 dropped:0 overruns:0 frame:0
TX packets:62 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:4678 (4.5 KiB)  TX bytes:10308 (10.0 KiB)

[root@server1 ~]#

Check your /etc/resolv.conf if it lists all nameservers that you’ve previously configured:

cat /etc/resolv.conf

If nameservers are missing, run

system-config-network

and add the missing nameservers again.

Now, on to the configuration…

4 Change Name Of Your NIC To ethx

Now we must configure Fedora to not use BIOS device names for our network interface anymore. Instead of p3p1, we need our good, old eth0 back (because otherwise ISPConfig’s firewall will go crazy and block everything because it expects eth0 instead of p3p1). Open /etc/grub.conf

vi /etc/grub.conf

… and add biosdevname=0 to the kernel line:

# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE:  You have a /boot partition.  This means that
#          all kernel and initrd paths are relative to /boot/, eg.
#          root (hd0,0)
#          kernel /vmlinuz-version ro root=/dev/mapper/vg_server1-lv_root
#          initrd /initrd-[generic-]version.img
#boot=/dev/sda
default=0
timeout=0
splashimage=(hd0,0)/grub/splash.xpm.gz
hiddenmenu
title Fedora (2.6.38.6-27.fc15.x86_64)
        root (hd0,0)
        kernel /vmlinuz-2.6.38.6-27.fc15.x86_64 ro root=/dev/mapper/vg_server1-lv_root rd_LVM_LV=vg_server1/lv_root rd_LVM_LV=vg_server1/lv_swap rd_NO_LUKS rd_NO_MD rd_NO_DM LANG=en_US.UTF-8 SYSFONT=latarcyrheb-sun16 KEYTABLE=de rhgb quiet biosdevname=0
        initrd /initramfs-2.6.38.6-27.fc15.x86_64.img

Then reboot the system:

reboot

After the reboot, your NIC should be named eth0. Run…

ifconfig

… to verify:

[root@server1 ~]# ifconfig
eth0      Link encap:Ethernet  HWaddr 00:0C:29:15:60:FA
inet addr:192.168.0.100  Bcast:192.168.0.255  Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe15:60fa/64 Scope:Link
UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
RX packets:48 errors:0 dropped:0 overruns:0 frame:0
TX packets:58 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:5226 (5.1 KiB)  TX bytes:9682 (9.4 KiB)

lo        Link encap:Local Loopback
inet addr:127.0.0.1  Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING  MTU:16436  Metric:1
RX packets:2 errors:0 dropped:0 overruns:0 frame:0
TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:100 (100.0 b)  TX bytes:100 (100.0 b)

[root@server1 ~]#

 

5 Adjust /etc/hosts

Next we edit /etc/hosts. Make it look like this:

vi /etc/hosts

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
192.168.0.100   server1.example.com     server1

::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

It is important that you add a line for server1.example.com and remove server1.example.com and server1 from the 127.0.0.1 line.

 

6 Configure The Firewall

(You can skip this chapter if you have already disabled the firewall at the end of the basic system installation.)

I want to install ISPConfig at the end of this tutorial which comes with its own firewall. That’s why I disable the default Fedora firewall now. Of course, you are free to leave it on and configure it to your needs (but then you shouldn’t use any other firewall later on as it will most probably interfere with the Fedora firewall).

Run

system-config-firewall

and disable the firewall.

To check that the firewall has really been disabled, you can run

iptables -L

afterwards. The output should look like this:

[root@server1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@server1 ~]#

 

7 Disable SELinux

SELinux is a security extension of Fedora that should provide extended security. In my opinion you don’t need it to configure a secure system, and it usually causes more problems than advantages (think of it after you have done a week of trouble-shooting because some service wasn’t working as expected, and then you find out that everything was ok, only SELinux was causing the problem). Therefore I disable it (this is a must if you want to install ISPConfig later on).

Edit /etc/selinux/config and set SELINUX=disabled:

vi /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

Afterwards we must reboot the system:

reboot

 

8 Install Some Software

First we import the GPG keys for software packages:

rpm –import /etc/pki/rpm-gpg/RPM-GPG-KEY*

Next we update our existing packages on the system:

yum update

Now we install some software packages that are needed later on:

yum groupinstall ‘Development Tools’

yum groupinstall ‘Development Libraries’

 

9 Journaled Quota

(If you have chosen a different partitioning scheme than I did, you must adjust this chapter so that quota applies to the partitions where you need it.)

To install quota, we run this command:

yum install quota

Edit /etc/fstab and add ,usrjquota=aquota.user,grpjquota=aquota.group,jqfmt=vfsv0 to the / partition (/dev/mapper/vg_server1-lv_root):

vi /etc/fstab

#
# /etc/fstab
# Created by anaconda on Wed May 25 15:57:24 2011
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
/dev/mapper/vg_server1-lv_root /                       ext4    defaults,usrjquota=aquota.user,grpjquota=aquota.group,jqfmt=vfsv0        1 1
UUID=366ba6a7-7e68-4ec9-9743-4b02dd105180 /boot                   ext4    defaults        1 2
/dev/mapper/vg_server1-lv_swap swap                    swap    defaults        0 0
tmpfs                   /dev/shm                tmpfs   defaults        0 0
devpts                  /dev/pts                devpts  gid=5,mode=620  0 0
sysfs                   /sys                    sysfs   defaults        0 0
proc                    /proc                   proc    defaults        0 0

Then run

mount -o remount /

quotacheck -avugm
quotaon -avug

to enable quota.

