HomeServer Part 5 - Initial configuration

In this instalment of the HomeServer series we will do the initial configuration of the HomeServer which will turn it into a working Firewall/Router.

Network interfaces

Only eth0 is configured properly. Eth1 is recognized by the kernel module and brought up but as it is not connected, it is not getting configured in the network configuration sub system. Luckily this is fairly easy to do.

Edit the file /etc/network/interfaces in your favorite editor. Remember to sudo your edit command. Otherwise the file is read only.

Leave the lo entry as it is. No reason to tempt fate by changing this.

Clone the eth0 entry and rename the device identifier with eth1. The config file should look something like this (bar the lo lines):

auto eth0 # Bring up eth0 automatically
iface eth0 inet dhcp # eth0 is an inet (TCP/IP) v4 based interface
# (as opposed to inet6 (TCP/IP v6), IPX etc protocols)
# It gets its network address, netmask, gateway,
# broadcast, DNS, etc address information from a
# DHCP server

auto eth1 # Bring up eth1 automatically

iface eth1 inet static # eth1 has a static address assigned by us
address 192.168.2.1
netmask 255.255.255.0

Then you can bring up eth1 by running ifconfig:

#sudo ifconfig eth1 up

DHCP Server

I Selected to install the dhcp3 server in my HomeServer. The configuration file for this server is located at /etc/dhcp3/dhcpd.conf. Open the configuration file with root capabilities and edit the following lines:

Comment out the ‘option domain-name’ line for now.

Uncomment the ‘authoritative’ line as our HomeServer is supposed to be the authoritative DHCP server on our local network.

Append the following lines at the end of the file to set up our network topology.

# Outside network (on eth0). No service provided
Subnet 10.0.0.0 netmask 255.255.255.0 {
}

Our sample network is 10.0.0.0 with a network netmask of 255.255.255.0. Please contact your ISP for the details of your setup. We are not going to provide any service to this network. We are just informing the dhcp daemon that it exists.

# Local network (on eth1)
subnet 192.168.2.0 netmask 255.255.255.0 {
range 192.168.2.129 192.168.2.250;
option routers 192.168.2.1;
}

If you have additional nets please add them accordingly, using the above as a template.

Back to the global variables in the beginning of the file. Change these lines to your suit your setup. If you like you can change the ‘option domain-name’ line. Please note that this will not change internet behavior outside of your local setup. I would advise you to raise the lease time to something close to 12 or more hours. Remember to add your domain name servers with the ‘option domain-name-servers’ line :

Option domain-name-servers x.y.z.q1, x.y.z.q2;

Add as many as you like that are available to you.

Shoreline Firewall (Shorewall) minimum setup

The configuration files for Shoreline Firewall is not ready in the /etc/ structure. You need to copy the appropriate default files and edit them to suit your setup. As our initial setup is a two interface setup we copy the default files from /usr/share/doc/shorewall/examples/two-interfaces like this :

#sudo cp /usr/share/doc/shorewall/examples/two-interfaces /etc/shorewall

This will copy all necessary files plus the file README.txt. For now I am keeping this file as its contents remind me which default setup I have copied.

Modify the Shorewall policy file (/etc/shorewall/policy) to allow the firewall machine (our HomeServer) to access the net. We need this in order to update our ubuntu installation. Change the line :

$FW net REJECT info

to

$FW net ACCEPT

I decided to comment out the old line to preserve what the default setting is in my config file, copied and modified the copy. Remember to remove the info keyword to avoid your log file being cluttered with lines stating that your firewall accessed the internet.

Initial configuration of Shorewall is now done. We will have to modify the Shorewall setup to allow access to our services, e.g. Samba (providing SMB - Windows File Server protocol), Apache (webserver), MySQL (relational SQL data base server) etc. running on the HomeServer.

We are not yet quite done setting up shorewall. Remember to enable startup in the /etc/shorewall/shorewall.conf file; edit the line:

STARTUP_ENABLED=No

to =Yes

Remember to allow Shorewall to be started on debian based systems (ubuntu and its cousins are based upon debian). Modify the file /etc/default/shorewall line:

startup=0

to =1

Remember to compile and start shorewall:

#sudo shorewall start

To check whether the rules has been set up use the command

#sudo iptables –L

Congratulations! You now have a working Router/Firewall setup – the first step on our road to a HomeServer!

