Setting up Pure FTP server
1. download pureftpd website http://www.pureftpd.org/project/pure-ftpd/doc
http://download.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-1.0.21.tar.gz
2. compile i suggest you use "./configure --with-everything" to install all features
3. this ftp server have versatile auth methods (read the documention). but in my case i've use ftp authentiacation based on a independent password file.. below are the
steps.
a. create an "ftpgroup" group and an "ftpuser" user.
groupadd ftpgroup
useradd -g ftpgroup -d /dev/null -s /etc ftpuser
b. execute the following command to add the user
pure-pw useradd testaccount -u ftpuser -d /home/ftpusers/testaccount -N 200
where
user - testaccount
uid - ftpuser
chroot directory - /home/ftpusers/testaccount
disk quota - 200 MB
* this will create "/etc/pureftpd.passwd" by default
c. execute "pure-pw mkdb" to save the changes
* this will create "/etc/pureftpd.pdb"
* remember always execute this after changes made to password file
d. to check account info execute the following
pure-pw show testaccount
OUTPUT:
Login : testaccount
Password : $1$G5jGYrk0$n8vs/BsYv5a2cypCLMStm.
UID : 508 (ftpuser)
GID : 509 (ftpgroup)
Directory : /home/ftpusers/testaccount/./
Full name :
Download bandwidth : 0 Kb (unlimited)
Upload bandwidth : 0 Kb (unlimited)
Max files : 0 (unlimited)
Max size : 200 Mb (enabled)
Ratio : 0:0 (unlimited:unlimited)
Allowed local IPs :
Denied local IPs :
Allowed client IPs :
Denied client IPs :
Time restrictions : 0000-0000 (unlimited)
Max sim sessions : 0 (unlimited)
4. run pureftp server
/usr/local/sbin/pure-ftpd -j -lpuredb:/etc/pureftpd.pdb &
Documentation:
http://www.pureftpd.org/project/pure-ftpd/doc
Thursday, July 19, 2007
Sunday, May 06, 2007
LVM TUTORIAL BASICS
LVM TUTORIAL BASICS V 1.0 03/21/07
by derrick caluag
[root@intel-4 ~]# fdisk -l
Disk /dev/sda: 145.4 GB, 145492017152 bytes
255 heads, 63 sectors/track, 17688 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Device Boot Start End Blocks Id System
/dev/sda1 * 1 16 128488+ 83 Linux
/dev/sda2 17 1060 8385930 83 Linux
/dev/sda3 1061 1321 2096482+ 82 Linux swap
/dev/sda4 1322 17688 131467927+ 8e Linux LVM
INITIALIZATION
-- Create Physical Volume
pvcreate /dev/sda4
-- Create Volume Group
vgcreate VolG00 /dev/sda4
-- Create Logical Group (this will create 21G for LVhome)
lvcreate -L21000 VolG00 -n LVhome
-- Format the create Group with desired file system
mkfs.ext3 -b 4096 /dev/VolG00 / LVhome
-- Create Mount point on fstab
vi /etc/fstab
/dev/VolG00/LVhome /home ext3 defaults 1 2
-- Backup files on mountpoint
tar –zcvf /tmp/home.tgz /home
mv /home home2
mkdir home
-- Mount the partition
mount /dev/VolG00/LVhome
-- Untar the backup file back to the mount point
cd /home
cp /tmp/home.tgz
tar –zxvf home.tgz
EXTENDING LVM
-- Unmount partition
umount /dev/VolG00/LVhome
Extend
lvextend -L+1G /dev/VolG00/LVhome
add 1G to current size
or
lvextend -L12G /dev/VolG00/LVhome
extend size to 12G
-- Check extended
e2fsck -f /dev/VolG00/LVhome
-- Resize the
resize2fs /dev/VolG00/LVhome
-- Remount the partition
mount /dev/VolG00/LVhome
Thursday, March 15, 2007
Installing Perl Modules
This tutorial has been my guide now for quite a while... i hope you like it as much as i am.
CPAN
if you need to change server pls check this cool site below
CPAN SERVER SITES:
http://www.cpan.org/SITES.html
CPAN
The Comprehensive Perl Archive Network (CPAN) holds many Perl modules and scripts, distributed among a large number of mirrors. The CPAN module provides an interface to query and install modules from CPAN. These notes document the setup and usage of CPAN, with attention to common tasks and pitfalls along the way.
Any Perl modules used by a site should be archived locally. Doing so ensures the modules can be installed on new systems, even if removed from CPAN.
Use CPAN::Reporter to submit module test results. Try SmokeAuto to automate module testing.
Alternatives
Other means of installing perl modules from CPAN include the following, which are not discussed in detail here.
- CPANPLUS. “CPAN++ (also referred to and pronounced as CPANPLUS) is a new and flexible method of perl module management and installation using the CPAN. It aims to be a rewrite, and in time a replacement to the current CPAN module. In addition to fixing some long-standing problems, CPAN++ includes new features, such as module uninstall.”
- PAR - Cross-Platform Packaging and Deployment tool.
- Perl Package Manager (PPM) - Included with ActiveState Perl.
- Other. Some vendors make perl modules available via other methods, such as ActiveState’s PPM, the FreeBSD ports system, or similar package software. These offer tight integration with the system in question, but may include outdated modules or use different naming conventions and filesystem layouts.
For example, p5-libwww is the FreeBSD port of the module distribution libwww-perl on CPAN, and LWP::UserAgent a module found in that distribution. The following commands are equivalent means to install libwww-perl via the FreeBSD ports system, yum on RedHat systems, or the cpan command included with modern versions of CPAN.
# portinstall p5-libwww
# yum -y install perl-libwww-perl
# cpan -i LWP::UserAgent
To lookup the documentation for a module, use http://search.cpan.org/perldoc/Module::Name. The documentation should also show the distribution a module belongs to, for example Data::Dumper. Other search interfaces include the CPAN Search Site or the CPAN shell search features.
- Conversion scripts. cpan2rpm helps convert Perl modules into RedHat Package Manager (RPM) files. The resulting *.rpm packages can be installed via a local Yellowdog Updater, Modified (YUM) server. On Debian, try dh-make-perl --install --cpan Module::Name.
perl Upgrade Bug
The first time CPAN is invoked, it will run through a set of questions, such as which CPAN mirror site to use. Following the questions, CPAN may recommend that you install Bundle::CPAN or Bundle::libnet. Avoid installing these bundles!
