Debian : purge packages marked with rc status

August 4, 2010 - 3 comments

Packages with rc status are not completely removed from the system, configuration files are still present.

If you have a bunch of rc packages you need to purge, as root, type :

dpkg --list |grep "^rc" | cut -d " " -f 3 | xargs sudo dpkg --purge

Source : http://joysofprogramming.com/remove-packages-marked-rc/

Several workspaces on Ubuntu Netbook Remix

June 3, 2010 - 1 comment

Workspaces are “disabled” by default in Ubuntu Netbook Remix (actually set to one workspace)

If you want 4 workspaces, in a terminal type :
gconftool-2 -s /apps/metacity/general/num_workspaces 4 --type int

You’ll navigate in the workspaces with the usual keyboard shortcuts : ctrl + alt + left/right arrow keys
And : ctrl + alt + shift + left/right to move windows from one space to another.

A basic OpenLDAP server in under 15 minutes

January 28, 2010 - 2 comments

Tested under Debian Lenny

This howto is basic, as in “no security involved”. I may come up with a second part to this guide about securing OpenLDAP with TLS, if I ever find the time.
Meanwhile see http://www.openldap.org/doc/admin23/security.html for the security aspect of things.

In this example, I’ll create a tree following this scheme : dc=my,dc=domain,dc=tld.
It’s really up to you how you organize your tree, it’s really for organizational purposes. You can limit your tree to a single root branch, for example dc=myname.

Install OpenLDAP server and some useful utilities :

# apt-get install slapd ldap-utils

You should be prompted for a password, if not create it from the command line :

# slappasswd
New password:
Re-enter new password:
{SSHA}vFk3EP4SSW0RDm4yEKD

Edit /etc/ldap/slapd.conf :

You should copy the password obtained with slappasswd under the rootpw option.

include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema
pidfile         /var/run/slapd/slapd.pid
argsfile        /var/run/slapd/slapd.args
loglevel        none
modulepath	/usr/lib/ldap
moduleload	back_hdb
sizelimit 500
tool-threads 1
backend		hdb
database        hdb
suffix          "dc=my,dc=domain,dc=tld"
rootdn          "cn=admin,dc=my,dc=domain,dc=tld"
rootpw		"{SSHA}vFk3EP4SSW0RDm4yEKD"
directory       "/var/lib/ldap"
dbconfig set_cachesize 0 2097152 0
dbconfig set_lk_max_objects 1500
dbconfig set_lk_max_locks 1500
dbconfig set_lk_max_lockers 1500
index           objectClass eq
lastmod         on
checkpoint      512 30
access to attrs=userPassword,shadowLastChange
        by dn="cn=admin,dc=my,dc=domain,dc=tld" write
        by anonymous auth
        by self write
        by * none
access to dn.base="" by * read
access to *
        by dn="cn=admin,dc=my,dc=domain,dc=tld" write
        by * read

“cn=admin,dc=my,dc=domain,dc=tld” is the database admin. This is what you will use as credential when you need to modify something in the database.

Then edit /etc/ldap/ldap.conf :

This is the configuration for the LDAP client.

HOST 127.0.0.1
BASE dc=my,dc=domain,dc=tld
URI ldap://localhost

Now create a directory that will contain some initial configuration files.

# mkdir /etc/ldap/LDIF

In this directory create the following files :

1_base.ldif (the base of our LDAP tree) :

dn: dc=my,dc=domain,dc=tld
dc: my
objectClass: domain

2_group.ldif (this will be the branch that will host our groups) :

dn: ou=Groups,dc=my,dc=domain,dc=tld
ou: Groups
objectClass: organizationalUnit

3_dev.ldif (this is our first group) :

dn: cn=dev,ou=Groups,dc=my,dc=domain,dc=tld
cn: dev
gidNumber: 30000
memberUid: user1
objectClass: posixGroup
objectClass: top
description: developers

4_people.ldif (this is the branch hosting users) :

dn: ou=People,dc=my,dc=domain,dc=tld
ou: People
objectClass: organizationalUnit

5_user1.ldif (this is our first user) :

dn: uid=user1,ou=People,dc=my,dc=domain,dc=tld
uid: user1
cn: John Doe
displayName: John Doe
givenName: Doe
sn: Doe
objectClass: inetOrgPerson
userPassword: pass
mail: johndoe@domain.tld

When we are done, we can restart OpenLDAP and create the tree and import some data :

# /etc/init.d/slapd restart
# cd /etc/ldap/LDIF
# for i in `ls`; do ldapadd -x -D "cn=admin,dc=my,dc=domain,dc=tld" -W -f $i ; done

You should be prompted for the admin password as much as you have LDIF files in the directory.
If you didn’t name your file 1_base.ldif, 2_group.ldif, etc. the command may fail as it may try to add a group or user before creating its branch.

