Bijit's Small World....

Monday, August 25, 2014

Setting up OpenVPN Server on CentOS-6.5 (running as a Openstack cloud instance)

I. Setting up OpenVPN Server on CentOS-6.5 (running as a Openstack cloud instance). The setup may just work the same on other *nix based systems.

A. OpenVPN Server

1. Download and Install the EPEL repo which would provide OpenVPN rpm;
(Epel repo: http://dl.fedoraproject.org/pub/epel/6/x86_64/)
# wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm .
# rpm -ivh epel-release-6-8.noarch.rpm

2. Install openvpn and easy-rsa (RSA key management package)
# yum -y install openvpn easy-rsa

3. # mkdir -p /etc/openvpn/easy-rsa/keys
# cp -rf /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa/

B. Generate CA Certificate and CA key

4. Open /etc/openvpn/easy-rsa/vars and set the following attributes which we would use later on Certificates and keys;
# vi /etc/openvpn/easy-rsa/vars

export KEY_COUNTRY="IN"
export KEY_PROVINCE="WB"
export KEY_CITY="KOL"
export KEY_ORG="IT"
export KEY_EMAIL="tu.bijit@gmail.com"
export KEY_OU="MyOrganizationalUnit"

5. Copy the required OpenSSL configuration file which OpenVPN might fail to detect;
# cd /etc/openvpn/easy-rsa/
# cp openssl-1.0.0.cnf openssl.cnf

6. Now, lets build our Certificate Authority (CA) based on the information provided in /etc/openvpn/easy-rsa/vars.
# source ./vars
# ./clean-all
# ./build-ca

7. Generate certificate for the OpenVPN server. Respond "Yes" when prompted for build-key-server to commit.

# ./build-key-server server

8. Generate the same for Client (which we would be copying to client later):
# ./build-key client

9. Generate Diffie Hellman key exchange files using the build-dh script;
# ./build-dh

10. In the above step, the necessary keys and certificates will be generated in the /etc/openvpn/easy-rsa/keys/ directory. Copy the following certificate and key files to the /etc/openvpn/ directory.

ca.crt
dh2048.pem (please make changes in the server.conf when needed)
server.crt
server.key

# cd /etc/openvpn/easy-rsa/keys/; cp ca.crt dh2048.pem server.crt server.key /etc/openvpn/

11. Copy all client certificates and keys to the remote VPN clients in order to authenticate to the VPN server. Since, we have generated certificates and keys for only one client, so we have to copy the following files (or its contents, keep the name exactly the same) to the VPN client.

ca.crt
client.crt
client.key

C. Configuring VPN Server

12. OpenVPN comes with a sample configuration file, copy that file to /etc/openvpn;

# cp /usr/share/doc/openvpn-2.3.2/sample/sample-config-files/server.conf /etc/openvpn/

15. Open /etc/openvpn/server.conf and make the follwoing changes;

Do the following;
i. Uncomment ( This is route all the traffic from Client through VPN):
push "redirect-gateway def1 bypass-dhcp"

ii. Use VPN to use opendns servers:
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

iii. Uncomment the following to reduce the OpenVPN daemon's privileges after initialization.

user nobody
group nobody

D. IP forwarding and routing Configuration:

13. vi /etc/sysctl.conf
Find the following line and set value “1” to enable IP forwarding.

# Controls IP packet forwarding
net.ipv4.ip_forward = 1

Run the following command to apply the sysctl changes.
# sysctl -p

14. iptables rules:

i. Allow proper routing of our VPN subnet,assuming 10.8.0.0/24 is used in /etc/openvpn/server.conf
# iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

ii. Allow port 1194 of openvpn to let traffic come in (iptables -L --line-numbers; iptables -I INPUT -p udp --dport 1194 -j ACCEPT)
# iptables -I INPUT 4 -p udp --dport 1194 -j ACCEPT
# service iptables save

15. # service openvpn start

16. Check if the OpenVPN is listening on port 1194 (UDP port by default, you can change that to TCP in /etc/server.conf)
# netstat -uapn | grep openvpn
udp 0 0 0.0.0.0:1194 0.0.0.0:* 11577/openvpn

