Sibirocobombus Setup

I’m paying the systemd tax, twice. I had a Debian Wheezy (7) machine that I wanted to upgrade to Debian Jessie (8). It ran in an OpenVZ environment, ie. the kernel is shared between instances. Sadly, Jessie uses systemd which means I need a new kernel. OpenVZ prevents me from installing a new kernel. I tried it and ended with a machine that was offline. I could connect via serial console and nothing else. But like an idiot, I once again used OpenVZ. And now as I am about to upgrade to Debin Stretch (9) I am faced with the same prospect. This time, however, it is going to be a KVM.

I tried it

So now I’m setting up a new machine. I’m copying stuff over, step by step. Needless to say, I’m not happy.

From the web site:

Connect as root via ssh:

On the old machine, I installed `apt-clone` and ran `apt-clone clone sibirocobombus` which game me the file `sibirocobombus.apt-clone.tar.gz`. When I tried to restore this on the new machine, I was unable to run the `restore-new-distro` command because there seemed to be no appropriate destination distro shortcut. When I used `restore` it seemed to take forever and I aborted it. Now I have a broken setup and I’m angry.

Don’t do this:

To undo the damage:

The manual alternative also doesn’t work. On the old system, you can export a list of packages:

Copy them to the new system and try to import them:

I’m getting an error for practically every single package. So now I’m trying to do it the old way.

Here’s the essential info: `for f in hardening.conf letsencrypt.conf security.conf max-uri.conf perl5.conf servername.conf log.conf; do echo $f; printf %s "$f"|tr -c '-' '[-*]'; echo; grep -v '^#' $f | grep -v '^ ; echo; done`

hardening.conf
--------------
SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLHonorCipherOrder On
SSLCipherSuite HIGH:!RSA:!MD5:!DSS

letsencrypt.conf
----------------
Alias /.well-known/acme-challenge /var/www/letsencrypt.sh/
<Directory /var/www/letsencrypt.sh/>
        Options None
        AllowOverride None
        Order allow,deny
        Allow from all
</Directory>

security.conf
-------------
ServerTokens Prod
ServerSignature Off
TraceEnable Off
Header set X-Frame-Options: "sameorigin"
Header set Strict-Transport-Security "max-age=15768000; includeSubDomains"

max-uri.conf
------------
LimitRequestLine      32000
LimitRequestFieldSize 32000

perl5.conf
----------
SetEnv PERL5LIB /home/alex/perl5/lib/perl5

servername.conf
---------------
ServerName sibiricobombus

log.conf
--------
CustomLog ${APACHE_LOG_DIR}/access.log vhost_combined

PAM

Watch out! Now that `monit` is monitoring the services, it will kill the SSH service if it can’t connect to it on port 882. I also had to comment the section about `/etc/ssh/ssh_host_dsa_key` in `/etc/monit/conf.d/openssh-server.conf`. I need to investigate where this comes from.

Verify that all the services are up and running:

I did not add reverse DNS entry on the web site. I don’t remember why this was necessary. Probably it was required back when I tried to run a mail server.

I thought I was going to need a copy of `/usr/local` but it was unnecessary. There is nothing in there.

I am using Perl via Perlbrew! It’s part of my home directory, so nothing else is required.

Connect as alex via ssh and copy stuff from the old server.

Copy the cronjobs from the old server. Use `EDITOR=emacs crontab -e` to edit the file using Emacs. Note that I’ve uncommented all the jobs because they should either run on the old server (kallobombus) or on the new server (sibirocobombus), but not on both!

MAILTO=kensanata@gmail.com
1. 02  5  *   *   *     /home/alex/bin/maintain-campaignwiki
1. 47 4,16 *  *   *     /home/alex/bin/backup
1. 28  4  *   *   *     /home/alex/bin/subscriptions

Don’t forget `/etc/cron.weekly/letsencrypt.sh`:

!/bin/sh
exec /etc/letsencrypt.sh/letsencrypt.sh -c

Make it executable.