Now you should be able to query the LDAP tree :

# ldapsearch -x
# extended LDIF
#
# LDAPv3
# base <dc=my,dc=domain,dc=tld> (default) with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# my.domain.tld
dn: dc=my,dc=domain,dc=tld
dc: my
objectClass: domain

# Groups, my.domain.tld
dn: ou=Groups,dc=my,dc=domain,dc=tld
ou: Groups
objectClass: organizationalUnit

# People, my.domain.tld
dn: ou=People,dc=my,dc=domain,dc=tld
ou: People
objectClass: organizationalUnit

# user1, People, my.domain.tld
dn: uid=user1,ou=People,dc=my,dc=domain,dc=tld
uid: user1
cn: John Doe
displayName: John Doe
givenName: Doe
sn: Doe
objectClass: inetOrgPerson
mail: johndoe@domain.tld

# dev, Groups, my.domain.tld
dn: cn=dev,ou=Groups,dc=my,dc=domain,dc=tld
cn: dev
gidNumber: 30000
memberUid: user1
objectClass: posixGroup
objectClass: top
description: developers

# search result
search: 2
result: 0 Success

# numResponses: 6
# numEntries: 5

This command requires /etc/ldap/ldap.conf. If you don’t have ldap.conf configured you’d have to type the whole command :

# ldapsearch -x -b "dc=my,dc=domain,dc=tld" -H ldap://server

Now, you can authenticate several services against your new LDAP server.
For example, web authentication in Apache.. Take a look at http://www.wains.be/index.php/2010/01/26/apache-simple-authentication-and-ldap-authentication-examples/

You also may want to install PHP LDAP Admin for managing your LDAP database through a web GUI :

# apt-get install phpldapadmin

Then go to http://server/phpldapadmin and authentify with cn=admin,dc=my,dc=domain,dc=tld and your rootpw.

Local user authentication with FreeRADIUS

January 25, 2010 - No comment

This one is a bit less complex than http://www.wains.be/index.php/2009/09/13/wpa2-freeradius-eap-tls/

This is actually the most basic RADIUS configuration ever, useful for quick tests. I can only recommend checking the post mentioned above if you want to do something serious.

# apt-get install freeradius

# vim /etc/freeradius/users

login     Cleartext-Password := "password"
login2     Cleartext-Password := "password2"
#vim /etc/freeradius/clients.conf

client localhost {
	ipaddr = 127.0.0.1
        secret = radiuspassword
}

client router {
	ipaddr = 10.0.0.1
        secret = radiuspassword
}

# /etc/init.d/freeradius restart

Check if RADIUS is working :

# radtest login password localhost 1812 radiuspassword
Sending Access-Request of id 222 to 127.0.0.1 port 1812
User-Name = "login"
User-Password = "password"
NAS-IP-Address = 127.0.1.1
NAS-Port = 1812
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=222, length=20

# radtest login2 password2 localhost 1812 radiuspassword
Sending Access-Request of id 1 to 127.0.0.1 port 1812
User-Name = "login2"
User-Password = "password2"
NAS-IP-Address = 127.0.1.1
NAS-Port = 1812
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=1, length=20

We expect Access-Accept from the server, not Access-Reject…

Configure your wireless access point :

Usually found under Security tab (or RADIUS, 802.1X, etc.)
Configure your device at 10.0.0.1 to authenticate against the Radius server with password radiuspassword.
Try to connect to your wireless access point using login and password.

Installing TRAC with Apache2 and mod-python on Debian Lenny

January 20, 2010 - 1 comment

This is based on a fresh install.

Install the necessary stuff :

# apt-get install apache2 subversion trac
# apt-get install libapache2-svn

libapache2-svn will enable dav and dav_fs modules.

