Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
tutorial:adm:server_preparation_tmp [2020/03/12 11:40] urbanl [INSTALACTNI NAVOD] |
tutorial:adm:server_preparation_tmp [2020/07/24 08:14] fiserp [Database server installation - CentOS8] |
||
---|---|---|---|
Line 1: | Line 1: | ||
- | <note important> | + | <note important> |
+ | |||
+ | **This tutorial is under development, | ||
Author: Ludek Urban | Author: Ludek Urban | ||
Line 5: | Line 7: | ||
- | ====== Server preparation - Linux ====== | + | ====== Server preparation - Linux - CentOS8 |
{{tag> | {{tag> | ||
- | This tutorial shows how to prepare the server for test or production | + | This tutorial shows how to prepare the server for test or production |
===== Basic system setup ===== | ===== Basic system setup ===== | ||
- | * 1 server (can be virtualized) for all: backend, frontend and database. | + | * 1 server (can be virtualized) for everything: backend, frontend and database. |
- | * OS Linux with EPEL repository enabled - CENTOS, basic network enabled installation | + | * OS Linux with EPEL repository enabled - CentOS, basic network enabled installation |
- | * It is possible to use Debian but you have to adjust | + | * It is possible to use Debian |
- | * PostgreSQL - installed from a new repository | + | * PostgreSQL |
- | * Java - distribution repository (OpenJDK 1.8) | + | * Java 11 - installed from OS packages. |
- | * Apache Tomcat - manually | + | * Apache Tomcat |
- | * Services | + | * Apache HTTPd 2.4.x - installed from OS packages. Can be replaced by nGinx. |
- | * Services run under dedicated | + | * All services |
+ | * Each service runs under dedicated non-privileged | ||
===== Instalation and software configuration ===== | ===== Instalation and software configuration ===== | ||
- | Prerequisities - Basic installation of CentOS | + | Prerequisities - Basic installation of CentOS |
<code bash> | <code bash> | ||
# EPEL installation | # EPEL installation | ||
- | yum clean all | + | dnf clean all |
- | yum install | + | dnf -y install |
- | yum update -y | + | dnf update -y |
# other recommended packages installation | # other recommended packages installation | ||
- | yum install | + | dnf -y install mc haveged nmap screen sysstat telnet |
# enable haveged after OS start | # enable haveged after OS start | ||
systemctl start haveged.service | systemctl start haveged.service | ||
systemctl enable haveged.service | systemctl enable haveged.service | ||
- | # remove unnecessary software | + | |
- | yum remove -y postfix | + | |
- | systemctl stop avahi-daemon.socket avahi-daemon.service | + | |
- | systemctl disable avahi-daemon.socket avahi-daemon.service | + | |
- | yum remove -y avahi-autoipd avahi | + | |
# set the hostname | # set the hostname | ||
hostnamectl set-hostname FQDN_server_name | hostnamectl set-hostname FQDN_server_name | ||
Line 45: | Line 45: | ||
</ | </ | ||
- | -!CHANGED | + | ===== PostgreSQL |
- | When installing to centos8, check and install these packages: | + | <note tip>If you are installing |
- | < | + | We install |
- | # check installed packages. It's recommanded to have them installed. | + | ==== Database server installation - CentOS8 ==== |
- | yum list installed | + | |
- | # other recommended packages installation | + | |
- | yum install -y mc haveged nmap screen sysstat telnet | + | |
- | </ | + | |
- | + | ||
- | When installing on Debian, install these packages: | + | |
- | < | + | |
- | screen dnsutils sysstat lsof haveged nmap tcpdump traceroute tcptraceroute curl iptables-persistent | + | |
- | </ | + | |
- | ===== PostgreSQL | + | |
