00-Initial Setup
------------------------------------------------
Installation
Setup a basic Ubuntu Server machine with no extras

Increase the history file size
# vi ~/.bashrc
HISTSIZE=10000
HISTFILESIZE=20000
 
# sudo su 
(note: all commands below, noted with the '#' prompt,  are performed with super user permissions.
use the 'sudo su' command to switch to the super user 
Be sure to use the 'exit' command after you are finished)
# vi ~/.bashrc
HISTSIZE=10000
HISTFILESIZE=20000
 
Set the machine name
# vi /etc/hostname
ubuntutest

# vi /etc/hosts
127.0.0.1 ubuntutest

Get updates
# apt-get update
# apt-get -y upgrade
# apt-get -y dist-upgrade
# apt-get -y autoremove

Get a few utilities
# apt-get install -y vim unzip
 
Install and Secure SSH
# apt-get install -y openssh-server openssh-client
# ufw allow 22
# addgroup --system --gid 19442 sshusers
# usermod -G sshusers -a <admin user account> 
# vi /etc/ssh/sshd_config
AllowGroups sshusers

# reboot

Set up Multi-Factor Authentication
https://www.digitalocean.com/community/tutorials/how-to-set-up-multi-factor-authentication-for-ssh-on-ubuntu-16-04
# apt-get install -y libpam-google-authenticator 
# exit   (exit super user mode)
$ google-authenticator

https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/brose@ubuntutest%3Fsecret%3DYSY7LC2BP73BOZJT

Your new secret key is: YSY7LC2BP73BOZJT
Your verification code is 454571
Your emergency scratch codes are:
  93925119
  93621537
  12369406
  41173439
  78222078

$ sudo su
# vim /etc/pam.d/sshd

auth required pam_google_authenticator.so (add to the beginning of the file)

# vim /etc/ssh/sshd_config
ChallengeResponseAuthentication yes    (change from 'no') 

Add a new user
# adduser <newuser>
# su <newuser>
$ cd ~
$ google-authenticator  (yes to all ). 

Your new secret key is: LRWCJDRTCUC63O5E
Your verification code is 526629
Your emergency scratch codes are:
  55886427
  93410111
  78009716
  88769345
  84888823
$ (Capture and copy a screenshot to the file  ~/.google-authenticator.gif Zip it up with encryption, and send it to the user.)
$ exit

For Admins
# usermod -aG sudo <newuser>
# usermod -G sshusers -a <newuser>

01-LAMP/HTTPS
------------------------------------------------
https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-apache-in-ubuntu-16-04

# apt-get update
# apt-get install -y apache2 mysql-server php libapache2-mod-php php-mcrypt php-mysql php-ldap php-gettext php-xml
# vim /etc/apache2/apache2.conf
ServerName ubuntutest   (Place it in the Global Configuration section)

# vim /etc/apache2/mods-enabled/dir.conf       (move index.php to the front)
<IfModule mod_dir.c>
    DirectoryIndex index.php index.html index.cgi index.pl index.xhtml index.htm
</IfModule>
# vim /var/www/html/php-info.php
<?php
phpinfo();
?>
# chown www-data:www-data /var/www/html/php-info.php
# ufw allow "Apache"

(in Windows) Edit - C:\Windows\System32\drivers\etc\hosts
192.168.11.130		ubuntutest

Test - http://collabcloud/
	http://collabcloud/php-info.php

# mysql_secure_installation
Enter password for user root: password
VALIDATE PASSWORD PLUGIN ? yes
Change the password for root ? yes/no  (MySQL root password = MySQLpassword42!)
Remove anonymous users? yes
Disallow root login remotely? yes
Remove test database and access to it? yes 
Reload privilege tables now? yes

# openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/apache-selfsigned.key -out /etc/ssl/certs/apache-selfsigned.crt
Country Name (2 letter code) [AU]: US
State or Province Name (full name) [Some-State]: New York
Locality Name (eg, city) []: New York City
Organization Name (eg, company) [Internet Widgits Pty Ltd]: My Organization
Organizational Unit Name (eg, section) []: MyOrg
Common Name (e.g. server FQDN or YOUR name) []: ubuntutest
Email Address []: admin@your_domain.com

# openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048
# vim /etc/apache2/conf-available/ssl-params.conf
# from https://cipherli.st/
# and https://raymii.org/s/tutorials/Strong_SSL_Security_On_Apache2.html

