Networking

Setting up LAMP on fedora 11… First install the required modules.

yum install -y httpd.i586 mysql.i586 mysql-server.i586 php.i586 php-mysql.i586 php-gd.i586

Next i’m copying my web source from another linux machine. I’ve run these commands from the destination machine…

cd /var/www/html

rsync -ave ssh 192.168.9.10:/var/www/html/ .

Now my mysql data…

cd /var/lib/mysql

rsync -ave ssh 192.168.9.10:/var/lib/mysql/ .

Accept the certificate and enter the source root password. Next fire up the services…  I usually just go into “setup” then “system services” and enable both httpd and mysqld

To share your zfs pool via NFS (that works with Citrix Xen / ESX) to a host called “esxhost”;

zfs set sharenfs=rw,nosuid,root=esxhost tank/nfs

Note : You MUST have a resolvable name from the opensolaris box. i.e. you should be able to ping it. I have tried with ip’s only and it will fail. I have edited the /etc/hosts file to include the following line for my config;

# Copyright 2007 Sun Microsystems, Inc. All rights reserved. # Use is subject to license terms. # # ident “%Z%%M% %I% %E% SMI” # # Internet host table # 192.168.9.120 esxhost

If your keen on enabling jumbo frames in opensolaris this is the way…

http://docs.sun.com/app/docs/doc/819-6990/gdyqk?l=en&a=view

# dladm show-phys

LINK       MEDIA        STATE     SPEED     DUPLEX     DEVICE

net0       ether        up        100Mb     full       bge0

itops1     ether        up        100Mb     full       qfe3

web1       ether        up        100Mb     full       bge1

# dladm show-linkprop -p mtu web1

LINK     PROPERTY     VALUE     DEFAULT     POSSIBLE

web1     mtu          1500      1500        –

# ifconfig web1 unplumb

# dladm set-linkprop -p mtu=9000 web1

# ifconfig web1 plumb 10.10.1.2/24 up

This is something i do in the lab so all of my vm’s are able to access iso’s etc (very handy for quick builds). Quite handy doing it through windows since its easiey enough to setup a windows network share to the same location and update various files via that.

This site has some good clear instructions : http://vmetc.com/2008/02/19/create-a-nfs-share-for-vm-iso-files-with-windows-2003-server-r2/

1. On the Windows 2003 Server make sure “Microsoft Services for NFS” in installed. If not you need to add it under Add/Remove Programs, Windows Components, Other Network File and Print Services
2. Next go to folder you want to share and right-click on it and select Properties
3. Click on the NFS Sharing tab and select “Share this Folder”
4. Enter a Share Name, check “Anonymous Access”
5. In VirtualCenter, select your ESX server and click the “Configuration” tab and then select “Storage”
6. Click on “Add Storage” and select “Network File System” as the storage type
7. Enter the Windows Server name, the folder (share) name and a descriptive Datastore Name
8. Done. Now you can map CD iso’s to your various vm’s.

 

I’ve had this with certain kernels (2009.06) on opensolaris. Seems there is some incompatibility between some kernels and the opensolaris virtualbox network emulation. This only seems to effect linux virtual guests.

When you try to ping an address you get something like this…

[root@VA-DHCPWEB ~]# ping 192.168.9.15 PING 192.168.9.15 (192.168.9.15) 56(84) bytes of data. 64 bytes from 192.168.9.15: icmp_seq=1 ttl=128 time=1.85 ms 64 bytes from 192.168.9.15: icmp_seq=1 ttl=127 time=1.88 ms (DUP!)

To show what routes your cisco router currently has loaded type the following command (from the enable prompt) ;

show ip route

To add any new static routes you need to use the following command (from the config terminal prompt) ;

ip route 10.10.20.0 255.255.255.0 192.168.100.1

the syntax as above is ip route network netmask gateway

If you find alot of MLS entries in your running-config file you may have QoS enabled. Within the lab i dont require QoS (Quality of Service) to be enabled so have disabled it via this command (config t);

no mls qos

Note: this was a 2960G switch.

Remember to save running config to startup config. Done.

A good reference page here…

http://www.cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/12.2_37_ey/configuration/guide/swqos.html#wp1021247

Sometimes when logged into a router or switch via the null modem (console port) the console messages make it hard to see the commands you are trying to run.

There is a way to turn off the messages on the console session. Log on to your switch router, enter into configuration terminal mode then type…

no logging console

Done

The first place to look for increasing your hit ratio is the refresh_pattern parameter within the squid.conf file.

Note: the following applies to squid 3.0 and higher only….

I have found a really good page here http://linux.com/archive/feature/153221 that explains some good setups if you with to increase your cache hits…

refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i \.(gif|png|jpg|jpeg|ico)$ 10080 90% 43200 override-expire ignore-no-cache ignore-no-store ignore-private refresh_pattern -i \.(iso|avi|wav|mp3|mp4|mpeg|swf|flv|x-flv)$ 43200 90% 432000 override-expire ignore-no-cache ignore-no-store ignore-private refresh_pattern -i \.(deb|rpm|exe|zip|tar|tgz|ram|rar|bin|ppt|doc|tiff)$ 10080 90% 43200 override-expire ignore-no-cache ignore-no-store ignore-private refresh_pattern -i \.index.(html|htm)$ 0 40% 10080 refresh_pattern -i \.(html|htm|css|js)$ 1440 40% 40320 refresh_pattern . 0 40% 40320

I’ve had this on a few windows 2003 machines, where the “DHCP client” service refuses to start and prompts with an access denied window.

