linux

htop-web2

All in one webserver from the ground up. A Virtualized Debian How-to

2

< This is the only image you get, as this is going to be a very text centered post.htop-web2

I figured after virtualizing my entire network a few weeks ago and while learning alot, I also rebuilt several machines, and documented the rebuild. So from those notes, I’m going to finally get around to how to securely host and build a website, from the ground up.

We’ll start with a bare bones debian 6 install (this guide will work for ubuntu server 12.04 as well) on a virtual host.

I’m also using this guide as a walk-through for myself, so I’ve included the instructions on getting vmware-tools installed, if you’re doing this on bare metal, skip that part. :)

Most of this should be done as the root user. In ubuntu, to gain root use the command:

Also to get the basics out of the way I will be using nano as my text editor, to save in nano use the keys

or to save and exit use the command

I will assume you know how to save a file from this point forward.

To get started let’s get our environment setup, it makes life easier in the end.

Uncomment the lines in the root .bashrc file

Save and exit * I won’t be telling you this again, if the files done being edited, save and close it! :) *

Force your current session to use the new .bashrc file.

You should now have colors when displaying the contents of your directories and have a shortcut to restart apache once we have it installed.

But before we install the web server let’s finish getting prepped. (ubuntu users, don’t add the netselect-apt in the next command, it’s not available in your repos.)

If your curious on how any of these programs work in more detail, you can always turn to the “man” command. I do often, so I like my man pages in color. If you do as well, use this, and select the option that references “most” (usually 3 in my experience)

Now let’s create a normal user (ubuntu users will already have a normal user, and can skip this part)
*replace <yourname> with Your name.*

and then answer the questions it asks as best you want.

Now let’s also give this user the ability to manage this server using sudo.

Copy the syntax for the root user replacing root with your username from above.

Now Debian users with netselect installed, use this list of commands:

then

Now we can start installing the vmware-tools. First click the option on your vmware console to install tools or guest additions. This will insert a virtual cd-rom in your virtual machine. I know right!?! How deep DOES the rabbit hole go?! Anyways.

Welcome back :) Login as your normal user from here on out and gain root using “sudo su“. It’s just good practice.

Comment out the default settings for the eth0 interface as we want a static IP address for a server and add something like this (changing the values as needed for your network of course!)

Then restart your network.

You will probably get disconnected if you’re using ssh to connect. This is to be expected and you should now be able to ssh to the IP address you just set.

Now let’s set the hostname of the server.

And append the same name to the hostname file and restart the service.

Being ssh is probably going to be left open, let’s start to automate banning of brute force attempts for our ssh login (moving ssh to a non standard port is also a good idea!)

Setup the times and purge options as you see fit and then restart denyhosts.

And let’s FINALLY get to installing that webserver like I promised!

That’s it! your webserver’s installed! Now let’s configure it!

Now let’s build the config for the website you’ll be hosting.

There are alot of options you can define in here, but to get you started make sure you have the DocumentRoot, ErrorLog and CustomLog defined in this config file.

Using our example above, let’s create those directories.

And bring this site online, and remove the default site

Your website should now be online! w00t!

Let’s get the rest going so we can get something more dynamic then html websites.

Enter in a SQL root password when prompted. (SHOULDNT BE THE SAME AS YOUR ROOT PASSWORD!!!!!!!!!!!!!)

And let’s harden our SQL environment as this is not a developer server.

You don’t need to change your SQL root password if you set a good one above. if it’s the same as your normal root user’s password, change it ffs! Answer yes to the rest of the questions.

Now this next line will install php. Lot’s of php. This command should be entered in as one single line!

These settings will get you off to a good start, but more tuning can be done. Search for the following and make the needed changes in this file. (search in nano using “Ctrl+w” and typing in the keyword.

(You do remember you can type in ^ arestart ^ instead of that line throughout this gude if you used my .bashrc edits, right? ;) )

And of course a web-gui to your SQL server is super handy, so let’s add that as well.

Select apache2 when asked, and choose yes to create the default database. Enter in the SQL root password, and then leave the next password prompt blank to have a random one generated, as you won’t need it.

Almost done!

Let’s set the permissions on the folders we created.

And your set!

Let’s go one step further and setup a firewall to finish it up, just in case you’re not behind a seperate firewall (Check out untangle if you’re looking for a good one!)

This will install the “Uncomplicated Firewall” that works with iptables, and makes life alot easier!
For more help with ufw settings check out this guys site, it’s got a pretty good rundown and examples.

You should now get a result that says the following:

Of course this is the basic setup, you can further limit ssh to local connections only etc.

