Giters

denmarksdev / linux-server

This project configures a linux server to run web applications in a secure environment.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Linux Server Configuration

How to configures a Linux server to run web applications in a secure environment.

This configuration uses the Catalog Item project to create a Python WSGI application

Application URL

Notice

The app is hosted on a Google Cloud, and may be unavailable after the trial period

The third party sign Google and Facebook not work, because the Google need valid domain name not an IP address number and the Facebook require HTTPS protocol. Only works in a localhost environment.

Requirements

  1. Use cloud service to create an instance of the Ubuntu Linux server.
  2. Follow the Linux SSH configuration instructions.
  3. Update all installed packages
  4. Change the default port SSH 22 to 2200 add the firewall rule.
    • add the firewall rule in VPN NETWORK option on Google AppEngine
  5. Configure Uncomplicated Firewall (UFW) to only allow connections:
    • SSH 2200
    • HTTP 80
    • NPT 123
  6. Create a grader user account
  7. Give sudo permission to user grader
  8. Create SSH keys to grader using the ssh-keygen tool
  9. Set the local time zone for UTC
  10. Install the apache server to serve mod_wsgi Python application
  11. Install PostgreSQL and create user catalog with limited permissions to the application database.
  12. Installing Git
  13. Cloning and Configuring the Project Item Catalog
  14. Configure the server so that it works correctly by visiting the ip address of your server in a browser. And do not allow the git directory to be publicly accessible through a browser

Steps

1 - Google Cloud Shell

  1. Update package information
    • sudo apt-get update
  2. Install package updates
    • sudo apt-get upgrade
  3. Create user grader
    • sudo adduser grader
  4. Give sudo permission to user grader
    • sudo cp /etc/sudoers.d/google_sudoers /etc/sudoers.d/grader
    • sudo nano /etc/sudoers.d/grader rename google_sudoers to grader
  5. Log in with user grader
    • su grader
  6. In the user's directory grader, create an .ssh folder to store the public key.
    • mkdir .ssh
  7. Generate SSH keys for the grader in your local environment
    • ssh-keygen grader with the name grader
  8. Create the authorized_key file in the .ssh folder save the public key
    • sudo nano .ssh/authorized_keys and paste content the file grader.pub
  9. Change permissions .ssh
    • sudo chmod 744 .ssh
  10. Change permissions for authorized_keys
    • sudo chmod 644 .ssh/autthorized_keys
  11. Close the Google Cloud Shell and log in to your local environment with a previously generated key
    • ssh grader@35.199.122.175 -i grader grader is the private key

2 - Security

ATTENTION: In the Google compute engine, change the default default-allow-ssh port to 2200 - If you do not do this, you will not be able to communicate through ssh

  1. Configure o Uncomplicated Firewall (UFW)
sudo ufw default deny incoming 
sudo ufw default allow incoming 
sudo ufw allow  2200/tcp
sudo ufw allow web
sudo ufw allow 123/tcp
  1. Activate the firewall
    • sudo ufw enable
  2. Change the ssh port to 2200 in the configuration file and disable SSH Root Login
    • sudo nano /etc/ssh/sshd_config
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

Port 2200

#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::
...
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m

PermitRootLogin no
...
  1. Restart the SSH service
  • sudo service ssh restart

3 - Implement the project

1 - The Apache server

  1. Set the time for UTC,
    • sudo dpkg-reconfigure tzdata select none of above and UTC.
  2. Install apache and wsgi
    • sudo apt-get install apache2
    • sudo apt-get install libapache2-mod-wsgi
  3. Install postgresql
    • sudo apt-get install postgresql

2 - Postgresql

  1. Install the Postgresql
    • sudo -u postgres psql postgres
  2. Create the database and user catalog
    • create database catalog;
    • create user catalog with password 'somePass'

2 - Create the Catalog Item wsgi application

  1. Install git
    • sudo apt-get install git
  2. create CatalogApp folder
    • sudo mkdir\var\www\ CatalogApp
  3. Enter the folder
    • cd \var\www\CatalogApp
  4. Cloning the Project Catalog Item
    • sudo git clone https://github.com/denmarksdev/catalog.git
  5. Install Virtual Python Environment
    • sudo virtualenv venv --always-copy
  6. Activate the virtual environment
    • source venv/bin/activate
  7. Install the application packages
    • sudo pip install -r catalog/requirements.txt
  8. Installing the PostgreSQL Provider
    • pip install psycopg2-binary
  9. Move the app folder to /var/www/CatalogApp
    • sudo mv /catalog/app ./
  10. Move the config.py folder to /var/www/CatalogApp
    • sudo mv /catalog/config.py ./
  11. In the configuration file change the provider of the bank and the public address
SQLALCHEMY_DATABASE_URI = 'postgresql://catalog:somePass@localhost/catalog'
PUBLIC_URL = "http://35.199.122.175"
  1. Changing static Image folder permissions
    • sudo ssh chmod 747 app\static\images
  2. Create the application's WSGI file
    • sudo nano catalogapp.wsgi
#!/usr/bin/python

import sys
import logging
import os

logging.basicConfig(stream=sys.stderr)
sys.path.insert(0,"/var/www/CatalogApp/")

from app import app as application
from app.sample_data import create as create_sample_data

create_sample_data()
  1. Configure the virtual host
    • sudo nano /etc/apache2/sites-available/CatalogApp.conf
<VirtualHost *:80>
                ServerName 35.199.122.175
                ServerAdmin grader@test.com
                WSGIScriptAlias / /var/www/CatalogApp/catalogapp.wsgi
                <Directory /var/www/CatalogApp/app/>
                        Order allow,deny
                        Allow from all
                </Directory>
                Alias /static /var/www/CatalogApp/app/static
                <Directory /var/www/CatalogApp/app/static/>
                        Order allow,deny
                        Allow from all
                </Directory>
                ErrorLog ${APACHE_LOG_DIR}/error.log
                LogLevel warn
                CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
  1. And finally restart the apache server
    • sudo service apache2 restart

Third-party resources

About

This project configures a linux server to run web applications in a secure environment.

License:GNU General Public License v3.0