linux Archives - Page 4 of 5 - Networking HowTos

Limit Postfix to listen on specific IP addresses

February 14, 2012 Linux

On a default install of Postfix, it will listen on all interfaces/IP addresses on your machine. Sometimes this is not what you want. For example, the computer may be connected directly to the internet on one network interface, and connected to a lan on another interface, however you may not want to allow access to the SMTP server from the internet, and only use it for internal mail. You can do this by specifying only the internal address to listen on (as well as local host).
The example below will be to limit SMTP access only to local host, so no other computers on the network can access it.
This configuration is done in the main.cf configuration file. Edit it in your editor of choice.

$ sudo nano /etc/postfix/main.cf

Find the following configuration option in the file:

inet_interfaces = all

Either comment this line out, and duplicate it underneath, or simply modify the line. I choose to comment and duplicate the line in case I needed to change it back.
Modify the ‘all’ text to contain a list of IP addresses, separated by commas, that you want Postfix to listen on.

#inet_interfaces = all
inet_interfaces = 127.0.0.1

Save the file, and exit the editor.
Restart Postfix to activate these changes.

$ sudo /etc/init.d/postfix restart

You can now issue the ‘netstat -an’ command and see that it is only listening on port 25 on the specific IP’s you configured, instead of 0.0.0.0.
The netstat output would look something like this for my example:

$ netstat -an
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN

More information on the inet_interfaces syntax is avaliable here:
http://www.postfix.org/postconf.5.html#inet_interfaces

Disable icmp ping replies on Linux

February 13, 2012 Linux

Having a computer that replies to ping requests allows for simple network connectivity tests, however there may be circumstances where you need to disable ping replies coming from your computer.
This can be done using firewall rules, however Linux provides an easy way to change the kernel parameters at run time to disable ping replies. Kernel parameters can be changed using the ‘sysctl’ command.
Command to disable ping replies:

$ sudo sysctl -w net.ipv4.icmp_echo_ignore_all=1

Command to enable ping replies:

$ sudo sysctl -w net.ipv4.icmp_echo_ignore_all=0

You can check the current status by running the following command:

$ sysctl net.ipv4.icmp_echo_ignore_all

Display process name and ID of network connections

February 12, 2012 Linux

The netstat command on Linux shows you any active and listening network connections on the computer. If there is a connection active that you are not sure what it is, you can use the ‘-p’ (or ‘–programs’) parameter to show the process id (PID) and process name of the network connection/socket.
Example:

Note: to use the -p parameter, you need to have root privileges, otherwise the ‘PID/Program name’ field will just display ‘-‘.

Configure a PPTP VPN Server on Ubuntu Linux

February 10, 2012 Linux, Ubuntu

If you need to access your network (be it a home network, or a work network) from a remote location, a great option is to set up some sort of VPN connection. There are a few different types of VPN connections, such as PPTP, L2TP, and IPSec, and each has advantages and disadvantages. One of the advantages of PPTP VPN connections is that almost all devices that can create VPN connections, have a PPTP VPN client already.
Linux can be set up as a PPTP Server easily, and the following guide will outline how to do this.
Install the PPTP server package:

$ sudo apt-get install pptpd

Edit the chap-secrets file, which contains the usernames and passwords for the users that will connect to the VPN.

$ sudo nano /etc/ppp/chap-secrets

Example blank chap-secrets file:

# Secrets for authentication using CHAP
# client        server  secret                  IP addresses

The following example shows two users (‘vpnuser’ and ‘vpnuser2’), and their plain text password of ‘pass123’. The ‘vpnuser2’ user has been set to use the same IP address (192.168.0.90) on each connection. This is how you can assign a static VPN IP to a specific user.