And your website is ready for stage 2, Content! You now have a memcached apache http server with php5 and mysql ready for the world wide web! Good luck!

(The stage 2 post will come soon!)

 

** EDIT **

After a few month’s with this setup I’ve started getting several mail objects that say:

This is a RAID status update from mpt-statusd.
The mpt-status program reports that one of the RAIDs changed state:

Report from /etc/init.d/mpt-statusd on virtual-proxy

Being it’s a virtual machine there’s no raid state to worry about (at least not from the guest side…) so unless you have a reason for it, just stop the mpt-status daemon. Do the following:

to stop it from it’s currently running state, and then

which will remove it from several startup scripts that run on boot.

That’s it, no more mail from that problem :) Hope your install is running as smoothly as mine has been!

Bob_Seger__The_Silver_Bullet_Band_-_Turn_the_Page-2012-07-28_03.45.08

Stream My Pi

2

Alright, so most of my friends already know, I’ve recieved one of my Raspberry Pi computers!

w00t!

So being my old love is streaming radio, I figured why not get this little guy pushing out some tunes for me!

MPD To the rescue!

Now I did a post for Ubuntu 10.04 a while ago where I had custom compiled a .deb file that included mp3 support, however the new version of MPD for the pi has it already built in! Double sweet!

So here’s how to get it started.

First install a few apps. I personally prefer ncmpcpp as my local client to control my MPD stream from the cli. And of course you’ll need to install MPD.

 

Type in “Y” when it asks if you would like to install the dependencies as well, let it run and install your requested apps.

Shucks, you’re already half way done!

Now you just need to configure your server (mpd) and client (ncmpcpp) to cut down on overhead I’ll just be using the built in httpd stream as well as the alsa mixer, however the config files are much more built out with better examples then they had on my last post, so configuring them should be quite simple these days.

In order to get MPD working as your local user “pi” in this case, we’ll first need to create some directories and files. Enter in the following commands one at a time from the pi user’s home directory.

That will create the “state” and “pid” file in your .mpd folder and the “cache” and “sticker.sql” files in your .mpd/db folder.

Now let’s backup the original mpd.conf file and then edit the original file.

You can copy it straight up if you like, as your username is most likely “pi” as well. I’ve set my default music folder to “/home/pi/Music” and Playlists to “/home/pi/Playlists” if you don’t have these directories either, go ahead and make them with the mkdir command, I’ll wait.

Alright, here’s my /etc/mpd.conf file (click it to expand, it’s kinda long):

I went and left all of the default comments in there, but of course if you want to make it more readable feel free to remove what you don’t use.

So, yea. MPD’s ready. Just restart it.

Now let’s get our client up and running so we can start playing some music!

This one’s a little more tricky as the default config file is hiding and compressed.

First let’s create the local config directory like we did for MPD.

and let’s copy the example config over to our new directory.

and then extract it.

Now go ahead and edit that file.

Again, these are the settings I used, but it’s well documented so feel free to make changes as well. Here is my config for ncmpcpp (again, click it to expand it, it’s even longer…)

So yea. That’s it! You should be up and running!

Start ncmpcpp in a tty with the logical command of “ncmpcpp” This will open the client app and allow you to start playing music! Being it’s a command line app, most of the work is done with keyboard commands. Press the number “1″ on your keyboard (NOT on the 10key if you have one to the right of your normal keyboard but the numbers above the qwerty row) and you will be shown a VERY long list of keyboard commands to control ncmpcpp, however the arrow and space and enter key’s will get you through most of it easily.

Plug it in to your amplifier, or better yet, grab your android phone and grab the free app called “MPDroid” it’s the best app I’ve found to interface with MPD. Now you can control your music from your phone, and get a stream of it sent TO your phone as well! No wires needed! (however it will be significantly buffered, so be patient when you first choose to start your stream)

Not too bad right!

Enjoy and if you have any questions, feel free to post a comment, here or in our forums, or even in my IRC hangout at italktomachines.com !

My Raspberry Pi and WiFi

Auto Start your WiFi on Raspberry Pi

7

So I just got my new Hawking HWUN3 USB wireless N adapter that I purchased for my Raspberry Pi, and wanted it to connect on boot being I only access it via SSH and to plug it in to a wired adapter in order to start the wireless connection so that I can unplug it just didn’t make sense. So here’s how I got it installed and starting on boot.

This network adapter is perfect, I didn’t need to compile a thing, it was recognized right out of the box. LOVE IT!

I ran ifconfig and it was right there, happy and waiting.

