ULYSSIS documentation - User contributions [en]

Getting SSL/TLS

2020-12-12T00:35:48Z

Principis: /* Getting your certificates installed */

ULYSSIS does not sell or offer any other SSL certificates than our self-signed certificate. We will however guide requests and install a certificate from the KU Leuven is you are eligible for one, and we will also install certificates you have bought or obtained elsewhere.

==Requesting SSL from the KU Leuven==

The KU Leuven partners with other universities through TERENA/Géant to arrange certificates for its services, organisations and academic structures. We have permission to request free SSL/TLS certificates for student unions (kringen) recognized by LOKO or faculty consultative bodies (facultaire overlegorganen) recognized by Stura body as well as organisations (vrije verenigingen) recognized by LOKO or KU Leuven.

Before sending us a request, the following steps have to be performed:
* Set up the site that needs SSL if that's not already the case
* Create a forwarder from hostmaster@yourdomain.tld to ulyssis@ulyssis.org
* Make sure our nameservers are being used for the involved domain(s), as explained on [[Adding domain names]]
* Consider all subdomains (whether separate websites or not) you wish to have certificates for
* Make a list of all relevant arguments for your use of SSL/TLS certificates. It's important to consider aspects of your website where important or personal information is exchanged: registration, login pages, newsletter signup, etc.

When '''all''' steps are done, the account holder of the ULYSSIS account can send an email to ulyssis@ulyssis.org containing their name, the name of the organisation, the relevant arguments what you will use SSL for and the domain and if needed a list of subdomains that should be covered by the certificate.

Based on our previous experience and our arrangements with ICTS we will consider whether you are eligible for certificates and whether your request is well-founded. We will then generate the required cryptographic key and request and submit them on the certificate platform supplied by ICTS and its partners. Depending on the situation, the verification and delivery of the certificate can take some time. As soon as the certificate has been issued, we will install it and notify you.

For procedures to request certificates, we follow instructions from ICTS. These instructions have changed several times in the past, so it's possible for a new request or for a renewal, you may have to follow a different procedure or make changes.

{{notice|Limitations|ICTS does not allow SSL requests for historic *.student.kuleuven.be domains. We judge requests for username.ulyssis.be and username.studentenweb.org on an individual basis.}}

==External certificates==
To install external certificates we require the certificate itself, the private key, and possibly the chain. We prefer you also send us (a link to) the documentation of your supplier. As certificate files, especially private keys, are a delicate matter we suggest you just email us the path in your homedirectory you've put them and we will move them over to the webserver safely. For more information concerning this procedure you can always contact us on ulyssis@ulyssis.org

===Let's Encrypt===
We currently do not have an automated system for renewing and deploying certificates such as those supplied by Let's Encrypt. We are however looking into automating this process in the future. Since more of our users are starting to use Let's Encrypt, and all of their certificates need to be renewed frequently, we have a specific procedure now.

When wishing to add a certificate with Let's Encrypt to your website, or renew your existing one, first create a folder <code>letsencrypt</code> in your '''home directory'''. Then add a folder per domain or group of domains:

mkdir -p ~/letsencrypt/mydomain.be

Certificates should be stored in these folders, according to the following file structure:

letsencrypt/
└── mydomain.be/
├── mydomain.be.chain (the CA file)
├── mydomain.be.crt (the cert file; "public key")
└── mydomain.be.key (the key file; "private key")

If you already possess the necessary files, renaming and copying them accordingly is sufficient.
'''You still have to email us to install your certificate.''' More information in the last section on this page.

Otherwise, you can generate or renew your certificates using acme.sh. This is explained in the next section.

==== Generating certificates ====
{{notice|If you use a <code>.htaccess</code> file in the webroot of the domain name, make sure to add the following lines at the top of the file:|<pre><IfModule mod_rewrite.c>
RewriteRule "^.well-known/acme-challenge" - [L]
</IfModule></pre>}}
Because the normal method of generating Let's Encrypt certificates, certbot, requires root access, it's impossible for normal users to do so on our servers. Luckily there are plenty of alternatives which implement the Let's Encrypt protocol. In this tutorial, we'll show how to use the acme.sh program to generate certificates on the ULYSSIS servers. '''If you already followed this section to generate certificates, skip to the next section on renewing certificates.'''

