1&1 cloud server unter Ubuntu 16.04.1 LTS, Teil 7, Apache- und Servermonitoring

Nachdem wir unseren Apache Webserver grundkonfiguriert haben, wäre es schön, wenn wir nun online sehen könnten was unser Apache macht und wie er konfiguriert ist. Dazu gibt es die beiden Apache Module status und info. Wenn wir in das Verzeichnis /etc/apache2/mods-enabled schauen, sehen wir, dass das status Modul sogar aktiviert ist. Es ist jedoch aus Sicherheitsgesichtspunkten keine gute Idee diese beiden Module so zu konfigurieren, dass man die Infomationen von beliebigen Rechnern aus abrufen kann. Deshalb sind beide Module so konfiguriert, dass nur lokal vom Server auf die Seiten zugegriffen werden kann. Wenn wir versuchen auf unsere https://mysubdomain.mydomain.tld/server-status Seite zuzugreifen erhalten wir eine Fehlerseite „403 Forbidden“, wir haben keine Berechtigung auf die Seite zuzugreifen. Für die server-info Seite erhalten wir ein „404 Not Found“, das Modul ist nicht aktiviert.

Wir werfen einen Blick in die beiden Konfigurationsdateien:

$ cat /etc/apache2/mods-available/status.conf
<IfModule mod_status.c>
        # Allow server status reports generated by mod_status,
        # with the URL of http://servername/server-status
        # Uncomment and change the "192.0.2.0/24" to allow access from other hosts.

        <Location /server-status>
                SetHandler server-status
                Require local
                #Require ip 192.0.2.0/24
        </Location>

        # Keep track of extended status information for each request
        #ExtendedStatus On

        # Determine if mod_status displays the first 63 characters of a request or
        # the last 63, assuming the request itself is greater than 63 chars.
        # Default: Off
        #SeeRequestTail On


        <IfModule mod_proxy.c>
                # Show Proxy LoadBalancer status in mod_status
                ProxyStatus On
        </IfModule>


</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

$ cat /etc/apache2/mods-available/status.conf

# Allow server status reports generated by mod_status,

# with the URL of http://servername/server-status

# Uncomment and change the "192.0.2.0/24" to allow access from other hosts.

SetHandler server-status

Require local

#Require ip 192.0.2.0/24

</Location>

# Keep track of extended status information for each request

#ExtendedStatus On

# Determine if mod_status displays the first 63 characters of a request or

# the last 63, assuming the request itself is greater than 63 chars.

# Default: Off

#SeeRequestTail On

# Show Proxy LoadBalancer status in mod_status

ProxyStatus On

</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

$ cat /etc/apache2/mods-available/info.conf
<IfModule mod_info.c>

        # Allow remote server configuration reports, with the URL of
        #  http://servername/server-info (requires that mod_info.c be loaded).
        # Uncomment and change the "192.0.2.0/24" to allow access from other hosts.
        #
        <Location /server-info>
                SetHandler server-info
                Require local
                #Require ip 192.0.2.0/24
        </Location>

</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

$ cat /etc/apache2/mods-available/info.conf

# Allow remote server configuration reports, with the URL of

# http://servername/server-info (requires that mod_info.c be loaded).

# Uncomment and change the "192.0.2.0/24" to allow access from other hosts.

SetHandler server-info

Require local

#Require ip 192.0.2.0/24

</Location>

</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

In beiden Fällen ist der Zugriff, durch die Anweisung „Require local“, lokal auf den Server beschränkt. Wenn wir hinter einer festen IP-Adresse sitzen, können wir diese natürlich hier eintragen. Ich bevorzuge einen anderen Weg, da ich hinter einer AVM Fritzbox am Vodafone Kabelanschluss, ehemals Kabel Deutschland, sitze und keine feste IP-Adresse habe, jedenfalls keine feste IPv4 Adresse. Voraussetzung ist der Einsatz eines DynDNS Dienstes für meine Fritzbox. AVM bietet einen kostenlosen Dienst für seine Kunden an, den man sehr einfach konfigurieren kann. Einmal eingerichtet findet man den DNS Namen für seine Fritzbox in deren Konfigurationsoberfläche unter Internet -> Online-Monitor. Dort sollte dann ein Eintrag MyFRITZ! existieren, mit einer URL der Form https://routerkennung.myfritz.net und einem Benutzernamen. Der DNS Name für unseren Router ist dann routerkennung.myfritz.net und ein „host routerkennung.myfritz.net“ sollte die momentan zugewiesene IP-Adresse unseres Routers zurückliefern. Da sich zumindest bei Vodafone die zugewiesene IP-Adresse selten ändert könnten wir natürlich diese IP-Adresse in die Konfigurationsdateien eintragen. Ich mache es hier etwas anders.

