SAC:betawebsite

This is setup of Cloud server osgeo.public.cloudvps.com

It is a debian 8, 4GB, 160 HDD server.

Martin's changes to get LDAP SSH working properly (per ticket 2010 I presume these supercede the ones I made
# Avoid error messages upon login

root@osgeo:~# aptitude install locales-all

# Have the preferred LDAP subsystem

root@osgeo:~# aptitude install libpam-ldapd libnss-ldapd

# Purge deprecated configs

root@osgeo:~# dpkg -l | grep \^rc | awk '{print $2}' | cut -f 1 -d \: | xargs dpkg --purge

# Purge local user

root@osgeo:~# grep -v \^martin /etc/passwd > Hallo && cat Hallo > /etc/passwd root@osgeo:~# grep -v \^martin /etc/shadow > Hallo && cat Hallo > /etc/shadow root@osgeo:~# rm -vf Hallo

# Purge cache and reload LDAP stuff

root@osgeo:~# /etc/init.d/nscd stop; rm -vf /var/cache/nscd/*; /etc/init.d/nscd start root@osgeo:~# /etc/init.d/nslcd restart

# Voila

root@osgeo:~# getent passwd martin martin:x:10026:100:Martin Spott:/home/martin:/bin/tcsh

# Have a homedir and proper login shell

root@osgeo:~# cp -a /etc/skel /home/martin root@osgeo:~# chown -R martin:100 /home/martin root@osgeo:~# aptitude install tcsh

# Reduce authentication error log

root@osgeo:~# aptitude install fail2ban

# Now test

foehn: 17:06:08 ~> ssh osgeo.public.cloudvps.com martin@osgeo.public.cloudvps.com's password: [...]   osgeo:~>

# Success

Original Setup Steps
These are the steps I did after it was created in attempt to implement LDAP

First I installed updates

apt-get update apt-get upgrade apt-get install libpam-ldap nscd apt-get install libnss-ldap #not sure if this one is needed apt-get install locales-all apt-get install sudo

Then to try the ldap

https://wiki.debian.org/LDAP/PAM

1) edit /etc/ldap/ldap.conf (copied from osgeo6)    BASE    dc=osgeo, dc=org    URI     ldaps://ldap.osgeo.org/    #SIZELIMIT      12    #TIMELIMIT      15    #DEREF          never    TLS_CHECKPEER yes    TLS_REQCERT demand    TLS_CACERT /etc/ssl/certs/STAR_osgeo_org.ca-bundle  #this file you need to copy from osgeo6 as well    pam_groupdn cn=telascience,ou=Shell,dc=osgeo,dc=org  #not though telascience is defunct so not sure what that cn    nss_base_passwd ou=People,dc=osgeo,dc=org    nss_base_shadow ou=People,dc=osgeo,dc=org    nss_base_group  ou=Group,dc=osgeo,dc=org    ldap_version 3    pam_password md5    bind_policy soft

2) Copy contents of /etc/nslcd.conf from osgeo6

nano /etc/ssh/sshd_config

(it will prompt for services you want to use ldap for ) Selections will be written to /etc/nsswitch.conf

after conf looked like this

after conf looked like this

# /etc/nsswitch.conf #   # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference' and `info' packages installed, try: # `info libc "Name Service Switch"' for information about this file.

passwd:        compat ldap group:         compat ldap shadow:        compat gshadow:       files

hosts:         files dns networks:      files

protocols:     db files ldap services:      db files ldap ethers:        db files rpc:           db files

netgroup:      nis aliases:       ldap

3) pam-auth-update Make sure both Unix and LDAP authentication are checked 4) /etc/init.d/nscd restart /etc/init.d/nslcd restart /etc/init.d/ssh restart Should output something like this: [ ok ] Restarting ssh (via systemctl): ssh.service.

