Corrélyce diffusion. Sommaire

Transcription

1 Corrélyce diffusion Procédure d installation de la plate-forme Corréé Titre du Procédure d installation de la plate-forme Corréé document Nom du correlyce-diffusion_doc_install_ pdf document Date 8 novembre 2011 Version 1.0 État Statut Évolutif Validé Auteur(s) Jean-Christophe Pérennes Diffusion Observations Document validé avec la version du code Sommaire 1. Origine du document L'installation des serveurs ldap Les commandes Fichier de configuration slapd.conf du Master Fichier de configuration slapd.conf du Slave Fichier de configuration de l'hôte virtuel ldap1.correex.fr Mise en place SSL L'installation des applicatifs pour correex Exim Installation de Exim : Configuration de Exim :: Test d'exim Sympa Installation de Sympa Configuration de Sympa Récupération des listes existantes Bugs sympa Mysql Installation de Mysql Configuration de Mysql Php Installer Php Modules complémentaires à installer PhpMyAdmin Installer PhpMyAdmin Utilisateurs et bases à sauvegarder Paramétrage d'apache Apache Installer Apache Modules complémentaires à installer Ce document est diffusé sous licence Creative Commons Attribution - Pas d'utilisation Commerciale - Partage à l'identique 3.0 non transposé. Pour accéder à une copie de cette licence, merci de vous rendre à l'adresse suivante &(url_licence) ou envoyez un courrier à Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA.

2 3.7. Java Installer Java Utilisation de Java 1.5 par défaut Tomcat Installer Tomcat Configuration de Tomcat Configuration du tas de la JVM Configuration d'apache Configuration des modules pré-installés Configuration de l'hôte virtuel Configuration des ports Configuration des certificats Applications Tomcat Application web CRDP de l Académie d Aix-Marseille page 2 G. Puimatto, JC Pérennes Novembre 2011

3 1. ORIGINE DU DOCUMENT Ce document d installation a été établi dans le cadre du projet Correex, pour permettre à l hébergeur exploitant de réaliser les opérations d installation. Il a été validé par le CRDP, qui assure l exploitation de Correex et la société Jaguar Networks, qui en assure l hébergement. Ce document est valide pour la version du code Corréé. Il devra bénéficier de nouveaux enrichissements pour les versions ultérieures. Dans ce qui suit, le nom de la plate-forme a été remplacé par Correex, désignation générique des implémentations du code Corréé dans le cadre du dispositif Corrélyce Diffusion. 2. L'INSTALLATION DES SERVEURS LDAP 2.1. Les commandes apt-get install slapd ldap-utils /etc/init.d/slapd stop cd /etc/ldap/schema/ mkdir corree cd /etc/ldap/schema/corree/ cp /home/crdpadmin/corree/init/ldap/schema/corree/*. chmod 644 * vi /etc/ldap/slapd.conf chown root:openldap slapd.conf chmod 640 slapd.conf slapadd -b 'dc=corree,dc=fr' -l /home/crdpadmin/corree.fr.ldif /etc/init.d/slapd start Pour deboggage si nécessaire cd /var/lib/ldap rm -R * /etc/init.d/slapd start ou slapd -d /etc/init.d/slapd stop chown -R openldap.openldap /var/lib/ldap chmod -R 600 /var/lib/ldap apt-get install php5-ldap phpldapadmin vi /etc/phpldapadmin/config.php Document technique du projet Correlyce - Diffusion Correlyce est une marque déposée par la Région PACA page 3

