Revision as of 09:39, 28 May 2018

Deploying a Web Server

Dependencies - Launch Cloud Instance

Before deploying a web server, first a cloud instance must be lauched. The instruction to do this can be found here. For the remainder of the instructions the ip address used is 199.241.164.95, this is for demonstration purposes and you should replace it with your assigned floating IP address.

1. login to cloud.sharcnet.ca
2. Don’t forget volume size
3. Choose Debian 9.2.2 (not required, but the remaining instructions are Debian centric).
4. Choose persistent (ephemeral is for shorter jobs) (4C-8GB)
5. Setup keypair
6. Associate floating ip

(Optional) Apply IP Address to your name server

If you have a registered domain name you should apply your floating IP address to it so that you can use the "let's encrypt" service to enable the secure socket layer without client side warnings. It is often best to do this at the beginning as there is typically a delay in updating the name service.

Server Setup

Login to Server & perform preliminaries

At this point log into the server to ensure that the service is up and running. There are a number of steps you can perform that will make the remaining steps easier. First loging to the server. Then setup a user prompt to make navigation easier. Switch to root (or use sudo in from of the remaining commands). Update and upgrade the system. Last install the manual pages.

   $ ssh debian@199.241.164.95
   $ echo 'export PS1="\[\e[33m\]\w\[\e[0m\]\n\[\e[32m\]\u@\h$ \[\e[0m\]"' >> .bash_aliases
   $ sudo su root
   $ apt update
   $ apt upgrade
   $ apt install man

Apt error

If you receive the "apt error" mesage put "nameserver 8.8.8.8" in /etc/resolve.conf.

   $ echo 'nameserver 8.8.8.8 >>' /etc/resolve.conf

Secure the SSH login

The following changes will disable logging into the server by using a password on any account and prevent logging into root remotly. Root can still be accessed by logging into a sudo enabled account and using the command su root. For more information on the sshd_config file options, go here. The unattended-upgrades package is used to keep they server up to date automatically.

   $ sudo vim /etc/ssh/sshd_config
   ChallengeResponseAuthentication no
   PasswordAuthentication no
   PermitRootLogin no
   $ service ssh reload
   $ apt install unattended-upgrades
   $ dpkg-reconfigure --priority=low unattended-upgrades
   $ sudo unattended-upgrade -d

Install webserver and suppporting packages

MYSQL

   $ apt install mysql-server
   $ mysql_secure_installation #password=password

Apache

Installing the Apache webserver will allow you to access a default page at your ip address. (ex http://199.241.164.95, or http://frar.ca). Note that https will not yet work.

   $ apt install apache2
   $ service apache2 start #add 80, 443 to default security group rules
   $ a2enmod cgid.load #(optional) enable cgi scripting, a2dismod to remove