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On

# Disable preloading HSTS for now.  You can use the commented out header line that includes
# the "preload" directive if you understand the implications.
# (remove preload) Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains"
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff
# Requires Apache >= 2.4
SSLCompression off 
SSLSessionTickets Off
SSLUseStapling on 
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"

SSLOpenSSLConfCmd DHParameters "/etc/ssl/certs/dhparam.pem"

# cp /etc/apache2/sites-available/default-ssl.conf /etc/apache2/sites-available/default-ssl.conf.bak
# vim /etc/apache2/sites-available/default-ssl.conf
<IfModule mod_ssl.c>
        <VirtualHost _default_:443>
                ServerAdmin admin@yourdomain.com
                ServerName ubuntutest

                DocumentRoot /var/www/html

                ErrorLog ${APACHE_LOG_DIR}/error.log
                CustomLog ${APACHE_LOG_DIR}/access.log combined

                SSLEngine on

                SSLCertificateFile      /etc/ssl/certs/apache-selfsigned.crt
                SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned.key

                <FilesMatch "\.(cgi|shtml|phtml|php)$">
                                SSLOptions +StdEnvVars
                </FilesMatch>
                <Directory /usr/lib/cgi-bin>
                                SSLOptions +StdEnvVars
                </Directory>

                BrowserMatch "MSIE [2-6]" \
                               nokeepalive ssl-unclean-shutdown \
                               downgrade-1.0 force-response-1.0

        </VirtualHost>
</IfModule>

#  vim /etc/apache2/sites-available/000-default.conf
<VirtualHost *:80>
        Redirect "/" "https://ubuntutest/"

        <leave all other items intact>
</VirtualHost>

# a2enmod ssl headers
# a2ensite default-ssl
# a2enconf ssl-params
# apache2ctl configtest
# ufw allow in "Apache Secure"
# systemctl restart apache2

Test it out

http://ubuntutest/  <should not connect - to allow this    ufw allow in "Apache" >

https://ubuntutest/ 

https://ubuntutest/php-info.php

02-LDAP
------------------------------------------------
Ref: https://help.ubuntu.com/lts/serverguide/openldap-server.html#openldap-tls

Download the tools
# apt-get -f install

(add -d flag to download only)
# apt-get install -y apache2 slapd ldap-utils gnutls-bin ssl-cert

SLAPD - LDAP Server
# dpkg-reconfigure slapd
	• 'No' for omit OpenLDAP configuration
	• 'ubuntutest' for DNS Domain name
	• 'test' for Organization name
	• <admin password> e.g LDAPpassword42!
	• BDB database       BDB is more flexible for backing up
	• 'Yes' to remove database when purged
	• 'Yes' to move old database
	• 'No' to allow LDAP2
	
Test it out
# ldapsearch -x -LLL -H ldap:/// -b dc=ubuntutest dn
	
	dn: dc=ubuntutest
	
	dn: cn=admin,dc=ubuntutest

TLS

# sh -c "certtool --generate-privkey > /etc/ssl/private/cakey.pem"
# vim /etc/ssl/ca.info
cn = Test
ca
cert_signing_key
# certtool --generate-self-signed --load-privkey /etc/ssl/private/cakey.pem --template /etc/ssl/ca.info --outfile /etc/ssl/certs/cacert.pem
# hostname -f
ubuntutest   <--  this is the fully qualified domain name FQDN of this system
# certtool --generate-privkey --bits 1024 --outfile /etc/ssl/private/ubuntutest_slapd_key.pem
# vim /etc/ssl/ubuntutest.info
organization = My Organization
cn = ubuntutest
tls_www_server
encryption_key
signing_key
expiration_days = 3650
# certtool --generate-certificate --load-privkey /etc/ssl/private/ubuntutest_slapd_key.pem --load-ca-certificate /etc/ssl/certs/cacert.pem --load-ca-privkey /etc/ssl/private/cakey.pem --template /etc/ssl/ubuntutest.info --outfile /etc/ssl/certs/ubuntutest_slapd_cert.pem
# chgrp openldap /etc/ssl/private/ubuntutest_slapd_key.pem
# chmod 0640 /etc/ssl/private/ubuntutest_slapd_key.pem
# gpasswd -a openldap ssl-cert
# systemctl restart slapd.service
# vim certinfo.ldif
dn: cn=config
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ssl/certs/ubuntutest_slapd_cert.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ssl/private/ubuntutest_slapd_key.pem
# ldapmodify -Y EXTERNAL -H ldapi:/// -f certinfo.ldif
# ufw allow 389

