Installing And Using OpenVZ On CentOS 6.0

View the original article here

Installing Lighttpd With PHP5 And MySQL Support On CentOS 5.6

Lighttpd is a secure, fast, standards-compliant web server designed for speed-critical environments. This tutorial shows how you can install Lighttpd on a CentOS 5.6 server with PHP5 support (through FastCGI) and MySQL support.

Comments (0)
You must be logged in to post a comment. Please register if you do not have an account yet.

View the original article here

Postfix/Dovecot Authentication Against Active Directory On CentOS 5.x

This document describes how to integrate Postfix/Dovecot with Microsoft Active Directory on CentOS 5.x, and you can manage mail users in Microsoft Active Directory. You will learn how to enable Postfix to look up email addresses in Active Directory and how to enable Dovecot to authenticate against Microsoft Active Directory.

View the original article here

Setup CentOS and move WordPress

I got a vServer by Hetzner and I chose a 64bit CentOS 5.5 install. Now I need to transfer WordPress to it with all my stuff, like database, plugins, themes and special settings like pretty permalinks.

I want to achieve all of this without any additional tools or backup plugins. In my experience WP backup tools mess with SQL tables and produce more headaches than necessary.
If this is a fresh install of Linux you should read on.
 

Why not start with adding an user to your fresh CentOS install. It’s never a good idea to login with a root password. You should rather elevate your rights with su or sudo when needed and login via SSH with a user with less permissions.
 

[root@CentOS ~]#useradd someName -g someMainGroup[root@CentOS ~]#passwd someName

The command -g someMainGroup will add the user to the any default group of your liking. -G would add the user to any secondary groups. You can always change these settings with usermod later.
 

I would use Public-key Authentication since it uses identity keys to authenticate individual users. The identity key has its own passphrase so it will protect my system login. Copies of the public key will have to be distributed to every host that I want to access. The private key should stay protected and must not be shared.

Secondly I would change the port to a nonstandard port because automated attack kits are likely to try brute-forcing their way in via port 22. This has the additional beneficial effect of lightening the load on any firewall logfiles.
 

As pointed out in the comments below by MidnighToker using plain FTP is a very bad idea. I decided to remove my FTP section completely because it wasn’t secure. Because setting up SFTP on CentOS / RHEL with added security -a chroot jail- is rather difficult, I dedicated an entire [blog post] to that topic. The post will cover how you upgrade openSSH 4.6. to 5.6 on RHEL / CentOS by compiling from source building your own rpm package.

LAMP stands for Linux, Apache, MySQL and PHP. To deal with this in one go we log into our web server and type into the shell:
 

yum install mysql mysql-server httpd php php-mysql -y

Above line uses the Yellow Dog Updater Modified to install a complete LAMP system. The -y switch means “assume that the answer to any question which would be asked is yes” (yum manpage, 2010)

Next, we have to have to insure that our services that we installed just a minute ago will start up after reboot. We do this with chkconfig, a system startup linking tool. It manages the symbolic links of the services inside the /etc/rc[0-6].d directory. These links would point to the startup scripts inside /etc/init.d. You could do this manually for the runlevels you need, but Redhat, Fedora and thus CentOS features chkconfig. In Debian you would have to use update-rc.d
 

chkconfig --levels 235 mysqld on

Better do it in one go:
 

chkconfig --levels 235 mysqld on && chkconfig --levels 235 httpd on && /etc/init.d/mysqld start && /etc/init.d/httpd start

The operator && does execute the next command if the previous one executed was successful. Now that your Apache server and SQL server is running, we will have to setup some security in MySQL.

mysqladmin -u root password mysecretphrase

Rather use this command since it is more secure and sets also a root access mask:

/usr/bin/mysql_secure_installation

If you now try to login into mysql and get an access denied then most probably your SQL server has no Grant-tables setup. Do this with the following file:
 

mysql_install_db

Create a database, furthermore a SQL user and give him permissions.
 

mysql -u adminusername -password=yourPassCREATE DATABASE databasename;GRANT ALL PRIVILEGES ON databasename.* TO wordpressusername@hostname IDENTIFIED BY "password";FLUSH PRIVILEGES;

Flushing Privileges empties the SQL servers cache.

Restore your database with:
 

mysql -h mysqlhostserver -u mysqlusername -p databasename < blog.bak.sql

Go into the httpd.conf file which you can locate with find / | grep httpd.conf.

I would change below settings to get things started. You can use vi with its / slash to search for the respective setting.
 

KeepAlive OnServerLimit 40MaxClients 40ServerAdmin yourMailAdressServerName www.yourDomain.com:80

KeepAlive On is one of the important features of HTTP 1.1, so enable it. With this enabled apache and a client will use a single TCP/IP connection to send continuous data instead of opening many simultaneous TCP connections. Every TCP connection goes through the slow start algorithm before reaching maximum transfer speed -the slow start threshold- so in essence KeepAlive On ensures faster loading of Web pages.

Lowering the ServerLimit ensures that your server will not hang or crash due to extreme swapping of memory. A server swaps memory from RAM to its pagefile or swap partition when for instance apache requests too many memory due too many open HTTP requests. The same goes for MaxClients. You should lower this value in both – the module section of prefork.c and worker.c

Set AllowOverride All to allow the file .htaccess do its magic. We will configure it later for pretty permalinks.

