Bienvenido! - Willkommen! - Welcome!

Bitácora Técnica de Tux&Cía., Santa Cruz de la Sierra, BO
Bitácora Central: Tux&Cía.
Bitácora de Información Avanzada: Tux&Cía.-Información
May the source be with you!
Showing posts with label LAMP. Show all posts
Showing posts with label LAMP. Show all posts

Thursday, November 25, 2010

Apache, PHP and MySQL on Linux

OpenSUSE: Part 1
  1. MySQL 5 Installation
    1. Prerequisites
    2. Download the Source
    3. Unpack, Copy, Configure
    4. Create my.cnf File
    5. Additional Settings
    6. Start Server, Check It, Connect
    7. Set the Root Password
    8. Restart MySQL Server
    9. Automatic Startup
  2. Apache 2 Installation
  3. PHP 5 Installation
MySQL 5.0 installation
Since Apache and MySQL servers must be installed prior to the PHP installation, I recommend installing the triad in this order: MySQL, Apache, PHP. You may well have some MySQL server already installed – in that case you can skip directly to the Apache 2 installation. However, it’s a good idea to reinstall everything, in order to have the most recent versions of the software.
There are several options for how to install MySQL:
  • using YaST – the easiest and fastest way. However, the version of MySQL bundled with SuSE installation is usually NOT the best (i.e. the most recent) available,
  • RPM installation – supposedly also fast and simple, I’ve never tried though. The only drawback here is that MySQL is not installed into a single destination – it’s scattered across several directories. I like to keep things tidy, so I skipped this option,
  • installing binaries – downloading precompiled files from the mysql.com website, copying them into a directory of your choice, and doing some simple configuration. I tried this, but it didn’t work for me – for some reason the MySQL server wouldn’t start,
  • installing from source – I would recommend this. Yes, it takes some time and effort, but you will get the most recent MySQL installed in a single location on your system, and everything will be configured according to your needs.
The rest of this chapter deals with the 4th option – the installation of MySQL from the source.
Prerequisites
Make sure you have superuser (root) privileges and user “mysql” already exists in your system. If not, create one:
1groupadd mysql
2useradd -g mysql mysql
This will be the default user under which the MySQL server will be running.

Download the source
First, download the MySQL source . You need the mysql-5.1.52-linux-i686-glibc23.tar.gz tarball file (or mysql-5.1.52-linux-x86_64-glibc23.tar.gz for 64-bit systems).

Unpack, configure, compile
So you have downloaded the mysql-5.1.52-linux-i686-glibc23.tar.gz file. You know the drill: unpack, configure, make, make install:.
1tar -xzf mysql-5.1.52-linux-i686-glibc23.tar.gz
2cd mysql-5.1.52-linux-i686-glibc23/
3./configure  --prefix=/usr/local/mysql-5.1.52 --with-charset=utf8  --with-collation=utf8_general_ci
4make
5make install
We used the –with-charset and –with-collation options to set the default character set and collation – otherwise it would have been the default Swedish collation.
I recommend creating a symbolic link called “mysql” pointing to the MySQL installation directory, in order to make referring to it from elsewhere easier:
1ln -s /usr/local/mysql-5.1.52/ /usr/local/mysql
This way we can always refer to MySQL installation directory as /usr/local/mysql . The obvious advantage is that if you install PHP with the –with-mysql=/usr/local/mysql option (see PHP 5 Installation Guide), it won’t stop working if the name of the MySQL installation directory changes in the future (if you upgrade your MySQL for instance).
Create my.cnf file
To complete MySQL server installation, you have to create a configuration file. It offers several security and control options (here you can limit system resources to be used by MySQL server, set the default collation and character set etc.). You need not to create a brand new configuration file – there are 4 pre-made files in the support-files/ directory. Read the information in those files to determine which one to use. For small servers (e.g. testing servers, or servers of a limited performance), my-small.cnf file is the best option. Copy the file of your choice to /etc/my.cnf:
1cp support-files/my-small.cnf /etc/my.cnf
2chown root /etc/my.cnf
3chgrp root /etc/my.cnf
4chmod 644 /etc/my.cnf
We have made sure both the owner and user group of the my.cnf file are “root” and the access privileges are properly set. Finally edit the file:
1vi /etc/my.cnf
Search for [mysqld] clause, and add immediately below it:
1user = mysql
We have specified that MySQL service is to be run with user “mysql” privileges.
If you want to use InnoDB databases (what you probably will), uncomment (and perhaps edit) all innodb options in the my.cnf file. Save all changes ( :wq).
Additional settings
For proper functioning, MySQL needs a “mysql” database. To create this database, simply run:
1/usr/local/mysql/bin/mysql_install_db --user=mysql
The script will create /usr/local/mysql/var/ directory containing the necessary databases. This directory serves as a default storage for all databases you will create. Make sure it is writable by “mysql” system user!
Start server, check it, connect
Now you are ready to start your MySQL server for the first time.
1/usr/local/mysql/bin/mysqld_safe --user=mysql &
Hit enter again to get your prompt back. The MySQL server should now be running. To check that server is running and works properly enter
1/usr/local/mysql/bin/mysqladmin version
You should get some response about the server software version.
Connect to MySQL server:
1/usr/local/mysql/bin/mysql -u root
If you get a welcome message and the prompt changes to mysql>, the server works and everything is fine. If this failed for any reason, it may indicate some problems with your installation/configuration.
Set the root password
Now, before you do anything else, set root user’s password (!). Stay connected to MySQL and enter:
1DELETE FROM mysql.user WHERE User = '';
2FLUSH PRIVILEGES;
3SELECT  Host, User FROM mysql.user;
Look for the record that has root in the User column and something other than localhost in the Host column. This is the host_name.
1SET  PASSWORD FOR 'root'@'localhost' = PASSWORD('new_password');
2SET  PASSWORD FOR 'root'@'host_name' =  PASSWORD('new_password');
Remember, this is the MySQL superuser for all databases. Therefore you should use a strong password and keep it safe. Later, when you will be writing PHP scripts, do NOT use superuser for accessing databases! The “root” user is meant only for administration purposes. After you are finished, exit MySQL:
1quit
Restart MySQL server
After everything is set up, restart MySQL server:
1/usr/local/mysql/bin/mysqladmin -u root -p shutdown
2/usr/local/mysql/bin/mysqld_safe --user=mysql &
Voila, your MySQL server is up and running!
Automatic startup
Set up an automatic startup so you don’t need to start MySQL server manually after each system reboot. Go back to the directory where you extracted the downloaded mysql tarball file. Enter
1cp support-files/mysql.server /etc/init.d/mysql
2chmod 755 /etc/init.d/mysql
3chkconfig --add mysql
4chkconfig --level 35 mysql on
Further readingMySQL Reference Manual

