Translations by Volkan Gezer

Apache is the most commonly used Web Server on Linux systems. Web Servers are used to serve Web Pages requested by client computers. Clients typically request and view Web Pages using Web Browser applications such as <application>Firefox</application>, <application>Opera</application>, <application>Chromium</application>, or <application>Mozilla</application>.

Once you install PHP5, you can run PHP5 scripts from your web browser. If you have installed <application>php5-cli</application> package, you can run PHP5 scripts from your command prompt.

You can also execute PHP5 scripts without installing PHP5 Apache module. To accomplish this, you should install <application>php5-cgi</application> package. You can run the following command in a terminal prompt to install <application>php5-cgi</application> package: <screen> <command>sudo apt-get install php5-cgi</command> </screen>

You can install additional Apache2 modules and use them with your Web server. For example, run the following command from a terminal prompt to install the <emphasis>MySQL Authentication</emphasis> module:

For more in depth information see <ulink url="http://www.php.net/docs.php">php.net</ulink> documentation.

To see all kernel configuration options you can look through <filename>/boot/config-3.13.0-server</filename>. Also, <ulink url="http://www.kroah.com/lkn/">Linux Kernel in a Nutshell</ulink> is a great resource on the options available.

Ubuntu 14.04 LTS Server Edition supports three (3) major architectures: Intel x86, AMD64 and ARM. The table below lists recommended hardware specifications. Depending on your needs, you might manage with less than this. However, most users risk being frustrated if they ignore these suggestions.

This chapter provides a quick overview of installing Ubuntu 14.04 LTS Server Edition. For more detailed instructions, please refer to the <ulink url="https://help.ubuntu.com/14.04/installation-guide/">Ubuntu Installation Guide</ulink>.

dir = /etc/ssl/ # Where everything is kept database = $dir/CA/index.txt # database index file. certificate = $dir/certs/cacert.pem # The CA certificate serial = $dir/CA/serial # The current serial number private_key = $dir/private/cakey.pem# The private key

This guide assumes you have a basic understanding of your Ubuntu system. Some installation details are covered in <xref linkend="installation"/>, but if you need detailed instructions installing Ubuntu please refer to the <ulink url="https://help.ubuntu.com/14.04/installation-guide/">Ubuntu Installation Guide</ulink>.

Web Servers

A Web server is a software responsible for accepting HTTP requests from clients, which are known as Web browsers, and serving them HTTP responses along with optional data contents, which usually are Web pages such as HTML documents and linked objects (images, etc.).

HTTPD - Apache2 Web Server

www.ubuntu.com

To view the <ulink url="http://www.ubuntu.com/community">community</ulink> sub-page, a user will enter the FQDN followed by a path:

www.ubuntu.com/community

The <application>Apache2</application> web server is available in Ubuntu Linux. To install Apache2:

<emphasis>httpd.conf:</emphasis> historically the main Apache2 configuration file, named after the <application>httpd</application> daemon. Now the file does not exist. In older versions of Ubuntu the file might be present, but empty, as all configuration options have been moved to the below referenced directories.

You may also want your site to respond to www.ubunturocks.com, since many users will assume the www prefix is appropriate. Use the <emphasis>ServerAlias</emphasis> directive for this. You may also use wildcards in the ServerAlias directive.

Enable the new <emphasis>VirtualHost</emphasis> using the <application>a2ensite</application> utility and restart Apache2:

Similarly, use the <application>a2dissite</application> utility to disable sites. This is can be useful when troubleshooting configuration problems with multiple VirtualHosts:

This section explains configuration of the Apache2 server default settings. For example, if you add a virtual host, the settings you configure for the virtual host take precedence for that virtual host. For a directive not defined within the virtual host settings, the default value is used.

You can install everything necessary to run private instances by entering the following command in the terminal prompt:

Version control is the art of managing changes to information. It has long been a critical tool for programmers, who typically spend their time making small changes to software and then undoing those changes the next day. But the usefulness of version control software extends far beyond the bounds of the software development world. Anywhere you can find people using computers to manage information that changes often, there is room for version control.

If you do not specify the hostname, there are three forward slashes (///) -- two for the protocol (file, in this case) plus the leading slash in the path. If you specify the hostname, you must use two forward slashes (//).

It is also assumed that the ssh server is running on that machine and that it is allowing incoming connections. To confirm, please try to login to that machine using ssh. If you can login, everything is perfect. If you cannot login, please address it before continuing further.

The purpose of IP Masquerading is to allow machines with private, non-routable IP addresses on your network to access the Internet through the machine doing the masquerading. Traffic from your private network destined for the Internet must be manipulated for replies to be routable back to the machine that made the request. To do this, the kernel must modify the <emphasis>source</emphasis> IP address of each packet so that replies will be routed back to it, rather than to the private IP address that made the request, which is impossible over the Internet. Linux uses <emphasis>Connection Tracking</emphasis> (conntrack) to keep track of which connections belong to which machines and reroute each return packet accordingly. Traffic leaving your private network is thus "masqueraded" as having originated from your Ubuntu gateway machine. This process is referred to in Microsoft documentation as Internet Connection Sharing.

<application>AppArmor</application> is a Linux Security Module implementation of name-based mandatory access controls. AppArmor confines individual programs to a set of listed files and posix 1003.1e draft capabilities.

AppArmor profiles have two modes of execution:

The <application>apparmor-utils</application> package contains command line utilities that you can use to change the <application>AppArmor</application> execution mode, find the status of a profile, create new profiles, etc.

<application>aa-complain</application> places a profile into <emphasis>complain</emphasis> mode.

<application>aa-enforce</application> places a profile into <emphasis>enforce</emphasis> mode.

The <filename>/etc/apparmor.d</filename> directory is where the AppArmor profiles are located. It can be used to manipulate the <emphasis>mode</emphasis> of all profiles.

Enter the following to place all profiles into complain mode:

To place all profiles in enforce mode:

<application>AppArmor</application> can be disabled, and the kernel module unloaded by entering the following:

<emphasis>/bin/ping flags=(complain):</emphasis> path to the profiled program, also setting the mode to <emphasis>complain</emphasis>.

During installation there is an option to encrypt the <filename role="directory">/home</filename> partition. This will automatically configure everything needed to encrypt and mount the partition.

Create a new section at the bottom of the file, or uncomment one of the examples, for the directory to be shared:

Samba Security Modes

There are two security levels available to the Common Internet Filesystem (CIFS) network protocol <emphasis>user-level</emphasis> and <emphasis>share-level</emphasis>. Samba's <emphasis>security mode</emphasis> implementation allows more flexibility, providing four ways of implementing user-level security and one way to implement share-level:

For example, if you have defined a Samba share called <emphasis>share</emphasis> and wish to give <emphasis role="italic">read-only</emphasis> permissions to the group of users known as <emphasis role="italic">qa</emphasis>, but wanted to allow writing to the share by the group called <emphasis role="italic">sysadmin</emphasis> and the user named <emphasis role="italic">vincent</emphasis>, then you could edit the <filename>/etc/samba/smb.conf</filename> file, and add the following entries under the <emphasis>[share]</emphasis> entry:

For the <emphasis>read list</emphasis> and <emphasis>write list</emphasis> to work the Samba security mode must <emphasis>not</emphasis> be set to <emphasis role="italic">security = share</emphasis>

Ubuntu comes with the <application>AppArmor</application> security module, which provides mandatory access controls. The default AppArmor profile for Samba will need to be adapted to your configuration. For more details on using AppArmor see <xref linkend="apparmor"/>.

By default the profiles for <application>smbd</application> and <application>nmbd</application> are in <emphasis>complain</emphasis> mode allowing Samba to work without modifying the profile, and only logging errors. To place the <application>smbd</application> profile into <emphasis>enforce</emphasis> mode, and have Samba work as expected, the profile will need to be modified to reflect any directories that are shared.

The <emphasis>-c</emphasis> option used above allows you to execute the <application>smbclient</application> command all at once. This is useful for scripting and minor file operations. To enter the <emphasis>smb: \&gt;</emphasis> prompt, a FTP like prompt where you can execute normal file and directory commands, simply execute:

If you see the following lines among others, then everything is working perfectly. Type <command>quit</command> to exit.

Log Files

If you have enabled imap, or pop3, you can also try to log in with the commands <command>telnet localhost pop3</command> or <command>telnet localhost imap2</command>. If you see something like the following, the installation has been successful: