PDA

View Full Version : Home Based Server HOWTO (0.8 beta edition)


fos
10-29-2006, 09:57 PM
Home Based Internet Server---

Please note: This is a beta 0.8 version. Please report any errors in content or gramar. I will be proofing and improving it as well. fos....

Do you seek fame and fortune? I'm sure you have heard the ads, start your home based business and earn as much as $300,000 per year! The answer is a dot com internet business! Answering those ads could cost you thousands of dollars, but only for the gullible.

Would you like to have a web presence? There are free sites available, with banner ads and spam included. You could also use your ISP. If you really want a personal web page such as: yourspecialname, you will have to pay a host provider for the service. You can find space for as little as $5 per month. A quality service is more likely $10 per month.

There is an alternative. A home based internet server. It is not as hard as you think. The requirements are small: an old PC, a DSL line or cable internet, and a router / switch.

Follow along and I'll tell you how I set mine up. For me it was intended to be an educational exercise. It has turned out to be very functional, reliable, secure, and a lot of fun.

Disclaimer: Be sure to read the Terms of Service you agreed to when you purchased your internet service. This use of their service may violate its terms. Many providers block the incomming ports used by servers. While there are work arounds, you may find yourself disconnected. I only use mine for educational purposes. I don't use it for a commercial use nor do I actively promote it. Caveat emptor...

Now for the details:

Hardware---

A throw away 2000 vintage Dell OptiPlex GX1, Pentium II 450 Mhz, 256 MB ram, ATI Mach64 video card, a 30 GB Maxtor HD, a 6 GB Maxtor HD, and a cdrom reader. This was a used PC given to me for parts. The installed Win98 would no longer boot due to hard drive errors. I re-partitioned and formatted the hard drives while installing Debian and everything ran again without problems.

A Linksys WRT54G wireless 4 port router/switch purchased at Walmart for $50.

The cable modem was supplied by the cable internet provider.

I salvaged an old APC Powercell UPS, installed a new $12.95 gel cell battery at the hardware store to backup the modem and router. When the modem loses power, it obtains a new dynamic IP address upon startup. (More on the dynamic IP addresses later.) The router must also be re-initialized after the modem stabilizes making power outages problematic. That's why the UPS is for the modem and router and not the server. I'll probably get another for the server sometime in the future.

That's it for the hardware - a pretty modest investment.

Software---

For a server you want a robust, stable, mature, and for me, an open source operating system. Debian, Redhat, Suse, and Slackware came immediately to mind. I am most familiar with Debian. I actually installed a Debian server first but then looked at other systems just make sure it was optimal. Slackware (actuall Soft Landing System) was my first Linux system back in the mid-ninties. I swithced to Slack after Mark Williams hence Coherent went out of business. I have also used RH and Suse in their various versions. I tried CentOS based on the indirect endorsement of CentOS by danieldk on the linuxagora.com forum. As in all things related to computing you can rely on his advice.

I settled on CentOS 4.3 (now 4.4) due to its implementation of a software firewall, SELinux, and logging system. It has proven to be quite secure when combined with a few security mods made after installation. The internet is a jungle filled with individuals scanning every available server site looking for weaknesses. I'm sure most of them are just kids flexing the techno savvy but a hazard none the less. You will inevitably have a multitude of attacks as soon as you make your server available to the internet. Once installed, you can check /var/log/messages to see what I mean.

My software support requirements include: apache, mysql, postgresql, php, ssh, ftp, gcc, vim, emacs, & mc (a norton commander clone). Everything except mc were included during the initial install. I added mc with the yum package manager included with CentOS. Other than these items, you want the minimum installation to optimize speed and security.

For the installation media, you will need either CentOS 4.4 cdrom disks 1 through 3 or the DVD version.

CentOS 4.4 installation: (Step by Step)---

1. After inserting the installation media, press <enter> at the boot prompt.

2. Test CD media or Skip. Your preference. Select OK.

3. CentOS Welcome Screen & Release Notes Select <next>

4. Language Selection: <English> <Next>

5. Keyboard <US English> <Next>

6. Installation Type: Server of Custom
<Custom> <Next>

I chose custom. The pre-configured selection added too much software including X Window support which is unnessary in a server. Think minimal for security reasons.