17. Check interface VPN is using (tun0 is in our case, "dev tun" will create a routed IP tunnel,);
# ip addr show
1: lo: mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: mtu 1450 qdisc pfifo_fast state UP qlen 1000
link/ether fa:16:3e:7e:11:4a brd ff:ff:ff:ff:ff:ff
inet 172.16.20.8/24 brd 172.16.20.255 scope global eth0
inet6 fe80::f816:3eff:fe7e:114a/64 scope link
valid_lft forever preferred_lft forever
3: tun0: mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100
link/[65534]
inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0

18. In certain cases, once VPN client connects to the VPN server, one might face loss of internet connectivity (was in my case); Following IPTABLES rules would be required to proper routing (as client changes the Gateway to VPN, which should be properly forwarded to access the LAN on the VPN server (you may use the specific LAN IP in the destination, here I used entire network in the destination)

# Allow traffic initiated from VPN to access LAN
iptables -I FORWARD -i tun0 -o eth0 -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT

# Allow established traffic to pass back and forth
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# service iptables save

II. OpenVPN Client (On Windows)

1. On Windows, one can download OpenVPN GUI for Windows;
http://openvpn.se/

2. Make sure we copied the following files from the server which were generated using "./build-key" earlier.

ca.crt
client.crt
client.key

3. Create a new file called client.ovpn, where "client" should match the name of the client being deployed (from build-key) with following contents;

remote x.x.x.x 1194
# Path to certificates (in windows as follows)
ca "C:\\MyVPN\\ca.crt"
cert "C:\\MyVPN\\client.crt"
key "C:\\MyVPN\\client.key"

4. Save and connect to VPN server using client config file.

III. OpenVPN Client (On Linux, CentOS release 6.5 (Final): 1. Download and install OpenVPN package. You would be required to setup EPEL repo as discussed
before. 2. Copy the sample Openvpn client configuration to your desired locaton; # cp /usr/share/doc/openvpn-2.3.2/sample/sample-config-files/client.conf . 3. Copy the following files from the server which were generated using "./build-key" earlier. ca.crt client.crt client.key 4. Provide the following information in "client.conf"; remote x.x.x.x 1194 ca ca.crt cert client.crt key client.key 5. Connect to the OpenVPN server as; # openvpn client.conf &

Thursday, June 19, 2014

Installation and Configuration of Samba-4 Domain Controller on CentOS-6x system

Steps:

1. Create a directory where source would be downloaded:

# cd /home/Administrator/Downloads

2. # mkdir Samba4; cd Samba4

3. # yum install git

4. # git clone git://git.samba.org/samba.git samba-master

5. # cd samba-master/

6. # git pull

7. # yum install gtkhtml setroubleshoot-server setroubleshoot-plugins policycoreutils-python libsemange-python setools-libs-python setools-libs popt-devel

8. # yum install libpcap-devel sqlite-devel libidn-devel libxml2-devel libacl-devel libsepol-devel libattr-devel keyutils-lib-devel zlib-devel cyrus-sasl-devel

9. # yum install gcc

10. # yum install python python-devel

11. # yum install bind bind-utils bind-libs samba-winbind-clients

12. # ./configure.developer

13. # make

14. # make quicktest

15. # make install

16. # yum install bind bind-utils bind-libs samba-winbind-clients

17. # service named start

18. Check the ports (bind):

# netstat -apn | grep 953

# nmap localhost

19. #./source4/setup/provision --realm=tux-kol.srv --domain=tux-kol --adminpass= --server-role='domain controller'

20. # mkdir /etc/phpldapadmin

21. # cp /usr/local/samba/private/phpldapadmin-config.php /etc/phpldapadmin/config.php

22. Backup the original /etc/krb5.conf

# cp /etc/krb5.conf /etc/krb5.conf_original

23. Copy the /usr/local/samba/private/krb5.conf under /etc/

# cp /usr/local/samba/private/krb5.conf /etc/

24. Start Samba:

# /usr/local/samba/sbin/samba

25. Check Client Version:

# /usr/local/samba/bin/smbclient --version

Version 4.0.0alpha17-GIT-ff94539

26. Check list of shares available on the server:

# /usr/local/samba/bin/smbclient -L localhost -U%

Sharename Type Comment

--------- ---- -------

netlogon Disk

sysvol Disk

IPC$ IPC IPC Service

REWRITE: list servers not implemented

27. Test for authentication by connecting to the netlogon share using the administrator credentials:

# /usr/local/samba/bin/smbclient //localhost/netlogon -Uadministrator%

smb: \>

Quit by typing "Exit" from the samba prompt.

