HTTP Strict Transport Security for Apache, NGINX and Lighttpd

HTTP Strict Transport Security (often abbreviated as HSTS) is a security feature that lets a web site tell browsers that it should only be communicated with using HTTPS, instead of using HTTP. This tutorial will show you how to set up HSTS in Apache2, NGINX and Lighttpd. It is tested with all mentioned webservers, NGINX 1.1.19, Lighttpd 1.4.28 and Apache 2.2.22 on Ubuntu 12.04, Debian 6 & 7 and CentOS 6.It should work on other distro’s however, these are just reference values.

What is HTTP Strict Transport Security?

Quoting the Mozilla Developer Network:

If a web site accepts a connection through HTTP and redirects to HTTPS, the user in this case may initially talk to the non-encrypted version of the site before being redirected, if, for example, the user types http://www.foo.com/ or even just foo.com.

This opens up the potential for a man-in-the-middle attack, where the redirect could be exploited to direct a user to a malicious site instead of the secure version of the original page.

The HTTP Strict Transport Security feature lets a web site inform the browser that it should never load the site using HTTP, and should automatically convert all attempts to access the site using HTTP to HTTPS requests instead.

An example scenario:

You log into a free WiFi access point at an airport and start surfing the web, visiting your online banking service to check your balance and pay a couple of bills. Unfortunately, the access point you're using is actually a hacker's laptop, and they're intercepting your original HTTP request and redirecting you to a clone of your bank's site instead of the real thing. Now your private data is exposed to the hacker.

Strict Transport Security resolves this problem; as long as you've accessed your bank's web site once using HTTPS, and the bank's web site uses Strict Transport Security, your browser will know to automatically use only HTTPS, which prevents hackers from performing this sort of man-in-the-middle attack.

Do note that HSTS does not work if you’ve never visited the website before. A website needs to tell you it is HTTPS only.

Set up HSTS in Apache2

Edit your apache configuration file (/etc/apache2/sites-enabled/website.conf and /etc/apache2/httpd.conf for example) and add the following to your VirtualHost:

# Optionally load the headers module:
LoadModule headers_module modules/mod_headers.so

<VirtualHost 67.89.123.45:443>
    Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
</VirtualHost>

Now your website will set the header every time someone visits, with an expiration date of two years (in seconds). It sets it at every visit. So tomorrow, it will say two years again.
You do have to set it on the HTTPS vhost only. It cannot be in the http vhost.

To redirect your visitors to the HTTPS version of your website, use the following configuration:

<VirtualHost *:80>
  [...]
  ServerName example.com
  Redirect permanent / https://example.com/
</VirtualHost>

If you only redirect, you dont even need a document root.

You can also use modrewrite, however the above method is simpler and safer. However, modrewrite below redirects the user to the page they were visiting over https, the above config just redirects to /:

<VirtualHost *:80>
  [...]
  <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
  </IfModule>
</VirtualHost>

And don’t forget to restart Apache.

Lighttpd

The lighttpd variant is just as simple. Add it to your Lighttpd configuration file (/etc/lighttpd/lighttpd.conf for example):

server.modules += ( "mod_setenv" )
$HTTP["scheme"] == "https" {
    setenv.add-response-header  = ( "Strict-Transport-Security" => "max-age=63072000; includeSubdomains; preload")
}

And restart Lighttpd. Here the time is also two years.

NGINX

NGINX is even shorter with its config. Add this in the server block for your HTTPS configuration:

add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";

Don’t forget to restart NGINX.

X-Frame-Options header

The last tip I’ll give you is the X-Frame-Options header, which you can add to your HTTPS website to make sure it is not embedded in a frame or iframe. This avoids clickjacking, and might be helpfull for HTTPS websites. Quoting the Mozilla Developer Network again:

The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a `<frame>` or `<iframe>`. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites.

You can change DENY to SAMEORIGIN or ALLOW-FROM uri, see the Mozilla link above for more information on that. (Or the RFC.)

X-Frame-Options for Apache2

As above, add this to the apache config file:

Header always set X-Frame-Options DENY

Lighttpd

This goes in the lighttpd config. Make sure you don’t double the above set config, if you have that, just add the rule it to it.

server.modules += ( "mod_setenv" )
$HTTP["scheme"] == "https" {
    setenv.add-response-header  = ( "X-Frame-Options" => "DENY")
}

NGINX

Yet again, in a server block:

add_header X-Frame-Options "DENY";

Set up a federated XMPP Chat Network with ejabberd, and how to Configure and Setup SSL Certificate for Ejabberd

This tutorial shows you how to set up your own federated chat network using ejabberd. It covers a basic single node ejabberd server and also the setup of an ejabberd cluster, including errors and DNS SRV record examples. Last but not least federation is also covered. You can use (almost) any VPS.

Why set up your own XMPP server

There are a few reasons to set up your own XMPP server.

You might use Google Talk or as it now is named Hangouts. Google’s service recently changed and it is going to drop XMPP compatibility. If you have non-gmail chat contacts you can keep chatting to them. And still use an open protocol which is widely supported, not being locked in to google specific software and hardware.

Or you might want to have more control over the logging of your data. Turn of ejabberd logging and use Off The Record which gives you full privacy (and perfect forward secrecy).

You might want to use awesome multi-account chatting applications like Pidgin, Psi+, Empathy, Adium, iChat/Messages or Miranda IM. And on Android you can use Xabber, Beem or OneTeam. Did you know that big players like Facebook, WhatsApp and Google (used) to use XMPP as their primary chat protocol?

Or you might be a sysadmin in need of an internal chat solution. I’ve got a ejabberd cluster running for a client consisting of 4 Debian 7 VM’s (2GB RAM each) spread over 3 sites and 1 datacenter, serving 12000 total users and most of the time 6000 concurrently.

XMPP is an awesome and extendible protocol, on which you can find more here: https://en.wikipedia.org/wiki/XMPP

Information

This setup is tested on Debian 7, Ubuntu 12.04 and 10.04 and OS X 10.8 Server, all running ejabberd installed via the package manager, either apt or ports. It also works on Windows Server 2012 with the ejabberd compiled from the erlang source but that is not covered in this tutorial.

This tutorial uses the example.org domain as the chat domain, and the server chat.example.org as the xmpp server domain. For the clustering part the servers srv1.example.org and srv2.example.org are used. Replace these values for your setup.

Single node / master node ejabberd installation

If you want to set up a single node installation of ejabberd, e.g. no clustering, then follow only this part and the DNS part of the tutorial. If you want to set up a cluster, then also follow this part and continue with the next part.

Installing Ejabberd

This is simple, use your package manager to install ejabberd:

apt-get install ejabberd

You will also install a few dependencies for the erlang runtime.

Configuring ejabberd

We are going to configure the ejabberd service. First stop it:

/etc/init.d/ejabberd stop

Now use your favorite text editor to edit the config files. The ejabberd config is erlang config, so comments are not # but %%. Also, every config option ends with a dot (.).

vim /etc/ejabberd/ejabberd.cfg

First we are going to add our chat domain name:

{hosts, ["example.org"]}.

If you want more domains then you add them as shown below:

{hosts, ["sparklingclouds.nl", "raymii.org", "sparklingnetwork.nl"]}.

This domain name is not the name of the servers you are adding.

Next we define an admin user:

{acl, admin, {user, "remy", "example.org"}}.

remy corresponds with the part before the @ in the XMPP ID, and example.org with the part after. If you need more admin users, add another ACL line.

Now if you want people to be able to register via their XMPP client enable in band registration:

{access, register, [{allow, all}]}.

If you are using MySQL or LDAP authentication then you wouldn’t enable this.

I like to have a shared roster with roster groups, and some clients of mine use a shared roster with everybody so that nobody has to add contacts but they see all online users, enable the modsharedroster:

%% Do this in the modules block
  {mod_shared_roster,[]},

If you are pleased with the config file, save it and restart ejabberd:

/etc/init.d/ejabberd restart

We now need to register a user to test our setup. If you’ve enabled in-band registration you can use your XMPP client, and if you did not enable in-band registration you can use the ejabberdctl command:

ejabberdctl register remy example.org 'passw0rd'

Now test it using an XMPP client like Pidgin, Psi+ or Empathy. If you can connect, then you can continue with the tutorial. If you cannot connect, check your ejabberd logs, firewall setting and such to troubleshoot it.

Clustering ejabberd

Note that you have to have a correctly working master node to continue with the ejabberd clustering. If your master node is not working then fix that first.

Important: the modules you use should be the same on every cluster node. If you use LDAP/MySQL authentication, or a shared_roster, or special MUC settings, or offline messaging, for the clustering this does not matter as long as it is on all nodes.

So lets get started. We are first going to configure the master node, and then the slave nodes.

Prepare the master node

Stop the ejabberd server on the master and edit the /etc/default/ejabberd file:

vim /etc/default/ejabberd

Uncomment the hostname option and change it to a FQDN hostname:

ERLANG_NODE=ejabberd@srv1.example.org

And add the external (public) IP addres as a tuple (no dots but comma’s):

INET_DIST_INTERFACE={20,30,10,5}

If you use ejabberd internally then use the primary NIC address.

We are going to remove all the mnesia tables. They will be rebuilt with an ejabberd restart. This is way easier then changing the mnesia data itself. Don’t do this on a already configured node without backing up the erlang cookie.

First backup the erlang cookie:

cp /var/lib/ejabberd/.erlang.cookie ~/

Then remove the mnesia database:

rm /var/lib/ejabberd/*

And restore the erlang cookie:

cp ~/.erlang.cookie /var/lib/ejabberd/.erlang.cookie

To make sure all erlang processes are stopped kill all processes from the ejabberd user. This is not needed but the epmd supervisor process might still be running:

killall -u ejabberd

And start ejabberd again:

/etc/init.d/ejabberd start 

If you can still connect and chat, then continue with the next part, configuring the slave nodes.

Prepare the slave nodes

*A slave node should first be configured and working as described in the first part of this tutorial. You can copy the config files from the master node. *

Stop the ejabberd server:

/etc/init.d/ejabberd stop

Stop the ejabberd server on the master and edit the /etc/default/ejabberd file:

vim /etc/default/ejabberd

Uncomment the hostname option and change it to a FQDN hostname:

ERLANG_NODE=ejabberd@srv2.example.org

And add the external (public) IP addres as a tuple (no dots but comma’s):

INET_DIST_INTERFACE={30,40,20,6}

If you use ejabberd internally then use the primary NIC address.

Now remove all the mnesia tables:

rm /var/lib/ejabberd/*

Copy the cookie from the ejabberd master node, either by cat and vim or via scp:

# On the master node
cat /var/lib/ejabberd/.erlang.cookie
HFHHGYYEHF362GG1GF

# On the slave node
echo "HFHHGYYEHF362GG1GF" > /var/lib/ejabberd/.erlang.cookie
chown ejabberd:ejabberd /var/lib/ejabberd/.erlang.cookie

We are now going to add and compile an erlang module, the easy_cluster module. This is a very small module which adds an erlang shell command to make the cluster addition easier. You can also execute the commands in the erlang functions itself on an erlang debug shell, but I find this easier and it gives less errors:

vim /usr/lib/ejabberd/ebin/easy_cluster.erl

Add the following contents:

-module(easy_cluster).

-export([test_node/1,join/1]).

test_node(MasterNode) ->
    case net_adm:ping(MasterNode) of 'pong' ->
        io:format("server is reachable.~n");
    _ ->
        io:format("server could NOT be reached.~n")
    end.

join(MasterNode) ->
    application:stop(ejabberd),
    mnesia:stop(),
    mnesia:delete_schema([node()]),
    mnesia:start(),
    mnesia:change_config(extra_db_nodes, [MasterNode]),
    mnesia:change_table_copy_type(schema, node(), disc_copies),
    application:start(ejabberd).

Save it and compile it into a working erlang module:

cd /usr/lib/ejabberd/ebin/
erlc easy_cluster.erl

Now check if it succeeded:

ls | grep easy_cluster.beam

If you see the file it worked. You can find more info on the module here: https://github.com/chadillac/ejabberd-easy_cluster/

We are now going to join the cluster node to the master node. Make sure the master is working and running. Also make sure the erlang cookies are synchronized.

On the slave node, start an ejabberd live shell:

/etc/init.d/ejabberd live

This will start an erlang shell and it will give some output. If it stops outputting then you can press ENTER to get a prompt. Enter the following command to test if the master node can be reached:

easy_cluster:test_node('ejabberd@srv1.example.org').

You should get the following response: server is reachable. If so, continue.

Enter the following command to actually join the node:

easy_cluster:join('ejabberd@srv1.example.org').

Here’s example output from a successful test and join join:

/etc/init.d/ejabberd live
*******************************************************
* To quit, press Ctrl-g then enter q and press Return *
*******************************************************

Erlang R15B01 (erts-5.9.1)  [async-threads:0] [kernel-poll:false]

Eshell V5.9.1  (abort with ^G)

=INFO REPORT==== 10-Jun-2013::20:38:15 ===
I(<0.39.0>:cyrsasl_digest:44) : FQDN used to check DIGEST-MD5 SASL authentication: "srv2.example.org"

=INFO REPORT==== 10-Jun-2013::20:38:15 ===
I(<0.576.0>:ejabberd_listener:166) : Reusing listening port for 5222

=INFO REPORT==== 10-Jun-2013::20:38:15 ===
I(<0.577.0>:ejabberd_listener:166) : Reusing listening port for 5269

=INFO REPORT==== 10-Jun-2013::20:38:15 ===
I(<0.578.0>:ejabberd_listener:166) : Reusing listening port for 5280

=INFO REPORT==== 10-Jun-2013::20:38:15 ===
I(<0.39.0>:ejabberd_app:72) : ejabberd 2.1.10 is started in the node 'ejabberd@srv2.example.org'
easy_cluster:test_node('ejabberd@srv1.example.org').
server is reachable.
ok
(ejabberd@srv2.example.org)2> easy_cluster:join('ejabberd@srv1.example.org').

