Featured CentOS 7.x How to help test .08 CentOS 7 Betas with Github code ?

darn, here we go again ! thanks for heads up !

 

yeah @RoldanLT mentioned it at Nginx PageSpeed - All Github branches should use the latest version already | Centmin Mod Community however, busy with rebuilding my PC right now too https://community.centminmod.com/threads/downtime-when-computer-goes-up-in-smoke.2093/

 

ngx_pagespeed 1.9.32.3 update + OpenSSL 1.0.1k

Updated all Centmin Mod .07 and .08 beta branches to ngx_pagespeed 1.9.32.3 (includes OpenSSL 1.0.1k by default for new Centmin Mod installs.)

• .07 stable update ngx_pagespeed 1.9.32.3 & openssl 1.0.1k for Nginx static compile ... · 7571772 · centminmod/centminmod · GitHub
• .08 beta update ngx_pagespeed 1.9.32.3 & openssl 1.0.1k for Nginx static compile ... · f89ad17 · centminmod/centminmod · GitHub

For existing installs

• Read how to upgrade OpenSSL 1.0.1k
• How to upgrade ngx_pagespeed for existing installs at ngx_pagespeed install on Centmin Mod - Menu based Nginx installer for CentOS servers

 

A few version updates for .08 beta builds - actual commits update libevent 2.0.22, igbinary 1.2.1, memcached server 1.4.22 for .08 ... · 6001f84 · centminmod/centminmod · GitHub

• Libevent updated from 2.0.21 to 2.0.22 stable
• Memcached server updated from 1.4.21 to 1.4.22
• igbinary PHP extension updated from 1.1.1-dev to 1.2.1 stable

Haven't tested changes yet but centmin.sh menu option 10 should rebuild them all and may need centmin.sh menu option 5 PHP rebuild for memcached PHP extension and ensure you answer Yes for YUM install checks when you run PHP rebuild via menu option 5..

edit: hmm libmemcached extension isn't compiling for some reason

Code:

checking for libmemcached... yes, shared
checking whether to enable memcached session handler support... yes
checking whether to enable memcached igbinary serializer support... yes
checking whether to enable memcached json serializer support... yes
checking whether to enable memcached msgpack serializer support... no
checking whether to enable memcached sasl support... yes
checking whether to enable memcached protocol support... no
checking for ZLIB... yes, shared
checking for pkg-config... /usr/bin/pkg-config
checking for zlib location... /usr
checking for session includes... /usr/local/include/php
checking for json includes... /usr/local/include/php
checking for igbinary includes... /usr/local/include/php
checking for memcached session support... enabled
checking for memcached igbinary support... enabled
checking for memcached msgpack support... disabled
checking for libmemcached location... configure: error: Unable to find memcached.h under /usr

Code:

locate memcached.h
/svr-setup/libmemcached-1.0.18/libmemcached/memcached.h
/svr-setup/libmemcached-1.0.18/libmemcached/memcached.hpp
/svr-setup/libmemcached-1.0.18/libmemcached-1.0/memcached.h
/svr-setup/libmemcached-1.0.18/libmemcached-1.0/memcached.hpp
/svr-setup/libmemcached-1.0.18/libmemcached-1.0/struct/memcached.h
/svr-setup/libmemcached-1.0.18/libtest/memcached.h
/svr-setup/libmemcached-1.0.18/libtest/memcached.hpp
/svr-setup/memcached-1.4.20/memcached.h
/svr-setup/memcached-1.4.22/memcached.h
/svr-setup/memcached-2.2.0/php_memcached.h
/usr/local/include/libmemcached/memcached.h
/usr/local/include/libmemcached/memcached.hpp
/usr/local/include/libmemcached-1.0/memcached.h
/usr/local/include/libmemcached-1.0/memcached.hpp
/usr/local/include/libmemcached-1.0/struct/memcached.h

