如何在CentOS 7上运行开源分布式社交网络

介绍

• 如何设置Rails应用程序（Diaspora）进行生产
• 如何配置MariaDB与Diaspora
• 如何设置Nginx作为Diaspora的反向代理服务器
• Nginx的SSL配置的最佳实践
• 如何编写自定义systemd单元文件以在Rails应用程序中使用
• 对于安全意识，有一个奖励部分关于如何配置SELinux与Diaspora打得很好

先决条件

• 带1 GB RAM的CentOS 7 需要一个小社区的最小RAM为1 GB，因此我们将使用1 GB / 1个CPUDroplet。
• sudo用户 下面的大多数命令需要root权限。检查如何添加用户引导到添加用户，并给它sudo特权， 此用户帐户将是除了稍后我们将创建散居用户帐户，其中散居的服务都将受到比较有限的权限运行。
• SSL证书 虽然Diaspora可以运行没有SSL证书，Diaspora的连接到其他pod的机制需要一个有效的SSL证书。对于生产，你应该有一个支付的SSL证书 。我们只需要在本文中创建的两个证书文件（public，private），因此您可以跳过该教程的Web服务器配置部分。我们会自己做。 或者，为了测试的目的，您可以生成自签名证书。请参见本教程的详细信息，或者只是从您的家目录中运行以下命令：

  openssl req \
     -newkey rsa:2048 -nodes -keyout ssl.key \
     -x509 -days 365 -out ssl.crt
  

• 注册域名指向您的Droplet的IP
• 交换文件 对于1 GB的服务器，需要至少1 GB的交换文件。按照在CentOS 7添加交换教程设置一个。
• 按照与CentOS 7初始服务器安装指南
• 按照新的CentOS 7服务器的其他建议步骤指南

第1步 - 安装实用程序

sudo yum install deltarpm yum-cron vim

sudo yum update

第2步 - 启用EPEL存储库

sudo yum install epel-release
sudo yum update

Retrieving key from file:///etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
Importing GPG key 0x352C64E5:
  Userid     : "Fedora EPEL (7) <epel@fedoraproject.org>"
  Fingerprint: 91e9 7d7c 4a5e 96f1 7f3e 888f 6a2f aea2 352c 64e5
  Package    : epel-release-7-5.noarch (@extras)
  From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-7
  Is this ok [y/N]: y

第3步 - 安装Ruby和C的包

sudo yum install git ruby ruby-devel libxslt-devel libxml2-devel gcc gcc-c++ automake net-tools libcurl-devel libffi-devel make redis nodejs ImageMagick-devel

sudo systemctl enable redis
sudo systemctl start redis

第4步 - 添加专用散居用户

sudo useradd diaspora

第5步 - 配置防火墙

sudo systemctl start firewalld
sudo systemctl enable firewalld

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --permanent --add-service=smtp

sudo firewall-cmd --reload

第6步 - 安装和保护MariaDB

sudo yum install mariadb-server mariadb-devel

sudo systemctl start mariadb
sudo systemctl enable mariadb

sudo mysql_secure_installation

Enter current password for root (enter for none): ENTER
Set root password? [Y/n] Y
Remove anonymous users? [Y/n] Y
Disallow root login remotely? [Y/n] Y
Remove test database and access to it? [Y/n] Y
Reload privilege tables now? [Y/n] Y

第7步 - 创建散居用户和数据库

mysql -u root -p

CREATE USER 'diaspora'@'localhost' IDENTIFIED BY 'password';

CREATE DATABASE IF NOT EXISTS `diaspora_production` DEFAULT CHARACTER SET `utf8mb4` COLLATE `utf8mb4_bin`;

GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER, LOCK TABLES ON `diaspora_production`.* TO 'diaspora'@'localhost';

\q

mysql -u diaspora -p -D diaspora_production

\q

第8步 - 安装Bundler

sudo gem install bundler

sudo ln -sf /usr/local/bin/bundle /usr/bin/bundle

第9步 - 获取散列源代码

sudo su - diaspora

git clone -b master https://github.com/diaspora/diaspora.git

第10步 - 配置散居数据库

cd ~/diaspora/

cp config/database.yml.example config/database.yml
vim config/database.yml

mysql: &mysql
  adapter: mysql2
  host: "localhost"
  port: 3306
  username: "diaspora"
  password: "password"
  encoding: utf8mb4
  collation: utf8mb4_bin

第1步1 - 配置Diaspora的基本设置

cp config/diaspora.yml.example config/diaspora.yml

vim config/diaspora.yml

url: "https://example.org/"

certificate_authorities: '/etc/pki/tls/certs/ca-bundle.crt'

rails_environment: 'production'

