Multiple Apache 2 instances configuration in Centos7

Multiple Apache 2 instances  configuration in Centos7::
===============================================

Multiple apache instances run on the same server  under different user accounts and ports

Here for example we can install apache  for the user 'linuxgeek1'  with common group 'apache'.

For more instances add more users and repeat the same steps below:

# yum install gcc

Creating the users and group::
groupadd apache
useradd -g apache -m -d /home/linuxgeek1 linuxgeek1
useradd -g apache -m -d /home/linuxgeek2 linuxgeek2

Installing apache  for first user:

Login as  linuxgeek1
# su - linuxgeek1

Download Apache latest version, under home directory  /home/linuxgeek1

# wget  http://redrockdigimark.com/apachemirror//httpd/httpd-2.4.25.tar.gz
# tar -zxvf   httpd-2.4.25.tar.gz

untar the source file as  /home/linuxgeek1/httpd-2.4.25

The dependencies  during the installation are as follows::

Download the dependencies under /home/linuxgeek1/httpd-2.4.25/srclib/ and untar it  there before apache compilation

It will appear as
 /home/linuxgeek1/httpd-2.4.25/srclib/  # ll

 drwxr-xr-x. 28  linuxgeek1 apache 4096 Jan 18 14:00 apr
drwxr-xr-x.  20  linuxgeek1 apache 4096 Jan 18 14:00 apr-util
-rw-r--r--.      1   linuxgeek1 apache 357 Jan 18 14:00 Makefile
-rw-r--r--.      1   linuxgeek1 apache   121 Feb 11  2005 Makefile.in
drwxr-xr-x.   9   linuxgeek1 apache 8192 Jan 18 09:39 pcre

 ================
apr-devel
# ./configure --prefix=/home/linuxgeek1/httpd-2.4.25/srclib/apr/

apr-util-devel
#  ./configure --with-apr=/home/linuxgeek1/httpd-2.4.25/srclib/apr/

pcre-8.4.0

=================

Now go to /home/linuxgeek1/httpd-2.4.25


# ./configure --prefix=/home/linuxgeek1/httpd/ --enable-ssl --enable-so --with-included-apr=/home/linuxgeek1/httpd-2.4.25/srclib/apr/ --with-included-apr-util=/home/linuxgeek1/httpd-2.4.25/srclib/apr-util/ --with-pcre=/home/linuxgeek1/httpd-2.4.25/srclib/pcre/pcre-config   --with-mod_jk --enable-mpms-shared=all

# make
# make install

Once installation is done edit httpd.conf  to change the apache port.

change it as follows::
Listen 192.168.1.1:8010

Restart apache

Try it from browser as  http://192.168.1.1:8010

Repeat the same steps for different users using different ports.

Connect Mysql/Mariadb/Postgresql with Jboss 7 Application Server in Centos 7

Connect Mysql/Mariadb/Postgresql with Jboss 7 Application Server::
-------------------------------------------------------------------------------------------

Mysql and Mariadb datasource Connectivity with Jboss:

Please check the previous threads in the blog for Mysql/Mariadb/Postgres and Jboss Installations. Assuming  you have the above installations done, go ahead with the connectivity as follows::


Download the mysql-java connector "mysql-connector-java-5.1.30.zip"  from the url dev.mysql.com/downloads/connector/j/

# unzip mysql-connector-java-5.1.30.zip for the jar file
We will find "mysql-connector-java-5.1.30-bin.jar"

Create Jboss Module for mysql datasource directory as follows::

# mkdir /usr/share/jboss-as-7.1.1.Final/mysql/main/  -p

Copy jar file to the above directory

# cp /root/Downloads/mysql-connector-java-5.1.30/mysql-connector-java-5.1.30-bin.jar  /usr/share/jboss-as-7.1.1.Final/mysql/main/

will update shortly!!!!!!!!!!!

