Sibirocobombus Setup

I’m paying the systemd tax, twice. I had a Debian Wheezy (7) machine that I wanted to upgrade to Debian Jessie (8). It ran in an OpenVZ environment, ie. the kernel is shared between instances. Sadly, Jessie uses systemd which means I need a new kernel. OpenVZ prevents me from installing a new kernel. I tried it and ended with a machine that was offline. I could connect via serial console and nothing else. But like an idiot, I once again used OpenVZ. And now as I am about to upgrade to Debin Stretch (9) I am faced with the same prospect. This time, however, it is going to be a KVM.

So now I’m setting up a new machine. I’m copying stuff over, step by step. Needless to say, I’m not happy.

From the web site:

Connect as root via ssh:

On the old machine, I installed apt-clone and ran apt-clone clone sibirocobombus which game me the file sibirocobombus.apt-clone.tar.gz. When I tried to restore this on the new machine, I was unable to run the restore-new-distro command because there seemed to be no appropriate destination distro shortcut. When I used restore it seemed to take forever and I aborted it. Now I have a broken setup and I’m angry.

Don’t do this:

To undo the damage:

The manual alternative also doesn’t work. On the old system, you can export a list of packages:

Copy them to the new system and try to import them:

I’m getting an error for practically every single package. So now I’m trying to do it the old way.

Here’s the essential info: for f in hardening.conf letsencrypt.conf security.conf max-uri.conf perl5.conf servername.conf log.conf; do echo $f; printf %s "$f"|tr -c '-' '[-*]'; echo; grep -v '^#' $f | grep -v '^$'; echo; done

hardening.conf
--------------
SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLHonorCipherOrder On
SSLCipherSuite HIGH:!RSA:!MD5:!DSS

letsencrypt.conf
----------------
Alias /.well-known/acme-challenge /var/www/letsencrypt.sh/
<Directory /var/www/letsencrypt.sh/>
        Options None
        AllowOverride None
        Order allow,deny
        Allow from all
</Directory>

security.conf
-------------
ServerTokens Prod
ServerSignature Off
TraceEnable Off
Header set X-Frame-Options: "sameorigin"
Header set Strict-Transport-Security "max-age=15768000; includeSubDomains"

max-uri.conf
------------
LimitRequestLine      32000
LimitRequestFieldSize 32000

perl5.conf
----------
SetEnv PERL5LIB /home/alex/perl5/lib/perl5

servername.conf
---------------
ServerName sibiricobombus

log.conf
--------
CustomLog ${APACHE_LOG_DIR}/access.log vhost_combined

Watch out! Now that monit is monitoring the services, it will kill the SSH service if it can’t connect to it on port 882. I also had to comment the section about /etc/ssh/ssh_host_dsa_key in /etc/monit/conf.d/openssh-server.conf. I need to investigate where this comes from.

Verify that all the services are up and running:

I did not add reverse DNS entry on the web site. I don’t remember why this was necessary. Probably it was required back when I tried to run a mail server.

I thought I was going to need a copy of /usr/local but it was unnecessary. There is nothing in there.

I am using Perl via Perlbrew! It’s part of my home directory, so nothing else is required.

Connect as alex via ssh and copy stuff from the old server.

Copy the cronjobs from the old server. Use EDITOR=emacs crontab -e to edit the file using Emacs. Note that I’ve uncommented all the jobs because they should either run on the old server (kallobombus) or on the new server (sibirocobombus), but not on both!

MAILTO=kensanata@gmail.com
1. 02  5  *   *   *     /home/alex/bin/maintain-campaignwiki
1. 47 4,16 *  *   *     /home/alex/bin/backup
1. 28  4  *   *   *     /home/alex/bin/subscriptions

Don’t forget /etc/cron.weekly/letsencrypt.sh:

!/bin/sh
exec /etc/letsencrypt.sh/letsencrypt.sh -c

Make it executable.

This requires the WELLKNOWN directory. Then run it once.

