dnf install -y epel-release gcc
dnf install -y screen git htop lsof strace emacs-nox nano patch libcap-devel python3-pip-wheel python3-setuptools-wheel.noarch python3-devel postgresql
setcap cap_net_admin=eip $(realpath $(which python))
dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
dnf -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
systemctl --now enable docker
# => edit
# nano /etc/ssh/sshd_config
SSHport=$(shuf -i 49152-65535 -n 1)
sed -e "s&#Port 22&Port $SSHport&" -e "s&#GatewayPorts.*&GatewayPorts yes&" -i /etc/ssh/sshd_config
#dnf install -y iptables-nft nfttables
nft list ruleset
nano /etc/sysconfig/nftables.conf
"
table inet filter {
chain input {
type filter hook input priority filter; policy drop;
iif "lo" accept
ct state established,related accept
# Allow ping
icmp type echo-request limit rate 5/second accept
tcp dport $SSHport accept
tcp dport 80 accept
tcp dport 443 accept
}
}
"
nft -f etc/sysconfig/nftables.conf
# OR
nft add rule inet filter input tcp dport $SSHport accept
nft add rule inet filter input icmp type echo-request limit rate 5/second accept
# Add TILEDVIZ
nft add table ip filter
nft add chain ip filter TILEDVIZ
nft add rule ip filter TILEDVIZ tcp dport $SSHport accept
systemctl --now enable nftables.service
systemctl restart sshd
USER="myuser"
usermod -a -G docker $USER
# User must logout and login again.
# copy SSL keys from local machine to VPS:
rootVPS> chown $USER /path_to_keys/domain.my
localUSER> rsync -e "ssh -T -p $SSHport " /local/SSLpath/domain.my/* $USER@host.docmain.my:/path_to_keys/domain.my
rootVPS> chown root:root -R /path_to_keys/domain.my
rootVPS> chmod o-rx /path_to_keys/domain.my
localUSER> rsync -e "ssh -T -p $SSHport " $TILEDVIZPATH/InstalOS/daemon.json $USER@host.docmain.my:./
rootVPS> mv ~$USER/tmp/daemon.json /etc/docker/
rootVPS> chown root:root /etc/docker/daemon.json
rootVPS> systemctl restart docker
rootVPS> dnf install -y fail2ban
#nginx
#rootVPS> mv /etc/nginx/nginx.conf /etc/nginx/nginx.conf_00
#rootVPS> cp $TILEDVIZ/TVWeb/nginx/nginx.conf /etc/nginx
#rootVPS> systemctl enable --now nginx
rootVPS> mkdir /var/log/nginx
rootVPS> touch /var/log/nginx/access.log /var/log/nginx/upstream.log /var/log/nginx/error.log
rootVPS> cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
rootVPS> sed -e 's&^\[sshd\]&[sshd]\nenabled=true\nbantime = 3600\nfindtime = 600\nmaxretry = 3&' -i /etc/fail2ban/jail.local
rootVPS> sed -e "s&^port\ * = ssh&port = $SSHport&" -i /etc/fail2ban/jail.local
rootVPS> sed -e 's&^\[\(nginx-.*\)\]&[\1]\nenabled=true&' -i /etc/fail2ban/jail.local
#TODO :
#* add nginx-botsearch2.conf
#[nginx-botsearch2]
#enabled=true
#port = http,https
#logpath = %(nginx_access_log)s
#* Open php-url-fopen
#[php-url-fopen]
#enabled=true
rootVPS> mv /etc/logrotate.d/nginx /root
rootVPS> systemctl --now enable fail2ban
# TODO : relaunch fail2ban after TiledViz to see nginx error files mount on host ?
rootVPS> systemctl restart fail2ban
rootVPS> fail2ban-client status --all |less
# After TiledViz started :
rootVPS> nft -nNsta list ruleset |less
