View
107
Download
0
Category
Tags:
Preview:
Citation preview
The Perfect Server - CentOS 6.4 x86_64 (nginx, Dovecot, ISPConfig 3)
Version 1.0Author: Falko Timme <ft [at] falkotimme [dot] com>
Follow me on TwitterLast edited 03/22/2013This tutorial shows how to prepare a CentOS 6.4 x86_64 server for the installation of ISPConfig 3, and how to install ISPConfig 3. ISPConfig 3 is a webhosting control panel that allows you to configure the following services through a web browser: nginx web server, Postfix mail server, MySQL, BIND nameserver, PureFTPd, SpamAssassin, ClamAV, Mailman, and many more. Since version 3.0.4, ISPConfig comes with full support for the nginx web server in addition to Apache; this tutorial covers the setup of a server that uses nginx, not Apache.
Please note that this setup does not work for ISPConfig 2! It is valid for ISPConfig 3 only!I do not issue any guarantee that this will work for you!
ISPConfig 3 ManualIn order to learn how to use ISPConfig 3, I strongly recommend to download the ISPConfig 3 Manual.On more than 300 pages, it covers the concept behind ISPConfig (admin, resellers, clients), explains how to install and update ISPConfig 3, includes a reference for all forms and form fields in ISPConfig together with examples of valid inputs, and provides tutorials for the most common tasks in ISPConfig 3. It also lines out how to make your server more secure and comes with a troubleshooting section at the end.
ISPConfig Monitor App For AndroidWith the ISPConfig Monitor App, you can check your server status and find out if all services are running as expected. You can check TCP and UDP ports and ping your servers. In addition to that you can use this app to request details from servers that have ISPConfig installed (please note that the minimum installed ISPConfig 3 version with support for the ISPConfig Monitor App is 3.0.3.3!); these details include everything you know from the Monitor module in the ISPConfig Control Panel (e.g. services, mail and system logs, mail queue, CPU and memory info, disk usage, quota, OS details, RKHunter log, etc.), and of course, as ISPConfig is multiserver-capable, you can check all servers that are controlled from your ISPConfig master server.For download and usage instructions, please visit http://www.ispconfig.org/ispconfig-3/ispconfig-monitor-app-for-android/.
1 RequirementsTo install such a system you will need the following:
Download the two CentOS 6.4 DVDs from a mirror next to you (the list of mirrors can be found here: http://isoredirect.centos.org/centos/6/isos/x86_64/).
a fast Internet connection.
2 Preliminary NoteIn this tutorial I use the hostname server1.example.com with the IP address 192.168.0.100 and the gateway 192.168.0.1. These settings might differ for you, so you have to replace them where
appropriate.
3 Install The Base SystemBoot from your first CentOS 6.4 DVD (DVD 1). Select Install or upgrade an existing system:
It can take a long time to test the installation media so we skip this test here:
The welcome screen of the CentOS installer appears. Click on Next:
Choose your language next:
Select your keyboard layout:
I assume that you use a locally attached hard drive, so you should select Basic Storage Devices here:
You might see the following warning - Error processing drive. If you see this click on the Re-initialize all button to proceed:
Fill in the hostname of the server (e.g. server1.example.com), then click on the Configure Network button:
Go to the Wired tab, select the network interface (probably eth0) and click on Edit...:
Mark the Connect automatically checkbox and go to the IPv4 Settings tab and select Manual in the Method drop-down menu. Fill in one, two, or three nameservers (separated by comma) in the DNS servers field (e.g. 8.8.8.8,8.8.4.4), then click on the Add button next to the Addresses area:
Now give your network card a static IP address and netmask (in this tutorial I'm using the IP address 192.168.0.100 and netmask 255.255.255.0 for demonstration purposes; if you are not sure
about the right values, http://www.subnetmask.info might help you). Also fill in your gateway (e.g. 192.168.0.1) and click on the Apply...button:
The network configuration is now finished. Click on the Next button:
Choose your time zone:
Give root a password:
Next we do the partitioning. Select Replace Existing Linux System(s). This will give you a small /boot partition and a large / partition which is fine for our purposes:
Select Write changes to disk:
The hard drive is being formatted:
Now we select the software we want to install. Select Basic Server, then check CentOS in the additional repositories field, choose Customize later and click on Next:
The installation begins. This will take a few minutes:
Finally, the installation is complete, and you can remove your DVD from the computer and reboot it:
After the reboot, log in as root.
I want to install ISPConfig at the end of this tutorial which comes with its own firewall. That's why I disable the default CentOS firewall now. Of course, you are free to leave it on and configure it to your needs (but then you shouldn't use any other firewall later on as it will most probably interfere with the CentOS firewall).
Run...
system-config-firewall-tui
... and disable the firewall. Hit OK afterwards:
Confirm your choice by selecting Yes:
If you did not configure your network card during the installation, you can do that now. Run...
system-config-network
... and go to Device configuration:
Select your network interface:
Then fill in your network details - disable DHCP and fill in a static IP address, a netmask, your gateway, and one or two nameservers, then hit Ok:
Next select Save:
You can also specify additional nameservers. Select DNS configuration:
Now you can fill in additional nameservers and hit Ok:
Hit Save&Quit afterwards:
You should run
ifconfig
now to check if the installer got your IP address right:
[root@server1 ~]# ifconfigeth0 Link encap:Ethernet HWaddr 00:0C:29:00:85:AC
inet addr:192.168.0.100 Bcast:192.168.0.255 Mask:255.255.255.0inet6 addr: fe80::20c:29ff:fe00:85ac/64 Scope:LinkUP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1RX packets:278 errors:0 dropped:0 overruns:0 frame:0TX packets:86 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:1000RX bytes:28503 (27.8 KiB) TX bytes:16360 (15.9 KiB)
lo Link encap:Local Loopbackinet addr:127.0.0.1 Mask:255.0.0.0inet6 addr: ::1/128 Scope:HostUP LOOPBACK RUNNING MTU:16436 Metric:1RX packets:0 errors:0 dropped:0 overruns:0 frame:0TX packets:0 errors:0 dropped:0 overruns:0 carrier:0collisions:0 txqueuelen:0RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
[root@server1 ~]#Check your /etc/resolv.conf if it lists all nameservers that you've previously configured:
cat /etc/resolv.conf
If nameservers are missing, run
system-config-network
and add the missing nameservers again.
