Do's & Dont's for Debian 13 options before the Virtualmin install

SYSTEM INFORMATION
OS type and version Debian 13
Webmin version Latest
Virtualmin version Laest
Webserver version ?
Related packages web-server? Choose a Debian Blend for installation?

This graphic is one of the last things you see before Debian gets to work building the base OS on the bare metal.


(NOTE: the options for Debian desktop environment and ...GNOME are NOT! checked by default, but the place I stole this graphic from had them checked. :wink: )

I’ve been struggling for a while now (mostly based on my own bad decisions in the distant past) to get a old set of sites and databases to migrate to new metal, and the Virtualmin recommendation is to install a minimal OS prior to Virtualmin getting on top of that pony. Debian 13 only has the SSH server and standard system utilities checked by default, but that is SOOOOOOOO minimal that we even have to install the curl program to install the Virtualmin system.

I’m so sick of playing Guess-&-Test (aka: F.A.F.O.), yet think that Choose a Debian Blend for Installation would be a good idea.

Does anybody really know for sure what checkboxes to check & uncheck?

Tonight I felt like throwing plates at the walls after finding a brand new way to fail. I’d like to leave the Upside Down now.

This is my new metal’s Virtualmin page after a reboot because I couldn’t get a POSTFIX error message to go away that was a latent problem that came from a virtual server restore. :expressionless_face: :expressionless_face: :expressionless_face: :expressionless_face: :expressionless_face: :expressionless_face: :expressionless_face: :expressionless_face:

That error has nothing to do with Postfix.

That error means Virtualmin couldn’t get a certificate from Let’s Encrypt.

Your Debian installation also has nothing to do with the problem. A minimal installation (with ssh and either curl or wget) is all the Virtualmin installer needs (actually it doesn’t even need curl or wget, as it’ll install one if they’re both missing, but the easiest way to get the install script onto your server is with curl or wget, so it’s easiest to install one of them).

You’re making this into a big mystery involving everything you ever did on the server. It’s not a big mystery, it is one specific problem, with one specific solution.

So, please simplify and focus on the actual problem, not all the perfectly normal steps of installing your OS and Virtualmin; those things are not related to your problem. No amount of reinstalling will fix this problem. (If there’s a problem with Postfix, we can discuss it in another topic.)

What happens when you try to log into Virtualmin? (Port 10000 on your system.)

If that works, what happens when you try to get a certificate for that problem website? Read the actual error when Let’s Encrypt tries to validate domain ownership. It’ll be one of maybe three things: DNS, something sucking up requests to .well-known, or web server misconfiguration is causing the wrong site to be served when Let’s Encrypt tries to reach your server.

The actual error message will help determine which of those problems it is.

If you look carefully at the supplied screenshot the url ends in ā€˜:1’ as this is a reduced screen shot you could assume perhaps the OP is showing the connection to port 10000.

Ah, you’re right. I can’t see well enough to make that out without zooming in.

So, that just means the system hostname didn’t resolve during installation (so, the problem is DNS, one of the three problems that can cause Let’s Encrypt to fail to validate).

No big deal. Use a browser that let’s you log in to a system with a self-signed cert. I’m sure you can turn off whatever ā€œfeatureā€ is preventing it in Chrome, but if not, use Firefox just until you’ve issued a cert.

After a quick check on the domain names name servers it would appear that the OP is using cloudflare to handle dns. As I have never used cloudflare, I’m not sure if there some hoops to jump through in order for lets encrypt to work correctly, I seem to remember some threads about this some time ago

As a quick workaround, you can skip this screen by typing thisisnotsafe when it appears (not in any specific text box — just keep typing until it goes away).

It also looks like you’ve used this domain before in the same browser, and it’s on the HSTS list. Until you get a proper SSL certificate, you can access Webmin from another subdomain on the same system or use the IP address directly.

You could also try another browser or open an incognito tab to avoid HSTS preload on your domain. That way, the buttons at the end of the warning appear, and you can move to the login page with a click instead of typing the thisisunsafe phrase.

