{"id":105,"date":"2022-05-06T10:28:38","date_gmt":"2022-05-06T09:28:38","guid":{"rendered":"https:\/\/thomaskoslowsky.com\/es\/?page_id=105"},"modified":"2022-05-06T10:28:38","modified_gmt":"2022-05-06T09:28:38","slug":"first-steps-ubuntu-setup","status":"publish","type":"page","link":"https:\/\/thomaskoslowsky.com\/es\/index.php\/first-steps-ubuntu-setup\/","title":{"rendered":"First steps &#8211; ubuntu setup"},"content":{"rendered":"\n<p>Despu\u00e9s de la instalaci\u00f3n inicial:<\/p>\n\n\n\n<p>1. Asegurar una contrase\u00f1a fuerte para el usuario principal y para root<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>passwd root<\/p><\/blockquote>\n\n\n\n<p>2. Configurar el DNS: (\/etc\/resolv.conf)<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>nameserver 8.8.8.8<br>nameserver 8.8.4.4<\/p><\/blockquote>\n\n\n\n<p>3. Asegurar que root no puede hacer login via ssh (\/etc\/ssh\/sshd_config):<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>PermitRootLogin = no<br>AllowUsers [myuser]<br>SyslogFacility AUTH<br>LogLevel INFO<\/p><\/blockquote>\n\n\n\n<p>4. Comprobar las reglas de la firewall (en mi caso utilizando iptables)<br>&#8211; desactivar uwf (sudo systemctl disable ufw)<br>&#8211; instalar iptables y iptables-persistant<br>&#8211; configurar reglas b\u00e1sicas (80, 22, 443)<\/p>\n\n\n\n<p>Instalar Apache Web Server<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>apt install apache2<\/p><\/blockquote>\n\n\n\n<p>Asegurar unas configuraciones de seguridad (\/etc\/apache2\/conf-enabled\/security.conf). Las directrices de \u00abHeader\u00bb requieren que el modulo \u00abHeaders\u00bb este activo: \u00aba2enmod headers\u00bb<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>ServerSignature Off<br>ServerTokens Prod<br>Header set X-Content-Type-Options: \u00abnosniff\u00bb<br>Header set Strict-Transport-Security \u00abmax-age=63072000\u00bb<br>Header set X-Frame-Options: \u00absameorigin\u00bb<br>Header set X-XSS-Protection \u00ab1; mode=block\u00bb<\/p><\/blockquote>\n\n\n\n<p>Revisar los m\u00f3dulos activos:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>apachectl -M | sort<\/p><\/blockquote>\n\n\n\n<p>Activate SSL module:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>a2enmod ssl<\/p><\/blockquote>\n\n\n\n<p>Install certbot para generar el certificado:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>apt-get install certbot<br>systemctl stop apache2<br>certbot certonly &#8211;standalone &#8211;rsa-key-size 4096 &#8211;agree-tos &#8211;preferred-challenges http -d [nombre_de_mi_domain]<\/p><\/blockquote>\n\n\n\n<p>Registrar el certificado en Apache en \/etc\/apache2\/sites-enabled\/default-ssl.conf<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>SSLEngine on<br>SSLProtocol -all +TLSv1.2 +TLSv1.3<br>SSLCertificateFile \/etc\/letsencrypt\/live\/<em>[nombre_de_mi_domain]<\/em>\/fullchain.pem<br>SSLCertificateKeyFile \/etc\/letsencrypt\/live\/<em>[nombre_de_mi_domain]<\/em>\/privkey.pem<\/p><\/blockquote>\n\n\n\n<p>Asegurar la configuraci\u00f3n del sitio en \/etc\/apache2\/sites-enabled\/000-default.conf<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>ServerAdmin xxxx<br>ServerName <em>[nombre_de_mi_domain]<\/em><br>DocumentRoot xxxx<br>ErrorLog<br>CustomLog<br>Redirect<\/p><\/blockquote>\n\n\n\n<p>Comprobar el score de seguridad en <a href=\"https:\/\/observatory.mozilla.org\">https:\/\/observatory.mozilla.org<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Preparar