How to Setup Sandstorm Personal Cloud Server in Linux

Sandstorm is an Open Source self-hostable web productivity suite implemented as a security-hardened web app package manager. It is a radically easier way to run personal instances of your web application at one place. It allows you to have your own personal server to install multiple application on it through an app store interface as easily as you would install apps on a phone. Sandstorm keeps a list so you can find everything you create and its unified access control system covers data from every app, and everything is private to you by default. Find any app you want on the App Market and start using it with a few clicks. Every app comes with automatic updates. More than all it protects you, each document, chat room, mail box, notebook, blog, or anything else you create is a "grain" in Sandstorm. It containerizes each one in its own secure sandbox from which it cannot talk to the world without express permission. All your grains are private until you share them. The result is that 95% of security vulnerabilities are automatically mitigated.

Prerequisites

To make Sandstorm run on CentOS 7, we will be required to have systems with following competencies.

• Linux Kernel 3.10+
• User namespaces disabled

According to its basic software requirements, you can easily install it on RHEL-7 or CentOS 7 as both have the kernel versions greater than 3.10. Like the same way if you have to install it on Arch Linux, you can do so because of its kernels compiles with 'CONFIG_USER_NS=n'.

Other than software requirements, you can use 1GB+ of RAM but 2GB+ is recommended. Here in this article we will be using a CentOS 7.2 VM with 2GB RAM , 2 CPUs and 20 GB disk space.

How to update your system

Once you have access to the VM, create a non-root user with sudo privileges to perform all system level tasks. In CentOS 7 you create a new user with sudo rights using below commands.

$ ssh root@server_ip

# adduser new_user

Set your password for the new user, and then Use the 'usermod' command to add the user to the 'wheel' group.

# usermod -aG wheel new_user

Now using the 'su' command, switch to the new user account and run the command with sudo to update your system.

# su - new_user

# sudo yum update -y

After system update with latest updates and security patches, move to the next step to download and install the Sandstorm on CentOS 7.

How to install Sandstorm

This comes with its own installer that provides its automatic installation setup. To install on your own Linux machine, you just need to run below 'curl' command.

$ curl https://install.sandstorm.io | bash

Then You can have two options, and you need to choose the appropriate one, either you like to go for 1 or 2 .

1. A typical install, to use Sandstorm (press enter to accept this default)
2. A development server, for working on Sandstorm itself or localhost-based app development

Let's choose the option '1' and press Enter key to go for its default typical installation.

This complete installation setup with go through the following process.:

* Install Sandstorm in /opt/sandstorm
* Automatically keep Sandstorm up-to-date
* Configure auto-renewing HTTPS if you use a subdomain of sandcats.io
* Create a service user (sandstorm) that owns Sandstorm's files
* Configure Sandstorm to start on system boot (with systemd)
* Listen for inbound email on port 25.

To set up Sandstorm, we have to provide the sudo privileges, type 'yes' to allow sudo access to continue after its password.

Note that Sandstorm's storage will only be accessible to the group 'sandstorm'. As a Sandstorm user, you are invited to use a free Internet hostname as a subdomain of sandcats.io, a service operated by the Sandstorm development team. You can choose your desired Sandcats subdomain (alphanumeric, max 20 characters). Type the word 'none; to skip this step, or 'help' for help.

What *.sandcats.io subdomain would you like? [] linox

Next you need to mention your email on file so it help you recover your domain if you lose access.

Enter your email address: [] kashifs@linoxide.com

This register your domain, and you will be provided with a URL that users will enter in browser.

[http://linox.sandicats.io:6080]

Next Sandstorm requires you to set up a wildcard DNS entry pointing at the server. This allows Sandstorm to allocate new hosts on-the-fly for sandboxing purposes. Please enter a DNS hostname containing a '*' which maps to your server. For example, if you have mapped *.foo.example.com to your server, you could enter "*.foo.example.com". You can also specify that hosts should have a special prefix, like "ss-*.foo.example.com". Note that if your server's main page is served over SSL, the wildcard address must support SSL as well, which implies that you must have a wildcard certificate. For local-machine servers, we have mapped *.local.sandstorm.io to 127.0.0.1 for your convenience, so you can use "*.local.sandstorm.io" here. If you are serving off a non-standard port, you must include it here as well.

Wildcard host: [*.linox.sandicats.io:6080] *.linox.sandicats.io.com

Server installation is complete now, Visit the link mentioned in the end of the setup to start using it.

http://ksh-cen-7.domain.com:6080/setup/token/36d4f17a3804ba7e19cc159a844f3e45e7a726c5

As mentioned the URL expires in 15 minutes. You can generate a new setup URL by running below command.

$ sudo sandstorm admin-token

How to configure Sandstorm Web setup

Once you open the URL, you will see a welcome page to begin the admin settings and to configure your login system.

1) Identity providers

To use Sandstorm, you need to create a user account. Every user account on Sandstorm is backed by an identity provider. You'll use this identity provider to authenticate as the first administrator of this Sandstorm install.

Configure the identity provider or providers you wish to enable by a click on the 'configure' button.

Let's see if you want to enable Github on your Sandstorm, click on the configure button, a new window will be opened where you need to provide github login configurations. Once you got your Client ID and Client secret from your github account, click on the 'Enable' button to proceed.

2) Organization settings

Sandstorm allows you to define an organization. You can automatically apply some settings to all members of your organization. Users within the organization will automatically be able to log in, install apps, and create grains.

3) Email delivery

Sandstorm needs a way to send email. You can skip this step (unless you're using email login), but email-related features will be unavailable until you configure email in the future. Mention your SMTP host with Port and credentials.

4) Pre-installed apps

Here Sandstorm installs the following Productivity Suite apps that are useful for most users shown below. You will be able to configure all pre-installed apps in the Admin Settings panel after setup.

5) Create Admin account

Log with your google or Github account that you created in previous step to create your admin account.

That's it, now add more users, edit other settings or start user your awesome personal cloud platform.

Conclusion

In the end of this article, you are now able to install, configure and use your own personal cloud platform on CentOS 7. It aims to tackle the authentication and security problems that software-As-A-Service poses for many companies through the use of fine-grained containerization. Using Sandstorm now it's much easier than setting up yourself because you just to point and click, your click install and you have the app running. It takes like 5 seconds to spin up a container that help's you build your own applications within seconds.