You could also add %T/%D in the LogFormat line to enable the module mod_headers to measure the time your server takes to process a HTTP request from the receival of the HTTP headers to delivery of the response headers.

If you want ErrorDocuments to be served properly, you should uncomment the line following #ErrorDocument 400.

Finally we setup our default virtual server, which will be taken as default server if any additional virtual servers cannot be resolved by apache. Since we defined ServerAdmin and ErrorLog earlier it is not necessary to define this again for our virtual server, but you could of course user alternate log file locations or ServerAdmins.

NameVirtualHost *.80 DocumentRoot /var/www/html/yourdomain ServerName yourdomain.com ServerAlias www.yourdomain.com

Now create the directory for your domain at /var/www/html/ otherwise apache will not start. Give this directory permissions with chmod 775, in order for the owner and the group having full permissions. You can change the group of the directory with /usr/bin/groupmod.

To enable compression in Apache I would add the recommended code taken from the apache 2.2 documentation.
 

# Insert filter SetOutputFilter DEFLATE # Netscape 4.x has some problems... BrowserMatch ^Mozilla/4 gzip-only-text/html # Netscape 4.06-4.08 have some more problems BrowserMatch ^Mozilla/4\.0[678] no-gzip # MSIE masquerades as Netscape, but it is fine BrowserMatch \bMSIE !no-gzip !gzip-only-text/html # Don't compress images SetEnvIfNoCase Request_URI \ \.(?:gif|jpe?g|png)$ no-gzip dont-vary # Make sure proxies don't deliver the wrong content Header append Vary User-Agent env=!dont-var

The Location directive makes sense as the apache documentation states:
 

“Location sections are processed in the order they appear in the configuration file, after the Directory sections and .htaccess files are read, and after the Files sections.”

In case you are not only moving WordPress but also changed your domain name you would have to alter the WordPress adress and Site address in the General Settings prior to making a SQL backup. Be aware you can lock yourself out if you change these settings. I would recommend to make the SQL backup and after restoring it on your new server I would change the domain settings with these SQL queries:
 

use yourDatabase;UPDATE 'wp_options' SET 'option_value' = 'http://newDomain.tld' WHERE 'option_id' =1 AND 'blog_id' =0 AND 'option_name' = 'siteurl' LIMIT 1 ;UPDATE 'wp_options' SET 'option_value' = 'http://newDomain.tld' WHERE 'option_id' =46 AND 'blog_id' =0 AND 'option_name' = 'home' LIMIT 1 ;

You can also do this with phpMyAdmin with these queries:
 

SELECT 'option_value'FROM 'wp_options'WHERE option_id =1AND blog_id =0AND option_name = 'siteurl'LIMIT 1 ;SELECT 'option_value'FROM 'wp_options'WHERE option_name = 'home'LIMIT 1 ;

Moving WordPress itself from one server to another is the simplest part. Just download your whole WordPress folder via FTP. That is the one where directories wp-content, wp-admin and so forth reside in. Then upload it via our secure openSSH/SFTP connection. Don’t forget to include your .htaccess file in case you want to use permalinks.

 

View the original article here

SFTP with chroot jail on CentOS

SFTP which uses openssh was engineered by the IETF 2001-2007. It has the potential to replace the insecure and legacy FTP. Another alternative would be WebDAV. It seems like a great alternative to SFTP since it uses HTTP/TCP pipelining and should considerably speed up file transfers. However if you want WebDAV to be secure you would have go through the pain of creating a valid SSL connection.SFTP should work out of the box if ssh is running on your server. Just connect from your client machine with sftp user@hostname.tldThe connection itself is tunneled over SSH now. However the user will have access to your entire file system and even worse if anyone gained these credentials, he could login via ssh to your server.Since we don’t want that, we will have to chroot (jail root) the sftp user and forbid him to use ssh itself. For this you will need openSSH 5 or greater. At the time of this blog post, CentOS 5.5 still ships with the year old openSSH 4.6. Therefore we will have to make a rpm package with the latest openSSH 5.6 sources and install it on our CentOS. rpm -qa | grep sshyum -y install gcc automake autoconf libtool make openssl-devel pam-devel rpm-buildwget http://ftp.halifax.rwth-aachen.de/openbsd/OpenSSH/portable/openssh-5.6p1.tar.gzwget http://ftp.halifax.rwth-aachen.de/openbsd/OpenSSH/portable/openssh-5.6p1.tar.gz.ascwget -O- http://ftp.halifax.rwth-aachen.de/openbsd/OpenSSH/portable/DJM-GPG-KEY.asc | gpg --importgpg openssh-5.6p1.tar.gz.asctar zxvf openssh-5.6p1.tar.gzcp openssh-5.6p1/contrib/redhat/openssh.spec /usr/src/redhat/SPECS/cp openssh-5.6p1.tar.gz /usr/src/redhat/SOURCES/cd /usr/src/redhat/SPECS/perl -i.bak -pe 's/^(%define no_(gnome|x11)_askpass)\s+0$/$1 1/' openssh.specrpmbuild -bb openssh.speccd /usr/src/redhat/RPMS/`uname -i`uname -ils -lrpm -Uvh openssh*rpm/etc/init.d/sshd restartAlright what does all this command lines do? First yum installs the gnu compiler with important tools like make, then yum installs openssl development packages and rpm-build. Then I choose a repository from Aachen, Germany, which is nearest from my server’s location. We also get the gpg signature and import it to our local gpg databse then we check it. The rest is building the rpm package; without GUI support like X11 or gnome, because it’s not really usable on a server. I must credit some of these steps to someone else on the interwebs: http://binblog.info/2009/02/27/packaging-openssh-on-centos/I found perl -i.bak -pe ‘s/^(%define no_(gnome|x11)_askpass)\s+0$/$1 1/’ openssh.spec to be very elegant and I liked also cd /usr/src/redhat/RPMS/`uname -i` very cool. The latter changes directory to the correct build version of your kernel. Did I mention you should be root to do this?I do it in one go, absolute hardcore. rpm -qa | grep ssh && yum -y install gcc automake autoconf libtool make openssl-devel pam-devel rpm-build && wget http://ftp.halifax.rwth-aachen.de/openbsd/OpenSSH/portable/openssh-5.6p1.tar.gz && wget http://ftp.halifax.rwth-aachen.de/openbsd/OpenSSH/portable/openssh-5.6p1.tar.gz.asc && wget -O- http://ftp.halifax.rwth-aachen.de/openbsd/OpenSSH/portable/DJM-GPG-KEY.asc | gpg --import && gpg openssh-5.6p1.tar.gz.asc && tar zxvf openssh-5.6p1.tar.gz && cp openssh-5.6p1/contrib/redhat/openssh.spec /usr/src/redhat/SPECS/ && cp openssh-5.6p1.tar.gz /usr/src/redhat/SOURCES/ && cd /usr/src/redhat/SPECS/ && perl -i.bak -pe 's/^(%define no_(gnome|x11)_askpass)\s+0$/$1 1/' openssh.spec && rpmbuild -bb openssh.spec && cd /usr/src/redhat/RPMS/`uname -i` && uname -i && ls -l && rpm -Uvh openssh*rpmBetter check if it worked. rpm -qa | grep sshopenssh-clients-5.6p1-1openssh-5.6p1-1openssh-server-5.6p1-1This were the pre-requisites for using chroot with SFTP. I will show how to setup SFTP and prepare your directory structure.First, setup two new groups. One group fullssh is going to have full access to the Linux filesystem. Just add your main user to the fullssh supplementary group. The other group is called sftponly for our SFTP users that will be jailed to a particular directory. groupadd sftponlyuseradd peteusermod -aG sftponly peteIn above snippet one could also use useradd -G sftponly pete, but in case the user pete exists already the -a switch ensures he is added to the supplemental group sftponly instead of deleting existing supplemental groups.Now go into /etc/ssh/sshd_config and comment out the default entry for the sftp service. #Subsystem sftp /usr/lib64/misc/sftp-serverSubsystem sftp internal-sftpAllowGroups fullssh sftponlyMatch Group sftponly ChrootDirectory /var/www/html ForceCommand internal-sftp X11Forwarding no AllowTcpForwarding noNow let’s set permissions on the directory structure. This has to be done with great care. chown root:sftponly /var/www/htmlchmod 755 /var/www/htmlmkdir -p /var/www/html/yourDomainchown pete:sftponly /var/www/html/yourDomainSome tutorials on the web suggest setting permissions to 750, but as it turns out this will lock out apache and produces a HTTP 403 Forbidden when accessing your website. We don’t want that.With chown you change the owners of the directory to root user-wise and to sftponly group-wise. The user pete should be a member of that group by now. You can check that with groups pete. Creating the directory with the -p shouldn’t be necessary in above example, but I included it nonetheless. The switch would take care of creating all necessary parent folders. This is how the permissions must look like in order to make the ssh / sftp login chain to work. ls -lishad /var/www/htmlinode 4.0K drwxr-xr-x 3 root sftponly 4.0K Nov 9 10:27 /var/www/htmlls -lishad /var/www/html/yourDomaininode 4.0K drwxr-xr-x 8 joe sftponly 4.0K Nov 9 11:33 /var/www/html/yourDomainNow if you login, ssh has root permissions and handles the login process until the user pete is authenticated. The user is then jail chrooted to the yourDomain directory, at least in my understanding. With SFTP we don’t need a proper chroot environment with access to /dev or any hardlinks – therefore it should be rather difficult for an attacker to escape the jail. There exists an exploit [1] since 1999. That is why Solaris and Linux stopped to consider chroot a secure solution. However it is possible to harden [2] a shell chroot environment.I hope you enjoyed this article. I would appreciate any thoughts on the topic of server security in the comments below. 

