Just a little Blog

Sering kali kita merasa disulitkan oleh banyaknya tanda pagar (#) pada file-file di linux, padahal yang akan belum tentu kita merasa perlu untuk membaca tulisan yang ada di belakang tanda tersebut.
Berikut cara simple untuk melihat suatu file konfigurasi pada linux tanpa menampilkan tanda pagar (#). Lewat command line interface, jalankan perintah berikut;

cat /lokasi/file/file.conf | sed '/ *#/d; /^ *$/d'

This guide explains how you can install and use KVM for creating and running virtual machines on an Ubuntu 8.10 server. I will show how to create image-based virtual machines and also virtual machines that use a logical volume (LVM). KVM is short for Kernel-based Virtual Machine and makes use of hardware virtualization, i.e., you need a CPU that supports hardware virtualization, e.g. Intel VT or AMD-V.

I do not issue any guarantee that this will work for you!

1 Preliminary Note

I'm using a machine with the hostname server1.example.com and the IP address 192.168.0.100 here as my KVM host.

Because we will run all the steps from this tutorial with root privileges, we can either prepend all commands in this tutorial with the string sudo, or we become root right now by typing

sudo su

2 Installing KVM And vmbuilder

First check if your CPU supports hardware virtualization - if this is the case, the command

egrep '(vmx|svm)' --color=always /proc/cpuinfo

should display something, e.g. like this:

root@server1:~# egrep '(vmx|svm)' --color=always /proc/cpuinfo
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext
fxsr_opt rdtscp lm 3dnowext 3dnow rep_good nopl pni cx16 lahf_lm cmp_legacy svm extapic cr8_legacy 3dnowprefetch
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext
fxsr_opt rdtscp lm 3dnowext 3dnow rep_good nopl pni cx16 lahf_lm cmp_legacy svm extapic cr8_legacy 3dnowprefetch
root@server1:~#

If nothing is displayed, then your processor doesn't support hardware virtualization, and you must stop here.

To install KVM and vmbuilder (a script to create Ubuntu-based virtual machines), we run

apt-get install ubuntu-virt-server python-vm-builder

Afterwards we must add the user as which we're currently logged in (root) to the group libvirtd:

adduser `id -un` libvirtd

You need to log out and log back in for the new group membership to take effect.

To check if KVM has successfully been installed, run

virsh -c qemu:///system list

It should display something like this:

root@server1:~# virsh -c qemu:///system list
Connecting to uri: qemu:///system
Id Name State
----------------------------------

root@server1:~#

If it displays an error instead, then something went wrong.

Next we need to set up a network bridge on our server so that our virtual machines can be accessed from other hosts as if they were physical systems in the network.

To do this, we install the package bridge-utils...

apt-get install bridge-utils

... and configure a bridge. Open /etc/network/interfaces:

vi /etc/network/interfaces

Before the modification, my file looks as follows

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
       address 192.168.0.100
       netmask 255.255.255.0
       network 192.168.0.0
       broadcast 192.168.0.255
       gateway 192.168.0.1

I change it so that it looks like this:

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet manual

auto br0
iface br0 inet static
       address 192.168.0.100
       network 192.168.0.0
       netmask 255.255.255.0
       broadcast 192.168.0.255
       gateway 192.168.0.1
       bridge_ports eth0
       bridge_fd 9
       bridge_hello 2
       bridge_maxage 12
       bridge_stp off

(Make sure you use the correct settings for your network!)

Restart the network...

/etc/init.d/networking restart

... and run

ifconfig

It should now show the network bridge (br0):

root@server1:~# ifconfig
br0 Link encap:Ethernet HWaddr 00:1e:90:f3:f0:02
inet addr:192.168.0.100 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::21e:90ff:fef3:f002/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:23 errors:0 dropped:0 overruns:0 frame:0
TX packets:24 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1580 (1.5 KB) TX bytes:2356 (2.3 KB)

eth0 Link encap:Ethernet HWaddr 00:1e:90:f3:f0:02
inet6 addr: fe80::21e:90ff:fef3:f002/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:13539 errors:0 dropped:0 overruns:0 frame:0
TX packets:7684 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:19476849 (19.4 MB) TX bytes:647692 (647.6 KB)
Interrupt:251 Base address:0xe000

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

vnet0 Link encap:Ethernet HWaddr 3e:7c:6f:ab:0e:8c
inet addr:192.168.122.1 Bcast:192.168.122.255 Mask:255.255.255.0
inet6 addr: fe80::3c7c:6fff:feab:e8c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:468 (468.0 B)

root@server1:~#

We can now create our first VM - an image-based VM (if you expect lots of traffic and many read- and write operations for that VM, use an LVM-based VM instead as shown in chapter 6 - image-based VMs are heavy on hard disk IO).

We will create a new directory for each VM that we want to create, e.g. ~/vm1, ~/vm2, ~/vm3, and so on, because each VM will have a subdirectory called ubuntu-kvm, and obviously there can be just one such directory in ~/vm1, for example. If you try to create a second VM in ~/vm1, for example, you will get an error message saying ubuntu-kvm already exists (unless you run vmbuilder with the --dest=DESTDIR argument):

root@server1:~/vm1# vmbuilder kvm ubuntu -c vm2.cfg
2008-12-10 16:32:44,185 INFO Cleaning up
ubuntu-kvm already exists
root@server1:~/vm1#

We will use the vmbuilder tool to create VMs. (You can learn more about vmbuilder here.) vmbuilder uses a template to create virtual machines - this template is located in the /etc/vmbuilder/libvirt/ directory. Because we must modify the template, we create a copy and modify that one:

mkdir -p ~/vm1/mytemplates/libvirt
cp /etc/vmbuilder/libvirt/* ~/vm1/mytemplates/libvirt/

Now we open ~/vm1/mytemplates/libvirt/libvirtxml.tmpl...

vi ~/vm1/mytemplates/libvirt/libvirtxml.tmpl

... and change the network section from

[...]
   
     
   
[...]

to

[...]
   
     
   
[...]

because we want the VM to use our network bridge.

Now we come to the partitioning of our VM. We create a file called vmbuilder.partition...

vi ~/vm1/vmbuilder.partition

... and define the desired partitions as follows:

root 8000
swap 4000
---
/var 20000

This defines a root partition (/) with a size of 8000MB, a swap partition of 4000MB, and a /var partition of 20000MB. The --- line makes that the following partition (/var in this example) is on a separate disk image (i.e., this would create two disk images, one for root and swap and one for /var). Of course, you are free to define whatever partitions you like (as long as you also define root and swap), and of course, they can be in just one disk image - this is just an example.

I want to install openssh-server in the VM. To make sure that each VM gets a unique OpenSSH key, we cannot install openssh-server when we create the VM. Therefore we create a script called boot.sh that will be executed when the VM is booted for the first time. It will install openssh-server (with a unique key) and also force the user (I will use the default username administrator for my VMs together with the default password howtoforge) to change the password when he logs in for the first time:

vi ~/vm1/boot.sh

# This script will run the first time the virtual machine boots
# It is ran as root.

# Expire the user account
passwd -e administrator

# Install openssh-server
apt-get update
apt-get install -qqy --force-yes openssh-server

Make sure you replace the username administrator with your default login name.

(You can find more about this here: https://help.ubuntu.com/community/JeOSVMBuilder#First%20boot)

(You can also define a "first login" script as described here: https://help.ubuntu.com/community/JeOSVMBuilder#First%20login)

Whenever vmbuilder builds a new VM, it has to download all packages from an Ubuntu mirror which can take quite some time. To speed this up, we install apt-proxy...

apt-get install apt-proxy

... to cache the downloaded packages so that subsequent VM installations will be a lot faster.

Now open /etc/apt-proxy/apt-proxy-v2.conf...

vi /etc/apt-proxy/apt-proxy-v2.conf

... and replace the default Ubuntu mirror with a mirror close to you (e.g. http://de.archive.ubuntu.com/ubuntu if you are in Germany):

[...]
[ubuntu]
;; Ubuntu archive
backends = http://de.archive.ubuntu.com/ubuntu
min_refresh_delay = 15m
[...]

