install nginx in custombuild

How to install Nginx Last Modified: Jul 11, 2014, 4:28 pm

Nginx is a high performance webserver as a replacement for Apache. However, the higher performance will come at the cost of a slightly reduced feature set, and requires CustomBuild 2.0, and the php mode to be php-fpm. To install Nginx: 1) You must have CustomBuild 2.0.  If you do not, upgrade to CustomBuild 2.0 If unsure of which version of CustomBuild you're using, see this guide. 2) You can either run this in step 2 of the CB2 install guide, or do it after. Run the following to set the options.conf to use Nginx and php-fpm: ./build set webserver nginx ./build set php1_mode php-fpm ./build update ./build all d ./build rewrite_confs

網站安全基礎

Note that it's ultimately the responsibility of the server admin to ensure his system is secure.  These are some basic security tips that can be done to help protect your system.  This is not an end-all guide for server security, admins must be diligent, but rather some suggestions for a start to securing your server.

1. At install time, the easiest thing to do is to mount your /tmp partition with the noexec,nosuid options, and mount the /home partition with the nosuidoption.  This is done in your /etc/fstab and requires those paths to exist as partitions, and not just as subdirectories of /.  If you're unsure, type:
   mount
   to get a listing of your partitions and their current mounting options.  Use google for more information on these mounting options. Be very careful when editing your /etc/fstab, as any errors could prevent your system from starting up.  Note that you must not have "nosuid,noexec" for / or /usr, as those partitions have suid binaries normally (su, passwd, etc).
2. After the system is installed, a good idea is to add dangerous php functions to the disable_functions list.  This prevents php scripts from running "raw" functions that could be used to execute programs on your system.  Note that some php scripts do legitimately require these functions to operate, so if your scripts don't run after enabling this function, edit your php.ini to remove the required functions from the list, and restart apache.  To add the disable_functions with custombuild, type the following then restart apache:
   cd /usr/local/directadmin/custombuild
   ./build update
   ./build secure_php
3. Do regular updates of system services, libraries and scripts.  It's important to keep your system updated once installed.   This is the responsibility of the server administrator.  There are several tools and options avaiable to help the admin do this.  For system libraries like openssl and other low level system items, this is left to the admin to do how he wish, usually package systems like yum or apt-get can do this for you.  For services and scripts that DA installs, you can use the custombuild script.   A typical update command with custombuild is:
   cd /usr/local/directadmin/custombuild
   ./build update
   ./build all d
   Note that in the custombuild directory is a file called "options.conf".  In this file is a list of all options you've got regarding what custombuild will do.   Regarding updates, ensure you have clean_old_webapps=yes present.  This removes all scripts from /var/www/html, after updating you do a new one.     The options.conf also has cron options to check for updates nightly, or even install these options nightly.  I recommend having the nightly cron check, and then a hand-on admin proceed with the update after he gets the notice.  To enable a nightly notice replace the following bold options with your relevant information:
   #Cron settings
   cron=yes
   cron_frequency=weekly
   email=email@domain.com
   notifications=yes
   da_autoupdate=yes
   updates=no
   webapps_updates=yes
   Then type:
   ./build cron
   These are the settings for getting nightly notices for updates, but it won't do the updates for you.
   After getting the notice in your inbox, you'd run the following from the custombuild directory:
   ./build update_versions
   to update just those items that require updating.  Note that doing "./build all d" can be simpler, but takes longer to run.
   If you wish to have "./build update_versions" be run automatically, change the updates=no to become updates=yes.  Just keep in mind that the server admin is still required to be fully aware of the system and it's state if he choses yes for this option.  The webapps_updates option only applies when updates=no is used.  It's there to still allow updates to the php scripts in /var/www/html, while not affecting compiled services.  Set webapps_updates=yes if updates=no and you wish to have automated updates of the webapps scripts with the cron option.  If updates=yes, then the webapps_updates value doesn't matter.  Similarly, using da_autoupdate=yes with updates=no, will update DA when cron is enabled.
   
4. If you're running php in "CLI" mode, then enabling both php SafeMode and open_basedir is wise.  Safemode is an internal form of disable_functions which also does a bit more checking.  See the documentation on Safemode for more info on this.   Open_basedir, which is enabled by default, tells php to not allow scripts to access files outside of the set list of paths.  
   To control SafeMode and Open_Basedir on your php CLI system (default), go to:
   
   Admin Level -> Php Safemode Config
5. suPhp is one option which some admin's like, other's do not.  What suPhp (php CGI) does is runs php scripts as the system user of the account, rather than the "apache" user.   This solves many issues like permission/ownership when a php script uploads files.  It also allows an admin to track down rogue scripts more easily as it's not running as a generic user.  Another benefit of suPhp is that you can chmod your php scripts to 700 instead of 755.  This makes them more secure in the case you're storing passwords in your scripts.   Drawbacks to suPhp include a slight slowdown in performance since there are a few more hoops to jump through to have php run as the user instead of "apache".  Also, the items in point 4) above have no effect since suPhp does not monitor VirtualHost php flags.  All settings must be done in php.ini files.  Note that you can have per-user php.ini files to allow per-user settings, see this link.
   
