SSH-Konfiguration anpassen: "/etc/ssh/sshd_config"

nano /etc/ssh/sshd_config

 AuthenticationMethods publickey
 PasswordAuthentication no
 ChallengeResponseAuthentication no
 PermitRootLogin no
 PermitEmptyPasswords no

Standard-Port (22) ändern

#Port 22
Port 99999

chown www-data:www-data  -R * # webserver ownership

find . -type d -exec chmod 755 {} \;
# Change directory permissions rwxr-xr-x

find . -type f -exec chmod 644 {} \;
# Change file permissions rw-r--r--

Nach der Installation

chown <username>:<username>  -R * # Let your useraccount be owner
chown www-data:www-data wp-content # Let webserver be owner of wp-content

Derzeitige Version überprüfen:

Node:

node -v

NPM:

npm -v

Node Versions-Management-Tool n installieren:

sudo npm install -g n

Node Version ändern

Wechsel zu spezifischer Version:

sudo n 11.15.0

Wechsel zu aktuellen stabilen Version:

sudo n stable

Restart des Terminals bei Problemen empfohlen.

Windows:

nvm-windows

sudo apt-get install python-virtualenv build-essential python python-dev

sudo mkdir /var/www/demoapp

cd /var/www/demoapp
virtualenv venv
. venv/bin/activate

flask installieren:

pip install flask

uwsgi installieren:

pip install uwsgi

nginx config:

server {
    listen      80; #443
    server_name myapp.com;
    charset     utf-8;
    client_max_body_size 75M;

    location / { try_files $uri @myapp; }
    location @myapp {
        include uwsgi_params;
        uwsgi_pass unix:/var/www/demoapp/demoapp_uwsgi.sock;
    }
   #alternnative locatio
    location / {
        include uwsgi_params;
        uwsgi_pass unix:/var/www/demoapp/demoapp_uwsgi.sock;
    }
}

nginx -t
service nginx reload

uWSGI config:

/var/www/demoapp/demoapp_uwsgi.ini:

[uwsgi]
#application's base folder
base = /var/www/demoapp

#python module to import, start/setup file
app = myapp
module = %(app)

home = %(base)/venv
pythonpath = %(base)

#socket file's location
socket = /var/www/demoapp/%n.sock

#permissions for the socket file
chmod-socket    = 666
# security
#chmod-socket    = 644

#the variable that holds a flask application inside the module
callable = app

#location of log files
logto = /var/log/uwsgi/%n.log

uWSGI Emperor

/etc/init/uwsgi.conf

description "uWSGI"
start on runlevel [2345]
stop on runlevel [06]
respawn

env UWSGI=/var/www/demoapp/venv/bin/uwsgi
env LOGTO=/var/log/uwsgi/emperor.log

exec $UWSGI --master --emperor /etc/uwsgi/vassals --die-on-term --uid www-data --gid www-data --logto $LOGTO

config dateien nach vassals verlinken –> /etc/uwsgi/vassals

sudo mkdir /etc/uwsgi && sudo mkdir /etc/uwsgi/vassals
sudo ln -s /var/www/demoapp/demoapp_uwsgi.ini /etc/uwsgi/vassals

uWSGI starten:

sudo start uwsgi

Statische Dateien:

location /static {
    root /var/www/demoapp/;
}

https://vladikk.com/2013/09/12/serving-flask-with-nginx-on-ubuntu/

https://www.digitalocean.com/community/tutorials/how-to-serve-flask-applications-with-uwsgi-and-nginx-on-ubuntu-16-04

Anpassungen:

„numberposts“ –> Anzahl der anzuzeigenden Beiträge

„post_type“ => ‚post‘ –> Nur Beiträge anzeigen

„post_status“ => „publish“ –> Nur veröffentlichte Beiträge anzeigen (Keine Entwürfe!)

