#!/bin/bash ###################################################################### # Auto Install & Optimize LEMP Stack on Ubuntu # # # # Author: Sanvv - HOSTVN Technical # # Website: https://hostvn.vn # # # # Please do not remove copyright. Thank! # # Please do not copy under any circumstance for commercial reason! # ###################################################################### # shellcheck disable=SC2207 apt update && apt upgrade -y DIR=$(pwd) # Set Color RED='\033[0;31m' NC='\033[0m' SCRIPTS_VERSION="0.2.9" IPADDRESS=$(curl -s http://cyberpanel.sh/?ip) DIR=$(pwd) BASH_DIR="/var/hostvn" GITHUB_RAW_LINK="https://raw.githubusercontent.com" EXT_LINK="https://scripts.hostvn.net" UPDATE_LINK="https://scripts.hostvn.net/ubuntu/update" FILE_INFO="${BASH_DIR}/.hostvn.conf" HOSTNAME=$(hostname) PHP2_RELEASE="no" # Copyright AUTHOR="HOSTVN.VN" AUTHOR_CONTACT="https://www.facebook.com/groups/hostvn.vn" # Service Version PHPMYADMIN_VERSION=$(curl -s ${UPDATE_LINK}/version | grep "phpmyadmin_version=" | cut -f2 -d'=') MARIADB_VERSION=$(curl -s ${UPDATE_LINK}/version | grep "mariadb_version=" | cut -f2 -d'=') # shellcheck disable=SC2207 PHP_LIST=($(curl -s http://scripts.hostvn.net/ubuntu/update/version | grep "php_list=" | cut -f2 -d'=')) # Set Lang OPTION_CHANGE_SSH="Ban co muon thay doi port SSH khong ? " ENTER_OPTION="Nhap vao lua chon cua ban: " SELECT_PHP="Hay lua chon phien ban PHP muon cai dat:" WRONG_PHP_OPTION="Lua chon cua ban khong chinh xac, vui long chon lai." SELECT_INST_PHP_2="Ban co muon cai dat phien ban PHP thu hai khong - Multiple PHP ?" ENTER_OPTION_PHP_2="Nhap vao lua chon cua ban [1-2]: " WRONG_PHP_SELECT_2="Ban nhap sai. Vui long nhap lai." INVALID_PHP2_OPTION="${RED}Lua chon cua ban khong chinh xac. Vui long chon lai.${NC}" SELECT_PHP_2="Lua chon phien ban PHP thu hai ban muon su dung:" LOGIN_NOTI1="Cam on ban da su dung dich vu cua ${AUTHOR}." LOGIN_NOTI2="Neu can ho tro vui long truy cap ${AUTHOR_CONTACT}" LOGIN_NOTI3="Truoc khi dat cau hoi vui long xem Document: https://doc.hostvn.vn/" LOGIN_NOTI4="De mo menu ban go lenh sau: hostvn" # Random Port RANDOM_ADMIN_PORT=$(shuf -i 49152-57343 -n 1) # Dir DEFAULT_DIR_WEB="/usr/share/nginx/html" DEFAULT_DIR_TOOL="/usr/share/nginx/private" USR_DIR="/usr/share" # Get info VPS CPU_CORES=$(grep -c "processor" /proc/cpuinfo) RAM_TOTAL=$(awk '/MemTotal/ {print $2}' /proc/meminfo) SWAP_TOTAL=$(awk '/SwapFree/ {print $2}' /proc/meminfo) PHP_MEM=${RAM_TOTAL}+${SWAP_TOTAL} MAX_CLIENT=$((CPU_CORES * 1024)) rm -rf "${DIR}"/hostvn ############################################ # Function ############################################ cd_dir() { cd "$1" || return } gen_pass() { PASS_LEN=$(perl -le 'print int(rand(6))+9') START_LEN=$(perl -le 'print int(rand(8))+1') END_LEN=$((PASS_LEN - START_LEN)) NUMERIC_CHAR=$(perl -le 'print int(rand(10))') PASS_START=$(perl -le "print map+(A..Z,a..z,0..9)[rand 62],0..$START_LEN") PASS_END=$(perl -le "print map+(A..Z,a..z,0..9)[rand 62],0..$END_LEN") PASS=${PASS_START}${NUMERIC_CHAR}${PASS_END} echo "$PASS" } random_string() { STRING=$(perl -le "print map+(A..Z,a..z,0..9)[rand 62],0..$1") echo "$STRING" } valid_ip() { # shellcheck disable=SC2166 if [ -n "$1" -a -z "${*##*\.*}" ]; then ipcalc "$1" | awk 'BEGIN{FS=":";is_invalid=0} /^INVALID/ {is_invalid=1; print $1} END{exit is_invalid}' else return 1 fi } ############################################ # Prepare install ############################################ create_bash_dir() { mkdir -p /home/backup chmod 710 /home/backup chmod 711 /home mkdir -p "${BASH_DIR}" mkdir -p "${BASH_DIR}"/custom } # Admin Email set_email() { clear while true; do read -r -p "Nhap vao email cua ban: " ADMIN_EMAIL echo if [[ "${ADMIN_EMAIL}" =~ ^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,4}$ ]]; then echo "Email cua ban la: ${ADMIN_EMAIL}." break else echo "Email ban nhap khong chinh xac vui long nhap lai." fi done } ssh_login_notify() { string=$(grep -rnw "$HOME/.bashrc" -e "${AUTHOR}") if [ -z "${string}" ]; then { echo "echo \"${LOGIN_NOTI1}\"" echo "echo \"${LOGIN_NOTI2}\"" echo "echo \"${LOGIN_NOTI3}\"" echo "echo \"${LOGIN_NOTI4}\"" } >>"$HOME"/.bashrc fi } ############################################ # Option Install ############################################ input_ip() { echo "Nhap vao dia chi IP cua VPS. Bam Enter de script tu detect IP Public." read -r -p "Nhap vao dia chi IP cua VPS: " IPADDRESS_NEW if [ -n "${IPADDRESS_NEW}" ] && valid_ip "${IPADDRESS_NEW}"; then IPADDRESS=${IPADDRESS_NEW} else printf "IP ban nhap khong chinh xac. Script se tu dong detect IP Public cua VPS." fi } option_change_ssh_port() { clear printf "%s\n" "${OPTION_CHANGE_SSH}" PS3="${ENTER_OPTION}" options=("Yes" "No") select opt in "${options[@]}"; do case $opt in "Yes") prompt_ssh="y" SSH_PORT="8282" sleep 1 printf "${RED}%s${NC}\n" "Port SSH moi là: 8282" printf "${RED}%s${NC}\n" "Luu y: Voi Google Cloud, Alibaba Cloud, AWS cac ban can mo port 8282 trong tab Firewall" sleep 1 break ;; "No") prompt_ssh="n" SSH_PORT="22" break ;; *) printf "${RED}%s${NC}\n" "${WRONG_PHP_SELECT_2} $REPLY" ;; esac done sleep 1 } select_php_ver() { clear while true; do printf "%s\n" "${SELECT_PHP}" PS3="${ENTER_OPTION}" select opt in "${PHP_LIST[@]}"; do case $opt in "$opt") PHP_VERSION="${opt}" break ;; esac done echo if [[ " ${PHP_LIST[*]} " == *" ${PHP_VERSION} "* ]]; then break else clear printf "${RED}%s${NC}\n" "${WRONG_PHP_OPTION}" fi done sleep 1 PHP_VERSION=${PHP_VERSION//php/} PHP1_CONFIG_PATH="/etc/php/${PHP_VERSION}/fpm" PHP1_INI_PATH="${PHP1_CONFIG_PATH}/conf.d" PHP1_POOL_PATH="${PHP1_CONFIG_PATH}/pool.d" PHP1_CLI_PATH="/etc/php/${PHP_VERSION}/cli/conf.d" } select_php_multi() { clear printf "%s\n" "${SELECT_INST_PHP_2}" PS3="${ENTER_OPTION_PHP_2}" options=("Yes" "No") select opt in "${options[@]}"; do case $opt in "Yes") MULTI_PHP="y" break ;; "No") MULTI_PHP="n" break ;; *) printf "${RED}%s${NC}\n" "${WRONG_PHP_SELECT_2} $REPLY" ;; esac done sleep 1 } select_php_ver_2() { clear while true; do printf "%s\n" "${SELECT_PHP_2}" PS3="${ENTER_OPTION}" select opt in "${PHP_LIST[@]}"; do case $opt in "$opt") PHP_VERSION_2="${opt}" break ;; esac done echo if [[ " ${PHP_LIST[*]} " == *" ${PHP_VERSION_2} "* ]]; then break else clear printf "${RED}%s\n${NC}" "${INVALID_PHP2_OPTION}" fi done PHP_VERSION_2=${PHP_VERSION_2//php/} PHP2_CONFIG_PATH="/etc/php/${PHP_VERSION_2}/fpm" PHP2_INI_PATH="${PHP2_CONFIG_PATH}/conf.d" PHP2_POOL_PATH="${PHP2_CONFIG_PATH}/pool.d" PHP2_CLI_PATH="/etc/php/${PHP_VERSION_2}/cli/conf.d" sleep 1 } check_duplicate_php() { if [[ "${PHP_VERSION_2}" == "${PHP_VERSION}" ]]; then MULTI_PHP="n" echo "Phien ban PHP thứ 2 trung voi phien ban mac dinh. He thong se cai dat mot phien ban PHP." fi } ############################################ # Install LEMP Stack ############################################ #install_nginx() { # apt-get install -y curl gnupg2 ca-certificates lsb-release # apt-get install build-essential zlib1g-dev libpcre3 libpcre3-dev unzip uuid-dev -y # apt-get install -y git build-essential libpcre3 libpcre3-dev libssl-dev libtool autoconf apache2-dev libxml2-dev \ # libcurl4-openssl-dev automake pkgconf -y # apt autoremove -y # # shellcheck disable=SC2006 # echo "deb http://nginx.org/packages/ubuntu $(lsb_release -cs) nginx" | # tee /etc/apt/sources.list.d/nginx.list # curl -fsSL https://nginx.org/keys/nginx_signing.key | apt-key add - # apt-key fingerprint ABF5BD827BD9BF62 # apt-get -y update # apt-get -y install nginx # # systemctl start nginx # systemctl enable nginx #} #install_nginx(){ # apt-get install build-essential zlib1g-dev libpcre3 libpcre3-dev unzip uuid-dev -y # apt autoremove -y # UPDATE_LINK="https://scripts.hostvn.net/update" # MODULE_PATH="/usr/share/nginx_module" # mkdir -p "${MODULE_PATH}" # NGINX_VERSION=$(curl -s ${UPDATE_LINK}/version | grep "nginx_version=" | cut -f2 -d'=') # NPS_VERSION=$(curl -s ${UPDATE_LINK}/version | grep "nps_version=" | cut -f2 -d'=') # ngx_cache_purge_version=$(curl -s ${UPDATE_LINK}/version | grep "ngx_cache_purge_version=" | cut -f2 -d'=') # openssl_version=$(curl -s ${UPDATE_LINK}/version | grep "openssl_version=" | cut -f2 -d'=') # pcre_version=$(curl -s ${UPDATE_LINK}/version | grep "pcre_version=" | cut -f2 -d'=') # zlib_version=$(curl -s ${UPDATE_LINK}/version | grep "zlib_version=" | cut -f2 -d'=') # # cd_dir "${MODULE_PATH}" # # wget -O- https://github.com/apache/incubator-pagespeed-ngx/archive/v"${NPS_VERSION}".tar.gz | tar -xz # nps_dir=$(find . -name "*pagespeed-ngx-${NPS_VERSION}" -type d) # cd_dir "$nps_dir" # NPS_RELEASE_NUMBER=${NPS_VERSION/beta/} # NPS_RELEASE_NUMBER=${NPS_VERSION/stable/} # # psol_url=https://dl.google.com/dl/page-speed/psol/${NPS_RELEASE_NUMBER}.tar.gz # [ -e scripts/format_binary_url.sh ] && psol_url=$(scripts/format_binary_url.sh PSOL_BINARY_URL) # wget -O- "${psol_url}" | tar -xz # # cd_dir "${MODULE_PATH}" # wget -O- http://nginx.org/download/nginx-"${NGINX_VERSION}".tar.gz | tar -xz # wget -O- http://scripts.hostvn.net/ubuntu/ngx_cache_purge-"${ngx_cache_purge_version}".tar.gz | tar -xz # wget -O- http://scripts.hostvn.net/ubuntu/openssl-OpenSSL_"${openssl_version}".tar.gz | tar -xz # wget -O- ftp://ftp.pcre.org/pub/pcre/pcre-"${pcre_version}".tar.gz | tar -xz # wget -O- https://www.zlib.net/zlib-"${zlib_version}".tar.gz | tar -xz # git clone --depth 1 https://github.com/google/ngx_brotli # cd_dir ngx_brotli && git submodule update --init # # apt-get install -y git build-essential libpcre3 libpcre3-dev libssl-dev libtool autoconf apache2-dev libxml2-dev \ # libcurl4-openssl-dev automake pkgconf # apt-get install bison build-essential ca-certificates curl dh-autoreconf doxygen flex gawk git iputils-ping \ # libcurl4-gnutls-dev libexpat1-dev libgeoip-dev liblmdb-dev libpcre3-dev libpcre++-dev libssl-dev libtool \ # libxml2 libxml2-dev libyajl-dev locales lua5.3-dev pkg-config wget zlib1g-dev -y # apt autoremove -y # # cd_dir "${MODULE_PATH}" # git clone -b nginx_refactoring https://github.com/SpiderLabs/ModSecurity.git # #wget -O- http://scripts.hostvn.net/ubuntu/ModSecurity.tar.gz | tar -xz # cd_dir ModSecurity # ./autogen.sh # ./configure --enable-standalone-module --disable-mlogc # make # cd_dir "${MODULE_PATH}"/nginx-"${NGINX_VERSION}"/ # ./configure \ # "--user=nginx" \ # "--group=nginx" \ # "--prefix=/usr" \ # "--sbin-path=/usr/sbin" \ # "--conf-path=/etc/nginx/nginx.conf" \ # "--pid-path=/var/run/nginx.pid" \ # "--http-log-path=/var/log/nginx/access_log" \ # "--error-log-path=/var/log/nginx/error_log" \ # "--without-mail_imap_module" \ # "--without-mail_smtp_module" \ # "--with-http_ssl_module" \ # "--with-http_realip_module" \ # "--with-http_stub_status_module" \ # "--with-http_gzip_static_module" \ # "--with-http_dav_module" \ # "--with-http_v2_module" \ # "--with-pcre=../pcre-${pcre_version}" \ # "--with-pcre-jit" \ # "--with-zlib=../zlib-${zlib_version}" \ # "--with-openssl=../openssl-OpenSSL_${openssl_version}" \ # "--with-openssl-opt=no-nextprotoneg" \ # "--add-module=../ngx_cache_purge-${ngx_cache_purge_version}" \ # "--add-module=../incubator-pagespeed-ngx-${NPS_VERSION}" \ # "--add-module=../ngx_brotli" \ # "--add-module=../ModSecurity/nginx/modsecurity" \ # "--with-cc-opt='-D FD_SETSIZE=32768'" # # make && make install # # if [[ -d "/usr/lib/nginx/modules" && ! -d "/etc/nginx/modules" ]]; then # ln -s /usr/lib/nginx/modules /etc/nginx/modules # fi # # adduser --system --home /nonexistent --shell /bin/false --no-create-home --disabled-login --disabled-password \ # --gecos "nginx user" --group nginx # # if [ ! -f "/etc/systemd/system/nginx.service" ]; then # cat >> "/etc/systemd/system/nginx.service" << EOnginx_service #[Unit] #Description=The nginx HTTP and reverse proxy server #After=syslog.target network.target remote-fs.target nss-lookup.target # #[Service] #Type=forking #PIDFile=/var/run/nginx.pid #ExecStartPre=/usr/sbin/nginx -t -c /etc/nginx/nginx.conf #ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf #ExecReload=/bin/kill -s HUP \$MAINPID #ExecStop=/bin/kill -s QUIT \$MAINPID #PrivateTmp=true #LimitMEMLOCK=infinity #LimitNOFILE=65535 # #[Install] #WantedBy=multi-user.target #EOnginx_service # fi # # sudo systemctl enable nginx.service # sudo systemctl start nginx.service # cd_dir "${DIR}" #} install_nginx(){ apt-get install build-essential zlib1g-dev libpcre3 libpcre3-dev unzip uuid-dev -y apt autoremove -y UPDATE_LINK="http://scripts.hostvn.net/ubuntu/update" MODULE_PATH="/usr/share/nginx_module" mkdir -p "${MODULE_PATH}" NGINX_VERSION=$(curl -s ${UPDATE_LINK}/version | grep "nginx_version=" | cut -f2 -d'=') NPS_VERSION=$(curl -s ${UPDATE_LINK}/version | grep "nps_version=" | cut -f2 -d'=') ngx_cache_purge_version=$(curl -s ${UPDATE_LINK}/version | grep "ngx_cache_purge_version=" | cut -f2 -d'=') more_clear_headers_v=$(curl -s ${UPDATE_LINK}/version | grep "more_clear_headers_v=" | cut -f2 -d'=') openssl_version=$(curl -s ${UPDATE_LINK}/version | grep "openssl_version=" | cut -f2 -d'=') pcre_version=$(curl -s ${UPDATE_LINK}/version | grep "pcre_version=" | cut -f2 -d'=') zlib_version=$(curl -s ${UPDATE_LINK}/version | grep "zlib_version=" | cut -f2 -d'=') nginx_module_vts_v=$(curl -s ${UPDATE_LINK}/version | grep "nginx_module_vts_v=" | cut -f2 -d'=') cd_dir "${MODULE_PATH}" wget -O- https://github.com/apache/incubator-pagespeed-ngx/archive/v"${NPS_VERSION}".tar.gz | tar -xz nps_dir=$(find . -name "*pagespeed-ngx-${NPS_VERSION}" -type d) cd_dir "$nps_dir" NPS_RELEASE_NUMBER=${NPS_VERSION/beta/} NPS_RELEASE_NUMBER=${NPS_VERSION/stable/} psol_url=https://dl.google.com/dl/page-speed/psol/${NPS_RELEASE_NUMBER}.tar.gz [ -e scripts/format_binary_url.sh ] && psol_url=$(scripts/format_binary_url.sh PSOL_BINARY_URL) wget -O- "${psol_url}" | tar -xz cd_dir "${MODULE_PATH}" wget -O- http://nginx.org/download/nginx-"${NGINX_VERSION}".tar.gz | tar -xz wget -O- http://scripts.hostvn.net/ubuntu/modules/ngx_cache_purge-"${ngx_cache_purge_version}".tar.gz | tar -xz wget -O- http://scripts.hostvn.net/ubuntu/modules/openssl-OpenSSL_"${openssl_version}".tar.gz | tar -xz wget -O- http://scripts.hostvn.net/ubuntu/modules/pcre-"${pcre_version}".tar.gz | tar -xz wget -O- http://scripts.hostvn.net/ubuntu/modules/zlib-"${zlib_version}".tar.gz | tar -xz wget -O- http://scripts.hostvn.net/ubuntu/modules/headers-more-nginx-module-"${more_clear_headers_v}".tar.gz | tar -xz wget -O- https://github.com/vozlt/nginx-module-vts/archive/refs/tags/v"${nginx_module_vts_v}".tar.gz | tar -xz git clone --depth 1 https://github.com/google/ngx_brotli cd_dir ngx_brotli && git submodule update --init cd_dir "${MODULE_PATH}"/nginx-"${NGINX_VERSION}"/ ./configure \ "--user=nginx" \ "--group=nginx" \ "--prefix=/usr" \ "--sbin-path=/usr/sbin" \ "--conf-path=/etc/nginx/nginx.conf" \ "--pid-path=/var/run/nginx.pid" \ "--http-log-path=/var/log/nginx/access_log" \ "--error-log-path=/var/log/nginx/error_log" \ "--without-mail_imap_module" \ "--without-mail_smtp_module" \ "--with-http_ssl_module" \ "--with-http_realip_module" \ "--with-http_stub_status_module" \ "--with-http_gzip_static_module" \ "--with-http_dav_module" \ "--with-http_v2_module" \ "--with-pcre=../pcre-${pcre_version}" \ "--with-pcre-jit" \ "--with-zlib=../zlib-${zlib_version}" \ "--with-openssl=../openssl-OpenSSL_${openssl_version}" \ "--with-openssl-opt=no-nextprotoneg" \ "--add-module=../ngx_cache_purge-${ngx_cache_purge_version}" \ "--add-module=../incubator-pagespeed-ngx-${NPS_VERSION}" \ "--add-module=../headers-more-nginx-module-${more_clear_headers_v}" \ "--add-module=../ngx_brotli" \ "--add-module=../nginx-module-vts-${nginx_module_vts_v}" \ "--with-cc-opt='-D FD_SETSIZE=32768'" make && make install if [[ -d "/usr/lib/nginx/modules" && ! -d "/etc/nginx/modules" ]]; then ln -s /usr/lib/nginx/modules /etc/nginx/modules fi adduser --system --home /nonexistent --shell /bin/false --no-create-home --disabled-login --disabled-password \ --gecos "nginx user" --group nginx rm -rf /etc/systemd/system/nginx.service cat >> "/etc/systemd/system/nginx.service" << EOnginx_service [Unit] Description=The nginx HTTP and reverse proxy server After=syslog.target network.target remote-fs.target nss-lookup.target [Service] Type=forking PIDFile=/var/run/nginx.pid ExecStartPre=/usr/sbin/nginx -t -c /etc/nginx/nginx.conf ExecStart=/usr/sbin/nginx -c /etc/nginx/nginx.conf ExecReload=/bin/kill -s HUP \$MAINPID ExecStop=/bin/kill -s QUIT \$MAINPID PrivateTmp=true LimitMEMLOCK=infinity LimitNOFILE=65535 [Install] WantedBy=multi-user.target EOnginx_service sudo systemctl enable nginx.service sudo systemctl start nginx.service cd_dir "${DIR}" } install_mariadb() { apt-get install software-properties-common apt-transport-https -y # apt-key adv --fetch-keys 'https://mariadb.org/mariadb_release_signing_key.asc' << EOF # #EOF # add-apt-repository "deb [arch=amd64,arm64,ppc64el] http://sgp1.mirrors.digitalocean.com/mariadb/repo/${MARIADB_VERSION}/ubuntu $(lsb_release -cs) main" << EOF # #EOF wget https://downloads.mariadb.com/MariaDB/mariadb_repo_setup echo "b7519209546e1656e5514c04b4dcffdd9b4123201bcd1875a361ad79eb943bbe mariadb_repo_setup" | sha256sum -c - chmod +x mariadb_repo_setup ./mariadb_repo_setup --mariadb-server-version="mariadb-${MARIADB_VERSION}" apt-get update -y apt-get -y install mariadb-server mariadb-backup } install_php() { add-apt-repository ppa:ondrej/php <"${DEFAULT_DIR_TOOL}/phpmyadmin/config.inc.php" <> "/opt/phpmyadmin.temp" <= 33586432)" == "1" ]]; then #32GB Ram max_allowed_packet="64M" back_log="1024" max_connections="600" key_buffer_size="768M" myisam_sort_buffer_size="768M" myisam_max_sort_file_size="8192M" innodb_log_buffer_size="64M" join_buffer_size="2M" read_buffer_size="2M" sort_buffer_size="2M" table_definition_cache="10240" table_open_cache="10240" thread_cache_size="384" tmp_table_size="1024M" max_heap_table_size="1024M" query_cache_limit="1536K" query_cache_size="256M" innodb_open_files="10000" innodb_buffer_pool_size="8192M" innodb_io_capacity="600" aria_pagecache_buffer_size="128M" aria_sort_buffer_size="128M" net_buffer_length="16384" read_rnd_buffer_size="512K" innodb_log_file_size="768M" innodb_read_io_threads="4" aria_log_file_size="64M" key_buffer="1024M " sort_buffer="256M" read_buffer="256M" write_buffer="256M" fi if [[ "$(expr "${RAM_TOTAL}" \>= 64000000)" == "1" ]]; then #64GB Ram max_allowed_packet="80M" back_log="1024" max_connections="800" key_buffer_size="1024M" myisam_sort_buffer_size="1024M" myisam_max_sort_file_size="10240M" innodb_log_buffer_size="64M" join_buffer_size="2M" read_buffer_size="2M" sort_buffer_size="2M" table_definition_cache="10240" table_open_cache="10240" thread_cache_size="384" tmp_table_size="1536M" max_heap_table_size="1536M" query_cache_limit="1536K" query_cache_size="256M" innodb_open_files="10000" innodb_buffer_pool_size="12288M" innodb_io_capacity="800" aria_pagecache_buffer_size="256M" aria_sort_buffer_size="256M" net_buffer_length="16384" read_rnd_buffer_size="512K" innodb_log_file_size="1024M" innodb_read_io_threads="4" aria_log_file_size="128M" key_buffer="1536M " sort_buffer="384M" read_buffer="384M" write_buffer="384M" fi } ############################################ # Install Other Library ############################################ install_optipng(){ optipng_version=$(curl -s ${UPDATE_LINK}/version | grep "optipng_version=" | cut -f2 -d'=') cd_dir /opt wget -O- http://scripts.hostvn.net/modules/optipng-"${optipng_version}".tar.gz | tar -xz cd_dir optipng-"${optipng_version}" ./configure make cp /opt/optipng-"${optipng_version}"/src/optipng/optipng /usr/bin/ cd_dir /opt rm -rf /opt/optipng-"${optipng_version}" } install_jpegoptim(){ jpegoptim_version=$(curl -s ${UPDATE_LINK}/version | grep "jpegoptim_version=" | cut -f2 -d'=') cd_dir /opt wget -O- http://scripts.hostvn.net/modules/jpegoptim-RELEASE."${jpegoptim_version}".tar.gz | tar -xz cd_dir jpegoptim-RELEASE."${jpegoptim_version}" ./configure make && make strip && make install ln -s /usr/local/bin/jpegoptim /usr/bin/jpegoptim cd_dir /opt rm -rf /opt/jpegoptim-RELEASE."${jpegoptim_version}" } install_pngquant(){ cd_dir /opt git clone --recursive https://github.com/kornelski/pngquant.git cd_dir /opt/pngquant ./configure make && make install cd_dir "${DIR}" rm -rf /opt/pngquant } ############################################ # Config LEMP ############################################ # Config SSL self_signed_ssl() { #Create dhparams self_signed_dir="/etc/nginx/ssl/server" mkdir -p "${self_signed_dir}" openssl dhparam -out /etc/nginx/ssl/dhparams.pem 2048 openssl genrsa -out "${self_signed_dir}/server.key" 4096 openssl req -new -key "${self_signed_dir}/server.key" \ -out "${self_signed_dir}/server.csr" -subj "/C=VN/ST=Caugiay/L=Hanoi/O=Hostvn/OU=IT Department/CN=${IPADDRESS}" openssl x509 -in "${self_signed_dir}/server.csr" -out "${self_signed_dir}/server.crt" \ -req -signkey "${self_signed_dir}/server.key" -days 3650 } # Config Nginx create_nginx_conf() { mkdir -p /etc/nginx/alias mkdir -p /etc/nginx/redirect mkdir -p /etc/nginx/php mkdir -p /etc/nginx/conf.d mkdir -p /etc/nginx/pagespeed mkdir -p /usr/share/nginx/html/ chown -R nginx. /usr/share/nginx/html/ mv /etc/nginx/nginx.conf /etc/nginx/nginx.conf."