=INFO REPORT==== 10-Jun-2013::20:38:51 ===
I(<0.39.0>:ejabberd_app:89) : ejabberd 2.1.10 is stopped in the node 'ejabberd@srv2.example.org'

=INFO REPORT==== 10-Jun-2013::20:38:51 ===
    application: ejabberd
    exited: stopped
    type: temporary

=INFO REPORT==== 10-Jun-2013::20:38:51 ===
    application: mnesia
    exited: stopped
    type: permanent

=INFO REPORT==== 10-Jun-2013::20:38:52 ===
I(<0.628.0>:cyrsasl_digest:44) : FQDN used to check DIGEST-MD5 SASL authentication: "srv2.example.org"

=INFO REPORT==== 10-Jun-2013::20:38:53 ===
I(<0.1026.0>:ejabberd_listener:166) : Reusing listening port for 5222

=INFO REPORT==== 10-Jun-2013::20:38:53 ===
I(<0.1027.0>:ejabberd_listener:166) : Reusing listening port for 5269

=INFO REPORT==== 10-Jun-2013::20:38:53 ===
I(<0.1028.0>:ejabberd_listener:166) : Reusing listening port for 5280
ok
(ejabberd@srv2.example.org)3>
=INFO REPORT==== 10-Jun-2013::20:38:53 ===
I(<0.628.0>:ejabberd_app:72) : ejabberd 2.1.10 is started in the node 'ejabberd@srv2.example.org'

Exit your erlang shell by pressing CTRL+C twice. Now stop ejabberd and start it again:

/etc/init.d/ejabberd restart

You can now check in the admin webinterface if the cluster join succeeded:

http://srv1.example.org:5280/admin/nodes/

If it shows the other node you are finished. If not, see if the steps worked and check the below section on troubleshooting.

Repeat the above steps for every node you want to add. You can add as many nodes as you want.

Errors when clustering

When setting up your cluster you might run into errors. Below are my notes for the errors I found.

• ejabberd restart does not restart epmd (erlang daemon)
  • overkill solution: killall -u ejabberd
• ejabberd gives hostname errors
  • make sure the hostname is set correctly (hostname srv1.example.com)
• ejabberd gives inconsistent database errors
  • backup the erlang cookie (/var/lib/ejabberd/.erlang.cookie) and then remove the contents of the /var/lib/ejabberd folder so that mnesia rebuilds its tables.
• ejabberd reports “Connection attempt from disallowed node”
  • make sure the erlang cookie is correct (/var/lib/ejabberd/.erlang.cookie). Set vim in insert mode before pasting…

DNS SRV Records and Federation

The DNS SRV Record is used both by chat clients to find the right server address as well as by other XMPP servers for federation. Example: Alice configures her XMPP clients with the email address alice@example.org. Her chat client looks up the SRV record and knows the chat server to connect to is chat.example.org. Bob sets up his client with the address bob@bobsbussiness.com, and adds Alice as a contact. The XMPP server at bobsbussiness.com looks up the SRV record and knows that it should initiate a server2server connection tochat.example.org to federate and let Bob connect with Alice.

The BIND 9 config looks like this:

; XMPP
_xmpp-client._tcp                       IN SRV 5 0 5222 chat.example.org.
_xmpp-server._tcp                       IN SRV 5 0 5269 chat.example.org.
_jabber._tcp                            IN SRV 5 0 5269 chat.example.org.

It is your basic SRV record, both the client port and the server2server port, and legacy Jabber. If you have hosted DNS then either enter it in your panel or consult your service provider.

You can use the following dig query to verify your SRV records:

dig _xmpp-client._tcp.example.org SRV
dig _xmpp-server._tcp.example.org SRV

Or if you are on Windows and have to use nslookup:

nslookup -querytype=SRV _xmpp-client._tcp.example.org
nslookup -querytype=SRV _xmpp-server._tcp.example.org

If you get a result like this then you are set up correctly:

;; QUESTION SECTION:
;_xmpp-client._tcp.raymii.org.  IN      SRV

;; ANSWER SECTION:
_xmpp-client._tcp.raymii.org. 3600 IN   SRV     5 0 5222 chat.raymii.org.

The actual record for chat.raymii.org in my case are multiple A records:

;; ADDITIONAL SECTION:
chat.raymii.org.        3600    IN      A       84.200.77.167
chat.raymii.org.        3600    IN      A       205.185.117.74
chat.raymii.org.        3600    IN      A       205.185.124.11

But if you run a single node this can also be a CNAME or just one A/AAAA record.

Final testing

To test if it all worked you can add the Duck Duck Go XMPP bot. If this works flawlessly and you can add it and chat to it, then you have done everything correctly. The email address to add is im@ddg.gg.

Ejabberd SSL Certificate

This tutorial shows you how to set up an SSL Certificate for use with Ejabberd. It covers both the creation of the Certificate Signing Request, the preparing of the certificate for use with Ejabberd and the installation of the certificate.

This tutorial assumes a working ejabberd installation. It is tested on Debian and Ubuntu, but should work on any ejabberd installation.

Steps and Explanation

To get an SSL certificate working on ejabberd we need to do a few things:

• Create an Certificate Signing Request (CSR) and a Private Key
• Submit the CSR to a Certificate Authority, let them sign it and give you a Certificate
• Combine the certificate, private key (and chain) into a ejabberd compatible PEM file
• Install the certificate in ejabberd

With a certificate we can secure our XMPP connection and conversations. This way it is much harder for others to spy on your conversations. Combined with OTR this enabled a super secure channel for conversation.

Creating the Certificate Signing Request

Create a folder to store all the files and cd to that:

mkdir -p ~/Certificates/xmpp cd ~/Certificates/xmpp

Now use OpenSSL to create both a Private Key and a CSR. The first command will do it interactively, the second command will do it non-interactive. Make sure to set the correct values, your Common Name (CN) should be your XMPP server URL:

Interactive:

openssl req -nodes -newkey rsa:2048 -keyout private.key -out CSR.csr

Non-interactive:

openssl req -nodes -newkey rsa:2048 -keyout private.key -out CSR.csr -subj “/C=NL/ST=State/L=City/O=Company Name/OU=Department/CN=chat.example.org”

This will result in two files, CSR.csr and private.key. You now have to submit the CSR to a Certificate Authority. This can be any CA, I myself have good experiences with Xolphin, but there are others like Digicert and Verisign.

Once you have submitted your CSR and have gotten a Certificate you can continue.

Creating the ejabberd certificate

Once you have all the files (private key, certificate and certificate chain), put them all in a folder and continue. We are going to cat all the required files into a ejabberd.pem file.

This needs to happen in a specific order:

• private key
• certificate
• chains

So adapt the following commands to your filenames and create the pem file:

cat private.key >> ejabberd.pem cat certificate.pem >> ejabberd.pem cat chain-1.pem >> ejabberd.pem cat chain-2.pem >> ejabberd.pem

If that all works out continue.

Installing the certificate in ejabberd

Copy the certificate to all your ejabberd servers:

scp ejabberd.pem user@srv1.example.org:

The place the certificate in the /etc/ejabberd folder:

cp ejabberd.pem /etc/ejabberd/ejabberd.pem

Now change the ejabberd config to point to the new certificate:

vim /etc/ejabberd/ejabberd.cfg

Check/change the following to point to the new certificate:

[…] {listen, [ {5222, ejabberdc2s, [ {access, c2s}, {shaper, c2sshaper}, {maxstanzasize, 65536}, starttls, {certfile, “/etc/ejabberd/ejabberd.pem”} ]}, […] {s2susestarttls, true}. {s2s_certfile, “/etc/ejabberd/ejabberd.pem”}. […]

Afterwards restart ejabberd:

/etc/init.d/ejabberd restart

You can now use any XMPP client to connect with SSL/TLS to see if it works.

How To complete Setup and Configure A New Linux Debian Server

Debian Server: How to

This tutorial shows how to prepare a Debian Server [Wheezy] with Apache2, BIND, Dovecot for the installation of ISPConfig 3, and how to install ISPConfig 3. ISPConfig 3 is a webhosting control panel that allows you to configure the following services through a web browser: Apache or nginx web server, Postfix mail server, Courier or Dovecot IMAP/POP3 server, MySQL, BIND or MyDNS nameserver, PureFTPd, SpamAssassin, ClamAV, and many more.

Install The SSH Server

If you did not install the OpenSSH server during the system installation, you can do it now:

apt-get install ssh openssh-server

From now on you can use an SSH client such as PuTTY and connect from your workstation to your Debian Server [Wheezy] and follow the remaining steps from this tutorial.

Configure The Network

Because the Debian Server [Wheezy] installer has configured our system to get its network settings via DHCP, we have to change that now because a server should have a static IP address. Edit/etc/network/interfaces and adjust it to your needs (in this example setup I will use the IP address 192.168.1.100) (please note that I replace allow-hotplug eth0 with auto eth0; otherwise restarting the network doesn’t work, and we’d have to reboot the whole system):

nano /etc/network/interfaces

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
#allow-hotplug eth0
#iface eth0 inet dhcp
auto eth0
iface eth0 inet static
        address 192.168.1.100
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.1

Then restart your network:

/etc/init.d/networking restart

Edit /etc/hosts. Make it look like this:

nano /etc/hosts

127.0.0.1       localhost.localdomain   localhost
192.168.0.100   demo.server.com     demo

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Now run

echo demo.server.com > /etc/hostname
/etc/init.d/hostname.sh start

Afterwards, run

hostname
hostname -f

It is important that both show demo.server.com now!

Update Your Debian Server Installation

First make sure that /etc/apt/sources.list of your Debian Server contains the wheezy-updates repository (this makes sure you always get the newest updates for the ClamAV virus scanner – this project publishes releases very often, and sometimes old versions stop working), and that the contrib and non-free repositories are enabled (some packages such as libapache2-mod-fastcgi are not in the main repository).

 nano /etc/apt/sources.list

deb http://ftp.de.debian.org/debian/ wheezy main contrib non-free
deb-src http://ftp.de.debian.org/debian/ wheezy main contrib non-free

deb http://security.debian.org/ wheezy/updates main contrib non-free
deb-src http://security.debian.org/ wheezy/updates main contrib non-free

# wheezy-updates, previously known as 'volatile'
deb http://ftp.de.debian.org/debian/ wheezy-updates main contrib non-free
deb-src http://ftp.de.debian.org/debian/ wheezy-updates main contrib non-free

Run

apt-get update

to update the apt package database and

apt-get upgrade

to install the latest updates (if there are any).

Synchronize the System Clock

It is a good idea to synchronize the system clock with an NTP (network time protocol) server over the Internet. Simply run

apt-get install ntp ntpdate

and your Debian Server time will always be in sync.

Install Postfix, Dovecot, MySQL, phpMyAdmin, rkhunter, binutils

We can install Postfix, Dovecot, MySQL, rkhunter, and binutils with a single command:

apt-get install postfix postfix-mysql postfix-doc mysql-client mysql-server openssl getmail4 rkhunter binutils dovecot-imapd dovecot-pop3d dovecot-mysql dovecot-sieve sudo

You will be asked the following questions:

General type of mail configuration: <-- Internet Site
System mail name: <-- demo.server.com
New password for the MySQL "root" user: <-- yourrootsqlpassword
Repeat password for the MySQL "root" user: <-- yourrootsqlpassword

Next open the TLS/SSL and submission ports in Postfix:

nano /etc/postfix/master.cf

Uncomment the submission and smtps sections as follows (leave -o milter_macro_daemon_name=ORIGINATING as we don’t need it):

[...]
submission inet n       -       -       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
smtps     inet  n       -       -       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
[...]

Restart Postfix afterwards:

/etc/init.d/postfix restart

We want MySQL to listen on all interfaces, not just localhost, therefore we edit /etc/mysql/my.cnf and comment out the line bind-address = 127.0.0.1:

nano /etc/mysql/my.cnf

[...]
# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
#bind-address           = 127.0.0.1
[...]

