Showing posts with label linux. Show all posts

Monday, August 13, 2012

Clean-up your Linux /boot partition

My server monitoring by New Relic told me the other day that one of my server's disk drives was full. Upon further inspection it was just the /boot partition, the actual data partition had reached less then 40% capacity. However the /boot partition was filled with old versions of the Linux kernel that hadn't been removed.

Using this great post I was able to remove the 8 older Linux kernels on my Ubuntu 10.04 LTS system.

Thursday, July 19, 2012

Unable to start MySQL after upgrade to Ubuntu 12.04 LTS

I recently upgraded one of my Ubuntu servers from 10.04 LTS to 12.04 LTS. During the process it warned me about the servers MySQL configuration file being different then the one provided in the package by the maintainer. I selected to keep mine, with it’s customizations, however after the upgrade I was no longer able to start the MySQL service.

To get the list of MySQL packages that were installed and that I needed to remove, I used the following command:

dpkg –get-selections | grep mysql

I removed the MySQL server using the following command:

sudo apt-get remove libmysqlclient16 libmysqlclient18 mysql-client-core–5.5 mysql-common mysql-server–5.1 mysql-server–5.5 mysql-server-core–5.5

I then restarted the server using the following command:

sudo shutdown -r now

I then installed MySQL once again using the following command:

sudo apt-get install mysql-server mysql-client

However that process terminated with the error dpkg: error processing mysql-server (--configure)

This time I removed the MySQL using the following command:

sudo aptitude purge libmysqlclient16 libmysqlclient18 mysql-client-core–5.5 mysql-common mysql-server–5.1 mysql-server–5.5 mysql-server-core–5.5

Then I renamed the /etc/mysql/ directory and restarted the server using the following command:

sudo mv /etc/mysql/ /etc/mysql.old
sudo shutdown -r now

Once the server restarted I re-installed MySQL, which completed correctly, by using the following command:

sudo apt-get install mysql-server mysql-client

In comparing my old MySQL configuration file and the new configuration file I noted the difference seems to be the addition of the following line under the [mysqld] section:

pid-file = /var/run/mysqld/mysqld.pid

Also, I had to remove the following two lines that I had added to the new MySQL configuration, as the server wouldn’t start with these two settings under the [mysqld]that I used with MySQL 5.1:

default-collation=utf8_unicode_ci
default-character-set=utf8

With those lines above removed or commented out, I was able to successfully start the server and all of my databases were intact and working.

After reviewing the MySQL 5.5 documentation it looks like the server option default-collation was deprecated in MySQL 5.5.3 in favor of collation-server. The same is true of the server option default-character-set being deprecated in MySQL 5.5.3 in favor of character-set-server

Thursday, October 20, 2011

MySQL won’t start after Ubuntu 11.10 upgrade

I upgrade my Ubuntu database server from 10.10 to 11.04 to 11.10 and suddenly my MySQL Server stopped responding.

Turned out the problem was that I didn’t accept one of the new apparmor configurations since it looked minimal and I had customized mine. Because of this my /var/log/mysql/error.log was filled with the following:

111020 17:31:44 [Note] Plugin 'FEDERATED' is disabled.
111020 17:31:44  InnoDB: Initializing buffer pool, size = 896.0M
111020 17:31:44  InnoDB: Completed initialization of buffer pool
111020 17:31:44  InnoDB: Started; log sequence number 0 172373406
111020 17:31:44 [ERROR] Can't start server : Bind on unix socket: Permission denied
111020 17:31:44 [ERROR] Do you already have another mysqld server running on socket: /var/run/mysqld/mysqld.sock ?
111020 17:31:44 [ERROR] Aborting

I had to edit the app armor file for MySQL

sudo nano /etc/apparmor.d/usr.sbin.mysqld

changed

  /run/mysqld/mysqld.pid w,
  /run/mysqld/mysqld.sock w,

  /{,var/}run/mysqld/mysqld.pid w,
  /{,var/}run/mysqld/mysqld.sock w,

Tuesday, October 04, 2011

Installing VMware Tools for Ubuntu 10.04+

Update your system to the latest packages

This updates your system with the catalog of the latest packages available, then upgrades any packages on your system that may have updates available.

sudo apt-get update -y
sudo apt-get dist-upgrade -y

Install the dynamic kernel modules

These modules will allow you to dymanically load modules with the kernel. I’m of the understanding that this prevents you from having to re-install the VMware Tools everytime the Linux kernel is updated.

sudo apt-get install dkms -y

Install VMware Tools

First you’ll need to initiate the VMware Tools install from the VMware Host system. This can usually be found on a “Tools –> VMware Tools Install” like menu.

