Perfect Server CentOS 8 with Apache, PHP, Postfix, Dovecot, Pure-FTPD, BIND and ISPConfig 3.2 (Beta)

Perfect Server CentOS 8 with Apache, PHP, Postfix, Dovecot, Pure-FTPD, BIND and ISPConfig 3.2 (Beta)

This tutorial shows the installation of ISPConfig 3.2 on a CentOS 8 (64-bit) server. ISPConfig is a web hosting control panel that allows you to configure the following services through a web browser: Apache web server, PHP, Postfix mail server, MySQL, BIND name server, PureFTPd, SpamAssassin, ClamAV, Mailman, etc.

1 requirements

To install such a system, you will need the following:

  • A Centos 8 minimal server system. As described in our Centos 8 minimum server tutorial, this can be a server installed from scratch, or a virtual server or root server of a hosting company with minimum Centos 8 settings installed.
  • Fast Internet connection.

2 preliminary description

In this tutorial, I will use the hostname server1.example.com with an IP address of 192.168.0.100 and a gateway of 192.168.0.1. These settings may be different for you, so you must replace them where appropriate.

3 prepare the server

Set keyboard layout

If the keyboard layout of the server does not match your keyboard, you can use the localectl command to switch to the right keyboard (in my case, the German keyboard layout is “de”):

localectl set-keymap de

To get a list of all available keyboard mappings, run:

localectl list-keymaps

I want to install ISPConfig at the end of this tutorial. ISPConfig comes with a Bastille firewall script that will be used as a firewall, so I now disable the default CentOS firewall. Of course, you can keep the CentOS firewall at will and configure it as needed (but you should not use any other firewall in the future, because it is likely to interfere with the CentOS firewall).

run…

dnf -y install net-tools wget rsyslogsystemctl stop firewalld.servicesystemctl disable firewalld.service

Stop and disable the CentOS firewall. It is okay when there is an error here, it just means that no firewall is installed.

Then, you should check whether the firewall is really disabled. To do this, run the command:

iptables -L

The output should look like this:

[[email protected] ~]# iptables -LChain INPUT (policy ACCEPT)target prot opt source destination
Chain FORWARD (policy ACCEPT)target prot opt source destination
Chain OUTPUT (policy ACCEPT)target prot opt source destination

Or use the firewall-cmd command:

firewall-cmd --state
[[email protected] ~]# firewall-cmd --statenot running[[email protected]r1 ~]#

Now, I will install the network configuration editor and the shell-based editor “nano”, which will be used to edit the configuration file in the next steps:

dnf -y install nano wget NetworkManager-tui yum-utils

If the network card is not configured during the installation process, you can configure it immediately. run…

nmtui

…And go to edit connection:

Choose your network interface:

Select network interface

advertising

Then fill in your network details-disable DHCP and fill in a static IP address, a netmask, your gateway and one or two name servers, and then click “OK”:

Set netmask

Next, select OK to confirm the changes you made in the network settings

Confirm network settings

Then exit to close the nmtui network configuration tool.

Exit nmtui

You should run

ifconfig

Now check if the installer has correctly set your IP address:

[[email protected] ~]# ifconfigens33: flags=4163  mtu 1500        inet 192.168.0.100  netmask 255.255.255.0  broadcast 192.168.0.255        inet6 fe80::20c:29ff:feee:b665  prefixlen 64  scopeid 0x20        inet6 2003:e1:bf22:1b00:20c:29ff:feee:b665  prefixlen 64  scopeid 0x0        ether 00:0c:29:ee:b6:65  txqueuelen 1000  (Ethernet)        RX packets 2874  bytes 1369892 (1.3 MiB)        RX errors 0  dropped 546  overruns 0  frame 0        TX packets 968  bytes 160901 (157.1 KiB)        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
lo: flags=73  mtu 65536        inet 127.0.0.1  netmask 255.0.0.0        inet6 ::1  prefixlen 128  scopeid 0x10        loop  txqueuelen 1000  (Local Loopback)        RX packets 0  bytes 0 (0.0 B)        RX errors 0  dropped 0  overruns 0  frame 0        TX packets 0  bytes 0 (0.0 B)        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

If your network card does not show up here, it means it was not enabled at startup. In this case, please open the file /etc/sysconfig/network-scripts/ifcfg-eth0

nano /etc/sysconfig/network-scripts/ifcfg-ens33

And set ONBOOT to yes:

[...]ONBOOT=yes[...]

And restart the server.

Check whether /etc/resolv.conf lists all the previously configured name servers:

cat /etc/resolv.conf

If the name server is missing, run

nmtui

And add the missing name server again.

