Changes between Version 3 and Version 4 of configure_new_server


Ignore:
Timestamp:
Aug 23, 2007, 1:48:05 AM (17 years ago)
Author:
Jamie McClelland
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • configure_new_server

    v3 v4  
    33== Purchase an ssl certificate ==
    44
    5 Generate a private key and certificate signing request.
     5 * Generate a private key and certificate signing request.
    66
    77{{{
    … …  
    1010}}}
    1111
    12 Change the domain@mayfirst.org email alias to point to your address.
    13 
    14 Go to Dotster (which is a thawte reseller) for server.mayfirst.org (from Dotster home page click Other Products -> ssl, get the 123 certificate)
    15 
    16 This will take a day or so to be generated.
    17 
    18 Once generated, login to Dotster using the mayfirst username. Click on My Services. You should see the new ssl Cert listed.
    19 
    20 Click Manage services.
    21 
    22 Copy the CRT into a file called:
    23 
    24 server.mayfirst.org.pem
    25 
    26 (replace server with the name of the server being setup)
    27 
    28 then add dh paramaters with:
     12 * Change the domain@mayfirst.org email alias to point to your address.
     13
     14 * Go to Dotster (which is a thawte reseller) for server.mayfirst.org (from Dotster home page click Other Products -> ssl, get the 123 certificate). This will take a day or so to be generated.
     15
     16 * Once generated, login to Dotster using the mayfirst username. Click on My Services. You should see the new ssl Cert listed.
     17 
     18 * Click Manage services.
     19
     20 * Copy the CRT into a file called: server.mayfirst.org.pem (replace server with the name of the server being setup)
     21
     22 * Then add dh paramaters with:
    2923
    3024{{{
    … …  
    3226}}}
    3327
    34 This file will be used by courier
    35 
    36 Now, put each one in a separate file called:
    37 
    38 server.mayfirst.org.key
    39 
    40 server.mayfirst.org.crt
    41 
    42 These will be used by apache
     28 This file will be used by courier
     29
     30 * Now, put each one in a separate file called: server.mayfirst.org.key and server.mayfirst.org.crt (these will be used by apache)
    4331
    4432== Use volatile for SA and clamav ==
    45 
    4633
    4734 * Edit /etc/apt/sources.list. Add the following:
    … …  
    6249}}}
    6350
    64 
    6551== Install debian packages ==
    6652
    6753{{{
    68 $ sudo apt-get install apache2 libapache2-mod-suphp cvs amavisd-new clamav clamav-daemon spamassassin maildrop courier-imap-ssl courier-pop-ssl scponly logcheck logcheck-database cron-apt awstats razor libnet-dns-perl dcc-client phpmyadmin php5-mysql php5-imap php5-gd mysql-server-5.0 mysql-client-5.0 squirrelmail php-mail php-db fail2ban aspell aspell-en aspell-es php5-mcrypt php-auth iproute  bzip2
    69 }}}
    70 
    71 Now, install php-pear and php-log. You must install these before installing imp4 or else imp4 will try to pull in un-needed php4 packages.
    72 
    73 {{{
    74 sudo apt-get install php-pear php-log
    75 }}}
    76 
    77 And now, imp4:
    78 
    79 {{{
    80 sudo apt-get install imp4 turba2 ingo1
    81 }}}
    82 
    83 Add the pear file package so that Turba (address book) can import address books. First try apt - but don't do it if it still tries to pull in php4 (which it is trying as of April 11, 2007)
    84 
    85 {{{
    86 sudo apt-get install php-file
    87 }}}
    88 
    89 If it is trying to pull in php4, then install it via pear:
    90 
    91 {{{
    92 sudo pear install -o File
     54$ sudo apt-get install apache2 libapache2-mod-suphp cvs amavisd-new clamav clamav-daemon spamassassin maildrop courier-imap-ssl courier-pop-ssl scponly logcheck logcheck-database cron-apt awstats razor libnet-dns-perl dcc-client phpmyadmin php5-mysql php5-imap php5-gd mysql-server-5.0 mysql-client-5.0 squirrelmail php-mail php-db fail2ban aspell aspell-en aspell-es php5-mcrypt php-auth iproute  bzip2 imagemagick php-pear php-log imp4 turba2 ingol php-file
    9355}}}
    9456
    … …  
    9759In order to route traffic directly from computer to computer (across different subnetworks) we need to add the different routes
    9860
    99 Create a file called add-he-routes with the following contents:
     61 * Create a file called add-he-routes with the following contents:
    10062
    10163{{{
    … …  
    10668#ip route add 209.51.163.192/28 dev eth0
    10769ip route add 209.51.180.16/28 dev eth0
    108 }}}
    109 
    110 Comment out the line representing the network this server is on
    111 
    112 Save the file in /etc/network/if-up.d
    113 chmod it to 755
    114 
    115 And add a corresponding file:
    116 
    117 {{{
    118 
     70ip route add 209.51.163.0/27 dev eth0
     71}}}
     72
     73 * Comment out the line representing the network this server is on
     74
     75 * Save the file in /etc/network/if-up.d and chmod it to 755
     76
     77 * And add a corresponding file:
     78
     79{{{
    11980#!/bin/bash
    12081# remove routes for alternate blocks in rack
    … …  
    12384ip route del 209.51.163.192/28
    12485#ip route del 209.51.180.16/28
    125 }}}
    126 
    127 Save the file in /etc/network/if-down.d
    128 chmod it to 755
     86ip route del 209.51.163.0/27
     87}}}
     88
     89 * Save the file in /etc/network/if-down.d and chmod it to 755
    12990
    13091== Configure suPHP ==
    … …  
    272233== Install Red ==
    273234
    274 
    275  * Edit /etc/apt/sources.list - make sure non-free is there, e.g.:
    276 deb http://http.us.debian.org/debian stable main contrib non-free. If you are adding anything to this line, run sudo apt-get update afterwards.
