CentOS - Server-Essentials

Ab und zu muass i mein CentOS-Server neu aufsetzn (entweder weil wieda irgendwos schiefglaufn is oda weil mir des befriedigende Gfühl von am neichn, sauberen System foit) und woar irgendwann zutiefst (allerallertiefst!) gnervt davon, dauernd de söbn Tasks zur Neuinstallation auszuführn. Um den Prozess a bissl zu beschleunigen, hob i ma a Skript gschriebn, des de nervigen Aufgaben für mi übernimmt. Vielleicht hüft's ja am oan oda ondern. Des Skript soit auf koan Foi ois "Start und gut is" gsehn wern, sondern eher ois Sammlung klaner Snippets, de ma vielleicht amoi brauchn kunnt. Beachts: Des Skript is für CentOS 7 gschriebn. Vül Spaß, ihr Zniachtln!

1. Update / Upgrade / Clean YUM

sudo yum -y clean all
sudo yum -y upgrade
sudo yum -y update

2. Install essentials

yum -y install nano
yum -y install zip
yum -y install unzip
yum -y install wget

3. Set Nano as default Editor

echo "export EDITOR=nano" >> ~/.bashrc
source ~/.bash_profile

4. Disable Remote Password Login

sudo nano /etc/ssh/sshd_config

Set PasswordAuthentication to „no"

sudo service sshd restart

5. Open HTTPS und HTTP Port

sudo firewall-cmd --add-service=http
sudo firewall-cmd --add-service=https
sudo firewall-cmd --runtime-to-permanent
sudo firewall-cmd --reload

6. Generate SSH Key for current user

ssh-keygen -t rsa -b 4096

7. Install Apache

sudo yum -y install httpd
sudo systemctl start httpd
sudo systemctl enable httpd

8. Enable .htaccess

In /etc/httpd/conf/httpd.conf set

AllowOverride in Directory /var/www to All

9. Activate Virtual Hosts

mkdir /var/www/domain.de
sudo chown -R apache:apache /var/www
sudo chmod -R 774 /var/www

10. Add conf-File for each domain in /etc/httpd/conf.d/

ServerName "www.DOMAIN.de"
ServerAlias "DOMAIN.de"
DocumentRoot "/var/www/DOMAIN.de/"

11. Enable SSL

sudo yum -y install epel-release
sudo yum -y install httpd mod_ssl python-certbot-apache
sudo systemctl start httpd
sudo certbot --apache -d DOMAIN.de -d www.DOMAIN.de

12. Increase Security

In /etc/httpd/conf.d/ssl.conf comment

SSLProtocol all -SSLv2
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA

Out

13. Enable Auto Renew

sudo crontab -e

insert

30 2 * * * /usr/bin/certbot renew >> /var/log/ssl-renew.log

14. Check everything

sudo apachectl configtest
sudo systemctl restart httpd

15. Install PHP

yum -y install epel-release yum-utils
yum -y install http://rpms.remirepo.net/enterprise/remi-release-7.rpm
yum-config-manager --enable remi-php72
yum -y install php php-common php-opcache php-mcrypt php-cli php-gd php-curl php-mysql
sudo apachectl restart

16. Install MySQL

sudo yum -y localinstall https://dev.mysql.com/get/mysql80-community-release-el7-2.noarch.rpm
sudo yum -y install mysql-community-server
sudo systemctl enable mysqld
sudo systemctl start mysqld
sudo systemctl status mysqld

17. Secure SQL

sudo grep 'temporary password' /var/log/mysqld.log
sudo mysql_secure_installation

18. Connect without password on local

cat <<EOT >> /etc/my.cnf
[client]
user=root
password=PASSWORD
EOT

19. Create User and grant admin

mysql -uroot -p

run

CREATE USER 'USERNAME'@'%' IDENTIFIED BY 'PASSWORD';
GRANT ALL PRIVILEGES ON *.* TO 'USERNAME'@'%' WITH GRANT OPTION;
ALTER USER 'david' IDENTIFIED WITH mysql_native_password BY 'PASSWORD';

20. Add sftp access for created user

adduser USERNAME
passwd USERNAME
adduser sftp-USERNAME
passwd sftp-USERNAME
groupadd sftpuser
sudo usermod -aG sftpuser sftp-USERNAME
chmod 774 -R /var/www/
chown -R USERNAME 770 /var/www/

cat <<EOT >> /etc/ssh/sshd_config
Match User sftpuser
    X11Forwarding no
    AllowTcpForwarding no
    PermitTTY no
    ForceCommand cvs server
    PermitRootLogin yes
EOT

cp -r /root/.ssh /home/USERNAME/
cp -r /root/.ssh /home/sftp-USERNAME/
chown -R USERNAME:USERNAME /home/USERNAME/
chown -R sftp-USERNAME:sftp-USERNAME /home/sftp-USERNAME/