Prerequisites - Updated July 2026
Ubuntu Server LTS 26.04.x (server install, basic - no GUI or other options), 16GB RAM, 120GB HDD
RDAP requires redis cache, SRS does not.
RDAP requires the rdap.properties tomcat config file - SRS does not.
The RDAP context.xml file references the rdap.proerties file - SRS context.xml does not.
The ngnix config files are different for RDAP and the SRS.
Changelog
Basics:
sudo apt update && sudo apt upgrade -y sudo apt install zip unzip sudo touch /etc/cloud/cloud-init.disabled sudo apt purge cloud-init -y sudo rm -Rf /etc/cloud sudo systemctl disable --now unattended-upgrades sudo apt remove unattended-upgrades sudo apt install whois sudo timedatectl set-timezone UTC sudo timedatectl set-ntp on sudo apt update && sudo apt upgrade -y sudo apt autoremove |
Basic Security
Ubunutu firewall basic configuration, handy commands:
- sudo ufw enable | disable
- sudo ufw status numbered ( see rules )
- sudo ufw delete X ( delete a rule by number )
- sudo ufw reload ( after rule changes )
|
sudo ufw allow from [trusted IP] to any port 22 ( if sshd is on non-standard port allow that port) SRS & RDAP sudo ufw allow from any to any port 80 sudo ufw allow from any to any port 443
SRS Only
sudo ufw allow from any to any port 700
sudo ufw allow from any to any port 53/udp |
Use fail2ban to protect against brute force/dictionary ssh attacks and mal-formed http requests. - tutorial
sudo apt install fail2ban |
Basic sshd refinements. (we recommend using ssh keys tutorial)
|
sudo nano /etc/ssh/sshd_config |
|
Protocol 2 Port XXX ( change port, config ufw to allow the selected port ) ListenAddress x.x.x.x ( if multiple IP, bind to one IP ) LogLevel VERBOSE AllowUsers user_1 user_2 ( list logins that are allowed to ssh ) LoginGraceTime 30 PermitRootLogin no MaxAuthTries 3 HostbasedAuthentication no IgnoreRhosts yes PermitEmptyPasswords no AllowTcpForwarding no X11Forwarding no ClientAliveInterval 300 ClientAliveCountMax 0 MaxStartups 2 |
sudo systemctl restart ssh |
PostgreSQL
Create the file repository configuration (replace "18" by the version you want).
sudo apt install -y postgresql-common sudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh sudo apt-get update sudo apt-get -y install postgresql-18 |
File to edit when tuning PG:
|
sudo nano /etc/postgresql/18/main/postgresql.conf |
Set password for user "postgres"
|
sudo -u postgres psql postgres \password postgres ( enter desired password when prompted ) \q (to exit the posgreSQL command interface ) |
Enable autoprewarm, in postgresql.conf set shared_preload_libraries = 'pg_prewarm' This parameter requires the server restart to take effect.
sudo nano /etc/postgresql/18/main/postgresql.conf |
Edit pg_hba.conf to force password confirmation for postgres commands Look for --- "Database administrative login by Unix domain socket", replace "peer" with "md5"
sudo nano /etc/postgresql/18/main/pg_hba.conf |
Restart PG for changes to take effect:
|
sudo pg_ctlcluster 18 main restart |
See Replication page to setup db replication between the registry and the rdap server.
https://cocca.org.nz/srs/replication.html
Import CoCCA database from a pg binary backup:
| pg_restore -U postgres -Fc -d registry < CoCCA-Backup.dump |
Java 25
Install Java JDK 25 LTS
sudo mkdir -p /usr/lib/jvm cd /usr/lib/jvm sudo wget --inet4-only https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25.0.3%2B9/OpenJDK25U-jdk_x64_linux_hotspot_25.0.3_9.tar.gz --no-check-certificate sudo tar -xvzf OpenJDK25U-jdk_x64_linux_hotspot_25.0.3_9.tar.gz |
Append the following command to open environment variables file.