 

10 Install Apache, MySQL, phpMyAdmin

This can all be installed with one single command:

yum install ntp httpd mysql-server php php-mysql php-mbstring php-mcrypt phpMyAdmin

11 Install Courier-IMAP, Courier-Authlib, And Maildrop

Unfortunately there are no rpm packages for Courier-IMAP, Courier-Authlib, and Maildrop, therefore we have to build them ourselves.

First remove Dovecot (Fedora 15 comes with Dovecot 2.x; unfortunately, ISPConfig 3 supports Dovecot 1.2.x, but not 2.x):

yum remove dovecot dovecot-mysql

Then install the prerequisites that we need to build Courier rpm packages:

yum install rpm-build gcc mysql-devel openssl-devel cyrus-sasl-devel pkgconfig zlib-devel pcre-devel openldap-devel postgresql-devel expect libtool-ltdl-devel openldap-servers libtool gdbm-devel pam-devel gamin-devel libidn-devel

RPM packages should not be built as root; courier-imap will even refuse to compile if it detects that the compilation is run as the root user. Therefore we create a normal user account now (falko in this example) and give him a password:

useradd -m -s /bin/bash falko
passwd falko

We will need the sudo command later on so that the user falko can compile and install the rpm packages. But first, we must allow falko to run all commands using sudo:

Run

visudo

In the file that opens there’s a line root ALL=(ALL) ALL. Add a similar line for falko just below that line:

[...]
## Allow root to run any commands anywhere
root    ALL=(ALL)       ALL
falko   ALL=(ALL)       ALL
[...]

Now we are ready to build our rpm package. First become the user falko:

su falko

Next we create our build environment:

mkdir $HOME/rpm
mkdir $HOME/rpm/SOURCES
mkdir $HOME/rpm/SPECS
mkdir $HOME/rpm/BUILD
mkdir $HOME/rpm/BUILDROOT
mkdir $HOME/rpm/SRPMS
mkdir $HOME/rpm/RPMS
mkdir $HOME/rpm/RPMS/i386
mkdir $HOME/rpm/RPMS/x86_64

echo “%_topdir $HOME/rpm” >> $HOME/.rpmmacros

Now we create a downloads directory and download the source files from http://www.courier-mta.org/download.php:

mkdir $HOME/downloads
cd $HOME/downloads

wget https://sourceforge.net/projects/courier/files/authlib/0.63.0/courier-authlib-0.63.0.tar.bz2/download
wget https://sourceforge.net/projects/courier/files/imap/4.8.1/courier-imap-4.8.1.tar.bz2/download
wget https://sourceforge.net/projects/courier/files/maildrop/2.5.4/maildrop-2.5.4.tar.bz2/download

(You might wonder why I don’t download the newest version of courier-imap – 4.9.3 at the time of this writing – but use an older one – 4.8.1. This is because 4.9.3 failed to build on my system, whereas 4.8.1 works just fine.)

Now (still in $HOME/downloads) we can build courier-authlib:

sudo rpmbuild -ta courier-authlib-0.63.0.tar.bz2

After the build process, the rpm packages can be found in /root/rpmbuild/RPMS/x86_64 (/root/rpmbuild/RPMS/i686 if you are on an i686 system). The command

sudo ls -l /root/rpmbuild/RPMS/x86_64

shows you the available rpm packages:

[falko@server1 downloads]$ sudo ls -l /root/rpmbuild/RPMS/x86_64
total 520
-rw-r–r– 1 root root 123448 May 25 18:06 courier-authlib-0.63.0-1.fc15.x86_64.rpm
-rw-r–r– 1 root root 265144 May 25 18:06 courier-authlib-debuginfo-0.63.0-1.fc15.x86_64.rpm
-rw-r–r– 1 root root  34876 May 25 18:06 courier-authlib-devel-0.63.0-1.fc15.x86_64.rpm
-rw-r–r– 1 root root  17448 May 25 18:06 courier-authlib-ldap-0.63.0-1.fc15.x86_64.rpm
-rw-r–r– 1 root root  13808 May 25 18:06 courier-authlib-mysql-0.63.0-1.fc15.x86_64.rpm
-rw-r–r– 1 root root  13020 May 25 18:06 courier-authlib-pgsql-0.63.0-1.fc15.x86_64.rpm
-rw-r–r– 1 root root   8276 May 25 18:06 courier-authlib-pipe-0.63.0-1.fc15.x86_64.rpm
-rw-r–r– 1 root root  34108 May 25 18:06 courier-authlib-userdb-0.63.0-1.fc15.x86_64.rpm
[falko@server1 downloads]$

Select the ones you want to install, and install them like this:

sudo rpm -ivh /root/rpmbuild/RPMS/x86_64/courier-authlib-0.63.0-1.fc15.x86_64.rpm /root/rpmbuild/RPMS/x86_64/courier-authlib-mysql-0.63.0-1.fc15.x86_64.rpm /root/rpmbuild/RPMS/x86_64/courier-authlib-devel-0.63.0-1.fc15.x86_64.rpm

