ConoHa Advent Calendar 2018 〜5日目〜

1

 # hostnamectl set-hostname (任意の名前)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

 # cp -a /etc/ssh/sshd_config{,.org}
 # vi /etc/ssh/sshd_config
 # diff /etc/ssh/sshd_config{,.org}
## 以下追記
Port 2222

ListenAddress 0.0.0.0

Protocol 2

LoginGraceTime 2m

MaxAuthTries 6

 # sshd -t
 # systemctl restart sshd
 # systemctl status sshd

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

 # vi /etc/hosts.deny
## 以下追記
ALL: ALL

 # vi /etc/hosts.allow
## 以下追記
ALL: 127.0.0.1
sshd: ALL

 # cp -a /usr/lib/firewalld/services/ssh.xml /etc/firewalld/services/my-ssh.xml
 # vi /etc/firewalld/services/my-ssh.xml
## 以下変更
port="22" -> port="2222"

 # firewall-cmd --reload
 # firewall-cmd --zone=public --add-service=my-ssh
 # firewall-cmd --zone=public --add-service=my-ssh --permanent

1
2
3
4

 # firewall-cmd --zone=public --list-service
 # firewall-cmd --zone=public --remove-service=ssh --permanent
 # firewall-cmd --reload
 # firewall-cmd --zone=public --list-service

1
2

 # yum clean all
 # yum update

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

 # yum install certbot
 # mkdir -p /var/www/letsencrypt/.well-known
 # cp -a /etc/nginx/conf.d/mattermost.conf{,.org}
 # vi /etc/nginx/conf.d/mattermost.conf
:
server {
listen 80;
## サブドメインを追記
    server_name (サブドメイン) localhost;

## /.well-known へのアクセス設定を追記
    location /.well-known {
    root /var/www/letsencrypt;
}

 # diff /etc/nginx/conf.d/mattermost.conf{,.org}
 # nginx -t
 # systemctl reload nginx
 # systemctl status nginx
 # certbot certonly --staging --webroot --webroot-path=/var/www/letsencrypt -d (サブドメイン)
 # ls -l /etc/letsencrypt/live/(サブドメイン)/

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

 # openssl dhparam 2048 -out /etc/nginx/conf.d/dhparam.pem
 # vi /etc/nginx/conf.d/mattermost.conf
## 以下編集
server {
    listen 80;
    server_name (サブドメイン) localhost;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name (サブドメイン) localhost;

    ssl on;
    ssl_certificate /etc/letsencrypt/live/(サブドメイン)/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/(サブドメイン)/privkey.pem;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EECDH EDH+aRSA RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !RC4";
    ssl_dhparam /etc/nginx/conf.d/dhparam.pem;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    add_header Strict-Transport-Security "max-age=15768000; includeSubdomains";

    location /.well-known {
        root /var/www/letsencrypt;
    }
:
}

 # nginx -t
 # systemctl reload nginx
 # systemctl status nginx

1
2

 # firewall-cmd --zone=public --add-service=https --permanent
 # firewall-cmd --reload

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

 # certbot certonly --webroot --webroot-path=/var/www/letsencrypt -d (サブドメイン)
:
## テスト用に発行したSSL証明書を上書きします
What would you like to do?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Keep the existing certificate for now
2: Renew & replace the cert (limit ~5 per 7 days)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2

 # nginx -t
 # systemctl reload nginx
 # systemctl status nginx

1
2
3

 # crontab -e
## 以下追記
0 4 10,20,30 * * certbot renew && systemctl reload nginx