New Linode VPS w/Slackware

astrogeek · 01-29-2015, 05:08 PM

I am new to hosted VPS, and am about to open a Linode account.

My immediate object is to quickly acclimate myself to the VPS platform and to decide on a permanent new home for a customer's website. Slackware provides familiarity for my own uses and will be my introduction, but I will also play with others, CentOS being moderately familiar from some recent Rackspace projects.

Linode seems to be highly recommended here on LQ and offers Slackware 14.1, so that will allow me to most quickly look at their tools and community and learn my way around. It also allows a low cost entry which is very helpful.

Linode also seems geared towards developer platforms, so I am unsure whether it will be in the running for the permanent platform. Does anyone here have any experience or knowledge of how appropriate Linode would be for a moderately busy web server with periodic high bursts of database activity?

All comments from Linode users and/or fanboyz, or recommendations of other VPS options for serious permanent use appreciated...

I also see Linode has a referral program that will give you credit if I use your code during signup...

Quote:

Where's my referral code?

Your referral code and referral URL are located on your My Profile within the Linode Manager.

Might as well use it! First helpful comment from a Linode user with your referral code gets the prize!
(I hope this does not break any LQ rules, please let me know if so...)

codeguy · 01-29-2015, 05:56 PM

I have a linode accout, I guess its been almost 2 years now. I can recommend it.

I do not have a busy webserver though, so I cannot really answer your questions. I'd be happy to run some benchmarks if you'd like. The hardware was recently updated to use ssd's, so HD access is pretty fast.

I can tell you, when I first did their basic slackware install, it was a minimal setup. (I don't recall if there was two options (full install and minimal install), but it was missing some required packages, which weren't hard to install, but it was a little messy. I don't recall what happened but some process pegged the cpu. It was very upset about some missing lib's.

You say its geared towards developer platforms, but I don't know what you mean. Its just a server, you can set it up any way you like. They do have a web api so you can script access to your account, which is pretty cool.

My referral code: 569e052035be2fbc1e9a16661e2e811f585c0a6a
and url: https://www.linode.com/?r=569e052035...2e811f585c0a6a

If you have other questions, I'd be happy to help.

-Andy

astrogeek · 01-29-2015, 06:28 PM

Quote:

Originally Posted by codeguy

I have a linode accout, I guess its been almost 2 years now. I can recommend it.

I do not have a busy webserver though, so I cannot really answer your questions. I'd be happy to run some benchmarks if you'd like. The hardware was recently updated to use ssd's, so HD access is pretty fast.

Thanks for the recommendation! In my searching for VPS Linode seems to be in a class by itself as far as happy users - much like Slackware in that regard!

Thanks for the benchmark offer, but at this point I wouldn't know what to ask for and would just waste your time.

Quote:

Originally Posted by codeguy

I can tell you, when I first did their basic slackware install, it was a minimal setup. (I don't recall if there was two options (full install and minimal install), but it was missing some required packages, which weren't hard to install, but it was a little messy. I don't recall what happened but some process pegged the cpu. It was very upset about some missing lib's.

Ok, I'll look out for that. If it offers a full install I'll probably do that and slim it down myself. But I should be able to cope with most things it throws at me which is why I will start with Slackware to begin with.

Quote:

Originally Posted by codeguy

You say its geared towards developer platforms, but I don't know what you mean. Its just a server, you can set it up any way you like. They do have a web api so you can script access to your account, which is pretty cool.

What I mean by that is their marketing and online documentation seem to be directed more towards developers themselves, as opposed to corporate suites (compare with Rackspace pages for example). That may just be my perception, and is not a negative thing, but I wondered if that might manifest in some support "attitude" after I hand the site off to someone else at a later time.

I have read their docs on their API, but will only see its usefulness once I get started - shortly!

Could you offer any brief comments about how you best make use of that scriptable access, it is a little vague to me at the moment, but will probably become clear with a little hands on.

Quote:

Originally Posted by codeguy

My referral code:...

If you have other questions, I'd be happy to help.

Thanks for the comments, Andy!

You win the prize! Linode says that you will receive a $20 credit after I have been there 90 days... enjoy your refreshment of choice with my compliments!

codeguy · 01-29-2015, 06:48 PM

Linode hosts dns (they have a web page where you modify your dns stuff), but they also let you dynamically update entries (with their api).

I have my main www.host.com entry that points back to linode, then I have another home.host.com that points back to my house. My pc at home runs a perl script to update dns. (They support other languages, if you don't happen to love perl).

They support all kinds of things:

https://www.linode.com/api

I've only used the dns stuff.

They also have a pretty good monitoring section (and ticket system). I was hit by the ntp bug a while back. It pegged my box for a while, and they notified me that my domain was having problems. I got it fixed up and they closed the ticket. (I have an ntp server on pool.ntp.org)

You can setup your own monitoring flags as well. You can setup an automated notification if your cpu peggs for example. Its pretty slick.

Quote:

You win the prize!

Whoo Hoo! Thanks!

-Andy

codeguy · 01-29-2015, 06:59 PM

This sound's familiar. This isn't me, but I'll bet that's what I hit:

https://forum.linode.com/viewtopic.p...ilit=slackware

astrogeek · 01-29-2015, 07:21 PM

Thanks for looking that up - I see no such problem with the 14.1 instance.

--- Update ---

After more reading and package installs, I decided I may indeed need pidentd - thanks!

---

In fact, it is running a 3.18 kernel, so not sure if it is actually current or if they provide selectively updated images.

--- Update ---

Ah, I think I see now... they supply their own kernels. So can I build packages with the Slackware kernel headers or is some magic required??

---

Anyway, I now have my Slackware VPS running - kind of cool!

I have to step away now for a couple of hours, figures! Back later tonight.

Thanks again!

astrogeek · 01-31-2015, 04:20 PM

Well, I now have apache working and secured, and a couple of vhosts setup using dormant domains from another life.

The Linode 14.1 install really is minimal! That is a good thing, but it requires a surprising number of libs just to get apache, php and mariadb running.

I also set up my own firewall, fairly aggressive for SSH attempts (ban forever after 4) with an idea provided by mancha. I love to watch them disappear from the messages so quickly!

Also using fail2ban (first time with it) and will need to learn some configuration for that - just defaults at this time.

Updated all applicable patches for 14.1, etc...

So far it has been a fun and rewarding experience! But all good things... tomorrow I will install postfix and dovecot...

Actually, I have already built both of them on the VPS, but have not yet installed the packages.

codeguy, I see from another thread here that you are using postfix and dovecot (on your Slackware Linode VPS?). Can you comment on installation and/or maintenance problems? Are you also using a spam filter on that too, and if so which?

the3dfxdude · 01-31-2015, 06:16 PM

Quote:

Originally Posted by astrogeek

The Linode 14.1 install really is minimal! That is a good thing, but it requires a surprising number of libs just to get apache, php and mariadb running.

It's refreshing to see such a clean image for a VPS. You get to set it up your way. The thing I don't get about it is why the content of the files in /var/log/packages were mostly empty and a few of them missing? It made tracking down the already installed libs slightly harder.

astrogeek · 01-31-2015, 06:54 PM

Quote:

Originally Posted by the3dfxdude

It's refreshing to see such a clean image for a VPS. You get to set it up your way. The thing I don't get about it is why the content of the files in /var/log/packages were mostly empty and a few of them missing? It made tracking down the already installed libs slightly harder.

Yes it really is refreshing - hadn't thought of that descriptive term, but it is! It is rock solid and lean!

I saw the empty package entries, but am working from a 14.1 machine locally, so I opened new tmux window to local package list and carried on.

I have installed most needed packages and updates from ftp-osuosl, and built a few from SBo.

One thing that I question is what kernel-headers to use for SBo builds that require them... Linode installs their own kernel but it does not appear that the kernel headers are available to linodes.

I thought about it and decided all the Slackware updates and packages were built against the 3.10.17 headers so I installed those, and seems OK... or build locally and upload. Anybody have a better idea?

Also some very basic man pages are not there, so I refer to local system.

codeguy · 02-01-2015, 08:13 AM

Yeah, I noticed a lot of ssh attempts too, I switched ports. Instead of running on 22 I run on a really high port. Its great cuz its never found, but it sucks because every updatepkg I have to remember NOT to replace the sshd_config.

Postfix has been great. I don't run any 3'rd party spam stuff at all. Postfix has a bunch of settings to filter out quite a bit, and the RBL's take care of the rest. Here's a few snips from my config:

Code:

home_mailbox = Maildir/

smtpd_client_restrictions =
    permit_mynetworks,
    check_client_access hash:/etc/postfix/ban,
    reject_unknown_client,
    reject_unknown_client_hostname,
    sleep 1,
    reject_unauth_pipelining

smtpd_helo_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_non_fqdn_hostname,
    reject_invalid_helo_hostname,
    permit

smtpd_sender_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    check_sender_access hash:/etc/postfix/sender_access,
    reject_non_fqdn_sender,
    reject_unknown_sender_domain,
    permit

smtpd_relay_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination

smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    check_client_access regexp:/etc/postfix/spam_ip_regex,
    reject_unauth_destination,
    reject_unauth_pipelining,
    reject_non_fqdn_recipient,
    reject_unknown_recipient_domain,
    reject_unlisted_recipient,
    reject_rhsbl_sender dsn.rfc-ignorant.org,
    reject_rbl_client zen.spamhaus.org,
    reject_rbl_client bl.spamcop.net,
    reject_rbl_client cbl.abuseat.org,
    reject_rbl_client dnsbl.sorbs.net,
    permit

smtpd_data_restrictions =
    reject_unauth_pipelining,
    permit

strict_rfc821_envelopes = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_authenticated_header = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtp_sasl_type = dovecot
smtpd_tls_auth_only = yes

smtpd_delay_reject = no
smtpd_helo_required = yes
broken_sasl_auth_clients = yes
disable_vrfy_command = yes

data_directory = /var/lib/postfix
smtp_tls_CAfile = /etc/postfix/cacert.pem
smtp_tls_session_cache_database = btree:/var/lib/postfix/smtp_tls_session_cache
smtp_tls_security_level = may
smtpd_tls_CAfile = /etc/postfix/cacert.pem
smtpd_tls_cert_file = /etc/postfix/foo-cert.pem
smtpd_tls_key_file = /etc/postfix/foo-key.pem
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_tls_session_cache
tls_random_source = dev:/dev/urandom
smtpd_tls_security_level = may

In the dovecot package they have a mkcert.sh file, I made a copy of that in a new folder and set up dovecot-openssl.cnf so the next update wouldnt overwrite it. Every year I re-make my self signed cert from this new folder.

/etc/postfix/spam_ip_regex:

Code:

/^dsl.*\..*\..*/i 553 AUTO_DSL Email Rejected.
/[ax]dsl.*\..*\..*/i 553 AUTO_XDSL Email Rejected.
/client.*\..*\..*/i 553 AUTO_CLIENT Email Rejected.
/cable.*\..*\..*/i 553 AUTO_CABLE Email Rejected.
/dial.*\..*\..*/i 553 AUTO_DIAL Email Rejected.
/.*dial[\-]*in.*/i 553 AUTO_DIAL2 Email Rejected.
/ppp.*\..*\..*/i 553 AUTO_PPP Email Rejected.
/dslam.*\..*\..*/i 553 AUTO_DSLAM Email Rejected.
/node.*\..*\..*/i 553 AUTO_NODE Email Rejected.
/.*dial-up.*/i 553 AUTO_DIAL_UP_ID_PATTERN Email Rejected.
/.*\.dhcp.*/i 553 AUTO_DHCP_ID_PATTERN Email Rejected.
/.*[0-9]+[\.-][0-9]+[\.-][0-9]+[\.-][0-9]+[\.-]+.*/i 553 AUTO_DYNAMIC_ID_PATTERN_DOT_DASH Email Rejected.
/.*[0-9]+[\.-]net[\.-][0-9]+[\.-][0-9]+[\.-][0-9]+[\.-]+.*/i 553 AUTO_DYNAMIC_ID_PATTERN_DOT_DASH_NET Email Rejected.
/.*[0-9]+-[0-9]+-[0-9]+-[0-9]+\..*/i 553 AUTO_DYNAMIC_ID_PATTERN_DASHES Email Rejected.
/.*internetdsl.tpnet.pl/i 553 AUTO_PL_DSL_PATTERN Email Rejected.
/.*\.cable.net.co\..*/i 553 AUTO_CABLE_DOT_NET Email Rejected.
/.*dynamic.*/i 553 AUTO_DYNAMIC_PATTERN Email Rejected.
/.*ppp.*/i 553 AUTO_PPP_PATTERN Email Rejected.
/.*user.*/i 553 AUTO_USER_PATTERN Email Rejected. 
/.*\.pool.einsundeins.de/i 553 AUTO_CABLE_DOT_NET Email Rejected.
/.*\.business.telecomitalia.it/i 553 AUTO_CABLE_DOT_NET Email Rejected.
/.*\.t-ipconnect.de/i 553 AUTO_CABLE_DOT_NET Email Rejected.
/.*\.hawcable.net/i 553 AUTO_CABLE_DOT_NET Email Rejected.
/.*\.wayinternet.com.br/i 553 AUTO_CABLE_DOT_NET Email Rejected.
/.*\.telecomproject.bb.cust.gts.sk/i 553 AUTO_CABLE_DOT_NET Email Rejected.
/.*\.dsl\..*/i 553 AUTO_DSL Email Rejected.
/.*\.tstt.net.tt/i 553 AUTO_DSL Email Rejected.
/.*chello[0-9]+\.chello.pl/i 553 AUTO_DSL Email Rejected.
/.*p[0-9]+-ipbf.*\.hyogo\.ocn\.ne\.jp/i 553 AUTO_DSL Email Rejected.
/.*[0-9]+.*\.codetel\.net\.do/i 553 AUTO_DSL Email Rejected.
/.*static\..*\.piotrkow\.pilicka\.pl/i 553 AUTO_DSL Email Rejected.
/.*host.*\.retail\.telecomitalia\.it/i 553 AUTO_DSL Email Rejected.
/.*office.electroindustry.cz/i 553 AUTO_DSL Email Rejected.
/.*\.home\.cgocable\.net/i 553 AUTO_DSL Email Rejected.
/.*\.dyn\.tolna\.net/i 553 AUTO_DSL Email Rejected.

Thats a pretty old list, dont even remember where I got it. There might be a newer/better list someplace.

astrogeek · 02-01-2015, 05:04 PM

Thanks! Just seeing your pasted configs helps by giving a glimpse at a live setup.

I have spent most of the day reading postfix and dovecot docs and how-tos... still mostly confused.

I don't want to deploy it until I actually understand it well enough to deal with administering it, and I am far from that point yet I think!

What I want is Postfix, Dovecot with MySQL virtual users. I think I see most of the pieces, but it is still a fairly large puzzle, not least because I have not ever set up a mail service before!

There is a good Postfix with Cyrus how to on SlackDocs, which is helpful getting me oriented, but nothing there on Dovecot. If I get it going and keep my sanity perhaps I can add a page for that... these days, just remembering long enough to keep my own notes is a real problem!

ryanpcmcquen · 02-06-2015, 12:15 AM

Going to put in a short plug for Vultr, which allows custom ISOs. I prefer installing a vanilla Slackware ISO as opposed to Linode's version (which required installing a lot of packages sets and also used a Linode kernel).

Also Vultr is cheaper and has more server locations.

astrogeek · 02-07-2015, 02:53 AM

Quote:

Originally Posted by ryanpcmcquen

Going to put in a short plug for Vultr, which allows custom ISOs. I prefer installing a vanilla Slackware ISO as opposed to Linode's version (which required installing a lot of packages sets and also used a Linode kernel).

Also Vultr is cheaper and has more server locations.

Thanks, I had not even seen Vultr in my reviews (admittedly not exhaustive...).

They look to be lower pricing on the low end and higher on the high end than Linode.com, but that is not greatly relevant to my current purposes. I have bookmarked them and will have a closer look before deciding on the new home for my user.

Being able to use my own ISO would be a big plus, although I have been very happy so far with what Linode provides. I don't mind having to install the necessary packages, it is probably less effort for me than trying to remove things from a full install. I think I would prefer to run the Slackware kernel, or my own, but theirs has not presented any problems and I am getting very comfortable with it.

astrogeek · 02-07-2015, 03:08 AM

Update for anyone interested...

In the past few days I have built and installed postfix, dovecot and mariadb (custom build) on my linode, and now have my mailserver working!

I read somewhere along the way that setting up a mail server was not for the faint of heart... understatement! I could not find a useful guide for setting up postfix/dovecot with mysql anywhere, to my surprise. Both the postfix and dovecot reference documentation is complete and mostly accessible (some exceptions), but there really is no "Quick Start" - lots and lots of reading, and unfamiliar terminology!

But now that it is done, working, secured and well tested, I feel like I have accomplished something, and learned quite a bit!

I kept notes which I hope to turn into a Slackdocs how-to, soon.

ryanpcmcquen · 02-07-2015, 09:18 AM

Quote:

Originally Posted by astrogeek

I don't mind having to install the necessary packages, it is probably less effort for me than trying to remove things from a full install.

Since you actually run the install from the ISO, there is no need to do a full install. I just choose:

A, AP, D, L and N.

I found that on Linode I had to install most of these package sets, they seemed to have almost nothing installed! Also Linode (which I do love for having a Slackware image) had the 64-current mirror commented out, which seemed strange for a server!

Glad to hear you've got a mail server running, maybe you'll write a nice how-to on the Slackware Docs and I'll go down that route myself. :-)

P.S. If you do decide to try out Vultr, you'll have to set up an initrd and Lilo before the first boot, I wrote a small guide (with help from willysr):

https://github.com/ryanpcmcquen/linu...erverSetup.txt