Then we restart MySQL:

/etc/init.d/mysql restart

Now check that networking is enabled. Run

netstat -tap | grep mysql

The output should look like this:

root@demo:~# netstat -tap | grep mysql
tcp        0      0 *:mysql                 *:*                     LISTEN      26757/mysqld
root@server1:~#

Install Amavisd-new, SpamAssassin, And Clamav

To install amavisd-new, SpamAssassin, and ClamAV, we run

apt-get install amavisd-new spamassassin clamav clamav-daemon zoo unzip bzip2 arj nomarch lzop cabextract apt-listchanges libnet-ldap-perl libauthen-sasl-perl clamav-docs daemon libio-string-perl libio-socket-ssl-perl libnet-ident-perl zip libnet-dns-perl

The ISPConfig 3 setup uses amavisd which loads the SpamAssassin filter library internally, so we can stop SpamAssassin to free up some RAM:

/etc/init.d/spamassassin stop
update-rc.d -f spamassassin remove

Install Apache2, PHP5, phpMyAdmin, FCGI, suExec, Pear, And mcrypt

Apache2, PHP5, phpMyAdmin, FCGI, suExec, Pear, and mcrypt can be installed as follows:

apt-get install apache2 apache2.2-common apache2-doc apache2-mpm-prefork apache2-utils libexpat1 ssl-cert libapache2-mod-php5 php5 php5-common php5-gd php5-mysql php5-imap phpmyadmin php5-cli php5-cgi libapache2-mod-fcgid apache2-suexec php-pear php-auth php5-mcrypt mcrypt php5-imagick imagemagick libapache2-mod-suphp libruby libapache2-mod-ruby libapache2-mod-python php5-curl php5-intl php5-memcache php5-memcached php5-ming php5-ps php5-pspell php5-recode php5-snmp php5-sqlite php5-tidy php5-xmlrpc php5-xsl memcached

You will see the following question:

Web server to reconfigure automatically: <-- apache2
Configure database for phpmyadmin with dbconfig-common? <-- No

Then run the following command to enable the Apache modules suexec, rewrite, ssl, actions, and include (plus dav, dav_fs, and auth_digest if you want to use WebDAV):

a2enmod suexec rewrite ssl actions include

a2enmod dav_fs dav auth_digest

Next open /etc/apache2/mods-available/suphp.conf…

 nano /etc/apache2/mods-available/suphp.conf

… and comment out the <FilesMatch “.ph(p3?|tml)$”> section and add the line AddType application/x-httpd-suphp .php .php3 .php4 .php5 .phtml – otherwise all PHP files will be run by SuPHP:

<IfModule mod_suphp.c>
    #<FilesMatch "\.ph(p3?|tml)$">
    #    SetHandler application/x-httpd-suphp
    #</FilesMatch>
        AddType application/x-httpd-suphp .php .php3 .php4 .php5 .phtml
        suPHP_AddHandler application/x-httpd-suphp

    <Directory />
        suPHP_Engine on
    </Directory>

    # By default, disable suPHP for debian server packaged web applications as files
    # are owned by root and cannot be executed by suPHP because of min_uid.
    <Directory /usr/share>
        suPHP_Engine off
    </Directory>

# # Use a specific php config file (a dir which contains a php.ini file)
#       suPHP_ConfigPath /etc/php5/cgi/suphp/
# # Tells mod_suphp NOT to handle requests with the type <mime-type>.
#       suPHP_RemoveHandler <mime-type>
</IfModule>

Restart Apache afterwards:

/etc/init.d/apache2 restart

If you want to host Ruby files with the extension .rb on your web sites created through ISPConfig, you must comment out the line application/x-ruby rb in /etc/mime.types:

nano /etc/mime.types

[...]
#application/x-ruby                             rb
[...]

(This is needed only for .rb files; Ruby files with the extension .rbx work out of the box.)

Restart Apache afterwards:

/etc/init.d/apache2 restart

Xcache

Xcache is a free and open PHP opcode cacher for caching and optimizing PHP intermediate code. It’s similar to other PHP opcode cachers, such as eAccelerator and APC. It is strongly recommended to have one of these installed to speed up your PHP page.

Xcache can be installed as follows:

apt-get install php5-xcache

Now restart Apache:

/etc/init.d/apache2 restart

PHP-FPM

Starting with ISPConfig 3.0.5, there is an additional PHP mode that you can select for usage with Apache: PHP-FPM.

To use PHP-FPM with Apache, we need the mod_fastcgi Apache module (please don’t mix this up with mod_fcgid – they are very similar, but you cannot use PHP-FPM with mod_fcgid). We can install PHP-FPM and mod_fastcgi as follows:

apt-get install libapache2-mod-fastcgi php5-fpm

Make sure you enable the module and restart Apache:

a2enmod actions fastcgi alias

/etc/init.d/apache2 restart

Install Mailman

Since version 3.0.4, ISPConfig also allows you to manage (create/modify/delete) Mailman mailing lists. If you want to make use of this feature, install Mailman as follows:

apt-get install mailman

Select at least one language, e.g.:

Languages to support: <-- en (English)
Missing site list <-- Ok<

Before we can start Mailman, a first mailing list called mailman must be created:

newlist mailman

root@demo:~# newlist mailman

Enter the email of the person running the list: <-- admin email address, e.g. listadmin@server.com
Initial mailman password: <-- admin password for the mailman list

To finish creating your mailing list, you must edit your /etc/aliases (or equivalent) file by adding the following lines, and possibly running the `newaliases' program:

## mailman mailing list mailman:        "|/var/lib/mailman/mail/mailman post mailman" 
mailman-admin:        "|/var/lib/mailman/mail/mailman admin mailman" 
mailman-bounces:      "|/var/lib/mailman/mail/mailman bounces mailman" 
mailman-confirm:      "|/var/lib/mailman/mail/mailman confirm mailman" 
mailman-join:         "|/var/lib/mailman/mail/mailman join mailman" 
mailman-leave:        "|/var/lib/mailman/mail/mailman leave mailman" 
mailman-owner:        "|/var/lib/mailman/mail/mailman owner mailman" 
mailman-request:      "|/var/lib/mailman/mail/mailman request mailman" 
mailman-subscribe:    "|/var/lib/mailman/mail/mailman subscribe mailman" 
mailman-unsubscribe:  "|/var/lib/mailman/mail/mailman unsubscribe mailman" 

Hit enter to notify mailman owner... <-- ENTER root@demo:~#

Open /etc/aliases afterwards…

 nano /etc/aliases

… and add the following lines:

[...]
## mailman mailing list
mailman:              "|/var/lib/mailman/mail/mailman post mailman"
mailman-admin:        "|/var/lib/mailman/mail/mailman admin mailman"
mailman-bounces:      "|/var/lib/mailman/mail/mailman bounces mailman"
mailman-confirm:      "|/var/lib/mailman/mail/mailman confirm mailman"
mailman-join:         "|/var/lib/mailman/mail/mailman join mailman"
mailman-leave:        "|/var/lib/mailman/mail/mailman leave mailman"
mailman-owner:        "|/var/lib/mailman/mail/mailman owner mailman"
mailman-request:      "|/var/lib/mailman/mail/mailman request mailman"
mailman-subscribe:    "|/var/lib/mailman/mail/mailman subscribe mailman"
mailman-unsubscribe:  "|/var/lib/mailman/mail/mailman unsubscribe mailman"

Run

newaliases

afterwards and restart Postfix:

/etc/init.d/postfix restart

Finally we must enable the Mailman Apache configuration:

ln -s /etc/mailman/apache.conf /etc/apache2/conf.d/mailman.conf

This defines the alias /cgi-bin/mailman/ for all Apache vhosts, which means you can access the Mailman admin interface for a list at http://<vhost>/cgi-bin/mailman/admin/<listname&gt;, and the web page for users of a mailing list can be found at http://<vhost>/cgi-bin/mailman/listinfo/<listname&gt;.

Under http://<vhost>/pipermail you can find the mailing list archives.

Restart Apache afterwards:

/etc/init.d/apache2 restart

Then start the Mailman daemon:

/etc/init.d/mailman start

Install PureFTPd And Quota

PureFTPd and quota can be installed with the following command:

apt-get install pure-ftpd-common pure-ftpd-mysql quota quotatool

Edit the file /etc/default/pure-ftpd-common…

 nano /etc/default/pure-ftpd-common

… and make sure that the start mode is set to standalone and set VIRTUALCHROOT=true:

[...]
STANDALONE_OR_INETD=standalone
[...]
VIRTUALCHROOT=true
[...]

Now we configure PureFTPd to allow FTP and TLS sessions. FTP is a very insecure protocol because all passwords and all data are transferred in clear text. By using TLS, the whole communication can be encrypted, thus making FTP much more secure.

If you want to allow FTP and TLS sessions, run

echo 1 > /etc/pure-ftpd/conf/TLS

In order to use TLS, we must create an SSL certificate. I create it in /etc/ssl/private/, therefore I create that directory first:

mkdir -p /etc/ssl/private/

Afterwards, we can generate the SSL certificate as follows:

openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem

Country Name (2 letter code) [AU]: <-- Enter your Country Name (e.g., "AQ").
State or Province Name (full name) [Some-State]: <-- Enter your State or Province Name. 
Locality Name (eg, city) []: <-- Enter your City. 
Organization Name (eg, company) [Internet Widgits Pty Ltd]: <-- Enter your ON (Name of your company) 
Organizational Unit Name (eg, section) []: <-- Enter your OU Name (e.g. "IT Department"). 
Common Name (eg, YOUR name) []: <-- Enter the FQDN (e.g. "demo.server.com"). 
Email Address []: <-- Enter your Email Address.

Change the permissions of the SSL certificate:

chmod 600 /etc/ssl/private/pure-ftpd.pem

Then restart PureFTPd:

/etc/init.d/pure-ftpd-mysql restart

Edit /etc/fstab. Mine looks like this (I added ,usrjquota=quota.user,grpjquota=quota.group,jqfmt=vfsv0 to the partition with the mount point /):

 nano /etc/fstab

# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
/dev/mapper/demo-root /               ext4    errors=remount-ro,usrjquota=quota.user,grpjquota=quota.group,jqfmt=vfsv0 0       1
# /boot was on /dev/sda1 during installation
UUID=46d1bd79-d761-4b23-80b8-ad20cb18e049 /boot           ext2    defaults        0       2
/dev/mapper/server1-swap_1 none            swap    sw              0       0
/dev/sr0        /media/cdrom0   udf,iso9660 user,noauto     0       0

To enable quota, run these commands:

mount -o remount /

quotacheck -avugm

quotaon -avug

Install BIND DNS Server

BIND can be installed as follows:

apt-get install bind9 dnsutils

Install Vlogger, Webalizer, And AWstats

Vlogger, webalizer, and AWstats can be installed as follows:

apt-get install vlogger webalizer awstats geoip-database libclass-dbi-mysql-perl

Open /etc/cron.d/awstats afterwards…

 nano /etc/cron.d/awstats

… and comment out everything in that file:

#MAILTO=root

#*/10 * * * * www-data [ -x /usr/share/awstats/tools/update.sh ] && /usr/share/awstats/tools/update.sh

# Generate static reports:
#10 03 * * * www-data [ -x /usr/share/awstats/tools/buildstatic.sh ] && /usr/share/awstats/tools/buildstatic.sh

Install Jailkit

Jailkit is needed only if you want to chroot SSH users. It can be installed as follows (important: Jailkit must be installed before ISPConfig – it cannot be installed afterwards!):

apt-get install build-essential autoconf automake1.9 libtool flex bison debhelper binutils-gold

cd /tmp
wget http://olivier.sessink.nl/jailkit/jailkit-2.15.tar.gz
tar xvfz jailkit-2.15.tar.gz
cd jailkit-2.15
./debian/rules binary

You can now install the Jailkit .deb package as follows:

cd ..
dpkg -i jailkit_2.15-1_*.deb
rm -rf jailkit-2.15*

Install fail2ban

This is optional but recommended, because the ISPConfig monitor tries to show the log:

apt-get install fail2ban

To make fail2ban monitor PureFTPd and Dovecot, create the file /etc/fail2ban/jail.local:

 nano /etc/fail2ban/jail.local

[pureftpd]
enabled  = true
port     = ftp
filter   = pureftpd
logpath  = /var/log/syslog
maxretry = 3

[dovecot-pop3imap]
enabled = true
filter = dovecot-pop3imap
action = iptables-multiport[name=dovecot-pop3imap, port="pop3,pop3s,imap,imaps", protocol=tcp]
logpath = /var/log/mail.log
maxretry = 5

[sasl]
enabled  = true
port     = smtp
filter   = sasl
logpath  = /var/log/mail.log
maxretry = 3

Then create the following two filter files:

 nano /etc/fail2ban/filter.d/pureftpd.conf

[Definition]
failregex = .*pure-ftpd: \(.*@<HOST>\) \[WARNING\] Authentication failed for user.*
ignoreregex =

 nano /etc/fail2ban/filter.d/dovecot-pop3imap.conf

[Definition]
failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed|Aborted login \(\d+ authentication attempts).*rip=(?P<host>\S*),.*
ignoreregex =

Restart fail2ban afterwards:

/etc/init.d/fail2ban restart

Install SquirrelMail

To install the SquirrelMail webmail client, run

apt-get install squirrelmail

Then configure SquirrelMail:

squirrelmail-configure

We must tell SquirrelMail that we are using Dovecot-IMAP/-POP3:

SquirrelMail Configuration : Read: config.php (1.4.0)
---------------------------------------------------------
Main Menu --
1.  Organization Preferences
2.  Server Settings
3.  Folder Defaults
4.  General Options
5.  Themes
6.  Address Books
7.  Message of the Day (MOTD)
8.  Plugins
9.  Database
10. Languages
D.  Set pre-defined settings for specific IMAP servers 

C   Turn color on 
S   Save data 
Q   Quit 

Command >> <-- D 

SquirrelMail Configuration : Read: config.php
 --------------------------------------------------------- 
While we have been building SquirrelMail, we have discovered some preferences that work better with some servers that don't work so well with others.  If you select your IMAP server, this option will set some pre-defined settings for that server. 

Please note that you will still need to go through and make sure everything is correct.  This does not change everything.  There are only a few settings that this will change. 