Zunächst lege ich im Apache Konfigurationsverzeichnis, im von uns angelegten Verzeichnis misc, siehe den 5. Teil der Artikelserie, eine neue leere Datei an:

touch /etc/apache2/misc/my-current-admin-host.conf

1	touch /etc/apache2/misc/my-current-admin-host.conf

In die Datei /etc/apache2/misc/my-current-admin-host.conf schreiben wir später eine passende „Require“ Anweisung. Dann tragen wir in allen Konfigurationen, in denen wir den Zugriff von unserem Heimnetz aus freischalten wollen, eine „Include“ Anweisung ein, die den Inhalt der Datei /etc/apache2/misc/my-current-admin-host.conf in die Konfiguration aufnimmt. Als Beispiel sehen wir hier die Datei /etc/apache2/mods-available/info.conf:

<IfModule mod_info.c>

        # Allow remote server configuration reports, with the URL of
        #  http://servername/server-info (requires that mod_info.c be loaded).
        # Uncomment and change the "192.0.2.0/24" to allow access from other hosts.
        #
        <Location /server-info>
                SetHandler server-info
                Require local
                #Require ip 192.0.2.0/24

                Include /etc/apache2/misc/my-current-admin-host.conf
        </Location>

</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

# Allow remote server configuration reports, with the URL of

# http://servername/server-info (requires that mod_info.c be loaded).

# Uncomment and change the "192.0.2.0/24" to allow access from other hosts.

SetHandler server-info

Require local

#Require ip 192.0.2.0/24

Include /etc/apache2/misc/my-current-admin-host.conf

</Location>

</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

Das gleiche machen wir in der Datei status.conf. Nun haben wir eine zentrale Stelle an der wir die IP-Adresse unseres Admin Hostes, bzw. die unseres Internetrouters eintragen können. Am einfachsten wäre für mich, wenn der 1&1 Cloud Server auch über IPv6 ans Internet angebunden wäre. Dann wäre es jetzt ausreichend in unsere neu angelegte Konfigurationsdatei /etc/apache2/misc/my-current-admin-host.conf meine feste IPv6-Adresse einzutragen. Leider ist dem momentan nicht so.

Die nächste einfach aussehende Option wäre die folgende:

Require host routerkennung.myfritz.net

1	Require host routerkennung.myfritz.net

Dies funktioniert leider nicht. Wenn wir einen „host“ angeben, müssen die DNS-Auflösung und die reverse DNS-Auflösung zusammen passen. Das ist bei den DynDNS Namen nicht der Fall, wie man leicht selbst überprüfen kann. Da ich dennoch einen Hosteintrag einem IP-Eintrag vorziehe, wähle ich folgende Vorgehensweise. Ich bestimme mir anhand des DynDNS Namens die IP-Adresse und dann von dieser ausgehend den Hostnamen im Providernetz. Diesen Hostnamen trage ich dann in unsere Konfigurationsdatei ein. Anschliessend müssen wir den Apache noch veranlassen seine Konfiguration neu zu lesen.

Um den ganzen Vorgang zu automatisieren benutze ich ein Script /root/bin/setmyhost.sh aus dem 5. Teil der alten Artikelserie mit einigen Korrekturen:

#!/bin/bash
#
# Utility to set a "Require host" record for apache
#
# You may adopt the following three variables to your needs
configdir="/etc/apache2/misc"
configfile="my-current-admin-host.conf"
comparefile="my-old-admin-host.txt"

#
# My own name
#
myname=$0

#
# define funktion usage
#
usage()
{
        echo "Usage: ${myname} [ options ] <hostname>"
        echo ""
        echo "Options:"
        echo "         -h, --help     print usage"
        echo "         -v, --verbose  give verbose output"
        echo ""
}

#
# parse arguments
#
dyndnsname=""

for arg in "$@"; do
        case $arg in
                -h|--help)
                        usage
                        exit 0
                ;;
                -v|--verbose)
                        verbose="true"
                ;;
                -*)
                        echo "Error: Unknown option $arg"
                        usage
                        exit 0
                ;;
                *)
                        if [ "${dyndnsname}" == "" ] ; then
                                dyndnsname=${arg}
                        else
                                echo "Error: No extra parameter allowed: $arg"
                                usage
                                exit 0
                        fi
                ;;
        esac
done

# Check if configdir exists
if [ ! -d "${configdir}" ] ; then
        echo "Error: Configuration directory ${configdir} doesn't exist!"
        exit 2
fi

# Check if comparefile exists
if [ ! -f "${configdir}/${comparefile}" ] ; then
        echo "Warning: File ${configdir}/${comparefile} doesn't exist, creating an empty one"
        touch "${configdir}/${comparefile}"
fi

# Lookup the IP address for dyndnsname.
myipaddress_tmp=`host -t A ${dyndnsname}`

# Check for Error!
case "$myipaddress_tmp" in
        # No Error. We are only interested in the A record. Extract the fourth field it's the IP.
        *"$dyndnsname has address"*)
                myipaddress=`echo $myipaddress_tmp | cut -d " " -f 4`
        ;;
        # Error
        *)
                echo "Error: $myipaddress_tmp"
                echo "Restrict to localhost.localdomain"
                myipaddress="127.0.0.1"
        ;;
esac

# Now we do a reverse lookup.
myhostname_tmp=`host ${myipaddress}`

# Check for Error!
case "$myhostname_tmp" in
        # No Error. Extract the fifth field it's the name.
        *".in-addr.arpa domain name pointer "*)
                myhostname=`echo $myhostname_tmp | cut -d " " -f 5`
        ;;
        # Error
        *)
                echo "Error: $myhostname_tmp"
                echo "Restrict to localhost.localdomain"
                myhostname="localhost.localdomain."
        ;;
esac

# Remove the trailing dot.
myhostname=`echo ${myhostname%.}`

# Read the old name, stored the last time the name changed.
myoldhostname=`cat ${configdir}/${comparefile}`

if [ "${myhostname}" != "${myoldhostname}" ] ; then
        echo "Host has changed."
        echo "Given hostname is:        ${dyndnsname}"
        echo "IPv4 address is:          ${myipaddress}"
        echo "The current hostname is:  ${myhostname}"
        echo "The old hostname was:     ${myoldhostname}"
        echo "Writing new configuration file and reloading apache!"

        # Write new configuration file. This file has to be included in the right places.
        echo "Require host ${myhostname}" >${configdir}/${configfile}

        # Write new current admin host to text file for easy comparison.
        echo "${myhostname}" >${configdir}/${comparefile}

        # Reload apache, suppress normal output.
        systemctl reload apache2
else
        if [ $2 ] ; then
                if [ $verbose ] ; then
                        echo "Host has not changed."
                        echo "Given hostname is:        ${dyndnsname}"
                        echo "IPv4 address is:          ${myipaddress}"
                        echo "The current hostname is:  ${myhostname}"
                        echo "The old hostname was:     ${myoldhostname}"
                        echo "Nothing to do!"
                fi
        fi
fi

exit 0

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

#!/bin/bash

# Utility to set a "Require host" record for apache

# You may adopt the following three variables to your needs

configdir="/etc/apache2/misc"

configfile="my-current-admin-host.conf"

comparefile="my-old-admin-host.txt"

# My own name

myname=$0

# define funktion usage

usage()

{

echo "Usage: ${myname} [ options ] <hostname>"

echo ""

echo "Options:"

echo " -h, --help print usage"

echo " -v, --verbose give verbose output"

echo ""

}

# parse arguments

dyndnsname=""

for arg in "$@"; do

case $arg in

-h|--help)

usage

exit 0

;;

-v|--verbose)

verbose="true"

;;

-*)

echo "Error: Unknown option $arg"

usage

exit 0

;;

if [ "${dyndnsname}" == "" ] ; then

dyndnsname=${arg}

else

echo "Error: No extra parameter allowed: $arg"

usage

exit 0

;;

esac

done

# Check if configdir exists

if [ ! -d "${configdir}" ] ; then

echo "Error: Configuration directory ${configdir} doesn't exist!"

exit 2

# Check if comparefile exists

if [ ! -f "${configdir}/${comparefile}" ] ; then

echo "Warning: File ${configdir}/${comparefile} doesn't exist, creating an empty one"

touch "${configdir}/${comparefile}"

# Lookup the IP address for dyndnsname.

myipaddress_tmp=`host -t A ${dyndnsname}`

# Check for Error!

case "$myipaddress_tmp" in

# No Error. We are only interested in the A record. Extract the fourth field it's the IP.

*"$dyndnsname has address"*)

myipaddress=`echo $myipaddress_tmp | cut -d " " -f 4`

;;

# Error

echo "Error: $myipaddress_tmp"

echo "Restrict to localhost.localdomain"

myipaddress="127.0.0.1"

;;

esac

# Now we do a reverse lookup.

myhostname_tmp=`host ${myipaddress}`

# Check for Error!

case "$myhostname_tmp" in

# No Error. Extract the fifth field it's the name.

*".in-addr.arpa domain name pointer "*)

myhostname=`echo $myhostname_tmp | cut -d " " -f 5`

;;

# Error

echo "Error: $myhostname_tmp"

echo "Restrict to localhost.localdomain"

myhostname="localhost.localdomain."

;;

esac

# Remove the trailing dot.

myhostname=`echo ${myhostname%.}`

# Read the old name, stored the last time the name changed.

myoldhostname=`cat ${configdir}/${comparefile}`

if [ "${myhostname}" != "${myoldhostname}" ] ; then

echo "Host has changed."

echo "Given hostname is: ${dyndnsname}"

echo "IPv4 address is: ${myipaddress}"

echo "The current hostname is: ${myhostname}"

echo "The old hostname was: ${myoldhostname}"

echo "Writing new configuration file and reloading apache!"

# Write new configuration file. This file has to be included in the right places.

echo "Require host ${myhostname}" >${configdir}/${configfile}

# Write new current admin host to text file for easy comparison.

echo "${myhostname}" >${configdir}/${comparefile}

# Reload apache, suppress normal output.

systemctl reload apache2

else

if [ $2 ] ; then

if [ $verbose ] ; then

echo "Host has not changed."

echo "Given hostname is: ${dyndnsname}"

echo "IPv4 address is: ${myipaddress}"

echo "The current hostname is: ${myhostname}"

echo "The old hostname was: ${myoldhostname}"

echo "Nothing to do!"

exit 0

Das script erwartet einen existierenden Hostnamen als Argument. Die Optionen -v, –verbose triggern das eine ausführliche Ausgabe, während die Optionen -h, –help die Hilfe zum Script anzeigen. Die Funktionsweise ist wie oben beschrieben. Zunächst wird für den angegebenen Hostnamen die zugehörige IP-Adresse bestimmt und dann per reverse Auflösung der zugehörige Hostnamen. Dieser Hostnamen wird mit dem in der Datei /etc/apache2/misc/my-old-admin-host.txt abgelegten Namen verglichen. Nur wenn die beiden Namen voneinander abweichen, wird unsere Konfigurationsdatei für die Hostauthentifizierung /etc/apache2/misc/my-current-admin-host.conf neu geschrieben und ein Apache Reload durchgeführt. Anschließend wird der neue Namen in die /etc/apache2/misc/my-old-admin-host.txt geschrieben. Dies stellt sicher, dass nur wenn notwendig eine neue Konfigurationsdatei geschrieben und ein Apache Reload durchgeführt wird. Im Falle eines Fehlers wird „Require host localhost.localdomain“ in die Datei /etc/apache2/misc/my-current-admin-host.conf geschrieben und damit der Zugriff lokal auf den Server beschränkt.

Wir ändern die Permissions und führen das Script zunächst an der Kommandozeile aus.

chmod 700 /root/bin/setmyhost.sh
/root/bin/setmyhost.sh xxxxxxxxxxxxxxxx.myfritz.net

1 2	chmod 700 /root/bin/setmyhost.sh /root/bin/setmyhost.sh xxxxxxxxxxxxxxxx.myfritz.net

Wir erhalten die folgende Ausgabe:

Warning: File /etc/apache2/misc/my-old-admin-host.txt doesn't exist, creating an empty one
Host has changed.
Given hostname is:        xxxxxxxxxxxxxxxx.myfritz.net
IPv4 address is:          xxx.xxx.xxx.xxx
The current hostname is:  ipxxxxxxxx.dynamic.kabel-deutschland.de
The old hostname was:
Writing new configuration file and reloading apache!

Warning: File /etc/apache2/misc/my-old-admin-host.txt doesn't exist, creating an empty one

Host has changed.

Given hostname is: xxxxxxxxxxxxxxxx.myfritz.net

IPv4 address is: xxx.xxx.xxx.xxx

The current hostname is: ipxxxxxxxx.dynamic.kabel-deutschland.de

The old hostname was:

Writing new configuration file and reloading apache!

Wenn wir das Script erneut ausführen, erhalten wir keine Ausgabe, da nichts zu tun ist. Erst wenn sich IP-Adresse meines Routers ändert, wird die Konfigurationsdatei neu geschrieben und es erfolgt eine Ausgabe. Das hat den angenehmen Nebeneffekt, das wir eine E-Mail-Benachrichtigung mit den Änderungen erhalten, wenn wir das Script in einem cronjob ausführen und sich die IP-Adresse und damit der Hostnamen geändert hat.

Zuletzt tragen wir mit „crontab -e“ einen entsprechenden cronjob in unserer crontab ein.

*/5 * * * *      /root/bin/setmyhost.sh xxxxxxxxxxxxxxxx.myfritz.net

1	/5 * * * /root/bin/setmyhost.sh xxxxxxxxxxxxxxxx.myfritz.net

Hiermit checken wir unseren Adminhost alle 5 Minuten.

Das Apache info Modul müssen wir noch aktivieren und den Apache restarten.

a2enmod info
service apache2 restart

1 2	a2enmod info service apache2 restart

Diese Konfiguration hat allerdings den Nachteil, dass die Server-Status und die Server-Info-Seite serverweit für alle virtuellen Hosts konfiguriert ist. Das möchte ich so nicht haben und nehme deshalb einige Änderungen vor. Dazu lösche ich zunächst die beiden Links auf die Konfigurationsdateien im /etc/apache/mods-enabled Verzeichnis.

cd /etc/apache2/mods-enabled
rm info.conf status.conf

1 2	cd /etc/apache2/mods-enabled rm info.conf status.conf

Anschliessend laden wir die beiden Konfigurationsdateien per Include Anweisung in unseren default vhost. Hier der entsprechende Abschnitt der der Datei /etc/apache2/sites-enabled/000-default-le-ssl.conf.

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with "a2disconf".
        #Include conf-available/serve-cgi-bin.conf
        Include /etc/apache2/mods-available/info.conf
        Include /etc/apache2/mods-available/status.conf

        # OCSP Stapling, only in httpd 2.3.3 and later. Stapling options configured in ssl.conf
        SSLUseStapling on

# For most configuration files from conf-available/, which are

# enabled or disabled at a global level, it is possible to

# include a line for only one particular virtual host. For example the

# following line enables the CGI configuration for this host only

# after it has been globally disabled with "a2disconf".

#Include conf-available/serve-cgi-bin.conf

Include /etc/apache2/mods-available/info.conf

Include /etc/apache2/mods-available/status.conf

# OCSP Stapling, only in httpd 2.3.3 and later. Stapling options configured in ssl.conf

SSLUseStapling on

Nach einem Restart des Apache Servers können wir dann unter https://myhost.mydomain.tld/server-info/ und https://myhost.mydomain.tld/server-status/ auf die Apache Info bzw. Apache Status Seite zugreifen.

Um bequem unsere PHP Konfiguration überprüfen zu können, werden wir zunächst eine PHP Info Webseite erstellen, auf die ebenfalls nur von unserem Admin-Host zugegriffen werden kann. Hierzu erstellen wir zunächst ein neues Verzeichnis im Webserverbaum.

mkdir /var/www/phpinfo

1	mkdir /var/www/phpinfo

Dort erstellen wir eine Datei /var/www/phpinfo/index.php mit dem folgenden Inhalt.

<?php

// Zeigt alle Informationen zu unserer PHP Konfiguration an
phpinfo(INFO_ALL);

?>

<?php

// Zeigt alle Informationen zu unserer PHP Konfiguration an

phpinfo(INFO_ALL);

Nun brauchen wir noch eine Apache Konfigurationsdatei phpinfo.conf. Diese erstellen wir im Verzeichnis /etc/apache2/conf-available.

Alias /phpinfo /var/www/phpinfo/

<Directory "/var/www/phpinfo/">
    AllowOverride None
    DirectoryIndex index.php
    Require local
    Include /etc/apache2/misc/my-current-admin-host.conf

    FallbackResource "/index.php"
</Directory>

Alias /phpinfo /var/www/phpinfo/

AllowOverride None

DirectoryIndex index.php

Require local

Include /etc/apache2/misc/my-current-admin-host.conf

FallbackResource "/index.php"

</Directory>

Diese Konfiguration können wir dann ebenfalls per Include Anweisung in unseren virtuellen Host übernehmen. Der entsprechende Abschnitt der Datei /etc/apache2/sites-enabled/000-default-le-ssl.conf sieht dann wie folgt aus:

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with "a2disconf".
        #Include conf-available/serve-cgi-bin.conf
        Include /etc/apache2/mods-available/info.conf
        Include /etc/apache2/mods-available/status.conf
        Include /etc/apache2/conf-available/phpinfo.conf

        # OCSP Stapling, only in httpd 2.3.3 and later. Stapling options configured in ssl.conf
        SSLUseStapling on

# For most configuration files from conf-available/, which are

# enabled or disabled at a global level, it is possible to

# include a line for only one particular virtual host. For example the

# following line enables the CGI configuration for this host only

# after it has been globally disabled with "a2disconf".

#Include conf-available/serve-cgi-bin.conf

Include /etc/apache2/mods-available/info.conf

Include /etc/apache2/mods-available/status.conf

Include /etc/apache2/conf-available/phpinfo.conf

# OCSP Stapling, only in httpd 2.3.3 and later. Stapling options configured in ssl.conf

SSLUseStapling on

Nach einem Reload des Apache Servers können wir dann unter https://myhost.mydomain.tld/phpinfo/ auf die PHP Info Seite zugreifen.

Ähnlich verfahren wir mit der Apache Dokumentation. Zunächst installieren wir die Dokumentation.

apt-get install apache2-doc

1	apt-get install apache2-doc

In die Konfigurationsdatei /etc/apache2/conf-available/apache2-doc.conf tragen wir ebenfalls eine Include Anweisung zur Konfiguration unseres Adminhostes ein.

Alias /manual /usr/share/doc/apache2-doc/manual/

<Directory "/usr/share/doc/apache2-doc/manual/">
    Options Indexes FollowSymlinks
    AllowOverride None
    Require local
    #Require all granted

    Include /etc/apache2/misc/my-current-admin-host.conf

    AddDefaultCharset off
</Directory>

Alias /manual /usr/share/doc/apache2-doc/manual/

Options Indexes FollowSymlinks

AllowOverride None

Require local

#Require all granted

Include /etc/apache2/misc/my-current-admin-host.conf

AddDefaultCharset off

</Directory>

Diese Konfiguration können wir dann ebenfalls per Include Anweisung in unseren virtuellen Host übernehmen. Nach einem Apache Reload steht die Apache Dokumentation dann unter der URL https://myhost.mydomain.tld/manual/ zur Verfügung.

Zum Schluss dieses Artikels wollen wir noch ein Servermonitoring mit Munin einrichten. Hierzu installieren wir Munin zunächst.

apt-get install munin munin-doc munin-node

1	apt-get install munin munin-doc munin-node

Hierbei werden eine ganze Reihe Pakete mitinstalliert. Anschliessend installieren wir noch etliche empfohlene Pakete.

apt-get install gawk-doc libdbd-csv-perl libxml-dom-perl liblog-dispatch-perl libipc-shareable-perl libio-socket-ssl-perl libnet-ssleay-perl libcrypt-des-perl libdigest-hmac-perl acpi libcrypt-ssleay-perl libdbd-pg-perl liblwp-useragent-determined-perl libnet-irc-perl libtext-csv-xs-perl libwww-perl libxml-simple-perl logtail mysql-client ruby libnet-netmask-perl libnet-telnet-perl libxml-parser-perl libcache-cache-perl libdbd-mysql-perl libnet-dns-perl libgssapi-perl libdbi-test-perl libmldbm-perl libnet-daemon-perl libmojolicious-perl libauthen-ntlm-perl

apt-get install gawk-doc libdbd-csv-perl libxml-dom-perl liblog-dispatch-perl libipc-shareable-perl libio-socket-ssl-perl libnet-ssleay-perl libcrypt-des-perl libdigest-hmac-perl acpi libcrypt-ssleay-perl libdbd-pg-perl liblwp-useragent-determined-perl libnet-irc-perl libtext-csv-xs-perl libwww-perl libxml-simple-perl logtail mysql-client ruby libnet-netmask-perl libnet-telnet-perl libxml-parser-perl libcache-cache-perl libdbd-mysql-perl libnet-dns-perl libgssapi-perl libdbi-test-perl libmldbm-perl libnet-daemon-perl libmojolicious-perl libauthen-ntlm-perl

Anschliessend nehmen wir eine Gundkonfiguration für Munin. Auf die Konfiguration einzelner Module werde ich hier nicht eingehen. Zunächst ändern wir die Datei /etc/munin/munin.conf.

