Project

General

Profile

Redmine 203 with Subversion and LDAP Authentication (for Redmine and Subversion through Redmine) on Centos 6 i386 - detailed » History » Version 19

Hung Nguyen Vu, 2012-08-30 17:41
Note on remote mysql setting

1 7 Hung Nguyen Vu
h1. Redmine 2.0.3 on Centos 6.3
2 2 Sven Nosse
3
{{>toc}}
4
5
h2. Introduction
6
7 6 Hung Nguyen Vu
Our company was using the BITNAMI stack with Redmine and Subversion for our production environment. So the goal was about changing the server and migrating the data from Redmine 1.4 to Redmine 2.0.3 including getting all repositories and permissions preserved. 
8 1 Sven Nosse
9 6 Hung Nguyen Vu
I've tried to avoid webrick but rather use the fastCGI Module for Apache2. 
10
11
12
Second was converting the built-in accounts from the database to LDAP (ActiveDirectory). This is the result of 2 days of work and googling is this little tutorial for setting up a mentioned box doing exactly this stuff. We are using CentOS 6 (i386) for that task. 
13
14
# Please excuse my bad english for I am not used anymore to post long instruction manuals. Feel free to edit whatever you want. 
15
16
First of all, I tend to use vi so if you cannot operate vi I'd recommend to use any editor you like. If my instruction tells you to edit a file, you can find the sequence "..." which means, there is something above or below that line of text, that needs to be edited. Do not include those dots... 
17
18 1 Sven Nosse
h2. Assumptions
19
20 2 Sven Nosse
* You have a CentOS 6.3 installation (minimum install) working and SSH access to your box
21 6 Hung Nguyen Vu
* You can access the Internet
22
* You are logged in as root
23 1 Sven Nosse
24 6 Hung Nguyen Vu
h2. Redmine Installation Instruction
25 2 Sven Nosse
26
My personal flavour is to use as less self compiled packages as necessary to get the package up and runnning. So I try to use as many repository packages as possible.
27
28 6 Hung Nguyen Vu
h3. Turn off SE-Linux
29 3 Sven Nosse
30 6 Hung Nguyen Vu
I spent a lot of time to find out, that selinux can be a real party pooper. So I strongly recommend to disable that first before installing anything else. You can find a tutorial inside the howto section describing how to enable SELinux for your installation.
31 2 Sven Nosse
<pre>
32
vi /etc/selinux/config
33
</pre>
34
35 1 Sven Nosse
find the line with SELINUX and set it to
36 2 Sven Nosse
<pre>
37
...
38
SELINUX=disabled
39
...
40
</pre>
41
Do a reboot *NOW*
42
43 6 Hung Nguyen Vu
h3. Install basic services (Apache, mySQL, and several tools...)
44 2 Sven Nosse
45 9 Hung Nguyen Vu
Now we are good to go to install some tools that might be useful during our installation... 
46
47
First of all, update your system, make sure it is up to date,
48 1 Sven Nosse
<pre>
49
yum update
50 9 Hung Nguyen Vu
</pre>
51
52
and then install some prerequisite packages to the setup,
53
<pre>
54
yum -y install wget vim \\
55
       system-config-network system-config-firewall vim openssh-clients
56
</pre>
57
58
anhd some packages needed for Redmine
59
<pre>
60 2 Sven Nosse
yum -y install httpd mysql mysql-server 
61 1 Sven Nosse
</pre>
62 2 Sven Nosse
After that continue and install all packages that might be necessary during the ruby and redmine installation.
63
<pre>
64
yum -y install ruby rubygems 
65 6 Hung Nguyen Vu
yum -y install zlib-devel curl-devel openssl-devel httpd-devel apr-devel apr-util-devel mysql-devel gcc ruby-devel \\
66
      gcc-c++ make postgresql-devel ImageMagick-devel sqlite-devel perl-LDAP mod_perl perl-Digest-SHA
67 2 Sven Nosse
</pre>
68
69
h3. Configure basic services
70
71 6 Hung Nguyen Vu
Let's configure the basic services, first of all, make mySQL and Apache to start at boot
72 2 Sven Nosse
<pre>
73 18 Hung Nguyen Vu
chkconfig httpd on --level 35
74
chkconfig mysqld on --level 35
75 2 Sven Nosse
</pre>
76
After configuring these, start them up
77
<pre>
78
service httpd start
79
service mysqld start
80
</pre>
81 18 Hung Nguyen Vu
Now configure your new mySQL Installation and follow the instructions. Please note/write down administrator password to MySQL you've just installed.
82 2 Sven Nosse
<pre>
83
/usr/bin/mysql_secure_installation
84
</pre>
85
86
h3. Configure passenger for Apache
87
88
You need to install passenger for Apache using gem. Do the following on the command line
89
<pre>
90
gem install passenger
91
passenger-install-apache2-module
92
</pre>
93
Please notice the installation messages! The next .conf file might use another path or version! 
94
After this you need to generate a conf file with the displayed content
95
<pre>
96
vi /etc/httpd/conf.d/ruby.conf
97
</pre>
98
During my installation the following content was displayed and needs to be entered in that file:
99
<pre>
100
   LoadModule passenger_module /usr/lib/ruby/gems/1.8/gems/passenger-3.0.15/ext/apache2/mod_passenger.so
101
   PassengerRoot /usr/lib/ruby/gems/1.8/gems/passenger-3.0.15
102
   PassengerRuby /usr/bin/ruby
103
</pre>
104
Restart your apache with
105
<pre>
106
service httpd restart
107
</pre>
108
109 1 Sven Nosse
h3. Get Redmine and install it
110
111
change to your home directory and download the latest version, expand it and copy it to the right place.
112
<pre>
113
cd
114
wget http://rubyforge.org/frs/download.php/76259/redmine-2.0.3.tar.gz
115
tar xvfz redmine-2.0.3.tar.gz
116 11 Hung Nguyen Vu
mkdir -p /var/www/redmine
117 12 Hung Nguyen Vu
cp redmine-2.0.3/* /var/www/redmine
118 1 Sven Nosse
</pre>
119 6 Hung Nguyen Vu
120
or you can do
121
122
<pre>
123
cd /var/www
124
wget http://rubyforge.org/frs/download.php/76259/redmine-2.0.3.tar.gz
125
tar xvfz redmine-2.0.3.tar.gz
126
ln -s redmine-2.0 redmine
127
</pre>
128
129 1 Sven Nosse
Next is to install bundler and let it install the production environment (with automatic resolve)
130
Now change to this directory - *this is your new Redmine application directory!*
131 2 Sven Nosse
<pre>
132
cd /var/www/redmine
133
gem install bundler
134
bundle install --without development test
135 1 Sven Nosse
</pre>
136 10 Hung Nguyen Vu
fetch some coffee... this might take some time...
137 2 Sven Nosse
138
h3. Create Redmine database
139
140 6 Hung Nguyen Vu
Next to generate a new database for redmine
141 14 Sven Nosse
Log on to your database with the following command. If prompted for a password, enter it.
142 2 Sven Nosse
<pre>
143
mysql -u root -p
144
</pre>
145
I tend to create a local only user for that database, change the password 'very_secret' to a better one :)
146
<pre>
147
create database redmine character set utf8;
148
create user 'redmine'@'localhost' identified by 'very_secret';
149
grant all privileges on redmine.* to 'redmine'@'localhost'; 
150
quit;
151
</pre>
152
153 19 Hung Nguyen Vu
Note: If you are going to store Redmine's database to a machine that is not the server you are going to install Redmine - whose IP address is 192.168.10.100, the settings should be: 
154
<pre>
155
create database redmine character set utf8;
156
create user 'redmine'@'192.168.10.100' identified by 'very_secret';
157
grant all privileges on redmine.* to 'redmine'@'192.168.10.100'; 
158
quit;
159
</pre>
160
161
162 2 Sven Nosse
h3. Configure Redmine
163
164
First of all, copy the example config to a productive one and edit the config for your needs
165
<pre>
166
cd /var/www/redmine/config
167
cp database.yml.example database.yml
168
vi /var/www/redmine/config/database.yml
169
</pre>
170
Now find the production section inside this file and edit it like that
171
<pre>
172
...
173
production:
174 13 Hung Nguyen Vu
# adapter = mysql2 is newer and proven to be more better than mysql
175
# adapter: mysql2
176 2 Sven Nosse
  adapter: mysql
177
  database: redmine
178
  host: localhost
179
  username: redmine
180
  password: very_secret
181
  encoding: utf8
182
...