Please select your IMAP server: 
     bincimap    = Binc IMAP server 
     courier     = Courier IMAP server 
     cyrus       = Cyrus IMAP server 
     dovecot     = Dovecot Secure IMAP server 
     exchange    = Microsoft Exchange IMAP server 
     hmailserver = hMailServer 
     macosx      = Mac OS X Mailserver 
     mercury32   = Mercury/32 
     uw          = University of Washington's IMAP server 
     gmail       = IMAP access to Google mail (Gmail) accounts 

     quit        = Do not change anything 

Command >> <-- dovecot 


SquirrelMail Configuration : Read: config.php 
--------------------------------------------------------- 
While we have been building SquirrelMail, we have discovered some preferences that work better with some servers that don't work so well with others.  If you select your IMAP server, this option will set some pre-defined settings for that server. 

Please note that you will still need to go through and make sure everything is correct.  This does not change everything.  There are only a few settings that this will change. 

Please select your IMAP server: 

       bincimap    = Binc IMAP server 
       courier     = Courier IMAP server 
       cyrus       = Cyrus IMAP server 
       dovecot     = Dovecot Secure IMAP server 
       exchange    = Microsoft Exchange IMAP server 
       hmailserver = hMailServer 
       macosx      = Mac OS X Mailserver 
       mercury32   = Mercury/32 
       uw          = University of Washington's IMAP server 
       gmail       = IMAP access to Google mail (Gmail) accounts 

       quit        = Do not change anything 

  Command >> dovecot 

            imap_server_type = dovecot 
            default_folder_prefix = <none> 
            trash_folder = Trash 
            sent_folder = Sent 
            draft_folder = Drafts 
            show_prefix_option = false 
            default_sub_of_inbox = false 
            show_contain_subfolders_
            option = false optional_
            delimiter = detect 
            delete_folder = false 

Press any key to continue... <-- press a key  


SquirrelMail Configuration : Read: config.php (1.4.0)
 --------------------------------------------------------- 
Main Menu -- 
1.  Organization Preferences 
2.  Server Settings 
3.  Folder Defaults 
4.  General Options 
5.  Themes 
6.  Address Books 
7.  Message of the Day (MOTD) 
8.  Plugins 
9.  Database 
10. Languages 

D.  Set pre-defined settings for specific IMAP servers 

C   Turn color on 
S   Save data 
Q   Quit 

Command >> <-- S 


SquirrelMail Configuration : Read: config.php (1.4.0) 
--------------------------------------------------------- 
Main Menu -- 
1.  Organization Preferences 
2.  Server Settings 
3.  Folder Defaults 
4.  General Options 
5.  Themes 
6.  Address Books 
7.  Message of the Day (MOTD) 
8.  Plugins 
9.  Database 
10. Languages 

D.  Set pre-defined settings for specific IMAP servers 

C   Turn color on 
S   Save data 
Q   Quit 

Command >> <-- Q

Now we will configure SquirrelMail so that you can use it from within your web sites (created through ISPConfig) by using the /squirrelmail or /webmail aliases. So if your website is http://www.server.com, you will be able to access SquirrelMail using http://www.server.com/squirrelmail or http://www.server.com/webmail.

SquirrelMail’s Apache configuration is in the file /etc/squirrelmail/apache.conf, but this file isn’t loaded by Apache because it is not in the /etc/apache2/conf.d/ directory. Therefore we create a symlink called squirrelmail.conf in the /etc/apache2/conf.d/ directory that points to /etc/squirrelmail/apache.conf and reload Apache afterwards:

cd /etc/apache2/conf.d/
ln -s ../../squirrelmail/apache.conf squirrelmail.conf
/etc/init.d/apache2 reload

Now open /etc/apache2/conf.d/squirrelmail.conf…

 nano /etc/apache2/conf.d/squirrelmail.conf

… and add the following lines to the <Directory /usr/share/squirrelmail></Directory> container that make sure that mod_php is used for accessing SquirrelMail, regardless of what PHP mode you select for your website in ISPConfig:

[...]
<Directory /usr/share/squirrelmail>
  Options FollowSymLinks
  <IfModule mod_php5.c>
    AddType application/x-httpd-php .php
    php_flag magic_quotes_gpc Off
    php_flag track_vars On
    php_admin_flag allow_url_fopen Off
    php_value include_path .
    php_admin_value upload_tmp_dir /var/lib/squirrelmail/tmp
    php_admin_value open_basedir /usr/share/squirrelmail:/etc/squirrelmail:/var/lib/squirrelmail:/etc/hostname:/etc/mailname
    php_flag register_globals off
  </IfModule>
  <IfModule mod_dir.c>
    DirectoryIndex index.php
  </IfModule>

  # access to configtest is limited by default to prevent information leak
  <Files configtest.php>
    order deny,allow
    deny from all
    allow from 127.0.0.1
  </Files>
</Directory>
[...]

Create the directory /var/lib/squirrelmail/tmp…

mkdir /var/lib/squirrelmail/tmp

… and make it owned by the user www-data:

chown www-data /var/lib/squirrelmail/tmp

Reload Apache again:

/etc/init.d/apache2 reload

That’s it already – /etc/apache2/conf.d/squirrelmail.conf defines an alias called /squirrelmail that points to SquirrelMail’s installation directory /usr/share/squirrelmail.

You can now access SquirrelMail from your web site as follows:

http://192.168.1.100/squirrelmail

http://www.server.com/squirrelmail

You can also access it from the ISPConfig control panel vhost (after you have installed ISPConfig, see the next chapter) as follows (this doesn’t need any configuration in ISPConfig):

http://demo.server.com:8080/squirrelmail

If you’d like to use the alias /webmail instead of /squirrelmail, simply open /etc/apache2/conf.d/squirrelmail.conf…

 nano /etc/apache2/conf.d/squirrelmail.conf

… and add the line Alias /webmail /usr/share/squirrelmail:

Alias /squirrelmail /usr/share/squirrelmail
Alias /webmail /usr/share/squirrelmail
[...]

Then reload Apache:

/etc/init.d/apache2 reload

Now you can access Squirrelmail as follows:

http://192.168.1.100/webmail

http://www.server.com/webmail

http://demo.server.com:8080/webmail (after you have installed ISPConfig, see the next chapter)

If you’d like to define a vhost like webmail.example.com where your users can access SquirrelMail, you’d have to add the following vhost configuration to/etc/apache2/conf.d/squirrelmail.conf:

 nano /etc/apache2/conf.d/squirrelmail.conf

[...]
<VirtualHost 1.2.3.4:80>
  DocumentRoot /usr/share/squirrelmail
  ServerName webmail.example.com
</VirtualHost>

Make sure you replace 1.2.3.4 with the correct IP address of your server. Of course, there must be a DNS record for webmail.example.com that points to the IP address that you use in the vhost configuration. Also make sure that the vhost webmail.example.com does not exist in ISPConfig (otherwise both vhosts will interfere with each other!).

Now reload Apache…

/etc/init.d/apache2 reload

… and you can access SquirrelMail under http://webmail.server.com!

Install ISPConfig 3

To install ISPConfig 3 from the latest released version, do this:

cd /tmp
wget http://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gz
tar xfz ISPConfig-3-stable.tar.gz
cd ispconfig3_install/install/

The next step is to run

php -q install.php

This will start the ISPConfig 3 installer. The installer will configure all services like Postfix, Dovecot, etc. for you. A manual setup as required for ISPConfig 2 (perfect setup guides) is not necessary.

root@demo:/tmp/ispconfig3_install/install# php -q install.php
PHP Deprecated:  Comments starting with '#' are deprecated in /etc/php5/cli/conf.d/ming.ini on line 1 in Unknown on line 0


--------------------------------------------------------------------------------
 _____ ___________   _____              __ _         ____
|_   _/  ___| ___ \ /  __ \            / _(_)       /__  \
  | | \ `--.| |_/ / | /  \/ ___  _ __ | |_ _  __ _    _/ /
  | |  `--. \  __/  | |    / _ \| '_ \|  _| |/ _` |  |_ |
 _| |_/\__/ / |     | \__/\ (_) | | | | | | | (_| | ___\ \
 \___/\____/\_|      \____/\___/|_| |_|_| |_|\__, | \____/
                                              __/ |
                                             |___/
--------------------------------------------------------------------------------


>> Initial configuration

Operating System: Debian or compatible, unknown version.

    Following will be a few questions for primary configuration so be careful.
    Default values are in [brackets] and can be accepted with <ENTER>.
    Tap in "quit" (without the quotes) to stop the installer.


Select language (en,de) [en]: <-- ENTER

Installation mode (standard,expert) [standard]: <-- ENTER

Full qualified hostname (FQDN) of the server, eg server1.domain.tld  [demo.server.com]: <-- ENTER

MySQL server hostname [localhost]: <-- ENTER

MySQL root username [root]: <-- ENTER

MySQL root password []: <-- yourrootsqlpassword

MySQL database to create [dbispconfig]: <-- ENTER

MySQL charset [utf8]: <-- ENTER

Generating a 4096 bit RSA private key
.............................................................++
.........................................................................................................................++
writing new private key to 'smtpd.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]: <-- ENTER
State or Province Name (full name) [Some-State]: <-- ENTER
Locality Name (eg, city) []: <-- ENTER
Organization Name (eg, company) [Internet Widgits Pty Ltd]: <-- ENTER
Organizational Unit Name (eg, section) []: <-- ENTER
Common Name (e.g. server FQDN or YOUR name) []: <-- ENTER
Email Address []: <-- ENTER
Configuring Jailkit
Configuring Dovecot
Configuring Spamassassin
Configuring Amavisd
Configuring Getmail
Configuring Pureftpd
Configuring BIND
Configuring Apache
Configuring Vlogger
Configuring Apps vhost
Configuring Bastille Firewall
Configuring Fail2ban
Installing ISPConfig
ISPConfig Port [8080]: <-- ENTER

Do you want a secure (SSL) connection to the ISPConfig web interface (y,n) [y]: <-- ENTER

Generating RSA private key, 4096 bit long modulus
.................................................................................................++
........++
e is 65537 (0x10001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]: <-- ENTER
State or Province Name (full name) [Some-State]: <-- ENTER
Locality Name (eg, city) []: <-- ENTER
Organization Name (eg, company) [Internet Widgits Pty Ltd]: <-- ENTER
Organizational Unit Name (eg, section) []: <-- ENTER
Common Name (e.g. server FQDN or YOUR name) []: <-- ENTER
Email Address []: <-- ENTER

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: <-- ENTER
An optional company name []: <-- ENTER
writing RSA key
Configuring DBServer
Installing ISPConfig crontab
no crontab for root
no crontab for getmail
Restarting services ...
Stopping MySQL database server: mysqld.
Starting MySQL database server: mysqld ..
Checking for tables which need an upgrade, are corrupt or were
not closed cleanly..
Stopping Postfix Mail Transport Agent: postfix.
Starting Postfix Mail Transport Agent: postfix.
Stopping amavisd: amavisd-new.
Starting amavisd: amavisd-new.
Stopping ClamAV daemon: clamd.
Starting ClamAV daemon: clamd .
Restarting IMAP/POP3 mail server: dovecot.
[Tue May 07 02:36:22 2013] [warn] NameVirtualHost *:443 has no VirtualHosts
[Tue May 07 02:36:22 2013] [warn] NameVirtualHost *:80 has no VirtualHosts
[Tue May 07 02:36:23 2013] [warn] NameVirtualHost *:443 has no VirtualHosts
[Tue May 07 02:36:23 2013] [warn] NameVirtualHost *:80 has no VirtualHosts
Restarting web server: apache2 ... waiting .
Restarting ftp server: Running: /usr/sbin/pure-ftpd-mysql-virtualchroot -l mysql:/etc/pure-ftpd/db/mysql.conf -l pam -H -O clf:/var/log/pure-ftpd/transfer.log -Y 1 -D -u 1000 -A -E -b -8 UTF-8 -B
Installation completed.
root@server1:/tmp/ispconfig3_install/install#

The installer automatically configures all underlying services, so no manual configuration is needed.

You now also have the possibility to let the installer create an SSL vhost for the ISPConfig control panel, so that ISPConfig can be accessed using https:// instead of http://. To achieve this, just press ENTER when you see this question: Do you want a secure (SSL) connection to the ISPConfig web interface (y,n) [y]:.

Afterwards you can access ISPConfig 3 under http(s)://demo.server.com:8080/ or http(s)://192.168.0.100:8080/ ( http or https depends on what you chose during installation). Log in with the username admin and the password admin (you should change the default password after your first login):

In order to learn how to use ISPConfig 3, I strongly recommend to download the ISPConfig 3 Manual.

Install And Configure munin

To install munin on Debian Server, we do this:

aptitude install munin munin-node

Next, we must edit the munin configuration file /etc/munin/munin.conf. We want munin to put its output into the directory /var/www/www.server.com/web/monitoring, therefore we change the value of htmldir, and we want it to use the name demo.server.com instead of localhost.localdomain in the HTML output, therefore we replace localhost.localdomain with demo.server.com. Without the comments, the changed file looks like this:

nano /etc/munin/munin.conf

dbdir   /var/lib/munin
htmldir /var/www/www.example.com/web/monitoring
logdir  /var/log/munin
rundir  /var/run/munin

tmpldir /etc/munin/templates

[server1.example.com]
    address 127.0.0.1
    use_node_name yes

Next we create the directory /var/www/www.server.com/web/monitoring and change its ownership to the user and group munin, otherwise munin cannot place its output in that directory. Then we restart munin:

mkdir -p /var/www/www.server.com/web/monitoring
chown munin:munin /var/www/www.server.com/web/monitoring
/etc/init.d/munin-node restart

Now wait a few minutes so that munin can produce its first output, and then go to http://www.example.com/monitoring/ in your browser, and you see the first statistics. After a few days this could look like this:

Password-Protect The munin Output Directory

Now it is a good idea to password-protect the directory /var/www/www.server.com/web/monitoring unless you want everybody to be able to see every little statistic about your server.