Older versions of CPAN have a bug whereby a new version of perl itself may be installed. To avoid this bug, install the latest version of CPAN first. Setting the FTP_PASSIVE=1 environment variable avoids another common problem where active File Transfer Protocol (FTP) connections are blocked by a local firewall.
# perl -MCPAN -e '$ENV{FTP_PASSIVE} = 1; install CPAN'
If already in the CPAN shell following the preferences questions, use:
cpan> install CPAN
For reference, the bug is that Bundle::CPAN or Bundle::libnet may list Data::Dumper as a dependency. Data::Dumper is a built-in perl module, so when old versions of CPAN lookup Data::Dumper, they find a new version of perl to install. This bug has been fixed in current versions of CPAN.
Active FTP versus Firewalls
Network problems may prevent access to CPAN mirror sites. The chief problem will be utilities set to use active FTP, which most firewalls block. Persue Active FTP vs. Passive FTP, a Definitive Explanation for more details. I recommend enabling passive FTP by default, though this setting will need to be done for a variety of utilities CPAN might run, such as wget or Net::FTP. Alternatives include disabling the client firewall to allow active FTP connections back from the FTP server, or configuring a local FTP proxy.
Set the FTP_PASSIVE environment variable before running cpan.
# env FTP_PASSIVE=1 cpan -i Net::FTP
During the install of the libnet distribution, enable passive FTP.
…
Ah, I see you already have installed libnet before.
Do you want to modify/update your configuration (y|n) ? [no] y
…
Should all FTP connections be passive (y|n) ? [no] y
If Net::FTP is already installed, edit the libnet.cfg configuration file to use passive FTP.
$ perl -le 'for (@INC) { $_ .= "/".$ARGV[0]; print if -f }' Net/libnet.cfg
/usr/local/lib/perl5/5.8.1/Net/libnet.cfg
$ grep passive /usr/local/lib/perl5/5.8.1/Net/libnet.cfg
'ftp_int_passive' => 1,
If Net::FTP does not work, or certain utilities take too long to time out, consider the following options.
- Disable Net::FTP.
If Net::FTP does not work, try adding the following line to the CPAN/Config.pm preferences file. More information on dontload_hash posted to the perl.perl5.porters newsgroup. Also consider installing LWP::UserAgent, which is more capable than Net::FTP.
'dontload_hash' => { 'Net::FTP' => 1 },
- Disable utilities that do not work
To reconfigure CPAN to not call certain utilities, replace the path to the utility with a single space.
$ grep ncftp ~/.cpan/CPAN/MyConfig.pm
'ncftp' => q[ ],
'ncftpget' => q[ ],
Preferences Questions
CPAN will ask for preferences settings any time the Config.pm preferences file does not exist or is out of date. The default choice should be acceptable for most.
- CPAN build and cache directory? [/root/.cpan]
I use /var/spool/cpan, as the root filesystem tends to be small on my systems, and the spool area makes more sense to me.
- Policy on building prerequisites (follow, ask or ignore)? [ask]
Leave this setting set to ask when upgrading CPAN the first time, to prevent dependency lookups automatically installing the latest stable perl. With ask set, one can say no to queries that ask to install Bundle::CPAN, Bundle::libnet, or Data::Dumper until the latest version of CPAN is installed.
- Where is your * program? [*]
This series of questions lets one configure (or disable) paths to various utilities CPAN may use to download or unpack modules. It is safe to leave entries blank, as long as CPAN is left with at least one working program that can download modules and another to expand them.
To disable a particular utility, use a single space instead of a file path.
- Parameters for the 'make install' command?
Set this option to include UNINST=1 if installing as root. This properly cleans out files from older versions of a module being installed. For user-specific setup, I never set the UNINST option, to avoid remove warnings of unremovable system files.
- Now we need to know where your favorite CPAN sites are located.
Choose several CPAN mirror sites. Use traceroute or bandwidth testing tools to determine which mirrors are best for your system. Or, mirror CPAN to a local system.
The mirrors list may need to be updated periodically, if a previous mirror site stops hosting CPAN. Symptoms of this will be slow downloads as CPAN fails though the mirror list.
Reconfiguring CPAN
To alter the CPAN preferences, either edit the Config.pm configuration file manually, or use the following command in the CPAN shell.
cpan> o conf init
The init configuration option runs through all the configuration questions, which may be time consuming. For example, other o conf commands can be used to list, remove, and add mirror sites, and then to save the changes to disk.
cpan> o conf urllist
urllist
ftp://ftp.kernel.org/pub/CPAN/
Type 'o conf' to view configuration edit options
cpan> o conf urllist shift
cpan> o conf urllist push ftp://ftp-mirror.internap.com/pub/CPAN/
cpan> o conf urllist
urllist
ftp://ftp-mirror.internap.com/pub/CPAN/
Type 'o conf' to view configuration edit options
cpan> o conf commit
commit: wrote /usr/local/lib/perl5/5.6.1/CPAN/Config.pm
To manually edit the existing configuration file, either open the user-specific ~/.cpan/CPAN/MyConfig.pm directly, or locate the system-wide configuration file (stored somewhere under the perl @INC path list) to edit with the following command.
$ perl -le 'for (@INC) { $_ .= $ARGV[0]; print if -f }' /CPAN/Config.pm
/System/Library/Perl/CPAN/Config.pm
Usage Tips
Invocation | autobundle | Debugging | Old Modules | Mac OS X | Manual Build | sudo | Uninstalling | Upgrading
Once the latest version of CPAN has been properly installed, it is safe to install Bundle::CPAN to get the latest versions of modules CPAN depends on. If already in the CPAN shell, be sure to run reload cpan first.
cpan> reload cpan
…
cpan> install Bundle::CPAN
The following sections outline various uses and caveats with CPAN.
Invocation
The latest version of CPAN should install a cpan command somewhere on the system, which is easier to use than the traditional means of calling CPAN. With an up to date version of CPAN, the following sets of commands are equivalent. Hereafter, the shorter cpan method will be used.