WebDAV<\/h2>\n\n\n\n<p>Crear el directorio del servidor: <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>mkdir \/var\/www\/webdav<br>mkdir \/var\/www\/DavLock<br><em>chown -R www-data:www-data \/var\/www\/<\/em>webdav<br><em>chown -R www-data:www-data \/var\/www\/<\/em>DavLock<\/p><\/blockquote>\n\n\n\n<p>Habilitar los m\u00f3dulos de apache para soportar DAV:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>a2enmod dav<br>a2enmod dav_fs<br>a2enmod auth_digest<\/p><\/blockquote>\n\n\n\n<p>Preparar el metodo de autenticaci\u00f3n, creando un fichero de contrase\u00f1a para el servicio webdav y el usuario que decidamos (username):<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-style-default is-layout-flow wp-block-quote-is-layout-flow\"><p><em>htdigest -c \/etc\/apache2\/users.password webdav <\/em>[username]<br><em>chown www-data:www-data \/etc\/apache2\/users.password<\/em><\/p><\/blockquote>\n\n\n\n<p>Adaptar la configuraci\u00f3n (\/etc\/apache2\/sites-enabled\/default-ssl.conf)<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>DavLockDB \/var\/www\/DavLock\/DavLock<br><br>&lt;Directory \/var\/www\/webdav&gt;<br>DAV On<br>AuthType Digest<br>AuthName \u00abwebdav\u00bb<br>AuthUserFile \/etc\/apache2\/users.password<br>Require valid-user<br>&lt;\/Directory&gt;<\/p><\/blockquote>\n\n\n\n<p>Reiniciar el servicio de Apache:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>systemctl restart apache2<\/p><\/blockquote>\n\n\n\n<p>Mounting y unmounting webdav en Ubuntu (es necesario tener los derechos!). Para mount se debe usar el usuario\/contrase\u00f1a de webdav<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>apt-get install davfs2<br>mkdir \/home\/thomas\/webmount<br>mount -t davfs \u00abhttps:\/\/tomspain72.ddns.net\/webdav\/\u00bb \/home\/thomas\/webmount<br>fusermount -u \/home\/thomas\/webmount<\/p><\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">IPTables<\/h2>\n\n\n\n<p>Listar las reglas existentes con n\u00ba de l\u00ednea:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>iptables -L -v &#8211;line-numbers<\/p><\/blockquote>\n\n\n\n<p>Borrar una regla en una l\u00ednea:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>iptables -D [INPUT|&#8230;] [n\u00ba de regla]<\/p><\/blockquote>\n\n\n\n<p>Insertar una nueva regla:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>iptables -I [INPUT|OUTPUT|&#8230;.] [n\u00ba de l\u00ednea] <br>ejemplo:  iptables -I INPUT 9 -s 192.168.0.0\/24 <code>-p tcp --dport 1714:1764 -j ACCEPT<\/code><\/p><\/blockquote>\n\n\n\n<p>Guardar \/ restaurar reglas:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>iptables-save &gt; \/etc\/iptables\/rules.v4<br><em>iptables-save &gt; \/etc\/iptables\/rules.v<\/em>6<\/p><\/blockquote>\n\n\n\n<p>Restaurar reglas guardadas:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>iptables-restore &lt; \/etc\/iptables\/rules.v[]<\/p><\/blockquote>\n\n\n\n<p>Servicio de iptables:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>systemctl [stop|start|restart|restart] iptables<\/p><\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Instalar Fail2ban<\/h2>\n\n\n\n<p>Guardar la configuraci\u00f3n de iptables.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>iptables-save &gt; \/etc\/iptables\/rules.v4<\/p><\/blockquote>\n\n\n\n<p>Instalar Fail2ban.