More stuff :

# apt-get install libapache2-mod-python

Create your directories for TRAC environments (/home/trac/), projects source files (/home/dev/) and SVN repositories (/home/svn/) :

# mkdir /home/{trac,dev,svn}

Create your first project :

# mkdir /home/dev/project1
# echo "<?php phpinfo() ?>" > /home/dev/project1/index.php

Create the SVN repository for the project :

# svnadmin create /home/svn/project1

Import the project into the SVN repository :

# svn import -m "Initial import" /home/dev/project1/ file:///home/svn/project1/
Adding         /home/dev/project1/index.php

Committed revision 1.

Move your sources to a safe place, while we checkout the project :

# mv /home/dev/project1 /home/dev/project1-orig

Checkout the project :

# svn checkout file:///home/svn/project1 /home/dev/project1
A /home/dev/project1/index.php
Checked out revision 1.

Make sure the project is now under revision, you should see a “.svn” directory :

# ls -lah /home/dev/project1
total 16K
drwxr-xr-x 3 root root 4.0K Jan 20 12:42 .
drwxr-xr-x 4 root root 4.0K Jan 20 12:42 ..
drwxr-xr-x 6 root root 4.0K Jan 20 12:42 .svn
-rw-r--r-- 1 root root 19 Jan 20 12:42 index.php

It’s now safe to delete the copy not under revision :

# rm -fr /home/dev/project1-orig/

Set up TRAC for your first project, in bold what you need to specify :

# trac-admin /home/trac/project1 initenv
Creating a new Trac environment at /home/trac/project1

Trac will first ask a few questions about your environment
in order to initialize and prepare the project database.

 Please enter the name of your project.
 This name will be used in page titles and descriptions.

Project Name [My Project]> Project1

 Please specify the connection string for the database to use.
 By default, a local SQLite database is created in the environment
 directory. It is also possible to use an already existing
 PostgreSQL database (check the Trac documentation for the exact
 connection string syntax).

Database connection string [sqlite:db/trac.db]> PRESS ENTER

 Please specify the type of version control system,
 By default, it will be svn.

 If you don't want to use Trac with version control integration,
 choose the default here and don't specify a repository directory.
 in the next question.

Repository type [svn]> svn

 Please specify the absolute path to the version control
 repository, or leave it blank to use Trac without a repository.
 You can also set the repository location later.

Path to repository [/path/to/repos]> /home/svn/project1

Creating and Initializing Project
 Installing default wiki pages
 TracSyntaxColoring imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracSyntaxColoring
 TracChangeset imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracChangeset
 TracWiki imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracWiki
 WikiHtml imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/WikiHtml
 TracRevisionLog imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracRevisionLog
 TracFastCgi imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracFastCgi
 TracTicketsCustomFields imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracTicketsCustomFields
 SandBox imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/SandBox
 WikiMacros imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/WikiMacros
 TracUpgrade imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracUpgrade
 TracBackup imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracBackup
 TracAccessibility imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracAccessibility
 RecentChanges imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/RecentChanges
 WikiDeletePage imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/WikiDeletePage
 TracNavigation imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracNavigation
 TracImport imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracImport
 TracModPython imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracModPython
 TracEnvironment imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracEnvironment
 TracBrowser imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracBrowser
 WikiFormatting imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/WikiFormatting
 TracPlugins imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracPlugins
 WikiPageNames imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/WikiPageNames
 TracNotification imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracNotification
 TracInstall imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracInstall
 TracIni imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracIni
 TracAdmin imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracAdmin
 TracRss imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracRss
 TracLogging imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracLogging
 TracGuide imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracGuide
 WikiStart imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/WikiStart
 TracQuery imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracQuery
 WikiNewPage imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/WikiNewPage
 CamelCase imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/CamelCase
 TracRoadmap imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracRoadmap
 TracLinks imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracLinks
 TracStandalone imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracStandalone
 TracInterfaceCustomization imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracInterfaceCustomization
 TracUnicode imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracUnicode
 InterMapTxt imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/InterMapTxt
 TracPermissions imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracPermissions
 TitleIndex imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TitleIndex
 WikiProcessors imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/WikiProcessors
 InterWiki imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/InterWiki
 TracCgi imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracCgi
 TracTimeline imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracTimeline
 InterTrac imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/InterTrac
 PageTemplates imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/PageTemplates
 TracTickets imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracTickets
 TracSupport imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracSupport
 TracWorkflow imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracWorkflow
 TracSearch imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracSearch
 TracFineGrainedPermissions imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracFineGrainedPermissions
 WikiRestructuredTextLinks imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/WikiRestructuredTextLinks
 TracReports imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/TracReports
 WikiRestructuredText imported from /usr/lib/python2.5/site-packages/trac/wiki/default-pages/WikiRestructuredText
 Indexing repository
 [1]
---------------------------------------------------------------------
Project environment for 'Project1' created.

