Forem: Saif

SSL Installation on Apache Web Server

Saif — Mon, 19 Jul 2021 08:33:41 +0000

Websites need SSL certificates to keep user data secure, verify ownership of the website, prevent attackers from creating a fake version of the site, and convey trust to users. ... HTTPS is the secure form of HTTP, which means that HTTPS websites have their traffic encrypted by SSL.

Procedure to Install SSL Certificate in Linux Instances

Purchase the SSL Certitifcate from the SSL provider i.e namecheap.com
Generate a CSR and KEY files from

CSR code (Certificate Signing Request) is a specific code and an essential part for the SSL activation. It contains information about website name and the company contact details. For many reasons, the code should be created on the hosting server end. On some servers, it is the obligatory condition.

Note: Many hosting providers offer CSR code generation assistance to their clients where possible. Thus, it is worth checking with the web-hosting company whether they provide such service and whether it is available on your hosting plan.

https://decoder.link/csr_generator

openssl option

openssl genrsa -out domain_name.key 2048
openssl req -new -key domain_name.key  -out domain_name.csr

CSR Information

Please ensure you fill out the CSR code details correctly. This should speed up the process of obtaining the SSL. Furthermore, the validation process for OV and EV SSL certificates requires that business details be entered accurately.

-Common Name (the domain name the Certificate will be issued for)

-For example - example.com

-Note! For Wildcard certificates, the Common Name should be represented with an asterisk in front (e.g. *.example.com).

-Country (two-letter code)

-Country (C) – the two-letter code of the country where the company or applicant is located (for example, GB for Great Britain or US for the United States; you can check your country code here.)

-State (or province)

-State (S) – the state, county or region the company or applicant is located in (e.g. California).

-Locality (or city)

-Locality (L) – the city where the company or applicant is located (e.g. Los Angeles). This parameter should not be abbreviated.

-Organization (your company name. Feel free to put "NA" here for any Domain Validated certificate)

-Organization (O) – the officially registered name of the organization that is applying for a certificate (e.g. Namecheap Inc.). For Organization and Extended Validation certificates, Certificate Authorities will be verifying the submitted organization. For Domain Validation SSLs, this field is not critical and the details will not be listed on the issued certificate; however, it should at least be filled in with "NA".

-Organizational Unit (department. Feel free to put "NA" here for any any Domain Validated certificate)

-Organization Unit (OU) – the name of the department or division within the submitted organization (e.g. SSL Support).

-Email address (put a valid email address here)

-Email Address – an email address of the company or the applicant. This field is optional.

-Note! This email address won’t be used during the verification process, unless a mistake is found with any of the submitted details. However, this email will be considered an admin contact, unless you change it during the activation process. The SSL will be issued to the admin contact email address once it is activated.

-Challenge Password and Optional Company Name - please do not use challenge password and leave Optional Company Name field empty too. These values are now obsolete and may cause issues with getting the SSL certificate.

Paste the CSR certificate file in namecheap DV authentication

Select the domain control validation method among CNAME, File uploading and Email-based options:

Click Submit to confirm the domain control validation method and submit the order

Approve the certificate issuance. If you chose Email validation, an approver email is to be delivered to a chosen approver address shortly after you finish the activation process. If you do not receive an email within 2 hours, please refer to the instructions provided in the What should I do if approval email was not delivered? article. When you confirm the issuance by following the link in the approver email, you should receive a signed certificate to the administrative email address you indicated during activation.
For HTTP-based validation, you need to upload a text file into into a particular directory of your website (/.well-known/pki-validation/). If the domain is the primary one in your cPanel account, the document root is usually the public_html folder. The validation file can be downloaded from the page with the certificate details after it was activated.

Note: If you have activated the certificate with domain.com or www.domain.com indicated as FQDN in your CSR code, please make sure that the file is available via http://domain.com/.well-known/pki-validation/file.txt . In this case, www.domain.com is considered to be under your control as well
Content of the file shouldn't be changed in any way, as Comodo (now Sectigo) validation system is case sensitive.

After the Domain Validation happens the Certificates bundles files have been issued

Initially, all the certificates purchased through Namecheap are sent by a Certificate Authority to the administrative email address provided during activation. In case you have not received a validated Certificate for any reason, you can download the certificate into your account following the steps below.