Next time we will have a go at setting up the Samba server which provides the SMB protocol for serving files to Windows clients.

HomeServer Part 4 - Installation

A few things has changed during the last 5-6 weeks. I have been able to aquire some used parts to upgrade my HomeServer project. Thus the Hardware setup for this project is as follows :

CPU Pentium 4 2.4 GHz
RAM 640 MB DDR Ram
Motherboard Intel 845 Desktop Motherboard
NICs 2 x D-Link DGE-628T Gigabit
Graphics board GeForce 2 MX
TV Tuner BrookTree 878 Based card
Hard disk drives 160 GB Seagate Harddisk ATA
Optical drives 20x Lite-On DVD-RW drive
Power Supply Unit Trust 520W Pro PSU Low Noise Big Fan
Computer case Full Size “server” tower with

• 3 internal 3.5” hdd bays
• 1 external 3.5” floppy bay
• 5 external 5.25” bays

The Graphics board and the TV Tuner are probably the oldest parts in this setup. The graphics board is mainly there because I need it during the initial install. Also most systems will not start without a Graphics board. The TV Tuner board is one that I have sitting idle in my desktop computer so the plan is to get some sort of Media Server part up and running too.

The optical drive was used for installation purposes as well and will be used in my backup plan. The current hard drive will serve both as the boot drive and main storage drive. I was contemplating whether I should partition it with one big root (/) partition and one /home partition or if I should keep a smaller root (/) partition together with /var and /usr partitions. I decided that a big root (/) partition was the way forward as it would allow for both root (/) /var and /usr to grow unproportionately without running into the situation where one partition lacks space and another has plenty of unused blocks.

Future hardware plans:
S-ATA RAID Controller
Hard disk drives 2 x 320 GB (at least) S-ATA in RAID 1 for /home user files

To safeguard personal data such as digital photos, documents, etc I plan to add a RAID 1 array based upon Serial ATA drives. This will, with the backup procedure safeguard important files. If a disk in the RAID 1 array fails, it will continue to run on the other drive. The faulty drive can be replaced and the RAID 1 array will recreate itself onto the new disk. Theoretically this should be possible online, on the fly so that both Data and Server is available as much as possible.

When the RAID 1 array is added it will host the user files in their /home directories. The main /home partition will then host the semi-volatile files such as MP3s created from our CD etc. collection.

Software:

Operating System Ubuntu 7.10 “Gutsy Gibbon” – server edition

Kernel Ubuntu vanilla kernel 2.6.22

Just shortly before I assembled the hardware, Ubuntu 7.10 code name “Gutsy Gibbon” was released (on oct. 18^th 2007) so I decided to go with the server edition of this new Ubuntu. If you want long term support, or you are simply not comfortable with using the latest version and would rather go for the tried and tested version, I suggest You try the LTS version available to you (6.06 code name “Dapper Drake” at the time of writing this).

Ubuntu detected the IDE controller as a SCSI controller and gave the boot drive the designation /dev/sda.

The drive was partitioned into three parts :
Partition Mount point Type Size
sda1 / ext3 15 GB
sda2 swap 2 GB
sda3 /home ext3 143 GB

The Ubuntu server installer installed the core system. In addition I selected to install the following extra packages:

• OpenSSH server - to allow remote system administration
• LAMP server - Linux, Apache, Mysql, PHP. This will allow me to run easy web based administration modules as well as provide a test and development bed for web development.
• Samba file server - to provide remote file storage for windows boxes
• NFS file server - to provide remote file storage for *nix (mainly Linux) boxes
• DHCP server - to provide network management
• Shoreline Firewall - to provide protection from outside (and inside) attacks

During the install I selected to add just one user (jan). I will add more as they are needed. Remember that Ubuntu allows this admin user account to act as root by preceeding the commands with the command sudo. You will be prompted with a request for your password if you have not done sudo within the last 15 minutes.

I also added the procinfo, make, gcc and linux-source packages. Procinfo to provide process etc info. Make, gcc and linux-source to allow me to finetune the kernel on the server as well as other applications.