7. Partitioning: Automatic of Manual (Disk Druid)
<Auto> <Next>

I chose automatic for easy installation of this experimental server. For a working serever, partitioning should be considered carefully for backup and security reasons.

8. Partitioning - Continued:
A. Remove all linux partitions
B. Remove all partitions
C. Keep all - Use free space

<Remove All> <Check review> <Next>

I chose all since this is going to be a dedicated server.

9. Are you sure? (Review before committing.)
<Yes> <Next>

10. Display partitioning: Back or Next
<Next>

11. Grub boot loader default?
<Next>

12. Network Device (Select appropriate)
For my system: eth0 DHCP

Host name:
Automatically via DHCP - (probably best selection)

Manually - I chose manual since I wanted a specific server name.

13. Firewall:
No firewall
Enable firewall (I chose enable to maximize security.)

Remote login ssh
Web server
File server
Mail server

I selected all options for my server. The mail is necessary. Logging informations is mailed locally to the root user for security reasong.

Enable SELinux:
Disabled
Warn
Active

I chose Active for the highest security profile. <Next>

14. Default Language:
English USA <Next>

15. Timezone:
USA Central (choose appropriate)

16. Root password:

Pick something random with letters, numbers, & punction characters. A must for security.
<Next>

17. Package Selection:

This is not critical as long as you include the packages necessary for the services you wish to provide. Keep it minimal. If you aren't going to use it, don't install it. If it turns out you need it, you can always install it later.

Note: you can select individual items in a category by selecting details. I am only going to mention the selections I have made. You can choose the packages that would be useful for your installation. Remember, unnecessare packages can lead to security vulnerabilities. You can always add something you need after the initial installation.

While there are gui based server administration packages, the command line tools and editing the ascii based configuration files are a better option. The X window environment and the Gnome and Kde packages consume a lot of space and service resources. I did not select them.

Editors: I use VIM and Emacs. Choose your favorites.

Server configuration tools: system-config-httpd, system-config-NFS

Web Server: Everything would be appropriate.

Mail Server: Sendmail

Windows File Server: Samba if you need to support WinX machines on your network.

I chose not to install the DNS server: www.zoneedit.com (http://www.zoneedit.com) is excellent for my purposes and free for up to five zones. (More later)

FTP Server - Everything

PostgreSQL Database: I chose everything except PL procedural language and tcl tool command language.

Mysql - everything

Development Tools: Not needed but choose desired packages. I installed gcc and g++ afer installation.

18. About to install: <Next>

19. Need Disks 1, 2, & 3 <Continue>

Installing: Approximately 30 minutes - ymmv

20. Remove installation media

<Reboot>

Your new server should now be running.

After installation details (Fine tuning)---

Your first task should be to set up a non-root user with useradd.

It would also be good to do an update with yum to insure that all installed packages are the most recent with the latest security patches. You can do this with the following command: yum update

You should verify the services that you require are running with a ps -A command.

Individual services can be started and stopped from within the /etc/init.d directory while logged in a su from your normal user account.
For example: ./mysqld start <Enter>

It is important to modify the sshd configuration file /etc/ssh/sshd_config while logged in as su from your user account:

Modify the lines after: # Authentication
LoginGraceTime 2m
PermitRootLogin no
StrictModes yes
MaxAuthTries 6

The most important is PermitRootLogin no
Your server will be subjected to numerous brute force breakin attacks on a daily basis. You want to minimize the possiblity that they can achieve root status. The above configuration is only a start.

After the above sshd_config file has been modified, restart the sshd server from the /etc/init.d directory with the command ./sshd restart

The next thing that needs to be configured is the /etc/rc.d/rc3.d directory. The rc3.d directory is the one that determines which services are started at boot time for a terminal (command line) based system. The rc5.d directory will determine the services that start at boot time if you selected an X Window based system. Notice that there are a number of files that start with either a K or an S. The ones that are prefixed with an S startup at boot time. The ones that start with a K must be started manually if you need them. For example, I didn't want the cups printer server running since I don't have a printer connected to the server so I changed S55cups to K55cups to disable the cups server at startup. The two numbers after the S or K determines the services startup priority in the startup sequence.

I had to enable httpd, mysqld, and postgresql on my system by changing the prefix from a K to an S.

