완벽한 서버 - Debian 8.4 Jessie (Apache2, BIND, Dovecot, ISPConfig 3.1) - 페이지 2

apt-get install apache2 apache2.2-common apache2-doc apache2-mpm-prefork apache2-utils libexpat1 ssl-cert libapache2-mod-php5 php5 php5-common php5-gd php5-mysql php5-imap phpmyadmin php5-cli php5-cgi libapache2-mod-fcgid apache2-suexec php-pear php-auth php5-mcrypt mcrypt php5-imagick imagemagick libruby libapache2-mod-python php5-curl php5-intl php5-memcache php5-memcached php5-pspell php5-recode php5-sqlite php5-tidy php5-xmlrpc php5-xsl memcached libapache2-mod-passenger

Web server to reconfigure automatically: <- apache2  
 Configure database for phpmyadmin with dbconfig-common? <- yes  
Enter the password of the administrative user? <- yourrootmysqlpassword  
Enter the phpmyadmin application password? <-  Just press enter

a2enmod suexec rewrite ssl actions include dav_fs dav auth_digest cgi headers

sudo nano /etc/apache2/conf-available/httpoxy.conf

    RequestHeader unset Proxy early

a2enconf httpoxy  
service apache2 restart

sudo apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 0x5a16e7281be7a449  
echo deb http://dl.hhvm.com/debian jessie main | sudo tee /etc/apt/sources.list.d/hhvm.list

sudo apt-get update

sudo apt-get install hhvm

apt-get install apache2-dev build-essential autoconf automake libtool flex bison debhelper binutils

cd /usr/local/src  
wget http://suphp.org/download/suphp-0.7.2.tar.gz  
tar zxvf suphp-0.7.2.tar.gz  
wget -O suphp.patch https://lists.marsching.com/pipermail/suphp/attachments/20130520/74f3ac02/attachment.patch  
patch -Np1 -d suphp-0.7.2 < suphp.patch  
cd suphp-0.7.2  
autoreconf -if  
./configure --prefix=/usr/ --sysconfdir=/etc/suphp/ --with-apr=/usr/bin/apr-1-config --with-apache-user=www-data --with-setid-mode=owner --with-logfile=/var/log/suphp/suphp.log  
make  
make install  

mkdir /var/log/suphp  
mkdir /etc/suphp  
nano /etc/suphp/suphp.conf

[global]  
;Path to logfile  
logfile=/var/log/suphp/suphp.log  
  
;Loglevel  
loglevel=info  
  
;User Apache is running as  
webserver_user=www-data  
  
;Path all scripts have to be in  
docroot=/var/www  
  
;Path to chroot() to before executing script  
;chroot=/mychroot  
  
; Security options  
allow_file_group_writeable=false  
allow_file_others_writeable=false  
allow_directory_group_writeable=false  
allow_directory_others_writeable=false  
  
;Check wheter script is within DOCUMENT_ROOT  
check_vhost_docroot=true  
  
;Send minor error messages to browser  
errors_to_browser=false  
  
;PATH environment variable  
env_path=/bin:/usr/bin  
  
;Umask to set, specify in octal notation  
umask=0022  
  
; Minimum UID  
min_uid=100  
  
; Minimum GID  
min_gid=100  
  
[handlers]  
;Handler for php-scripts  
x-httpd-suphp="php:/usr/bin/php-cgi"  
  
;Handler for CGI-scripts  
x-suphp-cgi=execute:!self  
umask=0022

echo "LoadModule suphp_module /usr/lib/apache2/modules/mod_suphp.so" > /etc/apache2/mods-available/suphp.load

nano /etc/apache2/mods-available/suphp.conf

        AddType application/x-httpd-suphp .php .php3 .php4 .php5 .phtml
        suPHP_AddHandler application/x-httpd-suphp

    
        suPHP_Engine on
    

    # By default, disable suPHP for debian packaged web applications as files
    # are owned by root and cannot be executed by suPHP because of min_uid.
    
        suPHP_Engine off
    

# # Use a specific php config file (a dir which contains a php.ini file)
#       suPHP_ConfigPath /etc/php5/cgi/suphp/
# # Tells mod_suphp NOT to handle requests with the type .
#       suPHP_RemoveHandler 

a2enmod suphp

service apache2 restart

mkdir /opt/certbot  
cd /opt/certbot  
wget https://dl.eff.org/certbot-auto  
chmod a+x ./certbot-auto

./certbot-auto

apt-get install libapache2-mod-fastcgi php5-fpm

a2enmod actions fastcgi alias  
service apache2 restart

apt-get install php5-xcache

service apache2 restart

apt-get install mailman

Languages to support: <-- en (English)  
 Missing site list <-- Ok

newlist mailman

root@server1:~# newlist mailman  
Enter the email of the person running the list: <-- admin email address, e.g. [email protected]  
Initial mailman password: <-- admin password for the mailman list  
To finish creating your mailing list, you must edit your /etc/aliases (or  
equivalent) file by adding the following lines, and possibly running the  
`newaliases' program:  
   
## mailman mailing list  
mailman:              "|/var/lib/mailman/mail/mailman post mailman"  
mailman-admin:        "|/var/lib/mailman/mail/mailman admin mailman"  
mailman-bounces:      "|/var/lib/mailman/mail/mailman bounces mailman"  
mailman-confirm:      "|/var/lib/mailman/mail/mailman confirm mailman"  
mailman-join:         "|/var/lib/mailman/mail/mailman join mailman"  
mailman-leave:        "|/var/lib/mailman/mail/mailman leave mailman"  
mailman-owner:        "|/var/lib/mailman/mail/mailman owner mailman"  
mailman-request:      "|/var/lib/mailman/mail/mailman request mailman"  
mailman-subscribe:    "|/var/lib/mailman/mail/mailman subscribe mailman"  
mailman-unsubscribe:  "|/var/lib/mailman/mail/mailman unsubscribe mailman"  
   
