Skip to content

Commit d58e21e

Browse files
tbrehmtbrehm
committed
Added a "under_development" folder in the docs folder. This folder can be used to store incomplete documentation or documentation files that are under devlopment.
1 parent ff70758 commit d58e21e

File tree

3 files changed

+313
-313
lines changed

3 files changed

+313
-313
lines changed

‎docs/CHROOTED_DEBIAN_5.0.txt‎

Lines changed: 184 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -1,129 +1,226 @@
1-
2-
3-
Setting up a chrooted ispconfig 3 installation
4-
--------------------------------------------------------------------
5-
6-
# Follow the steps 1 - 8 of the INSTALL_DEBIAN_5.0 Guide, then proceed
7-
# with the steps below.
1+
#!/bin/sh
2+
#
3+
# rev 0.6
4+
#
5+
# dxr@brutalsec.net
6+
# 01-09-2009
7+
#
8+
# We can create a script for configure chroot enviroment but,
9+
# YOU MUST UNDERSTAND HOW TO WORK IT for can solve possible
10+
# problems in the future.
811
#
9-
# This guide is experimental as there are a few cahnges nescessary in
10-
# ispconfig to get it workin. These changes will be part of ISPConfig 3.0.2
11-
12-
# Install packages
13-
14-
apt-get install debootstrap libapache2-mod-chroot
15-
16-
# Create the chroot enviroment
17-
18-
debootstrap lenny /var/www/ ftp://ftp.fr.debian.org/debian/
19-
20-
# Add mountpoints for the chroot env into the fstab file.
12+
# Every service has its own chroot enviroment:
13+
# BIND -> chroot
14+
# Apache -> chroot
15+
# Dovecot -> chroot
16+
# Pureftpd -> Apache's chroot
17+
#
18+
# Only apache and php packages aren't installed in real system,
19+
# only in chroot enviroment with symbolic links from real system.
20+
#
21+
# PLEASE, CONFIGURE CHROOT ENVIROMENT IF SECURITY IS REALLY
22+
# IMPORTANT FOR YOU AND YOU KNOWN HOW TO WORK IT!
23+
#
2124

22-
echo "/proc /var/www/proc proc defaults 0 0">>/etc/fstab
23-
echo "devpts /var/www/dev/pts devpts defaults 0 0">>/etc/fstab
25+
exit 1
2426

25-
# mount the filesystems
27+
1. BACKUP before change something in the system
28+
2. Create partitions
29+
3. Remove possible apache or php installations on real system
30+
4. Prepair Chroot enviroment
31+
5. Linking Webserver aplication from real system
32+
6. mini_sendmail
33+
7. Test services
34+
8. Howto install ispconfig3
35+
9. Migration
2636

27-
mount -a
2837

29-
# add a default chroot dir for all users of the sshusers group.
38+
1. BACKUP before change something in the system
39+
# If is not a new instalation, then
3040

31-
echo "@sshusers - chroot /var/www/">>/etc/security/limits.conf
41+
BACKUP BACKUP BACKUP BACKUP BACKUP BACKUP
42+
BACKUP BACKUP BACKUP BACKUP BACKUP BACKUP
43+
BACKUP BACKUP BACKUP BACKUP BACKUP BACKUP
44+
BACKUP BACKUP BACKUP BACKUP BACKUP BACKUP
3245

33-
# copy passwd and group files to the chroot env.
3446

35-
cp -rf /etc/apt /etc/passwd /etc/group /var/www/etc/ # Cleaning unecesary users and groups
47+
2. Create partitions
3648

37-
# Create symlinks.
49+
/var/www/ Chroot partition (ext3)
50+
/var/www/html/ Chroot system
51+
/var/www/html/var/log/apache2 Log partition (ext3)
52+
/var/www/html/var/www/html Webs partition (xfs)
53+
/var/www/html/tmp Temporal dir (tmpfs, options: )
3854

