The Perfect Server - Debian Wheezy (Apache2, BIND, Dovecot, ISPConfig 3) - Page 3

Want to support HowtoForge? Become a subscriber!
 
Submitted by falko (Contact Author) (Forums) on Tue, 2013-05-07 12:47. ::

4 Install The SSH Server (Optional)

If you did not install the OpenSSH server during the system installation, you can do it now:

apt-get install ssh openssh-server

From now on you can use an SSH client such as PuTTY and connect from your workstation to your Debian Wheezy server and follow the remaining steps from this tutorial.

 

5 Install vim-nox (Optional)

I'll use vi as my text editor in this tutorial. The default vi program has some strange behaviour on Debian and Ubuntu; to fix this, we install vim-nox:

apt-get install vim-nox

(You don't have to do this if you use a different text editor such as joe or nano.)

 

6 Configure The Network

Because the Debian Wheezy installer has configured our system to get its network settings via DHCP, we have to change that now because a server should have a static IP address. Edit /etc/network/interfaces and adjust it to your needs (in this example setup I will use the IP address 192.168.0.100) (please note that I replace allow-hotplug eth0 with auto eth0; otherwise restarting the network doesn't work, and we'd have to reboot the whole system):

vi /etc/network/interfaces

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
#allow-hotplug eth0
#iface eth0 inet dhcp
auto eth0
iface eth0 inet static
        address 192.168.0.100
        netmask 255.255.255.0
        network 192.168.0.0
        broadcast 192.168.0.255
        gateway 192.168.0.1

Then restart your network:

/etc/init.d/networking restart

Then edit /etc/hosts. Make it look like this:

vi /etc/hosts

127.0.0.1       localhost.localdomain   localhost
192.168.0.100   server1.example.com     server1

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Now run

echo server1.example.com > /etc/hostname
/etc/init.d/hostname.sh start

Afterwards, run

hostname
hostname -f

It is important that both show server1.example.com now!

 

7 Update Your Debian Installation

First make sure that your /etc/apt/sources.list contains the wheezy-updates repository (this makes sure you always get the newest updates for the ClamAV virus scanner - this project publishes releases very often, and sometimes old versions stop working), and that the contrib and non-free repositories are enabled (some packages such as libapache2-mod-fastcgi are not in the main repository).

vi /etc/apt/sources.list

deb http://ftp.de.debian.org/debian/ wheezy main contrib non-free
deb-src http://ftp.de.debian.org/debian/ wheezy main contrib non-free

deb http://security.debian.org/ wheezy/updates main contrib non-free
deb-src http://security.debian.org/ wheezy/updates main contrib non-free

# wheezy-updates, previously known as 'volatile'
deb http://ftp.de.debian.org/debian/ wheezy-updates main contrib non-free
deb-src http://ftp.de.debian.org/debian/ wheezy-updates main contrib non-free

Run

apt-get update

to update the apt package database and

apt-get upgrade

to install the latest updates (if there are any).

 

8 Change The Default Shell

/bin/sh is a symlink to /bin/dash, however we need /bin/bash, not /bin/dash. Therefore we do this:

dpkg-reconfigure dash

Use dash as the default system shell (/bin/sh)? <-- No

If you don't do this, the ISPConfig installation will fail.

 

9 Synchronize the System Clock

It is a good idea to synchronize the system clock with an NTP (network time protocol) server over the Internet. Simply run

apt-get install ntp ntpdate

and your system time will always be in sync.

 

10 Install Postfix, Dovecot, MySQL, phpMyAdmin, rkhunter, binutils

We can install Postfix, Dovecot, MySQL, rkhunter, and binutils with a single command:

apt-get install postfix postfix-mysql postfix-doc mysql-client mysql-server openssl getmail4 rkhunter binutils dovecot-imapd dovecot-pop3d dovecot-mysql dovecot-sieve sudo

You will be asked the following questions:

General type of mail configuration: <-- Internet Site
System mail name: <-- server1.example.com
New password for the MySQL "root" user: <-- yourrootsqlpassword
Repeat password for the MySQL "root" user: <-- yourrootsqlpassword

Next open the TLS/SSL and submission ports in Postfix:

vi /etc/postfix/master.cf

Uncomment the submission and smtps sections as follows (leave -o milter_macro_daemon_name=ORIGINATING as we don't need it):

[...]
submission inet n       -       -       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
smtps     inet  n       -       -       -       -       smtpd
  -o syslog_name=postfix/smtps
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
#  -o milter_macro_daemon_name=ORIGINATING
[...]

Restart Postfix afterwards:

/etc/init.d/postfix restart

We want MySQL to listen on all interfaces, not just localhost, therefore we edit /etc/mysql/my.cnf and comment out the line bind-address = 127.0.0.1:

vi /etc/mysql/my.cnf

[...]
# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
#bind-address           = 127.0.0.1
[...]

Then we restart MySQL:

/etc/init.d/mysql restart

Now check that networking is enabled. Run

netstat -tap | grep mysql

The output should look like this:

root@server1:~# netstat -tap | grep mysql
tcp        0      0 *:mysql                 *:*                     LISTEN      26757/mysqld
root@server1:~#

 

11 Install Amavisd-new, SpamAssassin, And Clamav

To install amavisd-new, SpamAssassin, and ClamAV, we run

apt-get install amavisd-new spamassassin clamav clamav-daemon zoo unzip bzip2 arj nomarch lzop cabextract apt-listchanges libnet-ldap-perl libauthen-sasl-perl clamav-docs daemon libio-string-perl libio-socket-ssl-perl libnet-ident-perl zip libnet-dns-perl

The ISPConfig 3 setup uses amavisd which loads the SpamAssassin filter library internally, so we can stop SpamAssassin to free up some RAM:

/etc/init.d/spamassassin stop
update-rc.d -f spamassassin remove


Please do not use the comment function to ask for help! If you need help, please use our forum.
Comments will be published after administrator approval.
Submitted by anhlqn (registered user) on Sat, 2014-02-01 23:01.
System mail name: <-- server1.example.com
 should be:
System mail name: <-- example.com
because postfix as for FQDN of the system, not server name. 
 
