Building A Web-And Mail Server With CentOS 4.3

hausmasta writes "This is a detailed description how to set up a CentOS 4.3 based server that offers all services needed by ISPs and hosters (web server (SSL-capable), mail server (with SMTP-AUTH and TLS!), DNS server, FTP server, MySQL server, POP3/IMAP, Quota, Firewall, etc.). This tutorial is written for the 64-bit version of CentOS 4.3, but should apply to the 32-bit version with very little modifications as well."

The Perfect Setup Articles

[Bios_Hakr]

There seem to be "perfect setup" articles about every major Linux distro. I even used one on my own site. However, you need to be aware that these articles are written for ISP Config. In fact, they seem to be almost a viral marketing tool designed to pimp ISP Config.

Now, there is nothing wrong with that. Just be aware that some things may not work if you do not install ISPC.

For instance, a newbie following along may not notice that he disable the ability for his server to run php in /var/www. A newbie may also be perplexed as to why he can get to his site on http://url443/ [url443] but not on https://url./ [url.]

I've even seen examples that suggested installing compilers and tools to build modules needed by SpamAssasin. Anyone installing a compiler on a production web server should be shot.

In short, unless you go on to install the ISPc, your site will be broken and may be vulnerable to attack.

So, buyer (reader?) beware! You may not be getting what you want.

Re:The Perfect Setup Articles

[Rosco P. Coltrane]

However, you need to be aware that these articles are written for ISP Config.

It's clearly written in the blurb and in TFA that it's a set of instructions for ISPs, so what are you warning readers about?

Re:The Perfect Setup Articles

[MrZaius]

I think he's saying he likes to shoot Gentoo users.

Re:The Perfect Setup Articles

[Bios_Hakr]

The theory is that you should disable root logins (over SSH at least) and only allow users to SSH in. The problem comes from users that use weak passwords and/or use their /. user/pass combo for the webserver. Eventually, a hacker will intercept the user/pass and login as that user. With compiler tools, he can begin building tools and modifying the $PATH so that those tools run vice the ones in /usr/bin.

Now, the hacker just waits for the user to login and try to "su" or "sudo".

After that, the hacker has

Re:The Perfect Setup Articles

[drsmithy]

I've even seen examples that suggested installing compilers and tools to build modules needed by SpamAssasin. Anyone installing a compiler on a production web server should be shot.

I think the additional exposure this creates on modern systems is vastly overstated.

It's not like compiling code for an x86 Linux machine is a particularly difficult thing to do.

Re:The Perfect Setup Articles

[DrSkwid]

> Anyone installing a compiler on a production web server should be shot.

whereas hosting your firewall, dns, database, webserver, ftp & email on the same box is just fine and dandy

Is ISP Config a bad thing?

[Kadin2048]

I see your point after reading TFA regarding ISP Config, it definitely expects you to install it. But I have to wonder, after checking out ISP Config, if this is a bad thing. It's not as if this is a closed-source or commercial product, so I don't think that the article writer is getting any sort of kickback from recommending it or using it in his easy setup article. It's BSD licensed, actually, so (depending on your personal definition of free, etc.) it's less thorny an issue in terms of use than Linux its

Give the man a clue!

[RedOregon]

How long will it be before our buddy in Oklahoma's [slashdot.org] inbox is flooded with this tip??

Centos Mirror

[zerocool^]

Obvious:

CentOS is Red Hat Enterprise, with a :s/RedHat/CentOS/g on the code. They download the RHEL Source RPMs and compile and release it. FYI.

Not so obvious:

They also recompile for additional arches, most notably Alpha (I have a couple of faculty members who don't want to be rid of their Digital machines; this makes a great alternative to paying $1000+/year for a True64 license to HP who hasn't looked at the code for 4.x since they bought it).

Get it here:

http://www.centos.org/modules/tinycontent/index.ph p?id=13 [centos.org]
There are a LOT of mirrors, and being on the listserv, I see more and more being added all the time. Including lots of tier 1 mirrors at Universities, if you're on Internet2. There are also lots of local mirrors around the world, so if you're not a USAian, check for one in your locale; you may get better speeds than a general mirror.
Best mirror? http://mirror.cs.vt.edu/ [vt.edu] =)

~Will

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Centos Mirror

[moro_666]

but centos is still missing something from rhel right ? otherwise ... who would buy the rhel at all ? only the customers that need support from a big red hatted company really badly ?

just want to get my facts straight here

haven't touched redhat for 6 years now, looked at article, don't miss it 1 bit. ubuntu & freebsd are easier :D

Re:Centos Mirror

[buysse]

Redhat has copyright-protected, non-redistributable graphics and docs.