sudo nano /etc/environment
JAVA_HOME="/usr/lib/jvm/jdk-25+36" |
Run from command line.
sudo update-alternatives --install "/usr/bin/java" "java" "/usr/lib/jvm/jdk-25.0.3+9/bin/java" 0 |
Check Version
java -version sudo update-alternatives --config java sudo update-alternatives --display java |
Tomcat 11
Install latest tomcat 11.x.x ( https://tomcat.apache.org/download-11.cgi )For security purposes, Tomcat should run under a separate, unprivileged user. Run the following command to create a user called tomcat:
sudo useradd -m -d /opt/tomcat -U -s /bin/false tomcat cd /tmp wget https://dlcdn.apache.org/tomcat/tomcat-11/v11.0.25/bin/apache-tomcat-11.0.25.tar.gz --no-check-certificate sudo tar xzvf apache-tomcat-11.0.25.tar.gz -C /opt/tomcat --strip-components=1 sudo chown -R tomcat:tomcat /opt/tomcat/ sudo chmod -R u+x /opt/tomcat/bin |
The systemd service that you will now create will keep Tomcat quietly running in the background. The systemd service will also restart Tomcat automatically in case of an error or failure.
|
sudo nano /etc/systemd/system/tomcat.service |
Paste the content bellow in the new tomcat.service file.
[Unit]
Description=Tomcat
After=network.target
[Service]
Type=forking
AmbientCapabilities=CAP_NET_BIND_SERVICE
User=tomcat
Group=tomcat
Environment="JAVA_HOME=/usr/lib/jvm/jdk-25.0.3+9"
Environment="JAVA_OPTS=-Djava.security.egd=file:///dev/urandom"
Environment="CATALINA_BASE=/opt/tomcat"
Environment="CATALINA_HOME=/opt/tomcat"
Environment="CATALINA_PID=/opt/tomcat/temp/tomcat.pid"
Environment="CATALINA_OPTS=-Xms1024M -Xmx2048M -server -XX:+UseParallelGC"
ExecStart=/opt/tomcat/bin/startup.sh - updated |
Run systemctl daemon-reload to reload units.
|
sudo systemctl stop tomcat
cd /opt/tomcat/webapps/
rm -fr ROOT
rm -fr docs |
cd /opt/tomcat/conf/ mv server.xml server.back mv context.xml context.back |
SRS
Download the default CoCCA tomcat config files. (server.xml & context.xml).
wget https://cocca.org.nz/srs/srs/server.xml wget https://cocca.org.nz/srs/srs/context.xml |
RDAP
Download the default CoCCA tomcat config files. (server.xml & context.xml).
wget https://cocca.org.nz/srs/rdap/server.xml wget https://cocca.org.nz/srs/rdap/context.xml |
Edit the context.xml file and update db name, username, password postgres IP & port
sudo nano /opt/tomcat/conf/context.xml |
To configure Tomcat to launch on reboot automatically, enable the service with:
sudo systemctl enable tomcat |
mkdir -p /opt/tomcat/rdap/ cd /opt/tomcat/rdap/ wget https://cocca.org.nz/srs/rdap/rdap.properties |
Edit the rdap.properties file and change host name.
Redis Cache 8
RDAP Server Only
sudo apt-get install lsb-release curl gpg curl -fsSL https://packages.redis.io/gpg | sudo gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpg sudo chmod 644 /usr/share/keyrings/redis-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/redis.list sudo apt-get update sudo apt-get install redis |
sudo systemctl enable redis-server sudo systemctl start redis-server |
After install, run this command to verify the installation:
|
redis-cli --scan --pattern 'WHOIS_DOMAIN_CACHE::*' | wc -l |
You should see 0. The above command shows how many domain records are currently cached in Redis.