Now, on to the configuration...
4 Adjust /etc/hosts
Next we edit /etc/hosts. Make it look like this:
vi /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4192.168.0.100 server1.example.com server1
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
5 Configure The Firewall(You can skip this chapter if you have already disabled the firewall at the end of the basic system installation.)
I want to install ISPConfig at the end of this tutorial which comes with its own firewall. That's why I disable the default CentOS firewall now. Of course, you are free to leave it on and configure it to your needs (but then you shouldn't use any other firewall later on as it will most probably interfere with the CentOS firewall).
Run
system-config-firewall
and disable the firewall.
To check that the firewall has really been disabled, you can run
iptables -L
afterwards. The output should look like this:
[root@server1 ~]# iptables -LChain INPUT (policy ACCEPT)target prot opt source destination
Chain FORWARD (policy ACCEPT)target prot opt source destination
Chain OUTPUT (policy ACCEPT)target prot opt source destination[root@server1 ~]#
6 Disable SELinuxSELinux is a security extension of CentOS that should provide extended security. In my opinion you don't need it to configure a secure system, and it usually causes more problems than advantages (think of it after you have done a week of trouble-shooting because some service wasn't working as expected, and then you find out that everything was ok, only SELinux was causing the problem). Therefore I disable it (this is a must if you want to install ISPConfig later on).
Edit /etc/selinux/config and set SELINUX=disabled:
vi /etc/selinux/config
# This file controls the state of SELinux on the system.# SELINUX= can take one of these three values:# enforcing - SELinux security policy is enforced.# permissive - SELinux prints warnings instead of enforcing.# disabled - No SELinux policy is loaded.SELINUX=disabled# SELINUXTYPE= can take one of these two values:# targeted - Targeted processes are protected,# mls - Multi Level Security protection.SELINUXTYPE=targeted
Afterwards we must reboot the system:
reboot
7 Enable Additional Repositories And Install Some SoftwareFirst we import the GPG keys for software packages:
rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY*
Then we enable the RPMforge and EPEL repositories on our CentOS system as lots of the packages that we are going to install in the course of this tutorial are not available in the official CentOS 6.4 repositories:
rpm --import http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt
cd /tmpwget http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpmrpm -ivh rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm
(If the above link doesn't work anymore, you can find the current version of rpmforge-release here: http://packages.sw.be/rpmforge-release/)
rpm --import https://fedoraproject.org/static/0608B895.txtwget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpmrpm -ivh epel-release-6-8.noarch.rpm
We also need to enable the Remi RPM repository which contains the php-fpm package which we will install later on:
rpm --import http://rpms.famillecollet.com/RPM-GPG-KEY-remirpm -ivh http://rpms.famillecollet.com/enterprise/remi-release-6.rpmyum install yum-priorities
Edit /etc/yum.repos.d/epel.repo...
vi /etc/yum.repos.d/epel.repo
... and add the line priority=10 to the [epel] section:
[epel]name=Extra Packages for Enterprise Linux 6 - $basearch#baseurl=http://download.fedoraproject.org/pub/epel/6/$basearchmirrorlist=https://mirrors.fedoraproject.org/metalink?repo=epel-6&arch=$basearchfailovermethod=priorityenabled=1priority=10gpgcheck=1gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-6[...]
Then do the same for the [remi] section in /etc/yum.repos.d/remi.repo, plus change enabled to 1:
vi /etc/yum.repos.d/remi.repo
[remi]name=Les RPM de remi pour Enterprise Linux $releasever -$basearch#baseurl=http://rpms.famillecollet.com/enterprise/$releasever/remi/$basearch/mirrorlist=http://rpms.famillecollet.com/enterprise/$releasever/remi/mirrorenabled=1priority=10gpgcheck=1gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remifailovermethod=priority
[remi-test]name=Les RPM de remi en test pour Enterprise Linux $releasever -$basearch#baseurl=http://rpms.famillecollet.com/enterprise/$releasever/test/$basearch/mirrorlist=http://rpms.famillecollet.com/enterprise/$releasever/test/mirrorenabled=0gpgcheck=1gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi
Then we update our existing packages on the system:
yum update
Now we install some software packages that are needed later on:
yum groupinstall 'Development Tools'
8 Quota(If you have chosen a different partitioning scheme than I did, you must adjust this chapter so that quota applies to
the partitions where you need it.)
To install quota, we run this command:
yum install quota
Edit /etc/fstab and add ,usrjquota=aquota.user,grpjquota=aquota.group,jqfmt=vfsv0 to the / partition (/dev/mapper/vg_server1-lv_root):
vi /etc/fstab
## /etc/fstab# Created by anaconda on Wed Jul 11 17:52:57 2012## Accessible filesystems, by reference, are maintained under '/dev/disk'# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info#/dev/mapper/vg_server1-lv_root / ext4 defaults,usrjquota=aquota.user,grpjquota=aquota.group,jqfmt=vfsv0 1 1UUID=806910a1-dbdf-4746-bd94-cbe73ce81493 /boot ext4 defaults 1 2/dev/mapper/vg_server1-lv_swap swap swap defaults 0 0tmpfs /dev/shm tmpfs defaults 0 0devpts /dev/pts devpts gid=5,mode=620 0 0sysfs /sys sysfs defaults 0 0proc /proc proc defaults 0 0
Then run
mount -o remount /
quotacheck -avugmquotaon -avug
to enable quota.
9 Synchronize The System Clock
It is a good idea to synchronize the system clock with an NTP (network time protocol) server over the Internet. Simply run
yum install ntp
and your system time will always be in sync.
10 Install MySQLInstall MySQL as follows:
yum install mysql mysql-server
Then create the system startup links for MySQL and start it:
chkconfig --levels 235 mysqld on/etc/init.d/mysqld start
Set passwords for the MySQL root account:
mysql_secure_installation
[root@server1 tmp]# mysql_secure_installation
NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MySQLSERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!
In order to log into MySQL to secure it, we'll need the currentpassword for the root user. If you've just installed MySQL, andyou haven't set the root password yet, the password will be blank,so you should just press enter here.
Enter current password for root (enter for none):OK, successfully used password, moving on...
Setting the root password ensures that nobody can log into the MySQLroot user without the proper authorisation.
