User Tools

Site Tools


linux:ispconfig

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
linux:ispconfig [2022/11/14 13:00]
Jan Forman [AWS Ports]
linux:ispconfig [2022/11/16 11:05] (current)
Jan Forman
Line 1: Line 1:
 +====== ISPConfig ======
 +<code>
 +aws ec2 run-instances \
 +  --instance-type t4g.small \
 +  --image-id ami-0e15cd9cd8e225753 \
 +  --security-groups MySecurityGroup \
 +  --key-name My-key-pair
 +  --credit-specification "CpuCredits=standard"
 +</code>
 +===== AWS Ports =====
 +TCP
 +<code>21,22,25,53,80,110,143,443,465,587,993,995,4190,8080,8081,40110:40210</code>
 +UDP
 +<code>53</code>
 +
 +===== PolyChaCha Cipher =====
 +/usr/local/ispconfig/server/conf-custom/nginx_vhost.conf.master
 +<code>
 +ssl_ciphers !aNULL:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256;
 +</code>
 +
 +===== ARM Graviton Install =====
 +Enable swap
 +<code>
 +sudo /bin/dd if=/dev/zero of=/swap.1 bs=1M count=1024
 +sudo chmod 600 /swap.1
 +sudo /sbin/mkswap /swap.1
 +sudo /sbin/swapon /swap.1
 +</code>
 +/etc/fstab
 +<code>
 +/swap.1   swap    swap    defaults        0   0
 +</code>
 +
 +<code>
 +su sudo
 +echo "172.0.1.1 hostname.domainname hostname" >>/etc/hosts
 +echo "hostname" >/etc/hostname
 +sudo apt update && sudo apt upgrade
 +sudo apt install linux-modules-extra-aws -y
 +</code>
 +and reboot!
 +
 +<file sh install.sh>
 +#!/bin/bash
 +# make sure locales are set
 +sudo sed -i '/^#.* en_US.UTF-8* /s/^#//' /etc/locale.gen
 +sudo locale-gen
 +sudo apt update -y
 +sudo apt install php-fpm ssl-cert curl gnupg software-properties-common rsync pigz php-net-idna2 php7.4-gmp php8.1-gmp -y
 +
 +mkdir /tmp/ispconfig
 +cd /tmp/ispconfig
 +sudo wget -O /tmp/ispconfig/ispconfig.tar.gz https://www.ispconfig.org/downloads/ispconfig-ai.tar.gz
 +sudo tar xvfz /tmp/ispconfig/ispconfig.tar.gz -C /tmp/ispconfig
 +
 +sed -i.bak -e '24d' /tmp/ispconfig/lib/os/class.ISPConfigUbuntu2004OS.inc.php #no repositories
 +sed -i.bak -e '141d' /tmp/ispconfig/lib/os/class.ISPConfigDebianOS.inc.php #no rar package on ARM
 +php "ispconfig.ai.php" --use-nginx --use-php=7.4,8.1 --use-ftp-ports=40110-40210 --lang=en --no-ntp
 +--no-mailman
 +systemctl stop clamav-daemon
 +systemctl disable clamav-daemon
 +systemctl stop clamav-freshclam
 +systemctl disable clamav-freshclam
 +sudo sed -i 's/^\(After\s*=\s*\).*$/\1network-online.target/' /usr/lib/systemd/system/nginx.service
 +
 +sudo chown root:ispapps /etc/roundcube/debian-db.php
 +sudo chmod 640 /etc/roundcube/debian-db.php
 +sudo chown root:ispapps /etc/roundcube/config.inc.php
 +sudo chmod 640 /etc/roundcube/config.inc.php
 +sudo chown -R ispapps:adm /var/log/roundcube
 +sudo chmod -R 750 /var/log/roundcube
 +sudo chown -R ispapps:ispapps /var/lib/roundcube/temp
 +sudo chmod -R 750 /var/lib/roundcube/temp
 +</file>
 +
 +Replace SH with BASH (select NO)\\
 +<code>dpkg-reconfigure dash</code>
 +
 +==== Clamav OOM ====
 +<code>
 +ReadTimeout 10
 +MaxThreads 3
 +ConcurrentDatabaseReload no
 +</code>
 +
 +==== Nexcloud inside ISPConfig with NGINX ====
 +php.ini
 +<code>
 +opcache.enable=1
 +opcache.enable_cli=1
 +opcache.memory_consumption=128
 +opcache.interned_strings_buffer=8
 +opcache.max_accelerated_files=10000
 +opcache.revalidate_freq=60
 +opcache.validate_timestamps = 0
 +opcache.save_comments=1
 +memory_limit = 512M
 +post_max_size = 300M
 +upload_max_filesize = 200M
 +clear_env = no
 +</code>
 +
 +in config.php
 +<code>