# Secrets for authentication using CHAP
# client        server  secret                  IP addresses
vpnuser         *       pass123                 *
vpnuser2        *       pass123                 192.168.0.103

Once you have added any users that you want to add, save the file and exit the editor.
Edit the main PPTP configuration file:

$ sudo nano /etc/pptpd.conf

The configuration file is well documented, so have a read through it and see if there are any options you need to change.
The main option that you will need to modify, is the ‘localip’ and ‘remoteip’ settings. I set the ‘localip’ option to be the IP address of the computer on the LAN side (192.168.0.1 in this case), and the ‘remoteip’ to be a range of IP’s on the same subnet as your LAN (192.168.0.100 through to 192.168.0.120 in this case).
Sample configuration settings:

localip 192.168.0.1
remoteip 192.168.0.100-120

Save the file and exit the editor.
Restart the PPTP/VPN server service for the changes to take effect.

sudo /etc/init.d/pptpd restart

You can now try and connect to the server from a PPTP VPN client.
Use the ifconfig command to see the status of the VPN interfaces, if there are any users connected.

ifconfig

The VPN connections will appear as ppp# connections.
Example ifconfig output with a VPN user connected:

ppp0      Link encap:Point-to-Point Protocol
          inet addr:192.168.0.1  P-t-P:192.168.0.100  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1396  Metric:1
          RX packets:86 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:7659 (7.6 KB)  TX bytes:98 (98.0 B)

Keep in mind that if your server has firewall rules on it, you will need to allow access to port 1723 with the TCP protocol, and also allow the GRE protocol (protocol number 47). You may also need to allow access from the PPP connections if the VPN users need to access services on the VPN server itself.
If the Linux server is behind a firewall/router, port forward TCP port 1723 to the VPN server (and also GRE if available on your firewall/router). Some routers may have a pre-defined rule named ‘PPTP’. Use this if it exists. Some NAT routers don’t seem to forward the GRE protocol correctly. Make sure your router has PPTP Pass through support.
If you need to access computers on the LAN behind the VPN server machine, you will have to look at enabling forwarding and setting up iptables forwarding rules.
The following should allow all traffic from the VPN to the LAN and vice versa, however don’t use this on a server directly connected to the Internet:

$ sudo sysctl -w net.ipv4.ip_forward=1
$ sudo iptables -A FORWARD -i ppp+ -o eth0 -s 192.168.0.0/24 -d 192.168.0.0/24 -j ACCEPT
$ sudo iptables -A FORWARD -o ppp+ -i eth0 -s 192.168.0.0/24 -d 192.168.0.0/24 -j ACCEPT

(This assuming your LAN subnet is 192.168.0.0/24 on the eth0 network interface.)

Installing Firebird From Source On Linux

February 3, 2012 Database, Firebird, Linux

This ‘How To’ article outlines the steps required to compile and install the Firebird database server on a Linux machine.
Download the latest version of the source code from http://www.firebirdsql.org/en/server-packages/
At the time of writing this article, the latest version was 2.5.1.26351-0.
Replace the URL below with the latest version, or get the source code package onto the Linux machine with some other method.

$ wget "http://internode.dl.sourceforge.net/project/firebird/firebird/2.5.1-Release/Firebird-2.5.1.26351-0.tar.bz2"

Extract the downloaded package.

$ tar xjvf Firebird-2.5.1.26351-0.tar.bz2

The file list will flow through on the screen while they get extracted.
Change the working folder to the Folder that got created in the extraction.

$ cd Firebird-2.5.1.26351-0

Before running the Firebird configure script, make sure your build environment is set up with the required packages.
On Ubuntu, you can run the following command to install the required packages:

$ sudo apt-get build-dep firebird2.1-classic

(While the above command references a older version of Firebird, the packages required are still the same).
Also make sure that xinetd has been installed, as Firebird uses it to start up the server process. If it is not currently installed, use the following command to install it:

$ sudo apt-get install xinetd

Run the configuration script to prepare for compilation, and to make sure all required library’s are installed.

$ ./configure

If you get the following error appearing:

configure: error: termcap support not found

you will need to install the libncurses5-dev package:

$ sudo apt-get install libncurses5-dev

If you did get that error, and installed libncurses, run the configure command again.
Confirm that all the configuration options in the configuration summary are as you need.
Sample configuration summary output:

The Firebird2 package has been configured with the following options:
                   Architecture : ClassicServer
                          Debug : disabled
                    Raw devices : enabled
                   Service name : gds_db
                   Service port : 3050
                   GPRE modules : c_cxx.cpp
                    Install Dir : /usr/local/firebird

Run the ‘make’ command to start compiling Firebird.

$ make

This process may take awhile…
Finally, run the ‘make install’ command to install the newly compiled Firebird package to the system folders on your Linux installation.