# Example configuration file for Munin, generated by 'make build'

# The next three variables specifies where the location of the RRD
# databases, the HTML output, logs and the lock/pid files.  They all
# must be writable by the user running munin-cron.  They are all
# defaulted to the values you see here.
#
#dbdir  /var/lib/munin
#htmldir /var/cache/munin/www
#logdir /var/log/munin
#rundir  /var/run/munin

# Where to look for the HTML templates
#
#tmpldir        /etc/munin/templates

# Where to look for the static www files
#
#staticdir /etc/munin/static

# temporary cgi files are here. note that it has to be writable by
# the cgi user (usually nobody or httpd).
#
# cgitmpdir /var/lib/munin/cgi-tmp

# (Exactly one) directory to include all files from.
includedir /etc/munin/munin-conf.d

# You can choose the time reference for "DERIVE" like graphs, and show
# "per minute", "per hour" values instead of the default "per second"
#
#graph_period second

# Graphics files are generated either via cron or by a CGI process.
# See http://munin-monitoring.org/wiki/CgiHowto2 for more
# documentation.
# Since 2.0, munin-graph has been rewritten to use the cgi code.
# It is single threaded *by design* now.
#
#graph_strategy cron

# munin-cgi-graph is invoked by the web server up to very many times at the
# same time.  This is not optimal since it results in high CPU and memory
# consumption to the degree that the system can thrash.  Again the default is
# 6.  Most likely the optimal number for max_cgi_graph_jobs is the same as
# max_graph_jobs.
#
#munin_cgi_graph_jobs 6

# If the automatic CGI url is wrong for your system override it here:
#
#cgiurl_graph /munin-cgi/munin-cgi-graph

# max_size_x and max_size_y are the max size of images in pixel.
# Default is 4000. Do not make it too large otherwise RRD might use all
# RAM to generate the images.
#
#max_size_x 4000
#max_size_y 4000

# HTML files are normally generated by munin-html, no matter if the
# files are used or not. You can change this to on-demand generation
# by following the instructions in http://munin-monitoring.org/wiki/CgiHowto2
#
# Notes:
# - moving to CGI for HTML means you cannot have graph generated by cron.
# - cgi html has some bugs, mostly you still have to launch munin-html by hand
#
#html_strategy cron

# munin-update runs in parallel.
#
# The default max number of processes is 16, and is probably ok for you.
#
# If set too high, it might hit some process/ram/filedesc limits.
# If set too low, munin-update might take more than 5 min.
#
# If you want munin-update to not be parallel set it to 0.
#
#max_processes 16

# RRD updates are per default, performed directly on the rrd files.
# To reduce IO and enable the use of the rrdcached, uncomment it and set it to
# the location of the socket that rrdcached uses.
#
#rrdcached_socket /var/run/rrdcached.sock

# Drop somejuser@fnord.comm and anotheruser@blibb.comm an email everytime
# something changes (OK -> WARNING, CRITICAL -> OK, etc)
#contact.someuser.command mail -s "Munin notification" somejuser@fnord.comm
#contact.anotheruser.command mail -s "Munin notification" anotheruser@blibb.comm
#
# For those with Nagios, the following might come in handy. In addition,
# the services must be defined in the Nagios server as well.
#contact.nagios.command /usr/bin/send_nsca nagios.host.comm -c /etc/nsca.conf

# a simple host tree
[public1.emrich-ebersheim.de]
    address 127.0.0.1
    use_node_name yes

#
# A more complex example of a host tree
#
## First our "normal" host.
# [fii.foo.com]
#       address foo
#
## Then our other host...
# [fay.foo.com]
#       address fay
#
## IPv6 host. note that the ip adress has to be in brackets
# [ip6.foo.com]
#       address [2001::1234:1]
#
## Then we want totals...
# [foo.com;Totals] #Force it into the "foo.com"-domain...
#       update no   # Turn off data-fetching for this "host".
#
#   # The graph "load1". We want to see the loads of both machines...
#   # "fii=fii.foo.com:load.load" means "label=machine:graph.field"
#       load1.graph_title Loads side by side
#       load1.graph_order fii=fii.foo.com:load.load fay=fay.foo.com:load.load
#
#   # The graph "load2". Now we want them stacked on top of each other.
#       load2.graph_title Loads on top of each other
#       load2.dummy_field.stack fii=fii.foo.com:load.load fay=fay.foo.com:load.load
#       load2.dummy_field.draw AREA # We want area instead the default LINE2.
#       load2.dummy_field.label dummy # This is needed. Silly, really.
#
#   # The graph "load3". Now we want them summarised into one field
#       load3.graph_title Loads summarised
#       load3.combined_loads.sum fii.foo.com:load.load fay.foo.com:load.load
#       load3.combined_loads.label Combined loads # Must be set, as this is
#                                                 # not a dummy field!
#
## ...and on a side note, I want them listen in another order (default is
## alphabetically)
#
# # Since [foo.com] would be interpreted as a host in the domain "com", we
# # specify that this is a domain by adding a semicolon.
# [foo.com;]
#       node_order Totals fii.foo.com fay.foo.com
#