   To enable suPhp, see this guide.
6. If you don't plan on doing any remote access to mysql, then setting up mysqld to only listen on 127.0.0.1 would be a good idea.  Note you'll have to keep this in mind if your users start asking you why they can't connect to mysql from a remote location.  To set mysql to only bind to 127.0.0.1, add the following to the [mysqld] section of your /etc/my.cnf, then restart mysqld:
   bind-address = 127.0.0.1
7. One filtering option for apache is mod_security.  This is not part of our installation, but mod_security is an apache filter which checks all http requests sent by clients to ensure they're valid.  Note that if not setup correctly, it can break frontpage, or other php scripts that often have long URL requests, so proper setup and testing would be important.  Check our forum for guides on this, it's not covered by our support.
8. A firewall is always a good idea.  Many people use CSF or the block_ip scripts.
9. Set the User's domains directory to block other Users on the system from seeing in:
   http://help.directadmin.com/item.php?id=254
10. Setup your named.conf to not allow recursion.  This should be done by default now, but check anyway with this guide.
11. Prevent Users from using weak passwords by enabling difficult password enforcement.
12. Prevent Users from creating subdomains belonging to other Users with this option.
13. If you're using DirectAdmin with SSL, it's a good idea to force all SSL connections to use TLS instead of other older SSL protocols.
14. To add another layer of security with the permissions of the perl binary, using a trick similar to step 9, run the following:
    chgrp apache /usr/bin/perl /usr/bin/wget /usr/local/bin/wget /usr/local/bin/curl /usr/bin/curl /usr/bin/python
    chmod 705 /usr/bin/perl /usr/bin/wget /usr/local/bin/wget /usr/local/bin/curl /usr/bin/curl /usr/bin/python
    what this will do is tell the system that any user in group "apache" is not allowed to execute /usr/bin/perl.  If you did implement step 9 you could in theory use "access" instead of "apache" for the chgrp value, to also prevent other system account from running it, but apache is the main one.   This technique can be applies to other binaries as well, like wget, fetch, etc.. anything you don't want the "apache" user from running.  Keep in mind that using suPhp (step 5) essentially negates this issue since php scripts run as the user instead.  Note that this is another layer of security, so using it anyway wouldn't hurt anything, in the event that an apache exploit happens independant of php completely.
    Do not block the apache group from running /usr/bin/perl if you are using mod_ruid2
15. Brute Force Login Attempts are more common, so it's best not to have direct ssh logins for common accounts like root or admin.  Generally, it's safe to use a hidden "su" user first, then login to root or other accounts once connected.  Disable any accounts (root, admin, etc) that don't need direct access by editing the /etc/ssh/sshd_config.   Always test changes before logging out else you may lock yourself out from the box.
    
    Also, DirectAdmin has a Brute Force attack detection system for the services, as well as an IP blocker for DA itself.
    More info on that here: http://help.directadmin.com/item.php?id=404
16. Force email logins to use a secure connection:
    http://www.directadmin.com/forum/showthread.php?t=43500
17. Disable 1.2.3.4/~username access, (UserDir on apache):
    cd /usr/local/directadmin/custombuild
    ./build set userdir_access no
    ./build rewrite_confs

For a default CustomBuild 2.0 install with apache, mod_php, and mod_ruid2, start with steps:
2, 3, 8, 11, 13, 15=8, 17, (optionally #1)

租用 Dedicated Server筆記

租用了一台專用主機

紀錄一下筆記：

-- 被安裝好的主機是 Centos 7.0
--起初想要自己加設 centos-webpanel，結果失敗，不行
在 wget centos-webpanel.com  的安裝檔時，一直下載不到 ,.... time out
我在其他 vps就很順利
很奇怪？！

-- 後來要求安裝 DirectAdmin，並移動我的 wordpress網站，他們服務人員就幫我安裝了
幫我設好了

-- 我在自己手動修改 wordpress 的 wp-config 檔、資料庫mysql重建、備份復原
這裡也搞了好久！不熟悉，所以邊研究、邊做

-- 終於可以跑起來 wordpress 網站了，可是我自己用Codecharge寫的php程式，產生 http error 500的錯誤，懷疑是 php 7.2.18的關係