4 2.2. Fichier de configuration slapd.conf du Master This is the main slapd configuration file. See slapd.conf(5) for more info on the configuration options. Global Directives: Features to permit allow bind_v2 Schema and objectclass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/corree/core_corree.schema include /etc/ldap/schema/corree/cosine_corree.schema include /etc/ldap/schema/corree/inetorgperson_corree.schema include /etc/ldap/schema/corree/ent_corree.schema Where the pid file is put. The init.d script will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args Read slapd.conf(5) for possible values loglevel 0 Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_bdb The maximum number of entries that is returned for a search operation sizelimit 500 The tool-threads parameter sets the actual amount of cpu's that is used for indexing. tool-threads 1 Specific Backend Directives for bdb: Backend specific directives apply to this backend until another 'backend' directive occurs backend bdb checkpoint Specific Backend Directives for 'other': Backend specific directives apply to this backend until another 'backend' directive occurs backend <other> CRDP de l Académie d Aix-Marseille page 4 G. Puimatto, JC Pérennes Novembre 2011

5 Specific Directives for database 1, of type bdb: Database specific directives apply to this databasse until another 'database' directive occurs database bdb Where the database file are physically stored for database 1 directory "/var/lib/ldap" replica uri=ldap:// :389 binddn="cn=admin,dc=corree,dc=fr" bindmethod=simple credentials = "$cour13_" replogfile /var/lib/ldap/replog For the Debian package we use 2MB as default but be sure to update this value if you have plenty of RAM dbconfig set_cachesize Sven Hartge reported that he had to set this value incredibly high to get slapd running at all. See for more information. Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 Number of lockers dbconfig set_lk_max_lockers 1500 Save the time that the entry gets modified, for database 1 lastmod on Where to store the replica logs for database 1 replogfile /var/lib/ldap/replog The base of your directory in database 1 suffix "dc=corree,dc=fr" moduleload syncprov rootdn "cn=admin,dc=corree,dc=fr" rootpw "$cour13_" index objectclass pres,eq index cn pres,eq,sub index sn pres,eq,sub index givenname eq index uid eq index l eq index ENTPersonLogin eq,sub index ENTPersonStructRattach eq index ENTAuxEnsClasses eq index ENTAuxEnsGroupes eq index ENTEleveClasses eq index ENTEleveGroupes eq index ENTStructureUAI eq index ENTStructureSIREN eq Document technique du projet Correlyce - Diffusion Correlyce est une marque déposée par la Région PACA page 5

6 index entrycsn,entryuuid eq overlay syncprov syncprov-checkpoint 50 5 syncprov-sessionlog Fichier de configuration slapd.conf du Slave This is the main slapd configuration file. See slapd.conf(5) for more info on the configuration options. Global Directives: Features to permit allow bind_v2 Schema and objectclass definitions include /etc/ldap/schema/core.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/corree/core_corree.schema include /etc/ldap/schema/corree/cosine_corree.schema include /etc/ldap/schema/corree/inetorgperson_corree.schema include /etc/ldap/schema/corree/ent_corree.schema Where the pid file is put. The init.d script will not stop the server if you change this. pidfile /var/run/slapd/slapd.pid List of arguments that were passed to the server argsfile /var/run/slapd/slapd.args Read slapd.conf(5) for possible values loglevel 0 Where the dynamically loaded modules are stored modulepath /usr/lib/ldap moduleload back_bdb The maximum number of entries that is returned for a search operation sizelimit 500 The tool-threads parameter sets the actual amount of cpu's that is used for indexing. tool-threads 1 Specific Backend Directives for bdb: Backend specific directives apply to this backend until another 'backend' directive occurs backend bdb checkpoint Specific Backend Directives for 'other': CRDP de l Académie d Aix-Marseille page 6 G. Puimatto, JC Pérennes Novembre 2011