# enter the CPAN shell
# perl -MCPAN -e shell
# cpan
# install the Acme::Bleach module
# perl -MCPAN -e install Acme::Bleach
# cpan -i Acme::Bleach
Depending on the shell in question, one may need to issue the hash -r or rehash command to make the new cpan command appear in the search path after the latest CPAN is installed. Consult your shell’s documentation for more information on whether this is required.
autobundle
The CPAN autobundle can be used to ease perl upgrades, by creating a special bundle containing all the installed modules of the current version of perl. This bundle can then be installed once the new version of perl is installed.
cpan> autobundle
…
Wrote bundle file
/var/spool/cpan/Bundle/Snapshot_2003_10_01_00.pm
cpan> quit
# upgrade perl here …
# cpan
cpan> install Bundle::Snapshot_2003_10_01_00
Autobundle appears to install the modules in alphabetical order; setting the prerequisites_policy policy to ask should help. Multiple install runs may be needed to install everything properly. Module build failures will lead to much recursion on the part of CPAN.
Debugging
Should tests fail during the make test phase of the module install process, the tests should be investigated to determine their impact. If the failed tests are not relevant to the system in question, the module can be installed with the force option. Otherwise, filing a bug report or otherwise contacting the module author may be in order.
- Force Install
To force install a module, use the force option.
cpan> force install HTML::Mason
- Verbose Testing
More verbose testing will need to be done from the command line. This can be done with the look command from the CPAN shell, along with subsequent shell code as shown in the following example for HTML::Mason, with verbose test logging saved to test.log via the tee(1) command.
cpan> install HTML::Mason
Running install for module HTML::Mason
Running make for D/DR/DROLSKY/HTML-Mason-1.23.tar.gz
…
t/02a-filter..........ok
t/04-misc.............FAILED tests 9-10
Failed 2/11 tests, 81.82% okay
t/05-request..........ok
…
Failed Test Stat Wstat Total Fail Failed List of Failed
---------------------------------------------------------------------------
t/04-misc.t 11 2 18.18% 9-10
2 tests skipped.
Failed 1/23 test scripts, 95.65% okay. 2/376 subtests failed, 99.47% okay.
*** Error code 35
Stop in /var/spool/cpan/build/HTML-Mason-1.23.
/usr/bin/make test -- NOT OK
Running make install
make test had returned bad status, won't install without force
cpan>
cpan> look HTML::Mason
Running look for module HTML::Mason
Trying to open a subshell in the build directory...
Working directory is /var/spool/cpan/build/HTML-Mason-1.23
# make test TEST_VERBOSE=1 TEST_FILE=t/04-misc.t | tee test.log
…
Determination as to whether the failed test is relevant to the system in question will need to be done by a human, typically by running of the test code and consulting the test script and module code to see what is failing. If the failed tests are for features of the module that will not be used, then the module typically can be installed and used without problems.
Old Modules
Some modules found by CPAN are out of date, and will not compile. An updated module may be available on CPAN, just not linked to as “current” by CPAN. Modules known to have this problem include the following. The links below should point to the current version of the modules.
Mac OS X
Problems with CPAN on Mac OS X.
Manual Build
On occasion one may need to manually build or test a module, or consult the module directory to read the documentation on any special needs the module may have. This can be done with the CPAN shell look command.
cpan> look Net::SSLeay
…
Working directory is /var/spool/cpan/build/Net_SSLeay.pm-1.25
# exit
cpan>
sudo
If CPAN is installed in your home directory, the system-wide cpan may cause problems when run via sudo(8), as by default sudo will invoke CPAN using the ~/.cpan/CPAN/MyConfig.pm configuration, but as root, which causes no end of trouble. To avoid this problem, reset the HOME environment variable with the -H option to sudo when invoking CPAN.
$ sudo -H cpan
Uninstalling
CPAN itself offers no uninstall method. Several of the alternatives to CPAN do, such as CPANPLUS or vendor package/port systems. If the module has been fully installed along with a .packlist file for the module, the ExtUtils::Packlist perl module documentation includes code for a modrm command to cleanly remove an installed module.
Modules built with other tools, such as Module::Build, may not write out a .packlist file for use by ExtUtils::Packlist.
Upgrading
How to upgrade all the modules on the system like apt-get is actually documented in the CPAN manual; however, the question comes up often enough that I answer it here as well.
# install everything that is outdated on my disk:
# perl -MCPAN -e 'CPAN::Shell->install(CPAN::Shell->r)'
Problems with this include new versions of modules that may break old module behavior, or various modules that cannot be upgraded due to build failures or system incompatibilities. Best to subject a test system to this sort of mass module upgrade before attempting it on a production system.
if you need to change server pls check this cool site below
CPAN SERVER SITES:
http://www.cpan.org/SITES.html
Wednesday, October 11, 2006
HOW TO SETUP DIAL-IN SERVER on LINUX
A lot of my friends have been asking me how to setup a dial-in server on a linux box.. As far as im an concern i was able to make this kind of setup on a debian os.. i've tried it on ubuntu on breezy and dappeldrake and it both went well.. only it requires you to have a modem preferably external or internal will also do and a dedicated line to be used by the dial-in users.. below are the steps that i followed:
Part I . The short version:D on how to get remote access to your Ubuntu box via modem. Install mgetty
sudo apt-get install mgetty
Add a line at the end of file /etc/inittab
S0:2345:respawn:/sbin/mgetty ttyS0
If your modem is on COM1.
Initialize init by typing
sudo init q
Now from Win you can use HyperTerminal to connect to your Ubuntu box with your user name/pass.
For those who want more here is a real deal;)
Part II
The problem: Establish PPP connection to Ubuntu server from a remote location using a modem and to share internet connection.
Laptop modem<> Server modem <> Ethernet Router <> Cable/DSL modem <> Internet
Assumptions: drivers for your modems already installed and modem is at ttyS0. I have an external modem attached to COM1 - ttyS0, COM2 will be ttyS1. I didn't have X installed so I was using nano to edit conf files, you can use gedit if you have X installed or any other editor. Make sure your are familiar with the interface of the editor before you start modifying files. Make sure you create backups of the files before you modify them. You will need to use sudo or login as root for most of the tasks. If you don't know how to configure your dial up on your client look for a dial up howto or Ubuntu docs. I also assume that you already have your local nework including routers properly configured and have an access to the Internet from your Ubuntu server.