Paravirtualization With Xen On CentOS 5.6 (x86_64)

This tutorial provides step-by-step instructions on how to install Xen (version 3.0.3) on a CentOS 5.6 (x86_64) system. Xen lets you create guest operating systems (*nix operating systems like Linux and FreeBSD), so called "virtual machines" or domUs, under a host operating system (dom0). Using Xen you can separate your applications into different virtual machines that are totally independent from each other (e.g. a virtual machine for a mail server, a virtual machine for a high-traffic web site, another virtual machine that serves your customers' web sites, a virtual machine for DNS, etc.), but still use the same hardware. This saves money, and what is even more important, it's more secure. If the virtual machine of your DNS server gets hacked, it has no effect on your other virtual machines. Plus, you can move virtual machines from one Xen server to the next one.

View the original article here

Paravirtualization With Xen On CentOS 5.6 (x86_64)

This tutorial provides step-by-step instructions on how to install Xen (version 3.0.3) on a CentOS 5.6 (x86_64) system.

Xen lets you create guest operating systems (*nix operating systems like Linux and FreeBSD), so called "virtual machines" or domUs, under a host operating system (dom0). Using Xen you can separate your applications into different virtual machines that are totally independent from each other (e.g. a virtual machine for a mail server, a virtual machine for a high-traffic web site, another virtual machine that serves your customers' web sites, a virtual machine for DNS, etc.), but still use the same hardware. This saves money, and what is even more important, it's more secure. If the virtual machine of your DNS server gets hacked, it has no effect on your other virtual machines. Plus, you can move virtual machines from one Xen server to the next one.

I will use CentOS 5.6 (x86_64) for both the host OS (dom0) and the guest OS (domU).

This howto is meant as a practical guide; it does not cover the theoretical backgrounds. They are treated in a lot of other documents in the web.

This document comes without warranty of any kind! I want to say that this is not the only way of setting up such a system. There are many ways of achieving this goal but this is the way I take. I do not issue any guarantee that this will work for you!

This guide will explain how to set up image-based virtual machines and also LVM-based virtual machines.

Make sure that SELinux is disabled or permissive:

vi /etc/sysconfig/selinux

# This file controls the state of SELinux on the system.# SELINUX= can take one of these three values:# enforcing - SELinux security policy is enforced.# permissive - SELinux prints warnings instead of enforcing.# disabled - SELinux is fully disabled.SELINUX=disabled# SELINUXTYPE= type of policy in use. Possible values are:# targeted - Only targeted network daemons are protected.# strict - Full SELinux protection.SELINUXTYPE=targeted

If you had to modify /etc/sysconfig/selinux, please reboot the system:

reboot

To install Xen, we simply run

yum install kernel-xen xen

This installs Xen and a Xen kernel on our CentOS system.

Before we can boot the system with the Xen kernel, please check your GRUB bootloader configuration. We open /boot/grub/menu.lst:

vi /boot/grub/menu.lst

The first listed kernel should be the Xen kernel that you've just installed:

[...]title CentOS (2.6.18-238.9.1.el5xen) root (hd0,0) kernel /xen.gz-2.6.18-238.9.1.el5 module /vmlinuz-2.6.18-238.9.1.el5xen ro root=/dev/VolGroup00/LogVol00 module /initrd-2.6.18-238.9.1.el5xen.img[...]

Change the value of default to 0 (so that the first kernel (the Xen kernel) will be booted by default):

The complete /boot/grub/menu.lst should look something like this:

# grub.conf generated by anaconda## Note that you do not have to rerun grub after making changes to this file# NOTICE: You have a /boot partition. This means that# all kernel and initrd paths are relative to /boot/, eg.# root (hd0,0)# kernel /vmlinuz-version ro root=/dev/VolGroup00/LogVol00# initrd /initrd-version.img#boot=/dev/sdadefault=0timeout=5splashimage=(hd0,0)/grub/splash.xpm.gzhiddenmenutitle CentOS (2.6.18-238.9.1.el5xen) root (hd0,0) kernel /xen.gz-2.6.18-238.9.1.el5 module /vmlinuz-2.6.18-238.9.1.el5xen ro root=/dev/VolGroup00/LogVol00 module /initrd-2.6.18-238.9.1.el5xen.imgtitle CentOS (2.6.18-238.el5) root (hd0,0) kernel /vmlinuz-2.6.18-238.el5 ro root=/dev/VolGroup00/LogVol00 initrd /initrd-2.6.18-238.el5.img

Afterwards, we reboot the system:

reboot

The system should now automatically boot the new Xen kernel. After the system has booted, we can check that by running

uname -r

[root@server1 ~]# uname -r
2.6.18-238.9.1.el5xen
[root@server1 ~]#

So it's really using the new Xen kernel!

We can now run

xm list

to check if Xen has started. It should list Domain-0 (dom0):

[root@server1 ~]# xm list
Name                                      ID Mem(MiB) VCPUs State   Time(s)
Domain-0                                   0     3343     2 r-----     18.1
[root@server1 ~]#

Paravirtualization With Xen On CentOS 5.6 (x86_64) - Page 2

View the original article here

Installing Zimbra Collaboration Suite 7 On CentOS 5.x (64Bit)

This article explains how to install Zimbra Collaboration Suite 7 (ZCS) on CentOS 5.x (64Bit). Prepared by Rafael Marangoni, from BRLink Suporte Linux Team.

