OpenERP

I am trying to create a “template” virtual Ubuntu 12.04 server with OpenERP 7.0 pre-installed and ready to go. At the same time, the server should be secured. I have found the following guidelines on the internet:

How to secure an Ubuntu 12.04 LTS server – Part 1 The Basics

I have implemented all except the following points: 6, 8, 9 and 10 (no DNS and no Apache installed). This took a few hours, but was worthwhile effort as from now on it is “baked” into my template virtual machine that I can copy indefinitely. Here are all the steps I took:

1. Firewall installed and configured – ufw
2. Shared memory secured - fstab
3. SSH root login disabled and port changed
4. Protected su by limiting access only to admin group
5. Hardened network with sysctl settings
6. IP Spoofing prevented
7. DenyHosts and Fail2Ban installed – scan logs and ban suspicious hosts
8. PSAD intrusion detection installed
9. RKHunter and CHKRootKit check for rootkits installed
10. Nmap installed to scan open ports
11. LogWatch installed to enable analysis of system LOG files
12. Apparmor installed to bulletproof system
13. Tiger installed to audit system security

What do you think? Will this suffice? Any other comments?

Here are the steps to follow if you want to install OpenERP 7.0 on Ubuntu 12.0 LTS

Step 1: build your server (installing the bare minimum). You can obtain the software from the following page: Ubuntu Server download page.The installation instructions can be found on: Installing Ubuntu Server.

Step 2: install the openssh-server package and denyhost packages:

sudo apt-get install openssh-server denyhosts

Step 3: update your server software to the latest versions and patches:

sudo apt-get update
sudo apt-get dist-upgrade

Step 4: reboot your server and login via ssh

Step 5: create the OpenERP user:

sudo adduser --system --home=/opt/openerp --group openerp

“openerp” is defined as a “system” user i.e. there to own and run the application, but not with a personal user with a login. The home directory defined with this command is /opt/openerp. The OpenERP server will reside in this directory. You are free to define a different directory but this will also mean that some of the instructions below will need to be altered.

Step 6: install the database server PostgreSQL:

sudo apt-get install postgresql

Step 7: to change to the ‘postgres’ user and obtain superuser privileges

sudo su - postgres

Step 8: now it is time to create a new database user so OpenERP has the necessary access rights to connect to PostgreSQL and to create and drop databases. Remember the password which you chose as you will need it later on:

createuser --createdb --username postgres --no-createrole --no-superuser --pwprompt openerp
Enter password for new role: *********
Enter it again: *********

Step 9: when you are done, exit from the ‘postgres’ account:

exit

Step 10: install the required Python libraries on the server:

sudo apt-get install python-dateutil python-docutils python-feedparser python-gdata \
python-jinja2 python-ldap python-libxslt1 python-lxml python-mako python-mock python-openid \
python-psycopg2 python-psutil python-pybabel python-pychart python-pydot python-pyparsing \
python-reportlab python-simplejson python-tz python-unittest2 python-vatnumber python-vobject \
python-webdav python-werkzeug python-xlwt python-yaml python-zsi

Step 10: install the OpenERP server:

wget http://nightly.openerp.com/7.0/nightly/src/openerp-7.0-latest.tar.gz

Step 11: install and extract the code where we need it and then change ownership of all the files to the ‘openerp’ user:

cd /opt/openerp
sudo tar xvf ~/openerp-7.0-latest.tar.gz
sudo chown -R openerp: *

Step 12: copy the server directory to something with a standardized name so you never have to update your scripts

sudo cp -a openerp-7.0 server

Step 13: configure OpenERP

The default configuration file for the server is located in /opt/openerp/server/install/ and requires only minimal changes and a change of ownership and permissions:

sudo cp /opt/openerp/server/install/openerp-server.conf /etc/
sudo chown openerp: /etc/openerp-server.conf
sudo chmod 640 /etc/openerp-server.conf

Step 14: change/add the following lines in the openerp-server.conf file:

sudo nano /etc/openerp-server.conf

change the line that reads db_password = False to the same password you used in step8. Then add the following line to tell OpenERP where to write its log file:

logfile = /var/log/openerp/openerp-server.log

Step 15: save the file and start the server to check if it actually runs:

sudo su - openerp -s /bin/bash
/opt/openerp/server/openerp-server

Step 16: watch out for any warnings. If you do get any, you may need to update one of the Python libraries to a more recent version by doing the following and then trying again step 15 to see if there are no further errors:

exit (this exits the openerp user shell)
sudo apt-get install python-pip -> this downloads the Python package management system
sudo pip install name_of_package --upgrade -> substitute name_of_package by the name of the package that needs updating