Set root password? [Y/n] <-- ENTER
New password: <-- yourrootsqlpassword
Re-enter new password: <-- yourrootsqlpassword
Password updated successfully!Reloading privilege tables..... Success!
By default, a MySQL installation has an anonymous user, allowing anyoneto log into MySQL without having to have a user account created forthem. This is intended only for testing, and to make the installationgo a bit smoother. You should remove them before moving into aproduction environment.
Remove anonymous users? [Y/n] <-- ENTER
... Success!
Normally, root should only be allowed to connect from 'localhost'. Thisensures that someone cannot guess at the root password from the network.
Disallow root login remotely? [Y/n] <-- ENTER
... Success!
By default, MySQL comes with a database named 'test' that anyone canaccess. This is also intended only for testing, and should be removedbefore moving into a production environment.
Remove test database and access to it? [Y/n] <-- ENTER
- Dropping test database...... Success!- Removing privileges on test database...... Success!
Reloading the privilege tables will ensure that all changes made so farwill take effect immediately.
Reload privilege tables now? [Y/n] <-- ENTER
... Success!
Cleaning up...
All done! If you've completed all of the above steps, your MySQLinstallation should now be secure.
Thanks for using MySQL!
[root@server1 tmp]#
11 Install Dovecot
Dovecot can be installed as follows:
yum install dovecot dovecot-mysql
Now create the system startup links and start Dovecot:
chkconfig --levels 235 dovecot on/etc/init.d/dovecot start
12 Install PostfixPostfix can be installed as follows:
yum install postfix
Then turn off Sendmail and start Postfix:
chkconfig --levels 235 sendmail offchkconfig --levels 235 postfix on/etc/init.d/sendmail stop/etc/init.d/postfix restart
13 Install GetmailGetmail can be installed as follows:
yum install getmail
14 Install Amavisd-new, SpamAssassin, And ClamAVTo install amavisd-new, spamassassin and clamav, run the following command:
yum install amavisd-new spamassassin clamav clamd unzip bzip2 unrar perl-DBD-mysql
Then we start freshclam, amavisd, and clamd.amavisd:
sa-updatechkconfig --levels 235 amavisd onchkconfig --del clamdchkconfig --levels 235 clamd.amavisd on/usr/bin/freshclam/etc/init.d/amavisd start/etc/init.d/clamd.amavisd start
15 Install Nginx, PHP5 (PHP-FPM), And FcgiwrapNginx is available as a package for CentOS 6.4 (from EPEL) which we can install as follows:
yum install nginx
Add the following section to the http {} section in /etc/nginx/nginx.conf (before any include lines) which determines if the visitor uses http or https and sets the $httpsvariable
accordingly - this is needed because the nginx version coming with CentOS is 1.0.15, and the $https variable was introduced in nginx in version 1.1.11, and ISPConfig makes use of this
variable:
vi /etc/nginx/nginx.conf
[...]http {[...]
## Detect when HTTPS is usedmap $scheme $https {default off;https on;
}[...]}[...]
If Apache2 is already installed on the system, stop it now...
/etc/init.d/httpd stop
... and remove Apache's system startup links:
chkconfig --del httpd
Then we create the system startup links for nginx and start it:
chkconfig --levels 235 nginx on/etc/init.d/nginx start
(If both Apache2 and nginx are installed, the ISPConfig 3 installer will ask you which one you want to use - answer nginx in this case. If only one of these both is installed, ISPConfig will do the necessary
configuration automatically.)We can make PHP5 work in nginx through PHP-FPM (PHP-FPM (FastCGI Process Manager) is an alternative PHP FastCGI implementation with some additional features useful for sites of any size, especially busier sites). We can install php-fpm together with php-cli and some PHP5 modules like php-mysql which you need if you want to use MySQL from your PHP scripts as follows:
yum install php-fpm php-cli php-mysql php-gd php-imap php-ldap php-odbc php-pear php-xml php-xmlrpc php-pecl-apc php-magickwand php-magpierss php-mbstring php-mcrypt php-mssql php-shout php-snmp php-soap php-tidy
Next we open /etc/php.ini...
vi /etc/php.ini
... and change the error reporting (so that notices aren't shown any longer):
[...];error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICTerror_reporting = E_ALL & ~E_NOTICE[...]
Also set cgi.fix_pathinfo=0:
vi /etc/php.ini
[...]; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting
; of zero causes PHP to behave as before. Default is 1. You should fix your scripts; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.; http://www.php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfocgi.fix_pathinfo=0[...]
(Please read http://wiki.nginx.org/Pitfalls to find out why you should do this.)In addition to that, in order to avoid errors like
[08-Aug-2011 18:07:08] PHP Warning: phpinfo(): It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'Europe/Berlin' for 'CEST/2.0/DST' instead in /usr/share/nginx/html/info.php on line 2
... in /var/log/php-fpm/www-error.log when you call a PHP script in your browser, you should set date.timezone in /etc/php.ini:
[...][Date]; Defines the default timezone used by the date functions; http://www.php.net/manual/en/datetime.configuration.php#ini.date.timezonedate.timezone = "Europe/Berlin"[...]
You can find out the correct timezone for your system by running:
cat /etc/sysconfig/clock
[root@server1 tmp]# cat /etc/sysconfig/clockZONE="Europe/Berlin"[root@server1 tmp]#Next create the system startup links for php-fpm and start it:
chkconfig --levels 235 php-fpm on/etc/init.d/php-fpm start
PHP-FPM is a daemon process (with the init script /etc/init.d/php-fpm) that runs a FastCGI server on port 9000.
To get CGI support in nginx, we install Fcgiwrap.
Fcgiwrap is a CGI wrapper that should work also for complex CGI scripts and can be used for shared hosting environments because it allows each vhost to use its own cgi-bin directory.