Zimbra is a collaboration suite very widely used in the world. Users can share folders, contacts, schedules and other things, using a very rich web interface. Click here to know more about it.

One important note is that we're using CentOS 5 64bits, that is not oficially supported by Zimbra team (only RHEL and SUSE are). But CentOS works fine with Zimbra.

First, we need to configure the DNS entry that is pointing to the server. In this case, we're using the hostname zimbratest.example.com

Then, we need to configure the hostname in the Linux box.

vi /etc/sysconfig/network

NETWORKING=yesNETWORKING_IPV6=noHOSTNAME=zimbratest.example.comvi /etc/hosts

127.0.0.1 localhost.localdomain localhost10.0.0.234 zimbratest.example.com zimbratest

Next, we need to install some packages:

yum install -y sysstat perl sudo sqlite

I suggest that you reboot the Linux box at this point, to apply all the configs.

First, we need to download the tarball from Zimbra's website. Click here.

mkdir /download
cd /download
wget http://files2.zimbra.com/downloads/7.0.1_GA/zcs-7.0.1_GA_3105.RHEL5_64.20110304210645.tgz

Initiate the installer:

tar -zxvf zcs-7.0.1_GA_3105.RHEL5_64.20110304210645.tgz
cd zcs-7.0.1_GA_3105.RHEL5_64.20110304210645
./install.sh --platform-override

PS: The Zimbra installation script checks if the distro is RHEL. To ignore that and install on CentOS, you must use "--platform-override".

The installation script is a wizard. For almost all the options, we'll select the default option. These are the questions:

If you leave the question in blank, it will select the default option.

First, we need to agree with the license terms.

Do you agree with the terms of the software license agreement? [N] y

Now, Zimbra will check all the prerequisites. If anything is not found, stop the Wizard and install it with yum.

If everything is ok, the script will ask what are the packages that we want to install. Just select the default options.

Select the packages to install
Install zimbra-ldap [Y]
Install zimbra-logger [Y]
Install zimbra-mta [Y]
Install zimbra-snmp [Y]
Install zimbra-store [Y]
Install zimbra-apache [Y]
Install zimbra-spell [Y]
Install zimbra-memcached [N]
Install zimbra-proxy [N]

Afterwards, the script asks you if you want to override the platform. You say "yes", of course.

You appear to be installing packages on a platform different
than the platform for which they were built.

This platform is CentOS5_64
Packages found: RHEL5_64
This may or may not work.

Using packages for a platform in which they were not designed for
may result in an installation that is NOT usable. Your support
options may be limited if you choose to continue.

Install anyway? [N] y
The system will be modified. Continue? [N] y

Now, we need to wait the installation procedures.

When all the packages are installed, a menu will be displayed with some config options. We only need to set the admin password.
To do that, we need to press 3.

Main menu

   1) Common Configuration:
2) zimbra-ldap:                             Enabled
3) zimbra-store:                            Enabled
+Create Admin User:                    yes
+Admin user to create:                 admin@zimbratest.example.com
******* +Admin Password                        UNSET
+Anti-virus quarantine user:           virus-quarantine.kzpbrsgbx7@zimbratest.example.com
+Enable automated spam training:       yes
+Spam training user:                   spam.sd5fsqtdzi@zimbratest.example.com
+Non-spam(Ham) training user:          ham.2qun60wc4@zimbratest.example.com
+SMTP host:                            zimbratest.example.com
+Web server HTTP port:                 80
+Web server HTTPS port:                443
+Web server mode:                      http
+IMAP server port:                     143
+IMAP server SSL port:                 993
+POP server port:                      110
+POP server SSL port:                  995
+Use spell check server:               yes
+Spell server URL:                     http://zimbratest.example.com:7780/aspell.php
+Configure for use with mail proxy:    FALSE
+Configure for use with web proxy:     FALSE
+Enable version update checks:         TRUE
+Enable version update notifications:  TRUE
+Version update notification email:    admin@zimbratest.example.com
+Version update source email:          admin@zimbratest.example.com

   4) zimbra-mta:                              Enabled
5) zimbra-snmp:                             Enabled
6) zimbra-logger:                           Enabled
7) zimbra-spell:                            Enabled
8) Default Class of Service Configuration:
r) Start servers after configuration        yes
s) Save config to file
x) Expand menu
q) Quit

Address unconfigured (**) items  (? - help) 3

Followed by 4. And type the admin password.

Store configuration

   1) Status:                                  Enabled
2) Create Admin User:                       yes
3) Admin user to create:                    admin@zimbratest.example.com
** 4) Admin Password                           UNSET
5) Anti-virus quarantine user:              virus-quarantine.kzpbrsgbx7@zimbratest.example.com
6) Enable automated spam training:          yes
7) Spam training user:                      spam.sd5fsqtdzi@zimbratest.example.com
8) Non-spam(Ham) training user:             ham.2qun60wc4@zimbratest.example.com
9) SMTP host:                               zimbratest.example.com
10) Web server HTTP port:                    80
11) Web server HTTPS port:                   443
12) Web server mode:                         http
13) IMAP server port:                        143
14) IMAP server SSL port:                    993
15) POP server port:                         110
16) POP server SSL port:                     995
17) Use spell check server:                  yes
18) Spell server URL:                        http://zimbratest.example.com:7780/aspell.php
19) Configure for use with mail proxy:       FALSE
20) Configure for use with web proxy:        FALSE
21) Enable version update checks:            TRUE
22) Enable version update notifications:     TRUE
23) Version update notification email:       admin@zimbratest.example.com
24) Version update source email:             admin@zimbratest.example.com

Select, or 'r' for previous menu [r] 4

Password for admin@zimbratest.example.com (min 6 characters): [7M_lgfdx3B] secret

Then press r to return to the main menu.