$(date +%Y-%m-%d)" cat >>"/etc/nginx/nginx.conf" <> "/etc/nginx/modsec/main.conf" << EOmodsec_main include /etc/nginx/modsec/modsecurity.conf include /etc/nginx/owasp-modsecurity-crs/crs-setup.conf include /etc/nginx/owasp-modsecurity-crs/rules/*.conf EOmodsec_main git clone https://github.com/SpiderLabs/owasp-modsecurity-crs.git cd_dir owasp-modsecurity-crs mv crs-setup.conf.example crs-setup.conf cd_dir rules mv RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf.example RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf cd_dir "${DIR}" } create_wordpress_conf() { mkdir -p /etc/nginx/wordpress cat >>"/etc/nginx/wordpress/disable_xmlrpc.conf" <>"/etc/nginx/wordpress/disable_user_api.conf" <> "/etc/nginx/wordpress/webp_express.conf" << EOwebp_express # WebP Express rules location ~* ^/?wp-content/.*\.(png|jpe?g)$ { add_header Vary Accept; expires 365d; if (\$http_accept !~* "webp"){ break; } try_files /wp-content/webp-express/webp-images/doc-root/\$uri.webp \$uri.webp /wp-content/plugins/webp-express/wod/webp-on-demand.php?xsource=x\$request_filename&wp-content=wp-content ; } # Route requests for non-existing webps to the converter location ~* ^/?wp-content/.*\.(png|jpe?g)\.webp$ { try_files \$uri /wp-content/plugins/webp-express/wod/webp-realizer.php?xdestination=x\$request_filename&wp-content=wp-content ; } # (WebP Express rules ends here) EOwebp_express cat >>"/etc/nginx/wordpress/wordpress_secure.conf" <>"/etc/nginx/wordpress/yoast_seo.conf" <>"/etc/nginx/wordpress/rank_math_seo.conf" <>"/etc/nginx/wordpress/w3c.conf" <>"/etc/nginx/wordpress/wpfc.conf" <>"/etc/nginx/wordpress/wpsc.conf" <>"/etc/nginx/wordpress/enabler.conf" <>"/etc/nginx/wordpress/swift2.conf" <> "/etc/nginx/extra/brotli.conf" << EOFBRCONF ##Brotli Compression brotli on; brotli_static on; brotli_buffers 16 8k; brotli_comp_level 5; brotli_types application/atom+xml application/geo+json application/javascript application/json application/ld+json application/manifest+json application/rdf+xml application/rss+xml application/vnd.ms-fontobject application/wasm application/x-font-opentype application/x-font-truetype application/x-font-ttf application/x-javascript application/x-web-app-manifest+json application/xhtml+xml application/xml application/xml+rss font/eot font/opentype font/otf image/bmp image/svg+xml image/vnd.microsoft.icon image/x-icon image/x-win-bitmap text/cache-manifest text/calendar text/css text/javascript text/markdown text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy text/xml; EOFBRCONF cat >> "/etc/nginx/extra/nginx_cache.conf" << EOnginx_cache fastcgi_cache_key "\$scheme\$request_method\$host\$request_uri"; fastcgi_cache_use_stale error timeout invalid_header http_500; fastcgi_ignore_headers Cache-Control Expires Set-Cookie; EOnginx_cache cat >> "/etc/nginx/extra/skip_cache.conf" << EOskip_cache # Enable SSI # https://en.wikipedia.org/wiki/Server_Side_Includes ssi on; # Enable caching for all by default set \$skip_cache 0; # Disable cache for all requests except GET and HEAD if (\$request_method !~ ^(GET|HEAD)$) { set \$skip_cache 1; } # Disable cache for all requests with a query string # You should disable this section if you use query string only for users tracking if (\$query_string != "") { set \$skip_cache 1; } # Disable cache for all logged in users or recent commenters # Add your custom cookies here! if (\$http_cookie ~* "nginx_no_cache|PHPSESSID") { set \$skip_cache 1; } # Wordpress if (\$http_cookie ~* "comment_author|wordpress_[a-f0-9]+|wp-postpass|wordpress_no_cache|wordpress_logged_in") { set \$skip_cache 1; } # Magento if (\$http_cookie ~* "frontend_cid|frontend|sid|adminhtml|EXTERNAL_NO_CACHE") { set \$skip_cache 1; } # Disable cache for uris containing the following segments # If is evil and you can speedup this section by using locations instead # https://www.nginx.com/resources/wiki/start/topics/depth/ifisevil/ # https://serverfault.com/questions/509327/can-we-jump-to-another-location-from-a-location-in-nginx # Best practice if (\$request_uri ~* "/ping|/metrics|/nginx_status|/admin|/administrator|/login|/feed|index.php|sitemap(_index)?.xml") { set \$skip_cache 1; } # Wordpress if (\$request_uri ~* "/wp-admin/|/xmlrpc.php|wp-.*.php|/feed/|index.php|sitemap(_index)?.xml") { set \$skip_cache 1; } # Magento # http://devdocs.magento.com/guides/v2.0/config-guide/varnish/config-varnish.html if (\$request_uri ~* "(index|litespeed).php|admin|api|cron.php|/checkout/|/account/|/brand-ambassador/|/brand-ambassador-coupon/|/brand-ambassador-program/|/affiliateplusstatistic/|/brand-ambassador/index/listTransaction/|/brand-ambassador/index/paymentForm/|/brand-ambassador-program/index/index/|/brand-ambassador/banner/list/|/brand-ambassador-coupon/index/index/|/brand-ambassador/refer/index/|/brand-ambassador/index/payments/|/brand-ambassador/index/referrers/|/affiliateplusstatistic/statistic/index/|/brand-ambassador/account/edit/|/checkout/cart/|/repeat-delivery") { set \$skip_cache 1; } EOskip_cache cat >> "/etc/nginx/extra/skip_cache_woo.conf" << EOskip_cache_woo #WooCommerce if (\$request_uri ~* "/store.*|/cart.*|/my-account.*|/checkout.*|/addons.*") { set \$skip_cache 1; } if ( \$arg_add-to-cart != "" ) { set \$skip_cache 1; } if ( \$cookie_woocommerce_items_in_cart != "0" ) { set \$skip_cache 1; } EOskip_cache_woo cat >> "/etc/nginx/extra/https.conf" << EOredirect_https if (\$http_x_forwarded_proto != 'https') { return 301 https://\$host\$request_uri; } EOredirect_https cat >>"/etc/nginx/extra/gzip.conf" <>"/etc/nginx/extra/ssl.conf" < "/etc/nginx/extra/cloudflare.conf" << END real_ip_header X-Forwarded-For; set_real_ip_from 173.245.48.0/20; set_real_ip_from 103.21.244.0/22; set_real_ip_from 103.22.200.0/22; set_real_ip_from 103.31.4.0/22; set_real_ip_from 141.101.64.0/18; set_real_ip_from 108.162.192.0/18; set_real_ip_from 190.93.240.0/20; set_real_ip_from 188.114.96.0/20; set_real_ip_from 197.234.240.0/22; set_real_ip_from 198.41.128.0/17; set_real_ip_from 162.158.0.0/15; set_real_ip_from 104.16.0.0/13; set_real_ip_from 104.24.0.0/14; set_real_ip_from 172.64.0.0/13; set_real_ip_from 131.0.72.0/22; set_real_ip_from 2400:cb00::/32; set_real_ip_from 2606:4700::/32; set_real_ip_from 2803:f800::/32; set_real_ip_from 2405:b500::/32; set_real_ip_from 2405:8100::/32; set_real_ip_from 2a06:98c0::/29; set_real_ip_from 2c0f:f248::/32; END # cron_cf_exists=$(crontab -l | grep -w 'updateCloudflareRangeIP') # if [ -z "${cron_cf_exists}" ]; then # crontab -l > updateCf # echo "0 3 * * * bash /var/hostvn/menu/cronjob/updateCloudflareRangeIP >/dev/null 2>&1" >> updateCf # crontab updateCf # rm -rf updateCf # fi # cat >>"/etc/nginx/extra/cloudflare.conf" <>"/etc/nginx/extra/nginx_limits.conf" <>"/etc/nginx/extra/staticfiles.conf" <>"/etc/nginx/extra/security.conf" <>"${REWRITE_CONFIG_PATH}/default.conf" <>"${REWRITE_CONFIG_PATH}/codeigniter.conf" <>"${REWRITE_CONFIG_PATH}/discuz.conf" <>"${REWRITE_CONFIG_PATH}/drupal.conf" <>"${REWRITE_CONFIG_PATH}/ecshop.conf" <>"${REWRITE_CONFIG_PATH}/xenforo.conf" <>"${REWRITE_CONFIG_PATH}/joomla.conf" <>"${REWRITE_CONFIG_PATH}/whmcs.conf" <>"${REWRITE_CONFIG_PATH}/wordpress.conf" <>"${REWRITE_CONFIG_PATH}/prestashop.conf" <>"${REWRITE_CONFIG_PATH}/opencart.conf" <>"${REWRITE_CONFIG_PATH}/laravel.conf" <>"${REWRITE_CONFIG_PATH}/cakephp.conf" <>"${REWRITE_CONFIG_PATH}/yii.conf" <>"/etc/nginx/apps/phpmyadmin.conf" <>"/etc/nginx/apps/opcache.conf" <>"/etc/nginx/apps/memcached.conf" <>"/etc/nginx/apps/redis.conf" <>"/etc/nginx/web_apps.conf" <>"${DEFAULT_DIR_WEB}/index.html" < Site Maintenance

We'll be back soon!

Sorry for the inconvenience but we're performing some maintenance at the moment. If you need to you can always contact us, otherwise we'll be back online shortly!

EOdefault_index cp "${DEFAULT_DIR_WEB}"/index.html ${DEFAULT_DIR_TOOL} } default_error_page() { if [[ -f "${DEFAULT_DIR_WEB}/50x.html" ]]; then rm -rf "${DEFAULT_DIR_WEB}"/50x.html fi cat >>"${DEFAULT_DIR_WEB}/50x.html" < Error

An error occurred.

Sorry, the page you are looking for is currently unavailable. Please try again later. If you need to you can always contact us, otherwise we'll be back online shortly!

EOdefault_index cp "${DEFAULT_DIR_WEB}"/50x.html ${DEFAULT_DIR_TOOL} } wp_rocket_nginx() { cd_dir /etc/nginx git clone https://github.com/satellitewp/rocket-nginx.git cd_dir /etc/nginx/rocket-nginx cp rocket-nginx.ini.disabled rocket-nginx.ini php rocket-parser.php } # Config PHP-FPM php_global_config() { if [[ -f "$PHP1_CONFIG_PATH/php-fpm.conf" ]]; then mv "$PHP1_CONFIG_PATH"/php-fpm.conf "$PHP1_CONFIG_PATH"/php-fpm.conf."$(date +%Y-%m-%d)" fi cat >>"$PHP1_CONFIG_PATH/php-fpm.conf" <>"$PHP1_POOL_PATH/www.conf" <>"$PHP2_CONFIG_PATH/php-fpm.conf" <>"$PHP2_POOL_PATH/www.conf" <"$PHP1_INI_PATH/00-hostvn-custom.ini" <"$PHP2_INI_PATH/00-hostvn-custom.ini" <"$PHP1_INI_PATH/10-opcache.ini" <"${PHP1_INI_PATH}/opcache-default.blacklist" <"$PHP2_INI_PATH/10-opcache.ini" <"${PHP2_INI_PATH}/opcache-default.blacklist" <>"/etc/mysql/my.cnf" <10.1.2+ query_cache_limit = ${query_cache_limit} query_cache_size = ${query_cache_size} query_cache_type = 1 query_cache_min_res_unit = 2K query_prealloc_size = 262144 query_alloc_block_size = 65536 transaction_alloc_block_size = 8192 transaction_prealloc_size = 4096 default-storage-engine = InnoDB ft_min_word_len = 3 log_warnings=1 slow_query_log=0 long_query_time=1 slow_query_log_file=/var/lib/mysql/slowq.log log-error=/var/log/mysql/mysqld.log # innodb settings #innodb_large_prefix=1 innodb_purge_threads=1 #innodb_file_format = Barracuda innodb_file_per_table = 1 innodb_open_files = ${innodb_open_files} innodb_data_file_path= ibdata1:10M:autoextend innodb_buffer_pool_size = ${innodb_buffer_pool_size} #open_files_limit=100000 ## https://mariadb.com/kb/en/mariadb/xtradbinnodb-server-system-variables/#innodb_buffer_pool_instances #innodb_buffer_pool_instances=2 #innodb_log_files_in_group = 2 innodb_log_file_size = ${innodb_log_file_size} innodb_log_buffer_size = ${innodb_log_buffer_size} innodb_flush_log_at_trx_commit = 2 innodb_thread_concurrency = 0 innodb_lock_wait_timeout=50 innodb_flush_method = O_DIRECT #innodb_support_xa=1 # 200 * # DISKS innodb_io_capacity = ${innodb_io_capacity} innodb_io_capacity_max = 2000 innodb_read_io_threads = ${innodb_read_io_threads} innodb_write_io_threads = 2 innodb_flush_neighbors = 1 # mariadb settings [mariadb] #thread-handling = pool-of-threads #thread-pool-size= 20 #mysql --port=3307 --protocol=tcp #extra-port=3307 #extra-max-connections=1 userstat = 0 key_cache_segments = 1 aria_group_commit = none aria_group_commit_interval = 0 aria_log_file_size = ${aria_log_file_size} aria_log_purge_type = immediate aria_pagecache_buffer_size = ${aria_pagecache_buffer_size} aria_sort_buffer_size = ${aria_sort_buffer_size} [mariadb-5.5] innodb_file_format = Barracuda innodb_file_per_table = 1 #ignore_db_dirs= query_cache_strip_comments=0 innodb_read_ahead = linear innodb_adaptive_flushing_method = estimate innodb_flush_neighbor_pages = 1 innodb_stats_update_need_lock = 0 innodb_log_block_size = 512 log_slow_filter =admin,filesort,filesort_on_disk,full_join,full_scan,query_cache,query_cache_miss,tmp_table,tmp_table_on_disk [mysqld_safe] socket=/var/lib/mysql/mysql.sock log-error=/var/log/mysqld/mysqld.log #nice = -5 open-files-limit = 8192 [mysqldump] quick max_allowed_packet = ${max_allowed_packet} [myisamchk] tmpdir=/tmp key_buffer = ${key_buffer} sort_buffer = ${sort_buffer} read_buffer = ${read_buffer} write_buffer = ${write_buffer} [mysqlhotcopy] interactive-timeout [mariadb-10.0] innodb_file_format = Barracuda innodb_file_per_table = 1 # 2 variables needed to switch from XtraDB to InnoDB plugins #plugin-load=ha_innodb #ignore_builtin_innodb ## MariaDB 10 only save and restore buffer pool pages ## warm up InnoDB buffer pool on server restarts innodb_buffer_pool_dump_at_shutdown=1 innodb_buffer_pool_load_at_startup=1 innodb_buffer_pool_populate=0 ## Disabled settings performance_schema=OFF innodb_stats_on_metadata=OFF innodb_sort_buffer_size=2M innodb_online_alter_log_max_size=128M query_cache_strip_comments=0 log_slow_filter =admin,filesort,filesort_on_disk,full_join,full_scan,query_cache,query_cache_miss,tmp_table,tmp_table_on_disk EOmy_cnf sql_root_pass=$(gen_pass) sql_admin_pass=$(gen_pass) systemctl start mariadb systemctl enable mariadb mysql_secure_installation <>"$PHP1_INI_PATH"/00-hostvn-custom.ini echo "memory_limit = -1" >>"$PHP1_CLI_PATH"/00-hostvn-custom.ini systemctl restart php"${PHP_VERSION}"-fpm wp package install iandunn/wp-cli-rename-db-prefix --allow-root wp package install trepmal/wp-revisions-cli --allow-root sed -i '/memory_limit/d' "$PHP1_INI_PATH"/00-hostvn-custom.ini sed -i '/memory_limit/d' "$PHP1_CLI_PATH"/00-hostvn-custom.ini echo "memory_limit = ${MAX_MEMORY}M" >>"$PHP1_INI_PATH"/00-hostvn-custom.ini echo "memory_limit = ${MAX_MEMORY}M" >>"$PHP1_CLI_PATH"/00-hostvn-custom.ini # echo "allow_url_fopen = Off" >> "$PHP2_INI_PATH"/00-hostvn-custom.ini # echo "allow_url_fopen = Off" >> "$PHP2_CLI_PATH"/00-hostvn-custom.ini # echo "allow_url_fopen = Off" >> "$PHP1_INI_PATH"/00-hostvn-custom.ini # echo "allow_url_fopen = Off" >> "$PHP1_CLI_PATH"/00-hostvn-custom.ini systemctl restart php"${PHP_VERSION}"-fpm } ############################################ # Fail2ban ############################################ install_fail2ban() { apt-get install fail2ban -y cp /etc/fail2ban/jail.{conf,local} if [ -f "/etc/fail2ban/jail.d/defaults-debian.conf" ]; then rm -rf /etc/fail2ban/jail.d/defaults-debian.conf fi ssh_port="ssh" if [[ "$prompt_ssh" =~ ^([yY]) ]]; then ssh_port=8282 fi mv /etc/fail2ban/jail.local /etc/fail2ban/jail.local."