Install VestaCP on Google Cloud in 5 steps

Sam Perrin 6 Comments

This article will provide you with 5 quick steps to get up and running with VestaCP and finish with adding your first domain to the portal.

VestaCP is an Open Source control panel that helps you manage your web server and simplifies a lot of things! https://vestacp.com/

  1. Within the Google Cloud Console, navigate to Networking > Firewall Rules.
    • Add a new firewall rule for VestaCP
    • Name = vestacp-panel
    • Source Filter = “allow from any source (0.0.0.0/0)
    • Allowed protocols and ports = 8083/tcp
    • Target Tags = vestacp-panel
  2. Deploy a new Compute Engine VM Instance
    • Define Name and Zone based on your preference
    • Choose Machine Type (I have used “micro”)
    • Boot Disk = 10gb and CentOS 7
    • Firewall = allow HTTP and HTTPS (so your websites can get through when setup)
    • Expand “ Management, disk, networking, SSH keys”
      • Under Management, in the Tags section, add “vestacp-panel”
      • Under Networking, assign a New Static External IP (or re-use an old one if you have any) – take note of the External IP assigned, you’ll need this later.
    • Create the instance
  3. Wait for the new VM to finish deploying, connect to it via SSH and install VestaCP
    • cd /tmp/
    • curl -O http://vestacp.com/pub/vst-install.sh
    • sudo bash vst-install.sh
    • Follow the on screen steps
    • When it asks for an FQDN, provide the full URL that you will use to access the portal (e.g. panel.example.com) – you will also need to add this as an A record for your domain.
    • Take note of password presented to you at the end of the install
  4. Login to your new VestaCP Control Panel
    • https://<your_server_ip>:8083 or https://<your_server_URL>:8083
    • Username = admin
    • Password = provided at the end of Step 3
    • If you can’t reach the portal, check your Firewall Rules from Step 1 and ensure your VM has the correct tags, as per Step 2
  5. Configure your VestaCP server
    • Edit the Admin user and change the password to something secure
    • Edit the VestaCP firewall and modify any existing rules to drop traffic you don’t want/need (POP3, DB, PING etc)
    • Add your domain
      • After this you’ll need to point your website to your new VestaCP web server

There are plenty more things to set up within VestaCP, such as setting Private Nameservers, creating Packages etc but the above will get you up and running.

Elasticsearch Cluster Install on CentOS 7

Sam Perrin Leave a comment

This post wont go in to any detail around setting up CentOS itself, but it will cover getting a simple 3 node Elasticsearch cluster up and running, with a couple of helpful plugins.

Install Java and check the install

yum install java-1.8.0-openjdk.x86_64 -y
java -version

Download Elasticsearch (check the site here for the latest versions)

cd /tmp
wget https://download.elasticsearch.org/elasticsearch/release/org/elasticsearch/distribution/rpm/elasticsearch/2.2.1/elasticsearch-2.2.1.rpm

Install Elasticsearch

cd /tmp
sudo rpm -ivh elasticsearch-2.2.1.rpm

This results in Elasticsearch being installed in /usr/share/elasticsearch/ with its configuration files placed in /etc/elasticsearch and its init script added in /etc/init.d/elasticsearch

Enable Elasticsearch on Boot

sudo systemctl enable elasticsearch.service

Configure Elasticsearch

vi /etc/elasticsearch/elasticsearch.yml

Add near the top, and replace anything in < > with your details

cluster.name: <name of the cluster>
#below line dynamically sets the node name based on the server hostname
node.name: ${HOSTNAME}
#below binds elasticsearch to the local (127.0.0.1) and site ip address (e.g. 192.168.1.1)
network.host: [_site_, _local_]
http.port: 9200
bootstrap.mlockall: true
#below sets the nodes the cluster should find
discovery.zen.ping.unicast.hosts: ["<node1_ip_or_fqdn>", "<node2_ip_or_fqdn>", "<node3_ip_or_fqdn>"]

Restart and Verify Elasticsearch status

sudo systemctl restart elasticsearch.service
sudo systemctl status elasticsearch.service

You should be able to access the node now, on: http://<node-ip>:9200

Optional: Install Elastic-HQ and Head Plugins

cd /usr/share/elasticsearch/
bin/plugin install mobz/elasticsearch-head
sudo bin/plugin install royrusso/elasticsearch-HQ
sudo systemctl restart elasticsearch.service
sudo systemctl status elasticsearch.service

Once installed, you can access these plugins via:
Head = http://<node-ip>:9200/_plugin/head
HQ = http://<node-ip>:9200/_plugin/hq

Additional Nodes:

Repeat the same process on your other servers, you can add more than 3 nodes to the cluster, but if you do make sure you update discovery.zen.ping.unicast.hosts in your Elasticsearch config to include those additional nodes.

