multiverse<\/span> repositories are enabled. It should look like this:<\/p>\nnano \/etc\/apt\/sources.list<\/p>\n
## deb cdrom:[Ubuntu-Server 18.04 LTS _Bionic Beaver_ - Release amd64 (20180425.1)]\/ bionic main restricted<\/p>
#deb cdrom:[Ubuntu-Server 18.04 LTS _Bionic Beaver_ - Release amd64 (20180425.1)]\/ bionic main restricted<\/p>
# See http:\/\/help.ubuntu.com\/community\/UpgradeNotes for how to upgrade to
## Major bug fix updates produced after the final release of the
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
## N.B. software from this repository may not have been tested as
## Uncomment the following two lines to add software from Canonical's
deb http:\/\/security.ubuntu.com\/ubuntu bionic-security main restricted
Then run:<\/p>\n
apt-get update<\/p>\n
To update the apt package database and then:<\/p>\n
apt-get upgrade<\/p>\n
to install the latest updates (if there are any). If you see that a new kernel gets installed as part of the updates, you should reboot the system afterward:<\/p>\n
reboot<\/p>\n
3. Change the Default Shell<\/h2>\n \/bin\/sh<\/span> is a symlink to \/bin\/dash<\/span>, however we need \/bin\/bash<\/span>, not \/bin\/dash<\/span>. Therefore we do this:<\/p>\ndpkg-reconfigure dash<\/p>\n
Use dash as the default system shell (\/bin\/sh)?<\/span> <– No<\/span><\/p>\nIf you don’t do this, the ISPConfig installation will fail.<\/p>\n
4. Disable AppArmor<\/h2>\n AppArmor is a security extension (similar to SELinux) that should provide extended security. We will cross check if it is installed and remove it if necessary. In my opinion you don’t need it to configure a secure system, and it usually causes more problems than advantages (think of it after you have done a week of trouble-shooting because some service wasn’t working as expected, and then you find out that everything was ok, only AppArmor was causing the problem). Therefore, I disable it (this is a must if you want to install ISPConfig later on).<\/p>\n
We can disable it like this:<\/p>\n
service apparmor stop
5. Synchronize the System Clock<\/h2>\n It is a good idea to synchronize the system clock with an NTP (n<\/strong>etwork t<\/strong>ime p<\/strong>rotocol) server over the Internet. Simply run<\/p>\napt-get -y install ntp ntpdate<\/p>\n
and your system time will always be in sync.<\/p>\n
6. Install Postfix, Dovecot, MariaDB, phpMyAdmin, rkhunter, Binutils<\/h2>\n For installing postfix, we need to ensure that sendmail is not installed and running. To stop and remove sendmail run this command:<\/p>\n
service sendmail stop; update-rc.d -f sendmail remove<\/p>\n
The error message:<\/p>\n
Failed to stop sendmail.service: Unit sendmail.service not loaded.<\/p>\n
Is ok, it just means that sendmail was not installed, so there was nothing to be removed.<\/p>\n
We can install Postfix, Dovecot, MariaDB (as MySQL replacement), rkhunter, and binutils with a single command:<\/p>\n
apt-get -y install postfix postfix-mysql postfix-doc mariadb-client mariadb-server openssl getmail4 rkhunter binutils dovecot-imapd dovecot-pop3d dovecot-mysql dovecot-sieve dovecot-lmtpd\u00a0sudo<\/span><\/p>\nMariaDB is a fork of the MySQL database server, developed by the original MySQL developer Monty Widenius. According to tests found on the internet, MariaDB is faster than MySQL and it’s development is going on with more pace, therefore, most Linux Distributions replaced MySQL with MariaDB as default “MySQL alike” database server. In case that you prefer MySQL over MariaDB, replace “mariadb-client mariadb-server” in the above command with “mysql-client mysql-server”.<\/p>\n
You will be asked the following questions:<\/p>\n
General type of mail configuration: <– Internet Site<\/span><–\u00a0server1.example.com<\/span><\/p>\nNext open the TLS\/SSL and submission ports in Postfix:<\/p>\n
nano \/etc\/postfix\/master.cf<\/p>\n
Uncomment the submission<\/span> and smtps<\/span> sections as follows – add the line -o smtpd_client_restrictions=permit_sasl_authenticated,reject<\/span> to both sections and leave everything thereafter commented:<\/p>\n[...]
\nsubmission inet n - - - - smtpd
-o syslog_name=postfix\/submission
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject<\/strong><\/span>
\n# -o smtpd_reject_unlisted_recipient=no
\n# -o smtpd_client_restrictions=$mua_client_restrictions
\n# -o smtpd_helo_restrictions=$mua_helo_restrictions
\n# -o smtpd_sender_restrictions=$mua_sender_restrictions
\n# -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
\n# -o milter_macro_daemon_name=ORIGINATING
\nsmtps inet n - - - - smtpd
-o syslog_name=postfix\/smtps
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject<\/strong><\/span>
\n# -o smtpd_reject_unlisted_recipient=no
\n# -o smtpd_client_restrictions=$mua_client_restrictions
\n# -o smtpd_helo_restrictions=$mua_helo_restrictions
\n# -o smtpd_sender_restrictions=$mua_sender_restrictions
\n# -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
\n# -o milter_macro_daemon_name=ORIGINATING
\n[...]<\/pre>\nNOTE:<\/strong>\u00a0<\/span>The whitespaces in front of the “-o …. ” lines are important!<\/span><\/p>\nRestart Postfix afterward:<\/p>\n
service postfix restart<\/p>\n
We want MariaDB\/MySQL to listen on all interfaces, not just localhost. Therefore we edit \/etc\/mysql\/mariadb.conf.d\/50-server.cnf (for MariaDB or<\/span>\u00a0\/etc\/mysql\/my.cnf<\/span>\u00a0(for MySQL) and comment out the line bind-address = 127.0.0.1<\/span>:<\/p>\nMariaDB<\/strong><\/p>\nnano\u00a0\/etc\/mysql\/mariadb.conf.d\/50-server.cnf<\/span><\/p>\n[...]
