首页 > 系统相关> > 如何在 CentOS 8 服务器上安装 ISP Config 3.2？

如何在 CentOS 8 服务器上安装 ISP Config 3.2？

2021-12-17 23:32:50 作者：互联网

本教程将介绍在 CentOS 8（64 位）服务器上安装 ISPConfig 3.2。ISPConfig 是一个网络托管控制面板，允许您通过网络浏览器配置以下服务：Apache 网络服务器、PHP、Postfix 邮件服务器、MySQL、BIND 名称服务器、PureFTPd、SpamAssassin、ClamAV、Mailman 等等。

文章目录

1 要求

要安装这样的系统，您将需要以下内容：

Centos 8 最小服务器系统。这可以是我们的Centos 8 最小服务器教程中描述的从头开始安装的服务器，也可以是来自安装了最小 Centos 8 设置的托管公司的虚拟服务器或根服务器。
快速的互联网连接。

2 初步说明

在本教程中，我使用主机名server1.example.com和 IP 地址192.168.0.100和网关192.168.0.1。这些设置可能因您而异。

3 准备服务器

设置键盘布局

如果服务器的键盘布局与您的键盘不匹配，您可以使用 localectl 命令切换到正确的键盘（在我的情况下为德语键盘布局的“de”：

localectl set-keymap de

要获取所有可用键盘映射的列表，请运行：

localectl list-keymaps

我想在本教程的最后安装 ISPConfig，ISPConfig 附带了 Bastille 防火墙脚本，我将用作防火墙，因此我现在禁用默认的 CentOS 防火墙。当然，您可以随意打开 CentOS 防火墙并根据您的需要进行配置（但是您以后不应使用任何其他防火墙，因为它很可能会干扰 CentOS 防火墙）。

dnf -y install net-tools wget rsyslog curl
systemctl stop firewalld.service
systemctl disable firewalld.service

停止和禁用 CentOS 防火墙。在这里出现错误是可以的，这只是表明没有安装防火墙。

然后你应该检查防火墙是否真的被禁用了，为此，请运行以下命令：

iptables -L

输出应如下所示：

[root@server1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

或者使用 firewall-cmd 命令：

firewall-cmd --state

[root@server1 ~]# firewall-cmd --state
not running
[root@server1 ~]#

现在我将安装网络配置编辑器和基于 shell 的编辑器“nano”，我将在接下来的步骤中使用它们来编辑配置文件：

dnf -y install nano wget NetworkManager-tui yum-utils

如果您在安装过程中没有配置网卡，您现在可以进行配置。

nmtui

选择您的网络接口：

然后填写您的网络详细信息 - 禁用 DHCP 并填写静态 IP 地址、网络掩码、您的网关和一两个名称服务器，然后点击Ok：

接下来选择确定以确认您在网络设置中所做的更改

和Quit关闭 nmtui 网络配置工具。

ifconfig

现在检查安装程序是否正确获取了您的 IP 地址：

[root@server1 ~]# ifconfig
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.100  netmask 255.255.255.0  broadcast 192.168.0.255
        inet6 fe80::20c:29ff:feee:b665  prefixlen 64  scopeid 0x20<link>
        inet6 2003:e1:bf22:1b00:20c:29ff:feee:b665  prefixlen 64  scopeid 0x0<global>
        ether 00:0c:29:ee:b6:65  txqueuelen 1000  (Ethernet)
        RX packets 2874  bytes 1369892 (1.3 MiB)
        RX errors 0  dropped 546  overruns 0  frame 0
        TX packets 968  bytes 160901 (157.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

如果你的网卡没有显示在那里，那么它不会在启动时启用，在这种情况下，打开文件/etc/sysconfig/network-scripts/ifcfg-eth0

nano /etc/sysconfig/network-scripts/ifcfg-ens33

并将 ONBOOT 设置为是：

[...]
ONBOOT=yes
[...]

并重新启动服务器。

检查您的/etc/resolv.conf是否列出了您之前配置的所有名称服务器：

cat /etc/resolv.conf

如果缺少名称服务器，请运行

nmtui

并再次添加缺少的名称服务器。

现在，进入配置…

调整 /etc/hosts 和 /etc/hostname

接下来，我们将编辑/etc/hosts。让它看起来像这样：

nano /etc/hosts

127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
192.168.0.100   server1.example.com     server1

::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

在 /etc/hostname 文件中设置主机名。该文件应包含完全限定的域名（例如在我的例子中是 server1.example.com），而不仅仅是像“server1”这样的短名称。使用 nano 编辑器打开文件：

nano /etc/hostname

并在文件中设置主机名。

server1.example.com

保存文件并退出nano。

将 SELinux 设置为宽松

SELinux 是 CentOS 的安全扩展，应该提供扩展的安全性。ISPConfig 不附带 SELinux 规则集，因此我将其设置为 permissive（如果您想稍后安装 ISPConfig，这是必须的）。

编辑/etc/selinux/config并设置SELINUX=permissive：

nano /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=permissive
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

之后我们必须重新启动系统：

reboot

4 启用附加存储库并安装一些软件

首先，我们导入软件包的 GPG 密钥：

rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY*

然后我们在 CentOS 系统上启用 EPEL 存储库，因为我们将在本教程中安装的许多软件包在官方 CentOS 8 存储库中不可用：

dnf -y install epel-release

激活Power Tools：

dnf config-manager --set-enabled powertools

然后我们更新系统上现有的包：

dnf -y update

现在我们安装一些稍后需要的软件包：

dnf -y groupinstall 'Development Tools'