-- 為了試試看，只好再研究，如何降級 php 7.2.18 => 5.6.36

-- 發信給主機服務，他回答說可以參考
https://help.directadmin.com/item.php?id=345
https://www.vultr.com/docs/using-multiple-php-versions-on-directadmin

-- 此時我才知道， DirectAdmin Server 有一個 custombuild 這種東西
好像 DA主機上的軟體、Apache, mysql, php 等，都是由這個軟體來管理的。
難怪之前用 yum 都沒有！

參考資料：

cd /usr/local/directadmin/custombuild
vi options.conf

修改参数 php1_release=的值，例如　php1_release=5.5 ，然后保存，再执行

./build clean
./build update
./build php n

等待完成后，就可以执行php -v查看php的版本了。
注意: 由于是重新执行编译安装，有可能需要较长时间，建议在执行所有命令前，先结合使用screen场景命令。以免中途断开造成失败。

--照這個做：

Using Multiple PHP Versions on DirectAdmin

Published on: Tue, Oct 18, 2016 at 6:41 pm EST

Linux Guides Server Apps System Admin

DirectAdmin has support for running two PHP versions alongside each other. Currently, the most popular combination is PHP 5.6 and 7.0. This way, you can support both legacy software as well as very new and up-to-date software.

In this tutorial, we will be using CustomBuild to run two PHP versions.

Prior to following this tutorial, you will need to make sure you are running CustomBuild 2.0. If this is not the case, please verify and update if needed. A step-by-step guide of how to do this can be found here.

Note: PHP 7 is only supported by DirectAdmin 1.50.1 and newer.

Step 1: Altering the CustomBuild configuration

There are two ways to alter the CustomBuild configuration: directly modifying the options.conf file or using the command line. In this guide, we will be using the command line.

In order to set the two PHP versions 5.6 and 7.0, first navigate to the CustomBuild folder:

cd /usr/local/directadmin/custombuild

Step 2: Setting the PHP versions

Next, run the following commands in order to set the versions:

./build set php1_mode php-fpm
./build set php2_mode php-fpm
./build set php1_release 7.0
./build set php2_release 5.6

Note: Using the above example, both PHP versions will be run in php-fpm mode. This is required if you are using an Nginx and Apache reverse proxy. If you are not using a reverse proxy, you can change the PHP mode if needed.

Using PHP versions older than 5.6 is strongly discouraged as they have all reached their end of life (EOL), thus and no longer updated or maintained. As such, it is recommended that you use PHP 7 whenever possible, and use 5.6 purely for being able to temporarily support legacy applications.

Open the options.conf file:

cd /usr/local/directadmin/custombuild
vi options.conf

Verify the first few lines match or occur at least once throughout the file:

php1_release=7.0
php1_mode=php-fpm
php2_release=5.6
php2_mode=php-fpm

If not, please rerun the commands above.

Step 3: Recompiling PHP

Recompile PHP and rewrite the configurations:

./build php n
./build rewrite_confs

This can take a long time, please don't interrupt the process. It is perhaps best if you ran the commands in a screen session, and detach while the process is running in case your SSH session gets disconnected or interrupted.

Step 4: Setting the PHP versions

You are now able to select a PHP version per virtual host (website). All websites currently running on your DirectAdmin server will use the value set for php1_release. In order to alter the PHP version per website, navigate to the User Level, select the domain name, click "Domain Setup" under "Your Account", click the domain name and scroll down. As demonstrated in the screenshot below, you will now be able to choose a PHP version. Note that after changing the version, it can take up to 1 minute to process the changes. A scheduled restart of the web server is added to the DirectAdmin task queue.

Thank you for reading our guide. You now have a DirectAdmin server running two PHP versions!

======================

結果：

我的 cd /usr/local/directadmin/custombuild

vi options.conf

php1_release=7.2
php1_mode=mod_php
php2_release=5.6
php2_mode=php-fpm

[root@server custombuild]# ./build php n
....... 跑很久.....
[root@server custombuild]# ./build rewrite_confs
Your license OS (CentOS 6) does not match the OS installed (CentOS 7).
Checking to ensure /etc/httpd/conf/ssl.crt/server.ca is set.
Using 162.210.98.121 for your server IP
**************************************

Apache 2.4.27 and higher will not negotiate http2 with mpm_prefork. Please do not use mod_php or disable http2 in the directadmin.conf
http://www.apache.org/dist/httpd/CHANGES_2.4.27

**************************************
Restarting apache.

Service Unavailable

The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.

