Setup Web Server (apache) and DNS (bind) on a MacMini using Homebrew

Contents

• XCODE and BBEdit - command line tools
• BREW
• APACHE
• HTTPD config edits including HTTP2 and vhosts
• Let's Encrypt - certbot
• HTML default header
• DNS - Named and bind
• DNSSEC
• DANE
• Network Performance tools
• SSH on a different port number
• SSH tunnel for SMB for timemachine
• TimeMachine
• How to solve calendar problems
• Common pitfalls, problems, useful commands
• MacMini Setup (for SC/webcam/demo)
• Online references
• How this page is made

XCODE and BBEdit command line tools

• xcode-select --install

If needed to re-install command tools do this command first:

• sudo rm -rf /Library/Developer/CommandLineTools

Install BBEdit from https://www.barebones.com/products/bbedit/index.html

Start BBEdit and set up its command line tools under the BBEdit menu.

BREW

Setup:

• ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
• brew install openldap libiconv

Maintenance:

• brew update
• brew upgrade
• brew cleanup
• brew services list
• sudo brew services restart --all

Debugging:

• brew doctor
• brew --version

• sudo chown -R "$USER":admin /usr/local
• sudo chown -R "$USER":admin /Library/Caches/Homebrew

• echo 'export PATH="/usr/local/sbin /usr/local/bin $PATH"' >> ~/.zshrc

APACHE

Setup:

• brew install httpd
• sudo brew services start httpd

Maintenance:

To restart httpd:

• sudo brew services restart httpd
• sudo apachectl stop
• sudo apachectl -k restart

Debugging:

• tail -n 200 -f /usr/local/var/log/httpd/error_log
• tail -n 200 -f /usr/local/var/log/httpd/access_log

• sudo apachectl stop
• sudo launchctl unload -w /System/Library/LaunchDaemons/org.apache.httpd.plist

Check if deamon is running:

• ps -aef | grep httpd

• sudo apachectl -S

• sudo apachectl configtest

HTTPD config edits HTTP2, headers, userdirs, proxy

HTTPD config basic edits:

• bbedit /usr/local/etc/httpd/httpd.conf

1. Listen 8080 => Listen 80
2. enable ==> LoadModule deflate_module lib/httpd/modules/mod_deflate.so
3. enable ==> LoadModule rewrite_module lib/httpd/modules/mod_rewrite.so
4. ServerAdmin admin@example.net
5. #ServerName www.example.net:8080 ==> ServerName localhost:80
6. enable ==> Include /usr/local/etc/httpd/extra/httpd-autoindex.conf

HTTPD config edits to enable http2

• bbedit /usr/local/etc/httpd/httpd.conf

1. disable ===> #LoadModule mpm_prefork_module lib/httpd/modules/mod_mpm_prefork.so
2. enable ===> LoadModule mpm_event_module lib/httpd/modules/mod_mpm_event.so
3. enable ===> LoadModule http2_module lib/httpd/modules/mod_http2.so
4. add ===> Protocols h2 h2c http/1.1

Enable full filename display in case of directory index:

• bbedit /usr/local/etc/httpd/extra/httpd-autoindex.conf

add NameWidth=* to the line IndexOptions FancyIndexing HTMLTable VersionSort

1. ===> IndexOptions FancyIndexing HTMLTable VersionSort NameWidth=*

Enable example.net/~user.