39-
cd /var/www/var/
40-
rm -rf /var/www/var/www
41-
ln -s / www
55+
/dev/lvm_foobar1/chroot_lv -> /var/www/ (ext3)
56+
/dev/lvm_foobar2/apachelogs_lv -> /var/www/html/var/log/apache2 (ext3)
57+
/dev/lvm_foobar3/hosting_lv -> /var/www/html/var/www/html (xfs)
4258

43-
# Enter the chroot
59+
mount /dev/lvm_foobar1/chroot_lv /var/www/
60+
mkdir -p /var/www/html/var/log/apache2 /var/www/html/var/www/html
61+
mount /dev/lvm_foobar2/apachelogs_lv /var/www/html/var/log/apache2
62+
mount /dev/lvm_foobar3/hosting_lv /var/www/html/var/www/html
4463

45-
chroot /var/www
4664

47-
# Update files in the chroot enviroment and install some packages.
48-
# You can ignore warnings about locales, we will fix them in the next step.
65+
3. Remove possible apache or php installations on real system
66+
# We never wont install apache or php in non-chroot system, if we have installed, we only have do a backup of confgigurations, uninstall, and check every simbolic link
67+
dpkg -l|egrep --color -i 'apache|php'
4968

50-
apt-get update
51-
apt-get install fakeroot --force-yes -y
52-
apt-get install locales
5369

54-
# Reconfigure locales. Select e.g the en_US* locales.
70+
4. Prepair Chroot enviroment
5571

56-
dpkg-reconfigure locales
72+
# Install packages in real system
73+
apt-get install debootstrap libpcre3 libaprutil1 libxml2 mime-support patch make gcc mysql-server subversion ssh openssh-server ntp ntpdate vim libdbd-mysql libdbi-perl dnsutils
74+
# The non webserver will install outside of chroot
75+
apt-get install postfix postfix-mysql postfix-doc mysql-client openssl getmail4 rkhunter amavisd-new spamassassin clamav clamav-daemon zoo unzip bzip2 arj nomarch lzop cabextract apt-listchanges libnet-ldap-perl libauthen-sasl-perl clamav-docs daemon libio-string-perl libio-socket-ssl-perl libnet-ident-perl zip libnet-dns-perl pure-ftpd-common pure-ftpd-mysql quota quotatool
76+
# If you will use courier:
77+
apt-get install courier-authdaemon courier-authlib-mysql courier-pop courier-pop-ssl courier-imap courier-imap-ssl libsasl2-2 libsasl2-modules libsasl2-modules-sql sasl2-bin libpam-mysql courier-maildrop
78+
# If you will use dovecot:
79+
#apt-get install dovecot-imapd dovecot-pop3d
80+
# If you will use BIND:
81+
apt-get install bind9 bind9utils
5782

58-
# run a dist upgarde.
83+
#
84+
# If we want execute php from real system (crontabs for example) we need install php dependencies in real system:
85+
# libgd2-xpm libt1-5 libmagick10 libc-client2007b libmcrypt4
86+
# cat /var/log/ispconfig/cron.log
87+
# ldd /usr/lib/php5/20060613/mcrypt.so
88+
#
5989

60-
fakeroot apt-get dist-upgrade
90+
time debootstrap --arch=amd64 lenny /var/www/html/ ftp://ftp.fr.debian.org/debian/
6191

62-
# Install apache and php in the chroot enviroment
92+
echo "/proc /var/www/html/proc proc defaults 0 0">>/etc/fstab
93+
echo "devpts /var/www/html/dev/pts devpts defaults 0 0">>/etc/fstab
6394

64-
apt-get install apache2 apache2.2-common apache2-doc apache2-mpm-prefork apache2-utils libexpat1 ssl-cert libapache2-mod-php5 php5 php5-common php5-gd php5-mysql php5-imap phpmyadmin php5-cli php5-cgi libapache2-mod-fcgid apache2-suexec php-pear php-auth php5-mcrypt mcrypt php5-imagick imagemagick libapache2-mod-suphp libopenssl-ruby
65-
/etc/init.d/apache2 stop
95+
mount -a
6696