28. Created a test share in /usr/local/samba/etc/smb.conf; then save and exit :

[test]

path = /data/test

read only = no

29. Test if the test share created is visible:

Stop samba (Right now, stopping the service by killing the samba process), start it back

Now, check /usr/local/samba/bin/smbclient -L localhost -U%

Sharename Type Comment

--------- ---- -------

netlogon Disk

sysvol Disk

test Disk

IPC$ IPC IPC Service

REWRITE: list servers not implemented

30. Modify the following files as;

A. /etc/named.conf

options {

listen-on port 53 { any; };

listen-on port 953 { any; };

// listen-on port 53 { 127.0.0.1; };

// listen-on-v6 port 53 { ::1; };

// allow-query { localhost; };

allow-query { any; };

tkey-gssapi-credential "DNS/tux-kol.srv";

tkey-domain "TUX-KOL.SRV";

};

include "/usr/local/samba/private/named.conf";

Please note that, in my case the following entries didn't work in /etc/named.conf file;

* include "/etc/named.root.key";

* managed-keys-directory "/var/named/dynamic";

B. In /etc/sysconfig/named; following entries were made for setting up of environmental

variables;

KEYTAB_FILE="/usr/local/samba/private/dns.keytab"

KRB5_KTNAME="/usr/local/samba/private/dns.keytab"

export KEYTAB_FILE

export KRB5_KTNAME

C. In kerberos config file i.e. /etc/krb5.conf

[logging]

default = FILE:/var/log/krb5libs.log

kdc = FILE:/var/log/krb5kdc.log

admin_server = FILE:/var/log/kadmind.log

[libdefaults]

default_realm = TUX-KOL.SRV

dns_lookup_realm = false

dns_lookup_kdc = true

ticket_lifetime = 24h

renew_lifetime = 7d

forwardable = true

[realms]

TUX-KOL.SRV = {

kdc = tux-kol.srv

admin_server = tux-kol.srv

}

[domain_realm]

.tux-kol.srv = TUX-KOL.SRV

tux-kol.srv = TUX-KOL.SRV

[kdc]

check-ticket-addresses = false

31. Restarted Bind (Also, set the named service to start at boot time if not done already):

# service named restart

# chkconfig named on

31. Test if the DNS is working correctly (With the output pasted below):

First, check if /etc/resolv.conf is pointing correctly at your local DNS server, if not make the

changes (In /etc/resolv.conf; comment out existing nameservers and put 127.0.0.1 i.e.

nameserver 127.0.0.1) Then, do the following tests;

# host -t SRV _ldap._tcp.tux-kol.srv

_ldap._tcp.tux-kol.srv has SRV record 0 100 389 localhost.tux-kol.srv.

# host -t SRV _kerberos._udp.tux-kol.srv.

_kerberos._udp.tux-kol.srv has SRV record 0 100 88 localhost.tux-kol.srv.

# host -t A tux-kol.srv.

tux-kol.srv has address 172.16.20.116

32. Testing kerberos by doing the following tests:

# kinit administrator@TUX-KOL.SRV

Password for administrator@TUX-KOL.SRV:

Warning: Your password will expire in 41 days on Tue Aug 30 13:12:54 2011

# klist -e

Ticket cache: FILE:/tmp/krb5cc_0

Default principal: administrator@TUX-KOL.SRV

Valid starting Expires Service principal

07/19/11 13:49:27 07/19/11 23:49:27 krbtgt/TUX-KOL.SRV@TUX-KOL.SRV

renew until 07/26/11 13:49:15, Etype (skey, tkt): ArcFour with HMAC/md5, ArcFour

with HMAC/md5

33. Change the required ownerships and permissions:

chown named.named /usr/local/samba/private/dns.keytab

chgrp named /usr/local/samba/private/dns

chgrp named /usr/local/samba/private/dns.keytab

chmod g+r /usr/local/samba/private/dns.keytab

chmod 775 /usr/local/samba/private/dns

34. Check DNS dynamic update process:

# /usr/local/samba/sbin/samba_dnsupdate --verbose

35. Install NTP package and start its service:

# yum install ntp ntpdate

# service ntpd start

36. Test filesystem support:

# cd /tmp

A. Create a test file:

# touch test.txt

B. Set the attributes:

# setfattr -n user.test -v test test.txt

# setfattr -n security.test -v test2 test.txt

C. Test if the attributes were set with getfattr (Output pasted below);

# getfattr -d test.txt

# file: test.txt

user.test="test"

# getfattr -n security.test -d test.txt

# file: test.txt

security.test="test2"

37. Once the above steps run successfully. Test the DC from a client (Win-XP, Win-7, Win-2003 etc)

Create a test samba user:

/usr/local/samba/bin/samba-tool newuser testguest just4now

/usr/local/samba/sbin/samba-tool user add testguest just4now

Tested the authentication from a Win-XP, Win-7, Win-2003 Client using "Administrator" and "testguest" credentials. It has been authenticated.