Firstly, execute the following commands to download the acme.sh script in your home directory and make it executable:

curl -o ~/acme.sh https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
chmod +x ~/acme.sh

Next, determine for which domains and subdomains you want to generate a certificate. You will need to generate a single certificate for each domain and subdomain which points to the same folder on your account (in most cases this is <code>www</code> in your home directory).

The following example command will generate a certificate for <code>mydomain.be</code> and <code>www.mydomain.be</code> which points to the <code>www</code> folder in the home directory. '''Change the parameters''' as explained below before executing this command!

~/acme.sh --issue --cert-file ~/letsencrypt/mydomain.be/mydomain.be.crt --key-file ~/letsencrypt/mydomain.be/mydomain.be.key --ca-file ~/letsencrypt/mydomain.be/mydomain.be.chain -m "email@mydomain.be" -w ~/www -d mydomain.be -d www.mydomain.be

The explanation of these many parameters is as follows:
* <code>--issue</code> tells acme.sh to generate a new certificate.
* <code>--cert-file ~/letsencrypt/mydomain.be/mydomain.be.crt</code> tells acme.sh to store the certificate file in the <code>letsencrypt/mydomain.be</code> folder in your home directory, using the special file name as required by the file structure. '''This folder should already exist''', please refer to the previous section if you have not created this folder yet.
* <code>--key-file ~/letsencrypt/mydomain.be/mydomain.be.key</code> tells acme.sh to store the key file in the <code>letsencrypt/mydomain.be</code> folder in your home directory, using the special file name as required by the file structure.
* <code>--ca-file ~/letsencrypt/mydomain.be/mydomain.be.chain</code> tells acme.sh to store the CA file in the <code>letsencrypt/mydomain.be</code> folder in your home directory, using the special file name as required by the file structure.
* <code>-m "email@mydomain.be"</code> tells acme.sh the email address associated with the certificate. Let's Encrypt will remind this email address (if provided) when the certificate is close to expiring.
* <code>-w ~/www</code> tells acme.sh where the domains in this certificate point to. Make sure to change the <code>www</code> part if the domains point to a different folder in your home directory.
* <code>-d mydomain.be</code> and <code>-d www.mydomain.be</code> tell acme.sh that the certificate should protect <code>mydomain.be</code> and <code>www.mydomain.be</code>. The first domain name will be the "main domain", which is important for renewing. You should '''add all domain names''' pointing to the <code>-w</code> folder.

After executing this command with the right parameters, your certificate should be generated successfully. When you have to renew the certificate in the future, you should follow the instructions in the next section. '''Don't forget to email us to install your new certificate.''' More information in the last section on this page.

==== Renewing certificates ====
To renew the certificates of <code>mydomain.be</code>, just execute:
~/acme.sh --renew -d mydomain.be

For the <code>-d</code> parameter, you have to provide the '''first''' domain name you provided when generating the certificate (in the previous section, this was <code>mydomain.be</code>.

If you are not sure which domain name to use, you can execute the command:
~/acme.sh --list

This will generate a list of available certificates, which looks a bit like this:
Main_Domain KeyLength SAN_Domains CA Created Renew
mydomain.be "" www.mydomain.be LetsEncrypt.org ... ...
... ... ... ... ... ...

In this example, the main domain is <code>mydomain.be</code>.

The renewed certificates will automatically be copied to the files you provided in the command to generate the certificates (see previous section).

'''After renewing the certificate, you have to email us to install your certificate.''' More information in the next section.

==== Getting your certificates installed ====
Check whether everything is stored correctly by executing the following command:
ulyssis-certificate check mydomain.be

If everything looks good, you should only see lines starting with <code>[ OK ]</code>. Any line starting with <code>[FAIL]</code> or <code>[ABRT]</code> means a check has failed, you must correct this error before asking us to install your certificate.

Once all steps are done and if you are the '''account holder''', '''you can send us an email clearly stating the account name, for which domains we need to add certificates and where the files are stored'''. If you are renewing existing certificates, also clearly state that in your email.

We have largely automated the installation of certificates. If you do not follow these instructions, your request will be denied or you may end up with broken SSL, so make sure you follow this procedure carefully.

[[Category:Webserver]]

Getting SSL/TLS

2020-12-12T00:31:56Z

Principis: /* Getting your certificates installed */

ULYSSIS does not sell or offer any other SSL certificates than our self-signed certificate. We will however guide requests and install a certificate from the KU Leuven is you are eligible for one, and we will also install certificates you have bought or obtained elsewhere.

