Virtual Domain Configuration
Virtual Domain Configuration
Virtual Domain Configuration
Enter the hostname. In this example, my system is called server1.example.com, so I enter server1:
Now you have to partition your hard disk. For simplicity's sake I select Guided - use entire disk
and set up LVM - this will create one volume group with two logical volumes, one for the / file
system and another one for swap (of course, the partitioning is totally up to you - if you know what
you're doing, you can also set up your partitions manually).
Select the disk that you want to partition:
When you're asked Write the changes to disks and configure LVM?, select Yes:
If you have selected Guided - use entire disk and set up LVM, the partitioner will create one big
volume group that uses all the disk space. You can now specify how much of that disk space should be
used by the logical volumes for / and swap. It makes sense to leave some space unused so that you
can later on expand your existing logical volumes or create new ones - this gives you more flexibility.
When you're finished, hit Yes when you're asked Write the changes to disks?:
Afterwards, your new partitions are being created and formatted:
The base system installation is now finished. Remove the installation CD from the CD drive and hit
Continue to reboot the system:
sudo su
and giving root a password. You can then directly log in as root, but this is frowned upon by the
Ubuntu developers and community for various reasons. See
http://ubuntuforums.org/showthread.php?t=765414.)
From now on you can use an SSH client such as PuTTY and connect from your workstation to your
Ubuntu 9.10 server and follow the remaining steps from this tutorial.
(You don't have to do this if you use a different text editor such as joe or nano.)
vi /etc/network/interfaces
/etc/init.d/networking restart
vi /etc/hosts
127.0.0.1 localhost.localdomain localhost
192.168.0.100 server1.example.com server1
reboot
Afterwards, run
hostname
hostname -f
vi /etc/apt/sources.list
#
# deb cdrom:[Ubuntu-Server 9.10 _Karmic Koala_ - Release
amd64 (20091027.2)]/ karmic main restricted
aptitude update
aptitude safe-upgrade
to install the latest updates (if there are any). If you see that a new kernel gets installed as part of the
updates, you should reboot the system afterwards:
reboot
dpkg-reconfigure dash
10 Disable AppArmor
AppArmor is a security extension (similar to SELinux) that should provide extended security. In my
opinion you don't need it to configure a secure system, and it usually causes more problems than
advantages (think of it after you have done a week of trouble-shooting because some service wasn't
working as expected, and then you find out that everything was ok, only AppArmor was causing the
problem). Therefore I disable it (this is a must if you want to install ISPConfig later on).
/etc/init.d/apparmor stop
update-rc.d -f apparmor remove
aptitude remove apparmor apparmor-utils
We can install Postfix, Courier, Saslauthd, MySQL, rkhunter, and binutils with a single command:
You will ask yourself why we didn't install maildrop together with all the other packages. The reason
for this is a bug in the courier-base package - if you install maildrop together with courier-pop,
courier-pop-ssl, courier-imap, and courier-imap-ssl, you will get the following error:
We want MySQL to listen on all interfaces, not just localhost, therefore we edit /etc/mysql/my.cnf
and comment out the line bind-address = 127.0.0.1:
vi /etc/mysql/my.cnf
[...]
# Instead of skip-networking the default is now to listen
only on
# localhost which is more compatible and is not less
secure.
#bind-address = 127.0.0.1
[...]
Then we restart MySQL:
/etc/init.d/mysql restart
During the installation, the SSL certificates for IMAP-SSL and POP3-SSL are created with the
hostname localhost. To change this to the correct hostname (server1.example.com in this tutorial),
delete the certificates...
cd /etc/courier
rm -f /etc/courier/imapd.pem
rm -f /etc/courier/pop3d.pem
... and modify the following two files; replace CN=localhost with CN=server1.example.com (you can
also modify the other values, if necessary):
vi /etc/courier/imapd.cnf
[...]
CN=server1.example.com
[...]
vi /etc/courier/pop3d.cnf
[...]
CN=server1.example.com
[...]
Then recreate the certificates...
mkimapdcert
mkpop3dcert
/etc/init.d/courier-imap-ssl restart
/etc/init.d/courier-pop-ssl restart
Then run the following command to enable the Apache modules suexec, rewrite, ssl, actions, and
include:
/etc/init.d/apache2 restart
vi /etc/default/pure-ftpd-common
... and make sure that the start mode is set to standalone and set VIRTUALCHROOT=true:
[...]