Test it out
# LDAPTLS_REQCERT=never ldapsearch -D "cn=admin,dc=ubuntutest" -W -p 389 -h ubuntutest -b "dc=ubuntutest" -s sub -x -ZZ "(objectclass=*)"

02-LDAP
------------------------------------------------
                  Snapshot in : UbuntuTest_02_LDAP.zip
------------------------------------------------

Import Backup Data

# ldapmodify -a -c -D cn=admin,dc=ubuntutest -W -f ubuntuserver.ldif
Enter LDAP Password: LDAPpassword42!

Setup Redmine
http://www.redmine.org/boards/2/topics/51779 

# apt-get install -y software-properties-common
# add-apt-repository ppa:brightbox/ruby-ng
# apt-get update
# apt-get install -y ruby ruby-switch ruby-dev ri libruby libssl-dev zlib1g-dev apache2 libapache2-mod-passenger libapache2-mod-perl2 libcurl4-openssl-dev libssl-dev libapr1-dev libaprutil1-dev libmagickcore-dev libmagickwand-dev curl git-core patch build-essential bison zlib1g-dev libssl-dev libxml2-dev libxml2-dev sqlite3 libsqlite3-dev autotools-dev libxslt1-dev libyaml-0-2 autoconf automake libreadline6-dev libyaml-dev libtool imagemagick apache2-utils ssh zip libicu-dev libssh2-1 libssh2-1-dev cmake libgpg-error-dev subversion libapache2-svn ruby-dev imagemagick libapache2-mod-passenger libpq-dev postgresql postgresql-contrib

# adduser --system --shell /bin/bash --gecos 'Redmine Administrator' --group --home /home/redmineuser redmineuser
# passwd redmineuser
Enter new UNIX password: RMpassword42!
# usermod -aG sudo redmineuser
# visudo      (To save press CTRL+O , then press ENTER, then CTRL+X to exit)

# temp - *REMOVE* after installation
redmineuser    ALL=(ALL)      NOPASSWD:ALL 

# sudo gem update
# sudo gem install bundler pg

Perform these actions as a regular user.

# su - redmineuser

Test it out
$ sudo ls -la /root
drwx------  3 root root 4096 Mar 20 14:14 .
drwxr-xr-x 22 root root 4096 Mar 14 11:48 ..
-rw-------  1 root root 3315 Mar 15 09:53 .bash_history
-rw-r--r--  1 root root 3108 Mar 14 12:02 .bashrc
drwxr-xr-x  2 root root 4096 Mar 20 14:14 .nano
-rw-r--r--  1 root root  148 Aug 17  2015 .profile
-rw-------  1 root root 1024 Mar 15 05:45 .rnd
-rw-------  1 root root 5302 Mar 15 07:18 .viminfo

Get Redmine and the files from the original server

$ wget http://www.redmine.org/releases/redmine-3.4.4.tar.gz
$ scp root@originalserver:/data/backups/postgres_backup.sql .
$ scp root@originalserver:/data/backups/redmine_files.tar .

------------------------------------------------
                  Snapshot in : UbuntuTest_03_Redmine-ERAPSCO.zip
------------------------------------------------

$ sed -i 's/redmine_app_sel/redminedbuser/g' /home/redmineuser/postgres_backup.sql
$ sed -i 's/redmine_app/redminedbuser/g' /home/redmineuser/postgres_backup.sql
$ sed -i 's/originalserver/ubuntutest/g' /home/redmineuser/postgres_backup.sql
$ exit
$ sudo -u postgres psql < /home/redmineuser/postgres_backup.sql

The original server may have some different user names or database names. Change them to match our new server.

$ sudo -u postgres psql
postgres=# ALTER USER redminedbuser ENCRYPTED PASSWORD 'PGSQLpassword42!';
postgres=# ALTER ROLE "redminedbuser" WITH LOGIN;
postgres=# ALTER DATABASE redmine RENAME TO redminedb;
postgres=# ALTER DATABASE redminedb OWNER TO redminedbuser;
postgres=# GRANT ALL PRIVILEGES ON DATABASE redminedb TO redminedbuser;