PHP-FPM restarts give

Code:

fpmrestart
Gracefully shutting down php-fpm . done
Starting php-fpm [14-Jan-2015 08:57:02] NOTICE: PHP message: PHP Warning:  PHP Startup: Unable to load dynamic library '/usr/local/lib/php/extensions/no-debug-non-zts-20131226/memcached.so' - /usr/local/lib/php/extensions/no-debug-non-zts-20131226/memcached.so: cannot open shared object file: No such file or directory in Unknown on line 0
done

edit2: found the problem, I tried updating an old .07 stable install with .08 beta latest code and it was missing Remi YUM repo where libmemcached and libmemcached-devel packages are installed from .08 beta. But my .07 stable doesn't have Remi YUM repo so failed.

steps to fix it below for .07 stable users trying latest .08 beta and have missing Remi YUM repo

For CentOS 6 to add missing Remi YUM repo for Centmin Mod .07 or .08 existing installs

Code:

CENTOSSIXREMIFILE="remi-release-6.rpm"
CENTOSSIXREMI="http://rpms.famillecollet.com/enterprise/${CENTOSSIXREMIFILE}"
wget ${CENTOSSIXREMI} --tries=3
rpm -ivh --nosignature ${CENTOSSIXREMIFILE}

For CentOS 7 to add missing Remi YUM repo for Centmin Mod .07 or .08 existing installs

Code:

CENTOSSEVENREMIFILE="remi-release-7.rpm"
CENTOSSEVENREMI="http://rpms.famillecollet.com/enterprise/${CENTOSSEVENREMIFILE}"
wget ${CENTOSSEVENREMI} --tries=3
rpm -ivh --nosignature ${CENTOSSEVENREMIFILE}

Then for either CentOS 6 or 7 final step add priority=9 and exclude=php* mysql* to first [remi] group within /etc/yum.repos.d/remi.repo

Code:

[remi]
name=Les RPM de remi pour Enterprise Linux 6 - $basearch
#baseurl=http://rpms.famillecollet.com/enterprise/6/remi/$basearch/
mirrorlist=http://rpms.famillecollet.com/enterprise/6/remi/mirror
enabled=0
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-remi
priority=9
exclude=php* mysql*

Then install libmemcached and libmemcached-devel from Remi YUM repo which has different naming convention making sure to disable plugin priorities and enable remi YUM repo

Code:

yum list libmemcached-last libmemcached-last-devel -q --disableplugin=priorities --enablerepo=remi
Available Packages
libmemcached-last.x86_64                                                            1.0.18-2.el6.remi                                                      remi
libmemcached-last-devel.x86_64                                                      1.0.18-2.el6.remi                                                      remi

install

Code:

yum -y install libmemcached-last libmemcached-last-devel -q --disableplugin=priorities --enablerepo=remi

now working after another centmin.sh menu 10 run to recompile memcached stuff

Code:

fpmrestart
Gracefully shutting down php-fpm . done
Starting php-fpm  done

Code:

php --ri memcache

memcache

memcache support => enabled
Version => 3.0.8
Revision => $Revision: 329835 $

Directive => Local Value => Master Value
memcache.allow_failover => 1 => 1
memcache.max_failover_attempts => 20 => 20
memcache.default_port => 11211 => 11211
memcache.chunk_size => 32768 => 32768
memcache.protocol => ascii => ascii
memcache.hash_strategy => consistent => consistent
memcache.hash_function => crc32 => crc32
memcache.redundancy => 1 => 1
memcache.session_redundancy => 2 => 2
memcache.compress_threshold => 20000 => 20000
memcache.lock_timeout => 15 => 15

Code:

php --ri memcached

memcached

memcached support => enabled
Version => 2.2.0
libmemcached version => 1.0.18
SASL support => yes
Session support => yes
igbinary support => yes
json support => yes
msgpack support => no

Directive => Local Value => Master Value
memcached.sess_locking => 1 => 1
memcached.sess_consistent_hash => 0 => 0
memcached.sess_binary => 0 => 0
memcached.sess_lock_wait => 150000 => 150000
memcached.sess_lock_max_wait => 0 => 0
memcached.sess_lock_expire => 0 => 0
memcached.sess_prefix => memc.sess.key. => memc.sess.key.
memcached.sess_number_of_replicas => 0 => 0
memcached.sess_randomize_replica_read => 0 => 0
memcached.sess_remove_failed => 0 => 0
memcached.sess_connect_timeout => 3000 => 3000
memcached.sess_sasl_username => no value => no value
memcached.sess_sasl_password => no value => no value
memcached.compression_type => fastlz => fastlz
memcached.compression_factor => 1.3 => 1.3
memcached.compression_threshold => 2000 => 2000
memcached.serializer => igbinary => igbinary
memcached.use_sasl => 0 => 0
memcached.store_retry_count => 2 => 2

and igbinary 1.2.1

Code:

php --ri igbinary

igbinary

igbinary support => enabled
igbinary version => 1.2.1
igbinary APC serializer ABI => 0
igbinary session support => yes

