Instructions to set up a basic LAMP+SSH server environment

bash shell script patch database apache iostat ssh web-server lamp lamp-server knockd mysql php

23 KiB

Raw Blame History

Linux servers - Exercice 7

Disclaimer:

This exercise is a part of Linux Server Administration (ICT4TN021, spring 2018) // Linux-palvelimet (ICT4TN021, kevät 2018) school course organized as a part of Information Technology studies in Haaga-Helia university of Applied Sciences, Helsinki, Finland. Course lecturer Tero Karvinen has defined the original assignment descriptions in Finnish presented in this document in English. Answers and translations have been written by Pekka Helenius (me, ~ Fincer).

a) Solve a previously published final major test of this school course (You can find them with DuckDuckGo or Google).

Answer:

Let's pick up our previous major test ict4tn021-1 autumn 2016.

Initial set-up for remote control of a server

Issue: Prepare to control the server from abroad. Secure the server with firewall

We shall install SSH server daemon to the targeted server computer. It is assumed that local or other direct access to the server command line is available since SSH server daemon is not yet installed, thus preventing direct, remote SSH control of the server.

Once having access to the server command line, we shall test that the computer can reach the internet. Test the following commands:

ifconfig
ping www.duckduckgo.com
ip -br link show

Command explanations:

ifconfig = Has IP address determined to a network interface on the server?
ping = Does a site respond to ICMP requests?
ip = Is the network interface, which should have connection to the internet, up and active (UP)?

When the internet connection is established, we shall proceed by installing the following packages, assuming that the server uses a Debian-based Linux distribution: openssh-server, openssh-sftp-server, openssh-client

On some distributions, those packages can be installed simply issuing:

sudo apt-get update
sudo apt-get -y install ssh

We shall confirm that the SSH server daemon starts during the server boot-up. We shall also confirm that the SSH server daemon is up and running and its status is active:

sudo systemctl enable ssh.service
systemctl is-active ssh.service

NOTE: Alternative commands can also be used, like:

sudo systemctl enable sshd
systemctl status sshd

Has our firewall program installed on the system?

which ufw
which iptables

If both of those executable files ('ufw' and 'iptables') are found on the system, we shall accept network traffic to port 22, protocol TCP (INPUT 22/TCP). Let's apply these rules to our firewall:

sudo ufw allow 22/tcp

Make sure our firewall program ufw (Uncomplicated Firewall) is enabled and turned on:

sudo ufw enable
sudo systemctl enable ufw.service

NOTE: By default, Linux firewall blocks all input traffic. Therefore, SSH input traffic must separately be allowed like described above.

Security set-up for a company

Issue: Install remotely working security tools for our company. (In this assignment, you can assume that installing a package or packages from our repository is secure)

The following commands have been pre-determined in the assignment:

download .deb package file with wget command
install the downloaded .deb package with command sudo dpkg -i which extract a new repository file terorep.list into /etc/apt/sources.list.d/)
update package databases with command sudo apt-get update
install package terowatch which is made available by the new repository. The package is available for Ubuntu distribution, version 16.04 LTS. The repository file terorep.list itself contains string deb http://terokarvinen.com/qrs/terorep/ precise main

NOTE: terowatch package uses network interface eth0 by default. However, we haven't defined such interface in our system configuration (this can be fixed by adding net.ifnames=0 in udev rules or in kernel boot parameters in Syslinux or GRUB2). Instead, we use default network interface enp4s0.

Proper fix to this issue would be patching the code and applying the patch into the deb package. Another solution would be making the proper fix directly to the source code. In this assignment, we directly modify the executable file, written in Python. This method is not recommended but for the extent of this assignment, it is sufficient solution to proceed.

dpkg -L terowatch
sudo sed -i 's/eth0/enp4s0/g' /usr/bin/qrsc

Command terowatch gives desired text output “TeroWatch is installed” (the string is defined in shell executable /usr/bin/terowatch)

System statistics

Issue: Collect workload statistics of various system resources (CPU, RAM) while doing the assignment. The data collection must be started before proceeding in the assignment. Write a short analysis of the collected statistics after you've finished other parts of the assignment.

