Although its taken a bit of time my server now has all the software I currently need.

The server has been configured as a LAMP server with PHP, MYSQL and Apache which is now working well and hosting several distinct websites one of which is using Wordpress(Enraged-Baboon)

I have now also got The email server working. I am using EXIM4 for the Mail transport Agent with Courier handling the IMAP and POP3 options for the site. I have installed spamassasin and Clamav plugged into EXIM which have cut down dramatically on the amount of spam I was receiving. This has also been improved further with some checks carried out when emails are received by the server to Check the HELO script and also check the IP address against a number of Blacklists. To allow SMTP I have set up OpenSSL to enable Authenticated SMTP connection.

ProFTPd has also been set up using OpenSSL to secure the connections.

With all this in place I have the beginnings of my own hosting solution which can be resold to other people. There are a number of issues with this at the moment. The main issue at the moment is that the password has to be set by me and to change the password the end user would need to use SSH to connect to the Server to change this. This would also create a security problem as it means they would have access to the server. A possible solution to this would be to create a Web based password form but this is not a priority yet as there are still some changes I need to make to my t-shirt shop (Tard) and also work on another project which is the main reason for upgrading to this more powerful server.

The guides available on the site so far have details installing and configuring a LAMP server which can host multiple Domains. I have also Detailed how to configure an EXIM4 Mail server with Spam and Anti-virus checking on all emails which can handle Email for multiple Domains. If you have followed these guides then you should be in a position where you can host as many websites as you have space for. The problem is unless you are going to writing the websites from scratch you will need a way to upload your sites.

FTP has been the standard way to do this for as long as I can remember so to make my server as useful as possible Installing an FTP server is a very important program. For the purpose of my server I will be using ProFTPD.

The first thing we need to do is to install ProFTPD.

apt-get install proftpd

When asked you should choose standalone.

The first thing we need to do is turn off ipv6. My server is set up using IPv4 so turning this off stops any errors when we start the program.

nano /etc/proftpd/proftpd.conf

The Flag we need to change is UseIPv6 and this needs changing to off.

Whilst we are editing the config file we also need to add the line:

DefaultRoot ~

This locks down the users to their own directory which stops them from moving outside of their home directory.

Now restart the ProFTPD and you should be able to connect via FTP.

/etc/init.d/proftpd restart
You should now have a working FTP server. The problem is that FTP is not the most secure of protocols as username and password are sent in clear text. By using TLS We can encrypt the information and make the whole process a lot more secure.

We have already installed Openssl on the server for use with our mail server so we will be able to use this again for our FTP certificate. First we will create a directory to hold the SSL certificate and Key.

mkdir /etc/proftpd/ssl

Now to generate the certificate. we will be doing this differently to the SMTP certificate as we`ll be using some flags to set up some parameters for this certificate and also state where to create the certificate

openssl req -new -x509 -days 365 -nodes -out /etc/proftpd/ssl/proftpd.cert.pem -keyout /etc/proftpd/ssl/proftpd.key.pem

You will be asked a series of questions about you which you should answer correctly as this is the basis of what your certificate will say.

now we need to edit the Config file for ProFTPd to ensure TLS is used.

nano /etc/proftpd/proftpd.conf

We need to find the section relating to TLSEngine and substite the information for this
<IfModule mod_tls.c>
TLSEngine on
TLSLog /var/log/proftpd/tls.log
TLSProtocol SSLv23
TLSOptions NoCertRequest
TLSRSACertificateFile /etc/proftpd/ssl/proftpd.cert.pem
TLSRSACertificateKeyFile /etc/proftpd/ssl/proftpd.key.pem
TLSVerifyClient off
TLSRequired on
</IfModule>

Then just restart ProFTPd and you the connection will now be encrypted.