Next Blog will be on the initial configuration of the HomeServer

Long time no see ...

I have been absent from my blog for more than a month. My apologies. Other things out there in the physical world has demanded my presence in a way that I have been unable and/or unwilling to spend time writing blogs.

I should be back on track, submitting at least a few blog posts every week.

HomeServer part 3

I have been away from the post a couple of days. Other things had more urgency and/or priority.

Continuing on the HomeServer project:

I have had a look at the harddisk which will hold the very first instalment of the HomeServer project and although I thought I had an 8 GB drive it seems that it is only a 4.3 GB drive. This does not stop the project as this - initially - is more than we need.

Software needed:

first off we need a base on which to build everything on. As this blog is on Linux you have probably guessed that I will not choose Microsoft Windows (tm) for this project. But almost any *nix would be an excellent choice. Maybe one of the *BSDs around would have been the obvious choice but as I have no experience on BSD I would rather not choose that. Which leaves us with ; Linux.

I have tried a few Linux distributions and they have all had their contribution to making Linux a better product. But I am going to select ubuntu (http://www.ubuntu.com) for the job. This choice is made on the basis of three major reasons.

1. ubuntu is based upon debian which has a reputation of a conservative but rock solid distribution that is well proven and tested. Ideal for a server
2. ubuntu has newer versions of software bundled than debian. You might say that ubuntu is a solid performer with an edge.
3. ubuntu uses the .deb packaging system for updates.


The firewall
Linux has built-in firewall and routing capabilities right out of the box, ipchains up to kernel 2.4 and iptables since the 2.3 kernel series. administering netfilter though can be quite tricky and complicated.

I am currently researching shorewall and will post my findings in a later blog.

HomeServer Part 2 - Planning continued

The requirements for my particular HomeServer are as follows:

• Firewall (including routing of possible multiple networks)
• Virtual Private Networking
• E-mail scanning
• Intrusion Detection
• SMB storage for Windows boxes
• NFS storage for *nix boxes
• Backup of above storage
• HTTP Proxying
• Web server with server side scripting (for administration module + development of dynamic web pages)
• Database (for development of database driven websites)

Hardware requirements:

The firewall in itself does not require much in system hardware. My Pentium 133 had only 32MB of memory and an 8 GB harddrive. and it had an idle rate of more than 98 per cent. Running multiple VPN connection *will* need processing power.

The HTTP Proxy database and the webserver will need plenty of memory - the more the merrier.

The storage area (which will be accessible from both *nix (NFS) and (Windows) needs space and preferably the infrastructure to run with some kind of redundancy. Again the more memory that is available, the bigger th chance will be that the required piece of storage will be in memory.

Backup will be burned onto CD and DVD.

As I don't have any funds that will influeence the hardware setup. The current storage is an 8 GB harddrive. the CPU an older Pentium

Personal note : I will be out all day tomorrow attending a wedding so there will only be a small blog if any.

HomeServer Part 1 – Planning

When you want to have yourself a (new) server you can always just jump into action without planning ahead and just making decisions as the need arises. But if you decide to plan ahead, you will find that everything will run smoother and that there will be fewer areas which you will not have thought through or even completely missed.

Of course you will not be able to foresee all problems and challenges but alone the act of planning systematically will reduce the number of problems, their severity and the challenge of overcoming them.

It will also help you with the schedule and quality control of your project.

The plan should contain the goal or mission of your project. You need to defind a main goal and perhaps some secondary goals. Each of these can then be divided into sub goals that when all fulfilled will fulfill the main goal. Each of the sub goals can then again be divided into sub goals. Keep dividing the goals ‘till you each is well defined and have a measurable fulfillment requirement.

This technique is also called divide and conquer.

Now this document of goals and sub goals is not set in stone, once you have written it. As you work your way through your project you may find, that you need to amend, add, refine, etc these. This is in itself not a failure merely a reflection of a changing world as well as your acquiring more knowledge and skills

To put this technique into practice in our little project we can define the following super, main and secondary goals:

Project : HomeServer

Super goal :

• Support and secure the IT needs of a SOHO(Small Office/Home Office)
  

Main goal :

• Secure the local network from attacks coming from both the internet and the local network (ie Firewall/routing , perhaps email-scanning)

Secondary goals :

• Provide easy and secure storage of data (Fileserver and Backup of data)
• Easy administration

If we break down the main goal into sub goals this could be:

Main Goal : “Securing the local network from attacks”

• Firewalling : Define rules for packets going through our system. Which ones will we allow? What to do with the ones we will not allow?
  