As there's no fcgiwrap package for CentOS 6.4, we must build it ourselves. First we install some
prerequisites:
yum install fcgi-devel
Now we can build fcgiwrap as follows:
cd /usr/local/src/git clone git://github.com/gnosek/fcgiwrap.gitcd fcgiwrapautoreconf -i./configuremakemake install
This installs fcgiwrap to /usr/local/sbin/fcgiwrap.Next we install the spawn-fcgi package which allows us to run fcgiwrap as a daemon:
yum install spawn-fcgi
Open /etc/sysconfig/spawn-fcgi...
vi /etc/sysconfig/spawn-fcgi
... and modify the file as follows:
# You must set some working options before the "spawn-fcgi" service will work.# If SOCKET points to a file, then this file is cleaned up by the init script.## See spawn-fcgi(1) for all possible options.## Example :#SOCKET=/var/run/php-fcgi.sock#OPTIONS="-u apache -g apache -s $SOCKET -S -M 0600 -C 32 -F 1 -P /var/run/spawn-fcgi.pid -- /usr/bin/php-cgi"
FCGI_SOCKET=/var/run/fcgiwrap.socketFCGI_PROGRAM=/usr/local/sbin/fcgiwrapFCGI_USER=apacheFCGI_GROUP=apacheFCGI_EXTRA_OPTIONS="-M 0770"OPTIONS="-u $FCGI_USER -g $FCGI_GROUP -s $FCGI_SOCKET -S $FCGI_EXTRA_OPTIONS -F 1 -P /var/run/spawn-fcgi.pid --
$FCGI_PROGRAM"
Now add the user nginx to the group apache:
usermod -a -G apache nginx
Create the system startup links for spawn-fcgi...
chkconfig --levels 235 spawn-fcgi on
... and start it as follows:
/etc/init.d/spawn-fcgi start
You should now find the fcgiwrap socket in /var/run/fcgiwrap.socket, owned by the user and group apache (some scripts, e.g. Mailman, expect to be run by the user/group apache, that's why we don't run spawn-fcgi as user/group nginx, but instead add nginx to the apache group).
16 Install phpMyAdmin
Next we install phpMyAdmin:
yum install phpmyadmin
Next we change the authentication in phpMyAdmin from cookie to http:
vi /usr/share/phpmyadmin/config.inc.php
[...]/* Authentication type */$cfg['Servers'][$i]['auth_type'] = 'http';[...]
You can now find phpMyAdmin in the /usr/share/phpmyadmin/ directory.
After you have installed ISPConfig 3, you can access phpMyAdmin as follows:
The ISPConfig apps vhost on port 8081 for nginx comes with a phpMyAdmin configuration, so you can use http://server1.example.com:8081/phpmyadmin orhttp://server1.example.com:8081/phpMyAdmin to access phpMyAdmin.If you want to use a /phpmyadmin or /phpMyAdmin alias that you can use from your web sites, this is a
bit more complicated than for Apache because nginx does not have global aliases (i.e., aliases that can be defined for all vhosts). Therefore you have to define these aliases for each vhost from which you want to access phpMyAdmin.
To do this, paste the following into the nginx Directives field on the Options tab of the web site in
ISPConfig:
location /phpmyadmin {root /usr/share/;index index.php index.html index.htm;location ~ ^/phpmyadmin/(.+\.php)$ {
try_files $uri =404;root /usr/share/;fastcgi_pass 127.0.0.1:9000;fastcgi_index index.php;fastcgi_param SCRIPT_FILENAME
$request_filename;include /etc/nginx/fastcgi_params;fastcgi_param PATH_INFO
$fastcgi_script_name;fastcgi_buffer_size 128k;fastcgi_buffers 256 4k;fastcgi_busy_buffers_size 256k;fastcgi_temp_file_write_size 256k;fastcgi_intercept_errors on;
}location ~*
^/phpmyadmin/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
root /usr/share/;}
}location /phpMyAdmin {
rewrite ^/* /phpmyadmin last;}
If you use https instead of http for your vhost, you should add the line fastcgi_param HTTPS on; to
your phpMyAdmin configuration like this:
location /phpmyadmin {root /usr/share/;index index.php index.html index.htm;location ~ ^/phpmyadmin/(.+\.php)$ {
try_files $uri =404;root /usr/share/;fastcgi_pass 127.0.0.1:9000;fastcgi_param HTTPS on; # <-- add this line
fastcgi_index index.php;fastcgi_param SCRIPT_FILENAME
$request_filename;include /etc/nginx/fastcgi_params;fastcgi_param PATH_INFO
$fastcgi_script_name;fastcgi_buffer_size 128k;fastcgi_buffers 256 4k;fastcgi_busy_buffers_size 256k;fastcgi_temp_file_write_size 256k;fastcgi_intercept_errors on;
}location ~*
^/phpmyadmin/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
root /usr/share/;}
}location /phpMyAdmin {
rewrite ^/* /phpmyadmin last;}
If you use both http and https for your vhost, you can use the $https variable - go to the nginx Directives field again, and instead of fastcgi_param HTTPS on; you add the line fastcgi_param HTTPS $https; so that you can use phpMyAdmin for both http and https requests:
location /phpmyadmin {root /usr/share/;index index.php index.html index.htm;location ~ ^/phpmyadmin/(.+\.php)$ {
try_files $uri =404;root /usr/share/;fastcgi_pass 127.0.0.1:9000;fastcgi_param HTTPS $https; # <-- add this line
fastcgi_index index.php;fastcgi_param SCRIPT_FILENAME
$request_filename;include /etc/nginx/fastcgi_params;fastcgi_param PATH_INFO
$fastcgi_script_name;fastcgi_buffer_size 128k;fastcgi_buffers 256 4k;fastcgi_busy_buffers_size 256k;fastcgi_temp_file_write_size 256k;fastcgi_intercept_errors on;
}location ~*
^/phpmyadmin/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
root /usr/share/;}
}location /phpMyAdmin {
rewrite ^/* /phpmyadmin last;}
17 Install MailmanSince version 3.0.4, ISPConfig also allows you to manage (create/modify/delete) Mailman mailing lists. If you want to make use of this feature, install Mailman as follows:
yum install mailman
Before we can start Mailman, a first mailing list called mailman must be created:
/usr/lib/mailman/bin/newlist mailman
[root@server1 tmp]# /usr/lib/mailman/bin/newlist mailmanEnter the email of the person running the list: <--
admin email address, e.g. listadmin@example.comInitial mailman password: <-- admin password for the mailman list
To finish creating your mailing list, you must edit your /etc/aliases (orequivalent) file by adding the following lines, and possibly running the`newaliases' program:
## mailman mailing listmailman: "|/usr/lib/mailman/mail/mailman post mailman"mailman-admin: "|/usr/lib/mailman/mail/mailman admin mailman"mailman-bounces: "|/usr/lib/mailman/mail/mailman bounces mailman"mailman-confirm: "|/usr/lib/mailman/mail/mailman confirm mailman"mailman-join: "|/usr/lib/mailman/mail/mailman join mailman"mailman-leave: "|/usr/lib/mailman/mail/mailman leave mailman"mailman-owner: "|/usr/lib/mailman/mail/mailman owner mailman"mailman-request: "|/usr/lib/mailman/mail/mailman request mailman"mailman-subscribe: "|/usr/lib/mailman/mail/mailman subscribe mailman"mailman-unsubscribe: "|/usr/lib/mailman/mail/mailman unsubscribe mailman"
Hit enter to notify mailman owner... <-- ENTER
[root@server1 tmp]#Open /etc/aliases afterwards...