Next we install the Linux build commands that are needed to compile the kernel with the VMware Tools extensions. This also requires the correct Linux headers for our system, which are determined using a system variable. Then we remove any packages that are no longer used (generally none, but just to be sure).

Finally we install the VMware Tools by doing the following:

Create a directory to mount the tools CD-ROM to
Mount the CD-ROM to the directory
Copy the tools archive to the temporary directory on the system
Unmount the CD-ROM
Change to the temporary directory
Extract the archive of the VMware Tools
Change to the VMware Tools extraction directory
Execute the VMware Tools installer script and indicate to use the defaults for all choices during the installation

sudo apt-get install build-essential gcc -y
sudo apt-get install linux-headers-$(uname -r) -y
sudo apt-get autoremove -y
sudo mkdir -p /media/cdrom
sudo mount /dev/cdrom /media/cdrom
cp /media/cdrom/VM* /tmp
sudo umount /media/cdrom
cd /tmp
tar -xzvf VMware*.gz
cd vmware-tools-distrib/
sudo ./vmware-install.pl -d

Restart the system

Last we want to restart the system for all of the changes to take affect.

sudo shutdown -r now

Monday, June 27, 2011

500 OOPS: SSL: cannot load RSA certificate

I recently setup a vsftpd 2.2.2 server running on Ubuntu Server 10.04 LTS that required SSL connections for the login and data transfer, however I wasn’t able to get the commercial SSL certificate from Comodo (InstantSSL) to work with the service. I later found out that I needed to concatenate the certificate that I received from Comodo with their latest bundle certificate, which I blogged about here before. However, I personally still couldn’t get this to work after much trial and error. When starting the vsftpd daemon from the command-line would produce the message “500 OOPS: SSL: cannot load RSA certificate”.

After a volley of email back and forth with Comodo Support over the past three weeks they helped me to isolate the problem. I was missing a single “-” at the end of my server certificate. At the end of your certificate it should have “—–END CERTIFICATE—–”, that’s five dashes on either side. I had four on the right-hand side, which prevented vsftpd from starting (although Apache never complained). I had searched on this error all over the Internet and never found a mention of this, so if you’re here searching on this error, check your dashes!

Friday, June 17, 2011

Ubuntu 10.04 and vsftpd configuration for virtual users

One of the labs that I work for wanted to have a shared file share that’s accessible from anywhere, from any of the clients they run. We ended up going with a FTPS configuration on Ubuntu using vsftpd. All of the users are considered “virtual users”, so they don’t have login privileges to the Ubuntu system, only the FTP daemon running (meaning no SSH, etc). Also, all users are working out of the same file share folder.

Since I had some trouble finding a good set of directions, I thought I’d write up what I did. First, because I’ll probably have to repeat it at some point, second because someone else might be looking for the same thing.

Requirements

Ubuntu 10.04 LTS
vsftpd 2.2.2+
SSL certificate, either self-signed or from a SSL provider

Install software

If you haven’t installed vsftpd yet, you’ll want to do this:

sudo apt-get install vsftpd

Next we need a database utility for creating the hashed username/password file that vsftpd will authenticate against:

sudo apt-get install db4.8-util

Create virtual users

Now we need to create a text file that will have your virtual users identified. Let’s start by creating a directory to store this in: sudo mkdir -p /etc/vsftpd

Now create the text file. This file will be turned into a hashed database file, so it’s OK that you’re typing out the password in clear text right now. sudo nano /etc/vsftpd/logins.txt

The file configuration is one line for the user account name, then the next line is the account password. Repeat this for each user in a single monolithic file. For example:

    mary
    das2hky434adfg6yjkaf
    peter
    uh4nufh7ands
    paul
    ud674kr6d

Now we take this plain-text file and convert it to a database file with hashed passwords using the following command

sudo db_load -T -t hash -f /etc/vsftpd/logins.txt /etc/vsftpd/virtual-users.db

We should change the file permissions on both of these files, just to protect them from prying eyes:

sudo chmod 600 /etc/vsftpd/logins.txt
sudo chmod 600 /etc/vsftpd/virtual-users.db

Note: in the future if you need add/change/delete users, modify the logins.txt file and then use the db_load command to re-create the hashed database file.

Configure vsftpd

Now we need to configure the vsftpd daemon to use the correct directory, have the correct permissions and correctly authenticate our users.