Directive => Local Value => Master Value
igbinary.compact_strings => On => On

Memcached 1.4.22 server

Code:

memcached -V
memcached 1.4.22

Looks like I need to add to .08 beta a check for Remi YUM repo's existence and if not installed, install it.

I already added a manual check that covers this though when you run PHP and Nginx upgrades you always get prompted for YUM install checks from inc/yumskip.inc which if you answer YES = y to, will run yuminstall function from inc/yuminstall.inc which calls yumcentossixdownload or yumcentossevendownload functions depending on detected OS = CentOS 6 or CentOS 7 and call inc/sdownload_centossix.inc or inc/downloads_centosseven.inc - this is where the remi.repo detection check comes in at lines 43 to 79 of inc/downloads_centossix.inc

Gist of it is, if you answer Yes = y to YUM install checks when you upgrade Nginx via centmin.sh option 4 or PHP via centmin.sh option 5 you will go through a routine to check each YUM repo's .repo file, if missing it will trigger the installation of the repo - in this case remi.repo. So you do not have to go through my above manual Remi YUM repo install steps - although I believe you would have to still do memcached yum install steps above.

 

Ah that's right as existing .08 betas prior to above change had in centmin.sh IGBINARYGIT=y set which takes the master github source code for latest dev version which is 1.2.2-dev.

While on new .08 code IGBINARYGIT=n in centmin.sh so it takes from stable igbinary 1.2.1

You can choose either IGBINARYGIT=y 1.2.2-dev or IGBINARYGIT=n 1.2.1 stable

 

did you re-run centmin.sh menu option 10 after setting IGBINARYGIT='n' in centmin.sh ? You need to do that too

 

what does output from this command produce to see which igbinary tarball and directories exist on your server

Code:

ls -lah /svr-setup/ | grep igbinary

try restarting PHP-FPM service too

 

looks like it might be problem with your changed directories not sure yet.. you can use How to troubleshoot Centmin Mod initial install issues | Centmin Mod Community and check your memcached upgrade log in /root/centminlogs for clues

list logs in ascending date order so it's easier to differentiate more current logs created during centmin.sh menu runs

Code:

ls -lAhrt /root/centminlogs

would be named in format like

Code:

centminmod_1.2.3-eva2000.0*_*-*_memcached_reinstall.log

edit: hmm i think the checkigbinary function might not reinstall igbinary if the routine detects igbinary is already installed.. will have to revise that

 

Updated .08 beta code to fix igbinary check routines when centmin.sh menu option 10 is run so that if versions installed do not match version set in centmin.sh, it will trigger a igbinary reinstall update igbinary check to reinstall when versions don't match for .08 bet... · 00bddcd · centminmod/centminmod · GitHub

 

Moving to more expert level in maintaining Centmin Mod code on your local servers via git clone/branches and git pull syncing Working with git command line for updating Centmin Mod local copies | Centmin Mod Community

 

Edit: made a dedicated thread for discussion and feedback here Centmin Mod .08 beta + pure-ftpd virtual FTP user support | Centmin Mod Community

Made an update to Centmin Mod .08 which easily added FTP virtual user/pass support to Nginx vhost creation routine on centmin.sh menu option 2 ! This should lock the virtual FTP user into their Nginx vhost directory

Note: This is not the full jailed/chrooted user preview setup I outlined but a much more basic workaround for now.

Commit: add support for pure-ftpd virtual FTP users & TLS FTP (explicit SSL) onl... · d0f5c8e · centminmod/centminmod · GitHub

It was @Mask question at LEB and StartledPhoenix user's answer which gets all the credit for pointing me onto using pure-ftpd YUM package and virtual user support. Honestly, never looked at pure-ftpd as an option !

