#Subsystem sftp /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp

Match Group sftp
        ChrootDirectory %h
        ForceCommand internal-sftp
        AllowTcpForwarding no

The first line changes the SFTP-Subsystem to the internal SFTP-Server which is better for chrooting.
The second line (Match Group sftp) causes the lines below to only affect users in the sftp usergroup.
ChrootDirectory %h binds the users to their home directory so they can’t see what’s outside.
The next line forces internal-sftp and the last one disables TCP forwarding.

That’s it.

Now you have to create a user with the appropriate settings.

groupadd sftp

useradd -d /path/to/the/sftp/folder -s /bin/false -G sftp Username

passwd Username

There is one more thing you have to care about. The home folder of this user has to be owned by root, else you won’t be able to login. Then you can create an upload folder for the user. For example:

chown root:root /path/to/sftp/folder
mkdir /path/to/sftp/folder/uploads
chown Username:Username /path/to/sftp/folder/uploads

I found most of the information about this at this German blog: http://madapez.com/it/linux/howto-chroot-sftp-zugang-openssh-ohne-shell-ssh/

The post Chrooted SFTP Without Shell Access appeared first on Black-Pixel.

Here is the link: http://black-pixel.net/serving-cgi-scripts-with-nginx-on-centos-6.html

I also presuppose that you have a working Postfix configuration.

 

The first step is to install Mailman.

yum install mailman

Next you have to edit your /usr/lib/mailman/Mailman/Defaults.py and change the DEFAULT_URL_PATTERN.

DEFAULT_URL_PATTERN = 'http://%s/mailman/cgi-bin/'

This is the same hierarchy as in the directory at /usr/lib.

Next download this script: http://black-pixel.net/stuff/postfix-to-mailman.tar

Extract the postfix-to-mailman.py into the folder /usr/lib/mailman/bin/.

As a next step, you’ll have to create a Nginx configuration.

vim /etc/nginx/conf.d/lists.example.conf

Add the following lines and adjust you domain:

server {
    server_name  lists.exmaple.com;                   # your domain name

        location /mailman/cgi-bin {
               root /usr/lib;
               fastcgi_split_path_info (^/mailman/cgi-bin/[^/]*)(.*)$;
               include /etc/nginx/fastcgi_params;
               fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
               fastcgi_param PATH_INFO $fastcgi_path_info;
               fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
               fastcgi_intercept_errors on;
               fastcgi_pass unix:/var/run/fcgiwrap.socket;
        }

        location /images/mailman {
               alias /usr/share/images/mailman;
        }

        location /pipermail {
               alias /var/lib/mailman/archives/public;
               autoindex on;
        }
}

That’s it for Nginx, don’t forget to restart it.

The last thing we have to take care of is the Postfix configuration.

postconf -e 'relay_domains = lists.example.com'
postconf -e 'mailman_destination_recipient_limit = 1'

Make sure your local IPv6 adress is at mydestinations = in your main.cf because mailman seems to use it for sending mails.

mydestinations = 127.0.0.1/8, [::1]/128

Next edit the master.cf file and add the following to the bottom:

mailman   unix  -       n       n       -       -       pipe
  flags=FR user=list(i used mailman) argv=/usr/lib/mailman/bin/postfix-to-mailman.py
  ${nexthop} ${user}

Now we need a transport map:

postconf -e 'transport_maps = hash:/etc/postfix/transport'

Edit the new transport file and add the following line:

lists.example.com mailman:

After that:

postmap -v /etc/postfix/transport
service postfix restart

You’re nearly done, add the defaul mailing list called mailman:

/usr/lib/mailman/bin/newlist --urlhost=lists.example.com --emailhost=lists.example.com mailman

Edit your aliases file as told and execute newaliases and postfix restart.

Now you can do the same for any mailing list you want to create.

After that start Mailman and add it to chkconfig.

service mailman start
chkconfig -–levels 2345 mailman on

You can access the Mailman list page at lists.example.com/mailman/cgi-bin/listinfo.

If you have any problems feel free to write a comment and I will try to help you asap. I’m not 100 percent sure if I’ve written everything necessary as I had to tweak around a lot to make it work.

The post Mailman with Postfix and Nginx on CentOS 6 appeared first on Black-Pixel.

As there’s no fcgiwrap package for CentOS 6.0, you must build it yourself. First install some prerequisites:

yum groupinstall 'Development Tools'

yum install fcgi-devel

Now you can build fcgiwrap:

cd /usr/local/src/
git clone git://github.com/gnosek/fcgiwrap.git
cd fcgiwrap
autoreconf -i
./configure
make
make install

This installs fcgiwrap to /usr/local/sbin/fcgiwrap.

