Deploying Your Own Server with DigitalOcean
We had a Free Technology Workshop on deploying your own server. Each student has a DigitalOcean Virtual Private Server (VPS), called a droplet, that they will setup and then configure some servers. DigitalOcean, as well as other websites, provide very good instructions for performing the setup. Here I collect the steps that we followed in the workshop into a single page so it is a bit faster. These instructions are copied from a few sources. It is probably best to follow the original sources rather than my instructions if you really want to understand and/or setup some other options.
- How To Create Your First DigitalOcean Droplet Virtual Server from DigitalOcean
- How To Setup Your Own VPN With PPTP from DigitalOCean
- How to Setup and Configure an OpenVPN Server on Debian 6 from DigitalOcean
- Install Tor on Debian/Ubuntu
- Linode Getting Started Tutorial from Linode. Despite being a different VPS, many of the instructions, starting from "Logging in for the First Time", are complementary to the DigitalOcean instructions.
- Securing Your Server from Linode
- Hosting a Website from Linode
In the instructions I use the following notation:
- DO is short for DigitalOcean
- yourcomputer$ represents the prompt on your actual computer in a terminal application
- root@droplet# represents the prompt when logged in as root user on your droplet
- you@droplet$ represents the prompt when logged in as the user you created on your droplet (I will create user "steve").
- I assume the IP address of the droplet is 220.127.116.11. Change this to your actual droplet IP address.
- I use a hostname of freetech. You should select a different value.
- Some text files need to be edited. You can use nano as the text editor (once in nano, Ctrl-X to save and exit). In the instructions I show the nano command, and after I show the contents of the file using cat. To know what to put in the file or where to edit, look at the output of cat (you can even copy and paste from this webpage to the terminal, but be careful that you change values to match your droplet).
Create a New Droplet
Once you have a DO account, create a new droplet. See the tutorial from DO for details. I created a droplet with the following information/options. You may choose different values (especially the hostname) if you desire.
- Droplet Hostname: zambia
- Select Size: $5 / month
- Select Region: Singapore
- Select Image: Applications -> LAMP on Ubuntu 14.04
- Settings: Enable VirtIO, Private Networking, IPv6 (DO NOT enable backups)
Once created you will receive an email from DO which contains the public IP address of your droplet, as well as the root password. In the following I assume the public IP address is 18.104.22.168 - change it to the IP you received in the email.
Login to your Droplet
Open up a terminal on your computer (or PuTTY on Windows) and connect using ssh to your new droplet. E.g. in a terminal:
yourcomputer$ ssh email@example.com
Enter the root password that you received in the email, answer 'yes' if there is a warning about SSH, and then you should be logged in. If this is the first login, then you will be prompted to change the root password. Do so now (which means you can skip the step later where you change the root password).
Initial Setup of Droplet
If you weren't prompted upon initial login, then change the root password:
Set the hostname:
root@droplet# echo "freetech" > /etc/hostname root@droplet# hostname -F /etc/hostname
Check your IPv4 and global IPv6 addresses:
root@droplet# ifconfig eth0 eth0 Link encap:Ethernet HWaddr 04:01:21:9b:30:01 inet addr:22.214.171.124 Bcast:126.96.36.199 Mask:255.255.192.0 inet6 addr: fe80::601:21ff:fe9b:3001/64 Scope:Link inet6 addr: 2400:1234:0:d0::cc:1234/64 Scope:Global UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:321987 errors:0 dropped:0 overruns:0 frame:0 TX packets:348832 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:323746529 (323.7 MB) TX bytes:309503051 (309.5 MB)
Add the lines to the file /etc/hosts that include your IPv4 and global IPv6 addresses and your hostname. Also replace the hostname for 127.0.1.1 (if it is different from yours).
root@droplet# nano /etc/hosts [edit the file, see the output of cat below to know what to edit] Ctrl-X root@droplet# cat /etc/hosts 127.0.0.1 localhost 127.0.1.1 freetech 188.8.131.52 freetech 2400:1234:0:d0::cc:1234 freetech # The following lines are desirable for IPv6 capable hosts ::1 ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters
Set the timezone and check the time:
root@droplet# dpkg-reconfigure tzdata [select Asia ... Bangkok]
Update the existing software packages:
root@droplet# apt-get update root@droplet# apt-get upgrade --show-upgraded
Install some additional packages. You may want to skip this step if you don't know these packages or don't want to use them. I've selected a set that may be useful for the workshop demonstration.
root@droplet# apt-get install imagemagick subversion pdftk wget lynx iperf rsync unrar unzip iptraf nmap tcpdump sysstat zip
Add a new user to your droplet (choose your own username) and add that user to the sudo group:
root@droplet# adduser steve root@droplet# usermod -a -G sudo steve
Restrict the "root" user from logging in via SSH. This minimises that chance the brute force attacks can break into your Droplet via a root login. Note that the following is a single command all on one line. There is a single space between PermitRootLogin and yes, as well as between PermitRootLogin and no.
root@droplet# sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
Now you will run everything as your newly created user. If you need admin privileges to perform some task, then preceed the command with "sudo". Avoid logging in as the "root" user unless absolutely necessary.
Reboot your droplet (you really should test that you can successfully login with your newly created user in another terminal first, just in case you made a mistake; but lets take a chance ...):
You will be logged out and return to the terminal prompt on your computer.
From your actual computer, use SSH to login to the droplet, this time using your newly created user:
yourcomputer$ ssh firstname.lastname@example.org
Once logged in to your droplet continue to setup the servers.
Apache Web Server
Apache web server was automatically installed when we created the droplet (since we selected the LAMP option: Linux, Apache, MySQL and PHP). It is already running. You could test by typing typing the IP address of your droplet into your browser. You should see a default page explaing the configuration of Apache. Lets remove that default page, as well as the info.php file and create a new default page.
you@droplet$ sudo rm /var/www/html/index.html you@droplet$ sudo rm /var/www/html/info.php you@droplet$ sudo nano /var/www/html/index.html [create a web page] you@droplet$ cat /var/www/html/index.html <html> <head> <title>Free Tech Workshop</title> </head> <body> <p> Free Tech Workshop </p> </body> </html>
MySQL Database Server
We will create an example database on the MySQL database server. But before we do so we must find the MySQL root user password (note that MySQL users, including the root user, are not connected to the system users). When the droplet was created the MySQL root password was saved in a file (you may have noticed it in the welcome message when you logged in). Lets get the password, delete the file, then setup a database.
Get the MySQL root password:
you@droplet$ cat /etc/motd.tail
Change the MySQL root password (note that in the first mysqladmin command the string following -p is the actual word password):
you@droplet$ mysqladmin -u root -p password Enter password: initialmysqlpassword New password: newmysqlpassword Confirm new password: newmysqlpassword
Delete the file that contains the initial MySQL root password:
you@droplet$ sudo rm /etc/motd.tail
Secure your MySQL installation, selecting the default values (except for creating a new root password):
you@droplet$ sudo mysql_secure_installation
Connect to the MySQL database as the MySQL root user:
you@droplet$ mysql -u root -p
After entering the new MySQL root password you will have a MySQL prompt to enter SQL statements. Create a new database called exampleDB:
mysql> create database exampleDB;
Set permissions for a MySQL user on that database. Use your own username, and choose your own password (it doesn't have to be, and should not be, the same as your login password):
mysql> grant all on exampleDB.* to 'student' identified by 'student';
Update and disconnect from MySQL:
mysql> flush privileges; mysql> quit
We will setup a Tor relay, i.e. a node that forwards other peoples traffic. (If you want to run a Tor client, then probably easiest to run it on your computer, not on the droplet, e.g. install the Tor Browser Bundle). There may be some legal issues if you run a Tor exit node, i.e. a node where traffic leaves the Tor network and enters the normal Internet, as servers on the Internet will identify the source as your droplet. We will NOT run a Tor exit node, but instead the much safer Tor relay (the node before the exit).
Edit /etc/apt/sources.list adding a line to enable download the latest Tor version:
you@droplet$ sudo nano /etc/apt/sources.list [add a line to the bottom as shown below] you@droplet$ cat /etc/apt/sources.list ... deb http://deb.torproject.org/torproject.org trusty main
Update the software packages and install Tor. We will also install ARM which is a nice way to monitor your relay and a key which makes updates easier. We also need to initially allow the Tor software repository.
you@droplet$ gpg --keyserver keys.gnupg.net --recv 886DDD89 you@droplet$ gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key add - you@droplet$ sudo apt-get update you@droplet$ sudo apt-get install deb.torproject.org-keyring you@droplet$ sudo apt-get install tor tor-arm
Now Tor is install we will setup the relay by editing the file /etc/tor/torrc. The file contains comments explaining the parameters. I will show the parameter values I edited by uncommenting them (removing the # character).
you@droplet$ sudo nano /etc/tor/torrc [edit/uncomment the parameters as highlighted below; don't change others] you@droplet$ cat /etc/tor/torrc ... ORPort 9001 Nickname freetech RelayBandwidthRate 100 KB # Throttle traffic to 100KB/s (800Kbps) RelayBandwidthBurst 200 KB # But allow bursts up to 200KB/s (1600Kbps) AccountingMax 4 GB AccountingStart day 00:00 ExitPolicy reject *:* # no exits allowed DisableDebuggerAttachment 0
Restart Tor and then start ARM to monitor:
you@droplet$ sudo service tor restart * Stopping tor daemon... [ OK ] * Starting tor daemon... [ OK ] you@droplet$ sudo -u debian-tor arm
The Tor relay spends a few minutes getting started, and then gradually starts to forward traffic.