At this point you should have an operational server. The apache web server (httpd) should be running with php, mysql, and postgresql support. You can use the command lynx localhost to check your server operation. It should show a default Apache information page. "lynx" is a text based web browser that I like to use. If you don't have it installed you can install it with the command: yum install lynx

The default web page directory is: /var/www/html You will see the default Apache startup page until you place an index.html or index.php file in the home web page directory. To test your systems php operation, place a file named index.php that contains the following line: <?php phpinfo(); ?> When you view this "page" with a browser, you should see a lot of information verifying you php installation.

Linksys Router Configuration---

At this point, I assume that you have some type of broadband connection to the internet already configured. In my area we have two services available, one cable based and the other a DSL line from the phone company. Neither of them support Linux knowingly. I have found that Linux runs fine whatever service you have you just won't get any support from the ISP. I have found it easiest to set it up with a Windows box. After that it is usually picked up automatically at startup on the linux system.

I have a Linksys Model WRT54G wireless router/switch that I purchased at Walmart for about $50. Most routers will be configured in a similar manner. I have set up a similar system with a Westell VersaLink Model 327W with equal results. In any case, you will have to follow the instructions included with your particular router.

Access to the Linksys router is provided by a web browser interface at: router control address (see manual).
You will be presented with a login and password form. Enter your login information of the default as detailed in you user manual.

Select the "Status" window: (On the far right of the menu bar for my system.)
There you will find your IP address, dynamic for most of us or a static IP address if you have purchased one with your service. This is the IP address you will need to point your domain name service to. That will enable the rest of the internet world to find you. An example of the IP address would be: 555.44.33.222

Next you will need to determine which address is assigned to your new server box in your routher. While still in the status window of your router control interface, select "Local Network" in the secondary menu bar. Then select the "DHCP Clients Table" button toward the middle of the page. You will see the various computers connected to your router. In my case the local address assigned to my "sever" is: 192.168.1.103

Now select the "Applications & Gaming" window from the primary menu bar. Then select the "DMZ" sub-menu item. Here you will select "Enable" DMZ Host IP Address 192.168.1.103 or whatever local IP address you determined in the previous step. Select save and then close your router access page.

Zoneedit.com Configuration---

I looked at a number of dynamic domain services including Zoneedit.com, Dynamic Domain Services, Inc., and TZO.com. The only one that is truly "free" using your own custom domain name is Zoneedit. The others charge a fee for something other than a name based on their service.

Note: Each of the Dynamic Domain Name services provide a wealth of information of this process. Please refer to their documentation as you are setting up the domain name service.

Once you have purchased a domain name such as XXX from a domain name vendor, register with Zoneedit.com. Each domain name is one zone. You can use as many variations
of that name as necessary and it is still one zone. For example: www (rupert.com) and rupert.com. Zoneedit will send all traffic for those domain names to your IP address.
Zoneedit offers service for up to 5 zones free. You can purchase service for additional zones at a very reasonable price. After you add your zone to zoneedit, you will be assigned two domain name servers. These are the servers that you will have to have your domain name DNS servers to at your domain service admin page. (I have used Godaddy for a number of years. I have found their fees reasonalbe and their service and reliability excellent.) Once you have set the dns servers to the ones provided by zoneedit at your domain name provider, you should go back to zoonedit and edit your zone. All you need to do is tell zoneedit which IP address to send your domain name traffic to. That will be the IP address you determined int the "status" window of your router. ie. 555.44.33.222
That's it! After all of the domain name and IP addresses have propagated through the internet system you should be able to type XXX in a browser window and go directly to your home based internet server.

The only time my service provider changes my designated IP address is when I shut down my modem and restart. I installed a UPS on the modem and router to minimize that occurrence. Whenever the address does change, you can again go to the router control web interface and get the new address from the status window. Software is available to do this automatically but I have found it to be an unnecessary additional route for Murphy to play his games. The Linksys router actually has an internal hardware based method to do this but it uses the fee based dynamic domain service vendors. Even those vendors don't suggest using that method as it is less reliable the the softare packages. The Dynamic Domain Nave vendors, such as zoneedit each reccomend software packages that will perform this service if you are interested.

QED!

I will discuss ssh shell access and sftp file transfer in another HOWTO

My next venture is a purpose built server with RAID 1 support. Stand by for the sequel.

fos....

