SHOW:
|
|
- or go back to the newest paste.
| 1 | `First if you read this tutorial ,this mean that you didnt purchase the installation service (100 dollars) and i wont help you for fix anything since im a busy guy and you must foolow carrefully this tutorial and all will be good.. | |
| 2 | ||
| 3 | follow this tutorial for hide all behind cloudlflare | |
| 4 | https://www.cloudflare.com/resources-downloads#mod_cloudflare | |
| 5 | //my setting | |
| 6 | http://snag.gy/dml7X.jpg | |
| 7 | ||
| 8 | CentOS 6 32/64 bit | |
| 9 | ||
| 10 | ||
| 11 | //little update | |
| 12 | yum -y update | |
| 13 | ||
| 14 | //Install PHP, and a few other goodies | |
| 15 | yum -y install php php-devel php-gd php-imap php-ldap php-mysql php-odbc php-pear php-xml php-xmlrpc curl curl-devel perl-libwww-perl ImageMagick libxml2 libxml2-devel php-mcrypt | |
| 16 | ||
| 17 | //if problem with php version because sometime the command above install wrong version | |
| 18 | yum -y install php53 php53-devel php53-gd php53-imap php53-ldap php53-mysql php53-odbc php53-pear php53-xml php53-xmlrpc curl curl-devel perl-libwww-perl ImageMagick libxml2 libxml2-devel php53-mcrypt | |
| 19 | ||
| 20 | ||
| 21 | if mcrypt is "no package available do this (it happend to me) | |
| 22 | rpm -ivh http://www.mirrorservice.org/sites/dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm | |
| 23 | yum -y install php-mcrypt | |
| 24 | ||
| 25 | //Install Mysql 5 | |
| 26 | yum -y install mysql | |
| 27 | yum -y install mysql-devel | |
| 28 | yum -y install mysql-server | |
| 29 | ||
| 30 | //Start MySQL and change the mysql password | |
| 31 | service mysqld start | |
| 32 | mysqladmin -u root password NEWMYSQLROOTPASSWORD | |
| 33 | chown mysql:mysql -R /var/lib/mysql | |
| 34 | service mysqld restart | |
| 35 | ||
| 36 | //create user and allow access for each user to each DB | |
| 37 | CREATE USER 'wordpress'@'localhost' IDENTIFIED BY 'uwhuiwefhewuihfiweuh'; //change the pass to your own | |
| 38 | CREATE USER 'suite'@'localhost' IDENTIFIED BY 'uohfjuwfhouweh4yew';//change the pass to your ownd | |
| 39 | ||
| 40 | GRANT ALL PRIVILEGES ON wordpress TO 'wordpress'@'localhost'; | |
| 41 | GRANT ALL PRIVILEGES ON suite TO 'suite'@'localhost'; | |
| 42 | ||
| 43 | //for disable wordpress rehash if its migration (it avoid rehash mysqld so it dont take time to load wo DB in command line) | |
| 44 | mysql -uroot -p -A | |
| 45 | ||
| 46 | mysql_secure_installation //it will do some secure thing and prompt you u can dissalow root login | |
| 47 | ||
| 48 | create a "wordpress" database & edit the file /_wordpress/wp-config.php (you must enter only the DB info nothing else) | |
| 49 | create a "suite" database and upload the sql file provided in the BHC package | |
| 50 | ||
| 51 | ||
| 52 | ||
| 53 | //create right for the folder we will work on | |
| 54 | chown -R apache:apache black | |
| 55 | cd public_html/ | |
| 56 | chmod +x *.php | |
| 57 | echo 0 >/selinux/enforce | |
| 58 | service httpd restart | |
| 59 | ||
| 60 | //Install Nano (notepad for linux) | |
| 61 | yum -y install nano | |