5 配额

（如果您选择了与我不同的分区方案，则必须调整本章，以便配额适用于您需要的分区。）

要安装配额，我们运行以下命令：

dnf -y install quota

现在我们检查是否已为存储网站 (/var/www) 和 Maildir 数据 (var/vmail) 的文件系统启用配额。在这个示例设置中，我有一个大的根分区，所以我搜索“/”：

mount | grep ' / '

[ root@server1 ~]# mount | grep ' / ' 
/dev/mapper/centos-root on / type xfs (rw,relatime,attr2,inode64,noquota) 
[ root@server1 ~]#

如果您有单独的 /var 分区，请使用：

mount | grep ' /var '

反而。如果该行包含单词“ noquota ”，则继续执行以下步骤以启用配额。

在 /（根）分区上启用配额

通常您会在 /etc/fstab 文件中启用配额，但如果文件系统是根文件系统“/”，则必须通过 Linux 内核的引导参数启用配额。

编辑 grub 配置文件：

nano /etc/default/grub

搜索以GRUB_CMDLINE_LINUX开头的行，并将rootflags=uquota,gquota添加到命令行参数，使结果行如下所示：

GRUB_CMDLINE_LINUX="crashkernel=auto resume=/dev/mapper/cl-swap rd.lvm.lv=cl/root rd.lvm.lv=cl/swap rootflags=uquota,gquota"

并通过运行以下命令应用更改。

cp /boot/grub2/grub.cfg /boot/grub2/grub.cfg_bak 
grub2-mkconfig -o /boot/grub2/grub.cfg

并重新启动服务器。

reboot

现在检查配额是否启用：

mount | grep ' / '

[ root@server1 ~]# mount | grep ' / ' 
/dev/mapper/centos-root on / type xfs (rw,relatime,attr2,inode64,usrquota,grpquota) 
[ root@server1 ~]#

当配额处于活动状态时，我们可以在挂载选项列表中看到“ usrquota,grpquota ”。

在单独的 /var 分区上启用配额

如果您有单独的 /var 分区，请编辑/etc/fstab并将,uquota,gquota添加到/分区（/dev/mapper/centos-var）：

nano /etc/fstab

#
# /etc/fstab
# Created by anaconda on Sun Sep 21 16:33:45 2014
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
/dev/mapper/centos-root /                       xfs     defaults        1 1
/dev/mapper/centos-var /var                     xfs     defaults,uquota,gquota        1 2
UUID=9ac06939-7e43-4efd-957a-486775edd7b4 /boot                   xfs     defaults        1 3
/dev/mapper/centos-swap swap                    swap    defaults        0 0

然后运行

mount -o remount /var

quotacheck -avugm 
quotaon -avug

启用配额。当您收到没有启用配额的分区的错误时，请在继续之前重新启动服务器。

6 安装 Apache、PHP、MySQL 和 phpMyAdmin

启用 Remi 存储库以获取更新的 PHP 版本（当前为 PHP 7.4）：

dnf install http://rpms.remirepo.net/enterprise/remi-release-8.rpm
dnf -y install yum-utils
dnf -y module reset php
dnf -y module install php:remi-7.4
dnf update

我们可以使用一个命令安装所需的软件包：

dnf -y install httpd mod_ssl mariadb-server php php-mysqlnd php-mbstring

为保证服务器不被HTTPOXY 漏洞攻击，我们将全局禁用apache中的HTTP_PROXY header。

在 httpd.conf 文件末尾添加 apache 头规则：

echo "RequestHeader unset Proxy early" >> /etc/httpd/conf/httpd.conf

并重新启动 httpd 以应用配置更改。

service httpd restart

安装 phpMyAdmin：

cd /tmp
wget https://files.phpmyadmin.net/phpMyAdmin/5.0.2/phpMyAdmin-5.0.2-all-languages.tar.gz
tar xzvf phpMyAdmin-5.0.2-all-languages.tar.gz
mkdir /usr/share/phpmyadmin
mv phpMyAdmin-5.0.2-all-languages/* /usr/share/phpmyadmin/
mkdir /usr/share/phpmyadmin/tmp
chown -R apache:apache /usr/share/phpmyadmin
chmod 777 /usr/share/phpmyadmin/tmp

可选：更改 Apache MPM 模块

CentOS 8 默认使用 Apache MPM 事件模块，这在一方面是好的，因为它允许您使用 HTTP/2 协议。另一方面，它不允许您使用 apache mod_php 模块。一般来说，今天应该使用 PHP-FPM 作为默认设置，ISPConfig 支持这一点。如果出于兼容性原因需要旧的 mod_php 模式，那么您可以像这样切换 Apache MPM：

nano /etc/httpd/conf.modules.d/00-mpm.conf

在 MPM 事件行前面添加一个 # 使其看起来像这样：

# LoadModule mpm_event_module modules/mod_mpm_event.so

然后从 MPM Prefork 行中删除 # in，如下所示：

LoadModule mpm_prefork_module modules/mod_mpm_prefork.so

然后重新启动 httpd 以应用配置更改。

service httpd restart

7 安装 Dovecot

Dovecot 可以安装如下：

dnf -y install dovecot dovecot-mysql dovecot-pigeonhole

创建一个空的 dovecot-sql.conf 文件并创建符号链接：

touch /etc/dovecot/dovecot-sql.conf 
ln -s /etc/dovecot/dovecot-sql.conf /etc/dovecot-sql.conf 
ln -s /etc/dovecot/dovecot.conf /etc/dovecot.conf