Store configuration

   1) Status:                                  Enabled
2) Create Admin User:                       yes
3) Admin user to create:                    admin@zimbratest.example.com
4) Admin Password                           set
5) Anti-virus quarantine user:              virus-quarantine.kzpbrsgbx7@zimbratest.example.com
6) Enable automated spam training:          yes
7) Spam training user:                      spam.sd5fsqtdzi@zimbratest.example.com
8) Non-spam(Ham) training user:             ham.2qun60wc4@zimbratest.example.com
9) SMTP host:                               zimbratest.example.com
10) Web server HTTP port:                    80
11) Web server HTTPS port:                   443
12) Web server mode:                         http
13) IMAP server port:                        143
14) IMAP server SSL port:                    993
15) POP server port:                         110
16) POP server SSL port:                     995
17) Use spell check server:                  yes
18) Spell server URL:                        http://zimbratest.example.com:7780/aspell.php
19) Configure for use with mail proxy:       FALSE
20) Configure for use with web proxy:        FALSE
21) Enable version update checks:            TRUE
22) Enable version update notifications:     TRUE
23) Version update notification email:       admin@zimbratest.example.com
24) Version update source email:             admin@zimbratest.example.com

Select, or 'r' for previous menu [r] r

And press a to apply the config. Afterwards, save the configuration data.

Main menu

   1) Common Configuration:
2) zimbra-ldap:                             Enabled
3) zimbra-store:                            Enabled
4) zimbra-mta:                              Enabled
5) zimbra-snmp:                             Enabled
6) zimbra-logger:                           Enabled
7) zimbra-spell:                            Enabled
8) Default Class of Service Configuration:
r) Start servers after configuration        yes
s) Save config to file
x) Expand menu
q) Quit

*** CONFIGURATION COMPLETE - press 'a' to apply
Select from menu, or press 'a' to apply config (? - help) a
Save configuration data to a file? [Yes]
Save config in file: [/opt/zimbra/config.11722]
Saving config in /opt/zimbra/config.11722...done.
The system will be modified - continue? [No] y

We need to wait the end of the process.

Operations logged to /tmp/zmsetup.04042011-131235.log
Setting local config values...done.
Setting up CA...done.
Deploying CA to /opt/zimbra/conf/ca ...done.
Creating SSL certificate...done.
Installing mailboxd SSL certificates...done.
Initializing ldap...done.
Setting replication password...done.
Setting Postfix password...done.
Setting amavis password...done.
Setting nginx password...done.
Creating server entry for zimbratest.example.com...done.
Saving CA in ldap ...done.
Saving SSL Certificate in ldap ...done.
Setting spell check URL...done.
Setting service ports on zimbratest.example.com...done.
Adding zimbratest.example.com to zimbraMailHostPool in default COS...done.
Installing webclient skins...
steel...done.
twilight...done.
pebble...done.
bare...done.
lemongrass...done.
beach...done.
sand...done.
sky...done.
carbon...done.
smoke...done.
lavender...done.
tree...done.
waves...done.
lake...done.
oasis...done.
bones...done.
hotrod...done.
Finished installing webclient skins.
Setting zimbraFeatureTasksEnabled=TRUE...done.
Setting zimbraFeatureBriefcasesEnabled=TRUE...done.
Setting MTA auth host...done.
Setting TimeZone Preference...done.
Initializing mta config...done.
Setting services on zimbratest.example.com...done.
Creating domain zimbratest.example.com...done.
Setting default domain name...done.
Creating domain zimbratest.example.com...already exists.
Creating admin account admin@zimbratest.example.com...done.
Creating root alias...done.
Creating postmaster alias...done.
Creating user spam.sd5fsqtdzi@zimbratest.example.com...done.
Creating user ham.2qun60wc4@zimbratest.example.com...done.
Creating user virus-quarantine.kzpbrsgbx7@zimbratest.example.com...done.
Setting spam training and Anti-virus quarantine accounts...done.
Initializing store sql database...done.
Setting zimbraSmtpHostname for zimbratest.example.com...done.
Configuring SNMP...done.
Checking for default IM conference room...not present.
Initializing default IM conference room...done.
Setting up syslog.conf...done.

