This guide explains how you can install Apple’s Safari browser on Ubuntu 7.10. As there is no Linux version of Safari, we will run it under Wine. We will use a tool called PlayOnLinux to install Safari under Wine. With PlayOnLinux you can install lots of Windows games and some Windows applications (such as Office 2003, IE6, MS Money, etc.) on Linux. Installing Safari on Linux is good for people such as web designers who have switched to Linux but still need to test their web sites in other browsers.

I do not issue any guarantee that this will work for you!

1 Installing PlayOnLinux

Open Firefox and go to http://www.playonlinux.com/en/download.html. Click on the link reading Click here for the .deb package:

In the Firefox download dialogue, select Open with GDebi Package Installer (default):

After the download has finished, the Package Installer comes up. Click on the Install Package button:

Type in your password:

Afterwards, the dependencies of PlayOnLinux are being downloaded and installed:

Next, PlayOnLinux is being installed:

After the installation you can click on Close and leave the Package Installer:

2 Starting PlayOnLinux For The First Time

Now open a terminal (Applications > Accessories > Terminal):

We install the package cabextract (which is needed to extract .exe files) like this:

sudo apt-get install cabextract

Afterwards, we start PlayOnLinux by typing:

playonlinux

If 3D aceleration isn’t enabled on your desktop and you get a warning like in the below image, you can click it away. It’s not important (at least for Safari – this might be different if you want to install Windows games which I haven’t tried):

Now PlayOnLinux is being initialized. Click your way through the following dialogues (which are in French – we will change PlayOnLinux’ language soon):

Click on Télecharger (means Download in French):

Click on Suivant (means Next):

Finally, we get to the PlayOnLinux window:

3 Configuring PlayOnLinux

First let’s change the language of PlayOnLinux (if French isn’t your mother tongue). Go to Options > Langue:

Click on Suivant:

Select your preferred language and click on Suivant:

The change will take effect after a restart of PlayOnLinux (which we will do later – we still have to configure a few other things):

Next we set up the repositories where PlayOnLinux downloads its scripts from (there are scripts for each Windows application that PlayOnLinux can install to run under Wine). Go to Options > Dépots:

Enable the Community repository:

Afterwards do the same again for the WorkOnLinux repository:

Finally we create a menu entry for PlayOnLinux in the Applications menu. Go to Options > Tableaux de bord…

… and click on Yes:

Now we must restart our desktop session. Press CTRL + ALT+ Backspace and log in again.

4 Installing Safari

Now start PlayOnLinux again, this time by using its menu entry (Applications > PlayOnLinux > PlayOnLinux):

After PlayOnLinux has started, click on the Install button:

The Installation wizard starts. Select WorkOnLinux and click on Next:

In the next step select Safari and click on Install:

Click on Install again:

Select Next…

… then Download:

Click on Next:

Install Microsoft Visual C++ by accepting its license:

The next window tells us that we must download the Safari .exe file from Apple before we can proceed:

Open Firefox and go to http://www.apple.com/safari/download/ (although PlayOnLinux displays another URL in the previous image). Select Safari for Windows XP or Vista (without Quicktime) and click on the Download Safari 3 Beta button:

Save the file somewhere on your computer:

Back in PlayOnLinux, click on Next…

… and then on Browse:

Select the Safari executable you’ve just downloaded from your hard drive…

… and click on Next:

The next message tells us to deselect Install Bonjour for Windows and Install Apple Software Update during the Safari setup – please keep this in mind, we’ll need it soon:

The Safari installer starts. Click on Next >:

Accept the Safari license:

Now it’s time to disable Install Bonjour for Windows as well as the Apple updates. This is important – otherwise Safari might not work as expected on Linux:

Now Safari is being installed:

Click on Finish to leave the installer:

In the next step PlayOnLinux downloads and installs the Adobe Flash player for Safari:

Click on Yes if you want to have a Safari shortcut on your desktop…

… and in the menu:

The Safari installation is complete, you can leave PlayOnLinux now:

Now you can start Safari:

This is how it looks:

5 Links

• Safari: http://www.apple.com/safari/download
• PlayOnLinux: http://www.playonlinux.com
• Wine: http://www.winehq.org
• Ubuntu: http://www.ubuntu.com

This document describes how to set up TrueCrypt with GUI on Ubuntu 7.10. TrueCrypt is a free open-source encryption software for desktop usage.

This howto is a practical guide without any warranty – it doesn’t cover the theoretical backgrounds. There are many ways to set up such a system – this is the way I chose.

1 Preparation

Set up a standard Ubuntu 7.10 system and update it.

2 Needed Packages

First we install some needed packages with the synaptic package manager.

• sun-java6-jre
• python-pexpect

You’ll see this window during the installation – mark the corresponding checkbox and proceed if you agree with the license agreement.

Afterwards check if all went well – open a terminal and enter.

java -version

The output should look like this:

java version “1.6.0_03″
Java(TM) SE Runtime Environment (build 1.6.0_03-b05)
Java HotSpot(TM) Client VM (build 1.6.0_03-b05, mixed mode, sharing)

3 Truecrypt

3.1 Installation

Open http://www.truecrypt.org/downloads.php within your browser and download the latest stable version for Ubuntu 7.10 (.tar.gz-file containing the .deb-package).

Afterwards unpack the .tar.gz-file, …

… switch to the folder with the unpacked files and install the .deb-package with the GDebi package installer (simply double click on the package). Click on “Install Package” to start the installation.

Enter the root password.

The package and its dependencies are being installed.

3.2 System Configuration

Please note, that the following steps (3.2.1 – 3.2.3) can be done automatically by the tcgui installer (step 4). Proceed if you have problems with the tcgui-installer or want to configure the system manually in the first place – otherwise go ahead with step 4.

3.2.1 Users & Groups

We have to add the group “truecrypt” to the system and afterwards we add the root-account and our user-account to it. The settings for users and groups are available in the gnome system menu.

Enter the root password.

Click on “Manage Groups“.

Click on “Add Group“.

Insert “truecrypt” (without the quotes) as name for the new group, mark the checkbox next to the root and your username and click on “OK“.

3.2.2 Sudo

Next we configure sudo in order that TrueCrypt is useable without a password query – open a terminal and enter:

sudo visudo

Add the following line:

%truecrypt ALL=(root) NOPASSWD:/usr/bin/truecrypt

It should look like this:

# /etc/sudoers
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the man page for details on how to write a sudoers file.
# Defaults
Defaults        !lecture,tty_tickets,!fqdn
# Uncomment to allow members of group sudo to not need a password
# %sudo ALL=NOPASSWD: ALL
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root    ALL=(ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
%truecrypt ALL=(root) NOPASSWD:/usr/bin/truecrypt

To save the changes press CTRL+O (STRG+O on a german keyboard) and hit enter. Close the editor via CTRL+X (STRG+X on a german keyboard).

3.2.3 TrueCrypt Group

As a last resort we have to assign TrueCrypt itself to the new group that we created at step 3.2.1. Open terminal and enter:

sudo chgrp truecrypt /usr/bin/truecrypt

Afterwards we check if all went well – enter:

truecrypt -l

If you’re NOT asked for a system password and the output looks like this …

No volumes mapped

… all is fine.

4 TrueCrypt GUI (tcgui)

Tcgui provides a GUI that is similar to the windows GUI for truecrypt. It’s licensed unter the GPL.

4.1 Download

Open http://tcgui.tc.funpic.de/en/download.htm (http://tcgui.tc.funpic.de/download.htm for German users) within your browser and download the latest version (When I was writing this howto the latest version was 0.4).

Afterwards unpack the file.

4.2 Installation

Open a terminal, switch to the unpacked files and run the installer.

cd Desktop/tcgui-0.4/
sudo bash install.sh $USER

Note: Don’t replace $USER with your username – simply copy & paste the line.

Choose your language (german or english) and answer the following questions with no (n) – unless you haven’t realized step 3.2.1 till 3.2.3. After the installation finished you have to log out and back in to take the changes effect.

4.3 Access The GUI

The TrueCrypt GUI is available in the gnome applications menu.

Click on “Yes” if you agree with the warranty agreement.

The GUI appears – make yourself familiar with it.

Note: Please have a look at the readme in the tcgui-folder (on your desktop). Which functions are working without problems and which not is described at the end of the file – so you should read it before you you’re playing around with the GUI

4.4 Deinstallation

If you want to deinstall the TrueCrypt GUI open a terminal and enter:

sudo bash /usr/share/tcgui/uninstall.sh

Note: The group “truecrypt” will not be deleted and the changes in the sudo configuration will not be restored.

5 Links

TrueCrypt: http://www.truecrypt.org/
TrueCrypt License: http://www.truecrypt.org/license.php
TrueCrypt Linux manpage: http://www.truecrypt.org/docs/linux-manpage.php
TrueCrypt GUI (en): http://tcgui.tc.funpic.de/en/index.htm
TrueCrypt GUI (de): http://tcgui.tc.funpic.de/index.htm
Ubuntu: http://www.ubuntu.com/

In this tutorial I will describe how to install and configure Snort (an intrusion detection system (IDS)) from source, BASE (Basic Analysis and Security Engine), MySQL, and Apache2 on Ubuntu 7.10 (Gutsy Gibbon). Snort will assist you in monitoring your network and alert you about possible threats. Snort will output its log files to a MySQL database which BASE will use to display a graphical interface in a web browser.