Let’s create a single directory for the data files on our server

sudo mkdir -p /var/ftp-data

Make sure that your ftp service account (created when we installed vsftpd) has correct permissions for this directory

sudo chown -R ftp:ftp /var/ftp-data

Now we need to create a new type of authentication that vsftpd will use to verify our user logins. We do this by creating a new file in the PAM configuration folder

sudo nano /etc/pam.d/vsftpd-virtual

The file contents should be as follows, which tells the system to look at our hashed database for the user login/password combinations:

auth required pam_userdb.so db=/etc/vsftpd/virtual-users
account required pam_userdb.so db=/etc/vsftpd/virtual-users

Now we have to tell vsftpd about these new configurations, but first let’s make a backup of the configuration, then make a new one.

sudo mv /etc/vsftpd.conf /etc/vsftpd/vsftpd.conf.bak
sudo nano /etc/vsftpd.conf

For the contents of this file, paste the following:

# runs vsftpd in standalone mode listen=YES

# listens on this port for incoming FTP connections listen_port=21 # disables anonymous FTP anonymous_enable=NO # enables non-anonymous FTP local_enable=YES # enables uploads and new directories write_enable=YES # the umask for file creation local_umask=022 # Activate directory messages - messages given to remote users when they # go into a certain directory. dirmessage_enable=YES # If enabled, vsftpd will display directory listings with the time # in your local time zone. The default is to display GMT. The # times returned by the MDTM FTP command are also affected by this # option. use_localtime=YES # Activate logging of uploads/downloads. xferlog_enable=YES # Make sure PORT transfer connections originate from port 20 (ftp-data). connect_from_port_20=YES # the virtual user is restricted to the virtual FTP area chroot_local_user=YES # the PAM file used by authentication of virtual uses pam_service_name=vsftpd-virtual # SSL configuration directives rsa_cert_file=/etc/ssl/certs/server.crt rsa_private_key_file=/etc/ssl/private/server.key ssl_enable=YES force_local_logins_ssl=YES force_local_data_ssl=YES ssl_tlsv1=YES ssl_sslv2=NO ssl_sslv3=NO # the minimum port to allocate for PASV style data connections pasv_min_port=31000 # the maximum port to allocate for PASV style data connections pasv_max_port=31453 # activates virtual users guest_enable=YES # virtual users to use local privs, not anon privs virtual_use_local_privs=YES # specifies a home directory for all virtual users local_root=/var/ftp-data # hides the FTP server user ID, just show "ftp" in directory listings hide_ids=YES

Now we restart the vsftpd service for all of the changes to take place

sudo service vsftpd restart

Conclusion

If you have a SSL certificate in the directory outlined, then you should be able to login to the FTP service over SSL and have access to the directory we setup in /var/ftp-data.

In my case we also put this network share behind an Astaro Security Gateway (ASG), so first our users make an SSL VPN connection to the ASG, then make a SSL connection to the FTP server.

Monday, June 13, 2011

Moving MySQL data and log files to separate disk drives

I’ve setup a new production system for a department here on campus. The back-end system is running MySQL and I wanted to have the OS, MySQL data and MySQL log files all on separate disks. The system I’m running consists of the following:

Ubuntu Server 10.04 LTS
MySQL 5.1

I was able to accomplish this by doing the following procedure.

Install the new hard drives

I’m running the system on a VMWare vSphere 4.x cluster, however this should work if you’re running on a physical system as well. You’ll first need to physically (or virtually in my case) install the hard disk drives. Next we’ll need to setup the disks on the system. I followed the instructions for installing a new hard drive on the Ubnutu documentation site. I ended up with the following:

/media/mysql_data = for my data files
/media/mysql_logs = for my log files

Configure MySQL for the different drives

First we’ll need to stop the MySQL database daemon sudo service mysql stop

Give the mysql user ownership of the new directories:

sudo chown -R mysql:mysql /media/mysql_data
sudo chown -R mysql:mysql /media/mysql_logs

Copy (just in case something goes awry) the database data files and directories to the new directory, then make sure the mysql user has ownership of these files:

sudo cp -rp /var/lib/mysql/* /media/mysql_data
sudo chown -R mysql:mysql /media/mysql_data/*

Remove the log files from the data directory

sudo rm -f /media/mysql_data/*log*

Copy (just in case something goes awry) the database log files and directories to the new directory, then make sure the mysql user has ownership of these files:

sudo cp -rp /var/lib/mysql/*log* /media/mysql_logs
sudo chown -R mysql:mysql /media/mysql_logs/*

Update the MySQL daemon configuration with the changed location

sudo nano /etc/mysql/my.cnf

Find the following statement “datadir” and change it to the new location:

datadir = /media/mysql_data

I also added the following in InnoDB area under the [mysqld] section # Default data directory for data files

innodb_data_home_dir = /media/mysql_data

# Set buffer pool size to 50-80% of your computer’s memory

innodb_buffer_pool_size=896M
innodb_additional_mem_pool_size=20M
innodb_log_group_home_dir = /media/mysql_logs

Save the file and exit.