$ sudo make install

You will be asked to enter in the new password for the SYSDBA user. Set this to anything you want, however keep in mind that the default is “masterkey”, and unfortunately some applications may be hard coded to use this.
Firebird should now be installed on the system and ready to use.

Load Balancing With HAProxy

February 2, 2012 Linux

HAProxy is a free, reliable, high performance load balancing solution capable of proxying TCP and HTTP applications.
This article will outline how to set up a simple HAProxy server to allow you to load balance web site requests to one or more back-end web servers. While this example may not be suitable for a production set up on the internet, its a good start if you just want to set up a simple load balanced web site.
The following example is using Ubuntu, however the configuration will be the same regardless of the distribution. The steps to install HAProxy will vary depending on the distribution. It also assumes that the back end web servers are on different physical machines to the one running HAProxy.
Installing HAProxy:

$ sudo apt-get install haproxy

On Ubuntu, by default the HAProxy service is disabled. To enable it you need to modify the /etc/default/haproxy file.

$ sudo nano /etc/default/haproxy

Modify the ‘ENABLED=0’ line to ‘ENABLED=1’ as shown below.
Change this:

# Set ENABLED to 1 if you want the init script to start haproxy.
ENABLED=0
# Add extra flags here.
#EXTRAOPTS="-de -m 16"

To this:

# Set ENABLED to 1 if you want the init script to start haproxy.
ENABLED=1
# Add extra flags here.
#EXTRAOPTS="-de -m 16"

Save and exit the editor.
The next step is to modify the HAProxy configuration file.

$ sudo nano /etc/haproxy/haproxy.cfg

In the default configuration file, there will likely be a number of ‘listen’ sections. These can be removed or commented out, as they wont be needed. You just want to keep the ‘global’ and ‘defaults’ sections for now.
Add in the following ‘frontend’ and ‘backend’ sections:

frontend http_in
        bind *:80
        default_backend webservers
backend webservers
        balance roundrobin
        server webserver1 192.168.50.11:80
        server webserver2 192.168.50.12:80

What this does is sets up a proxy frontend called ‘http_in’, listening on port 80, on all IP addresses on the machine. This proxy frontend will pass all traffic through to the ‘backend’ which has been configured with the name ‘webservers’. This is set with the ‘default_backend’ setting pointing to ‘webservers’.
THe ‘backend’ section is where we configure what servers will be avaliable to load balance between, and what type of load balancing model to use. This example uses the round robin model, which basically just rotates evenly between the servers listed. In this example, we have named the server running on 192.168.50.11 as ‘webserver1’ and the server running on 192.168.50.12 as ‘webserver2’. These names dont have to resolve to anything as they are just used for identifiers within HAProxy.
The configuration file should now look similar to this:

global
        log 127.0.0.1   local0
        log 127.0.0.1   local1 notice
        #log loghost    local0 info
        maxconn 4096
        #chroot /usr/share/haproxy
        user haproxy
        group haproxy
        daemon
        #debug
        #quiet
defaults
        log     global
        mode    http
        option  httplog
        option  dontlognull
        retries 3
        option redispatch
        maxconn 2000
        contimeout      5000
        clitimeout      50000
        srvtimeout      50000
frontend http_in
        bind *:80
        default_backend webservers
backend webservers
        balance roundrobin
        server webserver1 192.168.50.11:80
        server webserver2 192.168.50.12:80

Save the configuration, and exit the editor.
Restart/Start HAProxy for the changes to take effect.

$ sudo /etc/init.d/haproxy restart

You should now be able to go to the url of the HAProxy machine, and have the requests redirected to the back end web servers that were set up in the ‘backend’ section.
There are a large number of configuration options avaliable to do things like weighted balancing, server status checking, URL redirection, stats pages, and more. Read the documentation on the HAProxy website (http://haproxy.1wt.eu/) for more information on the various configuration options available.