Lastly, the easiest fix, though, is to make sure delta.rupp.....com has a DNS record pointing to your new system’s IP before running Virtualmin install script.

Cloudflare for DNS has no effect.

But, Cloudflare proxying does prevent most types of validation. If using Cloudflare proxying, they’re the termination point for the TLS connection, and you have no control over it, so they handle the cert (but you still need a secure connection from them to your server, which can be their tunnel app or a TLS connection secured via Let’s Encrypt, but as noted, validation is tricky through the Cloudflare proxy).

Funny I never have a problem installing VM on a new dedicated or VPS server.

I just choose the OS flavour to install offered by my provider usually Hetzner these days, after the minimal install has completed, I get a root pwd, I change that as its required one time. Then I login to the server using winscp via ssh, and go to /etc/hostname file and change that to what I want s1.domain.com or whatever and save the file, I then usually reboot, once back up, as root I run the command as stated on this site …

sh -c "$(curl -fsSL https://download.virtualmin.com/virtualmin-install)" -- --bundle LAMP

And away it goes … installing everything you need, after installation you login as root via the https://ipaddress:10000 ignoring any browser warnings.

That is it.

Also as Ilia pointed out, before you create a virtual server make sure you have at least some basic DNS A records setup like www and * etc for the domain pointing to your server IP and that they have propagated. Then you will have no problems with Letsencrypt when you create the virtual servers for those domains.

I may be missing the point here, all seems rather complicated.

David

Okay firstly, I am sorry for being unclear. Secondly, I don’t have the appropriate amount of time to learn fully before doing because I work a full-time gig as a museum handyperson, and this computational delusion of grandeur I’m creating is more of a retirement project now. Retirement is only 2 years away.

In the OP, I trailed off into a rant about my bad luck because no one in my offline life would understand a word of the troubles I’m having.

I can open Virtualmin on that new machine by typing in its static IP address + :10000. I should have mentioned that. :flushed_face: I’m about to erase the new machine’s storage and start again, carrying with me all the memories of how I failed in different ways.

My real reason for this post is finding the definition for a minimal server.

I’ve been exclusively trying with Debian 13 due to many TB of storage, but I never change my pre-Virtualmin install choices of SSH server and standard system utilities.
I’m hoping somebody would say,
ā€œMike, you would do better if you also selected the web server and Choose a Debian Blend for Installation optionsā€, or
ā€œdon’t change that part of what you did so far.ā€

And now for some red herrings…

In this most recent buildout of the new server, I seemed to have things working okay. During a previous failure, I was trying to do a full import/restore of the Virtualmin servers and subservers from my old machine (that old machine is the one I shouldn’t have invited Captain Morgan to the distro upgrade party).

My restore option selections onto the new machine were thusly overwriting the freshly installed Virtualmin settings and other things with the badly working old server’s settings. I realized the error of my ways and made increasingly more restrictive backups of those virtual servers till I thought I had it squared away.

As I was putting new systems onto the new server, like a Nextcloud via the Manage web apps module, I started to see I still had cracks in my theory of migration.

In the past, I had POSTFIX send outgoing mail through the Mailgun service because I used to serve sites behind a DHCP internet connection and the DMZ setting on the router. All those weird settings I did to the old machines’ POSTFIX system got erroneously imported. I didn’t remember checking that box, but I do stupid stuff at times. I didn’t know about that POSTFIX misconfiguration till I was trying to triage Virtualmin warnings about missing SSL certs. I think the cert trouble stemmed from importing custom templates, then switching the virtual servers to different templates I created on the new machine. Anyway, after I got all the ssl complaints to go away, POSTFIX threw me one during the configuration check. I thought I fixed everything in it, but the same misconfiguration error persisted. I thought a reboot would solve it, but I was wrong.

Looking to the future, this next try, I’m going to manually build the virtual servers & subservers on the freshly installed new machine, remake all the email addresses by hand, then just reimport the home directories of the old server’s stuff.

