## Introduction Traccar is a free and open-source Global Positioning System (GPS) tracking system that is capable of: * Tracking various types of GPS devices in real-time, * Sending alerts via the web, email, and Short Message Service (SMS) when abnormal conditions are detected, and * Providing detailed device location history, map routes, and reports as required. This tutorial explains how to set up a Traccar server on a Vultr Ubuntu 20.04 LTS server instance in a production environment. ## Prerequisites * A fresh Vultr Ubuntu 20.04 LTS server instance with at least 2GB of memory. Say its public IPv4 address is **203.0.113.100**. * A registered domain name for public access. Say it is **example.com**. ## 1. Setup DNS Records for Your Server To ease public access, you need to set up DNS records through your domain hosting service provider, pointing domain names (an apex domain name and one or more subdomain names) to the IPv4 address of your server. For example, if you are hosting the apex domain name **example.com** on Vultr, set up DNS records as follows to point **example.com** and **www.example.com** to the IPv4 address of your server in the **DNS** tab of the Vultr control panel: ### Entry #1 * Type: **A** * Name: [blank] * Data: **203.0.113.100** * TTL (seconds): **300** ### Entry #2 * Type: **A** * Name: **www** * Data: **203.0.113.100** * TTL (seconds): **300** ### Entry #3 * Type: **MX** * Name: [blank] * Data: **example.com** * TTL (seconds): **300** * Priority: **10** ### Entry #4 * Type: **NS** * Name: [blank] * Data: **ns1.vultr.com** * TTL (seconds): **300** ### Entry #5 * Type: **NS** * Name: [blank] * Data: **ns2.vultr.com** * TTL (seconds): **300** See detailed instructions on managing DNS through Vultr in this [Vultr tutorial](https://docs.vultr.com/introduction-to-vultr-dns). ## 2. Perform Basic Tasks on the Server Instance Log in to your server instance as **root** from an SSH terminal, and then perform basic tasks as follows to harden the system. Create a swap file: # fallocate -l 2g /swap # chmod 600 /swap # mkswap /swap # swapon /swap # echo '/swap none swap defaults 0 0' >> /etc/fstab # free -m Create a normal user named **traccar** with sudo privileges: # useradd -ms /bin/bash traccar # passwd traccar New pasword: Retype password: Passwd: password updated successfully # echo 'traccar ALL=(ALL) NOPASSWD: ALL' tee -a /etc/sudoers.d/designated # chmod 0440 /etc/sudoers.d/designated Set default firewall rules with UFW: # ufw default deny # ufw allow 22 # ufw enable Update and then restart the system: # apt update # apt upgrade -y # apt autoremove -y # shutdown -r now Having the server instance up and running again, log in as **traccar** from an SSH terminal for follow-on work. Be aware that the tasks mentioned above are for beginners only, and more security measures are at your discretion. ## 3. Install and Secure MariaDB 10.6 Traccar needs to work with a Database Management System (DBMS), such as MariaDB, MySQL, or PostgreSQL. Use commands listed below to install MariaDB 10.6, the current stable version of MariaDB, on the Ubuntu 20.04 LTS system: $ sudo apt-get install software-properties-common dirmngr apt-transport-https -y $ sudo apt-key adv --fetch-keys 'https://mariadb.org/mariadb_release_signing_key.asc' $ sudo add-apt-repository 'deb [arch=amd64,arm64,ppc64el,s390x] https://mirrors.xtom.com/mariadb/repo/10.6/ubuntu focal main' $ sudo apt update $ sudo apt install mariadb-server -y Start the MariaDB service: $ sudo systemctl start mariadb.service $ sudo systemctl enable mariadb.service Secure the installation of MariaDB: $ sudo mariadb-secure-installation In the wizard, answer prompted questions as follows: * Enter current password for root (enter for none): `:key_enter:` * Switch to unix_socket authentication [Y/n] `n:key_enter:` * Change the root password? [Y/n] `n:key_enter:` * Remove anonymous users? [Y/n] `y:key_enter:` * Disallow root login remotely? [Y/n] `y:key_enter:` * Remove test database and access to it? [Y/n] `y:key_enter:` * Reload privilege tables now? [Y/n] `y:key_enter:` ## 4. Create a Database and a Database User for Traccar Log in to the MariaDB shell as **root**: $ sudo mysql -u root In the MariaDB shell, create a database named **traccar** and a database user named **traccar** along with its password **YourPassword** for Traccar: MariaDB [(none)]> CREATE DATABASE traccar CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci; MariaDB [(none)]> CREATE USER 'traccar'@'localhost' IDENTIFIED BY 'YourPassword'; MariaDB [(none)]> GRANT ALL PRIVILEGES ON traccar.