You may now configure the environment by editing the file:

  /home/trac/project1/conf/trac.ini

If you'd like to take this new project environment for a test drive,
try running the Trac standalone web server `tracd`:

  tracd --port 8000 /home/trac/project1

Then point your browser to http://localhost:8000/project1.
There you can also browse the documentation for your installed
version of Trac, including information on further setup (such as
deploying Trac to a real web server).

The latest documentation can also always be found on the project
website:

http://trac.edgewall.org/

Congratulations

The configuration is stored under /home/trac/project1/conf/trac.ini.

Create the password files for web authentication :

# htpasswd -c /etc/apache2/passwd-trac yourusername

Set up Apache :

# cp /etc/apache2/sites-available/default /etc/apache2/sites-available/projects

# vim /etc/apache2/sites-available/projects
<VirtualHost *:80>
    DocumentRoot /var/www/

    <Directory /var/www/>
        Order allow,deny
        Allow from all
    </Directory>

    ### TRAC Root : http://server/trac or http://server/trac/

        # Rewrite ./trac to ./trac/
        RewriteEngine on
        RewriteRule ^(.*)\/trac$ $1/ [NC]

    <Location /trac/>
        SetHandler mod_python
        PythonHandler trac.web.modpython_frontend
        PythonInterpreter main
        PythonOption TracEnvParentDir /home/trac
        PythonOption TracUriRoot /trac/
        SetEnv PYTHON_EGG_CACHE /tmp
    </Location>

    ### TRAC Login : http://server/trac/*/login
    <LocationMatch ^(/trac/[^/]+)?/login>
        AuthType Basic
        AuthName "TRAC Login"
        AuthUserFile /etc/apache2/passwd-trac
        Require valid-user
    </LocationMatch>

    ### SVN repository : http://server/svn
    <Location /svn>
        DAV svn
        SVNParentPath /home/svn
        SVNListParentPath on

        AuthType Basic
        AuthName "SVN Repository"
        AuthUserFile /etc/apache2/passwd-trac
        Require valid-user
    </Location>
</VirtualHost>

Enable rewrite module :

# a2enmod rewrite
Enabling module rewrite.
Run '/etc/init.d/apache2 restart' to activate new configuration!

Disable the default website :

# a2dissite default
Site default disabled.
Run '/etc/init.d/apache2 reload' to activate new configuration!

Enable the newly configured website :

# a2ensite projects
Enabling site projects.
Run '/etc/init.d/apache2 reload' to activate new configuration!

Restart Apache :

# /etc/init.d/apache2 restart

Make sure Apache can read and write TRAC configuration files.
This is a basic working example but you may want to do something more elaborate involving Set-GID or POSIX ACL.

# chown -R www-data. /home/trac

Now go to http://server/trac, it should rewrite the URL to http://server/trac/ and display a list of available projects.

WALLA ;)

Please let me know if it works for you. Thanks.

Partially based on http://www.willamaze.eu/?p=732

Asterisk dependencies on Debian Lenny or Squeeze ??

January 16, 2010 - 3 comments

Can someone explain why build-essential is a dependency of Asterisk under Lenny or Squeeze ?

