07-05-2020

-La section Distributions regroupe Solus, Mint et Debian -Section Windows
2020-05-07 13:43:00 +02:00
parent 7e64b5c348
commit 6103008715
39 changed files with 1198 additions and 59 deletions
--- a/docs/Distributions/Mint/webserver.md
+++ b/docs/Distributions/Mint/webserver.md
@@ -0,0 +1,670 @@
+# Nginx / PHP / MySQL
+
+
+
+## Installer un serveur web
+
+
+
+#### Installer Nginx:
+
+```bash
+$ sudo apt-get install nginx
+```
+
+##### Version de Nginx:
+
+```bash
+$ nginx -v
+nginx version: nginx/1.14.0 (Ubuntu)
+```
+
+##### Démarrer,activer et vérifier l'étât du service Nginx.
+
+```bash
+$ sudo systemctl start nginx.service
+$ sudo systemctl enable nginx.service
+$ sudo systemctl status nginx.service
+```
+
+```bash
+# ps -ef | grep -i nginx
+
+root     18596 13:16 nginx: master process ./nginx
+nobody   18597 13:16 nginx: worker process
+```
+
+
+
+https://www.nginx.com/resources/wiki/start/
+
+https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/
+
+https://wiki.debian.org/Nginx/DirectoryStructure
+
+##### Arborescence:
+
+```bash
+bruno@MintBook:/etc/nginx$ tree
+.
+├── conf.d
+├── fastcgi.conf
+├── fastcgi_params
+├── koi-utf
+├── koi-win
+├── mime.types
+├── modules-available
+├── modules-enabled
+│   ├── 50-mod-http-geoip.conf -> /usr/share/nginx/modules-available/mod-http-geoip.conf
+│   ├── 50-mod-http-image-filter.conf -> /usr/share/nginx/modules-available/mod-http-image-filter.conf
+│   ├── 50-mod-http-xslt-filter.conf -> /usr/share/nginx/modules-available/mod-http-xslt-filter.conf
+│   ├── 50-mod-mail.conf -> /usr/share/nginx/modules-available/mod-mail.conf
+│   └── 50-mod-stream.conf -> /usr/share/nginx/modules-available/mod-stream.conf
+├── nginx.conf
+├── proxy_params
+├── scgi_params
+├── sites-available
+│   └── default
+├── sites-enabled
+│   └── default -> /etc/nginx/sites-available/default
+├── snippets
+│   ├── fastcgi-php.conf
+│   └── snakeoil.conf
+├── uwsgi_params
+└── win-utf
+```
+
+##### Configuration:
+
+Le fichier `/etc/nginx/nginx.conf` contient la configuration générale de nginx.
+
+```nginx
+user www-data;
+```
+
+
+
+Créer un fichier qui contiendra les configurations du site dans le répertoire `/etc/nginx/sites-available/`.
+Le dossier contient déjà un fichier par défaut: `/etc/nginx/sites-available/default`
+
+```bash
+$ cd /etc/nginx/sites-available/
+$ sudo cp default mint
+$ sudo gedit mint
+```
+
+Modifier les lignes:
+
+- root: le dossier root du site
+- index: ajouter index.php
+- server_name
+
+Dé-commenter les lignes:
+
+- include snippets/fastcgi-php.conf;
+- fastcgi_pass unix:/run/php/php7.2-fpm.sock;
+
+```nginx
+server {
+	listen 80 default_server;
+	listen [::]:80 default_server;
+
+	# SSL configuration
+	#
+	# listen 443 ssl default_server;
+	# listen [::]:443 ssl default_server;
+	#
+	# Note: You should disable gzip for SSL traffic.
+	# See: https://bugs.debian.org/773332
+	#
+	# Read up on ssl_ciphers to ensure a secure configuration.
+	# See: https://bugs.debian.org/765782
+	#
+	# Self signed certs generated by the ssl-cert package
+	# Don't use them in a production server!
+	#
+	# include snippets/snakeoil.conf;
+
+	root /home/bruno/Sites;
+
+	# Add index.php to the list if you are using PHP
+	index index.php index.html index.htm;
+
+	server_name mintbook.local;
+
+  access_log /var/log/nginx/access_log;
+	error_log /var/log/nginx/error_log;
+  
+	location / {
+		# First attempt to serve request as file, then
+		# as directory, then fall back to displaying a 404.
