完璧なサーバー - Debian 9 (Nginx, BIND, Dovecot, ISPConfig 3.1)

apt-get -y install ssh openssh-server

apt-get -y install nano vim-nox

nano /etc/hosts

127.0.0.1       localhost.localdomain   localhost
192.168.1.100   server1.example.com     server1

# 以下の行は、IPv6 対応ホストにとって望ましい
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

nano /etc/hostname

server1

reboot

hostname  
hostname -f

root@server1:/tmp# hostname  
server1  
root@server1:/tmp# hostname -f  
server1.example.com

nano /etc/apt/sources.list

deb http://ftp.us.debian.org/debian/ stretch main contrib non-free  
deb-src http://ftp.us.debian.org/debian/ stretch main contrib non-free  
  
deb http://security.debian.org/debian-security stretch/updates main contrib non-free  
deb-src http://security.debian.org/debian-security stretch/updates main contrib non-free

apt-get update

apt-get upgrade

dpkg-reconfigure dash

apt-get install ntp

apt-get install postfix postfix-mysql postfix-doc mariadb-client mariadb-server openssl getmail4 rkhunter binutils dovecot-imapd dovecot-pop3d dovecot-mysql dovecot-sieve dovecot-lmtpd sudo

mysql_secure_installation

root パスワードを変更しますか？ [Y/n] <-- y  
新しいパスワード：<-- 新しい MySQL root パスワードを入力  
新しいパスワードを再入力：<-- MySQL root パスワードを繰り返す  
匿名ユーザーを削除しますか？ [Y/n] <-- y  
リモートからの root ログインを禁止しますか？ [Y/n] <-- y  
テストデータベースとそのアクセスを削除しますか？ [Y/n] <-- y  
特権テーブルを今すぐ再読み込みしますか？ [Y/n] <-- y

nano /etc/postfix/master.cf

[...]  
submission inet n - y - - smtpd  
 -o syslog_name=postfix/submission  
 -o smtpd_tls_security_level=encrypt  
 -o smtpd_sasl_auth_enable=yes  
 -o smtpd_client_restrictions=permit_sasl_authenticated,reject  
# -o smtpd_reject_unlisted_recipient=no  
# -o smtpd_client_restrictions=$mua_client_restrictions  
# -o smtpd_helo_restrictions=$mua_helo_restrictions  
# -o smtpd_sender_restrictions=$mua_sender_restrictions  
# -o smtpd_recipient_restrictions=  
# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject  
# -o milter_macro_daemon_name=ORIGINATING  
smtps inet n - y - - smtpd  
 -o syslog_name=postfix/smtps  
 -o smtpd_tls_wrappermode=yes  
 -o smtpd_sasl_auth_enable=yes  
 -o smtpd_client_restrictions=permit_sasl_authenticated,reject  
# -o smtpd_reject_unlisted_recipient=no  
# -o smtpd_client_restrictions=$mua_client_restrictions  
# -o smtpd_helo_restrictions=$mua_helo_restrictions  
# -o smtpd_sender_restrictions=$mua_sender_restrictions  
# -o smtpd_recipient_restrictions=  
# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject  
# -o milter_macro_daemon_name=ORIGINATING  
[...]  

service postfix restart

nano /etc/mysql/mariadb.conf.d/50-server.cnf

[...]  

# skip-networking の代わりに、デフォルトは現在 localhost のみでリッスンすることです。
#bind-address           = 127.0.0.1  
  
sql-mode="NO_ENGINE_SUBSTITUTION"  
  
[...]  

echo "update mysql.user set plugin = 'mysql_native_password' where user='root';" | mysql -u root

nano /etc/mysql/debian.cnf

# Debian スクリプト用に自動生成されました。触れないでください！  
[client]  
host = localhost  
user = root  
password = howtoforge  
socket = /var/run/mysqld/mysqld.sock  
[mysql_upgrade]  
host = localhost  
user = root  
password = howtoforge  
socket = /var/run/mysqld/mysqld.sock  
basedir = /usr

nano /etc/security/limits.conf

mysql soft nofile 65535  
mysql hard nofile 65535

mkdir -p /etc/systemd/system/mysql.service.d/

nano /etc/systemd/system/mysql.service.d/limits.conf

[Service]  
LimitNOFILE=infinity

systemctl daemon-reload  
service mysql restart

netstat -tap | grep mysql

root@server1:~# netstat -tap | grep mysql  
tcp6       0      0 [::]:mysql              [::]:*                     LISTEN      4027/mysqld  
root@server1:~#

apt-get install amavisd-new spamassassin clamav clamav-daemon zoo unzip bzip2 arj nomarch lzop cabextract apt-listchanges libnet-ldap-perl libauthen-sasl-perl clamav-docs daemon libio-string-perl libio-socket-ssl-perl libnet-ident-perl zip libnet-dns-perl libdbd-mysql-perl postgrey

service spamassassin stop  
systemctl disable spamassassin

echo "deb http://packages.prosody.im/debian stretch main" > /etc/apt/sources.list.d/metronome.list  
wget http://prosody.im/files/prosody-debian-packages.key -O - | sudo apt-key add -

apt-get update

apt-get install build-essential

apt-get install git lua5.1 liblua5.1-0-dev lua-filesystem libidn11-dev libssl-dev lua-zlib lua-expat lua-event lua-bitop lua-socket lua-sec luarocks luarocks

luarocks install lpc

adduser --no-create-home --disabled-login --gecos 'Metronome' metronome

cd /opt; git clone https://github.com/maranda/metronome.git metronome  
cd ./metronome; ./configure --ostype=debian --prefix=/usr  
make  
make install