Edit /opt/tomcat/rdap/rdap.properties add the following properties:
-
redis.whois.ttl-minutes=1440
# DataLoader behaviour
whois.dataloader.enabled=true
whois.dataloader.page-size=500
# Reload interval in ms (default 15 minutes); must be less than redis.whois.ttl-minutes
whois.dataloader.interval-ms=900000
During bootstrap, the system will populate Redis cache by querying data in Registry database. You can run this command to see how many domains cached so far: redis-cli --scan --pattern 'WHOIS_DOMAIN_CACHE::*' | wc -l
The system works by fetching all domain records from Registry database and load into Redis, and then refresh the full dataset every 15 mins by default.
Both API and port 43 query uses cached data by default. Full dataset refresh happens in backend, both API and port 43 continue to work during refresh.
letsencrypt
If you want to get started with a free https certificate to match your host name, we suggest https://letsencrypt.org
If using nginx as a reverse proxy it is not nessesary to use a jks. The SSL .pem certs can be in refferences in the nginx config file. In the recomended setup Tomcat listens on port 127.0.0.1:8080, the TLS is configured in nginx.
Using nginx as a reversr proxy is the recommnded configuration.
sudo apt install certbot sudo apt install python3-certbot-nginx |
Stop nginx webserver temporarily.
sudo systemctl stop nginx |
Request a new certificate
|
sudo certbot certonly --standalone |
Make note of the path and .pem files created by letsencrypt to add to the nginx config file.
Enable letsencrypt Auto-Renew, in root's crontab.
|
sudo crontab -u root -e |
17 50 21 * * /usr/bin/certbot --quiet renew --nginx |
NGINX proxy
sudo apt update sudo apt install nginx sudo apt install -y libnginx-mod-stream sudo useradd -m -d /opt/nginxuser -U -s /bin/false nginxuser |
|
If installing the SRS, download the default CoCCA SRS nginx config files (registry.nic.tld & nginx.conf). Go to your home directory sudo wget https://cocca.org.nz/srs/srs/registry.nic.tld --no-check-certificate sudo wget https://cocca.org.nz/srs/srs/nginx.conf --no-check-certificate |
|
If installing the RDAP server, download the default CoCCA RDAP nginx config files (rdap.nic.tld & nginx.conf). Go to your home directory sudo wget https://cocca.org.nz/srs/rdap/rdap.nic.tld --no-check-certificate sudo wget https://cocca.org.nz/srs/rdap/nginx.conf --no-check-certificate |
|
REGISTRY sudo systemctl stop nginx Edit registry.nic.tld and update the placholder host names, and pem file locations for SSL cp registry.nic.tld /etc/nginx/sites-available/registry.nic.tld |
sudo systemctl stop nginx rm -fr /etc/nginx/nginx.conf cp nginx.conf /etc/nginx/nginx.conf |
|
RDAP sudo systemctl stop nginx Edit rdap.nic.tld and update the placholder host names, and pem file locations for SSL cp rdap.nic.tld /etc/nginx/sites-available/rdap.nic.tld |
sudo systemctl stop nginx rm -fr /etc/nginx/nginx.conf mv nginx.conf /etc/nginx/nginx.conf |
Next, enable this configuration file by creating a link from it to the sites-enabled directory that Nginx reads at startup:
sudo ln -s /etc/nginx/sites-available/registry.nic.tld /etc/nginx/sites-enabled/ |
or for rdap
sudo ln -s /etc/nginx/sites-available/rdap.nic.tld /etc/nginx/sites-enabled/ |
NGINX uses the default linked configuration file. Creating a reverse proxy requires creating and linking a custom file. To avoid any potential conflicts, use the following command:
|
sudo unlink /etc/nginx/sites-enabled/default |
Test the Configuration
sudo nginx -t |
To configure NGINX to launch on reboot automatically, enable the service with:
|
sudo systemctl enable nginx |
Grant nginxuser Necessary Permissions
sudo chown -R nginxuser:nginxuser /var/log/nginx sudo chown -R nginxuser:nginxuser /var/lib/nginx |
sudo systemctl restart tomcat sudo systemctl restart nginx |
Check the process using the following command to ensure that Nginx is running with the non-root user.