 
Submitted by admin (registered user) on Sun, 2014-02-02 14:35.
The tutorial is correct. You have to enter server1.example.com here. If you would use example.com , then the mail System will fail later as you cant use example.com  for mailboxes in ispconfig as all mailboxes are virtual postfix domains and a domain in postfix may not be lisetd as virtual domain and system domain.
Submitted by anhlqn (registered user) on Sat, 2014-01-25 03:39.
On fresh installation of Debian Wheezy 7.3, we need to comment out the DVD source in source.list, or we will get this message:
 
root@debian:/tmp# apt-get install ntp ntpdate
Reading package lists... Done
[...]
Do you want to continue [Y/n]? y
Media change: please insert the disc labeled
 'Debian GNU/Linux 7.3.0 _Wheezy_ - Official amd64 DVD Binary-1 20131215-04:56'
in the drive '/media/cdrom/' and press enter
Submitted by Quaxth (registered user) on Tue, 2014-01-07 13:52.

In Debian 7.3 Wheezy the sources.list is set by default:
 
deb http://ftp.th.debian.org/debian/ wheezy main non-free contrib
deb-src http://ftp.th.debian.org/debian/ wheezy main non-free contrib

deb http://security.debian.org/ wheezy/updates main contrib non-free
deb-src http://security.debian.org/ wheezy/updates main contrib non-free

# wheezy-updates, previously known as 'volatile'
deb http://ftp.th.debian.org/debian/ wheezy-updates main contrib non-free
deb-src http://ftp.th.debian.org/debian/ wheezy-updates main contrib non-free

 

 

Submitted by Gandalf4711 (not registered) on Wed, 2013-12-04 22:55.

If you may encounter problems in Debian 7 at mySQL restart like:

/usr/bin/mysql: Unknown OS character set 'ISO-8859-15'.
/usr/bin/mysql: Switching to the default character set 'latin1'.

you probably configured your locales with @Euro ....

Fill in the following in the /etc/mysql/debian.cnf file, in the client part:

 default-character-set=latin1

Then restart mysql....

Submitted by SamTzu (registered user) on Mon, 2013-12-30 13:25.

Hey Gandalf. You missed installation of char-sets before you installed mysql.

Try this...

dpkg-reconfigure locales
locale-gen
export LC_ALL=en_US.UTF-8
update-locale LC_ALL="en_US.UTF-8"

Submitted by Quaxth (registered user) on Wed, 2013-09-25 08:59.
PuTTY could be used after the Network Interfaces are set correctly and the Network were restarted. It wasn't work for me as suggested after point 4 were completed.
Submitted by Thomas CARTER (not registered) on Sun, 2013-09-01 15:21.

I had :
Clamav signatures not found in /var/lib/clamav ... failed!
Please retrieve them using freshclam ... failed!
Then run '/etc/init.d/clamav-daemon start' ... failed!

I ran freshclam and /etc/init.d/clamav-daemon start as suggested and it worked. 

Submitted by The redbaron (not registered) on Wed, 2013-12-04 02:55.

You have to run in first this command line:

freshclam

then check the log in /var/log/clamav/freshclam.log

 If it's work. you can run clamav without error in launching this command:

/etc/init.d/clamav-daemon start

That's all

 

Submitted by insink71 (not registered) on Wed, 2013-07-10 15:33.

As of 7.1 (Debian Wheezy), dependency based boot is used by default; so for example in step 11 of your tutorial, in lieu of:

update-rc.d -f spamassassin remove

you would use:

insserv -rf spamassasin

otherwise you get a lil message:

update-rc.d: using dependency based boot sequencing

and the init.rc isn't updated.

 

Rob

Submitted by Jan (not registered) on Tue, 2013-07-16 15:58.

There is a typo the correct command is:


insserv -rf spamassassin


(one s is missing in OP)

Submitted by suther (registered user) on Thu, 2013-05-23 17:49.

I do everything excatly like described here in the tutorial. I was not able to send Mails. After some hours of searching, I found the solution:  

In Debian 7 /etc/postfix/main.cf has this entry by default:

inet_interfaces = loopback-only

change this, with

inet_interfaces = all

Restart postfix, and you're able to send Mails.

Submitted by Anonymous (not registered) on Sat, 2013-11-09 06:41.

I can confirm this!

Clean install of Debian 7.0.

Then apt-get update &&  apt-get upgrade && apt-get dist-upgrade

 Then following The Perfect Server - Debian Wheezy (Apache2, BIND, Dovecot, ISPConfig 3)

Results in  inet_interfaces = loopback-only in /etc/postfix/main.cf, which prohibits all incoming emails and causes hours of troubleshooting.

This guide needs to be updated.

Submitted by cypherbsd (registered user) on Mon, 2013-10-21 17:24.

Mannnnnyyyyy THX suther,

 that was also my problem.... 

Submitted by Jan (not registered) on Tue, 2013-07-16 15:52.
I just installed a Debian 7.1 server (16.7.2013) and this is not needed anymore - it's fixed in an update.

Thanks to the OP though.