완벽한 서버 CentOS 7.6 - Apache, PHP 7.2, Postfix, Dovecot, Pure-FTPD, BIND 및 ISPConfig 3.1 설치 - 페이지 2

yum -y install dovecot dovecot-mysql dovecot-pigeonhole

touch /etc/dovecot/dovecot-sql.conf  
ln -s /etc/dovecot/dovecot-sql.conf /etc/dovecot-sql.conf  
ln -s /etc/dovecot/dovecot.conf /etc/dovecot.conf

systemctl enable dovecot  
systemctl start dovecot

yum -y install postfix

systemctl enable mariadb.service  
systemctl start mariadb.service

systemctl stop sendmail.service  
systemctl disable sendmail.service  
systemctl enable postfix.service  
systemctl restart postfix.service

yum -y install getmail

mysql_secure_installation

[root@server1 tmp]# mysql_secure_installation  
  
NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB  
SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!

MariaDB에 로그인하여 보안을 설정하려면 현재  
루트 사용자에 대한 비밀번호가 필요합니다. MariaDB를 방금 설치했으며  
루트 비밀번호를 아직 설정하지 않았다면 비밀번호는 비어 있으므로  
여기서 그냥 Enter를 누르십시오.

Enter current password for root (enter for none):  
OK, successfully used password, moving on...

루트 비밀번호를 설정하면 적절한 권한 없이 누구도 MariaDB  
루트 사용자로 로그인할 수 없도록 보장합니다.  
  
Set root password? [Y/n] <-- ENTER  
New password: <-- yourrootsqlpassword  
Re-enter new password: <-- yourrootsqlpassword  
Password updated successfully!  
Reloading privilege tables..  
 ... Success!  
  
기본적으로 MariaDB 설치에는 익명 사용자가 있어 누구나  
사용자 계정을 생성하지 않고도 MariaDB에 로그인할 수 있습니다. 이는  
테스트 용도로만 사용되며 설치를 조금 더 원활하게 진행하기 위한 것입니다.  
생산 환경으로 이동하기 전에 이들을 제거해야 합니다.  
  
Remove anonymous users? [Y/n] <-- ENTER  
 ... Success!  
  
일반적으로 루트는 'localhost'에서만 연결할 수 있어야 합니다.  
이는 누군가가 네트워크에서 루트 비밀번호를 추측할 수 없도록 보장합니다.  
  
Disallow root login remotely? [Y/n] <-- ENTER  
 ... Success!  
  
기본적으로 MariaDB에는 누구나 접근할 수 있는 'test'라는 데이터베이스가 있습니다.  
이는 테스트 용도로만 사용되며 생산 환경으로 이동하기 전에 제거해야 합니다.  
  
Remove test database and access to it? [Y/n] <-- ENTER  
- Dropping test database...  
 ... Success!  
- Removing privileges on test database...  
 ... Success!  
  
권한 테이블을 다시 로드하면 지금까지 변경된 모든 사항이  
즉시 적용됩니다.  
  
Reload privilege tables now? [Y/n] <-- ENTER  
 ... Success!  
  
정리 중...  
  
모든 작업이 완료되었습니다! 위의 모든 단계를 완료했다면  
당신의 MariaDB 설치는 이제 안전해야 합니다.  
  
MariaDB를 사용해 주셔서 감사합니다!  
  
[root@server1 tmp]#

nano /etc/httpd/conf.d/phpMyAdmin.conf

# phpMyAdmin - Web based MySQL browser written in php
#
# Allows only localhost by default
#
# But allowing phpMyAdmin to anyone other than localhost should be considered
# dangerous unless properly secured by SSL

Alias /phpMyAdmin /usr/share/phpMyAdmin
Alias /phpmyadmin /usr/share/phpMyAdmin


   
     # Apache 2.4
  #  
     #  Require ip 127.0.0.1
     #  Require ip ::1
  #  
   
   
     # Apache 2.2
     Order Deny,Allow
     Deny from All
     Allow from 127.0.0.1
     Allow from ::1
   

            

nano /etc/phpMyAdmin/config.inc.php

[...]
/* Authentication type */
$cfg['Servers'][$i]['auth_type'] = 'http';
[...]