Then we restart apt-proxy:

/etc/init.d/apt-proxy restart

apt-proxy listens on port 9999, so we can pass our local apt-proxy "mirror" as an argument to the vmbuilder script.

Now take a look at

vmbuilder kvm ubuntu --help

to learn about the available options.

To create our first VM, vm1, we go to the VM directory...

cd ~/vm1/

... and run vmbuilder, e.g. as follows:

vmbuilder kvm ubuntu --suite=intrepid --flavour=virtual --arch=amd64 --mirror=http://192.168.0.100:9999/ubuntu -o --libvirt=qemu:///system --tmpfs=- --ip=192.168.0.101 --part=vmbuilder.partition --templates=mytemplates --user=administrator --name=Administrator --pass=howtoforge --addpkg=vim-nox --addpkg=unattended-upgrades --addpkg=acpid --firstboot=boot.sh --mem=256 --hostname=vm1

Most of the options are self-explanatory. --part specifies the file with the partitioning details, relative to our working directory (that's why we had to go to our VM directory before running vmbuilder), --templates specifies the directory that holds the template file (again relative to our working directory), and --firstboot specifies the firstboot script. --libvirt=qemu:///system tells KVM to add this VM to the list of available virtual machines. --addpkg allows you to specify Ubuntu packages that you want to have installed during the VM creation (see above why you shouldn't add openssh-server to that list and use the firstboot script instead).

In the --mirror line I have specified my local apt-proxy mirror (http://192.168.0.100:9999/ubuntu) - I have used my publically accessible IP address instead of localhost or 127.0.0.1 because this mirror will be used in the VM's /etc/apt/sources.list file as well, and of course, the VM won't be able to connect to 127.0.0.1 on the host. Of course, you can as well specify an official Ubuntu repository in --mirror, e.g. http://de.archive.ubuntu.com/ubuntu. If you leave out --mirror, then the default Ubuntu repository (http://archive.ubuntu.com/ubuntu) will be used.

The build process can take a few minutes.

Afterwards, you can find an XML configuration file for the VM in /etc/libvirt/qemu/ (=> /etc/libvirt/qemu/vm1.xml):

ls -l /etc/libvirt/qemu/

root@server1:~/vm1# ls -l /etc/libvirt/qemu/
total 8
drwxr-xr-x 3 root root 4096 2008-12-10 15:26 networks
-rw------- 1 root root 963 2008-12-10 16:25 vm1.xml
root@server1:~/vm1#

The disk images are located in the ubuntu-kvm/ subdirectory of our VM directory:

ls -l ~/vm1/ubuntu-kvm/

root@server1:~/vm1# ls -l ~/vm1/ubuntu-kvm/
total 402804
-rw-r--r-- 1 root root 240963584 2008-12-10 16:37 disk0.qcow2
-rw-r--r-- 1 root root 171094016 2008-12-10 16:37 disk1.qcow2
root@server1:~/vm1#

4 Creating A Second VM

If you want to create a second VM (vm2), here's a short summary of the commands:

mkdir -p ~/vm2/mytemplates/libvirt
cp /etc/vmbuilder/libvirt/* ~/vm2/mytemplates/libvirt/

vi ~/vm2/mytemplates/libvirt/libvirtxml.tmpl

vi ~/vm2/vmbuilder.partition

vi ~/vm2/boot.sh

cd ~/vm2/
vmbuilder kvm ubuntu --suite=intrepid --flavour=virtual --arch=amd64 --mirror=http://192.168.0.100:9999/ubuntu -o --libvirt=qemu:///system --tmpfs=- --ip=192.168.0.102 --part=vmbuilder.partition --templates=mytemplates --user=administrator --name=Administrator --pass=howtoforge --addpkg=vim-nox --addpkg=unattended-upgrades --addpkg=acpid --firstboot=boot.sh --mem=256 --hostname=vm2

(Please note that you don't have to create a new directory for the VM (~/vm2) if you pass the --dest=DESTDIR argument to the vmbuilder command - it allows you to create a VM in a directory where you've already created another VM. In that case you don't have to create new vmbuilder.partition and boot.sh files and don't have to modify the template, but can simply use the existing files:

cd ~/vm1/
vmbuilder kvm ubuntu --suite=intrepid --flavour=virtual --arch=amd64 --mirror=http://192.168.0.100:9999/ubuntu -o --libvirt=qemu:///system --tmpfs=- --ip=192.168.0.102 --part=vmbuilder.partition --templates=mytemplates --user=administrator --name=Administrator --pass=howtoforge --addpkg=vim-nox --addpkg=unattended-upgrades --addpkg=acpid --firstboot=boot.sh --mem=256 --hostname=vm2 --destdir=vm2-kvm

)

5 Managing A VM

VMs can be managed through virsh, the "virtual shell". To connect to the virtual shell, run

virsh --connect qemu:///system

This is how the virtual shell looks:

root@server1:~/vm1/ubuntu-kvm# virsh --connect qemu:///system
Connecting to uri: qemu:///system
Welcome to virsh, the virtualization interactive terminal.

Type: 'help' for help with commands
'quit' to quit

virsh #

You can now type in commands on the virtual shell to manage your VMs. Run

help

to get a list of available commands:

virsh # help
Commands:

help print help
attach-device attach device from an XML file
attach-disk attach disk device
attach-interface attach network interface
autostart autostart a domain
capabilities capabilities
connect (re)connect to hypervisor
console connect to the guest console
create create a domain from an XML file
start start a (previously defined) inactive domain
destroy destroy a domain
detach-device detach device from an XML file
detach-disk detach disk device
detach-interface detach network interface
define define (but don't start) a domain from an XML file
domid convert a domain name or UUID to domain id
domuuid convert a domain name or id to domain UUID
dominfo domain information
domname convert a domain id or UUID to domain name
domstate domain state
domblkstat get device block stats for a domain
domifstat get network interface stats for a domain
dumpxml domain information in XML
freecell NUMA free memory
hostname print the hypervisor hostname
list list domains
migrate migrate domain to another host
net-autostart autostart a network
net-create create a network from an XML file
net-define define (but don't start) a network from an XML file
net-destroy destroy a network
net-dumpxml network information in XML
net-list list networks
net-name convert a network UUID to network name
net-start start a (previously defined) inactive network
net-undefine undefine an inactive network
net-uuid convert a network name to network UUID
nodeinfo node information
pool-autostart autostart a pool
pool-build build a pool
pool-create create a pool from an XML file
pool-create-as create a pool from a set of args
pool-define define (but don't start) a pool from an XML file
pool-define-as define a pool from a set of args
pool-destroy destroy a pool
pool-delete delete a pool
pool-dumpxml pool information in XML
pool-info storage pool information
pool-list list pools
pool-name convert a pool UUID to pool name
pool-refresh refresh a pool
pool-start start a (previously defined) inactive pool
pool-undefine undefine an inactive pool
pool-uuid convert a pool name to pool UUID
quit quit this interactive terminal
reboot reboot a domain
restore restore a domain from a saved state in a file
resume resume a domain
save save a domain state to a file
schedinfo show/set scheduler parameters
dump dump the core of a domain to a file for analysis
shutdown gracefully shutdown a domain
setmem change memory allocation
setmaxmem change maximum memory limit
setvcpus change number of virtual CPUs
suspend suspend a domain
ttyconsole tty console
undefine undefine an inactive domain
uri print the hypervisor canonical URI
vol-create create a vol from an XML file
vol-create-as create a volume from a set of args
vol-delete delete a vol
vol-dumpxml vol information in XML
vol-info storage vol information
vol-list list vols
vol-path convert a vol UUID to vol path
vol-name convert a vol UUID to vol name
vol-key convert a vol UUID to vol key
vcpuinfo domain vcpu information
vcpupin control domain vcpu affinity
version show version
vncdisplay vnc display

virsh #

list

shows all running VMs;

list --all

shows all VMs, running and inactive:

virsh # list --all
Id Name State
----------------------------------
- vm1 shut off

virsh #

Before you start a new VM for the first time, you must define it from its xml file (located in the /etc/libvirt/qemu/ directory):

define /etc/libvirt/qemu/vm1.xml

Please note that whenever you modify the VM's xml file in /etc/libvirt/qemu/, you must run the define command again!

