SAC:betawebsite
This is setup of Cloud server osgeo.public.cloudvps.com
PHP Plugins installed for Wordpress
sudp apt-get install php5-mysql php5-curl php5-mcrypt php5-xmlrpc sudo apt-get install php5-xsl sudo apt-get install php5-ldap sudo apt-get install php5-gd sendmail
It is a debian 8, 4GB , 160 HDD server.
Martin's changes to get LDAP SSH working properly (per ticket 2010 I presume these supercede the ones I made
# Avoid error messages upon login
root@osgeo:~# aptitude install locales-all
# Have the preferred LDAP subsystem
root@osgeo:~# aptitude install libpam-ldapd libnss-ldapd
# Purge deprecated configs
root@osgeo:~# dpkg -l | grep \^rc | awk '{print $2}' | cut -f 1 -d \: | xargs dpkg --purge
# Purge local user
root@osgeo:~# grep -v \^martin /etc/passwd > Hallo && cat Hallo > /etc/passwd root@osgeo:~# grep -v \^martin /etc/shadow > Hallo && cat Hallo > /etc/shadow root@osgeo:~# rm -vf Hallo
# Purge cache and reload LDAP stuff
root@osgeo:~# /etc/init.d/nscd stop; rm -vf /var/cache/nscd/*; /etc/init.d/nscd start root@osgeo:~# /etc/init.d/nslcd restart
# Voila
root@osgeo:~# getent passwd martin martin:x:10026:100:Martin Spott:/home/martin:/bin/tcsh
# Have a homedir and proper login shell
root@osgeo:~# cp -a /etc/skel /home/martin root@osgeo:~# chown -R martin:100 /home/martin root@osgeo:~# aptitude install tcsh
# Reduce authentication error log
root@osgeo:~# aptitude install fail2ban
# Now test
foehn: 17:06:08 ~> ssh osgeo.public.cloudvps.com martin@osgeo.public.cloudvps.com's password: [...] osgeo:~>
# Success
Original Setup Steps
These are the steps I did after it was created in attempt to implement LDAP
First I installed updates
apt-get update apt-get upgrade apt-get install libpam-ldap nscd apt-get install libnss-ldap #not sure if this one is needed apt-get install locales-all apt-get install sudo
Then to try the ldap
https://wiki.debian.org/LDAP/PAM
1) edit /etc/ldap/ldap.conf (copied from osgeo6)
BASE dc=osgeo, dc=org URI ldaps://ldap.osgeo.org/ #SIZELIMIT 12 #TIMELIMIT 15 #DEREF never TLS_CHECKPEER yes TLS_REQCERT demand TLS_CACERT /etc/ssl/certs/STAR_osgeo_org.ca-bundle #this file you need to copy from osgeo6 as well pam_groupdn cn=telascience,ou=Shell,dc=osgeo,dc=org #not though telascience is defunct so not sure what that cn nss_base_passwd ou=People,dc=osgeo,dc=org nss_base_shadow ou=People,dc=osgeo,dc=org nss_base_group ou=Group,dc=osgeo,dc=org ldap_version 3 pam_password md5 bind_policy soft
2) Copy contents of /etc/nslcd.conf from osgeo6
nano /etc/ssh/sshd_config
(it will prompt for services you want to use ldap for ) Selections will be written to /etc/nsswitch.conf
after conf looked like this
after conf looked like this
# /etc/nsswitch.conf # # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference' and `info' packages installed, try: # `info libc "Name Service Switch"' for information about this file.
passwd: compat ldap group: compat ldap shadow: compat gshadow: files
hosts: files dns networks: files
protocols: db files ldap services: db files ldap ethers: db files rpc: db files
netgroup: nis aliases: ldap
3) pam-auth-update Make sure both Unix and LDAP authentication are checked 4)
/etc/init.d/nscd restart /etc/init.d/nslcd restart /etc/init.d/ssh restart Should output something like this:
[ ok ] Restarting ssh (via systemctl): ssh.service.