systemctl enable  httpd.service  
systemctl restart  httpd.service

yum -y install amavisd-new spamassassin clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd unzip bzip2 perl-DBD-mysql postgrey re2c

sa-update  
freshclam  
systemctl enable amavisd.service  
systemctl start amavisd.service  
systemctl start [email protected]  
systemctl enable postgrey.service  
systemctl start postgrey.service

yum -y install php php-devel php-gd php-imap php-ldap php-mysql php-odbc php-pear php-xml php-xmlrpc php-pecl-apc php-mbstring php-mcrypt php-mssql php-snmp php-soap php-tidy curl curl-devel perl-libwww-perl ImageMagick libxml2 libxml2-devel mod_fcgid php-cli httpd-devel php-fpm php-intl php-imagick php-pspell wget

nano /etc/php.ini

[...]
;error_reporting = E_ALL & ~E_DEPRECATED
error_reporting = E_ALL & ~E_NOTICE & ~E_DEPRECATED & ~E_STRICT
[...]
; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI.  PHP's
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
; what PATH_INFO is.  For more information on PAppp.tldTH_INFO, see the cgi specs.  Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec.  A setting
; of zero causes PHP to behave as before.  Default is 1.  You should fix your scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; http://www.php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo
cgi.fix_pathinfo=1  
[...]  
date.timezone = 'Europe/Berlin'
[...]

systemctl start php-fpm.service  
systemctl enable php-fpm.service  
systemctl enable httpd.service

systemctl restart httpd.service

mkdir /opt/certbot  
cd /opt/certbot  
wget https://dl.eff.org/certbot-auto  
chmod a+x ./certbot-auto

./certbot-auto

yum -y install python-devel

cd /usr/local/src/  
wget http://dist.modpython.org/dist/mod_python-3.5.0.tgz  
tar xfz mod_python-3.5.0.tgz  
cd mod_python-3.5.0

./configure  
make

sed -e 's/(git describe --always)/(git describe --always 2>\/dev\/null)/g' -e 's/`git describe --always`/`git describe --always 2>\/dev\/null`/g' -i $( find . -type f -name Makefile\* -o -name version.sh )

make install

echo 'LoadModule python_module modules/mod_python.so' > /etc/httpd/conf.modules.d/10-python.conf  
systemctl restart httpd.service

yum -y install pure-ftpd

systemctl enable pure-ftpd.service  
systemctl start pure-ftpd.service

yum install openssl

nano /etc/pure-ftpd/pure-ftpd.conf

[...]
# This option can accept three values :
# 0 : disable SSL/TLS encryption layer (default).
# 1 : accept both traditional and encrypted sessions.
# 2 : refuse connections that don't use SSL/TLS security mechanisms,
#     including anonymous sessions.
# Do _not_ uncomment this blindly. Be sure that :
# 1) Your server has been compiled with SSL/TLS support (--with-tls),
# 2) A valid certificate is in place,
# 3) Only compatible clients will log in.

TLS                      1
[...]

mkdir -p /etc/ssl/private/

openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem

chmod 600 /etc/ssl/private/pure-ftpd.pem

openssl dhparam -out /etc/ssl/private/pure-ftpd-dhparams.pem 2048

systemctl restart pure-ftpd.service

yum -y install bind bind-utils haveged

cp /etc/named.conf /etc/named.conf_bak  
cat /dev/null > /etc/named.conf  
nano /etc/named.conf