142 MB.. seriously ? Meanwhile Askozia fits on 30 MB, and that includes the OS.

# apt-get install asterisk
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
  asterisk-config asterisk-sounds-main binutils build-essential bzip2 ca-certificates cpp cpp-4.3 debhelper dpkg-dev file g++ g++-4.3 gcc gcc-4.3 gettext gettext-base
  html2text intltool-debian libasound2 libc-client2007b libc6-dev libcap2 libcompress-raw-zlib-perl libcompress-zlib-perl libcurl3 libdigest-hmac-perl libdigest-sha1-perl
  libfile-remove-perl libgmp3c2 libgomp1 libgsm1 libidn11 libiksemel3 libio-compress-base-perl libio-compress-zlib-perl libio-stringy-perl libldap-2.4-2 libltdl3
  libmagic1 libmail-box-perl libmail-sendmail-perl libmailtools-perl libmime-types-perl libmpfr1ldbl libobject-realize-later-perl libogg0 libpci3 libperl5.10 libpq5
  libpri1.0 libradiusclient-ng2 libsensors3 libsnmp-base libsnmp15 libspeex1 libspeexdsp1 libsqlite0 libssh2-1 libstdc++6-4.3-dev libsys-hostname-long-perl libsysfs2
  libtimedate-perl libtonezone1 liburi-perl libuser-identity-perl libvorbis0a libvorbisenc2 libvpb0 linux-libc-dev make mlock module-assistant odbcinst1debian1 openssl
  patch perl perl-modules po-debconf ucf unixodbc vpb-driver-source
Suggested packages:
  ekiga ohphone twinkle kphone asterisk-doc asterisk-dev asterisk-h323 binutils-doc bzip2-doc cpp-doc gcc-4.3-locales dh-make debian-keyring g++-multilib g++-4.3-multilib
  gcc-4.3-doc libstdc++6-4.3-dbg gcc-multilib manpages-dev autoconf automake1.9 libtool flex bison gdb gcc-doc gcc-4.3-multilib libmudflap0-4.3-dev libgcc1-dbg
  libgomp1-dbg libmudflap0-dbg cvs gettext-doc libasound2-plugins uw-mailutils glibc-doc libmime-tools-perl libhtml-tree-perl libhtml-format-perl spamassassin
  libmail-imapclient-perl lm-sensors speex libstdc++6-4.3-doc libwww-perl vpb-utils make-doc diff-doc perl-doc libterm-readline-gnu-perl libterm-readline-perl-perl
  libmyodbc odbc-postgresql libct1
The following NEW packages will be installed:
  asterisk asterisk-config asterisk-sounds-main binutils build-essential bzip2 ca-certificates cpp cpp-4.3 debhelper dpkg-dev file g++ g++-4.3 gcc gcc-4.3 gettext
  gettext-base html2text intltool-debian libasound2 libc-client2007b libc6-dev libcap2 libcompress-raw-zlib-perl libcompress-zlib-perl libcurl3 libdigest-hmac-perl
  libdigest-sha1-perl libfile-remove-perl libgmp3c2 libgomp1 libgsm1 libidn11 libiksemel3 libio-compress-base-perl libio-compress-zlib-perl libio-stringy-perl
  libldap-2.4-2 libltdl3 libmagic1 libmail-box-perl libmail-sendmail-perl libmailtools-perl libmime-types-perl libmpfr1ldbl libobject-realize-later-perl libogg0 libpci3
  libperl5.10 libpq5 libpri1.0 libradiusclient-ng2 libsensors3 libsnmp-base libsnmp15 libspeex1 libspeexdsp1 libsqlite0 libssh2-1 libstdc++6-4.3-dev
  libsys-hostname-long-perl libsysfs2 libtimedate-perl libtonezone1 liburi-perl libuser-identity-perl libvorbis0a libvorbisenc2 libvpb0 linux-libc-dev make mlock
  module-assistant odbcinst1debian1 openssl patch perl perl-modules po-debconf ucf unixodbc vpb-driver-source
0 upgraded, 83 newly installed, 0 to remove and 0 not upgraded.
Need to get 47.3MB of archives.
After this operation, 142MB of additional disk space will be used.
Do you want to continue [Y/n]?