Install the PPTP software:
you@droplet$ sudo apt-get install pptpd
Set the tunnel IP addresses by editing /etc/pptpd.conf and adding two lines at the end:
you@droplet$ sudo nano /etc/pptpd.conf [edit to set the localip and remoteip values] you@droplet$ cat /etc/pptpd.conf ... localip 10.0.1.1 remoteip 10.0.1.2-15
Add DNS servers for MS Windows clients by pointing to Google's DNS servers:
you@droplet$ sudo nano /etc/ppp/pptpd-options [edit to add two lines with DNS servers similar to below] you@droplet$ cat /etc/ppp/pptpd-options ... ms-dns 184.108.40.206 ms-dns 220.127.116.11 ...
Create a username and password:
you@droplet$ sudo nano /etc/ppp/chap-secrets [edit as below] cat /etc/ppp/chap-secrets steve pptpd mysecretpassword *
Enable IP forwarding by editing /etc/sysctl.conf and uncommenting the entry that sets ip_forward to 1.
you@droplet$ sudo nano /etc/sysctl.conf [uncomment #net.ipv4.ip_forward=1 by removing hash] you@droplet$ cat /etc/sysctl.conf ... net.ipv4.ip_forward=1 ... you@droplet$ sudo sysctl -p
Setup the firewall:
you@droplet$ sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE you@droplet$ sudo iptables -A FORWARD -i eth0 -o ppp0 -m state --state RELATED,ESTABLISHED -j ACCEPT you@droplet$ sudo iptables -A FORWARD -i ppp0 -o eth0 -j ACCEPT
Restart the PPTP server:
you@droplet$ sudo service pptpd restart * Restarting PoPToP Point to Point Tunneling Server pptpd [ OK ]
Download and run a script that simplifies the installation process for OpenVPN. When you run the script will be asked a few questions - select the default answers. Then OpenVPN will be setup (the key creation step may take a few minutes).
you@droplet$ wget http://git.io/vpn --no-check-certificate -O openvpn-install.sh you@droplet$ chmod +x openvpn-install.sh you@droplet$ sudo ./openvpn-install.sh
Now on your computer (not the droplet) you need to configure the OpenVPN client. Assuming OpenVPN is already installed, download and unpack the config file created by your OpenVPN server:
yourcomputer$ scp email@example.com:/home/steve/ovpn*.tar.gz . yourcomputer$ tar xzvf ovpn-client.tar.gz client.conf ca.crt client.crt client.key
Copy the extracted files into the /etc/openvpn directory. If your client is using a different operating systems follow the instructions from OpenVPN as to where to put these configuration files.
yourcomputer$ sudo cp client.conf ca.crt client.crt client.key /etc/openvpn/
(Re)start the OpenVPN client on your computer. On Linux:
yourcomputer$ sudo service openvpn restart
Check that the tunnel interface has been created.
yourcomputer$ ifconfig tun0 tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.0.6 P-t-P:10.8.0.5 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:173 errors:0 dropped:0 overruns:0 frame:0 TX packets:214 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:76146 (76.1 KB) TX bytes:30034 (30.0 KB)
You can now use the VPN, e.g. visit a website that tells you your IP address - it should identify you with the IP address of your DO. You can stop the OpenVPN client:
yourcomputer$ sudo service openvpn stop
Other Things To Do
Some ideas for other things you may want to setup, and guides/instructions for different sources (most should be applicable to your droplet):
- Set a domain name, e.g. www.stevesgreatenewwebsite.com: DigitalOcean
- Setup your own email server, e.g. firstname.lastname@example.org: DigitalOcean | Linode | Ars Technica
- Host a website using a CMS, e.g. Drupal | Wordpress | Joomla! | Moodle
- Media server, e.g. your own video/audio stream, photo gallery: MediaGoblin
Created on Thu, 31 Jul 2014, 11:41am
Last changed on Thu, 31 Jul 2014, 6:07pm