第1步2 - 安装Gems并设置数据库

cd /home/diaspora/diaspora/

bundle config build.nokogiri --use-system-libraries

RAILS_ENV=production bin/bundle install --without test development --deployment

RAILS_ENV=production bin/rake db:create db:schema:load

RAILS_ENV=production bin/rake assets:precompile

exit

第1步3 - 配置Diaspora systemd服务

• Unicorn，应用服务器
• sidekiq，为后台作业处理

• 如何使用Systemctl来管理Systemd服务和单元
• 了解系统单元和单元文件
• 如何使用journalctl查看和操纵Systemd日志

创建tmpfiles目录

sudo mkdir /run/diaspora

sudo chown diaspora:diaspora /run/diaspora
sudo chmod 750 /run/diaspora

sudo vim /etc/tmpfiles.d/diaspora.conf

d /run/diaspora 0750 diaspora diaspora - -

Unicorn

sudo su - diaspora

vim /home/diaspora/diaspora/config/diaspora.yml

listen: 'unix:/run/diaspora/diaspora.sock'

su - username

sudo vim /etc/systemd/system/diaspora-unicorn.service

[Unit]
Description=Diaspora Unicorn Server
Requires=redis.service
After=redis.service network.target

[Service]
User=diaspora
Group=diaspora
SyslogIdentifier=diaspora-unicorn
WorkingDirectory=/home/diaspora/diaspora
Environment=RAILS_ENV=production
## Uncomment if postgres is installed
#Environment=DB=postgres

PIDFile=/run/diaspora/unicorn.pid
Restart=always

CPUAccounting=true
emoryAccounting=true
BlockIOAccounting=true
CapabilityBoundingSet=
PrivateTmp=true
NoNewPrivileges=true

ExecStart=/usr/bin/bundle exec "unicorn_rails -c config/unicorn.rb -E production"

[Install]
WantedBy=multi-user.target

sudo systemctl start diaspora-unicorn
sudo systemctl enable diaspora-unicorn

systemctl status diaspora-unicorn

diaspora-unicorn.service - Diaspora Unicorn Server
Loaded: loaded (/etc/systemd/system/diaspora-unicorn.service; enabled)
Active: active (running) since Tue 2015-06-23 10:18:25 EDT; 16s ago
Main PID: 16658 (ruby)
CGroup: /system.slice/diaspora-unicorn.service
└─16658 ruby /home/diaspora/diaspora/vendor/bundle/ruby/bin/unicorn_rails -c config/unicorn.rb -E production

Sidekiq

sudo vim /etc/systemd/system/diaspora-sidekiq.service

[Unit]
Description=Diaspora Sidekiq Worker
Requires=redis.service
After=redis.service network.target

[Service]
User=diaspora
Group=diaspora
SyslogIdentifier=diaspora-sidekiq
WorkingDirectory=/home/diaspora/diaspora
Environment=RAILS_ENV=production
## Uncomment if postgres is installed
#Environment=DB=postgres

Restart=always

CPUAccounting=true
emoryAccounting=true
BlockIOAccounting=true
CapabilityBoundingSet=
PrivateTmp=true

ExecStart=/usr/bin/bundle exec "sidekiq -e production -L log/sidekiq.log >> log/sidekiq.log 2>&1"

[Install]
WantedBy=multi-user.target

sudo systemctl start diaspora-sidekiq
sudo systemctl enable diaspora-sidekiq

systemctl status diaspora-sidekiq

diaspora-sidekiq.service - Diaspora Sidekiq Worker
   Loaded: loaded (/etc/systemd/system/diaspora-sidekiq.service; enabled)
   Active: active (running) since Mon 2014-12-29 08:21:45 UTC; 44s ago
 Main PID: 18123 (sh)
   CGroup: /system.slice/diaspora-sidekiq.service
           ├─18123 sh -c sidekiq -e production -L log/sidekiq.log >> log/sidekiq.log 2>&1
           └─18125 sidekiq 2.17.7 diaspora [0 of 5 busy]

第1步4 - 安装Nginx

sudo yum install nginx

sudo systemctl start nginx
sudo systemctl enable nginx

第1步5 - 给Nginx权限

sudo usermod -a -G diaspora nginx

sudo chmod 750 /home/diaspora/

第1步6 - 上传SSL证书并启用转发保密

sudo mkdir /etc/ssl/diaspora

sudo su -

openssl dhparam 2048 > /etc/ssl/dhparam.pem

su - username

第1步7 - 禁用nginx.conf中的默认网站

sudo vim /etc/nginx/nginx.conf

server {
listen 80;
listen [::]:80;
server_name localhost;
root /usr/share/nginx/html;