• bbedit /usr/local/etc/httpd/httpd.conf

1. enable ==> LoadModule userdir_module lib/httpd/modules/mod_userdir.so

• bbedit /usr/local/etc/httpd/extra/httpd-userdir.conf

1. Change public_html into Sites

Headers for security hardening

• https://wiki.mozilla.org/Security/Server_Side_TLS
• https://bettercrypto.org/
• https://ssl-config.mozilla.org/
• https://internet.nl/

• bbedit /usr/local/etc/httpd/httpd.conf

1. enable ==> LoadModule headers_module lib/httpd/modules/mod_headers.so
2. add at the end of the conf file:
   
   <IfModule headers_module>
   #  header set Strict-Transport-Security "max-age=15768000; includeSubDomains"
     header set Strict-Transport-Security "max-age=15768000"
     header set X-XSS-Protection "1; mode=block"
     header set X-Frame-Options "SAMEORIGIN"
     header set X-Content-Type-Options "nosniff"
     header set Referrer-Policy "same-origin"
   #  header set Content-Security-Policy: "default-src 'self' '*' ;"
   </IfModule>

Enable (reverse) proxies.

• https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html

In httpd.conf:

• bbedit /usr/local/etc/httpd/httpd.conf

1. enable ==> #LoadModule proxy_module lib/httpd/modules/mod_proxy.so
2. LoadModule proxy_http_module lib/httpd/modules/mod_proxy_http.so

• bbedit /usr/local/etc/httpd/extra/httpd-vhosts.conf

HTTPD config edits for vhosts

HTTPD config edits enable vhosts:

• bbedit /usr/local/etc/httpd/httpd.conf

1. enable ==> LoadModule vhost_alias_module lib/httpd/modules/mod_vhost_alias.so
2. enable ==> Include /usr/local/etc/httpd/extra/httpd-vhosts.conf

• bbedit /usr/local/etc/httpd/extra/httpd-vhosts.conf

Let's Encrypt - certbot

• sudo install -d -o $(whoami) -g admin /usr/local/Frameworks
• brew install certbot

• bbedit /usr/local/etc/httpd/httpd.conf

Uncomment:

add at the end:

• bbedit /usr/local/etc/httpd/extra/httpd-ssl.conf

Make sure these parameters have following values:
• SSLProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
• SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384 TLS_AES_256_GCM_SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 TLS_CHACHA20_POLY1305_SHA256 ECDHE-ECDSA-AES128-GCM-SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES256-GCM-SHA384 TLS_AES_256_GCM_SHA384 ECDHE-RSA-CHACHA20-POLY1305 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES128-GCM-SHA256 TLS_AES_128_GCM_SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES128-SHA  ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA "
• SSLProxyProtocol             all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
• SSLProxyCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384 TLS_AES_256_GCM_SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 TLS_CHACHA20_POLY1305_SHA256 ECDHE-ECDSA-AES128-GCM-SHA256 TLS_AES_128_GCM_SHA256 ECDHE-RSA-AES256-GCM-SHA384 TLS_AES_256_GCM_SHA384 ECDHE-RSA-CHACHA20-POLY1305 TLS_CHACHA20_POLY1305_SHA256 ECDHE-RSA-AES128-GCM-SHA256 TLS_AES_128_GCM_SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES128-SHA  ECDHE-RSA-AES256-SHA384 ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES128-SHA "
• SSLHonorCipherOrder     on
• SSLSessionTickets       off
• SSLCompression          off
• SSLOptions +StrictRequire
• # Add vhost name to log entries:
• LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
• LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
comment out the certs
change listen 8443 ==> listen 443
comment out everything in the virtual host block including #<VirtualHost _default_:8443> and #</VirtualHost>

• "/usr/local/var/www"

• catch example.net
  • catches all (sub)domains for which no other webroot is defined is
• example.net
  • this goes to the normal webroot of the domain example.net
• www.example.net
  • also goes to the normal webroot of the domain example.net
• sub1.example.net
  • a subdomain of example.net with its own webroot

• bbedit /usr/local/etc/httpd/extra/httpd-vhosts.conf

• bbedit /usr/local/etc/httpd/extra/httpd-vhosts-le-ssl.conf

• bbedit /usr/local/etc/httpd/extra/httpd-vhosts-le-ssl-options.conf

• sudo certbot --apache

• sudo certbot --apache --staging

• sudo certbot --apache --force-renewal

• sudo certbot renew

For automatic renewal, see:

• https://gist.github.com/jgillman/8b29c5d75f9fbcf30d55f1a0de535c5d

• bbedit /usr/local/etc/certbot-renew.sh

• chmod +x /usr/local/etc/certbot-renew.sh

create plist:

• bbedit /Library/LaunchDaemons/com.letsencrypt.renew.plist

• sudo chmod 644 /Library/LaunchDaemons/com.letsencrypt.renew.plist
• sudo chown root:admin /Library/LaunchDaemons/com.letsencrypt.renew.plist
• sudo launchctl load /Library/LaunchDaemons/com.letsencrypt.renew.plist
• sudo launchctl list | grep -i letsencrypt

If test runs are needed:

• sudo certbot renew --dry-run

If pre, post or deploy scripts are needed, those go here:

• /private/etc/letsencrypt/renewal-hooks

• tail -f -n 40 /tmp/com.letsencrypt.renew.stderr
• tail -f -n 40 /tmp/com.letsencrypt.renew.stdout
• sudo tail -f -n 400 /var/log/letsencrypt/letsencrypt.log

To list the certificates:

• sudo certbot certificates

Some more debugging:

• https://letsdebug.net/

The configuration file is at: /etc/letsencrypt/renewal/

HTML default header

DNS - Named and bind

Setup:

• brew install bind
• rndc-confgen -a

Edit the conf file:

• bbedit /usr/local/etc/named.conf

directory "/usr/local/var/named";
version "unknown";
rate-limit {
           responses-per-second 15;
           window 5;
           log-only no;
};

And create the zone files in:

• /usr/local/var/named/

• sudo brew services start bind

Maintenance:

• rndc sync -clean
• rndc reload
• sudo brew services restart bind
• sudo brew services stop bind

Debugging:

First set up a separate window with tail of logging:

• tail -f -n 40 /usr/local/var/log/named/named.log

Some checks:

• rndc status
• named-checkconf -z /usr/local/etc/named.conf
• host -t ns example.net

DNSSEC

Setup:

• https://kb.isc.org/docs/aa-00626
• https://kb.isc.org/docs/aa-00711
• https://www.sidn.nl/en/dnssec/dnssec-signatures-in-bind-named
• https://support.cloudflare.com/hc/en-us/articles/360021111972-Troubleshooting-DNSSEC

• The master zone files: edit those to change records, etc.
  • /usr/local/var/named/example.net.zone
• The keys:
  • /usr/local/var/named/keys/
• Bind can automatically sign and will produce intermediate files in the same directory as the zone files.

• mkdir /usr/local/var/named/keys

Then we need to once generate the keys for each zone file on the master DNS server. That can be done with the following commands:

• dnssec-keygen -3 -a ECDSAP256SHA256 -K /usr/local/var/named/keys/ example.net
• dnssec-keygen -3 -a ECDSAP256SHA256 -f KSK -K /usr/local/var/named/keys/ example.net

• bbedit /usr/local/sbin/keygen.sh

• chmod +x /usr/local/sbin/keygen.sh

Enable DNSSEC in named.conf by adding the following configuration directives inside options{ }:

• bbedit  /usr/local/etc/named.conf

• sudo brew services restart bind

Now we need the Delegation Signing records to supply to the parent zone manager. Easiest is using dig and dnssec-dsfromkey:

• dig @127.0.0.1 dnskey example.net | dnssec-dsfromkey -1 -2 -f - example.net

Debugging:

• dig DNSKEY example.net. @localhost +multiline

• dig A example.net. @localhost +noadditional +dnssec +multiline

• dig +trace +noadditional DS example.net. @8.8.8.8 | grep DS

• http://dnssec-debugger.verisignlabs.com
• http://dnsviz.net/

DANE

Setup:

• https://joscor.com/blog/dane-tlsa-tutorial/
• https://www.huque.com/bin/gen_tlsa

