diff --git a/content/new_vh.rst b/content/new_vh.rst new file mode 100644 index 0000000..153e40e --- /dev/null +++ b/content/new_vh.rst @@ -0,0 +1,82 @@ +new virtual host +################ + +:date: 2019-09-09 00:00 +:modified: 2019-09-09 00:00 +:tags: infra +:category: documentation +:slug: create_vh +:authors: Ms.Leave-A-Mix +:summary: How-To install a new virtual host to the webserver + +This article will explain how to deploy a new service within your web server. +The service (framadate), is hosted on the same machine than the webserver +(nginx). You may like to create a new machine, to use the self-included +webserver of your programming language (php, python, ruby...), as the goal of +having one webserver is to save time by configuring only one monitoring system +and security system for many apps. + +------------- +The Webserver +------------- + +We use NGINX as a webserver. It is modular and aimed to be as small and +efficient as possible. Since then, it doesn't include the necessary programs to +run your scripts. You need to have another program to launch and manages your +processes. For our example, this will be php-fpm_. If you also use `Alpine +Linux`_ you can follow `this tutorial +`__. + +------ +System +------ + +I will use the commands with the default Alpine Linux tools, that are not like +Debian or Arch ones. Adapt this if you use another distro. + +I suggest that the webserver is already installed, and is working for serving +php scripts. + +We will create a new user that has access to the git repository of your program, +so you can update it's code easily, without having to re-upload at each +modification. + +``useradd -rm www-git`` + +Create an passwordless ssh key for this user : + +``su www-git +ssh-keygen`` + +If you need the git authentication (i.e. because your repo is private), do as +usual. + +-------- +Database +-------- + +Freepoteries uses one server to handle all database stuff. We will assume in +this documentation that the DB software is MariaDB_ (ver. 10.1.38, debian). + +Your DB server needs to be accessible by the webserver machine, you can test +this on the webserver host by launching the following command : +``nc db.server db.port`` + +If it gives you the MariaDB version, you're ok to go with this. + +You need to have an administrator access to the MariaDB server. On the DB +server, try this by launching the following commands : +``mariadb -u root`` + +If this connects you to the MariaDB prompt, you're ok. +Now, in this prompt, create the user for our app. It will own a database and all +the rights on it. + +``CREATE DATABASE framadate; +CREATE USER 'framadate'@'www.freepoteries.fr' identified by '7VDYMDXJXHTC107Z61OWCVTWM'; +GRANT ALL PRIVILEGES ON framadate TO 'framadate'@'www.freepoteries.fr';`` + + +.. _php-fpm: https://php-fpm.org/ +.. _Alpine Linux: https://alpinelinux.org/ +.. _MariaDB: https://mariadb.org/ diff --git a/content/ssh.rst b/content/ssh.rst new file mode 100644 index 0000000..361f80b --- /dev/null +++ b/content/ssh.rst @@ -0,0 +1,101 @@ +ssh +### + +:date: 2019-09-09 00:00 +:modified: 2019-09-09 00:00 +:tags: ssh, admin +:category: documentation +:slug: ssh +:authors: Ms.Leave-A-Mix +:summary: SSH usage and configuration + +`Secure SHell`_ is a very powerful way to connect to computers remotely. It has +many uses and you may have already touched it, even without knowing it. + +This article will brief up some of the use cases, and will explain the basics of +some handy tips that you may use in your daily admin (no)life. + +------------------- +Authentication Keys +------------------- + +In many client-server programs, authentication is one of the major problems that +the programmers encounters to make his software secure. The usual way to handle +it is a login/password system. Since it's easy to code and use, many web +services have only this way to authenticate users. This leads in the end to a +mass usage of "bot tests", and in many cases, `Google's reCaptcha`_ usage. This +is no solution for real-world web applications, and for task automation and time +saving. + +The success of SSH_ is, between many of it's advantages, to handle an other way +to authenticate users. This is called "`Public Key Authentication`_", and you +can read more about it's benefits by clicking on the link. + +How-To +------ + +This how-to will use ssh, ssh-agent, ssh-keygen, netcat and of course our +beloved bash to show how to simply authenticate to any SSH_ or Git_ server. + +First, we will generate a SSH_ key pair, with or without password to protect it +: +``ssh-keygen -f new_key`` +This command created two files : new_key and new_key.pub +The first one is the private part of the pair, and the ".pub" one is the public +part. We don't have to check what's inside the private key, since it's randomly +generated bytes, an human can not read it. The public key, is like a fingerprint +that will authenticate only and only if it matches with the private one. + +Choose a server on which you have an user access with an SSH_ password. For +example, "nasa.gov". We will copy the newly created public key to it, and allow +the autentication with it. + +``ssh-copy-id -i new_key root@nasa.gov`` + +Just enter your password, and it should be done. The program should output : +``Number of key(s) added: 1`` + +This means that you succeeded! (You can now disable SSH password login on the remote +server, huh) + +SSH-Agent_ is like a keyring, it will register your keys to your session, and +will automate the authentication process when needing them. This is how you use +it : +``eval $(ssh-agent) +ssh-add ./new_key`` + +This program should output : +``Identity added: new_key (user@hostname)`` + +We then need to add some ssh client configuration, to make it automatized. + +``Host *.freepoteries.fr + ForwardAgent yes + User user + IdentityFiles ~/new_key`` + +If you want to allow users to login directly to machines in the local network of +your remote host (as it is done with every virtual machine of my server). You +can also add to the options of the host : + +``ProxyCommand ssh user@freepoteries.fr "-q0 %h %p" 2> /dev/null`` + +Save all of this in ``~/.ssh/config``. + +Put this in your ``~/.bashrc`` if you want to make the ssh-agent run at each +session (read `man ssh-agent` for further information): + +``if [[ "$SSH_AGENT_PID" == "" ]]; then + eval "$(<~/.run/ssh-agent/environment)" + ssh-add ~/.ssh/id_rsa + ssh-add ~/.ssh/id_rsa_ma-otec + ssh-add ~/.ssh/id_rsa_belugaspot-msleaveamix +fi`` + + +.. _Secure SHell: https://www.ssh.com/ssh +.. _SSH: https://www.ssh.com/ssh +.. _Google's reCaptcha: https://www.google.com/recaptcha +.. _Public Key Authentication: https://www.ssh.com/ssh/public-key-authentication +.. _Git: https://git-scm.com/ +.. _SSH-Agent: https://www.ssh.com/ssh/agent