PS. I have already had to XXX out the example domain names as it offered to send you to the actual domains that really exist. :)

autek
10-30-2006, 06:04 PM
A very interesting "how-to". Although at the present time all I need is a file server and Samba will do. This made for some very interesting reading. Thank you Jeff for sharing your knowledge on this subject.

Ed

fos
11-13-2006, 06:40 PM
Update 11/13/06

As I mentioned in another post, I tried to configure EnGarde Secure Linux 3.0.10. I was not very successful. It really doesn't want to be installed on a dynamic IP site even though it has a DHCP option (that didn't work). It only provided a set of default values that had to be manually configured anyway. I am also interested in a VPN setup. It is only available for EnGarde Pro at an extra cost plus yearly subscription fees for updates for that and EnGarde. I don't mind paying for the use of software. I do it all the time. But, EnGarde linux really isn't very open source to my way of thinking. YMMV

I re-installed CentOS 4.4. The install was smooth and flawless. Over the past month, I have carefully watched the site and added offending IP addresses that tried to invade my system to the /etc/hosts.deny file. I now get very few break in attempts. Most seem to come from a relatively small number of locations.

I was intrigued by EnGarde's remote web administration interface. It looked very much like a webmin knockoff. I went to the webmin site downloaded the latest rpm for Red Hat and installed it on my server. I then added the following line to /etc/sysconfig/iptables:

-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 10000 -j ACCEPT

This allows remote access to the webmin interface. After making any changes to iptables, you must restart iptables with the following command:

/etc/init.d/iptables restart

You must also start webmin with the following command:

/etc/init.d/webmin

At this point, I'm not sure I'm going to leave webmin running all of the time or leaving port 10000 open. It is somewhat a security risk. What I have been doing is logging into the system, starting webmin and re-configuring port 10000 just long enough to perform admin chores.

I'm not sure I'm being a little too paranoid.

Next task: Securing the webmin interface with ssh....

fos....

PS. It is amazing the services that the basic installation of webmin provides. It is very configurable and easily extended with modules as well. It is very nice software!

danieldk
11-14-2006, 03:40 AM
Jeff, some comments that may be useful:

- You can easily build VPNs with CentOS, both the GUI and vi way. In fact, when I wrote the IPsec/VPN support for Libranet I used slightly modified Red Hat scripts that bring up IPsec connections and built a configuration interface around that. Documentation about GUI-based configuration can be found here:

http://www.centos.org/docs/4/html/rhel-sag-en-4/s1-network-config-ipsec.html

Manual configuration can be found in the sections that follow:

http://www.centos.org/docs/4/html/rhel-sg-en-4/s1-vpn-ipsec.html

- It is better to block hosts at the packet filter level. It comes with less cost, and not all daemons use hosts.*. In fact, you can even block people that try to guess passwords via SSH with a simple iptables rule:


/usr/sbin/iptables -A INPUT -p tcp --dport 22 --dst x.x.x.x -i eth0 -m state --state NEW -m recent --set
/usr/sbin/iptables -A INPUT -p tcp --dport 22 --dst x.x.x.x -i eth0 -m state --state NEW -m recent --update --seconds 120 --hitcount 4 -j DROP
/usr/sbin/iptables -A INPUT -p tcp --dport 22 --dst x.x.x.x -i eth0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


Replace x.x.x.x with the IP adress where traffic comes in (and if applicable eth0 with the interface name). These rules say that if someone tries to set up a SSH connection fout times in two minutes, all further connections should be dropped. You can tinker with the 120/4 settings, though they work fine for me (most of the users for this server don't mistype their passwords four times, and if they do they should give me a call to clear the block). Some Linux versions have a bug in the "recent" module, I don't know if that still applies to RHEL4. (This particular server runs Slackware historically, though I want to replace it on the first opportunity, but it is kinda hard considering that it is a production server.)

- I would avoid using web administration interfaces like webmin. They leave open a potential hole, and are not really required if you grok configuration of your system.