Now, enter the configuration…Ad

Adjust /etc/hosts and /etc/hostname

Next, we will edit /etc/hosts. Make it look like this:

nano /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4192.168.0.100   server1.example.com     server1::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

Set the host name in the /etc/hostname file. The file should contain the fully qualified domain name (for example, server1.example.com in my case), not just short names such as “server1”. Open the file using the nano editor:

nano /etc/hostname

And set the host name in the file.

server1.example.com

Save the file and exit nano.

Set SELinux to lenient

SELinux is a security extension of CentOS and should provide extended security. ISPConfig does not come with SELinux rule set, so I set it to loose (if you want to install ISPConfig later, this is necessary).

Edit /etc/selinux/config and set SELINUX = permissive:

nano /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=permissive
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

After that, we must reboot the system:

reboot

4 enable other repositories and install certain software

First, we import the GPG key of the package:

rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY*

Then, enable the EPEL repository on the CentOS system, because many of the packages we will install in this tutorial are not available in the official CentOS 8 repository:

dnf -y install epel-release

Activate the power tool:

dnf config-manager --set-enabled PowerTools

Then, we update the existing software packages on the system:

dnf -y update

Now, we have installed some packages that we will need later:

dnf -y groupinstall 'Development Tools'

5 quotas

(If the partition scheme selected is different from the partition scheme I selected, you must adjust this chapter to apply the quota to the required partitions.)

To install quota, we run the following command:

dnf -y install quota

Now, we check if quotas have been enabled for the file system where the website (/var/www) and Maildir data (var/vmail) are stored. In this example setup, I have a large root partition, so I search for “/”:

mount | grep ' / '
[[email protected] ~]# mount | grep ' / '/dev/mapper/centos-root on / type xfs (rw,relatime,attr2,inode64,noquota)[[email protected] ~]#

If you have a separate /var partition, use:

mount | grep ' /var '

instead. If the line contains the word “Noquota“, and then follow the steps below to enable quotas.

Enable quotas on the / (root) partition

Normally, you will enable quotas in the /etc/fstab file, but if the file system is the root file system “/”, you must enable quotas through the startup parameters of the Linux Kernel.

Edit the grub configuration file:

nano /etc/default/grub

Search for the line starting with GRUB_CMDLINE_LINUX and add rootflags = uquota, gquota to the command line parameters so that the resulting line looks like this:

GRUB_CMDLINE_LINUX="crashkernel=auto resume=/dev/mapper/cl-swap rd.lvm.lv=cl/root rd.lvm.lv=cl/swap rootflags=uquota,gquota"

And apply the changes by running the following command.

cp /boot/grub2/grub.cfg /boot/grub2/grub.cfg_bakgrub2-mkconfig -o /boot/grub2/grub.cfg

And restart the server.

reboot

Now check if quota is enabled:

mount | grep ' / '
[[email protected] ~]# mount | grep ' / '/dev/mapper/centos-root on / type xfs (rw,relatime,attr2,inode64,usrquota,grpquota)[[email protected] ~]#

After enabling quotas, we can see “usrquota, grpquotaIn the list of installation options.

Enable quota on a separate /var partition

If you have a separate /var partition, edit /etc/fstab and add /uquota, gquota to /partition (/dev/mapper/centos-var):

nano /etc/fstab
## /etc/fstab# Created by anaconda on Sun Sep 21 16:33:45 2014## Accessible filesystems, by reference, are maintained under '/dev/disk'# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info#/dev/mapper/centos-root /                       xfs     defaults        1 1/dev/mapper/centos-var /var                     xfs     defaults,uquota,gquota        1 2UUID=9ac06939-7e43-4efd-957a-486775edd7b4 /boot                   xfs     defaults        1 3/dev/mapper/centos-swap swap                    swap    defaults        0 0

Then run

mount -o remount /var
quotacheck -avugmquotaon -avug

Enable quota. If an error occurs, that is, there is no partition with quotas enabled, please reboot the server before continuing.

6 Install Apache, PHP, MySQL and phpMyAdmin

Enable the Remi repository to get the updated PHP version (currently PHP 7.4):

dnf install http://rpms.remirepo.net/enterprise/remi-release-8.rpmdnf -y install yum-utilsdnf -y module reset phpdnf -y module install php:remi-7.4dnf update

We can install the required packages with one command:

dnf -y install httpd mod_ssl mariadb-server php php-mysqlnd php-mbstring

In order to ensure that the server will not be attacked through the HTTPOXY vulnerability, we will globally disable the HTTP_PROXY header in apache.