STANDALONE_OR_INETD=standalone
[...]
VIRTUALCHROOT=true
[...]
Then restart PureFTPd:
/etc/init.d/pure-ftpd-mysql restart
vi /etc/fstab
quotacheck -avugm
quotaon -avug
16 Install MyDNS
Before we install MyDNS, we need to install a few prerequisites:
MyDNS is not available in the Ubuntu 9.10 repositories, therefore we have to build it ourselves as
follows:
cd /tmp
wget http://heanet.dl.sourceforge.net/sourceforge/mydns-ng/mydns-1.2.8.27.tar.gz
tar xvfz mydns-1.2.8.27.tar.gz
cd mydns-1.2.8
./configure
make
make install
vi /etc/init.d/mydns
#! /bin/sh
#
# mydns Start the MyDNS server
#
# Author: Philipp Kern <phil@philkern.de>.
# Based upon skeleton 1.9.4 by Miquel van
Smoorenburg
# <miquels@cistron.nl> and Ian Murdock
<imurdock@gnu.ai.mit.edu>.
#
set -e
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/
usr/bin
DAEMON=/usr/local/sbin/mydns
NAME=mydns
DESC="DNS server"
SCRIPTNAME=/etc/init.d/$NAME
case "$1" in
start)
echo -n "Starting $DESC: $NAME"
start-stop-daemon --start --quiet \
--exec $DAEMON -- -b
echo "."
;;
stop)
echo -n "Stopping $DESC: $NAME"
start-stop-daemon --stop --oknodo --quiet \
--exec $DAEMON
echo "."
;;
reload|force-reload)
echo -n "Reloading $DESC configuration..."
start-stop-daemon --stop --signal HUP --quiet \
--exec $DAEMON
echo "done."
;;
restart)
echo -n "Restarting $DESC: $NAME"
start-stop-daemon --stop --quiet --oknodo \
--exec $DAEMON
sleep 1
start-stop-daemon --start --quiet \
--exec $DAEMON -- -b
echo "."
;;
*)
echo "Usage: $SCRIPTNAME {start|stop|restart|
reload|force-reload}" >&2
exit 1
;;
esac
exit 0
Then we make the script executable and create the system startup links for it:
chmod +x /etc/init.d/mydns
update-rc.d mydns defaults
17 Install Vlogger And Webalizer
Vlogger and webalizer can be installed as follows:
18 Install Jailkit
Jailkit is needed only if you want to chroot SSH users. It can be installed as follows (important: Jailkit
must be installed before ISPConfig - it cannot be installed afterwards!):
cd /tmp
wget http://olivier.sessink.nl/jailkit/jailkit-2.10.tar.gz
tar xvfz jailkit-2.10.tar.gz
cd jailkit-2.10
./configure
make
make install
cd ..
rm -rf jailkit-2.10*
19 Install fail2ban
This is optional but recommended, because the ISPConfig monitor tries to show the fail2ban log:
20 Install SquirrelMail
To install the SquirrelMail webmail client, run
squirrelmail-configure
C Turn color on
S Save data
Q Quit
Command >> <-- D
SquirrelMail Configuration : Read: config.php
---------------------------------------------------------
While we have been building SquirrelMail, we have discovered some
preferences that work better with some servers that don't work so
well with others. If you select your IMAP server, this option will
set some pre-defined settings for that server.
Please select your IMAP server:
bincimap = Binc IMAP server
courier = Courier IMAP server
cyrus = Cyrus IMAP server
dovecot = Dovecot Secure IMAP server
exchange = Microsoft Exchange IMAP server
hmailserver = hMailServer
macosx = Mac OS X Mailserver
mercury32 = Mercury/32
uw = University of Washington's IMAP server
SquirrelMail Configuration : Read: config.php
---------------------------------------------------------
While we have been building SquirrelMail, we have discovered some
preferences that work better with some servers that don't work so
well with others. If you select your IMAP server, this option will
set some pre-defined settings for that server.
