Buenos dias.... hoy sigo con mi proyecto de mejora del server de TKZ, que ya que tengo pendiente actualizar sus discos duros y el OS, pues voy a aprovechar para añadirle un poco de seguridad, porque el acceso y la privacidad de los datos para mi es crucial.

Para los que queráis saber más sobre lo que tengo en mente, os cuento un poco:

- La instalación será Debian 12.10 y tendrá el OS instalado en dos discos duros con RAID1, para que en caso de que haya un fallo de disco duro se pueda reemplazar por otro fácilmente con tolerancia a fallos y alcance completo al OS.

- Además de esto, el disco duro salvo la partición /boot irá encriptado con LUKS

- La clave de LUKS estará en un dispositivo externo (Llave USB) junto a la partición /boot

- Initramfs se encargará de montar este USB y coger automáticamente TODO lo necesario.

- Si el USB no está presente el sistema no arrancará.

- Si el USB está presente el sistema arrancará con su EFI de forma trasparente y sin preocupación.

- En caso de que uno de los HDs falle o la RAID 1 no esté operativa, el sistema reconstruirá la RAID 1 en un nuevo disco manteniendo la encriptación.

- La partición de intercambio (SWAP) también estará encriptada.

Todo esto ya lo he replicado con éxito y hecho funcionar en un entorno virtualizado y ahora me falta pasarlo al servidor, cosa que espero hacer a lo largo de hoy.

La idea principal es que sin el USB de arranque los datos no sean accesibles de ninguna manera, incluso extrayendo los discos duros físicamente, debido a la encriptación.

¿Tenéis alguna sugerencia, matíz o apunte sobre este setup? ¿Qué opinais?

¡Gracias!

#Debian #Linux #security

Categories:LAMP, Linux, VPS

rootname@VPShosting:~$ sudo apt update
rootname@VPShosting:~$ sudo apt install apache2 -y

rootname@VPShosting:~$

sudo snap install core; sudo snap refresh core
sudo snap install --classic certbot

rootname@VPShosting:~$ sudo ln -s /snap/bin/certbot /usr/bin/certbot

rootname@VPShosting:~$ sudo certbot --apache

Configure PHP dependencies:
www-data@VPShosting:~$ cd html
www-data@VPShosting:~/html$ bin/composer.phar install --no-dev

rootname@VPShosting:~$ sudo ufw allow ssh
rootname@VPShosting:~$ sudo ufw allow http
rootname@VPShosting:~$ sudo ufw allow https
rootname@VPShosting:~$ sudo ufw enable
rootname@VPShosting:~$ sudo ufw status

rootname@VPShosting:~$

sudo apt install fail2ban -y 
rootname@VPShosting:~$ [code]sudo systemctl enable fail2ban

rootname@VPShosting:~$ systemctl status fail2ban

rootname@VPShosting:~$ sudo reboot

Because of the reboot you will be logged out of your VPS server and will have to log on again to proceed with the installation.

"M" like MySQL/mariaDB and "P" like PHP of "LAMP" installation

rootname@VPShosting:~$ sudo apt update

rootname@VPShosting:~$

sudo apt install mariadb-server php libapache2-mod-php \
     php-common php-gmp php-curl php-intl php-mbstring \
	 php-xmlrpc php-mysql php-gd php-imagick php-xml \
	 php-cli php-zip php-sqlite3 curl git -y

rootname@VPShosting:~$ sudo mysql_secure_installation

MariaDB [(none)]> CREATE DATABASE friendicadb;
Query OK, 1 row affected (0.000 sec)
MariaDB [(none)]> CREATE USER 'friendica'@'localhost' IDENTIFIED BY '<password>';
Query OK, 0 rows affected (0.002 sec)
MariaDB [(none)]> GRANT ALL ON friendicadb.* TO 'friendica'@'localhost';
MariaDB [(none)]> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.000 sec)
MariaDB [(none)]> EXIT;
Bye

rootname@VPShosting:~#

To log from the console into your DB use the following command:
rootname@VPShosting:~# mysql friendicadb

To exit mariaDB:
MariaDB [friendicadb]> Ctrl-C -- exit!
Aborted
rootname@VPShosting:~#

install automysqlbackup
rootname@VPShosting:~# sudo apt-get install automysqlbackup
rootname@VPShosting:~# sudo automysqlbackup

