CentOS - Server essentials

reH CentOS server chu' install poQ (vay' Qagh qaS pagh clean new system jIH neH). DaH jIH Hurgh: reinstallation tasks same reH Qu'. process nom vIneH vaj script vIghItlh (annoying tasks jIH vaD Qu'). vay' help laH. script "start 'ej Dun" pagh - small snippets collection (vay' poH lo'laH). legh: script CentOS 7 vaD ghItlh. yItlhIch!

1. Update / Upgrade / Clean YUM

sudo yum -y clean all
sudo yum -y upgrade
sudo yum -y update

2. Install essentials

yum -y install nano
yum -y install zip
yum -y install unzip
yum -y install wget

3. Set Nano as default Editor

echo "export EDITOR=nano" >> ~/.bashrc
source ~/.bash_profile

4. Disable Remote Password Login

sudo nano /etc/ssh/sshd_config

Set PasswordAuthentication to "no"

sudo service sshd restart

5. Open HTTPS und HTTP Port

sudo firewall-cmd --add-service=http
sudo firewall-cmd --add-service=https
sudo firewall-cmd --runtime-to-permanent
sudo firewall-cmd --reload

6. Generate SSH Key for current user

ssh-keygen -t rsa -b 4096

7. Install Apache

sudo yum -y install httpd
sudo systemctl start httpd
sudo systemctl enable httpd

8. Enable .htaccess

In /etc/httpd/conf/httpd.conf set

AllowOverride in Directory /var/www to All

9. Activate Virtual Hosts

mkdir /var/www/domain.de
sudo chown -R apache:apache /var/www
sudo chmod -R 774 /var/www

10. Add conf-File for each domain in /etc/httpd/conf.d/

ServerName "www.DOMAIN.de"
ServerAlias "DOMAIN.de"
DocumentRoot "/var/www/DOMAIN.de/"

11. Enable SSL

sudo yum -y install epel-release
sudo yum -y install httpd mod_ssl python-certbot-apache
sudo systemctl start httpd
sudo certbot --apache -d DOMAIN.de -d www.DOMAIN.de

12. Increase Security

In /etc/httpd/conf.d/ssl.conf comment

SSLProtocol all -SSLv2
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!SEED:!IDEA

Out

13. Enable Auto Renew

sudo crontab -e

insert

30 2 * * * /usr/bin/certbot renew >> /var/log/ssl-renew.log

14. Check everything

sudo apachectl configtest
sudo systemctl restart httpd

15. Install PHP

yum -y install epel-release yum-utils
yum -y install http://rpms.remirepo.net/enterprise/remi-release-7.rpm
yum-config-manager --enable remi-php72
yum -y install php php-common php-opcache php-mcrypt php-cli php-gd php-curl php-mysql
sudo apachectl restart

16. Install MySQL

sudo yum -y localinstall https://dev.mysql.com/get/mysql80-community-release-el7-2.noarch.rpm
sudo yum -y install mysql-community-server
sudo systemctl enable mysqld
sudo systemctl start mysqld
sudo systemctl status mysqld

17. Secure SQL

sudo grep 'temporary password' /var/log/mysqld.log
sudo mysql_secure_installation

18. Connect without password on local

cat <<EOT >> /etc/my.cnf
[client]
user=root
password=PASSWORD
EOT

19. Create User and grant admin

mysql -uroot -p

run

CREATE USER 'USERNAME'@'%' IDENTIFIED BY 'PASSWORD';
GRANT ALL PRIVILEGES ON *.* TO 'USERNAME'@'%' WITH GRANT OPTION;
ALTER USER 'david' IDENTIFIED WITH mysql_native_password BY 'PASSWORD';

20. Add sftp access for created user

adduser USERNAME
passwd USERNAME
adduser sftp-USERNAME
passwd sftp-USERNAME
groupadd sftpuser
sudo usermod -aG sftpuser sftp-USERNAME
chmod 774 -R /var/www/
chown -R USERNAME 770 /var/www/

cat <<EOT >> /etc/ssh/sshd_config
Match User sftpuser
    X11Forwarding no
    AllowTcpForwarding no
    PermitTTY no
    ForceCommand cvs server
    PermitRootLogin yes
EOT

cp -r /root/.ssh /home/USERNAME/
cp -r /root/.ssh /home/sftp-USERNAME/
chown -R USERNAME:USERNAME /home/USERNAME/
chown -R sftp-USERNAME:sftp-USERNAME /home/sftp-USERNAME/