==Requesting SSL from the KU Leuven==

The KU Leuven partners with other universities through TERENA/Géant to arrange certificates for its services, organisations and academic structures. We have permission to request free SSL/TLS certificates for student unions (kringen) recognized by LOKO or faculty consultative bodies (facultaire overlegorganen) recognized by Stura body as well as organisations (vrije verenigingen) recognized by LOKO or KU Leuven.

Before sending us a request, the following steps have to be performed:
* Set up the site that needs SSL if that's not already the case
* Create a forwarder from hostmaster@yourdomain.tld to ulyssis@ulyssis.org
* Make sure our nameservers are being used for the involved domain(s), as explained on [[Adding domain names]]
* Consider all subdomains (whether separate websites or not) you wish to have certificates for
* Make a list of all relevant arguments for your use of SSL/TLS certificates. It's important to consider aspects of your website where important or personal information is exchanged: registration, login pages, newsletter signup, etc.

When '''all''' steps are done, the account holder of the ULYSSIS account can send an email to ulyssis@ulyssis.org containing their name, the name of the organisation, the relevant arguments what you will use SSL for and the domain and if needed a list of subdomains that should be covered by the certificate.

Based on our previous experience and our arrangements with ICTS we will consider whether you are eligible for certificates and whether your request is well-founded. We will then generate the required cryptographic key and request and submit them on the certificate platform supplied by ICTS and its partners. Depending on the situation, the verification and delivery of the certificate can take some time. As soon as the certificate has been issued, we will install it and notify you.

For procedures to request certificates, we follow instructions from ICTS. These instructions have changed several times in the past, so it's possible for a new request or for a renewal, you may have to follow a different procedure or make changes.

{{notice|Limitations|ICTS does not allow SSL requests for historic *.student.kuleuven.be domains. We judge requests for username.ulyssis.be and username.studentenweb.org on an individual basis.}}

==External certificates==
To install external certificates we require the certificate itself, the private key, and possibly the chain. We prefer you also send us (a link to) the documentation of your supplier. As certificate files, especially private keys, are a delicate matter we suggest you just email us the path in your homedirectory you've put them and we will move them over to the webserver safely. For more information concerning this procedure you can always contact us on ulyssis@ulyssis.org

===Let's Encrypt===
We currently do not have an automated system for renewing and deploying certificates such as those supplied by Let's Encrypt. We are however looking into automating this process in the future. Since more of our users are starting to use Let's Encrypt, and all of their certificates need to be renewed frequently, we have a specific procedure now.

When wishing to add a certificate with Let's Encrypt to your website, or renew your existing one, first create a folder <code>letsencrypt</code> in your '''home directory'''. Then add a folder per domain or group of domains:

mkdir -p ~/letsencrypt/mydomain.be

Certificates should be stored in these folders, according to the following file structure:

letsencrypt/
└── mydomain.be/
├── mydomain.be.chain (the CA file)
├── mydomain.be.crt (the cert file; "public key")
└── mydomain.be.key (the key file; "private key")

If you already possess the necessary files, renaming and copying them accordingly is sufficient.
'''You still have to email us to install your certificate.''' More information in the last section on this page.

Otherwise, you can generate or renew your certificates using acme.sh. This is explained in the next section.

==== Generating certificates ====
{{notice|If you use a <code>.htaccess</code> file in the webroot of the domain name, make sure to add the following lines at the top of the file:|<pre><IfModule mod_rewrite.c>
RewriteRule "^.well-known/acme-challenge" - [L]
</IfModule></pre>}}
Because the normal method of generating Let's Encrypt certificates, certbot, requires root access, it's impossible for normal users to do so on our servers. Luckily there are plenty of alternatives which implement the Let's Encrypt protocol. In this tutorial, we'll show how to use the acme.sh program to generate certificates on the ULYSSIS servers. '''If you already followed this section to generate certificates, skip to the next section on renewing certificates.'''

Firstly, execute the following commands to download the acme.sh script in your home directory and make it executable:

curl -o ~/acme.sh https://raw.githubusercontent.com/acmesh-official/acme.sh/master/acme.sh
chmod +x ~/acme.sh

Next, determine for which domains and subdomains you want to generate a certificate. You will need to generate a single certificate for each domain and subdomain which points to the same folder on your account (in most cases this is <code>www</code> in your home directory).

The following example command will generate a certificate for <code>mydomain.be</code> and <code>www.mydomain.be</code> which points to the <code>www</code> folder in the home directory. '''Change the parameters''' as explained below before executing this command!

~/acme.sh --issue --cert-file ~/letsencrypt/mydomain.be/mydomain.be.crt --key-file ~/letsencrypt/mydomain.be/mydomain.be.key --ca-file ~/letsencrypt/mydomain.be/mydomain.be.chain -m "email@mydomain.be" -w ~/www -d mydomain.be -d www.mydomain.be

The explanation of these many parameters is as follows:
* <code>--issue</code> tells acme.sh to generate a new certificate.
* <code>--cert-file ~/letsencrypt/mydomain.be/mydomain.be.crt</code> tells acme.sh to store the certificate file in the <code>letsencrypt/mydomain.be</code> folder in your home directory, using the special file name as required by the file structure. '''This folder should already exist''', please refer to the previous section if you have not created this folder yet.
* <code>--key-file ~/letsencrypt/mydomain.be/mydomain.be.key</code> tells acme.sh to store the key file in the <code>letsencrypt/mydomain.be</code> folder in your home directory, using the special file name as required by the file structure.
* <code>--ca-file ~/letsencrypt/mydomain.be/mydomain.be.chain</code> tells acme.sh to store the CA file in the <code>letsencrypt/mydomain.be</code> folder in your home directory, using the special file name as required by the file structure.
* <code>-m "email@mydomain.be"</code> tells acme.sh the email address associated with the certificate. Let's Encrypt will remind this email address (if provided) when the certificate is close to expiring.
* <code>-w ~/www</code> tells acme.sh where the domains in this certificate point to. Make sure to change the <code>www</code> part if the domains point to a different folder in your home directory.
* <code>-d mydomain.be</code> and <code>-d www.mydomain.be</code> tell acme.sh that the certificate should protect <code>mydomain.be</code> and <code>www.mydomain.be</code>. The first domain name will be the "main domain", which is important for renewing. You should '''add all domain names''' pointing to the <code>-w</code> folder.

After executing this command with the right parameters, your certificate should be generated successfully. When you have to renew the certificate in the future, you should follow the instructions in the next section. '''Don't forget to email us to install your new certificate.''' More information in the last section on this page.

==== Renewing certificates ====
To renew the certificates of <code>mydomain.be</code>, just execute:
~/acme.sh --renew -d mydomain.be

For the <code>-d</code> parameter, you have to provide the '''first''' domain name you provided when generating the certificate (in the previous section, this was <code>mydomain.be</code>.

If you are not sure which domain name to use, you can execute the command:
~/acme.sh --list

This will generate a list of available certificates, which looks a bit like this:
Main_Domain KeyLength SAN_Domains CA Created Renew
mydomain.be "" www.mydomain.be LetsEncrypt.org ... ...
... ... ... ... ... ...

In this example, the main domain is <code>mydomain.be</code>.

The renewed certificates will automatically be copied to the files you provided in the command to generate the certificates (see previous section).

'''After renewing the certificate, you have to email us to install your certificate.''' More information in the next section.

==== Getting your certificates installed ====
Check whether everything is stored correctly by executing the following command:
ulyssis-certificate check mydomain.be

If everything looks good, you should only see lines starting with <code>[ OK ]</code>. Any line starting with <code>[FAIL]</code> or <code>[ABRT]</code> means a check has failed, you must correct this error before asking us to install your certificate.

Once all steps are done, the account holder can '''send us an email clearly stating the account name, for which domains we need to add certificates and where the files are stored'''. If you are renewing existing certificates, also clearly state that in the email.

We have largely automated the installation of certificates. If you do not follow these instructions, your request will be denied or you may end up with broken SSL, so make sure you follow this procedure carefully.

[[Category:Webserver]]

Getting SSL/TLS

2020-06-02T10:55:36Z

Principis: /* Renewing the certificates */

Getting SSL/TLS

2020-06-02T10:55:19Z

Principis: /* Generating the certificates */

Getting SSL/TLS

2020-06-02T10:32:05Z

Principis:

Add an alias in Gmail

2020-04-19T10:39:06Z

Principis: fix server

You may want to send e-mail from Gmail using your @ulyssis.org-address, or another domain name that you use for your account. Gmail allows you to do this, but asks for SMTP info. We don't provide SMTP on our own mail server, but you can use the SMTP servers of the KU Leuven.

# In Gmail, go to '''Settings''' (in Dutch: '''Instellingen''').
# Go to the tab '''Accounts and Import''' (in Dutch: '''Accounts en import''')
# Under '''Send mail as:''' ('''E-mailberichten sturen vanaf'''), click on: '''Add another email address you own''' ('''Nog een e-mailadres toevoegen waarvan je eigenaar bent''').
# Fill in your name and the e-mail address, and check '''Treat as an alias.''' ('''Beschouwen als alias.''') More info: https://support.google.com/a/answer/1710338
# Click on '''Next step''' ('''Volgende stap''').
# Fill in the following information SMTP information (https://admin.kuleuven.be/icts/services/email/begrippen):
#* '''SMTP server''': '''smtps.kuleuven.be'''
#* '''port''': 465
#* '''Username''': your student id
#* '''Password''': your KU Leuven password
#* SSL
# Press on '''Add Account''' ('''Account toevoegen''').

[[Category:Mail]]

Installing packages

2018-12-23T17:51:27Z

Principis: Added Node.js paragraph

While most webhosting providers give you access to a few or even just one programming language and a set amount of libraries, ULYSSIS prefers to offer more flexibility. We hope to give our users the chance to experiment with different languages, libraries and tools. There are of course also limits to what is realistic for us to install. More on that below.

== Using a programming language, library or tool that is not installed ==
If the package that you would like us to install is available in the software repository of our current operating system, then that is usually not a problem. We currently use Ubuntu on all our servers, specifically, we upgrade to the latest LTS every summer vacation following the release of a new one. You can verify which version we are running by executing "cat /etc/lsb-release" on one of our shellservers. After you have verified what version we are running, you can refer to https://packages.ubuntu.com/ to check whether your package is available in that version of Ubuntu. If it is, then you can contact us by email on ulyssis@ulyssis.org which package or packages you would like to have installed, and what you will be using it for. You will most likely get a positive response. If your package is not in the repository, you will have to go for a [[Installing packages#Manual installation|Manual installation]].

== Using a newer/different version ==
As you can read in the section concerning the installation of new packages, we only offer the version available in the repository of the version of Ubuntu that we are running. In most cases, this means you will have to wait for a version upgrade with the next LTS release, or go for a [[Installing packages#Manual installation|Manual installation]]. However, there are some exceptions. Sometimes multiple version will be available in the repository, such as with Python 2 and 3, or Perl 5 and 6. In such cases, you can refer to the section above for instructions on how to request an installation.

== Manual installation ==
If you want to install a piece of software that is not available in the repository or you wish to install another version, you can always install it manually onto your account.

It is important to keep in mind that ULYSSIS will not support manually installed software, and that you are fully responsible for the security of this software. You are free to ask us questions, but we will most probably not help you. If you do require a manual installation of specific software, we expect you to be capable of maintaining it as well.

The way you install your software differs depending on the software. You could be using tools such as pip, gem or npm to install to a directory in your home folder, you could be using a virtual environment, or you could be compiling your own binary. We suggest you look at the documentation of the software you're using very thoroughly, and make sure you are comfortable with what you are doing and aware of your responsibilities.

After installing your software locally onto your account, you will probably want to add an alias in your dotfiles (for example .profile or .bashrc) to make using your manually installed version easier. In case you are using your piece of software for a web service, you will want to make sure you edit your fastcgi script or any other involved scripts to use your binary by changing the path or hardcoding the location.
== Node.js ==
We do not offer Node.js by default because we can't give you the most recent release. But you can use nvm ([https://github.com/creationix/nvm Node Version Manager]) which installs the required version for you. The installation should be straightforward and a guide can be found [https://github.com/creationix/nvm#installation here].

Getting SSL/TLS

2018-03-14T20:05:51Z

Principis: /* Let's Encrypt */

Getting SSL/TLS

2018-03-14T20:02:26Z

Principis: /* Let's Encrypt */

Getting SSL/TLS

2018-03-13T13:39:58Z

Principis: /* Let's Encrypt */

Getting SSL/TLS

2018-03-13T13:37:46Z

Principis: /* Let's Encrypt */