Install JBoss 7.* in Centos 7::

Install JBoss 7.* in Centos 7::
======================

Install java first
# yum install java

Check the version of java installed
# java -version
java version "1.7.0_111"
OpenJDK Runtime Environment (rhel-2.6.7.2.el7_2-x86_64 u111-b01)
OpenJDK 64-Bit Server VM (build 24.111-b01, mixed mode)

Download JBOSS AS 7
# screen  
# wget http://download.jboss.org/jbossas/7.1/jboss-as-7.1.1.Final/jboss-as-7.1.1.Final.zip

Unzip the zip file under /usr/share/
# unzip jboss-as-7.1.1.Final.zip -d /usr/share

Create a system user
# adduser jboss

Change ownership of the installation directory
# chown -fR jboss.jboss /usr/share/jboss-as-7.1.1.Final/

Switch user to the create user
# su jboss

Change to the bin directory
# cd /usr/share/jboss-as-7.1.1.Final/bin/

Create JBOSS Management users using the script (We can create as many users needed)
# ./add-user.sh

Start JBOSS server using the command
# ./standalone.sh -Djboss.bind.address=0.0.0.0 -Djboss.bind.address.management=0.0.0.0&

 Try accessing the JBOSS console in the browser::
http://localhost:9990/console/index.html

To stop the server  use the command::
./jboss-cli.sh --connect command=:shutdown

If you have issues in logging in with the user created. Follow the steps:

Open jboss-as-x.x.x.Final\standalone\configuration\mgmt-users.properties and delete the user ( delete the line which has the username you want to use, such as admin,etc)

Run jboss-as-x.x.x.Final\bin\add-user.sh to create new user as follows

    select user type a
    Realm (ManagementRealm) : ManagementRealm
    Username : linuxgeeknotes
    Password : password
    Re-enter Password : password

Postgres Installation in Centos 7 and configuration

Postgres Installation and Commands for system admins::

----------------------------------------------------------------------------------------------

 Postgressql installation is very easy and it completes in a single command

# yum install postgresql-server postgresql-contrib


Once the installtion is completed we can create a new PostgreSQL database cluster

# postgresql-setup initdb


Open the Host based authentication configuration file and edit the lines as follows::

# vi /var/lib/pgsql/data/pg_hba.conf

   
host all all 127.0.0.1/32 md5

host all all ::1/128 md5

# systemctl start postgresql

# systemctl enable postgresql

The installation procedure created a user account called postgres that is associated with the default Postgres role. In order to use Postgres, we'll need to log into that account as follows:

# sudo -i -u postgres 

You can get a Postgres prompt immediately by typing:

# psql

Exit out of the PostgreSQL prompt by typing:

    \q

Currently configured user roles can be seen using the command:

# \du

Version of PostgreSQL installed:

# SELECT version();
                                                   version                                                   
--------------------------------------------------------------------------------------------------------------
 PostgreSQL 9.2.15 on x86_64-redhat-linux-gnu, compiled by gcc (GCC) 4.8.5 20150623 (Red Hat 4.8.5-4), 64-bit
(1 row)



Command to see the  list of databases by running:

# psql -l

Some simple POSTGRESQL Commands

createuser --interactive --- to create user interactively
createuser test               --- creates user test
createdb test                  --- creates database test
      

-bash-4.2$ psql -d test  --- connects to database test
psql (9.2.15)
Type "help" for help.

test=# \conninfo           --- checks the database connection information
 
You are connected to database "test" as user "postgres" via socket in "/var/run/postgresql" at port "5432".
test=#

To connect to a Postgresql server remotely follow the steps. If you want to connect from a particular network, add the following entry in the postgresql.conf and pg_bha.conf(Host based authentication configuration file )

# vi  /var/lib/pgsql/data/pg_hba.conf
host    all         all         192.168.101.20/24    trust

# grep listen /var/lib/pgsql/data/postgresql.conf
listen_addresses = '*'


Once the entries are added and the service restarted, you should be able to connect to postgresql server remotely as follows::

# psql -U postgres -h 192.168.102.1
Welcome to psql 8.1.11 (server 8.4.18), the PostgreSQL interactive terminal.postgres=#

Default port of postgresql is 5432. If you want to change the port for postgresql edit the postgresql.conf file as follows::

# port = 5432  to port = 6969

Firewall entries to allow connections to the database 

# sudo firewall-cmd --permanent --zone=trusted --add-source=<Client IP address>/32

# sudo firewall-cmd --permanent --zone=trusted --add-port=5432/tcp

# sudo firewall-cmd --reload

Creating password for the postgres user

bash-4.2$ psql
psql (9.4.4)
Type "help" for help.

postgres=# \password
Enter new password:
Enter it again:
postgres=# \q

Command to login remotely to the database server as follows::

$ psql -h <Server IP Address> -p 5432 -U postgres -W
Password for user postgres:
psql (9.2.15)
Type "help" for help.