$(date +%Y-%m-%d)" cat > "/etc/fail2ban/jail.local" << EOjail_local [INCLUDES] before = paths-debian.conf [DEFAULT] ignorecommand = bantime = 48h findtime = 10m maxretry = 5 backend = auto usedns = warn logencoding = auto enabled = false filter = %(__name__)s[mode=%(mode)s] destemail = ${ADMIN_EMAIL} sender = ${ADMIN_EMAIL} mta = sendmail protocol = tcp chain = port = 0:65535 fail2ban_agent = Fail2Ban/%(fail2ban_version)s banaction = iptables-multiport banaction_allports = iptables-allports action_ = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] action_mw = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] %(mta)s-whois[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", protocol="%(protocol)s", chain="%(chain)s"] action_mwl = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"] action_xarf = %(banaction)s[name=%(__name__)s, bantime="%(bantime)s", port="%(port)s", protocol="%(protocol)s", chain="%(chain)s"] xarf-login-attack[service=%(__name__)s, sender="%(sender)s", logpath=%(logpath)s, port="%(port)s"] action_cf_mwl = cloudflare[cfuser="%(cfemail)s", cftoken="%(cfapikey)s"] %(mta)s-whois-lines[name=%(__name__)s, sender="%(sender)s", dest="%(destemail)s", logpath=%(logpath)s, chain="%(chain)s"] action_blocklist_de = blocklist_de[email="%(sender)s", service=%(filter)s, apikey="%(blocklist_de_apikey)s", agent="%(fail2ban_agent)s"] action_badips = badips.py[category="%(__name__)s", banaction="%(banaction)s", agent="%(fail2ban_agent)s"] action_badips_report = badips[category="%(__name__)s", agent="%(fail2ban_agent)s"] action_abuseipdb = abuseipdb action = %(action_)s [sshd] port = ${ssh_port} logpath = %(sshd_log)s backend = %(sshd_backend)s [dropbear] port = ssh logpath = %(dropbear_log)s backend = %(dropbear_backend)s [selinux-ssh] port = ssh logpath = %(auditd_log)s [apache-auth] port = http,https logpath = %(apache_error_log)s [apache-badbots] port = http,https logpath = %(apache_access_log)s bantime = 48h maxretry = 1 [apache-noscript] port = http,https logpath = %(apache_error_log)s [apache-overflows] port = http,https logpath = %(apache_error_log)s maxretry = 2 [apache-nohome] port = http,https logpath = %(apache_error_log)s maxretry = 2 [apache-botsearch] port = http,https logpath = %(apache_error_log)s maxretry = 2 [apache-fakegooglebot] port = http,https logpath = %(apache_access_log)s maxretry = 1 ignorecommand = %(ignorecommands_dir)s/apache-fakegooglebot [apache-modsecurity] port = http,https logpath = %(apache_error_log)s maxretry = 2 [apache-shellshock] port = http,https logpath = %(apache_error_log)s maxretry = 1 [openhab-auth] filter = openhab action = iptables-allports[name=NoAuthFailures] logpath = /opt/openhab/logs/request.log [nginx-http-auth] port = ${RANDOM_ADMIN_PORT} logpath = %(nginx_error_log)s [nginx-limit-req] port = http,https logpath = %(nginx_error_log)s [nginx-botsearch] port = http,https logpath = %(nginx_error_log)s maxretry = 2 [php-url-fopen] port = http,https logpath = %(nginx_access_log)s %(apache_access_log)s [suhosin] port = http,https logpath = %(suhosin_log)s [lighttpd-auth] port = http,https logpath = %(lighttpd_error_log)s [roundcube-auth] port = http,https logpath = %(roundcube_errors_log)s [openwebmail] port = http,https logpath = /var/log/openwebmail.log [horde] port = http,https logpath = /var/log/horde/horde.log [groupoffice] port = http,https logpath = /home/groupoffice/log/info.log [sogo-auth] port = http,https logpath = /var/log/sogo/sogo.log [tine20] logpath = /var/log/tine20/tine20.log port = http,https [drupal-auth] port = http,https logpath = %(syslog_daemon)s backend = %(syslog_backend)s [guacamole] port = http,https logpath = /var/log/tomcat*/catalina.out [monit] #Ban clients brute-forcing the monit gui login port = 2812 logpath = /var/log/monit [webmin-auth] port = 10000 logpath = %(syslog_authpriv)s backend = %(syslog_backend)s [froxlor-auth] port = http,https logpath = %(syslog_authpriv)s backend = %(syslog_backend)s [squid] port = 80,443,3128,8080 logpath = /var/log/squid/access.log [3proxy] port = 3128 logpath = /var/log/3proxy.log [proftpd] port = ftp,ftp-data,ftps,ftps-data logpath = %(proftpd_log)s backend = %(proftpd_backend)s [pure-ftpd] port = ftp,ftp-data,ftps,ftps-data logpath = %(pureftpd_log)s backend = %(pureftpd_backend)s [gssftpd] port = ftp,ftp-data,ftps,ftps-data logpath = %(syslog_daemon)s backend = %(syslog_backend)s [wuftpd] port = ftp,ftp-data,ftps,ftps-data logpath = %(wuftpd_log)s backend = %(wuftpd_backend)s [vsftpd] port = ftp,ftp-data,ftps,ftps-data logpath = %(vsftpd_log)s [assp] port = smtp,465,submission logpath = /root/path/to/assp/logs/maillog.txt [courier-smtp] port = smtp,465,submission logpath = %(syslog_mail)s backend = %(syslog_backend)s [postfix] mode = more port = smtp,465,submission logpath = %(postfix_log)s backend = %(postfix_backend)s [postfix-rbl] filter = postfix[mode=rbl] port = smtp,465,submission logpath = %(postfix_log)s backend = %(postfix_backend)s maxretry = 1 [sendmail-auth] port = submission,465,smtp logpath = %(syslog_mail)s backend = %(syslog_backend)s [sendmail-reject] port = smtp,465,submission logpath = %(syslog_mail)s backend = %(syslog_backend)s [qmail-rbl] filter = qmail port = smtp,465,submission logpath = /service/qmail/log/main/current [dovecot] port = pop3,pop3s,imap,imaps,submission,465,sieve logpath = %(dovecot_log)s backend = %(dovecot_backend)s [sieve] port = smtp,465,submission logpath = %(dovecot_log)s backend = %(dovecot_backend)s [solid-pop3d] port = pop3,pop3s logpath = %(solidpop3d_log)s [exim] port = smtp,465,submission logpath = %(exim_main_log)s [exim-spam] port = smtp,465,submission logpath = %(exim_main_log)s [kerio] port = imap,smtp,imaps,465 logpath = /opt/kerio/mailserver/store/logs/security.log [courier-auth] port = smtp,465,submission,imap,imaps,pop3,pop3s logpath = %(syslog_mail)s backend = %(syslog_backend)s [postfix-sasl] filter = postfix[mode=auth] port = smtp,465,submission,imap,imaps,pop3,pop3s logpath = %(postfix_log)s backend = %(postfix_backend)s [perdition] port = imap,imaps,pop3,pop3s logpath = %(syslog_mail)s backend = %(syslog_backend)s [squirrelmail] port = smtp,465,submission,imap,imap2,imaps,pop3,pop3s,http,https,socks logpath = /var/lib/squirrelmail/prefs/squirrelmail_access_log [cyrus-imap] port = imap,imaps logpath = %(syslog_mail)s backend = %(syslog_backend)s [uwimap-auth] port = imap,imaps logpath = %(syslog_mail)s backend = %(syslog_backend)s [named-refused] port = domain,953 logpath = /var/log/named/security.log [nsd] port = 53 action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] logpath = /var/log/nsd.log [asterisk] port = 5060,5061 action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"] logpath = /var/log/asterisk/messages maxretry = 10 [freeswitch] port = 5060,5061 action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] %(mta)s-whois[name=%(__name__)s, dest="%(destemail)s"] logpath = /var/log/freeswitch.log maxretry = 10 [mysqld-auth] port = 3306 logpath = %(mysql_log)s backend = %(mysql_backend)s [mongodb-auth] port = 27017 logpath = /var/log/mongodb/mongodb.log [recidive] logpath = /var/log/fail2ban.log banaction = %(banaction_allports)s bantime = 1w findtime = 1d [pam-generic] banaction = %(banaction_allports)s logpath = %(syslog_authpriv)s backend = %(syslog_backend)s [xinetd-fail] banaction = iptables-multiport-log logpath = %(syslog_daemon)s backend = %(syslog_backend)s maxretry = 2 [stunnel] logpath = /var/log/stunnel4/stunnel.log [ejabberd-auth] port = 5222 logpath = /var/log/ejabberd/ejabberd.log [counter-strike] logpath = /opt/cstrike/logs/L[0-9]*.log # Firewall: http://www.cstrike-planet.com/faq/6 tcpport = 27030,27031,27032,27033,27034,27035,27036,27037,27038,27039 udpport = 1200,27000,27001,27002,27003,27004,27005,27006,27007,27008,27009,27010,27011,27012,27013,27014,27015 action = %(banaction)s[name=%(__name__)s-tcp, port="%(tcpport)s", protocol="tcp", chain="%(chain)s", actname=%(banaction)s-tcp] %(banaction)s[name=%(__name__)s-udp, port="%(udpport)s", protocol="udp", chain="%(chain)s", actname=%(banaction)s-udp] [nagios] logpath = %(syslog_daemon)s ; nrpe.cfg may define a different log_facility backend = %(syslog_backend)s maxretry = 1 [oracleims] logpath = /opt/sun/comms/messaging64/log/mail.log_current banaction = %(banaction_allports)s [directadmin] logpath = /var/log/directadmin/login.log port = 2222 [portsentry] logpath = /var/lib/portsentry/portsentry.history maxretry = 1 [pass2allow-ftp] port = ftp,ftp-data,ftps,ftps-data knocking_url = /knocking/ filter = apache-pass[knocking_url="%(knocking_url)s"] logpath = %(apache_access_log)s blocktype = RETURN returntype = DROP action = %(action_)s[blocktype=%(blocktype)s, returntype=%(returntype)s] bantime = 1h maxretry = 1 findtime = 1 [murmur] # AKA mumble-server port = 64738 action = %(banaction)s[name=%(__name__)s-tcp, port="%(port)s", protocol=tcp, chain="%(chain)s", actname=%(banaction)s-tcp] %(banaction)s[name=%(__name__)s-udp, port="%(port)s", protocol=udp, chain="%(chain)s", actname=%(banaction)s-udp] logpath = /var/log/mumble-server/mumble-server.log [screensharingd] # For Mac OS Screen Sharing Service (VNC) logpath = /var/log/system.log logencoding = utf-8 [haproxy-http-auth] logpath = /var/log/haproxy.log [slapd] port = ldap,ldaps logpath = /var/log/slapd.log [domino-smtp] port = smtp,ssmtp logpath = /home/domino01/data/IBM_TECHNICAL_SUPPORT/console.log [phpmyadmin-syslog] port = http,https logpath = %(syslog_authpriv)s backend = %(syslog_backend)s [zoneminder] port = http,https logpath = %(apache_error_log)s EOjail_local cat >>"/etc/fail2ban/jail.d/defaults.conf" <>"/etc/fail2ban/jail.d/nginx-http-auth.conf" <>"/etc/fail2ban/jail.d/sshd.local" <> "/etc/ssh/sshd_config" << END Match Group filetransfer ChrootDirectory %h # Prevent user access to anything beyond their home folder X11Forwarding no # Disable X11 forwarding AllowTcpForwarding no # Disable tunneling AllowAgentForwarding no # Disable port forwarding PermitTunnel no # Disable network tunneling ForceCommand internal-sftp # Force the connection to use the built-in SFTP server PasswordAuthentication yes END fi check_group=$(grep filetransfer /etc/group) if [ -z "${check_group}" ]; then addgroup filetransfer fi } # Create menu ############################################ add_menu() { cd_dir "${BASH_DIR}" rm -rf menu hostvn.conf ipaddress menu.tar.gz /usr/bin/hostvn wget "${EXT_LINK}"/ubuntu/menu.tar.gz > /dev/null tar -xvf menu.tar.gz && rm -rf menu.tar.gz > /dev/null mkdir -p "${BASH_DIR}"/users mkdir -p /var/log/hostvn mkdir -p /var/hostvn/wpcron chmod 711 menu users wpcron chmod +x ./menu/* ./menu/*/* ./menu/*/*/* ./menu/*/*/*/* > /dev/null dos2unix ./menu/* > /dev/null dos2unix ./menu/*/* > /dev/null dos2unix ./menu/*/*/* > /dev/null mv "${BASH_DIR}"/menu/hostvn /usr/bin/hostvn && chmod +x /usr/bin/hostvn } ############################################ # Write Info ############################################ write_info() { touch "${FILE_INFO}" { echo "script_version=${SCRIPTS_VERSION}" echo "ssh_port=${SSH_PORT}" echo "admin_port=${RANDOM_ADMIN_PORT}" echo "admin_pwd=${ADMIN_TOOL_PWD}" echo "mysql_pwd=${sql_admin_pass}" echo "admin_email=${ADMIN_EMAIL}" echo "php1_release=yes" echo "php2_release=${PHP2_RELEASE}" echo "php1_version=${PHP_VERSION}" echo "php2_version=${PHP_VERSION_2}" echo "webserver=nginx" echo "lang=vi" } >>"${FILE_INFO}" touch /etc/hostvn.lock chmod 600 "${FILE_INFO}" /etc/hostvn.lock if [[ ! -f "/var/hostvn/ipaddress" ]]; then cat >>"/var/hostvn/ipaddress" <> "/etc/sysctl.conf" << EOsysctl ### ### GENERAL SYSTEM SECURITY OPTIONS ### ### # Controls the System Request debugging functionality of the kernel kernel.sysrq = 0 # Controls whether core dumps will append the PID to the core filename. # Useful for debugging multi-threaded applications. kernel.core_uses_pid = 1 #Allow for more PIDs kernel.pid_max = 65535 # The contents of /proc//maps and smaps files are only visible to # readers that are allowed to ptrace() the process #kernel.maps_protect = 1 #Enable ExecShield protection #kernel.exec-shield = 1 kernel.randomize_va_space = 2 # Controls the maximum size of a message, in bytes kernel.msgmnb = 65535 # Controls the default maxmimum size of a mesage queue kernel.msgmax = 65535 # Restrict core dumps fs.suid_dumpable = 0 # Hide exposed kernel pointers kernel.kptr_restrict = 1 ### ### IMPROVE SYSTEM MEMORY MANAGEMENT ### ### # Increase size of file handles and inode cache fs.file-max = 209708 # Do less swapping vm.swappiness = 10 vm.dirty_ratio = 10 vm.dirty_background_ratio = 5 vm.vfs_cache_pressure=50 # specifies the minimum virtual address that a process is allowed to mmap vm.mmap_min_addr = 4096 # 50% overcommitment of available memory vm.overcommit_ratio = 50 vm.overcommit_memory = 0 # Set maximum amount of memory allocated to shm to 256MB kernel.shmmax = 268435456 kernel.shmall = 268435456 # Keep at least 64MB of free RAM space available vm.min_free_kbytes = 65535 ### ### GENERAL NETWORK SECURITY OPTIONS ### ### #Prevent SYN attack, enable SYNcookies (they will kick-in when the max_syn_backlog reached) net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_syn_retries = 2 net.ipv4.tcp_synack_retries = 2 net.ipv4.tcp_max_syn_backlog = 4096 # Disables packet forwarding net.ipv4.ip_forward = 0 net.ipv4.conf.all.forwarding = 0 net.ipv4.conf.default.forwarding = 0 net.ipv6.conf.all.forwarding = 0 net.ipv6.conf.default.forwarding = 0 # Disables IP source routing net.ipv4.conf.all.send_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.default.accept_source_route = 0 net.ipv6.conf.all.accept_source_route = 0 net.ipv6.conf.default.accept_source_route = 0 # Enable IP spoofing protection, turn on source route verification net.ipv4.conf.all.rp_filter = 1 net.ipv4.conf.default.rp_filter = 1 # Disable ICMP Redirect Acceptance net.ipv4.conf.all.accept_redirects = 0 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.all.secure_redirects = 0 net.ipv4.conf.default.secure_redirects = 0 net.ipv6.conf.all.accept_redirects = 0 net.ipv6.conf.default.accept_redirects = 0 # Enable Log Spoofed Packets, Source Routed Packets, Redirect Packets net.ipv4.conf.all.log_martians = 1 net.ipv4.conf.default.log_martians = 1 # Decrease the time default value for tcp_fin_timeout connection net.ipv4.tcp_fin_timeout = 7 # Decrease the time default value for connections to keep alive net.ipv4.tcp_keepalive_time = 300 net.ipv4.tcp_keepalive_probes = 5 net.ipv4.tcp_keepalive_intvl = 15 # Don't relay bootp net.ipv4.conf.all.bootp_relay = 0 # Don't proxy arp for anyone net.ipv4.conf.all.proxy_arp = 0 # Turn on the tcp_timestamps, accurate timestamp make TCP congestion control algorithms work better net.ipv4.tcp_timestamps = 1 # Don't ignore directed pings net.ipv4.icmp_echo_ignore_all = 0 # Enable ignoring broadcasts request net.ipv4.icmp_echo_ignore_broadcasts = 1 # Enable bad error message Protection net.ipv4.icmp_ignore_bogus_error_responses = 1 # Allowed local port range net.ipv4.ip_local_port_range = 16384 65535 # Enable a fix for RFC1337 - time-wait assassination hazards in TCP net.ipv4.tcp_rfc1337 = 1 # Do not auto-configure IPv6 #net.ipv6.conf.all.autoconf=0 #net.ipv6.conf.all.accept_ra=0 #net.ipv6.conf.default.autoconf=0 #net.ipv6.conf.default.accept_ra=0 #net.ipv6.conf.eth0.autoconf=0 #net.ipv6.conf.eth0.accept_ra=0 ### ### TUNING NETWORK PERFORMANCE ### ### # Use BBR TCP congestion control and set tcp_notsent_lowat to 16384 to ensure HTTP/2 prioritization works optimally # Do a 'modprobe tcp_bbr' first (kernel > 4.9) # Fall-back to htcp if bbr is unavailable (older kernels) net.ipv4.tcp_congestion_control = htcp net.ipv4.tcp_congestion_control = bbr net.ipv4.tcp_notsent_lowat = 16384 # For servers with tcp-heavy workloads, enable 'fq' queue management scheduler (kernel > 3.12) net.core.default_qdisc = fq # Turn on the tcp_window_scaling net.ipv4.tcp_window_scaling = 1 # Increase the read-buffer space allocatable net.ipv4.tcp_rmem = 8192 87380 16777216 net.ipv4.udp_rmem_min = 16384 net.core.rmem_default = 262144 net.core.rmem_max = 16777216 # Increase the write-buffer-space allocatable net.ipv4.tcp_wmem = 8192 65536 16777216 net.ipv4.udp_wmem_min = 16384 net.core.wmem_default = 262144 net.core.wmem_max = 16777216 # Increase number of incoming connections net.core.somaxconn = 32768 # Increase number of incoming connections backlog net.core.netdev_max_backlog = 16384 net.core.dev_weight = 64 # Increase the maximum amount of option memory buffers net.core.optmem_max = 65535 # Increase the tcp-time-wait buckets pool size to prevent simple DOS attacks net.ipv4.tcp_max_tw_buckets = 1440000 # try to reuse time-wait connections, but don't recycle them (recycle can break clients behind NAT) #net.ipv4.tcp_tw_recycle = 0 net.ipv4.tcp_tw_reuse = 1 # Limit number of orphans, each orphan can eat up to 16M (max wmem) of unswappable memory net.ipv4.tcp_max_orphans = 16384 net.ipv4.tcp_orphan_retries = 0 # Limit the maximum memory used to reassemble IP fragments (CVE-2018-5391) net.ipv4.ipfrag_low_thresh = 196608 net.ipv6.ip6frag_low_thresh = 196608 net.ipv4.ipfrag_high_thresh = 262144 net.ipv6.ip6frag_high_thresh = 262144 # don't cache ssthresh from previous connection net.ipv4.tcp_no_metrics_save = 1 net.ipv4.tcp_moderate_rcvbuf = 1 # Increase size of RPC datagram queue length net.unix.max_dgram_qlen = 50 # Don't allow the arp table to become bigger than this net.ipv4.neigh.default.gc_thresh3 = 2048 # Tell the gc when to become aggressive with arp table cleaning. # Adjust this based on size of the LAN. 1024 is suitable for most /24 networks net.ipv4.neigh.default.gc_thresh2 = 1024 # Adjust where the gc will leave arp table alone - set to 32. net.ipv4.neigh.default.gc_thresh1 = 32 # Adjust to arp table gc to clean-up more often net.ipv4.neigh.default.gc_interval = 30 # Increase TCP queue length net.ipv4.neigh.default.proxy_qlen = 96 net.ipv4.neigh.default.unres_qlen = 6 # Enable Explicit Congestion Notification (RFC 3168), disable it if it doesn't work for you net.ipv4.tcp_ecn = 1 net.ipv4.tcp_reordering = 3 # How many times to retry killing an alive TCP connection net.ipv4.tcp_retries2 = 15 net.ipv4.tcp_retries1 = 3 # Avoid falling back to slow start after a connection goes idle # keeps our cwnd large with the keep alive connections (kernel > 3.6) net.ipv4.tcp_slow_start_after_idle = 0 # Allow the TCP fastopen flag to be used, beware some firewalls do not like TFO! (kernel > 3.7) net.ipv4.tcp_fastopen = 3 # This will enusre that immediatly subsequent connections use the new values net.ipv4.route.flush = 1 net.ipv6.route.flush = 1 EOsysctl sysctl -p } create_bash_dir set_email ssh_login_notify input_ip option_change_ssh_port select_php_ver select_php_multi if [[ "${MULTI_PHP}" =~ ^(Y|y)$ ]]; then select_php_ver_2 check_duplicate_php fi php_memory_calculation cal_ssl_cache_size php_parameter mariadb_calculation self_signed_ssl install_nginx install_mariadb install_php if [[ "${MULTI_PHP}" =~ ^(Y|y)$ ]]; then install_php_2 php2_global_config hostvn_custom_ini_2 php_2_opcache systemctl enable php"${PHP_VERSION_2}"-fpm fi create_nginx_conf #_create_mod_security_config create_wordpress_conf create_extra_conf default_vhost vhost_custom default_index default_error_page wp_rocket_nginx php_global_config systemctl enable php"${PHP_VERSION}"-fpm hostvn_custom_ini php_opcache config_my_cnf install_phpmyadmin install_composer install_wp_cli install_optipng install_jpegoptim install_pngquant install_acme gen_htpasswd opcache_dashboard install_rclone install_wp_cli_packages install_fail2ban if [[ "$prompt_ssh" =~ ^([yY]) ]]; then change_ssh_port fi setup_sftp add_menu write_info open_port kernel_tweak clear sleep 1 printf "=========================================================================\n" printf " Cai dat thanh cong Ubuntu LEMP Stack \n" printf " File luu thong tin: %s\n" "${FILE_INFO}" printf " Neu can ho tro vui long truy cap %s\n" "${AUTHOR_CONTACT}" printf "==========================================================================\n" printf " Luu lai thong tin duoi day de truy cap SSH va phpMyAdmin \n" printf " ${RED}%s${NC}\n \n" "De mo Menu su dung lenh: hostvn" printf "==========================================================================\n" printf "SSH Port : %s\n" "${SSH_PORT}" printf "phpMyAdmin : %s\n" "http://${IPADDRESS}:${RANDOM_ADMIN_PORT}/phpmyadmin" printf "Link Opcache Dashboard : %s\n" "http://${IPADDRESS}:${RANDOM_ADMIN_PORT}/opcache" echo "User phpMyAdmin va Admin Tool: admin " printf "Password Admin tool : %s\n" "${ADMIN_TOOL_PWD}" printf "Password phpMyAdmin : %s\n" "${sql_admin_pass}" printf "=========================================================================\n" sleep 3 shutdown -r now