Linux deployment
Hideez Enterprise Server on CentOS or Ubuntu Server

System Requirements

  • Can be installed on a bare metal or virtual server
  • 8GB drive
  • 2GB RAM
  • Option 1: Clean installation of CentOS Linux x86_64 7.6, select "minimal install" option during installation
  • Option 2: Clean installation of CentOS Linux x86_64 8.2, select "minimal install" option during installation
  • Option 3: Clean installation of Ubuntu Server LTS 18.04
  • Option 4: Clean installation of Ubuntu Server LTS 20.04

Before you start

1. Preparation

1.1 System Update

CentOS 7
1
$ sudo yum update -y
Copied!
CentOS 8
1
$ sudo dnf update -y
Copied!
Ubuntu
1
$ sudo apt update
2
$ sudo apt upgrade -y
Copied!
Reboot system
1
$ sudo reboot
Copied!

1.2 Disable SELinux (CentOS only)

1
$ sudo sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
2
$ sudo reboot
Copied!
To verify that SELinux is disabled, you can type:
1
$ sudo sestatus
2
SELinux status: disabled
Copied!
Note: on production servers, usually after installation and verification, you need to re-enable SELinux and configure it accordingly.

1.3 Firewall Configuration (optional)

To access the server from the network, ports 80 and 443 and port 22 (default port for connection via ssh) should be opened:
CentOS:
1
$ sudo firewall-cmd --zone=public --permanent --add-port=22/tcp
2
$ sudo firewall-cmd --zone=public --permanent --add-port=80/tcp
3
$ sudo firewall-cmd --zone=public --permanent --add-port=443/tcp
4
$ sudo firewall-cmd --reload
Copied!
Ubuntu:
1
$ sudo ufw allow 22
2
$ sudo ufw allow 80
3
$ sudo ufw allow 443
4
$ sudo ufw enable
Copied!

2. Installing Prerequisites

2.1 Install MySQL version 8

CentOS 7:
1
$ sudo rpm -Uvh https://dev.mysql.com/get/mysql80-community-release-el7-3.noarch.rpm
2
$ sudo yum install mysql-server -y
Copied!
CentOS 8:
1
$ sudo dnf install mysql-server -y
Copied!
Ubuntu 18.04:
1
$ wget -c https://dev.mysql.com/get/mysql-apt-config_0.8.16-1_all.deb
2
$ sudo dpkg -i mysql-apt-config_0.8.16-1_all.deb
Copied!
note: click "ok" to confirm the server installation
1
$ sudo apt update
2
$ sudo apt install mysql-server -y
Copied!
during the installation you will be prompted to enter the mysql user password. Remember this password for future use.
Ubuntu 20.04:
1
$ sudo apt install mysql-server -y
Copied!

2.2 Install Nginx

CentOS 7:
1
$ sudo yum install epel-release -y
2
$ sudo yum install nginx -y
3
$ sudo systemctl enable nginx
Copied!
CentOS 8:
1
$ sudo dnf install nginx -y
2
$ sudo systemctl enable nginx
Copied!
Ubuntu:
1
$ sudo apt install nginx -y
Copied!

2.3 Installing additional packages

Ubuntu:
1
$ sudo apt install git libgdiplus libicu jq gss-ntlmssp-dev -y
Copied!
Centos:
1
$ sudo yum install git libgdiplus libicu jq gss-ntlmssp -y
Copied!

3. Configuring MySQL Server and Database

3.1 Enable and start MySQL service (CentOS only):

CentOS:
1
$ sudo systemctl restart mysqld.service
2
$ sudo systemctl enable mysqld.service
Copied!

3.2 Verification of the Server availability

Run the following command to check that the server is running and has the correct version:
1
$ mysql -V
2
mysql Ver 8.0.26 for Linux on x86_64 (MySQL Community Server - GPL)
Copied!

