After the reboot you can login with your previously created username (e.g.
administrator).
Because we must run all the steps from this tutorial with root privileges, we can either prepend all commands in this tutorial with the string
sudo, or we become root right now by typing
(You can as well enable the root login by running
and giving root a password. You can then directly log in as root, but this is frowned upon by the Ubuntu developers and community for various reasons. See
http://ubuntuforums.org/showthread.php?t=765414.)
5. Install The SSH Server (Optional).
If you did not install the OpenSSH server during the system installation, you can do it now:
apt-get install ssh openssh-server
From now on you can use an SSH client such as
PuTTY and connect from your workstation to your Ubuntu 11.10 server and follow the remaining steps from this tutorial.
6. Install vim-nox (Optional).
I'll use
vi as my text editor in this tutorial. The default
vi program has some strange behaviour on Ubuntu and Debian; to fix this, we install
vim-nox:
(You don't have to do this if you use a different text editor such as joe or nano.)
7. Configure The Network.
Because the Ubuntu installer has configured our system to get its network settings via DHCP, we have to change that now because a server should have a static IP address. Edit
/etc/network/interfaces and adjust it to your needs (in this example setup I will use the IP address
192.168.0.100):
vi /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
iface eth0 inet static
address 192.168.0.100
netmask 255.255.255.0
network 192.168.0.0
broadcast 192.168.0.255
gateway 192.168.0.1 |
Then restart your network:
/etc/init.d/networking restart
Then edit
/etc/hosts. Make it look like this:
vi /etc/hosts
127.0.0.1 localhost.localdomain localhost
192.168.0.100 server1.example.com server1
# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters |
Now run
echo server1.example.com > /etc/hostname
/etc/init.d/hostname restart
Afterwards, run
hostname
hostname -f
Both should show
server1.example.com now.
8. Edit /etc/apt/sources.list And Update Your Linux Installation.
Edit
/etc/apt/sources.list. Comment out or remove the installation CD from the file and make sure that the
universe and
multiverse repositories are enabled. It should look like this:
vi /etc/apt/sources.list
#
# deb cdrom:[Ubuntu-Server 11.10 _Oneiric Ocelot_ - Release amd64 (20111011)]/ dists/oneiric/main/binary-i386/
# deb cdrom:[Ubuntu-Server 11.10 _Oneiric Ocelot_ - Release amd64 (20111011)]/ dists/oneiric/restricted/binary-i386/
# deb cdrom:[Ubuntu-Server 11.10 _Oneiric Ocelot_ - Release amd64 (20111011)]/ oneiric main restricted
#deb cdrom:[Ubuntu-Server 11.10 _Oneiric Ocelot_ - Release amd64 (20111011)]/ dists/oneiric/main/binary-i386/
#deb cdrom:[Ubuntu-Server 11.10 _Oneiric Ocelot_ - Release amd64 (20111011)]/ dists/oneiric/restricted/binary-i386/
#deb cdrom:[Ubuntu-Server 11.10 _Oneiric Ocelot_ - Release amd64 (20111011)]/ oneiric main restricted
# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to
# newer versions of the distribution.
deb http://de.archive.ubuntu.com/ubuntu/ oneiric main restricted
deb-src http://de.archive.ubuntu.com/ubuntu/ oneiric main restricted
## Major bug fix updates produced after the final release of the
## distribution.
deb http://de.archive.ubuntu.com/ubuntu/ oneiric-updates main restricted
deb-src http://de.archive.ubuntu.com/ubuntu/ oneiric-updates main restricted
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team. Also, please note that software in universe WILL NOT receive any
## review or updates from the Ubuntu security team.
deb http://de.archive.ubuntu.com/ubuntu/ oneiric universe
deb-src http://de.archive.ubuntu.com/ubuntu/ oneiric universe
deb http://de.archive.ubuntu.com/ubuntu/ oneiric-updates universe
deb-src http://de.archive.ubuntu.com/ubuntu/ oneiric-updates universe
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## team, and may not be under a free licence. Please satisfy yourself as to