To do this, we create an .htaccess file in /var/www/www.server.com/web/monitoring:

 nano /var/www/www.server.com/web/monitoring/.htaccess

AuthType Basic
AuthName "Members Only"
AuthUserFile /var/www/www.server.com/.htpasswd
<limit GET PUT POST>
require valid-user
</limit>

Then we must create the password file /var/www/www.example.com/.htpasswd. We want to log in with the username admin, so we do this:

htpasswd -c /var/www/www.example.com/.htpasswd admin

Enter a password for admin, and you’re done!

Install And Configure monit

To install monit, we do this:

aptitude install monit

Now we must edit /etc/monit/monitrc. The default /etc/monit/monitrc has lots of examples, and you can find more configuration examples on http://mmonit.com/monit/documentation/. However, in my case I want to monitor proftpd, sshd, mysql, apache, and postfix, I want to enable the monit web interface on port 2812, I want a https web interface, I want to log in to the web interface with the username admin and the password test, and I want monit to send email alerts to root@demo, so my file looks like this:

cp /etc/monit/monitrc /etc/monit/monitrc_orig
cat /dev/null > /etc/monit/monitrc
vi /etc/monit/monitrc

set daemon  60
set logfile syslog facility log_daemon
set mailserver localhost
set mail-format { from: monit@demo.server.com }
set alert root@localhost
set httpd port 2812 and
     ssl enable
     PEMFILE  /var/certs/monit.pem
     allow admin:test

check process proftpd with pidfile /var/run/proftpd.pid
   start program = "/etc/init.d/proftpd start"
   stop program  = "/etc/init.d/proftpd stop"
   if failed port 21 protocol ftp then restart
   if 5 restarts within 5 cycles then timeout

check process sshd with pidfile /var/run/sshd.pid
   start program  "/etc/init.d/ssh start"
   stop program  "/etc/init.d/ssh stop"
   if failed port 22 protocol ssh then restart
   if 5 restarts within 5 cycles then timeout

check process mysql with pidfile /var/run/mysqld/mysqld.pid
   group database
   start program = "/etc/init.d/mysql start"
   stop program = "/etc/init.d/mysql stop"
   if failed host 127.0.0.1 port 3306 then restart
   if 5 restarts within 5 cycles then timeout

check process apache with pidfile /var/run/apache2.pid
   group www
   start program = "/etc/init.d/apache2 start"
   stop program  = "/etc/init.d/apache2 stop"
   if failed host www.example.com port 80 protocol http
      and request "/monit/token" then restart
   if cpu is greater than 60% for 2 cycles then alert
   if cpu > 80% for 5 cycles then restart
   if totalmem > 500 MB for 5 cycles then restart
   if children > 250 then restart
   if loadavg(5min) greater than 10 for 8 cycles then stop
   if 3 restarts within 5 cycles then timeout

check process postfix with pidfile /var/spool/postfix/pid/master.pid
   group mail
   start program = "/etc/init.d/postfix start"
   stop  program = "/etc/init.d/postfix stop"
   if failed port 25 protocol smtp then restart
   if 5 restarts within 5 cycles then timeout

The configuration file is pretty self-explaining; if you are unsure about an option, take a look at the monit documentation: http://mmonit.com/monit/documentation/monit.html

In the apache part of the monit configuration you find this:

 if failed host www.server.com port 80 protocol http
      and request "/monit/token" then restart

which means that monit tries to connect to http://www.server.com on port 80 and tries to access the file /monit/token which is /var/www/www.server.com/web/monit/token because our web site’s document root is /var/www/www.server.com/web. If monit doesn’t succeed it means Apache isn’t running, and monit is going to restart it. Now we must create the file/var/www/www.server.com/web/monit/token and write some random string into it:

mkdir /var/www/www.server.com/web/monit
echo "hello" > /var/www/www.server.com/web/monit/token

Next we create the pem cert (/var/certs/monit.pem) we need for the SSL-encrypted monit web interface:

mkdir /var/certs
cd /var/certs

We need an OpenSSL configuration file to create our certificate. It can look like this:

 nano /var/certs/monit.cnf

# create RSA certs - Server

RANDFILE = ./openssl.rnd

[ req ]
default_bits = 1024
encrypt_key = yes
distinguished_name = req_dn
x509_extensions = cert_type

[ req_dn ]
countryName = Country Name (2 letter code)
countryName_default = MO

stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = Monitoria

localityName                    = Locality Name (eg, city)
localityName_default            = Monittown

organizationName                = Organization Name (eg, company)
organizationName_default        = Monit Inc.

organizationalUnitName          = Organizational Unit Name (eg, section)
organizationalUnitName_default  = Dept. of Monitoring Technologies

commonName                      = Common Name (FQDN of your server)
commonName_default              = server.monit.mo

emailAddress                    = Email Address
emailAddress_default            = root@monit.mo

[ cert_type ]
nsCertType = server

Now we create the certificate like this:

openssl req -new -x509 -days 365 -nodes -config ./monit.cnf -out /var/certs/monit.pem -keyout /var/certs/monit.pem

openssl gendh 512 >> /var/certs/monit.pem

openssl x509 -subject -dates -fingerprint -noout -in /var/certs/monit.pem

chmod 700 /var/certs/monit.pem

Afterwards we edit /etc/default/monit to enable the monit daemon. Change startup to 1 and set CHECK_INTERVALS to the interval in seconds that you would like monit to check your system. I choose 60 (seconds) so my file looks like this:

vi /etc/default/monit

# Defaults for monit initscript
# sourced by /etc/init.d/monit
# installed at /etc/default/monit by maintainer scripts
# Fredrik Steen <stone@debian.org>

# You must set this variable to for monit to start
startup=1

# To change the intervals which monit should run uncomment
# and change this variable.
CHECK_INTERVALS=60

Finally, we can start monit:

/etc/init.d/monit start

Now point your browser to https://www.server.com:2812/ (make sure port 2812 isn’t blocked by your firewall), log in with admin and test, and you should see the monit web interface. It should look like this:

Install RainLoop

SIMPLE, MODERN & FAST WEB-BASED EMAIL CLIENT

move to

cd /var/www/

You can also deploy the latest version of the application without a need to deal with zip archive, just run one of the following commands in your terminal:

curl -s http://repository.rainloop.net/installer.php | php

or

wget -qO- http://repository.rainloop.net/installer.php | php

Upon uploading the package content, be sure to configure permissions for files and directories.

This is all you have to do in order to ensure running the application with its default configuration.

The product will create all the required files on first run, and it will report an error if any requirement is not met.

how to establish a decentralized Ad-hoc WiFi network on a Linux Debian machine

WiFi Ad-hoc Network

This page describes how to establish a decentralized WiFi network.

Inhoud

1. WiFi Ad-hoc Network
   1. Debian Method
   2. Manual Method
   3. Troubleshooting
   4. See Also

A wireless ad-hoc network – also known as Independent Basic Service Set (IBSS) – consists of local wireless devices (nodes) discovering each other and forming a network, each able to forward data for other nodes. An access point is not required for managing this communication.

In the following examples, two wireless LAN clients will be configured as ad-hoc network nodes with static IP addressing. Before continuing, install the wireless-tools package.

Debian Method

1. On each node, open /etc/network/interfaces in a text editor:

   $ su
   # sensible-editor /etc/network/interfaces

2. Define stanzas for each node’s wireless interface, setting the network SSID and the device’s operating mode to ad-hoc:

   Node A

   auto wlan0
   iface wlan0 inet static
       address 192.168.1.1
       netmask 255.255.255.0
       wireless-channel 1
       wireless-essid MYNETWORK
       wireless-mode ad-hoc

   Node B

   auto wlan0
   iface wlan0 inet static
       address 192.168.1.2
       netmask 255.255.255.0
       wireless-channel 1
       wireless-essid MYNETWORK
       wireless-mode ad-hoc

3. Save the file and exit the editor.

4. Raise the interface on each node:

   # ifup wlan0

5. Scan for ad-hoc cells in range (necessary for some drivers to trigger IBSS scanning):

   # iwlist wlan0 scan
   wlan0     Scan completed :
             Cell 01 - Address: 02:0F:B5:4F:74:ED
                       ESSID:"MYNETWORK"
                       Mode:Ad-Hoc
                       Frequency:2.412 GHz (Channel 1)
                       Quality=42/70  Signal level=-53 dBm  Noise level=-95 dBm
                       Encryption key:off
                       Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 6 Mb/s
                                 9 Mb/s; 12 Mb/s; 18 Mb/s; 24 Mb/s; 36 Mb/s
                                 48 Mb/s; 54 Mb/s
                       Extra:bcn_int=100

6. To test, ping node A from node B:

   you@nodeB$ ping 192.168.1.1
   PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
   64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.073 ms
   64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.061 ms
   64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=0.062 ms
   64 bytes from 192.168.1.1: icmp_seq=4 ttl=64 time=0.063 ms
   
   --- 192.168.1.1 ping statistics ---
   4 packets transmitted, 4 received, 0% packet loss, time 3001ms
   rtt min/avg/max/mdev = 0.061/0.064/0.073/0.010 ms

For general /etc/network/interfaces information, see the interfaces(5) man page.

Manual Method

1. On each node, bring the wireless interface down, change the device’s operating mode and SSID, then raise the interface:

   $ su
   # ifconfig wlan0 down
   # iwconfig wlan0 channel 1 essid MYNETWORK mode ad-hoc
   # ifconfig wlan0 up

2. Scan for ad-hoc cells in range (necessary for some drivers to trigger IBSS scanning):

   iwlist wlan0 scan
   wlan0     Scan completed :
             Cell 01 - Address: 02:0F:B5:4F:74:ED
                       ESSID:"MYNETWORK"
                       Mode:Ad-Hoc
                       Frequency:2.412 GHz (Channel 1)
                       Quality=42/70  Signal level=-53 dBm  Noise level=-95 dBm
                       Encryption key:off
                       Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 6 Mb/s
                                 9 Mb/s; 12 Mb/s; 18 Mb/s; 24 Mb/s; 36 Mb/s
                                 48 Mb/s; 54 Mb/s
                       Extra:bcn_int=100

3. On each node, assign an IP address to the wireless interface:

   Node A

   # ifconfig wlan0 192.168.1.1 netmask 255.255.255.0

   Node B

   # ifconfig wlan0 192.168.1.2 netmask 255.255.255.0

4. To test, ping node A from node B:

   you@nodeB$ ping 192.168.1.1
   PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
   64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.073 ms
   64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=0.061 ms
   64 bytes from 192.168.1.1: icmp_seq=3 ttl=64 time=0.062 ms
   64 bytes from 192.168.1.1: icmp_seq=4 ttl=64 time=0.063 ms
   
   --- 192.168.1.1 ping statistics ---
   4 packets transmitted, 4 received, 0% packet loss, time 3001ms
   rtt min/avg/max/mdev = 0.061/0.064/0.073/0.010 ms

Troubleshooting

• The default operating frequency/channel (2.412 GHz: channel 1) is frequently congested. Try using a different channel in the event of difficulties.
• Wireless LAN devices compliant with IEEE 802.11 specifications will only support a maximum bit rate of 11 Mbit/s.

See Also

• WiFi/HowToUse

• WiFi

• http://hostap.epitest.fi/ | hostapd is a daemon to turn a computer into an access point.

Debian Wireless Fidelity

This portal deals with the installation and configuration of WiFi devices. Device installation is essentially a two-part process: 1) installing the driver (also called a module) and 2) setting up your WiFi interface.

A WiFi device operates on an electronic chip called a “chipset”. We can find the same chipset in several different devices. Consequently, the driver/module for one chipset will work for all wireless devices using that chipset.

Free software based systems such as Debian depend on the cooperation between manufacturers and developers to produce and maintain quality drivers and firmware. Drivers and firmware are what determine if and how well your hardware works.

Debian’s Social Contract mandates the freeing of the distribution. In practice this means manufacturers are required to cooperate by releasing specifications and free drivers that can be worked on by the community. Newer versions of Debian (6+) do not include non-free drivers or firmware.

Non-free drivers and firmware are produced by companies refusing or unable to cooperate with the free software community. With non-free drivers and firmware support is often unavailable or severely strained. For instance features are often left out, bugs go unfixed, and what support does exist from the manufacture is fleeting.

By encouraging good social practices the community is able to support end-users. Complex installation procedures are no longer required and support continues long after a product has been discontinued.

Currently there are only a few modern wifi chipsets readily available that work with free software systems. For USB wifi devices this list includes the Realtek RTL8187B chipset (802.11G) and the Atheros AR9170 chipset (802.11N). For Mini PCIe all cards with an Atheros chipset are supported.

Wifi has always been a problem for free software users. USB Wifi cards are becoming less free. With the older 802.11G standard many USB wifi cards had free drivers and did not require non-free firmware. With 802.11N there is only one chipset on the market from Atheros which is completely free.