Quelle: https://davidwalsh.name/wordpress-recent-posts

wget https://wordpress.org/latest.tar.gz

tar -xzvf latest.tar.gz

WordPress wird mit wget heruntergeladen und im Verzeichnis „wordpress“ entpackt.

server {
     listen 80;
     server_name *.domain.com;
     return 301 https://$host$request_uri;
     }
 server {
    listen 443 ssl http2;
    ssl on;
    server_name ~^(?<subdomain>[^.]+).domain.com;
 
    keepalive_timeout 300;
 
    # Letsencrypt
    ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;
    # Cipher
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
    ssl_dhparam /etc/ssl/private/dhparam.pem;
    ssl_ecdh_curve secp384r1;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
 
    # OSCP
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
    ssl_trusted_certificate /etc/letsencrypt/live/domain.com/chain.pem;
   
    # Header
    add_header Strict-Transport-Security max-age=63072000; # HSTS
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
 
    # Document-Root
    root /var/www/domain.com/$subdomain/public;
   
    index index.php index.html index.htm;
 
    location / {
        try_files $uri $uri/ =404;
    }
 
    # FastCGI
    fastcgi_param HTTPS on;
    location ~ \.php$ {
        try_files  $uri  =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php5-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param HTTPS on;
        fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
        fastcgi_intercept_errors on;
    }
 
} 

Problem:

Eigene Domain-Namen bei Azure Web Apps sind nicht kostenlos möglich. Durch einen Nginx Reverse Proxy von einem externem Server/Anbieter zu Azure Cloud kann man das Problem umgehen.

Lösung:

Eigene Domain auf Server mit nginx (inklusive Letsencrypt, kostenlose SSL-Zertifikate)
—>
nginx reverse proxy
—>
Azure Web App (zb. ASP.NET)

https://domain.com –> proxy –> webappname.azurewebsites.net

Nginx Config (Reverse Proxy zu Azure Web App)

server {
     listen 80;
     server_name domain.com www.domain.com;
     
     location /.well-known/acme-challenge { 
     default_type "text/plain";
     root /var/www/letsencrypt;
     } 
     location / {
     return 301 https://$server_name$request_uri;
     }
 }

upstream app_webappname {                           
     server webappname.azurewebsites.net:443; 
 }
 server {
     listen 443 ssl http2;
     ssl on;
     server_name www.domain.com domain.com;
     keepalive_timeout 300;
     
     # letsencrypt
     ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;
     
     # Cipher
     ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_prefer_server_ciphers on;
     ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
     ssl_dhparam /etc/ssl/private/dhparam.pem; ssl_ecdh_curve secp384r1;
     ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m;
     
     # OSCP
     ssl_stapling on; ssl_stapling_verify on;
     resolver 8.8.8.8 8.8.4.4 valid=300s;
     resolver_timeout 5s;
     ssl_trusted_certificate /etc/letsencrypt/live/domain.com/chain.pem;

     # proxy to upstream
     location / { proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header Host webappname.azurewebsites.net;
     proxy_set_header X-Forwarded-Proto $scheme;
     #proxy_set_header X-NginX-Proxy true;
     proxy_ssl_session_reuse off;
     proxy_pass https://app_webappname/;
     proxy_redirect off;
     }
 }

Azure Web App Einstellungen

Networking –> Access Restrictions
Nur Traffic von Reverse Proxy Server zulassen.
Neue Regel (Add rule) –> allow IP (IP vom nginx proxy Server)

TLS/SSL settings –> Bindings
HTTPS Only –> auf „On“

Quellen und weitere Informationen:
https://withouttheloop.com/articles/2017-07-23-nginx-letsencrypt-azure-web-app/
https://www.cloudflare.com/learning/cdn/glossary/reverse-proxy/
https://www.nginx.com/resources/glossary/reverse-proxy-server/
https://docs.nginx.com/nginx/admin-guide/web-server/reverse-proxy/
https://mohitgoyal.co/2018/06/02/load-balance-azure-web-apps-using-nginx-server/

Modul „vhost_alias“ aktivieren

–> vhost_alias.load
/etc/apache2/mods-enabled
/etc/apache2/mods-available

apache2ctl -M

nach vhost_alias.load suchen und wenn nicht aktiviert mit a2enmod aktivieren

sudo a2enmod vhost_alias

danach neu starten

service apache2 restart

dynamischen vHost konfigurieren

<VirtualHost *:80>
    	ServerAlias *.example.com
    	VirtualDocumentRoot /var/www/example.com/subdomain/%1/public/
	ServerAdmin mail@example.com
	<Directory /var/www/example.com/subdomain/*/>
		Options -Indexes +FollowSymLinks +MultiViews
		AllowOverride All
		Order allow,deny
		allow from all
	</Directory>
  ErrorLog ${APACHE_LOG_DIR}/error.log
	# Possible values include: debug, info, notice, warn, error, crit,
	# alert, emerg.
	LogLevel warn
</VirtualHost>