Now you can start the VM:

start vm1

After a few moments, you should be able to connect to the VM with an SSH client such as PuTTY; log in with the default username and password. After the first login you will be prompted to change the password.

list

should now show the VM as running:

virsh # list
Id Name State
----------------------------------
1 vm1 running

virsh #

To stop a VM, run

shutdown vm1

To immediately stop it (i.e., pull the power plug), run

destroy vm1

Suspend a VM:

suspend vm1

Resume a VM:

resume vm1

These are the most important commands.

Type

quit

to leave the virtual shell.

6 Creating An LVM-Based VM

LVM-based VMs have some advantages over image-based VMs. They are not as heavy on hard disk IO, and they are easier to back up (using LVM snapshots).

To use LVM-based VMs, you need a volume group that has some free space that is not allocated to any logical volume. In this example, I use the volume group /dev/vg01 with a size of approx. 454GB...

vgdisplay

root@server1:~# vgdisplay
--- Volume group ---
VG Name vg01
System ID
Format lvm2
Metadata Areas 1
Metadata Sequence No 2
VG Access read/write
VG Status resizable
MAX LV 0
Cur LV 1
Open LV 1
Max PV 0
Cur PV 1
Act PV 1
VG Size 454.67 GB
PE Size 4.00 MB
Total PE 116396
Alloc PE / Size 75000 / 292.97 GB
Free PE / Size 41396 / 161.70 GB
VG UUID q3xIiX-LDlm-IbMu-2PK2-WVoc-zHb8-8ibb32

root@server1:~#

... that contains the logical volume /dev/vg01/root with a size of approx. 292GB - the rest is not allocated and can be used for VMs:

lvdisplay

root@server1:~# lvdisplay
--- Logical volume ---
LV Name /dev/vg01/root
VG Name vg01
LV UUID f9W43z-RC1i-9JE8-CvOS-Qa89-0STq-q1M71e
LV Write Access read/write
LV Status available
# open 1
LV Size 292.97 GB
Current LE 75000
Segments 1
Allocation inherit
Read ahead sectors auto
- currently set to 256
Block device 254:0

root@server1:~#

I will now create the virtual machine vm5 as an LVM-based VM. We can use the vmbuilder command again. vmbuilder knows the --raw option which allows to write the VM to a block device (e.g. /dev/vg01/vm5) - I've tried this, and it gave back no errors, however, I was not able to boot the VM (start vm5 didn't show any errors either, but I've never been able to access the VM). Therefore, I will create vm5 as an image-based VM first and then convert it into an LVM-based VM.

mkdir -p ~/vm5/mytemplates/libvirt
cp /etc/vmbuilder/libvirt/* ~/vm5/mytemplates/libvirt/

vi ~/vm5/mytemplates/libvirt/libvirtxml.tmpl

Make sure that you create all partitions in just one image file, so don't use --- in the vmbuilder.partition file:

vi ~/vm5/vmbuilder.partition

root 8000
swap 2000
/var 10000

vi ~/vm5/boot.sh

cd ~/vm5/
vmbuilder kvm ubuntu --suite=intrepid --flavour=virtual --arch=amd64 --mirror=http://192.168.0.100:9999/ubuntu -o --libvirt=qemu:///system --tmpfs=- --ip=192.168.0.105 --part=vmbuilder.partition --templates=mytemplates --user=administrator --name=Administrator --pass=howtoforge --addpkg=vim-nox --addpkg=unattended-upgrades --addpkg=acpid --firstboot=boot.sh --mem=256 --hostname=vm5

As you see from the vmbuilder.partition file, the VM will use a max. of 20GB, so we create a logical volume called /dev/vg01/vm5 with a size of 20GB now:

lvcreate -L20G -n vm5 vg01

Don't create a file system in the new logical volume!

We will use the qemu-img command to convert the image to an LVM-based VM. The qemu-img command is part of the qemu package which we must install now:

apt-get install qemu

Then we go to the VM's ubuntu-kvm/ directory...

cd ~/vm5/ubuntu-kvm/

... and convert the image as follows:

qemu-img convert disk0.qcow2 -O raw /dev/vg01/vm5

Afterwards you can delete the disk image:

rm -f disk0.qcow2

Now we must open the VM's xml configuration file /etc/libvirt/qemu/vm5.xml...

vi /etc/libvirt/qemu/vm5.xml

... and change the following section...

[...]
   
     
     
   
[...]

... so that it looks as follows:

[...]
   
     
     
   
[...]

That's it! You can now use virsh to manage the VM.

7 Links

• KVM (Ubuntu Community Documentation): https://help.ubuntu.com/community/KVM
• vmbuilder: https://help.ubuntu.com/community/JeOSVMBuilder
• JeOS and vmbuilder: http://doc.ubuntu.com/ubuntu/serverguide/C/jeos-and-vmbuilder.html
• Ubuntu: http://www.ubuntu.com/

So you are too poor to afford another expensive router and want to do things yourself. You have found the right tutorial! This tutorial will show you how to set up an Ubuntu 8.10 router with NAT, port fowarding, a DNS server and a DHCP server.

Why Ubuntu you ask?

Not only is Ubuntu a great operating system, it's also very flexible and powerful enough to allow you to get up and running in no time! Note: Please restart your computer after every step. This will ensure everything is working correctly.

Some of the basic things we are going to need are...

DHCP -- dhcp3-server
DNS -- bind9
iptables -- included /w ubuntu

First things first

Your going to need 2 network cards. Take your first network card, and plug your WAN connection into it. You should know what network card this is, eth0 eth1 ect... If you don't know what it is, trial and error my friend.

Let's just say that your WAN card is going to be eth0 (if it's eth1, just do everything the same but ajust your config accordingly). We want to locate the file /etc/network/interfaces. Do a VI on the file such as

sudo vi /etc/network/interfaces

You should see in the file (if you have nothing setup yet):

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback

We are going to add this to the file. As a side note, if you don't know how to use VI use nano or learn VI.

auto eth0
iface eth0 inet dhcp

The auto eth0 code tells eth0 to start on boot, similar to running

sudo ifconfig eth0 up

The code iface eth0 inet dhcp tells the eth0 interface to look for a DHCP server and get its info from there. This is important if your hooked up to a cable modem, as you will want to get a public IP from your ISP.

The next step to take is to configure your network card eth1. This will be your "LAN" card.

If you remember, our /etc/network/interfaces configuration looked like

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
iface eth0 inet dhcp

We are going to VI into the interfaces file again and add a few more lines:

sudo vi /etc/network/interfaces

Add these lines to the bottom of the file.

auto eth1
iface eth1 inet static
       address         172.17.207.121
       netmask         255.255.255.0
       broadcast       172.17.207.255
       network         172.17.207.0

This just gives you a static IP address for your server on your LAN card.

Your file should now look like this.

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
iface eth0 inet dhcp
auto eth1
iface eth1 inet static
       address         172.17.207.121
       netmask         255.255.255.0
       broadcast       172.17.207.255
       network         172.17.207.0

Now, before we forget, let's edit your /etc/hosts file.

sudo vi /etc/hosts

Make the file look like mine, though if you call your server userve or myserver you can change it.

Also note the asus.local domain name, it's a good idea to use your own such as mydomain.local but you can use what I have for learning purposes.

sudo apt-get install dhcp3-server

Let's edit the dhcpd.conf file. Start by running the command

sudo vi /etc/dhcp3/dhcpd.conf

Now if there is anything in that file, REMOVE IT.

Copy and paste this into your file, then write and quit.

ddns-update-style none;
option domain-name "whatever.local"; //change this to something you want.local such as mydomain.local
option domain-name-servers 172.17.207.121, 24.92.226.41; //you also might want to change that second dns server to your ISP's local DNS server
option routers 172.17.207.121;
default-lease-time 42300;
max-lease-time 84600;
authoritative;
log-facility local7;
subnet 172.17.0.0 netmask 255.255.255.0 {
       range 172.17.207.1 172.17.207.100; //you can expand the range just by changing .100 to .254 or somthing like that
}

Now run the command

sudo /etc/init.d/dhcp3-server start

This will start your DHCP server and we can label this part DONE.

