Setting up Postfix

dpkg-reconfigure postfix
# Internet Site
# unexpectedit.com

Setting up rDNS on Amazon

Go to https://aws-portal.amazon.com/gp/aws/html-forms-controller/contactus/ec2-email-limit-rdns-request
Elastic IP Address 1: 107.123.23.123
Reverse DNS Record for EIP 1: mail1.unexpectedit.com

Setting up SPF Records

Add to your domain TXT pointing to @
v=spf1 a ip4:107.123.23.123 include:aspmx.googlemail.com ~all
…where 107.123.23.123 is your Apache/PHP server IP and we relay the mailboxes to Google Apps.

Check headers when I receive email

On a Brinkster (www.brinkster.com) mailbox

Return-Path: www-data@unexpectedit.com
X-DSPAM-Result: Innocent
X-DSPAM-Class: Innocent
X-DSPAM-Confidence: 0.79
X-DSPAM-Probability: 0.0000
X-DSPAM-Signature: N/A
X-Virus-Scanned: amavisd-new at mta2.brinkster.com
X-Spam-Flag: NO
X-Spam-Score: 2.399
X-Spam-Level: **
X-Spam-Status: No, score=2.399 tagged_above=-10 required=5
	tests=[BAYES_50=0.001, FH_HELO_EQ_D_D_D_D=0.001,
	HTML_IMAGE_ONLY_20=1.546, HTML_MESSAGE=0.001,
	HTML_SHORT_LINK_IMG_3=0.001, MPART_ALT_DIFF=0.739,
	MPART_ALT_DIFF_COUNT=1.11, DSPAM:Innocent=-1.000] autolearn=no
Received: from mta2.brinkster.com ([127.0.0.1])
	by localhost (mta2.brinkster.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id YwUJP968VFhq for ;
	Thu, 26 Jan 2012 05:40:02 -0500 (EST)
Received: from ip-10-190-222-218.ec2.internal (mail1.snappygo.com [107.123.23.123])
	by mta2.brinkster.com (Postfix) with ESMTP id 360B31285D4
	for ; Thu, 26 Jan 2012 05:40:02 -0500 (EST)
Received: by ip-10-190-222-218.ec2.internal (Postfix, from userid 33)
	id 93D7C43AB5; Thu, 26 Jan 2012 10:39:20 +0000 (UTC)

On a Google mailbox

Received-SPF: pass (google.com: domain of www-data@unexpectedit.com designates 107.123.23.123 as permitted sender) client-ip=107.123.23.123;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of www-data@unexpectedit.com designates 107.123.23.123 as permitted sender) smtp.mail=www-data@unexpectedit.com

Improve postfix settings

vi /etc/postfix/main.cf

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

myhostname = unexpectedit.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = unexpectedit.com, localhost.ec2.internal, localhost
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

vi /etc/mailname

mail1.unexpectedit.com

Change the Return-Path header of email to an existing account

//Setting Return-Path header
$tr = new Zend_Mail_Transport_Sendmail('-finfo@unexpectedit.com');
Zend_Mail::setDefaultTransport($tr);

//Create Mail on Zend_Mail
$mail = new Zend_Mail();
$mail->setFrom("info@unexpectedit.com", "Unexpected It");
$mail->addTo("other.user@unexpectedit.com");
$mail->setSubject($subject);
$mail->setBodyText($text);
$mail->setBodyHtml($html);
$mail->send();

Check headers now

Return-Path: info@unexpectedit.com
X-DSPAM-Result: Innocent
X-DSPAM-Class: Innocent
X-DSPAM-Confidence: 0.69
X-DSPAM-Probability: 0.0000
X-DSPAM-Signature: N/A
X-Virus-Scanned: amavisd-new at mta9.brinkster.com
X-Spam-Flag: NO
X-Spam-Score: -1.822
X-Spam-Level:
X-Spam-Status: No, score=-1.822 tagged_above=-10 required=5
	tests=[BAYES_00=-2.599, HTML_IMAGE_ONLY_32=1.778, HTML_MESSAGE=0.001,
	SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, DSPAM:Innocent=-1.000]
	autolearn=no
Received: from mta9.brinkster.com ([127.0.0.1])
	by localhost (mta9.brinkster.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id g7xih7MpqhwG for ;
	Sat, 28 Jan 2012 15:06:09 -0500 (EST)
Received: from unexpectedit.com (mail1.unexpectedit.com [107.123.23.123])
	by mta9.brinkster.com (Postfix) with ESMTP id 0478E49329B
	for ; Sat, 28 Jan 2012 15:06:06 -0500 (EST)
Received: by snappygo.com (Postfix, from userid 33)
	id B516D441A8; Sat, 28 Jan 2012 20:05:32 +0000 (UTC)

Assign SUID to programs

$ chmod 4755 /home/ipascual/scripts/test.sh

I doesn’t work with shell scripts!!!

Linux doesn’t allow you to use SUID root for shell scripts due to security role. Just real binary programs.
The reason is because an attacker could get the computer to execute any shell script when the script is processing to execute. Because of this, modern linux distributions ignore SUID shell scripts.

The solution is to use “sudo”.

What is sudo?

sudo allows a permitted user to execute a command as the superuser or another user, as specified in the sudoers file.
But, sudo asks me for the root! My users still can’t use it whiout password.

Running a shell script without asking for root password

$ sudo visudo

# Add this line at the end
ipascual        ALL=NOPASSWD: /home/ipascual/scripts/test.sh

$ cat /home/ipascual/scripts/test.sh
#!/bin/sh
/sbin/shutdown -h now

$ sudo /home/ipascual/scripts/test.sh

Now the user ipascual will execute test.sh as root without password.

I had to create a script to make my job easier.

Thanks to David Walsh for backup_tables cool function I can share this script to you guys

<?php
//1) Create a database dump file
backup_tables('localhost','root','123456','database_blog');

//2 Compress all folder tree including the database dump file before
$target = dirname(__FILE__);
echo exec('tar cfvz backup-'.time().'.tar.gz '.$target);

//3 To upload the full website
$target = dirname(__FILE__)."/website.zip";
echo exec('unzip '.$target);

/*
*	Script from http://davidwalsh.name/backup-mysql-database-php
* Thanks to david walsh
*/
function backup_tables($host,$user,$pass,$name,$tables = '*')
{

	$link = mysql_connect($host,$user,$pass);
	mysql_select_db($name,$link);

	//get all of the tables
	if($tables == '*')
	{
		$tables = array();
		$result = mysql_query('SHOW TABLES');
		while($row = mysql_fetch_row($result))
		{
			$tables[] = $row[0];
		}
	}
	else
	{
		$tables = is_array($tables) ? $tables : explode(',',$tables);
	}

	//cycle through
	foreach($tables as $table)
	{
		$result = mysql_query('SELECT * FROM '.$table);
		$num_fields = mysql_num_fields($result);

		$return.= 'DROP TABLE '.$table.';';
		$row2 = mysql_fetch_row(mysql_query('SHOW CREATE TABLE '.$table));
		$return.= "\n\n".$row2[1].";\n\n";

		for ($i = 0; $i < $num_fields; $i++)
		{
			while($row = mysql_fetch_row($result))
			{
				$return.= 'INSERT INTO '.$table.' VALUES(';
				for($j=0; $j<$num_fields; $j++)
				{
					$row[$j] = addslashes($row[$j]);
					$row[$j] = ereg_replace("\n","\\n",$row[$j]);
					if (isset($row[$j])) { $return.= '"'.$row[$j].'"' ; } else { $return.= '""'; }
					if ($j<($num_fields-1)) { $return.= ','; }
				}
				$return.= ");\n";
			}
		}
		$return.="\n\n\n";
	}

	//save file
	$handle = fopen('db-backup-'.time().'-'.(md5(implode(',',$tables))).'.sql','w+');
	fwrite($handle,$return);
	fclose($handle);
}

?>

References: http://davidwalsh.name/backup-mysql-database-php

2) Install ElasticLoadBalancing-1.0

3) Generate Security Credentials
Amazon > Account > Security Credentials
X.509 Credentials
Create
“Download Private Key File” and rename it to PrivateKey.pem
“Download X.509 certificate” and rename it to ServerCertificate.pem

Upload both files to /mnt

4) Download ElasticLoadBalancing-1.0.10.0.zip or the lastest version and install it under /root/bin/elb

5) Unix shell make variables

export AWS_ELB_HOME=/root/bin/elb
export JAVA_HOME=/usr/lib/jvm/java-1_6_0-ibm-1.6.0/jre
export PATH=$PATH:/root/bin/elb/bin
export EC2_PRIVATE_KEY=/mnt/PrivateKey.pem
export EC2_CERT=/mnt/ServerCertificate.pem

6) Config ELB
# elb-create-lb onlinecommunityspecialists –headers –listener “lb-port=443,instance-port=8443,protocol=TCP” –listener “lb-port=80,instance-port=80,protocol=http” –region eu-west-1 –availability-zones eu-west-1a
DNS_NAME DNS_NAME
DNS_NAME onlinecommunityspecialists-1752118929.eu-west-1.elb.amazonaws.com

