Nagios installed

Although I have had webmin on the server for ages, and keep looking at Fing,  I didn’t have any real time monitoring of the network.   This has now been addressed thu the installation of nagios

Took a bit of figuring which version of nagios to install for FreeBSD.   Nagios 4 aka Core is available in the ports so was quite an install, once I realised I was missing mod_cgi from my Apache configuration.  The CGI files where coming down as downloads and not running as scripts.  That and checking Nagios had access to the folders.

Still struggling with plug-ins and add-ons.  The default add-ins  have been installed from the ports but there are lots more on the Nagios website, but not sure how to install now.  So plenty of spare weekends and evenings tinkering with now the core service is up and running.

 

PHP 7.1 and Samba 4.8 updates

Quick flurry of updates as Samba 4.6 finally went out of support earlier this month so no more patches, so quick deinstall of Samba46 and then install of Samba48 to get Samba back into support.

Update to PHP 7.1 was a bit more involved.  Needed to update make.conf to amend the default_versions from 5.6 to 7.1 and then locate the port directories for mod_php56 and de-install.   Quick build of mod_php71 to update that and then pkg delete php56 to remove all the extensions.

I have Kanboard and phpsysinfo installed, so a quick trip to their port directories to re-installed pulled in most of the PHP extensions needed, but oddly not php71-extensions, so on Apachectl Restart WordPress spewed up some Server 500 Errors.  A quick check of the previous php extensions now installed versus the previous 56 variants thru up a few ports that had not been pulled back in.   A quick re-build of those ports and another apachectl restart and all is well and Apache is now running PHP 7.1 happily.

 

Slow summer

Not much to report this month as weather far too nice to spend messing around on the server indoors. Technological updates have really been around the house and finally getting to set up the smart tellies to be able to stream content stored on the server.

Plus just taken possession of a Kindle Fire 10 with Alexa built in so will be interesting to see how much use that gets

SSMTP and emails from Root not arriving

My daily and weekly status updates from Root stopped appearing in my main inbox a while back, (probably when I switched from Sendmail to SSMTP.  )  but they did appear in my secondary email account as this was the bounce-back address for email failures, as failure reports.

Issue seemed to be that the Root mail box was not reachable anymore.   Attempts to amend an alias to have them delivered to a live account failed as most of the method listed for amending Root’s alias are for Sendmail.

A bit of googling found this post  http://possiblelossofprecision.net/?p=591 and identified the correct file to edit as /ETC/MAIL.RC and add

set append dot save ask crt
ignore Received Message-Id Resent-Message-Id Status Mail-From Return-Path Via
alias root yournewrootmailboxhere@nowhere.com

to finally restore my housekeeping updates from the system

 

Problems updating WordPress

Had been playing around which Apache to add a new virtual host and somewhere, somehow, the auto update on WordPress stopped working and insisted that I entered the FTP credentials which is not something I have enabled on this server.   A bit of googling came across this post highlighted a potential work around in the WP-config.php to allow direct updates.    A quick edit with EE and an apachectl restart and WordPress update routine worked flawlessly as it did before, with out needing FTP access.

https://www.hongkiat.com/blog/update-wordpress-without-ftp/

Downtime – Packages vs Ports

Website has been down a few days as been very busy, so tried to rely on package updates rather than building from ports to keep everything patched as Perl and Python going thru the ‘Flavour’ splitting and packages where supposed to be easier.    To cut a long story short, it also downgraded my PHP version and dropped the Database support module in the process.  So in order to get the website back up I have had to manually install the port for the DB support, mixing packages and ports which is not a good idea.   At least the site is up and running again and I shall stick to ports in the future to ensure the latest patches are always applied.

 

FreeBSD patch update out

Note sure what happened to system patches p6, and  p7 but system update 11 p8 is now out and been duly applied.   Plus updates to Apache, PHP and MySql in recent weeks hopefully means I am up to date on the latest patches.

Housekeeping Freebsd – Forcing TLS 1.2

With Microsoft forcing everyone that uses Office 365 to use TLS 1.2 from the 1st March I thought it about time to check my webserver and see which old protocols where still supported .  Qualys have an excellent tool for checking at  https://www.ssllabs.com/ssltest/index.html

It was relatively easy after a quick google to check the default recommendations in httpd-ssl.conf to disable SSL 3.0, TLS 1.0 and TLS 1.1

A quick restart of Apache and a re-test at Qualys and now the server is only supporting TLS 1.2 and “approved” ciphers,

Updating Certificates

Its that time again, to renew the SSL Cert with LetsEncrypt.

Lets Encrypt Logo

 

 

Following the renew instructions here
https://certbot.eff.org/all-instructions/#freebsd-none-of-the-above

Essentially main steps are to stop Apache so it can bind to port 80 or 443.

sudo apachectl stop

sudo certbot renew -dry-run

sudo certbot renew

sudo apachectl start

Assuming all goes well, the new cert will be applied.   Next step is to set up a CRON job to automate this every 60 days.

 

Bootnote: whilst updating WordPress I also got around to enabling Google Analytics following instructions from http://www.wpbeginner.com/beginners-guide/how-to-install-google-analytics-in-wordpress/