Page History

...

1. Request Server Ops setup the standard system user configuration on this system.

...

1. This will include groups and system users for logs, www, and db.

...

...

1. Download the following software from the ISDA software repository onto the system being configured:

   Code Block
   httpd-2.2.4.tar.gz php-5.2.3.tar.gz MySQL/MySQL-*community-5.0.45-0.rhel4.i386.rpm MySQL/my.cnf mod_authz_mitgroup/mod_authz_mitgroup_rhel4.c

...

1. Remove previous version of MySQL and install current version

   Code Block
   rpm -ev cyrus-sasl-sql-2.1.19-5.EL4.i386 rpm -ev dovecot-0.99.11-4.EL4.i386 rpm -ev mysql-4.1.20-1.RHEL4.1.i386 rpm -ev mysqlclient10-3.23.58-4.RHEL4.1.i386 rpm -ivh MySQL-client-community-5.0.45-0.rhel4.i386.rpm rpm -ivh MySQL-test-community-5.0.45-0.rhel4.i386.rpm rpm -ivh MySQL-devel-community-5.0.45-0.rhel4.i386.rpm rpm -ivh MySQL-server-community-5.0.45-0.rhel4.i386.rpm

...

1. Stop the MySQL server and reconfigure my.cnf.

...

1. The MySQL server startups as part of the rpm install process.

   Code Block
   /etc/init.d/mysql stop mv /var/lib/mysql /home/db chown -R db:db /home/db cd /etc/ cp /root/my.cnf . /etc/init.d/mysql start

...

1. • Be certain to use the my.cnf file from the ISDA software repository, as it sets the database user to be 'db' (and not the default 'mysql'), and put the home and data

...

1. • directories into /home/db.

...

1. Install OpenSSL and setup certificates.

   Code Block
   mkdir /home/www/tmp cd /home/www/tmp tar -xzvf /root/openssl-0.9.8a.tar.gz cd openssl-0.9.8a ./config --prefix=/home/www/ssl --openssldir=/home/www/ssl make make install

...

1. Setup certificates

   ...

   1. 1. get the mitca at http://ca.mit.edu/mitClient.crt and save it as /usr/local/ssl/certs/mitClient.crt

   ...

   1. 1. convert mitCA.crt to pem format:

         Code Block
         openssl x509 -in /home/www/ssl/certs/mitClient.crt -inform DER -outform PEM -out /home/www/ssl/certs/mitCA.pem

   ...

   1. 1. Generate rsa key.  This simply generates some random stuff:

         Code Block
         ps > /tmp/foo ps -elf >> /tmp/foo cd /home/www/ssl/bin ./openssl genrsa -rand /tmp/foo 1024 >/home/www/ssl/private/`hostname`-key.pem

   ...

   1. 1. Generate request for a certificatecd /home/www/ssl/bin

         Code Block
         ./openssl req -key /home/www/ssl/private/`hostname`-key.pem -new \ >../certs/`hostname`-req.pem

         send the file /usr/local/ssl/certs/`hostname`-req.pem to mitcert@mit.edu,

   ...

   1. 1. • Please be aware, the organization (O) is

   ...

   1. 1. • Massachusetts Institute of Technology

   ...

   1. 1. • and the common name (CN) is the name of the server or

   ...

   1. 1. • service, including the domain name (.mit.edu).  Also, some servers, such

   ...

   1. 1. • as Thalia servers, can represent an entire subdomain.  These servers

   ...

   1. 1. • will need certificates issued with a wildcard in the domain name, such

   ...

   1. 1. • as *.isda-thalia-1.mit.edu.

   ...

   1. 1. • Wiki Markup

   ...

   1. 1. • Remember, if the server is a Thalia server, if will need a wildcard

   ...

   1. 1. • certificate and DNS record for \*.\[hostname\], and if it is doing any type of

   ...

   1. 1. • authentication, it will need a joint client/server certificate to be able

   ...

   1. 1. • to connect to the Shibboleth server (and have end users connect to it as

   ...

   1. 1. • well).

   ...

   1. 1. To generate a self signed temporary certificate, add the x509 and

   ...

   1. 1. nodes options to the openssl command line.

         Code Block
         cd /home/www/ssl/bin

   ...

   1. 1. ./openssl req \-key /home/www/ssl/private/`hostname`-key.pem \-new \

   ...

   1. 1. \-x509 \-nodes >../certs/`hostname`-temp.cert

   ...

   1. 1. When you receive a certificate from MIT Certificates, save it as

   ...

   1. 1. /home/www/ssl/certs/`hostname`-cert.pem

   ...

   1. 1. • to look at a request:

           Code Block
           openssl req \-in ./req.pem \-text

   ...

   1. 1. • to look at the private key:

           Code Block
           openssl rsa \-in /home/www/ssl/private/`hostname`-key.pem \-text

   ...

   1. 1. • ##*; to look at the server certificate:

           Code Block
           openssl x509 \-in /home/www/ssl/certs/`hostname`-cert.pem \-text

   ...

   1. Install Apache

      Code Block
      cd /home/www/tmp tar -xzvf /root/httpd-2.2.4.tar.gz cd httpd-2.2.4 ./configure --prefix=/home/www/apache-2.2.4 --enable-ssl \ --with-ssl=/home/www/ssl \ --enable-modules="most mod_rewrite" --enable-so make make install ln -s /home/www/apache-2.2.4 /home/www/apache

   ...

   1. Set up PHP
      1. If this is a RHEL 4 system, build it for source to get ver 5.

         Code Block

         cd /home/www/tmp tar -xzvf /root/php-5.2.3.tar.gz cd php-5.2.3 ./configure --with-mysql --with-kerberos=/usr/kerberos --prefix=/home/www/php-5.2.0 --with-apxs2=/home/www/apache-2.2.4/bin/apxs \ --enable-fastcgi --enable-magic-quotes --with-openssl --with-mysql-sock=/home/db/mysql/mysql.sock --with-mysqli --enable-sockets --enable-soap \ --with-openssl-dir=/home/www/ssl --with-pear=/usr/share/pear make make install ln -s php-5.2.0 php

   ...

   1. 1. If this is a RHEL 5 system, install from RPMs

         Code Block

   • Configure Apache