#debian #linux #friendica #fediVerse #fediTutorial

Categories: friendica,apache

tweaking apache configuration for friendica

rootname@VPShosting:/var/www/html# sudo nano /etc/apache2/sites-available/000-default-le-ssl.conf

search for the line:
ctrl+W -> DocumentRoot /var/www/html

add the code snippet:

    <Directory /var/www/html>
        AllowOverride All
    </Directory>

save the file "000-default-le-ssl.conf":
ctrl+X -> Y -> hit ENTER

<IfModule mod_ssl.c>
<VirtualHost *:443>
	# The ServerName directive sets the request scheme, hostname and port that
	# the server uses to identify itself. This is used when creating
	# redirection URLs. In the context of virtual hosts, the ServerName
	# specifies what hostname must appear in the request's Host: header to
	# match this virtual host. For the default virtual host (this file) this
	# value is not decisive as it is used as a last resort host regardless.
	# However, you must set it for any further virtual host explicitly.
	#ServerName www.example.com
        ServerAdmin webmaster@localhost
	DocumentRoot /var/www/html
    <Directory /var/www/html>
        AllowOverride All
    </Directory>
	# Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
	# error, crit, alert, emerg.
	# It is also possible to configure the loglevel for particular
	# modules, e.g.
	#LogLevel info ssl:warn
	ErrorLog ${APACHE_LOG_DIR}/error.log
	CustomLog ${APACHE_LOG_DIR}/access.log combined
	# For most configuration files from conf-available/, which are
	# enabled or disabled at a global level, it is possible to
	# include a line for only one particular virtual host. For example the
	# following line enables the CGI configuration for this host only
	# after it has been globally disabled with "a2disconf".
	#Include conf-available/serve-cgi-bin.conf
ServerName mydoman.com
SSLCertificateFile /etc/letsencrypt/live/mydoman.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mydoman.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

rootname@ubuntu:~# touch php.error.log

tweaking basic settings:

rootname@VPShosting:/var/www/html# sudo nano /etc/php/8.1/apache2/php.ini

search for the following lines [ctrl+w] and modify the values:

search and modify the line :
ctrl+W -> memory_limit =
modify to:
memory_limit = 256M

search and modify the line :
ctrl+W -> upload_max_filesize =
modify to:
upload_max_filesize = 100M

search and modify the line :
ctrl+W -> max_execution_time =
modify to:
max_execution_time = 300

search and modify the line :
ctrl+W -> max_input_vars =
modify to:
max_input_vars = 1500

activate php.error.log
search:
ctrl+W -> log_errors
unquote and and modify so it reads:
log_errors = On
; Default Value: Off
; Development Value: On
; Production Value: On

search:
ctrl+W -> error_log
unquote and and modify so it reads:
; Log errors to specified file. PHP's default behavior is to leave this value
; empty.
; php.net/error-log
; Example:
error_log = /var/www/html/php.error.log
; Log errors to syslog (Event Log on Windows).
; error_log = syslog

save the file "php.ini":
ctrl+X -> Y -> hit ENTER

rootname@VPShosting:/var/www/html# systemctl restart apache2
rootname@VPShosting:/var/www/html# systemctl status apache2

rootname@ubuntu:~# reboot
user@localPC:~$ log into your VPShosting again
rootname@ubuntu:~# nano /var/www/html/php.error.log

Congrats!
With this you have completed via SSH on the console all the installation steps necessary, now it's time to browse to your friendica web page and actually install and activate your node:

Go to your website and have a look at the short installation routine of friendica itself.

#debian #linux #friendica #fediVerse #fediTutorial

v.01
@Tutorial

Hi there @Friendica Developers and @Friendica Admins.

The plan is to change this single domain ubunu 2022.04lts VPS hosting into a single IP multi domain VPS server. For that purpose some apache VPS server tutorials were checked out and the specific steps were singled out to achieve that goal.

A main question hasn't been solved to define the naming of the folder structure and .conf files themself:

• Can the domain name in VPS folder structure be:
  /var/www/domaincom/
  or does it have to be
  /var/www/domain.com/

Are both options possible or does the system, for a correct working environment, need the dot in the folder structure?