Unsure of the cause at this point (it may be a security patch), but here is the fix…

Give the local “network service” account full rights to the following registry key;

hkey_local_machine\system\currentcontrolset\services\dhcp

Now try starting the service, should work. In some cases you may also need to add the rights to the following key..

Decided to create a SMF manifest for squid so that it autostarts on boot.

Command to start squid : /usr/squid/sbin/squid 

Command to stop squid : /usr/squid/sbin/squid -k shutdown 

This site has a good starter on SMF creation : http://blogs.sun.com/observatory/entry/mouting_windows_shares_at_startup

I’ve taken a copy of the /var/svc/manifest/network/smb/server.xml file for my squid manifest and placed it at /var/svc/manifest/network/squid/squid.xml

Import the XML using this command; 

svccfg import /var/svc/manifest/network/squid/squid.xml 

Update: i’ve stopped this work as i missed the fact that squid already comes with a SMF manifest! :)  No idea how i missed that one. You can enable via ; 

svcadm enable svc:/network/http:squid

This is the manifest for the above service; 

I used to have a virtual machine that acted as a transparent proxy, but as of late thought i’d move squid onto my host box (opensolaris). This way hopefully increasing the amount of free ram available to the host while also taking advantage of ZFS etc…

So this is a very brief guide on how to configure your opensolaris 2008.11 box as a transparent proxy. Essentially meaning if you set the solaris box as the default gateway all web traffic will be cached as it goes through it before it goes onto your dls router or outside connection.

Still my favourite light and fast web proxy is Squid. Its very easy to setup and get running on almost all flavours of linux. You can find it here http://www.squid-cache.org/ but will probably find it in your local package manager…

This is for more my own reference… as i don’t think too many people have the need for a transparent proxy. You only need one NIC configured on your VM / machine as its most probably on the same subnet as your dsl etc…

Telnet to your cisco router, enable then go into config t. Passwords may be required depending on how it has been configured…

en

config t

Ensure that ip routing has been enabled…

ip routing

To create the VLAN adapter you’ll need to run the following commands to create a “router on a stick”…   Note: the .2 after the interface name creates a virtual adapter on the interface.

interface FastEthernet1/1.2 description “VM Host Network” encapsulation dot1Q 2 ip address 172.25.2.1 255.255.255.0

In Windows i use robocopy…

This is the syntax to copy from one location to another…  (i like how robocopy uses UNC paths)

robocopy \\192.168.9.70\videos \\192.168.9.101\videos /e /r:2 /w:10 /sec robocopy \\192.168.9.70\software \\192.168.9.101\software /e /r:2 /w:10 /sec

Note: i always copy instead of the move. Run multiple times before switch over to shorten time for final sync. Always use the /SEC to copy over the NTFS permissions. I have had problems with the non X010 version of robocopy not copying NTFS permissions across. Check NTFS permissions before removing the source files. You can update files NTFS permissions with /SECFIX switch if required.

set ip_forward to 1 to enable routing between nics. type ‘route’ to insure both networks are routed as expected (connected route added with nic)

Setup a script with the following (CHMOD 0755 the script so it executes)

iptables -F (clears previous iptables stuff) iptables -P INPUT DROP (will set default policy to DROP all INPUT packets - Incoming to local NICs) iptables -P OUTPUT DROP (will set default policy to DROP all OUTPUT packets - Outgoing to local NICs) iptables -P FORWARD DROP (will set default policy to DROP all FORWARDed packets - Routed via local NICs)

Just wanted to note here that there is a tool for windows to ‘port forward’ Its a command MS ships that enables IPv6 to work on IPv4, but can be used as a port redirector…. so as long as you have IPv6 support on your box, you can do this.

syntax as follows;

netsh interface portproxy add v4tov4 listenport=443 connectaddress=targetmachine connectport=3389

so the machine above listens on 443 and redirects traffic to 3389 on targetmachine.

I have done most of the explaining in another post on how the permissions work with a zfs cifs share - link here.

In this post I’m going to show an example of how to add multiple groups / users to a specific folder. Which then recursively adds its ACL’’s to any child objects. Its essentially like the other commands i used, but with an extra line per user or group you want to configure; 

O.k. from this  point I’m assuming you have created your zfs shares via the zfs command and renamed appropriately like so…..   (if you havent setup cifs yet then check read this)

zfs set sharesmb=on protected/backup

zfs set sharesmb=name=backup protected/backup

Now to check your current shares type…

sharemgr show

zfs

zfs/protected/backup backup=/protected/backup

zfs/protected/photos photos=/protected/photos

Now its time to look at NFSv4 ACL’s. This page has a great explanation of ACL’s and how to set things up. http://cuddletech.com/blog/pivot/entry.php?id=939

OpenSolaris 2008.11 has a cifs/smb server built into the kernel. From what i have been reading (and discovering) this is a much more efficient and faster way to get your files out into the network.

Previously i have run a dedicated samba service to share my files as I’ve come from various linux distros which require it. Seems i should be doing things differently on OpenSolaris.

The dedicated samba service is called;