5) Verify server can do ldap queries with Osgeo by running something like this

ldapsearch -x uid=robe

Install LetsEncrypt SSL
First logged in as me robe, and did sudo bash so I can install stuff

1) Add jessie backports with:

echo "deb http://ftp.debian.org/debian jessie-backports main" | tee -a /etc/apt/sources.list aptitude update

2) now install

aptitude install certbot aptitude install python-certbot-apache -t jessie-backports

3) #needed to then edit the /etc/apache2/sites-available/www.osgeo.org.conf to allow ./wellknown folder to be accessed by adding these lines

Alias /.well-known "/var/www/osgeo.org/httpdocs/.well-known"  AllowOverride None Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec Require method GET POST OPTIONS 

After edit run: service apache2 reload

4) Get the cert had to do this since for some reason, trying to do normally gave error: Certbot doesn't know how to automatically configure the web server on this system. However, it can still get a certificate for you. Please run "certbot certonly" to do so. You'

certbot certonly -d staging.www.osgeo.org

Fill in following for prompts:

Press 1 [enter] to confirm the selection (press 'c' to cancel): 1 Input the webroot for staging.www.osgeo.org: (Enter 'c' to cancel):/var/www/osgeo.org/httpdocs Waiting for verification... Cleaning up challenges Generating key (2048 bits): /etc/letsencrypt/keys/0000_key-certbot.pem Creating CSR: /etc/letsencrypt/csr/0000_csr-certbot.pem

5) Created two new files /etc/apache2/sites-available/www.osgeo.org-le-ssl.conf and /etc/apache2/sites-available/www.osgeo.org-common.conf

The common one is pretty much copy of all stuff from the original www.osgeo.org.conf (that doesn't specifically reference host) and then included this in the new ssl.conf which is set to :443. So file looks like this

    ServerAdmin support@osgeo.org ServerName www.osgeo.org ServerAlias staging.www.osgeo.org

Include /etc/apache2/sites-available/www.osgeo.org-common.conf

SSLCertificateFile /etc/letsencrypt/live/staging.www.osgeo.org/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/staging.www.osgeo.org/privkey.pem #Include /etc/letsencrypt/options-ssl-apache.conf  

6) Now to enable the ssl config

a2ensite www.osgeo.org-le-ssl service apache2 reload

7) Added to cronjob of root, to schedule a monthly renewal every 15th day of month

30 1 15 * * certbot renew

Enabling LDAP Login for Wordpress
1) Edit the config.php in root of httpdocs and if not set change to $pluginAndThemeEditor = true; $pluginAndThemeUpdateAndInstallation = true;

2) Log in as an admin in wordpress. Go To Plugins -> Add New

Search for: wpDirAuth

Install the wpDirAuth plugin and activate

3) This should create a menu under Settings called: wpDirAuth

From there set the LDAP configs which have been set as follows:

Enable Directory Authentication: Yes Require SSL Login: Yes Automatically Register Authenticated Users: Yes

Use SSL (ldaps) Director Servers: ldap.osgeo.org AccountFilter: uid Base DN: dc=osgeo,dc=org

Cookie Settings: 3

Brading Settings: Fill in verbiage to your liking (probably needs to be redone) Set Terms Of Service Agreement: No

Leave other fields at the default (which is usually blank)

4) There is no interface to convert existing users to LDAP, but luckily you can do this from the database. To convert Jody's account which had username: jodygarnett, I did this by connecting to MySQL -- details in secure server

UPDATE fVT6y_users SET user_login = 'jive' WHERE user_login = 'jgarnett';

-- This part is to insert the metadata bit that tells wordpress, authentication is done by wpAuthDir -- I did this for a couple of users whose login already matched their ldap login INSERT INTO fVT6y_usermeta(user_id, meta_key, meta_value) SELECT u.ID, 'wpDirAuthFlag', '1' FROM fVT6y_users AS u  WHERE u.ID NOT IN(SELECT wp.user_id FROM fVT6y_usermeta As wp WHERE wp.meta_key = 'wpDirAuthFlag') AND u.user_login IN('jive','pramsey', 'strk', 'cvvergara', 'kalxas', 'evenr', 'jmckenna');

5) Todo I'm writing a script using ldap users directory output that will convert the remaining

Convert MySQL Tables to InnoDb
1. Details of how to log in to MySQL are on Secure server /access/osgeo.public.cloudvps.com - refer to those.

2. connect to osgeo db

3. Run this statement to generate query that you will then run to convert existing tables:

SELECT CONCAT('ALTER TABLE ', '`' , table_name , '` ENGINE=InnoDB;') FROM information_schema.tables where table_name LIKE 'fVT%' ORDER BY table_name;

4. Run the generated statements

5. SSH into server sudo bash cd /etc/mysql/conf.d 6. Create a new file with new default_storage.cnf

vi default_storage.cnf should have these contents when done:

default_storage_engine=InnoDB

7. Restart service

service mysql restart