67-
# Exit the chroot
97+
# We must create sshusers group
98+
echo "@sshusers - chroot /var/www/html/">>/etc/security/limits.conf
99+
100+
chroot /var/www/html apt-get update
101+
chroot /var/www/html apt-get install fakeroot --force-yes -y
102+
chroot /var/www/html apt-get install locales
103+
chroot /var/www/html dpkg-reconfigure locales
104+
105+
mv /usr/lib/apache2 /usr/lib/apache2_old
106+
mv /var/log/apache2 /var/log/apache2_old
107+
mv /var/lock/apache2 /var/lock/apache2_old
108+
mv /var/lib/apache2 /var/lib/apache2_old
109+
mv /usr/lib/php5 /usr/lib/php5_old
110+
mv /etc/apache2 /etc/apache2_old
111+
mv /etc/suphp /etc/suphp_old
112+
113+
chroot /var/www/html apt-get install apache2 apache2.2-common apache2-doc apache2-mpm-prefork apache2-utils libexpat1 ssl-cert libapache2-mod-php5 php5 php5-common php5-gd php5-mysql php5-imap phpmyadmin php5-cli php5-cgi libapache2-mod-fcgid apache2-suexec php-pear php-auth php5-mcrypt mcrypt php5-imagick imagemagick libapache2-mod-suphp libopenssl-ruby libapache2-mod-chroot php-apc libtimedate-perl
114+
115+
chroot /var/www/html /etc/init.d/apache2 stop
116+
117+
chroot /var/www/html a2enmod mod_chroot
118+
chroot /var/www/html a2enmod suexec
119+
echo "ChrootDir /var/www/html" > /var/www/html/etc/apache2/conf.d/mod_chroot.conf
120+
sed -i -e 's#DocumentRoot /var/www/#DocumentRoot /var/www/html/#' /var/www/html/etc/apache2/sites-enabled/000-default
121+
sed -i -e 's#x-httpd-php=php:/usr/bin/php-cgi#x-httpd-php=php:/usr/bin/php-cgi\nx-httpd-suphp=php:/usr/bin/php-cgi\nx-httpd-php=php:/usr/bin/php-cgi#' /var/www/html/etc/suphp/suphp.conf
122+
sed -i -e 's#/var/run/apache2.pid#/var/run/apache2/apache2.pid#' /var/www/html/etc/apache2/envvars
123+
sed -i -e 's/^"syntax on/syntax on/' /etc/vim/vimrc
124+
sed -i -e 's/^"syntax on/syntax on/' /var/www/html/etc/vim/vimrc
125+
126+
# Protect apache configuration. ONLY root can read it
127+
chown root:root /var/www/html/etc/apache2/ && chmod 700 /var/www/html/etc/apache2/
128+
chmod 711 /var/www/html/etc/php5/
129+
130+
131+
5. # Is good idea to add nagios alarm for check every simbolic link is correct.
132+
ln -s /var/www/html/etc/apache2 /etc/apache2
133+
ln -s /var/www/html/etc/suphp /etc/suphp
134+
ln -s /var/www/html/var/run/apache2 /var/run/apache2
135+
ln -s /var/www/html/var/run/apache2.pid /var/run/apache2.pid
136+
ln -s /var/www/html/usr/sbin/apache2ctl /usr/sbin/apache2ctl
137+
ln -s /var/www/html/usr/sbin/apache2 /usr/sbin/apache2
138+
ln -s /var/www/html/usr/lib/apache2 /usr/lib/apache2
139+
ln -s /var/www/html/usr/sbin/a2enmod /usr/sbin/a2enmod
140+
ln -s /var/www/html/usr/sbin/a2dismod /usr/sbin/a2dismod
141+
ln -s /var/www/html/usr/sbin/a2ensite /usr/sbin/a2ensite
142+
ln -s /var/www/html/usr/sbin/a2dissite /usr/sbin/a2dissite
143+
ln -s /var/www/html/var/log/apache2 /var/log/apache2
144+
ln -s /var/www/html/var/lock/apache2 /var/lock/apache2
145+
ln -s /var/www/html/var/lib/apache2 /var/lib/apache2
146+
ln -s /var/www/html/usr/lib/php5 /usr/lib/php5
147+
ln -s /var/www/html/etc/init.d/apache2 /etc/init.d/apache2
148+
# Neccessary for to install ispconfig3 from real system:
149+
ln -s /var/www/html/usr/bin/php5 /usr/bin/php5
150+
ln -s /var/www/html/etc/alternatives/php /etc/alternatives/php
151+
ln -s /var/www/html/usr/bin/php /usr/bin/php
152+
ln -s /var/www/html/etc/php5 /etc/php5
153+
154+
6. # Install mini_sendmail for chroot
155+
# We can use mini_sendmail for delivery emails directy in remote servers, but i prefer to control it in central mailserver for check spammers and limit it.
68156