Hit enter to notify mailman owner... <-- ENTER  
   
root@server1:~#

nano /etc/aliases

[...]  
## mailman mailing list  
mailman:              "|/var/lib/mailman/mail/mailman post mailman"  
mailman-admin:        "|/var/lib/mailman/mail/mailman admin mailman"  
mailman-bounces:      "|/var/lib/mailman/mail/mailman bounces mailman"  
mailman-confirm:      "|/var/lib/mailman/mail/mailman confirm mailman"  
mailman-join:         "|/var/lib/mailman/mail/mailman join mailman"  
mailman-leave:        "|/var/lib/mailman/mail/mailman leave mailman"  
mailman-owner:        "|/var/lib/mailman/mail/mailman owner mailman"  
mailman-request:      "|/var/lib/mailman/mail/mailman request mailman"  
mailman-subscribe:    "|/var/lib/mailman/mail/mailman subscribe mailman"  
mailman-unsubscribe:  "|/var/lib/mailman/mail/mailman unsubscribe mailman"

newaliases

service postfix restart

ln -s /etc/mailman/apache.conf /etc/apache2/conf-enabled/mailman.conf

service apache2 restart

service mailman start

apt-get install pure-ftpd-common pure-ftpd-mysql quota quotatool

nano /etc/default/pure-ftpd-common

[...]  
STANDALONE_OR_INETD=standalone  
[...]  
VIRTUALCHROOT=true  
[...]  

echo 1 > /etc/pure-ftpd/conf/TLS

mkdir -p /etc/ssl/private/

openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem

Country Name (2 letter code) [AU]: <-- Enter your Country Name (e.g., "DE").  
State or Province Name (full name) [Some-State]: <-- Enter your State or Province Name.  
Locality Name (eg, city) []: <-- Enter your City.  
Organization Name (eg, company) [Internet Widgits Pty Ltd]: <-- Enter your Organization Name (e.g., the name of your company).  
Organizational Unit Name (eg, section) []: <-- Enter your Organizational Unit Name (e.g. "IT Department").  
Common Name (eg, YOUR name) []: <-- Enter the Fully Qualified Domain Name of the system (e.g., "server1.example.com").  
Email Address []: <-- Enter your Email Address.

chmod 600 /etc/ssl/private/pure-ftpd.pem

service pure-ftpd-mysql restart

nano /etc/fstab

# /etc/fstab: static file system information.  
#  
# Use 'blkid' to print the universally unique identifier for a  
# device; this may be used with UUID= as a more robust way to name devices  
# that works even if disks are added and removed. See fstab(5).  
#  
#        
# / was on /dev/sda1 during installation  
UUID=3dc3b58d-97e5-497b-8254-a913fdfc5408 / ext4 errors=remount-ro,usrjquota=quota.user,grpjquota=quota.group,jqfmt=vfsv0 0 1  
# swap was on /dev/sda5 during installation  
UUID=36bf486e-8f76-492d-89af-5a8eb3ce8a02 none swap sw 0 0  
/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0

mount -o remount /

quotacheck -avugm  
quotaon -avug

apt-get install bind9 dnsutils

apt-get install haveged

apt-get install webalizer awstats geoip-database libclass-dbi-mysql-perl libtimedate-perl

nano /etc/cron.d/awstats

#MAILTO=root

#*/10 * * * * www-data [ -x /usr/share/awstats/tools/update.sh ] && /usr/share/awstats/tools/update.sh

# Generate static reports:
#10 03 * * * www-data [ -x /usr/share/awstats/tools/buildstatic.sh ] && /usr/share/awstats/tools/buildstatic.sh

apt-get install build-essential autoconf automake libtool flex bison debhelper binutils

cd /tmp  
wget http://olivier.sessink.nl/jailkit/jailkit-2.19.tar.gz  
tar xvfz jailkit-2.19.tar.gz  
cd jailkit-2.19  
./debian/rules binary

cd ..  
dpkg -i jailkit_2.19-1_*.deb  
rm -rf jailkit-2.19*

apt-get install fail2ban

nano /etc/fail2ban/jail.local

[pureftpd]
enabled  = true
port     = ftp
filter   = pureftpd
logpath  = /var/log/syslog
maxretry = 3

[dovecot-pop3imap]
enabled = true
filter = dovecot-pop3imap
action = iptables-multiport[name=dovecot-pop3imap, port="pop3,pop3s,imap,imaps", protocol=tcp]
logpath = /var/log/mail.log
maxretry = 5

[postfix-sasl]
enabled  = true
port     = smtp
filter   = postfix-sasl
logpath  = /var/log/mail.log
maxretry = 3

nano /etc/fail2ban/filter.d/pureftpd.conf

[Definition]
failregex = .*pure-ftpd: \(.*@\) \[WARNING\] Authentication failed for user.*
ignoreregex =

nano /etc/fail2ban/filter.d/dovecot-pop3imap.conf

[Definition]
failregex = (?: pop3-login|imap-login): .*(?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed|Aborted login \(\d+ authentication attempts).*rip=(?P\S*),.*
ignoreregex =

echo "ignoreregex =" >> /etc/fail2ban/filter.d/postfix-sasl.conf

service fail2ban restart

apt-get install ufw