| 62 | ||
| 63 | //Install Zend Guard (32 bits) | |
| 64 | zend guard (32 bits) | |
| 65 | wget http://downloads.zend.com/guard/5.5.0/ZendGuardLoader-php-5.3-linux-glibc23-i386.tar.gz | |
| 66 | tar -zxf ZendGuardLoader-php-5.3-linux-glibc23-i386.tar.gz | |
| 67 | cp ZendGuardLoader-php-5.3-linux-glibc23-i386/php-5.3.x/ZendGuardLoader.so /usr/lib/php/modules | |
| 68 | //add zend path to php.ini with nano | |
| 69 | nano /etc/php.ini | |
| 70 | zend_extension=/usr/lib/php/modules/ZendGuardLoader.so | |
| 71 | ||
| 72 | or 64 bits | |
| 73 | ||
| 74 | //Install Zend Guard (64 bits) | |
| 75 | wget http://downloads.zend.com/guard/5.5.0/ZendGuardLoader-php-5.3-linux-glibc23-x86_64.tar.gz | |
| 76 | tar -zxvf ZendGuardLoader-php-5.3-linux-glibc23-x86_64.tar.gz | |
| 77 | cp ZendGuardLoader-php-5.3-linux-glibc23-x86_64/php-5.3.x/ZendGuardLoader.so /usr/lib64/php/modules | |
| 78 | //add zend path to php.ini with nano | |
| 79 | nano /etc/php.ini | |
| 80 | zend_extension=/usr/lib64/php/modules/ZendGuardLoader.so | |
| 81 | ||
| 82 | //install Bind utility installation | |
| 83 | yum -y install bind bind-utils | |
| 84 | ||
| 85 | //install phpmyadmin | |
| 86 | yum -y install phpmyadmin | |
| 87 | Open /etc/httpd/conf.d/phpMyAdmin.conf file and find the lines “Deny from All ” and comment those lines and restart httpd service | |
| 88 | ||
| 89 | ///////////////////////////////////////////////////////////////////////////////////////////////////////////////// | |
| 90 | //if you have problem for install phpmyadmin because it is not available via "yum" , the simple solution is to find rpm package | |
| 91 | //this command download phpmyadmin rpm & add to repo the package phpmyadmin (u can yum it ) | |
| 92 | rpm -Uvh [url]http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm[/url] | |
| 93 | //& then | |
| 94 | yum -y install phpmyadmin | |
| 95 | ////////////////////////////////////////////////////////////////////////////////////////////////////////////////// | |
| 96 | ||
| 97 | ||
| 98 | ||
| 99 | ||
| 100 | setup virtualhosts in httpd.conf | |
| 101 | ||
| 102 | Head over to /etc/httpd/conf/httpd.conf | |
| 103 | ||
| 104 | ##Suite Path | |
| 105 | <VirtualHost yourmainip:80> | |
| 106 | DocumentRoot /home/black/public_html | |
| 107 | ServerName yourfirstiphere | |
| 108 | <Directory "/home/black/public_html/"> | |
| 109 | RewriteEngine On | |
| 110 | ## EVERYTHING BUT RESOURCES GOES TO THE BOOTSTRAPPER ## | |
| 111 | RewriteCond %{REQUEST_URI} !/(ajax|_www)/[a-zA-Z0-9_]{0,30}\.php$
| |
| 112 | RewriteRule !\.(js|ico|gif|jpg|png|css|swf)$ index.php | |
| 113 | ## COMPRESSED FILE PROCESS ## | |
| 114 | RewriteRule \.compressed\.(js|css)$ index.php?process=compress | |
| 115 | </Directory> | |
| 116 | </VirtualHost> | |
| 117 | ||
| 118 | ##Cloaked Site Builder | |
| 119 | <VirtualHost yourfirstadditionalip:80> | |
| 120 | DocumentRoot /home/black/public_html/_cloakedsitebuilder_root | |
| 121 | <Directory "/home/black/public_html/_cloakedsitebuilder_root"> | |
| 122 | RewriteEngine On | |
| 123 | RewriteBase / | |
