| commit | author | age | ||
| d58e21 | 1 | #!/bin/sh |
| T | 2 | # |
| 3 | # rev 0.6 | |
| 4 | # | |
| 5 | # dxr@brutalsec.net | |
| 6 | # 01-09-2009 | |
| 7 | # | |
| d7ef36 | 8 | # We can create a script for configure chroot environment but, |
| d58e21 | 9 | # YOU MUST UNDERSTAND HOW TO WORK IT for can solve possible |
| T | 10 | # problems in the future. |
| 35c101 | 11 | # |
| d7ef36 | 12 | # Every service has its own chroot environment: |
| d58e21 | 13 | # BIND -> chroot |
| T | 14 | # Apache -> chroot |
| 15 | # Dovecot -> chroot | |
| 16 | # Pureftpd -> Apache's chroot | |
| 17 | # | |
| 18 | # Only apache and php packages aren't installed in real system, | |
| d7ef36 | 19 | # only in chroot environment with symbolic links from real system. |
| d58e21 | 20 | # |
| T | 21 | # PLEASE, CONFIGURE CHROOT ENVIROMENT IF SECURITY IS REALLY |
| 22 | # IMPORTANT FOR YOU AND YOU KNOWN HOW TO WORK IT! | |
| 23 | # | |
| 35c101 | 24 | |
| d58e21 | 25 | exit 1 |
| 35c101 | 26 | |
| d7ef36 | 27 | 1. BACKUP before changing anything on the system |
| d58e21 | 28 | 2. Create partitions |
| d7ef36 | 29 | 3. Remove possible Apache or PHP installations on real system |
| J | 30 | 4. Prepare Chroot environment |
| d58e21 | 31 | 5. Linking Webserver aplication from real system |
| T | 32 | 6. mini_sendmail |
| 33 | 7. Test services | |
| 34 | 8. Howto install ispconfig3 | |
| 35 | 9. Migration | |
| 35c101 | 36 | |
| T | 37 | |
| d7ef36 | 38 | 1. BACKUP before changing anything on the system |
| J | 39 | # If is not a new installation, then |
| 35c101 | 40 | |
| d58e21 | 41 | BACKUP BACKUP BACKUP BACKUP BACKUP BACKUP |
| T | 42 | BACKUP BACKUP BACKUP BACKUP BACKUP BACKUP |
| 43 | BACKUP BACKUP BACKUP BACKUP BACKUP BACKUP | |
| 44 | BACKUP BACKUP BACKUP BACKUP BACKUP BACKUP | |
| 35c101 | 45 | |
| T | 46 | |
| d58e21 | 47 | 2. Create partitions |
| T | 48 | |
| 49 | /var/www/ Chroot partition (ext3) | |
| 50 | /var/www/html/ Chroot system | |
| 51 | /var/www/html/var/log/apache2 Log partition (ext3) | |
| 52 | /var/www/html/var/www/html Webs partition (xfs) | |
| 53 | /var/www/html/tmp Temporal dir (tmpfs, options: ) | |
| 54 | ||
| 55 | /dev/lvm_foobar1/chroot_lv -> /var/www/ (ext3) | |
| 56 | /dev/lvm_foobar2/apachelogs_lv -> /var/www/html/var/log/apache2 (ext3) | |
| 57 | /dev/lvm_foobar3/hosting_lv -> /var/www/html/var/www/html (xfs) | |
| 58 | ||
| 59 | mount /dev/lvm_foobar1/chroot_lv /var/www/ | |
| 60 | mkdir -p /var/www/html/var/log/apache2 /var/www/html/var/www/html | |
| 61 | mount /dev/lvm_foobar2/apachelogs_lv /var/www/html/var/log/apache2 | |
| 62 | mount /dev/lvm_foobar3/hosting_lv /var/www/html/var/www/html | |
| 63 | ||
| 64 | ||
| d7ef36 | 65 | 3. Remove possible Apache or PHP installations on real system |
| J | 66 | # We never wont install apache or php in non-chroot system, if we have installed, we only have do a backup of configurations, uninstall, and check every symbolic link |
| d58e21 | 67 | dpkg -l|egrep --color -i 'apache|php' |
| T | 68 | |
| 69 | ||
| d7ef36 | 70 | 4. Prepare Chroot environment |
| d58e21 | 71 | |
| T | 72 | # Install packages in real system |