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em><code>sudo apt update<\/code><br><code>sudo apt install fail2ban<\/code><\/em><\/p><\/blockquote>\n\n\n\n<p>Configurar el servicio, creando primero el fichero de configuraci\u00f3n \/etc\/fail2ban\/jail.local :<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>cp \/etc\/fail2ban\/jail.{conf,local}<\/p><\/blockquote>\n\n\n\n<p>Configurar los servicios que debe vigilar fail2ban (\/etc\/fail2ban\/jail.local):<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>sshd<br>apache<br><\/p><\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Install PHP<\/h2>\n\n\n\n<p>Adem\u00e1s del paquete <code>php<\/code>, necesitar\u00e1 <code>php-mysql<\/code>, un m\u00f3dulo PHP que permite que este se comunique con bases de datos basadas en MySQL. Tambi\u00e9n necesitar\u00e1 <code>libapache2-mod-php<\/code> para habilitar Apache para gestionar archivos PHP. Los paquetes PHP b\u00e1sicos se instalar\u00e1n autom\u00e1ticamente como dependencias.<\/p>\n\n\n\n<p>Para instalar estos paquetes, ejecute lo siguiente:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>apt install php libapache2-mod-php php-mysql<\/p><\/blockquote>\n\n\n\n<p>Configuraciones en (\/etc\/php\/7.4\/apache2\/php.ini):<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>error_log = \/var\/log\/php-scripts.log<br>extension=curl<br>extension=fileinfo<br>extension=mbstring<br>extension=exif<br>extension=mysqli<br>extension=openssl<br>extension=pdo_mysql<br>date.timezone = \u00abEurope\/Madrid\u00bb<br><br>[MySQLi]<br>mysqli.default_host = localhost<br>mysqli.default_pw = [xxx]<\/p><\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Install phpMyAdmin<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>apt install phpmyadmin php-mbstring php-zip php-gd php-json php-curl<\/p><\/blockquote>\n\n\n\n<p>Los ficheros de la aplicaci\u00f3n terminan en: <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>\/usr\/share\/phpmyadmin\/<\/p><\/blockquote>\n\n\n\n<p>Crear el directorio temporal y el fichero de configuraci\u00f3n, copiando la plantilla (\/usr\/share\/phpmyadmin\/):<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>mkdir \/usr\/share\/phpmyadmin\/tmp<br>chown root:www-data \/usr\/share\/phpmyadmin\/tmp<br>chmod 770 \/usr\/share\/phpmyadmin\/tmp<br>cp config.sample.inc.php config.sample.inc.php<br>vim config.sample.inc.php<\/p><\/blockquote>\n\n\n\n<p>Y editando los par\u00e1metros:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>$cfg[&#8216;blowfish_secret&#8217;] = [xxx]<br>$cfg[&#8216;TempDir&#8217;] = &#8216;\/usr\/share\/phpmyadmin\/tmp&#8217;;<br>$cfg[&#8216;DefaultLang&#8217;] = &#8216;en&#8217;;<\/p><\/blockquote>\n\n\n\n<p>Crear la seguridad de directorio en Apache, con el fichero y usuario:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>mkdir \/etc\/apache2\/passwordfiles<br>htpasswd -c \/etc\/apache2\/passwordfiles\/phpMyAdmin.password [nombre de usuario]<\/p><\/blockquote>\n\n\n\n<p>Configurar el directorio virtual (\/etc\/apache2\/sites-enabled\/default-ssl.conf):<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>Alias \/phpmyadmin \/usr\/share\/phpmyadmin\/<br>&lt;Directory \/usr\/share\/phpmyadmin\/&gt;<br>AuthType Basic                     <br>AuthName \u00abRestricted Content\u00bb<br>AuthUserFile \/etc\/apache2\/passwordfiles\/phpMyAdmin.password<br>Require valid-user<br>&lt;\/Directory&gt;<\/p><\/blockquote>\n\n\n\n<p>Y proteger los directorios del sistema de phpMyAdmin (\/etc\/apache2\/sites-enabled\/default-ssl.conf):<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>&lt;Directory \/usr\/share\/phpmyadmin\/templates&gt;<br>Require all denied<br>&lt;\/Directory&gt;<br>&lt;Directory \/usr\/share\/phpmyadmin\/libraries&gt;<br>Require all denied<br>&lt;\/Directory&gt;<br>&lt;Directory \/usr\/share\/phpmyadmin\/setup\/lib&gt;<br>Require all denied<br>&lt;\/Directory&gt;<\/p><\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Instalar y configurar SAMBA<\/h2>\n\n\n\n<p>Instalar el paquete b\u00e1sico:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>apt update<br>apt install samba<\/p><\/blockquote>\n\n\n\n<p>Crear un usuario de linux para gestionar el acceso a la carpeta compartida y asignarle una contrase\u00f1a de samba (no es la misma que de linux):<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>adduser [sambauser]<br>smbpasswd -a [sambauser]<\/p><\/blockquote>\n\n\n\n<p>Crear el directorio donde deben ir los ficheros. En mi caso ser\u00e1 un directorio para el servidor, con un usuario de samba para acceder desde Windows. Adem\u00e1s hay que ajustar los derechos del directorio al usuario que hemos creado.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>mkdir \/var\/samba\/sambashare -p<br>chown sambauser:sambauser \/var\/samba\/sambashare\/ -R<br>chmod 770 \/var\/samba\/sambashare -R<\/p><\/blockquote>\n\n\n\n<p>Ahora registrar el directorio en la configuraci\u00f3n de samba (\/etc\/samba\/smb.conf):<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>[sambashare]<br>comment = Samba on Ubuntu<br>path = \/var\/samba\/sambashare<br>read only = no<br>browsable = yes<\/p><\/blockquote>\n\n\n\n<p>Adem\u00e1s de alinear el grupo de trabajo al de la red de windows en el mismo fichero (\/etc\/samba\/smb.conf):<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>workgroup = WORKGROUP<\/p><\/blockquote>\n\n\n\n<p>A\u00f1adir los puertos necesarios al firewall (iptables). En este ejemplo se incluyen a partir de la linea 5 de las reglas existentes de iptables y solo se da acceso a un origen de red interna &#8216;<em>192.168.0.0\/24<\/em>&#8216;:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>sudo iptables -I INPUT 5 -s 192.168.0.0\/24 -p udp -m udp &#8211;dport 137 -j ACCEPT<br>sudo iptables -I INPUT 5 -s 192.168.0.0\/24 -p udp -m udp &#8211;dport 138 -j ACCEPT<br>sudo iptables -I INPUT 5 -s 192.168.0.0\/24 -p tcp -m tcp &#8211;dport 139 -j ACCEPT<br>sudo iptables -I INPUT 5 -s 192.168.0.0\/24 -p tcp -m tcp &#8211;dport 445 -j ACCEPT<br>iptables-save &gt; \/etc\/iptables\/rules.v4<br>systemctl restart iptables<\/p><\/blockquote>\n\n\n\n<p>Al final reiniciar el servicio:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>systemctl restart smbd<\/p><\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Compartir un nuevo directorio<\/h3>\n\n\n\n<p>Editar la configuraci\u00f3n de samba (\/etc\/samba\/smb.conf), para registrar el nuevo directorio:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>[sambashare]<\/em><br><em>comment = Samba on Ubuntu<\/em><br><em>path = \/var\/samba\/sambashare<\/em><br><em>read only = no<\/em><br><em>browsable = yes<\/em><\/p><\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Hacer que aparezca Ubuntu en el Windows 10 Network Browsing<\/h2>\n\n\n\n<p>Descargar e instalar el paquete WSDD.