The Perfect Server - CentOS 5.6 x86_64 [ISPConfig 3] - Page 5

15 Installing Apache2 With mod_php, mod_fcgi/PHP5, And suPHP

ISPConfig 3 allows you to use mod_php, mod_fcgi/PHP5, cgi/PHP5, and suPHP on a per website basis.

mod_fcgid is not available in the official CentOS repositories, but there's a package for CentOS 5.x in the centos.karan.org testing repository. We enable the repository as follows:

cd /etc/yum.repos.d/
wget http://centos.karan.org/kbsingh-CentOS-Extras.repo

Next we open /etc/yum.repos.d/kbsingh-CentOS-Extras.repo...

vi /etc/yum.repos.d/kbsingh-CentOS-Extras.repo

... and set gpgcheck to 0 and enabled to 1 in the [kbs-CentOS-Testing] section:

[...]
# pkgs in the -Testing repo are not gpg signed
[kbs-CentOS-Testing]
name=CentOS.Karan.Org-EL$releasever - Testing
gpgcheck=0
gpgkey=http://centos.karan.org/RPM-GPG-KEY-karan.org.txt
enabled=1
baseurl=http://centos.karan.org/el$releasever/extras/testing/$basearch/RPMS/

Afterwards we can install Apache2with mod_php5, mod_fcgid, and PHP5:

yum install php php-devel php-gd php-imap php-ldap php-mysql php-odbc php-pear php-xml php-xmlrpc php-eaccelerator php-mbstring php-mcrypt php-mhash php-mssql php-snmp php-soap php-tidy curl curl-devel perl-libwww-perl ImageMagick libxml2 libxml2-devel mod_fcgid php-cli httpd-devel

Next we open /etc/php.ini...

vi /etc/php.ini

... and change the error reporting (so that notices aren't shown any longer) and add cgi.fix_pathinfo = 1 at the end of the file:

[...]
;error_reporting  =  E_ALL
error_reporting = E_ALL & ~E_NOTICE
[...]
cgi.fix_pathinfo = 1

Next we install suPHP:

cd /tmp
wget http://suphp.org/download/suphp-0.7.1.tar.gz
tar xvfz suphp-0.7.1.tar.gz
cd suphp-0.7.1/
./configure --prefix=/usr --sysconfdir=/etc --with-apr=/usr/bin/apr-1-config --with-apxs=/usr/sbin/apxs --with-apache-user=apache --with-setid-mode=owner --with-php=/usr/bin/php-cgi --with-logfile=/var/log/httpd/suphp_log --enable-SUPHP_USE_USERGROUP=yes
make
make install

Then we add the suPHP module to our Apache configuration...

vi /etc/httpd/conf.d/suphp.conf

LoadModule suphp_module modules/mod_suphp.so

... and create the file /etc/suphp.conf as follows:

vi /etc/suphp.conf

[global]
;Path to logfile
logfile=/var/log/httpd/suphp.log
;Loglevel
loglevel=info
;User Apache is running as
webserver_user=apache
;Path all scripts have to be in
docroot=/
;Path to chroot() to before executing script
;chroot=/mychroot
; Security options
allow_file_group_writeable=true
allow_file_others_writeable=false
allow_directory_group_writeable=true
allow_directory_others_writeable=false
;Check wheter script is within DOCUMENT_ROOT
check_vhost_docroot=true
;Send minor error messages to browser
errors_to_browser=false
;PATH environment variable
env_path=/bin:/usr/bin
;Umask to set, specify in octal notation
umask=0077
; Minimum UID
min_uid=100
; Minimum GID
min_gid=100
[handlers]
;Handler for php-scripts
x-httpd-suphp="php:/usr/bin/php-cgi"
;Handler for CGI-scripts
x-suphp-cgi="execute:!self"

Finally we restart Apache:

/etc/init.d/httpd restart

 

15.1 Ruby

Starting with version 3.0.3, ISPConfig 3 has built-in support for Ruby. Instead of using CGI/FastCGI, ISPConfig depends on mod_ruby being available in the server's Apache.