What follows are the various DNS records.

emacswiki.org:

@ 10800 IN A 178.209.50.237
@ 10800 IN AAAA 2a02:418:6a04:178:209:50:237:1
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520800289 10800 3600 604800 10800
@ 10800 IN TXT "keybase-site-verification=A89bZB-zWTXsS00OTCMKTc9FILAujxFssBg-jHOHuRs"
www 10800 IN A 178.209.50.237

oddmuse.org:

@ 10800 IN A 178.209.50.237
@ 10800 IN AAAA 2a02:418:6a04:178:209:50:237:1
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520800453 10800 3600 604800 10800
@ 10800 IN TXT "keybase-site-verification=A89bZB-zWTXsS00OTCMKTc9FILAujxFssBg-jHOHuRs"
alexine 10800 IN A 94.23.219.181
www 10800 IN A 178.209.50.237

alexschroeder.ch:

@ 10800 IN A 178.209.50.237
@ 10800 IN AAAA 2a02:418:6a04:178:209:50:237:1
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520800528 10800 3600 604800 10800
@ 10800 IN TXT "keybase-site-verification=A89bZB-zWTXsS00OTCMKTc9FILAujxFssBg-jHOHuRs"
rpg 10800 IN A 178.209.50.237
www 10800 IN A 178.209.50.237

communitywiki.org:

@ 10800 IN A 178.209.50.237
@ 10800 IN AAAA 2a02:418:6a04:178:209:50:237:1
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520800356 10800 3600 604800 10800
@ 10800 IN TXT "keybase-site-verification=A89bZB-zWTXsS00OTCMKTc9FILAujxFssBg-jHOHuRs"
www 10800 IN A 178.209.50.237

orientalisch.info (includes mail redirection):

@ 10800 IN A 178.209.50.237
@ 10800 IN AAAA 2a02:418:6a04:178:209:50:237:1
@ 10800 IN MX 10 spool.mail.gandi.net.
@ 10800 IN MX 50 fb.mail.gandi.net.
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520792978 10800 3600 604800 10800
@ 10800 IN TXT "keybase-site-verification=A89bZB-zWTXsS00OTCMKTc9FILAujxFssBg-jHOHuRs"
@ 10800 IN TXT "v=spf1 include:_mailcust.gandi.net ?all"

flying-carpet.ch (parked domain):

* 10800 IN CNAME webredir.vip.gandi.net.
*.blog 10800 IN CNAME webredir.vip.gandi.net.
*.imap 10800 IN CNAME webredir.vip.gandi.net.
*.pop 10800 IN CNAME webredir.vip.gandi.net.
*.smtp 10800 IN CNAME webredir.vip.gandi.net.
*.webmail 10800 IN CNAME webredir.vip.gandi.net.
*.www 10800 IN CNAME webredir.vip.gandi.net.
@ 10800 IN A 217.70.184.38
@ 10800 IN MX 10 spool.mail.gandi.net.
@ 10800 IN MX 50 fb.mail.gandi.net.
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520793004 10800 3600 604800 10800
blog 10800 IN CNAME blogs.vip.gandi.net.
imap 10800 IN CNAME access.mail.gandi.net.
pop 10800 IN CNAME access.mail.gandi.net.
smtp 10800 IN CNAME relay.mail.gandi.net.
webmail 10800 IN CNAME agent.mail.gandi.net.
www 10800 IN CNAME webredir.vip.gandi.net.

campaignwiki.org:

@ 10800 IN A 178.209.50.237
@ 10800 IN AAAA 2a02:418:6a04:178:209:50:237:1
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520800412 10800 3600 604800 10800
@ 10800 IN TXT "keybase-site-verification=A89bZB-zWTXsS00OTCMKTc9FILAujxFssBg-jHOHuRs"
www 10800 IN A 178.209.50.237

arabisch-lernen.org:

@ 10800 IN A 178.209.50.237
@ 10800 IN AAAA 2a02:418:6a04:178:209:50:237:1
@ 10800 IN SOA ns1.gandi.net. hostmaster.gandi.net. 1520800579 10800 3600 604800 10800
@ 10800 IN TXT "keybase-site-verification=A89bZB-zWTXsS00OTCMKTc9FILAujxFssBg-jHOHuRs"
www 10800 IN A 178.209.50.237

If you want, copy the latest stuff.

Lock the old sites:

Write a note on the important old sites:

Todo:

Comments


Please make sure you contribute only your own work, or work licensed under the GNU Free Documentation License. Note: in order to facilitate peer review and fight vandalism, we will store your IP number for a number of days. See Privacy Policy for more information. See Info for text formatting rules. You can edit the comment page if you need to fix typos. You can subscribe to new comments by email without leaving a comment.

To save this page you must answer this question:

Please say HELLO.