 +'htaccess.RewriteBase' => '/',
 +'htaccess.IgnoreFrontController' => true,
 +</code>
 +
 +
 +=== nginx upload ===
 +copy /usr/local/ispconfig/server/conf/nginx_vhost.conf.master to conf-custom and change
 +<code>
 +-location ~ /\. { deny all
 ++location ~ /\.(?!file).* { deny all
 +</code>
 +
 +<code>
 +add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
 +add_header X-Content-Type-Options nosniff;
 +    add_header X-Frame-Options "SAMEORIGIN";
 +    add_header X-XSS-Protection "1; mode=block";
 +    add_header X-Robots-Tag none;
 +    add_header X-Download-Options noopen;
 +    add_header X-Permitted-Cross-Domain-Policies none;
 +        location = /robots.txt {
 +        allow all;
 +        log_not_found off;
 +        access_log off;
 +    }
 +location ~ \.php$ {
 +            try_files /b615814d8f2c19dbcb25b1fbae07ce38.htm @php2;
 +        }
 +    # The following 2 rules are only needed for the user_webfinger app.
 +    # Uncomment it if you're planning to use this app.
 +    #rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
 +    #rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
 +    location = /.well-known/carddav {
 +        return 301 $scheme://$host/remote.php/dav;
 +    }
 +    location = /.well-known/caldav {
 +        return 301 $scheme://$host/remote.php/dav;
 +    }
 +    location /.well-known/acme-challenge { }
 +    # set max upload size
 +    client_max_body_size 20G;
 +    fastcgi_buffers 64 4K;
 +    # Disable gzip to avoid the removal of the ETag header
 +    gzip off;
 +    # Uncomment if your server is build with the ngx_pagespeed module
 +    # This module is currently not supported.
 +    # pagespeed off;
 +    error_page 403 /core/templates/403.php;
 +    error_page 404 /core/templates/404.php;
 +    location / {
 +        rewrite ^ /index.php$uri;
 +    }
 +    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)/ {
 +        return 404;
 +    }
 +    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) {
 +        return 404;
 +    }
 +    location ~ ^(.+?\.php)(/.*)?$ {
 +                        try_files $1 =404;
 +                        include fastcgi_params;
 +                        fastcgi_param SCRIPT_FILENAME $document_root$1;
 +                        fastcgi_param PATH_INFO $2;
 +                        fastcgi_param HTTPS $https;
 +                        {FASTCGIPASS}
 +                        fastcgi_intercept_errors on;
 +                        fastcgi_index index.php;
 +                        fastcgi_buffers 64 64K;
 +                        fastcgi_buffer_size 256k;
 +                        fastcgi_param modHeadersAvailable true;
 +                        fastcgi_read_timeout 7200; 
 +        }
 +    location @php2 {
 +                        fastcgi_split_path_info ^((?U).+\.php)(/?.+)$;
 +                        include fastcgi_params;
 +                        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 +                        fastcgi_param PATH_INFO $fastcgi_path_info;
 +                        fastcgi_param HTTPS $https;
 +                        {FASTCGIPASS}
 +                        fastcgi_intercept_errors on;
 +                        fastcgi_index index.php;
 +                        fastcgi_buffers 64 64K;
 +                        fastcgi_buffer_size 256k;
 +                        fastcgi_param modHeadersAvailable true;
 +                        fastcgi_read_timeout 7200; 
 +        }