Are there any general discussions in the #apache #server environment that might lead to some standard in this regard in the future that makes it reasonable to consider one of the two above cited options as more logical to go for from the very beginning?

In the case of very long domain or subdomain names, isn't it more reasonable to choose the option without the real domain name including the dot?
Example:
https: //1dhfsbbdpv4wshuh7nymcfy66t5reqqkfvy9.domain.org/

Depending on the chosen naming syntax this would lead to the following folder structure options:
/var/www/1dhfsbbdpv4wshuh7nymcfy66t5reqqkfvy9.domain.org/
vs
/var/www/1d_domainorg/

Does the naming of the .conf file in /etc/apache2/sites-available/ refer to the actual domain name or to the folder name used in /var/www/?

In the first answer to this topic we'll address the question about:

• How to solve best a step by step change to migrate from a single VPS #hosting environment where one domain is served by one IP at:
  /var/www/html/
  to a multi domain VPS hosting were several domains are served by one IP on one #debian #ubuntu [2022.04lts] #VPS, leaving /html in place if a client request doesn’t match any other sites, like proposed in this digitalOcean tutorial:
  /var/www/html/ as fall back option
  /var/www/domaincom/index.html
/var/www/subdomaindomaincom/index.html
/var/www/domainorg/index.html
/var/www/subdomaindomainorg/index.html

Any comments hints and observations are really appreciated!
#admin #fediAdmin

utopiArte

2025-02-21 11:00:35

friendica

more tutorials

https://www.digitalocean.com/community/tutorials/how-to-set-up-apache-virtual-hosts-on-ubuntu-20-04
https://www.digitalocean.com/community/tutorials/how-to-install-the-apache-web-server-on-ubuntu-22-04
https://askubuntu.com/questions/463618/setting-up-subdomain-on-ubuntu-server
https://serverfault.com/questions/343449/multiple-sub-domains-with-one-ip-address
nginx
https://farhazalam.medium.com/setup-domains-subdomains-on-vps-in-ubuntu-36495b37da66

Categories: friendica,VPS,github

friendica installation on the VPS hosting
--
Up to this point we basically performed a standard LAMP installation on a ubuntu 22.04 LTS VPS hosting.

The following steps concern the actual friendica server installation.

creating the directory for friendica and the user www-data

¡IMPORTANT!
The following command and setting should only be used if you are on a clean brand new ubuntu VPS setup as it will or at least might meddle with your already existing web page setups as @tom s politely pointed out:
"This would damage a lot of (server) installations out there. Do not do this in /var/www, if you are not really sure, what you're doing."
rootname@VPShosting:~# sudo chown -R www-data:www-data /var/www
rootname@VPShosting:~# cd /var/www

rootname@VPShosting:~/var/www# sudo -u www-data bash
www-data@VPShosting:~$
(confirmation check if this is where console changes to www-data@VPShosting:~#)

www-data@VPShosting:~$ mv html html.bak
The new /html folder will be created when we clone the gitHub stable branch of friendica in the next step.

www-data@VPShosting:~$ git clone https://github.com/friendica/friendica.git -b stable html

www-data@VPShosting:~$ cd html
www-data@VPShosting:~/html$ bin/composer.phar install --no-dev
(is this the point the SSL install went wrong?)
squeet.me/display/962c3e10-126…

www-data@VPShosting:~/html$ mkdir -p view/smarty3
www-data@VPShosting:~/html$ chmod 775 view/smarty3

www-data@VPShosting:~/html$ git clone https://github.com/friendica/friendica-addons.git -b stable addon

www-data@VPShosting:~/html$ cp .htaccess-dist .htaccess

www-data@VPShosting:~/html$ exit
rootname@VPShosting:~/var/www/html#

#debian #linux #friendica #fediVerse #fediTutorial

…ᘛ⁐̤ᕐᐷ jesuisatire bitPickup

2023-10-17 15:34:41

friendica

As of now I skipped this step as I do have already a DB with password and name on the original installation I will have to migrate to this new VPS.