vi /etc/aliases
... and add the following lines:
[...]
mailman: "|/usr/lib/mailman/mail/mailman post mailman"mailman-admin: "|/usr/lib/mailman/mail/mailman admin mailman"mailman-bounces: "|/usr/lib/mailman/mail/mailman bounces mailman"mailman-confirm: "|/usr/lib/mailman/mail/mailman confirm mailman"mailman-join: "|/usr/lib/mailman/mail/mailman join mailman"mailman-leave: "|/usr/lib/mailman/mail/mailman leave mailman"mailman-owner: "|/usr/lib/mailman/mail/mailman owner mailman"mailman-request: "|/usr/lib/mailman/mail/mailman request mailman"mailman-subscribe: "|/usr/lib/mailman/mail/mailman subscribe mailman"mailman-unsubscribe: "|/usr/lib/mailman/mail/mailman unsubscribe mailman"
Run
newaliases
afterwards and restart Postfix:
/etc/init.d/postfix restart
Create the system startup links for Mailman and start it:
chkconfig --levels 235 mailman on/etc/init.d/mailman start
Now we need to create this symlink to make Mailman work with ISPConfig:
cd /usr/lib/mailman/cgi-bin/ln -s ./ mailman
If you want to use Mailman from your web sites created through ISPConfig, this is a bit more complicated than for Apache because nginx does not have global aliases (i.e., aliases that can be defined for all vhosts). Therefore you have to define these aliases for each vhost from which you want to access Mailman.
To do this, paste the following into the nginx Directives field on the Options tab of the web site in
ISPConfig:
location /cgi-bin/mailman {alias /usr/lib/mailman/cgi-bin;fastcgi_split_path_info (^/cgi-
bin/mailman/[^/]*)(.*)$;include /etc/nginx/fastcgi_params;fastcgi_param SCRIPT_FILENAME
/usr/lib/mailman$fastcgi_script_name;fastcgi_param PATH_INFO $fastcgi_path_info;fastcgi_param PATH_TRANSLATED
/usr/lib/mailman$fastcgi_path_info;fastcgi_intercept_errors on;fastcgi_pass unix:/var/run/fcgiwrap.socket;
}
location /images/mailman {alias /usr/lib/mailman/icons;
}
location /pipermail {alias /var/lib/mailman/archives/public;autoindex on;
}
This defines the alias /cgi-bin/mailman/ for your vhost, which means you can access the Mailman admin interface for a list at http://<vhost>/cgi-bin/mailman/admin/<listname>, and the web page for users of a mailing list can be found at http://<vhost>/cgi-bin/mailman/listinfo/<listname>.Under http://<vhost>/pipermail you can find the mailing list archives.
18 Install PureFTPdPureFTPd can be installed with the following command:
yum install pure-ftpd
Then create the system startup links and start PureFTPd:
chkconfig --levels 235 pure-ftpd on/etc/init.d/pure-ftpd start
Now we configure PureFTPd to allow FTP and TLS sessions. FTP is a very insecure protocol because all passwords and all data are transferred in clear text. By using TLS, the whole communication can be encrypted, thus making FTP much more secure.
OpenSSL is needed by TLS; to install OpenSSL, we simply run:
yum install openssl
Open /etc/pure-ftpd/pure-ftpd.conf...
vi /etc/pure-ftpd/pure-ftpd.conf
If you want to allow FTP and TLS sessions, set TLS to 1:
[...]# This option can accept three values :# 0 : disable SSL/TLS encryption layer (default).# 1 : accept both traditional and encrypted sessions.# 2 : refuse connections that don't use SSL/TLS security mechanisms,# including anonymous sessions.# Do _not_ uncomment this blindly. Be sure that :# 1) Your server has been compiled with SSL/TLS support (--with-tls),# 2) A valid certificate is in place,# 3) Only compatible clients will log in.
TLS 1[...]
In order to use TLS, we must create an SSL certificate. I create it in /etc/ssl/private/, therefore I
create that directory first:
mkdir -p /etc/ssl/private/
Afterwards, we can generate the SSL certificate as follows:
openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem
Country Name (2 letter code) [XX]: <-- Enter your Country Name (e.g., "DE").
State or Province Name (full name) []: <-- Enter your State or Province Name.
Locality Name (eg, city) [Default City]: <-- Enter your City.
Organization Name (eg, company) [Default Company Ltd]: <-- Enter your Organization Name (e.g.,
the name of your company).Organizational Unit Name (eg, section) []: <-- Enter your Organizational Unit Name (e.g. "IT
Department").Common Name (eg, your name or your server's hostname) []: <-- Enter the Fully Qualified Domain
Name of the system (e.g. "server1.example.com").Email Address []: <-- Enter your Email Address.
Change the permissions of the SSL certificate:
chmod 600 /etc/ssl/private/pure-ftpd.pem
Finally restart PureFTPd:
/etc/init.d/pure-ftpd restart
That's it. You can now try to connect using your FTP client; however, you should configure your FTP client to use TLS.