 +    location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|core/templates/40[34])\.php(?:$|/) {
 +        fastcgi_split_path_info ^(.+\.php)(/.*)$;
 +        include fastcgi_params;
 +        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 +        fastcgi_param PATH_INFO $fastcgi_path_info;
 +        fastcgi_param HTTPS on;
 +        fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
 +        fastcgi_param front_controller_active true;
 +        #fastcgi_pass php-handler;
 +#fastcgi_pass unix:/var/run/hhvm/hhvm.sock;
 +    {FASTCGIPASS}
 +        fastcgi_intercept_errors on;
 +        fastcgi_request_buffering off;
 +    }
 +    location ~ ^/(?:updater|ocs-provider)(?:$|/) {
 +        try_files $uri/ =404;
 +        index index.php;
 +    }
 +    # Adding the cache control header for js and css files
 +    # Make sure it is BELOW the PHP block
 +    location ~* \.(?:css|js)$ {
 +        try_files $uri /index.php$uri$is_args$args;
 +        add_header Cache-Control "public, max-age=7200";
 +        # Add headers to serve security related headers (It is intended to have those duplicated to the ones above)
 +        # Before enabling Strict-Transport-Security headers please read into this topic first.
 +        # add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
 +        add_header X-Content-Type-Options nosniff;
 +        add_header X-Frame-Options "SAMEORIGIN";
 +        add_header X-XSS-Protection "1; mode=block";
 +        add_header X-Robots-Tag none;
 +        add_header X-Download-Options noopen;
 +        add_header X-Permitted-Cross-Domain-Policies none;
 +        # Optional: Don't log access to assets
 +        access_log off;
 +    }
 +    location ~* \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg)$ {
 +        try_files $uri /index.php$uri$is_args$args;
 +        # Optional: Don't log access to other assets
 +        access_log off;
 +    }
 +location = /data/htaccesstest.txt {
 +  allow all;
 +  log_not_found off;
 +  access_log off;
 +}
 +</code>
 +
 +=== Dokuwiki ===
 +
 +<code>
 +location ~ /(conf/|bin/|inc/|vendor/|install.php) { deny all; }
 +location ~ ^/data/ { internal ; }
 +location ~ ^/lib.*\.(js|css|gif|png|ico|jpg|jpeg)$ { expires 365d; }
 +
 +index doku.php;
 +location / { try_files $uri $uri/ @dokuwiki; }
 +
 +location @dokuwiki {
 +        rewrite ^/_media/(.*) /lib/exe/fetch.php?media=$1 last;
 +        rewrite ^/_detail/(.*) /lib/exe/detail.php?media=$1 last;
 +        rewrite ^/_export/([^/]+)/(.*) /doku.php?do=export_$1&id=$2 last;
 +        rewrite ^/(.*) /doku.php?id=$1&$args last;
 +}
 +
 +location ~ \.php$ {
 + fastcgi_split_path_info ^(.+\.php)(/.*)$;
 + fastcgi_param HTTPS on;
 + include fastcgi_params;
 + {FASTCGIPASS}
 + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 + fastcgi_param REDIRECT_STATUS 200;
 +}
 +</code>
 +
 +
 +==== Postfix on Amazon EC2 ====
 +[[https://docs.aws.amazon.com/ses/latest/dg/postfix.html]]
 +[[https://support.console.aws.amazon.com/support/contacts#/rdns-limits]]
 +
 +==== online Resize FS ====
 +
 +<code>sudo resize2fs /dev/nvme1n1</code>
 +
 +==FTP config==
 +echo "YOUR_EXTERNAL_IP_ADDR" > /etc/pure-ftpd/conf/ForcePassiveIP
 +
 +==== Logo ====
 +
 +<code>dbispconfig.sys_ini.custom_logo</code>
 +<code>echo "data:image/png;base64,`base64 < path/to/your/custom_logo.png | tr -d '\n'`"​</code>
  
linux/ispconfig.txt · Last modified: 2022/11/16 11:05 by Jan Forman