Add a DNS and DHCP server with dnsmasq

In order to better control the allocation of addresses to the various bits that are now on the local network, I've added a DNS and DHCP server to 'fileserver' with dnsmasq. First install it

fileserver:~# apt-get install dnsmasq

then edit the configuration file /etc/dnsmasq -

# Don't use /etc/resolv.conf or any other
# file, get servers from this file instead
no-resolv
server=192.168.2.1

#This is our home network domain name
domain=ourhouse.net

#Don't forward anything without a full domain name
domain-needed
#Don't try to do reverse lookups of private IP addresses
bogus-priv
#Don't forward these local domains
local=/ourhouse.net/
local=/azea.net/

#Start the DHCP server
dhcp-range=192.168.2.20,192.168.2.49,12h

# Override the default route supplied by dnsmasq, which assumes the
# router is the same machine as the one running dnsmasq.
dhcp-option=3,192.168.2.1

# For debugging purposes, log each DNS query as it passes through
# dnsmasq.
log-queries

'fileserver' itself will have to have a static IP address now - since I will be turning off the DHCP server on the gateway router - therefore need to edit /etc/network/interfaces compared to the one used in the earlier post -

#This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
    address 0.0.0.0

auto br0
iface br0 inet static
    address 192.168.2.18
    netmask 255.255.255.0       
    gateway 192.168.2.1
    bridge_ports eth0 tap0
    pre-up openvpn --mktun --dev tap0
    post-down openvpn --rmtun --dev tap0

/etc/resolv.conf must be edited to make dns lookups originating on 'fileserver' use the local DNS server -

nameserver 127.0.0.1

and /etc/hosts edited so that dns lookups will find the correct addresses for 'fileserver' and 'gateway' - the only devices on the network that will not get their addresses from the new DHCP server -

127.0.0.1       localhost
192.168.2.1     gateway
192.168.2.18    fileserver

dnsmasq writes it's DHCP lease in formation to /var/lib/misc/dnsmasq.leases -

1225776083 00:0e:a6:9f:04:e7 192.168.2.32 Playroom-Router 01:00:0e:a6:9f:04:e7
1225772336 00:1a:73:bf:97:0c 192.168.2.25 AndrewsPC 01:00:1a:73:bf:97:0c
1225748001 00:10:60:a1:3c:79 192.168.2.15 Will-PC 01:00:10:60:a1:3c:79

Now I can let all other devices get there IP addresses via DHCP and I can refer to them by their hostnames - for example pinging 'fileserver' from a Windows machine gives -

C:\Documents and Settings\andrew>ping fileserver

Pinging fileserver.ourhouse.net [192.168.2.18] with 32 bytes of data:

Reply from 192.168.2.18: bytes=32 time=1ms TTL=64
Reply from 192.168.2.18: bytes=32 time=2ms TTL=64
Reply from 192.168.2.18: bytes=32 time=3ms TTL=64
Reply from 192.168.2.18: bytes=32 time=3ms TTL=64

Ping statistics for 192.168.2.18:
     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
     Minimum = 1ms, Maximum = 3ms, Average = 2ms

and similarly pinging 'Playroom-Router' from a linux box -

box:~# ping Playroom-Router
PING Playroom-Router (192.168.2.32) 56(84) bytes of data.
64 bytes from Playroom-Router.ourhouse.net (192.168.2.32): icmp_seq=1 ttl=64 time=17.9 ms
64 bytes from Playroom-Router.ourhouse.net (192.168.2.32): icmp_seq=2 ttl=64 time=4.20 ms
64 bytes from Playroom-Router.ourhouse.net (192.168.2.32): icmp_seq=3 ttl=64 time=3.11 ms
64 bytes from Playroom-Router.ourhouse.net (192.168.2.32): icmp_seq=4 ttl=64 time=2.19 ms
64 bytes from Playroom-Router.ourhouse.net (192.168.2.32): icmp_seq=5 ttl=64 time=3.22 ms

--- Playroom-Router ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4039ms
rtt min/avg/max/mdev = 2.199/6.137/17.943/5.937 ms

Super!