We shall install sysstat:

sudo apt-get update && sudo apt-get -y install sysstat

Let's run sar command with 2 second interval for undefined time period. Print output of the command to file $HOME/sysstat.file

sar 2 -o $HOME/sysstat.file

The file can be analysed afterwards with sar command in the end of the assignment.

Short analysis, based on the picture above:

CPU (command: sar 10 -f $HOME/sysstat.file): CPU has been in moderate workload. User processes have not depleted resources that much, in contrast to system processes which stress the CPU many times more. 'iowait' value tells us that the processor has waited for mass memory device. During the data collection, some data was transferred from a hard disk to another. CPU capacity limits were not reached.
Mem/RAM (command: sar -r 10 -f $HOME/sysstat.file): Memory consumption has been significant during the data collection period (%memused and %commit). The system has 4GB DDR3 memory of which majority has been in use. Amount of free memory has been 100MB. Two main operations have affected the memory usage level: web browser usage and file transfer/copy operations which were performed during the data collection period. Active memory was used 2.5GB on average, passive (inactive) memory usage was 700MB. Amount of memory which has waited for to be written varies between 5MB-200MB (kbdirty).

PHP from abroad

Issue: Install us necessary tools for remote PHP website development.

SSH server daemon has already been installed, port 22 is opened -> OK
We shall install HTTP daemon (Apache web server) and open the default port 80 for it in our firewall. Additionally, we shall install necessary PHP (7.0) packages:

sudo apt-get update && sudo apt-get -y install apache2 php7.0 libapache2-mod-php7.0 && sudo ufw allow 80/tcp

Let's enable Apache server daemon, check the status of it (must be active) and tell the system that Apache should automatically be started during the server boot-up:

systemctl is-active apache2
sudo systemctl enable apache2

Let's check that the port 80 is opened in our firewall:

xubuntu@xubuntu:/home$ sudo ufw status
Status: active
To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
22/tcp (v6)                ALLOW       Anywhere (v6)
80/tcp (v6)                ALLOW       Anywhere (v6)

(you don't need to execute command sudo systemctl start apache2 after the Apache installation because the Apache web server daemon is automatically enabled during the server boot-up by default. This information can be found with command systemctl status apache2)

We shall enable Apache's PHP module while using module userdir. This can be done by commenting the lines between <IfModule mod_userdir.c> tags in file /etc/apache2/mods-available/php7.0.conf. Right after we should enable Apache's 'userdir' module and restart the Apache web server:

sudo a2enmod userdir
sudo systemctl restart apache2.service

Let's check that Apache web server is still up and running by issuing command systemctl status apache2.service. Let's check that we can access our default localhost website (IP address 127.0.0.1) which indicates whether the Apache server works as intended:

xdg-open http://localhost

'xdg-open' command definition:

[12/03/2018 22:31:11 - fincer: ~ ]$ whatis xdg-open
xdg-open (1)         - opens a file or URL in the user's preferred application

We must check that we can access our website from a remote network. In a test laboratory, this test would be done checking output of command ifconfig, looking for a relevant IP address and login to the server from another computer using the grabbed IP address and SSH client program (command syntax using default SSH port 22 would be: ssh server-user@server-ip). In order to access the server from a remote network, the relevant IP address for connecting the server must be known, and confirmation for succeeded remote access must exist. Any router & NAT/PAT configurations between a client and the server must work.

Issue: Our users are as follows: Maija Mehilälinen, Peter Ö, Oskar Jäärä, John Do, Verner Vrij, Mikko Möttönen, Jalmari Ähkä, Håkan Swarz and Maija Maitoparta. Create a sample website for each user with PHP.

