Differences
This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
tutorial:adm:server_preparation_tmp [2020/03/27 14:18] urbanl [Database server installation - CentOS8] |
tutorial:adm:server_preparation_tmp [2020/07/24 09:15] fiserp [Apache Tomcat configuration] |
||
---|---|---|---|
Line 1: | Line 1: | ||
<note important> | <note important> | ||
- | This tutorial is in development | + | **This tutorial is under development, DO NOT USE.** |
Author: Ludek Urban | Author: Ludek Urban | ||
Line 11: | Line 11: | ||
{{tag> | {{tag> | ||
- | This tutorial shows how to prepare the server for test or production | + | This tutorial shows how to prepare the server for test or production |
===== Basic system setup ===== | ===== Basic system setup ===== | ||
- | * 1 server (can be virtualized) for all: backend, frontend and database. | + | * 1 server (can be virtualized) for everything: backend, frontend and database. |
- | * OS Linux with EPEL repository enabled - CENTOS, basic network enabled installation | + | * OS Linux with EPEL repository enabled - CentOS, basic network enabled installation |
- | * It is possible to use Debian but you have to adjust | + | * It is possible to use Debian |
- | * PostgreSQL - installed from a new repository | + | * PostgreSQL |
- | * Java - distribution repository (OpenJDK 1.8) | + | * Java 11 - installed from OS packages. |
- | * Apache Tomcat - manually | + | * Apache Tomcat |
- | * Services | + | * Apache HTTPd 2.4.x - installed from OS packages. Can be replaced by nGinx. |
- | * Services run under dedicated | + | * All services |
+ | * Each service runs under dedicated non-privileged | ||
===== Instalation and software configuration ===== | ===== Instalation and software configuration ===== | ||
Prerequisities - Basic installation of CentOS 8 | Prerequisities - Basic installation of CentOS 8 | ||
<code bash> | <code bash> | ||
# EPEL installation | # EPEL installation | ||
- | yum clean all | + | dnf clean all |
- | yum install | + | dnf -y install |
- | yum update -y | + | dnf update -y |
# other recommended packages installation | # other recommended packages installation | ||
- | yum install | + | dnf -y install |
# enable haveged after OS start | # enable haveged after OS start | ||
systemctl start haveged.service | systemctl start haveged.service | ||
systemctl enable haveged.service | systemctl enable haveged.service | ||
- | # remove unnecessary software | + | |
- | yum remove -y postfix | + | |
- | systemctl stop avahi-daemon.socket avahi-daemon.service | + | |
- | systemctl disable avahi-daemon.socket avahi-daemon.service | + | |
- | yum remove -y avahi-autoipd avahi | + | |
# set the hostname | # set the hostname | ||
hostnamectl set-hostname FQDN_server_name | hostnamectl set-hostname FQDN_server_name | ||
Line 48: | Line 46: | ||
===== PostgreSQL | ===== PostgreSQL | ||
- | <note tip>If you are install | + | <note tip>If you are installing |
- | CentOS8 default repository version of PostgreSQL | + | We install |
==== Database server installation - CentOS8 ==== | ==== Database server installation - CentOS8 ==== | ||
* Software installation on CentOS8(versions can vary): | * Software installation on CentOS8(versions can vary): | ||
Line 55: | Line 53: | ||
<code bash> | <code bash> | ||
# enable module postgres 12 | # enable module postgres 12 | ||
- | yum module enable postgresql: | + | dnf module enable postgresql: |
- | yum install | + | dnf -y install |
</ | </ | ||