Add dynamic DNS service updater

I'm going to be adding a VPN gateway to the fileserver so I can access it over the internet. I have an account at DynDNS that will map the WAN address of my router to my DynDNS domain name. I need a simple client on the LAN to update this account when the WAN address changes.

The simplest client recommened at DynDNS seems to be inadyn which I installed on the fileserver

fileserver:~# apt-get install inadyn

I generated the required config file automatically using the DynDNS tool and saved it on the fileserver at /etc/inadyn.conf.

fileserver:~# cat /etc/inadyn.conf
## inadyn configuration file
update_period_sec 600 # Check for a new IP every 600 seconds

# DynDNS username and password here
username xxxxxx
password xxxxxx

dyndns_system dyndns@dyndns.org

## Dynamic DNS hosts
alias flabby.is-a-geek.com

background

I tested the update process by running inadyn from the command line -

fileserver:~# inadyn
INADYN: Started 'INADYN version 1.96' - dynamic DNS updater.
I:INADYN: IP address for alias 'flabby.is-a-geek.com' needs update to '65.93.163.244'
I:INADYN: Alias 'flabby.is-a-geek.com' to IP '65.93.163.244' updated successful.

I added the line -

background

to the end of /etc/inadyn.conf which causes the process to run in the background and the output to be sent to syslog.

I then set up the required scripts to run inadyn correctly at boot time.

cp /etc/init.d/skeleton /etc/init.d/inadyn
chmod 755 /etc/init.d/inadyn

I changed only the line -

NAME=inadyn

and then tested with -

fileserver:~# /etc/init.d/inadyn start
fileserver:~# ps -ef | grep /etc/init.d/inadyn
root 3275 1 0 18:29 ? 00:00:00 /usr/sbin/inadyn
fileserver:~# tail -n 3 /var/log/syslog
Oct 20 18:29:21 fileserver INADYN[3275]: INADYN: Started 'INADYN version 1.96' - dynamic DNS updater.
Oct 20 18:29:22 fileserver INADYN[3275]: I:INADYN: IP address for alias 'flabby.is-a-geek.com' needs update to '65.93.163.244'
Oct 20 18:29:22 fileserver INADYN[3275]: I:INADYN: Alias 'flabby.is-a-geek.com' to IP '65.93.163.244' updated successful.

Then to make it permanent I did -

fileserver:# update-rc.d /etc/init.d/inadyn defaults
Adding system startup for /etc/init.d/inadyn...
/etc/rc0.d/K20inadyn -> ../init.d/inadyn
/etc/rc1.d/K20inadyn -> ../init.d/inadyn
/etc/rc6.d/K20inadyn -> ../init.d/inadyn
/etc/rc2.d/S20inadyn -> ../init.d/inadyn
/etc/rc3.d/S20inadyn -> ../init.d/inadyn
/etc/rc4.d/S20inadyn -> ../init.d/inadyn
/etc/rc5.d/S20inadyn -> ../init.d/inadyn

So it should run correctly on reboot now.

Setting up NFS on the NSLU2 fileserver

Will want to export NFS shares from the fileserver as well as Samba. Followed advice from DebianHelp.

apt-get install nfs-kernel-server

edited /etc/exports to add -

/home/share/music *

then update the running server by doing

exportfs -a

Installing rsync to automate backups onto the NSLU2 Fileserver

Install rsync on the Fileserver -

apt-get install rsync

edit /etc/rsyncd.conf

# rsyncd.conf
uid = share
gid = share
use chroot = yes
max connections = 2
syslog facility = local3
pid file = /var/run/rsyncd.pid
[GiddyKipper]
path = /home/share/backups/GiddyKipper
comment = nslu2 rsync backup of GiddyKipper
read only = no
[SillySausage]
path = /home/share/backups/SillySausage
comment = nslu2 rsync backup of SillySausage
read only = no