| 73 | apt-get install debootstrap libpcre3 libaprutil1 libxml2 mime-support patch make gcc mysql-server subversion ssh openssh-server ntp ntpdate vim libdbd-mysql libdbi-perl dnsutils | |
| 74 | # The non webserver will install outside of chroot | |
| 75 | apt-get install postfix postfix-mysql postfix-doc mysql-client openssl getmail4 rkhunter amavisd-new spamassassin clamav clamav-daemon zoo unzip bzip2 arj nomarch lzop cabextract apt-listchanges libnet-ldap-perl libauthen-sasl-perl clamav-docs daemon libio-string-perl libio-socket-ssl-perl libnet-ident-perl zip libnet-dns-perl pure-ftpd-common pure-ftpd-mysql quota quotatool | |
| 76 | # If you will use courier: | |
| 77 | apt-get install courier-authdaemon courier-authlib-mysql courier-pop courier-pop-ssl courier-imap courier-imap-ssl libsasl2-2 libsasl2-modules libsasl2-modules-sql sasl2-bin libpam-mysql courier-maildrop | |
| 78 | # If you will use dovecot: | |
| 79 | #apt-get install dovecot-imapd dovecot-pop3d | |
| 80 | # If you will use BIND: | |
| 81 | apt-get install bind9 bind9utils | |
| 82 | ||
| 83 | # | |
| 84 | # If we want execute php from real system (crontabs for example) we need install php dependencies in real system: | |
| 85 | # libgd2-xpm libt1-5 libmagick10 libc-client2007b libmcrypt4 | |
| 86 | # cat /var/log/ispconfig/cron.log | |
| 87 | # ldd /usr/lib/php5/20060613/mcrypt.so | |
| 88 | # | |
| 89 | ||
| 90 | time debootstrap --arch=amd64 lenny /var/www/html/ ftp://ftp.fr.debian.org/debian/ | |
| 91 | ||
| 92 | echo "/proc /var/www/html/proc proc defaults 0 0">>/etc/fstab | |
| 93 | echo "devpts /var/www/html/dev/pts devpts defaults 0 0">>/etc/fstab | |
| 35c101 | 94 | |
| T | 95 | mount -a |
| 96 | ||
| d58e21 | 97 | # We must create sshusers group |
| T | 98 | echo "@sshusers - chroot /var/www/html/">>/etc/security/limits.conf |
| 35c101 | 99 | |
| d58e21 | 100 | chroot /var/www/html apt-get update |
| T | 101 | chroot /var/www/html apt-get install fakeroot --force-yes -y |
| 102 | chroot /var/www/html apt-get install locales | |
| 103 | chroot /var/www/html dpkg-reconfigure locales | |
| 35c101 | 104 | |
| d58e21 | 105 | mv /usr/lib/apache2 /usr/lib/apache2_old |
| T | 106 | mv /var/log/apache2 /var/log/apache2_old |
| 107 | mv /var/lock/apache2 /var/lock/apache2_old | |
| 108 | mv /var/lib/apache2 /var/lib/apache2_old | |
| 109 | mv /usr/lib/php5 /usr/lib/php5_old | |
| 110 | mv /etc/apache2 /etc/apache2_old | |
| 111 | mv /etc/suphp /etc/suphp_old | |
| 35c101 | 112 | |
| d58e21 | 113 | chroot /var/www/html apt-get install apache2 apache2.2-common apache2-doc apache2-mpm-prefork apache2-utils libexpat1 ssl-cert libapache2-mod-php5 php5 php5-common php5-gd php5-mysql php5-imap phpmyadmin php5-cli php5-cgi libapache2-mod-fcgid apache2-suexec php-pear php-auth php5-mcrypt mcrypt php5-imagick imagemagick libapache2-mod-suphp libopenssl-ruby libapache2-mod-chroot php-apc libtimedate-perl |
| 35c101 | 114 | |
| d58e21 | 115 | chroot /var/www/html /etc/init.d/apache2 stop |
| 35c101 | 116 | |
| d58e21 | 117 | chroot /var/www/html a2enmod mod_chroot |
| T | 118 | chroot /var/www/html a2enmod suexec |
