How to install TeamPass password manager on Debian 10

TeamPass is a collaborative password manager for managing passwords and sharing passwords among team members with specific roles. It uses MySQL / MariaDB to store passwords and provides powerful tools for custom password access. Teampass is highly customizable and offers many options to customize it to your needs. It uses Defuse PHP encryption library to protect your data and users.

In this tutorial, we will show you how to install TeamPass on Debian 10 and secure it with Let’s Encrypt SSL.

prerequisites

• A server running Debian 10.
• A valid domain name pointing to the server IP. In this tutorial, we will use the teampass.example.com domain.
• A root password is configured on your server.

getting Started

Before you start, it’s a good idea to update your system to the latest version. You can use the following command to update the system:

apt-get update -y apt-get upgrade -y

After updating the system, restart it to implement the changes.

Install LAMP server

First, you need to install the Apache web server, MariaDB database server, PHP, and other necessary PHP extensions into your system. You can install all components with:

apt-get install apache2 mariadb-server php php-cli libapache2-mod-php php-mysql php-curl php-mbstring php-bcmath php-common php-gd php-xml git wget -y

After installing all the packages, open the php.ini file and change some required settings:

nano /etc/php/7.3/apache2/php.ini

memory_limit = 256M
upload_max_filesize = 100M
max_execution_time = 360
date.timezone = Asia/Kolkata

Save and close the file when you are finished.

Configure MariaDB

By default, MariaDB root password is not configured in Debian 10. Therefore, for security reasons, you need to set it up.

First, log in to the MariaDB shell using the following command:

mysql

After logging in, use the following command to set the MariaDB root user password:

MariaDB [(none)]> SET PASSWORD FOR 'root'@'localhost' = PASSWORD("yournewpassword");

Next, create a database and user for TeamPass using the following command:

MariaDB [(none)]> create database teampassdb; MariaDB [(none)]> grant all privileges on teampassdb.* to [email protected] identified by "password";

Next, refresh the privileges and exit from the MariaDB shell using the following command:

MariaDB [(none)]> flush privileges; MariaDB [(none)]> exit;

Download TeamPass

Next, you need to download the latest version of TeamPass from the Git repository. You can download it to the Apache web root directory using the following command:

cd /var/www/html git clone https://github.com/nilsteampassnet/TeamPass.git

Next, grant the appropriate permissions to TeamPass using the following command:

chown -R www-data.www-data /var/www/html/TeamPass/ chmod -R 775 /var/www/html/TeamPass/

Configure Apache for TeamPass

Next, you will need to create an Apache virtual host profile for TeamPass. You can create it using:

nano /etc/apache2/sites-available/teampass.conf

Add the following lines:

   
     ServerAdmin [email protected]
     DocumentRoot /var/www/html/TeamPass   
     ServerName teampass.example.com

           
          Options FollowSymlinks
          AllowOverride All
          Require all granted
        

     ErrorLog ${APACHE_LOG_DIR}/teampass_error.log
     CustomLog ${APACHE_LOG_DIR}/teampass_access.log combined

  

Save and close the file when you are finished. Then, enable TeamPass virtual hosting and restart the Apache web service to apply the changes:

a2ensite teampass systemctl restart apache2

Let’s Encrypt to Protect TeamPass

Next, it’s best to secure TeamPass with Free Encrypted SSL. First, you need to install the Certbot client in the server to download and install “Let’s Encrypt SSL” for your domain.

The Certbot client package is not available in the Debian 10 default repository by default. You can add a repository using the following command:

echo "deb http://ftp.debian.org/debian buster-backports main" >> /etc/apt/sources.list

Next, update the repository and install the Certbot client using the following command:

apt-get update -y apt-get install python-certbot-apache -t buster-backports

After installation, run the following command to obtain and install the SSL certificate for your domain:

certbot --apache -d teampass.example.com

You will be prompted to accept the Terms of Service and provide a valid email address as follows:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): [email protected]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for teampass.example.com
Waiting for verification...
Cleaning up challenges
Created an SSL vhost at /etc/apache2/sites-available/teampass-le-ssl.conf
Enabled Apache socache_shmcb module
Enabled Apache ssl module
Deploying Certificate to VirtualHost /etc/apache2/sites-available/teampass-le-ssl.conf
Enabling available site: /etc/apache2/sites-available/teampass-le-ssl.conf

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.

Next, you will need to choose whether to redirect HTTP traffic to HTTPS as follows:

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2

Types of 2 And hit Enter Then go on. When the installation is complete, you will get the following output:

Redirecting vhost in /etc/apache2/sites-enabled/teampass.conf to ssl vhost in /etc/apache2/sites-available/teampass-le-ssl.conf

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Congratulations! You have successfully enabled https://teampass.example.com

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=teampass.example.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/teampass.example.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/teampass.example.com/privkey.pem
   Your cert will expire on 2020-04-30. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot again
   with the "certonly" option. To non-interactively renew *all* of
   your certificates, run "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

At this point, your domain is protected by “Encrypt our SSL.”

Access the TeamPass web interface

Open your web browser and enter the URL https://teampass.example.com. You will be redirected to the TeamPass welcome page as shown below:

Click on next Button. You should see the following page:

Provide the URL and path of your TeamPass and click emission Button. Once all requirements are met, you should see the following page:

Click on next Button. You should see the following page:

Provide your database details and click emission with next Button. You should see the following page:

Provide your administrator password and click emission with next Button. You should see the following page:

Click on emission The button populates the database. You should see the following page:

Click on next Button. You should see the following page:

Click on emission Button to complete the installation. You should see the following page:

Click on next Button. After installation is complete. You should see the following page:

Click on Go to homepage. You will be redirected to the TeamPass login page:

Provide your administrator username and password and click recording in Button. You should see the TeamPass dashboard on the following pages:

Congratulations! You have successfully installed and configured the TeamPass password manager on Debian 10.

Source