Now we go back to our downloads directory:

cd $HOME/downloads

Run the following commands to create required directories/change directory permissions (because otherwise the build process for Courier-Imap will fail):

sudo mkdir /var/cache/ccache/tmp
sudo chmod o+rwx /var/cache/ccache/
sudo chmod 777 /var/cache/ccache/tmp

Now run rpmbuild again, this time without sudo, otherwise the compilation will fail because it was run as root:

rpmbuild -ta courier-imap-4.8.1.tar.bz2

After the build process, the rpm packages can be found in $HOME/rpm/RPMS/x86_64 ($HOME/rpm/RPMS/i686 if you are on an i686 system):

cd $HOME/rpm/RPMS/x86_64

The command

ls -l

shows you the available rpm packages:

[falko@server1 x86_64]$ ls -l
total 1708
-rw-rw-r– 1 falko falko  596432 May 25 18:33 courier-imap-4.8.1-2.15.x86_64.rpm
-rw-rw-r– 1 falko falko 1149328 May 25 18:33 courier-imap-debuginfo-4.8.1-2.15.x86_64.rpm
[falko@server1 x86_64]$

You can install courier-imap like this:

sudo rpm -ivh courier-imap-4.8.1-2.15.x86_64.rpm

Now we go back to our downloads directory:

cd $HOME/downloads

and run rpmbuild again, this time to build a maildrop package:

sudo rpmbuild -ta maildrop-2.5.4.tar.bz2

After the build process, the rpm packages can be found in /root/rpmbuild/RPMS/x86_64 (/root/rpmbuild/RPMS/i686 if you are on an i686 system). The command

sudo ls -l /root/rpmbuild/RPMS/x86_64

shows you the available rpm packages:

[falko@server1 downloads]$ sudo ls -l /root/rpmbuild/RPMS/x86_64
total 1628
-rw-r–r– 1 root root 123448 May 25 18:06 courier-authlib-0.63.0-1.fc15.x86_64.rpm
-rw-r–r– 1 root root 265144 May 25 18:06 courier-authlib-debuginfo-0.63.0-1.fc15.x86_64.rpm
-rw-r–r– 1 root root  34876 May 25 18:06 courier-authlib-devel-0.63.0-1.fc15.x86_64.rpm
-rw-r–r– 1 root root  17448 May 25 18:06 courier-authlib-ldap-0.63.0-1.fc15.x86_64.rpm
-rw-r–r– 1 root root  13808 May 25 18:06 courier-authlib-mysql-0.63.0-1.fc15.x86_64.rpm
-rw-r–r– 1 root root  13020 May 25 18:06 courier-authlib-pgsql-0.63.0-1.fc15.x86_64.rpm
-rw-r–r– 1 root root   8276 May 25 18:06 courier-authlib-pipe-0.63.0-1.fc15.x86_64.rpm
-rw-r–r– 1 root root  34108 May 25 18:06 courier-authlib-userdb-0.63.0-1.fc15.x86_64.rpm
-rw-r–r– 1 root root 278520 May 25 18:50 maildrop-2.5.4-1.15.x86_64.rpm
-rw-r–r– 1 root root 685672 May 25 18:50 maildrop-debuginfo-2.5.4-1.15.x86_64.rpm
-rw-r–r– 1 root root  99924 May 25 18:50 maildrop-devel-2.5.4-1.15.x86_64.rpm
-rw-r–r– 1 root root  63968 May 25 18:50 maildrop-man-2.5.4-1.15.x86_64.rpm
[falko@server1 downloads]$

You can now install maildrop like this:

sudo rpm -ivh /root/rpmbuild/RPMS/x86_64/maildrop-2.5.4-1.15.x86_64.rpm

After you have compiled and installed all needed packages, you can become root again by typing

exit

 

12 Install Postfix

Postfix can be installed as follows:

yum install postfix

Then turn off Sendmail and start Postfix and MySQL:

chkconfig –levels 235 mysqld on
/etc/init.d/mysqld start

chkconfig sendmail off
chkconfig –levels 235 postfix on
/etc/init.d/sendmail stop
/etc/init.d/postfix start

 

13 Install Getmail

Getmail can be installed as follows:

yum install getmail

 

14 Set MySQL Passwords And Configure phpMyAdmin

Set passwords for the MySQL root account:

mysql_secure_installation

[root@server1 ~]# mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MySQL
SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MySQL to secure it, we’ll need the current
password for the root user.  If you’ve just installed MySQL, and
you haven’t set the root password yet, the password will be blank,
so you should just press enter here.

Enter current password for root (enter for none): <– ENTER
OK, successfully used password, moving on…

Setting the root password ensures that nobody can log into the MySQL
root user without the proper authorisation.

Set root password? [Y/n] <– ENTER
New password: <– yourrootsqlpassword
Re-enter new password: <– yourrootsqlpassword
Password updated successfully!
Reloading privilege tables..
… Success!

By default, a MySQL installation has an anonymous user, allowing anyone
to log into MySQL without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] <– ENTER
 … Success!

