RFC and ICANN Compliance

  • CoCCA supports all the RFC’s required by the Internet Corporation for Assigned Name and Numbers - the peak body for co-ordination of the Internet naming and numbering system (ICANN). Compliant with standards in Specifications 6 and 10 of the ICANN base agreement.
  • List of supported RFCs
  • Support for DNSSEC signing using OpenDNSSEC or Packet Clearing House PCH
  • Anycast DNS using PCH Anycast. Additional Anycast using AfriNIC or LAC TLD also recommened - depending on region and TLD manager preference.
  • Support for WHMCS, and desec.
  • European GDPR Compliant.

Infrastructure

Changelog


Prerequisites - Updated June 21 2023

  • Ubuntu Server LTS 22.04.3 (server install, basic - no GUI or other options), 16GB RAM, 8 core, 200GB HDD
  • Latest postgreSQL 16, JDK 1.8 (8.0.402+6), OpenSSL 1.1.1w, Resin 4.0.66
  • Tips

Basics:

  • sudo apt update && sudo apt upgrade -y
  • sudo apt install zip unzip
  • sudo touch /etc/cloud/cloud-init.disabled
  • sudo apt purge cloud-init -y
  • sudo rm -Rf /etc/cloud
  • apt-get install gnupg
  • sudo apt-get -y install yamllint
  • apt install bind9 bind9utils bind9-doc -y
  • apt install dnsutils
  • sudo apt install ufw
  • sudo apt install nano
  • sudo apt-get install ttf-mscorefonts-installer
  • sudo apt-get install fontconfig
  • sudo fc-cache -f -v
  • sudo apt install build-essential checkinstall zlib1g-dev -y
  • sudo timedatectl set-timezone UTC
  • sudo timedatectl set-ntp on
  • sudo apt update && sudo apt upgrade -y
  • sudo apt autoremove

Basic Security

Ubunutu firewall basic configuration, handy commands:

  • sudo ufw enable | disable
  • sudo ufw status numbered ( see rules )
  • sudo ufw delete X ( delete a rule by number )
  • sudo ufw reload ( after rule changes )
sudo ufw allow from [trusted IP] to any port 22 ( if sshd is on non-standard port use that port )
sudo ufw allow from [trusted IP] to any port 53
sudo ufw allow from any to any port 80
sudo ufw allow from any to any port 443
sudo ufw allow from any to any port 43
sudo ufw allow from any to any port 700

Use fail2ban to protect against brute force/dictionary ssh attacks and mal-formed http requests. - tutorial

sudo apt install fail2ban

Basic sshd refinements. (we recommend using ssh keys tutorial)

sudo nano /etc/ssh/sshd_config


Protocol 2
Port XXX ( change port, config ufw to allow the selected port )
ListenAddress x.x.x.x ( if multiple IP, bind to one IP )
LogLevel VERBOSE
AllowUsers user_1 user_2 ( list logins that are allowed to ssh )
LoginGraceTime 30
PermitRootLogin no
MaxAuthTries 3
HostbasedAuthentication no
IgnoreRhosts yes
PermitEmptyPasswords no
AllowTcpForwarding no
X11Forwarding no
ClientAliveInterval 300
ClientAliveCountMax 0
MaxStartups 2

sudo systemctl restart sshd

PostgreSQL

Installation Instructions: https://www.postgresql.org/download/linux/ubuntu/

Create the file repository configuration:

sudo sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list'

Import the repository signing key:

wget --no-check-certificate -q -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -

Update the package lists:

sudo apt-get update

sudo apt-get -y install postgresql-16
Tune postgresql: https://pgtune.leopard.in.ua/

File to edit when tuning PG:

sudo nano /etc/postgresql/16/main/postgresql.conf

Starting (or stopping) postgres: ( stop | start | restart )

sudo pg_ctlcluster 16 main restart

Set password for user "postgres"

sudo -u postgres psql postgres
\password postgres ( enter desired password when prompted )
\q (to exit the posgreSQL command interface )

Edit pg_hba.conf to force password confirmation for postgres commands
Look for --- "Database administrative login by Unix domain socket", replace "peer" with "md5"

sudo nano /etc/postgresql/16/main/pg_hba.conf

Restart PG for changes to take effect:

sudo pg_ctlcluster 16 main restart

Create empty registry database:

sudo -u postgres psql postgres
CREATE database registry;
\q

Import CoCCA database from a backup:

psql -U postgres -d registry -f backup.sql


Java

Install Java JDK 1.8

sudo mkdir /usr/lib/jvm
cd /usr/lib/jvm
Direct from Adoptium https://adoptium.net
sudo wget --inet4-only https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u402-b06/OpenJDK8U-jdk_x64_linux_hotspot_8u402b06.tar.gz --no-check-certificate
Extract download
sudo tar -xvzf OpenJDK8U-jdk_x64_linux_hotspot_8u402b06.tar.gz

Append the following command to open the environment variables file.