Moving on to... DNS

Bind is the DNS package that we will be using. To install this, we just simply run

sudo apt-get install bind9

This will download and install our bind server.

Start by running the command

vi /etc/bind/named.conf

Then remove everything in the file and look for my comments, usually indicated by //.

// This is the primary configuration file for the BIND DNS server named.
//
// Please read /usr/share/doc/bind9/README.Debian.gz for information on the
// structure of BIND configuration files in Debian, *BEFORE* you customize
// this configuration file.
//
// If you are just adding zones, please do that in /etc/bind/named.conf.local
include "/etc/bind/named.conf.options";
// prime the server with knowledge of the root servers
zone "." {
       type hint;
       file "/etc/bind/db.root";
};
// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912
zone "asus.local" { //change asus.local to whatever you named your domain such as mydomain.local
type master;
file "/etc/bind/zones/asus.local.db"; //this file or foler does not exist so we will need to make it
};
zone "207.17.172.in-addr.arpa" {
type master;
file "/etc/bind/zones/rev.207.17.172.in-addr.arpa";//this file does not exist so we will also need to make it
};
zone "localhost" {
       type master;
       file "/etc/bind/db.local";
};
zone "127.in-addr.arpa" {
       type master;
       file "/etc/bind/db.127";
};
zone "0.in-addr.arpa" {
       type master;
       file "/etc/bind/db.0";
};
zone "255.in-addr.arpa" {
       type master;
       file "/etc/bind/db.255";
};
include "/etc/bind/named.conf.local";

Before we can make the two files asus.local.db and rev.207.17.172.in-addr.arpa, we need to edit another file. So

sudo vi /etc/bind/named.conf.options

Remove everything in the file and use this...

options {
       directory "/var/cache/bind";
       // If there is a firewall between you and nameservers you want
       // to talk to, you may need to fix the firewall to allow multiple
       // ports to talk.  See http://www.kb.cert.org/vuls/id/800113
       // If your ISP provided one or more IP addresses for stable
       // nameservers, you probably want to use them as forwarders.
       // Uncomment the following block, and insert the addresses replacing
       // the all-0's placeholder.
        forwarders {
         24.92.226.41; //very important, change this to your LOCAL ISP's DNS server(s)
     24.92.224.40;
        };
       auth-nxdomain no;    # conform to RFC1035
       listen-on-v6 { any; };
};

Pay attention to the comments, they tell you to CHANGE our forwarders address(es) to your LOCAL ISP's DNS.

Next, cd over to your bind directory:

cd /etc/bind/
sudo mkdir zones
cd zones
sudo vi asus.local.db

(Or use your domain name such as mydomain.local.db.)

Once you are in the asus.local.db file or mydomain.local.db file (whatever you called it), copy and paste this, make the appropriate changes to your domain name.

$ORIGIN .
$TTL 4000 ;
asus.local.     IN SOA  server.asus.local. admin.asus.local. (
2007031001      ; serial
28800           ; refresh
3600            ; retry
604800          ; expire
38400           ; min
)
               NS      server.asus.local.
$ORIGIN asus.local.
               IN      A       172.17.207.121
www             IN      A       172.17.207.121 //an example
server          IN      A       172.17.207.121 //an example
macpro          IN      A       172.17.207.4   //an example

If you do an nslookup macpro, you will get 172.17.207.4 back as an answer, so change the domain names and IP's according to your settings.

Next, we are going to vi the rev.207.17.172.in-addr.arpa file that does not exist yet. But it will once we save it. So assuming you're still in the zones folder:

vi rev.207.17.172.in-addr.arpa

Copy and paste what I have here, making the appropriate changes.

$ORIGIN .
$TTL 28800      ; 8 hours
207.17.172.IN-ADDR.ARPA IN SOA server.asus.local. admin.asus.local. (
                               2008110601 ; serial
                               28800      ; refresh (8 hours)
                               7200       ; retry (2 hours)
                               604800     ; expire (1 week)
                               86400      ; minimum (1 day)
                               )
                       NS      server.asus.local.
$ORIGIN 207.17.172.IN-ADDR.ARPA.
4                     PTR    macpro.asus.local.

So now if you did a reverse lookup on 172.17.207.4, you would get macpro.asus.local.

Now run the command to start named:

sudo /etc/init.d/named start

If it does not start, check the logs in /var/logs.

Last but not least, IPTABLES

First thing is first, we need to edit sysctl.conf in the folder /etc/, so:

sudo vi /etc/sysctl.conf

Uncomment line 28. That means removing the # in front of it. The line should be net.ipv4.ip_forward=1

Next, let's vi over to rc.local:

sudo vi /etc/rc.local

Add these two lines to the bottom of the file:

/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables --table nat -A POSTROUTING -o eth0 -j MASQUERADE

This will set up your gateway using iptables. You can use iptables to make this more secure than this basic setup.

To forward ports, you can add something like this to the end of the rc.local file.

/sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 -d jgibbs.dyndns.org --dport 3389 -j DNAT --to 172.17.207.4:3389

The long line above will port forward all incoming traffic on port 3389 to the IP 172.17.207.4, so I can remote desktop into my Windows box from outside my network.

You can do this with any ports you wish.

RESTART!

LAMP is short for Linux, Apache, MySQL, PHP. This tutorial shows how you can install an Apache2 webserver on an Ubuntu 9.04 server with PHP5 support (mod_php) and MySQL support.

I do not issue any guarantee that this will work for you!

1 Preliminary Note

In this tutorial I use the hostname server1.example.com with the IP address 192.168.0.100. These settings might differ for you, so you have to replace them where appropriate.

I'm running all the steps in this tutorial with root privileges, so make sure you're logged in as root:

sudo su

2 Installing MySQL 5.0

First we install MySQL 5.0 like this:

aptitude install mysql-server mysql-client

You will be asked to provide a password for the MySQL root user - this password is valid for the user root@localhost as well as root@server1.example.com, so we don't have to specify a MySQL root password manually later on:

New password for the MySQL "root" user: <-- yourrootsqlpassword
Repeat password for the MySQL "root" user: <-- yourrootsqlpassword

3 Installing Apache2

Apache2 is available as an Ubuntu package, therefore we can install it like this:

aptitude install apache2

Now direct your browser to http://192.168.0.100, and you should see the Apache2 placeholder page (It works!):

Apache's default document root is /var/www on Ubuntu, and the configuration file is /etc/apache2/apache2.conf. Additional configurations are stored in subdirectories of the /etc/apache2 directory such as /etc/apache2/mods-enabled (for Apache modules), /etc/apache2/sites-enabled (for virtual hosts), and /etc/apache2/conf.d.

4 Installing PHP5

We can install PHP5 and the Apache PHP5 module as follows:

aptitude install php5 libapache2-mod-php5

We must restart Apache afterwards:

/etc/init.d/apache2 restart

5 Testing PHP5 / Getting Details About Your PHP5 Installation

The document root of the default web site is /var/www. We will now create a small PHP file (info.php) in that directory and call it in a browser. The file will display lots of useful details about our PHP installation, such as the installed PHP version.

vi /var/www/info.php

phpinfo();
?>

Now we call that file in a browser (e.g. http://192.168.0.100/info.php):

As you see, PHP5 is working, and it's working through the Apache 2.0 Handler, as shown in the Server API line. If you scroll further down, you will see all modules that are already enabled in PHP5. MySQL is not listed there which means we don't have MySQL support in PHP5 yet.