现在创建系统启动链接并启动 Dovecot：

systemctl enable dovecot
systemctl start dovecot

8 安装后缀

Postfix可以安装如下：

dnf -y install postfix postfix-mysql

接下来，在 Postfix 中打开 TLS/SSL 和提交端口：

nano /etc/postfix/master.cf

取消对提交和 smtps 部分的注释如下，并在必要时添加行，以便 master.cf 文件的这一部分看起来与下面的完全一样。重要提示：删除以 smtps 和提交开头的行前面的 #，而不仅仅是从这些行之后的 -o 行中删除！

[...]
submission inet n - n - - smtpd
 -o syslog_name=postfix/submission
 -o smtpd_tls_security_level=encrypt
 -o smtpd_sasl_auth_enable=yes
 -o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o smtpd_reject_unlisted_recipient=no
# -o smtpd_client_restrictions=$mua_client_restrictions
# -o smtpd_helo_restrictions=$mua_helo_restrictions
# -o smtpd_sender_restrictions=$mua_sender_restrictions
# -o smtpd_recipient_restrictions=
# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
smtps inet n - n - - smtpd
 -o syslog_name=postfix/smtps
 -o smtpd_tls_wrappermode=yes
 -o smtpd_sasl_auth_enable=yes
 -o smtpd_client_restrictions=permit_sasl_authenticated,reject
# -o smtpd_reject_unlisted_recipient=no
# -o smtpd_client_restrictions=$mua_client_restrictions
# -o smtpd_helo_restrictions=$mua_helo_restrictions
# -o smtpd_sender_restrictions=$mua_sender_restrictions
# -o smtpd_recipient_restrictions=
# -o smtpd_relay_restrictions=permit_sasl_authenticated,reject
# -o milter_macro_daemon_name=ORIGINATING
[...]

然后关闭 Sendmail 并启动 Postfix 和 MariaDB (MySQL)：

systemctl enable mariadb.service 
systemctl start mariadb.service

systemctl enable postfix.service 
systemctl restart postfix.service

我们禁用 sendmail 以确保它不会启动，以防它安装在您的服务器上。所以错误消息“无法发出方法调用：未加载单元 sendmail.service”。可以忽略。

9 安装 Getmail

Getmail可以按如下方式安装：

dnf install python2
cd /tmp
wget http://pyropus.ca/software/getmail/old-versions/getmail-5.14.tar.gz
tar xvfz getmail-5.14.tar.gz
cd getmail-5.14
python2 setup.py build
python2 setup.py install

10 设置 MySQL 密码并配置 phpMyAdmin

为 MySQL 根帐户设置密码：

mysql_secure_installation

[root@server1 tmp]# mysql_secure_installation


NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.

Set root password? [Y/n] <-- ENTER
New password: <-- yourrootsqlpassword
Re-enter new password: <-- yourrootsqlpassword
Password updated successfully!
Reloading privilege tables..
 ... Success!


By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them. This is intended only for testing, and to make the installation
go a bit smoother. You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] <-- ENTER
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] <-- ENTER
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access. This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] <-- ENTER
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] <-- ENTER
 ... Success!

Cleaning up...



All done! If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

[root@server1 tmp]#

现在我们配置phpMyAdmin。创建这个 phpMyAdmin 配置文件：

nano /etc/httpd/conf.d/phpmyadmin.conf

将此内容添加到文件中：

# phpMyAdmin - Web based MySQL browser written in php
#
# Allows only localhost by default
#
# But allowing phpMyAdmin to anyone other than localhost should be considered
# dangerous unless properly secured by SSL

Alias /phpMyAdmin /usr/share/phpmyadmin
Alias /phpmyadmin /usr/share/phpmyadmin

<Directory /usr/share/phpmyadmin/>
   <IfModule mod_authz_core.c>
     # Apache 2.4
  #  <RequireAny>
     #  Require ip 127.0.0.1
     #  Require ip ::1
  #  </RequireAny>
   </IfModule>
   <IfModule !mod_authz_core.c>
     # Apache 2.2
     Order Deny,Allow
     Deny from All
     Allow from 127.0.0.1
     Allow from ::1
   </IfModule>
</Directory>

接下来，我们将 phpMyAdmin 中的身份验证从cookie更改为http：

cp -pf /usr/share/phpmyadmin/config.sample.inc.php /usr/share/phpmyadmin/config.inc.php 
nano /usr/share/phpmyadmin/config.inc.php

[...]
/* Authentication type */
$cfg['Servers'][$i]['auth_type'] = 'http';
[...]

然后我们为Apache创建系统启动链接并启动它：

systemctl enable httpd 
systemctl restart httpd

现在，您可以将浏览器定向到http://server1.example.com/phpmyadmin/或http://192.168.0.100/phpmyadmin/并使用用户名root和新的 MySQL 根密码登录。

11 安装 Amavisd-new、SpamAssassin、ClamAV 和 Postgrey

要安装 amavisd-new、SpamAssassin 和 ClamAV，请运行以下命令：

dnf -y install amavisd-new spamassassin clamav-server clamav-data clamav-update clamav-filesystem clamav clamav-scanner-systemd clamav-devel clamav-lib clamav-server-systemd unzip bzip2 perl-DBD-mysql postgrey re2c

然后我们启动freshclam、amavisd和clamd.amavisd：

sa-update 
freshclam 
systemctl enable amavisd.service 
systemctl start amavisd.service 
systemctl start clamd@amavisd.service 
systemctl enable postgrey.service 
systemctl start postgrey.service

