2010年12月の年末更新時期には特に大きな変更（ハードウエア更新、OS更新）は行わないことにしたが、サーバー証明書が失効したので久しぶりに自己認証式（なんちゃって式？）のサーバー証明書、懸案であった Dovecot のパスワード更新などマイナーなメンテナンスを実施したので、その内容を記録しておく。

サーバー証明書†

↑

課題†

↑

新サービス決定†

ー 今回検討したのは Namechep ---- 1 サーバー固定で 19$／2年

ー オーダー完了 （20101227）

Date :	Saturday, December 25, 2010
Transaction ID :	3169510769850943:XXGM:
Order ID :	122.249.122.231-WIKIHMUNA-NC-511918-04836A2304-76622.21
Charged Amount:	$19.9
Final Amount :	$19.9
↑

申請データの作成†

root@spirit:/etc/ssl/official# openssl genrsa -out wikihmunaPrivateKey.key 2048
Generating RSA private key, 2048 bit long modulus
................................................................+++
.....+++
e is 65537 (0x10001)
root@spirit:/etc/ssl/official# ls -l
合計 4
-rw-r--r-- 1 root root 1675 2010-12-26 11:42 wikihmunaPrivateKey.key
root@spirit:/etc/ssl/official# date
root@spirit:/etc/ssl/official# openssl req -new -key wikihmunaPrivateKey.key -out wikihmunaPrivateKey.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [JP]:
State or Province Name (full name) [Kanagawa]:
Locality Name (eg, city) [Yokohama]:
Organization Name (eg, company) [IT admin]:
Organizational Unit Name (eg, section) [IT]:
Common Name (eg, YOUR name) [hmuna.com]:wiki.hmuna.com
Email Address [server-admin@hmuna.com]:none

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

root@spirit:/etc/ssl/official# ls -l
合計 8
-rw-r--r-- 1 root root 1041 2010-12-26 11:48 wikihmunaPrivateKey.csr
-rw-r--r-- 1 root root 1675 2010-12-26 11:42 wikihmunaPrivateKey.key
↑

承認プロセス†

↑

発行†

ORDER COMPLETE

Dear hisao munakata,

Congratulations! GeoTrust has approved your request for a RapidSSL certificate. Your certificate is included at the end   of this email.

INSTALLATION INSTRUCTIONS 

1. INSTALL CERTIFICATE:
Install the X.509 version of your certificate included at the end of this e-mail.
For installation instructions for your SSL Certificate, go to:
https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO16226

2. INTERMEDIATE CERTIFICATE ADVISORY:
You MUST install the GeoTrust intermediate Certificate included at end of this e-mail on your server together with your  Certificate or it may not operate correctly

You can also get your GeoTrust intermediate Certificates at:
https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id=AR1422

3. CHECK INSTALLATION:
Ensure you have installed your certificate correctly at:
https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO9556&actp=LIST&viewlocale=en_US

Visit the GeoTrust Support Web site, where you will find a range of support tools to help you:

http://www.rapidssl.com/support


Sincerely,

RapidSSL Customer Support
http://www.rapidssl.com/support
Hours of Operation: Mon - Fri 09:00 - 17:00 (EST)
Email:     support@rapidssl.com
Phone:     1-720-359-1590
Live Chat: https://knowledge.rapidssl.com/support/ssl-certificate-support/index.html