6 Getting MySQL Support In PHP5

To get MySQL support in PHP, we can install the php5-mysql package. It's a good idea to install some other PHP5 modules as well as you might need them for your applications. You can search for available PHP5 modules like this:

aptitude search php5

Pick the ones you need and install them like this:

aptitude install php5-mysql php5-curl php5-gd php5-idn php-pear php5-imagick php5-imap php5-mcrypt php5-memcache php5-mhash php5-ming php5-ps php5-pspell php5-recode php5-snmp php5-sqlite php5-tidy php5-xmlrpc php5-xsl php5-json

Now restart Apache2:

/etc/init.d/apache2 restart

Now reload http://192.168.0.100/info.php in your browser and scroll down to the modules section again. You should now find lots of new modules there, including the MySQL module:

7 phpMyAdmin

phpMyAdmin is a web interface through which you can manage your MySQL databases. It's a good idea to install it:

aptitude install phpmyadmin

You will see the following questions:

Web server to reconfigure automatically: <-- apache2
Configure database for phpmyadmin with dbconfig-common? <-- No

Afterwards, you can access phpMyAdmin under http://192.168.0.100/phpmyadmin/:

8 Links

• Apache: http://httpd.apache.org/
• PHP: http://www.php.net/
• MySQL: http://www.mysql.com/
• Ubuntu: http://www.ubuntu.com/
• phpMyAdmin: http://www.phpmyadmin.net/

This short guide shows some important commands for your daily work on the Linux command line.

arch

$ arch

i686

cat

$ cat lorem.txt

Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

cd

$ cd /bin

chgrp

$ chgrp games moo.txt

chmod

$ chmod +x helloworld

chown

# chown root lorem.txt

cksum

$ cksum lorem.txt moo.txt

3570240675 453 lorem.txt
4294967295 0 moo.txt

cp

$ cp lorem.txt copy_of_lorem.txt

date

$ date

Sat Mar 3 12:07:09 GMT 2007

df

$ df

Filesystem 1K-blocks Used Available Use% Mounted on

/dev/simfs 39845888 218048 39627840 1% /

dir

$ dir

copy_of_lorem.txt lorem.txt moo.txt www

du

$ du -h /bin

7.8M /bin

echo

$ echo foobar

foobar

exit

$ exit

fgrep

$ fgrep "irure dolor" lorem.txt

commodo consequat. Duis aute irure dolor in reprehenderit in voluptate

find

$ find hello*

hello_world
hello_world.c

free

$ free

total used free shared buffers cached
Mem: 8299892 8287708 12184 0 2641772 1731236
Low: 3581300 3572764 8536
High: 4718592 4714944 3648
-/+ buffers/cache: 3914700 4385192
Swap: 8193140 2335664 5857476

grep

$ grep -i apple fruitlist.txt

apple

groups

$ groups

games users

head

$ head -2 lorem.txt

$ hostname

anapnea.net

id

$ id

uid=1478(smallfoot) gid=100(users) groups=35(games),100(users)

kill

$ kill -9 18298

-bash: kill: (18298) - Operation not permitted

killall

$ killall irssi

irssi(18298): Operation not permitted
irssi(13372): Operation not permitted
irssi(22048): Operation not permitted
irssi: no process killed

last

$ last -n 3

alice pts/6 192.0.34.166 Fri May 18 16:17 still logged in
bob pts/2 64.233.183.103 Fri May 18 16:17 still logged in
clare pts/6 72.5.124.61 Fri May 18 15:54 - 15:55 (00:01)

ldd

$ ldd /bin/bash

libncurses.so.5 => /lib/libncurses.so.5 (0x40023000)
libdl.so.2 => /lib/libdl.so.2 (0x40065000)
libc.so.6 => /lib/libc.so.6 (0x40069000)
/lib/ld-linux.so.2 (0x40000000)

ln

$ ln -s data.txt symlink.txt

logname

$ logname

smallfoot

ls

$ ls

copy_of_lorem.txt lorem.txt moo.txt www

man

$ man bash

md5sum

$ md5sum lorem.txt

56da9e37259af34345895883e6fd1a27 lorem.txt

mkdir

$ mkdir foobar

mv

$ mv lorem.txt ipsum.txt

nl

$ nl lorem.txt

1 Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod
2 tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim
3 veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea
4 commodo consequat. Duis aute irure dolor in reprehenderit in voluptate
5 velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint
6 occaecat cupidatat non proident, sunt in culpa qui officia deserunt
7 mollit anim id est laborum.

nm

$ nm hello_world

080494a0 D _DYNAMIC
0804956c D _GLOBAL_OFFSET_TABLE_
08048474 R _IO_stdin_used
w _Jv_RegisterClasses
08049490 d __CTOR_END__
0804948c d __CTOR_LIST__
08049498 d __DTOR_END__
...

od

$ od -t x /bin/sh

2376640 00098020 000054d4 00000000 00000000
2376660 00000020 00000000 000000c7 00000008
2376700 00000003 080e6500 0009d4f4 00004ae8
...

pidof

$ pidof fetchmail

22392

ping

$ ping -c 2 127.0.0.1

PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.048 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.052 ms

--- 127.0.0.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.048/0.050/0.052/0.002 ms

ps

$ ps

PID TTY TIME CMD
21542 pts/12 00:00:00 bash
27706 pts/12 00:00:00 ps

pstree

$ pstree

init-+-2*[BitchX]
|-3*[bash---sleep]
|-fetchmail
|-screen-+-bash---irssi
| `-bash---ctorrent
|-screen-+-bash---lisp.run
| |-bash---vi
| |-2*[bash]
| `-bash---lynx
|-2*[screen---bash---irssi]
|-screen---irssi
|-screen---bash
|-screen-+-bash
| `-irssi
|-skjerm---irssi
|-sshd-+-5*[sshd---sshd---bash---irssi]
| |-8*[sshd---sshd---bash]
| |-sshd---sshd---bash---screen
| |-sshd---sshd
| `-sshd---sshd---bash---pstree
`-syslog-ng

pwd

$ pwd

/home/smallfoot

rm

$ rm lorem.txt

rmdir

$ rmdir foobar

sed

$ echo "My cat's name is Bob" | sed -e 's/Bob/Mittens/g'

My cat's name is Mittens

sha1sum

$ sha1sum lorem.txt

c942ddebd142ec8bacac9213d48096e74bab4957 lorem.txt

shutdown

$ shutdown now

size

$ size /bin/bash

text data bss dec hex filename
621233 22712 19176 663121 a1e51 /bin/bash

stat

$ stat lorem.txt

File: `lorem.txt'
Size: 453 Blocks: 8 IO Block: 4096 regular file
Device: 77h/119d Inode: 27312217 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1478/smallfoot) Gid: ( 100/ users)
Access: 2007-03-03 12:24:39.000000000 +0000
Modify: 2007-03-03 12:24:39.000000000 +0000
Change: 2007-03-03 12:24:39.000000000 +0000

strings

$ strings hello_world

/lib/ld-linux.so.2
_Jv_RegisterClasses
__gmon_start__
libc.so.6
puts
_IO_stdin_used
__libc_start_main
GLIBC_2.0
PTRh%
[^_]
Hello World!

tail

$ tail -2 lorem.txt

occaecat cupidatat non proident, sunt in culpa qui officia deserunt
mollit anim id est laborum.

talk

$ talk bob Lookout for the dopefish!

touch

$ touch lorem.txt

tty

$ tty

/dev/pts/16

uname

$ uname -a

Linux anapnea.net 2.6.9 #1 SMP Wed Jul 19 16:24:18 MSD 2006 i686 Intel(R) Xeon(TM) CPU 2.80GHz GenuineIntel GNU/Linux

uptime

$ uptime

14:50:26 up 7 days, 17:52, 18 users, load average: 0.08, 0.02, 0.01

users

$ users

alice bob charlie eve

vdir

$ vdir

total 8
-rw-r--r-- 1 smallfoot users 453 Mar 3 12:32 copy_of_lorem.txt
-rw-r--r-- 1 smallfoot users 453 Mar 3 12:24 lorem.txt
-rw-r--r-- 1 smallfoot users 0 Mar 3 12:32 moo.txt
lrwxr-xr-x 1 root root 18 Feb 27 19:33 www -> /var/www/smallfoot

w

$ w

12:14:30 up 5 days, 15:16, 19 users, load average: 0.00, 0.00, 0.00
USER TTY LOGIN@ IDLE JCPU PCPU WHAT
charlie pts/0 Fri21 3:26m 2.52s 2.52s irssi
alice pts/2 Wed17 30:21m 0.00s 0.00s -bash
emma pts/4 11:37 36:57 0.00s 0.00s -bash
frank pts/5 11:48 11:03 0.00s 0.00s -bash
smallfoo pts/12 12:01 0.00s 0.04s 0.01s w