Part II.a - Dial in configuration
1. If not already installed use synaptic or apt-get to install ppp and mgetty packages. ppp should be already installed by default so
sudo apt-get install mgetty
2. Create a group ppp by adding a line in file /etc/group ppp:x:1001:
3. Create a new user "pppuser" or whatever you will use for your dial in connection and assign a password by using
sudo adduser pppuser
edit file /etc/passwd or use sudo vipw to change entry for pppuser to pppuser:x:1001:1001:,,,:/home/pppuser:/usr/sbin/ppplogin
4. Add a line to the file /etc/inittab S0:2345:respawn:/sbin/mgetty ttyS0 for modem on ttyS0. Or S1:2345:respawn:/sbin/mgetty ttyS1 for modem on ttyS1 That will let mgetty to accept incoming calls
5.Make a new file /usr/sbin/ppplogin and add the following in there
#!/bin/sh
#/etc/ppp/ppplogin
# PPP login script
mesg n
stty -echo
exec /usr/sbin/pppd -detach modem debug crtscts
6. Set access to the ppplogin file and etc/ppp directory
chmod 750 /usr/sbin/ppplogin
chown root:ppp /usr/sbin/ppplogin
chmod 775 /etc/ppp
chown root:root -R /etc/ppp
7. Restart init by typing init q
If you're use external modem it should be on before that.
8. Open file /etc/mgetty/login.config Comment out everything in there and add a line
/AutoPPP/ - a_ppp /usr/sbin/pppd file /etc/ppp/options
9. Open file /etc/ppp/options and make sure these lines are uncommented. If anything else is uncommented it probably should be commented.
-detach
asyncmap 0
modem
crtscts
proxyarp
lock
require-pap
refuse-chap
ms-dns 192.168.1.1 #put your dns server ip here
usepeerdns
In my case the ms-dns entry had an ip of my router, if you using Linksys router it's 192.168.1.1 by default unless you changed it.
10. Create a file /etc/ppp/options.ttyS0 for the modem on ttyS0 and add following in there
192.168.1.3:192.168.1.201
noauth
Where first address is the address of your server for ppp connection which I think, should be different from your eth ip. The second address is the address that will be assigned to the client when connection is established. It will probably make life easier, unless you know what you doing, if all those addresses on the same subnet as your other computers on the network. (ip starts with the same 192.168.1.x numbers)
You can substitute noauth for a debug line, this way it will log some info about you connection in a syslog.
11. Edit file /etc/ppp/pap-secrets
find a line after # Every regular user can use PPP and has to use passwords from /etc/passwd
It should look something like that
* hostname "" *
substitute hostnatname with * so it looks like that
* * "" *
If you don't do that pap will not authenticate you and you'll be immediately disconnected.
Now you're able to connect using dial-up connection from you laptop or a remote office into your Ubuntu server and use ssh or putty if you're using Win.
Part II.b - Accessing internet from a remote client
I'm sure there other or better solutions to that, but that was easy enough and it worked for me.
sudo apt-get install ipmasq
Done. ipmasq automatically senses all your interfaces and initializes IP Masquerade forwarding/firewalling and allows you to connect to the rest of your network and the Internet.
Part I . The short version:D on how to get remote access to your Ubuntu box via modem. Install mgetty
sudo apt-get install mgetty
Add a line at the end of file /etc/inittab
S0:2345:respawn:/sbin/mgetty ttyS0
If your modem is on COM1.
Initialize init by typing
sudo init q
Now from Win you can use HyperTerminal to connect to your Ubuntu box with your user name/pass.
For those who want more here is a real deal;)
Part II
The problem: Establish PPP connection to Ubuntu server from a remote location using a modem and to share internet connection.
Laptop modem<> Server modem <> Ethernet Router <> Cable/DSL modem <> Internet
Assumptions: drivers for your modems already installed and modem is at ttyS0. I have an external modem attached to COM1 - ttyS0, COM2 will be ttyS1. I didn't have X installed so I was using nano to edit conf files, you can use gedit if you have X installed or any other editor. Make sure your are familiar with the interface of the editor before you start modifying files. Make sure you create backups of the files before you modify them. You will need to use sudo or login as root for most of the tasks. If you don't know how to configure your dial up on your client look for a dial up howto or Ubuntu docs. I also assume that you already have your local nework including routers properly configured and have an access to the Internet from your Ubuntu server.
Part II.a - Dial in configuration
1. If not already installed use synaptic or apt-get to install ppp and mgetty packages. ppp should be already installed by default so
sudo apt-get install mgetty
2. Create a group ppp by adding a line in file /etc/group ppp:x:1001:
3. Create a new user "pppuser" or whatever you will use for your dial in connection and assign a password by using
sudo adduser pppuser
edit file /etc/passwd or use sudo vipw to change entry for pppuser to pppuser:x:1001:1001:,,,:/home/pppuser:/usr/sbin/ppplogin
4. Add a line to the file /etc/inittab S0:2345:respawn:/sbin/mgetty ttyS0 for modem on ttyS0. Or S1:2345:respawn:/sbin/mgetty ttyS1 for modem on ttyS1 That will let mgetty to accept incoming calls
5.Make a new file /usr/sbin/ppplogin and add the following in there
#!/bin/sh
#/etc/ppp/ppplogin
# PPP login script
mesg n
stty -echo
exec /usr/sbin/pppd -detach modem debug crtscts
6. Set access to the ppplogin file and etc/ppp directory
chmod 750 /usr/sbin/ppplogin
chown root:ppp /usr/sbin/ppplogin
chmod 775 /etc/ppp
chown root:root -R /etc/ppp
7. Restart init by typing init q
If you're use external modem it should be on before that.
8. Open file /etc/mgetty/login.config Comment out everything in there and add a line
/AutoPPP/ - a_ppp /usr/sbin/pppd file /etc/ppp/options
9. Open file /etc/ppp/options and make sure these lines are uncommented. If anything else is uncommented it probably should be commented.
-detach
asyncmap 0
modem
crtscts
proxyarp
lock
require-pap
refuse-chap
ms-dns 192.168.1.1 #put your dns server ip here
usepeerdns
In my case the ms-dns entry had an ip of my router, if you using Linksys router it's 192.168.1.1 by default unless you changed it.
