Tag Archives: debian 8

Sign nginx website and dovecot imap server on debian with let’s encrypt

If you have a setup with a single server with multiple services (web, IMAP etc.), and one CNAME per service (www.somedomain.com, imap.somedomain.com), and you would like to get the services signed in a manner that doesn’t give warnings or errors in browsers  (especially browsers in phones and tablets with iOS and Android), then this article may be of interest.

Self-signed certificates is a nuisance and the cacert.org initiative has been losing support. Let’s encrypt offers the possibility of having free (as in both cost and feedom) SSL certificates that don’t give warnings in web browsers. The only problem the threshold of taking the time to figure out how to use it.

It turned out there wasn’t much figuring to: on a debian jessie GNU/linux system, the certbot program from eff.org takes care of everything, including keeping the certificates automatically updated (the .deb package for certbot sets up a cronjob that does the right thing).

The way certbot works is that it requires that each server you wish to sign must be accessible on http (port 80) and the local path “/.well-known/” on each server must be accessible and map to a file area that certbot can put files in.

The certbot program works by contacting let’s encrypt saying that it wants a certificate for a DNS name,  and let’s encrypt will then access the HTTP URL to verify that certbot is indeed running on a server that can be found using that DNS name.

This means that, for certbot to work:

  1. Even if your HTTP server responds only on HTTPS and/or requires authentication, you will need to make a plain HTTP connection available and have the local path “/.well-known/” map to a part of the file system, and be available without authentication
  2. Even if you’re making a certificate for a non-HTTP service (e.g. an IMAP server), you will need to make a plain http (port 80) server responding to that DNS CNAME that can serve the local parth “/.well-known/” from the local

This article explains how to set up free SSL certificates signed with let’s encrypt on an nginx web server and a dovecot IMAP server, on a debian jessie GNU/linux system.

The certbot instructions takes you part of the way, but it has some holes and not a lot of explanation, which is why I wrote this article.

The steps are:

  1. Add jessie-backports to APT (click the link and follow the instructions)
  2. Install certbot from jessie-backports:
    1. Open a command shell as root and give the following command:
      apt-get install certbot -t jessie-backports
      
  3. Disable the default nginx site
    1. Edit the /etc/nginx/sites-available/default file to have the following content:
      server {
              listen 80 default_server;
              listen [::]:80 default_server;
      
              root /var/www/html;
      
              server_name _;
      
              location / {
                      deny all;
              }
      }
      
    2. Run the following command in the command shell openes as root
      systemctl reload nginx
      
  4. Add DNS CNAME-records for the virtual hosts you are going to sign.
    In the examples used in this procedure, the host is hostname.somedomain.com and it has two CNAME aliases: http://www.somedomain.com and imap.somedomain.com.
  5. Add a http://www.mydomain.com nginx site
    1. Create a file /etc/nginx/available-sites/www with the following contents:
      server {
              listen 80;
              listen [::]:80;
      
              server_name www.mydomain.com;
      
              root /var/www/html;
      
              index index.html index.htm index.nginx-debian.html;
      
              location / {
                      allow all;
              }
      }
      
    2. Give the following commands in the command shell opened as root:
      cd /etc/nginx/enabled-sites/
      ln -s /etc/nginx/available-sites/www .
      systemctl reload nginx
      
  6. Add an imap.mydomain.com nginx site
    Note! This isn’t a real website but it is necessary to give HTTP access to a web server listening to this CNAME alias so that the certbot program can create and auto-update the certificate that dovecot uses.

    1. Create a file /etc/nginx/available-sites/imap with the following contents:
      # The port 80 listener only gives access to certbot
      server {
              listen 80;
              listen [::]:80;
      
              server_name imap.bang.priv.no;
      
              root /var/www-imap/;
      
              location /.well-known/ {
                      allow all;
              }
      
              location / {
                      deny all;
              }
      }
      
    2. Give the following commands in the command shell opened as root:
      cd /etc/nginx/enabled-sites/
      ln -s /etc/nginx/available-sites/imap .
      systemctl reload nginx
      
  7. Add a certificate for http://www.mydomain.com
    1. Give the following command in the command shell opened as root:
      certbot certonly --webroot -w /var/www/html -d www.mydomain.com
      
  8. Configure certificates for the http://www.mydomain.com nginx web site
    1. Change the /etc/nginx/available-sites/www file to the following:
      server {
              listen 80;
              listen [::]:80;
      
              server_name www.mydomain.com;
      
              # SSL configuration
              #
              listen 443 ssl default_server;
              listen [::]:443 ssl default_server;
              ssl_certificate     /etc/letsencrypt/live/www.mydomain.com/fullchain.pem;
              ssl_certificate_key /etc/letsencrypt/live/www.mydomain.com/privkey.pem;
      
              root /var/www/html;
      
              location / {
                      allow all;
              }
      }
      
    2. Give the following command in the command shell opened as root
      certbot certonly --webroot -w /var/www-imap -d imap.mydomain.com
      