第1步8 - 创建Diaspora自己的Nginx配置文件

sudo vim /etc/nginx/conf.d/diaspora.conf

upstream diaspora {
  server unix:/run/diaspora/diaspora.sock fail_timeout=0;
}
server {
  listen [::]:80;
  listen 80;
  server_name _;
  return 301 https://example.com$request_uri;
}
server {
  listen [::]:443 ssl spdy;
  listen 443 ssl spdy;
  server_name example.com;
  root /home/diaspora/diaspora/public;
  server_tokens off;
  error_log /var/log/nginx/diaspora_error.log;

  # Configure maximum picture size
  # Note that Diaspora has a client side check set at 4M
  client_max_body_size 4M;

  ## SSL settings
  ssl_certificate /etc/ssl/diaspora/ssl.crt;
  ssl_certificate_key /etc/ssl/diaspora/ssl.key;

  # https://wiki.mozilla.org/Security/Server_Side_TLS
  ssl_dhparam /etc/ssl/dhparam.pem;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:AES:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK';
  ssl_session_timeout 5m;
  ssl_prefer_server_ciphers on;
  ssl_session_cache shared:SSL:50m;
  add_header Strict-Transport-Security "max-age=31536000";

  location / {
    # Proxy if requested file not found
    try_files $uri $uri/index.html $uri.html @diaspora;
  }

  location @diaspora {
    gzip off;
    proxy_set_header  X-Forwarded-Ssl   on;
    proxy_set_header  X-Real-IP         $remote_addr;
    proxy_set_header  X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header  X-Forwarded-Proto https;
    proxy_set_header  Host              $http_host;
    proxy_set_header  X-Frame-Options   SAMEORIGIN;
    proxy_redirect                      off;
    proxy_pass http://diaspora;
  }
}

• example.com用自己注册的域名; 你需要做的这两个地方
• /etc/ssl/diaspora/ssl.crt的路径到自己的公证书
• /etc/ssl/diaspora/ssl.key的路径到自己的私钥

• 在upstream块是我们成立了Unix套接字散居听（我们还Unicorn设置更早）。 这在以后的使用proxy_pass指令。
• 第一个server块监听标准的HTTP端口80和重定向到HTTPS的任何请求。
• 第二个server模块侦听的端口443 （SSL），并将这是从Mozilla的维基采取了一些强大的SSL参数。

sudo nginx -t

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

sudo systemctl restart nginx

第1步9 - 创建散居用户

第2步0 - 配置SELinux（可选）

警告：如果你不熟悉的SELinux，请注意， 这可以打破的东西 。您可以跳过此部分并开始使用Diaspora。

• 在CentOS 7上的SELinux简介 - 第1部分：基本概念
• 在CentOS 7 - 第2部分：文件和过程SELinux介绍
• 在CentOS 7上的SELinux简介 - 第3部分：用户

启用SELinux

sudo vim /etc/selinux/config

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=permissive
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected.
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

sudo reboot

su - username

sudo vim /etc/selinux/config

SELINUX=enforcing

sudo reboot

SELinux Nginx策略

grep denied /var/log/audit/audit.log

type=AVC msg=audit(1424394514.632:385): avc:  denied  { search } for  pid=1114 comm="nginx" name="diaspora" dev="vda1" ino=783369 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:user_home_dir_t:s0 tclass=dir
type=AVC msg=audit(1424394514.632:386): avc:  denied  { write } for  pid=1114 comm="nginx" name="diaspora.sock" dev="tmpfs" ino=21382 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file

yum install policycoreutils-{python,devel} setroubleshoot-server

grep nginx /var/log/audit/audit.log | audit2allow -M nginx_diaspora

vim nginx_diaspora.te

module nginx_diaspora 1.0;

require {
        type var_run_t;
        type httpd_t;
        type user_home_t;
        type init_t;
        class sock_file write;
        class unix_stream_socket connectto;
        class file { read open };
}


#============= httpd_t ==============
allow httpd_t init_t:unix_stream_socket connectto;

#!!!! This avc can be allowed using the boolean 'httpd_read_user_content'
allow httpd_t user_home_t:file { read open };
allow httpd_t var_run_t:sock_file write;

semodule -i nginx_diaspora.pp

简要SELinux故障排除

1. 运行下面命令grep通过audit.log ，并添加新条目拒绝对Nginx的政策。

grep nginx /var/log/audit/audit.log | audit2allow -M nginx_diaspora

1. 重新加载策略模块。

semodule -i nginx_diaspora.pp

tail -f /var/log/messages

. . .

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that nginx should be allowed write access on the  sock_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep nginx /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp

. . .

结论