69-
exit
157+
cd /tmp/
158+
wget http://acme.com/software/mini_sendmail/mini_sendmail-1.3.6.tar.gz
159+
tar xzf mini_sendmail-1.3.6.tar.gz
160+
wget http://users1.leipzig.freifunk.net/%7Efirmware-build/brcm_2_4_Broadcom_default/build/openwrt_packages/mail/mini_sendmail/patches/200-fullname.patch
161+
patch -p0 < 200-fullname.patch
162+
cd mini_sendmail-1.3.6
163+
make
164+
# 2e555b2573c3ea65a467a5960f0b51f6 mini_sendmail
165+
mv /var/www/html/usr/lib/sendmail /var/www/html/usr/lib/sendmail_old
166+
mv /var/www/html/usr/sbin/sendmail /var/www/html/usr/sbin/sendmail_old
167+
cp mini_sendmail /var/www/html/usr/sbin/mini_sendmail
168+
cd /var/www/html/usr/lib/ && ln -s ../sbin/mini_sendmail sendmail
169+
cd /var/www/html/usr/sbin && ln -s mini_sendmail sendmail
70170

71-
# Moving the apache configuration is not nescessary, as apache reads
72-
# the config files before it moves into the chroot
73-
# rm -rf /var/www/etc/apache2
74-
# mv -f /etc/apache2 /var/www/etc/
75-
# ln -s /var/www/etc/apache2 /etc/apache2
171+
# ./mini_sendmail -h
172+
# usage: ./mini_sendmail [-f<name>] [-t] [-s<server>] [-p<port>] [-T<timeout>] [-v] [address ...]
76173

77-
rm -rf /var/www/etc/php5/cgi/
78-
mv -f /etc/php5/cgi/ /var/www/etc/php5/
79-
ln -s /var/www/etc/php5/cgi /etc/php5/
174+
#add to php.ini (/var/www/html/etc/php5/apache2/php.ini /var/www2/etc/php5/cli/php.ini /var/www2/etc/php5/cgi/php.ini line :672)
175+
# sendmail_path = /usr/sbin/mini_sendmail -t -i -fhosting@alojamientotecnico.com -s127.0.0.1
80176

81-
rm -rf /var/www/etc/php5/apache2/
82-
mv -f /etc/php5/apache2/ /var/www/etc/php5/
83-
ln -s /var/www/etc/php5/apache2 /etc/php5/
177+
sed -i -e 's#^;sendmail_path =$#sendmail_path = /usr/sbin/mini_sendmail -t -i -fhosting@alojamientotecnico.com -s127.0.0.1#' /var/www/html/etc/php5/apache2/php.ini /var/www/html/etc/php5/cli/php.ini /var/www/html/etc/php5/cgi/php.ini
84178

