OpenSSH

2026-04-19T18:27:33Z

Guzman:

== Instalación OpenSSH SFTP en Docker ==
Instalación de [https://hub.docker.com/r/atmoz/sftp atmoz/sftp] en Docker.
Esta imagen se usa principalmente para funciones de debug.

== Requisitos ==
Para poder realizar esta configuración se necesita:
* Docker Engine (ver [[Docker Engine]])
** Módulo: Docker Compose (para PRO)

== Descargar imagen ==
Vamos a usar la imagen que es la latest a día de hoy.
<syntaxhighlight lang="Bash">
docker pull atmoz/sftp:latest
</syntaxhighlight>

== Ejecutar SFTP con usuario/contraseña ==
<syntaxhighlight lang="Bash">
docker run -d \
--name openssh-sftp \
-p 2222:22 \
-v //mnt/host/c/Users/foo/Desktop/temp://home/foo/upload \
atmoz/sftp \
foo:1234:::upload
</syntaxhighlight>

Nota: se usa un volumen para guardar los datos persistentemente.

== Ejecutar SFTP con clave RSA ==
<syntaxhighlight lang="Bash">
docker run -d \
--name openssh-sftp \
-p 2222:22 \
-v //mnt/host/c/Users/foo/Desktop/temp://home/foo/upload \
-v //mnt/host/c/Users/foo/.ssh/foo.key.pub://home/foo/.ssh/keys/foo.key.pub:ro \
atmoz/sftp \
foo:1234:::upload
</syntaxhighlight>

Nota: se usa un volumen para pasar las claves dentro de el directorio "/home/foo/.ssh/keys" (no se puede pasar directamente el fichero authorized_keys por temas de permisos).

== Referencias ==
* [https://hub.docker.com/r/atmoz/sftp https://hub.docker.com/r/atmoz/sftp]

[[Categoría:Notas]]

2026-04-18T20:00:55Z

Guzman:

== Instalación servidor LEMP ==
Instalaremos:
* GNU Linux (Ubuntu Server 24.04)
* eNginx 1.24.0 (APT Ubuntu)
* MariaDB 10.8 (Repo oficiales de MariaDB)
* PHP 8.5 (PPA ondrej/php)

== Permisos de root ==
Todos los comandos en esta guía se realizarán como root.
<syntaxhighlight lang="Bash">sudo -i</syntaxhighlight>

== Instalación Nginx (Stable) ==
* Actualizar repositorio
<syntaxhighlight lang="Bash">apt update</syntaxhighlight>

* Instalar Nginx
<syntaxhighlight lang="Bash">apt install nginx</syntaxhighlight>

* Instalación Apache Utils
<syntaxhighlight lang="Bash">apt install apache2-utils</syntaxhighlight>

== Instalación MariaDB ==
* Instalar requisitos
<syntaxhighlight lang="Bash">apt install apt-transport-https curl</syntaxhighlight>

* Añadir repositorios MariaDB (oficiales)
<syntaxhighlight lang="Bash">mkdir -p /etc/apt/keyrings</syntaxhighlight>
<syntaxhighlight lang="Bash">curl -o /etc/apt/keyrings/mariadb-keyring.pgp 'https://mariadb.org/mariadb_release_signing_key.pgp'</syntaxhighlight>
<syntaxhighlight lang="Bash">vi /etc/apt/sources.list.d/mariadb.sources</syntaxhighlight>
<syntaxhighlight lang="text">
# MariaDB 11.8 repository list - created 2026-02-23 08:31 UTC
# https://mariadb.org/download/
X-Repolib-Name: MariaDB
Types: deb
# deb.mariadb.org is a dynamic mirror if your preferred mirror goes offline. See https://mariadb.org/mirrorbits/ for details.
# URIs: https://deb.mariadb.org/11.8/ubuntu
URIs: https://mirror.raiolanetworks.com/mariadb/repo/11.8/ubuntu
Suites: noble
Components: main main/debug
Signed-By: /etc/apt/keyrings/mariadb-keyring.pgp
</syntaxhighlight>

* Actualizar repositorio
<syntaxhighlight lang="Bash">apt update</syntaxhighlight>

* Instalación de servidor y cliente
<syntaxhighlight lang="Bash">apt install mariadb-client mariadb-server mariadb-plugin-provider-bzip2 mariadb-plugin-provider-lz4 mariadb-plugin-provider-lzma mariadb-plugin-provider-lzo mariadb-plugin-provider-snappy</syntaxhighlight>

* Inicializar base de datos
<syntaxhighlight lang="Bash">mysql_secure_installation</syntaxhighlight>
<syntaxhighlight lang="text">
NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

You already have your root account protected, so you can safely answer 'n'.

Switch to unix_socket authentication [Y/n] n
... skipping.

You already have your root account protected, so you can safely answer 'n'.

Change the root password? [Y/n] y
New password:
Re-enter new password:
Password updated successfully!
Reloading privilege tables..
... Success!

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them. This is intended only for testing, and to make the installation
go a bit smoother. You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] y
... Success!

Normally, root should only be allowed to connect from 'localhost'. This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] Y
... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access. This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] Y
- Dropping test database...
... Success!
- Removing privileges on test database...
... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] Y
... Success!

Cleaning up...

All done! If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!
</syntaxhighlight>

== Instalación PHP ==
Vamos a usar los repositorios PPA de ondrej/php

* Instalar repositorio PPA
<syntaxhighlight lang="Bash">add-apt-repository ppa:ondrej/php</syntaxhighlight>

* Actualizar repositorios
<syntaxhighlight lang="Bash">apt update</syntaxhighlight>

* Instalar PHP 8.5
<syntaxhighlight lang="Bash">apt install php8.5 php8.5-apcu php8.5-common php8.5-fpm php8.5-curl php8.5-gd php8.5-mysql php8.5-xml php8.5-xmlrpc php8.5-bz2 php8.5-imap php8.5-intl php8.5-mbstring php8.5-soap php8.5-gnupg php8.5-imagick php8.5-mcrypt php8.5-zip</syntaxhighlight>

== Instalación Let's Encrypt ==
Vamos a usar Let's Encrypt para generar las claves y certificados usadas para comunicaciones HTTPS.

* Instalar Snap Core
<syntaxhighlight lang="Bash">snap install core</syntaxhighlight>

* Refrescar Snap Core
<syntaxhighlight lang="Bash">snap refresh core</syntaxhighlight>

* Instalar Certbot
<syntaxhighlight lang="Bash">snap install --classic certbot</syntaxhighlight>

* Crear enlace simbólico
<syntaxhighlight lang="Bash">ln -s /snap/bin/certbot /usr/local/bin/certbot</syntaxhighlight>

* Comprobar que está activada el timer de renovación
<syntaxhighlight lang="Bash">
systemctl list-timers | grep certbot
Mon 2026-02-23 11:47:00 UTC 12h - - snap.certbot.renew.timer snap.certbot.renew.service
</syntaxhighlight>

== Configuración PHP ==
* Configuración php-fpm:
<syntaxhighlight lang="Bash">vi /etc/php/8.5/fpm/php.ini</syntaxhighlight>
<syntaxhighlight lang="text">
[...]
; Maximum amount of memory a script may consume
; https://php.net/memory-limit
memory_limit = 128M
max_memory_limit = -1
[...]
; Maximum size of POST data that PHP will accept.
; Its value may be 0 to disable the limit. It is ignored if POST data reading
; is disabled through enable_post_data_reading.
; https://php.net/post-max-size
post_max_size = 100M
[...]
; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting
; of zero causes PHP to behave as before. Default is 1. You should fix your scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; https://php.net/cgi.fix-pathinfo
cgi.fix_pathinfo=0
[...]
; Whether to allow HTTP file uploads.
; https://php.net/file-uploads
file_uploads = On
[...]
; Maximum allowed size for uploaded files.
; https://php.net/upload-max-filesize
upload_max_filesize = 100M
[...]
; Maximum number of files that can be uploaded via a single request
max_file_uploads = 20
[...]
[Session]
; Handler used to store/retrieve data.
; https://php.net/session.save-handler
session.save_handler = files
[...]
</syntaxhighlight>

* Configuración php-cli:
<syntaxhighlight lang="Bash">vi /etc/php/8.5/cli/php.ini</syntaxhighlight>
<syntaxhighlight lang="text">
[...]
; Maximum amount of memory a script may consume
; https://php.net/memory-limit
memory_limit = -1
max_memory_limit = -1
[...]
; Maximum size of POST data that PHP will accept.
; Its value may be 0 to disable the limit. It is ignored if POST data reading
; is disabled through enable_post_data_reading.
; https://php.net/post-max-size
post_max_size = 100M
[...]
; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting
; of zero causes PHP to behave as before. Default is 1. You should fix your scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; https://php.net/cgi.fix-pathinfo
cgi.fix_pathinfo=0
[...]
; Whether to allow HTTP file uploads.
; https://php.net/file-uploads
file_uploads = On
[...]
; Maximum allowed size for uploaded files.
; https://php.net/upload-max-filesize
upload_max_filesize = 100M
[...]
; Maximum number of files that can be uploaded via a single request
max_file_uploads = 20
[...]
[Session]
; Handler used to store/retrieve data.
; https://php.net/session.save-handler
session.save_handler = files
[...]
</syntaxhighlight>