EDIT Janv. 30 :

Thanks to Kurt for the tip in the comments.
It completely went unnoticed to me, but Debian Lenny indeed installs “recommends” packages :

To avoid the bloat caused by this new policy, edit /etc/apt/apt.conf and add :
APT::Install-Recommends "0";

The result is clear : 

# apt-get install asterisk
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
  asterisk-config asterisk-sounds-main ca-certificates libasound2
  libc-client2007b libcap2 libcurl3 libgsm1 libidn11 libiksemel3 libldap-2.4-2
  libltdl3 libogg0 libpci3 libperl5.10 libpq5 libpri1.0 libradiusclient-ng2
  libsensors3 libsnmp-base libsnmp15 libspeex1 libspeexdsp1 libsqlite0
  libssh2-1 libsysfs2 libtonezone1 libvorbis0a libvorbisenc2 libvpb0 mlock
  odbcinst1debian1 openssl ucf unixodbc
Suggested packages:
  ekiga ohphone twinkle kphone asterisk-doc asterisk-dev asterisk-h323
  libasound2-plugins uw-mailutils lm-sensors speex vpb-utils libmyodbc
  odbc-postgresql libct1
Recommended packages:
  vpb-driver-source
The following NEW packages will be installed:
  asterisk asterisk-config asterisk-sounds-main ca-certificates libasound2
  libc-client2007b libcap2 libcurl3 libgsm1 libidn11 libiksemel3 libldap-2.4-2
  libltdl3 libogg0 libpci3 libperl5.10 libpq5 libpri1.0 libradiusclient-ng2
  libsensors3 libsnmp-base libsnmp15 libspeex1 libspeexdsp1 libsqlite0
  libssh2-1 libsysfs2 libtonezone1 libvorbis0a libvorbisenc2 libvpb0 mlock
  odbcinst1debian1 openssl ucf unixodbc
0 upgraded, 36 newly installed, 0 to remove and 13 not upgraded.
Need to get 14.0MB of archives.
After this operation, 33.2MB of additional disk space will be used.
Do you want to continue [Y/n]?

AFP server in under 15 minutes (Debian)

January 14, 2010 - 10 comments

Tested under Debian Lenny 32 bits.

This howto is based on http://www.kremalicious.com/2008/06/ubuntu-as-mac-file-server-and-time-machine-volume/
Matthias’ post is very comprehensive. This post is basically a raw copy paste of commands, if you want more information, go see Matthias post.
If you find this useful, please give credit to Matthias :-)

Why AFP (Apple Filing Protocol) ?

I wanted to see if AFP was faster than SMB.
A quick test showed my Macbook (running OS 10.6.2) is transfering files 20 % faster on AFP than SMB.

Build netatalk to support encryption

Starting with Netatalk version 2.0.4 (and Debian Squeeze) you won’t need to rebuild to support SSL (see Frank’s comment).

Lenny comes with version 2.0.3 so we still need to go through recompilation (which I recommend doing on another box).

# apt-get build-dep netatalk
# apt-get install cracklib2-dev fakeroot libssl-dev
# apt-get source netatalk
# cd netatalk-2*
# DEB_BUILD_OPTIONS=ssl dpkg-buildpackage -rfakeroot

Install modified version of netatalk

# dpkg -i ../netatalk_2*.deb
# echo "netatalk hold" | dpkg --set-selections

/etc/default/netatalk

ATALKD_RUN=no
PAPD_RUN=no
CNID_METAD_RUN=yes
AFPD_RUN=yes
TIMELORD_RUN=no
A2BOOT_RUN=no

/etc/netatalk/afpd.conf

- -transall -uamlist uams_dhx.so -nosavepassword

/etc/netatalk/AppleVolumes.default

/home/seb "Seb's share" allow:seb

Start netatalk

/etc/init.d/netatalk start

Advertise the service with Avahi

You can skip this step, but it’d mean the server doesn’t magically appear as a Shared drive in your Finder.

apt-get install avahi-daemon

/etc/avahi/services/afpd.service

<?xml version="1.0" standalone='no'?>
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
<service-group>
<name replace-wildcards="yes">%h AFP</name>
<service>
<type>_afpovertcp._tcp</type>
<port>548</port>
</service>
<service>
<type>_device-info._tcp</type>
<port>0</port>
<txt-record>model=Xserve</txt-record>
</service>
</service-group>

# /etc/init.d/avahi-daemon restart

Firewall :

Allow tcp/548 (netatalk) and tcp/5353 (avahi)

WPA2 + FreeRADIUS + EAP-TLS

September 13, 2009 - 10 comments

Tested under Debian Lenny

BUILDING AND INSTALLING FREERADIUS WITH TLS SUPPORT

Install the necessary packages :

apt-get install dpkg-dev fakeroot

Download the source :

cd /root
mkdir freeradius-tls
cd freeradius-tls
apt-get source freeradius

Make the changes :