     235 * Edit /etc/apt/sources.list - make sure non-free is there, e.g.: deb !http://http.us.debian.org/debian stable main contrib non-free. If you are adding anything to this line, run sudo apt-get update afterwards.
    277236{{{
    278237$ sudo apt-get install ucspi-tcp-src
    … …  
    290249 * Download the source from cvs
    291250
    292 copy and paste the following commands
     251 * Copy and paste the following commands
    293252
    294253{{{
    … …  
    307266}}}
    308267
    309 this last one, in case you are interested, copies all the files that end in .sample in this directory to files that strip the .sample part out.
    310 
    311268 * Edit the file called pinky. Change ip address to machine's real ip address. also edit red_server.conf, to add the database user and password.
     269
    312270 * Launch pinky with:
    313271{{{
    … …  
    317275
    318276== Postfix setup ==
    319 
    320 
    321277
    322278 * Create aliases in /etc/aliases
    … …  
    328284}}}
    329285
    330 Don't forget to run newaliases!
    331 
    332  * Create empty access, virtual_alias_maps and virtual_alias_domains files in
    333 /etc/postfix
     286 * Don't forget to run newaliases!
     287
     288 * Create empty access, virtual_alias_maps and virtual_alias_domains files in /etc/postfix
    334289
    335290{{{
    … …  
    375330 * Copy the /etc/postfix/master.cf file from chavez to get the amavis settings.
    376331
    377 
    378332 * Postfix as secure mail relay setup
    379333
    … …  
    383337}}}
    384338
    385  * Configure sasl
    386 {{{
    387 sudo vim /etc/default/saslauthd
    388 }}}
    389 
     339 * Configure sasl. Edit /etc/default/saslauthd
     340{{{
    390341Uncomment START = yes
    391342Change MECHANISMS to read:
    392343MECHANISMS ="shadow"
     344}}}
    393345
    394346 * Add postfix to the sasl group
    … …  
    436388}}}
    437389
    438 
    439390== Setup Postgrey ==
    440391
    … …  
    458409}}}
    459410
    460 
    461 check_policy_service inet:127.0.0.1:60000
    462 
    463411== Setup Courier ==
    464 
    465412
    466413 * Create a shared/index file that is empty (to avoid getting error messages in the log)
    … …  
    476423
    477424== Setup amavis ==
    478 
    479 
    480425
    481426 * Edit /etc/amavis/conf.d/50-user
    … …  
    494439
    495440 * Add AllowSupplementaryGroups to /etc/clamav/clamd.conf
     441
    496442 * Add a cron job to clean out viruses and spam collected by amavis in /etc/cron.d called clean-up-virus with the contents:
     443{{{
    497444# Find and delete all emails older than 14 days
    4984452 4 * * *       amavis  find /var/lib/amavis/virusmails -mtime +14  -exec rm '{}' \;
    499 
    500 
     446}}}
    501447
    502448== Configure Spamassassin ==
    503449
    504 
    505450 * Install helper packages
    506451{{{
    … …  
    510455 * Add a new rule for spamassassin (debian etch or above only!)