--- 研究  nginx + apache 組合，

26. How do I switch to nginx+apache combination? (nginx running in front of apache)

Code:

cd /usr/local/directadmin/custombuild
./build update
./build set webserver nginx_apache
./build nginx_apache
./build rewrite_confs

-- 查 custombuild version

cd /usr/local/directadmin/custombuild
./build version

-- 重启APACHE

service httpd restart

成功了！

TO DO:

What is screen 場景命令？

Linux 不熟，有好多東西在研究！

SPAM fighting tools in DirectAdmin

https://help.directadmin.com/item.php?id=577

哇！被稱為面板之神，方便到了極點？！http://www.baddb.com/51.html

DirectAdmin面板之神插件custombuild（2.0）

 2017年3月5日  0条评论  926次阅读  0人点赞

• 官方说明http://forum.directadmin.com/showthread.php?t=44743
• 目前的版本是 custombuild v2.0.0　，安装directadmin后默认其实已经自带安装了custombuild功能，但是仅为指令化方式使用。
• custombuild帮助directadmin使用者以最简单的方式安装和生产调整环境版本，几乎囊括所有主要的主流程序以及版本，方便到了极点。

可以在安装有directadmin面板的环境中执行以下命令行来查看是否安装有custombuild及custombuild的具体版本

custombuild版本检测:

/usr/local/directadmin/custombuild/build version

如果使用的还是v1.*版本，可以按照directadmin官方文档进行升级到 custombuild v2.0
具体参考文档 https://help.directadmin.com/item.php?id=555

OBS使用視窗擷取網頁會黑畫面的解決方式

我是用Win10的系統。
準備開OBS實況網頁遊戲時發現抓到網頁都是黑的畫面。

以前沒出現過這情況，我想是不是Win10或者是更新的問題。
所以找尋了解決方式。

------------------------------------------------------------------------

中文找不到相關問題資料，
只好跑OBS官網論壇找英文資料了。

發現到也有人跟我同樣的問題，
察看結果答案是 要把 網頁閱覽器的硬體加速關掉。

-----------------------------------------------------------------------------

由於我只使用 Chrome ，
所以只說明 Chrome 關閉的方法。

方法很簡單，
首先 進入 設定 (也可以在網址打 chrome://settings/ )，
把下面的 顯示進階設定 打開，
找到 系統 的標頭，

把 在可用時使用硬體加速 的勾勾關掉就行了。

躲避圖檔Cache的小妙方

如果系統有裝置Cache，圖檔就會留在cache，此時，你雖然程式改了，例如：產生QRCode圖檔，可能測試看到的還是舊的。不知道有沒有改成。
需要再去清除Cache，才能正確看到修改後的圖檔。
Cache會存在 Server端、Proxy、還有瀏覽器，全部都要去清除cache，改一次刪一次，花許多時間。
為了減省時間，有個小妙招：測試時，產生的圖檔，改個檔案名稱，例如後面加個數字，這樣就好了。
等程式設計完成，測試完成了，再來改回正式需要的檔案名稱，做一次清除cache就可以了。
這樣可以節省不少時間喔！

製作複製且不啟動Form的button

我用Javascript設計了一個複製功能，button ，同時裡面有個Form。
如果按了 button，就會執行 Form 的 summit，我不要他執行，怎麼辦？

查了網路，發現：將該 button 這樣設就好了：type="button"

<button type="button">複製</button>


<input value="要複製的內容123456" style="display:none;"/>
<button class="copy_coupon" type="button">點擊複製</button>
</div>

<script>
window.Clipboard = (function(window, document, navigator) {
var textArea,
copy;

function isOS() {
return navigator.userAgent.match(/ipad|iphone/i);
}

function createTextArea(text) {
textArea = document.createElement('textArea');
textArea.value = text;
document.body.appendChild(textArea);
}

function selectText() {
var range,
selection;

if (isOS()) {
range = document.createRange();
range.selectNodeContents(textArea);
selection = window.getSelection();
selection.removeAllRanges();
selection.addRange(range);
textArea.setSelectionRange(0, 999999);
} else {
textArea.select();
}
}

function copyToClipboard() {
document.execCommand("Copy");
document.body.removeChild(textArea);
}

copy = function(text) {
createTextArea(text);
selectText();
copyToClipboard();
};

return {
copy: copy
};
})(window, document, navigator);

$(".copy_coupon").on("click", function() {
var $this = $(this),
value = $this.prev("input").val();
window.Clipboard.copy(value);
});
</script>

CodeCharge 的 Security Group 很好用

CodeCharge 的Security 都已經設計好了，拿來用就可以了。
還蠻好用的。

可以有

Site Level
Page Level
Form Level

三個Level ，分別有權限管控。

問題：不符合權限時，警告訊息要如何顯現呢？