1. Gain root privileges

It is easiest to do this install as root user.

sudo su -

2. Install some packages

The following will install all the required packages to make this setup work:

apt-get install libpcap0.8-dev libmysqlclient15-dev mysql-client-5.0 mysql-server-5.0 bison flex apache2 libapache2-mod-php5 php5-gd php5-mysql libphp-adodb php-pear libc6-dev g++ gcc pcregrep

3. Get and compile snort

The Snort package in the Gutsy repo’s are out of date. So I prefered to download the most current and install that. This is the only thing we will compile from scratch.

The latest version of snort at the time of writing is 2.8.0.1

First let’s go to a working directory:

cd /usr/src/

Open a web browser and navigate to http://www.snort.org/dl right click on the most recent release and copy link location.

a. Download snort and snort rules

wget http://www.snort.org/dl/current/snort-2.8.0.1.tar.gz

There are a couple options for rules. The following will download the public rules, however with a quick registration at the snort site you can get more current rules. Your choice but the next command is run the same way with the appropriate URL:

wget http://snort.org/pub-bin/downloads.cgi/Download/vrt_pr/snortrules-pr-2.4.tar.gz

b. Unpack and get them ready for compile

tar zxvf snort-2.8.0.1.tar.gz
cd snort-2.8.0.1
tar zxvf ../snortrules-pr-2.4.tar.gz

c. Now compile them

./configure -enable-dynamicplugin –with-mysql
make
make install

Keep this directory handy as you can simply run

make uninstall

To uninstall snort later if you choose

d. Move things into position

We now need to move the rules and config for snort into position

mkdir /etc/snort /etc/snort/rules /var/log/snort
cd /usr/src/snort-2.8.0.1/etc
cp * /etc/snort/
cd ../rules
cp * /etc/snort/rules

4. Configure Snort

We need to modify the snort.conf file to suite our needs.

Open /etc/snort/snort.conf with your favorite text editor (nano, vi, vim, etc.).

# vi /etc/snort/snort.conf

Change “var HOME_NET any” to “var HOME_NET 192.168.1.0/24” (your home network may differ from 192.168.1.0)
Change “var EXTERNAL_NET any” to “var EXTERNAL_NET !$HOME_NET” (this is stating everything except HOME_NET is external)
Change “var RULE_PATE ../rules” to “var RULE_PATH /etc/snort/rules“

Scroll down the list to the section with “# output database: log, mysql, user=“, remove the “#” from in front of this line.
Change the “user=root” to “user=snort”, change the “password=password” to “password=snort_password“, “dbname=snort“
Make note of the username, password, and dbname. You will need this information when we set up the Mysql db.
Save and quit.

5. Setup the Mysql database.

Log into the mysql server.

# mysql -u root -p

Create the snort database. Make sure you change the ‘snort_password’ to something else!

mysql> create database snort;
grant all privileges on snort.* to ‘snort’@'localhost’ identified by ‘snort_password’; mysql> exit

We will use the snort schema for the layout of the database.

# mysql -D snort -u snort -p < /usr/src/snort-2.8.0.1/schemas/create_mysql

NOTE: Use your snort DB user password when prompted.

6. Time to test Snort

In the terminal type:

# snort -c /etc/snort/snort.conf

If everything went well you should see an ascii pig.

To end the test hit ctrl + c.

NOTE: If you get errors you may want to try commenting out lines 97,98 and 452 of /etc/snort/rules/web-misc.rules. This was an issue in the past but doesn’t seem to be anymore.

7. Get and install BASE

Open a web browser and go to http://sourceforge.net/project/showfiles.php?group_id=103348.

Click on download then right click on the newest tar.gz package and select copy link (at the time of writing this is base-1.3.9).

In the terminal type:

cd
wget http://easynews.dl.sourceforge.net/sourceforge/secureideas/base-1.3.9.tar.gz

Now go to your web document root (by default this is /var/www), unpack the tarball and set the permissions needed to configure BASE:

cd /var/www/
tar zxvf ~/base-1.3.9.tar.gz cd .. chmod 757 base-1.3.9

We want to make sure that a couple of Pear modules are activated:

pear install Image_Color
pear install Image_Canvas-alpha
pear install Image_Graph-alpha

8. Set up BASE

Open a web browser and navigate to http://YOUR.IP.ADDRESS/base-1.3.9/setup.

Click continue on the first page.

• Step 1 of 5: Enter the path to ADODB.
  This is /usr/share/php/adodb.
• Step 2 of 5:
  Database type = MySQL, Database name = snort, Database Host = localhost, Database username = snort, Database Password = snort_password
• Step 3 of 5: If you want to use authentication enter a username and password here and check the box.
• Step 4 of 5: Click on Create BASE AG.
• Step 5 of 5: once step 4 is done at the bottom click on Now continue to step 5.

Bookmark this page.

Change the permissions back on the /var/www/base-1.3.9 folder.

# chmod 755 /var/www/base-1.3.9

We are done. Congrats!!!

To start Snort in the terminal type (make sure you change eth0 to the right interface for your machine:

# snort -c /etc/snort/snort.conf -i eth0 -D

This starts snort using eth0 interface in a daemon mode.

To make sure it is running you can check with the following command:

# ps aux | grep snort

If it’s running you will see an entry similar to snort -c /etc/snort/snort.conf -i eth0 -D.

If you would like to learn how to write your own Snort rules there is a guide at http://www.snort.org/docs/snort_manual/node16.html.
Good luck.

Setting up Subversion

For detailed information on this, including alternate setups, have a look at Version Control with Subversion.

1. Install the required packages.

   sudo aptitude install enscript libapache2-mod-python python-docutils trac db4.3-util libapache2-svn subversion-tools

2. Create a virtual host directory for SVN. We’ll use /var/local/svn instead of /var/www so that Subversion instances don’t clog up the directory of web root directories.

   sudo mkdir -p /var/local/svn/svn.example.com

3. Create a development group, and add the web user to it.

   sudo addgroup example; sudo adduser www-data example

4. Add users to the development group. These are persons that need access to the repository.

   1. sudo adduser username1 example
   2. sudo adduser username2 example
   3. sudo adduser username3 example

5. Set the proper permissions.

   sudo chmod 2770 /var/local/svn/svn.example.com

6. Set up the repository.

   sudo svnadmin create /var/local/svn/svn.example.com

7. Clear the current password file. By default it’s for the svnserve protocol, but we’ll be using HTTPS (or just HTTP). We’ll be adding users to this file later in the process.

   sudo rm /var/local/svn/svn.example.com/conf/passwd
   sudo touch /var/local/svn/svn.example.com/conf/passwd

8. Allow the group to write to the repository.

   sudo chmod -R g+w /var/local/svn/svn.example.com

9. Set proper file ownership.

   sudo chown -R www-data:example /var/local/svn/svn.example.com

10. Set the repository access permissions. Information on how to do this can be found in the Path-Based Authorization section of Version Control with Subversion.

    sudo vi /var/local/svn/svn.example.com/conf/authz

11. Create a directory for the log files.

    sudo mkdir /var/log/apache2/svn.example.com

12. Add the site to the log rotation list.

    sudo vi /etc/logrotate.d/apache2

13. Configure the virtual host…

    sudo vi /etc/apache2/sites-available/svn.example.com

    …with the following data. If you don’t care about SSL, you can ignore the SSL options and run this on port 80.

    <VirtualHost [server's IP address]:443>
      ServerName svn.example.com
      <Location />
        DAV svn
        AuthType Basic
        AuthName "svn.example.com"
        AuthUserFile /var/local/svn/svn.example.com/conf/passwd
        AuthzSVNAccessFile /var/local/svn/svn.example.com/conf/authz
        SVNPath /var/local/svn/svn.example.com
        Require valid-user
      </Location>
      CustomLog /var/log/apache2/svn.example.com/access.log combined
      ErrorLog /var/log/apache2/svn.example.com/error.log
      SSLEngine on
      SSLCertificateFile /etc/apache2/ssl/apache.pem
    # Add this once there is a real (non self-signed) certificate.
    #  SSLCertificateKeyFile /etc/apache2/ssl/server.key
    </VirtualHost>
    <VirtualHost [server's IP address]:80>
      ServerName svn.example.com
      Redirect / https://svn.example.com/
    </VirtualHost>

    Reference:

    /etc/apache2/mods-enabled/dav_svn.conf

14. Enable the subversion virtual host.

    sudo a2ensite svn.example.com

15. Create user/password combinations.

    htpasswd /var/local/svn/svn.example.com/conf/passwd username

16. Restart the web server.

    sudo /etc/init.d/apache2 restart

17. If you’re going to have users working locally, set up svnwrap. (See the man page for details.)

    sudo ln -s /usr/bin/svnwrap /usr/local/bin/svn

Setting up Trac

1. Create the web directory. We’ll use /var/local/trac instead of /var/www so as not to clog up the directory of webroots.

   sudo mkdir /var/local/trac/trac.example.com

2. Set the proper permissions.

   sudo chmod 2770 /var/local/trac/trac.example.com

3. Create a Trac instance.

   sudo trac-admin /var/local/trac/trac.example.com initenv

4. Set proper ownership on the web directory.

   sudo chown -R www-data:example /var/local/trac/trac.example.com

5. Allow the group to write to the repository.

   sudo chmod -R g+w /var/local/trac/trac.example.com

6. Configure it.

   sudo vi /var/local/trac/trac.example.com/conf/trac.ini

7. Create a directory for the log files.

   sudo mkdir /var/log/apache2/trac.example.com

8. Add the site to the log rotation list.

   sudo vi /etc/logrotate.d/apache2

9. Configure the virtual host…

   sudo vi /etc/apache2/sites-available/trac.example.com

   …with the following data. If you don’t care about SSL, you can skip the SSL options and run this on port 80.

   # Trac Configuration
   <VirtualHost [server's IP address]:80>
     ServerName trac.example.com
     Redirect / https://trac.example.com/
   </VirtualHost>
   <VirtualHost [server's IP address]:443>
     ServerName trac.example.com
     DocumentRoot /var/local/trac/trac.example.com/
     Alias /trac/ /usr/share/trac/htdocs
     <Directory "/usr/share/trac/htdocs/">
         Options Indexes MultiViews
         AllowOverride None
         Order allow,deny
         Allow from all
     </Directory>
     <Location />
         SetHandler mod_python
         PythonHandler trac.web.modpython_frontend
         PythonInterpreter main_interpreter
         PythonOption TracEnv /var/local/trac/trac.example.com/
         PythonOption TracUriRoot /
         AuthType Basic
         AuthName "trac.example.com"
         # Use the SVN password file.
         AuthUserFile /var/local/svn/svn.example.com/conf/passwd
         Require valid-user
     </Location>
     CustomLog /var/log/apache2/trac.example.com/access.log combined
     ErrorLog /var/log/apache2/trac.example.com/error.log
     SSLEngine on
     SSLCertificateFile /etc/apache2/ssl/apache.pem
   # Add this once there is a real (non self-signed) certificate.
   #  SSLCertificateKeyFile /etc/apache2/ssl/server.key
   </VirtualHost>

   Reference:

   http://trac.edgewall.org/wiki/TracOnUbuntu

10. Enable the Trac virtual host.

    sudo a2ensite trac.example.com

11. Restart the web server.

    sudo /etc/init.d/apache2 restart

The last thing to do is add the subdomains “svn” and “trac” to the DNS configuration for your domain. Once this is done, Subversion and Trac will be integrated into your server environment, and will be accessible from the web.

Geubuntu 7.10 “Luna Nuova” is only the second release of the distro, which seems to trace Ubuntu’s release cycle. As the version number suggests, Geubuntu 7.10 is based on Ubuntu 7.10, from which it borrows the kernel and user conveniences like the restricted-drivers management utility.

Geubuntu is an installable live CD, but it can also be installed on top of an existing Ubuntu distro by installing specific packages from the Geubuntu mirror. Currently there’s only a 32-bit ISO available. To run Geubuntu on 64-bit hardware you’ll have to take the longer route of first installing a 64-bit version of Ubuntu and then getting Geubuntu packages that are compiled for 64-bit platforms.

Installing from the live CD requires about 1.5GB of disk space. The distro booted smoothly on all the computers I tried it on, including a 1.3GHz Celeron and two dual-core desktops, with a 2.0GHz E4400 and a 1.8GHz E6300. Geubuntu isn’t short on applications; some of the most used apps it includes are the Firefox Web browser, Pidgin instant messenger, Eclair and VLC media players, and the GIMP image editor. To keep its requirements low, Geubuntu bundles AbiWord word processor, Gnumeric spreadsheet, Orage Calendar, and the Thunar file manager instead of more resource-intensive office suites. If you want to install more apps you can use the Synaptic package manager.

Very usable desktop

The first thing you’ll notice about Geubuntu is its speed. Despite being based on Ubuntu 7.10, it runs well on older hardware like my Pentium Celeron 1.3GHz laptop. This is because Enlightenment isn’t as resource-hungry as Ubuntu’s default desktop environment GNOME, which Geubuntu doesn’t bundle.

Geubuntu boots into the visually stunning Sunshine theme created by its artist developer. The desktop sports panels at the top and bottom of the screen. To maximize the desktop real estate, the top panel folds over the top when not in use. The bottom panel, though minimal, is fully loaded with menu and application launchers, virtual desktop switcher, and applets like clock. I like its animated marquee-style auto-scrolling list of application launchers, which prevents the panel from taking too much space.

In addition to being visually stunning, Geubuntu’s Sunshine and Moonlight themes both have animated bits. Depending on the theme, a sun beam shines down from the sun or an Enlightenment logo appears on a large Moon and reflects in rippling water after regular intervals. Users can easily (and almost instantaneously) switch between the two themes at a click.

Of course this bling would be useless if it came at the price of usability. But that’s what I like about Geubuntu. It’s a stunning distro that’s also very usable, thanks to an assortment of components. Of note are two Xfce components, the Xfce panel and the Thunar file manager. These are complemented by bits and pieces from GNOME, such as the GNOME bar and applets like the network manager and the search applet.

Watch out for bugs!

The components that make this distro usable also introduce a few noticeable bugs, since they were not designed to interact with each other. And Enlightenment is still under heavy development and has several bugs of its own. Despite bundling Thunar file manager, Geubuntu relies on Enlightenment’s file manager, fm, for displaying desktop icons. However, you can’t mount or unmount removable devices or browse their files using their desktop icons; for that you need to use Thunar.

Also, when running Geubuntu from the live CD, the distro doesn’t log out without complaining that some task is taking too long to complete, giving you the option to either wait or continue with the logout. According to a post on the forums, it’s the Xfce panel that seems to be causing this and the developers are working on a solution. Strangely, once you’ve installed Geubuntu to the hard drive, it logs out without complaining.

This isn’t the only discrepancy between the live and installed versions of the distro. When I first installed it, the desktop didn’t display the top panel. I tried logging out, restarting the computer, killing and restarting the panels, but nothing worked. But reinstalling the distro brought back the panel.

Secondly, my PCMCIA wireless card, which worked from the live CD, didn’t work from the installed version. On the dual-core desktop, the distro picked up the wide-screen monitor and correctly booted into its 1440×900-pixel resolution. It failed however, to activate the wireless card, even after i installed the correct drivers via NDISwrapper. Also the splash screen that comes up while the distro boots is only visible when the distro boots from the disk. Live CD users get to stare at a blank screen during boot, which can be a little confusing for new users.

Some of the components under the Moonlight theme retain traces of the Sunshine theme, such as the semitransparent terminal window. If you run into any other errors, refer to the online documentation to check for a solution, if it’s a known bug.

Conclusion

Despite being a young distro with just two releases under its belt, Geubuntu delivers a visually stunning desktop without compromising functionality. As a double benefit, the components it uses to blend functionality with bling have modest hardware requirements. This makes the distro perfectly suitable for older computers.

Built atop Ubuntu, the distro has a solid, well-tested base. Its unique mix of components from desktop environments Xfce and GNOME on top of the under-development Enlightenment environment introduces several bugs, but the developers are working to iron these out, and have already tackled several between the first two releases. I’d recommend this distro to desktop users with aging hardware, and to users who haven’t tried Enlightenment before.

This document is a step by step guide for configuring Ubuntu 7.10 as a Samba Domain Controller with an LDAP backend (OpenLDAP). The point is to configure a server that can be comparable, from a central authentication point of view, to a Windows Server 2003 Domain Controller. The end result will be a server with an LDAP directory for storing user, group, and computer accounts. A Windows XP Professional SP2 workstation will be able to join the domain once properly configured. Please note that you do not have a fully comparable Windows domain controller at this time. Do not kid yourself, this guide only gets you a server with LDAP authentication. Of course this can be expanded to include slave servers to spread out authentication over multiple networks. Please also note that it took me approximately two and a half weeks to compile this information and get it working. The same functionality can be had in Windows in less than four hours (and this includes operating system installation). In my humble opinion the open source community will need to work on this side of Linux in order for it to be a true alternative to Windows.

Legal/Warranty/Etc…

This document is provided as-is with no implied warranty or agreement. I will not support other systems without compensation. This document is the property of Richard Maloley II. This document may be redistributed, copied, printed, and modified at will, however my name must remain as the original source. Legal action can and will be brought against any and all infractions of the terms.

Special Items of Interest

* My hostname during the installation was set to: dc01-ubuntu
* My fully qualified domain name will be: dc01-ubuntu.example.local
* After the installation my /etc/hostname was changed to: dc01-ubuntu.example.local
* After the installation my /etc/hosts was changed so that the line 127.0.1.1 contained “dc01-ubuntu dc01-ubuntu.example.local” to ensure no issues with name resolution.
* My LDAP domain is: example.local
* This translates to a Base DN of: dc=example,dc=local
* All passwords used are “12345″ to keep things simple.
* I am not using TLS or SSL for my LDAP directory. Too much work for this tutorial.
* The user I created during the installation is: sysadmin
* The password I assigned during the installation is: 12345
* This local user will be used for all configuration purposes.

Assumptions

* Ubuntu Server 7.10 is installed.
* No other software was installed during the OS install!
* After installation you enabled all the repositories in /etc/apt/sources.list
* You fully updated your system

apt-get update
apt-get upgrade
reboot

* You configured a static IP address. For me I used the following information:

address 192.168.0.60
gateway 192.168.0.1
netmask 255.255.255.0

* You edited your /etc/hosts file so that your hostname and fully qualified domain name are on the line 127.0.1.1

127.0.1.1 dc01-ubuntu dc01-ubuntu.example.local

* You installed the OpenSSH Server.

apt-get install openssh-server

* You did not set a password on the root account. All commands will be run with sudo or by opening a root shell.

sudo bash

* Currently you do not have any other software running nor do you have any other users on the system.

Step 1: Install WebMin

We will be installing WebMin. Why? I like to use it to configure some things. This step is techinically optional but I feel as though it greatly simplifies administration of the server in the future.

# Download the WebMin package from their website.

wget http://superb-west.dl.sourceforge.net/sourceforge/webadmin/webmin_1.380_all.deb

# Install pre-requisite software.

apt-get install openssl libauthen-pam-perl libio-pty-perl libmd5-perl libnet-ssleay-perl

# Install WebMin

dpkg -i webmin_1.380_all.deb

# If the installation is successful you will see a message similar to this:

“Webmin install complete. You can now login to https://dc01-ubuntu.example.local:10000/
as root with your root password,
or as any user who can use sudo to run commands as root.”

Step 2: Install OpenLDAP

For our LDAP server we will be using the very flexible OpenLDAP Server (slapd).

# Install the software.

apt-get install slapd ldap-utils migrationtools

# Answer the on-screen prompts with:

Admin password: 12345
Confirm password: 12345

# We need to configure OpenLDAP now.

dpkg-reconfigure slapd

# Answer the on-screen prompts with:

No
DNS domain name: example.local
Name of your organization: example.local
Admin password: 12345
Confirm password: 12345
OK
BDB
No
Yes
No

# Restart OpenLDAP.

/etc/init.d/slapd restart

Step 3: Install SAMBA

We will be using SAMBA for some main functions in this tutorial. In order to configure OpenLDAP correctly we must first install SAMBA.

# Install the software.

apt-get install samba smbldap-tools smbclient samba-doc

Step 4: Configure OpenLDAP for use with SAMBA

In order to use LDAP and SAMBA we need to configure the /etc/ldap/slapd.conf file.

# Copy the samba.schema file to the OpenLDAP schema directory.

cp /usr/share/doc/samba-doc/examples/LDAP/samba.schema.gz /etc/ldap/schema/

# Unzip the file.

gzip -d /etc/ldap/schema/samba.schema.gz

# Open the /etc/ldap/slapd.conf file for editing.

vim /etc/ldap/slapd.conf

# Add the following lines to the document where the other “include” lines are:

include         /etc/ldap/schema/samba.schema

include         /etc/ldap/schema/misc.schema

# Change the line:

access to attribute=userPassword

# to:

access to attrs=userPassword,sambaNTPassword,sambaLMPassword

# Restart OpenLDAP:

/etc/init.d/slapd restart

Step 5: Configure SAMBA

Now we need to configure SAMBA. This includes configuring the /etc/samba/smb.conf file.

# Open up the SAMBA directory.

cd /etc/samba/

# Backup the samba configuration file.

cp smb.conf smb.conf.original

# Open the samba configuration file for editing.

vim smb.conf

# Make the following changes throughout the file:

workgroup = EXAMPLE
security = user
passdb backend = ldapsam:ldap://localhost/
obey pam restrictions = no
#######################################################################
#COPY AND PASTE THE FOLLOWING UNDERNEATH "OBEY PAM RESTRICTIONS = NO"
#######################################################################
#
#	Begin: Custom LDAP Entries
#
ldap admin dn = cn=admin,dc=example,dc=local
ldap suffix = dc=example, dc=local
ldap group suffix = ou=Groups
ldap user suffix = ou=Users
ldap machine suffix = ou=Computers
ldap idmap suffix = ou=Users
; Do ldap passwd sync
ldap passwd sync = Yes
passwd program = /usr/sbin/smbldap-passwd %u
passwd chat = *New*password* %n\n *Retype*new*password* %n\n *all*authentication*tokens*updated*
add user script = /usr/sbin/smbldap-useradd -m "%u"
ldap delete dn = Yes
delete user script = /usr/sbin/smbldap-userdel "%u"
add machine script = /usr/sbin/smbldap-useradd -w "%u"
add group script = /usr/sbin/smbldap-groupadd -p "%g"
delete group script = /usr/sbin/smbldap-groupdel "%g"
add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%g"
delete user from group script = /usr/sbin/smbldap-groupmod -x "%u" "%g"
set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%u"
domain logons = yes
#
#	End: Custom LDAP Entries
#
#####################################################
#STOP COPYING HERE!
#####################################################

# Comment out the line:

invalid users = root

# Add the following line:

logon path =

# Restart SAMBA.

/etc/init.d/samba restart

# Give SAMBA the “admin” password to the LDAP tree.

smbpasswd -w 12345

Step 6: Configure the SMBLDAP-TOOLS package.

We will be using the smbldap-tools package to populate our directory, add users, add workstations, etc… But, the tools need to be configured first!

# Open up the examples directory.

cd /usr/share/doc/smbldap-tools/examples/

# Copy the configuration files to /etc/smbldap-tools:

cp smbldap_bind.conf /etc/smbldap-tools/
cp smbldap.conf.gz /etc/smbldap-tools/

# Unzip the configuration file.

gzip -d /etc/smbldap-tools/smbldap.conf.gz

# Open up the /etc/smbldap-tools directory.

cd /etc/smbldap-tools/

# Get the SID (Security ID) for your SAMBA domain.

net getlocalsid

This results in (example): SID for domain DC01-UBUNTU is: S-1-5-21-949328747-3404738746-3052206637

# Open the /etc/smbldap-tools/smbldap.conf file for editing.

vim smbldap.conf

# Edit the file so that the following information is correct (according to your individual setup):

SID="S-1-5-21-949328747-3404738746-3052206637" ## This line must have the same SID as when you ran "net getlocalsid"
sambaDomain="EXAMPLE"
ldapTLS="0"
suffix="dc=example,dc=local"
sambaUnixIdPooldn="sambaDomainName=EXAMPLE,${suffix}"
userSmbHome=
userProfile=
userHomeDrive=
userScript=
mailDomain="example.local"

# Open the /etc/smbldap-tools/smbldap_bind.conf file for editing.

vim smbldap_bind.conf

# Edit the file so that the following information is correct (according to your individual setup):

slaveDN="cn=admin,dc=example,dc=local"
slavePw="12345"
masterDN="cn=admin,dc=example,dc=local"
masterPw="12345"

# Set the correct permissions on the above files:

chmod 0644 /etc/smbldap-tools/smbldap.conf
chmod 0600 /etc/smbldap-tools/smbldap_bind.conf

Step 7: Populate LDAP using smbldap-tools

Now we need to populate our LDAP directory with some necessary SAMBA and Windows entries.

# Execute the command to populate the directory.

smbldap-populate -u 30000 -g 30000

# At the password prompt assign your root password:

12345

# Verify that the directory has information in it by running the command:

ldapsearch -x -b dc=example,dc=local | less

Step 8: Add an LDAP user to the system

It is time for us to add an LDAP user. We will use this user account to verify that LDAP authentication is working.

# Add the user to LDAP

smbldap-useradd -a -m -M ricky -c “Richard M” ricky

# Here is an explanation of the command switches that we used.

-a allows Windows as well as Linux login
-m makes a home directory, leave this off if you do not need local access
-M sets up the username part of their email address
-c specifies their full name

# Set the password the new account.

smbldap-passwd ricky
# Password will be: 12345

Step 9: Configure the server to use LDAP authentication.

The basic steps for this section came from the Ubuntu Forums (http://ubuntuforums.org/showthread.php?t=597056). Thanks to all who contributed to that thread! Basically we need to tell our server to use LDAP authentication as one of its options. Be careful with this! It can cause your server to break! This is why we always have a backup around.

# Install the necessary software for this to work.

apt-get install auth-client-config libpam-ldap libnss-ldap

# Answer the prompts on your screen with the following:

Should debconf manage LDAP configuration?: Yes
LDAP server Uniform Resource Identifier: ldapi://127.0.0.1
Distinguished name of the search base: dc=example,dc=local
LDAP version to use: 3
Make local root Database admin: Yes
Does the LDAP database require login? No
LDAP account for root: cn=admin,dc=example,dc=local
LDAP root account password: 12345

# Open the /etc/ldap.conf file for editing.

vim /etc/ldap.conf

# Configure the following according to your setup:

host 127.0.0.1
base dc=example,dc=local
uri ldap://127.0.0.1/
rootbinddn cn=admin,dc=example,dc=local
bind_policy soft

# Copy the /etc/ldap.conf file to /etc/ldap/ldap.conf

cp /etc/ldap.conf /etc/ldap/ldap.conf

# Create a new file /etc/auth-client-config/profile.d/open_ldap:

vim /etc/auth-client-config/profile.d/open_ldap

# Insert the following into that new file:

[open_ldap]
nss_passwd=passwd: compat ldap
nss_group=group: compat ldap
nss_shadow=shadow: compat ldap
pam_auth=auth       required     pam_env.so
 auth       sufficient   pam_unix.so likeauth nullok
 auth       sufficient   pam_ldap.so use_first_pass
 auth       required     pam_deny.so
pam_account=account    sufficient   pam_unix.so
 account    sufficient   pam_ldap.so
 account    required     pam_deny.so
pam_password=password   sufficient   pam_unix.so nullok md5 shadow use_authtok
 password   sufficient   pam_ldap.so use_first_pass
 password   required     pam_deny.so
pam_session=session    required     pam_limits.so
 session    required     pam_mkhomedir.so skel=/etc/skel/
 session    required     pam_unix.so
 session    optional     pam_ldap.so

# Backup the /etc/nsswitch.conf file:

cp /etc/nsswitch.conf /etc/nsswitch.conf.original

# Backup the /etc/pam.d/ files:

cd /etc/pam.d/
mkdir bkup
cp * bkup/

# Enable the new LDAP Authentication Profile by executing the following command:

auth-client-config -a -p open_ldap

# Reboot the server and test to ensure that you can still log in using SSH and LDAP.

reboot

Step 10: Install BIND (DNS Server)

Because we are going to be a domain controller and source for authentication it makes sense to also have some DNS services available. Please note that if you have multiple servers at your disposal it is recommended to install a seperate DNS server as well so we have two to look at.

# Install the software.

apt-get install bind9

Step 11: Configure our primary DNS Zone using WebMin

We now want to create our DNS zone so that we are in charge of it and can make use of it. I prefer using a GUI to do this as opposed to editing the zone files.

In a web browser navigate to: https://192.168.0.60:10000 (Please use the IP address that YOU assigned to your server.)
Login as “sysadmin” and “12345″.
Servers > BIND DNS Server
Under “Existing DNS Zones” click “Create master zone”.

Zone type: Forward (Names to Addresses)
Domain name / Network: example.local
Records file: Automatic
Master server: dc01-ubuntu.example.local
Email address: sysadmin@example.local

Click “Create” button.

Click “Apply Changes” button.

Click “Address (0)” at the top.

Name: dc01-ubuntu
Address: 192.168.0.60
Click “Create” button
Click “Return to record types”

Click “Apply Changes” button.

Step 12: Configure the server to use itself for DNS

DNS doesn’t do a whole lot of good if we don’t use it. In this section we point our /etc/resolv.conf file to ourselves. I also recommend leaving in a known working DNS server as the seconday source just in case something screws up. In some of my trials I did notice that the server would hang trying to start BIND9.

# Open the /etc/resolv.conf file for editing.

vim /etc/resolv.conf

# Add the following lines to the beginning of the file:

search example.local
nameserver 192.168.0.60

# Reboot the server to ensure that DNS is working correctly.

reboot

Step 13: Add a workstation account to LDAP

This tutorial is meant to create an opensource domain for Windows XP Professional client (and Linux clients) to authenticate against. Therefore we will add a workstation account for the Windows XP Professional workstation that we will be joining to the domain.

# Execute the command:

smbldap-useradd -w client-winxp

* “client-winxp” is the hostname of the computer that you will be adding to the domain. This must be very specific!

Step 14: Configure your Windows XP Professional Client

Now I will walk you through configuring your Windows XP Professional workstation so that it will join the domain.

# Assumptions:

* This is a vanilla installation of Windows XP Professional SP2.
* The computer name was set during installation to be: client-winxp
* The Administrator password assigned is: 12345
* All other installation options have been left at their default settings.
* After the installation the following occurred:
* The only user account on the computer in use was “Administrator”
* All available Windows Updates were installed.
* A static IP address was assigned with the following information (for my setup only!)

IP Address: 192.168.0.61
Gateway: 192.168.0.1
Netmask: 255.255.255.0
DNS: 192.168.0.60
Search domain: example.local

# Join the workstation to the domain.

* Log into the computer as Administrator.
* Right click “My Computer” and click “Properties”.
* Click the tab “Computer Name”.
* Click the button labeled “Change”.
* At the bottom click the radial button labeled “Domain”.
* In the box type the word “example” without quotes!
* Click the “OK” button.
* At the password prompt enter “root” for the user and “12345″ for the password (substitute the password for what you assigned to your root user earlier!).

It should say “Welcome to the example domain.”
* Click “OK”.
* Click “OK” again.
* Click “OK” again.
Restart the workstation.

# Log in with your test user (“ricky”) from earlier.
Try logging into the Windows XP workstation (after selecting the domain from the drop down box) using our test user. It should work without issue!

# Notes
Please note that this is basic authentication right now. You’re on your own if you wish to add logon scripts, mapped drives, etc…

Step 15: (Optional) Install Apache2 and PHPLDAPAdmin

A nice way to view and modify your LDAP tree is with a GUI. PHPLDAPAdmin is one that many people recommend so I will show you how to install it and use it.

# Install the software.

apt-get install apache2 phpldapadmin

# Open the file /etc/apache2/httpd.conf for editing:

vim /etc/apache2/httpd.conf

# Add the following line to the top of the file. This prevents an annoying error message from Apache2.

ServerName dc01-ubuntu.example.local

# Restart Apache2

/etc/init.d/apache2 restart

# Copy the PHPLDAPAdmin folder into the main web site directory. This is the lazy way of doing things. This way we don’t need to create a virtual server, we just access PHPLDAPAdmin by going to: http://192.168.0.60/phpldapadmin/

cp -R /usr/share/phpldapadmin/ /var/www/phpldapadmin

There you have it! A full Ubuntu LDAP and SAMBA Domain Controller in 15 easy steps.

I will use the following software:

• Web Server: Apache 2.2
• Database Server: MySQL 5.0
• Mail Server: Postfix
• DNS Server: BIND9
• FTP Server: proftpd
• POP3/IMAP: I will use Maildir format and therefore install Courier-POP3/Courier-IMAP.
• Webalizer for web site statistics

In the end you should have a system that works reliably, and if you like you can install the free webhosting control panel ISPConfig (i.e., ISPConfig runs on it out of the box).

I want to say first that this is not the only way of setting up such a system. There are many ways of achieving this goal but this is the way I take. I do not issue any guarantee that this will work for you!

1 Requirements

To install such a system you will need the following:

• the Ubuntu Gutsy Gibbon server CD, available here: http://releases.ubuntu.com/7.10/ubuntu-7.10-server-i386.iso
• a fast internet connection.

2 Preliminary Note

In this tutorial I use the hostname server1.example.com with the IP address 192.168.0.100 and the gateway 192.168.0.1. These settings might differ for you, so you have to replace them where appropriate.

3 The Base System

Insert your Ubuntu install CD into your system and boot from it. Select Install to the hard disk:

The installation starts, and first you have to choose your language:

Then select your location:

Choose a keyboard layout (you will be asked to press a few keys, and the installer will try to detect your keyboard layout based on the keys you pressed):

The installer checks the installation CD, your hardware, and configures the network with DHCP if there is a DHCP server in the network:

Enter the hostname. In this example, my system is called server1.example.com, so I enter server1:

Now you have to partition your hard disk. For simplicity’s sake I will create one big partition (with the mount point /) and a little swap partition so I select Guided – use entire disk (of course, the partitioning is totally up to you – if you like, you can create more than just one big partition, and you can also use LVM):

Select the disk that you want to partition:

When you’re finished, hit Yes when you’re asked Write the changes to disks?:

Afterwards, your new partitions are being created and formatted:

Configure your system’s clock. Normally UTC is a good choice:

Create a user, for example the user Administrator with the user name administrator (don’t use the user name admin as it is a reserved name on Gutsy Gibbon):

Now the base system is being installed:

We need a DNS, mail, and LAMP server, but nevertheless I don’t select any of them now because I like to have full control over what gets installed on my system. We will install the needed packages manually later on. The only item I select here is OpenSSH server so that I can immediately connect to the system with an SSH client such as PuTTY after the installation has finished:

The installation continues:

The GRUB boot loader gets installed:

The base system installation is now finished. Remove the installation CD from the CD drive and hit Continue to reboot the system:

On to the next step…

4 Enable The root Account

After the reboot you can login with your previously created username (e.g. administrator). Because we must run all the steps from this tutorial as root user, we must enable the root account now.

Run

sudo passwd root

and give root a password. Afterwards we become root by running

su

5 Install The SSH Server (Optional)

If you did not install the OpenSSH server during the system installation, you can do it now:

apt-get install ssh openssh-server

From now on you can use an SSH client such as PuTTY and connect from your workstation to your Ubuntu Gutsy Gibbon server and follow the remaining steps from this tutorial.

6 Install vim-full (Optional)

I’ll use vi as my text editor in this tutorial. The default vi program has some strange behaviour on Ubuntu and Debian; to fix this, we install vim-full:

apt-get install vim-full

(You don’t have to do this if you use a different text editor such as joe or nano.)

7 Configure The Network

Because the Ubuntu installer has configured our system to get its network settings via DHCP, we have to change that now because a server should have a static IP address. Edit /etc/network/interfaces and adjust it to your needs (in this example setup I will use the IP address 192.168.0.100):

vi /etc/network/interfaces

# This file describes the network interfaces available on your system# and how to activate them. For more information, see interfaces(5).# The loopback network interface

auto lo

iface lo inet loopback

# The primary network interface

auto eth0

iface eth0 inet static

address 192.168.0.100

netmask 255.255.255.0

network 192.168.0.0

broadcast 192.168.0.255

gateway 192.168.0.1

Then restart your network:

/etc/init.d/networking restart

Then edit /etc/hosts. Make it look like this:

vi /etc/hosts

127.0.0.1       localhost.localdomain   localhost192.168.0.100   server1.example.com     server1# The following lines are desirable for IPv6 capable hosts

::1     ip6-localhost ip6-loopback

fe00::0 ip6-localnet

ff00::0 ip6-mcastprefix

ff02::1 ip6-allnodes

ff02::2 ip6-allrouters

ff02::3 ip6-allhosts

Now run

echo server1.example.com > /etc/hostname
/etc/init.d/hostname.sh start

Afterwards, run

hostname
hostname -f

Both should show server1.example.com now.

8 Edit /etc/apt/sources.list And Update Your Linux Installation

Edit /etc/apt/sources.list. Comment out or remove the installation CD from the file and make sure that the universe and multiverse repositories are enabled. It should look like this:

vi /etc/apt/sources.list

## deb cdrom:[Ubuntu-Server 7.10 _Gutsy Gibbon_ - Release i386 (20071016)]/ gutsy main restricted#deb cdrom:[Ubuntu-Server 7.10 _Gutsy Gibbon_ - Release i386 (20071016)]/ gutsy main restricted

# See http://help.ubuntu.com/community/UpgradeNotes for how to upgrade to

# newer versions of the distribution.

deb http://de.archive.ubuntu.com/ubuntu/ gutsy main restricted

deb-src http://de.archive.ubuntu.com/ubuntu/ gutsy main restricted

## Major bug fix updates produced after the final release of the

## distribution.

deb http://de.archive.ubuntu.com/ubuntu/ gutsy-updates main restricted

deb-src http://de.archive.ubuntu.com/ubuntu/ gutsy-updates main restricted

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu

## team, and may not be under a free licence. Please satisfy yourself as to

## your rights to use the software. Also, please note that software in

## universe WILL NOT receive any review or updates from the Ubuntu security

## team.

deb http://de.archive.ubuntu.com/ubuntu/ gutsy universe

deb-src http://de.archive.ubuntu.com/ubuntu/ gutsy universe

deb http://de.archive.ubuntu.com/ubuntu/ gutsy-updates universe

deb-src http://de.archive.ubuntu.com/ubuntu/ gutsy-updates universe

## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu

## team, and may not be under a free licence. Please satisfy yourself as to

## your rights to use the software. Also, please note that software in

## multiverse WILL NOT receive any review or updates from the Ubuntu

## security team.

deb http://de.archive.ubuntu.com/ubuntu/ gutsy multiverse

deb-src http://de.archive.ubuntu.com/ubuntu/ gutsy multiverse

deb http://de.archive.ubuntu.com/ubuntu/ gutsy-updates multiverse

deb-src http://de.archive.ubuntu.com/ubuntu/ gutsy-updates multiverse

## Uncomment the following two lines to add software from the 'backports'

## repository.

## N.B. software from this repository may not have been tested as

## extensively as that contained in the main release, although it includes

## newer versions of some applications which may provide useful features.

## Also, please note that software in backports WILL NOT receive any review

## or updates from the Ubuntu security team.

# deb http://de.archive.ubuntu.com/ubuntu/ gutsy-backports main restricted universe multiverse

# deb-src http://de.archive.ubuntu.com/ubuntu/ gutsy-backports main restricted universe multiverse

## Uncomment the following two lines to add software from Canonical's

## 'partner' repository. This software is not part of Ubuntu, but is

## offered by Canonical and the respective vendors as a service to Ubuntu

## users.

# deb http://archive.canonical.com/ubuntu gutsy partner

# deb-src http://archive.canonical.com/ubuntu gutsy partner

deb http://security.ubuntu.com/ubuntu gutsy-security main restricted

deb-src http://security.ubuntu.com/ubuntu gutsy-security main restricted

deb http://security.ubuntu.com/ubuntu gutsy-security universe

deb-src http://security.ubuntu.com/ubuntu gutsy-security universe

deb http://security.ubuntu.com/ubuntu gutsy-security multiverse

deb-src http://security.ubuntu.com/ubuntu gutsy-security multiverse

Then run

apt-get update

to update the apt package database and

apt-get upgrade

to install the latest updates (if there are any).

9 Change The Default Shell

/bin/sh is a symlink to /bin/dash, however we need /bin/bash, not /bin/dash. Therefore we do this:

ln -sf /bin/bash /bin/sh

If you don’t do this, the ISPConfig installation will fail.

10 Install Some Software

Now we install a few packages that are needed later on. Run

apt-get install binutils cpp fetchmail flex gcc libarchive-zip-perl libc6-dev libcompress-zlib-perl libdb4.3-dev libpcre3 libpopt-dev lynx m4 make ncftp nmap openssl perl perl-modules unzip zip zlib1g-dev autoconf automake1.9 libtool bison autotools-dev g++ build-essential

(This command must go into one line!)

11 Quota

(If you have chosen a different partitioning scheme than I did, you must adjust this chapter so that quota applies to the partitions where you need it.)

To install quota, run

apt-get install quota

Edit /etc/fstab. Mine looks like this (I added ,usrquota,grpquota to the partition with the mount point /):

vi /etc/fstab

# /etc/fstab: static file system information.
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
proc            /proc           proc    defaults        0       0
# /dev/sda1
UUID=9fc157ff-975c-4f20-9fef-6a70085abdbd /               ext3    defaults,errors=remount-ro,usrquota,grpquota 0       1
# /dev/sda5
UUID=48fb7dd8-f099-4d63-ac1b-30e886ac7436 none            swap    sw              0       0
/dev/scd0       /media/cdrom0   udf,iso9660 user,noauto,exec 0       0
/dev/fd0        /media/floppy0  auto    rw,user,noauto,exec 0       0

To enable quota, run these commands:

touch /quota.user /quota.group
chmod 600 /quota.*
mount -o remount /

quotacheck -avugm
quotaon -avug

12 DNS Server

Run

apt-get install bind9

For security reasons we want to run BIND chrooted so we have to do the following steps:

/etc/init.d/bind9 stop

Edit the file /etc/default/bind9 so that the daemon will run as the unprivileged user bind, chrooted to /var/lib/named. Modify the line: OPTIONS=”-u bind” so that it reads OPTIONS=”-u bind -t /var/lib/named”:

vi /etc/default/bind9

OPTIONS="-u bind -t /var/lib/named"
# Set RESOLVCONF=no to not run resolvconf
RESOLVCONF=yes

Create the necessary directories under /var/lib:

mkdir -p /var/lib/named/etc
mkdir /var/lib/named/dev
mkdir -p /var/lib/named/var/cache/bind
mkdir -p /var/lib/named/var/run/bind/run

Then move the config directory from /etc to /var/lib/named/etc:

mv /etc/bind /var/lib/named/etc

Create a symlink to the new config directory from the old location (to avoid problems when bind gets updated in the future):

ln -s /var/lib/named/etc/bind /etc/bind

Make null and random devices, and fix permissions of the directories:

mknod /var/lib/named/dev/null c 1 3
mknod /var/lib/named/dev/random c 1 8
chmod 666 /var/lib/named/dev/null /var/lib/named/dev/random
chown -R bind:bind /var/lib/named/var/*
chown -R bind:bind /var/lib/named/etc/bind

We need to modify /etc/default/syslogd so that we can still get important messages logged to the system logs. Modify the line: SYSLOGD=”" so that it reads: SYSLOGD=”-a /var/lib/named/dev/log”:

vi /etc/default/syslogd

#
# Top configuration file for syslogd
#

#
# Full documentation of possible arguments are found in the manpage
# syslogd(8).
#

#
# For remote UDP logging use SYSLOGD="-r"
#
SYSLOGD="-a /var/lib/named/dev/log"

Restart the logging daemon:

/etc/init.d/sysklogd restart

Start up BIND, and check /var/log/syslog for errors:

/etc/init.d/bind9 start

13 MySQL

In order to install MySQL, we run

apt-get install mysql-server mysql-client libmysqlclient15-dev

You will be asked to provide a password for the MySQL root user – this password is valid for the user root@localhost as well as root@server1.example.com, so we don’t have to specify a MySQL root password manually later on (as was the case with previous Ubuntu versions):

New password for the MySQL “root” user: <– yourrootsqlpassword

We want MySQL to listen on all interfaces, not just localhost, therefore we edit /etc/mysql/my.cnf and comment out the line bind-address = 127.0.0.1:

vi /etc/mysql/my.cnf

[...]
# Instead of skip-networking the default is now to listen only on
# localhost which is more compatible and is not less secure.
#bind-address           = 127.0.0.1
#
[...]

Then we restart MySQL:

/etc/init.d/mysql restart

Now check that networking is enabled. Run

netstat -tap | grep mysql

The output should look like this:

root@server1:~# netstat -tap | grep mysql
tcp 0 0 *:mysql *:* LISTEN 5286/mysqld
root@server1:~#

14 Postfix With SMTP-AUTH And TLS

In order to install Postfix with SMTP-AUTH and TLS do the following steps:

apt-get install postfix libsasl2-2 sasl2-bin libsasl2-modules libdb3-util procmail

You will be asked two questions. Answer as follows:

General type of mail configuration: <– Internet Site
System mail name: <– server1.example.com

Then run

dpkg-reconfigure postfix

Again, you’ll be asked some questions:

General type of mail configuration: <– Internet Site
System mail name: <– server1.example.com
Root and postmaster mail recipient: <– [blank]
Other destinations to accept mail for (blank for none): <– server1.example.com, localhost.example.com, localhost.localdomain, localhost
Force synchronous updates on mail queue? <– No
Local networks: <– 127.0.0.0/8
Use procmail for local delivery? <– Yes
Mailbox size limit: <– 0
Local address extension character: <– +
Internet protocols to use: <– all

Next, do this:

postconf -e ‘smtpd_sasl_local_domain =’
postconf -e ‘smtpd_sasl_auth_enable = yes’
postconf -e ‘smtpd_sasl_security_options = noanonymous’
postconf -e ‘broken_sasl_auth_clients = yes’
postconf -e ‘smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination’
postconf -e ‘inet_interfaces = all’
echo ‘pwcheck_method: saslauthd’ >> /etc/postfix/sasl/smtpd.conf
echo ‘mech_list: plain login’ >> /etc/postfix/sasl/smtpd.conf

Afterwards we create the certificates for TLS:

mkdir /etc/postfix/ssl
cd /etc/postfix/ssl/
openssl genrsa -des3 -rand /etc/hosts -out smtpd.key 1024

chmod 600 smtpd.key
openssl req -new -key smtpd.key -out smtpd.csr

openssl x509 -req -days 3650 -in smtpd.csr -signkey smtpd.key -out smtpd.crt

openssl rsa -in smtpd.key -out smtpd.key.unencrypted

mv -f smtpd.key.unencrypted smtpd.key
openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650

Next we configure Postfix for TLS (make sure that you use the correct hostname for myhostname):

postconf -e ‘myhostname = server1.example.com’
postconf -e ‘smtpd_tls_auth_only = no’
postconf -e ‘smtp_use_tls = yes’
postconf -e ‘smtpd_use_tls = yes’
postconf -e ‘smtp_tls_note_starttls_offer = yes’
postconf -e ‘smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key’
postconf -e ‘smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt’
postconf -e ‘smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem’
postconf -e ‘smtpd_tls_loglevel = 1′
postconf -e ‘smtpd_tls_received_header = yes’
postconf -e ‘smtpd_tls_session_cache_timeout = 3600s’
postconf -e ‘tls_random_source = dev:/dev/urandom’

The file /etc/postfix/main.cf should now look like this:

cat /etc/postfix/main.cf

# See /usr/share/postfix/main.cf.dist for a commented, more complete version

# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

# TLS parameters
smtpd_tls_cert_file = /etc/postfix/ssl/smtpd.crt
smtpd_tls_key_file = /etc/postfix/ssl/smtpd.key
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = server1.example.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = server1.example.com, localhost.example.com, localhost.localdomain, localhost
relayhost =
mynetworks = 127.0.0.0/8
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
smtpd_sasl_local_domain =
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtpd_tls_auth_only = no
smtp_use_tls = yes
smtp_tls_note_starttls_offer = yes
smtpd_tls_CAfile = /etc/postfix/ssl/cacert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom

Restart Postfix:

/etc/init.d/postfix restart

Authentication will be done by saslauthd. We have to change a few things to make it work properly. Because Postfix runs chrooted in /var/spool/postfix we have to do the following:

mkdir -p /var/spool/postfix/var/run/saslauthd

Now we have to edit /etc/default/saslauthd in order to activate saslauthd. Set START to yes and change the line OPTIONS=”-c” to OPTIONS=”-c -m /var/spool/postfix/var/run/saslauthd -r”:

vi /etc/default/saslauthd

#
# Settings for saslauthd daemon
#

# Should saslauthd run automatically on startup? (default: no)
START=yes

# Which authentication mechanisms should saslauthd use? (default: pam)
#
# Available options in this Debian package:
# getpwent  -- use the getpwent() library function
# kerberos5 -- use Kerberos 5
# pam       -- use PAM
# rimap     -- use a remote IMAP server
# shadow    -- use the local shadow password file
# sasldb    -- use the local sasldb database file
# ldap      -- use LDAP (configuration is in /etc/saslauthd.conf)
#
# Only one option may be used at a time. See the saslauthd man page
# for more information.
#
# Example: MECHANISMS="pam"
MECHANISMS="pam"

# Additional options for this mechanism. (default: none)
# See the saslauthd man page for information about mech-specific options.
MECH_OPTIONS=""

# How many saslauthd processes should we run? (default: 5)
# A value of 0 will fork a new process for each connection.
THREADS=5

# Other options (default: -c)
# See the saslauthd man page for information about these options.
#
# Example for postfix users: "-c -m /var/spool/postfix/var/run/saslauthd"
# Note: See /usr/share/doc/sasl2-bin/README.Debian
OPTIONS="-c -m /var/spool/postfix/var/run/saslauthd -r"

Now start saslauthd:

/etc/init.d/saslauthd start

To see if SMTP-AUTH and TLS work properly now run the following command:

telnet localhost 25

After you have established the connection to your Postfix mail server type

ehlo localhost

If you see the lines

250-STARTTLS

and

250-AUTH PLAIN LOGIN

everything is fine.

The output on my system looks like this:

root@server1:/etc/postfix/ssl# telnet localhost 25
Trying 127.0.0.1…
Connected to localhost.localdomain.
Escape character is ‘^]’.
220 server1.example.com ESMTP Postfix (Ubuntu)
ehlo localhost
250-server1.example.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
quit
221 2.0.0 Bye
Connection closed by foreign host.
root@server1:/etc/postfix/ssl#

Type

quit

to return to the system’s shell.

15 Courier-IMAP/Courier-POP3

Run this to install Courier-IMAP/Courier-IMAP-SSL (for IMAPs on port 993) and Courier-POP3/Courier-POP3-SSL (for POP3s on port 995):

apt-get install courier-authdaemon courier-base courier-imap courier-imap-ssl courier-pop courier-pop-ssl courier-ssl gamin libgamin0 libglib2.0-0

You will be asked two questions:

Create directories for web-based administration ? <– No
SSL certificate required <– Ok

If you do not want to use ISPConfig, configure Postfix to deliver emails to a user’s Maildir*:

postconf -e ‘home_mailbox = Maildir/’
postconf -e ‘mailbox_command =’
/etc/init.d/postfix restart

*Please note: You do not have to do this if you intend to use ISPConfig on your system as ISPConfig does the necessary configuration using procmail recipes. But please go sure to enable Maildir under Management -> Server -> Settings -> EMail in the ISPConfig web interface.

16 Apache/PHP5

Now we install Apache:

apt-get install apache2 apache2-doc apache2-mpm-prefork apache2-utils libexpat1 ssl-cert

Next we install PHP5:

apt-get install libapache2-mod-php5 php5 php5-common php5-curl php5-dev php5-gd php5-idn php-pear php5-imagick php5-imap php5-json php5-mcrypt php5-memcache php5-mhash php5-ming php5-mysql php5-ps php5-pspell php5-recode php5-snmp php5-sqlite php5-tidy php5-xmlrpc php5-xsl

You will be asked the following question:

Continue installing libc-client without Maildir support? <– Yes

Next we edit /etc/apache2/mods-available/dir.conf:

vi /etc/apache2/mods-available/dir.conf

and change the DirectoryIndex line:

<IfModule mod_dir.c>

          #DirectoryIndex index.html index.cgi index.pl index.php index.xhtml
          DirectoryIndex index.html index.htm index.shtml index.cgi index.php index.php3 index.pl index.xhtml

</IfModule>

Now we have to enable some Apache modules (SSL, rewrite, suexec, and include):

a2enmod ssl
a2enmod rewrite
a2enmod suexec
a2enmod include

Reload the Apache configuration:

/etc/init.d/apache2 force-reload

16.1 Disable PHP Globally

(If you do not plan to install ISPConfig on this server, please skip this section!)

In ISPConfig you will configure PHP on a per-website basis, i.e. you can specify which website can run PHP scripts and which one cannot. This can only work if PHP is disabled globally because otherwise all websites would be able to run PHP scripts, no matter what you specify in ISPConfig.

To disable PHP globally, we edit /etc/mime.types and comment out the application/x-httpd-php lines:

vi /etc/mime.types

[...]
#application/x-httpd-php                                phtml pht php
#application/x-httpd-php-source                 phps
#application/x-httpd-php3                       php3
#application/x-httpd-php3-preprocessed          php3p
#application/x-httpd-php4                       php4
[...]

Edit /etc/apache2/mods-enabled/php5.conf and comment out the following lines:

vi /etc/apache2/mods-enabled/php5.conf

<IfModule mod_php5.c>
  #AddType application/x-httpd-php .php .phtml .php3
  #AddType application/x-httpd-php-source .phps
</IfModule>

Then restart Apache:

/etc/init.d/apache2 restart

17 Proftpd

In order to install Proftpd, run

apt-get install proftpd ucf

You will be asked a question:

Run proftpd from inetd or standalone? <– standalone

Then open /etc/proftpd/proftpd.conf and change UseIPv6 from on to off; otherwise you’ll get a warning like this when you start Proftpd:

If you get a message like this:

– IPv6 getaddrinfo ‘server1.example.com’ error: Name or service not known

you can either modify /etc/hosts and add server1.example.com to the ::1 line:

vi /etc/hosts

127.0.0.1       localhost.localdomain   localhost
192.168.0.100   server1.example.com     server1

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback server1.example.com
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

… or you can open /etc/proftpd/proftpd.conf and change UseIPv6 from on to off

vi /etc/proftpd/proftpd.conf

[...]
UseIPv6                         off
[...]

For security reasons you can also add the following lines to /etc/proftpd/proftpd.conf (thanks to Reinaldo Carvalho; more information can be found here: http://proftpd.org/localsite/Userguide/linked/userguide.html):

vi /etc/proftpd/proftpd.conf

[...]
DefaultRoot ~
IdentLookups off
ServerIdent on "FTP Server ready."
[...]

ISPConfig expects the configuration to be in /etc/proftpd.conf instead of /etc/proftpd/proftpd.conf, therefore we create a symlink (you can skip this command if you don’t want to install ISPConfig):

ln -s /etc/proftpd/proftpd.conf /etc/proftpd.conf

Then restart Proftpd:

/etc/init.d/proftpd restart

18 Webalizer

To install webalizer, just run

apt-get install webalizer

19 Synchronize the System Clock

It is a good idea to synchronize the system clock with an NTP (network time protocol) server over the internet. Simply run

apt-get install ntp ntpdate

and your system time will always be in sync.

20 Install Some Perl Modules Needed By SpamAssassin (Comes With ISPConfig)

Run

apt-get install libhtml-parser-perl libdb-file-lock-perl libnet-dns-perl

21 ISPConfig

The configuration of the server is now finished, and if you wish you can now install ISPConfig on it. Please check out the ISPConfig installation manual: http://www.ispconfig.org/manual_installation.htm

21.1 A Note On SuExec

If you want to run CGI scripts under suExec, you should specify /var/www as the home directory for websites created by ISPConfig as Ubuntu’s suExec is compiled with /var/www as Doc_Root. Run

/usr/lib/apache2/suexec -V

and the output should look like this:

root@server1:~# /usr/lib/apache2/suexec -V
-D AP_DOC_ROOT=”/var/www”
-D AP_GID_MIN=100
-D AP_HTTPD_USER=”www-data”
-D AP_LOG_EXEC=”/var/log/apache2/suexec.log”
-D AP_SAFE_PATH=”/usr/local/bin:/usr/bin:/bin”
-D AP_UID_MIN=100
-D AP_USERDIR_SUFFIX=”public_html”
root@server1:~#

So if you want to use suExec with ISPconfig, don’t change the default web root (which is /var/www) if you use expert mode during the ISPConfig installation (in standard mode you can’t change the web root anyway so you’ll be able to use suExec in any case).

The following screenshot is taken from an ISPConfig installation in expert mode. If you want to use ISPConfig, then don’t change the default web root:

22 Links

• Ubuntu: http://www.ubuntu.com
• ISPConfig: http://www.ispconfig.org

1) A good start: Ubuntu started with a strong background. It wasn’t “yet another” distribution, it was a distribution that had a vision and enough people and money behind it to support that vision.

2) Easy and straightforward installation: From the text-based installer of the first few versions, to the point&click installer of today, ubuntu always had a very straightforward and simple installation. Every step of the installer was explained in a short, yet clear manner that made it easy for everyone to follow the steps of the installation proccedure (almost) regardless of their experience with computers.

3) ShipIt: Sharing “official” CD’s with the Ubuntu logo increased the trust of users towards the distribution and made it much easier for users on slow connections to try it. People could now give away several CD’s to their friends and coworkers which made the general adoption of Linux much faster.

4) Synaptic: If you ask a first-time Ubuntu user to tell you what impressed them most, chances are that the answer will be “synaptic”. Indeed, this application brought APT much closer to the average user and made program installation in Linux a lot easier. Users didn’t have to search for RPMs or worry that they might needed to deal with dependancies, compile from source etc, synaptic solved everything using a very simple interface. When the first versions of Ubuntu came out, the only thing that could be compared to the flexibility and ease of use of APT and Synaptic was Fedora’s YUM, but unfortunately at that time Fedora didn’t have a good front-end for YUM (although Synaptic could be used with YUM, it was not nearly as easy to set up as synaptic and Ubuntu were).

5) Ubuntu forums/Community: The Ubuntu community was, and still is one of the most important factors that promote the growth of Ubuntu. The forums are very active and old users are very friendly and patient towards newcomers. Maybe it has to do with the philosophy of “Ubuntu”…

6) User promotion: Ubuntu is based heavily on the promotion it receives from it’s users. Nearly every person who uses Ubuntu today has beed advised to try it by someone else who had tried it before them and so on. This, combined with the strong influence of Ubuntu to the internet forums related to GNU/Linux, has led to a major increase in it’s adoption .

7) Fragmented competitors: When Ubuntu started it’s “march to glory” there were three “big” distributions, SuSE, Mandriva, and Fedora. Debian and Slackware were popular but were not very appealling to newbies (Debian still had a text based installer…). All of the “big three” were not at their best when Ubuntu came out and started gathering users. SuSE had recently been bought by Novell and was still undergoing internal reconstructions, Mandriva has in the middle of a severe financial crisis, and Fedora was just at FC2 which wasn’t nearly as easy as it now is. This “fragmentation” (or “decay of the distribution maket” if you like) helped many users make the decision to switch to Ubuntu.

There are definately many other reasons why Ubuntu managed to get to the top, and stay there, but making a complete analysis is not within the purposes of this post. Highlighting some of the points that made Ubuntu what it is today, is.

Till next time, keep drinking coffee

Canonical (the company that develops Ubuntu) has outlined a long-term road map for the operating system. During the UbuntuLive conference back in July, Canonical CTO Matt Zimmerman said Ubuntu 7.10 would feature several core enhancements for desktop and server users. On the desktop, 7.10 will support:

• a 3D interface out of the box
• multi-monitor configuration
• laptop power profiling
• more details still to come

On the server, 7.10 will offer:

• Turn-key web administration
• One-step server recipes
• Proactive security with AppArmor, an increasingly popular open source security option
• “desktop” type simplicity

So, what does that mean to Ubuntu resellers and customers? Quite a lot. Ubuntu moved from niche status into the spotlight when Michael Dell himself began running the operating system.

If Ubuntu 7.1o continues that positive buzz, it could help desktop Linux to gradually become a mainstream operating system. But don’t expect that to happen overnight. In an exclusive TechIQ interview with Dell’s Linux gurus last month, the company indicated that it would take a slow-and-steady approach to Ubuntu. Translation: Don’t expect Dell to throw marketing dollars at Ubuntu PCs just yet.

I do not expect that to happen for at least another year because Dell doesn’t want to over promise and under deliver to frustrated Windows users and small business owners who are seeking alternatives.

In the meantime, the countdown to Ubuntu 7.10 continues. And the buzz surrounding Ubuntu 7.1 will only grow louder as the upgrade’s October 18 launch date approaches.