RootForum Community

Code: Select all

vi /etc/rc.conf 

fsck_y_enable="YES"                             # "NO"
firewall_enable="YES"                           # "NO"
firewall_script="/etc/ipfw.rules"               # "/etc/rc.firewall"
tcp_drop_synfin="YES"                           # "NO"
icmp_drop_redirect="YES"                        # "NO"
syslogd_flags="-ss"                             # "-s"
sshd_enable="YES"                               # "NO"
ntpdate_enable="YES"                            # "NO"
ntpdate_flags="-b -s -4"                        # "-b"
ntpdate_hosts="ptbtime2.ptb.de"                 # ""
keymap="german.iso"                             # "NO"
font8x16="ISO8859-1"                      # "NO"
font8x14="ISO8859-1"                      # "NO"
font8x8="ISO8859-1"                       # "NO"
sendmail_submit_enable="NO"                     # "YES"
sendmail_outbound_enable="NO"                   # "YES"
sendmail_msp_queue_enable="NO"                  # "YES"
cron_flags="$cron_flags -J 15"                  # ""
nginx_enable="YES"                              # "<not defined>"
php_fpm_enable="YES"                            # "<not defined>"
mysql_enable="YES"                              # "<not defined>"
proftpd_enable="YES"                            # "<not defined>"
linux_enable="YES"

vi /etc/src.conf

WITH_BIND_SIGCHASE=YES
WITH_ICONV=YES

vi /etc/make.conf

THREAD=8
INSTALL_NODEBUG=YES
INSTALL_NODEBUG=YES
MASTER_SITE_BACKUP?= http://ftp4.de.freebsd.org/pub/FreeBSD/ports/distfiles/${DIST_SUBDIR}/
MASTER_SITE_OVERRIDE?= ${MASTER_SITE_BACKUP}

KERNCONF?=GENERIC
CPUTYPE?=opteron
CFLAGS= -O2 -fno-strict-aliasing -pipe
CXXFLAGS+= -fconserve-space
COPTFLAGS= -O -pipe
PRINTERDEVICE=ascii
SUP_UPDATE=
SUP=/usr/bin/csup
SUPFLAGS= -g -L 2
SUPHOST=cvsup.de.FreeBSD.org
SUPFILE=/usr/share/examples/cvsup/standard-supfile
WITHOUT_X11=YES

csup -L 2 -h cvsup.FreeBSD.org /usr/share/examples/cvsup/ports-supfile && 
portsnap fetch 
portsnap extract 
portsnap update 

cd /usr/ports/ports-mgmt/portupgrade && make install clean && rehash 

cd /usr/ports/devel/subversion && make install clean && rehash 

cd /usr/src && fetch http://ftp4.de.freebsd.org/pub/FreeBSD/releases/amd64/9.1-RELEASE/src.txz && tar -C / -xvzf src.txz && rm src.txz

portinstall portmaster && portinstall portaudit

mkdir -p /usr/compat/linux/proc
ln -s /usr/compat /compat

vi /etc/fstab

linproc /compat/linux/proc linprocfs    rw      0       0
fdesc   /dev/fd         fdescfs         rw      0       0
proc    /proc           procfs          rw      0       0

mount -t fdescfs fdesc /dev/fd
mount -t procfs proc /proc
mount linproc

cd /usr/ports/emulators/linux_base-f10
make install clean

cd /usr/ports/distfiles

fetch ftp://ftp.tmn.ru/pub/FreeBSD/distfiles/mc-4.8.1.7.tar.xz

portinstall htop 
portinstall vim 
portinstall mc 
portinstall wget wput gzip zip 
portinstall -c sshguard-ipfw

cd /usr/ports/ftp/proftpd && make config
cd /usr/ports/databases/mariadb55-server && make config
cd /usr/ports/databases/mariadb55-client && make config
cd /usr/ports/www/nginx && make config
cd /usr/ports/lang/php5 && make config
cd /usr/ports/lang/php5-extensions && make config
cd /usr/ports/databases/phpmyadmin && make config
cd /usr/ports/print/pdflib && make conifg

mkdir -p /opt/conf
cd /opt/conf
wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
gunzip ./GeoIP.dat.gz

vim /etc/ipfw.rules

IPF="ipfw -q add"
ipfw -q -f flush

#loopback
$IPF allow all from any to any via lo0
$IPF deny all from any to 127.0.0.0/8
$IPF deny all from 127.0.0.0/8 to any
$IPF deny tcp from any to any frag