    3. Open the https://www.somedomain.com server (replace with your actual URL) and observe that the browser reports it as secure with a valid certificate
  9. Add a certificate for imap.mydomain.com
    1. Give the following command in the command shell opened as root:
      certbot certonly --webroot -w /var/www-imap -d imap.mydomain.com
      
  10. Configure dovecot to use the imap.mydomain.com certificate
    1. Change/modify the following lines in the /etc/dovecot/conf.d/10-ssl.conf file:
      # SSL/TLS support: yes, no, required. <doc/wiki/SSL.txt>
      ssl = yes
      
      # PEM encoded X.509 SSL/TLS certificate and private key. They're opened before
      # dropping root privileges, so keep the key file unreadable by anyone but
      # root. Included doc/mkcert.sh can be used to easily generate self-signed
      # certificate, just make sure to update the domains in dovecot-openssl.cnf
      ssl_cert = </etc/letsencrypt/live/imap.bang.priv.no/fullchain.pem
      ssl_key = </etc/letsencrypt/live/imap.bang.priv.no/privkey.pem
      
    2. Give the following command in the command shell opened as root:
      /etc/init.d/dovecot reload
      

The certificates have a 90 day lifetime, but as mentioned earlier, the certificates will be automatically updated by certbot when they have 30 days valid time remaining. The certbot deb package installs a cronjob that runs twice every day at random second in the hour following 00:00 and 12:00 and checks if certificates needs to be updated and updates the ones that are ready for updating.

Get update notifications in the MATE desktop on debian jessie

One thing I have been missing since Gnome 2 was suceeded by the (IMO) horrible Gnome 3, is a tool tray notification icon for pending debian updates.

When someone continued Gnome 2 as MATE and MATE became available on debian, there was no notification tooltray icon to be found.

But now there is such a tooltray icon: pk-update-icon and since debian with MATE again is my primary desktop this I was something I was happy to discover.

When there are packages available, the icon looks like this:software-updates-mate-jessie

Then you can either click on “Install updates” and use the GUI to inspect, and install the updates, or you can pop to a root terminal window do:

apt-get dist-upgrade

To install the pk-update-icon:

  1. the apt-line for “jessie-backports”First ensure that you have the apt-line for “jessie-backports”, by adding the following line to /etc/apt/sources.list :
    deb http://http.debian.net/debian jessie-backports main contrib non-free
  2. Update APT to get the index files for “jessie-backports”, do the following command in a root command line window:
    apt-get dist-upgrade
  3. Install pk-update-icon from jessie backports, give the following command in a root command line window:
    apt-get install -t jessie-backports pk-update-icon

    Answer yes to the question about if the install should proceed

  4. Log out of the desktop and log back in, and the next time updates arrive the icon will show up, like in the screen shot above

Debian “jessie” on Intel “Skylake”

Except for work computers with GNU/linux, the last of which was retired in 2008, my GNU/linux computers have been outdated hand-me-downs. And when the P4 I got back in 2010 went belly up, I figured it was time for trying a modern machine.

Note: I wasn’t going for a top-of-the-line gaming computer with high performance everything. Just a modern state of the art computer.

I wasn’t satisfied with the combination of price and specs on the desktop computers sold by the consumer electronic retailers, so I asked an old colleague who likes building his own computers (thanks Alexey!) to help me come up with an order for components that would work when I put it together. This is what I ordered:

  • Main board: ASUS H170M-PLUS, Socket-1151
  • CPU: Intel Core i5-6600 Skylake
  • Memory: Corsair Vengeance LPX DDR4 2133MHz 16GB
  • SSD: Kingston SSDNow V300 120GB 2.5″ OEM
  • Hard disk: Seagate Barracuda® 1TB
  • Cabinet: Fractal Design Define S Black
  • Power supply: Corsair CX500, 500W PSU

I won’t spend much time on the task of putting the parts together to make a working computer, suffice to say that with re-watching this video, frequent phone calls to Alexey, compared with close reading of the documentation (Alexey told me to do that), I got it working and was greeted by the fancy screen that has taken the place of the BIOS.

UEFI Boot screen

I tried, and gave up on making PXE boot work for the debian install on the UEFI BIOS, and put the debian-8.3.0-amd64-netinst.iso image on an USB flash drive. I then inserted the USB flash drive in one of the USB3 connectors on the front of the cabinet, pressed F10 in the UEFI BIOS, and then kept F8 pressed F8 until I got to the boot menu.

In the boot menu, I selected

UEFI: Generic Flash Disk 8.07, Partition 1 (7640MB)

and then pressed ENTER.

In the debian installer:

  1. Selected the “Graphical installer”
  2. Selected “English” as the installer language
  3. Selected “Norway” as the time zone
  4. Selected “en_US.UTF-8” as the locale
  5. Selected “Norwegian” as the keyboard layout
  6. Gave “lorenzo” as the computer name
  7. Gave “hjemme.lan” as the domain name
  8. Set the root password
  9. I created a user for myself, and set the password
  10. Partitioned the disks manually:
    1. Partitioned the 120GB SSD. I put the root partition on the SSD to get a quick startup of the system, and to get fast startup of applications. I also had to put an EFI partition here. Without an EFI partition, the base-installer failed with a “No space left on device” error message:
      Number Size File system Name Flags
      #1 1GB fat32 efi boot,esp
      #2 119GB ext4 root
    2. Partitioned the 1TB HDD:
      1. I put the swap, sized to twice the physical memory, (something I’ve been doing since I installed my first GNU/linux box back in the 90-ies)
      2. To avoid SSD wear from frequent writing, I put the /var partition (where /var/log resides) on the spinning disk
      3. Finally, I made the rest of the disk the /home directory
      Number Size File system Name Flags
      #1 32GB linux-swap(v1) swap
      #2 100GB ext4 var
      #3 868GB ext4
  11. In the installer, I selected a package mirror from Norway (it doesn’t really matter which one, because of the NIX), selected “No proxy”, and continued
  12. I let the installer install GRUB on the hard disk
  13. During the installation of the system, the installer stopped with the following error message:
    Unable to install busybox
    An error was returned while trying to instal lthe busybox package
    onto the target system.
    
    Check /var/log/syslog or see virtual console 4 for details
  14. I googled for the error message, found this ubuntu bug report, and tried the following workaround from a comment on the bug, and the installer continued past the problem spot.The workaround/hack, was to boot the installer, press Ctrl-Alt-F2 to get a virtual console, and at the prompt in that console, type:
    # while true; do rm /var/run/chroot-setup.lock; sleep 1; done

    and then switch back to the installer in Ctrl-Alt-F1 and continue with the installation

  15. I let the installer run until completion, and pulled the USB flash drive from the USB3 connection (probably not necessary, since pressing F8 was necessary to get to the boot menu in the first place), and let the computer reboot
  16. The computer booted with the familiar debian gdm login screen, and a disappointing 1024×768 screen resolution
  17. I logged in to see what the display settings of the desktop had to say, but the display setting had 1024×768 as the only choice
  18. I let apt-get update the distribution
    apt-get update
    apt-get dist-upgrade
  19. I rebooted again after the update had completed, but the update wasn’t enough to fix the screen resolution, the display still had 1024×768 as the only available resolution
  20. This was my first test of Gnome 3 (when “gnome” in debian changed its meaning from the quite usable “Gnome 2” to “Gnome 3”, the old hardware on my previous debian computer wasn’t able to display anything at all), and I found it ugly and incomprehensible
  21. So I installed MATE
    apt-get install mate-desktop-environment

    and rebooted and logged in again

  22. This time, after logging in, I met something that looked very much like the old and familiar “Gnome 2” desktop, but still with 1024×768 as the only available display resolution
  23. I edited /etc/apt/sources.list and added apt lines for jessie-backports
    # jessie backports (4.3 kernel)
    deb http://http.debian.net/debian jessie-backports main contrib non-free
    
  24. I installed the kernel, firmware and xserver-xorg-video-intel
    apt-get -t jessie-backports install linux-image-amd64 firmware-linux
    apt-get -t jessie-backports xserver-xorg-video-intel
  25. After a new reboot I was up and running, and this time with 1600×1200 resolution on the display, which is the maximum the old display I was using would support
  26. Since I got a working system by using packages from backports, I didn’t make the jump to debian testing immediately, but I figured I might as well get as new packages as possible from jessie-backports, so I created an /etc/apt/preferences file with the following contents:
    Package: *
    Pin: release a=jessie
    Pin-priority: 700
    
    Package: *
    Pin: release a=jessie-updates
    Pin-priority: 710
    
    Package: *
    Pin: release a=jessie-backports
    Pin-priority: 720
    
  27. Then I did apt-get update followed by dist-upgrade and pulled in new versions of many packages
    apt-get update
    apt-get dist-upgrade
  28. I used apt-get to install many familiar packages from my old system
    apt-get install xscavenger
    apt-get install default-jdk
    apt-get install chromium
    apt-get install flightgear
    apt-get install oolite
  29. Like I always do on debian systems, I pulled in “real” firefox from Mint debian edition:
    1. I edited /etc/apt/sources.list file and added the apt lines for Mint debian edition
      # Linux Mint Debian Edition (has firefox)
      deb http://packages.linuxmint.com debian import
    2. I installed the key for Mint debian edition
      apt-get update
      apt-get install linuxmint-keyring
      apt-get update
    3. I used apt to install firefox
      apt-get install firefox
  30. I installed apticron that will check for updates daily and notify me about updates
    apt-get install apticron
  31. Then I rebooted into the system I’m currently running

That’s it basically. Things seems to work out of the box, sound, video etc. (youtube doesn’t play in chromium, but it does play in firefox).