19 Install BINDWe can install BIND as follows:
yum install bind bind-utils
Next open /etc/sysconfig/named...
vi /etc/sysconfig/named
... and make sure that the ROOTDIR=/var/named/chroot line is comment out:
# BIND named process options# ~~~~~~~~~~~~~~~~~~~~~~~~~~# Currently, you can use the following options:## ROOTDIR="/var/named/chroot" -- will run named in a chroot environment.# you must set up the chroot environment# (install the bind-chroot package) before# doing this.# NOTE:# Those directories are automatically mounted to chroot if they are# empty in the ROOTDIR directory. It will simplify maintenance of your# chroot environment.# - /var/named# - /etc/pki/dnssec-keys
# - /etc/named# - /usr/lib64/bind or /usr/lib/bind (architecture dependent)## Those files are mounted as well if target file doesn't exist in# chroot.# - /etc/named.conf# - /etc/rndc.conf# - /etc/rndc.key# - /etc/named.rfc1912.zones# - /etc/named.dnssec.keys# - /etc/named.iscdlv.key## Don't forget to add "$AddUnixListenSocket /var/named/chroot/dev/log"# line to your /etc/rsyslog.conf file. Otherwise your logging becomes# broken when rsyslogd daemon is restarted (due update, for example).## OPTIONS="whatever" -- These additional options will be passed to named# at startup. Don't add -t here, use ROOTDIR instead.## KEYTAB_FILE="/dir/file" -- Specify named service keytab file (for GSS-TSIG)## DISABLE_ZONE_CHECKING -- By default, initscript calls named-checkzone# utility for every zone to ensure all zones are# valid before named starts. If you set this option# to 'yes' then initscript doesn't perform those# checks.
Make a backup of the existing /etc/named.conf file and create a new one as follows:
cp /etc/named.conf /etc/named.conf_bakcat /dev/null > /etc/named.confvi /etc/named.conf
//// named.conf
//// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS// server as a caching only nameserver (as a localhost DNS resolver only).//// See /usr/share/doc/bind*/sample/ for example named configuration files.//options {
listen-on port 53 { any; };listen-on-v6 port 53 { any; };directory "/var/named";dump-file "/var/named/data/cache_dump.db";statistics-file "/var/named/data/named_stats.txt";memstatistics-file
"/var/named/data/named_mem_stats.txt";allow-query { any; };recursion yes;
};logging {
channel default_debug {file "data/named.run";severity dynamic;
};};zone "." IN {
type hint;file "named.ca";
};include "/etc/named.conf.local";
Create the file /etc/named.conf.local that is included at the end of /etc/named.conf (/etc/named.conf.local will later on get populated by ISPConfig if you create
DNS zones in ISPConfig):
touch /etc/named.conf.local
Then we create the startup links and start BIND:
chkconfig --levels 235 named on/etc/init.d/named start
20 Install Webalizer And AWStats
Webalizer and AWStats can be installed as follows:
yum install webalizer awstats perl-DateTime-Format-HTTP perl-DateTime-Format-Builder
21 Install Jailkit
Jailkit is needed only if you want to chroot SSH users. It can be installed as follows (important: Jailkit
must be installed before ISPConfig - it cannot be installed afterwards!):
cd /tmpwget http://olivier.sessink.nl/jailkit/jailkit-2.15.tar.gztar xvfz jailkit-2.15.tar.gzcd jailkit-2.15./configuremakemake installcd ..rm -rf jailkit-2.15*
22 Install fail2banThis is optional but recommended, because the ISPConfig monitor tries to show the log:
yum install fail2ban
We must configure fail2ban to log to the log file /var/log/fail2ban.log because this is the log file that is monitored by the ISPConfig Monitor module. Open/etc/fail2ban/fail2ban.conf...
vi /etc/fail2ban/fail2ban.conf
... and comment out the logtarget = SYSLOG line and add logtarget = /var/log/fail2ban.log:
[...]# Option: logtarget# Notes.: Set the log target. This could be a file, SYSLOG, STDERR or STDOUT.# Only one log target can be specified.# Values: STDOUT STDERR SYSLOG file Default: /var/log/fail2ban.log##logtarget = SYSLOGlogtarget = /var/log/fail2ban.log[...]
Then create the system startup links for fail2ban and start it:
chkconfig --levels 235 fail2ban on/etc/init.d/fail2ban start
23 Install rkhunterrkhunter can be installed as follows:
yum install rkhunter
24 Install SquirrelMailTo install the SquirrelMail webmail client, run...
yum install squirrelmail
Then configure SquirrelMail:
/usr/share/squirrelmail/config/conf.pl
We must tell SquirrelMail that we are using Dovecot:
SquirrelMail Configuration : Read: config.php (1.4.0)---------------------------------------------------------Main Menu --1. Organization Preferences2. Server Settings3. Folder Defaults4. General Options5. Themes6. Address Books7. Message of the Day (MOTD)8. Plugins9. Database10. Languages
D. Set pre-defined settings for specific IMAP servers
C Turn color offS Save data
Q Quit
Command >> <-- D
SquirrelMail Configuration : Read: config.php---------------------------------------------------------While we have been building SquirrelMail, we have discovered somepreferences that work better with some servers that don't work sowell with others. If you select your IMAP server, this option willset some pre-defined settings for that server.
Please note that you will still need to go through and make sureeverything is correct. This does not change everything. There areonly a few settings that this will change.
Please select your IMAP server:bincimap = Binc IMAP servercourier = Courier IMAP servercyrus = Cyrus IMAP serverdovecot = Dovecot Secure IMAP serverexchange = Microsoft Exchange IMAP serverhmailserver = hMailServermacosx = Mac OS X Mailservermercury32 = Mercury/32uw = University of Washington's IMAP servergmail = IMAP access to Google mail (Gmail) accounts
quit = Do not change anythingCommand >> <-- dovecot
SquirrelMail Configuration : Read: config.php---------------------------------------------------------While we have been building SquirrelMail, we have discovered somepreferences that work better with some servers that don't work sowell with others. If you select your IMAP server, this option willset some pre-defined settings for that server.
Please note that you will still need to go through and make sureeverything is correct. This does not change everything. There areonly a few settings that this will change.