(snip)
________________________________________________________________________

Web Server CERTIFICATE
-----------------

-----BEGIN CERTIFICATE-----
MIIEyjCCA7KgAwIBAgICJtUwDQYJKoZIhvcNAQEFBQAwPDELMAkGA1UEBhMCVVMx
FzAVBgNVBAoTDkdlb1RydXN0LCBJbmMuMRQwEgYDVQQDEwtSYXBpZFNTTCBDQTAe
Fw0xMDEyMjQwODEwNDNaFw0xMjEyMjYwNzU5MzdaMIHjMSkwJwYDVQQFEyBHTGM1
cnp4Z015bE9RTE1iYXBBUXhHNGF5aUtZY1k3SDELMAkGA1UEBhMCSlAxFzAVBgNV
BAoTDndpa2kuaG11bmEuY29tMRMwEQYDVQQLEwpHVDc4MDc1MzA2MTEwLwYDVQQL
EyhTZWUgd3d3LnJhcGlkc3NsLmNvbS9yZXNvdXJjZXMvY3BzIChjKTEwMS8wLQYD
VQQLEyZEb21haW4gQ29udHJvbCBWYWxpZGF0ZWQgLSBSYXBpZFNTTChSKTEXMBUG
A1UEAxMOd2lraS5obXVuYS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQCvojexdkMNelwHFnIz610dlpEstRmfqK0kCve4txIE/wcf4prYrayvVNxh
ZfIlCaqKNCCJQHtqg9FK/htreGoDMO+hKOM8oZb++HodR+QILZsuej/ETxH0NHQP
nxTXY6X2IE3te263H7RHtWB1drOI3KuFfG1eFT5Pw0bDIKXmzXvuPc6h7BTaJcVi
OoPs7qteNL3mPP3eofMzF/CY1rUoJs2GNZUNhp1bEUvPcvF5gWXAAg9owvgGARay
vY484nGkCnO6/wHpJ9X0rP0Bs1FqOS+eVFXIYKCb49iLTotmY/927e0eZ6iTxmo9
92HH3CMHoKwR0j+C+csPxnV4JINtAgMBAAGjggEsMIIBKDAfBgNVHSMEGDAWgBRr
aT1qGEJK3Y8CZTn9NSSGeJEWMDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYI
KwYBBQUHAwEGCCsGAQUFBwMCMBkGA1UdEQQSMBCCDndpa2kuaG11bmEuY29tMEMG
A1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9yYXBpZHNzbC1jcmwuZ2VvdHJ1c3QuY29t
L2NybHMvcmFwaWRzc2wuY3JsMB0GA1UdDgQWBBTwME01TrU41ve+HG6GyI/yGBHO
jDAMBgNVHRMBAf8EAjAAMEkGCCsGAQUFBwEBBD0wOzA5BggrBgEFBQcwAoYtaHR0
cDovL3JhcGlkc3NsLWFpYS5nZW90cnVzdC5jb20vcmFwaWRzc2wuY3J0MA0GCSqG
SIb3DQEBBQUAA4IBAQBCsWXCW+Y3Y0r6ULG5DH9W2uXIiz7LeuK3zDpCf09pNhyX
bDiOL+r9slt9KQDXof/dlRXUg6GQtG2c1cLiBghmMakwPylB+mTn7nEO9/dOrjri
XxhAP6TNJD7Js28tgi22M8f+idotxfGlNqtdglDzI/fHk+EZScPDo92+Gv7jBtSM
t0lbT3L9gjraDS1CK3Kr7+1Ralfp7yTXKiOxgsw8E3WFfpd7ya4F+KPQiqFfGYy7
3nSsC5CJOhQzENucdyvHTtPP4RPPVADBuWkHVYJ2zuW2s/rPIEOWx4YOkfGA1iOQ
O2QmKLyoskqm5J5emWTYXdHVnu3lIqUKwhXjEK3e
-----END CERTIFICATE-----

INTERMEDIATE CA:  
---------------------------------------

-----BEGIN CERTIFICATE-----
MIID1TCCAr2gAwIBAgIDAjbRMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i
YWwgQ0EwHhcNMTAwMjE5MjI0NTA1WhcNMjAwMjE4MjI0NTA1WjA8MQswCQYDVQQG
EwJVUzEXMBUGA1UEChMOR2VvVHJ1c3QsIEluYy4xFDASBgNVBAMTC1JhcGlkU1NM
IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx3H4Vsce2cy1rfa0
l6P7oeYLUF9QqjraD/w9KSRDxhApwfxVQHLuverfn7ZB9EhLyG7+T1cSi1v6kt1e
6K3z8Buxe037z/3R5fjj3Of1c3/fAUnPjFbBvTfjW761T4uL8NpPx+PdVUdp3/Jb
ewdPPeWsIcHIHXro5/YPoar1b96oZU8QiZwD84l6pV4BcjPtqelaHnnzh8jfyMX8
N8iamte4dsywPuf95lTq319SQXhZV63xEtZ/vNWfcNMFbPqjfWdY3SZiHTGSDHl5
HI7PynvBZq+odEj7joLCniyZXHstXZu8W1eefDp6E63yoxhbK1kPzVw662gzxigd
gtFQiwIDAQABo4HZMIHWMA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUa2k9ahhC
St2PAmU5/TUkhniRFjAwHwYDVR0jBBgwFoAUwHqYaI2J+6sFZAwRfap9ZbjKzE4w
EgYDVR0TAQH/BAgwBgEB/wIBADA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3Js
Lmdlb3RydXN0LmNvbS9jcmxzL2d0Z2xvYmFsLmNybDA0BggrBgEFBQcBAQQoMCYw
JAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmdlb3RydXN0LmNvbTANBgkqhkiG9w0B
AQUFAAOCAQEAq7y8Cl0YlOPBscOoTFXWvrSY8e48HM3P8yQkXJYDJ1j8Nq6iL4/x
/torAsMzvcjdSCIrYA+lAxD9d/jQ7ZZnT/3qRyBwVNypDFV+4ZYlitm12ldKvo2O
SUNjpWxOJ4cl61tt/qJ/OCjgNqutOaWlYsS3XFgsql0BYKZiZ6PAx2Ij9OdsRu61
04BqIhPSLT90T+qvjF+0OJzbrs6vhB6m9jRRWXnT43XcvNfzc9+S7NIgWW+c+5X4
knYYCnwPLKbK3opie9jzzl9ovY8+wXS7FXI6FoOpC+ZNmZzYV+yoAVHHb1c0XqtK
LEL2TxyJeN4mTvVvk0wVaydWTQBUbHq3tw==
-----END CERTIFICATE-----
↑