    511456
    512 <ul>
    513457 * Create /usr/local/share/spamassassin/plugins
    514458{{{
    … …  
    535479
    536480 * Turn on subject munging (uncomment line in /etc/spamassassin/local.cf)
    537  * Add temporary work around to get spamassassin to properly tag messages sent to us via tls by adding this line to /etc/spamassassin/local.cf:
     481
     482 * Add temporary work around to get spamassassin to properly tag messages sent to us via tls by adding this line to /etc/spamassassin/local.cf (change hostname, see http://wiki.apache.org/spamassassin/DynablockIssues):
    538483{{{
    539484header LOCAL_AUTH_RCVD    Received =~ /\(using TLS.*\) by chavez\.mayfirst\.org /
    540485score LOCAL_AUTH_RCVD -20
    541486}}}
    542 (edit the host name)
    543 See: http://wiki.apache.org/spamassassin/DynablockIssues
    544  * Turn off report safe (in /etc/spamassassin/local.cf set: report_safe 0
     487
     488 * Turn off report safe (in /etc/spamassassin/local.cf set: report_safe 0)
     489
    545490 * Edit /etc/default/spamassassin - enable spamassassin
     491
    546492 * Setup sa-update
    547493{{{
    … …  
    558504}}}
    559505
    560 
    561 
    562506== Maildrop ==
    563507
    … …  
    572516== Webmail setup ==
    573517
    574 
    575 
    576518 * Symlink the squirrelmail apache conf file:
    577519
    … …  
    584526Redirect /webmail https://servername.mayfirst.org/horde3
    585527}}}
     528
    586529 * Copy the various /etc/horde/*/conf.conf files from chavez
     530
    587531 * Edit /etc/horde/imp4/servers.php (see chavez for details)
     532
    588533 * Run sudo /etc/squirrelmail/conf.pl
    589534
    590535 * Change 1: organizational preferences (org name, provider link, provider name)
     536
    591537 * Change 2: server settings: A IMAP Settings (port: 993, secure imap: true,
    592538server software: courier
    593  * Plugins: install: delete_move_next,squirrelspell,
    594 filters,abook_take,listcommands,mail_fetch,gpg (you will need to download
     539
     540 * Plugins: install: delete_move_next,squirrelspell, filters,abook_take,listcommands,mail_fetch,gpg (you will need to download
    595541this one from www.squirrelmail.org into the /usr/share/squirrelmail/plugins
    596542
    597543 * Gunzip/usr/share/doc/horde3/examples/scripts/sql/create.mysql.sql.gz into your home directory
     544
    598545 * Edit - change the password to a good password
    599  * Import into mysql
    600  * Directly import /usr/share/doc/turba2/examples/scripts/sql/turba_objects.mysql.sql with:
     546
     547 * Import into mysql: Directly import /usr/share/doc/turba2/examples/scripts/sql/turba_objects.mysql.sql with:
     548
    601549{{{
    602550mysql -u root -p horde <  /usr/share/doc/turba2/examples/scripts/sql/turba_objects.mysql.sql
    603551}}}
    604552
    605 
    606553== Install Drupal ==
    607554
    608 
    609555 * Download from drupal.org into: /usr/local/share/
    610556
    … …  
    613559 * Create a soft link to the version (i.e. sudo ln -s drupal-4.7.3 drupal-4.7)
    614560
    615  * Tar up and copy all the files from wiwa /usr/local/share/drupal-modules-4.7
    616 and place into the /usr/local/share/drupal-modules-4.7 on the target server.
    617 
    618 
     561 * Tar up and copy all the files from wiwa /usr/local/share/drupal-modules-4.7 and place into the /usr/local/share/drupal-modules-4.7 on the target server.
    619562
    620563== Configure Apache ==
    621564
    622 
    623 
    624565 * In /etc/apache2/site-available/default change NameVirtualHost * to: NameVirtualHost *:80
    625566
    626567 * Change:
     568{{{
    627569<VirtualHost *> to: <VirtualHost *:80>
    628570ServerAdmin apache@mayfirst.org
    629571DocumentRoot /srv/apache/web (create this directory and index.html file)
    630 
     572}}}
    631573
    632574== Configure logrotate ==
    … …  
    655597
    656598Copy from Wiwa to the server:
     599{{{
    657600/etc/logcheck/logcheck.conf
    658601/etc/logcheck/ignore.d.server/local-*
     602}}}
    659603
    660604== Configure cron-apt ==
    661605
    662606Edit /etc/cron-apt
     607{{{
    663608Change line MAILON to MAILON ="upgrade"
     609}}}
    664610
    665611== Configure Awstats ==
    666 
    667612
    668613 * Copy /etc/awstats/awstats.conf.local from chavez to the target server's /etc/awstats directory
    … …  
    672617 * Copy /usr/share/doc/awstats/examples/apache.conf to /etc/apache2/conf.d/awstats
    673618
    674 
    675619== Configure Mutt ==
    676620