完璧なサーバー CentOS 7.2 と Apache、Postfix、Dovecot、Pure-FTPD、BIND および ISPConfig 3.1 - ページ 2

yum -y install dovecot dovecot-mysql dovecot-pigeonhole

touch /etc/dovecot/dovecot-sql.conf  
ln -s /etc/dovecot/dovecot-sql.conf /etc/dovecot-sql.conf

systemctl enable dovecot  
systemctl start dovecot

yum -y install postfix

systemctl enable mariadb.service  
systemctl start mariadb.service

systemctl stop sendmail.service  
systemctl disable sendmail.service  
systemctl enable postfix.service  
systemctl restart postfix.service

yum -y install getmail

mysql_secure_installation

[root@server1 tmp]# mysql_secure_installation  
  
  NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB  
  SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!

MariaDB にログインしてセキュリティを確保するには、現在の  
root ユーザーのパスワードが必要です。MariaDB をインストールしたばかりで、  
まだ root パスワードを設定していない場合、パスワードは空白になりますので、  
ここでは Enter を押してください。

Enter current password for root (enter for none):  
OK, successfully used password, moving on...

root パスワードを設定することで、適切な認証なしに誰も MariaDB  
root ユーザーにログインできなくなります。  

Set root password? [Y/n] <-- ENTER  
New password: <-- yourrootsqlpassword  
Re-enter new password: <-- yourrootsqlpassword  
Password updated successfully!  
Reloading privilege tables..  
 ... Success!  
  
デフォルトでは、MariaDB のインストールには匿名ユーザーがあり、誰でも  
ユーザーアカウントを作成せずに MariaDB にログインできます。これはテスト用にのみ  
意図されており、インストールを少しスムーズにするためのものです。  
本番環境に移行する前に、これらを削除する必要があります。  

Remove anonymous users? [Y/n] <-- ENTER  
 ... Success!  

通常、root は 'localhost' からのみ接続を許可されるべきです。  
これにより、誰かがネットワークから root パスワードを推測できなくなります。  

Disallow root login remotely? [Y/n] <-- ENTER  
 ... Success!  

デフォルトでは、MariaDB には誰でもアクセスできる 'test' という名前のデータベースがあります。  
これもテスト用にのみ意図されており、本番環境に移行する前に削除する必要があります。  

Remove test database and access to it? [Y/n] <-- ENTER  
- Dropping test database...  
 ... Success!  
- Removing privileges on test database...  
 ... Success!  

特権テーブルを再読み込みすることで、これまでに行ったすべての変更が  
即座に適用されることを保証します。  

Reload privilege tables now? [Y/n] <-- ENTER  
 ... Success!  

クリーンアップ...  
  
すべて完了しました！上記のすべての手順を完了した場合、あなたの MariaDB  
インストールは今や安全であるべきです。  

MariaDB をご利用いただきありがとうございます！  

[root@server1 tmp]#

nano /etc/httpd/conf.d/phpMyAdmin.conf

# phpMyAdmin - Web based MySQL browser written in php
#
# Allows only localhost by default
#
# But allowing phpMyAdmin to anyone other than localhost should be considered
# dangerous unless properly secured by SSL

Alias /phpMyAdmin /usr/share/phpMyAdmin
Alias /phpmyadmin /usr/share/phpMyAdmin


   
     # Apache 2.4
     
     #  Require ip 127.0.0.1
     #  Require ip ::1  
        Require all granted
     
   
   
     # Apache 2.2
     Order Deny,Allow
     Deny from All
     Allow from 127.0.0.1
     Allow from ::1
   

            

nano /etc/phpMyAdmin/config.inc.php

[...]
/* Authentication type */
$cfg['Servers'][$i]['auth_type'] = 'http';
[...]

systemctl enable  httpd.service  
systemctl restart  httpd.service

yum -y install amavisd-new spamassassin clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd unzip bzip2 perl-DBD-mysql

nano /etc/freshclam.conf

[....]  
# Example  
[....]