7 Backend specific directives apply to this backend until another 'backend' directive occurs backend <other> Specific Directives for database 1, of type bdb: Database specific directives apply to this databasse until another 'database' directive occurs database bdb Where the database file are physically stored for database 1 directory "/var/lib/ldap" updatedn cn=admin,dc=corree,dc=fr updateref ldap:// :389 For the Debian package we use 2MB as default but be sure to update this value if you have plenty of RAM dbconfig set_cachesize Sven Hartge reported that he had to set this value incredibly high to get slapd running at all. See for more information. Number of objects that can be locked at the same time. dbconfig set_lk_max_objects 1500 Number of locks (both requested and granted) dbconfig set_lk_max_locks 1500 Number of lockers dbconfig set_lk_max_lockers 1500 Save the time that the entry gets modified, for database 1 lastmod on Where to store the replica logs for database 1 replogfile /var/lib/ldap/replog The base of your directory in database 1 suffix "dc=corree,dc=fr" rootdn "cn=admin,dc=corree,dc=fr" rootpw "$cour13_" updateref ldap:// index objectclass pres,eq index cn pres,eq,sub index sn pres,eq,sub index givenname eq index uid eq index l eq index ENTPersonLogin eq,sub index ENTPersonStructRattach eq index ENTAuxEnsClasses eq index ENTAuxEnsGroupes eq index ENTEleveClasses eq index ENTEleveGroupes eq index ENTStructureUAI eq index ENTStructureSIREN eq Document technique du projet Correlyce - Diffusion Correlyce est une marque déposée par la Région PACA page 7

8 index entrycsn,entryuuid eq syncrepl rid=123 provider=ldap:// :389 type=refreshonly interval=00:00:01:00 searchbase="dc=corree,dc=fr" filter="(objectclass=*)" scope=sub attrs="*,+" schemachecking=off bindmethod=simple binddn="cn=admin,dc=corree,dc=fr" credentials="$cour13_" 2.4. Fichier de configuration de l'hôte virtuel ldap1.correex.fr NameVirtualHost *:443 <VirtualHost *:443> SSLEngine On SSLCertificateFile /etc/apache2/certs_tbs/ldap1.correex.fr.pem SSLCertificateKeyFile /etc/apache2/certs_tbs/ldap1.correex.fr.key SSLCertificateChainFile /etc/apache2/certs_tbs/chain.crt SSLCipherSuite HIGH SSLProtocol all -SSLv2 ServerName ldap1.correex.fr ServerAlias ldap1.correex.fr ServerAdmin DocumentRoot /var/www-https/ ErrorLog /var/log/apache2/error.ldap1.correex.fr.log CustomLog /var/log/apache2/access.ldap1.correex.fr.log combined RewriteEngine On RewriteRule ^/$ /phpldapadmin/\? [R] ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/ <Directory "/usr/lib/cgi-bin"> AllowOverride None Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch Order allow,deny Allow from </Directory> </VirtualHost> Indications complémentaires Activer les modes ssl, rewrite, alias Attention certificats dans /etc/apache2/cert_tbs Supprimer l'écoute de l'hôte virtuels sur le port 80 d'apache. CRDP de l Académie d Aix-Marseille page 8 G. Puimatto, JC Pérennes Novembre 2011

9 2.5. Mise en place SSL Génération de la clé et de la demande de certificat du server (cn=ldap1.correex.fr) openssl genrsa 2048 > slapd-key.pem openssl req -new -key slapd-key.pem > slapd-csr.pem Obtenir certificat seveur auprès d'une autorité de certification slap-crt.pem récupérer La chaine de certification myca-cacert.pem Modifier le fichier /etc/default/slapd SLAPD_SERVICES="ldap:/// ldaps:///" Modifier le fichier /etc/ldap/slapd.conf pour y ajouter avant le backend: TLSCertificateFile /etc/ssl/certs/slapd-crt.pem TLSCertificateKeyFile /etc/ldap/slapd-key.pem TLSCACertificateFile /etc/ssl/certs/myca-cacert.pem 3. L'INSTALLATION DES APPLICATIFS POUR CORREEX 3.1. Exim Installation de Exim : apt-get install exim Configuration de Exim :: Il est possible de configurer Exim en modifiant directement le fichier de configuration (/etc/exim4/update-exim4.conf.conf)ou par interface graphique (accessible par dpkg-reconfigure exim4-config) /etc/exim4/update-exim4.conf.conf Edit this file and /etc/mailname by hand and execute update-exim4.conf yourself or use 'dpkg-reconfigure exim4-config' Please note that this is _not_ a dpkg-conffile and that automatic changes to this file might happen. The code handling this will honor your local changes, so this is usually fine, but will break local schemes that mess around with multiple versions of the file. update-exim4.conf uses this file to determine variable values to generate exim configuration macros for the configuration file. Most settings found in here do have corresponding questions in the Debconf configuration, but not all of them. This is a Debian specific file dc_eximconfig_configtype='internet' dc_other_hostnames='correex.fr' dc_local_interfaces=' ; ' Document technique du projet Correlyce - Diffusion Correlyce est une marque déposée par la Région PACA page 9