Please select your IMAP server:bincimap = Binc IMAP servercourier = Courier IMAP servercyrus = Cyrus IMAP serverdovecot = Dovecot Secure IMAP server
exchange = Microsoft Exchange IMAP serverhmailserver = hMailServermacosx = Mac OS X Mailservermercury32 = Mercury/32uw = University of Washington's IMAP servergmail = IMAP access to Google mail (Gmail) accounts
quit = Do not change anythingCommand >> courier
imap_server_type = courierdefault_folder_prefix = INBOX.
trash_folder = Trashsent_folder = Sentdraft_folder = Drafts
show_prefix_option = falsedefault_sub_of_inbox = false
show_contain_subfolders_option = falseoptional_delimiter = .
delete_folder = true
Press enter to continue... <-- press ENTER
SquirrelMail Configuration : Read: config.php (1.4.0)---------------------------------------------------------Main Menu --1. Organization Preferences2. Server Settings3. Folder Defaults4. General Options5. Themes6. Address Books7. Message of the Day (MOTD)8. Plugins9. Database10. Languages
D. Set pre-defined settings for specific IMAP servers
C Turn color offS Save dataQ Quit
Command >> <--S
SquirrelMail Configuration : Read: config.php (1.4.0)
---------------------------------------------------------Main Menu --1. Organization Preferences2. Server Settings3. Folder Defaults4. General Options5. Themes6. Address Books7. Message of the Day (MOTD)8. Plugins9. Database10. Languages
D. Set pre-defined settings for specific IMAP servers
C Turn color offS Save dataQ Quit
Command >> <--Q
One last thing we need to do is modify the file /etc/squirrelmail/config_local.php and comment out the $default_folder_prefix variable - if you don't do this, you will see the following error message in SquirrelMail after you've logged in: Query: CREATE "Sent" Reason Given: Invalid mailbox name.
vi /etc/squirrelmail/config_local.php
<?php
/*** Local config overrides.** You can override the config.php settings here.* Don't do it unless you know what you're doing.* Use standard PHP syntax, see config.php for examples.** @copyright © 2002-2006 The SquirrelMail Project Team* @license http://opensource.org/licenses/gpl-license.php GNU Public License* @version $Id: config_local.php,v 1.2 2006/07/11 03:33:47 wtogami Exp $* @package squirrelmail* @subpackage config*/
//$default_folder_prefix = '';?>
You can now find SquirrelMail in the /usr/share/squirrelmail/ directory.
After you have installed ISPConfig 3, you can access SquirrelMail as follows:
The ISPConfig apps vhost on port 8081 for nginx comes with a SquirrelMail configuration, so you can use http://server1.example.com:8081/squirrelmail orhttp://server1.example.com:8081/webmail to access SquirrelMail.If you want to use a /webmail or /squirrelmail alias that you can use from your web sites, this is a
bit more complicated than for Apache because nginx does not have global aliases (i.e., aliases that can be defined for all vhosts). Therefore you have to define these aliases for each vhost from which you want to access SquirrelMail.To do this, paste the following into the nginx Directives field on the Options tab of the web site in
ISPConfig:
location /squirrelmail {root /usr/share/;index index.php index.html index.htm;location ~ ^/squirrelmail/(.+\.php)$ {
try_files $uri =404;root /usr/share/;fastcgi_pass 127.0.0.1:9000;fastcgi_index index.php;fastcgi_param SCRIPT_FILENAME
$request_filename;include /etc/nginx/fastcgi_params;fastcgi_param PATH_INFO
$fastcgi_script_name;fastcgi_buffer_size 128k;fastcgi_buffers 256 4k;fastcgi_busy_buffers_size 256k;fastcgi_temp_file_write_size 256k;fastcgi_intercept_errors on;
}location ~*
^/squirrelmail/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
root /usr/share/;}
}location /webmail {
rewrite ^/* /squirrelmail last;}
If you use https instead of http for your vhost, you should add the line fastcgi_param HTTPS on; to
your SquirrelMail configuration like this:
location /squirrelmail {
root /usr/share/;index index.php index.html index.htm;location ~ ^/squirrelmail/(.+\.php)$ {
try_files $uri =404;root /usr/share/;fastcgi_pass 127.0.0.1:9000;fastcgi_param HTTPS on; # <-- add this line
fastcgi_index index.php;fastcgi_param SCRIPT_FILENAME
$request_filename;include /etc/nginx/fastcgi_params;fastcgi_param PATH_INFO
$fastcgi_script_name;fastcgi_buffer_size 128k;fastcgi_buffers 256 4k;fastcgi_busy_buffers_size 256k;fastcgi_temp_file_write_size 256k;fastcgi_intercept_errors on;
}location ~*
^/squirrelmail/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
root /usr/share/;}
}location /webmail {
rewrite ^/* /squirrelmail last;}
If you use both http and https for your vhost, you can use the $https variable - go to the nginx Directives field again, and instead of fastcgi_param HTTPS on; you add the line fastcgi_param HTTPS $https; so that you can use SquirrelMail for both http and https requests:
location /squirrelmail {root /usr/share/;index index.php index.html index.htm;location ~ ^/squirrelmail/(.+\.php)$ {
try_files $uri =404;root /usr/share/;fastcgi_pass 127.0.0.1:9000;fastcgi_param HTTPS $https; # <-- add this line
fastcgi_index index.php;fastcgi_param SCRIPT_FILENAME
$request_filename;include /etc/nginx/fastcgi_params;fastcgi_param PATH_INFO
$fastcgi_script_name;fastcgi_buffer_size 128k;
fastcgi_buffers 256 4k;fastcgi_busy_buffers_size 256k;fastcgi_temp_file_write_size 256k;fastcgi_intercept_errors on;
}location ~*
^/squirrelmail/(.+\.(jpg|jpeg|gif|css|png|js|ico|html|xml|txt))$ {
root /usr/share/;}
}location /webmail {
rewrite ^/* /squirrelmail last;}
25 Install ISPConfig 3
Before you start the ISPConfig installation, make sure that Apache is stopped (if it is installed - it is possible that some of your installed packages have installed Apache as a dependency without you knowing). If Apache2 is already installed on the system, stop it now...
/etc/init.d/httpd stop
... and remove Apache's system startup links:
chkconfig --del httpd
Make sure that nginx is running:
/etc/init.d/nginx restart
(If you have both Apache and nginx installed, the installer asks you which one you want to use: Apache and nginx detected. Select server to use for ISPConfig: (apache,nginx) [apache]:Type nginx. If only Apache or nginx are installed, this is automatically detected by the installer, and
no question is asked.)Download the current ISPConfig 3 version and install it. The ISPConfig installer will configure all services like Postfix, Dovecot, etc. for you. A manual setup as required for ISPConfig 2 is not necessary anymore.You now also have the possibility to let the installer create an SSL vhost for the ISPConfig control panel, so that ISPConfig can be accessed using https:// instead ofhttp://. To achieve this, just press ENTER when you see this question: Do you want a secure (SSL) connection to the ISPConfig web interface (y,n) [y]:.
