SYSADMIN: Collection of useful commands and configs

Backup site plan.txt

#### Backup web directories ####
cd /data/web/; for i in */; do tar -cvzf "${i%/}-$(date '+%Y%m%d').backupgd.tar.gz" "$i"; done;
find / -iname "*.backupgd.tar.gz" -exec mv {} /data/backups/web \;

#### Backup sql ####
sudo service mysql stop;
sudo mysqld_safe --skip-grant-tables &
cd /data/backups/sql;
for I in $(mysql -u root -e 'show databases'); do mysqldump -u root $I | gzip > "$I.sql.gz"; done;
#find . -type f -name '*.sql.gz' -exec mv {} /data/backups/sql \;
sudo /etc/init.d/mysql stop
sudo /etc/init.d/mysql start

### On local machine ###
rsync -Pav -e 'ssh -i ~/.ssh/site.pem' [email protected]:/data/backups/ /Users/myuser/Desktop/backups/todays-date/

Commands to run on server.sh

# Clean up apple generates files
find /var/www/html \( -name '.DS_Store' -or -name '._*' \) -delete;

# Clear symfony cache
rm -rf /app/cache;

# Backup mysql
mysqldump -u USER -p DATABASE_NAME > DATABASE_NAME.sql;

# Install PHP7 with bchmath
sudo apt-get -y update;
sudo add-apt-repository ppa:ondrej/php;
sudo apt-get -y update;
sudo apt-get install -y php7.0 libapache2-mod-php7.0 php7.0 php7.0-common php7.0-gd php7.0-mysql php7.0-mcrypt php7.0-curl php7.0-intl php7.0-xsl php7.0-mbstring php7.0-zip php7.0-bcmath;

# Install composer on AWS EC2
cd ~;
sudo curl -sS https://getcomposer.org/installer | sudo php;
sudo mv composer.phar /usr/local/bin/composer;
sudo ln -s /usr/local/bin/composer /usr/bin/composer;

# Load private keypairs
ps -e | grep [s]sh-agent 
ssh-add ~/.ssh/id_rsa &>/dev/null
ssh-add ~/.ssh/id_rsa 

# Symfony build process
sudo mkdir app/cache;
sudo mkdir app/logs
sudo chown -R ubuntu:ubuntu app/cache/;
sudo chown -R ubuntu:ubuntu app/logs/;
sudo php app/console cache:clear --env=prod --no-debug;
sudo php app/console assets:install web --env=prod;
sudo php app/console assetic:dump web --env=prod;
sudo chown -R ubuntu:ubuntu app/cache/;
sudo chown -R ubuntu:ubuntu app/logs/;

# Create MySQL User and database
mysql -u root -p;
create database DB_NAME;
create user 'DB_USER'@'localhost' identified by 'DB_PASS';
grant all privileges on DB_NAME.*  TO 'DB_USER'@'localhost';

# Import database
mysql -u username -p databasename < filename.sql;

# Install wordpress command (Run in root of directory)
## Note: wget on the raw wordpress_installer.sh first
chmod +x wordpress_installer.sh; ./wordpress_installer.sh;

# MySQL reset root password
sudo /etc/init.d/mysql stop;
sudo killall -9 mysqld;
sudo mysqld_safe --skip-grant-tables --skip-networking &;
mysql -u root;
FLUSH PRIVILEGES;
UPDATE mysql.user SET Password=PASSWORD('newpwd') WHERE User='root';
FLUSH PRIVILEGES;
sudo /etc/init.d/mysql stop;
sudo /etc/init.d/mysql start; # Start normally, not in safe mode

# Clean pagespeed cache
touch `grep "^ *ModPagespeedFileCachePath" /etc/apache2/mods-enabled/pagespeed.conf | awk ' { print $2; } ' | sed 's/"//g'`/cache.flush

# Run a command in each directory excluding current
find . -maxdepth 1 -type d \( ! -name . \) -exec bash -c "cd '{}' && pwd" \;

# Delete files with extension in current directory plus sub directories
find . -name "*.bak" -type f -delete

crontab

30 2 * * 1 /opt/letsencrypt/letsencrypt-auto renew >> /var/log/le-renew.log
0 1 * * * /certbot-auto renew >/dev/null 2>&1

h2_apache.sh

# Apache2 latest version
apt-get install software-properties-common python-software-properties
add-apt-repository ppa:ondrej/apache2
apt-get update