- | <note tip>If you are install | + | |
- | CentOS8 default repository version of PostgreSQL | + | |
- | ==== Database server installation - CentOS8 | + | |
* Software installation on CentOS8(versions can vary): | * Software installation on CentOS8(versions can vary): | ||
<code bash> | <code bash> | ||
# enable module postgres 12 | # enable module postgres 12 | ||
- | yum module enable postgresql: | + | dnf module enable postgresql: |
- | yum install | + | dnf -y install |
</ | </ | ||
- | * create new system | + | * create new directory |
<code bash> | <code bash> | ||
- | mkdir -p / | ||
mkdir -p / | mkdir -p / | ||
chown -R postgres: | chown -R postgres: | ||
Line 79: | Line 65: | ||
</ | </ | ||
- | * Copy of the configuration file for systemd, in which we will make change of directory for data: | + | * Copy the PostgreSQL' |
<code bash> | <code bash> | ||
Line 91: | Line 77: | ||
</ | </ | ||
- | * In the file '' | + | * In the file '' |
< | < | ||
Line 113: | Line 99: | ||
Change SELINUX labels: | Change SELINUX labels: | ||
< | < | ||
- | chcon -Rt postgresql_db_t pgsql/ | + | chcon -Rt postgresql_db_t |
chcon -Rt postgresql_log_t / | chcon -Rt postgresql_log_t / | ||
</ | </ | ||
Line 155: | Line 141: | ||
</ | </ | ||
- | ==== Database server installation - Debian Stretch ==== | + | |
- | Install the database from OS packages: | + | ==== DB server configuration ==== |
- | < | + | |
- | apt-get install postgresql-9.6 | + | |
- | </ | + | |
- | We will move the database - create directory structure: | + | |
- | < | + | |
- | mkdir -p / | + | |
- | chown -R postgres: | + | |
- | chmod -R 700 / | + | |
- | </ | + | |
- | Create the file .bash\_profile in postgres user's home (default / | + | |
- | < | + | |
- | PGDATA=/ | + | |
- | </ | + | |
- | Stop the database: | + | |
- | < | + | |
- | systemctl stop postgresql | + | |
- | </ | + | |
- | Move database directory (run this as root): | + | |
- | < | + | |
- | mv / | + | |
- | </ | + | |
- | In the PostgreSQL configuration file / | + | |
- | < | + | |
- | data_directory = '/ | + | |
- | </ | + | |
- | Enable and start the database: | + | |
- | < | + | |
- | systemctl start postgresql | + | |
- | systemctl enable postgresql | + | |
- | </ | + | |
- | ==== DB server configuration | + | |
First of all, enable the password authentication. | First of all, enable the password authentication. | ||
Line 224: | Line 179: | ||
Restart DB: '' | Restart DB: '' | ||
- | |||
- | For Debian installation, | ||
- | < | ||
- | / | ||
- | / | ||
- | </ | ||
< | < | ||
- | ===== Java - CentOS8 | + | ===== Java - CentOS8 ===== |
Java must be installed before Tomcat start. It is recommended to use OpenJDK (at least 1.11) from standard OS repository. | Java must be installed before Tomcat start. It is recommended to use OpenJDK (at least 1.11) from standard OS repository. | ||
Line 247: | Line 196: | ||
</ | </ | ||
- | ===== Java - Debian ===== | ||
- | |||
- | Java must be installed before Tomcat start. It is recommended to use OpenJDK (at least 1.8) from standard OS repository. | ||
- | |||
- | Installation: | ||
- | <code bash> | ||
- | apt-get install openjdk-8-jdk-headless openjdk-8-jre-headless | ||
- | </ | ||
- | |||
- | Then create the file ''/ | ||
- | <file bash java.sh> | ||
- | [ -d / | ||
- | </ | ||
===== Tomcat ===== | ===== Tomcat ===== | ||
- | * Create a new group and add user for the tomcat to run under (for Debian, use / | + | * Create a new group and add user for the tomcat to run under: |
< | < | ||
Line 269: | Line 205: | ||
useradd -r -s / | useradd -r -s / | ||