在下一步中，我们配置 postgrey。在编辑器中打开文件 /etc/sysconfig/postgrey：

nano /etc/sysconfig/postgrey

并更改行：

POSTGREY_TYPE="--unix=/var/spool/postfix/postgrey/socket"

到

POSTGREY_TYPE="--inet=10023"

保存文件并重启 postgrey：

service postgrey restart

要配置 amavisd，请编辑文件 /etc/clamd.d/amavisd.conf：

nano /etc/clamd.d/amavisd.conf

并更改行：

LocalSocket /run/clamd.amavisd/clamd.sock

到

LocalSocket /var/spool/amavisd/clamd.sock

保存更改的配置文件并重新启动 ClamAV：

systemctl restart clamd@amavisd.service

现在我们必须为 freshclam 服务创建一个系统单元。创建一个新文件/usr/lib/systemd/system/freshclam.service：

nano /usr/lib/systemd/system/freshclam.service

并在该文件中输入以下内容：

[Unit]
Description = ClamAV Scanner
After = network.target

[Service]
Type = forking
# if you want to scan more than one in a day change the number 1 with your desired number in below line.
ExecStart = /usr/bin/freshclam -d -c 1
Restart = on-failure
PrivateTmp =true

[Install]
WantedBy=multi-user.target

保存文件，然后启用并启动服务。

systemctl enable freshclam.service 
systemctl start freshclam.service 
systemctl status freshclam.service

12 使用 mod_php、mod_fcgi/PHP、PHP-FPM 安装 Apache

ISPConfig 3 允许您在每个网站的基础上使用 mod_php、mod_fcgi/PHP、cgi/PHP 和 PHP-FPM。

我们可以使用 mod_php、mod_fcgid 和 PHP 安装 Apache2，如下所示：

dnf -y install php php-devel php-gd php-imap php-ldap php-mysql php-odbc php-pear php-xml php-xmlrpc php-pecl-apc php-mbstring php-mcrypt php-snmp php-soap php-tidy curl curl-devel perl-libwww-perl ImageMagick libxml2 libxml2-devel mod_fcgid php-cli httpd-devel php-fpm php-intl php-imagick php-pspell wget

接下来，我们打开/etc/php.ini …

nano /etc/php.ini

…并更改错误报告（以便不再显示通知），设置时区并取消注释cgi.fix_pathinfo=1：

[...]
;error_reporting = E_ALL & ~E_DEPRECATED
error_reporting = E_ALL & ~E_NOTICE & ~E_DEPRECATED & ~E_STRICT
[...]
; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI.  PHP's
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
; what PATH_INFO is.  For more information on PAppp.tldTH_INFO, see the cgi specs.  Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec.  A setting
; of zero causes PHP to behave as before.  Default is 1.  You should fix your scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; http://www.php.net/manual/en/ini.core.php#ini.cgi.fix-pathinfo
cgi.fix_pathinfo=1
[...]
date.timezone = 'Europe/Berlin'
[...]

启用 httpd 和 PHP-FPM 以在启动时启动并启动 PHP-FPM 服务。

systemctl start php-fpm.service
systemctl enable php-fpm.service
systemctl enable httpd.service

最后，我们重启Apache：

systemctl restart httpd.service

现在我们将添加对 Let’s encrypt 的支持。ISPConfig 现在使用 acme.sh 作为 Let’s Encrypt 客户端。使用以下命令安装 acme.sh：

curl https://get.acme.sh | sh -s

13 mod_python的安装

Apache 模块 mod_python 不能作为 RPM 包使用，因此我们将从源代码编译它。第一步是安装python开发文件并将当前的mod_python版本下载为.tar.gz文件

dnf -y install python3-devel

cd /usr/local/src/
wget http://dist.modpython.org/dist/mod_python-3.5.0.tgz
tar xfz mod_python-3.5.0.tgz
cd mod_python-3.5.0

然后配置和编译模块。

./configure --with-python=/usr/bin/python3
make

编译模块中存在一个错误，该错误将导致安装失败并显示错误“ version =”fatal: Not a git repository (or any of the parent directory): .git ”。要解决该问题，请运行此 sed 命令（命令是一行！）。

sed -e 's/(git describe --always)/(git describe --always 2>\/dev\/null)/g' -e 's/`git describe --always`/`git describe --always 2>\/dev\/null`/g' -i $( find . -type f -name Makefile\* -o -name version.sh )

然后使用此命令安装模块。

make install

并在 Apache 中启用该模块：

echo 'LoadModule python_module modules/mod_python.so' > /etc/httpd/conf.modules.d/10-python.conf
systemctl restart httpd.service

14 安装 PureFTPd

可以使用以下命令安装 PureFTPd：

dnf -y install pure-ftpd

然后创建系统启动链接并启动 PureFTPd：

systemctl enable pure-ftpd.service 
systemctl start pure-ftpd.service

现在我们配置 PureFTPd 以允许 FTP 和 TLS 会话。FTP 是一种非常不安全的协议，因为所有密码和所有数据都以明文形式传输。通过使用 TLS，可以对整个通信进行加密，从而使 FTP 更加安全。

TLS 需要 OpenSSL；要安装 OpenSSL，我们只需运行：

dnf install openssl

打开/etc/pure-ftpd/pure-ftpd.conf …

nano /etc/pure-ftpd/pure-ftpd.conf

如果要允许 FTP 和 TLS 会话，请通过删除 TLS 行前面的 #将TLS设置为1。强烈建议启用 TLS。

[...]
# This option can accept three values :
# 0 : disable SSL/TLS encryption layer (default).
# 1 : accept both traditional and encrypted sessions.
# 2 : refuse connections that don't use SSL/TLS security mechanisms,
#     including anonymous sessions.
# Do _not_ uncomment this blindly. Be sure that :
# 1) Your server has been compiled with SSL/TLS support (--with-tls),
# 2) A valid certificate is in place,
# 3) Only compatible clients will log in.