#
a2enmod http2
apachectl restart

# Apache 2.4.27, HTTP/2 not supported in prefork
apachectl stop
apt-get install php7.1-fpm # Install the php-fpm from your PHP repository. This package name depends on the vendor.
a2enmod proxy_fcgi setenvif
a2enconf php7.1-fpm # Again, this depends on your PHP vendor.
a2dismod php7.1 # This disables mod_php.
a2dismod mpm_prefork # This disables the prefork MPM. Only one MPM can run at a time.
a2enmod mpm_event # Enable event MPM. You could also enable mpm_worker.
apachectl start

Mac commands.txt

# Force remove trash
sudo rm -rf ~/.Trash;
sudo rm -rf /Volumes/*/.Trashes;

# Remove .* files
find . -name ".*" -exec rm -rf {} \;

# Upload file to ssh
scp -i KEYPAIR.pem -r FILE_TO_UPLOAD USER@SERVER_IP:/var/www/WEBSITE/FOLDER/;

# Ngrok for custom virtual host (using Vagrant/Homestead)
~/ngrok http -host-header=DOMAIN.DEV 8000;

# Reset git
rm -f .git/index;
git reset;

# Remove files that are gitignore
git rm -r --cached .;
git add -A;
git commit -am 'Removing ignored files';

# Add command to profile
nano ~/.bash_profile;

# Update profile
source ~/.bash_profile;

# Flush DNS
sudo dscacheutil -flushcache;sudo killall -HUP mDNSResponder; say cache flushed;

# Zip all directories
for i in */; do zip -r "${i%/}.zip" "$i"; done;

# Download only zip directories from server
scp -i key.pem -r ubuntu@server_ip:/data/web/\{*.zip,*.war\}  ~/Desktop/backups/;

# Update NPM
sudo npm cache clean -f
sudo npm install -g n
sudo n stable
npm update

# Find large files/directories
sudo du -sx /* 2>/dev/null | sort -n # Global search
sudo du -sx * 2>/dev/null | sort -n # Search in current directory

# Reset launchpad
defaults write com.apple.dock ResetLaunchPad -bool true; killall Dock

migrate_server.sh

#!/bin/bash

sudo -i

# Clone / Restore packages using apt-clone
apt-get install dpkg-repack
apt-get install apt-clone
apt-clone clone /migrate/apt-clone-state-ubuntu-$(lsb_release -sr)-$(date +%F).tar.gz --with-dpkg-repack

# Copy apache config files
cp -R /etc/apache2/sites-available /migrate/apache2/sites-available
cp -R /etc/apache2/conf-available /migrate/apache2/config-available

# Copy letsencrypt
cp -R /etc/letsencrypt /migrate/letsencrypt

# Copy apache log files
cd /var/log/apache2
find . -type f -maxdepth 3 -exec rm -v {} \; # TODO: Remove this and implement find . -type d
cp -R /var/log/apache2 /migrate/apache2/logs

# MySQL
mysqldump --all-databases -u root -p > /migrate/backup.sql

# - Get a list of apt-get modules
# - Get list of enabled PHP and Apache modules
php -m > php_modules.txt
apache2ctl -M > apache_modules.txt

# - New Relic, other daemons
# - Mount /data/web

Server recovery.txt

This document explains the process of fixing server problems such as the sudoers is throwing an error, or someone decided to run sudo chown ubuntu:www-data on the root directory
- This requires two servers, a clean one and the affected one
#S1 = Affected Server
#S2 = Clean Server

###### Run on #S1 ######
cd /;
mkdir fix;
cd /fix;

# Get installed packages
dpkg --get-selections | grep -v deinstall > packages.txt
echo "Installed packages exported"

# Apt-key transfer
apt-key exportall > keys.gpg
echo "Keys exported"

-- Move generated files to #S2 --

###### Run on #S2 ######
# Import apt-keys
apt-key add keys.gpg;

# If using multiarch, add appropiate arch to system
dpkg --add-architecture i386;

# Install all packages on system
apt-get update;
dselect update;
dpkg --set-selections < selections.txt;

# Get var permissions
find /var -printf "%m:%u:%g:%p\n" > /tmp/var.permissions.txt;

# Get chown permissions
find / -printf "%u:%g %p\n" > chown_permissions.txt;
echo "Permissions exported";

# Them mount the storage of #S1 onto #S2 to fix the permissions

# Restore /var permissions from generated file from 2nd server
while IFS=":" read perms user group file; do 
chmod -R $perms $file > /dev/null 2>&1
chown -R $user:$group $file > /dev/null 2>&1
done < /tmp/var.permissions.txt