For CentOS 5.6, there's no mod_ruby package available, so we must compile it ourselves. First we install some prerequisites:

yum install httpd-devel ruby ruby-devel

Next we download and install mod_ruby as follows:

cd /tmp
wget http://modruby.net/archive/mod_ruby-1.3.0.tar.gz
tar zxvf mod_ruby-1.3.0.tar.gz
cd mod_ruby-1.3.0/
./configure.rb --with-apr-includes=/usr/include/apr-1
make
make install

Finally we must add the mod_ruby module to the Apache configuration, so we create the file /etc/httpd/conf.d/ruby.conf...

vi /etc/httpd/conf.d/ruby.conf

LoadModule ruby_module modules/mod_ruby.so

... and restart Apache:

/etc/init.d/httpd restart

 

15.2 WebDAV

WebDAV should already be enabled, but to check this, open /etc/httpd/conf/httpd.conf and make sure that the following three modules are active:

vi /etc/httpd/conf/httpd.conf

[...]
LoadModule auth_digest_module modules/mod_auth_digest.so
[...]
LoadModule dav_module modules/mod_dav.so
[...]
LoadModule dav_fs_module modules/mod_dav_fs.so
[...]

If you have to modify /etc/httpd/conf/httpd.conf, don't forget to restart Apache afterwards:

/etc/init.d/httpd restart

 

16 Install PureFTPd

PureFTPd can be installed with the following command:

yum install pure-ftpd

Then create the system startup links and start PureFTPd:

chkconfig --levels 235 pure-ftpd on
/etc/init.d/pure-ftpd start

Now we configure PureFTPd to allow FTP and TLS sessions. FTP is a very insecure protocol because all passwords and all data are transferred in clear text. By using TLS, the whole communication can be encrypted, thus making FTP much more secure.

OpenSSL is needed by TLS; to install OpenSSL, we simply run:

yum install openssl

Open /etc/pure-ftpd/pure-ftpd.conf...

vi /etc/pure-ftpd/pure-ftpd.conf

If you want to allow FTP and TLS sessions, set TLS to 1:

[...]
# This option can accept three values :
# 0 : disable SSL/TLS encryption layer (default).
# 1 : accept both traditional and encrypted sessions.
# 2 : refuse connections that don't use SSL/TLS security mechanisms,
#     including anonymous sessions.
# Do _not_ uncomment this blindly. Be sure that :
# 1) Your server has been compiled with SSL/TLS support (--with-tls),
# 2) A valid certificate is in place,
# 3) Only compatible clients will log in.
TLS                      1
[...]

In order to use TLS, we must create an SSL certificate. I create it in /etc/ssl/private/, therefore I create that directory first:

mkdir -p /etc/ssl/private/

Afterwards, we can generate the SSL certificate as follows:

openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem

Country Name (2 letter code) [GB]: <-- Enter your Country Name (e.g., "DE").
State or Province Name (full name) [Berkshire]:
<-- Enter your State or Province Name.
Locality Name (eg, city) [Newbury]:
<-- Enter your City.
Organization Name (eg, company) [My Company Ltd]:
<-- Enter your Organization Name (e.g., the name of your company).
Organizational Unit Name (eg, section) []:
<-- Enter your Organizational Unit Name (e.g. "IT Department").
Common Name (eg, your name or your server's hostname) []:
<-- Enter the Fully Qualified Domain Name of the system (e.g. "server1.example.com").
Email Address []:
<-- Enter your Email Address.

Change the permissions of the SSL certificate:

chmod 600 /etc/ssl/private/pure-ftpd.pem

Finally restart PureFTPd:

/etc/init.d/pure-ftpd restart

That's it. You can now try to connect using your FTP client; however, you should configure your FTP client to use TLS.

 

17 Install A Chrooted DNS Server (BIND9)

To install a chrooted BIND9, we do this:

yum install bind-chroot

Then do this:

chmod 755 /var/named/
chmod 775 /var/named/chroot/
chmod 775 /var/named/chroot/var/
chmod 775 /var/named/chroot/var/named/
chmod 775 /var/named/chroot/var/run/
chmod 777 /var/named/chroot/var/run/named/
cd /var/named/chroot/var/named/
ln -s ../../ chroot
touch /var/named/chroot/var/named/named.local
cp /usr/share/doc/bind-9.3.6/sample/var/named/named.root /var/named/chroot/var/named/named.root
touch /var/named/chroot/etc/named.conf.local
vi /var/named/chroot/etc/named.conf

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { any; };
        directory       "/var/named/chroot/var/named";
        dump-file       "/var/named/chroot/var/named/data/cache_dump.db";
        statistics-file "/var/named/chroot/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/chroot/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
        recursion no;
        allow-recursion { none; };
};
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};
zone "." IN {
        type hint;
        file "named.root";
};
include "/var/named/chroot/var/named/named.local";

chkconfig --levels 235 named on
/etc/init.d/named start

BIND will run in a chroot jail under /var/named/chroot/var/named/. I will use ISPConfig to configure BIND (zones, etc.).