Edit /root/freeradius-tls/debian/rules :

and change
--with
by
--without
for eap_tls, eap_ttls, eap_peap and openssl

Just as :
--with-rlm_eap_tls \
--with-rlm_eap_ttls \
--with-rlm_eap_peap \
--without-rlm_eap_tnc \
--without-rlm_otp \
--with-rlm_sql_postgresql_lib_dir=`pg_config --libdir`\
--with-rlm_sql_postgresql_include_dir=`pg_config --includedir` \
--with-openssl \
--without-rlm_eap_ikev2 \
--without-rlm_sql_oracle \
--without-rlm_sql_unixodbc \

Then, comment the following :
for pkg in ${pkgs} ; do \
if dh_shlibdeps -p $$pkg -- -O 2>/dev/null | grep -q libssl; then \
echo "$$pkg links to openssl" ;\
exit 1 ;\
fi ;\
done

Edit /root/freeradius-tls/debian/control :
On the line beginning by “Build-Depends”
Add the folowing :
", libssl-dev"
at the end of the line (without the quotes)

Install dev libraries :
apt-get install libssl-dev debhelper libgdbm-dev libiodbc2-dev libkrb5-dev libldap2-dev libltdl3-dev libmysqlclient15-dev libpam0g-dev libpcap-dev libperl-dev libpq-dev libsasl2-dev libsnmp-dev python-dev

Build freeradius :
dpkg-buildpackage -rfakeroot

Building will end by a warning message, this is not important.

Put the packages on hold to avoid upgrading with a non-TLS version of FreeRADIUS :

echo “freeradius hold” | dpkg --set-selections
echo "libfreeradius2 hold" | dpkg --set-selections
echo "freeradius-common hold" | dpkg --set-selections

Install the packages we’ve just built :
dpkg --install freeradius-common_2.0.4+dfsg-6_all.deb libfreeradius2_2.0.4+dfsg-6_i386.deb

CERTIFICATES

Creating the CA

apt-get install openssl

Edit /etc/ssl/openssl.cnf

[ CA_default ]
dir = ./PKI

Edit /usr/lib/ssl/misc/CA.sh

CATOP=./PKI

Then type :

cd /etc/ssl
/usr/lib/ssl/misc/CA.sh -newca

Set a challenge password and a passphrase. This is needed.
The CA created will be copied to the server and clients later on.

Optional : if you have Windows XP clients

Create /etc/openssl/PKI/xpextensions

[xpclient_ext]
extendedKeyUsage=1.3.6.1.5.5.7.3.2

[xpserver_ext]
extendedKeyUsage=1.3.6.1.5.5.7.3.1

Server certificate signing request :

cd /etc/ssl
openssl req -new -nodes -keyout PKI/server_key.pem -out PKI/server_req.pem -days 730 -config openssl.cnf

Set a challenge password

Sign the server certificate request (if winxp clients) :
cd /etc/ssl
openssl ca -config openssl.cnf -policy policy_anything -out PKI/server_cert.pem -extensions xpserver_ext -extfile PKI/xpextensions -infiles PKI/server_req.pem

Mac clients :
openssl ca -config openssl.cnf -policy policy_anything -out PKI/server_cert.pem -infiles PKI/server_req.pem

Then :
cp server_cert.pem server_cert.pem-backup

Edit server_cert.pem
Remove everything before the line —–BEGIN CERTIFICATE—– (this is needed for winxp clients)

Next :
cat server_key.pem server_cert.pem > server_keycert.pem

Create a client certificate signing request :
cd /etc/ssl
openssl req -new -keyout PKI/client_key.pem -out PKI/client_req.pem -days 730 -config openssl.cnf

Sign client cert request :
cd /etc/ssl
Windows xp client :
openssl ca -config openssl.cnf -policy policy_anything -out PKI/client_cert.pem -extensions xpclient_ext -extfile PKI/xpextensions -infiles PKI/client_req.pem
Mac OS X client :
openssl ca -config openssl.cnf -policy policy_anything -out PKI/client_cert.pem -infiles PKI/client_req.pem