+		try_files $uri $uri/ =404;
+	}
+
+	# pass PHP scripts to FastCGI server
+	#
+	location ~ \.php$ {
+		include snippets/fastcgi-php.conf;
+	#
+	#	# With php-fpm (or other unix sockets):
+		fastcgi_pass unix:/run/php/php7.2-fpm.sock;
+	#
+	#	# With php-cgi (or other tcp sockets):
+	#	fastcgi_pass 127.0.0.1:9000;
+	}
+
+	# deny access to .htaccess files, if Apache's document root
+	# concurs with nginx's one
+	#
+	#location ~ /\.ht {
+	#	deny all;
+	#}
+}
+```
+
+
+
+Donner les droits à Nginx pour le dossuier root:
+
+```bash
+$ sudo chown -R www-data:www-data /home/bruno/Sites
+```
+
+
+
+Déclarer le socket Unix de PHP-FPM au niveau de Nginx: il faut modifier ou créer le fichier `/etc/nginx/conf.d/php7-fpm.conf`
+
+```nginx
+upstream php7.2-fpm-sock {
+        server unix:/run/php/php7.2-fpm.sock;
+}
+```
+
+
+
+Créer ensuite un lien symbolique de ce fichier dans le répertoire `/etc/nginx/sites-enabled/` afin d’activer le site.
+
+ Il est à noter que pour désactiver le site temporairement il suffit de supprimer le lien symbolique qui est dans `sites-enabled` et pour le réactiver, il faut refaire un lien symbolique avec le fichier qui se trouve dans `site-available`.
+
+```bash
+$ cd  /etc/nginx/sites-enabled/
+$ ln -s /etc/nginx/sites-available/mint  mint
+
+$ ls -la
+total 8
+drwxr-xr-x 2 root root 4096 mai   30 12:56 .
+drwxr-xr-x 8 root root 4096 mai   30 10:40 ..
+lrwxrwxrwx 1 root root   34 mai   30 10:40 default -> /etc/nginx/sites-available/default
+lrwxrwxrwx 1 root root   31 mai   30 12:56 mint -> /etc/nginx/sites-available/mint
+
+$ sudo rm default
+```
+
+
+
+##### Tester la configuration Nginx:
+
+```bash
+$ sudo nginx -t
+nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
+nginx: configuration file /etc/nginx/nginx.conf test is successful
+```
+
+##### Relancer Nginx:
+
+```bash
+$ sudo service nginx reload
+```
+
+
+
+##### Commandes Nginx:
+
+Démarrer nginx:  `$ sudo systemctl start nginx`
+
+Arrêter nginx: `$ sudo systemctl stop nginx`
+
+Redémarrer nginx: `$ sudo systemctl restart nginx`
+
+Recharger nginx après une modification de configuration: `$ sudo systemctl reload nginx`
+
+Désactiver le démarrage auto de nginx avec le système: `$ sudo systemctl disable nginx`
+
+Activer le démarrage auto de nginx avec le système: `$ sudo systemctl enable nginx`
+
+
+
+##### Vérifier l'étât de Nginx:
+
+```bash
+$ systemctl status nginx
+● nginx.service - A high performance web server and a reverse proxy server
+   Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
+   Active: active (running) since Thu 2019-05-30 10:40:04 CEST; 21h ago
+     Docs: man:nginx(8)
+ Main PID: 19485 (nginx)
+    Tasks: 9 (limit: 4915)
+   CGroup: /system.slice/nginx.service
+           ├─19485 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
+           ├─30594 nginx: worker process
+           ├─30595 nginx: worker process
+           ├─30596 nginx: worker process
+           ├─30597 nginx: worker process
+           ├─30598 nginx: worker process
+           ├─30599 nginx: worker process
+           ├─30600 nginx: worker process
+           └─30601 nginx: worker process
+
+```
+
+
+
+#### HTTPS:
+
+https://linoxide.com/linux-how-to/create-self-signed-ssl-certificate-nginx-ubuntu/
+
+https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-nginx-in-ubuntu-18-04
+
+
+
+##### Créer une clé et un certificat. auto-signé:
+
+```bash
+$ sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/mintbook.local.key -out /etc/ssl/certs/mintbook.local.crt
+[sudo] password for bruno:          
+Generating a 2048 bit RSA private key
+...........+++
+.................+++
+
+## writing new private key to '/etc/ssl/private/mintbook.local.key'
+
+You are about to be asked to enter information that will be incorporated
+into your certificate request.
+What you are about to enter is what is called a Distinguished Name or a DN.
+There are quite a few fields but you can leave some blank
+For some fields there will be a default value,
+
+## If you enter '.', the field will be left blank.
