0. Interesting Links:

	skyBuilders timeLines Documentation
	Red Hat -- Linux, Embedded Linux and Open Source Solutions
	GNU's Not Unix! - the GNU Project and the Free Software Foundation (FSF)
	The Apache HTTP Server Project
	The Comprehensive Perl Archive Network
	PHP Hypertext Preprocessor (documentation)
	PostgreSQL Relational Database Management System "The most advanced Open Source database system in the world" (documentation)
	Open Secure Shell
	The National Institute of Standards and Technology Internet Time Service
	WebMin a web-based interface for system administration for Unix

  This is the process for configuring a new RedHat 9 host to become a skyHost running (and developing) skyBuilders timeLines under GNU/Linux/Apache/PHP/PostgreSQL. No other distributions have been tested as of this date, but there are no known issues to prevent the Apache/PHP/PostgreSQL version of timeLines from running in any Linux or other Unix-like environment. There are a few required services and utilities:

• An httpd service with Middleware: Apache mod_php
• A Relational Database Service: PostgreSQL
• Secure Sockets Layer: Apache mod_ssl and openssl for secure web communication
• Editing and Network Utilities: the GNU Project system of software tools
• And two that are recommended, but not required:
  • Secure Shell Service: openssh
  • Linux development tools, including the kernel source

  These services will require the following ports to be opened:

• ssh: 22
• http: 80
• https: 443
• postgresql: 5432

  Install RedHat 9
  See the RedHat site for full freely downloadable distribution and documentation.

  Partitioning recommendation:

name	recommended	format
/	15%	ext3
/boot	100MB	ext3
/swap	2xRAM	N/A (linux swap)
/tmp	2GB	ext3
/home	15%	ext3
/var	42%	ext3
/usr	28%	ext3

  Fedora (FC3 - FC5) Partitioning recommendation:

name	recommended	format
/boot	100MB	ext3
/swap	2xRAM	N/A (linux swap)
/	Remaining	ext3

  * NB: Due to the possibility of unforseen file growth within partitions, we now recommend that all partitions, other than boot and swap, be consolidated into one super partition, '/'.

Fedora Core (3.0 - 5.0) Notes: It is advisable as a matter of general practice to disable the graphical login interface. To do this make the following edits.

1. In /etc/grub.conf comment out the hidemenu line. (Set the timeout if you like also.)


2. And also change the kernel line from (notice the removal of "rhgb quiet"):
       kernel /vmlinuz-2.6.9-1.667 ro root=/dev/VolGroup00/LogVol00 rhgb quiet
   to:
       kernel /vmlinuz-2.6.9-1.667 ro root=/dev/VolGroup00/LogVol00


3. Then edit the /etc/inittab file, changing the runlevel from 5 to 3:
       id:5:initdefault:
   to:
       id:3:initdefault:


4. Ensure that SELinux is disabled (important) edit the /etc/selinux/config file: set SELINUX=disabled.


5. Also ensure that PEAR is completely installed - this is no longer done by default - by issuing the following command line:
   # yum -y install php-pear
6. # pear install db
7. # yum -y install php-mbstring (multi-byte support for UTF8 charset in php)
8. # yum -y install php-xml (an XML parsing library for php)
9. # yum -y install http (a library for making http requests)
10. # yum -y install tidy (an html cleanup utility)

Enable ssh for all users who will require remote access.

Some general information about the service:

• Nota Bene: It is imperative that the Apache extension package for PostgreSQL be installed. Make sure to install the RPM which may looks something like php-pgsql-4.3.4-11.rpm. (The command to install it is: % rpm -Uvh php-pgsql-4.3.4-11.rpm)
• /etc/httpd is the program directory
• /etc/httpd/conf/httpd.conf is the configuration file
• /var/www/html is the wwwroot or home directory for the server
• # service httpd [start|restart|stop|status] can be used to control the service. # man service for details.

Set httpd to start on boot and start httpd. Make a new directory for the timeLines application to serve from.
  This directory should be named using the fully qualified domain name of the new site. For the examples in this manual, the example domain name "www.example.tld" will be used. The suggested location for the new directory is alongside the default web root (in this case /var/www/html/). Using the example the new directory would be at /var/www/www.example.tld/.
    # mkdir /var/www/www.example.tld

  SSL is only required for secure shopping cart transactions. This section can be skipped if your site will not have secure transactions. Likewise, the whole application would benefit from (and run properly) being run securely. Feel free to run the whole site under a secure certificate.
  SSL should automatically have been configured during OS installation. However, in order for the timeLines application to take advantage of SSL, a Secure Certificate Signing Request and associated Key must be generated. There is a requirement that in order to become a Secure Certificate, the Request must be digitally signed in order to operate, to authorize it. This does not add any security, rather it acts as a guarantor to strangers that the Certificate really belongs to the organization it says it does. Certificate Authorities such as VeriSign charge money for the identity verification and authentication service, but for an internal application like this one, their services are not strictly necessary, as a certificate can be "self-signed" (if you are interested in using their services, feel free; their site should have full instructions on generating a certificate and key which can be substituted for the indicated part of this section below). Self-signing allows the generating organization to enable their own, equally secure Certificates, generally only used internally, or by other trusting organizations.
  Thanks to Fermilab for their helpful, easy-to-follow instructions, which also link to further, more in depth material on the subject of SSL, for those who are interested.
  The process:

1. Navigate to /etc/httpd/:
       # cd /etc/httpd
2. Make a new directory called cert and navigate into it (this is where your certificate and key will be kept):
       # mkdir cert
    # cd cert
3. Create the Certificate Request:
       # openssl req -new > sky.cert.csr
4. The openssl command will now ask a few questions to identify the certificate. The crucial one is called Common Name. The value entered for Common Name must be the fully qualified host and domain name of the server. For this example, "www.example.tld" will be used. This name must perfectly match the name of the machine. The other key ones are the PEM pass phrase, which will be required in the following step of the process, and the Challenge Password, which should not be lost. Here is an example of its operation, with some example answers:
       # openssl req -new > sky.cert.csr
    Using configuration from /usr/share/ssl/openssl.cnf
    Generating a 1024 bit RSA private key
    .........+++++
    ....+++++
    writing new private key to 'privkey.pem'
    Enter PEM pass phrase: pick something
    Verifying password - Enter PEM pass phrase: pick something
    -----
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [AU]:US
    State or Province Name (full name) [Some-State]:Massachusetts
    Locality Name (eg, city) []:Boston
    Organization Name (eg, company) [Internet Widgits Pty Ltd]:Example LLQ
    Organizational Unit Name (eg, section) []:IT Department
    Common Name (eg, YOUR name) []:www.example.tld
    Email Address []:dtd@example.tld
    
    Please enter the following 'extra' attributes
    to be sent with your certificate request
    A challenge password []:
    An optional company name []:
5. The output of the previous step should be sky.cert.csr, the Request file, and privkey.pem, the PEM file that contains the Key. In this step, the pass phrase supplied above will be exported from the PEM file encrypted, so that the certificate can use it:
       # openssl rsa -in privkey.pem -out sky.cert.key
   The openssl command will now prompt you for the pass phrase to authorize the export, then generate the file sky.cert.key, the Key file.
6. Sign the Request. Either self-sign it or get it signed by a Certificate Authority.
   To self-sign the Request:
       # openssl x509 -in sky.cert.csr -out sky.cert.crt -req -signkey sky.cert.key -days 365
   The openssl command should reply something like:
       Signature ok
    subject=/C=US/ST=Massachusetts/L=Boston/O=Example LLQ/OU=IT Department
    /CN=www.example.tld/Email=dtd@example.tld
    Getting Private key
   This should generate the file sky.cert.crt, the Certificate file.
   
   To submit the Request to a Certificate Authority:
   Either send the Request file to a Certificate Signing Authority as an email attachment or upload it through their web site.
   Put the resulting PEM file into the /etc/httpd/cert/ directory as sky.cert.crt
7. The Certificate and Key have now been generated

Main Configuration
In /etc/httpd/conf/httpd.conf, add these lines to the virtual servers section (substituting the appropriate domain name and IP address), with an extra VirtualHost section for each timeLines installation. (Please note that the string "*:80" can usually be substitued for the IP numbers listed below.):

You will likely want to preface your VirtualHost block with the following:

   <Directory /var/www/>
     CheckSpelling on
     AcceptPathInfo on
     Options MultiViews
   </Directory>

   NameVirtualHost 10.10.10.1

   <VirtualHost 10.10.10.1>
     ServerName www.example.tld
     DocumentRoot /var/www/www.example.tld
     DirectoryIndex index.html
     AddType application/x-httpd-php .php .php4 .php3 .phtml .html .xsd .xml .rss .rdfs .rdf
   </VirtualHost>

Secure Configuration [Optional]
  SSL is only required for secure shopping cart transactions. This subsection can be skipped if your site will not have secure transactions. Likewise, the whole application would benefit from (and run properly) being run securely. Feel free to run the whole site under a secure certificate.
  Apache SSL configuration is managed in a file called /etc/httpd/conf.d/ssl.conf. This config file works in concert with httpd.conf, and shares its style and syntax. Specifically, this file already has a Listen 443 line in it, so there is no need to put one into httpd.conf.

1. Apache SSL requires the installation of the mod_ssl package:
     # yum install mod_ssl
2. Edit /etc/httpd/conf.d/ssl.conf
3. Look for the section in the file with the heading "SSL Virtual Host Context". Beneath this heading should be a line that reads "<VirtualHost _default_:443>". Comment out the VirtualHost line by putting a # (the comment character) at the front of it. Directly after that line, enter a line that looks just like it, but repeat _default_:443, substituting the host's IP address in place of _default_. Using the example:
     <VirtualHost 10.10.10.1:443>
4. In the subsection immediately follwing, called "General setup for the virtual host", comment out the lines that have the DocumentRoot, ServerName, and/or AddType directives and insert these lines (substituting your server name where appropriate):
     DocumentRoot "/var/www/www.example.tld/"
  ServerName www.example.tld
  DirectoryIndex index.html
  AddType application/x-httpd-php .php .php4 .php3 .phtml .html .html .xsd .xml .rss .rdfs .rdf
   