Some takeaways I learned while in the chaos…

I have a fairly large & complex database with a lot of referential integrity, functions & procedures on the old servers. Trying to migrate either of the twins via sqldump, Virtualmin backup & restore, or PhpMyAdmin commands was taking ridiculous amounts of time and failing prior to finishing. Trying to put it on my slightly older Proliant DL360p G8 has been running for about 4 days or more now and hasn’t finished; nothing else is being run on that server right now.

The exact same database only took about half a day or less to import on this newest server before tossing me the error message about one very special table that seems to be what ruins all the imports. Except for that table and a few views, everything finished. Here’s the reason it went so fast:

/etc/mysql/mariadb.conf.d/50-server.cnf
#
key_buffer_size        = 128M
max_allowed_packet     = 1G
thread_stack           = 192K
log_error = /var/log/mysql/error.log
# Enable the slow query log to see queries with especially long duration
log_slow_query_file    = /var/log/mysql/mariadb-slow.log
log_slow_query_time    = 360
log_slow_verbosity     = query_plan,explain
log-queries-not-using-indexes
long_query_time = 36000
slow_query_log = 1
big-tables
myisam_sort_buffer_size = 64K
query_cache_size = 1G
sort_buffer_size = 1G
net_buffer_length = 500M
innodb_lock_wait_timeout = 3600
innodb_buffer_pool_size = 100G

I found that MariaDB info about how you can (depending on relative : absolute sizes of OS Memory Needs vs. total RAM) set the InnoDB to 80% of the available RAM.

With these settings I’m only dedicating about 50% of my RAM to MariaDB.
On that G8 server, I have way more RAM, but I never played with the default settings.

My big project has many complicated long-running operations, and I never knew I had the ā€œRuby Slippersā€ to make it go faster!

It does seem that MariaDB has improved a lot over the last decade and does cleanly import older MySQL databases. My old Nextcloud site had its data on a different machine because a decade ago, when I tried migrating from MySQL to MariaDB, it wouldn’t cross over in a way that Nextcloud would work again.

The database migration failures I’m presently having are caused by MySQL & MariaDB being incompatible with themselves. My failing import has this one table with 5 similar columns that look like this:

  `REDACTED` char(15) COLLATE utf8mb4_bin GENERATED ALWAYS AS (replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(`redacted-primary-key`,' pre ','p'),' pre','p'),' pref ','.PR'),' pref','.PR'),' prf ','p'),' prf','p'),' wrnt ','.WS.'),' wrnt','.WS'),' rts ','r'),' rts','r')) STORED COMMENT 'REDACTED.',

Each of those 5 columns has many dependent tables set to cascade on update, including delete. The table that doesn’t import is the root of a central tree in the ecosystem. I’m not sure how to replicate a system to test what happens if I change the columns to non GENERATE types. I should have done the text manipulations with triggers, :expressionless_face:
I’ve been maintaining two copies of this system for almost a decade: MySQL on one machine and MariaDB on another old machine.

I’ve tried adding that missing table by parts (structure only | data only) to the new server, but it refuses to create it due to all the referential integrity spider webs I made. I’ll either have to detangle that before migrating, or start making a better one from scratch and then import the data one table at a time.

P.S. Virtualmin is so robust and stable that it’s the only thing that saves me from myself. I’ve been impressed by it and promoting it for a very, very long time.

No one suggested/recommended that. Nothing is wrong with your system.

Virtualmin couldn’t get a TLS cert from Let’s Encrypt because your system hostname didn’t resolve (or was unreachable, maybe because it’s behind a Cloudflare proxy). That has nothing to do with the installation being wrong.

You can just log in (override the warnings, as has been explained) and request a new cert, once you have your system hostname resolving. Reinstalling will not make your system hostname resolve.

Or create a new domain in Virtualmin and get a cert for that.

It’s not that precise. But, from your description of your installation process, you got it just fine. You need ssh (of course), and it’s easiest to download the install script with curl or wget, so that’s useful to have. Everything else Virtualmin needs, Virtualmin installs.

Nothing is wrong with your installation.