183
</pre>
184
Head back to your application directory and generate a secret token
185
<pre>
186
cd /var/www/redmine/
187
rake generate_secret_token
188
</pre>
189 1 Sven Nosse
Now it is about time to generate the database structure (application directory!)
190
<pre>
191 2 Sven Nosse
cd /var/www/redmine/
192
RAILS_ENV=production rake db:migrate
193
</pre>
194
fill the database with default values...
195 1 Sven Nosse
<pre>
196 2 Sven Nosse
cd /var/www/redmine/
197
RAILS_ENV=production rake redmine:load_default_data
198
</pre>
199
follow the instructions to select your language.
200
201 6 Hung Nguyen Vu
h3. Mind the firewall!
202 2 Sven Nosse
203 6 Hung Nguyen Vu
Be aware that the firewall is enabled by default (which is good!). So if you know which ports to open, do it now or disable the firewall (just for testing purposes). I'd really recommend disabling the firewall during installation and enable it (opening ports) after you are sure that everything works.
204 1 Sven Nosse
<pre>
205 2 Sven Nosse
system-config-firewall
206
</pre>
207
use the onscreen menu to disable it or adjust the values.
208
209 8 Hung Nguyen Vu
or simply disable iptables during Redmine's setup
210
<pre>
211
service iptables stop
212
</pre>
213
214 6 Hung Nguyen Vu
h3. Do a testdrive!
215 2 Sven Nosse
216
I mentioned that I wanted not to use webrick, but for a testdrive, it'll work. This helps finding bugs and errors that might have occured before.
217
<pre>
218
cd /var/www/redmine/
219
ruby script/rails server webrick -e production
220
</pre>
221
Open up a browser and point it to: http://yoursystemname.yourdomain.com:3000 - the default username and password is 'admin'.
222
If everything is working, you are good to go! Kill webrick by hitting Ctrl+C.
223
224 6 Hung Nguyen Vu
h3. Activate FCGI and generate plugin directory
225 2 Sven Nosse
226
To activate the fcgi module you need to copy the example file and edit the very first line. During this step it is recommended to generate the default .htaccess config as well.
227
<pre>
228
cd /var/www/redmine/public
229
mkdir plugin_assets
230
cp dispatch.fcgi.example dispatch.fcgi
231
cp htaccess.fcgi.example .htaccess
232 1 Sven Nosse
vi /var/www/redmine/public/dispatch.fcgi
233
</pre>
234 2 Sven Nosse
now edit dispatch.fcgi and change it like this...
235
<pre>
236
#!/usr/bin/ruby
237
...
238
</pre>
239
240
h3. Apache permissions!
241
242
this one is important, so don't miss that one... 
243 1 Sven Nosse
<pre>
244 2 Sven Nosse
chown -R apache:apache /var/www/redmine/
245 1 Sven Nosse
</pre>
246 2 Sven Nosse
247 6 Hung Nguyen Vu
Note: "apache" is the user that runs httpd (apache) service, as defined in /etc/password and /etc/httpd/conf/httpd.conf 
248
249 2 Sven Nosse
h3. Getting Apache to work with FastCGI
250
251
Unfortunately the default Repo from CentOS cannot deliver the fcgid module so it is important to include a replo, that can deliver this package. I use the Fedora Repo so it is time to activate this... Again - this can change so please take care which repository to use.
252
<pre>
253
rpm --import https://fedoraproject.org/static/0608B895.txt
254
wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-7.noarch.rpm
255
rpm -ivh epel-release-6-7.noarch.rpm
256
yum -y install mod_fcgid
257
</pre>
258
259 6 Hung Nguyen Vu
h3. Set the file path for Redmine
260 2 Sven Nosse
261
I wanted to move the files to another location, so I decided to move them to /opt/redmine
262
<pre>
263 6 Hung Nguyen Vu
mkdir -p /opt/redmine/files
264 2 Sven Nosse
chown -R apache:apache /opt/redmine
265
</pre>
266
now edit the configuration
267
<pre>
268
cd /var/www/redmine/config
269
cp configuration.yml.example configuration.yml
270
vi /var/www/redmine/config/configuration.yml
271
</pre>
272
edit the path settings inside this file...
273
<pre>
274
...
275
  attachments_storage_path: /opt/redmine/files
276
...
277
</pre>
278
279
h3. Telling Apache to serve REDMINE
280
281
The final step is to tell apache, where to find Redmine and what to do with it. Generate a new conf file for your virtual host to serve redmine...
282
<pre>
283
vi /etc/httpd/conf.d/redmine.conf
284
</pre>
285
and enter the following config (adjust to your needs ;) )
286
<pre>
287
<VirtualHost *:80>
288
        ServerName yoursystemname.yourdomain.com
289
        ServerAdmin yourmail@yourdomain.com
290
        DocumentRoot /var/www/redmine/public/
291
        ErrorLog logs/redmine_error_log
292
293
        MaxRequestLen 20971520
294
295
        <Directory "/var/www/redmine/public/">
296
297
                Options Indexes ExecCGI FollowSymLinks
298
                Order allow,deny
299
                Allow from all
300
                AllowOverride all
301
        </Directory>
302
</VirtualHost>
303
</pre>
304
Restart Apache and cross your fingers, wheter you can access http://yoursystemname.yourdomain.com - redmine should be available right now...
305
<pre>
306
service httpd restart
307
</pre>
308
309
h3. Additional Config: E-Mail System
310
311 1 Sven Nosse
in order to get emails sent to your clients, edit the configuration.yml and enter your server settings...
312
<pre>
313
vi /var/www/redmine/config/configuration.yml
314
</pre>
315
now find the settings for your server... the following settings describe an anonymous relay on an internal server. You need to remove the username and password line if you use anonymous sign on.
316
<pre>
317
...
318
default:
319
  # Outgoing emails configuration (see examples above)
320
  email_delivery:
321
    delivery_method: :smtp
322
    smtp_settings:
323
      address: mailserver.yourdomain.com
324
      port: 25
325
      domain: yourdomain.com
326
...
327
</pre>
328
329 6 Hung Nguyen Vu
Here is the configration if you use Google's SMTP server
330
331
<pre>
332
production:
333
  email_delivery:
334
    delivery_method: :smtp
335
    smtp_settings:
336
#      tls: true
337
      enable_starttls_auto: true
338
      address: "smtp.gmail.com"
339
      port: '587'
340
      domain: "smtp.gmail.com"
341
      authentication: :plain
342
      user_name: "google-account-name@domain-name.domain-extension"
343
      password: "password"
344
</pre>
345
346 1 Sven Nosse
h2. Getting Subversion working
347 2 Sven Nosse
348
After getting Redmine working, it is time to get Subversion working... The goal is to integrate the repositories inside Redmine and host them on the same server...
349
350
h3. Installing Packages for Subversion
351
352
Install the following packages
353 1 Sven Nosse
<pre>
354 2 Sven Nosse
yum -y install mod_dav_svn subversion subversion-ruby
355
</pre>
356
357
h3. Linking authentication for Redmine
358
359
Redmine provides a perl module to handle Apache authentication on SVN DAV repositories. First step is to link that module into the search path
360
<pre>
361
mkdir /usr/lib/perl5/vendor_perl/Apache
362
ln -s /var/www/redmine/extra/svn/Redmine.pm /usr/lib/perl5/vendor_perl/Apache/Redmine.pm
363
</pre>
364
365 16 Sven Nosse
h3. Creating a path for subversion repositories
366 2 Sven Nosse
367
create a path and set permissions for your SVN repo...
368
<pre>
369
mkdir /opt/subversion
370
chown -R apache:apache /opt/subversion
371
</pre>
372
373 6 Hung Nguyen Vu
h3. Edit virtual host for apache to serve SVN with redmine
374 2 Sven Nosse
375
to get Apache working with subversion, you need to adjust (create) the virtual host file
376
<pre>
377
vi /etc/httpd/conf.d/subversion.conf
378
</pre>
379
now enter/edit the following
380
<pre>
381
PerlLoadModule Apache::Redmine
382
<Location /svn>
383
        DAV svn
384
        SVNParentPath "/opt/subversion"
385
        SVNListParentPath on
386
        Order deny,allow
387
        Deny from all
388
        Satisfy any
389
        LimitXMLRequestBody 0
390
        SVNPathAuthz off
391
392
        PerlAccessHandler Apache::Authn::Redmine::access_handler
393
        PerlAuthenHandler Apache::Authn::Redmine::authen_handler
394
        AuthType Basic
395
        AuthName "Redmine SVN Repository"
396
397
        Require valid-user
398
        RedmineDSN "DBI:mysql:database=redmine;host=localhost:3306"
399
        RedmineDbUser "redmine"
400 15 Sven Nosse
        RedmineDbPass "very_secret"
401 2 Sven Nosse
402
        # cache max. 50 passwords
403 1 Sven Nosse
        RedmineCacheCredsMax 50
404
</Location>
405 14 Sven Nosse
</pre>
406
407 17 Hung Nguyen Vu
h3. Achievements
408 14 Sven Nosse
409 17 Hung Nguyen Vu
What we've done at this point:
410
* A running Redmine v2.0.3 installation using Apache Passenger
411
* Working authentication with Redmine's builtin database
412
* Working Subversion with Apache's WebDav
413
* Subversion authentication against redmine's builtin database
414 14 Sven Nosse
415
h2. Authentication against Active Directory
416
417
The last step requires some knowledge how to authenticate against your Active directory. First of all, open up Redmine in a web interface and enter the Administration dialogue. Select LDAP-Authentication adn create a new authentication entry.