 

18 Install Vlogger And Webalizer

Vlogger and webalizer can be installed as follows:

yum install webalizer perl-DateTime-Format-HTTP perl-DateTime-Format-Builder

cd /tmp
wget http://n0rp.chemlab.org/vlogger/vlogger-1.3.tar.gz
tar xvfz vlogger-1.3.tar.gz
mv vlogger-1.3/vlogger /usr/sbin/
rm -rf vlogger*

 

19 Install Jailkit

Jailkit is needed only if you want to chroot SSH users. It can be installed as follows (important: Jailkit must be installed before ISPConfig - it cannot be installed afterwards!):

cd /tmp
wget http://olivier.sessink.nl/jailkit/jailkit-2.13.tar.gz
tar xvfz jailkit-2.13.tar.gz
cd jailkit-2.13
./configure
make
make install
cd ..
rm -rf jailkit-2.13*

 

20 Install fail2ban

This is optional but recommended, because the ISPConfig monitor tries to show the log:

yum install fail2ban

chkconfig --levels 235 fail2ban on
/etc/init.d/fail2ban start

 

21 Install rkhunter

rkhunter can be installed as follows:

yum install rkhunter

Share this page:

31 Comment(s)

Add comment

Comments

From: Anonymous at: 2011-04-24 23:41:47

http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt gives a import read failed

 it now redirects to http://apt.sw.be/RPM-GPG-KEY.dag.txt however the rpm --import doesn't seem to use the re-direct.

From: Anonymous at: 2011-05-04 11:50:42

Step 9 link is now:

rpm --import http://apt.sw.be/RPM-GPG-KEY.dag.txt

 

From: Anonymous at: 2011-05-30 07:30:17

rpm --import http://dag.wieers.com/packages/RPM-GPG-KEY.dag.txt

From: Rony Jusman at: 2011-07-29 01:35:06

rpm --import http://apt.sw.be/RPM-GPG-KEY.dag.txt

From: Anonymous at: 2011-06-09 10:07:29

I've got a problem with:

wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el5.rf.x86_64.rpm

 I tried the other link, but it seems to be a problem with wget itself. I can ping google.com without any problems, so this won't be a network error?

From: erik at: 2011-08-29 18:03:03

 hi,

 i got a problem with the code:

yum install ntp httpd mysql-server php php-mysql php-mbstring php-mcrypt phpmyadmin

 i get this message error when i do it:

 Error: php53-common conflicts with php-common

 You could try using --skip-broken to work around the problem

 You could try running: package-cleanup --problems

                        package-cleanup --dupes

                        rpm -Va --nofiles --nodigest

The program package-cleanup is found in the yum-utils package

 how can i solve this trouble?? please its very importa i can't conitnue with the installation.

From: ernie at: 2011-09-01 16:45:23

Used How-to HERE

reason being...

Because the version of php on CentOS 5.6 is 5.1.6, we only can install phpMyAdmin 2.x, I choose 2.11.11.3.
# cd /usr/share
# wget http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/2.11.11.3/phpMyAdmin-2.11.11.3-english.tar.gz/download
# tar xvfz phpMyAdmin-2.11.11.3-english.tar.gz
# mv phpMyAdmin-2.11.11.3-english phpmyadmin
# rm phpMyAdmin-2.11.11.3-english.tar.gz

From: at: 2011-12-09 05:02:18

With step 9, it will install the php 5.1.x, which is not for some new CMS like Drupal 7.x. So if you want to install php 5.3.x, use the webtatic repo at http://www.webtatic.com/packages/php53/.

After install the repo, you can complete step 9 with command

yum --enablerepo=webtatic install ntp httpd mysql-server php php-mysql php-mbstring php-mcrypt phpmyadmin

 

 

From: Marcelo Santabaia at: 2011-05-23 12:24:24

When I type the command:

vi /usr/share/phpmyadmin/config.inc.php

I receive this ERROR:


"/usr/share/phpmyadmin/config.inc.php"
"/usr/share/phpmyadmin/config.inc.php" E212: Can't open file for writing

 

Why?

From: Anonymous at: 2012-12-22 03:11:10

hi

  you must use this path

 

/etc/httpd/conf.d/config.inc.php

    e.x : nano /etc/httpd/conf.d/config.inc.php

     

From: Hetz Ben Hamo at: 2011-04-20 19:20:46

Trying to install postfix, even by enabling the centosplus repository will not help, since there is an update which is newer then whats available in centosplus.