One company which specialises in free software and sells 802.11N USB wifi cards, ThinkPenguin.com, has indicated the availability of free software supported 802.11N USB wifi cards is disappearing. Solving this problem will require more demand than currently exists. Next time you purchase a piece of hardware ask yourself if it is free software compatible.

Continuing on, a WiFi interface is an Ethernet interface which also provides WiFi-specific configuration parameters. These parameters are controlled using the iwconfig program.

www.debian.org/doc/manuals/debian-reference/ch05 – Debian Reference Chapter 5 – Network setup

Inhoud

1. Prerequisites
2. Install Driver
   1. PCI Devices
   2. USB Devices
   3. PC Card (PCMCIA) Devices
   4. Routers
3. Configure Interface
4. Resources
5. External Links

Prerequisites

• wireless-tools, tools for manipulating Linux Wireless Extensions (installed by default on Desktop & Laptop installations)

• For GUI systems:

  1. NetworkManager (installed by default on Gnome-Desktop & Laptop installation)

  2. wicd, a wired and wireless manager, is recommended for other environments without GNOME dependencies such as XFCE, Fluxbox, Openbox, Enlightenment.

• wpasupplicant, client support for WPA and WPA2 networks

If these are missing, you can install these via:

aptitude install wireless-tools

…and similar

Install Driver

Before you buy, verify your intended device is supported by an available Linux driver. A good indication of support is Tux being displayed on the product’s packaging.

This section presents general lists of WiFi devices (grouped by host interface) and sorted by driver/module name. Each list has two main elements: the module name and the chipset(s) it supports. Known unsupported chipsets are at the end of each list.

If available, a help page link will provide you with further information. We recommend you read the associated help page, as some devices may require to be supplied with microcode (aka “firmware”) before they can be used.

For an indication of support with a specific device, see the Wireless Adapter Chipset Directory.

PCI Devices

See HowToIdentifyADevice/PCI for more information

module name	Device name(s)	help page	free (?)
acx-mac80211	Texas Instruments chipsets (ACX100/TNETW1100, ACX111/TNETW1130)	acx
adm8211	ADMtek ADM8211 chipset	adm8211
airo		?airo	?
arlan		?arlan	?
ath5k	Atheros Communications chipsets (AR5210, AR5211, AR5212, AR5213, AR5414, AR2413, AR242x)	ath5k
ath9k	Atheros Communications 802.11n chipsets	ath9k
atmel_pci	Atmel at76c506 chipset	atmel_pci
b43 b43legacy	Broadcom chipsets	bcm43xx
brcm80211 brcmsmac	Broadcom chipsets (BCM4313, BCM43224, BCM43225)	brcm80211
hostap_pci hostap_plx	Intersil Prism 2/2.5/3 chipsets	hostap	/ 1
ipw2100 ipw2200	Intel PRO/Wireless 2100 Intel PRO/Wireless 2200 Intel PRO/Wireless 2915	ipw2200
iwl3945 iwl4965	Intel PRO/Wireless 3945 Intel PRO/Wireless 4965	iwlegacy
iwlagn iwlwifi	Intel Wireless WiFi Link Intel Wireless-N Intel Advanced-N Intel Ultimate-N	iwlwifi
mwl8k	Marvell chipsets (88W8363, 88W8366, 88W8687)	mwl8k
orinoco_nortel orinoco_plx orinoco_tmd	Lucent/Agere Hermes and Intersil Prism 2/2.5/3 chipsets	orinoco	/ 2
p54pci	Intersil Prism54 chipsets (ISL3877, ISL3880, ISL3886, ISL3890)	prism54
r8192_pci r8192e_pci	Realtek RTL8192E chipset	rtl819x
rt2400pci	Ralink chipsets (RT2400/RT2460, RT2401/RT2460)	rt2400pci
rt2500pci	Ralink RT2500/RT2560 chipset	WiFi/rt2500
rt2800pci	Ralink chipsets (RT2760, RT2790, RT2860, RT2890, RT3060, RT3062, RT3090, RT3091, RT3092, RT3390, RT3562, RT3592, RT5390)	rt2800pci
rt2860sta	Ralink chipsets (RT2760/RT2790/RT2860/RT2890, RT3090/RT3091/RT3092)	rt2860sta
rt61pci	Ralink chipsets (RT2501/2561, RT2600/RT2661)	rt61pci
rtl8180	Realtek chipsets (RTL8180, RTL8185)	rtl818x
r8187se rtl8187se	Realtek RTL8187SE chipset	rtl818x
rtl8192ce	Realtek chipsets (RTL8188CE, RTL8192CE)	rtl819x
rtl8192de	Realtek chipsets (RTL8188DE, RTL8192DE)	rtl819x
rtl8192se	Realtek chipsets (RTL8191SE, RTL8192SE)	rtl819x
strip		?strip	?
wavelan		?wavelan	?
wl	Broadcom chipsets (BCM4311, BCM4312, BCM4313, BCM4321, BCM4322, BCM43224, BCM43225, BCM43227, BCM43228)	wl
	Atheros Communications AR5005VL (AR5513) chipset [168c:0020]	NdisWrapper
	InProComm IPN 2120 chipset [17fe:2120]	NdisWrapper
	InProComm IPN 2220 chipset [17fe:2220]	NdisWrapper
	Marvell Libertas 88W8335 chipset [11ab:1faa]	NdisWrapper
	WavePlus WP1200 chipset [17f7:0001]	NdisWrapper

Legend :
= OK ; Unsupported(No Driver) ; = Error (Couldn’t get it working); [?] Unknown, Not Test ; [-] Not-applicable
= Configuration Required; = Only works with a proprietary driver and/or firmware

• An extended list of PCI-IDs to kernel-module mapping is available at DeviceDatabase/PCI.

USB Devices

See HowToIdentifyADevice/USB for more information

module name	Device name(s)	help page	free (?)
acx-mac80211	Texas Instruments chipsets (ACX100USB, TNETW1450)	acx
ar5523	Atheros Communications chipsets (AR5005UG, AR5005UX)	ar5523
ar9170usb	Atheros Communications AR9170 chipset	ar9170usb	/ 3
at76c50x-usb at76_usb	Atmel chipsets (at76c503, at76c505, at76c505a)	at76_usb
ath9k_htc	Atheros Communications chipsets (AR9271, AR7010)	ath9k_htc	4/
carl9170	Atheros Communications AR9170 chipset	carl9170
orinoco_usb	Lucent/Agere Hermes chipset	orinoco_usb
p54usb	Intersil Prism54 chipsets (ISL3886, ISL3887)	prism54
prism2_usb	Intersil Prism 2/2.5/3 chipsets	linux-wlan-ng
r8712u r8192s_usb	Realtek chipsets (RTL8188SU, RTL8191SU, RTL8192SU)	rtl819x
r8192u_usb	Realtek RTL8192U chipset	rtl819x
rndis_wlan	Broadcom BCM4320 chipset	rndis_wlan
rt2500usb	Ralink RT2500USB/RT2571 chipset	rt2500usb
rt2800usb	Ralink chipsets (RT2070, RT2770, RT2870, RT3070, RT3071, RT3072, RT3370, RT3572, RT5370)	rt2800usb
rt2870sta	Ralink chipsets (RT2770/RT2870, RT3070/RT3071/RT3072)	rt2870sta
rt73usb	Ralink RT2501USB/RT2571W chipset	WiFi/rt73
rtl8187	Realtek chipsets (RTL8187, RTL8187B)	rtl818x
rtl8192cu	Realtek chipsets (RTL8188CE-VAU, RTL8188CUS, RTL8192CU)	rtl819x
usb8xxx	Marvell Libertas 88W8388 chipset	libertas
vt6656_stage	VIA VT6656 chipset	vt665x
zd1201	ZyDAS ZD1201 chipset	zd1201
zd1211rw	ZyDAS ZD1211/1211B and Atheros AR5007UG chipsets	zd1211rw
	Netgear MA111v2 [0846:4230]	NdisWrapper
	Netgear WN111v1 [0846:9000]	NdisWrapper
	TRENDware TEW-424UB v2 [0457:0163]	NdisWrapper

• An extended list of USB-IDs to kernel-module mapping is available at DeviceDatabase/USB.

PC Card (PCMCIA) Devices

See HowToIdentifyADevice/PC_Card for more information

module name	Device name(s)	help page	free (?)
acx-mac80211	Texas Instruments chipsets (ACX100/TNETW1100, ACX111/TNETW1130)	acx
adm8211	ADMtek ADM8211 chipset	adm8211
airo_cs		?airo_cs	?
ath5k	Atheros Communications chipsets (AR5210, AR5211, AR5212, AR5213, AR5414)	ath5k
ath9k	Atheros Communications 802.11n chipsets	ath9k
atmel_cs	Atmel chipsets (at76c502x, at76c504x)	atmel_cs
b43 b43legacy	Broadcom chipsets	bcm43xx
hostap_cs	Intersil Prism 2/2.5/3 chipsets	hostap	/ 1
netwave_cs		?netwave cs	?
orinoco_cs	Lucent/Agere Hermes and Intersil Prism 2/2.5/3 chipsets	orinoco	/ 2
p54pci	Intersil Prism54 chipsets (ISL3877, ISL3880, ISL3886, ISL3890)	prism54
ray_cs		?ray cs	?
rt2400pci	Ralink chipsets (RT2400/RT2460, RT2401/RT2460)	rt2400pci
rt2500pci	Ralink RT2500/RT2560 chipset	WiFi/rt2500
rt2800pci	Ralink chipsets (RT2760, RT2790, RT2860, RT2890, RT3060, RT3062, RT3090, RT3091, RT3092, RT3390, RT3562, RT3592, RT5390)	rt2800pci
rt2860sta	Ralink chipsets (RT2760/RT2790/RT2860/RT2890, RT3090/RT3091/RT3092)	rt2860sta
rt61pci	Ralink chipsets (RT2501/2561, RT2600/RT2661)	rt61pci
rtl8180	Realtek chipsets (RTL8180, RTL8185)	rtl818x
spectrum_cs	Symbol Spectrum24 Trilogy chipsets	orinoco	/ 5
wavelan_cs		?wavelan/cs	?
wl	Broadcom chipsets (BCM4311, BCM4312, BCM4313, BCM4321, BCM4322)	wl
wl3501_cs		?wl3501/cs	?
	Atheros Communications AR5005VL (AR5513) chipset [168c:0020]	NdisWrapper
	InProComm IPN 2120 chipset [17fe:2120]	NdisWrapper
	Marvell Libertas 88W8335 chipset [11ab:1faa]	NdisWrapper
	WavePlus WP1200 chipset [17f7:0002]	NdisWrapper
	ZyDAS ZD1201 chipset (16-bit PC Cards)	n/a

Routers

module name	Device name(s)	help page	free (?)
source code	Linksys WRT54GC	Wikipedia; it isn’t similar to the WRT54G; The WRT54GC is based on the Sercomm IP806SM reference design the same chipset as the current Linksys WTY54G the Airlink101 AR315W, Alloy WRT2454AP, and Hawking HWR54G. You also can useNdisWrapper

• http://hostap.epitest.fi/, hostapd is a daemon to turn a computer into an access point.

Configure Interface

Your wireless network interface can be configured using a connection manager or Debian’s network interface configuration file (/etc/network/interfaces).

Graphical Network Connection Tools:

Network Manager for GNOME (network-manager) or wicd

For more information, please see WiFi/HowToUse.

Resources

• WiFi/HowToUse

• WiFi/AdHoc

• Internet_Connection_Sharing

• Network

External Links

• http://www.linuxwireless.org , including devices and drivers.

• http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/#howto The Linux Wireless Compatibility and HowTo.

• Linux home networking wiki page about wireless networking.