85-
ln -s /var/www/var/run/apache2.pid /var/run/apache2.pid
86179

87-
# enable mod_chroot
180+
7.
181+
# Test
182+
apache2ctl restart
88183

89-
a2enmod mod_chroot
90-
echo "ChrootDir /var/www" > /etc/apache2/conf.d/mod_chroot.conf
184+
# php -i|grep --color sendmail
185+
#sendmail_from => no value => no value
186+
#sendmail_path => /usr/sbin/mini_sendmail -t -i -fhosting@alojamientotecnico.com -s127.0.0.1 => /usr/sbin/mini_sendmail -t -i -fhosting@alojamientotecnico.com -s127.0.0.1
187+
#Path to sendmail => /usr/sbin/mini_sendmail -t -i -fhosting@alojamientotecnico.com -s127.0.0.1
91188

92-
# Start apache
189+
# Sould be good idea check /var/www/html/usr/lib/sendmail /var/www/html/usr/sbin/sendmail and /var/www/html/usr/sbin/mini_sendmail with nagios alarm ;)
93190

94-
/etc/init.d/apache2 start
95191

96-
# Install ISPConfig
192+
8. Install ispconfig ........
97193

98-
cd /tmp
99-
wget http://www.ispconfig.org/downloads/ISPConfig-3.0.1.4-beta-2.tar.gz
100-
tar xvfz ISPConfig-3.0.1.4-beta-2.tar.gz
101-
cd ispconfig3_install/install/
102-
php -q install.php
103194
cd /tmp/
104-
rm -rf ispconfig3_install
105-
rm -f ISPConfig-3.0.1.4-beta-2.tar.gz
106-
107-
# Move the ispconfig interface part to the chroot enviroment and create a symlink
195+
svn co svn://svn.ispconfig.org/ispconfig3 svn.ispconfig.org
108196

109-
mkdir /var/www/usr/local/ispconfig
110-
chown ispconfig:ispconfig /var/www/usr/local/ispconfig
111-
chmod 750 /var/www/usr/local/ispconfig
112-
mv /usr/local/ispconfig/interface /var/www/usr/local/ispconfig/
113-
ln -s /var/www/usr/local/ispconfig/interface /usr/local/ispconfig/interface
114-
chroot /var/www adduser www-data ispconfig
197+
mv /usr/local/ispconfig /var/www/html/usr/local/
198+
ln -s /var/www/html/usr/local/ispconfig /usr/local/ispconfig
199+
mv /var/www/apps /var/www/html/var/www/
200+
mv /var/www/php-fcgi-scripts /var/www/html/var/www/
201+
mv /var/www/ispconfig /var/www/html/var/www/
202+
ln -s /var/www/html//var/www/ispconfig /var/www/ispconfig
203+
ln -s /var/www/html/var/www/php-fcgi-scripts /var/www/php-fcgi-scripts
204+
ln -s /var/www/html/var/www/apps /var/www/apps
205+
# After copy, we must clean unnecessary users and groups
206+
cp -r /etc/{passwd,group,apt} /var/www/html/etc/
207+
apache2ctl stop
208+
apache2ctl start
115209

116-
# Create a link for the mysql socket.
117210

118-
ln /var/run/mysqld/mysqld.sock /var/www/var/run/mysqld/mysqld.sock
211+
### Migration to other server ###
212+
Really easy:
119213

120-
# As an alternative to making a hardlink to the mysql socket,
121-
# change the my.cnf file in the chroot to use tcp sockets.
122-
# This is more secure but a bit slower then using the mysqld.sock file.
214+
Do step 1
123215

124-
# Restart apache
216+
And after do a simple rsync:
125217

126-
/etc/init.d/apache2 restart
218+
screen
219+
time rsync -a --progress root@host1:/var/www/ /var/www/
127220

221+
# Install some apache's dependencies
222+
apt-get install debootstrap libpcre3 libaprutil1 libxml2 mime-support
128223

224+
Do step 5
225+
Do step 6
129226

0 commit comments

Comments
 (0)