* Reiniciar php-fpm:
<syntaxhighlight lang="Bash">systemctl restart php8.5-fpm.service</syntaxhighlight>

== Configuración Nginx ==
* Backup nginx.conf
<syntaxhighlight lang="Bash">cp -a /etc/nginx/nginx.conf /etc/nginx/nginx.conf.$(date +%Y%m%d)</syntaxhighlight>

* Editar nginx.conf
<syntaxhighlight lang="Bash">vi /etc/nginx/nginx.conf</syntaxhighlight>
<syntaxhighlight lang="text">
[...]
http {
##
# Basic Settings
##
sendfile on;
tcp_nopush on;
types_hash_max_size 2048;
client_max_body_size 100M;
server_tokens off;
[...]
##
# SSL Settings
##
#ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
[...]
}
</syntaxhighlight>

* Generar PHParam:
<syntaxhighlight lang="Bash">mkdir /etc/nginx/ssl</syntaxhighlight>
<syntaxhighlight lang="Bash">openssl dhparam -out /etc/nginx/ssl/dhparam.pem 4096</syntaxhighlight>

* Configurar contraseñas:
Si se quiere configurar contraseñas Auth Basic se almacenan en /etc/nginx/passwd.
<syntaxhighlight lang="Bash">mkdir /etc/nginx/passwd</syntaxhighlight>
Por ejemplo:
<syntaxhighlight lang="Bash">htpasswd -c -B /etc/nginx/passwd/test.pw guzman</syntaxhighlight>

* Configurar snippets:
Estos "fragmentos" se pueden usar para permitir que sistemas funcionen si se tiene Auth Basic activo (como robots.txt o validación de Let's Encrypt).
<syntaxhighlight lang="Bash">vi /etc/nginx/snippets/allowed.conf</syntaxhighlight>
<syntaxhighlight lang="text">
# Allow favicon.ico, robots.txt, .well-known/
location = /favicon.ico {
log_not_found off;
access_log off;
}

# Allow robots.txt
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}

# Allow "Well-Known URIs" as pwe RFC 5785 (e.g. Let's Encrypt)
location ~* ^/.well-known/ {
auth_basic off;
allow all;
}
</syntaxhighlight>
<syntaxhighlight lang="Bash">vi /etc/nginx/snippets/denied.conf</syntaxhighlight>
<syntaxhighlight lang="text">
# Deny *.txt, *.log, .*/*.php, .*, *.json, .lock, *.ht

# Not allow txt or logs to be downloaded
location ~* \.(txt|log)$ {
deny all;
}

# Not allow execute php in hidden folders
location ~ \..*/.\.php$ {
return 403;
}

# Not allow "hidden files"
location ~ (^|/)\. {
return 403;
}

# Not allow *.json or *.lock
location ~* \.(json|lock)$ {
return 403;
}

# Deny *.ht
location ~ /\.ht {
deny all;
}
</syntaxhighlight>
<syntaxhighlight lang="Bash">vi /etc/nginx/snippets/hsts.conf</syntaxhighlight>
<syntaxhighlight lang="text">
# Activate HSTS (HTTP Strict Transport Security)
# Note: if we set another header in a location we've to
# rewrite it
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
</syntaxhighlight>

* Configurar sites-available:
En al carpeta /etc/nginx/sites-available/ se almacenan todos los Virtual Hosts disponibles.
En Nginx hay que personalizar cada uno por cada tipo de aplicación.
Hay que tener en cuenta las diferentes URL's.

* Configurar sites-enabled:
Se suelen configurar enlaces simbólicos con la carpeta sites-available para activarlos.
Por ejemplo:
<syntaxhighlight lang="Bash">ln -s /etc/nginx/sites-available/default /etc/nginx/sites-enabled/default</syntaxhighlight>

* Reiniciar Nginx:
<syntaxhighlight lang="Bash">systemctl restart nginx</syntaxhighlight>

== Configuración MariaDB ==
* Conectar a MariaDB
<syntaxhighlight lang="Bash">mariadb</syntaxhighlight>

* Opción 1: Permitir conexiones por TCP (sólo desde localhost)
<syntaxhighlight lang="Sql">
grant all privileges on *.* to 'root'@'localhost' identified by 'password' with grant option;
FLUSH PRIVILEGES;
</syntaxhighlight>

* Opción 2: Permitir conexiones por Sockets UNIX (sólo desde localhost)
<syntaxhighlight lang="Sql">
grant all privileges on *.* to 'root'@'localhost' identified via unix_socket with grant option;
FLUSH PRIVILEGES;
</syntaxhighlight>
Nota: esta opción es la que suelo usar yo (no se pueden usar los dos a la vez).

* Habilitar conexiones remotas
<syntaxhighlight lang="Bash">
vi /etc/mysql/mariadb.conf.d/50-server.cnf
</syntaxhighlight>
<syntaxhighlight lang="text">
[...]
# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
#bind-address = 127.0.0.1
bind-address = 0.0.0.0
[...]
</syntaxhighlight>
<syntaxhighlight lang="Bash">
systemctl restart mariadb.service
</syntaxhighlight>

Nota 1: vamos a necesitar deshabilitar el Bind Address para los contenedores de [[Docker Engine]].

Nota 2: el puerto 3306/tcp de MariaDB no se va a ver expuesto a Internet, porque no se va a habilitar en el firewall.

== Habilitar puertos en cortafuegos ==
<syntaxhighlight lang="Bash">ufw allow 80/tcp</syntaxhighlight>
<syntaxhighlight lang="Bash">ufw allow 443/tcp</syntaxhighlight>

== Virtual Host de ejemplo ==
=== Generar certificados autofirmados (temporales) ===
Estos certificados los vamos a generar sólo para levantar el Virtual Host y los sustituiremos por unos de Let's Encrypt.
* Generamos clave privada:
<syntaxhighlight lang="Bash">cd /etc/ssl/private</syntaxhighlight>
<syntaxhighlight lang="Bash">openssl genrsa -out selfsigned.key</syntaxhighlight>

* Generamos petición de firma (CSR):
<syntaxhighlight lang="Bash">
openssl req -key selfsigned.key -new -out selfsigned.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:ES
State or Province Name (full name) [Some-State]:Madrid
Locality Name (eg, city) []:Madrid
Organization Name (eg, company) [Internet Widgits Pty Ltd]:GCV
Organizational Unit Name (eg, section) []:GCV
Common Name (e.g. server FQDN or YOUR name) []:www.culturetas.net
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
</syntaxhighlight>

* Auto-firmamos con la misma firma:
<syntaxhighlight lang="Bash">openssl x509 -signkey selfsigned.key -in selfsigned.csr -req -days 365 -out selfsigned.crt</syntaxhighlight>

* Movemos certificados a las carpetas correctas:
<syntaxhighlight lang="Bash">mv selfsigned.key /etc/ssl/private/</syntaxhighlight>
<syntaxhighlight lang="Bash">mv selfsigned.crt /etc/ssl/certs/</syntaxhighlight>
<syntaxhighlight lang="Bash">rm selfsigned.csr</syntaxhighlight>

* Damos permisos a los certificados:
<syntaxhighlight lang="Bash">chmod 644 /etc/ssl/private/selfsigned.key</syntaxhighlight>
<syntaxhighlight lang="Bash">chmod 644 /etc/ssl/certs/selfsigned.crt</syntaxhighlight>

* Referencia: [https://www.baeldung.com/openssl-self-signed-cert https://www.baeldung.com/openssl-self-signed-cert]

=== Dar de alta Virtual Host en Nginx ===
<syntaxhighlight lang="Bash">vi /etc/nginx/sites-available/culturetas.net</syntaxhighlight>
<syntaxhighlight lang="text">
##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# http://wiki.nginx.org/Pitfalls
# http://wiki.nginx.org/QuickStart
# http://wiki.nginx.org/Configuration
#
# Generally, you will want to move this file somewhere, and start with a clean
# file but keep this around for reference. Or just disable in sites-enabled.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#
server {
# Redirect HTTP to HTTPS
listen 80 default_server;
listen [::]:80 default_server;
server_name www.culturetas.net culturetas.net;
# Redirect HTTP to HTTPS
return 301 https://$host$request_uri;
}

server {
# SSL configuration
#
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
ssl_certificate /etc/ssl/certs/selfsigned.crt;
ssl_certificate_key /etc/ssl/private/selfsigned.key;
#
# Note: You should disable gzip for SSL traffic.
# See: https://bugs.debian.org/773332
#
# Read up on ssl_ciphers to ensure a secure configuration.
# See: https://bugs.debian.org/765782
#
# Self signed certs generated by the ssl-cert package
# Don't use them in a production server!
#
# include snippets/snakeoil.conf;

root /var/www/culturetas.net;