Add the apache header rule at the end of the httpd.conf file:

echo "RequestHeader unset Proxy early" >> /etc/httpd/conf/httpd.conf

And restart httpd to apply configuration changes.

service httpd restart

Install phpMyAdmin:

cd /tmpwget https://files.phpmyadmin.net/phpMyAdmin/5.0.2/phpMyAdmin-5.0.2-all-languages.tar.gztar xzvf phpMyAdmin-5.0.2-all-languages.tar.gzmkdir /usr/share/phpmyadminmv phpMyAdmin-5.0.2-all-languages/* /usr/share/phpmyadmin/mkdir /usr/share/phpmyadmin/tmpchown -R apache:apache /usr/share/phpmyadminchmod 777 /usr/share/phpmyadmin/tmp

Optional: Change the Apache MPM module

CentOS 8 uses the Apache MPM Event module by default, which is good on the one hand because it allows you to use the HTTP/2 protocol. On the other hand, it does not allow you to use the apache mod_php module. Generally, PHP-FPM should be used as the default today, while ISPConfig supports it. If you need the old mod_php mode for compatibility reasons, you can switch Apache MPM like this:

nano /etc/httpd/conf.modules.d/00-mpm.conf

Add the # sign in front of the MPM event line, as shown below:

# LoadModule mpm_event_module modules/mod_mpm_event.so

Then remove #in from the MPM Prefork line, so it looks like this:

LoadModule mpm_prefork_module modules/mod_mpm_prefork.so

Then restart httpd to apply the configuration changes.

service httpd restart

7 install the dovecote

Dovecot can be installed as follows:

dnf -y install dovecot dovecot-mysql dovecot-pigeonhole

Create an empty dovecot-sql.conf file and create a symbolic link:

touch /etc/dovecot/dovecot-sql.confln -s /etc/dovecot/dovecot-sql.conf /etc/dovecot-sql.confln -s /etc/dovecot/dovecot.conf /etc/dovecot.conf

Now create a system startup link and start Dovecot:

systemctl enable dovecotsystemctl start dovecot

8 install Postfix

Postfix can be installed as follows:

dnf -y install postfix postfix-mysql

Next, open TLS/SSL and submission ports in Postfix:

nano /etc/postfix/master.cf

Uncomment the submission and smtps sections below and add lines if necessary to make this part of the master.cf file exactly the same as the one below. important: Delete the # in front of the line that starts with smtps and is submitted, not just from the -o line after these lines!

[...]submission inet n - n - - smtpd -o syslog_name=postfix/submission -o smtpd_tls_security_level=encrypt -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject# -o smtpd_reject_unlisted_recipient=no# -o smtpd_client_restrictions=$mua_client_restrictions# -o smtpd_helo_restrictions=$mua_helo_restrictions# -o smtpd_sender_restrictions=$mua_sender_restrictions# -o smtpd_recipient_restrictions=# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject# -o milter_macro_daemon_name=ORIGINATINGsmtps inet n - n - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes -o smtpd_client_restrictions=permit_sasl_authenticated,reject# -o smtpd_reject_unlisted_recipient=no# -o smtpd_client_restrictions=$mua_client_restrictions# -o smtpd_helo_restrictions=$mua_helo_restrictions# -o smtpd_sender_restrictions=$mua_sender_restrictions# -o smtpd_recipient_restrictions=# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject# -o milter_macro_daemon_name=ORIGINATING[...]

Then close Sendmail and start Postfix and MariaDB (MySQL):

systemctl enable mariadb.servicesystemctl start mariadb.service
systemctl enable postfix.servicesystemctl restart postfix.service

We disable sendmail to ensure that it will not be started in case it is installed on your server. Therefore, the error message “Cannot issue method call: unit sendmail.service is not loaded.” can be ignored.

9 install Getmail

You can install Getmail as follows:

dnf install python2cd /tmpwget http://pyropus.ca/software/getmail/old-versions/getmail-5.14.tar.gztar xvfz getmail-5.14.tar.gzcd getmail-5.14python2 setup.py buildpython2 setup.py install

10 set MySQL password and configure phpMyAdmin

Set the password of the MySQL root account:

mysql_secure_installation
[[email protected] tmp]# mysql_secure_installationNOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDBSERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!
In order to log into MariaDB to secure it, we'll need the currentpassword for the root user. If you've just installed MariaDB, andyou haven't set the root password yet, the password will be blank,so you should just press enter here.
Enter current password for root (enter for none):OK, successfully used password, moving on...
Setting the root password ensures that nobody can log into the MariaDBroot user without the proper authorisation.Set root password? [Y/n] <-- ENTERNew password: <-- yourrootsqlpasswordRe-enter new password: <-- yourrootsqlpasswordPassword updated successfully!Reloading privilege tables.. ... Success!By default, a MariaDB installation has an anonymous user, allowing anyoneto log into MariaDB without having to have a user account created forthem. This is intended only for testing, and to make the installationgo a bit smoother. You should remove them before moving into aproduction environment.Remove anonymous users? [Y/n] <-- ENTER ... Success!Normally, root should only be allowed to connect from 'localhost'.  Thisensures that someone cannot guess at the root password from the network.Disallow root login remotely? [Y/n] <-- ENTER ... Success!By default, MariaDB comes with a database named 'test' that anyone canaccess. This is also intended only for testing, and should be removedbefore moving into a production environment.Remove test database and access to it? [Y/n] <-- ENTER - Dropping test database... ... Success! - Removing privileges on test database... ... Success!Reloading the privilege tables will ensure that all changes made so farwill take effect immediately.Reload privilege tables now? [Y/n] <-- ENTER ... Success!Cleaning up...All done! If you've completed all of the above steps, your MariaDBinstallation should now be secure.Thanks for using MariaDB![[email protected] tmp]#