[codesyntax lang="bash" lines="no" title="ifconfig output"]

wlan0 Link encap:Ethernet HWaddr 00:0e:3b:1e:b8:4d
inet addr:192.168.0.51 Bcast:192.168.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:464 errors:0 dropped:0 overruns:0 frame:0
TX packets:267 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:68999 (67.3 KiB) TX bytes:40100 (39.1 KiB)

[/codesyntax]

Then you’ll need to do a little bash scripting, you can create a script in “/etc/init.d/” and then run “update-rc.d scriptname defaults” to install it, however I decided to instead just add it to the end of “/etc/rc.local” as this will run after everything else has already loaded after a reboot. Of course you can have init start your script at the end of the boot cycle (or anywhere in between) but the rc.local just takes less planning.

By default the “/etc/rc.local” file does nothing, but I left the existing code in and just commented it out. You can do what you like of course. Here is the contents of my rc.local file

[codesyntax lang="bash" lines="normal" title="rc.local"]

#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will “exit 0″ on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.

## Print the IP address
#_IP=$(hostname -I) || true
#if [ "$_IP" ]; then
# printf “My IP address is %s\n” “$_IP”
#fi

echo “Starting WiFi…”
wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant.conf
sleep .5s
dhclient wlan0
echo “WiFi should be started”

exit 0

[/codesyntax]

The code doesn’t actually do anything until line 18. On line 19 you’ll see that we’re starting the wpa_supplicant in the background (-B) for interface wlan0 (-i wlan0) using the configuration file found at “/etc/wpa_supplicant.conf” (-c)

We will need to create that file. Also I should note, wpasupplicant was already installed on my image, however if you need it installed, just issue the following command.

[codesyntax lang="bash" lines="no" title="install wpa supplicant"]

[/codesyntax]

now let’s create the ever important wpa_supplicant.conf file. This will hold your ssid name and pre-shared key (password) of course replace YOURSSID and YOURPASSWORD with your own info respectively.

[codesyntax lang="bash" lines="fancy" title="create wpa_supplicant.conf file"]

[/codesyntax]

and the contents of that file should look something like this:

[codesyntax lang="bash" lines="fancy" title="wpa_supplicant.conf"]

[/codesyntax]

That’s it! You should be connected! Go ahead and reboot, and then run iwconfig and you should be connected to your designated access point, all without using the GUI!

Here’s a pic of my pi, with the usb stick, and some ram heat sinks I picked up at Frys for like $10 ( and I still have 6 more lying around now.. guess I’ll need more pi!)

My Raspberry Pi and WiFi

And here’s a screen dump showing it recognized by my pi.

[codesyntax lang="text" lines="fancy" title="pi screendump"]

Using username “pi”.
pi@192.168.0.51′s password:
Linux raspberrypi 3.1.9+ #168 PREEMPT Sat Jul 14 18:56:31 BST 2012 armv6l

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.

Type ‘startx’ to launch a graphical session

Last login: Wed Jul 25 19:45:17 2012 from 192.168.0.119
pi@raspberrypi ~ $ iwconfig
lo no wireless extensions.

eth0 no wireless extensions.

wlan0 IEEE 802.11bgn ESSID:”editedformysaftey”
Mode:Managed Frequency:2.452 GHz Access Point: BC:C5:C3:6C
Bit Rate=65 Mb/s Tx-Power=20 dBm
Retry long limit:7 RTS thr:off Fragment thr:off
Power Management:on
Link Quality=70/70 Signal level=-37 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:47 Invalid misc:3 Missed beacon:0

pi@raspberrypi ~ $ ifconfig
eth0 Link encap:Ethernet HWaddr b8:27:16:60
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:8 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1104 (1.0 KiB) TX bytes:1104 (1.0 KiB)

wlan0 Link encap:Ethernet HWaddr 00:3b:1e:b8
inet addr:192.168.0.51 Bcast:192.168.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:464 errors:0 dropped:0 overruns:0 frame:0
TX packets:267 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:68999 (67.3 KiB) TX bytes:40100 (39.1 KiB)

pi@raspberrypi ~ $ lsusb
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 002: ID 0424:9512 Standard Microsystems Corp.
Bus 001 Device 003: ID 0424:ec00 Standard Microsystems Corp.
Bus 001 Device 004: ID 0e66:0013 Hawking Technologies HWUN3 Hi-Gain Wireless-N Adapter [Ralink RT3070]
pi@raspberrypi ~ $

[/codesyntax]

One thing to note, your network led’s wont be working, because your not using your nic…. You’ll want to watch the led on the actual usb stick to see if there’s activity. If it’s up and online, the light will be steady green, and only flash with transmissions. If it’s constantly off and only blinks every few seconds, something’s wrong and you’ll need to do some troubleshooting.