# Add index.php to the list if you are using PHP
index index.php index.html index.htm;

server_name www.culturetas.net culturetas.net;

access_log /var/log/nginx/culturetas.net-access.log;
error_log /var/log/nginx/culturetas.net-error.log;

# # Auth Basic (for developing)
# auth_basic "Pagina Restringida";
# auth_basic_user_file /etc/nginx/passwd/passwd-culturetas.net;

# Activate HSTS (HTTP Strict Transport Security)
# Note: reinclude if in a location a header is set
include snippets/hsts.conf;

# Allow favicon.ico, robots.txt, .well-known/
# Deny *.txt, *.log, .*/*.php, .*, *.json, .lock, *.ht
include snippets/allowed.conf;
include snippets/denied.conf;

location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
#try_files $uri $uri/ =404;
try_files $uri $uri/ /index.php?$args;
}

# pass the PHP scripts to FastCGI server
#
location ~ \.php$ {
include snippets/fastcgi-php.conf;

# # With php8.5-cgi alone (TCP Ports):
# fastcgi_pass 127.0.0.1:9000;
# With php8.5-fpm (UNIX Socket):
fastcgi_pass unix:/run/php/php8.5-fpm.sock;
}

# Disable hidden files
location ~ /\. {
deny all;
}
}
</syntaxhighlight>

=== Desactivar Virtual Host por defecto ===
<syntaxhighlight lang="Bash">rm /etc/nginx/sites-enabled/default</syntaxhighlight>

=== Activar Virtual Host nuevo ===
<syntaxhighlight lang="Bash">ln -s /etc/nginx/sites-available/culturetas.net /etc/nginx/sites-enabled/culturetas.net</syntaxhighlight>
<syntaxhighlight lang="Bash">systemctl reload nginx</syntaxhighlight>

=== Generar nuevas claves con Let's Encrypt ===
El certbot de Let's Encrypt ya contiene un plugin que gestiona Nginx.
Usándolo no sólo nos generará automáticamente las claves y certificados, si no que lo aplicará en el servidor por nosotros.
Además, también se encargará de la renovación, por lo que desatiende toda esa parte de gestión de certificados.

<syntaxhighlight lang="Bash">
certbot --nginx
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address or hit Enter to skip.
(Enter 'c' to cancel): admin@ejemplo.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at:
https://letsencrypt.org/documents/LE-SA-v1.6-August-18-2025.pdf
You must agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Account registered.

Which names would you like to activate HTTPS for?
We recommend selecting either all domains, or all domains in a VirtualHost/server block.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: culturetas.net
2: www.culturetas.net
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1,2
Requesting a certificate for culturetas.net and www.culturetas.net

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/culturetas.net/fullchain.pem
Key is saved at: /etc/letsencrypt/live/culturetas.net/privkey.pem
This certificate expires on 2026-05-25.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Deploying certificate
Successfully deployed certificate for culturetas.net to /etc/nginx/sites-enabled/culturetas.net
Successfully deployed certificate for www.culturetas.net to /etc/nginx/sites-enabled/culturetas.net
Congratulations! You have successfully enabled HTTPS on https://culturetas.net and https://www.culturetas.net

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
</syntaxhighlight>

=== Desplegar página de ejemplo ===
<syntaxhighlight lang="Bash">mkdir /var/www/culturetas.net</syntaxhighlight>
<syntaxhighlight lang="Bash">vi /var/www/culturetas.net/index.html</syntaxhighlight>
<syntaxhighlight lang="text">
<!DOCTYPE html>
<html lang="es">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<title>Culturetas.net - En construcción</title>
<style>
body {
margin: 0;
padding: 0;
height: 100vh;
font-family: system-ui, -apple-system, sans-serif;
background: linear-gradient(135deg, #1e3a8a 0%, #3b82f6 100%);
color: white;
display: flex;
flex-direction: column;
align-items: center;
justify-content: center;
text-align: center;
}

.container {
max-width: 700px;
padding: 20px;
}

h1 {
font-size: 4.5rem;
margin: 0.2em 0;
font-weight: 800;
letter-spacing: -1px;
text-shadow: 0 4px 12px rgba(0,0,0,0.3);
}

.subtitle {
font-size: 1.6rem;
margin: 0.8em 0 1.5em;
opacity: 0.95;
}

.construction {
font-size: 8rem;
margin: 0.3em 0;
animation: bounce 3s infinite;
}

p {
font-size: 1.3rem;
line-height: 1.6;
max-width: 600px;
margin: 1.5em auto;
opacity: 0.9;
}

.soon {
font-size: 2rem;
font-weight: bold;
margin-top: 2rem;
color: #fef08a;
text-shadow: 0 2px 10px rgba(0,0,0,0.4);
}

@keyframes bounce {
0%, 20%, 50%, 80%, 100% { transform: translateY(0); }
40% { transform: translateY(-25px); }
60% { transform: translateY(-12px); }
}

@media (max-width: 600px) {
h1 { font-size: 3.2rem; }
.construction { font-size: 6rem; }
.subtitle { font-size: 1.3rem; }
}
</style>
</head>
<body>

<div class="container">
<div class="construction">🚧</div>
<h1>Culturetas.net</h1>
<div class="subtitle">Está en construcción</div>

<p>Estamos trabajando para traerte un espacio mucho más bonito, rápido y con mucho más contenido cultural interesante.</p>

<p>¡Vuelve en unos días y te sorprenderás!</p>

<div class="soon">Próximamente... ✨</div>
</div>

</body>
</html>
</syntaxhighlight>

[[Categoría:Notas]]

LEMP

2026-04-18T18:57:10Z

Guzman:

LEMP

2026-04-18T18:55:38Z

Guzman:

== Instalación servidor LEMP ==
Instalaremos:
* GNU Linux (Ubuntu Server 24.04)
* eNginx 1.24.0 (APT Ubuntu)
* MariaDB 10.8 (Repo oficiales de MariaDB)
* PHP 8.5 (PPA ondrej/php)

== Permisos de root ==
Todos los comandos en esta guía se realizarán como root.
<syntaxhighlight lang="Bash">sudo -i</syntaxhighlight>

== Instalación Nginx (Stable) ==
* Actualizar repositorio
<syntaxhighlight lang="Bash">apt update</syntaxhighlight>

* Instalar Nginx
<syntaxhighlight lang="Bash">apt install nginx</syntaxhighlight>

* Instalación Apache Utils
<syntaxhighlight lang="Bash">apt install apache2-utils</syntaxhighlight>

== Instalación MariaDB ==
* Instalar requisitos
<syntaxhighlight lang="Bash">apt install apt-transport-https curl</syntaxhighlight>

* Añadir repositorios MariaDB (oficiales)
<syntaxhighlight lang="Bash">mkdir -p /etc/apt/keyrings</syntaxhighlight>
<syntaxhighlight lang="Bash">curl -o /etc/apt/keyrings/mariadb-keyring.pgp 'https://mariadb.org/mariadb_release_signing_key.pgp'</syntaxhighlight>
<syntaxhighlight lang="Bash">vi /etc/apt/sources.list.d/mariadb.sources</syntaxhighlight>
<syntaxhighlight lang="text">
# MariaDB 11.8 repository list - created 2026-02-23 08:31 UTC
# https://mariadb.org/download/
X-Repolib-Name: MariaDB
Types: deb
# deb.mariadb.org is a dynamic mirror if your preferred mirror goes offline. See https://mariadb.org/mirrorbits/ for details.
# URIs: https://deb.mariadb.org/11.8/ubuntu
URIs: https://mirror.raiolanetworks.com/mariadb/repo/11.8/ubuntu
Suites: noble
Components: main main/debug
Signed-By: /etc/apt/keyrings/mariadb-keyring.pgp
</syntaxhighlight>

* Actualizar repositorio
<syntaxhighlight lang="Bash">apt update</syntaxhighlight>

* Instalación de servidor y cliente
<syntaxhighlight lang="Bash">apt install mariadb-client mariadb-server mariadb-plugin-provider-bzip2 mariadb-plugin-provider-lz4 mariadb-plugin-provider-lzma mariadb-plugin-provider-lzo mariadb-plugin-provider-snappy</syntaxhighlight>

* Inicializar base de datos
<syntaxhighlight lang="Bash">mysql_secure_installation</syntaxhighlight>
<syntaxhighlight lang="text">
NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

You already have your root account protected, so you can safely answer 'n'.

Switch to unix_socket authentication [Y/n] n
... skipping.

You already have your root account protected, so you can safely answer 'n'.

Change the root password? [Y/n] y
New password:
Re-enter new password:
Password updated successfully!
Reloading privilege tables..
... Success!

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them. This is intended only for testing, and to make the installation
go a bit smoother. You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] y
... Success!

Normally, root should only be allowed to connect from 'localhost'. This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] Y
... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access. This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] Y
- Dropping test database...
... Success!
- Removing privileges on test database...
... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] Y
... Success!

Cleaning up...