Configure Ubuntu AppArmor protection for MySQL

Next we need to update the apparmor file to tell the system about these new file locations

sudo nano /etc/apparmor.d/usr.sbin.mysqld

Add the new location:

/media/mysql_data/ r,
/media/mysql_data/* rwk,
/media/mysql_logs/ r,
/media/mysql_logs/* rwk,

Modify the following file:

sudo nano /etc/apparmor.d/abstractions/mysql

Add the following line

/media/mysql_data/mysql/mysql.sock rw,

Restart the services

Now we just need to restart the AppArmor and MySQL services

sudo /etc/init.d/apparmor restart
sudo service mysql start

Thursday, June 09, 2011

Installing Oracle Java on Ubuntu 10.04 LTS

It seems lately that I've installed Oracle Java on a number of Ubuntu systems, and while I have a small little "cheat sheet" on how I do it here, I thought putting it on the blog might be something useful for others. If nothing else I know where to look if I can't find it on my system here. This assumes you're running Ubuntu 10.04 LTS (I can't speak to other versions) and that you're using 1.6_26 (it's the current version as of this writing). Modify the file name accordingly if a newer version is available. This will install the java files into the /usr/local/java folder, create a link of /usr/local/java/latest that points to the latest version (makes it easy to change when you install a newer version of Java). Finally it sets up the environment variables and path on your system. Download the Java Development Kit

wget http://download.oracle.com/otn-pub/java/jdk/6u26-b03/jdk-6u26-linux-x64.bin

Make the file executable and then execute the self-extraction

sudo chmod +x jdk-6u25-linux-x64.bin
sudo ./jdk-6u25-linux-x64.bin

Now we remove the JDK to the /usr/local/java folder, remove the downloaded file and setup the environment variables and path

    sudo rm -rf jdk-6u26-linux-x64.bin
    sudo mkdir -p /usr/local/java
    sudo mv jdk1.6.0_26 /usr/local/java/jdk1.6.0_26
    sudo ln -s /usr/local/java/jdk1.6.0_26 /usr/local/java/latest
    sudo mv /etc/environment /etc/environment.bak
    sudo echo "JAVA_HOME=\"/usr/local/java/latest\"" > ~/environment
    sudo echo "JRE_HOME=\"/usr/local/java/latest/jre\"" >> ~/environment
    sudo echo "PATH=\"\$JAVA_HOME/bin:$PATH\"" | cat >> ~/environment
    sudo mv ~/environment /etc/environment
    sudo echo "export JAVA_HOME=\"/usr/local/java/latest\"" > /etc/profile.d/javaenv.sh
    sudo echo "export JRE_HOME=\"/usr/local/java/latest/jre\"" >> /etc/profile.d/javaenv.sh
    sudo echo "export PATH=\"\$JAVA_HOME/bin:$PATH\"" | cat >> /etc/profile.d/javaenv.sh
    sudo /etc/profile.d/javaenv.sh

Confirm Java is installed and the version is correct

java -version

Wednesday, June 08, 2011

Hosting vsftpd (FTPS) server behind Astaro Security Gateway

At work we're moving from an internal Microsoft Windows hardware file server to a Ubuntu 10.04 LTS virtual server housed within the University data center. To provide secure, remote access to our shared files I've setup a vsftpd 2.2.2 FTP server that requires SSL for login and data transfer. This server lives "behind" an Astaro Security Gateway for protection.

I had some trouble with the setup of this initially, namely I could make a connection from outside on port 21, however I wasn't able to setup the data connection successfully to list the directory and perform transfers.

After much searching peppered with plenty of trial and error I was able to finally configure this setup correctly. Here is how I did it.