To install ISPConfig 3 from the latest released version, do this:
cd /tmpwget http://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gztar xfz ISPConfig-3-stable.tar.gzcd ispconfig3_install/install/
The next step is to run
php -q install.php
This will start the ISPConfig 3 installer:
[root@server1 install]# php -q install.php
--------------------------------------------------------------------------------_____ ___________ _____ __ _ ____
|_ _/ ___| ___ \ / __ \ / _(_) /__ \| | \ `--.| |_/ / | / \/ ___ _ __ | |_ _ __ _ _/ /| | `--. \ __/ | | / _ \| '_ \| _| |/ _` | |_ |
_| |_/\__/ / | | \__/\ (_) | | | | | | | (_| | ___\ \\___/\____/\_| \____/\___/|_| |_|_| |_|\__, | \____/
__/ ||___/
--------------------------------------------------------------------------------
>> Initial configuration
Operating System: Redhat or compatible, unknown version.
Following will be a few questions for primary configuration so be careful.Default values are in [brackets] and can be accepted with <ENTER>.Tap in "quit" (without the quotes) to stop the installer.
Select language (en,de) [en]: <-- ENTER
Installation mode (standard,expert) [standard]: <-- ENTER
Full qualified hostname (FQDN) of the server, eg server1.domain.tld [server1.example.com]: <-- ENTER
MySQL server hostname [localhost]: <-- ENTER
MySQL root username [root]: <-- ENTER
MySQL root password []: <-- yourrootsqlpassword
MySQL database to create [dbispconfig]: <-- ENTER
MySQL charset [utf8]: <-- ENTER
Apache and nginx detected. Select server to use for ISPConfig: (apache,nginx) [apache]: <-- nginx
Generating a 2048 bit RSA private key......................................................................+++...............................................+++writing new private key to 'smtpd.key'-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [XX]: <-- ENTER
State or Province Name (full name) []: <-- ENTER
Locality Name (eg, city) [Default City]: <-- ENTER
Organization Name (eg, company) [Default Company Ltd]: <-- ENTER
Organizational Unit Name (eg, section) []: <-- ENTER
Common Name (eg, your name or your server's hostname) []: <-- ENTER
Email Address []: <-- ENTER
Configuring JailkitConfiguring DovecotConfiguring SpamassassinConfiguring AmavisdConfiguring GetmailConfiguring PureftpdConfiguring BINDConfiguring nginxConfiguring VloggerConfiguring Apps vhostConfiguring Bastille FirewallConfiguring Fail2banInstalling ISPConfigISPConfig Port [8080]: <-- ENTER
Do you want a secure (SSL) connection to the ISPConfig web interface (y,n) [y]: <--
ENTER
Generating RSA private key, 4096 bit long modulus...........................................................++...........................................................................++e is 65537 (0x10001)You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [XX]: <-- ENTER
State or Province Name (full name) []: <-- ENTER
Locality Name (eg, city) [Default City]: <-- ENTER
Organization Name (eg, company) [Default Company Ltd]: <-- ENTER
Organizational Unit Name (eg, section) []: <-- ENTER
Common Name (eg, your name or your server's hostname) []: <-- ENTER
Email Address []: <-- ENTER
Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []: <-- ENTER
An optional company name []: <-- ENTER
writing RSA keyConfiguring DBServerInstalling ISPConfig crontabno crontab for rootno crontab for getmailRestarting services ...Stopping mysqld: [ OK ]Starting mysqld: [ OK ]Shutting down postfix: [ OK ]Starting postfix: [ OK ]Stopping saslauthd: [FAILED]Starting saslauthd: [ OK ]Shutting down amavisd: Daemon [1554] terminated by SIGTERM
[ OK ]amavisd stoppedStarting amavisd: [ OK ]
Stopping clamd.amavisd: [ OK ]Starting clamd.amavisd: [ OK ]Stopping Dovecot Imap: [ OK ]Starting Dovecot Imap: [ OK ]Reloading php-fpm: [ OK ]Reloading nginx: [ OK ]Stopping pure-ftpd: [ OK ]Starting pure-ftpd: [ OK ]
Installation completed.[root@server1 install]#
To fix the Mailman errors you might get during the ISPConfig installation, open /usr/lib/mailman/Mailman/mm_cfg.py...
vi /usr/lib/mailman/Mailman/mm_cfg.py
... and set DEFAULT_SERVER_LANGUAGE = 'en':
[...]#-------------------------------------------------------------# The default language for this server.DEFAULT_SERVER_LANGUAGE = 'en'[...]
Restart Mailman:
/etc/init.d/mailman restart
Afterwards you can access ISPConfig 3 under http(s)://server1.example.com:8080/ or http(s)://192.168.0.100:8080/ (http or httpsdepends on what you chose during installation). Log in with the username admin and the password admin (you should change the default password after your first login):
The system is now ready to be used.
If you want to use IPv6 addresses with your nginx vhosts, please do the following before you create IPv6 vhosts in ISPConfig:
Open /etc/sysctl.conf...
vi /etc/sysctl.conf
... and add the line net.ipv6.bindv6only = 1:
[...]net.ipv6.bindv6only = 1
Run...
sysctl -p
... afterwards for the change to take effect.
25.1 ISPConfig 3 Manual
In order to learn how to use ISPConfig 3, I strongly recommend to download the ISPConfig 3 Manual.On more than 300 pages, it covers the concept behind ISPConfig (admin, resellers, clients), explains how to install and update ISPConfig 3, includes a reference for all forms and form fields in ISPConfig together with examples of valid inputs, and provides tutorials for the most common tasks in ISPConfig 3. It also lines out how to make your server more secure and comes with a troubleshooting section at the end.
25.2 ISPConfig Monitor App For AndroidWith the ISPConfig Monitor App, you can check your server status and find out if all services are running as expected. You can check TCP and UDP ports and ping your servers. In addition to that you can use this app to request details from servers that have ISPConfig installed (please note that the minimum installed ISPConfig 3 version with support for the ISPConfig Monitor App is 3.0.3.3!); these details include everything you know from the Monitor module in the ISPConfig Control Panel (e.g. services, mail and system logs, mail queue, CPU and memory info, disk usage, quota, OS details, RKHunter log, etc.), and of course, as ISPConfig is multiserver-capable, you can check all servers that are controlled from your ISPConfig master server.For download and usage instructions, please visit http://www.ispconfig.org/ispconfig-3/ispconfig-monitor-app-for-android/.
Recommended