The following pages detail the installation of a Debian based operating system to do the following:
Although all the steps are shown to achieve this, they are not all explained in depth. This is more of a reminder to me so that a reinstall can be performed! If you do have any questions, please email me. The following assumptions are made:
The assumption of the install is that no internet connection is available. Therefore the following are required initially:
Install as follows:
Set up partitioning as required. I used automatic partitioning.
We setup the internet connection now so that we can download further packages.
The Solos PCI drivers are bundled with recent kernel versions. I have previously had problems with the bundled versions and had to install from source. However, as of Squeeze they work out of the box.
apt-get install ppp
"username@isp" "*" "password"
Replace username and password as appropriate
noipdefault defaultroute user username@isp noauth updetach usepeerdns plugin pppoatm.so 0.0.38
Replace username as appropriate
For ease, both files are located at: http://files.andybev.com/web-portal/speedtouch1/speedtch-1.bin http://files.andybev.com/web-portal/speedtouch1/speedtch-2.bin
Alternatively, these firmware files may work (for other versions): http://files.andybev.com/web-portal/speedtouch2/speedtch-1.bin http://files.andybev.com/web-portal/speedtouch2/speedtch-2.bin
Obviously you will need to download these on another PC if you do not currently have internet on the current server.
apt-get install ppp
Create file /etc/ppp/chap-secrets with the following contents:
"username@isp" "*" "password"
Replace username and password as appropriate
Create file /etc/ppp/peers/isp0 with the following contents:
noipdefault defaultroute user username@isp noauth updetach usepeerdns plugin pppoatm.so 0.38
Replace username as appropriate
Disconnect and reconnect the USB modem to force it to load the firmware. Once the modem has synced, connect as below.
Connect to the internet using pppd call isp0
This will be set to happen automatically later.
A number of additional packages are needed and can be installed using apt. Because the installation was initially done from a CD, no network repositories will be available, so it is best to set one up using the netselect command. However, netselect is not currently installed and is not on the CD! So, setup a temporary network repository first:
echo deb http://ftp.debian.org/debian squeeze main > /etc/apt/sources.list apt-get update
Then install netselect-apt:
apt-get install netselect-apt
And finally use netselect to setup the best repositories:
cd /etc/apt netselect-apt squeeze apt-get update
apt-get install conntrack iptraf joe sudo squid3 php5 mysql-server php5-mysql
apt-get install dhcp3-server
Restart apache to load PHP (apache2ctl restart)
auto eth0 iface eth0 inet static address 10.0.0.1 netmask 255.255.0.0
auto eth1 iface eth1 inet static address 192.168.0.1 netmask 255.255.255.0
/etc/init.d/networking restart
Whenever told to edit files from this point use the Joe editor started with the command “joe <file to edit>”
cd /var/ wget files.andybev.com/web-portal/portalshaper-www.tar.gz tar -zxvf portalshaper-www.tar.gz rm portalshaper-www.tar.gz
echo create database portal | mysql -pmysql -p portal < portal-schema.sqlecho grant INSERT,UPDATE,DELETE,SELECT,LOCK TABLES on portal.* to 'portal'@'localhost' identified by \'<password>\'|mysql -pcd /etc/apache2/mods-enabled ln -s ../mods-available/rewrite.load
Options +FollowSymlinks
RewriteEngine On
RewriteCond %{HTTP_HOST} !^qualso [NC]
RewriteCond %{HTTP_HOST} !^earth [NC]
RewriteRule . http://qualso.wardroom/index.php/%{HTTP_HOST}%{REQUEST_URI}?%{QUERY_STRING} [L,R]
apache2ctl restartThe DNS server is used to serve domain names of the local network and can also be used as a caching nameserver.
