1 of 48

my stupid web server talk

matt hammerly

2 of 48

free stuff

3 of 48

creating your droplet

  • log into DigitalOcean
  • click the Create Droplet button in the top right
  • most of the work happens on the next screen

4 of 48

Important decisions

5 of 48

Important decisions

  • choose Debian (latest/default is 8.6 x64)

6 of 48

Important decisions

  • choose Debian (latest/default is 8.6 x64)
  • cheapest option

7 of 48

Important decisions

  • choose Debian (latest/default is 8.6 x64)
  • cheapest option
  • skip block storage

8 of 48

Important decisions

  • choose Debian (latest/default is 8.6 x64)
  • cheapest option
  • skip block storage
  • choose NY 3

9 of 48

Important decisions

  • choose Debian (latest/default is 8.6 x64)
  • cheapest option
  • skip block storage
  • choose NY 3
  • no additional options

10 of 48

Important decisions

  • choose Debian (latest/default is 8.6 x64)
  • cheapest option
  • skip block storage
  • choose NY 3
  • no additional options
  • don’t add an SSH key
    • SSH keys are the Right Way, but that’ll have to be for the 201 class

11 of 48

the hardest problem in computer science

there are two hard things in computer science: cache invalidation, naming things, and off-by-one errors.� - variation on a quote by Phil Karlton

12 of 48

the hardest problem in computer science

there are two hard things in computer science: cache invalidation, naming things, and off-by-one errors.� - variation on a quote by Phil Karlton

13 of 48

action packed

14 of 48

connecting via ssh

check your email. you should have received this email from DigitalOcean:

we want to connect to that IP address via ssh�Mac and Linux: $ ssh root@<your IP address>

PuTTY: msu’s abomination:�type your IP address and click Open http://www.cse.msu.edu/Facility/Services/SSH_Docs.php�at the bottom. that’s it. log in with your host name will be your IP address�the username and password given in�the DigitalOcean email.

15 of 48

now for the fun stuff

$ ssh root@104.131.162.25

root@104.131.162.25's password:

You are required to change your password immediately (root enforced)

The programs included with the Debian GNU/Linux system are free software;

the exact distribution terms for each program are described in the

individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent

permitted by applicable law.

Last login: Sat Sep 19 14:30:47 2015 from c-73-191-184-43.hsd1.mi.comcast.net

Changing password for root.

(current) UNIX password:

Enter new UNIX password:

Retype new UNIX password:

root@webservertalk:~#

16 of 48

adding a user account

  • root is the administrator account, with max access to all the things
  • always operate with the least amount of privileges possible
  • ergo, use root as little as possible

root@webservertalk:~# adduser matt # choose your password, and enter anything you want in the rest of the fields

17 of 48

adding a user account

  • root is the administrator account, with max access to all the things
  • always operate with the least amount of privileges possible
  • ergo, use root as little as possible

root@webservertalk:~# adduser matt # choose your password, and enter anything you want in the rest of the fields

  • sometimes we actually need root
    • installing software globally and not just to areas you own
    • editing global configuration
    • binding to low-numbered ports
  • let’s make sure we can escalate our privileges when we need to

root@webservertalk:~# visudo

18 of 48

visudo (except actually it’s nano)

towards the bottom of the file we see the following:

# Allow members of group sudo to execute any command

%sudo ALL=(ALL:ALL) ALL

�this shows that for our user account to use sudo, we need to add it to the sudo group. hit control+x to exit and return to our shell.

root@webservertalk:~#

19 of 48

visudo (except actually it’s nano)

towards the bottom of the file we see the following:

# Allow members of group sudo to execute any command

%sudo ALL=(ALL:ALL) ALL

�this shows that for our user account to use sudo, we need to add it to the sudo group. hit control+x to exit and return to our shell.

root@webservertalk:~# usermod -aG sudo matt

root@webservertalk:~#

20 of 48

visudo (except actually it’s nano)

towards the bottom of the file we see the following:�

# Allow members of group sudo to execute any command

%sudo ALL=(ALL:ALL) ALL��for our user account to use sudo, we need to add it to the sudo group�hit control+x to exit and return to our shell

root@webservertalk:~# usermod -aG sudo matt

root@webservertalk:~# su matt

matt@webservertalk:/root$�

rad okay i feel a lot safer

21 of 48

it’s simple -- we kill the root user

  • we can’t actually kill the root user
  • we just don’t want anyone to log in as root over ssh like we did