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>wget https:\/\/github.com\/christgau\/wsdd\/archive\/master.zip<br>unzip master.zip<br>mv wsdd-master\/src\/wsdd.py wsdd-master\/src\/wsdd<br>cp wsdd-master\/src\/wsdd \/usr\/bin<br>cp wsdd-master\/etc\/systemd\/wsdd.service \/etc\/systemd\/system<br>Abrir los puertos necesarios.<\/p><\/blockquote>\n\n\n\n<p>Adaptar la configuraci\u00f3n del servicio:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>vim \/etc\/systemd\/system\/wsdd.service<\/p><cite>systemctl daemon-reload<br>systemctl start wsdd<br>service wsdd status<br>systemctl enable wsdd<br><\/cite><\/blockquote>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>sudo iptables -I INPUT 9 -s 192.168.0.0\/24 -p udp &#8211;dport 3702 -j ACCEPT<br>sudo iptables -A OUTPUT -p udp &#8211;dport 3702 -j ACCEPT<br>sudo iptables -I INPUT 9 -s 192.168.0.0\/24 -p tcp -m tcp &#8211;dport 5357 -j ACCEPT<\/p><\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Wake on LAN<\/h2>\n\n\n\n<p>Para configurar seguir los siguientes pasos:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Activar la opci\u00f3n en el BIOS del ordenador<\/li><li>Determinar la direcci\u00f3n MAC de la tarjeta de red que deba recibir el paquete WOL<\/li><li>Activar la opci\u00f3n en el sistema operativo (windows y\/o Linux)<\/li><li>Abrir el puerto en el router y asegurar que el router transmite el paquete al PC en cuesti\u00f3n (en general puerto 9)<\/li><li>Instalar el tool en Windows\/Android\/Linux que pueda enviar un paquete WOL al PC en cuesti\u00f3n<\/li><\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Printserver para compartir la impresora<\/h2>\n\n\n\n<p>Objetivo: compartir la impresora en la red domestica<\/p>\n\n\n\n<p>Instalar CUPS y SAMBA, <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>apt-get install cups cups-pdf<br>apt-get install printer-driver-gutenprint<\/p><\/blockquote>\n\n\n\n<p>Abrir el puerto en el firewall para administrar CUPS (631) desde un explorador (en mi caso solo se permite desde la red local):<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>sudo iptables -I INPUT 9 -s 192.168.0.0\/24 -p tcp -m tcp &#8211;dport 631 -j ACCEPT<\/p><\/blockquote>\n\n\n\n<p>A\u00f1adir el usuario (linux) para gestionar las impresoras al grupo \u00ablpadmin\u00bb, que es el grupo administrativo de CUPS (en mi caso el usuario de samba). Este usuario se utilizar\u00e1 para acceder a la p\u00e1gina de administraci\u00f3n de CUPS (<a href=\"http:\/\/192.168.0.114:631\">http:\/\/192.168.0.114:631<\/a>):<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>adduser [sambauser] lpadmin<\/p><\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Instalar PI-HOLE<\/h2>\n\n\n\n<p>Importante:<\/p>\n\n\n\n<p>El servicio en ubuntu es \u00ab<em>pihole-FTL<\/em>\u00ab.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>systemctl restart pihole-FTL<\/p><\/blockquote>\n\n\n\n<p>Es necesario instalar SQLITE y activar el m\u00f3dulo PHP de SQLITE3:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>apt-get install php7.4-sqlite3<br>\/etc\/php\/7.4\/apache2\/php.ini -&gt; \u00abextension=sqlite3\u00bb<\/p><\/blockquote>\n\n\n\n<p>Para cambiar la contrase\u00f1a del admin de pi-hole:<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>El directorio www de pi-hole en Apache debe pertenecer a \u00abwww-data\u00bb y el usuario \u00abpihole\u00bb al grupo \u00abwww-data\u00bb:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>chown www-data:www-data pi_html\/ -R<br>usermod -a -G pihole www-data<\/p><\/blockquote>\n\n\n\n<p>Asegurar que los