## your rights to use the software. Also, please note that software in
## multiverse WILL NOT receive any review or updates from the Ubuntu
## security team.
deb http://de.archive.ubuntu.com/ubuntu/ oneiric multiverse
deb-src http://de.archive.ubuntu.com/ubuntu/ oneiric multiverse
deb http://de.archive.ubuntu.com/ubuntu/ oneiric-updates multiverse
deb-src http://de.archive.ubuntu.com/ubuntu/ oneiric-updates multiverse
## N.B. software from this repository may not have been tested as
## extensively as that contained in the main release, although it includes
## newer versions of some applications which may provide useful features.
## Also, please note that software in backports WILL NOT receive any review
## or updates from the Ubuntu security team.
deb http://de.archive.ubuntu.com/ubuntu/ oneiric-backports main restricted universe multiverse
deb-src http://de.archive.ubuntu.com/ubuntu/ oneiric-backports main restricted universe multiverse
deb http://security.ubuntu.com/ubuntu oneiric-security main restricted
deb-src http://security.ubuntu.com/ubuntu oneiric-security main restricted
deb http://security.ubuntu.com/ubuntu oneiric-security universe
deb-src http://security.ubuntu.com/ubuntu oneiric-security universe
deb http://security.ubuntu.com/ubuntu oneiric-security multiverse
deb-src http://security.ubuntu.com/ubuntu oneiric-security multiverse
## Uncomment the following two lines to add software from Canonical's
## 'partner' repository.
## This software is not part of Ubuntu, but is offered by Canonical and the
## respective vendors as a service to Ubuntu users.
# deb http://archive.canonical.com/ubuntu oneiric partner
# deb-src http://archive.canonical.com/ubuntu oneiric partner
## Uncomment the following two lines to add software from Ubuntu's
## 'extras' repository.
## This software is not part of Ubuntu, but is offered by third-party
## developers who want to ship their latest software.
# deb http://extras.ubuntu.com/ubuntu oneiric main
# deb-src http://extras.ubuntu.com/ubuntu oneiric main |
Then run
apt-get update
to update the apt package database and
apt-get upgrade
to install the latest updates (if there are any). If you see that a new kernel gets installed as part of the updates, you should reboot the system afterwards:
reboot
9. Change The Default Shell.
/bin/sh is a symlink to
/bin/dash, however we need
/bin/bash, not
/bin/dash. Therefore we do this:
Use dash as the default system shell (/bin/sh)? <-- No
If you don't do this, the ISPConfig installation will fail.
10. Disable AppArmor.
AppArmor is a security extension (similar to SELinux) that should provide extended security. In my opinion you don't need it to configure a secure system, and it usually causes more problems than advantages (think of it after you have done a week of trouble-shooting because some service wasn't working as expected, and then you find out that everything was ok, only AppArmor was causing the problem). Therefore I disable it (this is a must if you want to install ISPConfig later on).
We can disable it like this:
/etc/init.d/apparmor stop
update-rc.d -f apparmor remove
apt-get remove apparmor apparmor-utils
11. Synchronize the System Clock.
It is a good idea to synchronize the system clock with an NTP (
network
time
protocol) server over the Internet. Simply run
apt-get install ntp ntpdate
and your system time will always be in sync.
We can install Postfix, Courier, Saslauthd, MySQL, rkhunter, and binutils with a single command:
apt-get install postfix postfix-mysql postfix-doc mysql-client mysql-server courier-authdaemon courier-authlib-mysql courier-pop courier-pop-ssl courier-imap courier-imap-ssl libsasl2-2 libsasl2-modules libsasl2-modules-sql sasl2-bin libpam-mysql openssl getmail4 rkhunter binutils maildrop
You will be asked the following questions:
New password for the MySQL "root" user: <-- yourrootsqlpassword
Repeat password for the MySQL "root" user: <-- yourrootsqlpassword
Create directories for web-based administration? <-- No
General type of mail configuration: <-- Internet Site
System mail name: <-- server1.example.com
SSL certificate required <-- Ok
If you find out (later after you have configured your first email account in ISPConfig) that you cannot send emails and get the following error in
/var/log/mail.log...
SASL LOGIN authentication failed: no mechanism available
... please go to
Ubuntu 11.10 + saslauthd: SASL PLAIN authentication failed: no mechanism available to learn how to resolve the issue.
We want MySQL to listen on all interfaces, not just localhost, therefore we edit
/etc/mysql/my.cnf and comment out the line
bind-address = 127.0.0.1:
vi /etc/mysql/my.cnf
[...]
# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
#bind-address = 127.0.0.1
[...] |
Then we restart MySQL:
/etc/init.d/mysql restart
Now check that networking is enabled. Run
netstat -tap | grep mysql
The output should look like this:
root@server1:~# netstat -tap | grep mysql
tcp 0 0 *:mysql *:* LISTEN 22355/mysqld
root@server1:~#
During the installation, the SSL certificates for IMAP-SSL and POP3-SSL are created with the hostname
localhost. To change this to the correct hostname (
server1.example.com in this tutorial), delete the certificates...
cd /etc/courier
rm -f /etc/courier/imapd.pem
rm -f /etc/courier/pop3d.pem
... and modify the following two files; replace
CN=localhost with
CN=server1.example.com (you can also modify the other values, if necessary):
vi /etc/courier/imapd.cnf
[...]
CN=server1.example.com
[...] |
vi /etc/courier/pop3d.cnf
[...]
CN=server1.example.com
[...] |
Then recreate the certificates...
mkimapdcert
mkpop3dcert
... and restart Courier-IMAP-SSL and Courier-POP3-SSL:
/etc/init.d/courier-imap-ssl restart
/etc/init.d/courier-pop-ssl restart
13. Install Amavisd-new, SpamAssassin, And Clamav.
To install amavisd-new, SpamAssassin, and ClamAV, we run
apt-get install amavisd-new spamassassin clamav clamav-daemon zoo unzip bzip2 arj nomarch lzop cabextract apt-listchanges libnet-ldap-perl libauthen-sasl-perl clamav-docs daemon libio-string-perl libio-socket-ssl-perl libnet-ident-perl zip libnet-dns-perl
The ISPConfig 3 setup uses amavisd which loads the SpamAssassin filter library internally, so we can stop SpamAssassin to free up some RAM:
/etc/init.d/spamassassin stop
update-rc.d -f spamassassin remove
14.Install Nginx, PHP5 (PHP-FPM), And Fcgiwrap.
Nginx is available as a package for Ubuntu which we can install as follows:
If Apache2 is already installed on the system, stop it now...
... and remove Apache's system startup links:
Start nginx afterwards:
(If both Apache2 and nginx are installed, the ISPConfig 3 installer will ask you which one you want to use - answer
nginx in this case. If only one of these both is installed, ISPConfig will do the necessary configuration automatically.)
We can make PHP5 work in nginx through
PHP-FPM (PHP-FPM (FastCGI Process Manager) is an alternative PHP FastCGI implementation with some additional features useful for sites of any size, especially busier sites) which we install as follows:
PHP-FPM is a daemon process (with the init script
/etc/init.d/php5-fpm) that runs a FastCGI server on port
9000.
To get MySQL support in PHP, we can install the
php5-mysql package. It's a good idea to install some other PHP5 modules as well as you might need them for your applications. You can search for available PHP5 modules like this:
Pick the ones you need and install them like this:
apt-get install php5-mysql php5-curl php5-gd php5-intl php-pear php5-imagick php5-imap php5-mcrypt php5-memcache php5-ming php5-ps php5-pspell php5-recode php5-snmp php5-sqlite php5-tidy php5-xmlrpc php5-xsl
APC is a free and open PHP opcode cacher for caching and optimizing PHP intermediate code. It's similar to other PHP opcode cachers, such as eAccelerator and XCache. It is strongly recommended to have one of these installed to speed up your PHP page.
APC can be installed as follows:
apt-get install php-apc
Now restart PHP-FPM:
/etc/init.d/php5-fpm restart
To get CGI support in nginx, we install Fcgiwrap.
Fcgiwrap is a CGI wrapper that should work also for complex CGI scripts and can be used for shared hosting environments because it allows each vhost to use its own
cgi-bin directory.
Install the
fcgiwrap package:
After the installation, the
fcgiwrap daemon should already be started; its socket is
/var/run/fcgiwrap.socket. If it is not running, you can use the
/etc/init.d/fcgiwrap script to start it.
That's it! Now when you create an nginx vhost, ISPConfig will take care of the correct vhost configuration.
14.1 Install phpMyAdmin.
Install phpMyAdmin as follows:
apt-get install phpmyadmin
You will see the following questions:
Web server to reconfigure automatically: <-- select none (because only apache2 and lighttpd are available as options)
Configure database for phpmyadmin with dbconfig-common? <-- No
You can now find phpMyAdmin in the
/usr/share/phpmyadmin/ directory.