# statefull
$IPF check-state
$IPF allow tcp from any to any established
$IPF allow all from any to any out keep-state
$IPF allow icmp from any to any

# Erlaube FTP
$IPF allow tcp from any to any 21 in setup
$IPF allow tcp from any 20 to any 1024-65535 in setup

# passive mode FTP erlauben - nicht empfohlen - wird ins log geschrieben
# um Missbrauch nachvollziehen zu koennen
$IPF allow log tcp from any 1024-65535 to any 1024-65535 in setup

# open port ssh (22), mail (25)
$IPF allow tcp from any to any 22 in
$IPF allow tcp from any to any 22 out
$IPF allow udp from any to any 53 in
$IPF allow tcp from any to any 53 in
$IPF allow udp from any to any 53 out
$IPF allow tcp from any to any 53 out

# http (80), dns (53) 
$IPF allow udp from any to any 80 in
$IPF allow tcp from any to any 80 in
$IPF allow udp from any to any 443 in
$IPF allow tcp from any to any 443 in
$IPF allow udp from any to any 445 in
$IPF allow tcp from any to any 445 in
$IPF allow udp from any to any 8080 in
$IPF allow tcp from any to any 8080 in

# Mail  110 143 25 465 585 993 995
$IPF allow tcp from any to any 25 in
$IPF allow tcp from any to any 25 out
$IPF allow tcp from any to any 110 in
$IPF allow tcp from any to any 110 out
$IPF allow tcp from any to any 143 in
$IPF allow tcp from any to any 143 out
$IPF allow tcp from any to any 465 in
$IPF allow tcp from any to any 465 out
$IPF allow tcp from any to any 585 in
$IPF allow tcp from any to any 585 out
$IPF allow tcp from any to any 993 in
$IPF allow tcp from any to any 993 out
$IPF allow tcp from any to any 995 in
$IPF allow tcp from any to any 995 out

#Default deny
$IPF deny all from any to any

echo 'firewall_enable="YES"' >> /etc/rc.conf 
echo 'firewall_script="/etc/ipfw.rules"' >> /etc/rc.conf

echo '59  2  *  *  *  root  /usr/sbin/ntpdate -b -s -4 ptbtime2.ptb.de' >> /etc/crontab

ipfw im kernel kompilieren:

cd /usr/obj
chflags -R noschg *
rm -rf *

grep IPFIREWALL /usr/src/sys/amd64/conf

cd /usr/src/sys/amd64/conf

cp GENERIC IPFWKERNEL

vim IPFWKERNEL

ihr fügt nun folgendes ein

machine   amd64
cpu       HAMMER
ident     GENERIC

options IPFIREWALL # required for IPFW
options IPFIREWALL_VERBOSE # optional; logging
options IPFIREWALL_VERBOSE_LIMIT=10 # optional; don't get too many log entries
options IPDIVERT # needed for natd

cd /usr/src

make buildkernel KERNCONF=IPFWKERNEL

make installkernel KERNCONF=IPFWKERNEL

reboot

Code: Select all

server {
        listen 80;
        server_name db.xxxxxxx.de;

        error_page 503 /usr/local/www/nginx-dist/500.html;
        error_page 403 /usr/local/www/nginx-dist/403.html;
        error_page 404 /usr/local/www/nginx-dist/404.html;

        root /var/www/vhost1/db.xxxxxxx.de/;
        index index.php index.html index.htm;

        proxy_cache_valid 200 302 1h;
        proxy_cache_valid 301 24h;
        proxy_cache_valid any 10m;

        location ~* \.(jpe?g|gif|png|ico|css|zip|tgz|gz|rar|bz2|doc|xls|exe|pdf|ppt|txt|tar|mid|midi|wav|bmp|rtf|js|swf|avi|mp3|mov|docx|pptx|xlsx|cfg|odt)$ {
                expires 864000;

        root    /var/www/vhost1/db.xxxxxx.de/;
        }
        location / {
                index index.php;
                try_files $uri $uri/ /index.php?q=$uri&$args;
                autoindex                   off;
                autoindex_exact_size        off;
                autoindex_localtime         off;
        }
        location ~ \.php$ {
                fastcgi_split_path_info ^(.+\.php)(/.+)$;
                fastcgi_pass unix:/var/run/php-fpm.sock;
                proxy_cache_key "$scheme://$host$request_uri $do_not_cache";
                proxy_cache staticfilecache;
                fastcgi_index index.php;
                fastcgi_param GEOIP_COUNTRY_CODE $geoip_country_code;
                fastcgi_param GEOIP_COUNTRY_NAME $geoip_country_name;
                fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
                include fastcgi_params;
        }
        location ~ /\.ht {
                deny all;
        }
}