moving a friendica VPS server onto ubuntu 22.04 LTS

@Friendica Support @Friendica Admins
Based on the tutorial "creating a friendica server - ubuntu" by @Hank G ☑️.
IntroductionHi, I'm working on my first #friendica #VPS installation, here you'll find my [ initial post about general thoughts](squeet.me/display/962c3e10-196…) like what distro to use, size and costs. As of now I'm doing well in the process and want to start this post to document differences and questions while installing the server. This server is going to host an already existing friendica node I have to move from another hosting provider. That means that for example the DB doesn't have to be created from scratch but moved and other smaller details. I will try to address the different steps of installation in answers to this post and appreciate help, ideas and observations.
Server specs and friendica version used:
VPS server | Ubuntu 22.04 LTS
PHP Version 8.1.2-1ubuntu2.14
4 Core CPU, 8 GB Ram with 300GB NVME Disk
Friendica [STABLE] | 'Giant Rhubarb' 2023.05 - 1518
Installation environmentThe only reasonable way to work with a VPSserver on the web is using the console. If you are not familiar with that don't worry, it is easy and the only thing you have to do is being able to copy/paste the commands displayed. On the console you wont be able to copy/paste with the keyboard ctrl-C/ctrl-V technique, you'll have to use the mouse "right click, chose option" technique. This tutorial was created on a #debian #linux desktop environment. There shouldn't be differences if you want to do this from a #windows machine. The method used for communication between your local computer and the VPS server is called #SSH: *Wikipedia - Secure Shell: "Cryptographic network protocol for secure data communication, remote shell services or command execution and other secure network services between two networked computers."*
Basic definitions for to work with the console:

user@localPC:~$ ----------------> your computer
rootname@VPShosting:~# ---> your VPS server
www-data@VPShosting:~$ --> the user name of the friendica installation on the apache VPS server

#fediVerse #tutorial #fediHelp #activityPub
@TupambAdmin [stable] @Tutorial

@helpers@forum.friendi.ca

Server specs and friendica version used:
VPS server | Ubuntu 22.04 LTS
PHP Version 8.1.2-1ubuntu2.14
4 Core CPU, 8 GB Ram with 300GB NVME Disk
Friendica [STABLE] | 'Giant Rhubarb' 2023.05 - 1518

…ᘛ⁐̤ᕐᐷ jesuisatire bitPickup

2023-10-17 13:04:10

friendica

moving a friendica VPS server onto ubuntu 22.04 LTS

@Friendica Support @Friendica Admins
Based on the tutorial "creating a friendica server - ubuntu" by @Hank G ☑️.
IntroductionHi, I'm working on my first #friendica #VPS installation, here you'll find my [ initial post about general thoughts](squeet.me/display/962c3e10-196…) like what distro to use, size and costs. As of now I'm doing well in the process and want to start this post to document differences and questions while installing the server. This server is going to host an already existing friendica node I have to move from another hosting provider. That means that for example the DB doesn't have to be created from scratch but moved and other smaller details. I will try to address the different steps of installation in answers to this post and appreciate help, ideas and observations.
Server specs and friendica version used:
VPS server | Ubuntu 22.04 LTS
PHP Version 8.1.2-1ubuntu2.14
4 Core CPU, 8 GB Ram with 300GB NVME Disk
Friendica [STABLE] | 'Giant Rhubarb' 2023.05 - 1518
Installation environmentThe only reasonable way to work with a VPSserver on the web is using the console. If you are not familiar with that don't worry, it is easy and the only thing you have to do is being able to copy/paste the commands displayed. On the console you wont be able to copy/paste with the keyboard ctrl-C/ctrl-V technique, you'll have to use the mouse "right click, chose option" technique. This tutorial was created on a #debian #linux desktop environment. There shouldn't be differences if you want to do this from a #windows machine. The method used for communication between your local computer and the VPS server is called #SSH: *Wikipedia - Secure Shell: "Cryptographic network protocol for secure data communication, remote shell services or command execution and other secure network services between two networked computers."*
Basic definitions for to work with the console:

user@localPC:~$ ----------------> your computer
rootname@VPShosting:~# ---> your VPS server
www-data@VPShosting:~$ --> the user name of the friendica installation on the apache VPS server

#fediVerse #tutorial #fediHelp #activityPub
@TupambAdmin [stable] @Tutorial