Intelehealth Cloud server setup on Digital Ocean

Setting up a server on Digital Ocean

Step-1.a: If you want to create a droplet on Digital Ocean.

Follow this link :- here

        • Choose a size:- Standard Droplets
        • Add backups
        • Choose a data-center region:- (A nearest location data-center)
        • Select additional options:- here
        • Add your SSH keys
        • Finalize and create

Step-1.b: If you are following step-1.a then skip this

We create a snapshot after all the initial setup is completed. We take a snapshot through the help of this you can easily create a server with all functionality. If you select the option to create the server from snapshot select snapshot ” InteleHealth_Basic_setup_Snapshot” and jump to "Step-17" then directly follow "Step-22".

Step-2. Create an alert on Digital Ocean for memory utilization (under Monitoring Tab). This will send an alert email to all the respective email id's about CPU running high.

Step-3. Login remotely using your SSH client, (if you are on windows use Putty, or Cygwin to use SSH client). Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. The best known example application is for remote login to computer systems by users.

Reset root password. This will help you to login to server via root (At this point there are no user created).

Step-4. Run these commands:

$ apt-get update (For sudo user write: sudo apt-get update).

$ apt-get upgrade (For sudo user write: sudo apt-get upgrade).

These commands are for the information about what updated versions of packages are available and are obtained by running sudo apt-get update (or sudo aptitude update). It is advisable to run this before installing any package, and necessary to run it to install the latest updates, even if you have not added or removed any Software Sources.

Step-4. $ apt-get autoclean Autoclean clears out the local repository of retrieved package files. It only removes package files that can no longer be downloaded, and are largely useless. This allows a cache to be maintained over a long period without it growing out of control.

$ apt-get autoremove It is used to remove packages that were automatically installed to satisfy dependencies for some package and that are no more needed.

Step-5. $ adduser username Create a new user through you can login, which will secure your server via login through only the root. Follow instruction from here .

$ usermod -aG sudo username Giving sudo access to that user through which user can the user can enter the server.

Step 6. Important steps to initial-server-setup:-

If you are working with windows, skip step 4 in this link here . Note:- If you enable firewall then please allow some ports to access the server(22, 8080). Otherwise you can't login to the server.

Step-7. $ apt-get install firefox (for sudo user use sudo apt install firefox). Install Firefox browser .

Step-8. $ sudo apt-get install openjdk-8-jdk Install Java which is the most important part of the server.

Step-9. $ apt-get install tomcat7 Use this URL to install the tomcat7 for Digital Ocean and follow the guide and don’t forget to change the JAVA_OPT here (P.S: Don’t follow STEP-FOUR of that URL)

Step-10. $ sudo apt-get install mysql-server mysql-client This command will Install MySQL to your server. Set ID & Password to login and to enable further access to mysql.

Step-11. After configuration and successfully installed tomcat7 use these commands.

  1. $ sudo mkdir /usr/share/tomcat7/.OpenMRS (making a OpenMRS directory at /usr/share/tomcat7/.OpenMRS to configure it).
  2. $ sudo chown -R tomcat7:tomcat7 /usr/share/tomcat7/.OpenMRS (to own all files in this directory so that tomcat can add, delete and modify files).
  3. $ sudo chgrp -R tomcat7:tomcat7 /usr/share/tomcat7/.OpenMRS (to group all together by tomcat7).

Step-12. Download the war file, which contains the OpenMRS platform and the reference application to setup OpenMRS to the server, by using this command:

$ wget https://sourceforge.net/projects/openmrs/files/releases/OpenMRS_Platform_2.0.5/openmrs.war

$ wget https://sourceforge.net/projects/openmrs/files/releases/OpenMRS_Reference_Application_2.6.0/referenceapplication-modules-2.6.0.zip

Step-13. $ sudo unzip openmrs.war -d /var/lib/tomcat7/webapps/openmrs This command will unzip the platform and install it to your server. Now you can see the openmrs through the server IP address (as in step 15).

Step-14. $ sudo chown -R tomcat7:tomcat7 /var/lib/tomcat7/webapps/openmrs

Step-15. Deploy the war file by going to the tomcat manager. http://IPaddress:8080/openmrs

It will lead you to initial steps of OpenMRS.

For Basic here

For Advanced here

After completing initial steps and installation, you will see in the screen that Platform 2.05 is successfully installed, but it will need some reference module which will help to run your company's UI. So to add all the reference application modules follow:

Step-16 ( i ) $ sudo unzip referenceapplication-modules-2.6.0.zip -d /usr/share/tomcat7/.OpenMRS/modules

$ sudo chown -R tomcat7:tomcat7 /usr/share/tomcat7/.OpenMRS/modules

Step-16 ( ii ) If Step-16 ( i ) does not work, then use WinSCP for ( sftp )

unzip referenceapplication-modules-2.6.0.zip at any location and copy all .omod file (which is in unziped folder) from your local directory and paste it /usr/share/tomcat7/.OpenMRS/modules.

Step-17. copy intelehealth-1.1.4.omod file also in same folder.

(If you are following " Step-1.b: " then next step is Step-22: )

Step-18. Parse Server and MongoDB installation & Configuration

Install MongoDB ### Requirements :

* [Linux](https://docs.mongodb.com/manual/administration/install-on-linux/) Install mongodb from this URL. also click_here

* [OS X](https://docs.mongodb.com/manual/tutorial/install-mongodb-on-os-x/)

* [Windows](https://docs.mongodb.com/manual/tutorial/install-mongodb-on-windows/)

Step-19. Node.js Installation here

     IMP:- PLease follow this lick first click_here / click_here. If completed jump to Step 20.
  1. $ cd ~ ( changing the current working path to your sudo user's home directory )
  2. $ curl -sL http://deb.nodesource.com/setup_8.x -o nodesource_setup.sh ( NodeSource offers an Apt repository for Debian and Ubuntu Node.js packages. We'll use it to install Node.js )
  3. $ nano ./nodesource_setup.sh ( review the contents of this script by opening it with nano )
  4. $ sudo -E bash ./nodesource_setup.sh ( The -E option to sudo tells it to preserve the user's environment variables so that they can be accessed by the script )
  5. $ sudo apt-get install -y nodejs build-essential git ( We can use apt-get to install the nodejs package. We'll also install the build-essential metapackage, which provides a range of development tools that may be useful later, and the Git version control system for retrieving projects from GitHub )
  6. $ npm install -g npm@4.6.1

Step-20. Install Parse Server: Note:- Check parse is installed or not.

$ npm install -g parse-server 

$ npm install -g mongodb-runner

$ mongodb-runner start

Step-21. Parse Dashboard: here

$npm install -g parse-dashboard

Step-22: install pm2 $ npm install pm2@latest -g

Create a config for parse dashboard to home Directory

$ nano PARSE_DASHBOARD_CONFIG.json

{ "apps":[{

"appName":"Image Server",

"serverURL":"ServerIP:1337/parse",

"appId":"app2","masterKey":"IH_IMAGE"}],

"users":[{

"user":"xxxxxx",

"pass":"xxxxxxxxx"

}]

}

Step-22. Now, you will have to configure the PM2(Process Manager). PM2 is a Production Runtime and Process Manager for Node.js applications with a built-in Load Balancer. It allows you to keep applications alive forever, to reload them without downtime and facilitate common Devops tasks. here

You have to set a configuration of processes which you want to run through the pm. for that you have to define the file which extension is .json. Remind the name of the file because you have to start the pm2 through this file

$ nano FILENAME.json

{

"apps":[{

"name":"Intelehealth Image Server",

"script":"/usr/bin/parse-server ",

"watch":true,"merge_logs":true,"cwd":"/home","

args" :

" --appId app2

--masterKey IH_IMAGE

--serverURL 'http://[ip address goes here]:1337/parse'

--databaseURI 'mongodb://localhost:27017/intelehealth_images' ",

"env":{"PORT":1337}},

{

"name":"Intelehealth Dashboard",

"script":"/usr/bin/parse-dashboard ",

"watch":true,"merge_logs":true,"cwd":"/home","

args":

" --config PARSE_DASHBOARD_CONFIG.json --allowInsecureHTTP"

}

]}

Final Steps:

Make sure that PARSE_DASHBOARD_CONFIG.json is in the cwd (current working directory) & Run the parse server and dashboard.

$ pm2 start FILENAME.json

$ pm2 status This help to show the status of all the processes which are running on pm2.

IMP:- If Parse-server didn't run via pm2 then run from "$ parse-server --appId APPLICATION_ID --masterKey MASTER_KEY --databaseURl mongodb://localhost/DB_NAME" . If you will run this command in the beginning, port 1337 will covered by this and pm2 cant recognize the port.

Access dashboard at http://localhost:4040/login . Other pm2 commands through which you can control the processes:

$ pm2 stop FILENAME.json (Stops all the running process)

$ pm2 delete FILENAME.json (Removes the apps in json file to running as daemon)

$ pm2 show X (Shows status of process X where X is whole number)

[More Information on pm2](http://pm2.keymetrics.io/docs/usage/quick-start/)

Step-23. Redirecting port 80, 443 on Ubuntu Server using iptables. you have to run the web application on a port 8080. The user accesses to your website via port 80, and it will be redirected to port 8080. The redirection is carried out by OS. To redirect it, you need to configure iptables. Please Click_Here for more details

http://demo.intelehealth.io:8080/openmrs (Address is not friendly)

http://demo.intelehealth.io/openmrs (Address is friendly).

Firstly, you need to check application running and port used. $ netstat -ntl Tomcat is running on port 8080:

command to redirect port 80 traffic to port 8080

$ sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

command to verify that redirect is working fine $ sudo iptables -t nat -L

Next, you have to save the configuration information above to make sure that it is still useful when you restart the OS.

$ sudo sh -c "iptables-save > /etc/iptables.rules"
$ sudo apt-get install iptables-persistent 

Select YES for IPv4 & IPv6 to apply access.

If you want to remove redirecting 80 to 8080 as above, you need run the following command:

$ sudo iptables -t nat -D PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

Step-24. After putting the domain name, we have to define the openmrs path as /openmrs to run the OpenMRS. But we have to redirect openmrs as a default page for Tomcat. After this openmrs will be redirect as default page to domain.

Previously http://demo.intelehealth.io/openmrs will open First login page.

$ sudo touch /var/lib/tomcat7/webapps/ROOT/openmrs_tomcat_redirect.html
$ sudo nano /var/lib/tomcat7/webapps/ROOT/openmrs_tomcat_redirect.html

Paste these line of code to openmrs_tomcat_redirect.html file

<?xml version="1.0" encoding="ISO-8859-1"?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">

<head>

<meta http-equiv="refresh" content="0; URL=openmrs">

</head>

<body>

</body>

</html>

$ sudo chown -R tomcat7:tomcat7  /var/lib/tomcat7/webapps/ROOT/openmrs_tomcat_redirect.html
$ sudo nano /var/lib/tomcat7/conf/web.xml

locate welcome file list " <welcome-file-list> " and replace

<welcome-file>index.html</welcome-file> to

<welcome-file>openmrs_tomcat_redirect.html</welcome-file>

Now, restart tomcat. OpenMRS will run as default page for tomcat. http://demo.intelehealth.io .

____________________________________IMPORTANT_________________________________________________

# Snapshot " InteleHealth_Basic_setup_Snapshot "

It configured as user. In snapshot it is installed Reference_Application_2.7.0 please downgrade it to 2.6.0.

It contains

jdk 8, Firefox, Tomcat7, mysql-server mysql-client ,

OpenMRS_Platform_2.0.5, OpenMRS_Reference_Application_2.7.0,

MongoDB, NodeJS, Parse-Server, Parse-Dashboard, Mongodb-runner


Web server security is the protection of information assets that can be accessed from a Web server. Web server security is important for any organization that has a physical or virtual Web server connected to the Internet. It requires a layered defense and is especially important for organizations with customer-facing websites. Server security comes to being confidentially, integrity, availability of appropriate information and authentication. A leaky server can cause a vital harm to an organisation. So security is the most complex topic that the modern world is concerned about. A security breach incurs a cost for the organisation in the terms of money as well as good will. Databases store confidential and sensitive information. Hence, it is the most important task of an organisation to safeguard crucial information from being stolen and misused. here

  • SSH login (weak passwords).
  • Users login (Stale and Unnecessary Accounts).
  • Firewall ( open network ports ).
  • update (old software version).
  • Off pwd login/only allow SSH & Off Root login.
  • Fail2ban (block failed attempt).
  • CPU running (server's performance).
  • rkhunter(malware detection).
  • Port 8080 should not be shown

1. SSH Login

SSH is a secure protocol used as the primary means of connecting to Linux servers remotely. It provides a text-based interface by spawning a remote shell. After connecting, all commands you type in your local terminal are sent to the remote server and executed there. SSH stands for Secure Shell and provides a safe and secure way of executing commands, making changes, and configuring services remotely. When you connect through SSH, you log in using an account that exists on the remote server. here.

When ever you create a user don't forget to set authentication to ssh.

2. User login

A user’s account details that show login details as well as what users are doing on the system. here

$ id is a simple command line utility for displaying a real and effective user and group IDs as follows.

$ groups command is used to show all the groups a user belongs to like this.

$ finger root command is used to search information about a user on Linux. It doesn’t come per-installed on many Linux systems. It shows a user’s real name; home directory; shell; login: name, time; and so much more

$ grep -i username /etc/passwd is a powerful pattern searching tool available on most if not all Linus systems. You can use it to find information about a specific user from the system accounts file: /etc/passwd .

$ last commands displays a list of last logged in users on the system.

$ users command shows the usernames of all users currently logged on the system .

$ who -u who command is used to display users who are logged on the system, including the terminals they are connecting from.

3. Firewall

Forgetting to secure and configure a dedicated server firewall is a common mistake and a huge security flaw. Firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. A firewall typically establishes a barrier between a trusted internal network and untrusted external network, such as the Internet.Going into the firewall’s configuration allows you to remove unnecessary software that’s connected to the internet. This makes your server and its ports vulnerable to intrusion. here

sudo apt-get install ufw (Install the firewall to the server).

  • $ sudo ufw allow 80
  • $ sudo ufw allow 22
  • $ sudo ufw allow 8080

4. Update

Although having fully patched software does not necessarily mean your server is fully secure, it is still very important to update your operating system and any other software running on it with the latest security patches. Upto this day, hacking incidents still occur because hackers took advantage and exploited un-patched servers and software.

apt-get update doesn't actually install new versions of software. Instead, it updates the package lists for upgrades for packages that need upgrading, as well as new packages that have just come to the repositories.

5. Off pwd login/only allow SSH.

Open the ssh configuration file with the help of this command $ nano /etc/ssh/sshd_config and set all the configuration. This configure allow all the security features to the server.

  • PermitRootLogin no
  • PubkeyAuthentication yes
  • PasswordAuthentication no

If " PermitRootLogin " is set to No, it defines that you can't enter the server via the Root. You will have to enter only through the user. If set to YES defines you can enter through the root.

" PubkeyAuthentication " Yes define you need the private key to enter to the server, NO define you don't need Private key to enter the server. "PasswordAuthentication " No define server not require the sever password to login, it only opened via ssh Private key, YES defines it required the password to login. Then restart the ssh $ /etc/init.d/sshd restart .

6.Fail2ban

Fail2ban is a log-parsing application that monitors system logs for symptoms of an automated attack on your Linode. When an attempted compromise is located, using the defined parameters, Fail2ban will add a new rule to iptables to block the IP address of the attacker, either for a set amount of time or permanently. Fail2ban can also alert you through email that an attack is occurring.

This command helps to install fail2ban apt-get install fail2ban

Go to the fail2ban directory cd /etc/fail2ban

The jail.conf file will enable Fail2ban for SSH by default for Debian and Ubuntu, but not CentOS. All other protocols and configurations (HTTP, FTP, etc.) are commented out. If you want to change this, create a jail.local for editing:

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Once the file is copied, we can open the original jail.conf file to see how things are set up by default

sudo nano /etc/fail2ban/jail.local

Make some changes to config the fail 2 ban according to your requirements

ignoreip = 127.0.0.1/8 xxx.x.x.xxx yyy.y.y.yyy (Fail2ban will not ban a host which matches an address in this list)

bantime = 3600 (the number of seconds that a host is banned)

findtime = 86400 (If ban the again try after this time period)

maxretry = 3 ( the number of failures before a host get banned)

destemail = root@localhost ( Destination email address used solely for the interpolations)

sender = root@localhost ( Sender email address used solely for some actions)

# SSH servers [sshd]

enabled = true

port = ssh

logpath = %(sshd_log)s

maxretry = 5

Afterwards, you can restart fail2ban to implement the wrapping rules: sudo sudo service fail2ban start

$ nano /var/mail/root

7. CPU running

The Linux kernel is an incredible circus performer, carefully juggling many processes and their resource needs to keep your server humming along. The kernel is also all about equity: when there is competition for resources, the kernel tries to distribute those resources fairly. A particular process might consume more CPU usage, and affects the performance of the whole system. Since that particular process consumes more CPU, you couldn’t do other tasks. You need to wait for the that process to finish before starting a new task.

top will display what is using your CPU. If you have it installed, htop allows you more fine-grained control, including filtering by—in your case—CPU.

$ sudo apt install cputool

use $ top command and see the process which takes too much cpu load. Find the PID (process id) of that process and put the limit of that process to use the cpu as you want 50% or 20%.

# cputool --cpu-limit 50 -p 8275 

where 50 defines the target % of that process & 8275 defines the PID of that particular process.

8. RK_Hunter

(RootKill Hunter) Rootkits are software secretly installed by a malicious intruder to allow that user continued access to the server once security is breached. This is an extremely dangerous problem, because even after the entry vector that the user originally used to gain access is fixed, they can continue to enter the server using the rootkit they installed. here & here. Change to the root directory.

$ sudo apt-get install rkhunter

Configure and Use RKHunter and make some changes

$ nano /etc/default/rkhunter
  • CRON_DAILY_RUN=" true "
  • CRON_DB_UPDATE=" true "
  • DB_UPDATE_EMAIL=" true "

Open and configure one more file, this will send the mail to your mail id about the malware detection.

$ nano /etc/rkhunter.conf make some changes to this place.

MAIL-ON-WARNING="youremail@yourdomain.com"

Now update it with $ rkhunter --update

Now run the command to start the scan. $ rkhunter --check --sk

You can check the log file for warning $ nano /var/log/rkhunter.log

9. disable :8080 from URL

Please follow the setup instruction step-23 for this.

___________________________________________________________________________________________________________________________________