Category Archives: Linux

The Linux Category actually encompasses *BSD, RH, Fedora, Ubuntu, and the like.

Proxmox Parted

I was setting up a proxmox server at home (my “budget committee” approved the purchase) to replace a few aging servers:

FreeNAS1 2.5GHz Pentium DualCore 1GB RAM 5x 1.5TB
FreeNAS2 2.5GHz Pentium DualCore 2GB RAM 2x 500GB 2x 750GB
Proxmox1 2.6GHz AMD X2 4GB RAM 1x 160GB
Firewall 2.5GHz Pentium DualCore 2GB RAM 1x 160GB
Esxi 2.6GHz Pentium DualCore 8GB RAM 2x 1TB

With:

Prox1 Dual 2.4GHz Xeon 32GB RAM 2x 80GB 2.5″ SATA (non-Hotswap) 8x 2TB 3.5″ SATA in RAID50

I think the IPMI alone makes this worth while. Current power draw for the old machines is around 440 watts. Current draw for the replacement server is 415 watts, but that’s without much load. So power savings will be negligable.

So anyway, I had a couple issues with my idea that I needed to fix before making this production:
1. Proxmox uses GRUB bootloader, which means I cannot have a boot drive larger than 2TB in size. My fix was to install a pair of 2.5″ 80GB laptop drives to be the boot drives.
2. Proxmox will not install on a software or motherboard RAID from the standalone ISO. I set the BIOS to boot off the laptop drives only, same issues applied. I had to install proxmox with the RAID card removed from the system, and on a single card.
3. Fdisk does not support GPT. As old-school as I am, I guess I’ll have to ditch fdisk and learn parted.

I know I could have just carved out an additional LUN or even partitioned before installing proxmox to fix the first issue. But I wanted a single LUN for storage only, and it should be the entire 12TB raw. As far as the second issue, there is an install path that allows you to install debian before proxmox, which would then allow you to setup on the soft raid. I’m still tempted to go this route as it’s generally better to have two drives instead of just one. As I’m currently running proxmox 2.Beta, I think I still have a little time to decide.

**NOTE**
EXT3/4 supports up to 16TB of storage per partition!

List Current Mounted Partitions
df -h

List all disks available
fdisk -l

In my case I had the RAID listed as /dev/sda and the single boot drive as /dev/sdb so don’t get these confused!

Install Parted
apt-get install parted

Run Parted on the drive
parted /dev/sda

Change the filetype to GPT
mklabel gpt

Verify the disk geometry
print

Now I created 2x 6TB partitions to see how it would work
mkpart primary ext3 0 6000000
mkpart primary ext3 6000000 12000000
It looks like you can run mkpart primary ext3 0 -1 to utilize the entire drive

Quit parted
quit

Make the ext3 filesystem (with 1% reserved)
mkfs.ext3 -m1 /dev/sda1
mkfs.ext3 -m1 /dev/sda2

Make the mount directories
mkdir /mnt/sd1
mkdir /mnt/sd2

Mount the drives
mount /dev/sda1 /mnt/sd1
mount /dev/sda2 /mnt/sd2

Verify the drives are mounted
df -h
You should see /dev/sda1 and /dev/sda2 with 6TB each now

Add to fstab so they mount on boot
nano /etc/fstab

/dev/sda1 /mnt/sd1 ext3 defaults 0 0
/dev/sda2 /mnt/sd2 ext3 defaults 0 0

Save and quit

Reboot and verify all is well!

Opendedup Ubuntu

After playing around with ZFS for a while (it’s pretty nice, especially snapshots), I wanted to try non-solaris-type-deduplication. Opendedup was the answer.

I installed on a 2.8GHz Xeon Dell Poweredge 850 with 2GB RAM, and a mirrored array 500GB SATA drives.

Installed 10.04.3 LTS x64

Upgrade the Server
apt-get dist-upgrade
reboot

Install and Download
apt-get install openjdk-6-jre
apt-get install attr
wget http://opendedup.googlecode.com/files/sdfs-1.1.0_amd64.deb
wget http://opendedup.googlecode.com/files/sdfs_fuse_2.8.4.tar.gz
tar zxvf sdfs_fuse_2.8.4.tar.gz
cd sdfs_fuse_2.8.4
dpkg --install *.deb
apt-get install -f
dpkg -i sdfs-1.1.0_amd64.deb
apt-get install -f

Edit
nano /etc/security/limits.conf
Add the following above # End of file:

soft nofile 65535
hard nofile 65535

Create
/sbin/mkfs.sdfs --volume-name=VOLUMENAME --volume-capacity=CAPACITY
So in my case I wanted a 10GB volume for testing:
/sbin/mkfs.sdfs --volume-name=volume1 --volume-capacity=10GB

Mount
mkdir /mnt/volume1
/sbin/mount.sdfs -v VOLUMENAME -m MOUNTPOINT
/sbin/mount.sdfs -v volume1 -m /mnt/volume1

Verify
df -h

sdfs:/etc/sdfs/volume1-volume-cfg.xml:6442
10G 0 10G 0% /mnt/volume1

I then copied about 2GB worth of data. Looks like it parses through every 10 minutes or so – but since it’s the end of the day I’ll be checking in the morning.