* TO 'traccar'@'localhost' IDENTIFIED BY 'YourPassword' WITH GRANT OPTION; MariaDB [(none)]> FLUSH PRIVILEGES; MariaDB [(none)]> EXIT; ## 5. Install Traccar 4.14 Download Traccar 4.14, the latest stable release of Traccar for now: $ cd $ wget https://github.com/traccar/traccar/releases/download/v4.14/traccar-linux-64-4.14.zip Unzip the Traccar archive: $ sudo apt install unzip -y $ unzip traccar-linux-64-4.14.zip Install Traccar: $ sudo ./traccar.run Use the database credentials (database: **traccar**, database user: **traccar**, database password: **YourPassword**) you setup earlier to update the Traccar configuration file: $ cat < ./conf/default.xml com.mysql.jdbc.Driver jdbc:mysql://localhost/traccar?serverTimezone=UTC&useSSL=false&allowMultiQueries=true&autoReconnect=true&useUnicode=yes&characterEncoding=UTF-8&sessionVariables=sql_mode='' traccar YourPassword EOF To avoid running the Traccar service as **root**, which is an unsafe operation in production, change the owner of the Traccar service as follows: $ sudo mkdir /etc/systemd/system/traccar.service.d/ $ cat </dev/null Verify the signing key within the downloaded file: $ gpg --dry-run --quiet --import --import-options import-show /usr/share/keyrings/nginx-archive-keyring.gpg The output should include this fingerprint: **573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62**. If it prints a different value, remove the downloaded file **/usr/share/keyrings/nginx-archive-keyring.gpg** and then re-run the above importing command. Setup the apt repository for stable Nginx packages: $ echo "deb [signed-by=/usr/share/keyrings/nginx-archive-keyring.gpg] \ http://nginx.org/packages/ubuntu `lsb_release -cs` nginx" \ sudo tee /etc/apt/sources.list.d/nginx.list Setup repository pinning to avoid installing distribution-provided Nginx packages: $ echo -e "Package: *\nPin: origin nginx.org\nPin: release o=nginx\nPin-Priority: 900\n" \ sudo tee /etc/apt/preferences.d/99nginx Install the latest stable version of Nginx, which is Nginx 1.20.2 for now: $ sudo apt update $ sudo apt install nginx Confirm the installation and learn about installation details: $ nginx -V Start the Nginx service: $ sudo systemctl start nginx.service $ sudo systemctl enable nginx.service Change firewall rules to allow HTTP traffic on port **80** and HTTPS traffic on port **443**: $ sudo ufw allow 80 $ sudo ufw allow 443 Disallow direct access on port **8082**: $ sudo ufw delete allow 8082 ## 7. Get Free Let's Encrypt TLS Certificates In a production environment, valid TLS certificates are indispensable for enabling HTTPS access to the website. Follow the instructions listed below to get free Let's Encrypt TLS certificates for **example.com** and **www.example.com** using the Certbot Automatic Certificate Management Environment (ACME) client. Update the pre-installed `snapd` program on Ubuntu 20.04 LTS: $ sudo snap install core; sudo snap refresh core To avoid conflicts, remove any existing Certbot programs installed using the system package manager or the **certbot-auto** script: $ sudo apt-get remove certbot $ sudo sed -i '/certbot-auto/d' /etc/crontab $ sudo rm -f /usr/local/bin/cert-bot $ sudo rm -rf /opt/eff.org Use `snapd` to install Certbot: $ sudo snap install --classic certbot Create a symbolic link in the **/usr/bin** directory to ease the use of the **certbot** command: $ sudo ln -s /snap/bin/certbot /usr/bin/certbot Get Let's Encrypt certificates for designated domain names using the Certbot program and its Nginx plugin: $ sudo certbot certonly --nginx In the Certbot program, reply to prompted questions as follows to get certificates for **example.com** and **www.example.com**: * Enter email address: `admin@example.com` * Do you agree to the terms of service? `y' * Would you be willing to share your email address with the Electronic Frontier Foundation? `n` * Please enter the domain name(s) you would like on your certificate (comma or space separated): `example.com www.example.com` The Certbot program has set up automatic certificate renewal by default to prevent Let's Encrypt TLS certificates from expiring in 90 days. Use commands listed below to confirm those renewals are accountable: $ sudo certbot renew --dry-run $ sudo systemctl list-timers grep snap.certbot.renew.service ## 8. Setup Nginx as a Reverse Proxy for Traccar Follow instructions in this section to setup Nginx as a reverse proxy for Traccar in a production environment, which is capable of: * Redirecting **example.com** and its non-www subdomains to **www.example.com**, * Redirecting HTTP to HTTPS, and * Disallow direct access to the server's IPv4 address **203.0.113.100**. Create directories to store Nginx server configuration files: $ sudo mkdir /etc/nginx/sites-available $ sudo mkdir /etc/nginx/sites-enabled Backup preset Nginx configuration files: $ sudo mv /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak $ sudo mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf.bak To increase SSL security, generate a 2048-bit Diffie-Hellman parameters file for Nginx: $ sudo openssl dhparam -out /etc/nginx/dhparam.pem 2048 Create the main Nginx configuration file: $ cat <

Articles in category: System Administration