Saturday, July 3, 2010

LAMP server with IPtables

Source
configured a lamp server whit iptables.
And wish to have a redirection from external port 1977 to internal port 80.
(actualy they are both external, there is only one nic)
So far I have setup two input rules,
Accept If protocol is TCP and destination port is 80
Accept If protocol is TCP and destination port is 1977
Two NAT rules,
Prerouting
Redirect If protocol is TCP and destination port is 1977
Output
Redirect If protocol is TCP and destination port is 1977
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1977 -j ACCEPT
-A PREROUTING -p tcp -m tcp --dport 1977 -j REDIRECT --to-ports 80
-A OUTPUT -p tcp -m tcp --dport 1977 -j REDIRECT --to-ports 80
Now i can connect to http://mijipadres:80 and :1977
BUT i want :80 to be closed for the outside world so that only http://mijipadres:1977 works.
Solutions
-A INPUT -p tcp -i eth0 --dport 80 -j DROP
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
The drop drops any communication to port 80, and the redirection fails on port 1977
--------------------------------------
Add a --source 10.1.1.1/10.1.1255 to your port 80 accept rule to only accept traffic from your LAN (substituting whatever the real LAN range is of course).
If you're doing this via a bash script i'd suggest adding it as a variable just to make the script maintenance easier.
--------------------------------------
Add a --source 10.1.1.1/10.1.1255 to your port 80 accept rule to only accept traffic from your LAN (substituting whatever the real LAN range is of course).
If you're doing this via a bash script i'd suggest adding it as a variable just to make the script maintenance easier.
No lan there, its a LAMP server one IP only.
--------------------------------------
cat /etc/sysconfig/iptables
# Generated by iptables-save v1.3.5 on Tue Sep 25 04:43:56 2007
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -p tcp -m tcp ! -i lo --dport 1977 -j REDIRECT --to-ports 80
-A OUTPUT -p tcp -m tcp --dport 1977 -j REDIRECT --to-ports 80
COMMIT
# Completed on Tue Sep 25 04:43:56 2007
# Generated by iptables-save v1.3.5 on Tue Sep 25 04:43:56 2007
*mangle
:PREROUTING ACCEPT [11:1218]
:INPUT ACCEPT [11:1218]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [10:3813]
:POSTROUTING ACCEPT [11:3845]
COMMIT
# Completed on Tue Sep 25 04:43:56 2007
# Generated by iptables-save v1.3.5 on Tue Sep 25 04:43:56 2007
*filter
:FORWARD ACCEPT [0:0]
:INPUT DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT
# Accept traffic with the ACK flag set
-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT
# Allow incoming data that is part of a connection we established
-A INPUT -m state --state ESTABLISHED -j ACCEPT
# Allow data that is related to existing connections
-A INPUT -m state --state RELATED -j ACCEPT
# Accept responses to DNS queries
-A INPUT -p udp -m udp --dport 1024:65535 --sport 53 -j DROP
# Accept responses to our pings
-A INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT
# Accept notifications of unreachable hosts
-A INPUT -p icmp -m icmp --icmp-type destination-unreachable -j ACCEPT
# Accept notifications to reduce sending speed
-A INPUT -p icmp -m icmp --icmp-type source-quench -j ACCEPT
# Accept notifications of lost packets
-A INPUT -p icmp -m icmp --icmp-type time-exceeded -j ACCEPT
# Accept notifications of protocol problems
-A INPUT -p icmp -m icmp --icmp-type parameter-problem -j ACCEPT
# Allow connections to our SSH server
-A INPUT -p tcp -i eth0 --dport 80 -j DROP
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 1977 -j ACCEPT
COMMIT