Thursday, March 13, 2014

"Printer-out-of-paper" error or bug?

I am using HP-1050 Deskjet printer and it is attached by USB to Fedora-14 system. Installed cups package is cups-1.4.8-5.fc14.i686. Sometime back as I was printing a document when the printer was out of paper. I put back the paper in place and everything started working normally Except the error message "Printer-out-of-paper" which seem to have permanently stuck on the printer.

system-config-printer (version 1.2.9) showed printer with the red error sign. The status message under Properties -> Ink/Toner Levels displays "Printer HP-Deskjet-1050-J410 is out of paper"

The point to note here is that the printer was working normally apart from that status message which was quite annoying. Restarting of cups service, switching on and off the printer did not help the cause.

How to fix;

After a bit search (hit and trial), I commented out the following line in /etc/cups/printer.conf;

# Reason media-empty-error

Restarted the cups service and voila!! The error message is no longer visible.

Thursday, February 27, 2014

MySQL, How to reset lost root password

Did you forget the root password of MySQL ? Here is how get it back.

The following steps tells you how to reset the root password in MySQL (this is specific to Linux environment, I understand the same process would also work in Windows)

1. Stop MySQL service:
# service mysqld stop
Stopping mysqld: [ OK ]

2. Start Mysql server with "--skip-grant-tables" option (user privileges table). You may optionally provide "--skip-networking" which would prohibit anyone from connecting the server from remote place;

Please note that, one need to start the server using "mysqld_safe" command. You need to send the process in the background by either pressing ctrl+z and send it to the background using "bg" or '&' at the end of the command;

# mysqld_safe --skip-grant-tables --skip-networking
140227 18:39:40 mysqld_safe Logging to '/var/log/mysqld.log'.
140227 18:39:40 mysqld_safe Starting mysqld daemon with databases from /var/lib/mysql
^Z
[1]+ Stopped mysqld_safe --skip-grant-tables --skip-networking

3. Login to Mysql without password (this will not prompt you for password);

[root@Fedora-14 ~]# mysql
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 3
Server version: 5.1.60 Source distribution

Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

4. Update the password for "root" user with a new password;

mysql> use mysql;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed
mysql> update user set password=PASSWORD("root") where user="root";
Query OK, 0 rows affected (0.01 sec)
Rows matched: 3 Changed: 0 Warnings: 0

mysql> flush privileges;
Query OK, 0 rows affected (0.01 sec)

mysql> quit
Bye

5. Stop the MySQL server;

[root@Fedora-14 ~]# /etc/init.d/mysqld stop
Stopping mysqld: [ OK ]

6. Start back the MySQL server;

# service mysqld start
Starting mysqld: [ OK ]

7. Login to the server with root user and the new password;

# mysql -u root -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 4
Server version: 5.1.60 Source distribution

Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql>

Wednesday, February 19, 2014

Accessing a Linux box in GUI mode

Here is how to setup a Linux system that would allow you to access it from a remote system using VNC client

A. Login to the Linux box & switch to root user. Now, install and configure
the packages stated below;

1. yum groupinstall "Desktop"

2. yum install xorg-x11-fonts-100dpi.noarch xorg-x11-fonts-ISO8859-1-100dpi.noarch
xorg-x11-fonts-misc.noarch xorg-x11-fonts-Type1.noarch tigervnc-server

3. Modify the /etc/inittab to set runlevel 5 (thus, the system would run
in full GUI mode)

4. Now, configure vnc password with the command "vncpasswd"

5. Start the vncserver by running the command "vncserver"

B. On the client system install VNC-Viewer-XXX from the link
http://www.realvnc.com/download/viewer/

C. Start the VNC-Viewer client and connect to the Linux box ( :5901
as the VNC Server value)

Note: Just in case you are not able to access the System, check the iptables rules
(firewall) and allow the port 5901 to be accessed from outside.