This requires the WELLKNOWN directory. Then run it once.

What follows are the various DNS records.

emacswiki.org:

@ 10800 IN A 178.209.50.237
@ 10800 IN AAAA 2a02:418:6a04:178:209:50:237:1
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520800289 10800 3600 604800 10800
@ 10800 IN TXT "keybase-site-verification=A89bZB-zWTXsS00OTCMKTc9FILAujxFssBg-jHOHuRs"
www 10800 IN A 178.209.50.237

oddmuse.org:

@ 10800 IN A 178.209.50.237
@ 10800 IN AAAA 2a02:418:6a04:178:209:50:237:1
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520800453 10800 3600 604800 10800
@ 10800 IN TXT "keybase-site-verification=A89bZB-zWTXsS00OTCMKTc9FILAujxFssBg-jHOHuRs"
alexine 10800 IN A 94.23.219.181
www 10800 IN A 178.209.50.237

alexschroeder.ch:

@ 10800 IN A 178.209.50.237
@ 10800 IN AAAA 2a02:418:6a04:178:209:50:237:1
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520800528 10800 3600 604800 10800
@ 10800 IN TXT "keybase-site-verification=A89bZB-zWTXsS00OTCMKTc9FILAujxFssBg-jHOHuRs"
rpg 10800 IN A 178.209.50.237
www 10800 IN A 178.209.50.237

communitywiki.org:

@ 10800 IN A 178.209.50.237
@ 10800 IN AAAA 2a02:418:6a04:178:209:50:237:1
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520800356 10800 3600 604800 10800
@ 10800 IN TXT "keybase-site-verification=A89bZB-zWTXsS00OTCMKTc9FILAujxFssBg-jHOHuRs"
www 10800 IN A 178.209.50.237

orientalisch.info (includes mail redirection):

@ 10800 IN A 178.209.50.237
@ 10800 IN AAAA 2a02:418:6a04:178:209:50:237:1
@ 10800 IN MX 10 spool.mail.gandi.net.
@ 10800 IN MX 50 fb.mail.gandi.net.
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520792978 10800 3600 604800 10800
@ 10800 IN TXT "keybase-site-verification=A89bZB-zWTXsS00OTCMKTc9FILAujxFssBg-jHOHuRs"
@ 10800 IN TXT "v=spf1 include:_mailcust.gandi.net ?all"

flying-carpet.ch (parked domain):


@ 10800 IN A 217.70.184.38
@ 10800 IN MX 10 spool.mail.gandi.net.
@ 10800 IN MX 50 fb.mail.gandi.net.
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520793004 10800 3600 604800 10800
blog 10800 IN CNAME blogs.vip.gandi.net.
imap 10800 IN CNAME access.mail.gandi.net.
pop 10800 IN CNAME access.mail.gandi.net.
smtp 10800 IN CNAME relay.mail.gandi.net.
webmail 10800 IN CNAME agent.mail.gandi.net.
www 10800 IN CNAME webredir.vip.gandi.net.

campaignwiki.org:

@ 10800 IN A 178.209.50.237
@ 10800 IN AAAA 2a02:418:6a04:178:209:50:237:1
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520800412 10800 3600 604800 10800
@ 10800 IN TXT "keybase-site-verification=A89bZB-zWTXsS00OTCMKTc9FILAujxFssBg-jHOHuRs"
www 10800 IN A 178.209.50.237

arabisch-lernen.org:

@ 10800 IN A 178.209.50.237
@ 10800 IN AAAA 2a02:418:6a04:178:209:50:237:1
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520800579 10800 3600 604800 10800
@ 10800 IN TXT "keybase-site-verification=A89bZB-zWTXsS00OTCMKTc9FILAujxFssBg-jHOHuRs"
www 10800 IN A 178.209.50.237

If you want, copy the latest stuff.

Lock the old sites:

Write a note on the important old sites:

Mark's site

korero.org

exim cheatsheet

dehydrated

Sibirocobombus Dehydrated

Todo:

CAA

easy