wall

$ wall next week we change the server for a new one

wc

$ wc -l lorem.txt

7 lorem.txt

whatis

$ whatis bash

bash (1) - GNU Bourne-Again SHell
bash [builtins] (1) - bash built-in commands, see bash(1)

who

$ who

charlie pts/0 Mar 2 21:37 (xtreme-11-65.acme.com)
alice pts/2 Feb 28 17:48 (147.21.16.3)
emma pts/4 Mar 3 11:37 (32.84-48-181.uac.com)
frank pts/5 Mar 3 11:48 (port-212-202-233-2.foobar.org)
smallfoot pts/12 Mar 3 12:01 (c-12776f4.cust.example.net)

whereis

$ whereis bash

bash: /bin/bash /etc/bash /usr/share/man/man1/bash.1.gz

whoami

$ whoami

smallfoot

This guide explains how you can run virtual machines with Sun VirtualBox 3.0 (released on June 30, 2009) on a headless Ubuntu 9.04 server. Normally you use the VirtualBox GUI to manage your virtual machines, but a server does not have a desktop environment. Fortunately, VirtualBox comes with a tool called VBoxHeadless that allows you to connect to the virtual machines over a remote desktop connection, so there's no need for the VirtualBox GUI.

I do not issue any guarantee that this will work for you!

1 Preliminary Note

I have tested this on an Ubuntu 9.04 server (host system) with the IP address 192.168.0.100 where I'm logged in as a normal user (user name administrator in this example) instead of as root.

2 Installing VirtualBox

To install VirtualBox 3.0 on our Ubuntu 9.04 server, we open /etc/apt/sources.list...

sudo vi /etc/apt/sources.list

... and add the following line to it:

[...]
deb http://download.virtualbox.org/virtualbox/debian jaunty non-free

Then we download Sun's public key...

wget -q http://download.virtualbox.org/virtualbox/debian/sun_vbox.asc -O- | sudo apt-key add -

... and update our package database:

sudo aptitude update

Afterwards, we install VirtualBox 3.0 as follows:

sudo aptitude install linux-headers-$(uname -r) build-essential virtualbox-3.0 dkms

(The dkms package ensures that the VirtualBox host kernel modules are properly updated if the Linux kernel version changes.)

Creating group 'vboxusers'
Users of VirtualBox must be members of that group. Host network interfaces will be assigned to that group. <-- Ok

Should the vboxdrv kernel module be compiled now? <-- Yes

Now we must add the user that will run VirtualBox (administrator in this example) to the vboxusers group:

sudo adduser administrator vboxusers

VirtualBox is now installed and ready to be used.

3 Using VirtualBox On The Command Line

3.1 Creating A VM

To create a VM on the command line, we can use the VBoxManage command. See

VBoxManage --help

for a list of available switches and (highly recommended!) take a look at http://www.virtualbox.org/manual/UserManual.html#vboxmanage.

I will now create an Ubuntu 9.04 Server VM with 256MB memory and a 10GB hard drive from the Ubuntu 9.04 Server iso image (which I have stored in /home/ubuntu-9.04-server-i386.iso):

VBoxManage createvm -name "Ubuntu 9.04 Server" -register
VBoxManage modifyvm "Ubuntu 9.04 Server" -memory "256MB" -acpi on -boot1 dvd -nic1 nat
VBoxManage createvdi -filename "Ubuntu_9_04_Server.vdi" -size 10000 -register
VBoxManage modifyvm "Ubuntu 9.04 Server" -hda "Ubuntu_9_04_Server.vdi"
VBoxManage registerimage dvd /home/ubuntu-9.04-server-i386.iso
VBoxManage modifyvm "Ubuntu 9.04 Server" -dvd /home/ubuntu-9.04-server-i386.iso

3.2 Importing An Existing VM

Let's assume you have a VM called examplevm that you want to reuse on this host. On the old host, you should have a directory Machines/examplevm in the VirtualBox directory; Machines/examplevm should contain the examplevm.xml file. Copy the examplevm directory (including the examplevm.xml file) to your new Machines directory (if your user name is administrator, this is /home/administrator/.VirtualBox/Machines - the result should be /home/administrator/.VirtualBox/Machines/examplevm/examplevm.xml).

In addition to that copy the examplevm.vdi file from the old VDI directory to the new one (e.g. /home/administrator/.VirtualBox/VDI/examplevm.vdi).

Afterwards, you must register the imported VM:

VBoxManage registervm Machines/examplevm/examplevm.xml

3.3 Starting A VM With VBoxHeadless

Regardless of if you create a new VM or import and old one, you can start it with the command:

VBoxHeadless -startvm "Ubuntu 9.04 Server"

(Replace Ubuntu 9.04 Server with the name of your VM.)

VBoxHeadless will start the VM and a VRDP (VirtualBox Remote Desktop Protocol) server which allows you to see the VM's output remotely on another machine.

To learn more about VBoxHeadless, take a look at

VBoxHeadless --help

and at http://www.virtualbox.org/manual/UserManual.html#id2515738.

• VirtualBox: http://www.virtualbox.org/
• Ubuntu: http://www.ubuntu.com/

LAMP is short for Linux, Apache, MySQL, PHP. This tutorial shows how you can install an Apache2 webserver on a CentOS 5.3 server with PHP5 support (mod_php) and MySQL support.

I do not issue any guarantee that this will work for you!

1 Preliminary Note

In this tutorial I use the hostname server1.example.com with the IP address 192.168.0.100. These settings might differ for you, so you have to replace them where appropriate.

2 Installing MySQL 5.0

To install MySQL, we do this:

yum install mysql mysql-server

Then we create the system startup links for MySQL (so that MySQL starts automatically whenever the system boots) and start the MySQL server:

chkconfig --levels 235 mysqld on
/etc/init.d/mysqld start

Run

mysqladmin -u root password yourrootsqlpassword
mysqladmin -h server1.example.com -u root password yourrootsqlpassword to set a password for the user root (otherwise anybody can access your MySQL database!).

3 Installing Apache2

Apache2 is available as a CentOS package, therefore we can install it like this:

yum install httpd

Now configure your system to start Apache at boot time...

chkconfig --levels 235 httpd on

... and start Apache:

/etc/init.d/httpd start

Now direct your browser to http://192.168.0.100, and you should see the Apache2 placeholder page:

Apache's default document root is /var/www/html on CentOS, and the configuration file is /etc/httpd/conf/httpd.conf. Additional configurations are stored in the /etc/httpd/conf.d/ directory.

4 Installing PHP5

We can install PHP5 and the Apache PHP5 module as follows:

yum install php

We must restart Apache afterwards:

/etc/init.d/httpd start

5 Testing PHP5 / Getting Details About Your PHP5 Installation

The document root of the default web site is /var/www/html. We will now create a small PHP file (info.php) in that directory and call it in a browser. The file will display lots of useful details about our PHP installation, such as the installed PHP version.

vi /var/www/html/info.php

phpinfo();
?>

Now we call that file in a browser (e.g. http://192.168.0.100/info.php):

As you see, PHP5 is working, and it's working through the Apache 2.0 Handler, as shown in the Server API line. If you scroll further down, you will see all modules that are already enabled in PHP5. MySQL is not listed there which means we don't have MySQL support in PHP5 yet.

6 Getting MySQL Support In PHP5

To get MySQL support in PHP, we can install the php-mysql package. It's a good idea to install some other PHP5 modules as well as you might need them for your applications. You can search for available PHP5 modules like this:

yum search php

Pick the ones you need and install them like this:

yum install php-mysql php-gd php-imap php-ldap php-odbc php-pear php-xml php-xmlrpc

Now restart Apache2:

/etc/init.d/httpd restart

Now reload http://192.168.0.100/info.php in your browser and scroll down to the modules section again. You should now find lots of new modules there, including the MySQL module:

7 phpMyAdmin

phpMyAdmin is a web interface through which you can manage your MySQL databases.

