2010年12月の年末更新時期には特に大きな変更（ハードウエア更新、OS更新）は行わないことにしたが、サーバー証明書が失効したので久しぶりに自己認証式（なんちゃって式？）のサーバー証明書、懸案であった Dovecot のパスワード更新などマイナーなメンテナンスを実施したので、その内容を記録しておく。

サーバー証明書†

↑

課題†

↑

新サービス決定†

ー 今回検討したのは Namechep ---- 1 サーバー固定で 19$／2年

ー オーダー完了 （20101227）

Date :	Saturday, December 25, 2010
Transaction ID :	3169510769850943:XXGM:
Order ID :	122.249.122.231-WIKIHMUNA-NC-511918-04836A2304-76622.21
Charged Amount:	$19.9
Final Amount :	$19.9

ー 更新オーダー完了 （2012-11-27）

↑

申請データの作成 （２０１２年１２月更新時）†

root@mythen:/etc/ssl/official2# openssl genrsa -des3 -out wiki.hmuna.com.privatekey 2048
Generating RSA private key, 2048 bit long modulus
..........+++
.............................................+++
e is 65537 (0x10001)
Enter pass phrase for wiki.hmuna.com.privatekey: 
Verifying - Enter pass phrase for wiki.hmuna.com.privatekey:
root@mythen:/etc/ssl/official2# ls -l
合計 4
-rw-r--r-- 1 root root 1751 12月 11 23:58 wiki.hmuna.com.privatekey
root@mythen:/etc/ssl/official2# cat wiki.hmuna.com.privatekey 
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,FE967CF70E2BECD5

1PbN5HRpFwGuGzQ8Uh5Wim9M2dO5SHAy3YEIgGC1PJnM2khdDuo6YsV3GMtSAOLq
WmpN+tWgrljx3zoKJUOIxkjo4YmnwsX6S1BKhw7RAisxBDMbRDVzjphiJx8O+8ik
alxudyYbcBhd0CAsDJYSxxWIbq8XSH1BZqM+1u0otDzM0o2MWJOgSrvzhgi0tAG2
44E+dvFT0SjY3LIxMAN+T5VkaKaHQfKybRGKy19Q1gV1DQkY8d7+AngCS6L6xZZO
a/uS0WjRhv35jNrOmDsXH2/8bjsD/XxR4Eb222zaYS2JHE3kHzX4oK09XVfLKuvC
yl/XsHKKEnaAY6XKv6+d+5ARcuMQX4fJHGKwjkTIvLoMpnijVYS+HC+tk75GzCzu
8D55Ws0cvqRvQlzPzoP98kfWwUv4/Qj4+aBSvExNaSNMDQAnFtoYBrTLnys2VA45
GhzejPMr2dIJRepNHVuKhNOg+jRu8ov6ZLIJkZRlXcsxHAeiZO0CenP78HW1QRQr
TPJIwxVO6xzLTttKLbqC9C8s75vo07k/FM6rwTVTsmJXCn0utMO4MOEgaDAIXk2m
85wjdv7JyOXsCUusuSxREWl8mgjLukQVea3vylbvtTFUV/ZvI8IJrVA+NYF1GqHp
YT7Qv5w0ALCb2Rcm4AJQCX+JArqFN1gxE1H9OaxaF8YxdTsf2acftJrGhObyY35D
2D5sH0uQ21VkS1tkZ9Ad68Os6NWymnmSgTYLfRPB7778qBXNOAkMURVDGNeEnaR8
E6BohuUhHUs4OQRcBlhfzHqyyK/9+JdFQ5ziGyCaVt4uuecEI+nmLZ7JTyAzhq0r
bo97suQi3jRYXsT0qMubCGS9Ic28y05BvT16SVhbqYongTXJVHLVw2qyYwtn5rcx
ntMwfnGJ8Lce4+ohkRksk70EBOvO4loBPypzirsM3Ht17pwEH1rHEFuoEqqgAJhb
kZug3FcZCusoOV1FmzzbjEVKNm2EB7xfIByN/RAQxNlDWD0js8ClSWIiD0wC60Qr
Nk+0Y+0EUOyxNB9lhnkm/4Y57Hyjn2DAjHblnyz/zr9zr+ZQrbciNU/VL2BCgJK3
w6/OKF/8f/xyh2yVgvySjYtNFVyevAKZbbdDkV2/cXKRRmbLuSY2ity4TtqptvMQ
lbRLlcTvZqIEv068UfCDCwDyiTANuHKBLMVN83Xi4n0e9WeG5yjocrZQnnJD9HXE
MAWLwRrZ5uvYn4up4vRgo2Fnd0vnZK6OgOJq1/Tx5LN/yZI6VMkDjTJUNqIgG7Hk
5EYUyRLIC3R0VSwbY6FTQuvpJHGAJhwhId9y6nBlCrF7z5imMdwmduZlsGcwa1RA
xzsn2QNwnRDkk/K+L8VwscwKtZnRnU4xbOxfSY7wgnjFdek0imkEYB3IJezlH8th
5dbevzw9jceS4zpBzgU/h4ivhsX40Uof1n8PT3ie5NcigpLGbDYk3d9YIMLiI5jJ
9I2e4l+rYK3j7m74TbWU/GDgI9jiHQVlIUsEX2e2Qsya0bt6cu3svTNfVOy7Ef0F
dYPENkIo4Q9SQQUHYlRRhT5dOhvhj/PhbQvprN7d6QCqGsMR3WwbURxVVPUCf49c
-----END RSA PRIVATE KEY-----
root@mythen:/etc/ssl/official2# openssl req -new -key wiki.hmuna.com.privatekey -out wikihmunaCSR.csr

