Deploying a Web Server
Dependencies - Launch Cloud Instance
Before deploying a web server, first a cloud instance must be lauched. The instruction to do this can be found here. For the remainder of the instructions the ip address used is 184.108.40.206, this is for demonstration purposes and you should replace it with your assigned floating IP address.
- login to cloud.sharcnet.ca
- Don’t forget volume size
- Choose Debian 9.2.2 (not required, but the remaining instructions are Debian centric).
- Choose persistent (ephemeral is for shorter jobs) (4C-8GB)
- Setup keypair
- Associate floating ip
(Optional) Apply IP Address to your name server
If you have a registered domain name you should apply your floating IP address to it so that you can use the "let's encrypt" service to enable the secure socket layer without client side warnings. It is often best to do this at the beginning as there is typically a delay in updating the name service.
Login to Server & perform preliminaries
At this point log into the server to ensure that the service is up and running. There are a number of steps you can perform that will make the remaining steps easier. First loging to the server. Then setup a user prompt to make navigation easier. Switch to root (or use sudo in from of the remaining commands). Update and upgrade the system. Last install the manual pages.
$ ssh email@example.com $ echo 'export PS1="\[\e[33m\]\w\[\e[0m\]\n\[\e[32m\]\u@\h$ \[\e[0m\]"' >> .bash_aliases $ sudo su root $ apt update $ apt upgrade $ apt install man
If you receive the "apt error" mesage put "nameserver 220.127.116.11" in /etc/resolve.conf.
$ echo 'nameserver 18.104.22.168 >>' /etc/resolve.conf
Secure the SSH login
The following changes will disable logging into the server by using a password on any account and prevent logging into root remotly. Root can still be accessed by logging into a sudo enabled account and using the command su root. For more information on the sshd_config file options, go here. The unattended-upgrades package is used to keep they server up to date automatically.
$ sudo vim /etc/ssh/sshd_config ChallengeResponseAuthentication no PasswordAuthentication no PermitRootLogin no $ service ssh reload $ apt install unattended-upgrades $ dpkg-reconfigure --priority=low unattended-upgrades $ sudo unattended-upgrade -d
Install webserver and suppporting packages
$ apt install mysql-server $ mysql_secure_installation #password=password
Installing the Apache webserver will allow you to access a default page at your ip address. (ex http://22.214.171.124, or http://frar.ca). Note that https will not yet work.
$ apt install apache2 $ service apache2 start #add 80, 443 to default security group rules $ a2enmod cgid.load #(optional) enable cgi scripting, a2dismod to remove