 Workaround: go to your local centos mirror, go to the centosplus directory, to http://mirror.centos.org/centos/5.6/centosplus/x86_64/RPMS/ and download manually the file: http://mirror.centos.org/centos/5.6/centosplus/x86_64/RPMS/postfix-2.3.3-2.el5.centos.mysql_pgsql.x86_64.rpm

 Then do: yum localinstall postfix-2.3.3-2.el5.centos.mysql_pgsql.x86_64.rpm (it needs to add .. postgresql.. don't ask me why..) and then things will work.

From: at: 2011-05-23 14:35:10
From: Web Age Support at: 2011-06-07 16:43:59

started with:

dovecot-1.2.17-0_115

dovecot-sieve-0.1.18-7

Commands I entered (as root) to get dovecot-sieve working:

yum install rpm-build

yum install redhat-rpm-config

mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}

echo '%_topdir %(echo $HOME)/rpmbuild' > ~/.rpmmacros

yum install make gcc

cd /root

wget 'http://dl.atrpms.net/all/dovecot-sieve-0.1.18-7.src.rpm'

wget http://dl.atrpms.net/all/dovecot-devel-1.2.17-0_115.el5.x86_64.rpm

rpm -ivh dovecot-devel-1.2.17-0_115.el5.x86_64.rpm 

rpmbuild --rebuild dovecot-sieve-0.1.18-7.src.rpm 

cd /root/rpmbuild/RPMS/x86_64

rpm -e dovecot-sieve

rpm -ivh dovecot-sieve-0.1.18-7.x86_64.rpm 

service dovecot restart

From: Anonymous at: 2011-05-18 11:47:14

Dovecot Warning ...

At the time i wrote this, the AtRPMS repo updated the dovecot from 1.2.16 to 1.2.17 and the current dovecot-sieve package is not in sync. Either you'll need to wait to update their dovecot-sieve package or you need to recompile from sources with rpmbuild.

 regards

From: at: 2011-05-19 11:48:03

Hi, Thank you for this really nice guide! Is it possible to give us more instructions about dovecot and 1.2.16 version,
i have installed 1.2.17 and i am trying for about two days now to figure out what was wrong.

I mean how to install or downgrade the  1.16 or perhaps how to recompile the dovecote package.

 

From: Luca Tocco at: 2011-05-20 13:33:59

Dovecot 1.2.17 not work on this guide from latest update. I have installed courier instead of dovecot and ispconfig work great!

 Bye.

From: Anonymous at: 2011-04-27 03:05:20

you can install the mod_fcgid from fedora epel repository.

From: Curu at: 2011-05-01 01:01:55

also, you can install suphp from rpmfoge repo using:

yum install mod_suphp 

From: at: 2011-07-26 16:36:15

That's good cuz the howto doesn't work: ...

checking for unistd.h... (cached) yes

checking for APR... configure: error: the --with-apr parameter is incorrect. It must specify an install prefix, a

build directory, or an apr-config file.

From: at: 2011-07-27 05:37:21

[root@ispconfig3 sysconfig]# yum install bind-chroot
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: centos.maulvi.net
 * extras: centos.maulvi.net
 * rpmforge: fr2.rpmfind.net
 * updates: centos.maulvi.net
Excluding Packages from Red Hat Enterprise Linux 5 - x86_64 - ATrpms
Finished
Reducing Red Hat Enterprise Linux 5 - x86_64 - ATrpms to included packages only
Finished
Excluding Packages from Red Hat Enterprise Linux 5 - x86_64 - ATrpms testing
Finished
Reducing Red Hat Enterprise Linux 5 - x86_64 - ATrpms testing to included packages only
Finished
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package bind-chroot.x86_64 30:9.3.6-16.P1.el5 set to be updated
--> Finished Dependency Resolution

Dependencies Resolved

=================================================================================================
 Package                Arch              Version                          Repository       Size
=================================================================================================
Installing:
 bind-chroot            x86_64            30:9.3.6-16.P1.el5               base             46 k

Transaction Summary
=================================================================================================
Install       1 Package(s)
Upgrade       0 Package(s)

Total download size: 46 k
Is this ok [y/N]: y
Downloading Packages:
bind-chroot-9.3.6-16.P1.el5.x86_64.rpm                                    |  46 kB     00:01
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing     : bind-chroot                                                               1/1