| 124 | RewriteCond %{REQUEST_FILENAME} !-f
| |
| 125 | RewriteCond %{REQUEST_FILENAME} !-d
| |
| 126 | RewriteRule . /index.php [L] | |
| 127 | </Directory> | |
| 128 | </VirtualHost> | |
| 129 | ||
| 130 | ##Landing Page Builder | |
| 131 | <VirtualHost yoursecondaddiotnalip:80> | |
| 132 | DocumentRoot /home/black/public_html/_landingpagebuilder_root | |
| 133 | <Directory "/home/black/public_html/_landingpagebuilder_root"> | |
| 134 | RewriteEngine On | |
| 135 | RewriteRule !\.(css|js|ico|swf|jpg|jpeg|gif|png)$ index.php | |
| 136 | </Directory> | |
| 137 | </VirtualHost> | |
| 138 | ||
| 139 | ##Blog Cloaker | |
| 140 | <VirtualHost yourthirdadditonalip:80> | |
| 141 | DocumentRoot /home/black/public_html/_wordpress | |
| 142 | <Directory "/home/black/public_html/_wordpress"> | |
| 143 | RewriteEngine On | |
| 144 | RewriteBase / | |
| 145 | RewriteCond %{REQUEST_FILENAME} !-f
| |
| 146 | RewriteCond %{REQUEST_FILENAME} !-d
| |
| 147 | RewriteRule . /index.php [L] | |
| 148 | </Directory> | |
| 149 | </VirtualHost> | |
| 150 | ||
| 151 | ||
| 152 | ||
| 153 | continue for each free ip on the server. Replace mypath with the actual path you would like to use. After saving this, head over to the /home directory and actually create the folders you specified in the above paths. Upload Blog Cloaker to the suite directory, and upload the blog cloaker wordpress files to the clients directory. Be sure to configure both. | |
| 154 | ||
| 155 | //Disable SUEXEC (not compatible & you got 404 errror) | |
| 156 | echo 0 > /selinux/enforce | |
| 157 | mv /usr/sbin/suexec /usr/sbin/suexec_old | |
| 158 | /etc/init.d/httpd restart | |
| 159 | ||
| 160 | Check for SELINUX to disable it you just | |
| 161 | edit the /etc/selinux/config , set SELINUX=disabled and reboot | |
| 162 | ---------------- | |
| 163 | //CronJob | |
| 164 | nano /etc/crontab | |
| 165 | //enterthis | |
| 166 | 59 23 * * * wget http://MAINIPHERE/cron/analytics | |
| 167 | 59 23 * * * wget http://MAINIPHERE/cron/getiplist | |
| 168 | ||
| 169 | now at this step you can point your browser to your main url and you should see the installation page wich will ask you some destail | |
| 170 | ||
| 171 | //IP additonal :ip are not listed when u do command:ifconfig and you need to add them | |
| 172 | //usually main ip is assigned to eth0 and we create new for introduce in the network internal map | |
| 173 | // you must change IP under as exemple that reflect your additonal IP's, note that the eth0 number change for each (eth0:1,eth0:2 etc.) | |
| 174 | ||
| 175 | sudo ifconfig eth0:1 112.129.1.34 netmask 255.255.255.0 up | |
| 176 | sudo ifconfig eth0:2 112.129.1.35 netmask 255.255.255.0 up | |
| 177 | sudo ifconfig eth0:3 115.129.1.170 netmask 255.255.255.0 up | |
| 178 | sudo ifconfig eth0:4 115.129.2.172 netmask 255.255.255.0 up | |
| 179 | sudo ifconfig eth0:5 120.129.2.121 netmask 255.255.255.0 up | |
| 180 | sudo ifconfig etc... | |
| 181 | etc... | |
| 182 | ||
| 183 | NOW POINT YOUR BROWSER TO THE MAIN IP AND YOU SHOULD SEE THE INSTALLATION PROCESS | |
| 184 | ||