10. Create a file /etc/ppp/options.ttyS0 for the modem on ttyS0 and add following in there
192.168.1.3:192.168.1.201
noauth
Where first address is the address of your server for ppp connection which I think, should be different from your eth ip. The second address is the address that will be assigned to the client when connection is established. It will probably make life easier, unless you know what you doing, if all those addresses on the same subnet as your other computers on the network. (ip starts with the same 192.168.1.x numbers)
You can substitute noauth for a debug line, this way it will log some info about you connection in a syslog.
11. Edit file /etc/ppp/pap-secrets
find a line after # Every regular user can use PPP and has to use passwords from /etc/passwd
It should look something like that
* hostname "" *
substitute hostnatname with * so it looks like that
* * "" *
If you don't do that pap will not authenticate you and you'll be immediately disconnected.
Now you're able to connect using dial-up connection from you laptop or a remote office into your Ubuntu server and use ssh or putty if you're using Win.
Part II.b - Accessing internet from a remote client
I'm sure there other or better solutions to that, but that was easy enough and it worked for me.
sudo apt-get install ipmasq
Done. ipmasq automatically senses all your interfaces and initializes IP Masquerade forwarding/firewalling and allows you to connect to the rest of your network and the Internet.
Tuesday, June 27, 2006
SETTING TWO IP ADDRESS in ONE LAN card or NIC
SETTING TWO IP ADDRESS in ONE LAN card or NIC.
Two options either you add it at /etc/netword/interfaces or you set using ifconfig
1. TO set using IFCONFIG (temporary)
ifconfig eth1:1 netmask 255.255.255.0
2. TO add permanently
for debian flavors:
edit
/etc/network/interfaces
iface eth1:1 inet static
address
netmask
broadcast
gateway
Two options either you add it at /etc/netword/interfaces or you set using ifconfig
1. TO set using IFCONFIG (temporary)
ifconfig eth1:1
2. TO add permanently
for debian flavors:
edit
/etc/network/interfaces
iface eth1:1 inet static
address
netmask
broadcast
gateway
Wednesday, May 17, 2006
Adding Additional Hard drive on your Linux Machine
Normally one would ask? how do i add additional harddrive to my linux box.. well we could make use of utilities like fdisk, cfdisk or QtParted but it is fdisk that is im going to discuss below.
Why FDISK.. the answer is simple. since fdisk is the utility that i've been using eversince i've tried linux. :)
Here are the steps:
You must first be able to identify which partion is your new harddrive either though dmesg or using fdisk utility
# fdisk -l
The output will display the current harddrive informations and which device it is assigned to.
for scsi drive its normally /dev/sda while for IDE drive its /dev/hda
# fdisk /dev/hdc
Command (m for help): _
For a short manual we need to enter the 'm' command:
Command (m for help): m
Command action
a toggle a bootable flag
b edit bsd disklabel
c toggle the dos compatibility flag
d delete a partition
l list known partition types
m print this menu
n add a new partition
o create a new empty DOS partition table
p print the partition table
q quit without saving changes
s create a new empty Sun disklabel
t change a partition's system id
u change display/entry units
v verify the partition table
w write table to disk and exit
x extra functionality (experts only)
Command (m for help):
We need to know just few necessary commands: d,p,n,q,w. Don't be afraid to use them--all your changes will be done only in memory and will only be written to the hard after the 'w' command is entered. If we have an error, we just need to cancel all changes with the command 'q'.
First of all, let's make ourself sure that disk is empty:
Command (m for help): p
Disk /dev/hdc: 64 heads, 63 sectors, 787 cylinders
Units = cylinders of 4032 * 512 bytes
Device Boot Start End Blocks Id System
Command (m for help):
Often sellers of PCs and hardware will pre-divide disks into partitions. In such cases we can use command 'd' (described below) to delete everything what we do not need.
So, let's create a new parititon (with command 'n'), answering all the questions as we go:
Command (m for help): n
Command action
e extended
p primary partition (1-4)
Choosing the partition type-- primary or extended--we will enter P for primary.
In choosing number of the partition in this example, we will assign all of the all free space to one partition. Because this will be the first and only existing partition, we will assign the number 1:
Partition number (1-4): 1
When setting the number of the first cylinder of the partition, we can just use the default value, which is recorded when we just press Enter:
First cylinder (1-787, default 1):
Using default value 1
Setting the number of the last cylinder of the partition is easy in this example, since we are filling the entire drive with one partition. Again, just press Enter for the default (instead of the number of the cylinder, we can set size of partition in bytes, kbytes, or megabytes):
Last cylinder or +size or +sizeM or +sizeK (1-787, default 787):
Using default value 787
Command (m for help):
Now, partition is created. We can take a look of new table of partitions with the help of the 'p' command:
Command (m for help): p
Disk /dev/hdc: 64 heads, 63 sectors, 787 cylinders
Units = cylinders of 4032 * 512 bytes
Device Boot Start End Blocks Id System
/dev/hdc1 1 787 1586560+ 83 Linux
Command (m for help):
If we don't like (for some reason) the location or number of the partition, we can delete it using 'd' command:
Command (m for help): d
Partition number (1-4): 1
Command (m for help):
If you want to divide the disk into a few partitions, you will need to repeat all these operations a few times. One thing that is important to remember is that if the amount of partitions is greater than four, you'll need to create not primary, but an extended partition across the whole available disk space. Inside this partition you can create as many logical parts as needed.
Remember, please, that logical partitions always should be numbered from 5 upwards; it doesn't matter how many primary partitions were created before (one, three, or none at all).
After a partition has been made. you may want to format it using mkfs command. you could use mkfs.ext3 depending on what type of partiition that you desired.
mkfs.ext3 /dev/hdc1
After formating you may want to mount it to your linux box so that you could use it already
mount /dev/hdc1 /u01
or simply add it on your fstab so that you dont need to remount it everytime your system is restarted.