There are a few common errors with simple fixes.
1. OutOfMemoryError – This is caused by the size of the DedupStorageEngine memory requirements being
larger than the heap size allocated for the JVM. To fix this edit the mount.sdfs script and increase the
-Xmx2g to something larger (e.g. -Xmx4g).

The files are actually stored in /opt/sdfs/volumes/VOLUMENAME
du -hc
Compare to df -h
df -h

In my example:
df -h
10G 5.4G 4.7G 54% /mnt/volume1
du -hc
3.1G total

So I’m using 5.4GB of space, but it’s only recorded as 3.1GB. Not a bad savings right there.

Next I’ll fill up the 10GB drive I created and see how much it really saves.

So I wanted a second volume shared for vmware using NFS. I ended up installing webmin and doing some of the configuration there for samba/cifs and nfs, but here’s my notes for commands on the opendedup server:

apt-get install nfs-kernel-server
nano /etc/exports
Add /export/volume2 *(insecure,no_subtree_check,rw,nohide,fsid=0)
/etc/init.d/nfs-kernel-server restart

Delete a Volume
If you ever need to delete a volume, make sure that you unmount it first:
umount /mnt/volume1
Then you can remove the data files:
rm -rf /opt/sdfs/volumes/volume1
The log files:
rm /var/log/sdfs/volume1*
And finally the configuration files:
rm /etc/sdfs/volume1*

Show Volume Info
/sbin/sdfscli --volume-info

OpenIndiana PE2650

I attempted to install OpenIndiana 151a on a Dell Poweredge 2650 server (2.8 xeon with 12gb ram, 5x 146SCSI, damn 3di controller). I put each disk into it’s own container on the controller and left the BIOS set to RAID.

I was receiving the following errors when attempting to install:

WARNING: Ignoring false simplex bit.
WARNING: Ignoring false simplex bit.
WARNING: /pci@0,0/pci-ide@f,1/ide@0 (ata0):
timeout: abort request, target=0 lun=0
WARNING: /pci@0,0/pci-ide@f,1/ide@0 (ata0):
timeout: abort device, target=0 lun=0
WARNING: /pci@0,0/pci-ide@f,1/ide@0 (ata0):
timeout: reset target, target=0 lun=0
WARNING: /pci@0,0/pci-ide@f,1/ide@0 (ata0):
timeout: reset bus, target=0 lun=0

IDE @ 0, the only IDE device I had was a CDROM drive. I figured it was a bad burn of the ISO – I verified the MD5 of the ISO I downloaded was correct, then I burned it again to CD (at 8X instead of 24X, just in case). Same issues persisted.

Looks like I need to disable DMA on the IDE channel to get this to work.
edit the grub configuration and add this at the end of the Kernel:
-B atapi-cd-dma-enabled=0,atapi-other-dma-enabled=0
Then run from that

I also ran the napp-it plugin:
wget -O - www.napp-it.org/amp | perl

Nexentastor Community edition did not want to run reliably on this hardware. I know it’s only 32-bit, so that is probably part of the issue. EON was just a giant pita for me, so I dropped that. FreeNAS was easy to setup but lacked on the ZFS support I wanted.

Find Files Ubuntu CLI

I don’t forget this, but I do have to teach people from time to time. Easiest way I know:
find / | grep FILENAMEYOUWANTTOFIND

so
find / | grep index.php

To find a file with certain words in the file:
grep -r ‘word or words you want to find’ /path/to/files/
grep -r ‘‘ /var/www/

Proxmox VLAN

Perhaps I’m just a little slow, but this one took me a while to figure out. I know there’s a lot of documentation floating around, but none of it seemed to work for my environment.
I was given a Dell PowerEdge 2950 server (2.5″ SAS backplane) with 8x 2.5″ 147GB 10KRPM SAS drives. It only had 16GB RAM so I upgraded to 32GB. Set the RAID to 10 (588GB raw) and away I went. I was also given a Cisco 2950 switch to play around with.

First I installed vmware esxi 4.1 (I know 5.0 is already out, but I already had an older server running esxi41 and wanted to keep them roughly the same). I then realized the free hypervisor didn’t include many features I was used to (Live migrations is huge in my book). For shame.

It was then that a fellow worker wanted to install Server 2008 R2 with hyper-v. For shame.

I like free, and I like a lot of the features of KVM, so I went with Proxmox 1.9.

I plugged eth0 into port 21 (vlan 40) for management
I plugged eth1 into port 5 (trunk) for trunking

Here’s my proxmox networking config (/etc/network/interfaces)
* as this didn’t like my tabbing, here’s a link to the txt file*

# LOCALHOST
auto lo
iface lo inet loopback

# INTERFACES
iface eth0 inet manual
iface eth1 inet manual

# PRIMARY BOND
auto bond0
iface bond0 inet manual
slaves eth0 eth1
bond_miimon 100
bond_mode 4

# SECONDARY BONDS
auto bond0.40
iface bond0.40 inet manual
vlan-raw-device bond0

auto bond0.10
iface bond0.10 inet manual
vlan-raw-device bond0

auto bond0.20
iface bond0.20 inet manual
vlan-raw-device bond0

auto bond0.30
iface bond0.30 inet manual
vlan-raw-device bond0

# BRIDGES
auto vmbr0
iface vmbr0 inet static
address 10.4.0.216
netmask 255.255.255.0
gateway 10.4.0.5
bridge_ports bond0.40
bridge_stp off
bridge_fd 0

auto vmbr1
iface vmbr1 inet manual
bridge_ports bond0.10
bridge_stp off
bridge_fd 0

auto vmbr2
iface vmbr2 inet manual
bridge_ports bond0.20
bridge_stp off
bridge_fd 0

auto vmbr3
iface vmbr3 inet manual
bridge_ports bond0.30
bridge_stp off
bridge_fd 0

And here’s my Cisco switch configuration (just for the ports used obviously):

interface FastEthernet0/5
description proxmox VM
switchport trunk allowed vlan 10,20,30,40
switchport mode trunk
spanning-tree portfast

interface FastEthernet0/21
description proxmox Management
switchport access vlan 40
spanning-tree portfast

Next I’ll be testing some iscsi server connectivity.

Well I went ahead and ran some initial tests:
POC server:
2.7GHz AMD x64, 4GB RAM, 160GB SATA 7200, 10/100/1000

CPU BOGOMIPS: 10772.71
REGEX/SECOND: 418377
HD SIZE: 36.67 GB (/dev/mapper/pve-root)
BUFFERED READS: 98.46 MB/sec
AVERAGE SEEK TIME: 11.16 ms
FSYNCS/SECOND: 573.28

Dell 2950 Production:
Dual 3.16GHz Xeon (X5460), 32GB RAM, 8X 147GB SAS 10000, Dual 10/100/1000

CPU BOGOMIPS: 50539.82
REGEX/SECOND: 1036781
HD SIZE: 94.49 GB (/dev/mapper/pve-root)
BUFFERED READS: 282.70 MB/sec
AVERAGE SEEK TIME: 5.22 ms
FSYNCS/SECOND: 1998.46

Still setting up the test iSCSI

Owncloud Ubuntu

I was recently tasked again to come up with a better solution than using dropbox. iFolder is great when it was working, at least from an IT perspective. The end users thought it was a little bit bulky and wanted something a little easier to use and understand. That’s when I saw owncloud – It had all the features of webdav without many of the headaches.

Owncloud is opensource – they even have packages for Ubuntu! I was excited.

apt-get install mp3info curl libcurl3 libcurl3-dev php5-curl zip build-essential
wget http://owncloud.org/releases/owncloud-1.2.tar.bz2
tar xvjf owncloud-1.2.tar.bz2
mv owncloud /var/www/
chown -R www-data:www-data owncloud/
**EDIT2** it’s now up to final 2.0 http://owncloud.org/releases/owncloud-2.tar.bz2

Browser to http://serveripaddress/owncloud
There is no LDAP setup quite yet. Maybe next revision?

Since I wanted to connect a windows machine to this server as a test, I setup a user and then attempted to connect to the webdav.
Unfortunately we require another piece of software to be installed to support owncloud:
http://www.netdrive.net/
NetDrive is free for personal use. Webdrive, a variant of NetDrive, is not free. If this gets approved by the PTB, then we’ll end up buying maybe 25 licenses (for developers).