• Routing: In case of multiple networks (ie in larger setup); which packet goes where? Differentiated rules for different networks; secure, intermediate, open networks, DMZ (DeMilitarized Zones) for public or intranet services.
  
• Intrusion Detection: Help prevent our system of being compromised and aid in the investigation of attempts and incidents of intrusion.
  
• Virus protection: Scanning of incoming and outgoing mail, scanning of storage for Vira, SpyWare, Trojans etc.

Secondary goal: “Provide easy and secure storage”

• Provide Windows boxes (and other boxes) with remote storage. (e.g. through Samba)
  
• Provide *nix boxes with remote storage (e.g. through NFS)
  
• Provide regular and reliable backup of remote storage
  

Secondary goal : “Easy Administration”

• Provide a simple interface accessible on many platforms to administer and supervise the system tailoring the information level to the given user.

In part 2 we will continue with the planning making it more detailed and concrete with our project in mind.

Later parts will include choice of hardware, software and policies. We will also take a look at setting up (some of) the software chosen.

New Firewall?!?

As my trusty old Pentium 133 died not too long ago I am in the process of building a new firewall. The old firewall is temporarily replaced by a 700 MHz Celeron running with the same harddrive and setup that ran on the 133.

The 133 had a friend in a 233 Pentium MMX which did the fileserving, http-proxy etc job. Both of these are now retired and in the process of being replaced by a single machine. Until I get my hands on some new hardware the semi old Celeron (bought back in 1999 or 2000) which is actually my parent's machine will perform as a stand-in.

The old firewall/server pair ran Debian with 2.4_bf kernels. And as the Celeron just "inherited" the disk from the old firewall it still runs the 2.4 Debian kernel. When time allows I will be building a new boot drive to replace it. This drive will replace the Debian now running on the interim 700 MHz celeron. It will also be the boot drive of the new system.

The choice of distribution for the new firewall/server machine will be ubuntu server. I am not quite sure if it will be the 7.04 or the older 6.06 LTS(Long Term Support) version. I have decided to switch to Ubuntu as it ;

1. Builds upon the Debian distribution which is well-known for its stability
2. Includes newer versions and newer alternatives to the Debian Stable branch

My initial focus will be on the firewall as this machine will be the test bed of firewall implementations that I will do in the future. One of which will be the net cafe.

The hardware for the future firewall/server wil most likely be a socket 775 celeron on a MSI motherboard with Intel chip set. the plan is to make a smallish boot disk (80GB) and then use a RAID 1 system to hold the data in the /home tree.

More tomorrow on the setup that I am planning for this machine.

Welcome to my blog

Hi and welcome to my blog on Linux!

This blog will contain ramblings, tips, etc about and my experiences with Linux.

I have been using Linux for more than 6 years now and have had some experience with using it but little experience programming on the *nix platform. All this will change soon enough.

My Linux use has been both as a desktop and for server purposes both at home and at a few (small) installations that I have had the joy to administer.

Currently I am admin'ing a small internet cafe. This setup comprises of Windows machines (Win XP Home) as client machines, (Windows XP Home and Windows XP Professional) as administrative machines and Linux machines as server and firewall.

This cafe runs the SmartLaunch [SL] system (http://www.smartlaunch.net) which uses Windows as its platform for both clients, admin and server machines. The client machines needs to run Windows as they run the games that the public wants. The admin machines will most likely keep running on windows as this is what most of the employees know. My plans for the server is to move it to a Linux machine, that will partly run Samba to serve the WinBoxes with files, MySQL to serve the [SL] server with an SQL service and then I would like to move the [SL] server itself to a VMWare Virtual Machine running WinXP Pro on a Linux host OS.

Later a dedicated Gameserver for hosting CounterStrike, Day of Defeat, etc based games wil be added.