Debugging:

• dig

SSH on a different port number

• https://superuser.com/questions/1398824/cant-change-port-listen-on-macos-x-mojave-for-built-in-ssh
• http://www.iana.org/assignments/port-numbers

• sudo vi /etc/services
  • Change the port number in:
  • ssh 22/udp # SSH Remote Login Protocol
  • ssh 22/tcp # SSH Remote Login Protocol
• sudo vi /etc/ssh/ssh_config
  • uncomment the following: Port 22
    and change that port number in the desired one.
• Restart the ssh daemon.
• sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
• sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist

SSH tunnel for e.g. VNC. Here we assume ssh over port 12345. After this tunnel setup one can ust vnc to 127.0.0.1:5901 to reach the other machine:

• ssh -p 12345 -v -L 5901:127.0.0.1:5900 destination

SSH tunnel for SMB for timemachine

Setup

• sudo ifconfig lo0 alias 127.0.0.2/32

• ssh-keygen
• ssh-copy-id remoteuser@example.net -p <port>

• ssh -p <port> remoteuser@example.net
• sudo ssh -p <port> -i /Users/localuser/.ssh/id_rsa user@example.net

• sudo ssh -f -C -N -p <port> -i /Users/localuser/.ssh/id_rsa -L 127.0.0.2:445:127.0.0.1:445 -o ServerAliveCountMax=3 -o ServerAliveInterval=15 -o ExitOnForwardFailure=yes remoteuser@example.net

• brew install ssh
• brew install autossh

Start the tunnel:

• sudo autossh -M 0 -f -C -N -p <port> -i /Users/localuser/.ssh/id_rsa -L 127.0.0.2:445:127.0.0.1:445 -o ServerAliveCountMax=3 -o ServerAliveInterval=15 -o ExitOnForwardFailure=yes remoteuser@example.net

• bbedit /Library/LaunchDaemons/localhost.loopback.plist

• sudo chmod 644 /Library/LaunchDaemons/localhost.loopback.plist
• sudo chown root:admin /Library/LaunchDaemons/localhost.loopback.plist
• sudo launchctl load /Library/LaunchDaemons/localhost.loopback.plist
• ifconfig | grep 127

Maintenance:

• sudo ifconfig lo0 alias 127.0.0.2/32
• sudo ssh -f -C -N -p <port> -i /Users/localuser/.ssh/id_rsa -L 127.0.0.2:445:127.0.0.1:445 -o ServerAliveCountMax=3 -o ServerAliveInterval=15 -o ExitOnForwardFailure=yes remoteuser@example.net

Debugging:

• ifconfig | grep 127

• ps aux | grep tunnel

TimeMachine

Setup:

• https://www.macworld.com/article/2033804/control-time-machine-from-the-command-line.html

• man tmutil

• sudo tmutil enable
• sudo tmutil disable

To get the status of anything going on or progressing:

• tmutil status

• tmutil startbackup

• tmutil stopbackup

• sudo tmutil disablelocal
• sudo tmutil enablelocal

• sudo tmutil addexclusion <path of folder/file to exclude>

• tmutil destinationinfo

• tmutil removedestination ......

• tmutil setdestination volume_name

• tmutil listbackups

Debugging:

• http://www.garth.org/archives/2011,08,27,169,fix-time-machine-sparsebundle-nas-based-backup-errors.html

• sudo chflags -R nouchg   <the backup bundle>
• sudo hdiutil attach -nomount -noverify -noautofsck <the backup bundle>
• sudo tail -f /var/log/fsck_hfs.log
• sudo fsck_hfs -drfy -c 2g /dev/diskXs2

• fsck_hfs -p /dev/diskXs2
• fsck_hfs -drfy -c 2g /dev/diskXs2

To scan for bad blocks:

• /sbin/fsck_hfs -S /dev/diskXs2

• hdiutil detach /dev/diskXs2

• bbedit <the backup bundle>/com.apple.TimeMachine.MachineID.plist

• log show --predicate 'subsystem == "com.apple.TimeMachine"' --info | grep 'upd: (' | cut -c 1-19,140-999

How to solve calendar problems

How to solve the error: "Apple Calendar Can’t Save Event to Exchange":

See: https://michaelkummer.com/tech/apple/macos-calendar-exchange/

• Quit Calendar application (Command + Q)
• Quit Apple Mail
• Open Activity Monitor (through Spotlight or Launchpad)
• Search for “Calendar” and quit all the relevant processes
• Open Finder and navigate to ~/Library/Calendars
• Double-check Activity Monitor to make sure no Calendar-related processes are running
• Delete cache files
• Relaunch Calendar

Network Performance tools

• https://fasterdata.es.net/performance-testing/network-troubleshooting-tools/

• iperf -s -i 4 -w 5m

• iperf -i 4 -t 1000 -N -w 5M -l 1M -c [servername]

• iperf3 -s -i 5

• iperf3 -i 4 -t 1000 -N -w 5M -l 1M -c [servername]

• nuttcp -S

• nuttcp [servername]

Common pitfalls, problems, useful commands

• After a brew upgrade some services may not work. One difficult to diagnose problem may be the firewall settings in MacOSX. It blocks by default incoming connections on unsigned bin's and executables need to be added in the list in the System Preferences Firewall settings. Also note that just putting there the /usr/local/bin/executable will not work since brew puts aliasses (links) there. Follow the link to the real bin. Same for /usr/local/sbin .
• After a "brew upgrade" the output may display an error that an old directory could not be removed and a sudo command is displayed. In reality the "brew upgrade" did not complete, so execute that sudo command and repeat "brew upgrade" and displayed error - sudo commands until nothing is being done anymore by that command.
• Somehow launchd has a different or incomplete PATH environment. Caused certbot renew to initially fail.
• if you need to log out another user:
  • ps awwwwux | grep loginwindow
  • kill the pid of that user with:
  • sudo kill -9 [pid]
• Support files can be found HERE.
• SSH plus Screensharing
  • ssh -p 22 -N -L 5999:localhost:5900 user@example.net
  • vnc://localhost:5999
• Starting/stopping remote desktop. The commands in this article https://support.apple.com/en-us/HT201710  work with Apple Remote Desktop 3.2 and later. Here are commands that you can use:
  • Restart the ARD Agent and helper:
    • sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -restart -agent
  • Turn on Remote Desktop Sharing, allow access for all users, and enable the menu extra:
    • sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -allUsers -privs -all -clientopts -setmenuextra -menuextra yes
  • Turn on Remote Desktop Sharing, allow access for specified users:
    • sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -specifiedUsers
  • You must use the -configure, -access, and -privs options in a separate command to specify the set of users and their access privileges. For example, this command is for users with the short names "teacher" and “student." It gives them access to observe (but not control) the computer, and to send text messages:
    • sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -users teacher,student -access -on -privs -ControlObserve -ObserveOnly -TextMessages
  • Unlike other kickstart options, you can’t combine the allowAccessFor options with other kickstart options. You must use it as in the last two samples above. You might have to call kickstart more than once to finish a computer’s setup. Remove access privileges for specified users ("student" in this example):
    • sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -users student -access -off
  • Disable ARD Agent and remove access privileges for all users:
    • sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -deactivate -configure -access -off
• Shell need to change from bash to zsh now:
  • The default interactive shell is now zsh. To update your account to use zsh, please run `chsh -s /bin/zsh`. For more details, please visit https://support.apple.com/kb/HT208050.
    • cp .bash_profile .zshrc
    • chsh -s /bin/zsh
  • restart terminal
    • brew doctor

MacMini Setup (for SC/webcam/demo)