 

CentOS 7 – Installing pymssql with pip, libgnutls.so.26 error

Sam Perrin 1 Comment

When trying to install pymssql with pip you may get a requirements error for libgnutls.so.26

To fix this error I took the following steps:

For the below you may need the EPEL repo, install this with the below command

yum install epel-release

Install gcc

yum install gcc

Install python-devel

yum install python-devel

Download freetds-devel and freetds for CentOS 7 and store in /tmp/ (or somewhere else, but remember where you stored it for later)

http://rpm.pbone.net/index.php3/stat/4/idpl/31220521/dir/redhat_el_7/com/freetds-devel-0.95.19-1.el7.x86_64.rpm.html

http://rpm.pbone.net/index.php3/stat/4/idpl/31220520/dir/redhat_el_7/com/freetds-0.95.19-1.el7.x86_64.rpm.html

Install both of them

yum install /tmp/freetds-0.95.19-1.el7.x86_64.rpm
yum install /tmp/freetds-devel-0.95.19-1.el7.x86_64.rpm

Run pip install pymssql again, it should hopefully succeed this time.

FortiGate as Slave DNS with Windows DNS Master

Sam Perrin Leave a comment

It is possible to setup your FortiGate device so that requests towards specific domains are forwarded to a Windows DNS server. Below are the steps needed to get this working.

On the Windows Master DNS Server

  • Open DNS Manager and open the zone needed
  • Find the Start of Authority (SOA) record
  • Properties > Zone Transfers
  • Allow Zone Transfers > To Any Server (you can also specify the server)
  • Open ‘Notify’ and add in the Slave DNS IP address (the IP your FortiGate will be seen as to the Master DNS)

On the FortiGate Slave

  • Enable the DNS Database feature (System > Config > Features)
  • Go to System > Network > DNS Servers and Create a new DNS Database.
    • Type: Slave
    • View: Shadow
    • DNS Zone: <dns_zone>
    • Domain Name: <dns_zone.local>
    • IP of Master:
    • Authoritative: Enable/Disable

You will then to add an SRV record, as well as identify the source IP address if your Master DNS is over VPN;

  • Connect to FortiGate CLI
  • Add SRV record
config system dns-database
edit "<dns_zone>"
set forwarder "<IP of Master DNS>"
next
end
  • Specify source IP
config system dns-database
edit "<dns_zone>"
set source-ip "<IP of FortiGate>"
next
end

Add the DNS service to the Interface

  • Go to System > Network > DNS Servers and Create a new DNS Service.
  • Interface: <Interface users will connect to>
  • Mode: Recursive

Testing

You can test the new DNS service works by running a ping through your FortiGate CLI

execute ping-options source <interface IP address>
execute ping <FQDN of a server in the new DNS zone>

Potential Issues

The interface your users connect to may be set to use the “Same as System DNS”. If you use external DNS servers this means your users will not benefit from the changes we have just made.

To fix this change the interface settings to be “Same as Interface IP”, this now means users will get the Interface IP as their DNS server, and will benefit from all DNS Database changes we make on the FortiGate

FortiGate – Change Switch Mode

Sam Perrin Leave a comment

Out of the box, your FortiGate device will most likely be in Switch mode, this groups the internal interfaces in to a single switch. To change to Interface mode, follow the below steps.

Interface mode allows you to control all of the interfaces separately. To change modes make sure none of the interfaces (lan/internal) are referenced

 

Enter Interface Mode

config system global
set internal-switch-mode interface
end

Enter Switch Mode:

config system global
set internal-switch-mode switch
end