getent passwd tomcat | getent passwd tomcat | ||
- | tomcat: | + | #tomcat: |
</ | </ | ||
Line 351: | Line 287: | ||
* Tomcat will be started under user '' | * Tomcat will be started under user '' | ||
- | * For Debian, change the JAVA\_HOME to '' | ||
* After every systemd configuration change it is necessary to reload: | * After every systemd configuration change it is necessary to reload: | ||
Line 433: | Line 368: | ||
It is advised to follow these steps for production usage: | It is advised to follow these steps for production usage: | ||
- | * Remove unnecessary | + | * Remove unnecessary |
<code bash> | <code bash> | ||
Line 445: | Line 380: | ||
<Server port=" | <Server port=" | ||
</ | </ | ||
- | -! CHANGED | + | |
* Make Tomcat listen only on localhost: | * Make Tomcat listen only on localhost: | ||
* In the ''/ | * In the ''/ | ||
- | * In same file configure ajp port('' | ||
- | | + | * Set the '' |
+ | * In the ''/ | ||
+ | |||
+ | * In same file configure ajp port('' | ||
+ | |||
+ | < | ||
+ | < | ||
address=" | address=" | ||
secretRequired=" | secretRequired=" | ||
Line 456: | Line 396: | ||
port=" | port=" | ||
redirectPort=" | redirectPort=" | ||
+ | </ | ||
* Do not show aplication server version: | * Do not show aplication server version: | ||
Line 485: | Line 425: | ||
<file txt tomcat> | <file txt tomcat> | ||
/ | / | ||
- | rotate | + | rotate |
daily | daily | ||
dateext | dateext | ||
Line 509: | Line 449: | ||
* Adjust particular SELinux labels. Example ([[https:// | * Adjust particular SELinux labels. Example ([[https:// | ||
</ | </ | ||
- | |||
- | Please note that on Debian, the log is not rotate during the first day, but after the second day. | ||
Line 529: | Line 467: | ||
</ | </ | ||
- | On Debian install those packages and allow modules: | + | HTTPd basic configuration: |
- | < | + | |
- | apt-get install apache2 libapache2-mod-security2 modsecurity-crs | + | |
- | a2enmod ssl | + | |
- | a2enmod proxy | + | |
- | a2enmod proxy_ajp | + | |
- | a2enmod proxy_http | + | |
- | a2enmod security2 | + | |
- | a2enmod rewrite | + | |
- | a2enmod headers | + | |
- | </ | + | |
- | + | ||
- | HTTPd basic configuration | + | |
Change MPM to worker (lower system requirements) - in the file ''/ | Change MPM to worker (lower system requirements) - in the file ''/ | ||
Line 573: | Line 499: | ||
</ | </ | ||
- | Virtualhost configuration to forward the communication from port 80 to 443. Add following section and change string ' | + | Virtualhost configuration to forward the communication from port 80 to 443. Add following section and change string ' |
<code xml> | <code xml> | ||
< | < | ||
Line 581: | Line 507: | ||
</ | </ | ||
- | Set the proxy in the virtualhost for https (443/tcp) - at the end of the file ''/ | + | Set the proxy in the virtualhost for https (443/tcp) - at the end of the file ''/ |
< | < | ||
+ | Protocols | ||
ProxyRequests | ProxyRequests | ||
ProxyPreserveHost on | ProxyPreserveHost on | ||
ProxyAddHeaders on | ProxyAddHeaders on | ||
- | ProxyPass / ajp:// | + | ProxyPass / ajp:// |
- | ProxyPassReverse / ajp:// | + | ProxyPassReverse / ajp:// |
</ | </ | ||
Line 613: | Line 540: | ||
</ | </ | ||
< | < | ||
- | |||
- | On Debian, create symlinks to sites-enabled: | ||
- | < | ||
- | cd / | ||
- | ln -s ../ | ||
- | ln -s ../ | ||
- | </ | ||
Syntax check before httpd restart: | Syntax check before httpd restart: | ||
Line 631: | Line 551: | ||
</ | </ | ||
+ | Allow in SELINUX to httpd connect to network: | ||
+ | < | ||
+ | / | ||
+ | </ | ||
+ | |||
Enable httpd after OS start: | Enable httpd after OS start: | ||
