2023-12

Debian12.5_en

Debian12.5 ; Suricata + Elastic Stack

Prerequisite.We will install Suricata IDS and ElasticStack on the following servers・1st server Suricata IDS & Filebeat : Debian12.5 IP address (192.168.11.83)・2nd server ElasticStack & kibana : Ubunru22.04 IP address(192.168.11.100) 1st server Suricata InstallSURICATA IDS/IPS is an open source IDS that monitors communications on the network and detects suspicious traffic. Its basic mechanism is signature-based, so it can detect predefined unauthorized communications. Suricata is also characterized by its ability to provide protection as well as detection.
Debian12.5_en

Debian12.5 ; MariaDB , WordPress Install

1. MariaDB1.1 Install# apt install mariadb-serverMariaDB version confirmation# mariadb -Vmariadb Ver 15.1 Distrib 10.11.6-MariaDB, for debian-linux-gnu (x86_64) using EditLine wrapper1.2 MariaDB Server Security SettingsMariaDB comes with a default security script, mariadb-secure-installation, which can be used to improve the security of your MariaDB installation, includingSet a password for the root account (if necessary).Disable remote root login to the database.Delete anonymous user accounts.Delete the test database to which anonymous users have access by default.2.WordPress2.1 Database CreationCreate a database for Word Press (for example, in this case, the database name is "wp_db", the user name is "wp_user", and the password is "?Y123456y")
Debian12.5_en

Debian12.5 ; SSH connection using public key cryptography

Create a key pairCreate a public/private key pair for a user connecting to a Linux server using OpenSSH.Use ssh-keygen to create the key pair.The creation of a public/private key pair must be done as a user with remote login privileges.If you do not specify the destination and file name, id_ed25519 and id_ed25519.pub will be created in /home/(user name)/.ssh/. On the way, enter the password for the key.
Debian12.5_en

Debian12.5 ; OS installation and initial setup

1.Debian12 Overview and Installation InstructionsIn this article, we will explain how to build a server with Debian, the basis of the user-friendly Linux distribution UBUNTU.The latest is Debian 12 (codenamed "bookworm") (released on June 10, 2023), a point-release version of Debian 12.5 (released on February 10, 2024) with bug fixes and security updates.1.1 Download Debian12.install imageDownload site for Debian12.  https://www.debian.org/Please access the above official website and download the latest "debian-12.5.0-amd64-netinst.iso." which is convenient for setup in an environment connected to the Internet. (It will fit on one CD.)
Archlinux_en

ArchLinux ; Clamav ( Anti-virus software ) , Mail server

1. Install clamav ( anti-virus software )1.1 Clam AntiVirus Installation# pacman -S clamav1.2 Virus definition file update settings# vim /etc/clamav/freshclam.confLine 76Insert "#" at the beginning of the line "DatabaseMirror database.clamav.net",Add "DatabaseMirror db.jp.clamav.net#DatabaseMirror database.clamav.netDatabaseMirror db.jp.clamav.net2. Mail Server (Postfix)2.1 Installing PostfixInstall Postfix and build an SMTP server# pacman -S postfix3. Mail Server(Dovecot)3.1 Dovecot Installation# pacman -S dovecot3.2 Edit dovecot.conf fileMail Server : Postfix + Clamav + clamav-milter+SpamAssassin1. Real-time scanning of email➁clamav-milter configuration
Archlinux_en

ArchLinux ; WEB Server(Apache2)

1. Apache2 installation and virtual host configuration1.1 Apache2 Installation①Install httpd# pacman -S apacheVersion Check# httpd -vServer version: Apache/2.4.58 (Unix)Server built: Oct 25 2023 18:28:291.2 Apache Configuration①Edit httpd.conf file2. Confirmation of CGI Script Usage①CGI availability check3. PHP installation and configuration3.1 PHP8 installation①Install# pacman -S php php-apache php-fpm②Version Check
Archlinux_en

ArchLinux ; FTP Server , File Server (SAMBA)

1.FTP Server1. 1 vsftpd installation# pacman -S vsftpd1.2 vsftpd configuration①Editing Configuration Files2. vsftpd SSL/TLSConfigure Vsftpd to use SSL/TLS2.1 Create self-signed certificatesThis step is not necessary if you are using a trusted, legitimate certificate such as Let's Encrypt.The information you enter is meaningless and will only be used for encryption.
Archlinux_en

ArchLinux ; SSH , Firewall (ufw)

1. SSH Service Security SettingsChange the configuration file for the SSH service, which is "/etc/ssh/sshd_config".In this case, we will change the default SSH port 22 to 2244.Change /etc/ssh/sshd_config as follows2. Firewall (ufw)2.1 Install# pacman -S ufw# systemctl status ufw○ ufw.service - CLI Netfilter Manager Loaded: loaded (/usr/lib/systemd/system/ufw.service; disabled; preset: dis> Active: inactive (dead)You can confirm that the ufw service is stopped by displaying "Active: inactive (dead)"
Archlinux_en