10 dc_readhost='' dc_relay_domains='' dc_minimaldns='false' dc_relay_nets='' dc_smarthost='' CFILEMODE='644' dc_use_split_config='false' dc_hide_mailname='true' dc_mailname_in_oh='true' dc_localdelivery='mail_spool' Test d'exim host mx1.correex.fr exim -bt mail tail /var/log/exim4/mainlog 3.2. Sympa L utilisation de Sympa est une spécificité de la plate-forme Courdecol13. Les plates-formes Corrééx doivent disposer d un accès à un gestionnaire de liste de diffusion, permettant notamment la diffusion des informations aux administrateurs, aux superviseurs, aux usagers et aux personnes s étant inscrites sur l interface publique du site. En fonction des applicatifs exploités par l organisation qui conduit l installation, de son système d information et de ses règles de fonctionnement propres, on pourra disposer d un serveur de listes spécifiques, pouvant être Sympa ou un autre Installation de Sympa apt-get install sympa libapache2-mod-fastcgi Configuration de Sympa Il est possible de configurer Sympa en modifiant directement le fichier de configuration (/etc/sympa/sympa.conf)ou par interface graphique (accessible par dpkg-reconfigure -plow sympa) Configuration file for Sympa many parameters are optional (defined in src/conf.pm) refer to the documentation for a detailed list of parameters \\\\ Directories and file location //// Directory containing mailing lists subdirectories home /var/lib/sympa/expl Directory for configuration files ; it also contains scenari/ and templates/ directories etc /etc/sympa File containing Sympa PID while running. Sympa also locks this file to ensure that it is not running more than once. Caution : user sympa need to write access without special privilegee. pidfile /var/run/sympa/sympa.pid CRDP de l Académie d Aix-Marseille page 10 G. Puimatto, JC Pérennes Novembre 2011

11 Umask used for file creation by Sympa umask 027 The main spool containing various specialized spools All spool are created at runtime by sympa.pl spool /var/spool/sympa Incoming spool queue /var/spool/sympa/msg Bounce incoming spool queuebounce /var/spool/sympa/bounce \\\\ Syslog //// The syslog facility for sympa Do not forget to edit syslog.conf syslog `/bin/cat /etc/sympa/facility` Communication mode with syslogd is either unix (via Unix sockets) or inet (use of UDP) log_socket_type unix Log intensity 0 : normal, 2,3,4 for debug log_level 0 \\\\ General definition //// Main robot hostname domain correex.fr Listmasters list comma separated Sympa will associate listmaster privileges to these addresses (mail and web interfaces). Some error reports may also be sent to these addresses. listmaster pacome.massol@crdp-aix-marseille.fr,jean-christophe.perennes@crdpaix-marseille.fr Local part of sympa adresse Effective address will be [ ]@[HOST] sympa Default lang (cs de el en_us fr hu it ja_jp nl oc pt_br tr) lang fr Who is able to create lists This parameter is a scenario, check sympa documentation about scenarios if you want to define one create_list public_listmaster Secret used by Sympa to make MD5 fingerprint in web cookies secure Should not be changed! May invalid all user password cookie `/bin/cat /etc/sympa/cookie` \\\\ Errors management //// Bouncing rate for warn list owner bounce_warn_rate 20 Bouncing rate for halt the list (not implemented) Not yet used in current version, Default is 50 bounce_halt_rate 50 Document technique du projet Correlyce - Diffusion Correlyce est une marque déposée par la Région PACA page 11