+
+Country Name (2 letter code) [AU]:FR
+State or Province Name (full name) [Some-State]:Bourgogne
+Locality Name (eg, city) []:Dijon
+Organization Name (eg, company) [Internet Widgits Pty Ltd]:clicclac.info
+Organizational Unit Name (eg, section) []:Web
+Common Name (e.g. server FQDN or YOUR name) []:mintbook.local
+Email Address []:enzo@clicclac.info
+
+```
+
+##### Paramètres Diffie-Hellman (DH):
+
+```
+$ sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
+Generating DH parameters, 2048 bit long safe prime, generator 2
+This is going to take a long time
+..........................................+.....+..
+
+```
+
+##### Configuration SSL:
+
+```bash
+$ sudo nano /etc/nginx/snippets/self-signed.conf
+
+```
+
+```ini
+ssl_certificate /etc/ssl/certs/mintbook.local.crt;
+ssl_certificate_key /etc/ssl/private/mintbook.local.key;
+
+```
+
+
+
+```bash
+$ sudo nano /etc/nginx/snippets/ssl-params.conf
+
+```
+
+```ini
+ssl_protocols TLSv1.2;
+ssl_prefer_server_ciphers on;
+ssl_dhparam /etc/ssl/certs/dhparam.pem;
+ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384;
+ssl_ecdh_curve secp384r1; # Requires nginx >= 1.1.0
+ssl_session_timeout  10m;
+ssl_session_cache shared:SSL:10m;
+ssl_session_tickets off; # Requires nginx >= 1.5.9
+ssl_stapling on; # Requires nginx >= 1.3.7
+ssl_stapling_verify on; # Requires nginx => 1.3.7
+resolver 8.8.8.8 8.8.4.4 valid=300s;
+resolver_timeout 5s;
+
+# Disable strict transport security for now. You can uncomment the following
+
+# line if you understand the implications.
+
+# add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
+
+add_header X-Frame-Options DENY;
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
+
+```
+
+
+
+```bash
+$ cd /etc/nginx/sites-available
+$ sudo cp mint mint-ssl
+$ sudo gedit mint-ssl 
+
+```
+
+```ini
+# SSL configuration
+#
+listen 443 ssl default_server;
+listen [::]:443 ssl default_server;
+#
+# Note: You should disable gzip for SSL traffic.
+# See: https://bugs.debian.org/773332
+#
+# Read up on ssl_ciphers to ensure a secure configuration.
+# See: https://bugs.debian.org/765782
+#
+# Self signed certs generated by the ssl-cert package
+# Don't use them in a production server!
+#
+# include snippets/snakeoil.conf;
+include snippets/self-signed.conf;
+include snippets/ssl-param.conf;
+
+```
+
+#### Installer PHP:
+
+```bash
+$ sudo apt-get install php-fpm
+
+```
+
+```bash
+$ which php
+/usr/bin/php
+
+$ php -v
+PHP 7.2.17-0ubuntu0.18.04.1 (cli) (built: Apr 18 2019 14:12:38) ( NTS )
+Copyright (c) 1997-2018 The PHP Group
+Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
+    with Zend OPcache v7.2.17-0ubuntu0.18.04.1, Copyright (c) 1999-2018, by Zend Technologies
+
+```
+
+
+
+##### Configurer PHP-FPM:
+
+- PHP et Nginx sur la même machine => socket Unix
+- PHP et Nginx sur la même machine => socket TCP
+
+
+
+```bash
+$ sudo gedit /etc/php/7.2/fpm/pool.d/www.conf
+
+```
+
+Vérifier que PHP-Fpm utilise le Socket Unix (NGINX et PHP sur la même machine):
+
+```bash
+;listen = 127.0.0.1:9000
+listen = /run/php/php7.2-fpm.sock
+
+```
+
+
+
+##### Configurer PHP.ini:
+
+```bash
+$ nano /etc/php/7.2/fpm/php.ini
+
+```
+
+```ini
+file_uploads = On
+allow_url_fopen = On
+memory_limit = 256M
+upload_max_filesize = 64M
+cgi.fix_pathinfo = 0
+upload_max_filesize = 100M
+max_execution_time = 360
+date.timezone = Europe/Paris
+
+```
+
+*cgi.fix_pathinfo : l’activation de ce paramètre permet à PHP de n’accepter que les URI qui existent réellement sur le serveur.*
+
+
+
+##### Configurer Nginx:
+
+```bash
+$ sudo gedit /etc/nginx/sites-availables
+
+```
+
+Activer php:
+
+```nginx
+location ~ \.php$ {
+	include snippets/fastcgi-php.conf;
+#
+#	# With php-fpm (or other unix sockets):
+	fastcgi_pass unix:/run/php/php7.2-fpm.sock;
+#
+#	# With php-cgi (or other tcp sockets):
+#	fastcgi_pass 127.0.0.1:9000;
+}
+
+```
+
+Redémarrer le service php-fpm:
+
+```bash
+$ sudo service php7.2-fpm restart
+
+```
+
+
+
+##### Installer les modules PHP manquants:
+
+Dans le Gestionnaire de paquets Synaptic, installer les modules GD, MySQL...
