{"id":7276,"date":"2022-10-10T16:14:02","date_gmt":"2022-10-10T16:14:02","guid":{"rendered":"https:\/\/www.sitekickr.com\/blog\/?p=7276"},"modified":"2022-10-10T16:30:17","modified_gmt":"2022-10-10T16:30:17","slug":"provisioning-a-new-linux-server-centos-stream-edition","status":"publish","type":"post","link":"https:\/\/www.sitekickr.com\/blog\/provisioning-a-new-linux-server-centos-stream-edition\/","title":{"rendered":"Provisioning a New Linux Server (CentOS Stream Edition)"},"content":{"rendered":"\n<p><strong>Time: 25 minutes<\/strong><\/p>\n\n\n\n<p>I created this post about <a href=\"https:\/\/www.sitekickr.com\/blog\/provisioning-server\/\">provisioning a new CentOS server<\/a> years ago before CentOS 7 was depreceted. Well, time to update things a bit!<\/p>\n\n\n\n<p>One difference that you&#8217;ll come to notice is that we&#8217;re now using a tool called <em><strong>dnf <\/strong><\/em>to install packages, where we had used <em>yum<\/em> in previous distros. Don&#8217;t let this overwhelm you, <em>dnf <\/em>is just a glorified version of <em>yum<\/em> with a few more options.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h2>Choosing a Server Template<\/h2>\n\n\n\n<p>If you&#8217;re provisioning a VPS or Cloud instance, you might be given the option to apply a &#8220;template&#8221; to the server. This template indicates which distribution to install, but also can offer installation of other software, such as the LAMP stack.<\/p>\n\n\n\n<p>I&#8217;d encourage you to avoid installing anything except for the bare-bones distribution itself. I&#8217;ve struggled to &#8220;clean up&#8221; after these templates have installed packages far too many times.<\/p>\n\n\n\n<h2>Creating a non-root superuser account.<\/h2>\n\n\n\n<p>The very first thing you should do is say goodbye to that root login. Don&#8217;t ever use it again. It&#8217;s not worth ever putting the root password at risk. Okay, but how will I gain admin privileges to the server?<\/p>\n\n\n\n<p><code>useradd <em>myusername<\/em><br>passwd <em>myusername<\/em>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; (then choose a password)<\/code><\/p>\n\n\n\n<p>Great, you have a new user account. Now let&#8217;s give it superpowers:<\/p>\n\n\n\n<p><code>visudo<\/code><\/p>\n\n\n\n<p>Locate the line that looks like this:<\/p>\n\n\n\n<p>root&nbsp;&nbsp;&nbsp; ALL=(ALL)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ALL<\/p>\n\n\n\n<p>Then, create another similar looking line directly under it:<\/p>\n\n\n\n<p><code><em>myusername<\/em> &nbsp;&nbsp; ALL=(ALL)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ALL<\/code><\/p>\n\n\n\n<p>What is this program, I can&#8217;t type anything! You&#8217;re using an age-old tool called <em><strong>vi<\/strong><\/em>, it&#8217;s not user-friendly at all, but there are die-hard linux fans that would dive in front of a bullet for it (yes, I have tried to physically harm the software program <strong><em>vi<\/em><\/strong> from time to time).<\/p>\n\n\n\n<p>Press the <kbd>i<\/kbd> key on your keyboard to allow editing.<\/p>\n\n\n\n<p>When you&#8217;re done, press the <kbd>Esc <\/kbd>key, then <kbd>colon<\/kbd>, then the letters <kbd>w<\/kbd>, then q.<\/p>\n\n\n\n<h2>Let&#8217;s update the OS itself first<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf upgrade --refresh -y<\/code><\/pre>\n\n\n\n<h3>Indexing the filesystem search database<\/h3>\n\n\n\n<p>While you&#8217;re provisioning the server, you&#8217;ll probably find yourself using the <em>locate<\/em> command to find utilities. Depending on your host, they may or may not have setup a cron job to auto-index the search database daily. If not, you&#8217;ll need to do this before issuing your first locate command.<\/p>\n\n\n\n<p><code>updatedb<br><\/code><\/p>\n\n\n\n<p>Yup, that&#8217;s it!<\/p>\n\n\n\n<p>Well, unless you don&#8217;t have the mlocate tool installed. Not to worry:<\/p>\n\n\n\n<h3><kbd>dnf install mlocate<\/kbd><br><br>Get the latest repositories<\/h3>\n\n\n\n<p>Before you start installing software, let&#8217;s make sure you&#8217;re using the most up-to-date repositories of the software.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo dnf config-manager --set-enabled crb<\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo dnf install https:\/\/dl.fedoraproject.org\/pub\/epel\/epel-release-latest-9.noarch.rpm https:\/\/dl.fedoraproject.org\/pub\/epel\/epel-next-release-latest-9.noarch.rpm<\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo dnf install dnf-utils http:\/\/rpms.remirepo.net\/enterprise\/remi-release-9.rpm -y<\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo dnf update --refresh -y<\/pre>\n\n\n\n<h2>Installing your web server, development tools and database<\/h2>\n\n\n\n<p>Otherwise known as the LAMP stack, Apache, MySQL and PHP (or Python\/Perl) are your most common installs for a web server. Being so common, it&#8217;s not a real heavy lift to get these installed.