| 185 | /////////////////////////////////////////////////////////////////////////////////////////// | |
| 186 | Let secure a bit and receive email if anyone login to ssh | |
| 187 | yum install mailx | |
| 188 | nano .bashrc | |
| 189 | //Add the following whole line at the bottom of the file | |
| 190 | echo 'ALERT - Root Shell Access (mybhcserver) on:' `date` `who` | mail -s "Alert: Root Access from `who | cut -d'(' -f2 | cut -d')' -f1`" [email protected]
| |
| 191 | ||
| 192 | //fail2ban | |
| 193 | you install fail2ban | |
| 194 | nano /etc/fail2ban/jail.conf //(if you want make any change) | |
| 195 | service fail2ban start | |
| 196 | ||
| 197 | //watch failed password | |
| 198 | cat /var/log/secure | grep 'Failed password' | sort | uniq -c | |
| 199 | ||
| 200 | //remove blocked ip | |
| 201 | iptables -D fail2ban-ssh 1 | |
| 202 | ||
| 203 | //add deny host for allow only your ip to login to ssh | |
| 204 | yum install denyhosts | |
| 205 | nano /etc/hosts.allow //add your ip at end of file | |
| 206 | //setup mail alert | |
| 207 | nano /etc/denyhosts.conf //change the email to your at "ADMIN_EMAIL" | |
| 208 | //now we check config if all ok | |
| 209 | chkconfig denyhosts on | |
| 210 | service denyhosts start | |
| 211 | ||
| 212 | //remove ip banned | |
| 213 | /etc/init.d/denyhosts stop | |
| 214 | nano /etc/hosts.deny | |
| 215 | nano /var/lib/denyhosts/hosts | |
| 216 | nano /var/lib/denyhosts/hosts-restricted | |
| 217 | nano /var/lib/denyhosts/hosts-root | |
| 218 | nano /var/lib/denyhosts/hosts-valid | |
| 219 | nano /var/lib/denyhosts/users-hosts | |
| 220 | /etc/init.d/denyhosts start | |
| 221 | ||
| 222 | //whitelist your IP | |
| 223 | nano /var/lib/denyhosts/allowed-hosts //add your ip | |
| 224 | service denyhosts restart | |
| 225 | ||
| 226 | more info here | |
| 227 | http://www.tecmint.com/block-ssh-server-attacks-brute-force-attacks-using-denyhosts/ | |
| 228 | ||
| 229 | ///////////////////////////////////// | |
| 230 | //install maldetect | |
| 231 | wget http://www.rfxn.com/downloads/maldetect-current.tar.gz | |
| 232 | tar -xvf maldetect-current.tar.gz | |
| 233 | cd maldetect-1.4.2 //this will change depending of the verison you downloaded | |
| 234 | ./install.sh | |
| 235 | //then insert your mail and active this script by change the value 0 to 1 | |
| 236 | nano /usr/local/maldetect/conf.maldet | |
| 237 | ||
| 238 | ||
| 239 | ||
| 240 | //inotify for receive email if any file change (i definly need it...) | |
| 241 | cd /usr/local/src | |
| 242 | wget http://www.rfxn.com/downloads/maldetect-current.tar.gz | |
| 243 | tar -zxvf maldetect-current.tar.gz | |
| 244 | cd maldetect-1.4.2 | |
| 245 | ./install.sh | |
| 246 | nano /usr/local/maldetect/conf.maldet //setup your mail etc.. | |
| 247 | //start monitor your home folder | |
| 248 | maldet --monitor /home/black/public_html //can be anything | |
| 249 | ||
| 250 | ||
| 251 | ///////////////////////////////////////////////////////////////////////////// | |
| 252 | //Upgrade mysql to 5.5 | |
| 253 | rpm -Uvh https://mirror.webtatic.com/yum/el6/latest.rpm | |
| 254 | yum install mysql.`uname -i` yum-plugin-replace | |
| 255 | yum replace mysql --replace-with mysql55w | |
| 256 | //there will be some historic dep for older features press yes | |
| 257 | service mysqld start | |
| 258 | ////////////////////////////////////////////////////////////////////////////////////////////////////////////////// | |
| 259 | ||
| 260 | ||
| 261 | THIS STEP UNDER ARE NOT OBLIGATORY TO RUN BHC YOU FREE TO SEE THIS SECTION LATER | |
| 262 | --------------------------------------------------------------------------------------------------------- | |
| 263 | ||
| 264 | install apf firewall: | |
| 265 | ||
| 266 | wget http://www.rfxn.com/downloads/apf-current.tar.gz | |
| 267 | tar -zxvf apf-current.tar.gz | |
| 268 | cd apf-9.7-2 | |
| 269 | sh ./install.sh | |
| 270 | ||
| 271 | if you like to install ionube loader for any reason | |
| 272 | ||
| 273 | yum -y install https://www6.atomicorp.com/channels/atomic/centos/6/x86_64/RPMS/atomic-release-1.0-16.el6.art.noarch.rpm | |
| 274 | yum -y install php-ioncube-loader | |
| 275 | ||
| 276 | copy this line in you php.ini & alway place the code above the zend guard line (or httpd crash) | |
| 277 | zend_extension=/usr/lib64/php/ioncube/ioncube_loader_lin_5.3.so | |
| 278 | service httpd restart | |
| 279 | ||
| 280 | ||
| 281 | //////////////your timezone for php & mysql for set your cron/////////////////////// | |
| 282 | ||
| 283 | rm /etc/localtime | |
| 284 | ln -s /usr/share/zoneinfo/Europe/London /etc/localtime | |
| 285 | ||
| 286 | and edit config.php & set your timezone | |
| 287 | exemple:date_default_timezone_set('Europe/London');
| |
| 288 | ||
| 289 | //////////////////ONLY FOR BLOG CLOAKER /////////////////////////////////////////////////// | |
| 290 | ||
| 291 | ||
| 292 | Installing Memcache and Memcached | |
| 293 | ||
| 294 | First get libevent: http://www.monkey.org/~provos/libevent/ | |
| 295 | ||
| 296 | wget http://www.monkey.org/~provos/libevent-1.4.8-stable.tar.gz | |
| 297 | tar -xvf libevent*.tar.gz | |
| 298 | cd libevent* | |
| 299 | ./configure;make;make install; | |
| 300 | ||
| 301 | /Memached can make display problem (strange domain that still here but they are deleted or thing like this) | |
| 302 | install memcached : | |
| 303 | yum install memcached | |
| 304 | ||
| 305 | memcached PROBABLY can't find libevent, so we need to move it where it can: | |
| 306 | ||
| 307 | LD_DEBUG=libs memcached -v 2>&1 > /dev/null | less | |
| 308 | ||
| 309 | ln -s /usr/local/lib/libevent-1.4.so.2 /usr/lib/libevent-1.4.so.2 | |
| 310 | ||
| 311 | start memcached: | |
| 312 | ||
| 313 | memcached -d -u nobody -m 512 127.0.0.1 -p 11211 | |
| 314 | ||
| 315 | Now we need MEMCACHE for php: | |
| 316 | ||
| 317 | wget http://pecl.php.net/get/memcache-2.1.2.tgz | |
| 318 | gzip -df memcache-2.1.2.tgz | |
| 319 | tar -xvf memcache-2.1.2.tar | |
| 320 | cd memcache-2.1.2 | |
| 321 | yum install php-devel | |
| 322 | phpize | |
| 323 | ./configure;make;make install; | |
| 324 | ||
| 325 | Now edit the /etc/php.ini and add the memcache module: |