/etc/init.d/proftpd restart

The previous guides on the website have explained how to set up an EXIM4 email server with IMAP and POP3 for access from your own email client as well as Virtual hosts so numerous domains can be serviced from the one mail server. We have also set up authenticated SMTP on the server so Emails can be sent out using EXIM4 as well. The guides have basically set up a fully working mail server which should be fine for most users. Over the Past few years however Spam has become a larger problem so this guide will outline a number of measures which should help to lower the amout of Junk email you receive.

This guide will detail a number of processes I have implemented on my mail server in the hope of reducing Spam coming through to my email boxes. This guide will cut down on spam by ensuring the correct Connection request is done.

nano /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt

WE need to add the Checks we want done after the line:

acl_check_rcpt:

First we`ll do the Checks on bad HELO/EHLO checks

# Reject hosts based on bad HELO/EHLO
#
# No HELO/EHLO
deny condition = ${if eq{$sender_helo_name}{}{1}{0}}
message = Polite hosts say HELO first\n\
Please see RFC 2821 section 4.1.1.1
log_message = Bad HELO: Empty HELO
delay = ${eval: ($rcpt_fail_count) * 60}s
#
# Forged HELO (localhost or my IP) from a host that isn’t allowed to relay
deny condition = ${if or { \
{ match{$sender_helo_name}{212.13.198.82} } \
{ eq{$sender_helo_name}{localhost} } \
}{1}{0}}
message = HELO/EHLO must contain YOUR OWN FQDN or IP literal; \
$sender_helo_name is MY name/IP!\n\
Please see RFC 2821 section 4.1.1.1
log_message = Forged HELO: claims to be me ($sender_helo_name)
delay = ${eval: ($rcpt_fail_count) * 60}s
hosts = ! +relay_from_hosts
#
# Syntactically invalid HELO/EHLO
defer condition = ${if match \
{$sender_helo_name}{\N^[^.:].*[.:][^.:]+$\N}\
{0}{1}}
message = HELO/EHLO must contain a FQDN or IP literal\n\
Please see RFC 2821 section 4.1.1.1
log_message = Bad HELO: Syntactically invalid HELO
delay = ${eval: ($rcpt_fail_count) * 60}s
hosts = ! +relay_from_hosts
#
# Syntactically invalid HELO/EHLO - IP address without []
defer condition = ${if isip{$sender_helo_name}{1}{0}}
message = HELO/EHLO must contain a FQDN or IP literal\n\
please see RFC 2821 section 4.1.1.1
log_message = Bad HELO: Syntactically invalid HELO
delay = ${eval: ($rcpt_fail_count) * 60}s
hosts = ! +relay_from_hosts
#
defer condition = ${if isip6{$sender_helo_name}{1}{0}}
message = HELO/EHLO must contain a FQDN or IP literal\n\
please see RFC 2821 section 4.1.1.1
log_message = Bad HELO: Invalid HELO
delay = ${eval: ($rcpt_fail_count) * 60}s
#
# Forged HELO (our hostname) from a host that isn’t allowed to relay
deny condition = ${if match_domain{$sender_helo_name}\
{+local_domains}{1}{0}}
message = Forged HELO: you are not $sender_helo_name
log_message = Forged HELO: $sender_helo_name is one of our \
local domains
delay = ${eval: ($rcpt_fail_count) * 60}s
hosts = ! +relay_from_hosts

These tests help to cut down on spam by making sure the SMTP connection is done properly.

Next for a bit of greylisting. This is very simple to configure and helps to cut down on spam even more. To do this we will isntall greylistd.

apt-get install greylistd

Now we need to configure EXIM4 to use greylistd:

greylistd-setup-exim4 add

This will add the greylistd rules to our EXIM4 configuration. This checks the IP address of the sending server and makes sure its not showing on any spam blacklists. if it is the message will be blocked for a set period of time and an email sent to the end user.

Now all we need to do is update the EXIM configuration

update-exim4.conf

And now restart EXIM with the new configuration

/etc/init.d/exim4 restart

Setting these measures up on my mail server helped to cut the amount of spam I was getting through from over 100 a day to less than 10.

If you have any questions leave a comment here and i`ll do my best to answer it.