Monday, May 01, 2006
3-legged 'Transparent Proxy' firewall using IPFilter 4.1.8, Squid on Fedora Core 1
3-legged 'Transparent Proxy' firewall using IPFilter 4.1.8, Squid on Fedora Core 1
Date: Oct 8, 2005
by Jett Tayer <>
Download and install apt for Fedora Core 1
# cd /usr/local/src
# wget http://apt.sw.be/fedora/1/en/i386/dag/RPMS/apt-0.5.15cnc6-4.1.fc1.rf.i386.rpm
# wget http://apt.sw.be/fedora/1/en/i386/dag/RPMS/apt-devel-0.5.15cnc6-4.1.fc1.rf.i386.rpm
# rpm -ivh apt-0.5.15cnc6-4.1.fc1.rf.i386.rpm
# rpm -ivh apt-devel-0.5.15cnc6-4.1.fc1.rf.i386.rpm
Update your apt database
# apt-get update
Upgrade your packages
# apt-get upgrade
Upgrade the kernel
# apt-get install kernel#2.4.22-1.2199.nptl kernel-source#2.4.22-1.2199.nptl
Install some needed apps
# apt-get install patch rpm-build
Restart your machine and boot the newly installed kernel.
Download and extract the Squid package.
# apt-get install squid
Configure Squid to do 'transparent proxying'
# vi /etc/squid/squid.conf
You will need to make at least the following changes in /etc/squid/squid.conf
http_port 3128
http_access deny to_localhost
acl our_networks src 192.168.1.0/24 192.168.2.0/24
http_access allow our_networks
visible_hostname your.server.name.dom
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
Fire up Squid!
# service squid start
Install Bind 9: Provide caching DNS service to LAN only
# apt-get install bind bind-chroot
# service named start
Install IPFilter
Download and extract ipfilter software package
# wget http://coombs.anu.edu.au/~avalon/ip_fil4.1.8.tar.gz
# gzip -cd ip_fil4.1.8.tar.gz tar xvf -
# cd ip_fil4.1.8
Edit Makefile
# vi Makefile
look for the line,
LINUXKERNEL=/usr/src/linux
and change it to,
LINUXKERNEL=/usr/src/linux-2.4
Uncomment the following 3 lines
STATETOP_CFLAGS=-DSTATETOP
STATETOP_INC=
STATETOP_INC=-I/usr/local/include
and change the last line
STATETOP_INC=-I/usr/local/include
to
STATETOP_INC=-I/usr/include
Uncomment the following 2 lines
STATETOP_LIB=-lncurses
STATETOP_LIB=-L/usr/local/lib -lncurses
and change the last line
STATETOP_LIB=-L/usr/local/lib -lncurses
to
STATETOP_LIB=-L/usr/lib -lncurses
Next look for the line
POLICY=-DIPF_DEFAULT_PASS=FR_PASS
and change it to
POLICY=-DIPF_DEFAULT_PASS=FR_BLOCK
Save the file
# wq!
Compile IPFilter
# make linux
# make install-linux
Note:
There will be errors about ipfilter.o not being found.
Just copy ipfilter.o created in 'make-linux' command above in
/usr/src/redhat/BUILD/ipfilter/lib/modules/2.4.22-1.2199.nptl/kernel/net/ipv4/
then do a "make install-linux" again.
Still there will be errors, but don't worry because ipfilter RPM file will
be written in /usr/src/redhat/RPMS/i386. In that case just go directly
to the location of IPFilter RPM file and install it manually.
# cd /usr/src/redhat/RPMS/i386/
# rpm -ivh ipfilter-4.1.8-1.i386.rpm
IPFilter is now installed.
Config file (/etc/ipf.conf)
Here is my working ipf.conf for a 3-legged firewall
############################
### ipf.conf starts here ###
#
# $Linux ipf.conf 2005/07/17 16:15:55 tayer Exp $
#
# See /usr/share/ipfilter/examples for syntax and examples.
# eth0 is connected to the Internet with ip address 10.10.10.1 which is part of
# 10.10.10.0/24 network (not my real ip block of course!)
# eth1 is connected to the private subnet 192.168.1.0/24, 192.168.1.1 is the IP of eth1
# eth2 is connected to the private subnet 192.168.2.0/24, 192.168.2.1 is the IP of eth2
# Filtering:
block in all
block out all
block in quick on eth0 from 127.0.0.0/8 to any
block in quick on eth0 from 192.168.0.0/16 to any
block in quick on eth0 from 172.16.0.0/12 to any
block in quick on eth0 from 10.0.0.0/8 to any
block in quick on eth0 from 169.254.0.0/16 to any
block in quick on eth0 from 223.0.0.0/8 to any
block in quick on eth0 from 198.18.0.0/15 to any
block in quick on eth0 from 197.0.0.0/8 to any
block in quick on eth0 from 224.0.0.0/3 to any
block out quick on eth0 from any to 127.0.0.0/8
block out quick on eth0 from any to 192.168.0.0/16
block out quick on eth0 from any to 172.16.0.0/12
block out quick on eth0 from any to 10.0.0.0/8
block out quick on eth0 from any to 169.254.0.0/16
block out quick on eth0 from any to 223.0.0.0/8
block out quick on eth0 from any to 198.18.0.0/15
block out quick on eth0 from any to 197.0.0.0/8
block out quick on eth0 from any to 224.0.0.0/3
# What's these?? :)
block in log quick on eth0 from any to 10.10.10.0
block in log quick on eth0 from any to 10.10.10.255
block in log quick on eth0 from any to 255.255.255.255
##### Block a bunch of different nasty things. ############
# That I don"t want to see in the log
#
# Block frags
block in log quick on eth0 all with frags
# Block short tcp packets
block in log quick from any to any with ipopts
block in log quick all with short
# Block anything with special options
block in log quick all with ipopts
#
# Log packets with BOTH ssrr and lsrr set
log in all with opt lsrr,ssrr
# block source routed packets
block in log quick all with opt lsrr
block in log quick all with opt ssrr
# Block nmap OS fingerprint attempts
# Log first occurrence of these so I can get their IP address
block in log first quick on eth0 proto tcp from any to any flags FUP
# Block public pings
#block in log quick on eth0 proto icmp all
# Allow loopback packets freely
pass in quick on lo
pass out quick on lo
# Allow LAN packets freely
# allow freely packets from 192.168.1.0/24 LAN
pass in quick on eth1
pass out quick on eth1
# allow freely packets from 192.168.2.0/24 LAN
pass in quick on eth2
pass out quick on eth2
# Allow incoming data channel for outgoing connections, reject
# and log all incoming control connections
pass out quick on eth0 proto tcp from any to any port = 21 flags S keep state
# Allow SSH
pass in on eth0 proto tcp from any to eth0/32 port = 22 flags S/SA keep state
# Allow SMTP traffic
#pass in on eth0 proto tcp from any to eth0/32 port = 25 flags S/SA keep state
# Allow DNS traffic (tcp & axfr)
#pass in on eth0 proto tcp from any to eth0/32 port = 53 flags S/SA keep state
# Allow DNS traffic (udp)
#pass in on eth0 proto udp from any to eth0/32 port = 53 keep state
# Allow outside world to ping me (bad idea)
#pass in on eth0 proto icmp from any to any icmp-type 8 code 0 keep state keep frags
# Allow me to ping the outside world
pass out quick proto icmp from any to any icmp-type 8 code 0 keep state keep frags
# Allow all outgoing tcp traffic
pass out on eth0 proto tcp all flags S/SA keep state
# Allow all outgoing udp traffic
pass out on eth0 proto udp all keep state
#
### ipf.conf ends here ###
##########################
Config file (/etc/ipnat.conf)
Here is my working ipnat.conf for my 3-legged firewall
### ipnat.conf starts here ###
#
map eth0 192.168.1.0/24 -> 10.10.10.1/32 proxy port ftp ftp/tcp
map eth0 192.168.1.0/24 -> 10.10.10.1/32 portmap tcp/udp 40000:60000
map eth0 192.168.1.0/24 -> 10.10.10.1/32
map eth0 192.168.2.0/24 -> 10.10.10.1/32 proxy port ftp ftp/tcp
map eth0 192.168.2.0/24 -> 10.10.10.1/32 portmap tcp/udp 40000:60000
map eth0 192.168.2.0/24 -> 10.10.10.1/32
#
# Redirection is triggered for input packets.
# For example, to redirect FTP connections through this box, to the local ftp
# port, forcing them to connect through a proxy, you would use:
#
rdr eth0 0.0.0.0/0 port ftp -> 127.0.0.1 port ftp
#
# squid transparent proxy
rdr eth1 192.168.1.1/32 port 80 -> 192.168.1.1 port 80
rdr eth1 0.0.0.0/0 port 80 -> 192.168.1.1 port 3128
rdr eth1 192.168.2.1/32 port 80 -> 192.168.2.1 port 80
rdr eth1 0.0.0.0/0 port 80 -> 192.168.2.1 port 3128
#
### ipnat.conf ends here ###
Enable IP Forwarding:
Add this line in /etc/sysctl.conf if not already there
# echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
Re-read /etc/sysctl.conf
# sysctl -p
Fire up IPFilter
# service ipfilter start
IPFilter admin commands
Display a table of data detailing firewall performance,
including how many packets have been passed or blocked.
# ipfstat -hio
To flush and load ipfilter rules
# ipf -Fa -f /etc/ipf.conf
To flush and load ipnat rules
# ipnat -CF -f /etc/ipnat.conf
Date: Oct 8, 2005
by Jett Tayer <>
Download and install apt for Fedora Core 1
# cd /usr/local/src
# wget http://apt.sw.be/fedora/1/en/i386/dag/RPMS/apt-0.5.15cnc6-4.1.fc1.rf.i386.rpm
# wget http://apt.sw.be/fedora/1/en/i386/dag/RPMS/apt-devel-0.5.15cnc6-4.1.fc1.rf.i386.rpm
# rpm -ivh apt-0.5.15cnc6-4.1.fc1.rf.i386.rpm
# rpm -ivh apt-devel-0.5.15cnc6-4.1.fc1.rf.i386.rpm
Update your apt database
# apt-get update
Upgrade your packages
# apt-get upgrade
Upgrade the kernel
# apt-get install kernel#2.4.22-1.2199.nptl kernel-source#2.4.22-1.2199.nptl
Install some needed apps
# apt-get install patch rpm-build
Restart your machine and boot the newly installed kernel.
Download and extract the Squid package.
# apt-get install squid
Configure Squid to do 'transparent proxying'
# vi /etc/squid/squid.conf
You will need to make at least the following changes in /etc/squid/squid.conf
http_port 3128
http_access deny to_localhost
acl our_networks src 192.168.1.0/24 192.168.2.0/24
http_access allow our_networks
visible_hostname your.server.name.dom
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
Fire up Squid!
# service squid start
Install Bind 9: Provide caching DNS service to LAN only
# apt-get install bind bind-chroot
# service named start
Install IPFilter
Download and extract ipfilter software package
# wget http://coombs.anu.edu.au/~avalon/ip_fil4.1.8.tar.gz
# gzip -cd ip_fil4.1.8.tar.gz tar xvf -
# cd ip_fil4.1.8
Edit Makefile
# vi Makefile
look for the line,
LINUXKERNEL=/usr/src/linux
and change it to,
LINUXKERNEL=/usr/src/linux-2.4
Uncomment the following 3 lines
STATETOP_CFLAGS=-DSTATETOP
STATETOP_INC=
STATETOP_INC=-I/usr/local/include
and change the last line
STATETOP_INC=-I/usr/local/include
to
STATETOP_INC=-I/usr/include
Uncomment the following 2 lines
STATETOP_LIB=-lncurses
STATETOP_LIB=-L/usr/local/lib -lncurses
and change the last line
STATETOP_LIB=-L/usr/local/lib -lncurses
to
STATETOP_LIB=-L/usr/lib -lncurses
Next look for the line
POLICY=-DIPF_DEFAULT_PASS=FR_PASS
and change it to
POLICY=-DIPF_DEFAULT_PASS=FR_BLOCK
Save the file
# wq!
Compile IPFilter
# make linux
# make install-linux
Note:
There will be errors about ipfilter.o not being found.
Just copy ipfilter.o created in 'make-linux' command above in
/usr/src/redhat/BUILD/ipfilter/lib/modules/2.4.22-1.2199.nptl/kernel/net/ipv4/
then do a "make install-linux" again.
Still there will be errors, but don't worry because ipfilter RPM file will
be written in /usr/src/redhat/RPMS/i386. In that case just go directly
to the location of IPFilter RPM file and install it manually.
# cd /usr/src/redhat/RPMS/i386/
# rpm -ivh ipfilter-4.1.8-1.i386.rpm
IPFilter is now installed.
Config file (/etc/ipf.conf)
Here is my working ipf.conf for a 3-legged firewall
############################
### ipf.conf starts here ###
#
# $Linux ipf.conf 2005/07/17 16:15:55 tayer Exp $
#
# See /usr/share/ipfilter/examples for syntax and examples.
# eth0 is connected to the Internet with ip address 10.10.10.1 which is part of
# 10.10.10.0/24 network (not my real ip block of course!)
# eth1 is connected to the private subnet 192.168.1.0/24, 192.168.1.1 is the IP of eth1
# eth2 is connected to the private subnet 192.168.2.0/24, 192.168.2.1 is the IP of eth2
# Filtering:
block in all
block out all
block in quick on eth0 from 127.0.0.0/8 to any
block in quick on eth0 from 192.168.0.0/16 to any
block in quick on eth0 from 172.16.0.0/12 to any
block in quick on eth0 from 10.0.0.0/8 to any
block in quick on eth0 from 169.254.0.0/16 to any
block in quick on eth0 from 223.0.0.0/8 to any
block in quick on eth0 from 198.18.0.0/15 to any
block in quick on eth0 from 197.0.0.0/8 to any
block in quick on eth0 from 224.0.0.0/3 to any
block out quick on eth0 from any to 127.0.0.0/8
block out quick on eth0 from any to 192.168.0.0/16
block out quick on eth0 from any to 172.16.0.0/12
block out quick on eth0 from any to 10.0.0.0/8
block out quick on eth0 from any to 169.254.0.0/16
block out quick on eth0 from any to 223.0.0.0/8
block out quick on eth0 from any to 198.18.0.0/15
block out quick on eth0 from any to 197.0.0.0/8
block out quick on eth0 from any to 224.0.0.0/3
# What's these?? :)
block in log quick on eth0 from any to 10.10.10.0
block in log quick on eth0 from any to 10.10.10.255
block in log quick on eth0 from any to 255.255.255.255
##### Block a bunch of different nasty things. ############
# That I don"t want to see in the log
#
# Block frags
block in log quick on eth0 all with frags
# Block short tcp packets
block in log quick from any to any with ipopts
block in log quick all with short
# Block anything with special options
block in log quick all with ipopts
#
# Log packets with BOTH ssrr and lsrr set
log in all with opt lsrr,ssrr
# block source routed packets
block in log quick all with opt lsrr
block in log quick all with opt ssrr
# Block nmap OS fingerprint attempts
# Log first occurrence of these so I can get their IP address
block in log first quick on eth0 proto tcp from any to any flags FUP
# Block public pings
#block in log quick on eth0 proto icmp all
# Allow loopback packets freely
pass in quick on lo
pass out quick on lo
# Allow LAN packets freely
# allow freely packets from 192.168.1.0/24 LAN
pass in quick on eth1
pass out quick on eth1
# allow freely packets from 192.168.2.0/24 LAN
pass in quick on eth2
pass out quick on eth2
# Allow incoming data channel for outgoing connections, reject
# and log all incoming control connections
pass out quick on eth0 proto tcp from any to any port = 21 flags S keep state
# Allow SSH
pass in on eth0 proto tcp from any to eth0/32 port = 22 flags S/SA keep state
# Allow SMTP traffic
#pass in on eth0 proto tcp from any to eth0/32 port = 25 flags S/SA keep state
# Allow DNS traffic (tcp & axfr)
#pass in on eth0 proto tcp from any to eth0/32 port = 53 flags S/SA keep state
# Allow DNS traffic (udp)
#pass in on eth0 proto udp from any to eth0/32 port = 53 keep state
# Allow outside world to ping me (bad idea)
#pass in on eth0 proto icmp from any to any icmp-type 8 code 0 keep state keep frags
# Allow me to ping the outside world
pass out quick proto icmp from any to any icmp-type 8 code 0 keep state keep frags
# Allow all outgoing tcp traffic
pass out on eth0 proto tcp all flags S/SA keep state
# Allow all outgoing udp traffic
pass out on eth0 proto udp all keep state
#
### ipf.conf ends here ###
##########################
Config file (/etc/ipnat.conf)
Here is my working ipnat.conf for my 3-legged firewall
### ipnat.conf starts here ###
#
map eth0 192.168.1.0/24 -> 10.10.10.1/32 proxy port ftp ftp/tcp
map eth0 192.168.1.0/24 -> 10.10.10.1/32 portmap tcp/udp 40000:60000
map eth0 192.168.1.0/24 -> 10.10.10.1/32
map eth0 192.168.2.0/24 -> 10.10.10.1/32 proxy port ftp ftp/tcp
map eth0 192.168.2.0/24 -> 10.10.10.1/32 portmap tcp/udp 40000:60000
map eth0 192.168.2.0/24 -> 10.10.10.1/32
#
# Redirection is triggered for input packets.
# For example, to redirect FTP connections through this box, to the local ftp
# port, forcing them to connect through a proxy, you would use:
#
rdr eth0 0.0.0.0/0 port ftp -> 127.0.0.1 port ftp
#
# squid transparent proxy
rdr eth1 192.168.1.1/32 port 80 -> 192.168.1.1 port 80
rdr eth1 0.0.0.0/0 port 80 -> 192.168.1.1 port 3128
rdr eth1 192.168.2.1/32 port 80 -> 192.168.2.1 port 80
rdr eth1 0.0.0.0/0 port 80 -> 192.168.2.1 port 3128
#
### ipnat.conf ends here ###
Enable IP Forwarding:
Add this line in /etc/sysctl.conf if not already there
# echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
Re-read /etc/sysctl.conf
# sysctl -p
Fire up IPFilter
# service ipfilter start
IPFilter admin commands
Display a table of data detailing firewall performance,
including how many packets have been passed or blocked.
# ipfstat -hio
To flush and load ipfilter rules
# ipf -Fa -f /etc/ipf.conf
To flush and load ipnat rules
# ipnat -CF -f /etc/ipnat.conf
Subscribe to:
Posts (Atom)