\n# Instead of skip-networking the default is now to listen only on
\n# localhost which is more compatible and is not less secure.
\n#<\/span><\/strong>bind-address = 127.0.0.1
\n[...]<\/pre>\nNow we set a root password in MariaDB. Run:<\/p>\n
mysql_secure_installation<\/p>\n
You will be asked these questions:<\/p>\n
Enter current password for root (enter for none): <– press enter<\/span><– y<\/span><– Enter the new MariaDB root password here<\/span><– Repeat the password<\/span><– y<\/span><– y<\/span><– y<\/span><\/p>\nSet the password authentication method in MariaDB to native so we can use PHPMyAdmin later to connect as root user:<\/p>\n
echo “update mysql.user set plugin = ‘mysql_native_password’ where user=’root’;” | mysql -u root<\/p>\n
Edit the file\u00a0\/etc\/mysql\/debian.cnf and set the MYSQL \/ MariaDB root password there twice in the rows that start with password.<\/p>\n
nano \/etc\/mysql\/debian.cnf<\/p>\n
The MySQL root password that needs to be added is shown in read, in this example the password is “howtoforge”.<\/p>\n
# Automatically generated for Debian scripts. DO NOT TOUCH!howtoforge<\/span>\u00a0<\/span>howtoforge<\/span>Then we restart MariaDB:<\/p>\n
service mysql restart<\/p>\n
The systemd service name for MariaDB and MySQL is “<\/span>mysql“, so the restart command is the same for both database servers.<\/span><\/p>\nMySQL<\/strong><\/p>\nnano \/etc\/mysql\/my.cnf<\/p>\n
[...]
\n# Instead of skip-networking the default is now to listen only on
\n# localhost which is more compatible and is not less secure.
\n#<\/span><\/strong>bind-address = 127.0.0.1
\n[...]<\/pre>\nThen we restart MySQL:<\/p>\n
service mysql restart<\/p>\n
The systemd service name for MariaDB and MySQL is “mysql”, so the restart command is the same for both database servers.<\/p>\n
For MySQL and MariaDB:<\/strong><\/p>\nNow check that networking is enabled. Run:<\/p>\n
netstat -tap | grep mysql<\/p>\n
The output should look like this:<\/p>\n
[email\u00a0protected]<\/a>:~# netstat -tap | grep mysql7. Install Amavisd-new, SpamAssassin, And ClamAV<\/h2>\n To install amavisd-new, SpamAssassin, and ClamAV, we run<\/p>\n
apt-get -y install amavisd-new spamassassin clamav clamav-daemon unzip bzip2 arj nomarch lzop cabextract apt-listchanges libnet-ldap-perl libauthen-sasl-perl clamav-docs daemon libio-string-perl libio-socket-ssl-perl libnet-ident-perl zip libnet-dns-perl postgrey<\/span><\/p>\nThe ISPConfig 3 setup uses amavisd-new which loads the SpamAssassin filter library internally, so we can stop SpamAssassin to free up RAM:<\/p>\n
service spamassassin stop
\u00a0To update the ClamAV antivirus signatures and start\u00a0the Clamd service. The update process can take some time, don’t interrupt it.<\/p>\n
freshclam<\/span>service clamav-daemon start<\/span><\/p>\nThe following error can be ignored on the first run of freshclam.<\/p>\n
ERROR: \/var\/log\/clamav\/freshclam.log is locked by another process
The amavisd-new program has currently a bug in Ubuntu 18.04 which prevents that emails\u00a0get signed with Dkim correctly. Run the following commands to patch amavisd-new.<\/p>\n
cd \/tmp
In case you get an error for thelast ‘patch’ command, then Ubuntu has probably fixed the issue in the meantime, so it should be safe to ignore that error then.<\/p>\n
7.1 Install Metronome XMPP Server (optional)<\/h2>\n The Metronome XMPP Server provides an XMPP chat server. This step is optional, if you do not need a chat server, then you can skip this step. No other ISPConfig functions depend on this software.<\/p>\n
Install the following packages with apt.<\/p>\n
apt-get -y install git lua5.1 liblua5.1-0-dev lua-filesystem\u00a0libidn11-dev libssl-dev lua-zlib lua-expat lua-event lua-bitop lua-socket lua-sec luarocks\u00a0luarocks<\/p>\n
luarocks install lpc<\/p>\n
Add a shell user for Metronome.<\/p>\n
adduser –no-create-home –disabled-login –gecos ‘Metronome’ metronome<\/p>\n
Download Metronome to the \/opt directory and compile it.<\/p>\n
cd \/opt; git clone https:\/\/github.com\/maranda\/metronome.git metronome
Metronome has now be installed to \/opt\/metronome.<\/p>\n <\/nav>\n\n
Share this page:<\/b><\/p>\n
\nThis tutorial shows the steps to install an Ubuntu 18.04 (Bionic Beaver) server with Nginx, PHP, MariaDB, Postfix, pure-ftpd, BIND, Dovecot and ISPConfig 3.1. ISPConfig is a web hosting control panel that allows you to configure the installed services through a web browser. This setup provides a full hosting server with web, email (inc. spam …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[],"class_list":["post-5552","post","type-post","status-publish","format-standard","hentry","category-36"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/5552","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=5552"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/5552\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=5552"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=5552"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=5552"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}