3.3 Setting a permanent root password and MySQL security settings

MySQL expects that your new password should consist of at least 8 characters, contain uppercase and lowercase letters, numbers and special characters (do not forget the password you set, it will come in handy later). After a successful password change, the following questions are recommended to answer "Y":
[Note]:
  • In CentOS 7, the default root password can be found using sudo grep "A temporary password" /var/log/mysqld.log
  • In CentOS 8, the root password is empty by default
  • In Ubuntu 18.04 the password was entered during installation of MySQL
  • In ubuntu 20.04 the password is empty after installation
1
$ sudo mysql_secure_installation
Copied!
Depending on the version of linux, the output of commands may differ slightly. The following is an example for CentOs 7:
1
Enter password for user root:
2
3
The existing password for the user account root has expired. Please set a new password.
4
5
New password:
6
Re-enter new password:
7
8
Remove anonymous users? (Press y|Y for Yes, any other key for No) : y
9
10
Disallow root login remotely? (Press y|Y for Yes, any other key for No) : y
11
12
Remove test database and access to it? (Press y|Y for Yes, any other key for No) : y
13
14
Reload privilege tables now? (Press y|Y for Yes, any other key for No) : y
Copied!
To verify that everything is correct, you can run
1
$ sudo mysql -h localhost -u root -p
Copied!
After entering password, you will see MySQL console with a prompt:
1
Enter password:
2
Welcome to the MySQL monitor. Commands end with ; or \g.
3
Your MySQL connection id is 10
4
Server version: 8.0.22 MySQL Community Server - GPL
5
6
Copyright (c) 2000, 2020, Oracle and/or its affiliates. All rights reserved.
7
8
Oracle is a registered trademark of Oracle Corporation and/or its
9
affiliates. Other names may be trademarks of their respective
10
owners.
11
12
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
13
14
mysql>
Copied!

3.4 Creating a MySQL user and database for Hideez Enterprise Server

The following lines create a database db, the user user with the password <user_password>. Сhange <user_password> to a strong password, otherwise you may get a password validator error.
1
### CREATE DATABASE
2
mysql> CREATE DATABASE db;
3
4
### CREATE USER ACCOUNT
5
mysql> CREATE USER 'user'@'127.0.0.1' IDENTIFIED BY '<user_password>';
6
7
### GRANT PERMISSIONS ON DATABASE
8
mysql> GRANT ALL ON db.* TO 'user'@'127.0.0.1';
9
10
### RELOAD PRIVILEGES
11
mysql> FLUSH PRIVILEGES;
Copied!
You should remember the user password, it will come in handy later.
To exit from the MySql console, press Ctrl+D.

4. Installing the HES server

4.1 Download HES server

1
$ cd ~
2
$ curl -O https://update.hideez.com/hes/linux_x64_latest.tar.gz
Copied!

4.2 Extracting files and moving to the /opt directory

1
$ tar -xvf linux_x64_latest.tar.gz
2
$ sudo mv HES /opt/
Copied!

4.3 Configuring the HES

Copy appsettings.json to appsettings.Production.json
1
$ sudo cp /opt/HES/appsettings.json /opt/HES/appsettings.Production.json
Copied!
Edit the file /opt/HES/appsettings.Production.json
1
{
2
"ConnectionStrings": {
3
"DefaultConnection": "server=127.0.0.1;port=3306;database=db;uid=user;pwd=<user_password>"
4
},
5
6
"EmailSender": {
7
"Host": "<smtp_host>",
8
"Port": "<smtp_port>",
9
"EnableSSL": true,
10
"UserName": "<email_address>",
11
"Password": "<email_password>"
12
},
13
14
"ServerSettings": {
15
"ServerUrl": "https://<your_domain_name>",
16
"ServerFullName": "Hideez Enterprise Server",
17
"ServerShortName": "HES",
18
"CompanyName": "Hideez Group Inc.",
19
"ReverseProxyHandleSSL": true,
20
"UpdateUrl": "https://update.hideez.com/hes/build.json"
21
},
22
...
Copied!
Replace the following settings in this file with your own:
  • <user_password> - Password for the user on MySQL server
  • <smtp_host> - Host name of your SMTP server (example: smtp.example.com)
  • <smtp_port> - Port number of your SMTP server (example: 123)
  • <email_address> - Your email adress (example: [email protected])
  • <email_password> - Password to access the SMTP server (example: password)
  • <you_domain_name> - you fully qualified domain name (FQDN) of your HES site (example: hideez.example.com)
Important note: by default, .Net Core uses ports 5000 and 5001. Therefore, if only one domain is running on the server, port numbers can be skipped. But if it is supposed to run a few sites on one computer, then it is necessary to specify different ports for each site in json file. For example, for a site to listen to ports 6000 and 6001, after "AllowedHosts": "*" add the following (via comma) :
1
,
2
"Kestrel": {
3
"Endpoints": {
4
"Http": {
5
"Url": "http://localhost:6000"
6
},
7
"Https": {
8
"Url": "https://localhost:6001"
9
}
10
}
11
}
Copied!
The basic format of a connection string includes a series of keyword/value pairs separated by semicolons. The equal sign (=) connects each keyword and its value. To include values that contain a semicolon, single-quote character, or double-quote character, the value must be enclosed in double quotation marks. If the value contains both a semicolon and a double-quote character, the value can be enclosed in single quotation marks. The single quotation mark is also useful if the value starts with a double-quote character. Conversely, the double quotation mark can be used if the value starts with a single quotation mark. If the value contains both single-quote and double-quote characters, the quotation mark character used to enclose the value must be doubled every time it occurs within the value.

4.4 Daemonizing of the Enterprise Server

We prepared file for to start and manage the HES server in the /opt/HES/Deploy directory
Copy file HES.service to the /lib/systemd/system/:
1
$ sudo cp /opt/HES/Deploy/HES.service /lib/systemd/system/HES.service
Copied!
Enabling autostart:
1
$ sudo systemctl enable HES.service
2
$ sudo systemctl restart HES.service
Copied!
You can verify that HES server is running with the command:
1
$ sudo systemctl status HES
Copied!
The output of the command should be something like this:
1
● HES.service - Hideez Enterprise Service
2
Loaded: loaded (/usr/lib/systemd/system/HES.service; enabled; vendor preset: disabled)
3
Active: active (running) since Wed 2020-03-25 09:05:04 UTC; 34s ago
4
Main PID: 2964 (HES.Web)
5
CGroup: /system.slice/HES.service
6
└─2964 /opt/HES/HES.Web
7
8
Mar 25 09:05:04 hesservertest systemd[1]: Started Hideez Enterprise Service.
Copied!

5. Configuring Reverse Proxy Server

To access your server from the local network as well as from the Internet, you have to configure a reverse proxy. We will use the Nginx server for this.

5.1 Creating a Self-Signed SSL Certificate for Nginx

Note 1:
In production, you should take care of acquiring a certificate from a certificate authority. For a self-signed certificate, the browser will alert you that site has security issues.
Note 2:
When generating a certificate, answer a few simple questions, of which Common Name (CN) will be important - here be the name of your site, in our example it is hideez.example.com
1
$ sudo mkdir /etc/nginx/certs
2
$ sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/certs/hes.key -out /etc/nginx/certs/hes.crt
Copied!
1
Country Name (2 letter code) [AU]:.
2
State or Province Name (full name) [Some-State]:.
3
Locality Name (eg, city) []:.
4
Organization Name (eg, company) [Internet Widgits Pty Ltd]:.
5
Organizational Unit Name (eg, section) []:.
6
Common Name (e.g. server FQDN or YOUR name) []:hideez.example.com
7
Email Address []:.
Copied!

5.2 Updating Nginx config

We prepared some Nginx configurations for different versions of Linux and placed them in the /opt/HES/Deploy directory. You may just copy the corresponding file or you can review and edit it for your needs.
CentOS 7:
1
$ sudo cp /opt/HES/Deploy/CentOS7/nginx.conf /etc/nginx/nginx.conf
Copied!
CentOS 8:
1
$ sudo cp /opt/HES/Deploy/CentOS8/nginx.conf /etc/nginx/nginx.conf
Copied!
Ubuntu 18:
1
$ sudo cp /opt/HES/Deploy/Ubuntu18/nginx.conf /etc/nginx/nginx.conf
Copied!
Ubuntu 20:
1
$ sudo cp /opt/HES/Deploy/Ubuntu20/nginx.conf /etc/nginx/nginx.conf
Copied!
After copying the file, it is recommended to verify nginx settings:
1
$ sudo nginx -t
Copied!
The output should be something like this:
1
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
2
nginx: configuration file /etc/nginx/nginx.conf test is successful
Copied!
Otherwise, you should carefully review the settings and correct the errors.