サーバーにキーをインストール†

# 20101225 に公式の証明書（でも安い！）を導入しなおした。
# 導入経緯の説明は wiki に（https://wiki.hmuna.com:443/index.php?HomeServer6
#   Server Certificate: 
SSLCertificateFile      /etc/ssl/official/wikihmunaSSLCertificateFile.pem
#   Server Private Key: 
SSLCertificateKeyFile   /etc/ssl/official/wikihmunaPrivateKey.key
#   Server Certificate Chain:
SSLCertificateChainFile /etc/ssl/official/RapidSSL_CA_bundle.pem
↑

Dovecot 調整†

↑

課題†

↑

パスワードの変更†

disable_plaintext_auth = yes
# passwd-like file with specified location
# <doc/wiki/AuthDatabase.PasswdFile.txt>
passdb passwd-file {
  # [scheme=<default password scheme>] [username_format=<format>]
  # <Path for passwd-file>
  # 20101224 enabled
  args = /etc/dovecot/passwd
}
root@spirit:/etc/dovecot# dovecotpw 
Enter new password: 
Retype new password: 
{HMAC-MD5}a76c629eb7d5c10aa1860c2dd783b01700d606bdf0b080604f62fc8c34661871
root@spirit:/etc/dovecot# cat passwd 
# postfix の認証に sasl_auth を利用する。relay が禁止されているが、smtp_auth の
# 認証が通ったものはリレー可能になるのでこの設定は必須。 実際の 認証は dovecot が
# 代行できるので この dovecot のパスワードファイルを利用する。
# 参照 web = http://nabe.blog.abk.nu/0304 
# pass for smtp_auth connection (imap)
server-admin@mtp:{HMAC-MD5}8e014b38eb82adeaa560bb8862d57004407240bf29acd6e37d6d7bbde603fc96
munakata@smtp:{HMAC-MD5}0e8d79672596240aca201410861cfe1bca7f639d4a9af9a63b0c4c11c0299a06
public_mail@smtp:{HMAC-MD5}47e27fa0a8ded62a095f4d265d25048f54e72487d2004a8dcfda3b2f786e2f7c
stored_mail@smtp:{HMAC-MD5}317d5f3e05294aee9d9993c723266d3d66082a94a9e70bf70dfb14da1660684a
yuko@smtp:{HMAC-MD5}a491880edfbd0793d0c00010b3e62380ed1d0e64450182667ffa4cd4ba8c47b6
purple@smtp:{HMAC-MD5}ca0a8f9b097ea5552b23375257443ab5abbb7c1401840c02567181d6fb545093
dtv-rec@smtp:{HMAC-MD5}acbd6cd9611b52ebbaf7fdb4771bbe2d32fac682dfce36134fee2bdda0128658
↑