Hope this helps someone, and if not, at least I can forget about how I did it until my next pi comes in a few more days!

 

2012-06-23_02-24-06_238

Installing Ubuntu Server 12.04 LTS using Hardware Raid1

19

So my new 10,000 rpm raptor drives came in today, and I’ve had a sabrent hardware 4 port sata raid controller sitting around for a while, and decided to put them to work in a desktop server I plan on migrating the site’s I host (including this one) over to during the next few weeks.

One of the main reasons for the move is I this new raid1 setup will help ensure that me and my clients data will remain safe, in the case of a hardware failure. While I do currently backup with mysqldump and some rsync magic, restoration is alot easier using raid, then moving and re-installing everything from backups, not to mention just add’s to the geek cred :)

However I ran into a problem installing grub the error stated:

Unable to install GRUB in /dev/mapper

Executing ‘grub-install ‘/dev/mapper’ failed.

This is a fatal error

and because I haven’t had a lot of experience with either raid configurations or ever having installed linux to a machine with such a configuration I needed to do some research.

I found a few good posts, but most of them recommended creating another partition just for grub, and then using the raid drives for the rest of the install.

To me that sounded like a poor workaround, I want the data to be mirrored on both drives, equally, grub and all.

That led me to try a few other avenues to figure out the correct and easy way to get through the install.

Long story short, here’s a breakdown of how to get it setup and working, the easy way. In this breakdown I’ll assume you can follow the easy installer prompts for Ubuntu, have “activated the serial ata raid devices”, have taken note of the array’s name (you can take note of it on the “[!!]  Partition disks” screen that looks like the purple box on the left. (sorry not a vm so I had to take a picture of the screen…) in my case the name of the array is “sil_biegdfaaeabh”, and have continued onto the part of the install where it asks where to install grub.

  • First let’s find the name of the raid array, in case you forgot to take note of the name as mentioned in the previous paragraph (as I’ve done a few times when just mindlessly pressing next in the wee hours of the morning..) press Ctrl +alt+F2 to drop into a busybox terminal session. Press enter when prompted to start the terminal.
  • Type in the command [codesyntax lang="bash" lines="no" title="command"]

    [/codesyntax] and find that funny-named array after the entry named controller and then head back to your install terminal by pressing Ctrl+Alt+F1.
  • enter that name after the /dev/mapper that is populated by default. In my case:
    [codesyntax lang="bash" lines="no" title="install grub to:"]


    [/codesyntax]Of course CHANGE THE NAME and substitute your OWN in the example above!
  •  Continue setting up Ubuntu as you see fit, as the rest should complete without any further hassle!
In my case, I think after an update&&upgrade and mabye
[codesyntax lang="bash" title="command"]
[/codesyntax] IF you feel like having a desktop to work with, of course. I’m starting to like XFCE a lot more these days, and the Midori browser is coming along nicely, so also give that a consideration. Some tasks I just find easier with a mouse and desktop, notice I didn’t say faster, but this post is all about easy!
Then it’s on to something like ISPConfig3, I’m still loving the ease of administration of my web hosting and haven’t seen anything else close to as feature packed!
As for the actual migration, I’ll probably be too busy with it to document it fully, but I might write-up some helpful reminders for you and I if I find the time.
Untangle

Untangle on the Edge

0

So my new employer is very generous on the old hardware that is going to be recycled and let me take home an old desktop (sans hard drive of course).

Awesome! Now what to do with it…

Wait, I remember a cool router I used to use a few years ago when I first moved out of my parents house.

Untangle.

So I ran down to my local Fry’s Electronics, picked up a new hard drive (IDE is really expensive!) more ram (so is ddr ram…) and two gigabit network cards. (pretty cheap!)

Viola, a great and very powerful new router!

Untangle offers you two options to setup your untangle router, either as the edge device (directly connected to the internet) or as a transparent bridge (behind a firewall or router just doing traffic filtering). I went with it as my edge device.

The UI is great and I’ve always liked the interface, it looks like a rack of independant network devices that you can configure the same way, independantly.

 

It does everything a good UTM router does, and then some, and most of the options are available for free. (I did end up buying the web cache as it really does help speed up most web browsing.) and the pay for additions are pretty averagely priced.

The “lite” package is made out of entirely opensource software, and provides a great platform for free,

It also does reporting, generates a key based VPN connection for each client independently using OpenVPN (there’s also an IPSec VPN available for purchase as well.)

If you haven’t heard of it, check it out. If your looking for a new router for your network, they also provide hardware appliances as well, if you have an old beige box lying around, why not add a nic card or two and give it a shot yourself!

 

Go to Top