ArchLinux ; Initial settings after OS installation

1. User Account CreationAdd user (huong) to wheel group and create home directory# useradd -m -G wheel huongUser (huong) password setting# passwd huongNew password:Retype new password:passwd: password updated successfullyGrant sudo privileges to the added huong user2 . Configuration of the text editor vimVim was already installed during the Arch Linux installation, so this is just a configuration file.If you are installing vim3. Network Connections■ If using systemd-resolved, create /etc/resolv.conf as a link file# ln -sf /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf■ If systemd-resolved is not used
Archlinux_en

ArchLinux ; Installation #4 How to install with btrfs file system

For installation with ext4 file system, please refer to the following pagehttps://korodes.com/arch_en_02/https://korodes.com/arch_en_03/1.Creating partitions1.1 Confirmation of installation deviceCheck the target device with the lsblk command
Archlinux_en

ArchLinux ; Installation #3 Initial settings during installation

Initial setup within the installed systemTo enter the installed system, use the arch-chroot command.arch-chroot is a script for Arch Linux installation that mounts the system so that the specified path is the root "/".However, after this, only commands in the destination ArchLinux can be used. Commands in the installation media cannot be used.For example, to install a package, use pacman instead of pacstrap.Enter the installed system (/mnt becomes /)
Archlinux_en

ArchLinux ; Installation #2 Disk Partitioning

1. Partitioning the disk on which Arch Linux is installedThis time, use gdisk command in UEFI mode and GPT for the partition table.Check current disk information# lsblkNAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTSloop0 7:0 0 693.5M 1 loop /run/archiso/airootfssda 8:0 0 20G 0 disksr0 11:0 1 813.3M 0 rom /run/archiso/bootmntIn the above case, a 20 GB virtual HDD was created on VmwareWorkstion, so the SIZE of the sda is set to 20 GB.The sda in the NAME line is the name of the device that represents the entire disk and will be partitioned to this sda.This time, create an EFI partition and a partition for Arch Linux, but not a swap partition.In the past, a partition was created for swap and allocated as swap, but now a "swap file" can be used without a swap partition.A "swap file" is a method of creating a single file of any size for swap and using that area as swap, which can be created, deleted, and resized.
Archlinux_en

ArchLinux ;  Installation #1 Image Download and Preparation

Arch Linux Arch Linux is a Linux distribution.Unlike other distributions, which often perform graphical installation, Arch Linux uses a CUI command line screen to perform the installation process.However, since there is no need to install unnecessary packages, you can create your own environment that is highly flexible, lightweight, and compact.Arch Linux does not have the "version" concept of other distributions.The installation ISO contains only the commands used during the installation process, and the ISO file is updated monthly to ensure that it is always up-to-date.Forte・Arch Linux does not have the "version" concept that other distributions have・The installation ISO image contains only the commands used during the installation process, and the ISO file is updated monthly.・Ability to work with the latest kernel and commands for installation・Arch Linux allows you to select and install only what you use, so no extra packages are installed.・Packages are always updated to be nearly up-to-date, so you can use the latest Linux kernel, the latest versions of software, and so on.・Arch Linux's proprietary package manager, pacman (CUI), takes significantly longer to install packages than other distributions.
Debian12.5_en

Debian12.5 ; SSH , Firewall Setting

1. SSH Service Security SettingsThe SSH service allows the root user to log in by default, and since the root user already knows the user name and can log in to the server with administrative privileges once the password is known, we will deny this setting.1.1 Creating a General UserIf you have created a general user when installing Debian, this procedure is not necessary.If the only user created on the server is root, remote login via SSH will not be possible, so if a user has not been created during OS installation, a user must be created in advance.Users can be created with the "useradd" command. The "-m" option creates a home directory and the "-p" option specifies the password.For example, to set "debianuser" as the user account name and "123456" as the password, execute the following
Debian12.5_en

Debian12.5 ; WEB Server(Apache)

Web server Apache2 installationAllow http:80 and https:443 ports in UFW before installation3.  Apache2; Using Perl ScriptsEnable CGI to make Perl scripts available①Install Perl4 Apache2 : Using PHP Scripts①Install PHP5. Virtual Host SettingsCopy the default configuration file (file name is arbitrary, in this case vhost-yourdomain.conf as an example) and configure the virtual host6. Digest authentication with Apache2Since Basic Authentication, a well-known authentication authorization method for http, sends authentication information in plain text, there is a risk of ID and password leakage if the packet is intercepted.On the other hand, Digest Authentication encrypts and transmits authentication information, so there is almost no risk of information leakage.