Now we configure phpMyAdmin. Create this phpMyAdmin configuration file:

nano /etc/httpd/conf.d/phpmyadmin.conf

Add this content to the file:

# phpMyAdmin - Web based MySQL browser written in php
#
# Allows only localhost by default
#
# But allowing phpMyAdmin to anyone other than localhost should be considered
# dangerous unless properly secured by SSL

Alias /phpMyAdmin /usr/share/phpmyadmin
Alias /phpmyadmin /usr/share/phpmyadmin


   
     # Apache 2.4
  #  
     #  Require ip 127.0.0.1
     #  Require ip ::1
  #  
   
   
     # Apache 2.2
     Order Deny,Allow
     Deny from All
     Allow from 127.0.0.1
     Allow from ::1
   

            

Next, we change the authentication in phpMyAdmin from cookie to http:

cp -pf /usr/share/phpmyadmin/config.sample.inc.php /usr/share/phpmyadmin/config.inc.phpnano /usr/share/phpmyadmin/config.inc.php
[...]
/* Authentication type */
$cfg['Servers'][$i]['auth_type'] = 'http';
[...]

Then, we create a system startup link for Apache and start it:

systemctl enable httpdsystemctl restart httpd

Now you can direct your browser to http://server1.example.com/phpmyadmin/ or http://192.168.0.100/phpmyadmin/ and log in with the username root and the new root MySQL password.

11 Install new Amavisd, SpamAssassin, ClamAV and Postgrey

To install amavisd-new, SpamAssassin and ClamAV, run the following command:

dnf -y install amavisd-new spamassassin clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd unzip bzip2 perl-DBD-mysql postgrey re2c

Then we start Freshclam, amavisd and clamd.amavisd:

sa-updatefreshclamsystemctl enable amavisd.servicesystemctl start amavisd.servicesystemctl start [email protected]systemctl enable postgrey.servicesystemctl start postgrey.service

12 Install Apache with mod_php, mod_fcgi/PHP, PHP-FPM

ISPConfig 3 allows you to use mod_php, mod_fcgi/PHP, cgi/PHP and PHP-FPM on every website.

We can install Apache2 using mod_php, mod_fcgid and PHP as follows:

dnf -y install php php-devel php-gd php-imap php-ldap php-mysql php-odbc php-pear php-xml php-xmlrpc php-pecl-apc php-mbstring php-mcrypt php-snmp php-soap php-tidy curl curl-devel perl-libwww-perl ImageMagick libxml2 libxml2-devel mod_fcgid php-cli httpd-devel php-fpm php-intl php-imagick php-pspell wget

Next, we open /etc/php.ini...

nano /etc/php.ini

...And change the error report (so that the notification is no longer displayed), set the time zone and uncomment cgi.fix_pathinfo = 1:

[...]
;error_reporting = E_ALL & ~E_DEPRECATED
error_reporting = E_ALL & ~E_NOTICE & ~E_DEPRECATED & ~E_STRICT
[...]
; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI.  PHP's
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
; what PATH_INFO is.  For more information on PAppp.tldTH_INFO, see the cgi specs.  Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec.  A setting
; of zero causes PHP to behave as before.  Default is 1.  You should fix your scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; http://www.php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo
cgi.fix_pathinfo=1[...]date.timezone = 'Europe/Berlin'
[...]

Enable httpd and PHP-FPM to start and start the PHP-FPM service at boot time.

systemctl start php-fpm.servicesystemctl enable php-fpm.servicesystemctl enable httpd.service

Finally, we restart Apache:

systemctl restart httpd.service

Now, we will add support for "Let's Encrypt".

mkdir /opt/certbotcd /opt/certbotwget https://dl.eff.org/certbot-autochmod a+x ./certbot-auto

Now run the certbot-auto command, which will download and install the software and its dependencies.

./certbot-auto

The command will tell you "Name not found in the configuration file" and ask whether to continue, please select "c" here to cancel, because the certificate will be created by ispconfig.