All done! If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!
</syntaxhighlight>

== Instalación PHP ==
Vamos a usar los repositorios PPA de ondrej/php

* Instalar repositorio PPA
<syntaxhighlight lang="Bash">add-apt-repository ppa:ondrej/php</syntaxhighlight>

* Actualizar repositorios
<syntaxhighlight lang="Bash">apt update</syntaxhighlight>

* Instalar PHP 8.5
<syntaxhighlight lang="Bash">apt install php8.5 php8.5-apcu php8.5-common php8.5-fpm php8.5-curl php8.5-gd php8.5-mysql php8.5-xml php8.5-xmlrpc php8.5-bz2 php8.5-imap php8.5-intl php8.5-mbstring php8.5-soap php8.5-gnupg php8.5-imagick php8.5-mcrypt php8.5-zip</syntaxhighlight>

== Instalación Let's Encrypt ==
Vamos a usar Let's Encrypt para generar las claves y certificados usadas para comunicaciones HTTPS.

* Instalar Snap Core
<syntaxhighlight lang="Bash">snap install core</syntaxhighlight>

* Refrescar Snap Core
<syntaxhighlight lang="Bash">snap refresh core</syntaxhighlight>

* Instalar Certbot
<syntaxhighlight lang="Bash">snap install --classic certbot</syntaxhighlight>

* Crear enlace simbólico
<syntaxhighlight lang="Bash">ln -s /snap/bin/certbot /usr/local/bin/certbot</syntaxhighlight>

* Comprobar que está activada el timer de renovación
<syntaxhighlight lang="Bash">
systemctl list-timers | grep certbot
Mon 2026-02-23 11:47:00 UTC 12h - - snap.certbot.renew.timer snap.certbot.renew.service
</syntaxhighlight>

== Configuración PHP ==
* Configuración php-fpm:
<syntaxhighlight lang="Bash">vi /etc/php/8.5/fpm/php.ini</syntaxhighlight>
<syntaxhighlight lang="text">
[...]
; Maximum amount of memory a script may consume
; https://php.net/memory-limit
memory_limit = 128M
max_memory_limit = -1
[...]
; Maximum size of POST data that PHP will accept.
; Its value may be 0 to disable the limit. It is ignored if POST data reading
; is disabled through enable_post_data_reading.
; https://php.net/post-max-size
post_max_size = 100M
[...]
; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting
; of zero causes PHP to behave as before. Default is 1. You should fix your scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; https://php.net/cgi.fix-pathinfo
cgi.fix_pathinfo=0
[...]
; Whether to allow HTTP file uploads.
; https://php.net/file-uploads
file_uploads = On
[...]
; Maximum allowed size for uploaded files.
; https://php.net/upload-max-filesize
upload_max_filesize = 100M
[...]
; Maximum number of files that can be uploaded via a single request
max_file_uploads = 20
[...]
[Session]
; Handler used to store/retrieve data.
; https://php.net/session.save-handler
session.save_handler = files
[...]
</syntaxhighlight>

* Configuración php-cli:
<syntaxhighlight lang="Bash">vi /etc/php/8.5/cli/php.ini</syntaxhighlight>
<syntaxhighlight lang="text">
[...]
; Maximum amount of memory a script may consume
; https://php.net/memory-limit
memory_limit = -1
max_memory_limit = -1
[...]
; Maximum size of POST data that PHP will accept.
; Its value may be 0 to disable the limit. It is ignored if POST data reading
; is disabled through enable_post_data_reading.
; https://php.net/post-max-size
post_max_size = 100M
[...]
; cgi.fix_pathinfo provides *real* PATH_INFO/PATH_TRANSLATED support for CGI. PHP's
; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting
; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting
; of zero causes PHP to behave as before. Default is 1. You should fix your scripts
; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
; https://php.net/cgi.fix-pathinfo
cgi.fix_pathinfo=0
[...]
; Whether to allow HTTP file uploads.
; https://php.net/file-uploads
file_uploads = On
[...]
; Maximum allowed size for uploaded files.
; https://php.net/upload-max-filesize
upload_max_filesize = 100M
[...]
; Maximum number of files that can be uploaded via a single request
max_file_uploads = 20
[...]
[Session]
; Handler used to store/retrieve data.
; https://php.net/session.save-handler
session.save_handler = files
[...]
</syntaxhighlight>

* Reiniciar php-fpm:
<syntaxhighlight lang="Bash">systemctl restart php8.5-fpm.service</syntaxhighlight>

== Configuración Nginx ==
* Backup nginx.conf
<syntaxhighlight lang="Bash">cp -a /etc/nginx/nginx.conf /etc/nginx/nginx.conf.$(date +%Y%m%d)</syntaxhighlight>

* Editar nginx.conf
<syntaxhighlight lang="Bash">vi /etc/nginx/nginx.conf</syntaxhighlight>
<syntaxhighlight lang="text">
[...]
http {
##
# Basic Settings
##
sendfile on;
tcp_nopush on;
types_hash_max_size 2048;
client_max_body_size 100M;
server_tokens off;
[...]
##
# SSL Settings
##
#ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
[...]
}
</syntaxhighlight>

* Generar PHParam:
<syntaxhighlight lang="Bash">mkdir /etc/nginx/ssl</syntaxhighlight>
<syntaxhighlight lang="Bash">openssl dhparam -out /etc/nginx/ssl/dhparam.pem 4096</syntaxhighlight>

* Configurar contraseñas:
Si se quiere configurar contraseñas Auth Basic se almacenan en /etc/nginx/passwd.
<syntaxhighlight lang="Bash">mkdir /etc/nginx/passwd</syntaxhighlight>
Por ejemplo:
<syntaxhighlight lang="Bash">htpasswd -c -B /etc/nginx/passwd/test.pw guzman</syntaxhighlight>

* Configurar snippets:
Estos "fragmentos" se pueden usar para permitir que sistemas funcionen si se tiene Auth Basic activo (como robots.txt o validación de Let's Encrypt).
<syntaxhighlight lang="Bash">vi /etc/nginx/snippets/allowed.conf</syntaxhighlight>
<syntaxhighlight lang="text">
# Allow favicon.ico, robots.txt, .well-known/
location = /favicon.ico {
log_not_found off;
access_log off;
}

# Allow robots.txt
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}

# Allow "Well-Known URIs" as pwe RFC 5785 (e.g. Let's Encrypt)
location ~* ^/.well-known/ {
auth_basic off;
allow all;
}
</syntaxhighlight>
<syntaxhighlight lang="Bash">vi /etc/nginx/snippets/denied.conf</syntaxhighlight>
<syntaxhighlight lang="text">
# Deny *.txt, *.log, .*/*.php, .*, *.json, .lock, *.ht

# Not allow txt or logs to be downloaded
location ~* \.(txt|log)$ {
deny all;
}

# Not allow execute php in hidden folders
location ~ \..*/.\.php$ {
return 403;
}

# Not allow "hidden files"
location ~ (^|/)\. {
return 403;
}

# Not allow *.json or *.lock
location ~* \.(json|lock)$ {
return 403;
}

# Deny *.ht
location ~ /\.ht {
deny all;
}
</syntaxhighlight>
<syntaxhighlight lang="Bash">vi /etc/nginx/snippets/hsts.conf</syntaxhighlight>
<syntaxhighlight lang="text">
# Activate HSTS (HTTP Strict Transport Security)
# Note: if we set another header in a location we've to
# rewrite it
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
</syntaxhighlight>

* Configurar sites-available:
En al carpeta /etc/nginx/sites-available/ se almacenan todos los Virtual Hosts disponibles.
En Nginx hay que personalizar cada uno por cada tipo de aplicación.
Hay que tener en cuenta las diferentes URL's.

* Configurar sites-enabled:
Se suelen configurar enlaces simbólicos con la carpeta sites-available para activarlos.
Por ejemplo:
<syntaxhighlight lang="Bash">ln -s /etc/nginx/sites-available/default /etc/nginx/sites-enabled/default</syntaxhighlight>

* Reiniciar Nginx:
<syntaxhighlight lang="Bash">systemctl restart nginx</syntaxhighlight>

== Configuración MariaDB ==
* Conectar a MariaDB
<syntaxhighlight lang="Bash">mariadb</syntaxhighlight>

* Opción 1: Permitir conexiones por TCP (sólo desde localhost)
<syntaxhighlight lang="Sql">
grant all privileges on *.* to 'root'@'localhost' identified by 'password' with grant option;
FLUSH PRIVILEGES;
</syntaxhighlight>

* Opción 2: Permitir conexiones por Sockets UNIX (sólo desde localhost)
<syntaxhighlight lang="Sql">
grant all privileges on *.* to 'root'@'localhost' identified via unix_socket with grant option;
FLUSH PRIVILEGES;
</syntaxhighlight>
Nota: esta opción es la que suelo usar yo (no se pueden usar los dos a la vez).

* Habilitar conexiones remotas
<syntaxhighlight lang="Bash">
vi /etc/mysql/mariadb.conf.d/50-server.cnf
</syntaxhighlight>
<syntaxhighlight lang="text">
[...]
# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
#bind-address = 127.0.0.1
bind-address = 0.0.0.0
[...]
</syntaxhighlight>

Nota 1: vamos a necesitar deshabilitar el Bind Address para los contenedores de [[Docker Engine]].