12 Task name for expiration of old bounces expire_bounce_task daily Welcome message return-path If set to unique, new subcriber is removed if welcome message bounce welcome_return_path unique \\\\ MTA related //// Path to the MTA (sendmail, postfix, exim or qmail) should point to a sendmail-compatible binary (eg: a binary named 'sendmail' is distributed with Postfix) sendmail /usr/sbin/sendmail Maximum number of recipients per call to Sendmail. The nrcpt_by_domain.conf file allows a different tuning per destination domain. nrcpt 25 Max. number of different domains per call to Sendmail avg 10 Max. number of Sendmail processes (launched by Sympa) running simultaneously Proposed value is quite low, you can rise it up to 100, 200 or even 300 with powerfull systems. maxsmtp 40 \\\\ Pluggin //// Path to the antivirus scanner engine supported antivirus : McAfee/uvscan, Fsecure/fsav, Sophos, AVP and Trend Micro/VirusWall antivirus_path /usr/local/uvscan/uvscan Antivirus pluggin command argument antivirus_args --secure --summary --dat /usr/local/uvscan \\\\ S/MIME pluggin //// Path to OpenSSL Sympa knowns S/MIME if openssl is installed openssl /usr/local/bin/openssl The directory path use by OpenSSL for trusted CA certificates capath /etc/sympa/ssl.crt This parameter sets the all-in-one file where you can assemble the Certificates of Certification Authorities (CA) cafile /usr/local/apache/conf/ssl.crt/ca-bundle.crt User CERTs directory ssl_cert_dir /var/lib/sympa/x509-user-certs Password used to crypt lists private keys key_passwd your_password \\\\ Database //// Database type (mysql Pg Oracle Sybase SQLite) be carefull to the case db_type mysql Name of the database with SQLite, the name of the DB corresponds to the DB file db_name sympa CRDP de l Académie d Aix-Marseille page 12 G. Puimatto, JC Pérennes Novembre 2011

13 The host hosting your sympa database db_host localhost Database user for connexion db_user sympa Database password (associated to the db_user) What ever you use a password or not, you must protect the SQL server (is it a not a public internet service?) db_passwd your_passwd Database private extention to user table You need to extend the database format with these fields db_additional_user_fields age,address Database private extention to subscriber table You need to extend the database format with these fields db_additional_subscriber_fields billing_delay,subscription_expiration \\\\ Web interface //// css_path /usr/lib/cgi-bin/sympa/css css_url Sympa's main page URL wwsympa_url web interface color : dark dark_color web interface color : selected_color selected_color web interface color : light light_color cccc66 web_interface color : shaded shaded_color 66cccc web_interface color : background bg_color ffffcc Supported languages for the user interface supported_lang fr,en_us -- Database configuration begin DO NOT REMOVE SURROUNDING COMMENTS DO NOT EDIT BY HAND USE dpkg-reconfigure -plow sympa TO RECONFIGURE Database driver (DBD) db_type mysql Name of your database db_name sympa Your database hostname db_host localhost Username to connect to the DB db_user sympa Document technique du projet Correlyce - Diffusion Correlyce est une marque déposée par la Région PACA page 13

14 Password for the user db_passwd cour13 -- Database configuration end Récupération des listes existantes En cas de réinstallation ou de mise à jour de Sympa, penser à sauvegarder le répertoire /var/lib/sympa/expl Bugs sympa Si vous recevez un mail du type : Could not lock /var/run/sympa/sympa.pid, process is probably already running Could not lock /var/run/sympa/archived.pid, process is probably already running Could not lock /var/run/sympa/task_manager.pid, process is probably already running Could not lock /var/run/sympa/bounced.pid, process is probably already running Il faut arrêter sympa, suppr imer ces fichiers et redémarrer sympa. Si sympa n'envoie pas le msessage à la liste alors qu'il a été validé, procédure à suivre avant de redémarrer exim : router/400_exim4-config_system_aliases.ifndef SYSTEM_ALIASES_PIPE_TRANSPORT SYSTEM_ALIASES_PIPE_TRANSPORT = address_pipe.endif 3.3. Mysql Installation de Mysql apt-get install mysql-server Configuration de Mysql /etc/mysql/my.cnf The MySQL database server configuration file. You can copy this to one of: - "/etc/mysql/my.cnf" to set global options, - "~/.my.cnf" to set user-specific options. One can use all long options that the program supports. Run program with --help to get a list of available options and with --print-defaults to see which it would actually understand and use. For explanations see This will be passed to all mysql clients It has been reported that passwords should be enclosed with ticks/quotes escpecially if they contain "" chars... Remember to edit /etc/mysql/debian.cnf when changing the socket location. [client] CRDP de l Académie d Aix-Marseille page 14 G. Puimatto, JC Pérennes Novembre 2011

15 port = 3306 socket = /var/run/mysqld/mysqld.sock Here is entries for some specific programs The following values assume you have at least 32M ram This was formally known as [safe_mysqld]. Both versions are currently parsed. [mysqld_safe] socket = /var/run/mysqld/mysqld.sock nice = 0 [mysqld] * Basic Settings user = mysql pid-file = /var/run/mysqld/mysqld.pid socket = /var/run/mysqld/mysqld.sock port = 3306 basedir = /usr datadir = /var/lib/mysql tmpdir = /tmp language = /usr/share/mysql/english skip-external-locking default-character-set=utf8 default-storage-engine=innodb lower_case_table_names=1 Instead of skip-networking the default is now to listen only on localhost which is more compatible and is not less secure. bind-address = * Fine Tuning key_buffer = 16M max_allowed_packet = 16M thread_stack = 128K thread_cache_size = 8 This replaces the startup script and checks MyISAM tables if needed the first time they are touched myisam-recover = BACKUP max_connections = 100 table_cache = 64 thread_concurrency = 10 * Query Cache Configuration query_cache_limit = 1M query_cache_size = 16M * Logging and Replication Both location gets rotated by the cronjob. Be aware that this log type is a performance killer. log = /var/log/mysql/mysql.log Error logging goes to syslog. This is a Debian improvement :) Here you can see queries with especially long duration log_slow_queries = /var/log/mysql/mysql-slow.log long_query_time = 2 log-queries-not-using-indexes Document technique du projet Correlyce - Diffusion Correlyce est une marque déposée par la Région PACA page 15

16 The following can be used as easy to replay backup logs or for replication. note: if you are setting up a replication slave, see README.Debian about other settings you may need to change. server-id = 1 log_bin = /var/log/mysql/mysql-bin.log expire_logs_days = 10 max_binlog_size = 100M binlog_do_db = include_database_name binlog_ignore_db = include_database_name * BerkeleyDB Using BerkeleyDB is now discouraged as its support will cease in skip-bdb * InnoDB InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/. Read the manual for more InnoDB related options. There are many! You might want to disable InnoDB to shrink the mysqld process by circa 100MB. skip-innodb * Security Features Read the manual, too, if you want chroot! chroot = /var/lib/mysql/ For generating SSL certificates I recommend the OpenSSL GUI "tinyca". ssl-ca=/etc/mysql/cacert.pem ssl-cert=/etc/mysql/server-cert.pem ssl-key=/etc/mysql/server-key.pem [mysqldump] quick quote-names max_allowed_packet = 16M [mysql] no-auto-rehash faster start of mysql but no tab completition default-character-set=utf8 [isamchk] key_buffer = 16M * NDB Cluster See /usr/share/doc/mysql-server-*/readme.debian for more information. The following configuration is read by the NDB Data Nodes (ndbd processes) not from the NDB Management Nodes (ndb_mgmd processes). [MYSQL_CLUSTER] ndb-connectstring= * IMPORTANT: Additional settings that can override those from this file! The files must end with '.cnf', otherwise they'll be ignored.!includedir /etc/mysql/conf.d/ CRDP de l Académie d Aix-Marseille page 16 G. Puimatto, JC Pérennes Novembre 2011

17 3.4. Php Installer Php5 apt-get install php Modules complémentaires à installer apt-get install php5-curl apt-get install php5-gd apt-get install php5-ldap apt-get install php5-mcrypt 3.5. PhpMyAdmin Installer PhpMyAdmin apt-get install PhpMyAdmin Utilisateurs et bases à sauvegarder Eléments à sauvegarder en cas d intervention sur une plate-forme existante Utilisateur corree base correedb et spipactus Utilisateur sympa base sympa Jeu de caractères pour MySQL: UTF-8 Unicode (utf8) Chaque base est de type innodb et d'interclassement utf8_general_ci Paramétrage d'apache Supprimer l'accès sur la déclaration de l'hôte virtuel port 80 Supprimer le lien de /etc/apache2/conf.d Déclaration ssl voir le fichier de conf de l'hôte viruels 3.6. Apache Installer Apache apt-get install apache Modules complémentaires à installer apt-get install apache2-mpm-prefork Document technique du projet Correlyce - Diffusion Correlyce est une marque déposée par la Région PACA page 17

18 apt-get install libapache2-mod-fastcgi apt-get install libapache2-mod-jk apt-get install libapache2-mod-php5 apt-get install libapache2-mod-python a2enmod rewrite 3.7. Java Installer Java Le paquet java n étant pas libre, il faut ajouter des sources spécifiques aux dépôts. Pour ce faire, il faut modifier le fichier /etc/apt/sources.list pour y ajouter les adresses suivantes deb lenny main contrib non-free deb-src lenny main contrib non-free Installation apt-get install sun-java5-jdk Utilisation de Java 1.5 par défaut vi /root/.bash_profile JAVA_HOME=/usr/lib/jvm/java sun export JAVA_HOME PATH=$JAVA_HOME/bin:$PATH export PATH export LANG=fr_FR@euro 3.8. Tomcat Installer Tomcat 5.5 apt-get install tomcat5.5 tomcat5.5-admin tomcat5.5-webapps Configuration de Tomcat 5.5 vi /var/lib/tomcat5,5/conf/server.xml <!-- Server Configuration File for Tomcat 5.5 on Debian You can find a more complete example in /usr/share/doc/tomcat5.5/examples/ <!-- Note that component elements are nested corresponding to their parent-child relationships with each other <!-- A "Server" is a singleton element that represents the entire JVM, which may contain one or more "Service" instances. The Server CRDP de l Académie d Aix-Marseille page 18 G. Puimatto, JC Pérennes Novembre 2011