Enabled TLS/SSL

• I went one step further beyond just adding pure-ftpd virtual user support, I also enabled and forced TLS SSL only mode by creating a self-signed SSL certificate for pure-ftpd. So there's enforced encryption for more secure FTP connection.
• As such you need to set your FTP client to use FTP explicit SSL mode and enable and check Passive connections (PASV) and connect via your server's ip address for hostname and use FTP port 21. Filezilla users have a guide and info for FTP Explicit SSL/TLS mode. Centmin Mod updated code already creates the self signed certificate, so only thing in Filezilla to do is set In the SSL/TLS settings menu check "allow Explicit SSL/TLS on normal connections" and check "Disallow plain unencrypted FTP" and "Force PROT P to encrypt file transfers in SSL/TLS mode"
• You also have to disable in your FTP client SSL validation as a self-signed certificate was used.
• Note passive ports if needed to be set in FTP client are in range between 3000 to 3050 i.e. for Filezilla.

Sample centmin.sh menu option 2 add Nginx vhost output from Centmin Mod .08 beta below

Code:

--------------------------------------------------------
Centmin Mod 1.2.3-eva2000.08 - http://centminmod.com
--------------------------------------------------------
                   Centmin Mod Menu
--------------------------------------------------------
1).  Centmin Install
2).  Add Nginx vhost domain
3).  NSD setup domain name DNS
4).  Nginx Upgrade / Downgrade
5).  PHP Upgrade / Downgrade
6).  XCache Re-install
7).  APC Cache Re-install
8).  XCache Install
9).  APC Cache Install
10). Memcached Server Re-install
11). MariaDB 5.2, 5.5, 10 Upgrade Sub-Menu
12). Zend OpCache Install/Re-install
13). Install ioping.sh vbtechsupport.com/1239/
14). SELinux disable
15). Install/Re-install ImageMagick PHP Extension
16). Change SSHD Port Number
17). Multi-thread compression: pigz,pbzip2,lbzip2,p7zip etc
18). Suhosin PHP Extension install
19). Install FFMPEG and FFMPEG PHP Extension
20). NSD Re-install
21). Update - Nginx + PHP-FPM + Siege
22). Exit
--------------------------------------------------------
Enter option [ 1 - 22 ] 2
--------------------------------------------------------

Code:

---------------------------------------------
Enter vhost domain name you want to add (without www. prefix): domain1.com
Create FTP username for vhost domain (enter username): ftpuser4
Create FTP password for ftpuser4 (enter password): pass

FTP username you entered: ftpuser4
FTP password you entered: pass

Password:
Enter it again:

---------------------------------------------
service nginx reload
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
Reloading nginx:                                           [  OK  ]
service pure-ftpd restart
Stopping pure-ftpd:                                        [  OK  ]
Starting pure-ftpd:                                        [  OK  ]

---------------------------------------------
FTP hostname : ipaddress
FTP port : 21
FTP mode : FTP (explicit SSL)
FTP Passive (PASV) : ensure is checked/enabled
FTP username created for domain1.com : ftpuser4
FTP password created for domain1.com : pass
---------------------------------------------
vhost for domain1.com created successfully
vhost conf file for domain1.com created: /usr/local/nginx/conf/conf.d/domain1.com.conf
upload files to /home/nginx/domains/domain1.com/public
vhost log files directory is /home/nginx/domains/domain1.com/log

Current vhost listing at: /usr/local/nginx/conf/conf.d/

Jan 1   00:37   798    ssl.conf
Jan 1   00:37   1.1K   demodomain.com.conf
Jan 1   00:37   1.4K   virtual.conf
Jan 17  21:53   1.3K   domain1.com.conf
---------------------------------------------

My SecureFX SFTP/FTP client settings example with FTP/SSL (explicit). Some FTP clients call it FTP over TLS or SSL




Disable certificate validation due to using self-signed SSL certificate



TLS secure connection details connected via TLS1.2




Using Filezilla FTP Client with FTP Explicit TLS/SSL



Transfer mode = Passive



Self-signed certificate as expected is unknown to Filezilla so needs to manually allowed. Will need to work on setting SHA2 for signature algorithm etc