After you have installed ISPConfig 3, you can access phpMyAdmin as follows:
The ISPConfig apps vhost on port 8081 for nginx comes with a phpMyAdmin configuration, so you can use
http://server1.example.com:8081/phpmyadmin or
http://server1.example.com:8081/phpMyAdmin to access phpMyAdmin.
If you want to use a
/phpmyadmin or
/phpMyAdmin alias that you can use from your web sites, this is a bit more complicated than for Apache because nginx does not have global aliases (i.e., aliases that can be defined for all vhosts). Therefore you have to define these aliases for
each vhost from which you want to access phpMyAdmin.
To do this, paste the following into the
nginx Directives field on the
Options tab of the web site in ISPConfig:
location /phpmyadmin {
root /usr/share/;
index index.php index.html index.htm;
location ~ ^/phpmyadmin/(.+\.php)$ {
try_files $uri =404;
root /usr/share/;
fastcgi_pass 127.0.0.1:9000;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $request_filename;
include /etc/nginx/fastcgi_params;
fastcgi_param PATH_INFO $fastcgi_script_name;
fastcgi_buffer_size 128k;
fastcgi_buffers 256 4k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
fastcgi_intercept_errors on;
}
location ~* ^/phpmyadmin/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
root /usr/share/;
}
}
location /phpMyAdmin {
rewrite ^/* /phpmyadmin last;
} |
If you use http
s instead of http for your vhost, you should add the line
fastcgi_param HTTPS on; to your phpMyAdmin configuration like this:
location /phpmyadmin {
root /usr/share/;
index index.php index.html index.htm;
location ~ ^/phpmyadmin/(.+\.php)$ {
try_files $uri =404;
root /usr/share/;
fastcgi_pass 127.0.0.1:9000;
fastcgi_param HTTPS on; # <-- add this line
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $request_filename;
include /etc/nginx/fastcgi_params;
fastcgi_param PATH_INFO $fastcgi_script_name;
fastcgi_buffer_size 128k;
fastcgi_buffers 256 4k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
fastcgi_intercept_errors on;
}
location ~* ^/phpmyadmin/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
root /usr/share/;
}
}
location /phpMyAdmin {
rewrite ^/* /phpmyadmin last;
} |
If you use both http and https for your vhost, you need to add the following section to the
http {} section in
/etc/nginx/nginx.conf (before any include lines) which determines if the visitor uses http or https and sets the
$fastcgi_https variable (which we will use in our phpMyAdmin configuration) accordingly:
vi /etc/nginx/nginx.conf
[...]
http {
[...]
## Detect when HTTPS is used
map $scheme $fastcgi_https {
default off;
https on;
}
[...]
}
[...] |
Don't forget to reload nginx afterwards:
/etc/init.d/nginx reload
Then go to the
nginx Directives field again, and instead of
fastcgi_param HTTPS on; you add the line
fastcgi_param HTTPS $fastcgi_https; so that you can use phpMyAdmin for both http and https requests:
location /phpmyadmin {
root /usr/share/;
index index.php index.html index.htm;
location ~ ^/phpmyadmin/(.+\.php)$ {
try_files $uri =404;
root /usr/share/;
fastcgi_pass 127.0.0.1:9000;
fastcgi_param HTTPS $fastcgi_https; # <-- add this line
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $request_filename;
include /etc/nginx/fastcgi_params;
fastcgi_param PATH_INFO $fastcgi_script_name;
fastcgi_buffer_size 128k;
fastcgi_buffers 256 4k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;
fastcgi_intercept_errors on;
}
location ~* ^/phpmyadmin/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
root /usr/share/;
}
}
location /phpMyAdmin {
rewrite ^/* /phpmyadmin last;
} |
15 Install Mailman
Since version 3.0.4, ISPConfig also allows you to manage (create/modify/delete) Mailman mailing lists. If you want to make use of this feature, install Mailman as follows:
apt-get install mailman
Before we can start Mailman, a first mailing list called
mailman must be created:
newlist mailman
root@server1:~# newlist mailman
Enter the email of the person running the list: <-- admin email address, e.g. info@example.com
Initial mailman password: <-- admin password for the mailman list
To finish creating your mailing list, you must edit your /etc/aliases (or
equivalent) file by adding the following lines, and possibly running the
`newaliases' program:
## mailman mailing list
mailman: "|/var/lib/mailman/mail/mailman post mailman"
mailman-admin: "|/var/lib/mailman/mail/mailman admin mailman"
mailman-bounces: "|/var/lib/mailman/mail/mailman bounces mailman"
mailman-confirm: "|/var/lib/mailman/mail/mailman confirm mailman"
mailman-join: "|/var/lib/mailman/mail/mailman join mailman"
mailman-leave: "|/var/lib/mailman/mail/mailman leave mailman"
mailman-owner: "|/var/lib/mailman/mail/mailman owner mailman"
mailman-request: "|/var/lib/mailman/mail/mailman request mailman"
mailman-subscribe: "|/var/lib/mailman/mail/mailman subscribe mailman"
mailman-unsubscribe: "|/var/lib/mailman/mail/mailman unsubscribe mailman"
Hit enter to notify mailman owner... <-- ENTER
root@server1:~#
Open
/etc/aliases afterwards...
vi /etc/aliases
... and add the following lines:
[...]
mailman: "|/var/lib/mailman/mail/mailman post mailman"
mailman-admin: "|/var/lib/mailman/mail/mailman admin mailman"
mailman-bounces: "|/var/lib/mailman/mail/mailman bounces mailman"
mailman-confirm: "|/var/lib/mailman/mail/mailman confirm mailman"
mailman-join: "|/var/lib/mailman/mail/mailman join mailman"
mailman-leave: "|/var/lib/mailman/mail/mailman leave mailman"
mailman-owner: "|/var/lib/mailman/mail/mailman owner mailman"
mailman-request: "|/var/lib/mailman/mail/mailman request mailman"
mailman-subscribe: "|/var/lib/mailman/mail/mailman subscribe mailman"
mailman-unsubscribe: "|/var/lib/mailman/mail/mailman unsubscribe mailman" |
Run
newaliases
afterwards and restart Postfix:
/etc/init.d/postfix restart
Then start the Mailman daemon:
/etc/init.d/mailman start
After you have installed ISPConfig 3, you can access Mailman as follows:
The ISPConfig apps vhost on port 8081 for nginx comes with a Mailman configuration, so you can use
http://server1.example.com:8081/cgi-bin/mailman/admin/<listname> or
http://server1.example.com:8081/cgi-bin/mailman/listinfo/<listname> to access Mailman.
If you want to use Mailman from your web sites, this is a bit more complicated than for Apache because nginx does not have global aliases (i.e., aliases that can be defined for all vhosts). Therefore you have to define these aliases for
each vhost from which you want to access Mailman.
To do this, paste the following into the
nginx Directives field on the
Options tab of the web site in ISPConfig:
location /cgi-bin/mailman {
root /usr/lib/;
fastcgi_split_path_info (^/cgi-bin/mailman/[^/]*)(.*)$;
include /etc/nginx/fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
fastcgi_intercept_errors on;
fastcgi_pass unix:/var/run/fcgiwrap.socket;
}
location /images/mailman {
alias /usr/share/images/mailman;
}
location /pipermail {
alias /var/lib/mailman/archives/public;
autoindex on;
} |
This defines the alias
/cgi-bin/mailman/ for your vhost, which means you can access the Mailman admin interface for a list at
http://<vhost>/cgi-bin/mailman/admin/<listname>, and the web page for users of a mailing list can be found at
http://<vhost>/cgi-bin/mailman/listinfo/<listname>.
Under
http://<vhost>/pipermail you can find the mailing list archives.
If you liked this article, subscribe to the feed by clicking the image below to keep informed about new contents of the blog:
Ferdinand Thommes has announced the release of siduction 11.1, a desktop-oriented distribution and live CD/DVD based on Debian's "unstable" branch, recently forked from aptosid: "We are excited to present to you, after last week's release candidate, the first final release of siduction, a new distribution based on our great mother Debian's 'Unstable' branch and forked from aptosid. This first release ships three desktop environments - KDE SC, Xfce and LXDE, all three in 32-bit and 64-bit editions.
Arne Exton has announced the release of 
ABINIT
Posts