Server setup

Ubuntu 10.04 LTS server
vsftpd 2.2.2
Self-signed SSL certificate

Generate a 5 year self-signed certificate using 2048 bits

sudo openssl req -x509 -nodes -days 1825 -newkey rsa:2048 -keyout /etc/ssl/certs/vsftpd.pem -out /etc/ssl/certs/vsftpd.pem

Install the vsftpd server if you haven’t already

sudo apt-get install vsftpd

Configure the vsftpd server configuration file

sudo nano /etc/vsftpd.conf

Here we need to add the following lines at the end of the configuration file. Note that a key here is you define what your FTP PASV ports will be for data transfers. I’m using random values, so please select your own instead of just copying these:

    rsa_cert_file=/etc/ssl/certs/vsftpd.pem
    ssl_enable=YES
    force_local_logins_ssl=YES
    force_local_data_ssl=YES
    ssl_tlsv1=YES
    ssl_sslv2=NO
    ssl_sslv3=NO
    pasv_min_port=33423
    pasv_max_port=33500

Save the configuration file, then restart the vsftpd service

sudo /etc/init.d/vsftpd restart

Astaro Security Gateway v8.103 setup

In this example we’ll pretend the Astaro Security Gateway external interface has an IP of 1.1.1.1 and an additional IP address of 1.1.1.2 configured for just the traffic to go to the FTP server. You would configure the additional IP address for the external interface by going to:

Interfaces & Routing
Interfaces
Additional Addresses
New additional address…
Name = 1.1.1.2
On interface = External (WAN)
IPv4 Address = 1.1.1.2
Netmask = 255.0.0.0
Comment = my ftp server address
Save and make sure to enable the IP address by clicking on the green light to the left of the adapter graphic

Next we need to define a new service on the Astaro. This will be used to tell it what ports to expect the data connections on. We’ll be using the port range we specified earlier in the vsftpd.conf file. To setup this service, do the following:

Definitions
Services
New service definition…
Name = FTP-Data
Type of Definition = TCP
Destination port = 33423:33500
Source port = 1:65535
Comment = File Transfer Protocol Data
Save

OK, now we need to setup a definition for your internal FTP server that we’ll be exposing to the Internet. To do this, do the following:

Definitions
Networks
New network definition…
Name = ftp-server
Type = host
Interface = internal
IPv4 Address = 192.168.0.22
Comment = my internal ftp server
Save

Now that we’ve configured the system and service defintions we’ll actually create the rules to allow the inbound connections to the external IP address (1.1.1.2) to be passed to the internal IP address (192.168.0.22) using the FTP port (21) and respond back and allow data connections using the range we specified (33423 to 33500).

First we setup the destination NAT rule (DNAT) by doing the following:

Network Security
NAT
DNAT/SNAT
New NAT rule…
Traffic source = Any
Traffic service = FTP
Traffic destination = 1.1.1.2
NAT mode = DNAT (Destination)
Destination = ftp-server
Destination service = FTP
Save
New NAT rule…
Traffic source = Any
Traffic service = FTP-Data
Traffic destination = 1.1.1.2
NAT mode = DNAT (Destination)
Destination = ftp-server
Destination service = FTP-Data
Save

Make sure to enable both of these DNAT rules by clicking on the green light to the left of the DNAT rule number!

Lastly we’ll configure the packet filter rules to allow the traffic by doing the following:

Network Security
Packet Filter
New rule…
Source = Any
Service = FTP
Destination = ftp-server
Action = Allow
Save
New rule…
Source = Any
Service = FTP-Data
Destination = ftp-server
Action = Allow
Save

Again, make sure to enable both of these packet filter rules by clicking on the green light to the left of the packet filter rule number!

Client setup

On the two Mac systems we’re using the excellent Panic Transmit application. This allows us to access the share like a regular FTP server or mount the FTP server as a drive on the Mac (this is key for us). Create a new connection with the following parameters:

Protocol = FTP with TLS/SSL
Server = 1.1.1.2
User Name = whatever your Linux login account is
Password = whatever your Linux login password is
Port = 21
Use passive model = checked
Save

On the ten Windows systems we’re using NetDrive which allows us to mount the FTP server as a drive in Windows explorer (again, this is key for my users). Create a new connection with the following parameters:

Site name = 1.1.1.2
Site IP or URL = 1.1.1.2
Port = 21
Server Type = FTP
Drive = F
Account = whatever your Linux login account is
Password = whatever your Linux login password is
Save
Advanced
SSL = Force SSL for all communications
OK

Conclusion

That should have you setup and running now, able to access your internally hosted vsftpd server over SSL from external clients through the Astaro Security Gateway you have in front of the internal FTP server.

Using Comodo (InstantSSL) certificate with vsftpd (FTPS) server

It turns out the the problem is that Comodo certificates require the installation of a root and intermediate certificate for the issued certificate to work. Now that I know that, thanks to this knowledge base article it’s easy to fix. Here’s how to fix it on your server.

Download the Comodo bundle

sudo wget http://www.instantssl.com/ssl-certificate-support/cert_installation/bundle.crt -O ~/instantssl.crt

Concatenate certificates

sudo cat _your SSL certificate from Comodo_ ~/instantssl.crt >> ~/vsftpd.pem

Now configure your vsftpd.conf file to point to this new .pem file and restart the vsftpd service. Connections should now be using the valid certificate.