+
+Manque: apcu, gmp, odbc, yaml
+
+ou
+
+```bash
+$ sudo apt-cachesearch php- | less
+$ sudo apt-get install "module name"
+$ sudo apt-cache show "module name"
+
+```
+
+
+
+#### Installer MySQL (MariaDB):
+
+```bash
+$ sudo apt-get -y install mariadb-server mariadb-client
+
+```
+
+##### Démarrer, activer et vérifier l'étât du service MariaDB:
+
+```bash
+$ sudo systemctl start mysql.service
+$ sudo systemctl enable mysql.service
+$ sudo systemctl status mysql.service
+
+```
+
+
+
+##### Securiser l'installation de MariaDB:
+
+```bash
+$ sudo mysql_secure_installation
+
+Enter current password for root (enter for none): Enter Your Current Password
+OK, successfully used password, moving on...
+
+Set root password? [Y/n] n
+ ... skipping.
+
+Remove anonymous users? [Y/n] y
+ ... Success!
+
+Disallow root login remotely? [Y/n] y
+ ... Success!
+
+Remove test database and access to it? [Y/n] y
+
+- Dropping test database...
+  ... Success!
+- Removing privileges on test database...
+  ... Success!
+
+Reload privilege tables now? [Y/n] y
+ ... Success!
+
+Cleaning up...
+
+All done!  If you've completed all of the above steps, your MariaDB
+installation should now be secure.
+
+Thanks for using MariaDB!
+
+```
+
+~~l/p: root/sncfp1p2~~
+
+
+
+##### Désinstaller mysql:
+
+```bash
+    $ sudo service mysql stop
+    $ sudo apt-get remove --purge mysql*
+    $ sudo apt-get autoremove
+    $ sudo apt-get autoclean
+    $ sudo rm -rf /var/lib/mysql
+    $ sudo rm -rf /etc/mysql
+
+```
+
+
+
+##### Se connecter à MySQL:
+
+```bash
+$ sudo mysql -u root -p
+Enter password: 
+Welcome to the MariaDB monitor.  Commands end with ; or \g.
+Your MariaDB connection id is 49
+Server version: 10.1.38-MariaDB-0ubuntu0.18.04.2 Ubuntu 18.04
+
+Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
+
+Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
+
+MariaDB [(none)]> 
+
+```
+
+
+
+##### Depuis ubuntu 18.04
+
+Se logguer dans mysql en root.
+
+Créer un utilisateur et lui donner tous les droits:
+
+```mysql
+CREATE USER 'username'@'localhost' IDENTIFIED BY 'the_password';
+GRANT ALL PRIVILEGES ON *.* TO 'username'@'localhost' WITH GRANT OPTION;
+
+```
+
+Créer un utilisateur avec le même nom et lui donner tous les droits:
+
+```mysql
+CREATE USER 'username'@'%' IDENTIFIED BY 'the_password';
+GRANT ALL PRIVILEGES ON *.* TO 'username'@'%' WITH GRANT OPTION;
+
+```
+
+Le compte 'username'@‘localhost' est utilisé quand on se connecte depuis la machine locale.
+Le compte 'username'@'%' est utilisé pour se connecter depuis n'importe quelle machine.
+
+```mysql
+SHOW GRANTS FOR username;
+FLUSH PRIVILEGES;
+
+```
+
+
+
+#### Configurer le firewall ubuntu:
+
+```bash
+$ sudo ufw app list
+[sudo] password for bruno:          
+Available applications:
+  CUPS
+  Nginx Full
+  Nginx HTTP
+  Nginx HTTPS
+  syncthing
+  syncthing-gui
+
+```
+
+<u>Liste les profils disponibles:</u>
+
+Profile Nginx Full: ouvre les ports 80 (http) et 443 (https)
+Profile Nginx HTTP: ouvre les ports 80 (http)
+Profile Nginx HTTPS: ouvre les ports 443 (https)
+
+
+
+##### Activer le profile  Nginx Full:
+
+```bash
+$ sudo ufw allow 'Nginx Full'
+Rule added
+Rule added (v6)
+
+```
+
+##### Status du firewall:
+
+```bash
+$ sudo ufw status
+Status: active
+
+To                         Action      From
+
+------
+
+Nginx Full                 ALLOW       Anywhere                  
+Nginx Full (v6)            ALLOW       Anywhere (v6)     
+
+```
+
+
+
+####