5.3 Restart nginx

1
$ sudo systemctl restart nginx
Copied!

5.4 Check that nginx service is installed and started

1
$ sudo systemctl status nginx
Copied!
The output would be something like this:
1
* nginx.service - The nginx HTTP and reverse proxy server
2
Loaded: loaded (/usr/lib/systemd/system/nginx.service; enabled; vendor preset: disabled)
3
Active: active (running) since Sat 2020-01-25 08:22:56 UTC; 8min ago
4
Process: 1702 ExecStart=/usr/sbin/nginx (code=exited, status=0/SUCCESS)
5
Process: 1700 ExecStartPre=/usr/sbin/nginx -t (code=exited, status=0/SUCCESS)
6
Process: 1699 ExecStartPre=/usr/bin/rm -f /run/nginx.pid (code=exited, status=0/SUCCESS)
7
Main PID: 1704 (nginx)
8
CGroup: /system.slice/nginx.service
9
+-1704 nginx: master process /usr/sbin/nginx
10
+-1705 nginx: worker process
Copied!

6. Final Verification

After these steps, your server should be up and running. Go to the https://<you_domain_name> in the browser and verify if the site is available.
Note: for a self-signed certificate, it should be a warning that your connection isn't private. Press Advanced/Proceed to ignore the warning.

Updating HES

Option 1 (using a script)

To update the server, you can use the update.sh script, which is located in the HES directory (/opt/HES default). You can run it either manually or through the web interface (by clicking on the server version). If an update is available, you will be prompted to update the server using a script. If you have changed the location of the server, the name of the service to run, you can manually specify the necessary parameters in the script.

Option 2 (without using a script)

2.1 Stopping HES Service

1
$ sudo systemctl stop HES
Copied!

2.2 Back up the HES binaries and the configuration file

1
$ sudo mv /opt/HES /opt/HES.old
Copied!

2.3 Back up the MySQL Database

The following command will create a copy (dump) of the database in file db.sql in /opt/HES.old directory:
1
$ sudo mysqldump -uroot -p<MySQL_root_password> db > /opt/HES.old/db.sql
Copied!
change <MySQL_root_password> with your real password

2.4 Download a new version of the HES

1
$ cd ~
2
$ curl -O https://update.hideez.com/hes/linux_x64_latest.tar.gz
3
$ tar -xvf linux_x64_latest.tar.gz
4
$ sudo mv HES /opt/
Copied!

2.5 Restore the configuration file

1
$ sudo cp /opt/HES.old/appsettings.Production.json /opt/HES/appsettings.Production.json
Copied!

2.6 Restart the HES and check its status

1
$ sudo systemctl restart HES
2
$ sudo systemctl status HES
3
4
5
● HES-hideez.example.com.service - Hideez Enterprise Service
6
Loaded: loaded (/usr/lib/systemd/system/HES-hideez.example.com.service; enabled; vendor preset: disabled)
7
Active: active (running) since Wed 2020-03-25 10:48:12 UTC; 16s ago
8
Main PID: 4657 (HES.Web)
9
CGroup: /system.slice/HES.service
10
└─4657 /opt/HES/HES.Web
11
12
Mar 25 10:48:12 hesservertest systemd[1]: Started Hideez Enterprise Service.
Copied!

If something goes wrong, you can restore the HES server using the following commands

1
$ sudo systemctl stop HES
2
$ sudo mv /opt/HES.old /opt/HES
3
$ sudo mysql -uroot -p<MySQL_root_password> db < /opt/HES.old/db.sql
4
$ sudo systemctl start HES
Copied!
change <MySQL_root_password> with your real password

After checking that the update was successful and everything works fine, you can delete copies of the database and server:

1
$ sudo rm -rf /opt/HES.old
Copied!
Last modified 11d ago