# elb-create-lb neverforget –headers –listener “lb-port=443,instance-port=8444,protocol=TCP” –listener “lb-port=80,instance-port=80,protocol=http” –region eu-west-1 –availability-zones eu-west-1a
DNS_NAME DNS_NAME
DNS_NAME neverforget-1687287348.eu-west-1.elb.amazonaws.com

# elb-register-instances-with-lb onlinecommunityspecialists –region eu-west-1 –instances i-9d84dcea

# elb-register-instances-with-lb neverforget –region eu-west-1 –instances i-9d84dcea

7) Config Apache to listen to that ports with different SSL

# vi /etc/apache2/listen.conf
Listen 80
Listen 8443
Listen 8444
NameVirtualHost *:80
NameVirtualHost *:8443
NameVirtualHost *:8444

# vi /etc/apache2/vhosts.d/vhost.conf
<VirtualHost *:80>
    ServerAdmin root@linux.com
    DocumentRoot /srv/www/htdocs/online
    ServerName www.onlinecommunityspecialists.co.uk
    ServerAlias www.onlinecommunityspecialists.co.uk
    HostnameLookups Off
    ServerSignature On
    <Directory "/srv/www/htdocs/online">
        Options -Indexes FollowSymLinks
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
</VirtualHost>
<VirtualHost *:80>
    ServerAdmin root@linux.com
    DocumentRoot /srv/www/htdocs/neverforget
    ServerName www.neverforgetagain.co.uk
    ServerAlias www.neverforgetagain.co.uk
    HostnameLookups Off
    ServerSignature On
    <Directory "/srv/www/htdocs/neverforget">
        Options -Indexes FollowSymLinks
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
</VirtualHost>
<IfDefine SSL>
<IfDefine !NOSSL>

<VirtualHost *:8444>
    ServerAdmin ipascual@unexpectedit.com
    DocumentRoot /srv/www/htdocs/neverforget
    ServerName www.neverforgetagain.co.uk
    ServerAlias www.neverforgetagain.co.uk

    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile /etc/apache2/ssl.crt/www_neverforgetagain_co_uk.crt
    SSLCertificateKeyFile /etc/apache2/ssl.crt/neverforgetagain.key
    SSLCertificateChainFile /etc/apache2/ssl.crt/www_neverforgetagain_co_uk.ca-bundle
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

    <Directory "/srv/www/htdocs/neverforget">
        Options -Indexes FollowSymLinks
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
</VirtualHost>
<VirtualHost *:8443>
    ServerAdmin ipascual@unexpectedit.com
    DocumentRoot /srv/www/htdocs/online
    ServerName www.onlinecommunityspecialists.co.uk
    ServerAlias www.onlinecommunityspecialists.co.uk

    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile /etc/apache2/ssl.crt/www_onlinecommunityspecialists_co_uk.crt
    SSLCertificateKeyFile /etc/apache2/ssl.crt/onlinecomunityspecialists.key
    SSLCertificateChainFile /etc/apache2/ssl.crt/www_onlinecommunityspecialists_co_uk.ca-bundle
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

    <Directory "/srv/www/htdocs/online">
        Options -Indexes FollowSymLinks
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
</VirtualHost>
</IfDefine>
</IfDefine>

7) Add CNAME records to your domains
Domain: onlinecommunityspecialists.co.uk
www >>> onlinecommunityspecialists-1752118929.eu-west-1.elb.amazonaws.com.
Domain: neverforgetagain.co.uk
www >>> neverforget-1687287348.eu-west-1.elb.amazonaws.com

8) Do not forget to open the ports related on your Amazon Firewall

1) Create the default structure

/root/my_project
.
|-branches
|—stable (production stable versions)
|—vendors
|—–x (release versions from Magento)
|-tags
|-trunk
|—data (database backups)
|—scripts (shell scripts)
|—src (last version of your development magento site)

2) Copy your initial Magento version. Delete and create templates (or use SVN ignore/lock instead for this)

# cp -R /srv/www/htdocs/Handpicked /root/my_project/trunk/src/
app/etc/local.xml (*local.sample.xml)
media/
var/
36093_nmerchandis.txt
.project
.server-monitor/config.php (*config.sample.xml)
.server-monitor/phpMyAdmin/config.inc.php (*config.sample.inc.xml)
(*template config files)

3) Copy your Magento original version under
/root/my_project/branches/stable/1.4.0.1/

4) Create repository

# svnadmin create /srv/svn/handpicked
# chown -R wwwrun:www /srv/svn
# /etc/init.d/svnserve start
# /etc/init.d/apache2 restart