| 119 | echo "ChrootDir /var/www/html" > /var/www/html/etc/apache2/conf.d/mod_chroot.conf | |
| 120 | sed -i -e 's#DocumentRoot /var/www/#DocumentRoot /var/www/html/#' /var/www/html/etc/apache2/sites-enabled/000-default | |
| 121 | sed -i -e 's#x-httpd-php=php:/usr/bin/php-cgi#x-httpd-php=php:/usr/bin/php-cgi\nx-httpd-suphp=php:/usr/bin/php-cgi\nx-httpd-php=php:/usr/bin/php-cgi#' /var/www/html/etc/suphp/suphp.conf | |
| 122 | sed -i -e 's#/var/run/apache2.pid#/var/run/apache2/apache2.pid#' /var/www/html/etc/apache2/envvars | |
| 123 | sed -i -e 's/^"syntax on/syntax on/' /etc/vim/vimrc | |
| 124 | sed -i -e 's/^"syntax on/syntax on/' /var/www/html/etc/vim/vimrc | |
| 35c101 | 125 | |
| d58e21 | 126 | # Protect apache configuration. ONLY root can read it |
| T | 127 | chown root:root /var/www/html/etc/apache2/ && chmod 700 /var/www/html/etc/apache2/ |
| 128 | chmod 711 /var/www/html/etc/php5/ | |
| 35c101 | 129 | |
| T | 130 | |
| d7ef36 | 131 | 5. # Is good idea to add Nagios alarm for check every symbolic link is correct. |
| d58e21 | 132 | ln -s /var/www/html/etc/apache2 /etc/apache2 |
| T | 133 | ln -s /var/www/html/etc/suphp /etc/suphp |
| 134 | ln -s /var/www/html/var/run/apache2 /var/run/apache2 | |
| 135 | ln -s /var/www/html/var/run/apache2.pid /var/run/apache2.pid | |
| 136 | ln -s /var/www/html/usr/sbin/apache2ctl /usr/sbin/apache2ctl | |
| 137 | ln -s /var/www/html/usr/sbin/apache2 /usr/sbin/apache2 | |
| 138 | ln -s /var/www/html/usr/lib/apache2 /usr/lib/apache2 | |
| 139 | ln -s /var/www/html/usr/sbin/a2enmod /usr/sbin/a2enmod | |
| 140 | ln -s /var/www/html/usr/sbin/a2dismod /usr/sbin/a2dismod | |
| 141 | ln -s /var/www/html/usr/sbin/a2ensite /usr/sbin/a2ensite | |
| 142 | ln -s /var/www/html/usr/sbin/a2dissite /usr/sbin/a2dissite | |
| 143 | ln -s /var/www/html/var/log/apache2 /var/log/apache2 | |
| 144 | ln -s /var/www/html/var/lock/apache2 /var/lock/apache2 | |
| 145 | ln -s /var/www/html/var/lib/apache2 /var/lib/apache2 | |
| 146 | ln -s /var/www/html/usr/lib/php5 /usr/lib/php5 | |
| 147 | ln -s /var/www/html/etc/init.d/apache2 /etc/init.d/apache2 | |
| 148 | # Neccessary for to install ispconfig3 from real system: | |
| 149 | ln -s /var/www/html/usr/bin/php5 /usr/bin/php5 | |
| 150 | ln -s /var/www/html/etc/alternatives/php /etc/alternatives/php | |
| 151 | ln -s /var/www/html/usr/bin/php /usr/bin/php | |
| 152 | ln -s /var/www/html/etc/php5 /etc/php5 | |
| 35c101 | 153 | |
| d58e21 | 154 | 6. # Install mini_sendmail for chroot |
| T | 155 | # We can use mini_sendmail for delivery emails directy in remote servers, but i prefer to control it in central mailserver for check spammers and limit it. |
| 35c101 | 156 | |
| T | 157 | cd /tmp/ |
| d58e21 | 158 | wget http://acme.com/software/mini_sendmail/mini_sendmail-1.3.6.tar.gz |
| T | 159 | tar xzf mini_sendmail-1.3.6.tar.gz |
| 160 | wget http://users1.leipzig.freifunk.net/%7Efirmware-build/brcm_2_4_Broadcom_default/build/openwrt_packages/mail/mini_sendmail/patches/200-fullname.patch | |
| 161 | patch -p0 < 200-fullname.patch | |
| 162 | cd mini_sendmail-1.3.6 | |
| 163 | make | |
| 164 | # 2e555b2573c3ea65a467a5960f0b51f6 mini_sendmail | |