5) Verify server can do ldap queries with Osgeo by running something like this
ldapsearch -x uid=robe
Install LetsEncrypt SSL
First logged in as me robe, and did sudo bash so I can install stuff
1) Add jessie backports with:
echo "deb http://ftp.debian.org/debian jessie-backports main" | tee -a /etc/apt/sources.list aptitude update
2) now install
aptitude install certbot aptitude install python-certbot-apache -t jessie-backports
3) #needed to then edit the /etc/apache2/sites-available/www.osgeo.org.conf to allow ./wellknown folder to be accessed by adding these lines
Alias /.well-known "/var/www/osgeo.org/httpdocs/.well-known" <Directory "/var/www/osgeo.org/httpdocs/.well-known/"> AllowOverride None Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec Require method GET POST OPTIONS </Directory>
After edit run:
service apache2 reload
4) Get the cert had to do this since for some reason, trying to do normally gave error: Certbot doesn't know how to automatically configure the web server on this system. However, it can still get a certificate for you. Please run "certbot certonly" to do so. You'
certbot certonly -d staging.www.osgeo.org
- we will be temporarily hosting production on this box so also did
certbot certonly -d www.osgeo.org certbot certonly -d osgeo.org
Fill in following for prompts:
Press 1 [enter] to confirm the selection (press 'c' to cancel): 1 Input the webroot for staging.www.osgeo.org: (Enter 'c' to cancel):/var/www/osgeo.org/httpdocs Waiting for verification... Cleaning up challenges Generating key (2048 bits): /etc/letsencrypt/keys/0000_key-certbot.pem Creating CSR: /etc/letsencrypt/csr/0000_csr-certbot.pem
5) Created two new files /etc/apache2/sites-available/www.osgeo.org-le-ssl.conf and /etc/apache2/sites-available/www.osgeo.org-common.conf
The common one is pretty much copy of all stuff from the original www.osgeo.org.conf (that doesn't specifically reference host) and then included this in the new ssl.conf which is set to :443. So file looks like this
<IfModule mod_ssl.c> <VirtualHost *:443> ServerAdmin support@osgeo.org ServerName www.osgeo.org ServerAlias staging.www.osgeo.org
Include /etc/apache2/sites-available/www.osgeo.org-common.conf
SSLCertificateFile /etc/letsencrypt/live/staging.www.osgeo.org/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/staging.www.osgeo.org/privkey.pem #Include /etc/letsencrypt/options-ssl-apache.conf </VirtualHost> </IfModule>
6) Now to enable the ssl config
a2ensite www.osgeo.org-le-ssl service apache2 reload
7) Added to cronjob of root, to schedule a monthly renewal every 15th day of month
30 1 15 * * certbot renew
Enabling LDAP Login for Wordpress
1) Edit the config.php in root of httpdocs and if not set change to $pluginAndThemeEditor = true; $pluginAndThemeUpdateAndInstallation = true;
2) Log in as an admin in wordpress. Go To Plugins -> Add New
Search for: wpDirAuth
Install the wpDirAuth plugin and activate
3) This should create a menu under Settings called: wpDirAuth
From there set the LDAP configs which have been set as follows:
Enable Directory Authentication: Yes Require SSL Login: Yes Automatically Register Authenticated Users: Yes
Use SSL (ldaps) Director Servers: ldap.osgeo.org AccountFilter: uid Base DN: dc=osgeo,dc=org
Cookie Settings: 3
Brading Settings: Fill in verbiage to your liking (probably needs to be redone) Set Terms Of Service Agreement: No
Leave other fields at the default (which is usually blank)
4) There is no interface to convert existing users to LDAP, but luckily you can do this from the database.
To convert Jody's account which had username: jodygarnett, I did this by connecting to MySQL -- details in secure server
UPDATE fVT6y_users SET user_login = 'jive' WHERE user_login = 'jgarnett';
-- This part is to insert the metadata bit that tells wordpress, authentication is done by wpAuthDir -- I did this for a couple of users whose login already matched their ldap login INSERT INTO fVT6y_usermeta(user_id, meta_key, meta_value) SELECT u.ID, 'wpDirAuthFlag', '1' FROM fVT6y_users AS u WHERE u.ID NOT IN(SELECT wp.user_id FROM fVT6y_usermeta As wp WHERE wp.meta_key = 'wpDirAuthFlag') AND u.user_login IN('jive','pramsey', 'strk', 'cvvergara', 'kalxas', 'evenr', 'jmckenna');
5) Todo I'm writing a script using ldap users directory output that will convert the remaining
Convert MySQL Tables to InnoDb
1. Details of how to log in to MySQL are on Secure server /access/osgeo.public.cloudvps.com - refer to those.
2. connect to osgeo db
3. Run this statement to generate query that you will then run to convert existing tables:
SELECT CONCAT('ALTER TABLE ' , '`' , table_name , '` ENGINE=InnoDB;') FROM information_schema.tables where table_name LIKE 'fVT%' ORDER BY table_name;
4. Run the generated statements
5. SSH into server
sudo bash cd /etc/mysql/conf.d
6. Create a new file with new default_storage.cnf
vi default_storage.cnf
should have these contents when done:
default_storage_engine=InnoDB
7. Restart service
service mysql restart