# Fix sudoers
chown root:root /usr/lib/sudo/sudoers.so;
chmod 4755 /usr/lib/sudo/sudoers.so;
chown root:root /etc/sudoers;
chown root:root /etc/sudoers;

wordpress_deploy

##########
# 1. Duplicator Pro > Export package to S3
##########

##########
# 2. Duplicator Pro > Ignore:
##########
{root path}/wp-content/cache;
{root path}/wp-content/backup-db;
{root path}/wp-content/backups;
{root path}/wp-content/blogs.dir;
{root path}/wp-content/upgrade;
{root path}/wp-content/themes/{theme}/node_modules;

# File extensions to ignore
zip;rar;tar;gz;bz2;7z;log;orig;bkp;

# Files to ignore
{root path}/.htaccess;
{root path}/license.txt;
{root path}/readme.html;
{root path}/sitemap.xml;
{root path}/sitemap.xml.gz;
{root path}/wp-content/advanced-cache.php;
{root path}/wp-content/wp-cache-config.php;
{root path}/wp-content/plugins/hello.php;
{root path}/wp-content/themes/{theme}/npm-debug.log;

##########
# 3. Server side
##########
cd /var/www/{dir};    # Go to wordpress root
rm -rf ..?* .[!.]* *; # Delete all
touch index.php       # Setup a default maintenance page

##########
# 3. Amazon
##########
- Go to S3 > bucket > Duplicator Pro/{site}
- Right click > Download As on each _archive.zip and installer.php
- wget "{amazon url with tokens}" for both
- mv _archive.zip?amazon_stuff to _archive.zip
- mv installer.php?amazon_stuff to installer.php
- chmod 777 -R /var/www/{dir}/
- chown www-data:www-data -R /var/www/{dir}/

##########
# Wordpress backend
##########
- Enable iThemes, WP Super Cache, Hummingbird Pro
- Run through iThemes setup, Wp Super Cache enable caches and Hummingbird test site

wordpress_permissions.sh

#!/bin/bash
#
# This script configures WordPress file permissions based on recommendations
# from http://codex.wordpress.org/Hardening_WordPress#File_permissions
#
# Author: Michael Conigliaro
#
WP_OWNER=ubuntu # <-- wordpress owner
WP_GROUP=www-data # <-- wordpress group
WP_ROOT=${1:-.} # <-- wordpress root directory
WS_GROUP=www-data # <-- webserver group
 
# reset to safe defaults
find ${WP_ROOT} -exec chown ${WP_OWNER}:${WP_GROUP} {} \;
find ${WP_ROOT} -type d -exec chmod 755 {} \;
find ${WP_ROOT} -type f -exec chmod 644 {} \;
 
# allow wordpress to manage wp-config.php (but prevent world access)
chgrp ${WS_GROUP} ${WP_ROOT}/wp-config.php;
chmod 660 ${WP_ROOT}/wp-config.php;
 
# allow wordpress to manage .htaccess
touch ${WP_ROOT}/.htaccess;
chgrp ${WS_GROUP} ${WP_ROOT}/.htaccess;
chmod 664 ${WP_ROOT}/.htaccess;
 
# allow wordpress to manage wp-content
find ${WP_ROOT}/wp-content -exec chgrp ${WS_GROUP} {} \;
find ${WP_ROOT}/wp-content -type d -exec chmod 755 {} \;
find ${WP_ROOT}/wp-content -type f -exec chmod 664 {} \;

wp_cli.sh

#!/bin/bash

# VERSION 1.1

echo "Downloading and seting up Wordpress"
wp core download --locale=en_GB

## Create a new wp-config.php file with wp config create (doc).
read -p 'database name:' dbname;
read -p 'database user:' dbuser;
read -p 'database password:' dbpass;

# DISALLOW_FILE_EDIT throws errors
wp config create --dbname=$dbname --dbuser=$dbuser --dbpass=$dbpass --dbhost=localhost --extra-php <<PHP
define( 'WP_MAX_MEMORY_LIMIT', '64M' );
define( 'COMPRESS_CSS',        true );
define( 'COMPRESS_SCRIPTS',    true );
define( 'CONCATENATE_SCRIPTS', true );
define( 'ENFORCE_GZIP',        true );
define('WP_POST_REVISIONS', 5 );
define('EMPTY_TRASH_DAYS', 7);
define('FS_METHOD','direct');
@ini_set('session.cookie_httponly', true);
@ini_set('session.cookie_secure', true);
@ini_set('session.use_only_cookies', true);
@ini_set('display_errors','Off');
@ini_set('error_reporting', E_ALL );
define( 'WP_DEBUG', false );
define( 'WP_DEBUG_LOG', false );
define( 'WP_DEBUG_DISPLAY', false );
PHP