Nota 2: el puerto 3306/tcp de MariaDB no se va a ver expuesto a Internet, porque no se va a habilitar en el firewall.

== Habilitar puertos en cortafuegos ==
<syntaxhighlight lang="Bash">ufw allow 80/tcp</syntaxhighlight>
<syntaxhighlight lang="Bash">ufw allow 443/tcp</syntaxhighlight>

== Virtual Host de ejemplo ==
=== Generar certificados autofirmados (temporales) ===
Estos certificados los vamos a generar sólo para levantar el Virtual Host y los sustituiremos por unos de Let's Encrypt.
* Generamos clave privada:
<syntaxhighlight lang="Bash">cd /etc/ssl/private</syntaxhighlight>
<syntaxhighlight lang="Bash">openssl genrsa -out selfsigned.key</syntaxhighlight>

* Generamos petición de firma (CSR):
<syntaxhighlight lang="Bash">
openssl req -key selfsigned.key -new -out selfsigned.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:ES
State or Province Name (full name) [Some-State]:Madrid
Locality Name (eg, city) []:Madrid
Organization Name (eg, company) [Internet Widgits Pty Ltd]:GCV
Organizational Unit Name (eg, section) []:GCV
Common Name (e.g. server FQDN or YOUR name) []:www.culturetas.net
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
</syntaxhighlight>

* Auto-firmamos con la misma firma:
<syntaxhighlight lang="Bash">openssl x509 -signkey selfsigned.key -in selfsigned.csr -req -days 365 -out selfsigned.crt</syntaxhighlight>

* Movemos certificados a las carpetas correctas:
<syntaxhighlight lang="Bash">mv selfsigned.key /etc/ssl/private/</syntaxhighlight>
<syntaxhighlight lang="Bash">mv selfsigned.crt /etc/ssl/certs/</syntaxhighlight>
<syntaxhighlight lang="Bash">rm selfsigned.csr</syntaxhighlight>

* Referencia: [https://www.baeldung.com/openssl-self-signed-cert https://www.baeldung.com/openssl-self-signed-cert]

=== Dar de alta Virtual Host en Nginx ===
<syntaxhighlight lang="Bash">vi /etc/nginx/sites-available/culturetas.net</syntaxhighlight>
<syntaxhighlight lang="text">
##
# You should look at the following URL's in order to grasp a solid understanding
# of Nginx configuration files in order to fully unleash the power of Nginx.
# http://wiki.nginx.org/Pitfalls
# http://wiki.nginx.org/QuickStart
# http://wiki.nginx.org/Configuration
#
# Generally, you will want to move this file somewhere, and start with a clean
# file but keep this around for reference. Or just disable in sites-enabled.
#
# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
##

# Default server configuration
#
server {
# Redirect HTTP to HTTPS
listen 80 default_server;
listen [::]:80 default_server;
server_name www.culturetas.net culturetas.net;
# Redirect HTTP to HTTPS
return 301 https://$host$request_uri;
}

server {
# SSL configuration
#
listen 443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
ssl_certificate /etc/ssl/certs/selfsigned.crt;
ssl_certificate_key /etc/ssl/private/selfsigned.key;
#
# Note: You should disable gzip for SSL traffic.
# See: https://bugs.debian.org/773332
#
# Read up on ssl_ciphers to ensure a secure configuration.
# See: https://bugs.debian.org/765782
#
# Self signed certs generated by the ssl-cert package
# Don't use them in a production server!
#
# include snippets/snakeoil.conf;

root /var/www/culturetas.net;

# Add index.php to the list if you are using PHP
index index.php index.html index.htm;

server_name www.culturetas.net culturetas.net;

access_log /var/log/nginx/culturetas.net-access.log;
error_log /var/log/nginx/culturetas.net-error.log;

# # Auth Basic (for developing)
# auth_basic "Pagina Restringida";
# auth_basic_user_file /etc/nginx/passwd/passwd-culturetas.net;

# Activate HSTS (HTTP Strict Transport Security)
# Note: reinclude if in a location a header is set
include snippets/hsts.conf;

# Allow favicon.ico, robots.txt, .well-known/
# Deny *.txt, *.log, .*/*.php, .*, *.json, .lock, *.ht
include snippets/allowed.conf;
include snippets/denied.conf;

location / {
# First attempt to serve request as file, then
# as directory, then fall back to displaying a 404.
#try_files $uri $uri/ =404;
try_files $uri $uri/ /index.php?$args;
}

# pass the PHP scripts to FastCGI server
#
location ~ \.php$ {
include snippets/fastcgi-php.conf;

# # With php8.5-cgi alone (TCP Ports):
# fastcgi_pass 127.0.0.1:9000;
# With php8.5-fpm (UNIX Socket):
fastcgi_pass unix:/run/php/php8.5-fpm.sock;
}

# Disable hidden files
location ~ /\. {
deny all;
}
}
</syntaxhighlight>

=== Desactivar Virtual Host por defecto ===
<syntaxhighlight lang="Bash">rm /etc/nginx/sites-enabled/default</syntaxhighlight>

=== Activar Virtual Host nuevo ===
<syntaxhighlight lang="Bash">ln -s /etc/nginx/sites-available/culturetas.net /etc/nginx/sites-enabled/culturetas.net</syntaxhighlight>
<syntaxhighlight lang="Bash">systemctl reload nginx</syntaxhighlight>

=== Generar nuevas claves con Let's Encrypt ===
El certbot de Let's Encrypt ya contiene un plugin que gestiona Nginx.
Usándolo no sólo nos generará automáticamente las claves y certificados, si no que lo aplicará en el servidor por nosotros.
Además, también se encargará de la renovación, por lo que desatiende toda esa parte de gestión de certificados.

<syntaxhighlight lang="Bash">
certbot --nginx
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address or hit Enter to skip.
(Enter 'c' to cancel): admin@ejemplo.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at:
https://letsencrypt.org/documents/LE-SA-v1.6-August-18-2025.pdf
You must agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: N
Account registered.

Which names would you like to activate HTTPS for?
We recommend selecting either all domains, or all domains in a VirtualHost/server block.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: culturetas.net
2: www.culturetas.net
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 1,2
Requesting a certificate for culturetas.net and www.culturetas.net

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/culturetas.net/fullchain.pem
Key is saved at: /etc/letsencrypt/live/culturetas.net/privkey.pem
This certificate expires on 2026-05-25.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Deploying certificate
Successfully deployed certificate for culturetas.net to /etc/nginx/sites-enabled/culturetas.net
Successfully deployed certificate for www.culturetas.net to /etc/nginx/sites-enabled/culturetas.net
Congratulations! You have successfully enabled HTTPS on https://culturetas.net and https://www.culturetas.net

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
</syntaxhighlight>

=== Desplegar página de ejemplo ===
<syntaxhighlight lang="Bash">mkdir /var/www/culturetas.net</syntaxhighlight>
<syntaxhighlight lang="Bash">vi /var/www/culturetas.net/index.html</syntaxhighlight>
<syntaxhighlight lang="text">
<!DOCTYPE html>
<html lang="es">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0"/>
<title>Culturetas.net - En construcción</title>
<style>
body {
margin: 0;
padding: 0;
height: 100vh;
font-family: system-ui, -apple-system, sans-serif;
background: linear-gradient(135deg, #1e3a8a 0%, #3b82f6 100%);
color: white;
display: flex;
flex-direction: column;
align-items: center;
justify-content: center;
text-align: center;
}

.container {
max-width: 700px;
padding: 20px;
}

h1 {
font-size: 4.5rem;
margin: 0.2em 0;
font-weight: 800;
letter-spacing: -1px;
text-shadow: 0 4px 12px rgba(0,0,0,0.3);
}

.subtitle {
font-size: 1.6rem;
margin: 0.8em 0 1.5em;
opacity: 0.95;
}

.construction {
font-size: 8rem;
margin: 0.3em 0;
animation: bounce 3s infinite;
}

p {
font-size: 1.3rem;
line-height: 1.6;
max-width: 600px;
margin: 1.5em auto;
opacity: 0.9;
}

.soon {
font-size: 2rem;
font-weight: bold;
margin-top: 2rem;
color: #fef08a;
text-shadow: 0 2px 10px rgba(0,0,0,0.4);
}

@keyframes bounce {
0%, 20%, 50%, 80%, 100% { transform: translateY(0); }
40% { transform: translateY(-25px); }
60% { transform: translateY(-12px); }
}

@media (max-width: 600px) {
h1 { font-size: 3.2rem; }
.construction { font-size: 6rem; }
.subtitle { font-size: 1.3rem; }
}
</style>
</head>
<body>

<div class="container">
<div class="construction">🚧</div>
<h1>Culturetas.net</h1>
<div class="subtitle">Está en construcción</div>

<p>Estamos trabajando para traerte un espacio mucho más bonito, rápido y con mucho más contenido cultural interesante.</p>

<p>¡Vuelve en unos días y te sorprenderás!</p>

<div class="soon">Próximamente... ✨</div>
</div>

</body>
</html>
</syntaxhighlight>

[[Categoría:Notas]]

2026-04-18T10:18:28Z

Guzman:

2026-03-21T23:06:41Z

Guzman:

== Instalación de Docker Engine en Ubuntu Server ==
El objetivo de este documento es instalar Docker Engine en Ubuntu Server 24.04.