- | * create new system | + | * create new directory |
<code bash> | <code bash> | ||
- | mkdir -p / | ||
mkdir -p / | mkdir -p / | ||
chown -R postgres: | chown -R postgres: | ||
Line 68: | Line 65: | ||
</ | </ | ||
- | * Copy of the configuration file for systemd, in which we will make change of directory for data: | + | * Copy the PostgreSQL' |
<code bash> | <code bash> | ||
Line 80: | Line 77: | ||
</ | </ | ||
- | * In the file '' | + | * In the file '' |
< | < | ||
Line 97: | Line 94: | ||
<code bash> | <code bash> | ||
- | /usr/bin/postgresql-setup --initdb --unit postgresql | + | postgresql-setup --initdb --unit postgresql |
</ | </ | ||
Line 145: | Line 142: | ||
- | ==== DB server configuration ==== | + | ==== Database |
- | First of all, enable | + | * Enable |
In the file ''/ | In the file ''/ | ||
Line 154: | Line 151: | ||
host all | host all | ||
</ | </ | ||
- | + | and change the value at the end of each line to '' | |
- | and change the value at the end of each line into md5 like this: | + | |
< | < | ||
host all | host all | ||
Line 161: | Line 157: | ||
</ | </ | ||
- | Now we can do DB sizing. | + | * Adjust |
- | In a file ''/ | + | * In following snippet, we presume the system has 3GB of memory |
+ | * We also log queries running longer than 200ms. | ||
+ | In a file ''/ | ||
< | < | ||
- | max_connections = 100 # (change requires restart) | + | # This is an EXAMPLE. Use the calculator to adjust for your deployment! |
- | shared_buffers = 768MB # min 128kB | + | # DB Version: 12 |
+ | # OS Type: linux | ||
+ | # DB Type: web | ||
+ | # Total Memory (RAM): 3 GB | ||
+ | # Connections num: 100 | ||
+ | # Data Storage: ssd | ||
+ | max_connections = 100 | ||
+ | shared_buffers = 768MB | ||
effective_cache_size = 2304MB | effective_cache_size = 2304MB | ||
- | work_mem = 7864kB | ||
maintenance_work_mem = 192MB | maintenance_work_mem = 192MB | ||
- | |||
- | min_wal_size = 1GB | ||
- | max_wal_size = 2GB | ||
checkpoint_completion_target = 0.7 | checkpoint_completion_target = 0.7 | ||
wal_buffers = 16MB | wal_buffers = 16MB | ||
- | |||
default_statistics_target = 100 | default_statistics_target = 100 | ||
+ | random_page_cost = 1.1 | ||
+ | effective_io_concurrency = 200 | ||
+ | work_mem = 3932kB | ||
+ | min_wal_size = 1GB | ||
+ | max_wal_size = 4GB | ||
log_min_duration_statement = 200 | log_min_duration_statement = 200 | ||
</ | </ | ||
- | Restart | + | * Restart |
- | < | + | < |
+ | systemctl restart | ||
+ | </ | ||
+ | |||
+ | < | ||
===== Java - CentOS8 ===== | ===== Java - CentOS8 ===== | ||
- | Java must be installed | + | Tomcat application server needs Java installed. |
Installation: | Installation: | ||
- | < | + | < |
- | yum install -y java-11-openjdk-headless java-11-openjdk-devel | + | dnf install -y java-11-openjdk-headless java-11-openjdk-devel |
</ | </ | ||
- | |||
- | Then create the file ''/ | ||
- | <file bash java.sh> | ||
- | [ -d / | ||
- | </ | ||
Line 206: | Line 211: | ||
< | < | ||
groupadd -r tomcat | groupadd -r tomcat | ||
- | useradd -r -s /bin/nologin -g tomcat -d /opt/tomcat tomcat | + | useradd -r -s /usr/sbin/nologin -g tomcat -d /opt/tomcat tomcat |
getent passwd tomcat | getent passwd tomcat | ||
- | tomcat: | + | #tomcat: |
</ | </ | ||
Line 218: | Line 223: | ||
</ | </ | ||
- | * Download Apache Tomcat 8.5.x from the website [[https:// | + | * Download Apache Tomcat 8.5.x from the website [[https:// |
- | * In our exapmle the version is 8.5.8. | + | * In our exapmle the version is 8.5.57. |