|
>ps aux | grep nginx |
SRS-Notes
SRS Server Only
mkdir -p /opt/tomcat/srs/ mkdir -p /opt/tomcat/srs/epp-certs mkdir -p /opt/tomcat/srs/keys |
If upgrading from resin
cp /opt/resin/conf/keys/epp_coccaregistry_org.jks /opt/tomcat/srs/keys/epp_coccaregistry_org.jks cp /opt/resin/conf/keys/epp_ca.jks /opt/tomcat/srs/keys/epp_ca.jks cp /opt/resin/conf/cocca.key /opt/tomcat/srs/cocca.key |
|
sudo chown -R tomcat:tomcat /opt/tomcat/ |
|
Configure the SRS to use the EPP certs generated by Let's Encrypt. Create a directory for the EPP certificates and set the appropriate ownership: Because the files in /etc/letsencrypt/live are symlinks, you will need to create a script that copies the actual certificate files to the /opt/tomcat/srs/epp-certs Tomcat directory. Create a new script file: |
sudo nano /etc/letsencrypt/renewal-hooks/deploy/copy-epp-cert.sh |
#!/bin/sh set -e SRC=/etc/letsencrypt/live/"domain" DEST=/opt/tomcat/srs/epp-certs install -d -o tomcat -g tomcat -m 750 "$DEST" install -o tomcat -g tomcat -m 640 "$SRC/privkey.pem" "$DEST/privkey.pem" install -o tomcat -g tomcat -m 640 "$SRC/fullchain.pem" "$DEST/fullchain.pem" |
chmod 755 /etc/letsencrypt/renewal-hooks/deploy/copy-epp-cert.sh |
Intial copy of keys.
/etc/letsencrypt/renewal-hooks/deploy/copy-epp-cert.sh |
The above script will run every time the certificate is renewed, copying the new certificate files to the Tomcat directory. Make sure to replace "domain" with your actual registry domain name.
Once tomcat is loaded, go to Configuration > EPP and select "Use Let's Encrypt Certificate" as the EPP Server Certificate option.
Put
/opt/tomcat/srs/epp-certs |
in the :EPP Server Certificate Path" field.
Save the changes to take effect.
Tomcat is not running as the root user, so in order for the CoCCA SRS to write zone files, backups, escrow files and reload bind, certain folder permissions must be set. Adjust commands below to suit your install & file locations.
sudo chown -R root:tomcat /var/lib/bind/*
sudo chmod -R 775 /var/lib/bind/*
usermod -aG bind tomcat
chgrp bind /etc/bind/rndc.key
chmod 640 /etc/bind/rndc.key
systemctl restart tomcat
sudo -u tomcat rndc status # verify the permission change see if tomcat can run rndc command
chown -R tomcat:tomcat /opt/zones/ |
WHOIS p43
RDAP Server Only
OPTIONAL - By default CoCCA runs a whois server on port 4300 of the RDAP server. If you want to run a port 43 service you need to setup port forwarding in UFW.
Step 1 sudo nano /etc/ufw/sysctl.conf IPv4 - uncomment net/ipv4/ip_forward=1. IPv6 - uncomment net/ipv6/conf/all/forwarding=1 net/ipv6/conf/default/forwarding=1 Save and Exit |
Step 2 For IPv4 - sudo nano /etc/ufw/before.rules For IPv6 - sudo nano /etc/ufw/before6.rules Add a NAT table after the table that starts with *filter and ends with COMMIT, at bottom of the file.
# Start port 43 WHOIS NAT
*nat
:PREROUTING ACCEPT [0:0]
-A PREROUTING -p tcp --dport 43 -j REDIRECT --to-port 4300
COMMIT
# End port 43 WHOIS NAT
|
Infrastructure
WHMCS module
WHMCS v8+ required. Simplifed install and configuration, support for premium domains and DNSSEC.
- Support for WHMCS.
- cocca-whmcs-v9-2026-02-27.zip