�matt@webservertalk:~$ sudo nano /etc/ssh/sshd_config�

  • we need to search for “rootlogin”
  • press control+w to bring up a search field, type it, press enter
  • change “yes” to “no” on the line it brings you to
  • control+x to exit, y to save changes, enter to confirm filename
  • restart the ssh daemon

�matt@webservertalk:~$ sudo service sshd restart

22 of 48

installing our webserver package

matt@webservertalk:/root$ cd ~ # cd is change directory, so this takes us home

matt@webservertalk:~$

  • linux systems typically handle getting software through a package manager
  • package managers handle installs, uninstalls, upgrades, dependencies
  • they’re p great (sometimes)
  • macs have homebrew and macports. windows has chocolatey

23 of 48

installing our webserver package

matt@webservertalk:/root$ cd ~ # cd is change directory, so this takes us home

matt@webservertalk:~$ sudo apt-get update # this will update our package lists

...

matt@webservertalk:~$

  • linux systems typically handle getting software through a package manager
  • package managers handle installs, uninstalls, upgrades, dependencies
  • they’re p great (sometimes)
  • macs have homebrew and macports. windows has chocolatey

24 of 48

installing our webserver package

matt@webservertalk:/root$ cd ~ # cd is change directory, so this takes us home

matt@webservertalk:~$ sudo apt-get update # this will update our package lists

...

matt@webservertalk:~$ sudo apt-get upgrade # upgrade all our outdated packages

...

matt@webservertalk:~$

  • linux systems typically handle getting software through a package manager
  • package managers handle installs, uninstalls, upgrades, dependencies
  • they’re p great (sometimes)
  • macs have homebrew and macports. windows has chocolatey

25 of 48

installing our webserver package

matt@webservertalk:/root$ cd ~ # cd is change directory, so this takes us home

matt@webservertalk:~$ sudo apt-get update # this will update our package lists

...

matt@webservertalk:~$ sudo apt-get upgrade # upgrade all our outdated packages

...

matt@webservertalk:~$ sudo apt-get install nginx # pronounced “engine X” -- another popular choice is apache

...

matt@webservertalk:~$

  • linux systems typically handle getting software through a package manager
  • package managers handle installs, uninstalls, upgrades, dependencies
  • they’re p great (sometimes)
  • macs have homebrew and macports. windows has chocolatey

26 of 48

baby’s first webpage

make sure the nginx daemon is running

matt@webservertalk:~$ sudo service nginx start�matt@webservertalk:~$

groovy. now let’s check it out:

27 of 48

domain names

  • IP addresses are very pointy and i don’t want them in my brain
  • domain names are friendlier identifiers for computers
  • DNS (Domain Name System) maps domain names to IP addresses

28 of 48

domain names

  • IP addresses are very pointy and i don’t want them in my brain
  • domain names are friendlier identifiers for computers
  • DNS (Domain Name System) maps domain names to IP addresses

  • go to http://dot.tk
  • type in the domain you want and hit go

29 of 48

making your DNS records

  • create DNS records that look like mine but with your IP address

30 of 48

DNS is a trip

  • an A records maps a name to an IP address
  • a CNAME record maps a name to another name
  • TTL is Time To Live, or how long your record will be cached for
  • http://en.wikipedia.org/wiki/List_of_DNS_record_types

31 of 48

elevator music plays

that “Welcome to nginx!” page is kinda dumb

let’s make a better one

matt@webservertalk:~$ mkdir -p ~/webpages/test/htdocs

matt@webservertalk:~$

32 of 48

elevator music plays

that “Welcome to nginx!” page is kinda dumb

let’s make a better one

matt@webservertalk:~$ mkdir -p ~/webpages/test/htdocs

matt@webservertalk:~$ cd ~/webpages/test/htdocs

matt@webservertalk:~/webpages/test/htdocs$

33 of 48

elevator music plays

that “Welcome to nginx!” page is kinda dumb

let’s make a better one

matt@webservertalk:~$ mkdir -p ~/webpages/test/htdocs

matt@webservertalk:~$ cd ~/webpages/test/htdocs

matt@webservertalk:~/webpages/test/htdocs$ nano index.html

34 of 48

elevator music plays

that “Welcome to nginx!” page is kinda dumb

let’s make a better one

matt@webservertalk:~$ mkdir -p ~/webpages/test/htdocs

matt@webservertalk:~$ cd ~/webpages/test/htdocs

matt@webservertalk:~/webpages/test/htdocs$ nano index.html

copypaste the contents of the file from the link below

https://github.com/mhammerly/webservertalk/blob/master/index.html

or if you’re feeling bold, skip nano and use wget:

wget https://raw.githubusercontent.com/mhammerly/webservertalk/master/index.html

35 of 48

making nginx show us our webpage

matt@webservertalk:~$ cd /etc/nginx

matt@webservertalk:/etc/nginx$ ls

conf.d fastcgi_params koi-utf koi-win mime.types naxsi.rules naxsi_core.rules nginx.conf proxy_params scgi_params sites-available sites-enabled uwsgi_params win-utf

  • sites-available is a folder that contains some site configurations
    • aka server blocks, virtualhosts, vhosts
  • if a site is enabled, there should be a symlink in sites-enabled that points to its configuration in sites-available
    • a symlink is a symbolic link, or basically a shortcut
    • in other words, a site is enabled IFF there is a symlink for it in sites-enabled

36 of 48

stuff that didn’t fit on the last slide

kill the default nginx configuration

matt@webservertalk:/etc/nginx$ sudo rm sites-enabled/default

create our own

matt@webservertalk:/etc/nginx$ sudo nano sites-available/testsite

(you can copypaste from here: https://github.com/mhammerly/webservertalk/blob/master/webservertalk.conf)

(can also skip nano and wget https://raw.githubusercontent.com/mhammerly/webservertalk/master/webservertalk.conf)

37 of 48

/etc/nginx/sites-available/testsite

server {

}

38 of 48

/etc/nginx/sites-available/testsite

server {

listen 80 default_server;

}

39 of 48

/etc/nginx/sites-available/testsite

server {

listen 80 default_server;

root /home/matt/webpages/test/htdocs;

}

40 of 48

/etc/nginx/sites-available/testsite

server {

listen 80 default_server;

root /home/matt/webpages/test/htdocs;

index index.html index.htm;

}

41 of 48

/etc/nginx/sites-available/testsite

server {

listen 80 default_server;

root /home/matt/webpages/test/htdocs;

index index.html index.htm;

server_name mhammerly.tk www.mhammerly.tk;

}

42 of 48

/etc/nginx/sites-available/testsite

server {

listen 80 default_server;

root /home/matt/webpages/test/htdocs;

index index.html index.htm;

server_name mhammerly.tk www.mhammerly.tk;

location / {

}

}

43 of 48

/etc/nginx/sites-available/testsite

server {

listen 80 default_server;

root /home/matt/webpages/test/htdocs;

index index.html index.htm;

server_name mhammerly.tk www.mhammerly.tk;

location / {

try_files $uri $uri/ /index.html;

}

}

44 of 48

create the symlink

  • recall from earlier: sites are enabled IFF there is a symlink for it in sites-enabled

matt@webservertalk:/etc/nginx$ sudo ln -s /etc/nginx/sites-available/testsite /etc/nginx/sites-enabled/testsite

  • i almost forgot to make this slide
  • that would have sucked

45 of 48

nginx should be good to go

restart the service so our configuration changes take effect

matt@acmtesttalk:/etc/nginx$ sudo service nginx restart

gonna frown really hard if there are any error messages at this point

navigate to your server by typing your IP address into your web browser’s address bar again and you should see your site!!!

46 of 48

try the domain name

type your domain name into your web browser and see if it does anything

47 of 48

it’s been a pleasure

go forth and make more websites

  • matt

48 of 48