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

# Example configuration file for Munin, generated by 'make build'

# The next three variables specifies where the location of the RRD

# databases, the HTML output, logs and the lock/pid files. They all

# must be writable by the user running munin-cron. They are all

# defaulted to the values you see here.

#dbdir /var/lib/munin

#htmldir /var/cache/munin/www

#logdir /var/log/munin

#rundir /var/run/munin

# Where to look for the HTML templates

#tmpldir /etc/munin/templates

# Where to look for the static www files

#staticdir /etc/munin/static

# temporary cgi files are here. note that it has to be writable by

# the cgi user (usually nobody or httpd).

# cgitmpdir /var/lib/munin/cgi-tmp

# (Exactly one) directory to include all files from.

includedir /etc/munin/munin-conf.d

# You can choose the time reference for "DERIVE" like graphs, and show

# "per minute", "per hour" values instead of the default "per second"

#graph_period second

# Graphics files are generated either via cron or by a CGI process.

# See http://munin-monitoring.org/wiki/CgiHowto2 for more

# documentation.

# Since 2.0, munin-graph has been rewritten to use the cgi code.

# It is single threaded *by design* now.

#graph_strategy cron

# munin-cgi-graph is invoked by the web server up to very many times at the

# same time. This is not optimal since it results in high CPU and memory

# consumption to the degree that the system can thrash. Again the default is

# 6. Most likely the optimal number for max_cgi_graph_jobs is the same as

# max_graph_jobs.

#munin_cgi_graph_jobs 6

# If the automatic CGI url is wrong for your system override it here:

#cgiurl_graph /munin-cgi/munin-cgi-graph

# max_size_x and max_size_y are the max size of images in pixel.

# Default is 4000. Do not make it too large otherwise RRD might use all

# RAM to generate the images.

#max_size_x 4000

#max_size_y 4000

# HTML files are normally generated by munin-html, no matter if the

# files are used or not. You can change this to on-demand generation

# by following the instructions in http://munin-monitoring.org/wiki/CgiHowto2

# Notes:

# - moving to CGI for HTML means you cannot have graph generated by cron.

# - cgi html has some bugs, mostly you still have to launch munin-html by hand

#html_strategy cron

# munin-update runs in parallel.

# The default max number of processes is 16, and is probably ok for you.

# If set too high, it might hit some process/ram/filedesc limits.

# If set too low, munin-update might take more than 5 min.

# If you want munin-update to not be parallel set it to 0.

#max_processes 16

# RRD updates are per default, performed directly on the rrd files.

# To reduce IO and enable the use of the rrdcached, uncomment it and set it to

# the location of the socket that rrdcached uses.

#rrdcached_socket /var/run/rrdcached.sock

# Drop somejuser@fnord.comm and anotheruser@blibb.comm an email everytime

# something changes (OK -> WARNING, CRITICAL -> OK, etc)

#contact.someuser.command mail -s "Munin notification" somejuser@fnord.comm

#contact.anotheruser.command mail -s "Munin notification" anotheruser@blibb.comm

# For those with Nagios, the following might come in handy. In addition,

# the services must be defined in the Nagios server as well.

#contact.nagios.command /usr/bin/send_nsca nagios.host.comm -c /etc/nsca.conf

# a simple host tree

[public1.emrich-ebersheim.de]

address 127.0.0.1

use_node_name yes

# A more complex example of a host tree

## First our "normal" host.

# [fii.foo.com]

# address foo

## Then our other host...

# [fay.foo.com]

# address fay

## IPv6 host. note that the ip adress has to be in brackets

# [ip6.foo.com]

# address [2001::1234:1]

## Then we want totals...

# [foo.com;Totals] #Force it into the "foo.com"-domain...

# update no # Turn off data-fetching for this "host".

# # The graph "load1". We want to see the loads of both machines...

# # "fii=fii.foo.com:load.load" means "label=machine:graph.field"

# load1.graph_title Loads side by side

# load1.graph_order fii=fii.foo.com:load.load fay=fay.foo.com:load.load

# # The graph "load2". Now we want them stacked on top of each other.

# load2.graph_title Loads on top of each other

# load2.dummy_field.stack fii=fii.foo.com:load.load fay=fay.foo.com:load.load

# load2.dummy_field.draw AREA # We want area instead the default LINE2.

# load2.dummy_field.label dummy # This is needed. Silly, really.

# # The graph "load3". Now we want them summarised into one field

# load3.graph_title Loads summarised

# load3.combined_loads.sum fii.foo.com:load.load fay.foo.com:load.load

# load3.combined_loads.label Combined loads # Must be set, as this is

# # not a dummy field!

## ...and on a side note, I want them listen in another order (default is

## alphabetically)

# # Since [foo.com] would be interpreted as a host in the domain "com", we

# # specify that this is a domain by adding a semicolon.

# [foo.com;]

# node_order Totals fii.foo.com fay.foo.com

Wichtig ist dabei nur der Abschnitt unter „# a simple host tree“. Danach passen wir die Datei /etc/munin/munin-node.conf an.