Friday, May 20, 2011

Setting Up a Mutli-CFML Engine Development Server

Summary

After attending the cf.Objective() 2011 conference last week, and attending Matt Woodward’s “Running Mulitple CFML Engines on Apache Tomcat” session, I wanted to setup a development server running multiple versions of the CFML language. I decided to setup this server with the following technologies:

I’m sure I’ll repeat this process at some point in the future so I wanted to record these steps to simply the process in the future, and perhaps someone else might find them helpful. Note that I’m installing all of this in a virtual machine on my Mac using VMware Fusion, however you should be able to do the exact same thing using VirtualBox.

Install Ubuntu Server

Download the server ISO and install this in your virtual machine
Accept all of the default options and make sure you select the “OpenSSH” option when prompted near the end.
We need to modify the packages source for one of the components required for ColdFusion, so open the sources list by typing
```
nano /etc/apt/sources.list
```
Add the following line as the first line under “universe” packages
```
"deb http://us.archive.ubuntu.com/ubuntu jaunty main universe"
```
Now we’ll install some additional packages that are needed for the guest tools by your virtualization software and ColdFusion, as well as upgrade the server software to the latest versions by typing
```
sudo apt-get update
sudo apt-get install build-essential gcc linux-headers-$(uname -r) libstdc++5 
sudo apt-get upgrade 
sudo apt-get dist-upgrade"
```
Determine your virtual machines IP address by typing “sudo ifconfig” and recording the 192.x.x.x address as you’ll need later.
Install the VMware Tools or VirtualBox Guest Additions for best performance. If you’re on VMware Fusion you’d type the following:
```
sudo mkdir /mnt/cdrom
sudo mount /dev/cdrom /mnt/cdrom
ls /mnt/cdrom
tar xzvf /mnt/cdrom/VMwareTools-<x.x.x-xxxx>.tar.gz -C /tmp/
cd /tmp/vmware-tools-distrib/
sudo ./vmware-install.pl -d
sudo reboot
```
Install Apache HTTP Server
- Install the Apache web server by typing “sudo apt-get apache2”
- Browse to http://<server_ip_address_here> to verify the installation is successful and running
Install MySQL Client & Server
- Install the MySQL client and server by typing “sudo apt-get mysql-client mysql-server”
- Set the root password when prompted
Install Oracle Java
- Download the latest Java JDK, make sure to NOT select the one with the “RPM” in the file name, you do NOT want that file.
- Copy this file to your virtual machine. If you’re on a Mac you’d use Secure File Copy to do this by opening your Terminal, then going to your Downloads directory (type “cd Downloads”) then type
```
scp jdk<full file name here> <ubuntu_user_name_here>@<ubuntu_ip_address_here>:~
```
- Login to the Ubuntu server
- Make the Java package executable by typing
```
sudo chmod +x jdk<full_file_name_here>
```
- Execute the Java package by typing
```
sudo ./jdk<full_file_name_here>
```
- Make a general java directory for holding the Java VM for the system by typing
```
sudo mkdir -p /opt/java
```
- Copy the Java installation to the /opt/java directory by typing
```
sudo cp jdk<full_file_name_here>/ /opt/java/
```
- Now we need to add the Java path to the environment variable for easy access. It’s important to note the actual directory name created for your version of Java as it maybe different then mine. My entire path is /opt/java/jdk1.6.0_25/
- Modify your environment variables by typing
```
sudo nano ~/.bash_rc
```
- Add the following lines:
```
PATH=${PATH}:/opt/java/jdk1.6.0_25/bin  #you'll need to change if your directory name is different
export PATH
JAVA_HOME=/opt/java/jdk1.6.0_25  #you'll need to change if your directory name is different
export JAVA_HOME
```
- Now exit the editor by holding down the Control key and pressing the “X” key, type “Y” to save and then the Enter key to retain the same file name.
- Restart your server
Install Apache Tomcat 7
- Download the latest .tar.gz file
- Copy this file to your virtual machine. If you’re on a Mac you’d use Secure File Copy to do this by opening your Terminal, then going to your Downloads directory (type “cd Downloads”) then type
```
scp apache-tomcat<full_file_name_here>  <ubuntu_user_name_here>@<ubuntu_ip_address_here>:~
```
- Extract the Tomcat archive by typing
```
tar -xf apache-tomcat<full_file_name_here>
```
- Delete the archive by typing
```
sudo rm -rf apache-tomcat<full_file_name_here>
```
- Now we’ll rename the directory to make it easier to reference by typing
```
sudo mv apache-tomcat tomcat
```
- Move the Tomcat program to the /opt directory by typing
```
"sudo mv tomcat /opt
```
- Now we need to modify the environment for Tomcat, to do this type “sudo nano /opt/tomcat/bin/setenv.sh” and add the following two lines for your environment
```
export JAVA_HOME=/opt/java/jdk1.6.0_25
export CATALINA_OPTS="-Xms256m -Xmx512m -XX:MaxPermSize=384m"
```
- Now exit the editor by holding down the Control key and pressing the “X” key, type “Y” to save and then the Enter key to retain the same file name.
- Start the Tomcat server by typing
```
sudo ./startup.sh
```
- Browse to http://<server_ip_address_here>:8080 to verify the installation is successful and running
Install Open BlueDragon
- Copy this file to your virtual machine. If you’re on a Mac you’d use Secure File Copy to do this by opening your Terminal, then going to your Downloads directory (type “cd Downloads”) then type
```
scp openbd.war  <ubuntu_user_name_here>@<ubuntu_ip_address_here>:~
```
- Login to your Ubuntu Server
- Deploy the Open BlueDragon engine by typing
```
sudo cp openbd.war /opt/tomcat/webapps/openbd.war
```
- Browse to http://<server_ip_address_here>:8080/openbd to verify the installation is successful and running
Install Railo