sa-update  
freshclam  
systemctl enable amavisd.service  
systemctl start amavisd.service  
systemctl start [email protected]

yum -y install php php-devel php-gd php-imap php-ldap php-mysql php-odbc php-pear php-xml php-xmlrpc php-pecl-apc php-mbstring php-mcrypt php-mssql php-snmp php-soap php-tidy curl curl-devel perl-libwww-perl ImageMagick libxml2 libxml2-devel mod_fcgid php-cli httpd-devel php-fpm wget

nano /etc/php.ini

[...]
;error_reporting = E_ALL & ~E_DEPRECATED
error_reporting = E_ALL & ~E_NOTICE & ~E_DEPRECATED
[...]
; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI.  PHP's
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
; what PATH_INFO is.  For more information on PAppp.tldTH_INFO, see the cgi specs.  Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec.  A setting
; of zero causes PHP to behave as before.  Default is 1.  You should fix your scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; http://www.php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo
cgi.fix_pathinfo=1  
[...]  
date.timezone = 'Europe/Berlin'
[...]

systemctl start php-fpm.service  
systemctl enable php-fpm.service  
systemctl enable httpd.service

systemctl restart httpd.service

mkdir /opt/certbot  
cd /opt/certbot  
wget https://dl.eff.org/certbot-auto  
chmod a+x ./certbot-auto

./certbot-auto

yum -y install python-devel

cd /usr/local/src/  
wget http://dist.modpython.org/dist/mod_python-3.5.0.tgz  
tar xfz mod_python-3.5.0.tgz  
cd mod_python-3.5.0

./configure  
make  
make install

echo 'LoadModule python_module modules/mod_python.so' > /etc/httpd/conf.modules.d/10-python.conf  
systemctl restart httpd.service

yum -y install pure-ftpd

systemctl enable pure-ftpd.service  
systemctl start pure-ftpd.service

yum install openssl

nano /etc/pure-ftpd/pure-ftpd.conf

[...]
# This option can accept three values :
# 0 : disable SSL/TLS encryption layer (default).
# 1 : accept both traditional and encrypted sessions.
# 2 : refuse connections that don't use SSL/TLS security mechanisms,
#     including anonymous sessions.
# Do _not_ uncomment this blindly. Be sure that :
# 1) Your server has been compiled with SSL/TLS support (--with-tls),
# 2) A valid certificate is in place,
# 3) Only compatible clients will log in.

TLS                      1
[...]

mkdir -p /etc/ssl/private/

openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem

chmod 600 /etc/ssl/private/pure-ftpd.pem

systemctl restart pure-ftpd.service

yum -y install bind bind-utils haveged

cp /etc/named.conf /etc/named.conf_bak  
cat /dev/null > /etc/named.conf  
nano /etc/named.conf

// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { any; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
                allow-recursion {"none";};
        recursion no;
};
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};
zone "." IN {
        type hint;
        file "named.ca";
};
include "/etc/named.conf.local";

touch /etc/named.conf.local

systemctl enable named.service  
systemctl start named.service

yum -y install awstats perl-DateTime-Format-HTTP perl-DateTime-Format-Builder

yum install -y libpng-devel gd-devel  
cd /tmp  
wget ftp://ftp.mrunix.net/pub/webalizer/webalizer-2.23-08-src.tgz  
tar xvfz webalizer-2.23-08-src.tgz  
cd webalizer-2.23-08  
./configure  
make  
make install

cd /tmp  
wget http://olivier.sessink.nl/jailkit/jailkit-2.19.tar.gz  
tar xvfz jailkit-2.19.tar.gz  
cd jailkit-2.19  
./configure  
make  
make install  
cd ..  
rm -rf jailkit-2.19*

yum -y install iptables-services fail2ban fail2ban-systemd  
systemctl stop firewalld.service  
systemctl mask firewalld.service  
systemctl disable firewalld.service  
systemctl stop firewalld.service

nano /etc/fail2ban/jail.local

[sshd]  
enabled = true  
action = iptables[name=sshd, port=ssh, protocol=tcp]  
  
[pure-ftpd]  
enabled = true  
action = iptables[name=FTP, port=ftp, protocol=tcp]  
maxretry = 3  
  
[dovecot]  
enabled = true  
action = iptables-multiport[name=dovecot, port="pop3,pop3s,imap,imaps", protocol=tcp]  
maxretry = 5  
  
[postfix-sasl]  
enabled = true  
action = iptables-multiport[name=postfix-sasl, port="smtp,smtps,submission", protocol=tcp]  
maxretry = 3

systemctl enable fail2ban.service  
systemctl start fail2ban.service

yum -y install rkhunter

yum -y install mailman

touch /var/lib/mailman/data/aliases  
postmap /var/lib/mailman/data/aliases  
/usr/lib/mailman/bin/newlist mailman