#
# Example config-file for munin-node
#

log_level 4
log_file /var/log/munin/munin-node.log
pid_file /var/run/munin/munin-node.pid

background 1
setsid 1

user root
group root

# This is the timeout for the whole transaction.
# Units are in sec. Default is 15 min
#
# global_timeout 900

# This is the timeout for each plugin.
# Units are in sec. Default is 1 min
#
# timeout 60

# Regexps for files to ignore
ignore_file [\#~]$
ignore_file DEADJOE$
ignore_file \.bak$
ignore_file %$
ignore_file \.dpkg-(tmp|new|old|dist)$
ignore_file \.rpm(save|new)$
ignore_file \.pod$

# Set this if the client doesn't report the correct hostname when
# telnetting to localhost, port 4949
#
#host_name localhost.localdomain

# A list of addresses that are allowed to connect.  This must be a
# regular expression, since Net::Server does not understand CIDR-style
# network notation unless the perl module Net::CIDR is installed.  You
# may repeat the allow line as many times as you'd like

allow ^127\.0\.0\.1$
allow ^::1$

# If you have installed the Net::CIDR perl module, you can use one or more
# cidr_allow and cidr_deny address/mask patterns.  A connecting client must
# match any cidr_allow, and not match any cidr_deny.  Note that a netmask
# *must* be provided, even if it's /32
#
# Example:
#
# cidr_allow 127.0.0.1/32
# cidr_allow 192.0.2.0/24
# cidr_deny  192.0.2.42/32

# Which address to bind to;
# host *
host 127.0.0.1

# And which port
port 4949

# Example config-file for munin-node

log_level 4

log_file /var/log/munin/munin-node.log

pid_file /var/run/munin/munin-node.pid

background 1

setsid 1

user root

group root

# This is the timeout for the whole transaction.

# Units are in sec. Default is 15 min

# global_timeout 900

# This is the timeout for each plugin.

# Units are in sec. Default is 1 min

# timeout 60

# Regexps for files to ignore

ignore_file [\#~]$

ignore_file DEADJOE$

ignore_file \.bak$

ignore_file %$

ignore_file \.dpkg-(tmp|new|old|dist)$

ignore_file \.rpm(save|new)$

ignore_file \.pod$

# Set this if the client doesn't report the correct hostname when

# telnetting to localhost, port 4949

#host_name localhost.localdomain

# A list of addresses that are allowed to connect. This must be a

# regular expression, since Net::Server does not understand CIDR-style

# network notation unless the perl module Net::CIDR is installed. You

# may repeat the allow line as many times as you'd like

allow ^127\.0\.0\.1$

allow ^::1$

# If you have installed the Net::CIDR perl module, you can use one or more

# cidr_allow and cidr_deny address/mask patterns. A connecting client must

# match any cidr_allow, and not match any cidr_deny. Note that a netmask

# *must* be provided, even if it's /32

# Example:

# cidr_allow 127.0.0.1/32

# cidr_allow 192.0.2.0/24

# cidr_deny 192.0.2.42/32

# Which address to bind to;

# host *

host 127.0.0.1

# And which port

port 4949

Nachdem wir die Änderungen durchgeführt haben, müssen wir den munin-node Dienst neu starten.

systemctl restart munin-node

1	systemctl restart munin-node

Zuletzt ändern wir die Konfiguration für den Apache Webserver /etc/munin/apache24.conf und fügen zwei Include Anweisungen für unseren Adminhost ein.

Alias /munin /var/cache/munin/www
<Directory /var/cache/munin/www>
        Require local
        Include /etc/apache2/misc/my-current-admin-host.conf
        Options None
</Directory>

ScriptAlias /munin-cgi/munin-cgi-graph /usr/lib/munin/cgi/munin-cgi-graph
<Location /munin-cgi/munin-cgi-graph>
        Require local
        Include /etc/apache2/misc/my-current-admin-host.conf
        <IfModule mod_fcgid.c>
            SetHandler fcgid-script
        </IfModule>
        <IfModule !mod_fcgid.c>
            SetHandler cgi-script
        </IfModule>
</Location>

Alias /munin /var/cache/munin/www

Require local

Include /etc/apache2/misc/my-current-admin-host.conf

Options None

</Directory>

ScriptAlias /munin-cgi/munin-cgi-graph /usr/lib/munin/cgi/munin-cgi-graph

Require local

Include /etc/apache2/misc/my-current-admin-host.conf

SetHandler fcgid-script

</IfModule>

SetHandler cgi-script

</IfModule>

</Location>

Im Apache Verzeichnis wurde bei der Installation ein Link auf diese Konfiguration im Verzeichnis /etc/apache2/conf-available angelegt. Mit Include /etc/apache2/conf-available/munin.conf können wir die Konfiguration in unseren virtuellen Host übernehmen. Nach einem Reload des Apache steht die Munin Server Monitoring Seite für unseren Server unter https://myhost.mydomain.tld/munin/ zur Verfügung.

Damit schliesse ich den 7. Teil der Artikelserie. Im 8. Teil werden wir uns mit PHP und MySQL auf dem neuen Server beschäftigen.

Schreibe einen Kommentar Antworten abbrechen