TLS                      1
[...]

为了使用 TLS，我们必须创建一个 SSL 证书。我在/etc/ssl/private/ 中创建它，因此我首先创建该目录：

mkdir -p /etc/ssl/private/

之后，我们可以生成 SSL 证书，如下所示：

openssl req -x509 -nodes -days 7300 -newkey rsa:2048 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem

Country Name (2 letter code) [XX]: <-- Enter your Country Name (e.g., "DE").
State or Province Name (full name) []:<-- Enter your State or Province Name.
Locality Name (eg, city) [Default City]:<-- Enter your City.
Organization Name (eg, company) [Default Company Ltd]:<-- Enter your Organization Name (e.g., the name of your company).
Organizational Unit Name (eg, section) []:<-- Enter your Organizational Unit Name (e.g. "IT Department").
Common Name (eg, your name or your server's hostname) []:<-- Enter the Fully Qualified Domain Name of the system (e.g. "server1.example.com").
Email Address []:<-- Enter your Email Address.

更改 SSL 证书的权限：

chmod 600 /etc/ssl/private/pure-ftpd.pem

创建一个 DHParam 文件：

openssl dhparam -out /etc/ssl/private/pure-ftpd-dhparams.pem 2048

最后，重启 PureFTPd：

systemctl restart pure-ftpd.service

而已。您现在可以尝试使用您的 FTP 客户端进行连接；但是，您应该将 FTP 客户端配置为使用 TLS。

15 安装绑定

我们可以按如下方式安装 BIND：

dnf -y install bind bind-utils hasged

备份现有的/etc/named.conf文件并创建一个新文件，如下所示：

cp /etc/named.conf /etc/named.conf_bak 
cat /dev/null > /etc/named.conf 
nano /etc/named.conf

//
// named.conf
//
// Provided by Red Hat bind package to configure the ISC BIND named(8) DNS
// server as a caching only nameserver (as a localhost DNS resolver only).
//
// See /usr/share/doc/bind*/sample/ for example named configuration files.
//
options {
        listen-on port 53 { any; };
        listen-on-v6 port 53 { any; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        allow-query     { any; };
				allow-recursion {"none";};
        recursion no;
};
logging {
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};
zone "." IN {
        type hint;
        file "named.ca";
};
include "/etc/named.conf.local";

创建文件/etc/named.conf.local被包括在年底的/etc/named.conf（/etc/named.conf.local稍后会得到由ISPConfig如果你创建ISPConfig DNS区域填充）：

touch /etc/named.conf.local

然后我们创建启动链接并启动 BIND：

systemctl enable named.service 
systemctl start named.service 
systemctl enable hasged.service 
systemctl start hasged.service

16 安装 AWStats

AWStats 可以按如下方式安装：

dnf -y install awstats perl-DateTime-Format-HTTP perl-DateTime-Format-Builder

CentOS 8 不再提供替代的网络统计应用程序“webalizer”，因此您将只能使用 AWStats。

17 安装Jailkit

Jailkit 用于 chroot SSH 用户和 cronjobs。它可以安装如下：

ln -s /usr/bin/python2 /usr/bin/python 
cd /tmp 
wget http://olivier.sessink.nl/jailkit/jailkit-2.21.tar.gz 
tar xvfz jailkit-2.21.tar.gz 
cd jailkit- 2.21 
./configure 
make 
make install 
cd .. 
rm -rf jailkit-2.21*

18 安装 Fail2Ban

这是可选的但建议使用，因为 ISPConfig 监视器会尝试显示日志。

dnf -y install iptables-services fail2ban fail2ban-systemd 
systemctl stop firewalld.service 
systemctl mask firewalld.service 
systemctl disable firewalld.service

接下来我们创建 /etc/fail2ban/jail.local 文件并启用对 ssh、电子邮件和 ftp 服务的监控。

nano /etc/fail2ban/jail.local

在 jail.local 文件中添加以下内容：

[sshd] 
enabled = true 
action = iptables[name=sshd, port=ssh, protocol=tcp] 

[pure-ftpd] 
enabled = true 
action = iptables[name=FTP, port=ftp, protocol=tcp] 
maxretry = 3 

[ dovecot] 
enabled = true 
action = iptables-multiport[name=dovecot, port="pop3,pop3s,imap,imaps", protocol=tcp] 
maxretry = 5 

[postfix-sasl] 
enabled = true 
action = iptables-multiport[name= postfix-sasl, port="smtp,smtps,submission", protocol=tcp] 
maxretry = 3

然后为fail2ban创建系统启动链接并启动它：

systemctl enable fail2ban.service 
systemctl start fail2ban.service

19 安装rkhunter

rkhunter 可以如下安装：

dnf -y install rkhunter

20 安装mailman

如果您喜欢在服务器上使用 Mailman 管理邮件列表，请立即安装 mailman。ISPConfig 支持 Mailman，因此您可以稍后通过 ISPConfig 创建新的邮件列表。

dnf -y install mailman

在我们可以启动 Mailman 之前，必须创建一个名为mailman 的邮件列表：

touch /var/lib/mailman/data/aliases
postmap /var/lib/mailman/data/aliases
/usr/lib/mailman/bin/newlist mailman
ln -s /usr/lib/mailman/mail/mailman /usr/bin/mailman