<code bash> | <code bash> | ||
Line 637: | Line 562: | ||
===== mod_security configuration ===== | ===== mod_security configuration ===== | ||
- | Mod_security files locations (on CentOS7): | + | Mod_security files locations (on CentOS8): |
* Audit log: ''/ | * Audit log: ''/ | ||
* Directory with activated rules: ''/ | * Directory with activated rules: ''/ | ||
- | * basic configuration file for mod\_security: | + | * basic configuration file for mod\_security: |
* The file for chosen rules deactivation: | * The file for chosen rules deactivation: | ||
Line 656: | Line 581: | ||
==== Disabling mod_security rules ==== | ==== Disabling mod_security rules ==== | ||
- | In the file ''/ | + | These rules are disabled for modsec_crs 3.0. |
+ | |||
+ | In the file ''/ | ||
<code xml> | <code xml> | ||
< | < | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
+ | | ||
+ | | ||
# Allow Czech signs | # Allow Czech signs | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
| | ||
# Too restrictive for login format | # Too restrictive for login format | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
+ | |||
# Needed by Websockets | # Needed by Websockets | ||
< | < | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
</ | </ | ||
| | ||
- | # These break Certificate Authority module | ||
- | < | ||
- | SecRuleRemoveById 960915 | ||
- | SecRuleRemoveById 200003 | ||
- | </ | ||
- | |||
- | # Modsec can throw false positives on some files due to multipart boundary check | ||
- | < | ||
- | SecRuleRemoveById 960915 | ||
- | SecRuleRemoveById 200003 | ||
- | </ | ||
- | |||
# do not log request/ | # do not log request/ | ||
SecAuditLogParts ABFHZ | SecAuditLogParts ABFHZ | ||
Line 694: | Line 611: | ||
</ | </ | ||
- | ==== mod_security configuration - CentOS7 | + | ==== mod_security configuration - CentOS8 |
- | In the file / | + | In the file / |
- | Whole rule after the changes looks like this: | + | |
+ | * find the rule 900200 | ||
< | < | ||
- | SecAction | + | # Default HTTP policy: allowed_methods (rule 900200) |
- | "id:' | + | SecRule & |
- | phase:1, \ | + | "id:901160,\ |
- | | + | phase:1,\ |
- | setvar:' | + | pass,\ |
- | setvar:' | + | |
- | setvar:' | + | |
- | setvar:' | + | |
- | setvar:' | + | |
- | nolog, \ | + | |
- | pass" | + | |
</ | </ | ||
- | ==== mod_security configuration - Debian ==== | + | * find the rule 900220 and add support for content\_type=application/json, application/hal+json and text/plain on the line starting with tx.allowed\_request\_content\_type, |
- | Enable mod\_security configuration: | + | |
- | < | + | |
- | cd /etc/modsecurity | + | |
- | cp modsecurity.conf-recommended modsecurity.conf | + | |
- | </ | + | |
- | Uncomment following rules in the ''/ | ||
< | < | ||
- | SecAction \ | + | # Default HTTP policy: allowed_request_content_type (rule 900220) |
- | " | + | SecRule &TX:allowed_request_content_type "@eq 0" \ |
- | phase:1,\ | + | "id:901162,\ |
- | nolog,\ | + | phase:1,\ |
- | pass,\ | + | pass,\ |
- | t:none,\ | + | nolog,\ |
- | setvar:' | + | setvar:' |
- | + | ||
- | SecAction | + | |
- | " | + | |
- | phase:1,\ | + | |
- | | + | |
- | | + | |
- | | + | |
- | setvar:' | + | |
</ | </ | ||
Line 778: | Line 678: | ||
</ | </ | ||
- | ===== Workaround for slow HTTPD shutdown ===== | ||
- | In some RHEL/CentOS versions Apache HTTPD shutsdown or restarts itself very slowly. It is caused by [[https:// | ||
- | Workaround is to edit '''/ | ||
- | < | ||
- | KillMode=none | ||
- | </ | ||
- | Then reload systemd: | ||
- | < | ||
- | systemctl daemon-reload | ||
- | </ | ||
- | |||