418
419
* Name: Enter a NAME for your entry, this can be anything... 
420
* Host: Enter the IP address of a domain controler unless you are really sure, that DNS is working correctly
421
* Port: 389
422
* Account: This one is kind of a pitfall. Enter the DN of the user object that can authenticate against the Active Directory.
423
??EXAMPLE??: Assume that you have a domain that is called: mynetwork.local and an organizational unit that is named: myUsers. The DN of this organizational unit is: @OU=myUsers, DC=mynetwork, DC=local@ If you create a user, which Display name is like ??ldap authentication user?? then the Account you need to enter is: @CN=ldap authentication user, OU=myUsers, DC=mynetwork, DC=local@. I'd recommend using a tool like Sysinternals ADExplorer if you are unsure about the distinguished name of your authentication user.
424
* Base DN: This is the entry point, where Redmine tries to find users. In the example above you want to enter: @OU=myUsers, DC=mynetwork, DC=local@
425
* LDAP Filter: You can enter any filter you like here, a valid filter for finding users is: @(&(objectClass=user)(objectCategory=person))@. 
426
* On-the-fly Usercreation: I tend to check this.. This allows the initial creation of a new user when the user logs on redmine.
427
428
Attributes: _(I am not sure, whether the fields below are correctly tranlsated... please correct if necessary)_
429
* member name: sAMAccountName
430
* first name: givenname
431
* surname: sn
432
* E-Mail: mail
433
434
Save it, try it :)
435
436
You should be able to log on with your windows logon name and your windows passwort. If you've never logged on a new account should have been created within the redmine built in database.
437
438
h2. Last step - authenticate Subversion against active directory (by using the built in database from redmine!)
439
440
This one is tricky, you want the authentication data from Active Directory but you also want the group permissions from redmine. So you need to tell the logon mechanism to authenticate against AD and check inside the database, whether the user is SVN editor or not. Finally most of the work is done here with the redmine.pm script (remember, we've linked that already). But unfortunatelly the CentOS Perl implementation includes no module for Simple::LDAP. So we need to do some compiler work... 
441
442
First of all, fetch the packages needed for building the necessary perl module(s).
443
<pre>
444
yum -y install perl-CPAN perl-YAML
445
</pre>
446
447
There are a lot of dependencies when trying to build the module, so I recommend to turn on automatic dependency handling inside the CPAN shell....
448
Start up the shell:
449
<pre>
450
perl -MCPAN -e shell
451
</pre>
452
and then run the following two commands:
453
<pre>
454
o conf prerequisites_policy follow
455
o conf commit
456
</pre>
457
Now it is time, to install the module, still inside the shell. Enter
458
<pre>
459
install Authen::Simple::LDAP
460
</pre>
461
This takes some time... If queried for any dependencies or defaults, just acknowledge them with their default values - this should work.
462
Close the shell after everything is done by entering
463
<pre>
464
exit
465
</pre>
466
467
Now we need to tell Apache where to find the authentication data, this is simple by editing the subversion.conf
468
<pre>
469
vi /etc/httpd/conf.d/subversion.conf
470
</pre>
471
just add the Simple::LDAP Perl module by editing it this way:
472
<pre>
473
   ...
474
   PerlLoadModule Apache::Redmine
475
   PerlLoadModule  Authen::Simple::LDAP
476
   <Location /svn>
477
     DAV svn
478
     ...
479
</pre>
480
481
Restart Apache and LDAP Authentication should work now
482
<pre>
483
service httpd restart
484 2 Sven Nosse
</pre>