[root@server1 tmp]# /usr/lib/mailman/bin/newlist mailman
Enter the email of the person running the list: <-- admin email address, e.g. listadmin@example.com
Initial mailman password: <-- admin password for the mailman list
To finish creating your mailing list, you must edit your /etc/aliases (or
equivalent) file by adding the following lines, and possibly running the
`newaliases' program:

## mailman mailing list
mailman:              "|/usr/lib/mailman/mail/mailman post mailman"
mailman-admin:        "|/usr/lib/mailman/mail/mailman admin mailman"
mailman-bounces:      "|/usr/lib/mailman/mail/mailman bounces mailman"
mailman-confirm:      "|/usr/lib/mailman/mail/mailman confirm mailman"
mailman-join:         "|/usr/lib/mailman/mail/mailman join mailman"
mailman-leave:        "|/usr/lib/mailman/mail/mailman leave mailman"
mailman-owner:        "|/usr/lib/mailman/mail/mailman owner mailman"
mailman-request:      "|/usr/lib/mailman/mail/mailman request mailman"
mailman-subscribe:    "|/usr/lib/mailman/mail/mailman subscribe mailman"
mailman-unsubscribe:  "|/usr/lib/mailman/mail/mailman unsubscribe mailman"

Hit enter to notify mailman owner... <-- ENTER

[root@server1 tmp]#

之后打开/etc/aliases …

nano /etc/aliases

…并添加以下几行：

[...]
mailman:              "|/usr/lib/mailman/mail/mailman post mailman"
mailman-admin:        "|/usr/lib/mailman/mail/mailman admin mailman"
mailman-bounces:      "|/usr/lib/mailman/mail/mailman bounces mailman"
mailman-confirm:      "|/usr/lib/mailman/mail/mailman confirm mailman"
mailman-join:         "|/usr/lib/mailman/mail/mailman join mailman"
mailman-leave:        "|/usr/lib/mailman/mail/mailman leave mailman"
mailman-owner:        "|/usr/lib/mailman/mail/mailman owner mailman"
mailman-request:      "|/usr/lib/mailman/mail/mailman request mailman"
mailman-subscribe:    "|/usr/lib/mailman/mail/mailman subscribe mailman"
mailman-unsubscribe:  "|/usr/lib/mailman/mail/mailman unsubscribe mailman"

运行：

newaliases

之后并重新启动Postfix：

systemctl restart postfix.service

现在打开 Mailman Apache 配置文件/etc/httpd/conf.d/mailman.conf …

nano /etc/httpd/conf.d/mailman.conf

…并添加行ScriptAlias /cgi-bin/mailman/ /usr/lib/mailman/cgi-bin/。注释掉Alias /pipermail/ /var/lib/mailman/archives/public/并添加一行Alias /pipermail /var/lib/mailman/archives/public/：

#
#  httpd configuration settings for use with mailman.
#

ScriptAlias /mailman/ /usr/lib/mailman/cgi-bin/
ScriptAlias /cgi-bin/mailman/ /usr/lib/mailman/cgi-bin/
<Directory /usr/lib/mailman/cgi-bin/>
    AllowOverride None
    Options ExecCGI
    Order allow,deny
    Allow from all
</Directory>


#Alias /pipermail/ /var/lib/mailman/archives/public/
Alias /pipermail /var/lib/mailman/archives/public/
<Directory /var/lib/mailman/archives/public>
    Options Indexes MultiViews FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
    AddDefaultCharset Off
</Directory>

# Uncomment the following line, to redirect queries to /mailman to the
# listinfo page (recommended).

# RedirectMatch ^/mailman[/]*$ /mailman/listinfo

重启阿帕奇：

systemctl restart httpd.service

为 Mailman 创建系统启动链接并启动它：

systemctl enable mailman.service 
systemctl start mailman.service

安装 ISPConfig 3 后，您可以按如下方式访问 Mailman：

您可以为所有 Apache 虚拟主机使用别名/cgi-bin/mailman（请注意，必须为所有要访问 Mailman 的虚拟主机禁用 suExec 和 CGI！），这意味着您可以访问 Mailman 管理界面以获取列表在http://<vhost>/cgi-bin/mailman/admin/<listname>，邮件列表用户的网页可以在http://<vhost>/cgi-bin/mailman/listinfo/<listname>..

在http://<vhost>/pipermail/<listname> 下，您可以找到邮件列表档案。

21 安装 Roundcube 网络邮件

要安装 RoundCube webmail 客户端，请使用 wget 将最新版本下载到 /tmp 文件夹：

cd /tmp
wget https://github.com/roundcube/roundcubemail/releases/download/1.4.3/roundcubemail-1.4.3-complete.tar.gz

解压 tar.gz 存档并将 RoundCube 源移动到 /usr/share/roundcubemail

tar xfz roundcubemail-1.4.3-complete.tar.gz 
mkdir /usr/share/ 
roundcubemail mv /tmp/roundcubemail-1.4.3/* /usr/share/roundcubemail/ 
chown -R root:root /usr/share/roundcubemail 
chown apache /usr/share/roundcubemail/temp 
chown apache /usr/share/roundcubemail/logs

使用 nano 编辑器创建一个 roundcubemail.conf 配置文件：

nano /etc/httpd/conf.d/roundcubemail.conf

并将以下内容添加到该文件中：

#
# Round Cube Webmail is a browser-based multilingual IMAP client
#

Alias /roundcubemail /usr/share/roundcubemail
Alias /webmail /usr/share/roundcubemail