5. At the bottom of a subsection (two or three subsections down) called "Server Certificate:", comment out the line with the SSLCertificateFile directive and insert the line:
     SSLCertificateFile /etc/httpd/cert/sky.cert.crt
6. At the bottom of the subsection beneath that one called "Server Private Key:", comment out the line with the SSLCertificateKeyFile directive and insert the line:
     SSLCertificateKeyFile /etc/httpd/cert/sky.cert.key
7. Save and exit
8. Restart the server httpd:
     # service httpd restart
9. The Application Site is now configured

Test PHP

Make appropriate changes to the file /etc/php.ini
Fedora Code 3.0 Installations and SELinux

Set the postgresql service to start on boot
PostgreSQL helpful hints
Enable proper logging for the postgresql service

1. Edit the file /etc/init.d/postgresql in your favorite editor (applies only to versions of PostgreSQL prior to version 7.4.3)
2. Find the line that reads:
       su -l postgres -s /bin/sh -c "/usr/bin/pg_ctl -D $PGDATA -p /usr/bin/postmaster -o '-p ${PGPORT}' start > /dev/null 2>&1" < /dev/null
   Edit the line to read (changes marked in bold, note double greater than after 'start'):
       su -l postgres -s /bin/sh -c "/usr/bin/pg_ctl -D $PGDATA -p /usr/bin/postmaster -o '-i -p ${PGPORT}' start >> /var/log/pgsql 2>&1" < /dev/null
   NOTE: If you are running the Fedora Core 3 version of PostgreSQL (postgresql-7.4.6-1.FC3.1) you will need to make the following edit - change:
       $SU -l postgres -c "$PGENGINE/postmaster -p ${PGPORT} -D '${PGDATA}' ${PGOPTS } &" >> $PGLOG 2>&1 < /dev/null
   to:
       $SU -l postgres -c "$PGENGINE/postmaster -i -p ${PGPORT} -D '${PGDATA}' ${PGOPTS } &" >> /var/log/pgsql 2>&1 < /dev/null
   
3. If you are running PostgreSQL version 7.4.3 or higher you will have to edit the /var/lib/pgsql/data/postgresql.conf as well:
   Look for the line     #tcpip_socket = false
   and make the following changes:
       # BEGIN skybuilders mod
    #tcpip_socket = false
    tcpip_socket = true
    max_connections = 100
        # note: increasing max_connections costs about 500 bytes of shared
        # memory per connection slot, in addition to costs from shared_buffers
        # and max_locks_per_transaction.
    #superuser_reserved_connections = 2
    #port = 5432
    port = 5432
    # END skybuilders mod
   
   If you are using PostgreSQL 8.0 or higher ensure that you have the following in place (substitue your relavent IP address).
   Configure PostgreSQL CONNECTIONS AND AUTHENTICATION
   listen_addresses = '10.10.40.29'
   port = 5432
   
   
4. Save and exit
5. Restart postgresql:
       # service postgresql restart
service should reply OK

Configure PostgreSQL users and databases

  Download the timeLines distribution archive file and extract it into the application site directory:

1. Navigate into the new application site directory made in the Apache Configuration section above (/var/www/www.example.tld/ from the example).
2. Download the installation archive file from downloads.skybuilders.com.
3. Decompress the installation archive into the the new directory (for this example sky.tar.gz is the name of the downloaded archive file):
       # tar -xvf sky.tar.gz -z
   All necessary application server pages, directories, and image files will now be in place in the timelines subdirectory.
4. Permissions must be set on the application directory. Create a group called "skyapp", if it has not yet been created. This will be the group that gives anonymous and administrator access to the application site.
       # /usr/sbin/groupadd skyapp
5. Add users to this group. The apache user (in this case "apache") must be added so that requests to the web server will have permission to operate on the site. Other users that may need to be added to this group are any non-root administrators of the machine or the site, or any users who require ftp or sftp access (though any users who require different permissioning from the web users should be permissioned separately).
       # /usr/sbin/usermod -G skyapp apache
    # /usr/sbin/usermod -G skyapp <username>
6. Change the group setting for the site directory (recursively, for all the files and directories below it).
       # cd /var/www
    # chown -R apache:skyapp www.example.tld
7. Set permissions for the site directory (recursively, for all the files and directories below it).
       # chmod -R 770 www.example.tld
8. Restart the web server httpd.
       # service httpd restart

1. # yum -y install php-mbstring.rpm
2. # yum -y install php-xml.rpm

Make sure to restart the apache server (# service httpd restart) after installing these packages.

  Run the timeLines installation script
  This script will build the new database's schema and populate it with initial data. Open a timeLines-compatible browser (Mozilla > 1.1, Netscape > 4.0, Internet Explorer > 4) and navigate to the following URL (where <domain name> is the domain name of your new site):
    http://<domain name>/timelines/Install.html
  The timeLines application will now challenge for the database password for the new site (as set in the PostgreSQL subsection "Configure PostgreSQL users and databases"). Initialization should take around two minutes.

  skyBuilders timeLines installation should now be complete!
  Please report any bugs at our interactive Bug Report. Thank you.