Normally, root should only be allowed to connect from ‘localhost’.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] <– ENTER
 … Success!

By default, MySQL comes with a database named ‘test’ that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] <– ENTER
 – Dropping test database…
… Success!
– Removing privileges on test database…
… Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] <– ENTER
 … Success!

Cleaning up…

All done!  If you’ve completed all of the above steps, your MySQL
installation should now be secure.

Thanks for using MySQL!

[root@server1 ~]#

Now we configure phpMyAdmin. We change the Apache configuration so that phpMyAdmin allows connections not just from localhost (by commenting out the <Directory /usr/share/phpMyAdmin/> stanza):

vi /etc/httpd/conf.d/phpMyAdmin.conf

# phpMyAdmin - Web based MySQL browser written in php
#
# Allows only localhost by default
#
# But allowing phpMyAdmin to anyone other than localhost should be considered
# dangerous unless properly secured by SSL

Alias /phpMyAdmin /usr/share/phpMyAdmin
Alias /phpmyadmin /usr/share/phpMyAdmin

#<Directory /usr/share/phpMyAdmin/>
#   Order Deny,Allow
#   Deny from All
#   Allow from 127.0.0.1
#   Allow from ::1
#</Directory>

<Directory /usr/share/phpMyAdmin/setup/>
   Order Deny,Allow
   Deny from All
   Allow from 127.0.0.1
   Allow from ::1
</Directory>

# These directories do not require access over HTTP - taken from the original
# phpMyAdmin upstream tarball
#
<Directory /usr/share/phpMyAdmin/libraries/>
    Order Deny,Allow
    Deny from All
    Allow from None
</Directory>

<Directory /usr/share/phpMyAdmin/setup/lib/>
    Order Deny,Allow
    Deny from All
    Allow from None
</Directory>

# This configuration prevents mod_security at phpMyAdmin directories from
# filtering SQL etc.  This may break your mod_security implementation.
#
#<IfModule mod_security.c>
#    <Directory /usr/share/phpMyAdmin/>
#        SecRuleInheritance Off
#    </Directory>
#</IfModule>

Then we create the system startup links for Apache and start it:

chkconfig –levels 235 httpd on
/etc/init.d/httpd start

Now you can direct your browser to http://server1.example.com/phpmyadmin/ or http://192.168.0.100/phpmyadmin/ and log in with the user name root and your new root MySQL password.

15 Install Amavisd-new, SpamAssassin And ClamAV

To install amavisd-new, spamassassin and clamav, run the following command:

yum install amavisd-new spamassassin clamav clamav-data clamav-server clamav-update unzip bzip2 perl-DBD-mysql

When we installed ClamAV, a cron job got installed that tries to update the ClamAV virus database every three hours. But this works only if we enable it in /etc/sysconfig/freshclam and /etc/freshclam.conf:

vi /etc/sysconfig/freshclam

Comment out the FRESHCLAM_DELAY line at the end:

## When changing the periodicity of freshclam runs in the crontab,
## this value must be adjusted also. Its value is the timespan between
## two subsequent freshclam runs in minutes. E.g. for the default
##
## | 0 */3 * * *  ...
##
## crontab line, the value is 180 (minutes).
# FRESHCLAM_MOD=

## A predefined value for the delay in seconds. By default, the value is
## calculated by the 'hostid' program. This predefined value guarantees
## constant timespans of 3 hours between two subsequent freshclam runs.
##
## This option accepts two special values:
## 'disabled-warn'  ...  disables the automatic freshclam update and
##                         gives out a warning
## 'disabled'       ...  disables the automatic freshclam silently
# FRESHCLAM_DELAY=


### !!!!! REMOVE ME !!!!!!
### REMOVE ME: By default, the freshclam update is disabled to avoid
### REMOVE ME: network access without prior activation
#FRESHCLAM_DELAY=disabled-warn  # REMOVE ME

vi /etc/freshclam.conf

Comment out the Example line:

[...]
# Comment or remove the line below.
#Example
[...]

Then we start freshclam, amavisd, and clamd…

sa-update
chkconfig –levels 235 amavisd on
chkconfig –levels 235 clamd.amavisd on
/usr/bin/freshclam
/etc/init.d/amavisd start
/etc/init.d/clamd.amavisd start

Next do this:

rm -f /var/spool/amavisd/clamd.sock
mkdir /var/run/clamav.amavisd /var/run/clamd.amavisd /var/run/amavisd
chown amavis /var/run/clamav.amavisd
chown amavis /var/run/clamd.amavisd
chown amavis /var/run/amavisd
ln -sf /var/spool/amavisd/clamd.sock /var/run/clamav.amavisd/clamd.sock
ln -sf /var/spool/amavisd/clamd.sock /var/run/clamd.amavisd/clamd.sock
/etc/init.d/clamd.amavisd restart

Fedora 15 has a /run directory for storing runtime data. /run is now a tmpfs, and /var/run and /var/lock are now bind mounted to /run and /run/lock from tmpfs, and hence emptied on reboot (see https://docs.fedoraproject.org/en-US/Fedora/15/html/Release_Notes/sect-Release_Notes-Changes_for_SysAdmin.html for more details).

This means that after a reboot, the directories /var/run/clamav.amavisd, /var/run/clamd.amavisd, and /var/run/amavisd that we have just created will not exist anymore, and therefore clamd and amavisd will fail to start. Therefore we create the file /etc/tmpfiles.d/amavisd.conf now that will create these directories at system startup (see http://0pointer.de/public/systemd-man/tmpfiles.d.html for more details):

vi /etc/tmpfiles.d/amavisd.conf

D /var/run/clamav.amavisd 0755 amavis root -
D /var/run/clamd.amavisd 0755 amavis root -
D /var/run/amavisd 0755 amavis root -

 

16 Installing mod_php, mod_fcgi/PHP5, And suPHP

ISPConfig 3 allows you to use mod_php, mod_fcgi/PHP5, cgi/PHP5, and suPHP on a per website basis.

We can install Apache2 with mod_php5, mod_fcgid, and PHP5 as follows:

yum install php php-devel php-gd php-imap php-ldap php-mysql php-odbc php-pear php-xml php-xmlrpc php-mbstring php-mcrypt php-mssql php-snmp php-soap php-tidy curl curl-devel perl-libwww-perl ImageMagick libxml2 libxml2-devel mod_fcgid php-cli httpd-devel

Next we open /etc/php.ini

vi /etc/php.ini

… and change the error reporting (so that notices aren’t shown any longer) and uncomment cgi.fix_pathinfo=1:

[...]
;error_reporting = E_ALL & ~E_DEPRECATED
error_reporting = E_ALL & ~E_NOTICE
[...]
; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI.  PHP's
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
; what PATH_INFO is.  For more information on PATH_INFO, see the cgi specs.  Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec.  A setting
; of zero causes PHP to behave as before.  Default is 1.  You should fix your scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; http://www.php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo
cgi.fix_pathinfo=1
[...]

Next we install suPHP:

cd /tmp
wget http://www.suphp.org/download/suphp-0.7.1.tar.gz
tar xvfz suphp-0.7.1.tar.gz
cd suphp-0.7.1/
./configure –prefix=/usr –sysconfdir=/etc –with-apr=/usr/bin/apr-1-config –with-apxs=/usr/sbin/apxs –with-apache-user=apache –with-setid-mode=owner –with-php=/usr/bin/php-cgi –with-logfile=/var/log/httpd/suphp_log –enable-SUPHP_USE_USERGROUP=yes
make
make install

Then we add the suPHP module to our Apache configuration…

vi /etc/httpd/conf.d/suphp.conf

LoadModule suphp_module modules/mod_suphp.so

… and create the file /etc/suphp.conf as follows:

vi /etc/suphp.conf

[global]
;Path to logfile
logfile=/var/log/httpd/suphp.log

;Loglevel
loglevel=info

;User Apache is running as
webserver_user=apache

;Path all scripts have to be in
docroot=/

;Path to chroot() to before executing script
;chroot=/mychroot

; Security options
allow_file_group_writeable=true
allow_file_others_writeable=false
allow_directory_group_writeable=true
allow_directory_others_writeable=false

;Check wheter script is within DOCUMENT_ROOT
check_vhost_docroot=true

;Send minor error messages to browser
errors_to_browser=false

;PATH environment variable
env_path=/bin:/usr/bin

;Umask to set, specify in octal notation
umask=0077

; Minimum UID
min_uid=100

; Minimum GID
min_gid=100

[handlers]
;Handler for php-scripts
x-httpd-suphp="php:/usr/bin/php-cgi"

;Handler for CGI-scripts
x-suphp-cgi="execute:!self"

Finally we restart Apache:

/etc/init.d/httpd restart

 

16.1 Ruby

Starting with version 3.0.3, ISPConfig 3 has built-in support for Ruby. Instead of using CGI/FastCGI, ISPConfig depends on mod_ruby being available in the server’s Apache.

For Fedora 15, there’s no mod_ruby package available, so we must compile it ourselves. First we install some prerequisites:

yum install ruby ruby-devel

Next we download and install mod_ruby as follows:

cd /tmp
wget http://modruby.net/archive/mod_ruby-1.3.0.tar.gz
tar zxvf mod_ruby-1.3.0.tar.gz
cd mod_ruby-1.3.0/
./configure.rb –with-apr-includes=/usr/include/apr-1
make
make install

Finally we must add the mod_ruby module to the Apache configuration, so we create the file /etc/httpd/conf.d/ruby.conf

vi /etc/httpd/conf.d/ruby.conf

LoadModule ruby_module modules/mod_ruby.so
RubyAddPath /1.8

… and restart Apache:

/etc/init.d/httpd restart

(If you leave out the RubyAddPath /1.8 directive, you will see errors like the following ones in Apache’s error log when you call Ruby files:

[Thu May 26 02:05:05 2011] [error] mod_ruby: ruby:0:in `require’: no such file to load — apache/ruby-run (LoadError)
[Thu May 26 02:05:05 2011] [error] mod_ruby: failed to require apache/ruby-run
[Thu May 26 02:05:05 2011] [error] mod_ruby: error in ruby

)

 

16.2 WebDAV

WebDAV should already be enabled, but to check this, open /etc/httpd/conf/httpd.conf and make sure that the following three modules are active:

vi /etc/httpd/conf/httpd.conf

[...]
LoadModule auth_digest_module modules/mod_auth_digest.so
[...]
LoadModule dav_module modules/mod_dav.so
[...]
LoadModule dav_fs_module modules/mod_dav_fs.so
[...]