SSL Certificate installation in Apache and Nginx

SSL Certificate installation in Apache and Nginx::
=====================================

First step is to generate the CSR(Certificate Signing Request) for the domain

Apache Server SSL setup ::
------------------------------------

# openssl req -new -newkey rsa:2048 -nodes -keyout linuxgeeknotes_com.key -out linuxgeeknotes_com.csr

This will create two files

1. linuxgeeknotes_com.csr

2. linuxgeeknotes_com.key

Now contact the certificate provider with the csr file generated and they will verify the details provided and generate the cert file and CA bundle.

For apache webserver, we need to add the SSL certificate entries in the configuration files as follows::

<VirtualHost 192.168.0.1:443>
DocumentRoot /var/www/html2
ServerName www.linuxgeeknotes.com
SSLEngine on
SSLCertificateFile /path/to/linuxgeeknotes.crt
SSLCertificateKeyFile /path/to/linuxgeeknotes.key
SSLCertificateChainFile /path/to/linuxgeeknotes.crt
</VirtualHost>

Restart the service.



Nginx Server SSL Setup::
----------------------------------

# openssl req -new -newkey rsa:2048 -nodes -keyout linuxgeeknotes_com.key -out linuxgeeknotes_com.csr

This will create two files

1. linuxgeeknotes_com.csr

2. linuxgeeknotes_com.key

Now contact the certificate provider with the csr file generated and purchase the cert files. Concatenate the files to a single file named ssl-bundle.crt using the command as follows::

# cat www_linuxgeeknotes_com.crt DomainValidationSecureServerCA.crt AddTrustCA.crt AddTrustExternalCARoot.crt > ssl-bundle.crt


Add the SSL entries in the  configuration file as follows and restart the service::

server
{
listen 443;
ssl on;
ssl_certificate /etc/nginx/ssl/linuxgeeknotes_com/ssl-bundle.crt;
ssl_certificate_key /etc/nginx/ssl/linuxgeeknotes_com/linuxgeeknotes_com.key;

# side note: only use TLS since SSLv2 and SSLv3 have had recent vulnerabilities ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # ...
}

Apache vs Nginx Webservers

Apache vs Nginx Webservers::
====================

>> If you need a high speed webserver to host a single website, NGINX is the best choice because it can handle much higher load of concurrent connections while using less resources. And if you are looking for a shared hosting, to host multiple websites on a shared web server, Apache webserver is more flexible.

>> Nginx is event driven and Apache is process driven

>> Nginx support newer frameworks, such as Node.js, Python/Django and also support  CGI/FastCGI  and alternative such as WSGI

>> Apache is best for traditional MySQL/PHP applications, such as WordPress or Drupal and in shared hosting to host many websites with different configurations per site through  .htaccess file

>> Apache has a variety of different modules, add-ons, and components and very well documented.

 As a server admin you can google and decide which one is best  for the client requirement. At the end of the day, the choice of the web server platform is entirely dependent on what you’re doing with the server.

Mail Server Setup to avoid SPAM/JUNK

Mail Server Setup to avoid SPAM/JUNK::

===============================

Make sure to setup rDNS,SPF,DKIM authentications on your mail server to avoid being marked as spam

1. rDNS setup

2. SPF 

SPF and SenderID allow a domain owner to add a file or record on the server that the recipient server cross-checks.

v=spf1 include:spf.linuxgeeknotes.com ?all

3. DKIM Authentication

DKIM and DomainKeys embed information within the email, making it harder to forge (but they can also be harder to implement for senders and receivers).

We can make the setups in the mail server dns zone file

Exim mail server configuration on Centos 7

What is Exim?

Exim is a mail transfer agent (MTA) used on Unix-like operating systems. Exim is free software distributed under the terms of the GNU General Public License, and it aims to be a general and flexible mailer with extensive facilities for checking incoming e-mail.