Installed:
  bind-chroot.x86_64 30:9.3.6-16.P1.el5

Complete!
[root@ispconfig3 sysconfig]# chmod 755 /var/named/
[root@ispconfig3 sysconfig]# chmod 775 /var/named/chroot/
[root@ispconfig3 sysconfig]# chmod 775 /var/named/chroot/var/named/
[root@ispconfig3 sysconfig]# chmod 775 /var/named/chroot/var/run/
[root@ispconfig3 sysconfig]# chmod 777 /var/named/chroot/var/run/named/
[root@ispconfig3 sysconfig]# cd /var/named/chroot/var/named/
[root@ispconfig3 named]# ln -s ../../ chroot
[root@ispconfig3 named]# touch /var/named/chroot/var/named/named.local
[root@ispconfig3 named]# cp /usr/share/doc/bind-9.3.6/sample/var/named/named.root /var/named/chroot/var/named/named.root
[root@ispconfig3 named]# touch /var/named/chroot/etc/named.conf.local
[root@ispconfig3 named]# vi /var/named/chroot/etc/named.conf
 (named.conf edited as per the text)
[root@ispconfig3 named]# chkconfig named on
[root@ispconfig3 named]# service named start
Starting named:
Error in named configuration:
/var/named/chroot/var/named/named.local:1: unknown option '$TTL'
/var/named/chroot/var/named/named.local:3: unknown option 'Serial'
/var/named/chroot/var/named/named.local:4: unknown option 'Refresh'
/var/named/chroot/var/named/named.local:5: unknown option 'Retry'
/var/named/chroot/var/named/named.local:6: unknown option 'Expire'
/var/named/chroot/var/named/named.local:7: unknown option 'Minimum'
/etc/named.conf:30: unexpected token near end of file
                                                           [FAILED]

From: Rolf Ernst at: 2011-09-05 02:59:01

For all it's worth - I am getting the same error. I am installing under OpenVZ - not sure this is related?

From: Anonymous at: 2012-02-08 12:38:47

I have the same error. Have you solved it?

From: at: 2011-12-09 05:06:30

At step 15, if you already install webtatic repo I suggested on page 3 step 9, you don't need to enable the centos.karan.org testing repository, just simply run this command to install

yum --enablerepo=webtatic install php php-devel php-gd php-imap php-ldap php-mysql php-odbc php-pear 
php-xml php-xmlrpc php-eaccelerator php-mbstring php-mcrypt php-mhash 
php-mssql php-snmp php-soap php-tidy curl curl-devel perl-libwww-perl 
ImageMagick libxml2 libxml2-devel mod_fcgid php-cli httpd-devel
Or you can enable the repo webtatic by editing the repo file to enabled=1

From: at: 2011-12-09 05:13:03

With my Drupal 7.x site using SuPHP on ISPConfig3, with step to install suphp, I have to change the umask from

umask=0077  => change to umask=0022
Or folders created by Drupal will have wrong permission.

From: Anonymous at: 2011-05-04 10:27:54

how can you run firefox if u didnt instaled gnome or kde...?

From: Anonymous at: 2011-06-14 23:22:18

wow!

From: Anonymous at: 2011-07-07 14:56:36

Hello...

           I install my firth's the ISPConfig 3 in a CentOS 5.6 server. I follow the steps perfectly.

           And only one thing doesnt work. I cant recivied incomming mail. 

          The error is

Final-Recipient: rfc822; suport@mydomain.com.py
Original-Recipient: rfc822;suport@mydomain.com.py
Action: failed
Status: 5.1.1
Diagnostic-Code: X-Postfix; unknown user: "suport"

 

I Seek a lot of forums buy nobody resolve the problem, well, my kind of problem... 

 Thanks to all

 

CharlyKai from PARAGUAY

From: Anonymous at: 2011-07-21 09:31:34

Really?

This is the problem: Diagnostic-Code: X-Postfix; unknown user: "suport"

 Maybe, U have support, not suport user?

From: Anonymous at: 2011-07-21 09:44:00

It's a miracle! He don't install any linux window manager, and can run an MS windows program.

I hope, You will be  learning more, for example netwrorking, before starting Your sysadmin's life.

From: at: 2011-05-08 12:54:44

I'm a CentOS 5.6 version is used and the description of at least 20 in bad!

By the time I made the installation work properly there is nothing!

this is the whole thing as it is scandalous!

From: at: 2012-01-06 23:54:45

Hello I saw all tutorial step by step, at the end only ispconfig doesn't start.

 I understood that it isn't under init.d ispconfig, so I can't manually start the service.

 Please how can I do?

 thanks in advance