Enter pass phrase for wiki.hmuna.com.privatekey:  <---- nanamochahiko

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Kanagawa
Locality Name (eg, city) []:Yokohama
Organization Name (eg, company) [Internet Widgits Pty Ltd]:IT Admin
Organizational Unit Name (eg, section) []:IT
Common Name (e.g. server FQDN or YOUR name) []:wiki.hmuna.com
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
↑

申請データの作成†

root@spirit:/etc/ssl/official# openssl genrsa -out wikihmunaPrivateKey.key 2048
Generating RSA private key, 2048 bit long modulus
................................................................+++
.....+++
e is 65537 (0x10001)
root@spirit:/etc/ssl/official# ls -l
合計 4
-rw-r--r-- 1 root root 1675 2010-12-26 11:42 wikihmunaPrivateKey.key
root@spirit:/etc/ssl/official# date
root@spirit:/etc/ssl/official# openssl req -new -key wikihmunaPrivateKey.key -out wikihmunaPrivateKey.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [JP]:
State or Province Name (full name) [Kanagawa]:
Locality Name (eg, city) [Yokohama]:
Organization Name (eg, company) [IT admin]:
Organizational Unit Name (eg, section) [IT]:
Common Name (eg, YOUR name) [hmuna.com]:wiki.hmuna.com
Email Address [server-admin@hmuna.com]:none

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

root@spirit:/etc/ssl/official# ls -l
合計 8
-rw-r--r-- 1 root root 1041 2010-12-26 11:48 wikihmunaPrivateKey.csr
-rw-r--r-- 1 root root 1675 2010-12-26 11:42 wikihmunaPrivateKey.key
↑

承認プロセス†

↑

発行†

ORDER COMPLETE

Dear hisao munakata,

Congratulations! GeoTrust has approved your request for a RapidSSL certificate. Your certificate is included at the end   of this email.

INSTALLATION INSTRUCTIONS 

1. INSTALL CERTIFICATE:
Install the X.509 version of your certificate included at the end of this e-mail.
For installation instructions for your SSL Certificate, go to:
https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO16226

2. INTERMEDIATE CERTIFICATE ADVISORY:
You MUST install the GeoTrust intermediate Certificate included at end of this e-mail on your server together with your  Certificate or it may not operate correctly

You can also get your GeoTrust intermediate Certificates at:
https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id=AR1422

3. CHECK INSTALLATION:
Ensure you have installed your certificate correctly at:
https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&id=SO9556&actp=LIST&viewlocale=en_US

Visit the GeoTrust Support Web site, where you will find a range of support tools to help you:

http://www.rapidssl.com/support


Sincerely,

RapidSSL Customer Support
http://www.rapidssl.com/support
Hours of Operation: Mon - Fri 09:00 - 17:00 (EST)
Email:     support@rapidssl.com
Phone:     1-720-359-1590
Live Chat: https://knowledge.rapidssl.com/support/ssl-certificate-support/index.html