Nope. Please make a new topic for new problems. This topic is about installation (and we can keep talking about the problem you have with the Let’s Encrypt cert for your system hostname, since that’s installation related). Everything else gets new topics.

https://forum.virtualmin.com/guidelines

I wasn’t having a topic for new problems. Just knew some of the most important people were already touching this thread, and thought it might be an interesting read.

One day Virtualmin might have a pro feature that supercharges the database settings for different use cases at the click of a button.

I will do the things I saw above, and will not change the OS choices if I do burn it down again.

I forgot to mention I specifically have the proxying options switched off for all my domains on Cloudflare. There is other DNS things to update though, like SSHFP and TLSA records .

Minor note: in addition to Debian 13 not having curl in the minimal install, it doesn’t have sudo either.
Not a big deal to after first login as root to do the apt install curl sudo

Also, this might be a Debian problem but it’s worth noting that after the base OS is on, SSH isn’t working nicely enough to ssh root@192.168.1.XXX into the server from another machine inside the network. The first part negotiates correctly, but it doesn’t take the password no matter how correctly it’s typed in. Console login at the server works fine.

If you provide a root password during install, then no. It assumes you want to use su to get root.

If you leave a blank password for root during install, root logins are disabled and sudo is installed.

It’s not a problem, most distros now have sshd configured in such a way to disallow root logins with password.
This is a good thing, as you should in any case just get your keys installed and disable password auth all-together :slight_smile:

SSH keys in some ways offer higher security. I have always used root and as just a normal dude who has never been server hacked, a good root pwd has served me well since 1995 also I change it out of habit frequently.

Also, the main software I use as a Windows Desktop user is winscp which is password protected to access , but I agree it is something I can remember and is different from server root access, but that no one could work out anyway. Also a great browser feature these days, which I did not like at first was the admin login key to access very sensitive info held on the home work station that I have and no where else.

Which I have to admit the pwd is ok but not brilliant, but I doubt anyone would guess it in a few years as its something in my head that means something to me in this very regard.

Also to even access my workstation they need a pwd PIn anyway.

Can of worms dude.

If someone targets you, gets in your home, what good is your ssh keys if access is not pwd protected?

I will probably recant a bit on this, but this is like a typical Genz & Millenial thought.

Gimme ./root every time.

Thank goodness I am retiring…

I am out of the mainstream stuff now.

David

Never had that in a distro, you mean a VPS. Vultr dosn’t but I have keys configured (during install) and cloud-int to disable ssh password logins.

I appreciate this chat… I have a Debian 11 I need to migrate to 13… and have been waiting until ā€œall the kinks were worked outā€ before taking the step… sounds like we’re close. (I do bare-metal side-by-side migrations)

This might be useless information, but just last night I realized that Debian does something slightly different from what Ubuntu did in the past. I haven’t done a fresh Ubuntu install in about 10 years, so my experience has that gap too.

On my normal dashboard of Virtualmin, I noticed my hostname was the hostname I gave during the Debian 13 install plus the domain name (given separately during the Debian install) instead of just the hostname:
was srv01.mysite.tld
expected srv01

I corrected it with Virtualmin, and a bunch of weird problems went away.

what would you expect, I guess you need to take closer attention when you are installing you chosen OS, whatever choices you make there could alter things. Why not install a virtualbox type instance o your home lab setup (I am assuming this install is done on a home lab) and do a clean install of whatever OS you choose or in fact create different instances in different virtualbox instances and then put your choosen OS on your bare metal

I don’t know if this is relevant, but on Cloudflare I have grassroots.land, outsourcedmath.com, ruppssites.com and wnymathguy.com. For some reason I put asterisk A records in the two %math% domains. Maybe because ā€œOā€ comes before ā€œRā€, Google thinks something fishy is happening because of *.outsourcedmath.com having the same IP address as the other domains on that server?


The latest I found was that it stemmed from my hurried, thoughtless actions during virtual server creation. See Problems after using the Cloudflare API token for DNS - #8 by WNYmathGuy for the step I did wrong.