## Create the database based on wp-config.php with wp db create (doc).
wp db create

## Install WordPress with wp core install (doc).
wp core install --prompt --skip-email

echo "Installing plugins"
# Install our base plugin boilerplate
wp plugin install https://github.com/johnhearfield/Wordpress-Plugin-Boilerplate/archive/master.zip

# Forms: Contact Form 7
# Backup: Duplicator
# Email: Easy WP SMTP (or use Sendgrid?)
# Neccesary tools: Safe SVG, ManageWP, Snippy
# Security: iThemes, WP Cerber
# SEO: Yoast, Cache Enabler, Optimus, Lazy Loader, Jetpack
#wp plugin install contact-form-7
#wp plugin install duplicator --activate
wp plugin install easy-wp-smtp --activate
wp plugin install safe-svg --activate
#wp plugin install worker
#wp plugin install snippy --activate
wp plugin install better-wp-security
#wp plugin install wp-cerber
wp plugin install wordpress-seo
wp plugin install cache-enabler
wp plugin install optimus --activate
#wp plugin install jetpack
#wp plugin install lazy-loading-responsive-images
#wp plugin install gdpr-framework

# accelerated-mobile-pages
# add-to-any
# automatic-image-alt-attributes

# Other plugins (optional):
# Search and Replace [Dev tools]
# 	wp plugin install search-and-replace
# Pagespeed Ninja [SEO]
# 	wp plugin install pagespeed-ninja
# Admin Menu Editor [Dev tools]
# 	wp plugin install admin-menu-editor
# Redirection [SEO]
# 	wp plugin install redirection
# Duplicate Page and Post [Dev tools]
# 	wp plugin install duplicate-wp-page-post
# Client Documentation [Dev tools]
# 	wp plugin install client-documentation
# Post Types Order [Dev tools]
# 	wp plugin install post-types-order
# Disable Author Pages [SEO]
# 	wp plugin install disable-author-pages

# Recommended Premium Plugins:
# Advanced Custom Fields Pro, Visual Composer
# WPMU Plugins: Hummingbird Pro, Smartcrawl, Google Analytics+
# Thrive Leads, Layered Popups


#Plugins on Github
wp plugin install https://github.com/roots/soil/archive/master.zip

mkdir -p wp-content/mu-plugins
wget --quiet https://raw.githubusercontent.com/roots/wp-password-bcrypt/master/wp-password-bcrypt.php
mv wp-password-bcrypt.php wp-content/mu-plugins/

# Get our mu-plugins
wget --quiet https://gist.githubusercontent.com/johnhearfield/1546f86454540adb0dfb2a7d6a9cde34/raw/4d4c98718314bc5f4efe89a0f52371c71df1a377/Core256792.php
mv Core256792.php wp-content/mu-plugins/

wget --quiet https://gist.githubusercontent.com/johnhearfield/1546f86454540adb0dfb2a7d6a9cde34/raw/0b7fc860c982735ab595f1e463ca956b59abc34a/Core256793.php
mv Core256793.php wp-content/mu-plugins/

echo "Cleaning up defaults and setting options"
wp plugin update --all;
#wp post delete 1;
#wp post delete 2;
#wp comment delete $(wp comment list --format=ids);
wp option update permalink_structure '/%postname%/';
wp option update comment_moderation 1;
wp option update default_comment_status 'closed';
wp option update show_avatars 0;
wp option update comment_registration 1;
wp option update gzipcompression 1;

wp theme delete twentytwelve;
wp theme delete twentythirteen;
wp theme delete twentyfourteen;
wp theme delete twentyfifteen;
wp theme delete twentysixteen;
wp theme delete twentyseventeen;

# Install Sage 8.5.4 (should really use Sage 9+)
#cd wp-content/themes;
#composer create-project roots/sage your-theme-name 8.5.4
#cd ../../;

#echo "Patching load-styles vuln"
#wget --quiet https://raw.githubusercontent.com/Quitten/WordPress/master/wp-dos-patch.sh;
#chmod +x wp-dos-patch.sh
#./wp-dos-patch.sh

#rm -rf wp-dos-patch.sh
rm -rf wp_cli.sh;