- If you do want to use it, block port 10000 for all external machines through IPtables, and set up an SSH tunnel with something like:

ssh -l user -L 10001:server:10000 www.nedlinux.nl

And log on to localhost:10001 on the client, and all traffic to webmin will be tunneled and encrypted by SSH, and will be sent to port 10000 from the server host itself.

danieldk
11-14-2006, 03:47 AM
Oh, and I can really recommend the MoinMoin wiki :). Some of my server users use it for research projects to build a public website, and to exchange information in private areas. MoinMoin has some very strong points:

- Once you have the modules installed, it is very eassy to make new instances of MoinMoin, making it possible te deploy it rapidly for multiple websites.
- MoinMoin has very nice access control.
- The data is stored efficiently on the filesystem rather than a database. It makes it really easy to backup Wikis, and to make mass changes (e.g. you can just rename a bunch of pages in one go, or replace contents in a collection of pages with e.g. sed).
- MoinMoin can give good DocBook output.
- Future versions of MoinMoin will probably accept DocBook markup besides Wiki markup.
- Lot's of other stuff (Unicode pages, subpages, RSS feeds, advanced locking, etc.)

Their site is:
http://moinmoin.wikiwikiweb.de/

It is used by many major projects, like CentOS, Fedora and Ubuntu.

fos
11-14-2006, 07:26 AM
Whew!!!

Thank you for the very helpful information, especially the ssh setup for webmin. I will implement that today. I will also setup the iptable filtering as well. Using the hosts.deny file has been effective but I have to manually add each instance. Using 61.52.333. for an attacker on 61.52.333.215 will block everything from 000 up. It works but may block some legitimate users as well.

pmwiki has many of the same features as moinmoin. Some of moinmoin page designations look less like a wiki though. I will give it a try.

Thank you,

fos

fos
11-22-2006, 10:52 AM
My latest server configuration is now operational at: (PM for information)

It is operating on a Via C7 processor operating at 1.5 Ghz with 1 Gb ram, and a 80 Gb RE Western Digital HD. The measured power consumption is only 22 watts. It doesn't need a system fan. The cpu fan and power supply fan are adequate. In future implementations, I plan to use DC power directly backed up with a 3+ hour lithium ion battery.

BTW, the included support forum is based on phpBB2. :)

fos....

danieldk
11-22-2006, 12:40 PM
Hmm, add renewable energy to the mix, and it's ecohost ;).

uteck
11-23-2006, 01:59 AM
I also gave EnGuard a try, but my machine was not up to their specs of 512 MB Ram, so the installer would not load. Compaq with 450MHz cpu and 128 MB Ram.
I ended up installing the kubuntu alternate version for low memory systems. I use firestarter for the firewall which works well with ssh -X, (but eats cpu and memory so I don't leave it up so I can't watch for threats with the system tray icon), and denyhosts for monitoring the auth log for failed ssh attempts. Denyhosts scans the log file every few minutes and looks for 5 failed logins and adds the IP to hosts.deny. It also reads hosts.allow so it will not ban an IP you do not want blocked.

I installed the Wildfire jabber server and I will start work on a web site soon. Another thing you may want for a firewall server is upnp so that ports can be opened and closed by applications when they need them. (Some bittorrent apps will do this and so will some IM apps.) There are linux packages for various distros, but for Ubuntu I had to manually add the route.
route add -net 239.0.0.0 netmask 255.0.0.0 eth0 (were eth0 is your internal nic)

I know some of you are saying, you are using X forwarding on a firewall, that's inscure! But I trust in firestarter to only allow Lan clients to connect to it. I can tighten it more and only allow my IP to connect, but I am not too worried about it, the convenience outways the potential problems.

fos
11-23-2006, 07:18 AM
I downloaded Denyhosts from Sourceforge. I initially installed the rpm binary. At that point, I couldn't figure out how to configure the program for operation. After downloading the source files, I found that the files are stored in /usr/share/denyhosts....

After reading the README file everything went smoothly.

It seems to be running in the daemon mode. It has already added four IP addresses to my hosts.deny file and reported the action to my email address.

Denyhosts should save me a lot of work.

Thanks, fos....

fos
11-23-2006, 12:14 PM
SSL access for Webmin was not too difficult to setup using the method found in the documentation section of www.webmin.com.

As noted in the documentation OpenSSL was already installed in CentOS. The only download necessary is the perl module Net_SSLeay.pm.

