---
# System prepended metadata

title: 'Lab 9: NGINX and NTP'

---

# Lab 9: NGINX and NTP
- Roman Soldatov B19-SD-01
- r.soldatov@innopolis.university

## Questions to answer

### 1. Configure static web page and generate ssl certificate

- Create a Directory for the website domain and configure permissions
    - `sudo mkdir -p /var/www/roman_domain.com/html`
    - `sudo chown -R $USER:$USER/var/www/roman_domain.com`
    - `sudo chmod -R 755 /var/www/roman_domain.com`

    ![](https://i.imgur.com/zwHlRz0.png)
    
- Configure static web page
    - `sudo nano /var/www/roman_domain.com/html/index.html`
    - ```html
        <html>
           <head>
              <title>Welcome to roman_domain.com!</title>
           </head>
           <body>
              <h1>Roman greets you. Great work!</h1>
           </body>
        </html>
       ```
    ![](https://i.imgur.com/jWrRQQJ.png)
    ![](https://i.imgur.com/NMfuFT2.png)

- Generate ssl certificate with a domain name `www.roman_domain.com` for 365 days. Keys will be stored in `/etc/nginx/ssl` directory.
    - `sudo mkdir /etc/nginx/ssl`
    - `sudo chmod 700 /etc/nginx/ssl`
    - `sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/www.roman_domain.com.key -out /etc/nginx/ssl/www.roman_domain.com.crt`
    ![](https://i.imgur.com/tYFdc4h.png)
    
- Сonfigure ssl certificate in the web server
    - `sudo nano /etc/nginx/sites-available/roman_domain.com`
    - Nginx Server Block Configuration
        ```
        server {
            listen 80;
            server_name roman_domain.com www.roman_domain.com;
            return 301 https://roman_domain.com$request_uri;
        }

        server  {
            listen 443 ssl;

            server_name roman_domain.com www.roman_domain.com;

            ssl_certificate     /etc/nginx/ssl/www.roman_domain.com.crt;
            ssl_certificate_key /etc/nginx/ssl/www.roman_domain.com.key;
            ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
            ssl_ciphers         HIGH:!aNULL:!MD5;

            root /var/www/roman_domain.com/html;
            index index.html index.htm;

            location / {
                try_files $uri $uri/ =404;
            }
        }
        ```
        
        > - Redirect from http to https:
        ```
        server {
            listen 80;
            server_name roman_domain.com www.roman_domain.com;
            return 301 https://roman_domain.com$request_uri;
        }
        ```
        > - Configuration of SSL
        ```
        ssl_certificate     /etc/nginx/ssl/www.roman_domain.com.crt;
        ssl_certificate_key /etc/nginx/ssl/www.roman_domain.com.key;
        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers         HIGH:!aNULL:!MD5;
        ```

        ![](https://i.imgur.com/bGA89UU.png)
        ![](https://i.imgur.com/UGCIdWe.png)
        
- Create Symbolic Link for Nginx to Read on Startup. So, the file in `sites-enabled` automatically changes if we modify `sites-available/roman_domain.com` file:
`sudo ln -s /etc/nginx/sites-available/roman_domain.com /etc/nginx/sites-enabled`
- Restart the Nginx Service and test the configuration
    - `sudo systemctl restart nginx`
    - `sudo nginx -t`

![](https://i.imgur.com/cPKnJXE.png)

- Modify the Hosts File
    - Check IP `hostname -i`
    - `sudo nano /etc/hosts`
    - Set an IP for the `roman_domain`
    ```
    127.0.0.1 localhost
    10.0.2.15 roman_domain.com www.roman_domain.com
    ```

![](https://i.imgur.com/FEmaANv.png)
![](https://i.imgur.com/ufztJhc.png)

- So, Firefox can see our self-signed certificate. The website opens using **https** connection. If we input **http** it will redirect us to the **https**. To disable warning about not trusted self-signed certificate, we can add the certificate to the trusted root CA store.
![](https://i.imgur.com/FeKmCJ5.png)
![](https://i.imgur.com/uIH01Go.png)
![](https://i.imgur.com/91wEppv.png)
![](https://i.imgur.com/4alLPow.png)


### 2. On the webserver confgire maximum file upload/download 1GB to site.

- Configure `nginx.conf` file: `sudo nano /etc/nginx/nginx.conf`
- Add file size limit `client_max_body_size 1024M;` in **http block**.

![](https://i.imgur.com/56gz3En.png)
![](https://i.imgur.com/E2uaRTZ.png)

- Apply changes: `sudo systemctl restart nginx`


### 3. Configure your machine synchronization with any NTP server which located in the United Kingdom.

- Check NTP server in the United Kingdom: [on this website](https://www.pool.ntp.org/zone/uk)
![](https://i.imgur.com/qznnwX8.png)

- Configure `ntp.conf` file: `sudo nano /etc/ntp.conf`
- Insert a pool zone to find the closest available server
```
server 0.uk.pool.ntp.org iburst
server 1.uk.pool.ntp.org iburst
server 2.uk.pool.ntp.org iburst
server 3.uk.pool.ntp.org iburst
```
    > Add `iburst` option to speed up the NTP time sync slightly
    
![](https://i.imgur.com/4uQPjHB.png)
![](https://i.imgur.com/PY9Hz49.png)

- Check a synchronization status: `ntpq -p`
![](https://i.imgur.com/ATLUzpS.png)