After the install of netdrive and a reboot, you can connect to your owncloud server!
You may have noticed on the http://serveripaddress/owncloud site when you logged in as the administrator, you can see at the very bottom of the page:
“Hint: Mount it via webdav like this: webdav://address/to/your/webdav/here/owncloud.php”
You will need that entire address to connect using NetDrive.

After connection you will see your webdav drive as a shared drive on My Computer.

***EDIT***
Turns out that you don’t require this software. You can just edit a registry key and add it to you windows 7 machine without issues:
Start the WebClient service
Add the following key in regedit
HKLM\SYSTEM\CurrentControlSet\services\WebClient\Parameters
“BasicAuthLevel” set to “2”

Since this is an external/internal facing server, I had to secure it up a bit.
Firewall rule only allowing ports 80, and 443. SSH can be accessed internally only.

I edited the hosts file to deny all, and only allow certain ranges for my networks:
Hosts.deny

sshd:all

Hosts.allow

sshd:internaliprange/24 publicip anotherip

nano /etc/fail2ban/filter.d/apache-owncloud.conf

# Fail2Ban configuration file
# Author: TheLibrarie.com
# $Revision: 001 $
#

[Definition]

failregex = -.* 401 499
OR
failregex = -.*POST.*/index\.php
ignoreregex =

Test with the regex
fail2ban-regex /var/log/apache2/access.log /etc/fail2ban/filter.d/apache-owncloud.conf

As that worked, I put the following in my /etc/fail2ban/jail.local

[owncloud]
enabled = true
port = http,https
filter = apache-owncloud
logpath = /var/log/apache/access.log
maxretry = 5

/etc/init.d/fail2ban restart

I also noticed that someone could simply navigate to http://servername/owncloud/data and see all the usernames and then drill down into all of the files. Obviously a huge issue.
I edited /etc/apache2/sites-available/default to disallow directory listing for the entire site:
nano /etc/apache2/sites-available/default
Under “Directory /var/www/>” Change the following line from:
Options Indexes FollowSymLinks MultiViews
To
Options -Indexes IncludesNOEXEC FollowSymLinks MultiViews
apache2ctl restart

Final Thoughts:
After I run through some more testing on my end, I will unleash it to the QA department to hit the crap out of it. If it still passes testing, I’ll implement SSL. And then test again. Then release to the masses.

**EDIT3**
I’ve installed the 2b1 beta – there is LDAP, but I haven’t configured just yet. I had to write this down before I forget:
Change PHP to allow larger than 2MB file uploads

nano /etc/php5/apache2/php.ini
Search for “2m”
Change to 10m
Save, quit, restart apache

**EDIT4**
IE9 has some issues with compatibility mode for this software. I had to add this to the html meta portion (:
meta http-equiv="X-UA-Compatible" content="IE=9" /

**EDIT5**
I was having problems with downloading certain docx files – the server was thinking these were actually compressed archives. I had to edit the mimetypes.fixlist.php file with the following:
nano /owncloud/lib/mimetypes.fixlist.php
'docx'=>'application/msword',
ETC – add any other applications you require

Smooth-Sec

I’m a huge fan of free software. I’m not against compiling code, installing dependencies, or taking days to research fixes to my issues. So when I read about Phillip Bailey’s turnkey solutions, it makes me wonder how it’ll all work. Well, I’m here to say it DOES WORK WELL! Link to Bailey.

PBailey has released some snort-based turnkey solutions in the past (Snorby SPSA), but I really like the new solution SMooth-Sec.

After installing the software on an older HP DL320 G3 (P4 3.4 with 2GB RAM and dual 80GB SATA) I mirror one port on eth0 to the primary on the core switch

Switch#conf t
Switch(config)#monitor session 1 source interface Fa0/18
Switch(config)#monitor session 1 destination interface Fa0/2
Switch(config)#

Eth1 is then setup with a static IP on the management side (for access).
After letting this sit for about 30 minutes – the updates are run every half hour – I find that the number of results per hour are in the hundreds of thousands. Ut oh, it’s killing the server with load averages over 9.00

Edit out your external net

nano /etc/suricata/suricata.yaml
Find “EXTERNAL_NET” and change from $ANY to !$HOME_NET
Find “threshold-file” and uncomment this line
Save and quit

Now I also have a couple nagios monitoring servers around the network that are constantly sending traffic. So I needed to add these servers to the exemption list for suricata.
nano /etc/suricata/threshold.config

suppress gen_id 1, track by_src, ip 192.168.0.253
suppress gen_id 1, sig_id 366, track by_src, ip 192.168.0.252

It’s recommended to reboot the server after making changes.