Showing posts with label hardy. Show all posts
Showing posts with label hardy. Show all posts

Thursday, 14 October 2010

HOWTO: Syncing your /home with a server

Do you have a storage server where you keep your files? Do you think it would be a neat idea to keep a copy of your user files (home directory) on that storage in case your laptop or desktop suffers some sort of a catastrophe? Would you like an approximation of Windows roaming profiles?

If you answered yes to any of the above then read on! (However you should read the disclaimer at the end of this post.)

PLATFORM :
* Ubuntu (Tested with 10.04.1 Lucid but should work with any version)

PREREQUISITES :
* You must have passwordless SSH configured between the client and server users on the two hosts.
* rsync and openssh-server are installed on both hosts.

b) On the server;

The server part is pretty simple. First we will login as the root user;

sudo -i

We need a place to store the copies of the home folders. Create a folder;

mkdir -p /store/homes

Go back to the client;

Now assuming that we have keyless access to our server from the client we just need a script to do the syncing.

Create a script in /etc/init.d

root@hack:~# vi /etc/init.d/homesync
#!/bin/sh
### BEGIN INIT INFO
# Provides: homesync
# Required-Start: $remote_fs $syslog
# Required-Stop: $remote_fs $syslog
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# Short-Description: sync homes at startup and shutdown
# Description:
### END INIT INFO

MODE=$1
TARGET="root@zen:/store/homes/"
EXCLUDE="/root/excludes.rsync"

case $MODE in

start)
rsync -parv --inplace $TARGET /home/
;;

stop)
rsync -parv --inplace --exclude-from=$EXCLUDE --delete /home/ $TARGET
;;

esac

Note: Of course you need to change TARGET= to suit your own environment. Also, if your SSH server is listening on a non standard port you will need to modify the rsync command as per this post

Make the script executable;

chmod +x /etc/init.d/homesync

If you look carefully, you will notice that the script will refer to /root/excludes.rsync for any files or folders that it should avoid syncing. We should create that file;

touch /root/excludes.rsync

Now, there are no files on the server yet so we should do an initial sync.
WARNING: If this is not the first (ie primary) client that you are setting this up on then don't run the following command as is or else it will wipe out the "backup" that is already on the server. In such a case you need to replace the "stop" in the command with "start" in order to retrieve the primary files from the server instead.

Perform an initial sync;

/etc/init.d/homesync stop
Note: Depending on how much stuff you have in your user homes this may take some time. You should also ensure that you have enough space to fit everything!


OK, assuming everything is working, the final step is to make sure the homesync script executes when the system stops and start. We do that with the update-rc.d command;

sudo update-rc.d -f homesync defaults

That's it. You can test your setup by adding or altering a file in your home folder and then shutting down your system. If you check the server you should see your changes appear there after it shuts down. If you delete or alter the file again on the server the change should appear on the client after reboot.

If you want to exclude particular files or directories then you may list them in the exludes.rsync file we created earlier.

Here is a sample list;

Junk*
oops*
.pulse*
.cache*
tmp*
temp*
gvfs*
.gvfs*
.Trash*
Trash*
*~
Thumbs.db*
desktop.ini*
lost+found*


DISCLAIMER: Be very careful using this setup in a multiuser environment where there is more than one PC (in use) at any one time. If a user is logged in on more than one PC then it is possible that they could lose data. Be sure you understand the limitations of this system before proceeding down such a path. Also note that the script only executes at startup and shutdown so if the PC is rarely restarted then this system will be of little value. I recommend using it for a simple home network only. It is not flexible or robust enough for use in a corporate network. And one final note, this does not work if you connect to the server using a wifi connection due to the way Ubuntu connects and disconnects after the user logs in. Any script such as this one that runs at boot time will not be able to connect to the network in order to do the sync. In such scenarios you could consider using a cron job or syncing manually.

Friday, 12 March 2010

LDAP Client Howto (8.04 LTS)

This is where we configure our client to authenticate with our LDAP server.

PLATFORM: Ubuntu 8.04 LTS (Hardy)

We are going to set up a Hardy client on a server machine, which involves using NFS for mounting the user homes)

apt-get install libpam-ldap libnss-ldap nss-updatedb libnss-db nfs-common nscd ldap-utils

You will again be asked a bunch of questions, the answers are the same;

LDAP server Uniform Resource Identifier: ldap://ldap.example.com
Distinguished name of the search base: dc=example,dc=com
ldap://ldap.example.com 3
Make local root Database admin: Yes
Does the LDAP database require login? No
LDAP account for root: cn=admin,dc=example,dc=com
LDAP root password: password

Now we need to edit the following files;

vi /etc/ldap.conf and add this line;

bind_policy soft

vi /etc/ldap/ldap.conf

BASE dc=example,dc=com
URI ldap://ldap.example.com

SIZELIMIT 0
TIMELIMIT 0
DEREF never


vi /etc/pam.d/common-account

account sufficient pam_ldap.so
account required pam_unix.so

vi /etc/pam.d/common-auth

auth sufficient pam_ldap.so
auth required pam_unix.so nullok_secure use_first_pass

vi /etc/pam.d/common-password

password sufficient pam_ldap.so
password required pam_unix.so nullok obscure min=4 max=8 crypt

vi /etc/pam.d/common-session

session required pam_unix.so
session required pam_mkhomedir.so skel=/etc/skel/
session optional pam_ldap.so

vi /etc/nsswitch.conf

passwd: files ldap
group: files ldap
shadow: files ldap

hosts: files dns
networks: files

protocols: db files
services: db files
ethers: db files
rpc: db files


Now update nss to use ldap.

nss_updatedb ldap


If you get an error;
Failed to enumerate nameservice: No such file or directory

Check that your uri line in /etc/ldap.conf is correct.

You should now be able to check the server with;

ldapsearch -x

getent passwd

Mount a directory for users homes using NFS.

Create a mountpoint

mkdir /home/users

Add the following to /etc/fstab

servername:/home/users /home/users nfs defaults 0 0

You should now be able to login via ssh using the user "fred"s credentials

For Gnome Desktop users.

Assigning users to the correct groups at login

vi /etc/security/group.conf

gdm;*;*;Al0000-9000;floppy,audio,cdrom,video,plugdev,scanner


We need to override HALs behaviourl

vi /etc/dbus-1/system.d/hal.conf

Find and remove the following lines;

<deny send_interface="org.freedesktop.Hal.Device.Volume"/>
<deny send_interface="org.freedesktop.Hal.Device.Volume.Crypto"/>


We also need to tell pam to use the group.conf settings;

vi /etc/pam.d/gdm

Add this line;

auth optional pam_group.so


Reboot your PC and you should be able to login to gnome using ldap!

HOWTO: LDAP Server on 8.04 Hardy Heron

So, I've been playing around with LDAP and I have finally got it working. There are lots of howto's out there but none of them worked for me.

NOTE: For an up to date howto for 10.04 Lucid Lynx see this article

So, here we go!

PLATFORM:
* Ubuntu Server 8.04 LTS (Hardy)

PREREQUISITES:
* Working DNS with fqdn.
* An NFS server exporting the users home directorys

Network overview;
* domain name: example.com
* ldap-server ldap.example.com

Install The Packages

apt-get install slapd ldap-utils migrationtools

For some reason the install process doesn't ask you all of the necessary questions so when it is done we must reconfigure slapd.

dpkg-reconfigure slapd

It will ask you a bunch of questions

Omit OpenLDAP server configuration? No
DNS domain name: example.com
Name of your organization: Example Corp
Admin Password: password
Confirm Password: password
Database Type: HDB
Do you want your database to be removed when slapd is purged? ... No
Move old database? ... Yes
Allow LDAPv2 Protocol? ... No

Note: During this process, I will use "password" for simplicities sake. This is fine for setting up a test network for educational purposes but if you intend to use this in production then you should obviously choose a more appropriate password.

Oh, also, make sure you DONT FORGET IT! You will need it later.

You can now check if you can access your ldap server by typing:

ldapsearch -x -b dc=example,dc=com

Installing phpldapadmin

apt-get install phpldapadmin
ln -s /usr/share/phpldapadmin/ /var/www/phpldapadmin


Increase php memory limit

vi /etc/php5/apache2/php.ini

Find this line and change the memory limit to 64M;

memory_limit = 64M ; Maximum amount of memory a script may consume (16MB)

Restart apache;

/etc/init.d/apache2 restart

You can then browse to http://ldap.example.com/phpldapadmin

and login using admin:password

Once you have logged in, expand the tree & you should see something like this;

+--> dc=example,dc=com (1)
---> cn=admin
---> Create new entry here


Lets add some users and groups;

cd /usr/share/migrationtools/

We need to create the default migrationtools' config file "migrate_common.ph"

vi migrate_common.ph

and add the following parameters:

$DEFAULT_MAIL_DOMAIN = "example.com";
$DEFAULT_BASE = "dc=example,dc=com";


Create an ldif file with the details for our ou entries

vi ~/usergroup.ldif

dn: ou=users, dc=example, dc=com
ou: users
objectclass: organizationalUnit

dn: ou=groups, dc=example, dc=com
ou: groups
objectclass: organizationalUnit

Note: If you cut and paste from this guide, ensure that there are no whitespace chars at the end of the file.

Now that the user and group info is saved in your file, we can add it to the ldap server

ldapadd -x -W -D "cn=admin,dc=example,dc=com" -f ~/usergroup.ldif

Possible errors;
ldap_add: Invalid syntax (21)
additional info: objectclass: value #0 invalid per syntax


Probable cause;
If you copy/pasted the above then check for whitespace at the end of the users_group.ldif file. You will also need to remove the first entry (ou=users stanza) if it has already gone through before or you will get "already exists" and the script will halt before reaching the second entry

ldap_add: Server is unwilling to perform (53)
additional info: no global superior knowledge


Probable cause;
You have used incorrect domain details. Make sure the uri setting in /etc/ldap.conf is correct and that the server is pingable.

Now, if you hit "refresh" in the phpldapadmin gui, you should see your Users and Groups ou's are there.

Of course you could have added those ou's using the clickety-clickety gui as well but I just wanted to show how stuff can be added via command line. Yes, yes, I know, I'm a cruel bastard.

So now we want to add a new test user to the ldap tree using the phpldapadmin gui, but first we need to create a group called "users" in the Groups ou.

Click on the Groups ou and click "Create a child entry". Select "Posix Group".

Call the group "users" with Group ID 100. Click "Save Changes" when done.

Next, create a user in the Users ou with the following details;

User: fred
Group: users
Password: password
Encryption: crypt


Note: When I do this, the drop down box does not list /bin/bash as an option for loginShell. If you click "Save" you get a second screen where it is possible to alter the loginShell parameter to use /bin/bash. This is less of an issue if your users just use GDM. I use crypt instead of md5. You can use md5 if you prefer but remember to change the encryption type when setting up client hosts to match.

Well, assuming everything is working up to this point, the server is ready to authenticate your users.

Let's go on and set up a client on Hardy or Lucid

Friday, 25 September 2009

HOWTO: Setting up a vpn using ssh and pppd

For this we need two systems, one is designated as the server, the other the client. The server needs to have a static IP address or dynamic dns name from a free service such as https://www.dyndns.com/. Also, ensure that all firewalls are turned off or port 22 forwarding is enabled for both hosts.

Configuring the SSH accounts;

On the "server" machine;

Firstly, if you have not already installed ssh server do so now.
sudo apt-get install openssh-server

I use port 443 for VPN connections because this is usually the easiest port to get through a firewall that you don't control.

Edit your ssh server config;

sudo vi /etc/ssh/sshd_config

Change the line;

Port 22

to

Port 443

and restart your SSH server;

sudo /etc/init.d/ssh restart

Now, we create a user called "vpn";

sudo adduser --system --group vpn

The --system parameter sets vpn's shell to /bin/false but because the vpn user needs to log in via ssh, we must change this to /bin/bash in the /etc/passwd file.

sudo vi /etc/passwd

Here is an example;

vpn:x:110:110::/home/vpn:/bin/bash

The account password will only be used during this howto. You can choose a complex (secure) one now or a simpler temporary one and change it later.

Creating a password;

sudo passwd vpn

You should be able to login to the account from the client now;

ssh vpn@hostname

The next step is to create a ssh keypair for the root user on the client machine and place that public key in the vpn users authorized_keys file. Use this guide to configure passwordless ssh but remember to use the vpn user on the server instead of the root user as is shown in that guide.

Once you have passwordless SSH properly configured between root@client and vpn@server you should change the password to a more secure (random) one if you haven't already done so it will no longer be needed.


Time to set up the actual VPN.

Configuring the VPN;

The pppd daemon we will use needs to run as root, but we don't want to give our vpn user complete access to the system. To do that we configure sudo to give minimal access rights.

On the Server, open the visudo editor

visudo

Add these three lines to the end of the file

vpn ALL=NOPASSWD: /usr/sbin/pppd
vpn ALL=NOPASSWD: /sbin/iptables
vpn ALL=NOPASSWD: /sbin/route


This allows our vpn user to execute the pppd command to start the vpn and use the "route" command to set the return routes (if required).
If you are setting up a router<->router connection you will need to set the appropriate return routes to the client on the server.

To do this, create a script in the vpn user directory on the server.

vi /home/vpn/returnroutes.sh

Place the appropriate route commands to the subnet(s) at the clients end. If you don't want return routes then just don't enter any route commands. Here is mine;

#!/bin/sh
sudo route add -net 10.48.0.0/16 gw 192.168.0.1
sudo route add -net 10.0.0.0/16 gw 192.168.0.1


This script must be executable

chmod +x /home/vpn/returnroutes.sh

and owned by the vpn user

chown vpn:vpn /home/vpn/returnroutes.sh

We can also check that the pppd permissions are set up properly by logging in as the vpn user and issuing this command;

sudo /usr/sbin/pppd noauth

You should see a bunch of hieroglyphics such as this.

~�}#�!}!}!} }4}"}&} } } } }%}&����}'}"}(}"��~

You can kill the process from another terminal or just wait 30 secs or so for it to finish on its own.

Now we can configure the client (logged in as root)
Firstly, we need to use a script to connect to the server. You can locate the script anywhere you like, I put it in /usr/local/bin

You can download a copy of the connect script or simply
copy and paste this text into a file


#!/bin/sh
# SCRIPT: vpn-connect version 2.2
# LOCATION: /usr/local/bin/vpn-connect
# DESCRIPTION: This script initiates a ppp-ssh vpn connection.
# see the VPN PPP-SSH HOWTO on http://www.linuxdoc.org
# for more information.
# NOTES: This script uses port 443 so your VPN server should be
# configured to listen for ssh on Port 443
#
# revision history:
# 1.6 11-Nov-1996 miquels@cistron.nl
# 1.7 20-Dec-1999 bart@jukie.net
# 2.0 16-May-2001 bronson@trestle.com
# 2.2 27-Sep-2009 brettg@tuxnetworks.com
#
# You will need to change these variables...
#
# The host name or IP address of the SSH server that we are
# sending the connection request to:
SERVER_HOSTNAME=tuxnetworks.homelinux.net

# The username on the VPN server that will run the tunnel.
# For security reasons, this should NOT be root. (Any user
# that can use PPP can intitiate the connection on the client)
SERVER_USERNAME=vpn

# The VPN network interface on the server should use this address:
SERVER_IFIPADDR=192.168.3.2

# ...and on the client, this address:
CLIENT_IFIPADDR=192.168.3.1

# This tells ssh to use unprivileged high ports, even though it's
# running as root. This way, you don't have to punch custom holes
# through your firewall.
LOCAL_SSH_OPTS="-P"

PATH=/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin:/usr/bin/X11/:

## required commands...

PPPD=/usr/sbin/pppd
SSH=/usr/bin/ssh
RETURNROUTES=/home/vpn/zenroutes.sh

if ! test -f $PPPD ; then echo "can't find $PPPD"; exit 3; fi
if ! test -f $SSH ; then echo "can't find $SSH"; exit 4; fi

case "$1" in
start)
# echo -n "Starting vpn to $SERVER_HOSTNAME: "
${PPPD} updetach noauth passive pty "${SSH} -p 443 ${LOCAL_SSH_OPTS} ${SERVER_HOSTNAME} -l${SERVER_USERNAME} -o Batchmode=yes sudo ${PPPD} nodetach notty noauth" ipparam vpn ${CLIENT_IFIPADDR}:${SERVER_IFIPADDR}
${SSH} -p 443 ${SERVER_HOSTNAME} -l ${SERVER_USERNAME} ${RETURNROUTES}
route add -net 10.1.0.0 netmask 255.255.0.0 gw $SERVER_IFIPADDR
# route add -net 10.2.0.0 netmask 255.255.0.0 gw $SERVER_IFIPADDR
# route add -net 192.0.0.0/8 gw $SERVER_IFIPADDR
;;

stop)
# echo -n "Stopping vpn to $SERVER_HOSTNAME: "
PID=`ps ax | grep "${SSH} -p 443 ${LOCAL_SSH_OPTS} ${SERVER_HOSTNAME} -l${SERVER_USERNAME} -o" | grep -v ' passive ' | grep -v 'grep ' | awk '{print $1}'`
if [ "${PID}" != "" ]; then
kill $PID
echo "disconnected."
else
echo "Failed to find PID for the connection"
fi
;;

config)
echo "SERVER_HOSTNAME=$SERVER_HOSTNAME"
echo "SERVER_USERNAME=$SERVER_USERNAME"
echo "SERVER_IFIPADDR=$SERVER_IFIPADDR"
echo "CLIENT_IFIPADDR=$CLIENT_IFIPADDR"
;;

*)
echo "Usage: vpn {start|stop|config}"
exit 1
;;
esac
exit 0


You need to change the SERVER_HOSTNAME variable in the above script. You may also need to change SERVER_IFIPADDR and CLIENT_IFIPADDR depending on your existing network landscape.

Now we need to make the script executable

chmod +x /usr/local/bin/vpn-client

To start the vpn, at the client type

/usr/local/sbin/vpn-client start

You can check if it is up using the "ifconfig" command

ifconfig ppp0

Note: if you already have a ppp connection, such as to your ISP, then you may need to do "ifconfig ppp1". To see all your current ppp connections enter

ifconfig | grep ppp

If you want the vpn connection to be permanently up you can create a script to check the status and restart it if required.

vi /usr/local/sbin/vpn-check

Code;

#!/bin/sh
EMAIL=brettg@tuxnetworks.com
DAEMON=pppd

if [ "$(/bin/pidof $DAEMON)" = "" ]; then
/usr/local/sbin/vpn-client start
wait
if ! [ "$(/bin/pidof $DAEMON)" = "" ]; then
echo "VPN restarted $(date +%m-%d-%Y)"
fi
fi


Now, add an entry to the system crontab to run the script every minute

vi /etc/crontab

Add this line

* * * * * root /usr/local/sbin/vpn-check

Cron will automatically restart so we don't need to do that.

Now, assuming all has gone well if you issue the command

/usr/local/sbin/vpn-client stop

and wait for about a minute the vpn client should automatically reconnect!

Source:
http://www.faqs.org/docs/Linux-mini/ppp-ssh.html#AEN237

Wednesday, 23 September 2009

Graphing router traffic with MRTG

Systems tested; Ubuntu Hardy

Prerequisites
NET-SNMP configured on each target (Ubuntu,FreeBSD)

Install required packages
sudo apt-get install apache22 gcc make g++

Install MRTG
sudo apt-get install mrtg

Edit the mrtg configuration file
sudo vi  /etc/mrtg.cfg

# Global Settings

RunAsDaemon: yes
EnableIPv6: no
WorkDir: /var/www/mrtg
Options[_]: bits,growright
WriteExpires: Yes

Title[^]: Traffic Analysis for

Now we use cfgmaker to create a profile for each snmp target
sudo :q!cfgmaker public@targetname > /etc/mrtg.cfg

Finally, we create an index file for the webserver using indexmaker
sudo indexmaker /etc/mrtg.cfg > /var/www/mrtg/index.html

You can take a look at the graphs by pointing your browser to
http://10.100.1.198/mrtg/


Sources:
http://www.debianadmin.com/mrtg-installation-and-configuration-in-debian-based-distributions-2.

Friday, 11 September 2009

Installing Request Tracker in Hardy LTS

Tested in Ubuntu Server 8.04 LTS

Pre-requisites:
Your system should be able to send and receive email
You should have the universe repo enabled in /etc/apt/sources.list

Installing the packages;
sudo apt-get install request-tracker3.6 rt3.6-apache2 \
rt3.6-clients mysql-server apache2

The mysql-server installer will ask you to create a root password during the package configuration process. Don't forget to jot it down!

Configuring Request Tracker;

The RT configuration file located at /etc/request-tracker3.6/RT_SiteConfig.pm
vi /etc/request-tracker3.6/RT_SiteConfig.pm

Make the appropriate changes to the config file for email address, domain, database and timezone for your particular network.

Add the following two lines to the database section.
Set($DatabaseHost , ‘localhost’);
Set($DatabaseRTHost , ‘localhost’);

Here is a sample config;
Set($rtname, 'support.example.com');
Set($Organization, 'example');

Set($CorrespondAddress , 'support@example.com');
Set($CommentAddress , 'comments@example.com');

Set($Timezone , 'Australia/Melbourne'); # obviously choose what suits you

# THE DATABASE:

Set($DatabaseType, 'mysql'); # e.g. Pg or mysql

# These are the settings we used above when creating the RT database,
# you MUST set these to what you chose in the section above.

Set($DatabaseUser , 'rtadmin');
Set($DatabasePassword , 'password');
Set($DatabaseName , 'rtdb');
Set($DatabaseHost , 'localhost');
Set($DatabaseRTHost , 'localhost');

# THE WEBSERVER:

Set($WebPath , "/rt");
Set($WebBaseURL , "http://support");

1;

Configure the database

Log in to the db (you did write down the root password, right?)
mysql -u root -p


Create a database user
GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,DROP,INDEX ON rtdb.* TO 'rtadmin'@'localhost' IDENTIFIED BY 'password';

Exit mysql
quit;

Configure the database;
sudo /usr/sbin/rt-setup-database-3.6 --action init --dba rtadmin --prompt-for-dba-password

This is what you should see;
Now creating a database for RT.
Creating mysql database rtdb.
Now populating database schema.
Creating database schema.
Done setting up database schema.
Now inserting database ACLs
Done setting up database ACLs.
Now inserting RT core system objects
Checking for existing system user...not found. This ap perlpears to be a new installation.
Creating system user...done.
Now inserting RT data
Creating Superuser ACL...done.
Creating groups...3.4.5.6.7.8.9.done.
Creating users...10.12.done.
Creating queues...1.2.done.
Creating ACL...2.3.done.
Creating ScripActions...1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.done.
Creating ScripConditions...1.2.3.4.5.6.7.8.9.10.done.
Creating templates...1.2.3.4.5.6.7.8.9.10.11.12.done.
Creating scrips...1.2.3.4.5.6.7.8.9.10.11.12.13.14.done.
Creating predefined searches...1.2.3.done.
Done setting up database content.

Enable the apache2 RewriteEngine
sudo ln -s /etc/apache2/mods-available/rewrite.load /etc/apache2/mods-enabled/

Enable the apache perl module
sudo a2enmod perl

Reload apache
sudo /etc/init.d/apache2 force-reload

The Request Tracker login screen can be found at;
http://servername/rt

Wednesday, 12 August 2009

HOWTO: Passwordless SSH using a public key

If you find yourself logging in to machines regularly or you want to include ssh commands in a script, for example using rsync to backup then you don't want to have to enter a password every time. In such cases you can use a public key.

The first thing we need to do is create a ssh key pair on the client host. Make sure that you login as the user who will be connecting to the server. In this case I am using the root user.
Warning: If your user already has a key pair then you should skip this step otherwise you may overwrite your existing key and potentially cause problems for other services that may already rely on them.

First, we should check whether there is already a keypair for our user;

ls -al ~/.ssh/
known_hosts


If there are files id_rsa and id_rsa.pub (or similar) listed then you already have a keypair and you should skip this step.

Creating an ssh key pair (press [enter] for each question asked);

ssh-keygen
Note: It is important that you don't enter a passphrase when asked to! If you did just run the command again, it will overwrite the key you just created.

You can check your new keys by looking in the .ssh folder

root@client:~# ls .ssh/
id_rsa id_rsa.pub known_hosts


The one we are interested in here is the public key which ends with .pub. We need to copy this file to /root on the server.
Note: You can do this via scp or copy it onto a thumbdrive or even type it in from a printout if you like! I will leave it up to you to decide the best method in your situation.

On the server, we will need to login as the root user;

Now, we should have the public key file that we copied earlier in our root directory. Let's double check that;

root@server:~# ls -al *.pub
-rw-r--r-- 1 root root 392 2010-08-02 08:22 id_rsa.pub


Great, it is there! We need to add this key to the root users authorized_keys file;

cat id_rsa.pub >> .ssh/authorized_keys

We can test that this worked by going back to our client PC and logging into the server via ssh;

root@client:~# ssh root@server
Linux server 2.6.32-25-generic-pae #44-Ubuntu SMP Fri Sep 17 21:57:48 UTC 2010 i686 GNU/Linux
Ubuntu 10.04.1 LTS

Welcome to Ubuntu!
* Documentation: https://help.ubuntu.com/
Last login: Thu Oct 14 15:38:57 2010 from client
root@server:~#


If it didn't ask you to enter a password then you are cooking with gas!

Monday, 18 May 2009

HOWTO: Using apt-cacher-ng to cache packages

If you have a lot of machines to manage, you don't want them all reaching out to the internet to retrieve updates and using up your precious bandwidth. What you want is a local machine that can keep copies of all the files that your machines download from the repositories so that the next machine that asks for the same file can just be given the copy that has already been downloaded. You could of course use squid, but squid is a less than perfect solution as it is not designed to ensure files are kept on hand until they are no longer needed.

apt-cacher-ng is a purpose built application that keeps track of all the packages that have been downloaded. If a client requests some-package.v123.deb it checks to see if it is already cached locally and if so it provides it to the client.

If the package has not previously been requested, it then downloads the package, provides it to the client, adds it to the cache and, here is the important part, deletes all older, outdated versions of that file!

It will keep cached files indefinitely, unlike squid which is designed to flush files if they remain unrequested for a predefined period.

So, to use apt-cacher-ng, your /etc/apt/sources file doesn't need to be modified or configured in any special way. Just leave it configured as you would normally (in my case these are the official aus repos with the source repos removed);

Example;

deb http://au.archive.ubuntu.com/ubuntu lucid main restricted
deb http://au.archive.ubuntu.com/ubuntu lucid-updates main restricted
deb http://au.archive.ubuntu.com/ubuntu lucid-backports main restricted
deb http://au.archive.ubuntu.com/ubuntu lucid-backports universe multiverse
deb http://au.archive.ubuntu.com/ubuntu lucid universe multiverse
deb http://au.archive.ubuntu.com/ubuntu lucid-updates universe multiverse
deb http://au.archive.ubuntu.com/ubuntu lucid-security main restricted
deb http://au.archive.ubuntu.com/ubuntu lucid-security universe multiverse


To install apt-cacher-ng, simply do;

sudo apt-get install apt-cacher-ng

And that is it, there is no further configuration needed!

For each client however, you do need to make a few small changes;

Create (or edit) the file /etc/apt/apt.conf and add the following line (substituting the IP address for the address of your server of course!)

Acquire::http { Proxy "http:10.1.1.1:3142"; };

If you use Synaptic, you also need to modify another file;

sudo vi /root/.synaptic/synaptic.conf

Add the following lines to the end but before the final brace (ie before the " }; ')

useProxy "1";
httpProxy "10.1.1.1";
httpProxyPort "3142";
ftpProxy "10.1.1.1";
ftpProxyPort "3142";
noProxy "";


For the changes to be applied you need to do an apt-get update;

sudo apt-get update

If this completes without error you are done! It is that easy.

Saturday, 26 July 2008

HOWTO: Mounting SSH directories

If you want to mount a directory on a remote PC then here is what you do.

Of course, to mount a folder via ssh the server must be running as a ssh server.

sudo apt-get install openssh-server

It is not necessary, but I strongly recommend that you set up passwordless ssh logins between the server and the client. The linked guide describes setting up SSH keys between two root users, so you do need to ensure that you configure things correctly for whatever pair of users you intend to use here.

From here on, all of the configuration we need to do is on the client.

1. Install SSHFS;

sudo apt-get install sshfs

2. Use the modprobe command to load fuse into the kernel;

sudo modprobe fuse

3. Set up the appropriate users & permissions;

sudo adduser username fuse
sudo chown root:fuse /dev/fuse
sudo chmod +x /bin/fusermount


If you've added yourself to the fuse user group, you need to logout and back in at this point.

To mount the home directory of "user";

sshfs user@host: mountpoint

Eg.

sshfs brett@server: ~/server_home

You can add a path after the colon.

Eg. to mount the "share" directory on the server (ie. /home/brett/share)

sshfs brett@server:/share ~/share

UPDATED: By default, only the user who has mounted the share has access to it. To allow access to root add the following option;

-o allow_root

For all users;

-o allow_other

To mount the share as read only;

-o ro

Eg. to mount the "share" directory on the server as read only and available to all users;

sshfs -o allow_other -o ro brett@server:/share ~/share

And that is all you need to do! Easy Peasy!