• http://linux-wless.passys.nl/ Wireless Adapter Chipset Directory

• Wi-Fi definition

The Debian Network Management Portal

Debian Network management portal

1. Network configuration
2. Network services
   1. Printing
   2. Data Base
      1. MySQL
      2. PostgreSql
   3. DHCP
   4. DNS
   5. FTP
   6. LDAP
   7. Mail
      1. Postfix
      2. Exim
      3. Mailing lists Managers
   8. Monitoring
   9. NTP
   10. PPP
   11. Remote Display
   12. File sharing
       1. NFS
       2. Samba
   13. Disk Sharing
   14. SSH
   15. SVN
   16. Web Server
       1. Apache
       2. Content Management Systems
       3. Web Application Servers
   17. IM
       1. Ejabberd
   18. IPSec VPN
   19. Azureus as a daemon

Network configuration

• DebianReference/Network

• DialupConf, PPP, pppd

• NetworkConfiguration – How to configure your network

• netconf

• NetworkManager

• Proxy: ProxyAutodetectConf, HowtoProxyThroughSSH

• WakeOnLan

• Wireless

• BridgeNetworkConnections

• ConvertNetToStatic

• Android_Tethering

Need to be translated:

• fr/AdslFree (in french)

• fr/LaptopMultiNet (in french)

• fr/SysVInit (in french)

• ru/xl2tpd (in russian)

Network services

Printing

• Printing

• fr/CUPS (in French)

Data Base

• DatabaseServers

• DataBase

• DebianNPDatabases

MySQL

• LAMP: – Linux Apache MySQL PHP framework

PostgreSql

• PostgreSql

DHCP

• DHCP_Client

• DHCP_Server

DNS

• Bind9

• DDNS

FTP

• FTP Clients and servers

LDAP

• LDAP

Mail

• DebianSpamAssassin

• PkgDspam

• ImapProxy

• sSMTP

• QpopperSSL

Postfix

• Postfix

• PostfixAndSASL

Exim

• GmailAndExim4

• HowtoSendWithEximThroughSSH

• PkgExim4

• PkgExim4UserFAQ

• YahooAndExim4

• ATTUverseExim4

Mailing lists Managers

• ?GNU mailman

• Sympa

• ?SmartList

Monitoring

• Network_Monitoring

NTP

• NTP

• fr/NTPProtocole

• DateTime

• TaskTimeManagers

• TimeZoneChanges

PPP

• PPP

Remote Display

• Remote desktop

• HowtoRecordVNC

• VNCviewer

• Rdesktop

• freenx

File sharing

NFS

• NFS

• NFSServerSetup

• NFSTroubleshooting

• SecuringNFS

Samba

• BuildingALinuxDomain

• SAMBAClientSetup

• SAMBAServerSetup

• SambaDcWithLdapBackend

• Samba Quick Setup(Rus)

• Simple Samba file sharing server setup

Disk Sharing

• SAN/iSCSI

SSH

• SSH

SVN

• Subversion

• SmallSVNAdministrationTutorial

• SmallSVNTutorial

• ConvertCVStosvn

Web Server

• Web server

Apache

• Apache

• EtchApache2DefineSSL

• LAMP: – Linux Apache MySQL PHP framework

• SubversionApache2SSLHowto

• Caudium

Content Management Systems

• WordPress

Web Application Servers

• Zope

IM

• InstantMessaging

Ejabberd

• es/Ejabberd_Configuration (in Spanish)

IPSec VPN

• IPsec between debian clients and netscreen firewalls

Azureus as a daemon

• AzureusAsDaemon

How to list and identify connected USB devices on a Debian Linux machine

How to list and identify the USB devices that are connected to you computer.

Make sure the device is powered-up and enabled before listing the devices.

Device are mainly identified using a pair of hexadecimal numbers, like 04b3:3108.

• The 4 first hexadecimal digits are the Vendor ID (04b3 = IBM).

• The 4 last hexadecimal digits are the Device ID (3108 = ThinkPad 800dpi Optical Travel Mouse).

See references for more information.

Most of the devices (device-ids) handled by Debian are listed in the page : DeviceDatabase/USB.

Many people simply use lsusb, which is available on almost every Debian system, to list the devices on their computer. Gnome users can install and use the hardinfo method. KDE user can use kinfocenter.

lsusb

lsusb (package:usbutils) is the standard tool to query the connected USB devices.

#lsusb
Bus 005 Device 001: ID 0000:0000
Bus 004 Device 006: ID 0a5c:2110 Broadcom Corp.
Bus 004 Device 001: ID 0000:0000
Bus 001 Device 001: ID 0000:0000
Bus 002 Device 001: ID 0000:0000
Bus 003 Device 001: ID 0000:0000

• if your device description says “Unknown device”, you can update your local usb-id definition by running update-usbids as root.

To get something slightly more verbose, but still readable, I use :

#lsusb -v | grep -E '\<(Bus|iProduct|bDeviceClass|bDeviceProtocol)' 2>/dev/null
Bus 005 Device 001: ID 0000:0000
  bDeviceClass            9 Hub
  bDeviceProtocol         1 Single TT
  iProduct                2 EHCI Host Controller
Bus 004 Device 006: ID 0a5c:2110 Broadcom Corp.
  bDeviceClass          224 Wireless
  bDeviceProtocol         1 Bluetooth
  iProduct                2 BCM2045B
  (Bus Powered)
Bus 004 Device 001: ID 0000:0000
  bDeviceClass            9 Hub
  bDeviceProtocol         0 Full speed hub
  iProduct                2 UHCI Host Controller
Bus 001 Device 001: ID 0000:0000
  bDeviceClass            9 Hub
  bDeviceProtocol         0 Full speed hub
  iProduct                2 UHCI Host Controller
Bus 002 Device 001: ID 0000:0000
  bDeviceClass            9 Hub
  bDeviceProtocol         0 Full speed hub
  iProduct                2 UHCI Host Controller
Bus 003 Device 001: ID 0000:0000
  bDeviceClass            9 Hub
  bDeviceProtocol         0 Full speed hub
  iProduct                2 UHCI Host Controller

man lspci(8)

Under Gnome : hardinfo

Gnomes’s System Information (Hardinfo in Menu Applications/System Tools, from package:hardinfo) has an information page on the “USB” cards.

note the “Vendor” and “Product ID”.

Under KDE : KInfocenter

KDE’s KInfoCenter (in K Menu / System / KInfoCenter Info Center, from package:kcontrol) has an information page on the “USB” cards.

discover

The discover package has a nice command too:

discover --vendor-id --model-id usb
0000 0000 unknown unknown
0000 0000 unknown unknown
0a5c 2110 unknown unknown
0000 0000 unknown unknown
0000 0000 unknown unknown
0000 0000 unknown unknown

man (1)discover
discover uses its own files : /lib/discover/usb-busclass.xml, /lib/discover/usb-device.xml, /lib/discover/usb-vendor.xml

Digging by hand

/proc/bus/usb/devices

If lsusb isn’t available (!), you can display the contents of /proc/bus/usb/devices to list vendor and device IDs and other technical details:

#use grep to filter important line.
cat /proc/bus/usb/devices | grep -E "^([TSPD]:.*|)$"
T:  Bus=05 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=480 MxCh= 8
D:  Ver= 2.00 Cls=09(hub  ) Sub=00 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0000 ProdID=0000 Rev= 2.06
S:  Manufacturer=Linux 2.6.18-4-686 ehci_hcd
S:  Product=EHCI Host Controller
S:  SerialNumber=0000:00:1d.7

T:  Bus=04 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12  MxCh= 2
D:  Ver= 1.10 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=0000 ProdID=0000 Rev= 2.06
S:  Manufacturer=Linux 2.6.18-4-686 uhci_hcd
S:  Product=UHCI Host Controller
S:  SerialNumber=0000:00:1d.3

T:  Bus=04 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  7 Spd=12  MxCh= 0
D:  Ver= 2.00 Cls=e0(unk. ) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0a5c ProdID=2110 Rev= 1.00
S:  Manufacturer=Broadcom Corp
S:  Product=BCM2045B

T:  Bus=03 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12  MxCh= 2
D:  Ver= 1.10 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=0000 ProdID=0000 Rev= 2.06
S:  Manufacturer=Linux 2.6.18-4-686 uhci_hcd
S:  Product=UHCI Host Controller
S:  SerialNumber=0000:00:1d.2

T:  Bus=02 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12  MxCh= 2
D:  Ver= 1.10 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=0000 ProdID=0000 Rev= 2.06
S:  Manufacturer=Linux 2.6.18-4-686 uhci_hcd
S:  Product=UHCI Host Controller
S:  SerialNumber=0000:00:1d.1

T:  Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#=  1 Spd=12  MxCh= 2
D:  Ver= 1.10 Cls=09(hub  ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=0000 ProdID=0000 Rev= 2.06
S:  Manufacturer=Linux 2.6.18-4-686 uhci_hcd
S:  Product=UHCI Host Controller
S:  SerialNumber=0000:00:1d.0

References

• Wikipedia – USB

• http://www.linux-usb.org/usb.ids – maintains a list of device-id and vendor-id to text mappings

• /usr/share/doc/linux-doc-2.6.26/Documentation/usb/* – kernel USB documentation

How to identify a PC Card

PC Card is a generic name for two technologies of hot-pluggable cards (the size of a smart card, but about 5mm thick):

• 16-bit PC Card (PCMCIA)

• 32-bit CardBus

This page covers “16-bit PC Card” devices, previously named “PCMCIA”.

pccardctl

Install the pcmciautils package to provide the pccardctl utility.

pccardctl ident

Socket 0:
  product info: "The Linksys Group, Inc.", "Instant Wireless Network PC Card", "ISL37300P", "RevA"
  manfid: 0x0274, 0x1613
  function: 6 (network)

pccardctl info

PRODID_1="The Linksys Group, Inc."
PRODID_2="Instant Wireless Network PC Card"
PRODID_3="ISL37300P"
PRODID_4="RevA"
MANFID=0274,1613
FUNCID=6

pccardctl status

Socket 0:
  5.0V 16-bit PC Card
  Subdevice 0 (function 0) [unbound]

Under GNOME: hardinfo

Hardinfo doesn’t list PCMCIA cards.

Under KDE: KInfocenter

KDE’s KInfoCenter (in K Menu / System / KInfoCenter Info Center, from package kcontrol) has an information page on PC Cards.

Note: Sometimes, KInfoCenter doesn’t detect PCMCIA cards.

dmidecode

The motherboard DMI zone has information about the system’s slots. dmidecode can be used to retrieve this information.

dmidecode -t 9
# dmidecode 2.9
SMBIOS 2.4 present.

Handle 0x0020, DMI type 9, 13 bytes
System Slot Information
        Designation: ExpressCard Slot 1
        Type: x1 PCI Express
        Current Usage: Available
        Length: Other
        ID: 0
        Characteristics:
                Hot-plug devices are supported

Handle 0x0021, DMI type 9, 13 bytes
System Slot Information
        Designation: CardBus Slot 1
        Type: 32-bit PC Card (PCMCIA)
        Current Usage: Available
        Length: Other
        ID: Adapter 1, Socket 0
        Characteristics:
                5.0 V is provided
                3.3 V is provided
                PC Card-16 is supported
                Cardbus is supported
                Zoom Video is supported
                Modem ring resume is supported
                PME signal is supported
                Hot-plug devices are supported

lspci

32-bit CardBus devices are usually visible (bridged) as a PCI device.

/proc/bus/pccard/*

TODO

/sys/bus/pcmcia/*

TODO

References

• /usr/share/doc/pcmciautils/mini-howto.txt.gz (also online) – PCMCIA Howto (pccardctl)

• pccardctl(8)

• Wikipedia – PC Card

Setup Nginx + php-FPM + apc + MariaDB on Debian 7 – The perfect LEMP server

Debian webserver

Debian is a great choice for setting up linux webservers. According to current stats it is the most popular server OS followed closely by centos. I am a great fan of the apt/dpkg/gdebi commands, which make it so easy to install and update packages on the system.

To setup a complete functional php webserver, you need to install a couple of extra things which include a webserver and a database. In this post we shall be setting up nginx, php, php-fpm, apc and MariaDB.

Nginx is a modern webserver, that has been designed to handle large amounts of traffic using the least amount of resources in terms of RAM and CPU. Before nginx the traditional webserver used through out the internet was apache. However as the internet became more populated, the need for a faster and efficient webserver grew.

Nginx vs Apache

Apache by design is very bulky and has tons of features, most of which are not necessary for typical websites. It was probably designed to satisfy everyone’s needs, but this ended up making it a large and heavy webserver with mostly unused features.

Nginx on the other hand is a very sleek and swift webserver that focuses entirely on speed, scalability, and efficiency. The technicals of how it does so are large and beyond the scope of this post. May be we could take a look later on. Just for your information this website runs on nginx.

Now without any further discussion lets get to work.

1. Install Nginx on Debian

The nginx package is right there in the debian repositories so you dont have to look anywhere else. Fire up apt-get and install it.

# apt-get install nginx

Now launch the nginx server.

# service nginx start
Starting nginx: nginx.

Now access the nginx server from browser by opening the url

http://localhost/

and you should get the welcome message

Welcome to nginx!

Important notes

There are few things you should memorise to manage your nginx server better. The nginx configuration files are found in the following location

/etc/nginx/

root@localhost:/etc/nginx# ls
conf.d		koi-win		  naxsi.rules	scgi_params	 uwsgi_params
fastcgi_params	mime.types	  nginx.conf	sites-available  win-utf
koi-utf		naxsi_core.rules  proxy_params	sites-enabled

We shall not modify the nginx.conf file directly. Instead we create a separate configuration file for each vhost/site and save it in the following directories.

/etc/nginx/sites-available
/etc/nginx/sites-enabled

This is similar to apache. The sites-enabled directory contains the configurations for vhosts that are to be enabled. It contains symlinks to the corresponding configuration files in sites-available directory.

Setup a virtualhost

Now that we have installed nginx, its time to setup a virtual host. This is what you would be doing on a real webserver to setup your site.

Inside /etc/nginx/sites-available you would see a file named default. It is a template file to create your own configuration files. Just copy it and name it to your site.

# cp default binarytides.com
root@localhost:/etc/nginx/sites-available# ls
binarytides.com  default

We choose to name the configuration files with the site name, so that it is easier to remember and maintain.
Now open up binarytides.com and edit the things as per your need.
You would see a server block similar to this

server {
	#listen   80; ## listen for ipv4; this line is default and implied
	#listen   [::]:80 default_server ipv6only=on; ## listen for ipv6

	root /usr/share/nginx/www;
	index index.html index.htm;

	# Make site accessible from http://localhost/
	server_name localhost;

This first thing to configure here is the server_name. Name it to your site. For example

server_name binarytides.com
or
server_name binarytides.com www.binarytides.com

When someone opens binarytides.com in his browser, the http header contains this hostname which nginx would pickup and search for a matching server block. When a matching server block is found, it would use the configuration from that particular server block.

Another thing to configure is the web root directory for this site/vhost. Note that this is by default/usr/share/nginx/www which you might want to change to something else.