Started rsync in daemon mode -

rsync --daemon

Should now be able to see the rsysnc server from another machine on the LAN -

andrew@giddykipper:~$ sudo rsync fileserver::
GiddyKipper nslu2 rsync backup of GiddyKipper
SillySausage nslu2 rsync backup of SillySausage
andrew@giddykipper:~$

Clients 'push' backups onto the server - i.e. to back-up my Linux 'home' directory on GiddyKipper -

rsync -arv --delete /home/andrew/ fileserver::GiddyKipper/andrew/

In order for this backup to run daily, the following script is added to /etc/cron.daily

#!/bin/sh
#
# backup cron daily
rsync -arv --delete /home/andrew/ fileserver::GiddyKipper/andrew/

For Windows machine, need to install cygwin, and then install rsync within cygwin. Backups are run as -

rsync -arv --delete /cygdrive/c/Documents\ and\ Settings/Rachel/ fileserver::SillySausage/Rachel/

and can include explicit exclude options to avoid lots of junk -

--exclude '*/Temporary\ Internet\ Files/*'

To run regular backups, need to add something like the following script to "Scheduled Tasks" to be run as an Administrator -

c:
cd c:\cygwin\bin
bash --login -c "rsync -avr --log-file=/cygdrive/c/backup.log --delete --exclude '*/Temporary\ Internet\ Files/*' /cygdrive/c/Documents\ and\ Settings/Rachel/ fileserver::SillySausage/Rachel/"

Setting up Samba on the NSLU2 Fileserver

Added an new user 'share' with password 'share'

adduser share

This also automatically creates a directory /home/share. Added new directories in /home/share to store the data to be shared by samba -

cd /home/share/
mkdir music
mkdir pictures

mkdir backups
mkdir videos

mkdir /home/share/backups/GiddyKipper
mkdir /home/share/backups/SillySausage

- and changed the owner of the directories to 'share'

chown share:share /home/share -R

Installed samba

apt-get install samba

edited /etc/samba/smb.conf

# Global parameters
[global]
workgroup = OURHOUSE
netbios name = fileserver

server string = Our Fileserver

security = SHARE

#turn off printing!
load printers = no
printing = bsd
printcap name = /dev/null
disable spoolss = yes

[music]
comment = Shared Music Files
path = /home/share/music
force user = share
force group = share
read only = Yes
guest ok = Yes

[pictures]
comment = Shared Pictures
path = /home/share/pictures
force user = share
force group = share
read only = Yes
guest ok = Yes

[videos]
comment = Shared videos
path = /home/share/videos
force user = share
force group = share
read only = Yes
guest ok = Yes

[backups]
comment = Network backups
browseable = No
force user = share
force group = share
read only = Yes
guest ok = Yes

[shares-admin]
comment = Admin access to the shares
browseable = No
user = share
read only = No
guest ok = No

Added a samba user called 'share' with password 'share'

fileserver:~# smbpasswd -a share
New SMB password:
Retype new SMB password:
Added user share.

And checked he was there OK -

fileserver:~# pdbedit -L
share:1001:,,,

Restarted samba to force rereading of the config file (update: actually don't need to do this - config file is re-read every 60 seconds)

/etc/init.d/samba restart

- and then check to see if shares are exported.

The shares 'music', 'pictures' and 'videos' should be visible to everyone - but no writes or deletes allowed:

 

The 'backups' share isn't shown above because it isn't browsable - but it's there readonly for everyone as well if you type the full share name in:

Typing in the full path of the 'shares-admin' share brings up a password dialog box and you have to log in as the samba user 'share' as created above before the share is accessable (full read write access):

Installing Debian on the NSLU2 Fileserver

My first attmpt to reflash the NSLU2 with Debian Etch using the Debian Installer repeatedly failed while downloading packages from the mirrors (Next time I try it I'll make more detailed notes of what went wrong!) - so instead I used the manual method described here. This uses a tar ball prepared by Martin Michlmayr which just needs to be unpacked into the target filesystem.

Firstly, I partitioned the usb diskdrive. I plugged the drive into my laptop running Ubuntu 7.04 and used fdisk to create the required partitions. In order to match Martin's tar ball, I created /dev/sdb1 for the root partition (size 3000M), /dev/sdb2 as an extended partition from which I created /dev/sdb5 for the swap partition (700M) and /dev/sdb6 for the home partition (the remainder of the disk ~ 36G) are created. I also used fdisk to make /dev/sdb1 bootable and to change the type of /dev/sdb5 to 82 (Linux swap).

(...I had to reboot the laptop and then unmount the automounted usb disk before the next step...)

I then formatted the drive –

mkfs.ext3 /dev/sdb1
mkfs.ext3 /dev/sdb6
mkswap /dev/sdb5

- and mounted it on the laptop -

sudo mount /dev/sdb1 /mnt/tmp

I got the tar ball from -

wget http://people.debian.org/~tbm/nslu2/etch/base.tar.bz

- and unpacked it onto the root partition of the prepared drive -

cd /mnt/tmp
bzcat ~/base.tar.bz2 tar -xvf -

I then had to manually install the proprietary firmware that is needed for the in-built Ethernet chip, following the instructions on the NSLU2-Linux wiki describing how to extract this firmware from an installer image, as follows -

Firstly I downloaded the debian-installer image from slug-firmware.net and unpacked the image using slugimage (the version of slugimage packaged for Ubuntu was too old - I got my version from the Unslung CVS.)

slugimage -u -i di-nslu2.bin

- endian swapped the initramfs (ramdisk.gz).

devio '<< ramdisk.gz; xp $ 4' > ramdisk-swap.gz

- unpacked the initramfs

mkdir initrd; cd initrd
zcat ../ramdisk-swap.gz cpio -i

(there were lots of errors here relating to file permissions - but the firmware seems to have been extracted OK)

The NPE microcode firmware was in the initrd/lib/firmware directory - called NPE-B.01000201. I copied this file to /mnt/tmp/lib/firmware, and then created a symbolic link in /mnt/tmp/lib/firmware called NPE-B which points to NPE-B.01000201.

sudo cp NPE-B.01000201 /mnt/tmp/lib/firmware/
cd /mnt/tmp/lib/firmware; sudo ln -s NPE-B.01000201 NPE-B

The filesystem was now prepared, so I put the NSLU2 in upgrade mode and flashed the etch firmware image using upslug2 (the version packaged with Ubuntu was OK).

sudo upslug2 -i sda1-2.6.18.dfsg.1-12.bin

I connected the hard drive when upslug2 had finished and the NSLU2 rebooted the new Debian system. The system obtained an IP address via DHCP on eth0. I was able connect via SSH with user root and password root.

First thing I did was changed the root password -

passwd root

- regenerated the ssh keys

ssh-keygen -f /etc/ssh/ssh_host_key -N '' -t rsa1

ssh-keygen -f /etc/ssh/ssh_host_rsa_key -N '' -t rsa
ssh-keygen -f /etc/ssh/ssh_host_dsa_key -N '' -t dsa

- edited /etc/network/interfaces to give a static IP address

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug eth0
iface eth0 inet static
address 192.168.1.77
netmask 255.255.255.0
gateway 192.168.1.1

- added a normal user andrew

adduser andrew

- changed the host name by changing 'foobar' to 'fileserver' in /etc/hostname and /etc/hosts

I then rebooted to make sure I could still log in (I could as user andrew and as root ...) then edited /etc/apt/sources.list to point to local mirrors as well as the contrib and non-free repositories -

deb http://ftp.uk.debian.org/debian/ etch main contrib non-free
deb-src http://ftp.uk.debian.org/debian/ etch main contrib non-free
deb http://security.debian.org/ etch/updates main contrib non-free
deb-src http://security.debian.org/ etch/updates main contrib non-free

and upgraded -

apt-get update
apt-get dist-upgrade

There was a kernel upgrade required, but no packages required updating.

Next - installing samba ...