Issue: List all user accounts and passwords in file lab.txt (/home/*/lab.txt). Protect the file so that other users can not read it.

We shall generate all required passwords (9 for users + admin) with pwgen. Password length is 20 characters, randomized, at least one uppercase character included and secure parameter for the command is used:

sudo apt-get update && sudo apt-get install pwgen
pwgen 20 10 -sc1

We shall store additional admin password into a separate, secure place (of your choice). Admin account (or user) username is admin.

We haven't created admin user admin yet. Let's do it. We shall also grant sudo group permissions to this new administration user:

sudo adduser admin
sudo usermod -aG sudo admin
su admin

The last command su admin switched our shell view to admin shell. We should lock the server root account by issuing command sudo usermod --lock root (which adds an exclamation mark right before root's password in file /etc/shadow). We could increase system's overall security by blocking usage of various TTY sessions (commenting out lines in file /etc/securetty) and by adding more restrictions to the system's PAM policy.

For securing our SSH connections, we shall add the following line in /etc/ssh/sshd_config file (use sudoedit /etc/ssh/sshd_config or sudo nano /etc/ssh/sshd_config command):

PermitRootLogin no

After having altered /etc/ssh/sshd_config, restart SSH server daemon by issuing command

sudo systemctl restart sshd

Create file $HOME/lab.txt (where $HOME is /home/admin) with the following contents:

mmehilal    RWjM8r2fyq8gQq3wnzq0        # Maija Mehilälinen
po          a5B60cmTyrwPLS2mJ9uQ        # Peter Ö
ojaara      P1KkLl0XaV5JpqntxdJG        # Oskar Jäärä
jdo         ZgMb5TrU4Ee3bT48eCff        # John Do
vvrij       RWjM8r2fyq8gQq3wnzq0        # Verner Vrij
mmottone    GpuyZqp2pGsmPINJPO1h        # Mikko Möttönen
jahka       nFTellIyRjwiC0YKtPwq        # Jalmari Ähkä
hswarz      u5qfJCC2jZMGQPWwPZLV        # Håkan Swarz
mmaitopa    OCeBmKYWWgFIXubdFc6j        # Maija Maitoparta

Restrict permissions for this file by issuing the following command (as user admin):

chmod og-rwx,u-x $HOME/lab.txt

Output:

admin@xubuntu:~$ ls -l lab.txt
-rw------- 1 admin admin 407 Mar 12 11:42 lab.txt

Let's create a generic, pretty simple PHP file index.php into the home directory of admin (and as admin).

nano /home/admin/index.php

Add the following contents:

<?php
phpinfo();
?>

NOTE: Make sure you have enabled php & userdir modules on Apache at this point!

After that, we shall copy the PHP file for each user into a user-specific subdirectory public_html (/home/*/public_html).

The user-specific directory public_html and contents of it should have correct permissions set up for each user.

On Debian-based Linux distributions, a perl script 'adduser' is provided for creating new users. Let's do the following:

1. Create required user accounts with the generated passwords
1. Copy the pre-created index.php file into each user's $HOME/public_html folder
1. For each user, test that their index.php is showing expected and correct output

Run the following with any system user who belongs to sudo group:

sudo apt-get update && \
sudo apt-get -y install curl && \
for user in mmehilal po ojaara jdo vvrij mmottone jahka hswarz mmaitopa; do \
echo -e "User is: $user\n" && \
sudo adduser $user && \
sudo mkdir -p /home/$user/public_html/ && \
sudo cp /home/admin/index.php /home/$user/public_html/ && \
sudo chown -R $user:$user /home/$user && \
[[ $(curl -s http://localhost/~${user}/index.php | grep -i "404 not found" | wc -l) -ne 0 ]] && \
echo -e "\nPHP test site not found for '${user}'\n" || \
echo -e "\nPHP test site is OK for user\n"; \
done

NOTE: To test site on a graphical web browser, you need to keep in mind that user xubuntu is the only user having access to graphical display on X server right now (see .Xauthority and environment variable DISPLAY for details). Thus, the following commands should be used in our current setup:

sudo passwd xubuntu
su xubuntu
for user in mmehilal po ojaara jdo vvrij mmottone jahka hswarz mmaitopa; do xdg-open http://localhost/~${user}; done

NOTE: We can exit the shell view of the user admin simply issuing command exit on that shell view.