The general convention is to have a separate directory for each vhost. For example

/usr/share/nginx/www/binarytides.com/
/usr/share/nginx/www/google.com/

So create an appropriate directory and point the root setting in the configuration file to the directory.

...
root /usr/share/nginx/www/binarytides.com;
...

After doing these changes, save the configuration file and create a symlink the /etc/nginx/sites-enabled directory.

root@localhost:/etc/nginx/sites-available# ls
binarytides.com  default
root@localhost:/etc/nginx/sites-available# cd ..
root@localhost:/etc/nginx# cd sites-enabled/
root@localhost:/etc/nginx/sites-enabled# ln -s ../sites-available/binarytides.com 
root@localhost:/etc/nginx/sites-enabled# ls
binarytides.com  default
root@localhost:/etc/nginx/sites-enabled#

Now test your new configuration

# nginx -t
nginx: [warn] conflicting server name "localhost" on 0.0.0.0:80, ignored
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

The last line of the output must say successful, or some error would be shown. It might show some warnings which can be fixed later.

Finally restart nginx for the new configuration to take effect

# service nginx restart
Restarting nginx: nginx: [warn] conflicting server name "localhost" on 0.0.0.0:80, ignored
nginx.
root@localhost:/etc/nginx/sites-enabled#

So the new configuration has taken effect. Now create a new index.html file in the new web root of this virtual host and open it from the browser and it should work.

2. Install php and php-fpm

The next thing to install is the php interpreter and php-fpm. Php-FPM is dedicated fastcgi process manager for php that can interface or connect with any compatible webserver and manage php processes to process php requests.

Nginx <== communicates ==> Php-FPM <== manages ==> php child process

Install the necessary packages first.

# apt-get install php5 php5-fpm

It will automatically install the necessary dependencies. You can install php5-cli package also if you need the php command to run php scripts.

Php-fpm runs as a separate server and nginx communicates with it over a socket. Hence the php execution is totally outside the server. Also since fpm keeps php process persistent, it fully supports APC.

Now locate the php fpm configuration files. The files at located at

/etc/php5/fpm/

A pool is a bunch of php processes running with same user/group. So if you want the php files of each site to run with a separate user permission, then you need to create separate pools of fpm. For simplicity sake we just showing a single pool here.

The pool configuration files are inside the pool.d directory. Navigate in

root@localhost:/etc/php5/fpm/pool.d# ls
www.conf

Open the http://www.conf file which is again a template for you to use and create separate configuration files for each pool.
It looks something like this

; Start a new pool named 'www'.
; the variable $pool can we used in any directive and will be replaced by the
; pool name ('www' here)
[www]

; Per pool prefix
; It only applies on the following directives:
; - 'slowlog'
; - 'listen' (unixsocket)
; - 'chroot'
; - 'chdir'
; - 'php_values'
; - 'php_admin_values'
; When not set, the global prefix (or /usr) applies instead.
; Note: This directive can also be relative to the global prefix.
; Default Value: none
;prefix = /path/to/pools/$pool

; Unix user/group of processes
; Note: The user is mandatory. If the group is not set, the default user's group
;       will be used.
user = www-data
group = www-data

; The address on which to accept FastCGI requests.
; Valid syntaxes are:
;   'ip.add.re.ss:port'    - to listen on a TCP socket to a specific address on
;                            a specific port;
;   'port'                 - to listen on a TCP socket to all addresses on a
;                            specific port;
;   '/path/to/unix/socket' - to listen on a unix socket.
; Note: This value is mandatory.
listen = /var/run/php5-fpm.sock

; Set listen(2) backlog.
; Default Value: 128 (-1 on FreeBSD and OpenBSD)
;listen.backlog = 128

The above thing consists of comments mostly and the most important 4 lines are

1. [www]  this is the pool name  2. user = www-data  this is the user with whose permissions the php script would be run  3. group = www-data this is the group  4. listen = /var/run/php5-fpm.sock this is the socket for communicating with this pool. This socket must be given to nginx for nginx to be able to talk to fpm

Connect fpm with nginx

We are not going to change much here. Just note down the socket path. We have to put this into the nginx configuration file. Go back to your nginx configuration and open it again.

It contains a section for php fpm configuration which looks like this

# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
#
#location ~ \.php$ {
#	fastcgi_split_path_info ^(.+\.php)(/.+)$;
#	# NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
#
#	# With php5-cgi alone:
#	fastcgi_pass 127.0.0.1:9000;
#	# With php5-fpm:
#	fastcgi_pass unix:/var/run/php5-fpm.sock;
#	fastcgi_index index.php;
#	include fastcgi_params;
#}

Uncomment it and make it look like this

location ~ \.php$ {
	fastcgi_split_path_info ^(.+\.php)(/.+)$;
#	# NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini

#	# With php5-cgi alone:
#	fastcgi_pass 127.0.0.1:9000;
	# With php5-fpm:
	fastcgi_pass unix:/var/run/php5-fpm.sock;
	fastcgi_index index.php;
	include fastcgi_params;
}

Test PHP

Now put up a file in the web root with the phpinfo call.

1 2 3

<?php phpinfo();

And then open the file in browser and the php information block should come up, saying that php is setup and working correctly.

Another thing that you can do is add index.php to the index files list. So that when accessing a directory, if no file is specified, then index.php gets called.

root /usr/share/nginx/www/binarytides.com;
index index.html index.htm index.php;

Setup apc – alternate php cache

APC is a great way to speed up the execution of php scripts. Apc compiles php code and keeps the opcode in memory and uses it next time without compiling the same php code again from file. This drastically speeds up execution. Apart from opcode cache, apc also offers a user cache to store raw data for the php application in memory.

Php as of version 5.5 has new feature called OPcache which does the same thing as apc opcode cache thereby deprecating apc.

Setting up apc is very simple and quick. Just install the apc package for php

1	# apt-get install php-apc

Then restart php fpm

# service php5-fpm restart

Now check the phpinfo page again and it should have the apc details as well. The apc configuration file is located at

/etc/php5/fpm/conf.d/20-apc.ini

The configuration can be tweaked a bit for optimal performance for your needs. Here is the kind of configuration that I use

extension=apc.so
 
apc.enabled=1
apc.shm_size=128M
apc.ttl=3600
apc.user_ttl=7200
apc.gc_ttl=3600
apc.max_file_size=1M

Check the list of apc configuration parameters for more information.

3. Install MariaDB on Debian

Now comes the last and final component of the LEMP stack. That is the MariaDB database and not mysql. Well by now you should be knowing that mysql is in the hands of oracle and no more a community belonging. So major corps have started switching to mariadb. The good thing is that mariadb is binary compatible with mysql with lots of additional features. So if you are already using mysql for your php applications then shifting to mariadb would be absolutely hassle free.

MariaDB is not present in the debian repositories. To get the repositories visit the following page

https://downloads.mariadb.org/mariadb/repositories/

Select Debian as the distro, Wheezy as the release and version 10.0 of mariadb. Then select a mirror on the right side. Now scroll down to the bottom of the page to find the repository details.

Here are the commands that I got

sudo apt-get install python-software-properties
sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 0xcbcb082a1bb943db
sudo add-apt-repository 'deb http://mirrors.fe.up.pt/pub/mariadb/repo/10.0/debian wheezy main'

Now update the apt cache and install the mariadb packages

sudo apt-get update
sudo apt-get install mariadb-server mariadb-client

While installation mariadb would ask for the password of user root. Enter the password and make sure not to forget.

After the installation finishes check your mariadb version

# mysql -V
mysql  Ver 15.1 Distrib 10.0.3-MariaDB, for debian-linux-gnu (x86_64) using readline 5.1

Note that the command name is same as with mysql. But the name mariadb is there in the version information.

Webserver is ready

So now the LEMP web server is ready to use. You may want to install a couple of extra goodies like phpmyadmin to manage your database better. Phpmyadmin is there in the debian repository so install it right from there.

Have any questions ? Feel free to comment below.

Installing Metasploit Framework on Ubuntu 14.04 LTS and Debian 7

This Guide covers the installation of Metasploit Framework OSS Project on Ubuntun Linux LTS. If you do not wish to run the Open Source version or set up a development environment and do not mind giving your email address to Rapid 7 for marketing I would recommend downloading their comercial installer from http://www.metasploit.com/ Installing DependencieWe start by making sure that we have the latest packages by updating the system using apt-get:

sudo apt-get update
sudo apt-get upgrade

Now that we know that we are running an updated system we can install all the dependent packages that are needed by Metasploit Framework:

sudo apt-get install build-essential libreadline-dev libssl-dev libpq5 libpq-dev libreadline5 libsqlite3-dev libpcap-dev openjdk-7-jre git-core autoconf postgresql pgadmin3 curl zlib1g-dev libxml2-dev libxslt1-dev vncviewer libyaml-dev curl zlib1g-dev

Installing a Proper Version of Ruby

The distribution sadly does not comes by default with a proper version of Linux for us to use with Metasploit Framework and we will have to download and compile a proper one. There 2 mains ways recommended for this are using RVM or rbenv (Do not install both choose one or the other).

Installing Ruby using RVM:

curl -L https://get.rvm.io | bash -s stable
source ~/.rvm/scripts/rvm
echo "source ~/.rvm/scripts/rvm" >> ~/.bashrc
source ~/.bashrc
rvm install 2.1.5
rvm use 2.1.5 --default
ruby -v

Installing Ruby using rbenv:

cd ~
git clone git://github.com/sstephenson/rbenv.git .rbenv
echo 'export PATH="$HOME/.rbenv/bin:$PATH"' >> ~/.bashrc
echo 'eval "$(rbenv init -)"' >> ~/.bashrc
exec $SHELL

git clone git://github.com/sstephenson/ruby-build.git ~/.rbenv/plugins/ruby-build
echo 'export PATH="$HOME/.rbenv/plugins/ruby-build/bin:$PATH"' >> ~/.bashrc
exec $SHELL

rbenv install 2.1.5
rbenv global 2.1.5
ruby -v

Once the packages have been install we need to install the required Ruby libraries that metasploit depends on:

sudo gem install bundler 

Installing Nmap

One of the external tools that Metasploit uses for scanning that is not included with the sources is Nmap. Here we will cover downloading the latest source code for Nmap, compiling and installing:

mkdir ~/Development
cd ~/Development
svn co https://svn.nmap.org/nmap
cd nmap
./configure
make
sudo make install
make clean

Configuring Postgre SQL Server

We start by switching to the postgres user so we can create the user and database that we will use for Metasploit

sudo -s
su postgres

Now we create the user and Database, do record the database that you gave to the user since it will be used in the database.yml file that Metasploit and Armitage use to connect to the database.

createuser msf -P -S -R -D
createdb -O msf msf
exit
exit

If you experience problems with the database setup this fedora guide offers a good guide for troubleshooting and setup https://fedoraproject.org/wiki/Metasploit_Postgres_Setup

Installing Metasploit Framework

We will download the latest version of Metasploit Framework via Git so we can use msfupdate to keep it updated:

cd /opt
git clone https://github.com/rapid7/metasploit-framework.git
cd metasploit-framework

Install using bundler the requiered gems and versions:

cd metasploit-framework 
bundle install

WARNING: Currently there is a bug in Metasploit Framework with Symlinks: https://github.com/rapid7/metasploit-framework/issues/4602

Lets create the links to the commands so we can use them under any user and not being under the framework folder, for this we need to be in the metasploit-framework folder if not already in it:

cd metasploit-framework
sudo bash -c 'for MSF in $(ls msf*); do ln -s /opt/metasploit-framework/$MSF /usr/local/bin/$MSF;done'

Metasploit for Development and Contribution

If you wish to develop and contribute to the product you can follow the additional steps here Metasploit Dev Environment . For this you will need a GitHub account and you will fork the project in to your own account. I personally keep my dev copy of Metasploit in ~/Development folder and after an initial run of msfconsole I keep my database.yml file in ~/.msf4/cofig folder and adjust the MSF_DATABASE_CONFIG variable for it or run msfconsole with the -y option and point it to a YAML file with the correct configuration.

Installing armitage:

curl -# -o /tmp/armitage.tgz http://www.fastandeasyhacking.com/download/armitage-latest.tgz
sudo tar -xvzf /tmp/armitage.tgz -C /opt
sudo ln -s /opt/armitage/armitage /usr/local/bin/armitage
sudo ln -s /opt/armitage/teamserver /usr/local/bin/teamserver
sudo sh -c "echo java -jar /opt/armitage/armitage.jar \$\* > /opt/armitage/armitage"
sudo perl -pi -e 's/armitage.jar/\/opt\/armitage\/armitage.jar/g' /opt/armitage/teamserver

Lets create the database.yml file that will contain the configuration parameters that will be use by framework:

sudo nano /opt/metasploit-framework/config/database.yml

Copy the YAML entries and make sure you provide the password you entered in the user creating step in the password field for the database:

production:
 adapter: postgresql
 database: msf
 username: msf
 password: 
 host: 127.0.0.1
 port: 5432
 pool: 75
 timeout: 5

Create and environment variable so it is loaded by Armitage and by msfconsole when running and load the variable in to your current shell:

sudo sh -c "echo export MSF_DATABASE_CONFIG=/opt/metasploit-framework/config/database.yml >> /etc/profile"

source /etc/profile

First Run

Now we are ready to run Metasploit for the first time. My recommendation is to run it first under a regular user so the folders create under your home directory have the proper permissions. First time it runs it will create the entries needed by Metasploit in the database so it will take a while to load.

msfconsole