Check the Database
postgres=# \list
                                         List of databases
   Name    |     Owner     | Encoding |   Collate   |    Ctype    |        Access privileges
-----------+---------------+----------+-------------+-------------+---------------------------------
 bugs      | bugs          | UTF8     | en_US.UTF-8 | en_US.UTF-8 |
 postgres  | postgres      | UTF8     | en_US.UTF-8 | en_US.UTF-8 |
 redminedb | redminedbuser | UTF8     | en_US.UTF-8 | en_US.UTF-8 | =Tc/redminedbuser              +
           |               |          |             |             | redminedbuser=CTc/redminedbuser
 template0 | postgres      | UTF8     | en_US.UTF-8 | en_US.UTF-8 | =c/postgres                    +
           |               |          |             |             | postgres=CTc/postgres
 template1 | postgres      | UTF8     | en_US.UTF-8 | en_US.UTF-8 | postgres=CTc/postgres          +
           |               |          |             |             | =c/postgres
(5 rows)

postgres=# \du
                                        List of roles
   Role name   |                         Attributes                         |    Member of
---------------+------------------------------------------------------------+-----------------
 alexdubois    |                                                            | {redminedbuser}
 brianrose     |                                                            | {redminedbuser}
 bugs          | Create DB                                                  | {}
 postgres      | Superuser, Create role, Create DB, Replication, Bypass RLS | {}
 redminedbuser | Password valid until infinity                              | {}

postgres=# \q

Test the Database connection
$ sudo -u postgres psql -U redminedbuser -d redminedb -h localhost
Password for user redminedbuser: PGSQLpassword42!
psql (9.5.12)
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)
Type "help" for help.

redminedb=> \q

Install Redmine (as redmine user – “sudo su – redmineuser” )
$ tar zxf redmine-3.4.4.tar.gz
$ cd /home/redmineuser/redmine-3.4.4
$ mkdir -p tmp tmp/pdf public/plugin_assets
$ chmod -R 755 files log tmp public/plugin_assets

$ cp /home/redmineuser/redmine-3.4.4/config/database.yml.example /home/redmineuser/redmine-3.4.4/config/database.yml

$ vi /home/redmineuser/redmine-3.4.4/config/database.yml
<comment everything else out with a # at the front of the line.

      production:
      adapter: postgresql
      database: redminedb
      host: localhost
      port:
      username: redminedbuser 
      password: PGSQLpassword42!
      encoding: utf8 
      schema_search_path: public

$ bundle install --without development test
  Password: RMpassword42!
$ bundle exec rake generate_secret_token
$ RAILS_ENV=production bundle exec rake db:migrate
$ RAILS_ENV=production bundle exec rake redmine:load_default_data
$ exit

Configure Apache

$ sudo vi /etc/apache2/mods-available/passenger.conf    (Add Bold line)
<IfModule mod_passenger.c>
  PassengerDefaultUser redmineuser
  PassengerRoot /usr
  PassengerRuby /usr/bin/ruby
</IfModule>

$ sudo ln -s /home/redmineuser/redmine-3.4.4/public /var/www/html/redmine
$ sudo vi /etc/apache2/sites-available/default-ssl.conf (Add below other Directory statements)
<Directory /var/www/html/redmine>
    RailsBaseURI /redmine
    PassengerResolveSymlinksInDocumentRoot on
</Directory>

$ sudo touch /home/redmineuser/redmine-3.4.4/Gemfile.lock
$ sudo chown redmineuser:redmineuser /home/redmineuser/redmine-3.4.4/Gemfile.lock
$ sudo service apache2 restart

Configure Redmine
https://ubuntutest/redmine/

Log in with admin REDMINEpassword42!  (this is the admin user stored in the DB)

Setup LDAP Authentication
	1. Login as administrator
	2. Go to Administration tab
	3. Click on LDAP Authentication (on the right bar)
	4. Add Authentication Mode
		a. Name: LDAP local
		b. Host: localhost
		c. Port: 389
		d. LDAPS: checked
		e. Account: uid=app_redmine_svn_testserver_dls_eng,ou=users,dc=ubuntutest
            f. Password: 9aa85609ccb659f3057af69cc76cc8b1
		g. Base BN: ou=users,dc=ubuntutest
		h. LDAP Filter: 
		i. Timeout:
		j. On-the-fly user creation: <checked>
		k. Login Attribute: uid
		l. Firstname Attribute: givenName
		m. Lastname Attribute: sn
		n. Email Attribute: mail
		
Configure Redmine
1.	Administration…Settings…Display
	a. Enable "Display attachment thumbnails"
	b. Thumbnails size (in pixels) : 300
Administration…Settings…Authentication
	a. Enable "Authentication Required"
	b. Disable "Allow users to delete their own account"