- | * extract files from archive: | + | * extract files from the archive: |
<code bash> | <code bash> | ||
- | tar xzf apache-tomcat-8.5.8.tar.gz | + | tar xzf apache-tomcat-8.5.57.tar.gz |
</ | </ | ||
Line 231: | Line 236: | ||
<code bash> | <code bash> | ||
cd /opt/tomcat | cd /opt/tomcat | ||
- | ln -s apache-tomcat-8.5.8 current | + | ln -s apache-tomcat-8.5.57 current |
</ | </ | ||
Line 241: | Line 246: | ||
chmod 750 /opt/tomcat | chmod 750 /opt/tomcat | ||
cd / | cd / | ||
- | chmod o+rX -R ./ | + | chmod -R o+rX ./ |
chgrp -R tomcat conf/ bin/ lib/ | chgrp -R tomcat conf/ bin/ lib/ | ||
- | chmod g+rwx conf | + | chmod g+rx conf |
chmod g+r conf/* | chmod g+r conf/* | ||
chown -R tomcat webapps/ work/ temp/ logs/ | chown -R tomcat webapps/ work/ temp/ logs/ | ||
Line 263: | Line 268: | ||
[Unit] | [Unit] | ||
Description=Apache Tomcat Web Application Container | Description=Apache Tomcat Web Application Container | ||
- | After=syslog.target network.target | + | After=syslog.target network.target |
[Service] | [Service] | ||
Line 286: | Line 291: | ||
WantedBy=multi-user.target | WantedBy=multi-user.target | ||
</ | </ | ||
+ | < | ||
+ | * Values of '' | ||
+ | * Tomcat will be started under user '' | ||
+ | </ | ||
- | * Values of Xms a Xmx se are closely dependent on server sizing. If you have enough memory it is strongly advised to use Xmx 6128M or more. | + | * Reload |
- | + | ||
- | * Tomcat will be started under user '' | + | |
- | * After every systemd configuration | + | |
< | < | ||
systemctl daemon-reload | systemctl daemon-reload | ||
</ | </ | ||
- | | + | |
+ | | ||
< | < | ||
systemctl start tomcat | systemctl start tomcat | ||
+ | systemctl enable tomcat | ||
</ | </ | ||
+ | |||
* Check that Tomcat runs with desirable parameters: | * Check that Tomcat runs with desirable parameters: | ||
+ | |||
<code bash> | <code bash> | ||
- | [root@tomcat1 logs]# ps -u tomcat | + | [root@tomcat1 logs]# ps -ef | grep ^tomcat |
- | UID PID PPID C STIME TTY TIME CMD | + | tomcat |
- | tomcat | + | |
</ | </ | ||
- | | + | |
+ | | ||
< | < | ||
systemctl stop tomcat | systemctl stop tomcat | ||
- | </ | ||
- | * Enable tomcat start after OS start: | ||
- | <code bash> | ||
- | systemctl enable tomcat | ||
</ | </ | ||
Line 325: | Line 333: | ||
If you want to use them, it is necessary to do following steps. | If you want to use them, it is necessary to do following steps. | ||
- | First of all, create a database user that you will use for the access to those applications. If you plan to connect to the applications remotely (not only from localhost) you have to also allow communication from your IP. | + | First of all, create a Tomcat' |
- | + | ||
- | Create user like this: | + | |
- | Create the a new user in the file ''/ | + | * Create administration user |
- | The documentation of available roles as well as overall configuration of the application is a part of application installation available at http:// | + | * Create the a new user in the file ''/ |
+ | | ||
- | The file ''/ | + | The file ''/ |
<file xml tomcat-users.xml> | <file xml tomcat-users.xml> | ||
<?xml version=" | <?xml version=" | ||
Line 348: | Line 355: | ||
</ | </ | ||
- | If you plan to connect to the applications remotely (not only from localhost) you have to also allow communication from your IP. If you see '' | + | * If you plan to connect to the applications remotely (not only from localhost) you have to also allow communication from your IP. |