(snip)
________________________________________________________________________

Web Server CERTIFICATE
-----------------

-----BEGIN CERTIFICATE-----
MIIEyjCCA7KgAwIBAgICJtUwDQYJKoZIhvcNAQEFBQAwPDELMAkGA1UEBhMCVVMx
FzAVBgNVBAoTDkdlb1RydXN0LCBJbmMuMRQwEgYDVQQDEwtSYXBpZFNTTCBDQTAe
Fw0xMDEyMjQwODEwNDNaFw0xMjEyMjYwNzU5MzdaMIHjMSkwJwYDVQQFEyBHTGM1
cnp4Z015bE9RTE1iYXBBUXhHNGF5aUtZY1k3SDELMAkGA1UEBhMCSlAxFzAVBgNV
BAoTDndpa2kuaG11bmEuY29tMRMwEQYDVQQLEwpHVDc4MDc1MzA2MTEwLwYDVQQL
EyhTZWUgd3d3LnJhcGlkc3NsLmNvbS9yZXNvdXJjZXMvY3BzIChjKTEwMS8wLQYD
VQQLEyZEb21haW4gQ29udHJvbCBWYWxpZGF0ZWQgLSBSYXBpZFNTTChSKTEXMBUG
A1UEAxMOd2lraS5obXVuYS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
AoIBAQCvojexdkMNelwHFnIz610dlpEstRmfqK0kCve4txIE/wcf4prYrayvVNxh
ZfIlCaqKNCCJQHtqg9FK/htreGoDMO+hKOM8oZb++HodR+QILZsuej/ETxH0NHQP
nxTXY6X2IE3te263H7RHtWB1drOI3KuFfG1eFT5Pw0bDIKXmzXvuPc6h7BTaJcVi
OoPs7qteNL3mPP3eofMzF/CY1rUoJs2GNZUNhp1bEUvPcvF5gWXAAg9owvgGARay
vY484nGkCnO6/wHpJ9X0rP0Bs1FqOS+eVFXIYKCb49iLTotmY/927e0eZ6iTxmo9
92HH3CMHoKwR0j+C+csPxnV4JINtAgMBAAGjggEsMIIBKDAfBgNVHSMEGDAWgBRr
aT1qGEJK3Y8CZTn9NSSGeJEWMDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYI
KwYBBQUHAwEGCCsGAQUFBwMCMBkGA1UdEQQSMBCCDndpa2kuaG11bmEuY29tMEMG
A1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9yYXBpZHNzbC1jcmwuZ2VvdHJ1c3QuY29t
L2NybHMvcmFwaWRzc2wuY3JsMB0GA1UdDgQWBBTwME01TrU41ve+HG6GyI/yGBHO
jDAMBgNVHRMBAf8EAjAAMEkGCCsGAQUFBwEBBD0wOzA5BggrBgEFBQcwAoYtaHR0
cDovL3JhcGlkc3NsLWFpYS5nZW90cnVzdC5jb20vcmFwaWRzc2wuY3J0MA0GCSqG
SIb3DQEBBQUAA4IBAQBCsWXCW+Y3Y0r6ULG5DH9W2uXIiz7LeuK3zDpCf09pNhyX
bDiOL+r9slt9KQDXof/dlRXUg6GQtG2c1cLiBghmMakwPylB+mTn7nEO9/dOrjri
XxhAP6TNJD7Js28tgi22M8f+idotxfGlNqtdglDzI/fHk+EZScPDo92+Gv7jBtSM
t0lbT3L9gjraDS1CK3Kr7+1Ralfp7yTXKiOxgsw8E3WFfpd7ya4F+KPQiqFfGYy7
3nSsC5CJOhQzENucdyvHTtPP4RPPVADBuWkHVYJ2zuW2s/rPIEOWx4YOkfGA1iOQ
O2QmKLyoskqm5J5emWTYXdHVnu3lIqUKwhXjEK3e
-----END CERTIFICATE-----

INTERMEDIATE CA:  
---------------------------------------

-----BEGIN CERTIFICATE-----
MIID1TCCAr2gAwIBAgIDAjbRMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i
YWwgQ0EwHhcNMTAwMjE5MjI0NTA1WhcNMjAwMjE4MjI0NTA1WjA8MQswCQYDVQQG
EwJVUzEXMBUGA1UEChMOR2VvVHJ1c3QsIEluYy4xFDASBgNVBAMTC1JhcGlkU1NM
IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx3H4Vsce2cy1rfa0
l6P7oeYLUF9QqjraD/w9KSRDxhApwfxVQHLuverfn7ZB9EhLyG7+T1cSi1v6kt1e
6K3z8Buxe037z/3R5fjj3Of1c3/fAUnPjFbBvTfjW761T4uL8NpPx+PdVUdp3/Jb
ewdPPeWsIcHIHXro5/YPoar1b96oZU8QiZwD84l6pV4BcjPtqelaHnnzh8jfyMX8
N8iamte4dsywPuf95lTq319SQXhZV63xEtZ/vNWfcNMFbPqjfWdY3SZiHTGSDHl5
HI7PynvBZq+odEj7joLCniyZXHstXZu8W1eefDp6E63yoxhbK1kPzVw662gzxigd
gtFQiwIDAQABo4HZMIHWMA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUa2k9ahhC
St2PAmU5/TUkhniRFjAwHwYDVR0jBBgwFoAUwHqYaI2J+6sFZAwRfap9ZbjKzE4w
EgYDVR0TAQH/BAgwBgEB/wIBADA6BgNVHR8EMzAxMC+gLaArhilodHRwOi8vY3Js
Lmdlb3RydXN0LmNvbS9jcmxzL2d0Z2xvYmFsLmNybDA0BggrBgEFBQcBAQQoMCYw
JAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmdlb3RydXN0LmNvbTANBgkqhkiG9w0B
AQUFAAOCAQEAq7y8Cl0YlOPBscOoTFXWvrSY8e48HM3P8yQkXJYDJ1j8Nq6iL4/x
/torAsMzvcjdSCIrYA+lAxD9d/jQ7ZZnT/3qRyBwVNypDFV+4ZYlitm12ldKvo2O
SUNjpWxOJ4cl61tt/qJ/OCjgNqutOaWlYsS3XFgsql0BYKZiZ6PAx2Ij9OdsRu61
04BqIhPSLT90T+qvjF+0OJzbrs6vhB6m9jRRWXnT43XcvNfzc9+S7NIgWW+c+5X4
knYYCnwPLKbK3opie9jzzl9ovY8+wXS7FXI6FoOpC+ZNmZzYV+yoAVHHb1c0XqtK
LEL2TxyJeN4mTvVvk0wVaydWTQBUbHq3tw==
-----END CERTIFICATE-----
↑

サーバーにキーをインストール†

# 20101225 に公式の証明書（でも安い！）を導入しなおした。
# 導入経緯の説明は wiki に（https://wiki.hmuna.com:443/index.php?HomeServer6
#   Server Certificate: 
SSLCertificateFile      /etc/ssl/official/wikihmunaSSLCertificateFile.pem
#   Server Private Key: 
SSLCertificateKeyFile   /etc/ssl/official/wikihmunaPrivateKey.key
#   Server Certificate Chain:
SSLCertificateChainFile /etc/ssl/official/RapidSSL_CA_bundle.pem
↑

Dovecot 調整†

↑

課題†

↑

パスワードの変更†

disable_plaintext_auth = yes
# passwd-like file with specified location
# <doc/wiki/AuthDatabase.PasswdFile.txt>
passdb passwd-file {
  # [scheme=<default password scheme>] [username_format=<format>]
  # <Path for passwd-file>
  # 20101224 enabled
  args = /etc/dovecot/passwd
}
root@spirit:/etc/dovecot# dovecotpw 
Enter new password: 
Retype new password: 
{HMAC-MD5}a76c629eb7d5c10aa1860c2dd783b01700d606bdf0b080604f62fc8c34661871
root@spirit:/etc/dovecot# cat passwd 
# postfix の認証に sasl_auth を利用する。relay が禁止されているが、smtp_auth の
# 認証が通ったものはリレー可能になるのでこの設定は必須。 実際の 認証は dovecot が
# 代行できるので この dovecot のパスワードファイルを利用する。
# 参照 web = http://nabe.blog.abk.nu/0304 
# pass for smtp_auth connection (imap)
server-admin@mtp:{HMAC-MD5}8e014b38eb82adeaa560bb8862d57004407240bf29acd6e37d6d7bbde603fc96
munakata@smtp:{HMAC-MD5}0e8d79672596240aca201410861cfe1bca7f639d4a9af9a63b0c4c11c0299a06
public_mail@smtp:{HMAC-MD5}47e27fa0a8ded62a095f4d265d25048f54e72487d2004a8dcfda3b2f786e2f7c
stored_mail@smtp:{HMAC-MD5}317d5f3e05294aee9d9993c723266d3d66082a94a9e70bf70dfb14da1660684a
yuko@smtp:{HMAC-MD5}a491880edfbd0793d0c00010b3e62380ed1d0e64450182667ffa4cd4ba8c47b6
purple@smtp:{HMAC-MD5}ca0a8f9b097ea5552b23375257443ab5abbb7c1401840c02567181d6fb545093
dtv-rec@smtp:{HMAC-MD5}acbd6cd9611b52ebbaf7fdb4771bbe2d32fac682dfce36134fee2bdda0128658
↑