Code: Select all

<?php
/* vim: set expandtab sw=4 ts=4 sts=4: */
/**
 * phpMyAdmin sample configuration, you can use it as base for
 * manual configuration. For easier setup you can use setup/
 *
 * All directives are explained in Documentation.html and on phpMyAdmin
 * wiki <http://wiki.phpmyadmin.net>.
 *
 * @package PhpMyAdmin
 */

/*
 * This is needed for cookie based authentication to encrypt password in
 * cookie
 */
$cfg['blowfish_secret'] = 'xxxxxxxx'; /* YOU MUST FILL IN THIS FOR COOKIE AUTH! */

/*
 * Servers configuration
 */
$i = 0;

/*
 * First server
 */
$i++;
/* Authentication type */
$cfg['Servers'][$i]['auth_type'] = 'cookie';
/* Server parameters */
$cfg['Servers'][$i]['host'] = 'localhost';
$cfg['Servers'][$i]['connect_type'] = 'tcp';
$cfg['Servers'][$i]['compress'] = false;
/* Select mysql if your server does not have mysqli */
$cfg['Servers'][$i]['extension'] = 'mysqli';
$cfg['Servers'][$i]['AllowNoPassword'] = false;

/*
 * phpMyAdmin configuration storage settings.
 */

/* User used to manipulate with storage */
$cfg['Servers'][$i]['controlhost'] = 'localhost';
$cfg['Servers'][$i]['controluser'] = 'pma';
$cfg['Servers'][$i]['controlpass'] = 'xxxxxxx';

/* Storage database and tables */
$cfg['Servers'][$i]['pmadb'] = 'phpmyadmin';
$cfg['Servers'][$i]['bookmarktable'] = 'pma_bookmark';
$cfg['Servers'][$i]['relation'] = 'pma_relation';
$cfg['Servers'][$i]['table_info'] = 'pma_table_info';
$cfg['Servers'][$i]['table_coords'] = 'pma_table_coords';
$cfg['Servers'][$i]['pdf_pages'] = 'pma_pdf_pages';
$cfg['Servers'][$i]['column_info'] = 'pma_column_info';
$cfg['Servers'][$i]['history'] = 'pma_history';
$cfg['Servers'][$i]['table_uiprefs'] = 'pma_table_uiprefs';
$cfg['Servers'][$i]['tracking'] = 'pma_tracking';
$cfg['Servers'][$i]['designer_coords'] = 'pma_designer_coords';
$cfg['Servers'][$i]['userconfig'] = 'pma_userconfig';
$cfg['Servers'][$i]['recent'] = 'pma_recent';
/* Contrib / Swekey authentication */
// $cfg['Servers'][$i]['auth_swekey_config'] = '/etc/swekey-pma.conf';

/*
 * End of servers configuration
 */

/*
 * Directories for saving/loading files from server
 */
$cfg['UploadDir'] = '';
$cfg['SaveDir'] = '';

Code: Select all

extension=ctype.so
extension=dom.so
extension=filter.so
extension=hash.so
extension=iconv.so
extension=json.so
extension=pdo.so
extension=pdo_sqlite.so
extension=phar.so
extension=posix.so
extension=session.so
extension=simplexml.so
extension=sqlite3.so
extension=tokenizer.so
extension=xml.so
extension=xmlreader.so
extension=xmlwriter.so
extension=mysql.so
extension=mysqli.so
extension=bcmath.so
extension=bz2.so
extension=mbstring.so
extension=xsl.so
extension=apc.so
extension=mcrypt.so
extension=openssl.so
extension=gd.so
extension=pdf.so
extension=zip.so
extension=calendar.so
extension=gettext.so
extension=gmp.so
extension=mssql.so
extension=curl.so
extension=dba.so
extension=exif.so
extension=fileinfo.so
extension=ftp.so
extension=interbase.so
extension=ldap.so
extension=odbc.so
extension=pcntl.so