Serveur basé sur une Debian 12 (bookworm) AMD64.

1. disque SSD monté normalement avec partitions physiques:
   • / (~50G)
   • /home (~200G)
2. disque RAID 2x 2T (voir ci-dessous)

sudo mdadm --create --verbose /dev/md0 --metadata 1.2 --level=mirror --raid-devices=2 /dev/sda1 /dev/sdb1
sudo reboot
cat /proc/mdstat
 
sudo mdadm --detail --scan >> my_mdadm.conf

Ensuite j'ai rajouté une ligne (celle du fichier my_mdadm.conf dans le fichier /etc/mdadm/mdadm.conf). Mais je ne sais pas si c'est utile :

# mdadm.conf
#
# !NB! Run update-initramfs -u after updating this file.
# !NB! This will ensure that initramfs has an uptodate copy.
#
# Please refer to mdadm.conf(5) for information about this file.
#

# by default (built-in), scan all partitions (/proc/partitions) and all
# containers for MD superblocks. alternatively, specify devices to scan, using
# wildcards if desired.
#DEVICE partitions containers

# automatically tag new arrays as belonging to the local system
HOMEHOST <system>

# instruct the monitoring daemon where to send mail alerts
MAILADDR beafrancois@beafrancois.fr

# definitions of existing MD arrays
ARRAY /dev/md/cahute:0 metadata=1.2 name=cahute:0 UUID=4a1d7069:3a4a17d0:06e37696:8d5c340d

# This configuration was auto-generated on Wed, 25 Jul 2018 23:01:52 +0000 by mkconf

modifier le fichier /etc/apt/sources.list

deb http://archive.ubuntu.com/ubuntu bionic main universe
deb http://archive.ubuntu.com/ubuntu bionic-security main universe
deb [arch=amd64] https://download.docker.com/linux/ubuntu bionic stable
deb http://archive.ubuntu.com/ubuntu bionic-updates main universe

Installer lxd

snap install lxd

configurer l'utilisateur courant pour qu'il puisse gérer les conteneurs lxd

sudo usermod -a -G lxd $USER

Installer le serveur nfs:

sudo apt install nfs-kernel-server

Modifier /etc/fstab:

[...]
/media/stockage/multimedia       /export/multimedia          none bind 0 0
/media/stockage/famille          /export/famille             none bind 0 0
/media/stockage/partage          /export/partage             none bind 0 0
/media/stockage/homes/francois   /export/home/francois       none bind 0 0
/media/stockage/homes/beatrice   /export/home/beatrice       none bind 0 0
/media/stockage/repositories     /export/repositories        none bind 0 0
[...]

la suite ici.

Les commandes suivantes sont utilisées pour l'install:

sudo apt install apache2

Génération des clefs SSL

sudo mkdir /etc/apache2/ssl
sudo openssl req -x509 -nodes -days 1095 -newkey rsa:2048 -out /etc/apache2/ssl/server.crt -keyout /etc/apache2/ssl/server.key
sudo chmod -R www-data.www-data /etc/apache2/ssl

Activation du site https et désactivation du site http

sudo a2enmod ssl
sudo a2enmod rewrite
sudo a2enmod headers
sudo a2dissite 000-default
sudo a2ensite default-ssl

Puis modification du fichier /etc/apache2/ports.conf

# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default.conf

#Listen 80

<IfModule ssl_module>
        Listen 443
</IfModule>

<IfModule mod_gnutls.c>
        Listen 443
</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

Ensuite modification du fichier /etc/apache2/sites-enabled/default-ssl.conf

[...]

                #   A self-signed (snakeoil) certificate can be created by installing
                #   the ssl-cert package. See
                #   /usr/share/doc/apache2/README.Debian.gz for more info.
                #   If both key and certificate are stored in the same file, only the
                #   SSLCertificateFile directive is needed.
                SSLCertificateFile     /etc/apache2/ssl/server.crt
                SSLCertificateKeyFile  /etc/apache2/ssl/server.key

[...]

Configuration du serveur

Le fichier /etc/apache2/apache2.conf est modifié :

[...]