Top 5 Network Monitoring Tools for Linux

January 28, 2012 Linux

Below is a list of my top 5 network monitoring tools for Linux, in no particular order.
Nagios
Nagios is a network monitoring application that is capable of alerting a system administrator in the event that something goes wrong on a network, and even when it comes good again. Nagios lets you monitor network services (such as FTP, HTTP, SMTP, POP3, etc), host availability, host resources (CPU load, memory usage, etc), bandwidth utilization, and via the customizable nature of Nagios, it can potentially monitor anything (within reason). Some of the possibilities include monitoring for when SSL certificates are going to expire for a website, or when a domain name is going to expire, or even when a UPS drops below a set input voltage.
http://www.nagios.org/
Cacti
Cacti is a web based graphing tool, which stores its statistics in the RRDTool backend. It allows you create graphs of network traffic utilization, via the SNMP protocol. This allows you to create a central location of graphs, for all SNMP enabled network devices you have access to. Shell scripts can be written to allow graphing of other devices that may not be SNMP enabled.
http://www.cacti.net/
Tcpdump
Tcpdump is a network packet analyzer (or otherwise known as a packet sniffer). It allows you to intercept and display any network traffic that your network interface card can see. While a network that runs in a switched environment will prevent Tcpdump from viewing all data, it is still handy for viewing data that does go through the PC you are running it on, especially if the machine is a firewall/router. Great tool for diagnosing network related issues. You can create pcap compatible capture files, and open them at a later time in Wireshark/Ethereal for easy analyzing.
http://www.tcpdump.org/
Nmap
Nmap stands for “Network Mapper”, and is tool for network scanning and security auditing. It is probably the best known port scanner around. It is a great tool for checking to see what services are running, what ports are open, etc. It has the ability to perform host discovery, port scanning, version detection, operating system detection, and also has its own scripting engine (NSE).
http://nmap.org/
Ntop
NTop is similar to the standard unix/linux “top” program, but displays network traffic information instead of process information. It runs in a console, however there is a web interface avaliable as well. When used on a firewall/gateway it allows you to monitor the Internet usage of your entire network.
http://www.ntop.org/

Live monitoring of Apache log files

January 26, 2012 Linux

The “ApacheTop” package has been written to allow users to monitor real time statistics based on the Apache log files. ApacheTop is a great way to keep an eye on your Apache web server statistics. It allows you to monitor how many requests you get (total and per second), bandwidth usage (total and per second), the number of 2xx, 3xx, 4xx, and 5xx HTTP return code responses, individual page/url requests, and more.
ApacheTop is similar in style to the ‘top’ program for monitoring running processes, and also the ‘ntop’ program for monitoring network traffic. The application loads, and sits there constantly updating, and waiting for commands from the user.
Installing ApacheTop:
For Ubuntu or Debian:

$ sudo apt-get -y install apachetop

For CentOS or RedHat Enterprise Linux:

# yum install gcc gcc-c++ ncurses-devel readline-devel make wget
# wget "http://www.webta.org/apachetop/apachetop-0.12.6.tar.gz"
# tar xzvf apachetop-0.12.6.tar.gz
# cd apachetop-0.12.6
# ./configure
# make
# make install

For other distributions, you can download the source files from http://www.webta.org/projects/apachetop/.
Running ApacheTop:

apachetop -f /path/to/apache/access.log

(Note: if you dont have read access to the log file, you may need to run apachetop as root, by prefixing the ‘apachetop’ command with the ‘sudo’ command)
Eg:

sudo apachetop -f /path/to/apache/access.log

Example output:

last hit: 15:06:23         atop runtime:  0 days, 00:05:35             15:06:33
All:           26 reqs (   0.1/sec)        206.9K (  685.6B/sec)    8148.6B/req
2xx:      25 (96.2%) 3xx:       0 ( 0.0%) 4xx:     1 ( 3.8%) 5xx:     0 ( 0.0%)
R (335s):      26 reqs (   0.1/sec)        206.9K (  632.4B/sec)    8148.6B/req
2xx:      25 (96.2%) 3xx:       0 ( 0.0%) 4xx:     1 ( 3.8%) 5xx:     0 ( 0.0%)
 REQS REQ/S    KB KB/S URL
    1  0.03  16.5  0.6 /
    1  0.07   8.2  0.6 /images/021.png
    1  0.07   1.3  0.1 /images/011.png
    1  0.07   4.8  0.3 /images/06.png
    1  0.07   4.0  0.3 /images/031.png
    1  0.07   5.0  0.4 /images/07.png
    1  0.07   4.3  0.3 /images/08.png
    1  0.07   4.4  0.3 /images/09.png
    1  0.07   3.9  0.3 /images/10.png
    1  0.07   3.6  0.3 /images/11.png
    1  0.07   3.4  0.2 /images/12.png
    1  0.07   3.5  0.2 /images/13.png
    1  0.08   4.6  0.4 /images/14.png
    1  0.08   2.7  0.2 /images/15.png
    1  0.08  24.3  1.9 /images/041.png
    1  0.08   6.0  0.5 /images/051.png