NOTE: Consider the following in a production environment, instead of doing nasty things with administration users:

You can (but don't have to) modify the current user, grant administration rights, modify username, home directory and groups (usermod command) instead of adding a separate account for an administrator
You can create a new main/admin user and remove an old one (in our case, we should delete xubuntu account). You can delete users with command sudo userdel <account>.
You can have clearly restricted and well named groups to separate users with various permissions on a system. Apply your user and group policy so that specific users belong to the right groups.
Check usage of various environment variables in your shell view

Screenshot of user-specific PHP sites on the configured server environment:

Checking permissions for each index.php files & public_html directories:

for user in mmehilal po ojaara jdo vvrij mmottone jahka hswarz mmaitopa; do ls -lR /home/$user | sed '/total [0-9]/d'; done

Output:

/home/mmehilal:
drwxr-xr-x 2 mmehilal mmehilal 60 Mar 12 11:50 public_html
/home/mmehilal/public_html:
-rw-r--r-- 1 mmehilal mmehilal 20 Mar 12 12:00 index.php
/home/po:
drwxr-xr-x 2 po po 60 Mar 12 12:00 public_html
/home/po/public_html:
-rw-r--r-- 1 po po 20 Mar 12 12:00 index.php
/home/ojaara:
drwxr-xr-x 2 ojaara ojaara 60 Mar 12 12:01 public_html
/home/ojaara/public_html:
-rw-r--r-- 1 ojaara ojaara 20 Mar 12 12:01 index.php
/home/jdo:
drwxr-xr-x 2 jdo jdo 60 Mar 12 12:01 public_html
/home/jdo/public_html:
-rw-r--r-- 1 jdo jdo 20 Mar 12 12:01 index.php
/home/vvrij:
drwxr-xr-x 2 vvrij vvrij 60 Mar 12 12:01 public_html
/home/vvrij/public_html:
-rw-r--r-- 1 vvrij vvrij 20 Mar 12 12:01 index.php
/home/mmottone:
drwxr-xr-x 2 mmottone mmottone 60 Mar 12 12:01 public_html
/home/mmottone/public_html:
-rw-r--r-- 1 mmottone mmottone 20 Mar 12 12:01 index.php
/home/jahka:
drwxr-xr-x 2 jahka jahka 60 Mar 12 12:02 public_html
/home/jahka/public_html:
-rw-r--r-- 1 jahka jahka 20 Mar 12 12:02 index.php
/home/hswarz:
drwxr-xr-x 2 hswarz hswarz 60 Mar 12 12:02 public_html
/home/hswarz/public_html:
-rw-r--r-- 1 hswarz hswarz 20 Mar 12 12:02 index.php
/home/mmaitopa:
drwxr-xr-x 2 mmaitopa mmaitopa 60 Mar 12 12:02 public_html
/home/mmaitopa/public_html:
-rw-r--r-- 1 mmaitopa mmaitopa 20 Mar 12 12:02 index.php

iot12tools - IoT tools for users

Issue: Install and configure metapackage iot12tools for us. The metapackage should install the following development tools for 'Internet of Things': arduino IDE, gedit (text editor), gedit-plugins, curl (CLI browser) and Python 3 programming language.