# Sets the default security model of the Apache2 HTTPD server. It does
# not allow access to the root filesystem outside of /usr/share and /var/www.
# The former is used by web applications packaged in Debian,
# the latter may be used for local directories served by the web server. If
# your system is serving content from a sub-directory in /srv you must allow
# access here, or in any related virtual host.
<Directory />
        Options FollowSymLinks
        AllowOverride None
        Require all denied
</Directory>

#<Directory /usr/share>
#       AllowOverride None
#       Require all granted
#</Directory>

#<Directory /var/www/>
#       Options Indexes FollowSymLinks
#       AllowOverride None
#       Require all granted
#</Directory>

<Directory /var/www/html/>
        Options FollowSymLinks
        AllowOverride All
        Require all granted
</Directory>

[...]

sudo apt install mysql-server

Mot de passe root

sudo systemctl stop mysql
sudo mkdir /var/run/mysqld; sudo chown mysql /var/run/mysqld
sudo mysqld_safe --skip-grant-tables &
sudo mysql --user=root mysql

Dans le prompt mysql

update user set authentication_string=PASSWORD('new-password') where user='root';
flush privileges;

Et ensuite, tuer le service démarré en “safe”

Il faut changer le mode d'autentification root

mysql> SELECT User, Host, plugin FROM mysql.user;
+------------------+-----------+-----------------------+
| User             | Host      | plugin                |
+------------------+-----------+-----------------------+
| root             | localhost | auth_socket           |
| mysql.session    | localhost | mysql_native_password |
| mysql.sys        | localhost | mysql_native_password |
| debian-sys-maint | localhost | mysql_native_password |
+------------------+-----------+-----------------------+

changement du mode

mysql> ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'mypassword';
Query OK, 0 rows affected (0.00 sec)
 
mysql> SELECT User, Host, plugin FROM mysql.user;
+------------------+-----------+-----------------------+
| User             | Host      | plugin                |
+------------------+-----------+-----------------------+
| root             | localhost | mysql_native_password |
| mysql.session    | localhost | mysql_native_password |
| mysql.sys        | localhost | mysql_native_password |
| debian-sys-maint | localhost | mysql_native_password |
+------------------+-----------+-----------------------+
4 rows in set (0.00 sec)
 
mysql> 

sudo apt install php php-curl php-zip  php-mbcrypt php-mbstring php-intl

installation de composer

php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php -r "if (hash_file('SHA384', 'composer-setup.php') === '544e09ee996cdf60ece3804abc52599c22b1f40f4323403c44d44fdfdd586475ca9813a858088ffbc1f233e9b180f061') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;"
sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer
php -r "unlink('composer-setup.php');"

installation de phpmyadmin

cd ~/tmp
composer create-project --no-dev phpmyadmin/phpmyadmin

installation

sudo apt install msmtp
sudo apt install msmtp-mta

fichier de configuration globale /etc/msmtprc

# Example for a system wide configuration file

# A system wide configuration file is optional.
# If it exists, it usually defines a default account.
# This allows msmtp to be used like /usr/sbin/sendmail.
account default

# The SMTP smarthost.
host smtp.free.fr

# Construct envelope-from addresses of the form "user@oursite.example".
#auto_from on
#maildomain oursite.example
from maison@beafrancois.fr

# Use TLS.
#tls on
#tls_trust_file /etc/ssl/certs/ca-certificates.crt

# Syslog logging with facility LOG_MAIL instead of the default LOG_USER.
syslog LOG_MAIL

Exemple de commande pour tester le fonctionnement

printf "Subject:DeQuoiOnParle\nLeCorpsDuMessage" | msmtp francois@beafrancois.fr

installation

sudo apt install fail2ban

Ajout du fichier de configuration /etc/fail2ban/jail.local

[DEFAULT]
bantime = 1h

destemail = beafrancois@beafrancois.fr
sender = cahute@beafrancois.fr

# to ban & send an e-mail with whois report to the destemail.
action = %(action_mw)s

# same as action_mw but also send relevant log lines
#action = %(action_mwl)s

Pour le port spécial sftp, modifier le fichier /etc/fail2ban/jail.d/defaults-debian.conf

[sshd]
enabled = true
port=ssh,2200