This is a quick implementation in Centmin Mod with only a few hours of testing. So test it out on test VPS servers first and provide feedback and suggestions for improvements here

To be able to use this code, ensure you're using latest updated Centmin Mod .08 beta code. If you have an existing .08 install, see how to update the instance in 1st post of this thread. Or try out the Git command line method outlined here.

pure-pw commands

pure-pw command adduser was to add a virtual user. However, there's more commands to delete a user or change passwords etc.

pure-pw manual is here and http://download.pureftpd.org/pub/pure-ftpd/doc/README.Virtual-Users

Code:

pure-pw userdel login [-f passwd_file] [-F puredb_file] [-m]
pure-pw passwd login [-f passwd_file] [-F puredb_file] [-m]
pure-pw show login [-f passwd_file] [-m]
pure-pw mkdb [<puredb_database_file> [-f passwd_file]] [-F puredb_file]
pure-pw list [-f passwd_file]

list all pure-ftpd created virtual FTP users

Code:

pure-pw list

to delete virtual FTP user

Code:

pure-pw userdel FTPUSERNAME
pure-pw mkdb

change virtual FTP user's password

Code:

pure-pw passwd FTPUSERNAME
pure-pw mkdb

show full details for an specific pure-ftpd virtual FTP user

Code:

pure-pw show FTPUSERNAME

Existing Centmin Mod Nginx vhosts

For folks with existing Centmin Mod setups with already created Nginx vhosts, you can manually instally pure-ftpd using following commands:

Code:

CNIP=$(ip route get 8.8.8.8 | awk 'NR==1 {print $NF}')
yum -q -y install pure-ftpd
chkconfig pure-ftpd on
sed -i 's/LF_FTPD = "10"/LF_FTPD = "3"/g' /etc/csf/csf.conf
sed -i 's/PORTFLOOD = \"\"/PORTFLOOD = \"21;tcp;5;300\"/g' /etc/csf/csf.conf
sed -i 's/# UnixAuthentication  /UnixAuthentication  /' /etc/pure-ftpd/pure-ftpd.conf
sed -i 's/VerboseLog                  no/VerboseLog                  yes/' /etc/pure-ftpd/pure-ftpd.conf
sed -i 's/# PureDB                        \/etc\/pure-ftpd\/pureftpd.pdb/PureDB                        \/etc\/pure-ftpd\/pureftpd.pdb/' /etc/pure-ftpd/pure-ftpd.conf
sed -i 's/#CreateHomeDir               yes/CreateHomeDir               yes/' /etc/pure-ftpd/pure-ftpd.conf
sed -i 's/# TLS                      1/TLS                      2/' /etc/pure-ftpd/pure-ftpd.conf
sed -i 's/# PassivePortRange          30000 50000/PassivePortRange    3000 3050/' /etc/pure-ftpd/pure-ftpd.conf
mkdir -p /etc/ssl/private
openssl req -x509 -days 7300 -sha256 -nodes -subj "/C=US/ST=California/L=Los Angeles/O=Default Company Ltd/CN==$CNIP" -newkey rsa:1024 -keyout /etc/ssl/private/pure-ftpd.pem -out /etc/ssl/private/pure-ftpd.pem
chmod 600 /etc/ssl/private/*.pem
openssl x509 -in /etc/ssl/private/pure-ftpd.pem -text -noout
service pure-ftpd restart
csf -r

Once pure-ftpd is installed, create your FTP username via command below which will lock and jail the YOURFTPUSERNAME to directory path specified by -d /home/nginx/domains/YOURDOMAINVHOST. So you can also lock specific virtual FTP users to other directory paths to if you want.

Code:

pure-pw useradd YOURFTPUSERNAME -u nginx -g nginx -d /home/nginx/domains/YOURDOMAINVHOST
pure-pw mkdb
service pure-ftpd restart

• where YOURFTPUSERNAME is your FTP username, you will be prompted to create password
• where YOURDOMAINVHOST is your existing Nginx vhost domain name you already setup

Compatible FTP clients for SSL/TLS