Install certbot on CentOS

The Apache module mod_python cannot be used as an RPM package, so we will compile it from the source code. The first step is to install the python development files and download the current mod_python version as a .tar.gz file.

dnf -y install python3-devel
cd /usr/local/src/wget http://dist.modpython.org/dist/mod_python-3.5.0.tgztar xfz mod_python-3.5.0.tgzcd mod_python-3.5.0

Then configure and compile the module.

./configure --with-python=/usr/bin/python3make

An error in the compiled module will cause the installation to fail and display the error "version="fatal: not a git repository (or any parent directory): .git". To solve this problem, run this sed command (the command is One line!).

sed -e 's/(git describe --always)/(git describe --always 2>/dev/null)/g' -e 's/`git describe --always`/`git describe --always 2>/dev/null`/g' -i $( find . -type f -name Makefile* -o -name version.sh )

Then use this command to install the module.

make install

And enable the module in Apache:

echo 'LoadModule python_module modules/mod_python.so' > /etc/httpd/conf.modules.d/10-python.confsystemctl restart httpd.service

14 install PureFTPd

You can install PureFTPd with the following command:

dnf -y install pure-ftpd

Then create a system startup link and start PureFTPd:

systemctl enable pure-ftpd.servicesystemctl start pure-ftpd.service

Now, we configure PureFTPd to allow FTP and TLS sessions. FTP is a very insecure protocol because all passwords and all data are transmitted in clear text. By using TLS, the entire communication can be encrypted, making FTP more secure.

TLS requires the use of OpenSSL. To install OpenSSL, we just need to run:

dnf install openssl

Open /etc/pure-ftpd/pure-ftpd.conf...

nano /etc/pure-ftpd/pure-ftpd.conf

If you want to allow FTP and TLS sessions, please set TLS to 1 by deleting the # in front of the TLS line. It is strongly recommended to enable TLS.

[...]
# This option can accept three values :
# 0 : disable SSL/TLS encryption layer (default).
# 1 : accept both traditional and encrypted sessions.
# 2 : refuse connections that don't use SSL/TLS security mechanisms,
#     including anonymous sessions.
# Do _not_ uncomment this blindly. Be sure that :
# 1) Your server has been compiled with SSL/TLS support (--with-tls),
# 2) A valid certificate is in place,
# 3) Only compatible clients will log in.

TLS                      1
[...]

In order to use TLS, we must create an SSL certificate. I created it in /etc/ssl/private/, so I created the directory first:

mkdir -p /etc/ssl/private/

After that, we can generate the SSL certificate as follows:

openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem

Country name (2-letter code) [XX]:<-Enter your country/region name (e.g. "DE"). State or province (full name) []:<-Enter your state or province name. District name (e.g. city) [Default City]:<-Enter your city. Organization name (e.g. company) [Default Company Ltd]:<-Enter your organization name (for example, company name). Organizational unit name (for example, part) []:<-Enter the name of your organizational unit (for example, "IT Department"). Common name (for example, your name or the host name of the server) []:<-Enter the fully qualified domain name of the system (for example, "server1.example.com"). Email address []:<-Enter your email address.

Change the authority of the SSL certificate:

chmod 600 /etc/ssl/private/pure-ftpd.pem

Create a DHParam file:

openssl dhparam -out /etc/ssl/private/pure-ftpd-dhparams.pem 2048

Finally, restart PureFTPd:

systemctl restart pure-ftpd.service

That's it. Now, you can try to connect using an FTP client; however, you should configure the FTP client to use TLS.

15 install BIND

We can install BIND as follows:

dnf -y install bind bind-utils haveged

Back up the existing /etc/named.conf file and create a new file as shown below:

cp /etc/named.conf /etc/named.conf_bakcat /dev/null > /etc/named.confnano /etc/named.conf
//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { any; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
				allow-recursion {"none";};
        recursion no;
};
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};
zone "." IN {
        type hint;
        file "named.ca";
};
include "/etc/named.conf.local";

Create the file /etc/named.conf.local, which is included at the end of /etc/named.conf (if you create a DNS zone in ISPConfig, /etc/named.conf.local will be populated by ISPConfig later):

touch /etc/named.conf.local

Then, we create a startup link and start BIND:

systemctl enable named.servicesystemctl start named.servicesystemctl enable haveged.servicesystemctl start haveged.service

16 Install AWStats

AWStats can be installed as follows:

dnf -y install awstats perl-DateTime-Format-HTTP perl-DateTime-Format-Builder

The alternative web statistics application'webalizer' is no longer available for CentOS 8, so you will only be able to use AWStats.