+ | * If you see '' | ||
- | Add your IP address into application configuration files. In files ''/ | + | Add your IP address into application configuration files. In files ''/ |
- | In my case, I want to access | + | For example, if you want to access Tomcat' |
<file xml context.xml> | <file xml context.xml> | ||
Line 362: | Line 370: | ||
</ | </ | ||
- | Again, restart the tomcat: | + | * Again, restart the tomcat |
<code bash> | <code bash> | ||
systemctl restart tomcat | systemctl restart tomcat | ||
</ | </ | ||
- | === Apache Tomcat configuration recommended for production | + | === Apache Tomcat configuration recommended for production |
- | It is advised | + | We advise |
- | * Remove unnecessary applications that comes with Tomcat: | + | * Remove unnecessary applications that come with Tomcat: |
<code bash> | <code bash> | ||
Line 386: | Line 394: | ||
* Make Tomcat listen only on localhost: | * Make Tomcat listen only on localhost: | ||
* In the ''/ | * In the ''/ | ||
- | | + | |
+ | * Set the '' | ||
+ | * In the ''/ | ||
+ | |||
+ | | ||
< | < | ||
Line 398: | Line 410: | ||
* Do not show aplication server version: | * Do not show aplication server version: | ||
- | * In the file ''/ | + | * In the file ''/ |
<code xml> | <code xml> | ||
Line 565: | Line 577: | ||
* Audit log: ''/ | * Audit log: ''/ | ||
* Directory with activated rules: ''/ | * Directory with activated rules: ''/ | ||
- | * basic configuration file for mod\_security: | + | * basic configuration file for mod\_security: |
* The file for chosen rules deactivation: | * The file for chosen rules deactivation: | ||
Line 579: | Line 591: | ||
==== Disabling mod_security rules ==== | ==== Disabling mod_security rules ==== | ||
+ | |||
+ | These rules are disabled for modsec_crs 3.0. | ||
In the file ''/ | In the file ''/ | ||
+ | |||
<code xml> | <code xml> | ||
< | < | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
+ | | ||
+ | | ||
# Allow Czech signs | # Allow Czech signs | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
- | SecRuleRemoveById | + | SecRuleRemoveById |
| | ||
# Too restrictive for login format | # Too restrictive for login format | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
+ | |||
# Needed by Websockets | # Needed by Websockets | ||
< | < | ||
- | SecRuleRemoveById | + | SecRuleRemoveById |
</ | </ | ||
| | ||
- | # These break Certificate Authority module | ||
- | < | ||
- | SecRuleRemoveById 960915 | ||
- | SecRuleRemoveById 200003 | ||
- | </ | ||
- | |||
- | # Modsec can throw false positives on some files due to multipart boundary check | ||
- | < | ||
- | SecRuleRemoveById 960915 | ||
- | SecRuleRemoveById 200003 | ||
- | </ | ||
- | |||
# do not log request/ | # do not log request/ | ||
SecAuditLogParts ABFHZ | SecAuditLogParts ABFHZ | ||
Line 620: | Line 624: | ||
==== mod_security configuration - CentOS8 | ==== mod_security configuration - CentOS8 | ||
- | In the file / | + | In the file / |
- | Whole rules after the changes looks like this: | + | |
+ | * find the rule 900200 and add methods | ||
< | < | ||
Line 631: | Line 636: | ||
nolog,\ | nolog,\ | ||
setvar:' | setvar:' | ||
+ | </ | ||
+ | * find the rule 900220 and add support for content\_type=application/ | ||
+ | |||
+ | < | ||
# Default HTTP policy: allowed_request_content_type (rule 900220) | # Default HTTP policy: allowed_request_content_type (rule 900220) | ||
SecRule & | SecRule & |