You have the option of notifying Zimbra of your installation.
This helps us to track the uptake of the Zimbra Collaboration Suite.
The only information that will be transmitted is:
The VERSION of zcs installed (7.0.1_GA_3105_CentOS5_64)
The ADMIN EMAIL ADDRESS created (admin@zimbratest.example.com)

Notify Zimbra of your installation? [Yes] no
Notification skipped
Starting servers...done.
Installing common zimlets...
com_zimbra_bulkprovision...done.
com_zimbra_phone...done.
com_zimbra_attachmail...done.
com_zimbra_linkedin...done.
com_zimbra_srchhighlighter...done.
com_zimbra_attachcontacts...done.
com_zimbra_adminversioncheck...done.
com_zimbra_url...done.
com_zimbra_cert_manager...done.
com_zimbra_date...done.
com_zimbra_email...done.
com_zimbra_webex...done.
com_zimbra_dnd...done.
com_zimbra_social...done.
Finished installing common zimlets.
Restarting mailboxd...done.
Setting up zimbra crontab...done.

Moving /tmp/zmsetup.04042011-131235.log to /opt/zimbra/log

Configuration complete - press return to exit

First, we need to access the admin console:

https://zimbratest.example.com:7071

or directly by IP:

https://10.0.0.234:7071

PS: You will need to accept the SSL cert.

 

To log in, the user is admin and the password used in the installation script.

Use the admin console to configure the server.

To use the webclient, just point your browser to:

http://zimbratest.example.com

or directly by IP:

http://10.0.0.234

Zimbra Docs: http://www.zimbra.com/support/documentation/

View the original article here

The Perfect Server - CentOS 5.6 x86_64 [ISPConfig 2]

This tutorial shows how to set up a CentOS 5.6 server (x86_64) that offers all services needed by ISPs and web hosters: Apache web server (SSL-capable), Postfix mail server with SMTP-AUTH and TLS, BIND DNS server, Proftpd FTP server, MySQL server, Dovecot POP3/IMAP, Quota, Firewall, etc. This tutorial is written for the 64-bit version of CentOS 5.6, but should apply to the 32-bit version with very little modifications as well. In the end you should have a system that works reliably, and if you like you can install the free webhosting control panel ISPConfig 2 (i.e., ISPConfig runs on it out of the box).

I will use the following software:

Web Server: Apache 2.2 with PHP 5.1.6 Database Server: MySQL 5.0 Mail Server: PostfixDNS Server: BIND9 (chrooted) FTP Server: ProftpdPOP3/IMAP server: DovecotWebalizer for web site statistics

Please note that this setup does not work for ISPConfig 3! It is valid for ISPConfig 2 only!

I want to say first that this is not the only way of setting up such a system. There are many ways of achieving this goal but this is the way I take. I do not issue any guarantee that this will work for you!

To install such a system you will need the following:

In this tutorial I use the hostname server1.example.com with the IP address 192.168.0.100 and the gateway 192.168.0.1. These settings might differ for you, so you have to replace them where appropriate.

Boot from your first CentOS 5.6 CD (CD 1) or the first CentOS 5.6 DVD. Press at the boot prompt:

 It can take a long time to test the installation media so we skip this test here:

 

The welcome screen of the CentOS installer appears. Click on Next:

 

Choose your language next:

 Select your keyboard layout:

 I'm installing CentOS 5.6 on a fresh system, so I answer Yes to the question Would you like to initialize this drive, erasing ALL DATA?

 Now we must select a partitioning scheme for our installation. For simplicity's sake I select Remove linux partitions on selected drives and create default layout. This will result in a small /boot and a large / partition as well as a swap partition. Of course, you're free to partition your hard drive however you like it. Then I hit Next:

 Answer the following question (Are you sure you want to do this?) with Yes:

 On to the network settings. The default setting here is to configure the network interfaces with DHCP, but we are installing a server, so static IP addresses are not a bad idea... Click on the Edit button at the top right.

In the window that pops up uncheck Dynamic IP configuration (DHCP) and Enable IPv6 support and give your network card a static IP address (in this tutorial I'm using the IP address 192.168.0.100 for demonstration purposes) and a suitable netmask (e.g. 255.255.255.0; if you are not sure about the right values, http://www.subnetmask.info might help you):

Set the hostname manually, e.g. server1.example.com, and enter a gateway (e.g. 192.168.0.1) and up to two DNS servers (e.g. 8.8.8.8 and 145.253.2.75):  

Choose your time zone Give root a password:

 The Perfect Server - CentOS 5.6 x86_64 [ISPConfig 2] - Page 2

View the original article here

Installing And Using OpenVZ On CentOS 5.6

In this HowTo I will describe how to prepare a CentOS 5.6 server for OpenVZ. With OpenVZ you can create multiple Virtual Private Servers (VPS) on the same hardware, similar to Xen and the Linux Vserver project. OpenVZ is the open-source branch of Virtuozzo, a commercial virtualization solution used by many providers that offer virtual servers. The OpenVZ kernel patch is licensed under the GPL license, and the user-level tools are under the QPL license.

This howto is meant as a practical guide; it does not cover the theoretical backgrounds. They are treated in a lot of other documents in the web.

This document comes without warranty of any kind! I want to say that this is not the only way of setting up such a system. There are many ways of achieving this goal but this is the way I take. I do not issue any guarantee that this will work for you!