5) Add the first version of your project

# cd /root/my_project
# svn import . http://ec2-xx-xx-xx-amazon.com/svn/repo/ -m "Initial version"

6) Merge Production image folder wih Test image folder script

#!/bin/sh
rm -rf /srv/www/htdocs/Handpicked/media/catalog/product/cache
rsync -e "ssh -i /root/.ssh/handpickedserver.pem -c blowfish -l root" -avx --delete-excluded --recursive --exclude '*media/catalog/product/cache*' root@www.handpickedcollection.com:/srv/www/htdocs/Handpicked/media /srv/www/htdocs/Handpicked/

/root/my_project
.
|-branches
|—stable (production stable versions)
|—–1.4.0.1.handpicked23
|——-data
|———HandpickedMagento.sql.gz
|——-scripts
|——-data
|———[...]
|—vendors
|—–magento (release versions from Magento)
|——-1.4.0.1
|———[...]
|-tags
|-trunk
|—data (database backups)
|—scripts (shell scripts)
|—src (last version of your development magento site)
|—–[...]

Errors:
svn: Can’t open file ‘…file.txt’: No such file or directory
This is a case sensivity issue. Please remove from console the file with “svn del” and “svn commit” before checkout again.

… Could not read chunk size: connection was closed by server …
This is a timeout issue. Change in /etc/apache2/server-tuning.conf
KeepAliveTimeout 15
TO
KeepAliveTimeout 360

ip-10-48-162-89:~ # vi /etc/sysconfig/apache2
APACHE_MODULES=”… mod_dav mod_dav_svn mod_authz_svn”

ip-10-48-162-89:~ # vi /etc/apache/httpd.conf

<Location /svn>
	DAV svn
	SVNParentPath /srv/svn

	# how to authenticate a user
	AuthType Basic
	AuthName "Subversion repository"
	AuthzSVNAccessFile /etc/svn-auth-users
        AuthUserFile /etc/svn-auth-passwd
 	Require valid-user
</Location>

ip-10-48-162-89:~ # vi /etc/svn-auth-users

[/]
guest = r
admin = rw
ignacio = rw

ip-10-48-162-89:~ # htpasswd -cm /etc/svn-auth-passwd ignacio

New password:
Re-type new password:
Adding password for user ignacio

(Execute this command for each user, remove -c to avoid overwrite the file)

ip-10-48-162-89:~ # vi /etc/sysconfig/svnserve
SVNSERVE_OPTIONS=”-d -R -r /srv/svn”
SVNSERVE_USERID=”svn”
SVNSERVE_GROUPID=”svn”

Creating repository folder and unix user/group
ip-10-48-162-89:~ # mkdir /srv/svn
ip-10-48-162-89:~ # useradd svn
ip-10-48-162-89:~ # groupadd svn

Create a repository (use “repo” as the name of your company)
ip-10-48-162-89:~ # svnadmin create /srv/svn/repo
ip-10-48-162-89:~ # chown -R wwwrun:www /srv/svn
ip-10-48-162-89:~ # /etc/init.d/svnserve start
ip-10-48-162-89:~ # /etc/init.d/apache2 restart
ip-10-48-162-89:~ # cd ~
ip-10-48-162-89:~ # mkdir my_project
ip-10-48-162-89:~ # cd my_project/
ip-10-48-162-89:~/my_project # mkdir branches tags trunk
ip-10-48-162-89:~/my_project # cd trunk

Import all the files to your repository
ip-10-48-162-89:~/# cd ..
ip-10-48-162-89:~/# svn import . http://ec2-xx-xx-xx-amazon.com/svn/repo/ -m “Initial version”

Fist time you want to use the trunk version to your web server
cd /srv/www/htdocs
svn checkout http://ec2-xx-xx-xx-amazon.com/svn/repo/trunk .

Next times
cd /srv/www/htdocs
svn update

Notes
If you get “mod_security: Access denied with code 403.”
Add these lines to disable mod_security on /etc/apache/httpd.conf

# Turn off mod_security filtering.
SecFilterEngine Off

# The below probably isn’t needed, but better safe than sorry.
SecFilterScanPOST Off

Note: Replace ec2-xx-xx-xx-amazon.com for your instance e.g.ec2-46-23-152-198.eu-west-1.compute.amazonaws.com

EC2 SUSE Linux Enterprise Server 11 32-bit SP1
- MySQL 5.0.67
- Apache 2.2.16
- OpenSSL 0.9.8h
- PHP 5.3.3