Export P12 certs (Windows and Mac clients ) :

openssl pkcs12 -export -in client_cert.pem -inkey client_key.pem -out client_cert.p12 -clcerts

FREERADIUS CONFIG

FreeRadius

Do :
cp /etc/ssl/PKI/cacert.pem /etc/freeradius/certs/cacert.pem
cp /etc/ssl/PKI/server_keycert.pem /etc/freeradius/certs/server_keycert.pem

Then :
cd /etc/freeradius/certs
openssl dhparam -check -text -5 512 -out dh
dd if=/dev/urandom of=random count=2
chown freerad dh
chmod o-w dh

Next :
cp /etc/freeradius/eap.conf /etc/freeradius/eap.conf-default

/etc/freeradius/eap.conf :

eap {
        default_eap_type = tls
        timer_expire     = 60
        ignore_unknown_eap_types = no
        cisco_accounting_username_bug = no         

        tls {
                certdir = ${confdir}/certs
                cadir = ${confdir}/certs
                private_key_password = whatever
                private_key_file = ${certdir}/server_keycert.pem
                certificate_file = ${certdir}/server_keycert.pem
                CA_file = ${cadir}/cacert.pem
                dh_file = ${certdir}/dh
                random_file = ${certdir}/random
                fragment_size = 1024
                include_length = yes
                check_cert_cn = %{User-Name}
                cipher_list = "DEFAULT"
        }
}

Edit /etc/freeradius/clients.conf

We will consider the access-point that will authenticate users against the RADIUS server has the IP 192.168.7.45 :

client localhost {
        ipaddr = 127.0.0.1
        secret          = testing123
        require_message_authenticator = no
        nastype     = other     # localhost isn't usually a NAS...
}

client 192.168.7.45 {
        secret = suchasecurepassword
        shortname = linksys
}

Start FreeRADIUS :
freeradius -X -f

Set up wifi access point for authentication against our new RADIUS server

It depends on your hardware here.
You must usually go under the security panel of your device, where you can specify the IP/hostname and port of the RADIUS server, and the password (in our example : suchasecurepassword)

Configure clients

This will be the subject of a separate post as I will try to publish the method for all majors OSes (Linux, Mac and Windows) but don’t have much time for now.
Stay tuned !

This post is a stripped down version of the following howto by my colleague Jérôme :
http://hanoteau.blogspot.com/2009/03/howto-setup-eap-tls-wpa-network-with.html

GNBD on Debian installation howto

June 30, 2009 - 2 comments

GNBD is some kind of alternative to iSCSI and to a (much) lower extent to sshfs or other filesharing systems (NFS, Samba, etc.).

Unlike iSCSI, there’s no authentication or such, I invite you to read the documentation to learn more about GNBD.

Server (server.example.org) :

Optional : Create a test filesystem

dd if=/dev/zero of=/home/disk bs=1M count=1000
losetup -f (find the next available loop device)
losetup /dev/loop0 /home/disk
mkfs.ext3 -j /dev/loop0

Install GNBD on the server and start :

apt-get install gnbd-server
/etc/init.d/gnbd-server start or gnbd-server -n

Export the device :

gnbd_export -d /dev/loop0 -e DISK -c

Replace /dev/loop0 by any device on your system you want to share (eg : /dev/sda2).
DISK will be the name of the exported device.

List the current exported drives :

gnbd_export

Client

Install GNBD on the client (client.example.org) :

apt-get install gnbd-client redhat-cluster-modules-2.6.26-2-686
(pick the package matching your architecture)

modprobe gnbd

List exports on the server from the client :

gnbd_import -e server.example.org -n

Create the device for the shared drive on the client :

gnbd_import -i server.example.org -n

This will result in a new device available under /dev/gnbd/DISK

Mount the device :

mount /dev/gnbd/DISK /mnt/DISK

Done !

Sources :

Linux Magazine France n° 118 and Vincent ;-)

ztdummy for Debian Lenny

December 3, 2008 - 2 comments

I just compiled zaptel-modules for Debian Lenny (Kernel 2.6.26 i386)
That package contains the ztdummy module.

Here’s a link to the package :
http://www.wains.be/pub/zaptel-modules-2.6.26-1-686_1.4.11~dfsg-2+2.6.26-10_i386.deb

Next Page »