ProVision Local Installation For CentOS 7 | ProVision Documentation (View All)

Before You Begin

Ensure that System Requirements have been met prior to proceeding with the CentOS Configuration Guide.

Install Requirements

1) Upgrade your current packages

Upgrade packages

Upgrade your current packages.

PowerShell

yum update

2) Install Required Packages

PHP

Installations of ProVision 7.x and newer require PHP 7.1 (and related extensions). CentOS 7 comes with PHP 5.3 by default. You can either add a repository which provides PHP 7.1 or install PHP manually.

Repository & Syntax

The Webtatic and Remi repos both have versions of PHP which are newer than those in the official repos. For this example, we'll be using Webtatic.

If using a different repo or installing manually, your installation syntax may be different from what is listed here.

Add the repository:

Bash

  rpm -Uvh https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
  rpm -Uvh https://mirror.webtatic.com/yum/el7/webtatic-release.rpm

Install PHP and extensions:

httpd
php71w
php71w-opcache
php71w-mysqlnd
php71w-pdo
php71w-ldap
php71w-pecl-memcache
php71w-bcmath
php71w-devel
php71w-pear
php71w-cli
php7.1-imap

Development tools for pecl / additional system packages:

curl
openssl
memcached
mod_ssl

Bash

yum install httpd php71w php71w-opcache php71w-mysqlnd php71w-pdo php71w-ldap php71w-pecl-memcache php71w-bcmath php71w-devel php71w-pear php71w-cli php7.1-imap curl openssl memcached mod_ssl

MySQL / MariaDB

MySQL

Install MySQL 5.7 to use a local database.

MySQL is included with most CentOS installs, check for it with:

PowerShell

yum list installed | grep mysql

If it is not installed:

Bash

   rpm -Uvh http://repo.mysql.com/mysql-community-release-el7-5.noarch.rpm
   yum install mysql-server
   service mysqld start
   chkconfig mysqld on

Set the MySQL root password:

Bash

    /usr/bin/mysqladmin -u root password 'new-password'

To install MariaDB instead of MySQL, click here...

If you prefer to install MariaDB:

Bash

   yum install mariadb-server mariadb
   systemctl start mariadb

Set the root password, as currently it is not set, just hit ENTER on the current password:

Bash

mysql_secure_installation

Set so that it starts on boot:

systemctl enable mariadb.service

DNS and Additional Utilities

Install the DNS and other remaining utilities:

curl
openssl
nmap
bind-utils
bind
expect
wget
bzip2

    yum install curl openssl nmap bind-utils bind expect wget bzip2

3) Configure the requirements:

SSL

Self signed certificates in CentOS 7 by default have been already installed.

If you want to change it, follow the steps below:

Note: For production install, it is HIGHLY RECOMMENDED to use organization signed certs

SSL

Generate private key, CSR, and temporary key if one hasn't been provided.

Bash

   openssl genrsa -out ca.key 1024
   openssl req -new -key ca.key -out ca.csr
   openssl x509 -req -days 365 -in ca.csr -signkey ca.key -out ca.crt

Copy the files to the correct locations

Bash

   cp ca.crt /etc/pki/tls/certs
   cp ca.key /etc/pki/tls/private/ca.key
   cp ca.csr /etc/pki/tls/private/ca.csr

Make sure that you copy the files and do not move them if SELinux is enabled (which it is by default)

Edit the apache ssl config and put in the appropriate options:

(shown using the vi editor, though you may use the editor of your choice)

Bash

vi /etc/httpd/conf.d/ssl.conf

Find the lines that start with SSHCertificateFile and change them to be like:

SSLCertificateFile /etc/pki/tls/certs/ca.crt 
SSLCertificateKeyFile /etc/pki/tls/private/ca.key

Then restart:

PowerShell

/etc/init.d/httpd restart

Add 443 virtual hosts as needed in httpd.conf.

Apache

Allow overwrites in the apache vhosts:

Bash

sed -i 's/AllowOverride None/AllowOverride All/g' /etc/httpd/conf/httpd.conf

Start Apache and make it start on boot:

Bash

    systemctl start httpd.service
    systemctl enable httpd.service

mod rewrite REQUIRED

Please note that mod_rewrite is required! If it is not enabled in Apache, key elements will not work as expected.

MySQL

Set the MySQL Configuration:

Bash

mysql -p -e "SET GLOBAL sql_mode='NO_ENGINE_SUBSTITUTION';SET SESSION sql_mode='NO_ENGINE_SUBSTITUTION';"

then enter the MySQL root password when prompted.

MySQL Packet Size Configuration

We recommend setting the max_allowed_packet setting in the MySQL configuration file to 128MB (or similar) to account for the typical dataset size handled in ProVision.

4) Optional configurations:

Configure SELinux

READ THIS BEFORE YOU USE SELINUX

SELinux is a very powerful method of securing the CentOS environment, but it is not "turn key" and requires expertise to configure it correctly. If you do not know how to configure SELinux, please do not use it. A badly configured SELinux install will not work well and result in frustration. If you have any questions or concerns about this - please contact support.

RE-IP WARNING

Please remember - if you change the IP address of the your server, then you will need to update SELinux functions accordingly

Most CentOS install have SELinux enabled by default. One of its protections is to not allow httpd daemon to make network connections, we need to disable this for license checks.

To view the SELinux configuration for http:

Bash

/usr/sbin/getsebool -a | grep httpd

To turn protection off for the httpd daemon for creating network connections:

Bash

   /usr/sbin/setsebool -P httpd_can_network_connect 1

Configure IPTables

IPTables is enabled by default on CentOS. Add a new rule to allow 443 from anywhere. Make sure that this rule is in the chain BEFORE any blanket reject rule.

If you are going to run iptables, see the following:

To list all current IPTable rules:

Bash

iptables -L

To add a rule for 443:

Bash

/sbin/iptables  RH-Firewall-1-INPUT -I 5 -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT

Note

The -I 5 is what adds the rule to the 5th chain position. You might need to change this depending on existing rules. Look at what rules are there before running.

To save the new config:

Bash

/etc/rc.d/init.d/iptables save

OR (some versions of centOS have different iptables names, so the above won't work)

Bash

vi /etc/sysconfig/iptables

With the file open for editing, add:

PowerShell

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT

Once complete - restart the iptables service:

PowerShell

/etc/init.d/iptables restart

Customers can alter this post install to allow only their IP space, plus the ProVision management space.

Radius (Optional)

This section only needs to be followed if the customer will be using Radius for authentication.

If you are going to use radius authentication, click here.

Install radius module:

    pecl install radius
    echo extension=radius.so > /etc/php.d/radius.ini

SSH

Install ssh module:

Bash

    yum install libssh2-devel
    pecl install -f ssh2
    echo extension=ssh2.so > /etc/php.d/ssh2.ini

5) Install ProVision Software:

Install ProVision:

Remove the current contents in the ProVision web folder (currently the www root) and after extract the archive contents (where 7.x.x is the version number for the ProVision, and php7.x is the required php version build) :

Bash

 tar -xf productionBuild-7.x.x-php7.x.tar -C /var/www/html

Change the permissions to be the web user permissions

Bash

chown -R apache.apache /var/www/html

If enabled SELinux you must execute the following command:

Bash

chcon -R -t httpd_sys_rw_content_t /var/www/html

chcon -R -t httpd_sys_rw_content_t /tmp

You must also execute the same command for the 6c secure path created from configSecureKeys.sh

Go to http://﹤web root﹥/install/configTest.php. Follow the provided instructions, correcting any configuration errors if they occur. Once all steps are completed, you are ready to use your ProVision instance!