| 165 | mv /var/www/html/usr/lib/sendmail /var/www/html/usr/lib/sendmail_old | |
| 166 | mv /var/www/html/usr/sbin/sendmail /var/www/html/usr/sbin/sendmail_old | |
| 167 | cp mini_sendmail /var/www/html/usr/sbin/mini_sendmail | |
| 168 | cd /var/www/html/usr/lib/ && ln -s ../sbin/mini_sendmail sendmail | |
| 169 | cd /var/www/html/usr/sbin && ln -s mini_sendmail sendmail | |
| 35c101 | 170 | |
| d58e21 | 171 | # ./mini_sendmail -h |
| T | 172 | # usage: ./mini_sendmail [-f<name>] [-t] [-s<server>] [-p<port>] [-T<timeout>] [-v] [address ...] |
| 35c101 | 173 | |
| d58e21 | 174 | #add to php.ini (/var/www/html/etc/php5/apache2/php.ini /var/www2/etc/php5/cli/php.ini /var/www2/etc/php5/cgi/php.ini line :672) |
| T | 175 | # sendmail_path = /usr/sbin/mini_sendmail -t -i -fhosting@alojamientotecnico.com -s127.0.0.1 |
| 35c101 | 176 | |
| d58e21 | 177 | sed -i -e 's#^;sendmail_path =$#sendmail_path = /usr/sbin/mini_sendmail -t -i -fhosting@alojamientotecnico.com -s127.0.0.1#' /var/www/html/etc/php5/apache2/php.ini /var/www/html/etc/php5/cli/php.ini /var/www/html/etc/php5/cgi/php.ini |
| 35c101 | 178 | |
| T | 179 | |
| d58e21 | 180 | 7. |
| T | 181 | # Test |
| 182 | apache2ctl restart | |
| 183 | ||
| 184 | # php -i|grep --color sendmail | |
| 185 | #sendmail_from => no value => no value | |
| 186 | #sendmail_path => /usr/sbin/mini_sendmail -t -i -fhosting@alojamientotecnico.com -s127.0.0.1 => /usr/sbin/mini_sendmail -t -i -fhosting@alojamientotecnico.com -s127.0.0.1 | |
| 187 | #Path to sendmail => /usr/sbin/mini_sendmail -t -i -fhosting@alojamientotecnico.com -s127.0.0.1 | |
| 188 | ||
| 189 | # Sould be good idea check /var/www/html/usr/lib/sendmail /var/www/html/usr/sbin/sendmail and /var/www/html/usr/sbin/mini_sendmail with nagios alarm ;) | |
| 190 | ||
| 191 | ||
| 192 | 8. Install ispconfig ........ | |
| 193 | ||
| 194 | cd /tmp/ | |
| 195 | svn co svn://svn.ispconfig.org/ispconfig3 svn.ispconfig.org | |
| 196 | ||
| 197 | mv /usr/local/ispconfig /var/www/html/usr/local/ | |
| 198 | ln -s /var/www/html/usr/local/ispconfig /usr/local/ispconfig | |
| 199 | mv /var/www/apps /var/www/html/var/www/ | |
| 200 | mv /var/www/php-fcgi-scripts /var/www/html/var/www/ | |
| 201 | mv /var/www/ispconfig /var/www/html/var/www/ | |
| 202 | ln -s /var/www/html//var/www/ispconfig /var/www/ispconfig | |
| 203 | ln -s /var/www/html/var/www/php-fcgi-scripts /var/www/php-fcgi-scripts | |
| 204 | ln -s /var/www/html/var/www/apps /var/www/apps | |
| 205 | # After copy, we must clean unnecessary users and groups | |
| 206 | cp -r /etc/{passwd,group,apt} /var/www/html/etc/ | |
| 207 | apache2ctl stop | |
| 208 | apache2ctl start | |
| 209 | ||
| 210 | ||
| 211 | ### Migration to other server ### | |
| 212 | Really easy: | |
| 213 | ||
| 214 | Do step 1 | |
| 215 | ||
| 216 | And after do a simple rsync: | |
| 217 | ||
| 218 | screen | |
| 219 | time rsync -a --progress root@host1:/var/www/ /var/www/ | |
| 220 | ||
| 221 | # Install some apache's dependencies | |
| 222 | apt-get install debootstrap libpcre3 libaprutil1 libxml2 mime-support | |
| 223 | ||
| 224 | Do step 5 | |
| 225 | Do step 6 | |
| 35c101 | 226 | |