# Define who can access the Webmail
# You can enlarge permissions once configured

<Directory /usr/share/roundcubemail/>
        Options none
        AllowOverride Limit
        Require all granted
</Directory>

# Define who can access the installer
# keep this secured once configured

<Directory /usr/share/roundcubemail/installer>
        Options none
        AllowOverride Limit
        Require all granted
</Directory>


# Those directories should not be viewed by Web clients.
<Directory /usr/share/roundcubemail/bin/>
    Order Allow,Deny
    Deny from all
</Directory>
<Directory /usr/share/roundcubemail/plugins/enigma/home/>
    Order Allow,Deny
    Deny from all
</Directory>

重启阿帕奇：

systemctl restart httpd.service

现在我们需要一个 RoundCube 邮件数据库，我们将其初始化如下：

mysql -u root -p

在 MariaDB 提示下使用：

CREATE DATABASE roundcubedb;
CREATE USER roundcubeuser@localhost IDENTIFIED BY 'roundcubepassword';
GRANT ALL PRIVILEGES on roundcubedb.* to roundcubeuser@localhost ;
FLUSH PRIVILEGES;
exit

我以 RoundCube 数据库的详细信息为例，出于安全原因，请根据您的选择替换值。

现在我们将在浏览器中安装 RoundCube，地址为http://192.168.0.100/roundcubemail/installer

现在创建 config.inc.php 文件：

nano /usr/share/roundcubemail/config/config.inc.php

<?php

/* Local configuration for Roundcube Webmail */

// ----------------------------------
// SQL DATABASE
// ----------------------------------
// Database connection string (DSN) for read+write operations
// Format (compatible with PEAR MDB2): db_provider://user:password@host/database
// Currently supported db_providers: mysql, pgsql, sqlite, mssql, sqlsrv, oracle
// For examples see http://pear.php.net/manual/en/package.database.mdb2.intro-dsn.php
// NOTE: for SQLite use absolute path (Linux): 'sqlite:full/path/to/sqlite.db?mode=0646'
// or (Windows): 'sqlite:///C:/full/path/to/sqlite.db'
$config['db_dsnw'] = 'mysql://roundcubeuser:roundcubepassword@localhost/roundcubedb';

// ----------------------------------
// IMAP
// ----------------------------------
// The IMAP host chosen to perform the log-in.
// Leave blank to show a textbox at login, give a list of hosts
// to display a pulldown menu or set one host as string.
// To use SSL/TLS connection, enter hostname with prefix ssl:// or tls://
// Supported replacement variables:
// %n - hostname ($_SERVER['SERVER_NAME'])
// %t - hostname without the first part
// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
// %s - domain name after the '@' from e-mail address provided at login screen
// For example %n = mail.domain.tld, %t = domain.tld
// WARNING: After hostname change update of mail_host column in users table is
// required to match old user data records with the new host.
$config['default_host'] = 'localhost';
$config['smtp_server'] = 'localhost';
$config['smtp_port'] = 25;

// provide an URL where a user can get support for this Roundcube installation
// PLEASE DO NOT LINK TO THE ROUNDCUBE.NET WEBSITE HERE!
$config['support_url'] = '';

// This key is used for encrypting purposes, like storing of imap password
// in the session. For historical reasons it's called DES_key, but it's used
// with any configured cipher_method (see below).
$config['des_key'] = 'pb0UucO0eqjgvhrqYlFTBVjE';

// ----------------------------------
// PLUGINS
// ----------------------------------
// List of active plugins (in plugins/ directory)
$config['plugins'] = array();

// Set the spell checking engine. Possible values:
// - 'googie' - the default (also used for connecting to Nox Spell Server, see 'spellcheck_uri' setting)
// - 'pspell' - requires the PHP Pspell module and aspell installed
// - 'enchant' - requires the PHP Enchant module
// - 'atd' - install your own After the Deadline server or check with the people at http://www.afterthedeadline.com before using their API
// Since Google shut down their public spell checking service, the default settings
// connect to http://spell.roundcube.net which is a hosted service provided by Roundcube.
// You can connect to any other googie-compliant service by setting 'spellcheck_uri' accordingly.
$config['spellcheck_engine'] = 'pspell';
$config['enable_installer'] = true;

然后在网络安装程序中按“继续”。在下一页上，按“初始化数据库”按钮。

最后，禁用 Roundecubemail 安装程序。更改 RoundCube config.inc.php 配置文件

nano /usr/share/roundcubemail/config/config.inc.php

并更改行：

$config['enable_installer'] = true;

到：

$config['enable_installer'] = false;

Roundcube 现在在您服务器上的别名 /webmail 和 /roundcubemail 下可用：

http://192.168.0.100/webmail

RoundCube 登录名是您稍后在 ISPConfig 中创建的电子邮件帐户的电子邮件地址和密码。

22 安装ISPConfig 3.2

ISPConfig 安装程序将为您配置所有服务，如 Postfix、Dovecot 等。

您现在还可以让安装程序为 ISPConfig 控制面板创建 SSL 虚拟主机，以便可以使用https://而不是http://访问 ISPConfig 。要实现此目的，只需在看到以下问题时按ENTER 键：Do you want a secure (SSL) connection to the ISPConfig web interface (y,n) [y]:。

要安装 ISPConfig 3.2 nightly build，请执行以下操作：

cd /tmp
wget -O ispconfig.tar.gz https://www.ispconfig.org/downloads/ISPConfig-3-stable.tar.gz 
tar xfz ispconfig.tar.gz
 cd ispconfig3*/install/