Please select your IMAP server:
bincimap = Binc IMAP server
courier = Courier IMAP server
cyrus = Cyrus IMAP server
dovecot = Dovecot Secure IMAP server
exchange = Microsoft Exchange IMAP server
hmailserver = hMailServer
macosx = Mac OS X Mailserver
mercury32 = Mercury/32
uw = University of Washington's IMAP server
imap_server_type = courier
default_folder_prefix = INBOX.
trash_folder = Trash
sent_folder = Sent
draft_folder = Drafts
show_prefix_option = false
default_sub_of_inbox = false
show_contain_subfolders_option = false
optional_delimiter = .
delete_folder = true
Press any key to continue... <-- ENTER
C Turn color on
S Save data
Q Quit
Command >> <-- S
C Turn color on
S Save data
Q Quit
Command >> S
Data saved in config.php
Press enter to continue... <-- ENTER
C Turn color on
S Save data
Q Quit
Command >> <-- Q
21 Install ISPConfig 3
To install ISPConfig 3 from the latest released version, do this:
cd /tmp
wget http://downloads.sourceforge.net/ispconfig/ISPConfig-3.0.1.6.tar.gz?use_mirror=
tar xvfz ISPConfig-3.0.1.6.tar.gz
cd ispconfig3_install/install/
php -q install.php
root@server1:/tmp/ispconfig3_install/install# php -q install.php
--------------------------------------------------------------------------------
_____ ___________ _____ __ _
|_ _/ ___| ___ \ / __ \ / _(_)
| | \ `--.| |_/ / | / \/ ___ _ __ | |_ _ __ _
| | `--. \ __/ | | / _ \| '_ \| _| |/ _` |
_| |_/\__/ / | | \__/\ (_) | | | | | | | (_| |
\___/\____/\_| \____/\___/|_| |_|_| |_|\__, |
__/ |
|___/
--------------------------------------------------------------------------------
>> Initial configuration
Operating System: Debian or compatible, unknown version.
Select language (en,de) [en]: <-- ENTER
Installation mode (standard,expert) [standard]: <-- ENTER
MySQL root username [root]: <-- ENTER
MySQL root password []: <-- yourrootsqlpassword
MySQL charset [utf8]: <-- ENTER
Configuring DBServer
Installing Crontab
no crontab for root
no crontab for getmail
Restarting services ...
* Stopping MySQL database server mysqld
...done.
* Starting MySQL database server mysqld
...done.
* Checking for corrupt, not cleanly closed and upgrade needing tables.
* Stopping Postfix Mail Transport Agent postfix
...done.
* Starting Postfix Mail Transport Agent postfix
...done.
* Stopping SASL Authentication Daemon saslauthd
...done.
* Starting SASL Authentication Daemon saslauthd
...done.
Stopping amavisd: amavisd-new.
Starting amavisd: amavisd-new.
* Stopping ClamAV daemon clamd
...done.
* Starting ClamAV daemon clamd
LibClamAV Warning: ***********************************************************
LibClamAV Warning: *** This version of the ClamAV engine is outdated. ***
LibClamAV Warning: *** DON'T PANIC! Read http://www.clamav.net/support/faq ***
LibClamAV Warning: ***********************************************************
...done.
* Stopping Courier authentication services authdaemond
...done.
* Starting Courier authentication services authdaemond
...done.
* Stopping Courier IMAP server...
...done.
* Starting Courier IMAP server...
...done.
* Stopping Courier IMAP-SSL server...
...done.
* Starting Courier IMAP-SSL server...
...done.
* Stopping Courier POP3 server...
...done.
* Starting Courier POP3 server...
...done.
* Stopping Courier POP3-SSL server...
...done.
* Starting Courier POP3-SSL server...
...done.
* Restarting web server apache2
... waiting ...done.
Restarting ftp server: Running: /usr/sbin/pure-ftpd-mysql-virtualchroot -l mysql:/etc
/pure-ftpd/db/mysql.conf -l pam -A -b -O clf:/var/log/pure-ftpd/transfer.log -8 UTF-8
-u 1000 -E -B
Installation completed.
root@server1:/tmp/ispconfig3_install/install#
The installer automatically configures all underlying services, so no manual configuration is needed.