zone "wardroom" {
type master;
file "/etc/bind/db.wardroom";
};
qualso A 10.0.0.1 earth A 10.0.0.1 mail A 10.0.0.1
/etc/init.d/bind9 reloadauthoritativeoption domain-name to wardroomoption domain-name-servers to 10.0.0.1allow booting; and allow bootp; after the above lines (only if using network boot clients - see later)subnet 10.0.0.0 netmask 255.255.0.0 {
option subnet-mask 255.255.0.0;
range 10.0.10.0 10.0.30.255;
option broadcast-address 10.0.255.255;
option routers 10.0.0.1;
option root-path "10.0.0.1:/opt/ubuntu";
filename "pxelinux.0";
next-server 10.0.0.1;
}
The last 3 lines are only for network booting of clients. On a separate page (see link later) it is shown how to set up some network booting deskstations that will boot a network live copy of Ubunutu.
Restart the DHCP server: <code>
/etc/init.d/isc-dhcp-server restart
IPSet is a program that allows sets of IP addresses to be stored within iptables rules. It is used to collate a list of clients using P2P software. IPSet consists of both a kernel module and a userspace program. The module is not yet in the kernel provided with Debian. The following will install both the userspace program and the kernel module.
aptitude install ipset ipset-source module-assistant module-assistant auto-install ipset-source
These are a variety of scripts to do traffic shaping, force users to log on, and check that the PPP link is up. Full details are available on other pages of this Wiki.
cd /usr/local/bin wget http://files.andybev.com/web-portal/rmtrack chmod +x rmtrack
cd /usr/local/bin wget http://files.andybev.com/web-portal/test-ppp chmod +x test-ppp cd /etc/init.d wget http://files.andybev.com/web-portal/test-ppp.init chmod +x test-ppp.init insserv test-ppp.init
cd /usr/local/bin wget http://files.andybev.com/web-portal/linkstats-ppp0 chmod +x linkstats-ppp0 wget http://files.andybev.com/web-portal/linkstats-eth0 chmod +x linkstats-eth0 wget http://files.andybev.com/web-portal/tc-viewer chmod +x tc-viewer
cd /usr/local/ wget http://files.andybev.com/web-portal/portalshaper-sh.tar.gz tar -zxvf portalshaper-sh.tar.gz rm portalshaper-sh.tar.gz
/usr/local/portal/settings as requiredThe scripts within /usr/local/portal can be edited as required. Load balancing is enabled by default, but will obviously make no difference for only one interface.
noipdefault
nodefaultroute
user cwdwardroom1@cwlogin.adsl24.co.uk
noauth
updetach
plugin pppoatm.so
1.0.38
echo '101 balance1' >> /etc/iproute2/rt_tables
echo '102 balance2' >> /etc/iproute2/rt_tables
The following are some further optional examples:
Use the script at http://files.andybev.com/web-portal/mess-office
And add it to the “master” script just after the captive-portal entry
auto ppp0
iface ppp0 inet ppp
pre-up /etc/network/solos-preload solos-pci0
provider isp0
post-up /usr/local/portalshaper/master
auto ppp1
iface ppp1 inet ppp
pre-up /etc/network/solos-preload solos-pci1
provider isp1
post-up /usr/local/portalshaper/master
cd /etc/network/ wget http://files.andybev.com/web-portal/solos-preload chmod +x solos-preload
killall pppd
ifup ppp0
visudo and add the following lines. Sudo is used to allow the apache web server to add and remove the needed iptables rules each time a user signs up to access the internet, as well as update the Squid session helper when displaying announcement pageswww-data ALL = NOPASSWD: /sbin/iptables -I internet 1 -t nat -m time --datestop ??????????????????? -m mac --mac-source ??\:??\:??\:??\:??\:?? -j RETURN www-data ALL = NOPASSWD: /sbin/iptables -D internet -t nat -m time --datestop ??????????????????? -m mac --mac-source ??\:??\:??\:??\:??\:?? -j RETURN www-data ALL = NOPASSWD: /usr/local/bin/rmtrack [0-9]*.[0-9]*.[0-9]*.[0-9]* www-data ALL = (proxy) NOPASSWD: /usr/lib/squid3/ext_session_acl
Note: sudo does not use regular expressions, so the last statement is not as accurate as it should be
Squid is configured to show splash page announcements and mark packets for traffic shaping. Both of these require recent patches which are only contained in the latest beta version of Squid. Therefore, a very recent version of Squid will need to be compiled and installed over the standard Debian build > |
The web proxy is used to speed up requests, as well as log all requests and show a splash page periodically.