- Copy this file to your virtual machine. If you’re on a Mac you’d use Secure File Copy to do this by opening your Terminal, then going to your Downloads directory (type “cd Downloads”) then type
```
scp railo-<full_file_name_here>   <ubuntu_user_name_here>@<ubuntu_ip_address_here>:~
```
- Login to your Ubuntu Server
- Deploy the Railo engine by typing
```
sudo cp railo<full_file_name_here>.war /opt/tomcat/webapps/railo.war
```
- Browse to http://<server_ip_address_here>:8080/railo to verify the installation is successful and running
Install Adobe ColdFusion 8
- Copy this file to your virtual machine. If you’re on a Mac you’d use Secure File Copy to do this by opening your Terminal, then going to your Downloads directory (type “cd Downloads”) then type
```
scp coldfusion-8<full file name here>  <ubuntu_user_name_here>@<ubuntu_ip_address_here>:~
```
- Login to your Ubuntu Server
- Make the ColdFusion installer executable by typing
```
sudo chmod +x coldfusion-801-lin64.bin
```
- Start the installer by typing
```
sudo ./coldfusion-801-lin64.bin
```
- Select the following options:
  - Read through the license agreement by pressing the Enter key
  - For install type, select “Developer Edition” using #3
  - For installer configuration, select “J2EE configuration (WAR file)” using #4
  - Un-select all of the sub-components by pressing 1, Enter, 2, Enter, 3, Enter, 4, Enter, 5, Enter
  - For Choose Install Folder, press Enter to accept the default
  - For Configure ColdFusion with OpenOffice, select 2, Enter
  - Enter a password for the ColdFusion administrator
  - For Enable RDS, select Y
  - Enter a pssword for RDS
- Now that the installer has completed, we need to deploy the ColdFusion 8 engine by typing
```
sudo cp /opt/coldfusion8/cfusion.war  /opt/tomcat/webapps/cfusion8.war
```
- Browse to http://<server_ip_address_here>:8080/cfusion8/CFIDE/administrator/index.cfm to verify the installation is successful and running
Install Adobe ColdFusion 9
- Copy this file to your virtual machine. If you’re on a Mac you’d use Secure File Copy to do this by opening your Terminal, then going to your Downloads directory (type “cd Downloads”) then type
```
scp ColdFusion_9_<full file name here>  <ubuntu_user_name_here>@<ubuntu_ip_address_here>:~
```
- Login to your Ubuntu Server
- Make the ColdFusion installer executable by typing
```
sudo chmod +x ColdFusion_9_WWE_linux64.bin
```
- Start the installer by typing
```
sudo ./ColdFusion_9_WWE_linux64.bin
```
- Select the following options:
  - Read through the license agreement by pressing the Enter key
  - For install type, select “Developer Edition” using #3
  - For installer configuration, select “J2EE configuration (WAR file)” using #4
  - Un-select all of the sub-components by pressing 1, Enter, 2, Enter, 3, Enter, 4, Enter, 5, Enter
  - For Choose Install Folder, press Enter to accept the default
  - For Configure ColdFusion with OpenOffice, select 2, Enter
  - Enter a password for the ColdFusion administrator
  - For Enable RDS, select Y
  - Enter a pssword for RDS
Install Adobe ColdFusion 9.0.1 Update
- Copy this file to your virtual machine. If you’re on a Mac you’d use Secure File Copy to do this by opening your Terminal, then going to your Downloads directory (type “cd Downloads”) then type
```
scp  ColdFusion_update_<full file name here>   <ubuntu_user_name_here>@<ubuntu_ip_address_here>:~
```
- Login to your Ubuntu Server
- Make the ColdFusion installer executable by typing
```
"sudo chmod +x ColdFusion_update_901_WWEJ_linux64.bin
```
- Start the installer by typing
```
"sudo ./ColdFusion_update_901_WWEJ_linux64.bin
```
- For the installer do the following:
  - Press Enter
  - Accept the license agreement
  - For Configuration Installation select #3
  - For EAR/WAR Location, enter the location you used in the previous installation
    - /opt/coldfusion9/cfusion.war
  - For the “Pre-Installation Summary”, press Enter
- Now that the installer has completed, we need to deploy the ColdFusion 9 engine by typing
```
sudo cp /opt/coldfusion9/cfusion.war  /opt/tomcat/webapps/cfusion9.war
```
- Browse to http://<server_ip_address_here>:8080/cfusion9/CFIDE/administrator/index.cfm to verify the installation is successful and running
Configuring Tomcat to startup with the system
For one last bit of configuration, we’ll set the Tomcat server to start at system startup to make things easier for us. To do this I’m going to borrow a script written by Aaron West here with a few mondifications following Jenson Taylor written here for my system. To setup this file type the following
```
sudo nano /etc/init.d/tomcat
```
and then add the following to the contents:
```
#!/bin/sh -e
### BEGIN INIT INFO
# Provides: tomcat
# Required-Start: $local_fs $remote_fs $network $syslog
# Required-Stop: $local_fs $remote_fs $network $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# X-Interactive: true
# Short-Description: Start/stop Tomcat as service
### END INIT INFO

# setup the JAVA_HOME environment variable
export JAVA_HOME=/opt/java/jdk1.6.0_25

ENV="env -i LANG=C PATH=/usr/local/bin:/usr/bin:/bin"

#set -e

#. /lib/lsb/init-functions

#test -f /etc/default/rcS && . /etc/default/rcS

case $1 in
start)
echo -n "Starting Tomcat server"
echo " "
sh /opt/tomcat/bin/startup.sh
echo
;;
stop)
echo -n "Stopping Tomcat server"
echo " "
sh /opt/tomcat/bin/shutdown.sh
;;
restart)
echo -n "Restarting Tomcat server"
echo " "
sh /opt/tomcat/bin/shutdown.sh
echo " "
sleep 6
echo " "
sh /opt/tomcat/bin/startup.sh
sleep 6
;;
esac
exit 0
```
Now we set this file to be executable and start at system startup by doing the following:
```
cd/etc/init.d
sudo chmod +x tomcat"
sudo update-rc.d -f tomcat defaults"
sudo shutdown -r now" to restart your server
```
Now if you restart your system, the Tomcat server should come up automatically!