17 install Jailkit

Jailkit is used to chroot SSH users and cronjobs. It can be installed as follows:

ln -s /usr/bin/python2 /usr/bin/pythoncd /tmpwget http://olivier.sessink.nl/jailkit/jailkit-2.21.tar.gztar xvfz jailkit-2.21.tar.gzcd jailkit-2.21./configuremakemake installcd ..rm -rf jailkit-2.21*

18 install Fail2Ban

This is optional, but recommended because the ISPConfig monitor tries to display the log.

dnf -y install iptables-services fail2ban fail2ban-systemdsystemctl stop firewalld.servicesystemctl mask firewalld.servicesystemctl disable firewalld.service

Next, we create the /etc/fail2ban/jail.local file and enable monitoring of ssh, email and ftp services.

nano /etc/fail2ban/jail.local

Add the following to the jail.local file:

[sshd]enabled = trueaction = iptables[name=sshd, port=ssh, protocol=tcp][pure-ftpd]enabled = trueaction = iptables[name=FTP, port=ftp, protocol=tcp]maxretry = 3[dovecot]enabled = trueaction = iptables-multiport[name=dovecot, port="pop3,pop3s,imap,imaps", protocol=tcp]maxretry = 5[postfix-sasl]enabled = trueaction = iptables-multiport[name=postfix-sasl, port="smtp,smtps,submission", protocol=tcp]maxretry = 3

Then create a system startup link for fail2ban and start it:

systemctl enable fail2ban.servicesystemctl start fail2ban.service

19 install rkhunter

rkhunter can be installed as follows:

dnf -y install rkhunter

20 install Mailman

If you want to use Mailman on the server to manage mailing lists, please install mailman now. ISPConfig supports Mailman, so you can create new mailing lists through ISPConfig in the future.

dnf -y install mailman

Before starting Mailman, you must create the first mailing list called mailman:

touch /var/lib/mailman/data/aliasespostmap /var/lib/mailman/data/aliases/usr/lib/mailman/bin/newlist mailmanln -s /usr/lib/mailman/mail/mailman /usr/bin/mailman

[[email protected] tmp]#/Usr/lib/mailman/bin/newlist mailman enter the email of the person running the list: <-admin email address, for example [email protected]Initial postman password: <- admin password for the postman list To finish creating your mailing list, you must edit your /etc/aliases (equivalent) file by adding the following lines and possibly running a new mail. listmailman: "" | /usr/lib/mailman/mail/mailman post mailman" mailman-admin: """ // usr/lib/mailman/mail/mailman admin mailman" mailman-bounces: /mailman return mailman" mailman- confirm:" | /usr/lib/mailman/mail/mailman confirm mailman" mailman-join: usr/lib/mailman/mail/mailman leave mailman "mailman-owner:"" | /usr/lib/mailman/mail/mailmanowner -mailman" mailman-request: "mailman-subscribe: "|/usr/lib/mailman/mail/mailman subscribe to mailman" mailman-unsubscribe: "|/usr/lib/mailman/mail/mailman unsubscribe mailman" hit to notify mailman owner... <-input[[email protected] tmp]#

Then open /etc/aliases...

nano /etc/aliases

...And add the following line:

[...]
mailman:              "|/usr/lib/mailman/mail/mailman post mailman"
mailman-admin:        "|/usr/lib/mailman/mail/mailman admin mailman"
mailman-bounces:      "|/usr/lib/mailman/mail/mailman bounces mailman"
mailman-confirm:      "|/usr/lib/mailman/mail/mailman confirm mailman"
mailman-join:         "|/usr/lib/mailman/mail/mailman join mailman"
mailman-leave:        "|/usr/lib/mailman/mail/mailman leave mailman"
mailman-owner:        "|/usr/lib/mailman/mail/mailman owner mailman"
mailman-request:      "|/usr/lib/mailman/mail/mailman request mailman"
mailman-subscribe:    "|/usr/lib/mailman/mail/mailman subscribe mailman"
mailman-unsubscribe:  "|/usr/lib/mailman/mail/mailman unsubscribe mailman"

run

newaliases

After that, restart Postfix:

systemctl restart postfix.service

Now open the Mailman Apache configuration file /etc/httpd/conf.d/mailman.conf...

nano /etc/httpd/conf.d/mailman.conf

...And add the ScriptAlias ​​line /cgi-bin/mailman//usr/lib/mailman/cgi-bin/. Comment out Alias ​​/ pipermail / / var / lib / mailman / archives / public / and add the line Alias ​​/ pipermail / var / lib / mailman / archives / public /:

#
#  httpd configuration settings for use with mailman.
#

ScriptAlias /mailman/ /usr/lib/mailman/cgi-bin/
ScriptAlias /cgi-bin/mailman/ /usr/lib/mailman/cgi-bin/

    AllowOverride None
    Options ExecCGI
    Order allow,deny
    Allow from all



#Alias /pipermail/ /var/lib/mailman/archives/public/
Alias /pipermail /var/lib/mailman/archives/public/