# We don't want persistent connections, otherwise lots # of requests to the same server will look like a bulk download server_persistent_connections off # Add a "fake" mark. This will stop packets being routed # incorrectly, at the early routing stages. They will be # properly routed at the re-route stage. qos_flows mark miss=0x1000000/0xF000000
acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1
acl our_networks src 10.0.0.0/16 # This ACL will only allow active sessions. Sessions are made active with separate # PHP code within the announce.php splash page external_acl_type session_active_def concurrency=100 ttl=3 %SRC /usr/lib/squid3/ext_session_acl -a -T 10800 -b /var/lib/squid/session/ acl session_is_active external session_active_def external_acl_type session_day_def ttl=60 %SRC /usr/lib/squid3/datetime_acl.pl /var/www/announce_days.txt acl session_day external session_day_def acl images urlpath_regex -i (\.gif$|\.jpg$|\.png$|\.jpeg$) deny_info http://qualso.wardroom/announce.php?url=%u session_day session_is_active images http_access deny session_day !session_is_active !images http_access allow our_networks
mkdir -p /var/lib/squid/session chown proxy:proxy /var/lib/squid/session/
cd /usr/lib/squid3/
wget ''%%http://files.andybev.com/web-portal/datetime_acl.pl%%''
chmod +x datetime_acl.pl
/etc/init.d/squid3 restartIf you have 2 hard drives, use the steps in the following website to set up a software RAID:
apt-get install autofs udev
mkdir /mnt/usb
udevadm info --query all --path /sys/block/sdc/sdc1/ |grep UUID
/mnt/usb /etc/auto.removable --timeout=2,sync,nodev,nosuid
backupusb -fstype=auto UUID=c9a095d8-c867-496b-98d4-d09c5c7f109f
/etc/init.d/autofs restart
Whenever the USB stick is pugged in, it will be mounted in /mnt/usb/backupusb
[client]
user=portal
password=<password>
crontab -e and add the following line:
0 12 * * * /usr/bin/mysqldump --defaults-extra-file=/root/backup.cnf --lock-tables portal > /mnt/usb/backupusb/portal-`/bin/date +\%a`.sql
Performing this step allows any user on the network to send mail through the server. By creating the setup shown below, any user wishing to send mail from their PC on the network will have to set up their mail client to authenticate with the server before they can send.
The setup as shown will configure postfix as a smarthost, sending email to the ISP's mail server. This is preferable to sending email directly, as it is fairly likely that the IP address of the ADSL connection will be blacklisted.
apt-get install postfix (this will remove Exim)apt-get install libsasl2-modulesisp.server.name USERNAME:PASSWORD
chown root:root /etc/postfix/relay_passwd chmod 600 /etc/postfix/relay_passwd
postmap /etc/postfix/relay_passwd
smtp_sasl_auth_enable = yes smtp_sasl_password_maps = hash:/etc/postfix/relay_passwd smtp_sasl_security_options =
10.0.0.0/16 to the “mynetworks” configuration lineIf you want to force people to authenticate, then:
useradd -g users mailuser passwd mailuser
/bin/false on the end of the line for the new user. This will stop people logging into the server using that username and password!iptraf or linkstatsThe page here shows how to set up an image on the server for any deskstation to network boot from. The great advantage of this is that each time a user has used the deskstation in question, the PC can be rebooted and the operating system will effectively be 're-installed'. Very low maintenance! Each time a user closes the firefox web browser, they will be presented with a single-click 'I agree to the terms and conditions' screen.