sudo nano /etc/environment
JAVA_HOME="/usr/lib/jvm/jdk8u402-b06"

Run from command line.

sudo update-alternatives --install "/usr/bin/java" "java" "/usr/lib/jvm/jdk8u402-b06/bin/java" 0
sudo update-alternatives --install "/usr/bin/javac" "javac" "/usr/lib/jvm/jdk8u402-b06/bin/javac" 0
sudo update-alternatives --set java /usr/lib/jvm/jdk8u402-b06/bin/java
sudo update-alternatives --set javac /usr/lib/jvm/jdk8u402-b06/bin/javac

Check Version

java -version
sudo update-alternatives --config java
sudo update-alternatives --display java


OpenSSL

cd /usr/local/src/
sudo wget https://www.openssl.org/source/openssl-1.1.1w.tar.gz
sudo tar -xf openssl-1.1.1w.tar.gz
cd openssl-1.1.1w
sudo ./config --prefix=/usr/local/ssl --openssldir=/usr/local/ssl shared zlib
sudo make && sudo make install

sudo nano /etc/ld.so.conf.d/openssl-1.1.1w.conf
/usr/local/ssl/lib
save and exit
sudo ldconfig -v
sudo mv /usr/bin/c_rehash /usr/bin/c_rehash.backup
sudo mv /usr/bin/openssl /usr/bin/openssl.backup

sudo nano /etc/environment

Insert :/usr/local/ssl/bin at the end of the line - separate entries with a colon and wrap everything in a double-quote. Save file and exit nano.

source /etc/environment
echo $PATH
openssl version -a

Resin

The http server used with CoCCA https://caucho.com

Before installing resin, install OpenSSL and the JDK

Recomended : Create a host name for your instance with an A record to match the server IP

cd /opt
sudo wget --inet4-only http://caucho.com/download/resin-4.0.66.tar.gz --no-check-certificate
tar -vzxf resin-4.0.66.tar.gz
cd resin-4.0.66
./configure --enable-64bit --prefix=/opt/resin/ --with-resin-root=/opt/resin --with-resin-log=/opt/resin/log --with-resin-conf=/opt/resin/conf
sudo make && sudo make install

Post Install Configuration:
Download the CoCCA lab jks from CoCCA ( needed for EPP and https ).

cd /opt/resin/conf/keys/
sudo wget --inet4-only https://updates.coccaregistry.org/jks/epp_coccaregistry_org.jks --no-check-certificate

Download the latest CoCCA ROOT.war file

cd /opt/resin/webapps/
sudo wget --inet4-only https://updates.coccaregistry.org/ROOT.war --no-check-certificate

Get postgreSQL jdbc driver

cd /opt/resin/lib/
wget --inet4-only https://jdbc.postgresql.org/download/postgresql-42.7.1.jar --no-check-certificate

Rename default resin.xml and download resin config file for CoCCA:

cd /opt/resin/conf
mv resin.xml resin.backup
sudo wget --inet4-only https://updates.coccaregistry.org/resin/resin.xml --no-check-certificate

Edit resin config file:

  • replace default IPs with your server IPs ( line 28 and 42 )
  • replace default host registry.example.tld with your host name (line 75 and 83 ). Note: If you have not created an A record yet, you may put the server IP in place of the host name.
  • insert postgreql password you created in postgesql section above ( line 92 )
sudo nano /opt/resin/conf/resin.xml

Start ( or restart ) resin and login to portal. If restart does not work, try stop then start.

/etc/init.d/resin stop | start | restart

Go to your host name URL- https://registry.example.tld ( or https://ipaddress - will take ±15-20 seconds to load )


letsencrypt

Optional The CoCCA lab jks downloaded above will enable https connections but with a browser warning. If you want a free https certificate to match your host name, we suggest https://letsencrypt.org

sudo apt install certbot

Stop resin webserver to release port 80 and 443 temporarily.

/etc/init.d/resin stop

Request a new certificate

sudo certbot certonly --standalone

Create p12 (one long srting/command)

openssl pkcs12 -export -name sslcertificate -in /etc/letsencrypt/live/registry.example.tld/fullchain.pem -inkey /etc/letsencrypt/live/registry.example.tld/privkey.pem -out registry.example.tld.p12

Create Java keystore and import p12 (one long string/command):

/usr/lib/jvm/jdk8u402-b06/bin/keytool -importkeystore -destkeystore registry.example.tld.jks -srckeystore registry.example.tld.p12 -srcstoretype pkcs12 -alias sslcertificate

Move newly created jks to the resin keys folder

mv registry.example.tld.jks /opt/resin/conf/keys/registry.example.tld.jks

Edit resin config file to enable new http certificate:

sudo nano /opt/resin/conf/resin.xml

Add the path, jks file name and password for the custom jks created above (lines 45 & 46)

Start ( or restart ) resin and login to portal. If restart does not work, try stop then start.

/etc/init.d/resin stop | start | restart