== Requisitos ==
Antes de instalar Docker hay que tener en cuenta una serie de consideraciones.

=== Usuario root ===
Todos los comandos que aquí se ponen, han de ejecutarse como root.
<syntaxhighlight lang="Bash">sudo -i</syntaxhighlight>

=== Desinstalar UFW ===
El firewall que viene por defecto en entornos tipo Debian (como Ubuntu) tiene problemas de compatibilidad con Docker Engine.
Debido a que Docker crea reglas directamente con IPTables, se ocasiona que Docker cree reglas que se salten las reglas existentes.
Para evitar que esto pase vamos a sustituir UFW por FirewallD (en modo IPTables), que evita este tipo de problemas.
<syntaxhighlight lang="Bash">ufw disable</syntaxhighlight>
<syntaxhighlight lang="Bash">systemctl disable ufw</syntaxhighlight>
<syntaxhighlight lang="Bash">systemctl stop ufw</syntaxhighlight>
<syntaxhighlight lang="Bash">apt remove --purge ufw</syntaxhighlight>

=== Instalar FirewallD ===
<syntaxhighlight lang="Bash">apt update</syntaxhighlight>
<syntaxhighlight lang="Bash">apt install firewalld</syntaxhighlight>
<syntaxhighlight lang="Bash">systemctl enable firewalld</syntaxhighlight>
<syntaxhighlight lang="Bash">systemctl start firewalld</syntaxhighlight>

=== Habilitar modo IPTables a FirewallD (opcional) ===
Hay problemas reportados de conexión entre contenedores de Docker cuando FirewallD está en modo nftables, se resuelven cambiando a modo IPTables.

<syntaxhighlight lang="Bash">vi /etc/firewalld/firewalld.conf</syntaxhighlight>
<syntaxhighlight lang="text">
[...]
# FirewallBackend
# Selects the firewall backend implementation.
# Choices are:
# - nftables (default)
# - iptables (iptables, ip6tables, ebtables and ipset)
# Note: The iptables backend is deprecated. It will be removed in a future
# release.
#FirewallBackend=nftables
FirewallBackend=iptables
[...]
</syntaxhighlight>
<syntaxhighlight lang="Bash">systemctl restart firewalld</syntaxhighlight>

=== Habilitar reglas anteriores ===
En mi paso prefiero habilitar puertos TCP en vez de servicios (aunque también es posible).

<syntaxhighlight lang="Bash">firewall-cmd --permanent --zone=public --add-port=80/tcp</syntaxhighlight>
<syntaxhighlight lang="Bash">firewall-cmd --permanent --zone=public --add-port=443/tcp</syntaxhighlight>
<syntaxhighlight lang="Bash">firewall-cmd --reload</syntaxhighlight>

=== Habilitar salida a Internet de contenedores ===
<syntaxhighlight lang="Bash">firewall-cmd --permanent --zone=public --add-masquerade</syntaxhighlight>
<syntaxhighlight lang="Bash">firewall-cmd --reload</syntaxhighlight>

=== Comprobar estado de FirewallD ===
<syntaxhighlight lang="Bash">
firewall-cmd --list-all
public (default, active)
target: default
ingress-priority: 0
egress-priority: 0
icmp-block-inversion: no
interfaces:
sources:
services: dhcpv6-client ssh
ports: 80/tcp 443/tcp
protocols:
forward: yes
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:
</syntaxhighlight>

=== Consideraciones importantes ===
* Toda esta configuración estamos asumiendo que estamos usando la zona public.
* Cuando se creen contenedores en Docker hay que evitar usar la opción -p (--port), ya que creará reglas en el firewall (iptables) que habilitarán acceso directo desde Internet a los contenedores.
* Mi recomendación es no hacerlo así y exponer los servicios a través de un proxy inverso (ver artículo sobre servidor [[LEMP]]).

== Desinstalar versiones anteriores de Docker Engine ==
Comprobar que no existe una versión de Docker Engine instalada.
<syntaxhighlight lang="Bash">apt remove $(dpkg --get-selections docker.io docker-compose docker-compose-v2 docker-doc podman-docker containerd runc | cut -f1)</syntaxhighlight>

== Añadir repositorios APT oficiales de Docker ==
<syntaxhighlight lang="Bash">apt update</syntaxhighlight>
<syntaxhighlight lang="Bash">apt install ca-certificates curl</syntaxhighlight>
<syntaxhighlight lang="Bash">install -m 0755 -d /etc/apt/keyrings</syntaxhighlight>
<syntaxhighlight lang="Bash">curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc</syntaxhighlight>
<syntaxhighlight lang="Bash">chmod a+r /etc/apt/keyrings/docker.asc</syntaxhighlight>
<syntaxhighlight lang="Bash">
sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Signed-By: /etc/apt/keyrings/docker.asc
EOF
</syntaxhighlight>

== Instalar Docker Engine ==
<syntaxhighlight lang="Bash">apt update</syntaxhighlight>
<syntaxhighlight lang="Bash">apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin</syntaxhighlight>

== Comprobar Docker Engine ==
=== Comprobar servicio ===
<syntaxhighlight lang="Bash">
systemctl status docker
● docker.service - Docker Application Container Engine
Loaded: loaded (/usr/lib/systemd/system/docker.service; enabled; preset: enabled)
Active: active (running) since Thu 2026-02-26 22:52:45 UTC; 2min 39s ago
TriggeredBy: ● docker.socket
Docs: https://docs.docker.com
Main PID: 23159 (dockerd)
Tasks: 11
Memory: 26.5M (peak: 29.2M)
CPU: 284ms
CGroup: /system.slice/docker.service
└─23159 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock

Feb 26 22:52:44 culturetas.net dockerd[23159]: time="2026-02-26T22:52:44.065056936Z" level=info msg="Deleting nftables IPv4 rules" error="exit s>
Feb 26 22:52:44 culturetas.net dockerd[23159]: time="2026-02-26T22:52:44.088078290Z" level=info msg="Deleting nftables IPv6 rules" error="exit s>
Feb 26 22:52:44 culturetas.net dockerd[23159]: time="2026-02-26T22:52:44.118636746Z" level=info msg="Firewalld: created docker-forwarding policy"
Feb 26 22:52:45 culturetas.net dockerd[23159]: time="2026-02-26T22:52:45.117792420Z" level=info msg="Loading containers: done."
Feb 26 22:52:45 culturetas.net dockerd[23159]: time="2026-02-26T22:52:45.131108392Z" level=info msg="Docker daemon" commit=6bc6209 containerd-sn>
Feb 26 22:52:45 culturetas.net dockerd[23159]: time="2026-02-26T22:52:45.131332307Z" level=info msg="Initializing buildkit"
Feb 26 22:52:45 culturetas.net dockerd[23159]: time="2026-02-26T22:52:45.149255659Z" level=info msg="Completed buildkit initialization"
Feb 26 22:52:45 culturetas.net dockerd[23159]: time="2026-02-26T22:52:45.158529795Z" level=info msg="Daemon has completed initialization"
Feb 26 22:52:45 culturetas.net dockerd[23159]: time="2026-02-26T22:52:45.158627568Z" level=info msg="API listen on /run/docker.sock"
Feb 26 22:52:45 culturetas.net systemd[1]: Started docker.service - Docker Application Container Engine.
</syntaxhighlight>

Si el servicio está apagado hay que arrancarlo y habilitarlo en el arranque:
<syntaxhighlight lang="Bash">systemctl start docker</syntaxhighlight>
<syntaxhighlight lang="Bash">systemctl enable docker</syntaxhighlight>

=== Desplegar contenedor de prueba (hello-world) ===
<syntaxhighlight lang="Bash">docker run hello-world</syntaxhighlight>
<syntaxhighlight lang="Bash">
docker ps --all
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
3995e4839733 hello-world "/hello" 2 minutes ago Exited (0) 2 minutes ago elated_matsumoto
</syntaxhighlight>
<syntaxhighlight lang="Bash">docker stop elated_matsumoto</syntaxhighlight>
<syntaxhighlight lang="Bash">docker rm elated_matsumoto</syntaxhighlight>
<syntaxhighlight lang="Bash">
docker image list
i Info → U In Use
IMAGE ID DISK USAGE CONTENT SIZE EXTRA
hello-world:latest ef54e839ef54 25.9kB 9.52kB
</syntaxhighlight>
<syntaxhighlight lang="Bash">docker image rm hello-world:latest</syntaxhighlight>

== Desarrollo con Docker Compose ==
Para entornos productivos está recomendado usar Docker Compose para declarar todos los contenedores que se van a usar (mediante fichero YAML).
Para su eso utilizo las siguientes herramientas:

=== Visual Studio Codium ===
Visual Studio Codium o [https://vscodium.com/ VS Codium] es la versión libre de Visual Studio Code.