If you have to modify /etc/httpd/conf/httpd.conf, don’t forget to restart Apache afterwards:

/etc/init.d/httpd restart

 

17 Install PureFTPd

PureFTPd can be installed with the following command:

yum install pure-ftpd

Then create the system startup links and start PureFTPd:

chkconfig –levels 235 pure-ftpd on
/etc/init.d/pure-ftpd start

Now we configure PureFTPd to allow FTP and TLS sessions. FTP is a very insecure protocol because all passwords and all data are transferred in clear text. By using TLS, the whole communication can be encrypted, thus making FTP much more secure.

OpenSSL is needed by TLS; to install OpenSSL, we simply run:

yum install openssl

Open /etc/pure-ftpd/pure-ftpd.conf

vi /etc/pure-ftpd/pure-ftpd.conf

If you want to allow FTP and TLS sessions, set TLS to 1:

[...]
# This option can accept three values :
# 0 : disable SSL/TLS encryption layer (default).
# 1 : accept both traditional and encrypted sessions.
# 2 : refuse connections that don't use SSL/TLS security mechanisms,
#     including anonymous sessions.
# Do _not_ uncomment this blindly. Be sure that :
# 1) Your server has been compiled with SSL/TLS support (--with-tls),
# 2) A valid certificate is in place,
# 3) Only compatible clients will log in.

TLS                      1
[...]

In order to use TLS, we must create an SSL certificate. I create it in /etc/ssl/private/, therefore I create that directory first:

mkdir -p /etc/ssl/private/

Afterwards, we can generate the SSL certificate as follows:

openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem

Country Name (2 letter code) [XX]: <– Enter your Country Name (e.g., “DE”).
State or Province Name (full name) []:
<– Enter your State or Province Name.
Locality Name (eg, city) [Default City]:
<– Enter your City.
Organization Name (eg, company) [Default Company Ltd]:
<– Enter your Organization Name (e.g., the name of your company).
Organizational Unit Name (eg, section) []:
<– Enter your Organizational Unit Name (e.g. “IT Department”).
Common Name (eg, your name or your server’s hostname) []:
<– Enter the Fully Qualified Domain Name of the system (e.g. “server1.example.com”).
Email Address []:
<– Enter your Email Address.

Change the permissions of the SSL certificate:

chmod 600 /etc/ssl/private/pure-ftpd.pem

Finally restart PureFTPd:

/etc/init.d/pure-ftpd restart

That’s it. You can now try to connect using your FTP client; however, you should configure your FTP client to use TLS.

 

18 Install BIND

We can install BIND as follows:

yum install bind bind-utils

Next open /etc/sysconfig/named

vi /etc/sysconfig/named

… and comment out the ROOTDIR=/var/named/chroot line:

# BIND named process options
# ~~~~~~~~~~~~~~~~~~~~~~~~~~
# Currently, you can use the following options:
#
# ROOTDIR="/var/named/chroot"  --  will run named in a chroot environment.
#                            you must set up the chroot environment
#                            (install the bind-chroot package) before
#                            doing this.
#       NOTE:
#         Those directories are automatically mounted to chroot if they are
#         empty in the ROOTDIR directory. It will simplify maintenance of your
#         chroot environment.
#          - /var/named
#          - /etc/pki/dnssec-keys
#          - /etc/named
#          - /usr/lib64/bind or /usr/lib/bind (architecture dependent)
#
#         Those files are mounted as well if target file doesn't exist in
#         chroot.
#          - /etc/named.conf
#          - /etc/rndc.conf
#          - /etc/rndc.key
#          - /etc/named.rfc1912.zones
#          - /etc/named.dnssec.keys
#          - /etc/named.iscdlv.key
#
#       Don't forget to add "$AddUnixListenSocket /var/named/chroot/dev/log"
#       line to your /etc/rsyslog.conf file. Otherwise your logging becomes
#       broken when rsyslogd daemon is restarted (due update, for example).
#
# OPTIONS="whatever"     --  These additional options will be passed to named
#                            at startup. Don't add -t here, use ROOTDIR instead.
#
# KEYTAB_FILE="/dir/file"    --  Specify named service keytab file (for GSS-TSIG)
#
# DISABLE_ZONE_CHECKING  -- By default, initscript calls named-checkzone
#                           utility for every zone to ensure all zones are
#                           valid before named starts. If you set this option
#                           to 'yes' then initscript doesn't perform those
#                           checks.
#ROOTDIR=/var/named/chroot

Then we create the startup links:

chkconfig –levels 235 named on

We don’t start BIND now because it must be configured first – this will be done automatically by the ISPConfig 3 installer later on.

 

19 Install Vlogger, Webalizer, And AWStats

Vlogger, webalizer, and AWStats can be installed as follows:

yum install webalizer awstats perl-DateTime-Format-HTTP perl-DateTime-Format-Builder

cd /tmp
wget http://n0rp.chemlab.org/vlogger/vlogger-1.3.tar.gz
tar xvfz vlogger-1.3.tar.gz
mv vlogger-1.3/vlogger /usr/sbin/
rm -rf vlogger*

 

20 Install Jailkit

Jailkit is needed only if you want to chroot SSH users. It can be installed as follows (important: Jailkit must be installed before ISPConfig – it cannot be installed afterwards!):

cd /tmp
wget http://olivier.sessink.nl/jailkit/jailkit-2.14.tar.gz
tar xvfz jailkit-2.14.tar.gz
cd jailkit-2.14
./configure
make
make install
cd ..
rm -rf jailkit-2.14*

 

21 Install fail2ban

This is optional but recommended, because the ISPConfig monitor tries to show the log:

yum install fail2ban

chkconfig –levels 235 fail2ban on
/etc/init.d/fail2ban start

 

22 Install rkhunter

rkhunter can be installed as follows:

yum install rkhunter

23 Install SquirrelMail

To install the SquirrelMail webmail client, run…

yum install squirrelmail

… and restart Apache:

/etc/init.d/httpd restart

Then configure SquirrelMail:

/usr/share/squirrelmail/config/conf.pl

We must tell SquirrelMail that we are using Courier-IMAP/-POP3:

SquirrelMail Configuration : Read: config.php (1.4.0)
———————————————————
Main Menu —
1.  Organization Preferences
2.  Server Settings
3.  Folder Defaults
4.  General Options
5.  Themes
6.  Address Books
7.  Message of the Day (MOTD)
8.  Plugins
9.  Database
10. Languages

D.  Set pre-defined settings for specific IMAP servers

C   Turn color off
S   Save data
Q   Quit

Command >> <– D

SquirrelMail Configuration : Read: config.php
———————————————————
While we have been building SquirrelMail, we have discovered some
preferences that work better with some servers that don’t work so
well with others.  If you select your IMAP server, this option will
set some pre-defined settings for that server.

Please note that you will still need to go through and make sure
everything is correct.  This does not change everything.  There are
only a few settings that this will change.

Please select your IMAP server:
bincimap    = Binc IMAP server
courier     = Courier IMAP server
cyrus       = Cyrus IMAP server
dovecot     = Dovecot Secure IMAP server
exchange    = Microsoft Exchange IMAP server
hmailserver = hMailServer
macosx      = Mac OS X Mailserver
mercury32   = Mercury/32
uw          = University of Washington’s IMAP server
gmail       = IMAP access to Google mail (Gmail) accounts

quit        = Do not change anything
Command >> <– courier

SquirrelMail Configuration : Read: config.php
———————————————————
While we have been building SquirrelMail, we have discovered some
preferences that work better with some servers that don’t work so
well with others.  If you select your IMAP server, this option will
set some pre-defined settings for that server.

Please note that you will still need to go through and make sure
everything is correct.  This does not change everything.  There are
only a few settings that this will change.

Please select your IMAP server:
bincimap    = Binc IMAP server
courier     = Courier IMAP server
cyrus       = Cyrus IMAP server
dovecot     = Dovecot Secure IMAP server
exchange    = Microsoft Exchange IMAP server
hmailserver = hMailServer
macosx      = Mac OS X Mailserver
mercury32   = Mercury/32
uw          = University of Washington’s IMAP server
gmail       = IMAP access to Google mail (Gmail) accounts

quit        = Do not change anything
Command >> courier

imap_server_type = courier
default_folder_prefix = INBOX.
trash_folder = Trash
sent_folder = Sent
draft_folder = Drafts
show_prefix_option = false
default_sub_of_inbox = false
show_contain_subfolders_option = false
optional_delimiter = .
delete_folder = true

Press any key to continue… <– press ENTER

SquirrelMail Configuration : Read: config.php (1.4.0)
———————————————————
Main Menu —
1.  Organization Preferences
2.  Server Settings
3.  Folder Defaults
4.  General Options
5.  Themes
6.  Address Books
7.  Message of the Day (MOTD)
8.  Plugins
9.  Database
10. Languages

D.  Set pre-defined settings for specific IMAP servers

C   Turn color off
S   Save data
Q   Quit

Command >> <–S

SquirrelMail Configuration : Read: config.php (1.4.0)
———————————————————
Main Menu —
1.  Organization Preferences
2.  Server Settings
3.  Folder Defaults
4.  General Options
5.  Themes
6.  Address Books
7.  Message of the Day (MOTD)
8.  Plugins
9.  Database
10. Languages

D.  Set pre-defined settings for specific IMAP servers

C   Turn color off
S   Save data
Q   Quit

Command >> <–Q

One last thing we need to do is modify the file /etc/squirrelmail/config_local.php and comment out the $default_folder_prefix variable – if you don’t do this, you will see the following error message in SquirrelMail after you’ve logged in: Query: CREATE “Sent” Reason Given: Invalid mailbox name.

vi /etc/squirrelmail/config_local.php

<?php

/**
 * Local config overrides.
 *
 * You can override the config.php settings here.
 * Don't do it unless you know what you're doing.
 * Use standard PHP syntax, see config.php for examples.
 *
 * @copyright &copy; 2002-2006 The SquirrelMail Project Team
 * @license http://opensource.org/licenses/gpl-license.php GNU Public License
 * @version $Id$
 * @package squirrelmail
 * @subpackage config
 */

//$default_folder_prefix                = '';
?>

Now you can type in http://server1.example.com/webmail or http://192.168.0.100/webmail in your browser to access SquirrelMail.

32

24 Install ISPConfig 3

To install ISPConfig 3 from the latest released version, do this:

cd /tmp
wget http://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gz
tar xfz ISPConfig-3-stable.tar.gz
cd ispconfig3_install/install/

The next step is to run

php -q install.php

This will start the ISPConfig 3 installer:

[root@server1 install]# php -q install.php

——————————————————————————–
_____ ___________   _____              __ _         ____
|_   _/  ___| ___ \ /  __ \            / _(_)       /__  \
| | \ `–.| |_/ / | /  \/ ___  _ __ | |_ _  __ _    _/ /
| |  `–. \  __/  | |    / _ \| ‘_ \|  _| |/ _` |  |_ |
_| |_/\__/ / |     | \__/\ (_) | | | | | | | (_| | ___\ \
\___/\____/\_|      \____/\___/|_| |_|_| |_|\__, | \____/
__/ |
|___/
——————————————————————————–

>> Initial configuration

Operating System: Redhat or compatible, unknown version.

Following will be a few questions for primary configuration so be careful.
Default values are in [brackets] and can be accepted with <ENTER>.
Tap in “quit” (without the quotes) to stop the installer.

Select language (en,de) [en]: <– ENTER

Installation mode (standard,expert) [standard]: <– ENTER

Full qualified hostname (FQDN) of the server, eg server1.domain.tld  [server1.example.com]: <– ENTER

MySQL server hostname [localhost]: <– ENTER

MySQL root username [root]: <– ENTER

MySQL root password []:  <– yourrootsqlpassword

MySQL database to create [dbispconfig]: <– ENTER

MySQL charset [utf8]: <– ENTER

Generating a 2048 bit RSA private key
……+++
……………+++
writing new private key to ‘smtpd.key’
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [XX]:
 <– ENTER
State or Province Name (full name) []: <– ENTER
Locality Name (eg, city) [Default City]: <– ENTER
Organization Name (eg, company) [Default Company Ltd]: <– ENTER
Organizational Unit Name (eg, section) []: <– ENTER
Common Name (eg, your name or your server’s hostname) []: <– ENTER
Email Address []: <– ENTER
Configuring Jailkit
Configuring SASL
Configuring PAM
Configuring Courier
Configuring Spamassassin
Configuring Amavisd
Configuring Getmail
Configuring Pureftpd
Configuring BIND
Configuring Apache
Configuring Vlogger
Configuring Apps vhost
Configuring Firewall
Installing ISPConfig
ISPConfig Port [8080]:
 <– ENTER

Configuring DBServer
Installing ISPConfig crontab
no crontab for root
no crontab for getmail
Restarting services …
Restarting mysqld (via systemctl):                         [  OK  ]
Restarting postfix (via systemctl):                        [  OK  ]
Restarting saslauthd (via systemctl):                      [  OK  ]
Restarting amavisd (via systemctl):                        [  OK  ]
Restarting clamd.amavisd (via systemctl):                  [  OK  ]
Stopping Courier authentication services: authdaemond
Starting Courier authentication services: authdaemond
Stopping Courier-IMAP server: imap imap-ssl pop3 pop3-ssl
Starting Courier-IMAP server: imap generating-SSL-certificate… imap-ssl pop3 generating-SSL-certificate… pop3-ssl
Stopping Courier-IMAP server: imap imap-ssl pop3 pop3-ssl
Starting Courier-IMAP server: imap imap-ssl pop3 pop3-ssl
Stopping Courier-IMAP server: imap imap-ssl pop3 pop3-ssl
Starting Courier-IMAP server: imap imap-ssl pop3 pop3-ssl
Stopping Courier-IMAP server: imap imap-ssl pop3 pop3-ssl
Starting Courier-IMAP server: imap imap-ssl pop3 pop3-ssl
Restarting httpd (via systemctl):                          [  OK  ]
Restarting pure-ftpd (via systemctl):                      [  OK  ]
Installation completed.
[root@server1 install]#

The installer automatically configures all underlying services, so no manual configuration is needed.

Afterwards you can access ISPConfig 3 under http://server1.example.com:8080/ or http://192.168.0.100:8080/. Log in with the username admin and the password admin (you should change the default password after your first login):

33

34

The system is now ready to be used.

 

 

  • Fedora: http://fedoraproject.org/
  • Network Device Naming: http://fedoraproject.org/wiki/Features/ConsistentNetworkDeviceNaming
  • /run directory: https://docs.fedoraproject.org/en-US/Fedora/15/html/Release_Notes/sect-Release_Notes-Changes_for_SysAdmin.html
  • tmpfiles.d: http://0pointer.de/public/systemd-man/tmpfiles.d.html
  • ISPConfig: http://www.ispconfig.org/

 

 

Comments

comments