• Users & Groups
  • SNE-Admin
    • sne-admin
  • SNE-demo
    • sne-demo
  • Login Options
    • auto login sne-demo
• Power settings
  • never sleep computer
  • restart after power fail
  • prevent display sleep
  • awake with net access
  • start up 8h00 in the morning
• Desktop & Screen Saver
  • no screen saver
• Sharing
  • Screen Sharing
  • File Sharing
  • Remote login
• Security
  • turn off screen lock
  • enable location services
  • no filevault
• Date & Time
  • automatic time adjustment
• Display Menu.app
  
  • Download Display_Menu.app.zip
• MenuMeters
  • MenuMeters.app.zip
• BBEdit
  • BBEdit for High Sierra and earlier
  • BBEdit for newer systems
• Deskpicture SNE logo
  • SNE-desktop.jpg
  • http://delaat.net/logos/logo-sne/logo-sne-big-inv-flat.png
  • http://delaat.net/logos/
• Team Viewer Setup
  • Teamviewer Download
• To keep mac from sleeping unexpectedlythat stops video
  
  • in terminal: caffeinate -di &
• EvoCam Setup
  • Evocam4 download
  • Evocam5 download
    • serial ES56-MUDX-9LD6-BRAG
    • Note:
      • EvoCam 4 crashes now and then but does recording fine, however is 32 bit app!
      • EvoCam 5 is more stable but gives unusable recordings, is 64 bit!
      • NOTE: the low resolution serve must start first, then the high resolution, otherwise video is low quality.
  • Settings
  • • Preferences
      • web server port nr 10456
      • Log Web Server access
      • auto-open docs from previous session at startup
      • make sure the low res is loaded first.
      • Finder Cam1.settings on desktop put in dock and set Open at login
      Cam1.evocamsettings
      • 320 * 180
      • 384 * 216
      • 480 * 270
      • font size 12
      • framerate 15
      • quality normal normal
      • fontsize 9
    • Cam2.evocamsettings
      • 1280 * 720
      • framerate 15
      • quality normal normal
    • Other resolutions 16*9
    • 256 * 144 -> YouTube 144p
    • 320 * 180
    • 480 * 270
    • 640 * 360 -> nHD
    • 768 * 432
    • 800 * 450
    • 848 * 480
    • 896 * 504
    • 960 * 540 -> qHD
    • 1024 * 576
    • 1152 * 648
    • 1280 * 720 -> HD
    • 1366 * 768 -> WXGA
    • 1600 * 900 -> HD+
    • 1920 * 1080 -> Full HD
    • 2000 * 1125
    • 2048 * 1152
    • 2304 * 1296
    • 2560 * 1440 -> QHD
    • 2880 * 1620
    • 3200 * 1800 -> QHD+
    • 3520 * 1980
    • 3840 * 2160 -> 4K UHD
    • 4096 * 2304 -> Full 4K UHD
    • 4480 * 2520
    • 5120 * 2880 -> 5K UHD
    • 5760 * 3240
    • 6400 * 3600
    • 7040 * 3960
    • 7680 * 4320 -> 8K UHD
    • 15360 * 8640 -> 16K

Online references

In this table are the commands for apache, bind and certbot via brew as in https://getgrav.org/blog/macos-mojave-apache-multiple-php-versions.

• Via homebrew
  1. https://getgrav.org/blog/macos-mojave-apache-multiple-php-versions
  2. https://getgrav.org/blog/macos-mojave-apache-mysql-vhost-apc
  3. https://getgrav.org/blog/macos-mojave-apache-ssl
  4. https://certbot.eff.org/lets-encrypt/osx-apache
• Using only installed version (not advised)
  
  • https://coolestguidesontheplanet.com/install-apache-mysql-php-on-macos-mojave-10-14/
• Via server (depricated, not advised)
  • https://www.macstrategy.com/article.php?210
• For email I use MailServe from Cutedge Systems.

How this page is made

• author Cees de Laat
• bluegriffon