First we enable the RPMforge repository on our CentOS system as phpMyAdmin is not available in the official CentOS 5.3 repositories:

On x86_64 systems:

wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm
rpm -Uvh rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm

On i386 systems:

wget http://packages.sw.be/rpmforge-release/rpmforge-release-0.3.6-1.el5.rf.i386.rpm
rpm -Uvh rpmforge-release-0.3.6-1.el5.rf.i386.rpm

phpMyAdmin can now be installed as follows:

yum install phpmyadmin

Now we configure phpMyAdmin. We change the Apache configuration so that phpMyAdmin allows connections not just from localhost (by commenting out the stanza):

vi /etc/httpd/conf.d/phpmyadmin.conf

#
#  Web application to manage MySQL
#

#
#  Order Deny,Allow
#  Deny from all
#  Allow from 127.0.0.1
#

Alias /phpmyadmin /usr/share/phpmyadmin
Alias /phpMyAdmin /usr/share/phpmyadmin
Alias /mysqladmin /usr/share/phpmyadmin

Next we change the authentication in phpMyAdmin from cookie to http:

vi /usr/share/phpmyadmin/config.inc.php

[...]
/* Authentication type */
$cfg['Servers'][$i]['auth_type'] = 'http';
[...]

Afterwards, you can access phpMyAdmin under http://192.168.0.100/phpmyadmin/:

Links

• Apache: http://httpd.apache.org/
• PHP: http://www.php.net/
• MySQL: http://www.mysql.com/
• CentOS: http://www.centos.org/
• phpMyAdmin: http://www.phpmyadmin.net/

This tutorial explains how to set up a FreeRadius 2.x server for wifi authentication, authorization and accounting in conjunction with mysql & web based management with Daloradius on CentOS 5.x. Production deployment is also possible with minor tweaking. But as usual I do not guarantee anything & take no responsibilities.

(For basic how-to refer to the doc http://www.howtoforge.com/wifi-authentication-accounting-with-freeradius-on-centos5.)

The following steps are involved:

1- Building Centos 5.x binary rpms

2- Installing the binary packages

3- Configuring the FR with mysql

4- Setting up web management with Daloradius


Step 1- Building Centos 5.X packages

Get hold of src.rpms from http://rpmfind.net//linux/RPM/fedora/devel/src/freeradius-2.0.5-1.fc10.src.html.

rpm -Uvh freeradius-2.0.5-1.fc10.src

Note: It is recommended that you carry this building process on a non-production server & move over the final binary rpms over to the produtions server. But it isn't mandatory if you know what you're doing.

cd /usr/src/redhat/RPMS/SPECS

rpmbuild -bb freeradius.spec

Note: You might require some package for these. yum them & rerun the rebuild process. (I got prompted for the following)

beecrypt-devel, sqlite-devel, unixODBC, unixODBC-devel,
python-devel, pam-devel, elfutils-libelf-devel,
elfutils-libelf-devel-static, rpm-devel, elfutils-devel,
elfutils-devel-static, net-snmp-devel, mysql, cyrus-sasl-devel,
mysql-devel, openldap-devel, gdbm-devel, libtool-ltdl-devel,
postgresql, postgresql-devel

After a while (depending on your system specs) you should have rpms built at the following locations (if using x86):

cd /usr/src/redhat/RPMS/i386

Move these to a production server if this is your development workstation.


Step 2- Installing the binary packages

rpm -Uvh freeradius-libs-2.0.5-1.i386.rpm

rpm -Uvh freeradius-2.0.5-1.i386.rpm

rpm -Uvh freeradius-utils-2.0.5-1.i386.rpm

rpm -Uvh freeradius-mysql-2.0.5-1.i386.rpm

After running with the out of the box configuration, validate against a local user.

E.g: run radius in debug mode:

radiusd -X

From another shell run this while the radius -X is running:

radtest abc 123 localhost 1812 testing123

Make sure the user 'abc' with password '123' is set in the /etc/raddb/users file.


Step 3- Configuring the FR with MySQL

First the MySQL bits (creating the db & its admin user). Do the following from your shell.

mysqladmin -u root password 123456

mysql -u root -p

On the MySQL shell type the following:

CREATE DATABASE radiusdb;

GRANT ALL ON radiusdb.* TO radius@localhost IDENTIFIED BY "radpass";

exit;

Now import the file mysql-dalo-and-fr2x.sql schema into the radiusdb from the following zipped file which also contains daloradius.conf file for daloradius which is discussed later in the web management section.

Download sql_schema & daloradius.conf zipped

unzip daloradius.zip

mysql -u root -p radiusdb < /root/mysql-dalo-fr2x.sql

To have a look at the db schema do the following:

mysql -u root -p

use database radiusdb;

show tables;

quit;

Now edit your /etc/raddb/sql.conf.

Reset the user/password/database parameters to reflect the changes (eg. login = radius, password=radpass & radius_db=radiusdb); to turn the NAS management from MySQL, search for the line

readclients = no

and change it to:

readclients = yes

Edit the file /etc/raddb/sites-enabled/default and add a line saying 'sql' to the authorize{} section (which is towards the end of the file). Also add a line saying 'sql' to the accounting{} section to tell FreeRadius to store accounting records in SQL as well. Optionally add 'sql' to the session{} section if you want to do Simultaneous-Use detection. Optionally add 'sql' to the post-auth{} section if you want to log all authentication attempts to SQL.

Here is the authorize section:

authorize {
preprocess
chap
mschap
suffix
eap
sql
pap
}

And the accounting section:

accounting {
detail
sql
}

To insert a test user in the database, go to the MySQL shell and run this:

mysql -u root -p

mysql> use database radiusdb;

mysql> INSERT INTO radcheck (UserName, Attribute, Value) VALUES ('sqltest', 'Password', 'testpwd');

mysql> select * from radcheck where UserName='sqltest';

mysql> exit

Fire up radius in debug mode:

radiusd -X

Go to another shell and run the test:

radtest sqltest testpwd localhost 1812 testing123

At this moment you should see a message containing something like ... Accept-Accept ... which is an indication that your user is getting authenticated just fine.

Congratulations! Your FreeRadius + MySQL setup is working.


4- Setting up web management with Daloradius

The latest stable release is version 0.9-7.

Get hold of the it from http://sourceforge.net/projects/daloradius.

tar -zxvf daloradius-0.9-7.tar.gz

Download the following prerequisite packages:

yum install install httpd -y

yum install php php-mysql php-pear php-gd php-pear-DB -y

cp daloradius-0.9-7/ /var/www -vr

Change ownership:

chown apache:apache /var/www/daloradius-0.9-7 -R

A few tables that are needed by Daloradius, have already been created earlier.

Copy over the already unzippedfile daloradius.conf from the downloaded zipped file.

cp /root/daloradius.conf /var/www/daloradius-0.9-7/library/

Note: This file daloradius.conf has been modified for freeradius 2.x which, as of yet, is not being packaged by daloradius.

Now, simply adjust the MySQL database information in the DaloRadius config file.

vi /var/www/daloradius-0.9-7/library/daloradius.conf

Fill in the database details, few important parameters are listed below:

...........
......................
CONFIG_DB_ENGINE = mysql
CONFIG_DB_HOST = 127.0.0.1
CONFIG_DB_USER = radius
CONFIG_DB_PASS = radpass
CONFIG_DB_NAME = radiusdb
.......................
............

Change ownership & permission:

chown apache.apache /var/ww/daloradius-0.9-7/library/daloradius.conf

chmod 644 /var/www/daloradius-0.9-7/library/daloradius.conf

touch /tmp/daloradius.log

chown apache.apache /tmp/daloradius.log

Set up the apache server.

Edit the /etc/httpd/conf/httpd.conf file and append this to the end of the file (customize to your likings):

Alias /myradius "/var/www/daloradius-0.9-7/"

Options None
order deny,allow
deny from all
allow from 127.0.0.1
allow from


Save and exit.

Restart the httpd server:

/etc/init.d/httpd restart

Fire up Firefox (or any other borowser) and go to the URL http:///myradius.

Log in with the administrator for management:

username: administrator
password: radius

Change this information first for the sake of security (info is located in the operator table).

Take Daloradius for a spin. You should have created an sqltest user earlier. You can also try adding new users and testing the connectivity from within the Daloradius frontend.

Congratulations you are done.

Again developers of FreeRadius, MySQL and Daloradius, do accept my humble appreciation for all your efforts. Open source community, as always you rock, thanx.

(Note: I haven't mentioned anything regarding setting up eap/ttls in this article. For that, just follow the section of setting up certificates and eap.conf from the below mentioned HowtoForge link.)


References:

http://freeradius.org/

http://wiki.freeradius.org/SQL_HOWTO

http://sourceforge.net/projects/daloradius

http://www.howtoforge.com/wifi-authentication-accounting-with-freeradius-on-centos5

http://rpmfind.net//linux/RPM/fedora/devel/src/freeradius-2.0.5-1.fc10.src.html

Ada beberapa perintah dasar yang tersedia di linux yang dapat dipakai, terutama yang biasa memakai OS DOS, ini dapat dijadikan sedikit referensi dalam mengingat perintah-perintah.

Format perintah dasar di linux yaitu :

perintah [opsi] [file sumber] [file tujuan]

1. Melihat daftar file (dir)
   #ls —-> melihat daftar file

   lokal:tes user$ ls
contoh.log tes.txt
   

2. Menghapus file (del)
   #rm ——> menghapus file / direktori

   #rm test.txt : menghapus file test.txt
   #rm * : menhapus semua file dalam satu folder
   #rm -r tes : menghapus folder tes dan seluruh file/direktori di dalamnya
   

3. Mengganti nama file (ren)
   #mv ——-> memindah file / direktori

   #mv test.txt test.txt.old : mengganti nama file test.txt menjadi test.txt.old
   #mv tes backup : mengganti nama folder tes menjadi backup
   

4. Menyalin file (copy)
   #cp ——–> menyalin file / direktori

   #cp test.txt test.txt.old : membuat salinan file test.txt.old dari file test.txt
   #cp tes backup : membuat salinan folder backup dari folder tes (jika dalam folder tes ada filenya maka akan gagal)
   #cp -r tes backup : membuat salinan folder backup dari folder tes dengan seluruh isinya
   

5. Membuat folder (mkdir)
   #mkdir ——> membuat folder baru

   #mkdir tes : membuat folder tes
   

6. Menghapus folder (rmdir)
   #rmdir ——> menghapus folder

   #rmdir tes : menghapus folder tes (akan gagal jika dalam folder ada filenya, gunakan perintah rm -r tes)
   

7. Pindah folder (cd)
   #cd ——–> pindah folder

   #cd tes : pindah ke folder tes
   #cd /home/user/pra : pindah ke folder /home/user/pra
   #cd.. : pindah ke folder sebelumnya / atasnya
   

8. Mengedit file (edit)
   #vi ——–> membuat atau edit file (untuk ubuntu memakai vim)

   #vi test.txt : jika file tidak ada maka akan dibuat file test.txt, jika file ada maka file text.txt akan diedit

   perintah dalam editor :
   i/o : [insert] untuk memulai mode insert
   [esc] : keluar dari mode insert
   / : masuk perintah command
   /w : tulis ke file
   /q : keluar editor
   /wq : tulis terus keluar editor
   /q! : keluar dan abaikan perubahan

Tahapan yang dilakukan yaitu :

1. Membuat Centos agar menjadi routerDisini disiapkan router ang bersifat Masquerading, maksudnya yaitu, semua komputer yang ada di ruangan (yang terhubung melalui gateway eth1) akan bisa melakukan koneksi ke luar melalui eth0 dan mengatas namakan eth0. Misalnya komputer di ruangan IPnya adalah 192.168.210.12 melakukan browsing ke server 192.168.220.5 (komputer di LAN lain yang bisa diakses melalui eth0), maka komputer server 192.168.220.5 akan membaca yang akses ke servernya adalah 192.168.200.200 bukannya 192.168.210.12. Atau dengan kata lain masquerading bermaksud membungkus alamat IP asli menjadi alamat IP yang Masquerading.Scrip yang disiapkan yaitu
   

   # Hapus semua seting yang sudah ada.
   iptables –flush
   iptables –table nat –flush
   iptables –delete-chain
   iptables –table nat –delete-chain

   # Set up IP FORWARDing and Masquerading
   iptables –table nat –append POSTROUTING –out-interface eth0 -j MASQUERADE
   iptables –append FORWARD –in-interface eth1 -j ACCEPT

   # Aktifkan packet forwarding di kernel
   echo 1 > /proc/sys/net/ipv4/ip_forward

   # routing
   route add -net 192.168210.0 netmask 255.255.255.0 gw 192.168.200.1 dev eth1

2. Setup squid agar support transparent proxyYang dimaksud transparent proxy yaitu secara mudahnya adalah agar browsing di browser tidak usah melakukan seting proxy (tanpa proxy atau default port 80).Di Squid bisa dicek di data berikut :
   

   # TAG: http_port
   # Usage: port [options]
   # hostname:port [options]
   # 1.2.3.4:port [options]
   #
   # The socket addresses where Squid will listen for HTTP client
   # requests. You may specify multiple socket addresses.
   # There are three forms: port alone, hostname with port, and
   # IP address with port. If you specify a hostname or IP
   # address, Squid binds the socket to that specific
   # address. This replaces the old ‘tcp_incoming_address’
   # option. Most likely, you do not need to bind to a specific
   # address, so you can use the port number alone.
   #
   # The default port number is 3128.
   

   #
   # If you are running Squid in accelerator mode, you
   # probably want to listen on port 80 also, or instead.
   #
   # The -a command line option will override the *first* port
   # number listed here. That option will NOT override an IP
   # address, however.
   #
   # You may specify multiple socket addresses on multiple lines.
   #
   # options are:
   # transparent Support for transparent proxies
   # vhost Accelerator using Host directive
   # vport Accelerator with IP virtual host support
   # vport= As above, but uses specified port number
   # rather than the http_port number.
   # defaultsite= Main web site name for accelerators.
   # urlgroup= Default urlgroup to mark requests
   # with (see also acl urlgroup and
   # url_rewrite_program)
   # protocol= Protocol to reconstruct accelerated
   # requests with. Defaults to http.
   # no-connection-auth
   # Prevent forwarding of Microsoft
   # connection oriented authentication
   # (NTLM, Negotiate and Kerberos)

   # tproxy Support Linux TPROXY for spoofing
   # outgoing connections using the client
   # IP address.
   #
   # If you run Squid on a dual-homed machine with an internal
   # and an external interface we recommend you to specify the
   # internal address:port in http_port. This way Squid will only be
   # visible on the internal address.
   #
   # Squid normally listens to port 3128
   http_port 3128 transparent

   Disini kita set proxy aktif di port 3128 dan transparent.
   Langkah yang disiapkan yaitu :
   1. Lakukan redirect akses yang bertujuan di port 80 ke port 3128 (port proxy)

   iptables –table nat –append PREROUTING -i eth1 -p tcp –dport 80 -j REDIRECT –to-port 3128

   printah ini bermaksud melakukan aturan dalam iptable agar paket tcp yang tujuannya port 80 diarahkan ke port 3128 (proxy server). Perintah ini bisa di tambahkan dalam scrip di pembuatan gateway diatas.

   2. Uji coba proxy
   2.1. Ujicoba dengan browser

   Dari browser di komputer client dengan isian proxy di kosongkan (tanpa proxy) lakukan browsing ke www.uii.ac.id

   2.2. Apabila gagal, coba lakukan pengujian dengan telnet, “telnet 192.168.210.1 80″

   telnet 192.168.210.1 80
   Trying 192.168.210.1…
   Connected to 192.168.210.1.
   Escape character is ‘^]’.

   kemudian tuliskan alamat website yang akan dibuka, misalnya www.uii.ac.id
   get http://www.uii.ac.id

   maka berikutnya akan muncul isi text dari www.uii.ac.id

2.3. Apabila 2.2 berhasil membuka alamat website dengan port 80 akan tetapi 2.1 gagal, maka perlu diperhatikan sebagai berikut :
- Alamat gateway komputer client harus ke 192.168.210.1
- Alamat DNS server harus betul dan bisa berfungsi, apabila kosong/ tidak berfungsi maka tidak akan bisa browsing