Friday, April 29, 2011

Securing CentOS Server

I'm setting up a production CentOS Linux server at work. This will be my first production Linux box, I've always done Windows installs in the past. I wanted to disable the root user account from logging into the system, and change the default SSH port number. I found this nice guide (http://wiki.centos.org/HowTos/Network/SecuringSSH) on the CentOS site that details just how to do that.

Monday, August 13, 2012

Thursday, July 19, 2012

Thursday, October 20, 2011

Tuesday, October 04, 2011

Update your system to the latest packages

Install the dynamic kernel modules

Install VMware Tools

Restart the system

Monday, June 27, 2011

Friday, June 17, 2011

Requirements

Install software

Create virtual users

Configure vsftpd

Conclusion

Monday, June 13, 2011

Install the new hard drives

Configure MySQL for the different drives

Configure Ubuntu AppArmor protection for MySQL

Restart the services

Thursday, June 09, 2011

Wednesday, June 08, 2011

Server setup

Astaro Security Gateway v8.103 setup

Client setup

Conclusion

Download the Comodo bundle

Concatenate certificates

Friday, May 20, 2011

Summary

Install Ubuntu Server

Install Apache HTTP Server

Install MySQL Client & Server

Install Oracle Java

Install Apache Tomcat 7

Install Open BlueDragon

Install Railo

Install Adobe ColdFusion 8

Install Adobe ColdFusion 9

Install Adobe ColdFusion 9.0.1 Update

Configuring Tomcat to startup with the system

Friday, April 29, 2011