Se compilan del mismo repositio, pero no se incluyen las herramientas de telemetría que introduce Microsoft.

Esta es una buena herramienta para desarrollar los ficheros YAML.

Sin embargo, es necesario añadir extensiones.

=== Docker (extensión) ===
Extensión de VS Codium para gestionar contenedores.

URL: [https://open-vsx.org/extension/ms-azuretools/vscode-docker https://open-vsx.org/extension/ms-azuretools/vscode-docker]

Instalará automática otra extensión: [https://open-vsx.org/extension/ms-azuretools/vscode-containers Container Tools].

=== YAML (extensión) ===
Extensión de VS Codium para soporte al formato YAML.

URL: [https://open-vsx.org/extension/redhat/vscode-yaml https://open-vsx.org/extension/redhat/vscode-yaml]

=== Open Remote - SSH (extensión) ===
Para poder conectar a servidores SSH en el propio VS Codium.

URL: [https://open-vsx.org/extension/jeanp413/open-remote-ssh https://open-vsx.org/extension/jeanp413/open-remote-ssh]

=== Spanish Language Pack (extensión) ===
Para traducir VS Codium al español.

URL: [https://open-vsx.org/extension/MS-CEINTL/vscode-language-pack-es https://open-vsx.org/extension/MS-CEINTL/vscode-language-pack-es]

== Herramientas útiles ==
=== Skopeo ===
Permite analizar los repositorios de imágenes.
<syntaxhighlight lang="Bash">sudo -i</syntaxhighlight>
<syntaxhighlight lang="Bash">apt install skopeo</syntaxhighlight>

Uso:
<syntaxhighlight lang="Bash">skopeo list-tags docker://cleanstart/openldap</syntaxhighlight>

=== Composerize ===
Permite transformar un comando "docker run..." en fichero YAML para Docker Compose.
<syntaxhighlight lang="Bash">sudo -i</syntaxhighlight>
<syntaxhighlight lang="Bash">apt install npm</syntaxhighlight>
<syntaxhighlight lang="Bash">npm install composerize -g</syntaxhighlight>

Uso:
<syntaxhighlight lang="Bash">composerize docker run -p 80:80 -v /var/run/docker.sock:/tmp/docker.sock:ro --restart always --log-opt max-size=1g nginx</syntaxhighlight>

== Referencias ==
* [https://docs.docker.com/engine/install/ubuntu/ https://docs.docker.com/engine/install/ubuntu/]
* [https://docs.docker.com/engine/network/packet-filtering-firewalls/#docker-and-ufw https://docs.docker.com/engine/network/packet-filtering-firewalls/#docker-and-ufw]
* [https://github.com/nextcloud/all-in-one?tab=readme-ov-file#how-to-resolve-firewall-problems-with-fedora-linux-rhel-os-centos-suse-linux-and-others https://github.com/nextcloud/all-in-one?tab=readme-ov-file#how-to-resolve-firewall-problems-with-fedora-linux-rhel-os-centos-suse-linux-and-others]
* [https://github.com/composerize/composerize https://github.com/composerize/composerize]

[[Categoría:Notas]]

2026-02-27T22:10:59Z

Guzman:

== Objetivo ==
En esta página se muestra cómo administrar el correo genérico instalado en la página [Servidor de Correo].

== Añadir un nuevo dominio ==
Consiste en configurar el servidor de correo para que sirva correos de un nuevo dominio (en este ejemplo culturetas.net).

=== Añadir nuevo dominio en BD ===
En mi configuración los dominios, usuarios y aliases se encuentran en una base de datos MariaDB.
<syntaxhighlight lang="Bash">mariadb</syntaxhighlight>
<syntaxhighlight lang="Bash">use mailserver;</syntaxhighlight>
<syntaxhighlight lang="Bash">INSERT INTO virtual_domains (domain) VALUES ('culturetas.net');</syntaxhighlight>
<syntaxhighlight lang="Bash">COMMIT;</syntaxhighlight>

=== Configuración OpenDKIM ===
* Generamos una clave criptográficas:
<syntaxhighlight lang="Bash">cd /etc/dkimkeys</syntaxhighlight>
<syntaxhighlight lang="Bash">opendkim-genkey -s mail -d culturetas.net</syntaxhighlight>
<syntaxhighlight lang="Bash">mv mail.private /etc/dkimkeys/culturetas.net-dkim.key</syntaxhighlight>
<syntaxhighlight lang="Bash">mv mail.txt /etc/dkimkeys/culturetas.net-dkim.txt</syntaxhighlight>
<syntaxhighlight lang="Bash">chown opendkim:opendkim /etc/dkimkeys/culturetas.net-dkim.*</syntaxhighlight>

* Habilitar dominios en OpenDKIM:
<syntaxhighlight lang="Bash">vi /etc/dkimkeys/key_table</syntaxhighlight>
<syntaxhighlight lang="text">
#KEYID DOMAIN:SELECTOR:KEY
[...]
mail._domainkey.culturetas.net culturetas.net:mail:/etc/dkimkeys/culturetas.net-dkim.key
</syntaxhighlight>
<syntaxhighlight lang="Bash">vi /etc/dkimkeys/signing_table</syntaxhighlight>
<syntaxhighlight lang="text">
#DOMAIN KEYID
[...]
culturetas.net mail._domainkey.culturetas.net
</syntaxhighlight>

* Anotar clavé pública de OpenDKIM:
<syntaxhighlight lang="Bash">cat /etc/dkimkeys/culturetas.net-dkim.txt</syntaxhighlight>
<syntaxhighlight lang="text">
mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
"p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvRG1MMcJ0XbHKCgwLrr8zO1AVXxNYE+ut/3SQD0VxdHvexIvlIovyKFMagAQlzIJ0Tr+9l7FUNlCdeUoCqIxi4R4mOgOcrqgXRNXAwQoa7ns1j2pFeYnKHCODIiDRsszU0gKmgUX82ps55Feo/Fx5v1xtZNy855G+h8LnGy6lEoXx87TcCIsdXkslWPdGBJZPwNlvO+SCtttSM"
"f//sdjGuc5zQnnnqdSLgNa6vSidM/71MvF0L5rPpeaQ0bAAicb2Iv047lDT2G1LnJ+y1wpugDdJGQoEa6D8SV2Q8ffzaPyRJ340wP9d1m2BZT2EvLTJA60wFc22GfkM0ha6N2QtwIDAQAB" ) ; ----- DKIM key mail for culturetas.net
</syntaxhighlight>

* Reiniciar OpenDKIM:
<syntaxhighlight lang="Bash">systemctl restart opendkim</syntaxhighlight>

=== Configuración OpenDMARC ===
* Configurar dominios en OpenDMARC:
<syntaxhighlight lang="Bash">vi /etc/opendmarc.conf</syntaxhighlight>
<syntaxhighlight lang="text">
[...]
TrustedAuthservIDs HOSTNAME,culturetas.net
[...]
IgnoreMailFrom smtp.castanedo.es,culturetas.net
[...]
</syntaxhighlight>

* Reiniciar OpenDMARC:
<syntaxhighlight lang="Bash">systemctl restart opendmarc</syntaxhighlight>

=== Configurar registros DNS ===
Es necesario acceder a la zona DNS para añadir nuevos dominios para el dominio (culturetas.net en este ejemplo).

* Registro DKIM
Hay que añadir un registro DNS con la información de la clave pública de DKIM.
<syntaxhighlight lang="text">
mail._domainkey IN TXT "v=DKIM1;g=*;h=sha256;k=rsa;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvRG1MMcJ0XbHKCgwLrr8zO1AVXxNYE+ut/3SQD0VxdHvexIvlIovyKFMagAQlzIJ0Tr+9l7FUNlCdeUoCqIxi4R4mOgOcrqgXRNXAwQoa7ns1j2pFeYnKHCODIiDRsszU0gKmgUX82ps55Feo/Fx5v1xtZNy855G+h8LnGy6lEoXx87TcCIsdXkslWPdGBJZPwNlvO+SCtttSMf//sdjGuc5zQnnnqdSLgNa6vSidM/71MvF0L5rPpeaQ0bAAicb2Iv047lDT2G1LnJ+y1wpugDdJGQoEa6D8SV2Q8ffzaPyRJ340wP9d1m2BZT2EvLTJA60wFc22GfkM0ha6N2QtwIDAQAB;"
</syntaxhighlight>

* Registro SPF:
Hay que añadir un registro DNS con la información de SPF.
<syntaxhighlight lang="text">
culturetas.net. IN TXT "v=spf1 mx include:smtp.castanedo.es ~all"
</syntaxhighlight>
** a: permite que el servidor en A envien correo.
** mx: permite que el servidor en MX envie correo.
** -all: la información describe a todos los hosts estrictamente.

* Registro ADSP:
Hay que añadir un registro DNS con la información de ADSP (Author Domain Signing Practices).
<syntaxhighlight lang="text">
_adsp._domainkey IN TXT "dkim=all"
</syntaxhighlight>
** unknown: válidos tanto firmados como sin firmar.
** all: todos los emails firmados.
** discardable: todos los emails firmados y los que no lo estén pueden eliminarse.