Sign in to your Namecheap account >> navigate to the Dashboard and open the SSL Certificates tab.
Find the SSL certificate in question and click Download over on the right, see the picture below:

The ZIP file with your certificate will be downloaded to your computer. Once it is unzipped, you will see three files: *.crt, *.ca-bundle and *.p7b .
*.crt and *.ca-bundle are the files for Apache, Nginx, cPanel, etc.
*.crt is a file with your server certificate, and the *ca-bundle is a file with the Certificate Authority Chain which should be installed on your server with your domain certificate.
*.ca-bundle is necessary for the browser to be able to check the CA signature of the certificate. If the bundle is missing, incomplete or broken, the browser might mark the website as untrusted or even restrict the connection, depending on a browser version and security settings.
*.p7b file is a certificate and CA Bundle combined into one file. The file is suitable for the certificate installation on Microsoft IIS and Tomcat servers.

Configuring in the Apache Web Server

Installation check

First, we will check the exact location of the current configuration file for HTTP websites. For that, run the following command:

sudo apachectl -S

We can see the website configuration file (the one for non-secured HTTP connections via port 80) in the output. It is usually called "000-default.conf" or” domain_name.conf".

The default folder for such a file location is `/etc/apache2/sites-available.

In this guide, we will show in detail how to add the settings for HTTPS port 443 into the same configuration file. However, we also recommend reviewing all possible ways to proceed - like separate configuration file creation in the /etc/apache2/sites-available or /etc/apache2/sites-enabled folder - here in the 'Tips and troubleshootings' part of this guide.

Before we proceed any further, we will need to make sure that SSL/TLS support is enabled on the webserver. For that, we will need to run the following command:

sudo a2enmod ssl

sudo service apache2 restart

Configuring the webserver

Now, configure the website to work with the SSL certificate.

If there were no SSLs installed on the webserver previously, check the configuration file name for the HTTP port 80 and open it in your text editor of choice (nano, vi, etc.).

Note: If you are following another way from these ones, then keep in mind that your file name will be different, and you need to open your configuration file instead of the default one.

<VirtualHost *:80>
        ServerAdmin webmaster@example.com
        ServerName example.com
        DocumentRoot /var/www/html/
        Redirect / "https://example.com/"
</VirtualHost>

<VirtualHost *:443>

        ServerAdmin webmaster@example.com
        ServerName example.com
        DocumentRoot /var/www/html
        SSLEngine on
        SSLCertificateFile "/etc/apache2/ssl/example.com/__example.com.crt"
        SSLCertificateKeyFile "/etc/apache2/ssl/example.com/example.com.key"
        SSLCACertificateFile "/etc/apache2/ssl/example.com/__example.com.ca-bundle"
        ErrorLog /etc/apache2/ssl/example.com/error_ssl.log
        CustomLog /etc/apache2/ssl/example.com/access_ssl.log combined

</VirtualHost>


<Directory /var/www/html/>
     Order allow,deny
     AllowOverride All
     Allow from All
     Require all granted         
</Directory>

Then, make sure to replace the paths of the certificate files in the following sections:

SSLCertificateFile
SSLCertificateKeyFile
SSLCertificateChainFile

Checking the configuration file and restarting the webserver

Now, make sure to check the file syntax by running this command:

apachectl -t

If the command responds with “Syntax OK”, you can reboot the webserver. To do that, run the command:

sudo service apache2 restart

The configuration file should be listed in the Apache configuration files list (it can be checked by running apachectl -S once again):

Done! The website is now secured. The installation can be checked here.

WordPress Migration Plan Dev-Production Server (cPanel)

Saif — Tue, 08 Jun 2021 05:02:25 +0000

WordPress Migration can be done in several options some of the following are below.

Migration of WordPress Site Manually

Following steps describes the migration process in case manual method

Step 1: Backup the development WordPress Host (Development Server)
The first thing you need to do is make a copy of all your website’s files. To do this, you’ll want to use an FTP tool. If you don’t already have one, FileZilla is an excellent (and free) option.
After you connect to your site’s server via FTP, you’ll need to navigate to your WordPress root folder, which contains all the files on your site. It’s usually called either public_html or www, or is named after your site

Step 3: Back Up Your WordPress Database
At this point, you already have a copy of your website’s files. Now you need to back up its database. This is where all the information about your site’s content, users, and lots more is contained.
To do this, you’ll need to access your database. Most web hosts enable you to do this through your control panel. For example, if you’re using cPanel, you’ll find a section called Databases. In that section, you’ll want to click on the phpMyAdmin option:

Once you’re in, choose your site’s database from the list on the left, and navigate to the Export tab using the top menu. Select the Quick option under Export Method, and hit Go:
This will download a copy of your site’s database in .sql format.

Step 5: Create a New SQL Database and Import the Contents of Your Old One

Next, you have to create a new database on the web host you’re moving to. Then you’ll import the file from your old database, which will override the contents of the new one.
If your new WordPress host also uses cPanel, here’s what you’ll need to do:

Go to the Databases section in cPanel, and choose the MySQL Databases option.
Create a new database and add a user to it from this same tab (and take note of the names you use for later).
Access the new database using phpMyAdmin, as you did during the previous step.
Go to the Import tab within the new database, and upload the .sql file you generated earlier.

That’s it! Now your old database is located on your new web host. However, you still need to re-upload the rest of your site’s files.

Step 6: Upload Your Site’s Files to the New Web Host

For this step, you’ll need to first log into your new server via FTP. Then, navigate to its root folder.
Right-click anywhere within that folder, and select the Upload option. Locate the folder you downloaded during the first step, open it, and select all the files and directories within.
The upload process can take a while, since we’re talking about hundreds of files. If you’re patient, however, you’ll soon find yourself almost at the end of the journey.

Step 7: Edit Your Site’s wp-config.php File

Once all your files are up on the new server, you’ll need to access your WordPress root folder one more time. If you try to actually visit your website now, it won’t work, because you need to update WordPress’ wp-config.php file so that it points towards your new database.

This will open the file using your local text editor, enabling you to make changes. Here are the three lines you’ll need to update:
define('DB_NAME, 'db_name');
define('DB_USER, 'db_user');
define('DB_PASSWORD, 'db_pass');

Step 8: Configure and Change Your DNS

Finally, you’ll need to make sure your Domain Name Server (DNS) is pointed towards the correct host. For example, if you are migrating to one of our hosting plans, you’ll need to point your DNS to your new WP Engine server.
To do this, you’ll need two things:

Information from your new host
Access to the registrar where you purchased your domain name

How to Migrate Your WordPress Site With a Plugin

When you need to migrate your website, there are several excellent migration plugins available that can help many of these tools can create complete site backups for you, as well as providing recovery services. Additionally, if you only need to migrate part of your site, there are paid plugins that can customize the process to meet your needs.

All-in-One WP Migration

All-in-One WP Migration is one of the most streamlined backup and migration plugins you can find. It enables you to create copies of your site in minutes, and then import them to another WordPress installation using the same plugin. In our experience, it’s perfect for small websites, although it can struggle with larger installs.

Complete Guide to setup LAMP Architecture Docker Image into Azure Kubernetes Services,with azure persistence disk attached

Saif — Tue, 02 Jun 2020 07:46:04 +0000

Hey Everyone,

This tutorial provides a walkthrough of, how to create a docker image of LAMP(Linux,Apache,MySql,PHP) and Deploy it into Kubernetes cluster with Azure Static Provision Persistence disk attached.

Creating Docker Image

Installing Docker on Ubuntu

Step 1: Update Software Repositories

sudo apt-get update

Step 2:(Optional)Uninstall Old Versions of Docker

sudo apt-get remove docker docker-engine docker.io

Step 3: Install Docker

sudo apt install docker.io

Step 4: Start and Automate Docker

sudo systemctl start docker

sudo systemctl enable docker

Step 5 (Optional): Check Docker Version

docker --version

Step 6: Docker Infomation

docker info

Step 7: Docker Images

docker images

Deploy Docker LAMP Architecture

sudo docker pull ubuntu:latest

sudo docker ps -a #view all containers

sudo docker images -a #View all available images

sudo docker stop container_id #Stop a specific container

sudo docker rm container_id #Delete a specific container

sudo docker rmi image_id #Delete a specific image

sudo docker exec –it <container-name/id> /bin/bash# docker image exec

Installing PHP on Ubuntu VM in Azure

sudo apt-get install php

sudo apt-get install python-software-properties

sudo apt-get update

php -v # to check the PHP version

apt-get remove –purge php* # to uninstall PHP

Installing MySQL in Ubuntu 16.04

sudo apt-get install mysql-server # to get latest remove numeric

sudo apt-get update

Copying Source Code from localhost to VM

Path to copy: /var/www/websitename.com/html

scp -r pathlocation root@ip(ip of where to be copied):/pathlocation 
Example :
scp -r source_code.zip root@10.10.10.10:/var/www/websitename.com/html

Start the apache2 in the container

service apache2 start

Run the image as container

docker run –itd –p 70:80 –name <container-name> <image-name>
Example :
docker run –itd –p 70:80 –name zaif/lamp

exit # exit from the container

Note:
Access the localhost with the exposed port number in the browser to check whether the application is deployed properly or not localhost:70

Commit the changes and create a new docker image

docker commit

  docker commit <container-name/id> <image-name>

Push the committed/created image to the docker hub

 docker push <account-name/repository-name>:tag
 docker push username/imagename:latest

Create an AKS cluster

To create an AKS cluster, complete the following steps,
On the Azure portal menu or from the Home page, select Create a resource_
__Select Containers -> Kubernetes Service
On the Basics page, configure the following options

Project details: Select an Azure Subscription, then select or create an Azure Resource group, such as myResourceGroup
Cluster details: Enter a Kubernetes cluster name, such as myAKSCluster. Select a Region, Kubernetes version, and DNS name prefix for the AKS cluster
Primary node pool: Select a VM Node size for the AKS nodes. The VM size can't be changed once an AKS cluster has been deployed. - Select the number of nodes to deploy into the cluster. For this quick start, set Node count to 1. Node count can be adjusted after the cluster has been deployed.