<\/p>\n\n\n\n<p>There are a few ways to install packages, the two most common are:<\/p>\n\n\n\n<ul><li>From source (requires us to compile the source code on our server)<\/li><li>RPM (software comes packaged and installation is managed by the package)<\/li><\/ul>\n\n\n\n<p>I typically choose the RPM method as it&#8217;s works for my needs 90% of the time. Occasionally, you&#8217;ll find yourself compiling from source (it&#8217;s easier than it sounds), but I encourage you to stick with RPM until it&#8217;s no longer sufficient.<\/p>\n\n\n\n<p><em><strong>dnf <\/strong><\/em>is an excellent front-end tool that leverages the RPM packaging system. With <em><strong>dnf<\/strong><\/em>, you are able to use common names for packages and install them with a single command. Let&#8217;s start with <strong>Apache<\/strong>.<\/p>\n\n\n\n<h3>Installing Apache<\/h3>\n\n\n\n<p><code>dnf install httpd httpd-devel<br>dnf install mod_ssl<\/code><\/p>\n\n\n\n<p>It&#8217;s a good ideal to install Apache&#8217;s development tools (httpd-devel), as you&#8217;ll find them necessary when you add modules such as OpenSSL and others. The same goes for other services such as PHP and MySQL; if a development tools library is available, it usually doesn&#8217;t hurt to install it.<\/p>\n\n\n\n<p>You&#8217;ll also notice that we&#8217;ve install mod_ssl. Might as well while we&#8217;re at it.<\/p>\n\n\n\n<p>Now, here&#8217;s the kicker. Depending on your version of CentOS, you might be greeted by a server error when you enter your server&#8217;s IP address in a web browser. The reason is that the default firewall rules are blocking port 80.<\/p>\n\n\n\n<p>No problem, drop in these commands and you should be good to go:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">firewall-cmd --permanent --zone=public --add-service=http\nfirewall-cmd --permanent --zone=public --add-service=https\nfirewall-cmd --reload\n<\/pre>\n\n\n\n<p>If that doesn&#8217;t work, try adding these lines to &nbsp;\/etc\/sysconfig\/iptables:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT\n-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT<\/pre>\n\n\n\n<p>Directly after<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">:OUTPUT ACCEPT [3:440]<\/pre>\n\n\n\n<p>Then running<em> service iptables save<\/em>.<\/p>\n\n\n\n<h3>Installing Development Tools<\/h3>\n\n\n\n<p>At some point, you will need to compile from source, so it makes sense to have the development tools &#8220;suite&#8221; on your machine:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">yum groupinstall \"Development Tools\"<\/pre>\n\n\n\n<h3>Installing PHP<\/h3>\n\n\n\n<p>I like to grab the most recent PHP version. The problem is that older versions of PHP are the default choice for standard installation.<\/p>\n\n\n\n<p>To see what&#8217;s available, use<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo dnf module list php<\/pre>\n\n\n\n<p>Once you&#8217;ve decided on a version, enable it with (using PHP 8.1 as an example):<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sudo dnf module enable php:remi-8.1 -y<\/pre>\n\n\n\n<p>And finally, install it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf install php-fpm -y\nsudo dnf install php-cli php-curl php-gd php-opcache php-zip php-intl php-common php-bcmath php-imap php-imagick php-xmlrpc php-json php-readline php-memcached php-redis php-mbstring php-apcu php-xml php-dom php-redis php-memcached php-memcache<\/code><\/pre>\n\n\n\n<h3>Installing MySQL<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf install mysql mysql-server -y\n\n<\/code><\/pre>\n\n\n\n<p>At this point, it makes sense to setup MySQL using the included secure installation script:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">mysql_secure_installation<\/pre>\n\n\n\n<h3>Installing PHP Modules<\/h3>\n\n\n\n<p>Now that MySQL is installed, let&#8217;s install the PHP modules necessary to connect to MySQL. While we&#8217;re at it, we should snag as many other useful modules as possible<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf install php-mysqlnd<\/code><\/pre>\n\n\n\n<h3>Installing nano<\/h3>\n\n\n\n<p>As I mentioned before, unless you&#8217;re a die-hard, you won&#8217;t be happy with the vi text editor that comes installed on the server. nano is a step up, something you might more closely equate with Windows Notepad.