Getting ready to run Magento 1.4 with two websites and multiple stores.
domain a > magento website1 / store1
domain b > magento website1 / store2
domain c > magento website2 / store3

1) Add the next repositories in YaST > Software > Software Repositories
** Apparently openSUSE_11.1 is not available any more. Try with openSUSE_11.3 repository instead **
a) Apache – http://download.opensuse.org/repositories/Apache/openSUSE_11.3/
b) Apache Modules – http://download.opensuse.org/repositories/Apache:/Modules/Apache_openSUSE_11.3/
c) Apache PHP Modules – http://download.opensuse.org/repositories/server:/php/openSUSE_11.3/
(Thanks to Opensuse.org! http://en.opensuse.org/Additional_package_repositories)
(image1)

2) Install the next packages from YaST > Software > Software Management
Packages installed:
php5
php5-bz2
php5-calendar
php5-ctype
php5-curl
php5-devel
php5-dom
php5-exif
php5-fileinfo
php5-ftp
php5-gd
php5-gettext
php5-gmp
php5-hash
php5-iconv
php5-json
php5-ldap
php5-mbstring
php-mcrypt
php5-mysql
php5-openssl
php5-pdo
php5-pear
php5-phar
php5-shmop
php5-soap
php5-sockets
php5-sqlite
php5-tokenizer
php5-wddx
php5-xmlreader
php5-xmlrpc
php5-xmlwriter
php5-xsl
php5-zip
php5-zlib

apache2
apache-devel
apache2-prefork
apache2-utils
apache2-mod_php5
apache2-mod_security
apache2-mod_stats
apache2-mod_telemetry

mysql
mysql-client

logwatch

3) Setting up mod_security
# mkdir /srv/www/logs

4) Setting up Apache, Mysql and PHP5
Apache2_PHP5_Standard_Config.zip

# vi /etc/sysconfig/apache2
[...]
APACHE_MODULES=”actions alias auth_basic authn_file authz_host authz_groupfile authz_default authz_user autoindex cgi dir env expires include log_config mime negotiation setenvif ssl userdir php5 rewrite status security deflate”
# If you need SSL activate this flag
APACHE_SERVER_FLAGS=”-D SSL”
[...]

# vi /etc/php5/apache2/php.ini
[...]
short_open_tag = On
[...]
date.timezone = “Europe/London”
date.timezone = “America/Bogota”
[...]

3) Install PHP APC Cache
pecl install channel://pecl.php.net/apc-3.1.4

4) Extra Software Needed (if needed)
# YaST
lynx
vsftpd

#vi /etc/vsftpd.conf
anonymous_enable=NO
# Amazon Firewall Ports Open
pasv_max_port=30000
pasv_min_port=30100
pam_service_name=vsftpd
#userlist_enable=YES
tcp_wrappers=NO
pasv_enable=YES
port_enable=YES
# Log everything
log_ftp_protocol=NO
# Block the users to Home Folder
chroot_local_user=YES

5) Date and Time
YaST > System > Date and Time

6) Automatic Startup Services
# chmod 755 /etc/init.d/mysql
# chkconfig –add mysql
# chkconfig –level 35 mysql on

# chmod 755 /etc/init.d/apache2
# chkconfig –add apache2
# chkconfig –level 35 apache2 on

At this point is the AMI Image “Suse11S1 v2 UnexpectedIT”
Apache 2.2.16
PHP Version 5.3.4-dev
APC 3.1.4
MySQL 5.0.67

# mysql_secure_installation

# vi /etc/aliases
[...]
root: handpicked@richardmason.net
[...]

# vi /etc/postfix/main.cf
myhostname = ec2-12-34-567-89.eu-west-1.compute.amazonaws.com
smtp_generic_maps = hash:/etc/postfix/generic

# vi /etc/postfix/generic
wwwrun@ec2-12-34-567-89.eu-west-1.compute.amazonaws.com no-reply@yourdomain.com

# postmap /etc/postfix/generic

# /etc/init.d/postfix restart

2 domains
2 different SSL Certificates

# vi /etc/apache2/listen.conf
NameVirtualHost ec2-xx-xx-xxx-xxx.eu-west-1.compute.amazonaws.com:80

# vi vhosts.d/vhost.conf
[...]

ServerAdmin server-admin@unexpectedit.com
DocumentRoot /srv/www/htdocs/ipascual.com/
ServerName www.unexpectedit.com
ServerAlias www.ipascual.com

Options -Indexes FollowSymLinks
AllowOverride All
Order deny,allow
Deny from all


[...]

#
# Look for a string on files – recursive mode
#
grep -nir –color ‘text to find’ *