Select Next: Scale when complete,
On the Scale page, keep the default options. At the bottom of the screen,
click Next: Authentication.
On the Authentication page, configure the following options:
Create a new service principal by leaving the Service Principal field with (new) default service principal. Or you can choose Configure service principal to use an existing one. If you use an existing one, you will need to provide the SPN client ID and secret.
Enable the option for Kubernetes role-based access controls (RBAC). This will provide more fine-grained control over access to the Kubernetes resources deployed in your AKS cluster.
By default, Basic networking is used, and Azure Monitor for containers is enabled. Click Review + Create and then Create when validation
completes.

It takes a few minutes to create the AKS cluster. When your deployment is complete, click Go to resource, or browse to the AKS cluster resource group, such as myResourceGroup, and select the AKS resource, such as myAKSCluster. The AKS cluster dashboard is shown, as in this example:

Creating Azure Persistence Volume Disk

Steps:
select the same Resource Group Name where the AKS Cluster is placed
give azure disk name such myaks-pv and select the same region as of AKS is, size can be customized click on review and create

To configure kubectl to connect to your Kubernetes Cluster,use the
az aks get-credentials command ,this will download the credentials and configures the Kubernetes CLI to use them.
The following example gets credentials for the cluster name myAKSCluster in the resource group named myResourceGroup:

Create a Pod

The next step is to create a Pod and link it to Persistence volume (Azure Disk).

Use Azure cloud shell
Azure hosts Azure Cloud Shell, an interactive shell environment that you can use through your browser

enter this command in azure bash shell

  az aks get-credentials --resource-group myResourceGroup --name myAKSCluster
  az aks browse --resource-group myResourceGroup --name myAKSCluster

Note: az extension add --name aks-preview # optional if any error

Upload YAML file (Create From Text Input) Here is the configuration file for the Pod:


kind: Pod
apiVersion: v1
metadata:
  name: myaks_pod
spec:
  containers:
  - name: myaks_container
    image: zaif/lamp_docker
    volumeMounts:
    - mountPath: "/mnt/azure/"
      name: volume
  volumes:
    - name: volume
      azureDisk:
        kind: Managed
        diskName: myaks-pv 
        diskURI: /subscriptions/73xxxx-xxx-xxxx-xxxxxas5/resourceGroups/myaksGroup/providers/Microsoft.Compute/disks/myaks-pv

Note:disk URI copy the Resource ID from myaks-pv(Azure Disk)->properties
image below for reference

Run the following command in Azure CLI


kubectl get pods       #List all pods in ps output format
kubectl get pv or pvc  #Verify that the container in the Pod is running

kubectl label pod pod_name label=app
Example:
kubectl label pod myaks_pod label=app 

kubectl expose pod pod_name --type=LoadBalancer --port=80,443 #to expose the pod in order to get public sharing ip 
Example:
kubectl expose pod myaks_pod --type-LoadBalancer --port=80,443

kubectl get svc 
NAME           TYPE           CLUSTER-IP   EXTERNAL-IP    PORT(S)                      AGE

kubernetes      ClusterIP      10.0.0.1     <none>         443/TCP                      24h 

myaks_pod       LoadBalancer   10.0.39.57   52.143.95.12 80:30761/TCP,443:31098/TCP   6h9m

Now Login into the Pod using command
Go to the shell,(Azure CLI)

kubectl exec -it my_pod_name --container container_name -- /bin/bash
Example: 
kubectl exec -it myaks_pod  --container myaks_container -- /bin/bash

Note:
To test the attached Azure Disk is connected and can be used for data lost retrieval, delete the POD and create a same config POD and check whether the database files can been retrieved form mnt/azure/lost+found path location

kubectl delete pod pod_name
Example:
kubectl delete pod myaks_pod

kubectl get svc

Note:
Follow the above same steps from creating a POD through YAML and the next further procedures in order to check whether the data files can be retrieved through azure persistence disk attached with reference to the POD "mnt/azure/lost+found"

The persistence disk is attached to the pod (myaks_pod) to retrieve the data when pod get’s evicted works as above

Persistence Mount Path: "/mnt/azure"