参考 URL†

↑

dovecot と postfix の証明書†

↑

公式証明書の取得†

↑

証明書の更新 （2012-11 4年間）†

↑

証明書†

↑

証明書のインストール†

↑

参考 URL†

↑

awstats (メール統計）の復旧†

root@spirit:~# cat /etc/cron.hourly/awstats 
#!/bin/bash

/usr/lib/cgi-bin/awstats.pl -config=postfix -update > /dev/null
/usr/lib/cgi-bin/awstats.pl -config=postfix -output -staticlink > /raid_vol/www/awstats/index.html

exit 0
↑

設定記録 （asof 2011-05-04)†

↑

fstab†

server-admin@spirit:~$ cat /etc/fstab
# /etc/fstab: static file system information.
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
#---------------------------------------------------------------------------------------------------
proc            /proc           proc    defaults        0       0
#---------------------------------------------------------------------------------------------------
# /dev/sda1
UUID=d91f0e8b-d558-4448-83d3-e3e4397fa1d4 /               ext3    relatime,errors=remount-ro 0       1
#---------------------------------------------------------------------------------------------------
# /dev/sda3
UUID=82470a1b-ed6c-4e25-915e-cd5445863cdc /boot           ext3    relatime        0       2
#---------------------------------------------------------------------------------------------------
# /dev/sdd1
#UUID=7ec7c6ac-a426-4ae6-ae6b-497c2d84c164 /recipe	  ext3    relatime        0	  2
#---------------------------------------------------------------------------------------------------
# /dev/sdf2
#/dev/sdf2                                /dtv_rec        ext3    relatime        0       2
#UUID=66c408d1-d786-4f96-97d0-9c19b9f110c5 /dtv_rec        ext3    relatime        0       2
#---------------------------------------------------------------------------------------------------
# /dev/sdg1
#/dev/sdg1                                /dtv_rec2       ext4    relatime        0       2
UUID=75a20c86-b461-4808-adfc-6fb5a26db0f3 /dtv_rec2       ext4    relatime        0       2
#---------------------------------------------------------------------------------------------------
# /dev/sdh1
#/dev/sdh1                                /dtv_recA       ext4    relatime        0       2
UUID=b424addb-e108-4281-90c0-c09a18fe1c21 /dtv_recA       ext4    relatime        0       2
#---------------------------------------------------------------------------------------------------
# /dev/sdi1
#/dev/sdi1                                /dtv_recB       ext4    relatime        0       2
UUID=7e0844b8-c278-4f07-b3e9-7a62a5450eb0 /dtv_recB       ext4    relatime        0       2
#---------------------------------------------------------------------------------------------------
# /dev/md0 (/dev/sdb1 + /dev/sdc1 : RAID1 )
/dev/md0	/raid_vol	ext4    relatime        0       2
#---------------------------------------------------------------------------------------------------
# /dev/sde2
UUID=fef7b57a-beb7-4e04-98b0-9b1ca438c762 /ref            ext4    relatime        0       2
#---------------------------------------------------------------------------------------------------
# /dev/sdb5
UUID=b97f92e6-b7c5-406b-b62b-9c643275077a none            swap    sw              0       0
#---------------------------------------------------------------------------------------------------
/dev/scd0       /media/cdrom0   udf,iso9660 user,noauto,exec,utf8 0       0
↑

mount†

server-admin@spirit:~$ mount
/dev/sda1 on / type ext3 (rw,relatime,errors=remount-ro)
proc on /proc type proc (rw)
none on /sys type sysfs (rw,noexec,nosuid,nodev)
none on /sys/fs/fuse/connections type fusectl (rw)
none on /sys/kernel/debug type debugfs (rw)
none on /sys/kernel/security type securityfs (rw)
udev on /dev type tmpfs (rw,mode=0755)
none on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620)
none on /dev/shm type tmpfs (rw,nosuid,nodev)
none on /var/run type tmpfs (rw,nosuid,mode=0755)
none on /var/lock type tmpfs (rw,noexec,nosuid,nodev)
none on /lib/init/rw type tmpfs (rw,nosuid,mode=0755)
/dev/sdf1 on /dtv_recA type ext4 (rw,relatime)
/dev/sdg1 on /dtv_recB type ext4 (rw,relatime)
/dev/sde1 on /dtv_rec2 type ext4 (rw,relatime)
/dev/sdd2 on /ref type ext4 (rw,relatime)
/dev/md0 on /raid_vol type ext4 (rw,relatime)
/dev/sda3 on /boot type ext3 (rw,relatime)
gvfs-fuse-daemon on /home/server-admin/.gvfs type fuse.gvfs-fuse-daemon (rw,nosuid,nodev,user=server-admin)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,noexec,nosuid,nodev)
↑

Ubuntuインストール直後にすべき10のこと†

トップ   新規 一覧 検索 最終更新   ヘルプ   最終更新のRSS