aelius Posted January 8, 2012 Report Posted January 8, 2012 (edited) Acest tutorial este adresat celor care doresc sa isi configureze un server cu Debian. O sa acopar in in el urmatoarele aspecte:1. Instalare kernel cu grsec.2. Instalare si configurare apache.3. Instalare si configurare php.4. Instalare si module php (extensii).5. Configurare suhosin.6. Instalare MySQL Server.7. Modificari diverse permisiuni pentru un nivel mai bun de securitate8. Instalare nginx si folosirea lui ca frontend pentru apache (dual strat web server)----------------1. Instalare kernel cu grsec.Daca nu stiti inca ce este grsec/grsecurity, un bun punct de plecare este Grsecurity. Pentru linux, grsecurity este un fel de "sfantul graal" in materie de securitate. In plus, va scapa de o problema ce o are linux si care pe mine ma irita: ps aux dupa user, arata toate procesele.root@tex:~# echo "deb http://debian.cr0.org/repo/ kernel-security/" >> /etc/apt/sources.listroot@tex:~# wget http://kernelsec.cr0.org/kernel-security.ascroot@tex:~# apt-key add kernel-security.ascOKroot@tex:~# apt-get updateroot@tex:~# apt-cache search grseclinux-source-2.6.32.15-1-grsec - Linux kernel source for version 2.6.32.15-1-grseclinux-source-2.6.25.10-1-grsec - Linux kernel source for version 2.6.25.10-1-grseclinux-image-2.6.32.15-1-grsec - Linux kernel binary image for version 2.6.32.15-1-grseclinux-headers-2.6.32.15-1-grsec - Header files related to Linux kernel, specifically,linux-source-2.6.27.29-4-grsec - Linux kernel source for version 2.6.27.29-4-grsecroot@tex:~# apt-get install linux-image-2.6.32.15-1-grsec linux-headers-2.6.32.15-1-grsecroot@tex:~# init 6 # aici dam reboot pentru a boota noul kernel.// Dupa rebootroot@tex:~# uname -aLinux tex 2.6.32.15-1-grsec #2 SMP Mon Jun 28 09:05:30 CEST 2010 x86_64 GNU/Linuxroot@tex:~# su - textex@tex:~$ ps auxUSER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMANDtex 2103 0.6 0.1 36908 1276 pts/0 S 00:58 0:00 su - textex 2104 13.0 0.6 23380 6200 pts/0 S 00:58 0:00 -sutex 2129 0.0 0.1 16332 1176 pts/0 R+ 00:58 0:00 ps auxDin cate observati, vad doar procesele mele dupa user. 2. Instalare si configurare apache.root@tex:~# apt-get install apache2-mpm-prefork apache2.2-common apache2.2-binroot@tex:~# rm /etc/apache2/sites-available/defaultroot@tex:~# cat >> /etc/apache2/sites-available/default << EOF> NameVirtualHost *>> <Directory "/var/www">> AllowOverride AuthConfig FileInfo Options Indexes Limit> Options FollowSymLinks> Options -Indexes> </Directory>>> <VirtualHost *>> DocumentRoot /var/www> ServerName 10.0.0.220> CustomLog /var/log/apache2/access_log combined> ErrorLog /var/log/apache2/error_log> </VirtualHost>> EOFroot@tex:~#Apache o sa-l listam pe 127.0.0.1 port 81 si o sa fie backend.root@tex:~# echo "Listen 127.0.0.1:81" > /etc/apache2/ports.confroot@tex:~# /etc/init.d/apache2 start3. Instalare si configurare php (plus libapache2-mod-php5, necesar la apache (mod php))PHP-ul o sa-l instalez de la dotdeb.root@tex:~# echo "deb http://packages.dotdeb.org stable all" >> /etc/apt/sources.listroot@tex:~# echo "deb-src http://packages.dotdeb.org stable all" >> /etc/apt/sources.listroot@tex:~# wget http://www.dotdeb.org/dotdeb.gpgroot@tex:~# cat dotdeb.gpg |apt-key add - && rm dotdeb.gpgOKroot@tex:~# apt-get updateroot@tex:~# apt-get install php5 php5-cli libapache2-mod-php5 php5-common php5-suhosinInlocuiesc "expose_php = On" cu "expose_php = Off" / "short_open_tag = Off" cu "short_open_tag = On" si "session.name = PHPSESSID" cu "session.name = SERVLET" in php.ini pentru apache2.root@tex:~# perl -pi -e 's/expose_php = On/expose_php = Off/' /etc/php5/apache2/php.iniroot@tex:~# perl -pi -e 's/short_open_tag = Off/short_open_tag = On/' /etc/php5/apache2/php.iniroot@tex:~# perl -pi -e 's/PHPSESSID/SERVLET/' /etc/php5/apache2/php.ini4. Instalare si configurare module php (extensii).O sa instalez urmatoarele extensii php: curl, gd, mcrypt, mysql.root@tex:~# apt-get install php5-curl php5-gd php5-mcrypt php5-mysql5. Configurare