What is Dovecot?

Dovecot is an open source IMAP and POP3 email server for Linux/UNIX-like systems, written with security primarily in mind. Dovecot is an excellent choice for both small and large installations.



UPDATE THE SYSTEM

First off, ssh to your server and initiate a screen session using the command below:

## screen -U -S exim-dovecot
once you’re in a screen session, update your CentOS 7 VPS using yum as in:

## yum update


ENABLE EPEL REPOSITORY

Enable EPEL repository on the CentOS system using:

## yum install http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-2.noarch.rpm
if you get a 404 not found, go at http://dl.fedoraproject.org/pub/epel/7/x86_64/e/ and install the latest epel-release rpm package available.

check if EPEL has been enabled on your system using:

## yum repolist
once EPEL is enabled, install some useful tools using:

## yum install file perl-Mail-SPF.noarch openssl vim


GENERATE SSL CERTIFICATE

Since we are going to use SSL in Dovecot and Exim, we need to have an SSL certificate. You can purchase and use one of our GeoTrust SSL Certificates or you can create your own self-signed SSL certificate for mail.mydomain.com using the commands below:

## mkdir /root/SSL/mail.mydomain.com -p
## cd /root/SSL/mail.mydomain.com
## openssl req -nodes -x509 -newkey rsa:2048 -keyout mail.mydomain.com.key -out mail.mydomain.com.crt -days 365
Move the SSL certificate and key to /etc/ssl using:

## cp mail.mydomain.com.key mail.mydomain.com.crt /etc/ssl/


INSTALL AND CONFIGURE EXIM

Install exim on the CentOS 7 virtual server using yum:

## yum install exim
next, open /etc/exim/exim.conf with your favorite editor and configure exim as follows:

## cp /etc/exim/exim.conf{,.orig}
## vim /etc/exim/exim.conf

primary_hostname = mail.mydomain.com
domainlist local_domains = @ : mydomain.com

tls_advertise_hosts = *
tls_certificate = /etc/ssl/mail.mydomain.com.crt
tls_privatekey = /etc/ssl/mail.mydomain.com.key

auth_advertise_hosts = *
find the transport section and edit the following:

local_delivery:
  driver = appendfile
  directory = $home/Maildir
  maildir_format
  maildir_use_size_file
  delivery_date_add
  envelope_to_add
  return_path_add
scroll down the the authenticators section and add the following lines:

dovecot_login:
  driver = dovecot
  public_name = LOGIN
  server_socket = /var/run/dovecot/auth-client
  server_set_id = $auth1

dovecot_plain:
  driver = dovecot
  public_name = PLAIN
  server_socket = /var/run/dovecot/auth-client
  server_set_id = $auth1
Start the EXIM MTA and add it to system’s startup using systemctl

## systemctl start exim
## systemctl status exim
## systemctl enable exim


Exim Commands::
==============
Email Count
exim -bpc

Email queue details
exim -bp

Email header details
exim -Mvh ID

Email body details
exim -Mvb ID

Email log details
exim -Mvl ID

Email count with sender details
exim -bpr|grep "<"|awk {'print $4'}|cut -d"<" -f2|cut -d">" -f1|sort -n|uniq -c|sort -n

Count of emails sent from a sender
exiqgrep -f sendername|grep "<"|wc -l

Count of emails sent to a particular email
exiqgrep -f recipient|grep "<"|wc -l

Delete mails from a particular sender
exim -bpr| grep sendername| awk '{print $3}'|xargs exim -Mrm

List of frozen mails
exim -bp|grep frozen|wc -l

Delete frozen mails
exim -bp|grep frozen|awk {'print $3'}|xargs exim -Mrm

Summary of emails in the queue
exim -bp|exiqsumm

Display what exim is doing now
exiwhat


INSTALL AND CONFIGURE DOVECOT
===============================
Install Dovecot on the system using yum

## yum install dovecot
Once installed, configure SSL in Dovecot by editing the following:

## vim /etc/dovecot/conf.d/10-ssl.conf

ssl = yes
ssl_cert = </etc/ssl/mail.mydomain.com.crt
ssl_key = </etc/ssl/mail.mydomain.com.key
next, allow plaintext authentication in /etc/dovecot/conf.d/10-auth.conf:

## vim /etc/dovecot/conf.d/10-auth.conf

disable_plaintext_auth = no
auth_mechanisms = plain login
configure mailbox location and type in /etc/dovecot/conf.d/10-mail.conf:

## vim /etc/dovecot/conf.d/10-mail.conf

mail_location = maildir:~/Maildir
Set-up Dovecot so that is allows Exim to use its authentication system in /etc/dovecot/conf.d/10-master.conf

## vim /etc/dovecot/conf.d/10-master.conf

service auth {
...
    unix_listener auth-client {
        mode = 0660
        user = exim
    }
}
Start Dovecot and add it to system’s start-up using:

## systemctl start dovecot
## systemctl status dovecot
## systemctl enable dovecot


CREATE SYSTEM USER

## useradd -m test
## passwd test

ffmpeg installation

ffmpeg installation::
==============

If you just want to install ffmpeg without php extension

Goto ffmpeginstaller.com

Download the autoinstaller
run ./install.sh.

It should work fine.

Mysql/Mariadb installation in fedora 24

Mysql/Mariadb installation in fedora 24::
============================
Mysql project is owned by Oracle now. Mysql and Mariadb are the widely used in web applications like joomla, wordpress, magento etc

In fedora we use dnf instead of yum. dnf is the future version of yum. Please follow the steps below

# dnf -y update
# dnf -y install mysql-server mysql
# systemctl start mariadb
# systemctl enable mariadb
# systemctl status mariadb
# mysql

 Latest server version is 10.1.16 mariadb

Mysql tweaks::
===========

>> Mysql performs better in ext4 and xfs filesystem. Please check if you are using older file system versions.

>> Mysql performs better if the database is stored on a separate drive/partition. Make sure mysql database have a separate drive/partition if your server is a shared server.
# mount /dev/sdb1   /mysql/
# ln -s  /mysql/mysql  /var/lib/mysql

>> Check for sleep process
# mysqladmin processlist grep “Sleep”
set time out for sleep process in my.cnf so that it won't  take memory anymore
wait_timeout=60

>> Optimization of databases
# mysqlcheck -u root -p --auto-repair --check --optimize --all-databases
# mysqlcheck -u root -p --auto-repair --check --optimize databasename


>> Turn of reverse DNS lookup of clients and set max connections appropriately in my.cnf
skip-name-resolve
global max_connections := 300;

>> Use different tools like mysqltuner for performance tuning. You can try this by downloading from the below url::
https://github.com/search?utf8=%E2%9C%93&q=mysqltuner

LDAP configuration in centos 7

ldap set in centos 7::

===============

My virtual servers  with IP's as follows::

Server IP : 192.168.1.1

Client IP : 192.168.1.2

Please follow the steps below as follows in server and client for ldap configuration.

Server Configuration on 192.168.1.1

==========================

# yum -y install *openldap* migrationtools

# slappasswd

New password:

Re-enter new password:{SSHA}Gks7qu7ndsmwopjsfgbwr4b452b2b1n2K91T5rwt9ns0dfg
olcRootDN: cn=Manager,dc=linuxgeeknotes,dc=in

Ldap configutaion files are located at  /etc/openldap/slapd.d/

Edit the file as follows::

# vi /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif

olcSuffix: dc=linuxgeeknotes,dc=in

olcRootDN: cn=Manager,dc=linuxgeeknotes,dc=in

olcRootPW: {SSHA}bHSiwuPJEypHS6zHSE2Uy7M69sQjmkPL
olcTLSCertificateFile: /etc/certs/linuxgeeknotescert.pem
olcTLSCertificateKeyFile: /etc/certs/linuxgeeknoteskey.pem

Now edit the file 
# vi /etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif
Edit the line starting with "olcAccess"
dn.base="cn=Manager,dc=linuxgeeknotes,dc=in" read by * none

Check the configuration using the command
# slaptest -u
# systemctl start slapd

# systemctl enable slapd

Configuring ldap database

# cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
# chown -R ldap:ldap /var/lib/ldap/

Generate ldap certificate
# openssl req -new -x509 -nodes -out /etc/certs/linuxgeeknotescert.pem -keyout /etc/certs/linuxgeeknoteskey.pem -days 365