SSL at least encrypts the data going over the internet. It still leaves open a port of entry for mischief via the root user. I suggest only running the webmin daemon when you want to use it for configuration.

fos....

uteck
11-23-2006, 04:02 PM
I was looking over the options for Denyhosts, and they added a new feature, the sync server. You can upload the IPs you have blocked into a central server, and download IPs others have blocked and add them to your hosts.deny file.
Very nice. I'm go to enable it now.

fos
11-23-2006, 04:19 PM
I saw the sync option as I was installing Denyhosts. I have it enabled.

PmWiki has the same option that uses pmwiki, moinmoin, and one of the other large wiki sites.

The more we can pass around security info, the easier it will be to block hackers.

fos....

Red*Fox
12-08-2006, 02:19 PM
Nice howTo btw,

I was wondering on how to install an web server with centos, ive got centos installed and ive tried messing with the http settings alittle but it never works. I jsut want a local http server but i can never seem to get it started.

Red*Fox
12-08-2006, 02:22 PM
Nervermind , i figured it out

fos
12-08-2006, 04:26 PM
# /etc/init.d/httpd start

Red*Fox
12-17-2006, 01:31 AM
Nice how-to ...i now am experimenting with the webserver at http://71.51.54.221/

I cant seem to make more than one page accessible to the internet except the index ...i have set the permissions to viewable to everyone but apache just blocks it. I installed the gnome enviroment i may install x-window later but im still messing around with it.

danieldk
12-17-2006, 03:47 AM
Do you have SELinux enabled? If so, make sure that web pages have the right context. E.g.:


$ ls -Z /var/www/ | grep html
drwxr-xr-x root root system_u:object_r:httpd_sys_content_t html



$ chcon -t httpd_sys_content_t /var/www/html/somefile.html


SELinux provides an extra layer of protection. Apache can only read/serve files that are within a certain context. More information can be found at:

http://www.centos.org/docs/4/html/rhel-selg-en-4/

Red*Fox
12-19-2006, 11:38 AM
Ok Thanks.:)

fos
07-02-2008, 06:50 PM
Time to fire up the old home server again....

I called Comcast to complain again about the abysmal upload speed (< 25 kbits / min). The agent suggested a commercial account. I could have one with a 6 MB download and 1 MB upload speed for $79 / month including 1 static IP address. That is pretty good if you really get close to those specs. That adds up to $31 / month more than I am currently paying.

I installed CentOS 5.2 on an old Via MB with 512 MB of memory and a 40 GB hard disk. It is ready to go with Apache, php, ssh, and mysql. I'm going to load up something like Drupal and SMF and give it a try.

Heck, it will be fun to play with and my wife will be happy with the increased upload speeds. She does a lot of media work for her classes and back and forth with her family.

fos

danieldk
07-03-2008, 05:42 AM
I called Comcast to complain again about the abysmal upload speed (< 25 kbits / min).

Do the specifications of the subscription specify an upload speed, if so, they should just provide that.

The agent suggested a commercial account. I could have one with a 6 MB download and 1 MB upload speed for $79 / month including 1 static IP address. That is pretty good if you really get close to those specs. That adds up to $31 / month more than I am currently paying.

Ouch. I am amazed what subscription fees are asked in the US (I know that there are a lot more remote rural areas). I pay ~23 Euro for 20MBit downstream, and 1MBit upstream, and have done so for three years. Although that figure isn't as pretty as it was with the current Euro-Dollar exchange rate, but that doesn't hurt us (yet).

fos
07-03-2008, 11:13 AM
// Do the specifications of the subscription specify an upload speed, if so, they should just provide that.

Comcast only states that their download speed is approximately 6 times that of dialup.... no guarantees.

I typically averaged about 600Kbits download and about half that upload when the system was owned by Time-Warner. After Comcast took over the upload speed would drop to about 25 Kbits after 30 seconds. I called and complained enough that they sent out a tech and replaced the modem. He finally got someone in their office to admit that it was throttled.

I won't experience the new speed until they send out a tech and install the new "commercial" modem in 6 to 10 business days. We will see if it is any better.

The corporate giants here in the states want to meter bandwidth like they did in the old days at the beginning of the internet. I can remember paying $6 per hour for Compuserve in the early 80s. That was 10 cents per minute in 1980 dollars!