Secret Lair Labs: June 2010

Howdy boys and girls!

Today we'll be mangling us some web.

I've started off by installing a fresh copy of Ubuntu Lucid Server in Virtualbox 3.2.4. Mind, if you're using a Linux host, turn *ON* host caching in the "SATA Controller" if your host's using EXT4 as the filesystem your VDIs are stored on, otherwise it will try to use AIO and corrupt your VDIs. The host kernel needs a patch to fix this, but neither karmic or lucid have it, apparently. Anyway.

The Core System

For my first act, I've shuttled over my SSH public keys so I can use my agent to login.

ssh kamilion@laptop # Say no or ^C to make empty ~/.ssh dir with proper perms!
scp kamilion@laptop:/home/kamilion/.ssh/authorized_keys ~/.ssh/authorized_keys
tee -a /etc/ssh/sshd_config <<-\EOA

# No passwords! Get bent, crackers!
PasswordAuthentication no
EOA

For my second act, I've tossed a couple of the more useful utilities on. (python-software-properties gives you "add-apt-repository ppa:freenx-team" shortcuts)

sudo apt-get install python-software-properties dnsutils openssh-server denyhosts screen htop rsync nethogs sqlite3

Make *sure* you add your REAL origin IPs to /etc/hosts.allow

tee -a /etc/hosts.allow <<-\EOA

sshd: 10.0.0.5
sshd: 24.48.64.128
EOA
AND edit /etc/denyhosts.conf to enable blocklist sync.

nano /etc/denyhosts

At the bottom, you need to uncomment: SYNC_SERVER, SYNC_DOWNLOAD, SYNC_DOWNLOAD_THRESHOLD = 10, and SYNC_DOWNLOAD_RESILIENCY = 2d
then:
/etc/init.d/denyhosts restart

This will sync the ssh blocklists from the denyhosts server.
Uncomment SYNC_UPLOAD too, please contribute your stats!

(Yes, I know this is pointless after shutting off password auth, but BETTER SAFE THAN SORRY.)

Virtual Machines

If you're using a VM, this might be handy:

sudo apt-get install build-essential dkms
sudo rm /etc/init/tty[2-6].conf #Disable other TTYs because this is a VM.

The virtualbox guest additions will use dkms to build the guest kernel modules automatically.

You can select the Install Guest Additions from the vbox menu to insert the ISO into the cdrom.

/media/cdrom/autorun.sh

The Webserver

Now we'll install nginx.

sudo apt-get install nginx

And set it up to startup on boot with upstart.
The prestart tests the config; handy!

sudo tee /etc/init/nginx.conf <<-\EOA
# /etc/init/nginx.conf
# nginx - starts the nginx webserver

description "nginx"

start on (net-device-up and local-filesystems)
stop on runlevel [016]

pre-start exec /usr/sbin/nginx -t

expect fork
respawn
exec /usr/sbin/nginx
EOA

Now you should be able to

start nginx

and check port 80 for the default "Welcome to nginx!" response.

Right -- so this is served out of /var/www/ by default and controlled from /etc/nginx/ in such a manner that you dump config stanzas into a file in /etc/nginx/sites-available/ and link them as such:

sudo ln -s /etc/nginx/sites-available/fqdn.com /etc/nginx/sites-enabled/fqdn.com && sudo service nginx reload

you should get a working vhost with a proper config.

So, we're now capable of serving static pages, what else can we do?

Let's check which modules and defaults our nginx was compiled with:

nginx -V

nginx version: nginx/0.7.65
TLS SNI support enabled
configure arguments: --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --pid-path=/var/run/nginx.pid --lock-path=/var/lock/nginx.lock --http-log-path=/var/log/nginx/access.log --http-client-body-temp-path=/var/lib/nginx/body --http-proxy-temp-path=/var/lib/nginx/proxy --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --with-debug --with-http_stub_status_module --with-http_flv_module --with-http_ssl_module --with-http_dav_module --with-http_gzip_static_module --with-http_realip_module --with-mail --with-mail_ssl_module --with-ipv6 --add-module=/build/buildd/nginx-0.7.65/modules/nginx-upstream-fair

Looks like we've got fastcgi, DAV, FLV streaming, gzip and mail-proxy by default.

Installing PHP5

Now for PHP5.

sudo apt-get install php5-cgi php5-mysql php5-pgsql php5-sqlite php5-suhosin php5-imap php5-mcrypt php5-gd # php5-gd is usually needed

# security disclosure risk: shut php up -- hide version!
sudo sed -i '/expose_php/s/\;exp/exp/;/expose_php/s/=.*/= 0/' /etc/php5/cgi/php.ini
grep 'expose_php' /etc/php5/cgi/php.ini

sudo tee /etc/init/php-fastcgi.conf <<-\EOA
# /etc/init/php-fastcgi.conf
# php-fastcgi - starts php-cgi as an external FASTCGI process

description "php-fastcgi - respawning UNIX Socket"

start on (net-device-up and local-filesystems)
stop on runlevel [!2345]

expect fork
respawn
exec /usr/bin/sudo -u www-data PHP_FCGI_CHILDREN=5 PHP_FCGI_MAX_REQUESTS=125 /usr/bin/php-cgi -q -b /tmp/php-fastcgi.socket
EOA

Okay, now to start it.

start php-fastcgi

PHP5 FastCGI for nginx

Now you'll need an nginx config.