参考 URL†

↑

dovecot と postfix の証明書†

↑

公式証明書の取得†

↑

証明書†

↑

証明書のインストール†

↑

参考 URL†

↑

awstats (メール統計）の復旧†

root@spirit:~# cat /etc/cron.hourly/awstats 
#!/bin/bash

/usr/lib/cgi-bin/awstats.pl -config=postfix -update > /dev/null
/usr/lib/cgi-bin/awstats.pl -config=postfix -output -staticlink > /raid_vol/www/awstats/index.html

exit 0
↑

設定記録 （asof 2011-05-04)†

↑

fstab†

server-admin@spirit:~$ cat /etc/fstab
# /etc/fstab: static file system information.
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
#---------------------------------------------------------------------------------------------------
proc            /proc           proc    defaults        0       0
#---------------------------------------------------------------------------------------------------
# /dev/sda1
UUID=d91f0e8b-d558-4448-83d3-e3e4397fa1d4 /               ext3    relatime,errors=remount-ro 0       1
#---------------------------------------------------------------------------------------------------
# /dev/sda3
UUID=82470a1b-ed6c-4e25-915e-cd5445863cdc /boot           ext3    relatime        0       2
#---------------------------------------------------------------------------------------------------
# /dev/sdd1
#UUID=7ec7c6ac-a426-4ae6-ae6b-497c2d84c164 /recipe	  ext3    relatime        0	  2
#---------------------------------------------------------------------------------------------------
# /dev/sdf2
#/dev/sdf2                                /dtv_rec        ext3    relatime        0       2
#UUID=66c408d1-d786-4f96-97d0-9c19b9f110c5 /dtv_rec        ext3    relatime        0       2
#---------------------------------------------------------------------------------------------------
# /dev/sdg1
#/dev/sdg1                                /dtv_rec2       ext4    relatime        0       2
UUID=75a20c86-b461-4808-adfc-6fb5a26db0f3 /dtv_rec2       ext4    relatime        0       2
#---------------------------------------------------------------------------------------------------
# /dev/sdh1
#/dev/sdh1                                /dtv_recA       ext4    relatime        0       2
UUID=b424addb-e108-4281-90c0-c09a18fe1c21 /dtv_recA       ext4    relatime        0       2
#---------------------------------------------------------------------------------------------------
# /dev/sdi1
#/dev/sdi1                                /dtv_recB       ext4    relatime        0       2
UUID=7e0844b8-c278-4f07-b3e9-7a62a5450eb0 /dtv_recB       ext4    relatime        0       2
#---------------------------------------------------------------------------------------------------
# /dev/md0 (/dev/sdb1 + /dev/sdc1 : RAID1 )
/dev/md0	/raid_vol	ext4    relatime        0       2
#---------------------------------------------------------------------------------------------------
# /dev/sde2
UUID=fef7b57a-beb7-4e04-98b0-9b1ca438c762 /ref            ext4    relatime        0       2
#---------------------------------------------------------------------------------------------------
# /dev/sdb5
UUID=b97f92e6-b7c5-406b-b62b-9c643275077a none            swap    sw              0       0
#---------------------------------------------------------------------------------------------------
/dev/scd0       /media/cdrom0   udf,iso9660 user,noauto,exec,utf8 0       0
↑

mount†

server-admin@spirit:~$ mount
/dev/sda1 on / type ext3 (rw,relatime,errors=remount-ro)
proc on /proc type proc (rw)
none on /sys type sysfs (rw,noexec,nosuid,nodev)
none on /sys/fs/fuse/connections type fusectl (rw)
none on /sys/kernel/debug type debugfs (rw)
none on /sys/kernel/security type securityfs (rw)
udev on /dev type tmpfs (rw,mode=0755)
none on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620)
none on /dev/shm type tmpfs (rw,nosuid,nodev)
none on /var/run type tmpfs (rw,nosuid,mode=0755)
none on /var/lock type tmpfs (rw,noexec,nosuid,nodev)
none on /lib/init/rw type tmpfs (rw,nosuid,mode=0755)
/dev/sdf1 on /dtv_recA type ext4 (rw,relatime)
/dev/sdg1 on /dtv_recB type ext4 (rw,relatime)
/dev/sde1 on /dtv_rec2 type ext4 (rw,relatime)
/dev/sdd2 on /ref type ext4 (rw,relatime)
/dev/md0 on /raid_vol type ext4 (rw,relatime)
/dev/sda3 on /boot type ext3 (rw,relatime)
gvfs-fuse-daemon on /home/server-admin/.gvfs type fuse.gvfs-fuse-daemon (rw,nosuid,nodev,user=server-admin)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev)
↑

Ubuntuインストール直後にすべき10のこと†

トップ   新規 一覧 検索 最終更新   ヘルプ   最終更新のRSS