Source:

https://httpd.apache.org/docs/2.4/mod/mod_vhost_alias.html

https://www.chris-shaw.com/blog/using-wildcards-in-virtual-hosts-on-apache

• certbot-auto
• dns-cloudflare plugin
• CloudFlare API
• nginx dynamische vhosts

Schritt 1 – certbot deinstallieren
Wenn installiert, certbot deinstallieren

sudo apt-get remove certbot

Schritt 2 – certbot-auto installieren (https://certbot.eff.org/)

https://certbot.eff.org/lets-encrypt/debianjessie-nginx

cd /root
wget https://dl.eff.org/certbot-auto
chmod a+x certbot-auto

Schritt 3 – certbot plugin installieren (certbot-dns-cloudflare)

Details: https://devops.stackexchange.com/questions/3757/how-to-install-certbot-plugins

Plugins checken:

./certbot-auto plugins

Zu certbot-auto Installationsort wechseln und mit pip Plugin installieren

cd /opt/eff.org/certbot/venv
source bin/activate
pip install certbot-dns-cloudflare
deactivate

Plugins erneut kontrollieren:

./certbot-auto plugins

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
* apache
Description: Apache Web Server plugin - Beta
Interfaces: IAuthenticator, IInstaller, IPlugin
Entry point: apache = certbot_apache.entrypoint:ENTRYPOINT

* dns-cloudflare
Description: Obtain certificates using a DNS TXT record (if you are using Cloudflare for DNS).
.... 

* nginx
Description: Nginx Web Server plugin
Interfaces: IAuthenticator, IInstaller, IPlugin
Entry point: nginx = certbot_nginx.configurator:NginxConfigurator

* standalone
Description: Spin up a temporary webserver
Interfaces: IAuthenticator, IPlugin
Entry point: standalone = certbot.plugins.standalone:Authenticator

* webroot
Description: Place files in webroot directory
Interfaces: IAuthenticator, IPlugin
Entry point: webroot = certbot.plugins.webroot:Authenticator
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Schritt 4 – Cloudflare API Zugangsdaten

Details:https://bjornjohansen.no/wildcard-certificate-letsencrypt-cloudflare

Datei erstellen mit API Key:

dns_cloudflare_email = "youremail@example.com"
dns_cloudflare_api_key = "4jg3252352sfsdffghfjghfjg6252522352cbcab4"

zb /root/.secrets/cloudflare.ini

Berechtigungen:

$ sudo chmod 0700 /root/.secrets/
$ sudo chmod 0400 /root/.secrets/cloudflare.ini

Schritt 5 – Zertifikat anlegen

cd /root
./certbot-auto certonly --dns-cloudflare --dns-cloudflare-credentials /root/.secrets/cloudflare.ini -d *.example.com --preferred-challenges dns-01

Schritt 5 – nginx vHosts (dynamisch)

Ordnerstruktur für *.example.com

/var/www/example.com/subdomain/*/public

server {
    listen 80;
    #listen [::]:80;
    server_name *.example.com;
    return 301 https://$host$request_uri;
    }

server {
    listen 443 ssl http2;
    ssl on;
    #listen [::]:443 ssl spdy;
    server_name ~^(?<subdomain>[^.]+).example.com;


    # Letsencrypt
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    # Cipher
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
    ssl_dhparam /etc/ssl/private/dhparam.pem;
    ssl_ecdh_curve secp384r1;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    #OSCP
    ssl_stapling on;
    ssl_stapling_verify on;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

    #Document-Root
    root /var/www/example.com/subdomain/$subdomain/public;
    index index.html index.htm index.php;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        try_files  $uri  =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php5-fpm.sock;
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param HTTPS on;
        fastcgi_param SCRIPT_FILENAME 
        $document_root/$fastcgi_script_name;
        fastcgi_intercept_errors on;
    }