    Options Indexes MultiViews FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
    AddDefaultCharset Off


# Uncomment the following line, to redirect queries to /mailman to the
# listinfo page (recommended).

# RedirectMatch ^/mailman[/]*$ /mailman/listinfo

Restart Apache:

systemctl restart httpd.service

Create Mailman's system startup link and start it:

systemctl enable mailman.servicesystemctl start mailman.service

After installing ISPConfig 3, you can access Mailman as follows:

You can use the alias /cgi-bin/mailman for all Apache virtual hosts (please note that suExec and CGI must be disabled for all virtual hosts to access Mailman!), which means you can access the Mailman management interface to get the list. At http: ///cgi-bin/mailman/admin/, The web page about mailing list users can be found on http:///cgi-bin/mailman/listinfo/.

Under http:///pipermail/ You can find the mailing list archive.

21 Install Roundcube Webmail

To install the RoundCube Webmail client, use wget to download the latest version to the /tmp folder:

cd /tmpwget https://github.com/roundcube/roundcubemail/releases/download/1.4.3/roundcubemail-1.4.3-complete.tar.gz

Unzip the tar.gz archive file and move the RoundCube source to /usr/share/roundcubemail

tar xfz roundcubemail-1.4.3-complete.tar.gzmkdir /usr/share/roundcubemailmv /tmp/roundcubemail-1.4.3/* /usr/share/roundcubemail/chown -R root:root /usr/share/roundcubemailchown apache /usr/share/roundcubemail/tempchown apache /usr/share/roundcubemail/logs

Use the nano editor to create a roundcubemail.conf configuration file:

nano /etc/httpd/conf.d/roundcubemail.conf

And add the following to the file:

#
# Round Cube Webmail is a browser-based multilingual IMAP client
#

Alias /roundcubemail /usr/share/roundcubemailAlias /webmail /usr/share/roundcubemail

# Define who can access the Webmail
# You can enlarge permissions once configured


        Options none
        AllowOverride Limit
        Require all granted


# Define who can access the installer
# keep this secured once configured


        Options none
        AllowOverride Limit
        Require all granted



# Those directories should not be viewed by Web clients.

    Order Allow,Deny
    Deny from all


    Order Allow,Deny
    Deny from all

Restart Apache:

systemctl restart httpd.service

Now we need a database for RoundCube mail, we will initialize it as follows:

mysql -u root -p

Use at the MariaDB prompt:

CREATE DATABASE roundcubedb;CREATE USER [email protected] IDENTIFIED BY 'roundcubepassword';GRANT ALL PRIVILEGES on roundcubedb.* to [email protected] ;FLUSH PRIVILEGES;exit

I take the detailed information of the RoundCube database as an example. For security reasons, please replace these values ​​according to your choice.

Now we will install RoundCube on http://192.168.0.100/roundcubemail/installer in the browser

Perfect Server CentOS 8 with Apache, PHP, Postfix, Dovecot, Pure-FTPD, BIND and ISPConfig 3.2 (Beta)

Now create the config.inc.php file:

nano /usr/share/roundcubemail/config/config.inc.php

Then press "Continue" in the web installer. On the next page, click the button "Initialize Database".

Finally, disable the Roundecubemail installer. Change the RoundCube config.inc.php configuration file

nano /usr/share/roundcubemail/config/config.inc.php

And change the line:

$config['enable_installer'] = true;

to:

$config['enable_installer'] = false;

Roundcube is now available under aliases /webmail and /roundcubemail on the server:

http://192.168.0.100/webmail

The RoundCube login name is the email address and password of the email account you create later in ISPConfig.

22 Install ISPConfig 3.2

The ISPConfig installer will configure all services for you, such as Postfix, Dovecot, etc.

Now you can also let the installer create an SSL virtual host for the ISPConfig control panel so that you can use https:// instead of http:/// to access ISPConfig. To do this, please press ENTER when you see the following question: Do you want a secure (SSL) connection to the ISPConfig Web interface (y, n) [y]:.

To install ISPConfig 3.2 Beta, do the following:

cd /tmp wget -O ispconfig.tar.gz http://www.ispconfig.org/downloads/ISPConfig-3.2b2.tar.gztar xfz ispconfig.tar.gzcd ispconfig3*/install/

The next step is to run:

php -q install.php

This will launch the ISPConfig 3 installer. The installer will configure all services for you, such as Postfix, Dovecot, etc.