Here's one of my templates:

# Enable with
# sudo ln -s /etc/nginx/sites-available/fqdn.com /etc/nginx/sites-enabled/fqdn.com && sudo service nginx reload

server {
        listen                  80;
        server_name             fqdn.com www.fqdn.com;
        access_log              /var/www/fqdn.com/log/access.log;
        error_log               /var/www/fqdn.com/log/error.log;

        location / {
                root            /var/www/fqdn.com/public/;
                index           index.php index.html;
                }

        location ~ \.php$ {
                fastcgi_pass    unix:/tmp/php-fastcgi.socket;
                fastcgi_index   index.php;
                fastcgi_param   SCRIPT_FILENAME /var/www/fqdn.com/public$fastcgi_script_name;
                include         fastcgi_params;
                }
        }

### Redirect www to root domain?
#server {
#       listen                  80;
#       server_name             www.fqdn.com;
#       rewrite                 ^/(.*) http://fqdn.com/$1 permanent;
#       }

### Redirect root domain to www?
#server {
#       listen                  80;
#       server_name             fqdn.com;
#       rewrite                 ^/(.*) http://www.fqdn.com/$1 permanent;
#       }

### HTTPS server
#server {
#       listen                  443;
#       server_name             fqdn.com;
#       ssl                     on;
#       ssl_certificate         /var/www/fqdn.com/private/cert.pem;
#       ssl_certificate_key     /var/www/fqdn.com/private/cert.key;
#       ssl_session_timeout     5m;
#       ssl_protocols           SSLv2 SSLv3 TLSv1;
#       ssl_ciphers             ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
#       ssl_prefer_server_ciphers       on;
#       access_log              /var/www/fqdn.com/log/secure.access.log;
#       error_log               /var/www/fqdn.com/log/secure.error.log;
#       location / {
#               root            /var/www/fqdn.com/public/;
#               index           index.php index.html;
#               }
#       location ~ \.php$ {
#               fastcgi_pass    unix:/tmp/php-fastcgi.socket;
#               fastcgi_index   index.php;
#               fastcgi_param   SCRIPT_FILENAME /var/www/fqdn.com/public$fastcgi_script_name;
#               include         fastcgi_params;
#               }
#       }

The Database

Okay, let's move on and install a real database. Doesn't really matter which you choose. I'm gonna go with mysql for now so we can use phpmyadmin later.

sudo apt-get install mysql-server

Enter your new mysql root password twice.

Now for phpmyadmin.

sudo apt-get install phpmyadmin

It'll ask which server you want to configure it for -- leave both apache2 and lighttpd disabled and continue. Yes, we want to use dbconfig-common. Enter your mysql root password for the first one; then just hit enter to have phpmyadmin generate it's own account and random password.

sudo tee /etc/nginx/sites-available/phpmyadmin <<-\EOA
# Enable with
# sudo ln -s /etc/nginx/sites-available/phpmyadmin /etc/nginx/sites-enabled/phpmyadmin && sudo service nginx reload
server {
        listen 80 default;
        server_name localhost;
        access_log /var/www/apps/logs/phpmyadmin.access.log;
        error_log /var/www/apps/logs/phpmyadmin.error.log;

        location / {
            root /usr/share/phpmyadmin;
            index index.php;
            }

        location ~ \.php$ {
            include /etc/nginx/fastcgi_params;
            fastcgi_pass unix:/tmp/php-fastcgi.socket; #127.0.0.1:9000;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME /usr/share/phpmyadmin$fastcgi_script_name;
            }
        location /nginx_status {
            # copied from http://blog.kovyrin.net/2006/04/29/monitoring-nginx-with-rrdtool/
            stub_status on;
            access_log   off;
            allow 24.48.64.128; # Home
            allow 10.0.0.5; # Work
            deny all;
            }

        }
EOA

Make some empty logdirs or nginx will go splat when it can't access them.

mkdir -p /var/www/apps/logs/
chown -R www-data.www-data /var/www/apps/logs/

Kill the pesky default site now that we have phpmyadmin. (yes, "reload nginx" is a command. Nifty, huh? The magic of Upstart!)

ln -s /etc/nginx/sites-available/phpmyadmin /etc/nginx/sites-enabled/phpmyadmin
rm /etc/nginx/sites-enabled/default
reload nginx

You should now be able to access phpmyadmin and login with root/mysqlpass.
phpmyadmin also can synchronize two mysql instances now, as well.

Additional Information and Tricks

SSH tunnels are your friend! Sync DBs over ssh with phpmyadmin!
ssh -vg -L 8080:localhost:80 -R 33306:mysql-server.home:3306 user@fqdn.com

firefox http://localhost:8080/server_synchronize.php

replace mysql-server.home with whatever hostname/ip has the mysqld instance you wish to sync with. You can pick any port instead of 33306, just make sure you tell phpmyadmin to look at "localhost" on that port.

You can clone whole servers too!
push.sh:
#/bin/bash
rsync -azvv -e ssh /var/www/ root@fqdn.com:/var/www/
rsync -azvv -e ssh /etc/nginx/ root@fqdn.com:/etc/nginx/

pull.sh:
#!/bin/bash
rsync -azvv -e ssh root@fqdn.com:/etc/nginx/ /etc/nginx/
rsync -azvv -e ssh root@fqdn.com:/var/www/ /var/www/

Want a remote mini-desktop? This'll take a couple minutes.
add-apt-repository ppa:freenx-team
apt-get install freenx-server firefox gnome-core synaptic

Boom, grab the nxclient.

Now, go forth and serve pages!

Secret Lair Labs

Wednesday, June 9, 2010

Fun with nginx, upstart, and lucid

Tuesday, June 8, 2010

Goodbye [DB], Hello Crunchyroll!