Friday, November 20, 2009

NFS on Debian/Ubuntu

Installation of NFS on server

Considering how powerful NFS is and the flexibility it gives you it is amazingly simple to set up. I expected it to be on a par with setting up Samba which can be a complete nightmare. Typically when setting up Samba one would use Swat or another configuration tool. With NFS set us is as easy as entering the paths you want exported into /etc/exports and making sure the correct packages are installed.

There are two implementations of NFS one runs in kernel space (nfs-kernel-server) the other in user space (nfs-user-server). The kernel space implementation is faster and more stable but if something goes wrong it could bring your box down. In reality the kernel space NFS implementation very rarely fails. I have been running it for years (and on at least one occasion for 150 days straight) and have had it fail only a couple of times. The times it did fail it simply needed restarting. In fact the only way I have even managed to get it to make a noise is when I had a box with a network card that was on the way out. The port on the card was bad which caused it to repeatedly drop and re-aquire the network sometimes several times a minute. After a few hours of that NFS would sometimes start to refuse new connections.

As well as the server you will need portmap. Fortunately if you chose NFS when you first installed the server you will have all the required packages already installed, configured and running.

One important point to remember when setting up NFS is to make sure that the user id (uid) of the user on the server matches the uid of the user on the local machine. NFS has no way of mapping "fred" on the local machine to "fred" on the server other than by relying on the uids being the same. Typically when you create a user the uid given is just the next one available but you can specify it explicitly.

Once you have made the required entries in /etc/exports you need to tell the NFS server about them. Typically I restart all three required utilities (portmap, nfs-kernel-server and nfs-common) as it is generally the best way to make sure everything is working correctly. See the section below on restarting NFS.

Step 0: Installation of NFS-server and NFS-client
Server:
# apt-get install nfs-kernel-server nfs-common portmap
Client
apt-get install nfs-common portmap

Step 1: Export directories on server
At server machine, export the directory in /etc/export file
# /etc/exports: the access control list for filesystems which may be exported
# to NFS clients. See exports(5).
/home 192.168.0.0/26(rw,sync)


Step 2: Restarting NFS on server

nfs-server:/samba#/etc/init.d/portmap start
nfs-server:/samba#/etc/init.d/nfs-kernel-server start
nfs-server:/samba#/etc/init.d/nfs-common start


Verify NFS is runnning
nfs-server:/samba# rpcinfo -p
program vers proto port
100000 2 tcp 111 portmapper
100000 2 udp 111 portmapper
100004 2 udp 878 ypserv
100004 1 udp 878 ypserv
100004 2 tcp 881 ypserv
100004 1 tcp 881 ypserv
100009 1 udp 880 yppasswdd
600100069 1 udp 883 fypxfrd
600100069 1 tcp 885 fypxfrd
100007 2 udp 892 ypbind
100007 1 udp 892 ypbind
100007 2 tcp 895 ypbind
100007 1 tcp 895 ypbind
100003 2 udp 2049 nfs
100003 3 udp 2049 nfs
100021 1 udp 32868 nlockmgr
100021 3 udp 32868 nlockmgr
100021 4 udp 32868 nlockmgr
100005 1 udp 709 mountd
100005 1 tcp 712 mountd
100005 2 udp 709 mountd
100005 2 tcp 712 mountd
100005 3 udp 709 mountd
100005 3 tcp 712 mountd
100024 1 udp 32869 status
100024 1 tcp 58711 status


Step3: Mounting NFS drives on Client
Add location with drive and options.
:  nfs  0 0

# Mounts from other hosts

nfs-server:/home /home nfs rw,rsize=32768,wsize=32768,hard,intr,async 0 2


Mount also on command line
client:/# mount -t nfs nfs-server:/home /home

Verification of mounting the drive.
On Client verify the mount point

client:/# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 2.8G 2.1G 578M 79% /
tmpfs 126M 0 126M 0% /lib/init/rw
udev 10M 52K 10M 1% /dev
tmpfs 126M 0 126M 0% /dev/shm
nfs-server:/home 123G 105G 12G 90% /home



Reference
http://www.crazysquirrel.com/computing/debian/servers/nfs.jspx
http://www.debianhelp.co.uk/nfs.htm

Monday, November 9, 2009

Upgrading Subversion in Ubuntu 9.10 server

Step 1:Install the subversion
apt-get install subversion libapache2-svn

Step 2: Create the repository

svnadmin create /svn

Configuration
Edit the directory
/etc/apache2/mods-enabled/dav_svn.conf


# Uncomment this to enable the repository,
DAV svn
# Set this to the path to your repository
SVNPath /svn
# Uncomment the following 3 lines to enable Basic Authentication
AuthType Basic
AuthName “Subversion Repository”
AuthUserFile /etc/apache2/dav_svn.passwd

Require valid-user


Save and exit the file

Creation of user
htpasswd -cm /etc/apache2/dav_svn.passwd imran
New password:
Re-type new password:
Adding password for user imran

Enable ssl (if required)
#a2enmod ssl

This will enable the ssl if you have problem to set it.

Migration
Export by :Dumping the existing repository
root@jupiter:/svn# svnadmin dump svn > reposdump.dmp
Import by:
root@saturn:/srv# svnadmin load srv-jupiter < /home/imran/reposdump.dmp

Tuesday, November 3, 2009

Intrusion Detection (Snort) fixation in IPCOP Firewall 1.4.21

After installing the IPcop got the following error messages

When running update the Error is:
HTTP::Response=HASH(0x82a3c14)->code registered md5
When running download the Error is:
HTTP::Response=HASH(0x82a3c68)->code

The reason is that now snort.org publish rules now on current branch that are no more compatible with snort-2.6.1.5
We have manually add the current branch, to - date it is 2. You can find on snort if you have your account on snort.org under My Account-->My Oinkcodes along with the code (You must have account at snort to access code and use snort in IPCOP).

Here is a solution, it is a manual fixation in the code.

Open the /usr/local/bin/snortrules.pl in and editor.
root@firewall:/etc/snort # nano /usr/local/bin/snortrules.pl
Change the value to 2.8 at line no 55.
my $rulesbranch="2.8"; # version should match snort branch version

Save the change.
Remember you must have to add the oink code in IPCOP--> Services-->INTRUSION DETECTION.
Save-Apply-Refresh update list-Download Rullset.

It should work, no update rull-set failure or MD5 checksum error.

https://www.snort.org/
http://www.howtoforge.com/perfect_linux_firewall_ipcop