Run the following commands as admin:

sudo apt-get update && sudo apt-get -y install equivs
mkdir ~/iot12tools
cd ~/iot12tools
equivs-control iot12tools

Edit contents of file io12tools to look like the following:

### Commented entries have reasonable defaults.
### Uncomment to edit them.
Section: misc
Priority: optional
Standards-Version: 3.9.2
Package: iot12tools
Version: 0.1
Maintainer: Pekka Helenius <fincer89@hotmail.com>
Depends: arduino, gedit, gedit-plugins, curl, python3
Architecture: all
Description: A meta package which provides basic IoT development tools
Installs Gedit text editor, Gedit plugins, Arduino IDE and Python 3

Run the following command in directory ~/iot12tools:

equivs-build iot12tools

Install the generated metapackage (which installs required packages for us):

sudo apt install -f ./iot12tools_0.1_all.deb

Hello Python 3

Issue: Jalmari wants to develop in Python 3. Create a simple Python 3 file in his home root directory. The file should print output 'Hello World'.

Install necessary python3 packages as the user admin:

sudo apt-get update && sudo apt-get install -y python3

Switch your shell view to user jahka (Jalmari Ähkä) and go to his home directory:

su jahka
cd

NOTE: We can make sure that we are in his home directory (/home/jahka) by issuing command 'pwd'.

Let's create a new file ~/helloworld.py with the following contents:

#!/usr/bin/env python3
print("Hello World");

Modify file permissions, grant executable permission for the user jahka, remove from others (including the group who owns the file):

chmod u+x,og-x helloworld.py

The file permissions are now:

-rwxrw-r-- 1 jahka jahka 47 Mar 12 12:59 helloworld.py

Test the code:

jahka@xubuntu:~$ python3 ~/helloworld.py 
Hello World

The output is as desired, Hello World, indicating that we have successfully installed Python3 development environment for the required user.

c) (optional) Use Linux outside the course scope.

Answer:

The following pictures demonstrate Arch Linux ARM running on my Raspberry Pi 1 Model B. The solution is quite rushed but it works technically:

Display: Lilliput 869GL
SDHC card: Transcend 16GB
HDD: 750GB in Icy Box IB-3640SU3 hard disk external case.
Desktop environment: LxQt

About my Linux usage

My first touch to Linux world was back in early spring, 2011. The first Linux distribution I installed was Ubuntu 10.04 LTS, and after that I have tried out many distributions, including Linux Mint, Fedora, OpenSUSE and Arch Linux.

The first computer I ever had a Linux installation was Asus Eee PC 1215N mini laptop. My primary operating system on that laptop was EasyPeasy, a variant of Ubuntu 10.04 LTS which uses Gnome 2 desktop environment and additional customization package 'ubuntu-netbook-launcher' (known as Linux Netbook Remix), predecessor of Canonical's Unity desktop.

After the Asus Eee PC 1215N broke, I moved to Asus N56JR laptop for which I installed Linux Mint with Cinnamon desktop environment at first. Soon after I moved to Arch Linux where I used Cinnamon desktop for a short while, as well. I moved quickly from Cinnamon to KDE desktop because I Cinnamon desktop had mysterious and unacceptable freeze events on my personal use.

Why did I choose KDE desktop over multiple alternatives, such as XFCE, LXDE, Mate, Gnome 3, Budgie, Pantheon or LxQt? I consider several things when choosing a desktop environment: stability, long-term development history, suitability for efficient multitasking and configuration possibilities (source code + GUI + conf files). I have been happy Arch Linux + KDE desktop user for many years - and I still am. Of course, I have tested various other desktop environments but always returned to KDE.

In general, I have multiple Linux distributions, MS Windows 7 and Android on Virtual Machines for various purposes.

More or less, I have participated in various open source project and done Windows software testing on Wine. I like to create scripts for daily usage, mainly to automate routine-like, boring tasks and processes. One of my key interests have been in digital image processing and raw image analysis, for which both Linux suits very well, offering a solid, adaptable and cost-effective platform. I set up my first LAMP server several years back from now on my Raspberry Pi 1 Model B.

23 KiB Raw Blame History