Otherwise, CentOS is RHEL. People do pay Redhat to supply support -- for most corp installs, it is that important. There are a few edge cases as well -- if you're running any commercial software, like Oracle, SPSS, or SAS -- you will definitely run RHEL over CentOS, or your vendor won't even talk to you.

For an academic install, RHEL is cheap enough that it's worth the cost ($50/year/host) to have the possibility of support. Just like it's worth the $120/year/host for basic service on Solaris 10 machines.

Re:Centos Mirror

[zerocool^]

Our fiberchannel SAN only has drivers for RHEL. We have tested it; the drivers are binary compatablie plug-and-go with CentOS; but, you're absolutely right, the systems attached to the SAN use RHEL because of support issues. Without RHEL, we get no support.

~Will

CentOS is NOT RHEL.

[mnmn]

Theres a major difference. The name.

On my own accord I'd always choose slackware or the debian-based distros like knoppix and ubuntu. If I need enterprise support I'll go with redhat or suse. CentOS doesnt give me the support.

Moreover I'd only use redhat because the commercial world depends on redhat's linux than any other distro. I can install oracle, websphere, domino etc with minimal pain on redhat. Now CentOS doesnt have the name, which these apps check for. That brings down redhat to the importance of

Support.

[Kadin2048]

To a PHB, RHEL is an "enterprise OS," CentOS is a "free software project."

That is to say, RHEL is made by a company and usually purchased with a service or support contract, comes in a bunch of grades/flavors for different applications, and comes with a lot of documentation and even has certified training courses.

CentOS is just that -- an Operating System. They don't support it, they don't service it, and you can't send Sean From IT to them to take a few training courses on how to administer it. You can bas

They can complament each other.

[LWATCDR]

CentOS is also great to use for some low priority edge systems and test boxes in a RHEL shop. It is free and you already know how to use it :)
RHEL is well worth the money for an Enterprise. CentOS is well worth it to everyone else.

Nice newbie guide I'm sure

[Anonymous Coward]

Personally I'd have used exim as the mail server software and vexim for account management. Dovecot supports vexim for account details, so you end up with a nice integrated setup for email. The article was missing SpamAssassin and ClamAV installation, the former via exim-sa or standalone.

However there were a few nice things in the article that are always useful to have around for someone who might be good at Linux, but not an expert on server configuration, especially in these days of Google searches gettin

CentOS is Risky!

[Anonymous Coward]

I don't know if it's such a good idea to run CentOS. Your local city manager might call the FBI on you...

This can be done in one step

[4/3PI*R^3]

SME 7.0 is based on CentOS 4 and is a fairly turn-key installation and it has all these features already built in and it has a web based configuration interface. (http://www.contribs.org [contribs.org])

Centos 64bit + Dovecot == BAD

[the_maddman]

I ran a mail server on 64bit Centos (dual Opteron 244's) and dovecot for IMAP and POP3 access. Dovecot does not seem like like Opterons, and I had ECC errors and strange hard locks of the system. Same machine with the 32bit release of Centos is rock solid.

What amazingly bad advice

[greg1104]

On page 3, the system gets connected to the Internet, at which point he promptly disables the firewall and other important security features that he doesn't understand (that's warning sign #1 right there, the comments about SELinux). Then, on page 6, the system gets re-secured with this ISPConfig software, which may or may not be good.

I hope you're feeling lucky, because I've watched my share of servers get hacked during the period between when the firewall etc. was taken down "just for a minute" and when it was turned back on again. Anyone considering following this unsafe tutorial, do yourself a favor and at least practice this much paranoia: download all the packages recommended, then disconnect your network cable during the period when you have the RedHa...er, CentOS firewall service down. Don't reconnect yourself to the network unless a) you've correctly configured the ISPConfig software, or b) you've turned the firewall back on temporarily because you need to download something else.