Server Log Debian

Server Log Debian
Linux Server and router for WARNET - (another) HOWTO

Download Debian from http://cdimage.debian.org/debian-cd/current/i386/iso-cd/debian-6.0.4-i386-netinst.iso
Install just SSH and uncheck Standart System Utilities.

what i have done :
1. a subdomain from afraid.org (hade.netgameonline.com)
2. redirect port (80, 443) from modem to 192.168.1.2

MODEM (pppoe)   >> eth1 >> DEBIAN BOX >> eth0
192.168.1.1   192.168.1.2/24		192.168.1.2/24

host = hade domain = netgameonline.com

add repository :
echo deb http://kambing.ui.ac.id/debian/ squeeze main | tee -a /etc/apt/sources.list
echo deb-src http://kambing.ui.ac.id/debian/ squeeze main | tee -a /etc/apt/sources.list
echo deb http://kambing.ui.ac.id/debian/ squeeze-updates main | tee -a /etc/apt/sources.list
echo deb-src http://kambing.ui.ac.id/debian/ squeeze-updates main | tee -a /etc/apt/sources.list
echo deb http://download.webmin.com/download/repository sarge contrib | tee -a /etc/apt/sources.list
echo deb http://archive.canonical.com/ lucid partner | tee -a /etc/apt/sources.list | tee -a /etc/apt/sources.list
echo deb http://packages.dotdeb.org squeeze all | tee -a /etc/apt/sources.list
echo deb-src http://packages.dotdeb.org squeeze all | tee -a /etc/apt/sources.list
cd /root
wget http://www.dotdeb.org/dotdeb.gpg
cat dotdeb.gpg | apt-key add -
wget http://www.webmin.com/jcameron-key.asc
apt-key add jcameron-key.asc

apt-get update

apt-get -y install build-essential mc webmin bind9  bind9-doc dnsutils

/etc/init.d/bind9 stop
mkdir -p /var/chroot/bind9/{etc,dev,var/cache/bind,var/run/bind/run}
chown -R bind:bind /var/chroot/bind9/var/*
mknod /var/chroot/bind9/dev/null c 1 3
mknod /var/chroot/bind9/dev/random c 1 8
chmod 666 /var/chroot/bind9/dev/{null,random}
mv /etc/bind /var/chroot/bind9/etc
ln -s /var/chroot/bind9/etc/bind /etc/bind
chown -R bind:bind /etc/bind/*
echo "\$AddUnixListenSocket /var/chroot/bind9/dev/log" > /etc/rsyslog.d/bind-chroot.conf

edit bind9 to use the chroot (file /etc/default/bind9):
from OPTIONS="-u bind" to OPTIONS="-u bind -t /var/chroot/bind9"
nano /etc/default/bind9

restart rsyslogd and start bind9.

/etc/init.d/rsyslog restart ; /etc/init.d/bind9 start

2. Let’s configure Bind. We need to touch 4 files.

We will edit 3 files.

    * /etc/bind/named.conf.local
    * /etc/bind/named.conf.options
    * /etc/resolv.conf

We will create 1 files.

    * /etc/master/hade.netgameonline.com.zone

A. First step. Lets add our domain zone – hade.netgameonline.com.

nano /etc/bind/named.conf.local

//
// Do any local configuration here
//
zone "hade.netgameonline.com" {
		type master;
		file "/etc/master/hade.netgameonline.com.zone";
		allow-transfer {
			127.0.0.1;			# localhost
			50.23.197.94;		# ns1.afraid.org
			174.37.196.55;		# ns2.afraid.org
			192.168.1.2;		# local
		};
		notify yes;
};
// Consider adding the 1918 zones here, if they are not
// used in your organization
include "/etc/bind/zones.rfc1918";

Save file. Exit.

We just created a new domain. Please note: later we will create one files named hade.netgameonline.com.zone files.

B. Let’s add the DNS servers from your ISP. In my case, I’m using telkom.net.id DNS servers. You can place the primary and secondary DNS servers here separated by semicolons.

nano /etc/bind/named.conf.options

	// forwarders {
	//      0.0.0.0;
	// };
	forwarders {
		202.134.1.5;
		202.134.0.155;
		202.134.0.5;
		202.134.2.5;
		202.134.1.10;
		203.130.208.18;
		203.130.206.250;
		203.130.196.6;
		203.130.196.155;
		203.130.196.5;
		222.124.204.34;
		203.130.208.18;
	};

Save file. Exit.

C. Now, let’s modify the resolv.conf file found in /etc and place the IP address of our DNS server which is set to 192.168.1.100.

cat > /etc/resolv.conf << "EOF"
# Begin /etc/resolv.conf
domain hade.netgameonline.com
nameserver 127.0.0.1
nameserver 192.168.1.1
nameserver 50.23.197.94
nameserver 174.37.196.55
nameserver 110.136.159.200
# End /etc/resolv.conf
EOF


D. Now, let’s define the zones.
" http://www.zonefile.org "

mkdir -p /etc/master
nano /etc/master/hade.netgameonline.com.zone

; hade.netgameonline.com
$TTL 3600
hade.netgameonline.com. IN     SOA    a.root-servers.net. [email protected]. (
				2012031801  ; Serial
				3H          ; refresh after 3 hours
				1H          ; retry after 1 hour
				1W          ; expire after 1 week
				1D)         ; minimum TTL of 1 day

	; Name Server
	IN	NS	ns1.afraid.org.
	IN	NS	ns2.afraid.org.
	IN	NS	hade.netgameonline.com.

	; Mail Exchanger

hade.netgameonline.com.		IN A			110.136.159.200
www				IN CNAME		110.136.159.200

; Resource Record - veryfy the IP where your mails come from(disable if not needed)
; @	IN TXT		"v=spf1 ip4:85.214.123.0/24 -all"

; EOF

3. Let’s restart Bind to activate our latest changes.

/etc/init.d/bind9 restart

4. Finally, let’s test our new domain and DNS entries.

dig localhost
dig hade.netgameonline.com
nslookup localhost
nslookup hade.netgameonline.com

apt-get -y install apache2

Generate A certificate

mkdir /etc/apache2/ssl
cd /etc/apache2/ssl
openssl req -x509 -days 365 -newkey rsa:1024 -keyout hostkey.key -nodes -out hostcert.pem

--------------
Generating a 1024 bit RSA private key
...........++++++
......++++++
writing new private key to '/etc/apache2/ssl/hostcert.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:ID
State or Province Name (full name) [Some-State]:West Java
Locality Name (eg, city) []:Bandung
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Hade Network
Organizational Unit Name (eg, section) []:Hade Warnet
Common Name (eg, YOUR name) []:Wandi Budiana
Email Address []:[email protected]
root@debian:~#
------------------------

chmod 700 *

nano /etc/apache2/sites-available/default-ssl
//update the following:

SSLCertificateFile    /etc/ssl/certs/ssl-cert-snakeoil.pem
SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

with :

SSLCertificateFile    /etc/apache2/ssl/hostcert.pem
SSLCertificateKeyFile /etc/apache2/ssl/hostkey.key

ln -s /etc/apache2/sites-available/default-ssl /etc/apache2/sites-enabled/000-default-ssl
a2enmod ssl
/etc/init.d/apache2 restart or /etc/init.d/apache2/force-reload

wget http://download.avgfree.com/filedir/inst/avg2012flx-r1786-a4748.i386.deb
dpkg --install avg2012flx-r1786-a4748.i386.deb
avgctl
reboot
avgupdate