Set up linux box for secure local hosting a-z
- by microchasm
I am in the process of reinstalling the OS on a machine that will be used to host a couple of apps for our business. The apps will be local only; access from external clients will be via vpn only.
The prior setup used a hosting control panel (Plesk) for most of the admin, and I was looking at using another similar piece of software for the reinstall - but I figured I should finally learn how it all works. I can do most of the things the software would do for me, but am unclear on the symbiosis of it all. This is all an attempt to further distance myself from the land of Configuration Programmer/Programmer, if at all possible.
I can't find a full walkthrough anywhere for what I'm looking for, so I thought I'd put up this question, and if people can help me on the way I will edit this with the answers, and document my progress/pitfalls. Hopefully someday this will help someone down the line.
The details:
CentOS 5.5 x86_64
httpd: Apache/2.2.3
mysql: 5.0.77 (to be upgraded)
php: 5.1 (to be upgraded)
The requirements:
SECURITY!!
Secure file transfer
Secure client access (SSL Certs and CA)
Secure data storage
Virtualhosts/multiple subdomains
Local email would be nice, but not critical
The Steps:
Download latest CentOS DVD-iso (torrent worked great for me).
Install CentOS:
While going through the install, I checked the Server Components option thinking I was going to be using another Plesk-like admin. In hindsight, considering I've decided to try to go my own way, this probably wasn't the best idea.
Basic config:
Setup users, networking/ip address etc. Yum update/upgrade.
Upgrade PHP/MySQL:
To upgrade PHP and MySQL to the latest versions, I had to look to another repo outside CentOS. IUS looks great and I'm happy I found it!
Add IUS repository to our package manager
cd /tmp
wget http://dl.iuscommunity.org/pub/ius/stable/Redhat/5/x86_64/epel-release-1-1.ius.el5.noarch.rpm
rpm -Uvh epel-release-1-1.ius.el5.noarch.rpm
wget http://dl.iuscommunity.org/pub/ius/stable/Redhat/5/x86_64/ius-release-1-4.ius.el5.noarch.rpm
rpm -Uvh ius-release-1-4.ius.el5.noarch.rpm
yum list | grep -w \.ius\. # list all the packages in the IUS repository; use this to find PHP/MySQL version and libraries you want to install
Remove old version of PHP and install newer version from IUS
rpm -qa | grep php # to list all of the installed php packages we want to remove
yum shell # open an interactive yum shell
remove php-common php-mysql php-cli #remove installed PHP components
install php53 php53-mysql php53-cli php53-common #add packages you want
transaction solve #important!! checks for dependencies
transaction run #important!! does the actual installation of packages.
[control+d] #exit yum shell
php -v
PHP 5.3.2 (cli) (built: Apr 6 2010 18:13:45)
Upgrade MySQL from IUS repository
/etc/init.d/mysqld stop
rpm -qa | grep mysql # to see installed mysql packages
yum shell
remove mysql mysql-server #remove installed MySQL components
install mysql51 mysql51-server mysql51-devel
transaction solve #important!! checks for dependencies
transaction run #important!! does the actual installation of packages.
[control+d] #exit yum shell
service mysqld start
mysql -v
Server version: 5.1.42-ius Distributed by The IUS Community Project
Upgrade instructions courtesy of IUS wiki: http://wiki.iuscommunity.org/Doc/ClientUsageGuide
Install rssh (restricted shell) to provide scp and sftp access, without allowing ssh login
cd /tmp
wget http://dag.wieers.com/rpm/packages/rssh/rssh-2.3.2-1.2.el5.rf.x86_64.rpm
rpm -ivh rssh-2.3.2-1.2.el5.rf.x86_64.rpm
useradd -m -d /home/dev -s /usr/bin/rssh dev
passwd dev
Edit /etc/rssh.conf to grant access to SFTP to rssh users.
vi /etc/rssh.conf
Uncomment or add:
allowscp
allowsftp
This allows me to connect to the machine via SFTP protocol in Transmit (my FTP program of choice; I'm sure it's similar with other FTP apps).
rssh instructions appropriated (with appreciation!) from http://www.cyberciti.biz/tips/linux-unix-restrict-shell-access-with-rssh.html
Set up virtual interfaces
ifconfig eth1:1 192.168.1.3 up #start up the virtual interface
cd /etc/sysconfig/network-scripts/
cp ifcfg-eth1 ifcfg-eth1:1 #copy default script and match name to our virtual interface
vi ifcfg-eth1:1 #modify eth1:1 script
#ifcfg-eth1:1 | modify so it looks like this:
DEVICE=eth1:1
IPADDR=192.168.1.3
NETMASK=255.255.255.0
NETWORK=192.168.1.0
ONBOOT=yes
NAME=eth1:1
Add more Virtual interfaces as needed by repeating. Because of the ONBOOT=yes line in the ifcfg-eth1:1 file, this interface will be brought up when the system boots, or the network starts/restarts.