You can specify a number of options when running apachetop, and these can be see by reading the man page, or by running apachetop with the –help parameter:
Eg:

apachetop --help

The two options that I find the most useful are the -H and the -T options:

  -H hits     remember stats for this many hits
  -T secs     remember stats for this many seconds

By default ApacheTop remembers stats for 30 seconds. 600 is a good figure to use (10 minutes) for the -T option.
Note: I had issues with apachetop running on Ubuntu where the hot keys wouldn’t get picked up, and to exit I had to press ctrl-c. If you know why this occurs, or know how to fix it, please add a comment below.

Updating CentOS with the YUM package manager

January 25, 2012 CentOS, Linux

Updating the software running on a operating system is an important part of maintaining a computer. Not only does it allow you to keep up to date with the latest features in the applications you use, it is also crucial to keep your system as secure as possible.
The YUM (Yellowdog Updater Modified) package management tools makes installing/updating/removing packages extremely simple.
Run the one of the following command to update all packages:
If logged in as root:

# yum update

If logged in as a normal user:

$ su -c 'yum update'

Example output:

# yum update
Loaded plugins: fastestmirror, presto
Loading mirror speeds from cached hostfile
 * base: mirror.as24220.net
 * extras: mirror.as24220.net
 * updates: mirror.as24220.net
base                                                                    | 3.7 kB     00:00
extras                                                                  | 3.5 kB     00:00
updates                                                                 | 3.5 kB     00:00
updates/primary_db                                                      | 715 kB     00:00
Setting up Update Process
No Packages marked for Update

Note: No applications actually got upgraded in this example.
For more details on yum, check the following site:
http://www.centos.org/docs/5/html/yum/

Updating Ubuntu with the APT package manager

January 25, 2012 Linux, Ubuntu

Updating the software running on a operating system is an important part of maintaining a computer. Not only does it allow you to keep up to date with the latest features in the applications you use, it is also crucial to keep your system as secure as possible.
The APT (Advanced Package Tool) package management system makes installing/updating/removing packages extremely simple.
The first step in the process is to update the APT sources. This downloads the latest package lists, so the APT system knows what software is available, and also what software has an update available.
To update the sources, run the following command:

$ sudo apt-get update

Example output:

$ sudo apt-get update
Hit http://au.archive.ubuntu.com lucid Release.gpg
Hit http://au.archive.ubuntu.com/ubuntu/ lucid/main Translation-en_AU
Hit http://au.archive.ubuntu.com/ubuntu/ lucid/restricted Translation-en_AU
Hit http://security.ubuntu.com lucid-security/universe Packages
...
... (Lines cut out to save space)
...
Hit http://security.ubuntu.com lucid-security/universe Sources
Hit http://security.ubuntu.com lucid-security/multiverse Packages
Hit http://security.ubuntu.com lucid-security/multiverse Sources
Reading package lists... Done

Once you have the latest package sources, you can proceed to running the command to actually update all packages that have an update available.
Run the following command to update all packages:

$ sudo apt-get -y upgrade

Note: The -y option automatically chooses “yes” when you would normally be asked to confirm if you want to install the updates.
Example output:

$ sudo apt-get upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages have been kept back:
  linux-headers-server linux-image-server linux-server
0 upgraded, 0 newly installed, 0 to remove and 3 not upgraded.

Note: No applications actually got upgraded in this example.
To run a update and upgrade in a single command, use the following:

$ sudo apt-get update && sudo apt-get -y upgrade

To update the actual distribution, you need to run the following command:

$ sudo apt-get dist-upgrade

Make sure you have already updated the package source list using the “sudo apt-get update” command.
If you are running as root, you don’t need the “sudo” statement in any of the above commands.
For more details on apt, check the following sites:
http://en.wikipedia.org/wiki/Advanced_Packaging_Tool
https://help.ubuntu.com/community/AptGet/Howto

Older Posts

Newer Posts