1a:

Install the spawn-fcgi package which allows you to run fcgiwrap as a daemon:

yum install spawn-fcgi

1b:

If you are already using spawn-fcgi for php, copy the init.d script and sysconfig of spawn-fcgi

cp -R /etc/init.d/spawn-fcgi /etc/init.d/spawn-fcgi2

cp -R /etc/sysconfig/spawn-fcgi /etc/sysconfig/spawn-fcgi2

Next change the following lines in your spawn-fcgi2 file in /etc/init.d/ to look like this:

prog="spawn-fcgi2"
config="/etc/sysconfig/spawn-fcgi2"

Then modify your new spawn-fcgi configuration in /etc/sysconfig/to look like this:

FCGI_SOCKET=/var/run/fcgiwrap.socket
FCGI_PROGRAM=/usr/local/sbin/fcgiwrap
FCGI_USER=nginx
FCGI_GROUP=nginx
FCGI_EXTRA_OPTIONS="-M 0700"
OPTIONS="-u $FCGI_USER -g $FCGI_GROUP -s $FCGI_SOCKET -S $FCGI_EXTRA_OPTIONS -F 1 -P /var/run/spawn-fcgi.pid -- $FCGI_PROGRAM"

Now you can start it like any other service. Don’t forget to add it to chkconfig via chkconfig –levels 2345 spawn-fcgi on. (or chkconfig –levels 2345 spawn-fcgi2 on depending on your configuration)

The last thing you need to do is to write the nginx configuration.

location /cgi-bin/ {
gzip off;
fastcgi_pass unix:/var/run/fcgiwrap.socket;
include /etc/nginx/fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}

If you want to user another method, visit http://www.howtoforge.com/serving-cgi-scripts-with-nginx-on-debian-squeeze-ubuntu-11.04.

The post Serving CGI Scripts with Nginx on CentOS 6 appeared first on Black-Pixel.

If you haven’t already done it, you have to set up the EPEL repository.

For 32bit:

rpm -Uvh http://download.fedora.redhat.com/pub/epel/6/i386/epel-release-6-5.noarch.rpm

For 64bit:

rpm -Uvh http://download.fedora.redhat.com/pub/epel/6/x86_64/epel-release-6-5.noarch.rpm

Next install Nginx and spawn-fcgi, I assume you have already installed PHP and all the modules you need.

yum install nginx spawn-fcgi

Now it’s time for the spawn-fcgi configuration. The config should be at /etc/sysconfig/spawn-fcgi.

vim /etc/sysconfig/spawn-fcgi

# You must set some working options before the "spawn-fcgi" service will work.
# If SOCKET points to a file, then this file is cleaned up by the init script.
#
# See spawn-fcgi(1) for all possible options.
#
# Example :
#SOCKET=/var/run/php-fcgi.sock
OPTIONS="-a 127.0.0.1 -p 9000 -u nginx -g nginx -C 32 -F 1 -P /var/run/spawn-fcgi.pid -- /usr/bin/php-cgi"

It’s very important that you remember the port, you’ll have to set the same in the nginx configuration. You should also use the same username and group as nginx.
To play it safe, make sure the following line is not commented in the file /etc/init.d/spawn-fcgi:

config="/etc/sysconfig/spawn-fcgi"

Now let’s make sure that spawn-fcgi and nginx automatically start after a reboot.

chkconfig --level 2345 nginx on
chkconfig --level 2345 spawn-fcgi on

For more information about chkconfig check this site: http://www.centos.org/docs/5/html/Deployment_Guide-en-US/s1-services-chkconfig.html

Next up we have to fix a folder permission. The group of the session cookies folder, the address can be found in the php.ini (session.save_path = “/var/lib/php/session”). The folder group has to be changed from apache to whatever you use, e. g. nginx. You should check this after every php update.

As a last step, just add the following line to the /etc/nginx.conf and/or your custom domain configuration in /etc/nginx/conf.d/yourdomain.conf.

location ~ \.php$ {
                include        fastcgi_params;
                fastcgi_pass   localhost:9000;
                fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
        }

You should also make some additional changes in your configuration. I’m going to make another post about some of the settings.

The official wiki is always a good source for help: http://wiki.nginx.org/Configuration

The post Nginx with PHP on CentOS 6 appeared first on Black-Pixel.

TmpFS

This is how you mount a tmpfs volume with 128MB space:

# mkdir -p /mnt/tmp
# mount -t tmpfs -o size=128m tmpfs /mnt/tmp

If you don’t set the size, it will use 50% of the available memory. You can set the size as a normal value (size=128[k,m,g]) or as a percentage value (size=20%).

If you want to see if it worked or how much of the device is used, use the command df -k.

In my opinion, this is the best method to set up a ram device. There is also ramfs, on which tmpfs is based on, but I don’t recommend it.

Don’t forget that you will loose all the data on the ram device if the computer reboots or crashes, so make sure you do regular backups.

For more information, check out this link:

• http://www.thegeekstuff.com/2008/11/overview-of-ramfs-and-tmpfs-on-linux/

The post Ram device with TmpFS appeared first on Black-Pixel.

First open your vsftpd.conf, it should be located in /etc/.

Now add the following lines to enable SSL:

ssl_enable=YES
allow_anon_ssl=NO
force_local_data_ssl=YES
force_local_logins_ssl=YES
ssl_tlsv1=YES
ssl_sslv2=YES
ssl_sslv3=YES

The last thing you need is to specify the SSL files. There are already default files you can use.

# This option specifies the location of the RSA certificate to use for SSL
# encrypted connections.
rsa_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
# This option specifies the location of the RSA key to use for SSL
# encrypted connections.
rsa_private_key_file=/etc/ssl/private/ssl-cert-snakeoil.key

You can also use your own SSL files if you want. You just have to set the appropriate path.

After a restart of Vsftpd, everything should work.

Note: If you’ve just installed vsftpd, you should make some additional configurations depending on your needs.

These are some adjustments I recommend:

# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
# Uncomment this to allow local users to log in.
local_enable=YES
# Uncomment this to enable any form of FTP write command.
write_enable=YES
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
local_umask=022

The post Configure Vsftpd to use FTPS appeared first on Black-Pixel.