<\/p>\n\n\n\n<p><code>dnf install nano<br><\/code><\/p>\n\n\n\n<h3>Verifying your mail sender<\/h3>\n\n\n\n<p>It&#8217;s likely that you distribution will include <em>sendmail<\/em> by default, but it&#8217;s possible that it won&#8217;t. In some cases, by doing:<\/p>\n\n\n\n<p><code>locate sendmail<\/code><\/p>\n\n\n\n<p>It appeared to me that sendmail was actually installed. But when I tried to test it (as shown below), it returned errors. Sendmail wasn&#8217;t actually installed.<\/p>\n\n\n\n<p>If this happens, you can easily install it with <em>yum<\/em>.<\/p>\n\n\n\n<p><code>yum install sendmail<\/code><\/p>\n\n\n\n<p>Then, verify it&#8217;s working using this <a href=\"http:\/\/www.sitekickr.com\/snippets\/linux\/sendmail-test-command-line\">sendmail test snippet<\/a>.<\/p>\n\n\n\n<h3>Fire it up!<\/h3>\n\n\n\n<p>Now that you have everything installed, it&#8217;s time to start Apache and MySQL.<\/p>\n\n\n\n<p>You can call these programs directly:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/etc\/init.d\/httpd start\n\/etc\/init.d\/mysqld start<\/code><\/pre>\n\n\n\n<p>Or, you can use the <em>systemctl<\/em> command to start them. service is basically a convenience utility to start, stop or restart any daemon located in the \/etc\/init.d directory.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl httpd start\nsystemctl mysqld start\nsystemctl php-fpm start<\/code><\/pre>\n\n\n\n<h3>Make &#8217;em last forever<\/h3>\n\n\n\n<p>Once you start your services, you&#8217;re good to go. For now. But what happens when you need to restart your server (or it restarts automatically for some unforeseen reason, like a power outage)?<\/p>\n\n\n\n<p>Thankfully, the <em>chkconfig<\/em> command has been provided to use to manage our starting lineup. To ensure that both Apache and MySQL start automatically on boot, issue the following two commands:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">systemctl enable httpd --now\nsystemctl enable\u00a0mysqld --now\nsystemctl enable --now php-fpm<\/pre>\n\n\n\n<h3>Configuring Apache<\/h3>\n\n\n\n<p><code>nano \/etc\/httpd\/conf\/httpd.conf<br><\/code><\/p>\n\n\n\n<p>Uncomment this line:<\/p>\n\n\n\n<p><code>#NameVirtualHost *:80<\/code><\/p>\n\n\n\n<p>Then, add any VirtualHost stanzas required, either directly in httpd.conf, or preferably within a separate file. Many use the convention of having a separate file for virtual host directives, called vhosts.conf<\/p>\n\n\n\n<p><code>\/etc\/httpd\/conf.d\/vhosts.conf<br><\/code><\/p>\n\n\n\n<p>After you&#8217;re done setting up your virtual hosts, restart apache.<\/p>\n\n\n\n<p><code>service httpd graceful<br><\/code><\/p>\n\n\n\n<p>By using the <em>graceful <\/em>argument, you&#8217;re telling Apache not restart in the middle of a request. Of course, when first provisioning your server, it&#8217;s not likely that you&#8217;re getting production requests from your web site. But, it&#8217;s a good idea to get in the habit of gracefully restarting your web server.<\/p>\n\n\n\n<p>I&#8217;ve found that some of my CentOs servers tend to fall out of sync with time. The NTP service can be used to keep the server&#8217;s time in sync against a remote time service.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#install ntp\nsudo yum install ntp\n\n# make sure it's starts up after reboot\nsudo \/sbin\/chkconfig ntpd on\n\n# start the ntp service now\nsudo \/etc\/init.d\/ntpd start<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Time: 25 minutes I created this post about provisioning a new CentOS server years ago before CentOS 7 was depreceted. Well, time to update things&hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"amp_status":""},"categories":[41],"tags":[],"_links":{"self":[{"href":"https:\/\/www.sitekickr.com\/blog\/wp-json\/wp\/v2\/posts\/7276"}],"collection":[{"href":"https:\/\/www.sitekickr.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sitekickr.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sitekickr.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sitekickr.com\/blog\/wp-json\/wp\/v2\/comments?post=7276"}],"version-history":[{"count":6,"href":"https:\/\/www.sitekickr.com\/blog\/wp-json\/wp\/v2\/posts\/7276\/revisions"}],"predecessor-version":[{"id":7282,"href":"https:\/\/www.sitekickr.com\/blog\/wp-json\/wp\/v2\/posts\/7276\/revisions\/7282"}],"wp:attachment":[{"href":"https:\/\/www.sitekickr.com\/blog\/wp-json\/wp\/v2\/media?parent=7276"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sitekickr.com\/blog\/wp-json\/wp\/v2\/categories?post=7276"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sitekickr.com\/blog\/wp-json\/wp\/v2\/tags?post=7276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}