* Registro DMARC:
Hay que añadir un registro DNS con la información DMAR (Domain bases Message Authentication, Reporting and Conformance).
<syntaxhighlight lang="text">
_dmarc IN TXT "v=DMARC1; p=none; rua=mailto:admin@culturetas.net; fo=0; adkim=r; aspf=r"
</syntaxhighlight>
** p puede ser:
*** none: no hace nada si falla DMARC.
*** quarantine: si falla que sean tratado como sospechoso.
*** reject: si falla que sea eliminado.
** rua: dirección a donde los fallos deben ser reportados.
** fo puede ser:
*** 0: generar reporte si falla SPF y DKIM.
*** 1: generar reporte si falla SPF o DKIM.
*** s: generar reporte si falla SPF.
*** d: generar reporte si falla DKIM.

== Añadir un nuevo buzón ==
=== Generar contraseña ===
<syntaxhighlight lang="Bash">doveadm pw -s SHA512-CRYPT</syntaxhighlight>

=== Añadir a base de datos ===
<syntaxhighlight lang="Bash">mariadb</syntaxhighlight>
<syntaxhighlight lang="Bash">use mailserver;</syntaxhighlight>
<syntaxhighlight lang="Bash">INSERT INTO virtual_users (domain_id, email, password, access) VALUES ('6', 'admin@culturetas.net', '$6$XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX', 'OK');</syntaxhighlight>
<syntaxhighlight lang="Bash">COMMIT;</syntaxhighlight>

== Añadir un nuevo alias ==
<syntaxhighlight lang="Bash">mariadb</syntaxhighlight>
<syntaxhighlight lang="Bash">use mailserver;</syntaxhighlight>
<syntaxhighlight lang="Bash">INSERT INTO virtual_aliases (domain_id, source, destination) VALUES ('6', 'postmaster@culturetas.net', 'admin@culturetas.net');</syntaxhighlight>
<syntaxhighlight lang="Bash">INSERT INTO virtual_aliases (domain_id, source, destination) VALUES ('6', 'webmaster@culturetas.net', 'admin@culturetas.net');</syntaxhighlight>
<syntaxhighlight lang="Bash">COMMIT;</syntaxhighlight>

[[Categoría:Notas]]

Administración servidor de correo

2026-02-27T21:49:07Z

Guzman:

Administración servidor de correo

2026-02-27T21:40:16Z

Guzman:

== Objetivo ==
En esta página se muestra cómo administrar el correo genérico instalado en la página [Servidor de Correo].

== Añadir un nuevo dominio ==
Consiste en configurar el servidor de correo para que sirva correos de un nuevo dominio (en este ejemplo culturetas.net).

=== Configuración OpenDKIM ===
* Generamos una clave criptográficas:
<syntaxhighlight lang="Bash">cd /etc/dkimkeys</syntaxhighlight>
<syntaxhighlight lang="Bash">opendkim-genkey -s mail -d culturetas.net</syntaxhighlight>
<syntaxhighlight lang="Bash">mv mail.private /etc/dkimkeys/culturetas.net-dkim.key</syntaxhighlight>
<syntaxhighlight lang="Bash">mv mail.txt /etc/dkimkeys/culturetas.net-dkim.txt</syntaxhighlight>
<syntaxhighlight lang="Bash">chown opendkim:opendkim /etc/dkimkeys/culturetas.net-dkim.*</syntaxhighlight>

* Habilitar dominios en OpenDKIM:
<syntaxhighlight lang="Bash">vi /etc/dkimkeys/key_table</syntaxhighlight>
<syntaxhighlight lang="text">
#KEYID DOMAIN:SELECTOR:KEY
[...]
mail._domainkey.culturetas.net culturetas.net:mail:/etc/dkimkeys/culturetas.net-dkim.key
</syntaxhighlight>
<syntaxhighlight lang="Bash">vi /etc/dkimkeys/signing_table</syntaxhighlight>
<syntaxhighlight lang="text">
#DOMAIN KEYID
[...]
culturetas.net mail._domainkey.culturetas.net
</syntaxhighlight>

* Anotar clavé pública de OpenDKIM:
<syntaxhighlight lang="Bash">cat /etc/dkimkeys/culturetas.net-dkim.txt</syntaxhighlight>
<syntaxhighlight lang="text">
mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
"p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvRG1MMcJ0XbHKCgwLrr8zO1AVXxNYE+ut/3SQD0VxdHvexIvlIovyKFMagAQlzIJ0Tr+9l7FUNlCdeUoCqIxi4R4mOgOcrqgXRNXAwQoa7ns1j2pFeYnKHCODIiDRsszU0gKmgUX82ps55Feo/Fx5v1xtZNy855G+h8LnGy6lEoXx87TcCIsdXkslWPdGBJZPwNlvO+SCtttSM"
"f//sdjGuc5zQnnnqdSLgNa6vSidM/71MvF0L5rPpeaQ0bAAicb2Iv047lDT2G1LnJ+y1wpugDdJGQoEa6D8SV2Q8ffzaPyRJ340wP9d1m2BZT2EvLTJA60wFc22GfkM0ha6N2QtwIDAQAB" ) ; ----- DKIM key mail for culturetas.net
</syntaxhighlight>

* Reiniciar OpenDKIM:
<syntaxhighlight lang="Bash">systemctl restart opendkim</syntaxhighlight>

=== Configuración OpenDMARC ===
* Configurar dominios en OpenDMARC:
<syntaxhighlight lang="Bash">vi /etc/opendmarc.conf</syntaxhighlight>
<syntaxhighlight lang="text">
[...]
TrustedAuthservIDs HOSTNAME,culturetas.net
[...]
IgnoreMailFrom smtp.castanedo.es,culturetas.net
[...]
</syntaxhighlight>

* Reiniciar OpenDMARC:
<syntaxhighlight lang="Bash">systemctl restart opendmarc</syntaxhighlight>

=== Configurar registros DNS ===
Es necesario acceder a la zona DNS para añadir nuevos dominios para el dominio (culturetas.net en este ejemplo).

* Registro DKIM
Hay que añadir un registro DNS con la información de la clave pública de DKIM.
<syntaxhighlight lang="text">
mail._domainkey IN TXT "v=DKIM1;g=*;h=sha256;k=rsa;s=email;p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvRG1MMcJ0XbHKCgwLrr8zO1AVXxNYE+ut/3SQD0VxdHvexIvlIovyKFMagAQlzIJ0Tr+9l7FUNlCdeUoCqIxi4R4mOgOcrqgXRNXAwQoa7ns1j2pFeYnKHCODIiDRsszU0gKmgUX82ps55Feo/Fx5v1xtZNy855G+h8LnGy6lEoXx87TcCIsdXkslWPdGBJZPwNlvO+SCtttSMf//sdjGuc5zQnnnqdSLgNa6vSidM/71MvF0L5rPpeaQ0bAAicb2Iv047lDT2G1LnJ+y1wpugDdJGQoEa6D8SV2Q8ffzaPyRJ340wP9d1m2BZT2EvLTJA60wFc22GfkM0ha6N2QtwIDAQAB;"
</syntaxhighlight>

* Registro SPF:
Hay que añadir un registro DNS con la información de SPF.
<syntaxhighlight lang="text">
culturetas.net. IN TXT "v=spf1 mx include:smtp.castanedo.es ~all"
</syntaxhighlight>
** a: permite que el servidor en A envien correo.
** mx: permite que el servidor en MX envie correo.
** -all: la información describe a todos los hosts estrictamente.

* Registro ADSP:
Hay que añadir un registro DNS con la información de ADSP (Author Domain Signing Practices).
<syntaxhighlight lang="text">
_adsp._domainkey IN TXT "dkim=all"
</syntaxhighlight>
** unknown: válidos tanto firmados como sin firmar.
** all: todos los emails firmados.
** discardable: todos los emails firmados y los que no lo estén pueden eliminarse.

* Registro DMARC:
Hay que añadir un registro DNS con la información DMAR (Domain bases Message Authentication, Reporting and Conformance).
<syntaxhighlight lang="text">
_dmarc IN TXT "v=DMARC1; p=none; rua=mailto:admin@culturetas.net; fo=0; adkim=r; aspf=r"
</syntaxhighlight>
** p puede ser:
*** none: no hace nada si falla DMARC.
*** quarantine: si falla que sean tratado como sospechoso.
*** reject: si falla que sea eliminado.
** rua: dirección a donde los fallos deben ser reportados.
** fo puede ser:
*** 0: generar reporte si falla SPF y DKIM.
*** 1: generar reporte si falla SPF o DKIM.
*** s: generar reporte si falla SPF.
*** d: generar reporte si falla DKIM.

[[Categoría:Notas]]

Administración servidor de correo

2026-02-27T20:31:09Z

Guzman:

Administración servidor de correo

2026-02-27T20:23:52Z

Guzman:

Administración servidor de correo

2026-02-27T20:09:33Z

Guzman:

Administración servidor de correo

2026-02-27T20:01:51Z

Guzman: