Author Archives: James Coyle

Create a Ubuntu 14.04 OpenVZ Template for Proxmox

Get Social!

proxmox logo gradThe latest Ubuntu long term support is now available, called Ubuntu 14.04.

There isn’t currently a template available over on OpenVZ however I’m sure that will be shortly rectified. In the meantime, however, you can use the below steps to create a 14.04 Ubuntu template for OpenVZ/ Proxmox. This template has only been lightly tested so please report any errors as you find them.

This template is BETA, please report any problems in the comments.

Vistit Downloads Page

 

You can download a pre-created VM from here directly, or you can create your own using the below notes.

 

Before continuing, this guide assumes that you already have an installation of Ubuntu up and running which you can SSH to. This could be either a KVM or physical machine.

We will use debootstrap to create the template so make sure it’s installed and install it if you haven’t already.

apt-get install -y debootstrap

Use debootstrap to download and configure all the required packages to a temporary directory. For this example, we’ll use /tmp/deb.

debootstrap --arch amd64 trusty /tmp/deb ftp://ftp.ubuntu.com/ubuntu

Copy the below script into the tmp directory of the template root which has just been created. For this example you’ll need to copy the text into this path:

vi /tmp/deb/tmp/client.sh
#!/bin/bash

echo "root:password" | chpasswd

apt-get update

apt-get purge -y console-setup ntpdate whiptail eject ureadahead sudo vim-tiny rsync
apt-get install -y vim openssh-server

find / -name *ondemand -exec rm -rf {} \;
rm -f /etc/init/console* /etc/init/tty*

sed -i -e 's/^\$ModLoad imklog/#\$ModLoad imklog/g' /etc/rsyslog.conf
sed -i -e 's@\(space:\)\(/var/log/\)@\1-\2@' /etc/rsyslog.d/*.conf
sed -i -e 's/^\#cron./cron./g' /etc/rsyslog.d/50-default.conf

sed -i -e 's/^\console output/#console output/g' /etc/init/rc.conf
sed -i -e 's/^\env INIT_VERBOSE/#env INIT_VERBOSE/g' /etc/init/rc.conf

locale-gen en_US.UTF-8
locale-gen en_GB.UTF-8
dpkg-reconfigure locales

cp /usr/share/zoneinfo/Europe/London /etc/localtime

cat <<EOF > /etc/init/tty1.conf
# tty1 - getty
#
# This service maintains a getty on tty1 from the point the system is
# started until it is shut down again.

start on stopped rc RUNLEVEL=[2345]

stop on runlevel [!2345]

respawn
exec /sbin/getty -8 38400 tty1
EOF

rm -f /etc/ssh/ssh_host_*

cat << EOF > /etc/init.d/generate_ssh_keys
#!/bin/bash
ssh-keygen -f /etc/ssh/ssh_host_rsa_key -t rsa -N ''
ssh-keygen -f /etc/ssh/ssh_host_dsa_key -t dsa -N ''
rm -f \$0
EOF

chmod a+x /etc/init.d/generate_ssh_keys
update-rc.d generate_ssh_keys defaults

apt-get clean
find /var/ -name *.log -exec rm -rf {} \;
rm -rf /boot /dev /media /opt /run /srv /tmp /root/.bash_history /root/.viminfo /etc/ssh/ssh_host_*
mkdir /dev /run /tmp
touch /dev/null

exit

Make the script runnable which chmod.

chmod +x /tmp/deb/tmp/client.sh

Run the above script using the chroot command to set up the template.

chroot /tmp/deb /tmp/client.sh

The script will now run and set up the template using /tmp/deb/ as the templates root.

Once completed, create an archive of the template root device and install it on your OpenVZ/ Proxmox server.

cd /tmp/deb
tar -czpf /tmp/ubuntu-14.04-x86_64-initial1.tar.gz .

Copy the /tmp/ubuntu-14.04-x86_64-initial1.tar.gz file to your cache directory of your Proxmox install and create your first Ubuntu 14.04 container!

proxmox-ubuntu-1404-template


Install Splunk on Ubuntu

Category : How-to

Get Social!

splunkSplunk is the heavyweight open source software which enables you to index, visualise and explore virtually any machine generated data. Splunk is often used to consume Apache and Nginx web server logs as well as website clicks and any other data which maintains a constant format.

Installing Splunk on any Debian based Linux distribution, such as Ubuntu, couldn’t be easier with the .deb package that available for download.

Visit the Splunk download page to download the Splunk .deb package:

Upload the file to your Ubuntu server and place it a temporary directory.

Run the dpkg command to install the Splunk server.  The file name of the .deb file may change as new versions are made available so make sure that you have downloaded.

dpkg -i splunk-6.0.3-204106-linux-2.6-amd64.deb

The output of the command will look like the below example.

Selecting previously unselected package splunk.
(Reading database ... 20803 files and directories currently installed.)
Unpacking splunk (from splunk-6.0.3-204106-linux-2.6-amd64.deb) ...
Setting up splunk (6.0.3-204106) ...
complete

Next we need to create the init.d script so that we can easily start and stop Splunk. Change the the Splunk directory and run the splunk executable with the below arguments.

cd /opt/splunk/bin/
./splunk enable boot-start

Press SPACE to view all of the license agreement and then Y to accept it.

Start Splunk with the service command.

service splunk start

You will now be able to access Splunk’s web GUI which is running on port 8000.

http://10.10.10.10:8000/

Open the URL in the browser and login with the below details:

  • User Name: admin
  • Password: changeme

splunk-dashboard-new


Apache Redirect Root URL to Subfolder

Get Social!

The Apache HTTP is able to redirect traffic to a specific URL with use of the Apache mod_rewrite. mod_rewrite can do at least 100 other things and I’ll include some of those in a later blog post.

Let’s take a look at a simple redirection of traffic from / to /mysubfolder.

For example, this would redirect all traffic sent to http://www.jamescoyle.net/ to http://www.jamescoyle.net/mysubfolder/

This can be very helpful when you are using a reverse proxy and the application you are proxying is on a sub folder in the URL path. You can simply use this technique to redirect all users to the subdirectory folder path.

Make sure the module is enabled. In Ubuntu you can simply run the a2enmod command however in RHEL/ Cent OS you may need to add the module manually to your httpd.conf file.

a2enmod rewrite

Then in your sites file you will need to add the following code.

RewriteEngine on
RewriteCond %{REQUEST_URI} ^/$
RewriteRule (.*) /mysubfolder/ [R=301]
  • RewriteEngine on is used to specify to Apache that this site will use Rewrite rules to transform the URL
  • RewriteCond is the match part of the pattern. If the URL matches this pattern then RewriteRule will be applied. This particular pattern is checking if the requested URL path is equal to /.
  • RewriteRule is going to add /mysubfolder/ to the URL which only contains the domain due to the above RewriteCond already performing the check.

Apache Active Directory Group Authentication

Get Social!

apache-logoThe Apache HTTP server can be used with LDAP or Microsoft’s Active Directory to authenticate users before viewing a webpage or site.

Before getting started, you will need to have the required Apache mods installed. Run the following command to enable the required LDAP mods.

a2enmod ldap authnz_ldap

The LDAP configuration generally goes in the Location tags, as per the below example.

<Location />
        Order allow,deny
        Allow from all
	AuthzLDAPAuthoritative on
	AuthLDAPBindDN "CN=ldapservice,CN=Users,DC=jamescoyle,DC=net"
	AuthLDAPBindPassword "mypassword"
	AuthLDAPURL "ldap://jamescoyle.net/OU=Users,DC=jamescoyle,DC=net?sAMAccountName?sub?(objectClass=*)"
	AuthType Basic
	AuthName "JamesCoyle.net Authentication"
	AuthBasicProvider ldap
	AuthLDAPGroupAttributeIsDN on
	AuthLDAPGroupAttribute member
	Require ldap-group CN=mygroup,OU=Groups,DC=jamescoyle,DC=net
</Location>

Lets break down each attribute in the above config:

  • AuthzLDAPAuthoritative specifies to Apache that LDAP/ Active Directory authentication should override any other form of authentication.
  • AuthLDAPBindDN is the user DN which Apache will bind to when connecting to your LDAP/ Active Directory server.
  • AuthLDAPURL is the LDAP/ Active Directory URL which specifies your LDAP/ Active Directory server, the location where the users are stored within the directory and the attributes which will be used as a username when authenticating.
  • AuthType is the type of authentication which will be used. Basic gives us the dialogue box to enter our credentials.
  • AuthName is the text which will appear in the login dialogue box. This can differ depending on the web browser.
  • AuthBasicProvider specifies that we will use LDAP as the authentication mechanism.
  • AuthLDAPGroupAttributeIsDN when set to ON this option specifies to use the DN of the user when checking for group permissions in the LDAP/ Active Directory server. Otherwise the username will be used, in this example sAMAccountName.
  • AuthLDAPGroupAttribute is the attribute in the LDAP/ Active Directory server which is used to check for group membership.
  • Require when set to ldap-group indicates to Apache that the user must be in the specified group to allow access.

Installing the OpenVZ Web Panel

Get Social!

There are many web front ends to the OpenVZ virtualisation server which offer varying functionality and are at different stages of development.

Take a look at the OpenVZ Control Panels wiki page for a list and a brief description of what each one does.

One that I have found to be very stable, easy to use and the most feature rich is the OpenVZ Web Panel (OWP). It allows you to create and destroy new OpenVZ containers, manage networking, download new OS templates and a few other things all from a clean web based front end.

Installing the OpenVZ Web Panel

Installing the OpenVZ Web Portal couldn’t be easier – simply run a one-line command on the terminal and let the script do the rest. The script will download all the required dependencies, such as Ruby, and set everything up so that you have a working web address which you can use to administer your OpenVZ server.

Run the below command on your OpenVZ server.

wget -O - http://ovz-web-panel.googlecode.com/svn/installer/ai.sh | sh

Once the script completes, the web server will be available on your servers IP or hostname and port 3000. The default username and password, which are required for login are:

  • Username: admin
  • Password: admin

openvz-web-panel-login

If you have iptables installed you will need to add a new rule for the default port 3000.

iptables -A INPUT -i eth0 -p tcp --dport 3000 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables-save

You can also change the port number by editing the config file of OWP.

vi /etc/owp.conf

And change the PORT attribute to the new port number. Remember to update your iptables configuration to the new port number. See my iptables cheat sheet for more information.

Once you have logged in you will need to change the default admin password. Click on My Profile on the left hand side and fill in the information as requested.

openvz-web-panel-change-password

The next time you log in you will be able to log in with your new password.


Install an OpenVZ Server on CentOS

Category : How-to

Get Social!

openvz-logo-150px_new_3OpenVZ servers are hypervisors which allow you to create numerous guest instances within a single hardware node. Unlike other products which offer full hardware virtualisation, OpenVZ creates containers – isolated program execution environments – that share the hardware nodes kernel.

OpenVZ works very differently to the more mainstream hypervisors like VMWare’s ESXI, KVM or Xen and therefore comes with some benefits as well as a few problems. In the benefit category, the big one is performance.  OpenVZ containers loose very little power from what is available on a bare metal machine. The big drawback is that an OpenVZ container can only run Linux guests because each guest is actually using the hardware nodes kernel.

OpenVZ recommends running an OpenVZ server on Red Hat Linux, or one of it’s derivitives such as CentOS. Before starting this tutorial, make sure that you have a freshly installed CentOS server with terminal access. For this example, I’m going to use a fresh install of CentOS 6.5.

There are three stages to the installation of the OpenVZ software; install the OpenVZ kernel, configure system parameters and install the OpenVZ tools.

Install the OpenVZ kernel

All of the packages required to install an OpenVZ server are available in a repository which needs to be added to yum. Once this is complete, you can use yum to install all of the OpenVZ packages, including the kernel. Using this method, we can also keep our packages up to date as future releases are made available by the OpenVZ team.

Download the OpenVZ repository details and add the GPG key which is used to sign each package.

wget -P /etc/yum.repos.d/ http://ftp.openvz.org/openvz.repo
rpm --import http://ftp.openvz.org/RPM-GPG-Key-OpenVZ

We can now install the OpenVZ kernel by running the below command. Type y when prompted to begin the download and installation.

yum install vzkernel

Configure system parameters

We need to configure various system parameters for OpenVZ to work, especially on the networking side.

Open up the sysctl.conf file.

vi /etc/sysctl.conf

Either add or amend the following settings.

# packet forwarding enabled and proxy arp disabled
net.ipv4.ip_forward = 1
net.ipv6.conf.default.forwarding = 1
net.ipv6.conf.all.forwarding = 1
net.ipv4.conf.default.proxy_arp = 0

# Enables source route verification
net.ipv4.conf.all.rp_filter = 1

# Enables the magic-sysrq key
kernel.sysrq = 1

# We do not want all our interfaces to send redirects
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.all.send_redirects = 0

OpenVZ needs SELinux to be disabled. Open up the selinux config file and make the SELINUX attribute disabled.

vi /etc/sysconfig/selinux

For example:

 This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

Install OpenVZ tools

Once the kernel is set up we need to install the OpenVZ tools for creating and managing an OpenVZ server.

yum install vzctl vzquota

You can now reboot your machine. When your machine starts up, make sure that the OpenVZ kernel is loaded with the uname -r command. The result should be similar to below, although the version numbers will change with time.

# uname -r
2.6.32-042stab084.26

And that’s it! You now have an OpenVZ server up and running.

 

See Basic container management for details on creating your first CT.

 


Visit our advertisers

Quick Poll

Do you use GlusterFS in your workplace?

Visit our advertisers