// named.conf
//
// Red Hat bind 패키지가 ISC BIND named(8) DNS를 구성하기 위해 제공
// 서버를 캐싱 전용 이름 서버로 설정합니다 (로컬호스트 DNS 해 resolver 전용).
//
// 예제 named 구성 파일은 /usr/share/doc/bind*/sample/에서 확인할 수 있습니다.
//
options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { any; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
        allow-recursion {"none";};
        recursion no;
};
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};
zone "." IN {
        type hint;
        file "named.ca";
};
include "/etc/named.conf.local";

touch /etc/named.conf.local

systemctl enable named.service  
systemctl start named.service  
systemctl enable haveged.service  
systemctl start haveged.service

yum -y install webalizer awstats perl-DateTime-Format-HTTP perl-DateTime-Format-Builder

nano /etc/httpd/conf.d/awstats.conf

Require local

Require all granted

systemctl restart httpd.service

cd /tmp  
wget http://olivier.sessink.nl/jailkit/jailkit-2.20.tar.gz  
tar xvfz jailkit-2.20.tar.gz  
cd jailkit-2.20  
./configure  
make  
make install  
cd ..  
rm -rf jailkit-2.20*

yum -y install iptables-services fail2ban fail2ban-systemd  
systemctl stop firewalld.service  
systemctl mask firewalld.service  
systemctl disable firewalld.service  
systemctl stop firewalld.service

nano /etc/fail2ban/jail.local

[sshd]  
enabled = true  
action = iptables[name=sshd, port=ssh, protocol=tcp]  
  
[pure-ftpd]  
enabled = true  
action = iptables[name=FTP, port=ftp, protocol=tcp]  
maxretry = 3  
  
[dovecot]  
enabled = true  
action = iptables-multiport[name=dovecot, port="pop3,pop3s,imap,imaps", protocol=tcp]  
maxretry = 5  
  
[postfix-sasl]  
enabled = true  
action = iptables-multiport[name=postfix-sasl, port="smtp,smtps,submission", protocol=tcp]  
maxretry = 3

systemctl enable fail2ban.service  
systemctl start fail2ban.service

yum -y install rkhunter

yum -y install mailman

touch /var/lib/mailman/data/aliases  
postmap /var/lib/mailman/data/aliases  
/usr/lib/mailman/bin/newlist mailman  
ln -s /usr/lib/mailman/mail/mailman /usr/bin/mailman

nano /etc/aliases

[...]
mailman:              "|/usr/lib/mailman/mail/mailman post mailman"
mailman-admin:        "|/usr/lib/mailman/mail/mailman admin mailman"
mailman-bounces:      "|/usr/lib/mailman/mail/mailman bounces mailman"
mailman-confirm:      "|/usr/lib/mailman/mail/mailman confirm mailman"
mailman-join:         "|/usr/lib/mailman/mail/mailman join mailman"
mailman-leave:        "|/usr/lib/mailman/mail/mailman leave mailman"
mailman-owner:        "|/usr/lib/mailman/mail/mailman owner mailman"
mailman-request:      "|/usr/lib/mailman/mail/mailman request mailman"
mailman-subscribe:    "|/usr/lib/mailman/mail/mailman subscribe mailman"
mailman-unsubscribe:  "|/usr/lib/mailman/mail/mailman unsubscribe mailman"

newaliases

systemctl restart postfix.service

nano /etc/httpd/conf.d/mailman.conf

#
#  httpd 구성 설정은 mailman과 함께 사용됩니다.
#
ScriptAlias /mailman/ /usr/lib/mailman/cgi-bin/
ScriptAlias /cgi-bin/mailman/ /usr/lib/mailman/cgi-bin/

    AllowOverride None
    Options ExecCGI
    Order allow,deny
    Allow from all


#Alias /pipermail/ /var/lib/mailman/archives/public/
Alias /pipermail /var/lib/mailman/archives/public/

    Options Indexes MultiViews FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
    AddDefaultCharset Off


# 다음 줄의 주석을 제거하여 /mailman에 대한 쿼리를
# listinfo 페이지로 리디렉션합니다 (권장).

# RedirectMatch ^/mailman[/]*$ /mailman/listinfo

systemctl restart httpd.service

systemctl enable mailman.service  
systemctl start mailman.service