下一步是运行：

php -q install.php

这将启动 ISPConfig 3 安装程序。安装程序将为您配置所有服务，如 Postfix、Dovecot 等。

[ root@server1 install]# php install.php


--------------------------------------------------------------------------------
_____ ___________ _____ __ _ ____
|_ _/ ___| ___ \ / __ \ / _(_) /__ \
| | \ `--.| |_/ / | / \/ ___ _ __ | |_ _ __ _ _/ /
| | `--. \ __/ | | / _ \| '_ \| _| |/ _` | |_ |
_| |_/\__/ / | | \__/\ (_) | | | | | | | (_| | ___\ \
\___/\____/\_| \____/\___/|_| |_|_| |_|\__, | \____/
__/ |
|___/
--------------------------------------------------------------------------------

>> Initial configuration

Operating System: CentOS 8.2

Following will be a few questions for primary configuration so be careful.
Default values are in [brackets] and can be accepted with <ENTER>.
Tap in "quit" (without the quotes) to stop the installer.

Select language (en,de) [en]: <-- Hit Enter

Installation mode (standard,expert) [standard]: <-- Hit Enter

Full qualified hostname (FQDN) of the server, eg server1.domain.tld [server1.example.com]: <-- Hit Enter

MySQL server hostname [localhost]: <-- Hit Enter

MySQL server port [3306]: <-- Hit Enter

MySQL root username [root]: <-- Hit Enter

MySQL root password []: <-- Ente the MySQL root password here

MySQL database to create [dbispconfig]: <-- Hit Enter

MySQL charset [utf8]: <-- Hit Enter

Configuring Postgrey
Configuring Postfix
Generating a 4096 bit RSA private key
................................++
.....................................................................................................................................................................................................................................................................................................................................................++
writing new private key to 'smtpd.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]: <-- Enter 2 Letter country code, e.g. US
State or Province Name (full name) []: <-- Enter anme of State or Province
Locality Name (eg, city) [Default City]: <-- Name of city
Organization Name (eg, company) [Default Company Ltd]: <-- Company name
Organizational Unit Name (eg, section) []: <-- Hit Enter
Common Name (eg, your name or your server's hostname) []: <-- Enter server hostname here, in my case: server1.example.com
Email Address []: <-- Enter Email address
Configuring mailman
Configuring Dovecot
Configuring Spamassassin
Configuring Amavisd
Configuring Getmail
Configuring Jailkit
Configuring Pureftpd
Configuring BIND
Configuring Apache
Configuring vlogger
[INFO] service OpenVZ not detected
Configuring Bastille Firewall
[INFO] service Metronome XMPP Server not detected
Configuring Fail2ban
Configuring Apps vhost
Installing ISPConfig
ISPConfig Port [8080]: <-- Hit Enter

Admin password [fad579a6]: <-- Enter new password for ISPConfig admin user

Re-enter admin password []: <-- Repeat the password

Do you want a secure (SSL) connection to the ISPConfig web interface (y,n) [y]: <-- Hit Enter

Generating RSA private key, 4096 bit long modulus
.................................................................................++
.....++
e is 65537 (0x10001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]: <-- Enter 2 Letter country code, e.g. US
State or Province Name (full name) []: <-- Enter anme of State or Province
Locality Name (eg, city) [Default City]: <-- Name of city
Organization Name (eg, company) [Default Company Ltd]: <-- Company name
Organizational Unit Name (eg, section) []: <-- Hit Enter
Common Name (eg, your name or your server's hostname) []: <-- Enter server hostname here, in my case: server1.example.com
Email Address []: <-- Enter Email address

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: <-- Hit Enter
An optional company name []: <-- Hit Enter
writing RSA key

Configuring DBServer
Installing ISPConfig crontab
Installing ISPConfig crontab
no crontab for root
no crontab for getmail
Detect IP addresses
Restarting services ...
Installation completed.

安装程序会自动配置所有底层服务，因此无需手动配置。

23 第一次 ISPConfig 登录

之后您可以在http(s)://server1.example.com:8080/或http(s)://192.168.0.100:8080/下访问 ISPConfig 3 （http或https 取决于您在安装过程中选择的内容）。

使用用户名admin和密码admin登录（首次登录后应更改默认密码）：

23.1 ISPConfig 3 手册

为了学习如何使用 ISPConfig 3，我强烈建议您下载 ISPConfig 3 手册。

下载地址：

https://www.howtoforge.com/download-the-ispconfig-3-manual

在 300 多页中，它涵盖了 ISPConfig（管理员、经销商、客户）背后的概念，解释了如何安装和更新 ISPConfig 3，包括 ISPConfig 中所有表单和表单字段的参考以及有效输入的示例，并提供教程用于 ISPConfig 3 中最常见的任务。它还列出了如何使您的服务器更安全，并在最后附有故障排除部分。

24 下载为虚拟机

此设置可作为 ova/ovf 格式（与 VMWare 和 Virtualbox 兼容）的虚拟机下载，供 howtoforge 订阅者使用。

VM 的登录详细信息

root 密码是：howtoforge
ISPConfig“admin”用户的密码是：howtoforge
还有另一个名为“howtoforge”和密码的 shell 用户：howtoforge

请在第一次登录时更改两个密码。

VM 的 IP 地址为 192.168.0.100

标签：mailman,service,CentOS,ISP,服务器上安装,etc,systemctl,usr,php
来源： https://blog.csdn.net/weixin_43025343/article/details/122006581