- | It is absolutely correct to create new versions of unity in /etc, that has the option: | ||
- | |||
- | < | ||
- | cp / | ||
- | vim / | ||
- | systemctl daemon-reload | ||
- | </ | ||
- | |||
- | The patch of httpd should come soon so the first option is OK too. | ||
- | |||
- | ===== SSO ===== | ||
- | |||
- | If you want to enable SSO to CzechIdM, additional configuration must be done with mod\_auth\_kerb. See [[tutorial: | ||
- | |||
- | ====== INSTALACTNI NAVOD ====== | ||
- | |||
- | <note important> | ||
- | ==== 2. JDBC driver installation - CentOS8 ==== | ||
- | **CentOS** | ||
- | |||
- | Install the package with PostgreSQL JDBC driver: | ||
- | |||
- | <code bash> | ||
- | yum install -y postgresql-jdbc | ||
- | </ | ||
- | |||
- | allow Tomcat to use the driver: | ||
- | |||
- | <code bash> | ||
- | ln -s / | ||
- | </ | ||
- | |||
- | ==== Application properties ==== | ||
- | |||
- | * The most important file is **/ | ||
- | |||
- | <file properties application-production.properties> | ||
- | # Doc: https:// | ||
- | |||
- | idm.pub.app.instanceId=idm-primary | ||
- | idm.pub.app.stage=production | ||
- | |||
- | spring.datasource.url=jdbc: | ||
- | spring.datasource.username=czechidm | ||
- | spring.datasource.password=********** TODO ********* | ||
- | spring.datasource.driver-class-name=org.postgresql.Driver | ||
- | spring.datasource.validationQuery=SELECT 1 | ||
- | spring.datasource.test-on-borrow=true | ||
- | spring.jpa.generate-ddl=false | ||
- | spring.jpa.hibernate.ddl-auto=none | ||
- | flyway.enabled=true | ||
- | |||
- | |||
- | scheduler.properties.location=quartz-production.properties | ||
- | |||
- | logging.config=/ | ||
- | |||
- | idm.sec.core.demo.data.enabled=false | ||
- | |||
- | # attachments will be stored under this path. | ||
- | # new directories for attachment will be created in this folder (permissions has to be added) | ||
- | # System.getProperty(" | ||
- | idm.sec.core.attachment.storagePath=/ | ||
- | # configuration property for default backup | ||
- | idm.sec.core.backups.default.folder.path=/ | ||
- | |||
- | |||
- | idm.pub.security.allowed-origins=http:// | ||
- | # Generate JWT token security string as "cat / | ||
- | # We recommend the VALUE to be at least 25. | ||
- | idm.sec.security.jwt.secret.token=********** TODO ********* | ||
- | idm.sec.security.jwt.expirationTimeout=36000000 | ||
- | |||
- | # Cipher secret key for crypt values in confidential storage | ||
- | # for crypt values is used secretKey or secretKey defined by file - secretKeyPath | ||
- | # | ||
- | cipher.crypt.secret.keyPath=/ | ||
- | |||
- | # Defaults for: emailer.* | ||
- | # test.enabled=true means mail WILL NOT be sent | ||
- | idm.sec.core.emailer.test.enabled=true | ||
- | # http:// | ||
- | idm.sec.core.emailer.protocol=smtp | ||
- | idm.sec.core.emailer.host=something.tld | ||
- | idm.sec.core.emailer.port=25 | ||
- | # idm.sec.core.emailer.username=czechidm@domain.tld | ||
- | # idm.sec.core.emailer.password=password | ||
- | idm.sec.core.emailer.from=czechidm@localhost | ||
- | |||
- | # Default user role will be added automatically, | ||
- | # could contains default authorities and authority policies configuration | ||
- | # for adding autocomplete or all record read permission etc. | ||
- | idm.sec.core.role.default=userRole | ||
- | # Admin user role | ||
- | idm.sec.core.role.admin=superAdminRole | ||
- | |||
- | # Max file size of uploaded file. Values can use the suffixed " | ||
- | spring.servlet.multipart.max-file-size=100MB | ||
- | spring.servlet.multipart.max-request-size=100MB | ||
- | </ | ||
- | |||
- | |||
- | |||
- |