puertos de DNS est\u00e9n abiertos para el tr\u00e1fico local:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>sudo iptables -I INPUT 9 -s 192.168.0.0\/24 -p udp -m udp &#8211;dport 53 -j ACCEPT<br>sudo iptables -I INPUT 9 -s 192.168.0.0\/24 -p tcp -m tcp &#8211;dport 53 -j ACCEPT<\/p><\/blockquote>\n\n\n\n<p>Comprobar que no se use otro nameserver que el pi-hole local:<\/p>\n\n\n\n<p>\/etc\/resolv.conf<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Renovar Certificados (Apache y Tomcat)<\/h2>\n\n\n\n<p>Con sudo o con usuario root, primero parar Apache service y despues renovar mediante el cerbot:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>systemctl stop apache2<br>certbot renew<br>systemctl start apache2<\/p><\/blockquote>\n\n\n\n<p>Ahora actualizar los certificados en Tomcats:<br><br>Asegurar que la configuraci\u00f3n en el fichero \u00ab\/etc\/tomcat9\/server.xml\u00bb es correcta:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>&lt;Connector port=\u00bb8443&#8243; protocol=\u00bborg.apache.coyote.http11.Http11NioProtocol\u00bb     maxThreads=\u00bb150&#8243; SSLEnabled=\u00bbtrue\u00bb &gt; <br>&lt;SSLHostConfig&gt;<br>&lt;Certificate <br>certificateFile=\u00bb\/etc\/tomcat9\/certs\/cert.pem\u00bb<br>certificateKeyFile=\u00bb\/etc\/tomcat9\/certs\/privkey.pem\u00bb<br>certificateChainFile=\u00bb\/etc\/tomcat9\/certs\/chain.pem\u00bb \/&gt;<br>&lt;\/SSLHostConfig&gt;<br>&lt;\/Connector&gt;<\/p><\/blockquote>\n\n\n\n<p>Despues copiar los ficheros de certicado de Let&#8217;s Encryp a la configuraci\u00f3n de Tomcat y reiniciar el servicio.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>rm \/etc\/tomcat9\/certs\/*<br>cd \/etc\/letsencrypt\/live\/thomaskoslowsky.com<br>cp {cert,chain,privkey}.pem \/etc\/tomcat9\/certs<br>chown tomcat:tomcat \/etc\/tomcat9\/certs\/*<br>systemctl restart tomcat9<\/p><\/blockquote>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Despu\u00e9s de la instalaci\u00f3n inicial: 1. Asegurar una contrase\u00f1a fuerte para el usuario principal y para root passwd root 2. Configurar el DNS: (\/etc\/resolv.conf) nameserver 8.8.8.8nameserver 8.8.4.4 3. Asegurar que root no puede hacer login via ssh (\/etc\/ssh\/sshd_config): PermitRootLogin = noAllowUsers [myuser]SyslogFacility AUTHLogLevel INFO 4. Comprobar las reglas de la firewall (en mi caso utilizando [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"site-sidebar-layout":"default","site-content-layout":"default","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"class_list":["post-105","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/thomaskoslowsky.com\/es\/index.php\/wp-json\/wp\/v2\/pages\/105","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thomaskoslowsky.com\/es\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/thomaskoslowsky.com\/es\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/thomaskoslowsky.com\/es\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thomaskoslowsky.com\/es\/index.php\/wp-json\/wp\/v2\/comments?post=105"}],"version-history":[{"count":40,"href":"https:\/\/thomaskoslowsky.com\/es\/index.php\/wp-json\/wp\/v2\/pages\/105\/revisions"}],"predecessor-version":[{"id":259,"href":"https:\/\/thomaskoslowsky.com\/es\/index.php\/wp-json\/wp\/v2\/pages\/105\/revisions\/259"}],"wp:attachment":[{"href":"https:\/\/thomaskoslowsky.com\/es\/index.php\/wp-json\/wp\/v2\/media?parent=105"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}