Zoneminder on Minimal CentOS 7 Install

I have said Zoneminder is easy to install, hard to configure, lets go through that

Say you did a minimal install of CentOS 7 and you wanted to install Zoneminder on it, here are the minimal steps you need in order to get it working. Simply log in as root and paste the following script. I do have a couple of concerns with these steps, see below, but this will get you started.

Just the Script

#!/bin/bash
yum -y install mariadb mariadb-server mod_ssl php-mbstring php php-mysql httpd wget
yum -y install epel-release
wget https://download1.rpmfusion.org/free/el/rpmfusion-free-release-7.noarch.rpm
yum -y install rpmfusion-free-release-7.noarch.rpm
yum -y install zoneminder
setenforce 0
sed -i --follow-symlinks 's/^SELINUX=.*/SELINUX=disabled/g' /etc/sysconfig/selinux
systemctl start mariadb
mysql < /usr/share/zoneminder/db/zm_create.sql
mysql -e "GRANT ALL ON zm.* to 'zmuser'@localhost identified by 'zmpass';"
mysql -e "FLUSH PRIVILEGES;"
pushd /etc/httpd/conf.d
ln -s /etc/zm/www/zoneminder.httpd.conf
sed -i --follow-symlinks 's/;date.timezone =/date.timezone = America\/Los_Angeles/g' /etc/php.ini
popd
firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --add-port=443/tcp --permanent
firewall-cmd --reload
yum -y update
systemctl enable mariadb
systemctl enable httpd
systemctl enable zoneminder

Quick tip – If you are logged in on the console and need the IP address the command “ip a” will tell you what it is so you can remotely access it.

Detailed Explanation

The first line

#!/bin/bash

Is needed if you are pasting this into a script to run, it just defines the interpreter to use.

yum -y install mariadb mariadb-server mod_ssl php-mbstring php php-mysql httpd wget

This command installs some packages you need from CentOS itself

yum -y install epel-release

This command enables access to the EPEL third party repository

wget https://download1.rpmfusion.org/free/el/rpmfusion-free-release-7.noarch.rpm
yum -y install rpmfusion-free-release-7.noarch.rpm

These two commands downloads the rpm needed to enable the rpmfusion repository

yum -y install zoneminder

This command installs zoneminder packages

But we want you to get to a state where you can actually access Zoneminder, so read on

setenforce 0
sed -i --follow-symlinks 's/^SELINUX=.*/SELINUX=disabled/g' /etc/sysconfig/selinux

These the first of these two commands is needed to temporarily disables selinux by putting it in to permissive mode which can be problematic for Zoneminder, the second command changes /etc/sysconfig/selinux so that on reboot selinux is truly disabled.

systemctl start mariadb
mysql < /usr/share/zoneminder/db/zm_create.sql
mysql -e "GRANT ALL ON zm.* to 'zmuser'@localhost identified by 'zmpass';"
mysql -e "FLUSH PRIVILEGES;"

These series of commands starts the database server, creates the database and adds the default user “zmuser” with the default password “zmpass” that zoneminder is configured to use (see below regarding my concerns)

pushd /etc/httpd/conf.d
ln -s /etc/zm/www/zoneminder.httpd.conf
sed -i --follow-symlinks 's/;date.timezone =/date.timezone = America\/Los_Angeles/g' /etc/php.ini
popd

These commands configures apache to access zoneminder, the pushd command is similar to cd (Change Directory) but allows easy return to the current directory you were in when you run the popd command, the /etc/zm/www/zoneminder.httpd.conf is the config file for zoneminder in apache, you could cp (copy) the file, but an ln (Link) command may be more appropriate if zoneminder packages need to change it. The sed command is probably not needed anymore, but configures php to the Los Angeles Time Zone, I considered removing that command from this documentation, but leaving it in just in case.

firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --add-port=443/tcp --permanent
firewall-cmd --reload

CentOS has a host based firewall, these commands open up the http and https ports so your client can communicate with apache. Alternatively you can disable the firewall on reboot using the command systemctl disable firewalld

yum -y update

This command updates your box, not required but is recommended

systemctl enable mariadb
systemctl enable httpd
systemctl enable zoneminder

These three commands make sure the database, webserver, and zoneminder itself are started on reboot.

reboot

This reboots your ZM box, after which you can connect with a web browser using https://ipaddress/zm

Concerns

#1 Minimal Build/I did not fully test

I don’t usually just do a minimum install when I build a CentOS server, I do have a base linux install that I follow

Base Linux Install

So I did not fully test these install procedures. But they do seem to work and should work if you already have other things installed.

#2 Insecure Database

Notice I used the default zmuser account and password for the database. You really should create your own are at a minimum change the entries in /etc/zm/zm.conf to whatever you set it at.

Also run the mysql_secure_installation script to secure your database by doing things like set the root password, disallow remote root access, especially of you decide to disable the firewall.

#3 Certificate Error

Couple years ago I would not care if my web applications had a cert error like this one

But you really should have proper DNS and Certificates on your network. Here is an easy way to set up a Certificate Authority

Conclusion

These steps just gets you started, when you log in for the first time you will have to decide if you want to submit telemetry or not, and after that, the hard part comes up, configuring zoneminder, because there really is nothing there at this point.