19 listens for a shutdown command on the indicated port. Note: A "Server" is not itself a "Container", so you may not define subcomponents such as "Valves" or "Loggers" at this level. <Server port="8005" shutdown="shutdown"> <!-- Comment these entries out to disable JMX MBeans support used for the administration web application <Listener classname="org.apache.catalina.core.aprlifecyclelistener" /> <Listener classname="org.apache.catalina.mbeans.serverlifecyclelistener" /> <Listener classname="org.apache.catalina.mbeans.globalresourceslifecyclelistener" /> <Listener classname="org.apache.catalina.storeconfig.storeconfiglifecyclelistener"/> <!-- Global JNDI resources <GlobalNamingResources> <!-- Test entry for demonstration purposes <Environment name="simplevalue" type="java.lang.integer" value="30"/> <!-- Editable user database that can also be used by UserDatabaseRealm to authenticate users <Resource name="userdatabase" auth="container" type="org.apache.catalina.userdatabase" description="user database that can be updated and saved" factory="org.apache.catalina.users.memoryuserdatabasefactory" pathname="conf/tomcat-users.xml" /> </GlobalNamingResources> <!-- A "Service" is a collection of one or more "Connectors" that share a single "Container" (and therefore the web applications visible within that Container). Normally, that Container is an "Engine", but this is not required. Note: A "Service" is not itself a "Container", so you may not define subcomponents such as "Valves" or "Loggers" at this level. <!-- Define the Tomcat Stand-Alone Service <Service name="catalina"> <!-- A "Connector" represents an endpoint by which requests are received and responses are returned. Each Connector passes requests on to the associated "Container" (normally an Engine) for processing. By default, a non-ssl HTTP/1.1 Connector is established on port You can also enable an SSL HTTP/1.1 Connector on port 8443 by following the instructions below and uncommenting the second Connector entry. SSL support requires the following steps (see the SSL Config HOWTO in the Tomcat 5 documentation bundle for more detailed instructions): * If your JDK version 1.3 or prior, download and install JSSE or later, and put the JAR files into "$JAVA_HOME/jre/lib/ext". * Execute: %JAVA_HOME%\bin\keytool -genkey -alias tomcat -keyalg RSA (Windows) $JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA (Unix) with a password value of "changeit" for both the certificate and the keystore itself. By default, DNS lookups are enabled when a web application calls request.getremotehost(). This can have an adverse impact on Document technique du projet Correlyce - Diffusion Correlyce est une marque déposée par la Région PACA page 19

20 performance, so you can disable it by setting the "enablelookups" attribute to "false". When DNS lookups are disabled, request.getremotehost() will return the String version of the IP address of the remote client. <!-- Define a non-ssl HTTP/1.1 Connector on port 8180 <Connector port="8080" maxhttpheadersize="8192" maxthreads="150" minsparethreads="25" maxsparethreads="75" enablelookups="false" redirectport="8443" acceptcount="100" connectiontimeout="20000" disableuploadtimeout="true" URIEncoding="UTF-8"/> <!-- Note : To disable connection timeouts, set connectiontimeout value to 0 <!-- Note : To use gzip compression you could set the following properties : compression="on" compressionminsize="2048" nocompressionuseragents="gozilla, traviata" compressablemimetype="text/html,text/xml" <!-- Define a SSL HTTP/1.1 Connector on port 8443 <!-- <Connector port="8443" maxhttpheadersize="8192" maxthreads="150" minsparethreads="25" maxsparethreads="75" enablelookups="false" disableuploadtimeout="true" acceptcount="100" scheme="https" secure="true" clientauth="false" sslprotocol="tls" URIEncoding="UTF-8" truststorefile="/var/lib/tomcat5.5/keys/.keystore" truststorepass="correex" keystorefile="/var/lib/tomcat5.5/keys/.keystore" keystorepass="correex" /> <!-- Define an AJP 1.3 Connector on port 8009 <Connector port="8009" enablelookups="false" redirectport="8443" protocol="ajp/1.3" /> <!-- Define a Proxied HTTP/1.1 Connector on port 8082 <!-- See proxy documentation for more information about using this. <!-- <Connector port="8082" maxthreads="150" minsparethreads="25" maxsparethreads="75" enablelookups="false" acceptcount="100" connectiontimeout="20000" proxyport="80" disableuploadtimeout="true" /> <!-- An Engine represents the entry point (within Catalina) that processes every request. The Engine implementation for Tomcat stand alone analyzes the HTTP headers included with the request, and passes them on to the appropriate Host (virtual host). <!-- You should set jvmroute to support load-balancing via AJP ie : <Engine name="standalone" defaulthost="localhost" jvmroute="jvm1"> <!-- Define the top level container in our container hierarchy <Engine name="catalina" defaulthost="localhost"> <!-- The request dumper valve dumps useful debugging information about CRDP de l Académie d Aix-Marseille page 20 G. Puimatto, JC Pérennes Novembre 2011