Secure Linux based environment - communication for SMEs

Thu, 13 Mar 2014 13:11:16 +0000

Data governance procedures include the management of communication assets (e-mail, instant messaging, phone calls), which are considered as business secrets. While small enterprises should make calculations on using the cloud as the price benefit might be worth the negative impact on data management and ownership, a medium/large sized company is suggested to use own solutions with own security and data backup policies. Hereby - in brief - I present an exemplary cost-effective, secure setup for small to medium enterprises own infrastructure based on encrypted communication and messaging storage with data security and backup in mind. This is a high-level overview: data governance practices, backup policies, disaster recovery, update procedures, security testing, physical security, etc. are to be defined. Linux based servers: CentOS or Ubuntu Office 1: ~100-200 users

Set up Owncloud for personal data management and Android sync

Thu, 13 Mar 2014 13:09:25 +0000

If privacy is a concern and you’d be feeling better to host your own CalDAV and CardDAV (calendar and contact) data but still would like to access it from your smartphone and web, Owncloud is a straightforward open-source tool to use. Remark: hosting your email would only be a possibility if high availability server hardware and internet connection is available for use.

Register a cheap domain with Namecheap and configure DynamicDNS
Add this script to CRON to regularly update Namecheap on your IP address
- Do this on the Internet interface of your host or OpenWRT router
- Use this script

urllib2.urlopen("http://dynamicdns.park-your-domain.com/update?host=%s&domain=%s&password=%s" % ("subdomain", "yourdomain.com", "hash.by.namecheap..82d9365e23be655"))

Set it in crontab

crontab -e

#Add this to run IP update script every 0:05

        5 0 * * * /path/to/script

Use an Ubuntu Server (14.04 64)

#Install Owncloud from Repository
cd ~
wget http://download.opensuse.org/repositories/isv:ownCloud:community/xUbuntu_14.04/Release.key
sudo sh -c "echo 'deb http://download.opensuse.org/repositories/isv:/ownCloud:/community/xUbuntu_14.04/ /' >> /etc/apt/sources.list.d/owncloud.list"
sudo apt-get update
sudo apt-get install owncloud
sudo apt-get install mysql-server
#Define MySQL password

#Create MySQL table
sudo mysql -u root -p #DefinedPwHere
	CREATE DATABASE owncloud;
	GRANT ALL ON owncloud.* to 'owncloud'@'localhost' IDENTIFIED BY 'database_password';
	exit

#Set file permissions
sudo chown -R www-data:www-data /var/www/owncloud
find /var/www/owncloud -type d -exec chmod 750 {} ;
find /var/www/owncloud -type f -exec chmod 640 {} ;

#Enable Apache SSL
sudo a2enmod ssl
sudo a2ensite default-ssl
sudo service apache2 reload
sudo a2enmod rewrite

#Generate SSL certs
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt

#Modify Apache configuration
sudo nano /etc/apache2/sites-available/default-ssl

#Add this to the file being edited with Nano
<IfModule mod_ssl.c>
    <VirtualHost _default_:443>
        ServerName YourServerName
        ServerAdmin webmaster@localhost
        DocumentRoot /var/www
        <Directory />
            Options FollowSymLinks
            AllowOverride None
        </Directory>
        <Directory /var/www/>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride None
            Order allow,deny
            allow from all
        </Directory>
        ErrorLog ${APACHE_LOG_DIR}/error.log
        LogLevel warn
        CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined
        SSLEngine on
        SSLCertificateFile /etc/apache2/ssl/apache.crt
        SSLCertificateKeyFile /etc/apache2/ssl/apache.key
        <FilesMatch ".(cgi|shtml|phtml|php)$">
            SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
            SSLOptions +StdEnvVars
        </Directory>
        <Directory /var/www/owncloud>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride All
            Order allow,deny
            Allow from all
            # add any possibly required additional directives here
            # e.g. the Satisfy directive (see below for details):
            Satisfy Any
        </Directory>
    </VirtualHost>
</IfModule>

sudo service apache2 restart

Access your Owncloud at http://host/owncloud
- Follow install steps, use MySQL, owncloud as database and use your database password as root or owncloud user
Use your Owncloud
Configure your router to forward requests of yourdomain:443 to yourowncloudhost:443 to access Owncloud from the Internet
Configure mobile device sync
- Use DAVdroid for your Android phone
  - CalDAV: https://yourowncloudhost/remote.php/caldav/
  - CardDAV: https://yourowncloudhost/remote.php/carddav/
- As most likely a self-signed certificate is used, set it up with CADroid accessible from FDroid market

Caldav on Dataprd.Com

Secure Linux based environment - communication for SMEs

Set up Owncloud for personal data management and Android sync