service network restart
Shutting down interface eth0: [ OK ]
Shutting down interface eth1: [ OK ]
Shutting down loopback interface: [ OK ]
Bringing up loopback interface: [ OK ]
Bringing up interface eth0: [ OK ]
Bringing up interface eth1: [ OK ]
ping 192.168.1.3
64 bytes from 192.168.1.3: icmp_seq=1 ttl=64 time=0.105 ms
Virtualhosts
In the rssh section above I added a user to use for SFTP. In this users' home directory, I created a folder called 'https'. This is where the documents for this site will live, so I need to add a virtualhost that will point to it. I will use the above virtual interface for this site (herein called dev.site.local).
vi /etc/http/conf/httpd.conf
Add the following to the end of httpd.conf:
<VirtualHost 192.168.1.3:80>
ServerAdmin dev@site.local
DocumentRoot /home/dev/https
ServerName dev.site.local
ErrorLog /home/dev/logs/error_log
TransferLog /home/dev/logs/access_log
</VirtualHost>
I put a dummy index.html file in the https directory just to check everything out. I tried browsing to it, and was met with permission denied errors. The logs only gave an obscure reference to what was going on:
[Mon May 17 14:57:11 2010] [error] [client 192.168.1.100] (13)Permission denied: access to /index.html denied
I tried chmod 777 et. al., but to no avail. Turns out, I needed to chmod+x the https directory and its' parent directories.
chmod +x /home
chmod +x /home/dev
chmod +x /home/dev/https
This solved that problem.
DNS
I'm handling DNS via our local Windows Server 2003 box. However, the CentOS documentation for BIND can be found here: http://www.centos.org/docs/5/html/Deployment_Guide-en-US/ch-bind.html
SSL
To get SSL working, I changed the following in httpd.conf:
NameVirtualHost 192.168.1.3:443 #make sure this line is in httpd.conf
<VirtualHost 192.168.1.3:443> #change port to 443
ServerAdmin dev@site.local
DocumentRoot /home/dev/https
ServerName dev.site.local
ErrorLog /home/dev/logs/error_log
TransferLog /home/dev/logs/access_log
</VirtualHost>
Unfortunately, I keep getting (Error code: ssl_error_rx_record_too_long) errors when trying to access a page with SSL. As JamesHannah gracefully pointed out below, I had not set up the locations of the certs in httpd.conf, and thusly was getting the page thrown at the broswer as the cert making the browser balk.
So first, I needed to set up a CA and make certificate files. I found a great (if old) walkthrough on the process here: http://www.debian-administration.org/articles/284.
Here are the relevant steps I took from that article:
mkdir /home/CA
cd /home/CA/
mkdir newcerts private
echo '01' > serial
touch index.txt #this and the above command are for the database that will keep track of certs
Create an openssl.cnf file in the /home/CA/ dir and edit it per the walkthrough linked above. (For reference, my finished openssl.cnf file looked like this: http://pastebin.com/raw.php?i=hnZDij4T)
openssl req -new -x509 -extensions v3_ca -keyout private/cakey.pem -out cacert.pem -days 3650 -config ./openssl.cnf #this creates the cacert.pem which gets distributed and imported to the browser(s)
Modified openssl.cnf again per walkthrough instructions.
openssl req -new -nodes -out dev.req.pem -config ./openssl.cnf #generates certificate request, and key.pem which I renamed dev.key.pem.
Modified openssl.cnf again per walkthrough instructions.
openssl ca -out dev.cert.pem -config ./openssl.cnf -infiles dev.req.pem #create and sign certificate.
cp dev.cert.pem /home/dev/certs/cert.pem
cp dev.key.pem /home/certs/key.pem
I updated httpd.conf to reflect the certs and turn SSLEngine on:
NameVirtualHost 192.168.1.3:443
<VirtualHost 192.168.1.3:443>
ServerAdmin dev@site.local
DocumentRoot /home/dev/https
SSLEngine on
SSLCertificateFile /home/dev/certs/cert.pem
SSLCertificateKeyFile /home/dev/certs/key.pem
ServerName dev.site.local
ErrorLog /home/dev/logs/error_log
TransferLog /home/dev/logs/access_log
</VirtualHost>
Put the CA cert.pem in a web-accessible place, and downloaded/imported it into my browser. Now I can visit https://dev.site.local with no errors or warnings.
And this is where I'm at. I will keep editing this as I make progress. Any tips on how to configure SSL email would be appreciated.