Create  object in ldap
Edit the file as follows::
# vi  /usr/share/migrationtools/migrate_common.ph
$DEFAULT_MAIL_DOMAIN = "linuxgeeknotes.in";
$DEFAULT_BASE = "dc=linuxgeeknotes,dc=in";
$EXTENDED_SCHEMA = 1;

Create base.ldif file as follows.
# vi  /root/base.ldif

dn: dc=linuxgeeknotes,dc=in
objectClass: top
objectClass: dcObject
objectclass: organization
o: linuxgeeknotes in
dc: linuxgeeknotes

dn: cn=Manager,dc=linuxgeeknotes,dc=in
objectClass: organizationalRole
cn: Manager
description: Directory Manager

dn: ou=People,dc=linuxgeeknotes,dc=in
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=linuxgeeknotes,dc=in
objectClass: organizationalUnit
ou: Group

Create users on the server.
# useradd lduser1
# useradd lduser2
set password for both the users
# grep ":10[0-9][0-9]" /etc/passwd > /root/passwd
# grep ":10[0-9][0-9]" /etc/group > /root/group

# ./usr/share/migrationtools/migrate_passwd.pl  /root/passwd  /root/users.ldif
# ./usr/share/migrationtools/migrate_group.pl /root/group /root/groups.ldif

# ldapadd -x -W -D "cn=Manager,dc=linuxgeeknotes,dc=in" -f /root/base.ldif
# ldapadd -x -W -D "cn=Manager,dc=linuxgeeknotes,dc=in" -f /root/users.ldif
# ldapadd -x -W -D "cn=Manager,dc=linuxgeeknotes,dc=in" -f /root/groups.ldif

 # ldapsearch -x cn=lduser1 -b dc=linuxgeeknotes,dc=in

Mounting ldap users home directories
# vi /etc/exports
/home *(rw,sync)
# yum -y install rpcbind nfs-utils
# systemctl start rpcbind
# systemctl start nfs
# systemctl enable rpcbind
# systemctl enable nfs


LDAP Client Configuration in 192.168.1.2
================================
# yum install -y openldap-clients nss-pam-ldapd
# authconfig-tui

1. Put '*' Mark on "Use LDAP"

2. Put '*' Mark on "Use LDAP Authentication"

3. Select "Next" and Enter.

4. Enter the server field as "ldap://192.168.1.1/"

5. Enter the Base DN Field as "dc=linuxgeeknotes,dc=in"

6. Select "OK" and Enter

You will be able to see the ldap user details using the command.

# getent passwd lduser1

Mount server home directory 

192.168.1.1:/home   /home   auto  defaults 0 0

NAS backup setup in Linux

NAS backup setup in Linux::
====================

For setting up NAS backup, it should be supported by the OS.  CIFS should be enabled in the kernel. If not enabled, it can be enabled via kernel compilation, which comes under Network File Systems.

Make sure that cifs-util is installed on the box.

We need to mount the backup machine to run the backup or we will have to use the commands/protocols like ssh  to run the backup which won't be appropriate.

Use the nmap (network mapper) command to find the different host and the services running on the hosts.

nmap -sP

VMware 12 and Oracle VM Virtual Box

VMware 12 and Oracle VM Virtual Box Installation in Centos 7 and Windows 7
==========================================================

Creating virtual machines and managing them is simple via VMware Workstation Player.

Download the latest VMware Workstation player from VMware downloads ::

VMware download url::

https://my.vmware.com/en/web/vmware/free#desktop_end_user_computing/vmware_workstation_player/12_0

Virtual Box download url::

https://www.virtualbox.org/wiki/Downloads

You will be able to download the latest version  for Windows and Linux distributions.  Download and  just execute the file which will guide you to complete the installation.

Run yum update in linux box before executing the file.

Once the VMware /Virtual Box  is installed we can now create virtual machines.. The gui will guide you the installation if you are a system admin.

Select the iso image of the OS to be installed and also the path  where the OS that has to be installed. Select a partition or a folder for the installation and assign memory for each installations. Try installing multiple OS as virtual machines.

If you need any help in the installation process, comment below and I will be more than happy to assist..

Thanks