suhosin.Din motive de securitate, o sa adaug in blacklisted utilizand suhosin urmatoarele functii: exec,shell_exec,passthru,show_source,dl,leak,ini_alter,ini_restore,proc_open,proc_nice,proc_terminate,proc_close,proc_get_status,symlink,system,popen,pcntl_getpriority,pcntl_wait,diskfreespace,disk_free_space,disk_total_space,get_current_user,stream_socket_accept,stream_socket_client,stream_socket_get_name,stream_socket_recvfrom,stream_socket_sendto,stream_socket_server,stream_socket_shutdownroot@tex:~# cat >> /etc/php5/conf.d/suhosin.ini << EOF>> suhosin.executor.func.blacklist = "exec,shell_exec,passthru,show_source,dl,leak,ini_alter,ini_restore,proc_open,proc_nice,proc_terminate,proc_close,proc_get_status,symlink,system,popen,pcntl_getpriority,pcntl_wait,diskfreespace,disk_free_space,disk_total_space,get_current_user,stream_socket_accept,stream_socket_client,stream_socket_get_name,stream_socket_recvfrom,stream_socket_sendto,stream_socket_server,stream_socket_shutdown"> suhosin.cookie.max_array_depth = 256> suhosin.cookie.max_array_index_length = 256> suhosin.cookie.max_name_length = 256> suhosin.cookie.max_totalname_length = 512> suhosin.cookie.max_value_length = 20000> suhosin.cookie.max_vars = 200> suhosin.get.max_array_depth = 200> suhosin.get.max_totalname_length = 1024> suhosin.get.max_value_length = 1024> suhosin.get.max_vars = 1024>>> suhosin.post.max_array_depth = 1024> suhosin.post.max_array_index_length = 1024> suhosin.post.max_name_length = 1024> suhosin.post.max_totalname_length = 1024> suhosin.post.max_value_length = 95000> suhosin.post.max_vars = 1024>> suhosin.request.max_vars = 512> suhosin.request.max_value_length = 90000> suhosin.request.max_totalname_length = 1024> suhosin.upload.max_uploads = 400>> suhosin.executor.include.max_traversal = 2>> EOFroot@tex:~#Cam asa arata php in cli:root@tex:~# php -vPHP 5.3.8-1~dotdeb.2 with Suhosin-Patch (cli) (built: Aug 25 2011 13:30:46)Copyright (c) 1997-2011 The PHP GroupZend Engine v2.3.0, Copyright (c) 1998-2011 Zend Technologies with Suhosin v0.9.32.1, Copyright (c) 2007-2010, by SektionEins GmbHroot@tex:~#6. Instalare MySQL Server si MySQL Clientroot@tex:~# apt-get install mysql-client-5.5 mysql-server-5.57. Modificari diverse permisiuni pentru un nivel mai bun de securitateMountam tmpfs in /tmp cu flag-urile "noexec,nosuid,nodev" din motive de securitate.root@tex:~# echo "tmpfs /tmp tmpfs noexec,nosuid,nodev 2 2" >> /etc/fstabroot@tex:~# mount /tmproot@tex:~# mount |grep "/tmp"tmpfs on /tmp type tmpfs (rw,noexec,nosuid,nodev)Stergem "/var/tmp" si il facem simlink catre tmp.root@tex:~# rm -rf /var/tmp/ && ln -s /tmp /var/tmpDam chmod 640 la "/dev/shm" din motive de securitate.root@tex:~# chmod 640 /dev/shm8. Instalare nginx si folosirea lui ca frontend pentru apache (dual strat web server)O sa listam port 80 cu nginx si o sa-l folosim ca frontend pentru apache, care se listeaza pe 127.0.0.1 port 81. (reverse proxy)root@tex:~# apt-get install nginxroot@tex:~# rm /etc/nginx/sites-enabled/defaultroot@tex:~# pico /etc/nginx/sites-enabled/default# fisier configuratieserver { listen 0.0.0.0:80 default; server_name _; access_log off; error_log /dev/null; location / { proxy_pass http://127.0.0.1:81; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; } }Pornim nginx-ul.root@tex:~# /etc/init.d/nginx startStarting nginx: nginx.root@tex:~#[URL="http://i42.tinypic.com/121zmtx.png"]O sa pun un phpinfo in "/var/www/"[/URL] pentru a vedea daca este totul in ordine si o sa sterg index.html (default)root@tex:~# echo "<?php phpinfo(); ?>" >> /var/www/index.phproot@tex:~# rm /var/www/index.html// restart la apache.root@tex:~# /etc/init.d/apache2 restart---------Note: - Daca aveti intrebari legate de acest tutorial, va raspund cu cea mai mare placere.- Imi cer scuze pentru eventualele greseli legate de exprimare (am cam tras chiulul de la somn)- Nu am specificat sursa acestui tutorial pentru ca este facut de mine. Edited February 1, 2014 by aelius // formatare corecta 2 Quote