In order to install OpenVZ, we need to add the OpenVZ repository to yum:

cd /etc/yum.repos.d
wget http://download.openvz.org/openvz.repo
rpm --import http://download.openvz.org/RPM-GPG-Key-OpenVZ

The repository contains a few different OpenVZ kernels (you can find more details about them here: http://wiki.openvz.org/Kernel_flavors). The command

yum search ovzkernel

shows you the available kernels:

[root@server1 yum.repos.d]# yum search ovzkernel
...
ovzkernel.i686 : Virtuozzo Linux kernel (the core of the Linux operating system)
ovzkernel.x86_64 : Virtuozzo Linux kernel (the core of the Linux operating system)
ovzkernel-PAE.i686 : The Linux kernel compiled for PAE capable machines.
ovzkernel-PAE-debug.i686 : The Linux PAE kernel compiled with debug config
ovzkernel-PAE-devel.i686 : Development package for building kernel modules to match the PAE kernel.
ovzkernel-debug.i686 : The Linux kernel compiled with debug config
ovzkernel-debug.x86_64 : The Linux kernel compiled with debug config
ovzkernel-devel.i686 : Development package for building kernel modules to match the kernel.
ovzkernel-devel.x86_64 : Development package for building kernel modules to match the kernel.
ovzkernel-ent.i686 : The Linux kernel compiled for huge mem capable machines.
ovzkernel-ent-debug.i686 : The Linux ent kernel compiled with debug config
ovzkernel-ent-devel.i686 : Development package for building kernel modules to match the ent kernel.
ovzkernel-xen.i686 : The Linux kernel compiled for Xen VM operations
ovzkernel-xen.x86_64 : The Linux kernel compiled for Xen VM operations
ovzkernel-xen-devel.i686 : Development package for building kernel modules to match the kernel.
ovzkernel-xen-devel.x86_64 : Development package for building kernel modules to match the kernel.
[root@server1 yum.repos.d]#

Pick one of them and install it as follows:

yum install ovzkernel

This should automatically update the GRUB bootloader as well. Anyway, we should open /boot/grub/menu.lst; the first kernel stanza should now contain the new OpenVZ kernel. The title of that kernel just reads "CentOS". I think it's a good idea to change that title and add something with "OpenVZ" to it so that you know that it's the OpenVZ kernel. Also make sure that the value of default is 0 so that the first kernel (the OpenVZ kernel) is booted automatically instead of the default CentOS kernel.

vi /boot/grub/menu.lst

# grub.conf generated by anaconda## Note that you do not have to rerun grub after making changes to this file# NOTICE: You have a /boot partition. This means that# all kernel and initrd paths are relative to /boot/, eg.# root (hd0,0)# kernel /vmlinuz-version ro root=/dev/VolGroup00/LogVol00# initrd /initrd-version.img#boot=/dev/sdadefault=0timeout=5splashimage=(hd0,0)/grub/splash.xpm.gzhiddenmenutitle CentOS OpenVZ (2.6.18-238.5.1.el5.028stab085.5) root (hd0,0) kernel /vmlinuz-2.6.18-238.5.1.el5.028stab085.5 ro root=/dev/VolGroup00/LogVol00 initrd /initrd-2.6.18-238.5.1.el5.028stab085.5.imgtitle CentOS (2.6.18-238.el5) root (hd0,0) kernel /vmlinuz-2.6.18-238.el5 ro root=/dev/VolGroup00/LogVol00 initrd /initrd-2.6.18-238.el5.img

Now we install some OpenVZ user tools:

yum install vzctl vzquota

Open /etc/sysctl.conf and make sure that you have the following settings in it:

vi /etc/sysctl.conf

[...]net.ipv4.ip_forward = 1net.ipv4.conf.default.proxy_arp = 0net.ipv4.conf.all.rp_filter = 1kernel.sysrq = 1net.ipv4.conf.default.send_redirects = 1net.ipv4.conf.all.send_redirects = 0net.ipv4.icmp_echo_ignore_broadcasts=1net.ipv4.conf.default.forwarding=1[...]

If you need to modify /etc/sysctl.conf, run

sysctl -p

afterwards.

The following step is important if the IP addresses of your virtual machines are from a different subnet than the host system's IP address. If you don't do this, networking will not work in the virtual machines!

Open /etc/vz/vz.conf and set NEIGHBOUR_DEVS to all:

vi /etc/vz/vz.conf

[...]NEIGHBOUR_DEVS=all[...]

SELinux needs to be disabled if you want to use OpenVZ. Open /etc/sysconfig/selinux and set the value of SELINUX to disabled:

vi /etc/sysconfig/selinux

# This file controls the state of SELinux on the system.# SELINUX= can take one of these three values:# enforcing - SELinux security policy is enforced.# permissive - SELinux prints warnings instead of enforcing.# disabled - SELinux is fully disabled.SELINUX=disabled# SELINUXTYPE= type of policy in use. Possible values are:# targeted - Only targeted network daemons are protected.# strict - Full SELinux protection.SELINUXTYPE=targeted

Finally, reboot the system:

reboot

If your system reboots without problems, then everything is fine!

Run

uname -r

and your new OpenVZ kernel should show up:

[root@server1 ~]# uname -r
2.6.18-238.5.1.el5.028stab085.5
[root@server1 ~]#

Installing And Using OpenVZ On CentOS 5.6 - Page 2

View the original article here