[[email protected] install]# php install.php
--------------------------------------------------------------------------------_____ ___________ _____ __ _ ____|_ _/ ___| ___  / __  / _(_) /__ | |  `--.| |_/ / | / / ___ _ __ | |_ _ __ _ _/ /| | `--.  __/ | | / _ | '_ | _| |/ _` | |_ |_| |_/__/ / | | __/ (_) | | | | | | | (_| | ___ \___/____/_| ____/___/|_| |_|_| |_|__, | ____/__/ ||___/--------------------------------------------------------------------------------
>> Initial configuration
Operating System: CentOS 8.2
Following will be a few questions for primary configuration so be careful.Default values are in [brackets] and can be accepted with .Tap in "quit" (without the quotes) to stop the installer.
Select language (en,de) [en]: <-- Hit Enter
Installation mode (standard,expert) [standard]: <-- Hit Enter
Full qualified hostname (FQDN) of the server, eg server1.domain.tld [server1.example.com]: <-- Hit Enter
MySQL server hostname [localhost]: <-- Hit Enter
MySQL server port [3306]: <-- Hit Enter
MySQL root username [root]: <-- Hit Enter
MySQL root password []: <-- Ente the MySQL root password here
MySQL database to create [dbispconfig]: <-- Hit Enter
MySQL charset [utf8]: <-- Hit Enter
Configuring PostgreyConfiguring PostfixGenerating a 4096 bit RSA private key................................++.....................................................................................................................................................................................................................................................................................................................................................++writing new private key to 'smtpd.key'-----You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [XX]: <-- Enter 2 Letter country code, e.g. USState or Province Name (full name) []: <-- Enter anme of State or ProvinceLocality Name (eg, city) [Default City]: <-- Name of cityOrganization Name (eg, company) [Default Company Ltd]: <-- Company nameOrganizational Unit Name (eg, section) []: <-- Hit EnterCommon Name (eg, your name or your server's hostname) []: <-- Enter server hostname here, in my case: server1.example.comEmail Address []: <-- Enter Email addressConfiguring mailmanConfiguring DovecotConfiguring SpamassassinConfiguring AmavisdConfiguring GetmailConfiguring JailkitConfiguring PureftpdConfiguring BINDConfiguring ApacheConfiguring vlogger[INFO] service OpenVZ not detectedConfiguring Bastille Firewall[INFO] service Metronome XMPP Server not detectedConfiguring Fail2banConfiguring Apps vhostInstalling ISPConfigISPConfig Port [8080]: <-- Hit Enter
Admin password [fad579a6]: <-- Enter new password for ISPConfig admin user
Re-enter admin password []: <-- Repeat the password
Do you want a secure (SSL) connection to the ISPConfig web interface (y,n) [y]: <-- Hit Enter
Generating RSA private key, 4096 bit long modulus.................................................................................++.....++e is 65537 (0x10001)You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank.-----Country Name (2 letter code) [XX]: <-- Enter 2 Letter country code, e.g. USState or Province Name (full name) []: <-- Enter anme of State or ProvinceLocality Name (eg, city) [Default City]: <-- Name of cityOrganization Name (eg, company) [Default Company Ltd]: <-- Company nameOrganizational Unit Name (eg, section) []: <-- Hit EnterCommon Name (eg, your name or your server's hostname) []: <-- Enter server hostname here, in my case: server1.example.comEmail Address []: <-- Enter Email address
Please enter the following 'extra' attributesto be sent with your certificate requestA challenge password []: <-- Hit EnterAn optional company name []: <-- Hit Enterwriting RSA key
Configuring DBServerInstalling ISPConfig crontabInstalling ISPConfig crontabno crontab for rootno crontab for getmailDetect IP addressesRestarting services ...Installation completed.

The installer will automatically configure all basic services, so no manual configuration is required.

23 first ISPConfig login

After that, you can use http(s://://server1.example.com:8080/or http(s)://192.168.0.100:8080/(http or https depends on what you choose during installation ) To access ISPConfig 3.

Log in with username admin and password admin (you should change the default password after logging in for the first time):

ISPConfig login

23.1 ISPConfig 3 Manual

In order to learn how to use ISPConfig 3, I strongly recommend downloading the ISPConfig 3 manual.

On more than 300 pages, it covers the concept of ISPConfig (administrator, reseller, client), explains how to install and update ISPConfig 3, includes references to all forms and form fields in ISPConfig, and examples of valid input, and A tutorial is provided. The most common tasks in ISPConfig 3. It also lists how to make the server more secure, and provides a troubleshooting section at the end.

24 download as a virtual machine

This setting can be provided to howtoforge subscribers in the form of a virtual machine download in the ova/ovf format (compatible with VMWare and Virtualbox).

VM login details

  • The root password is: howtoforge
  • The password of the ISPConfig "admin" user is: howtoforge
  • There is also a shell user named "howtoforge" and password: howtoforge

Please change both passwords when logging in for the first time.

  • The IP address of the virtual machine is 192.168.0.100
Sidebar