Walker News » Linux

How To Setup VPN Server Using pptpd On RHEL?

Walker — Sun, 19 Jun 2011 12:42:25 +0000

You might need only 3 minutes to install and configure a Linux VPN server using pptpd and a minute later have Windows 7 VPN client connect pptpd successfully.

On RHEL or CentOS 5 Linux:

Download pptpd. The current version used by this guide is pptpd-1.3.4-2.rhel5.i386.rpm. For experts who want to compile pptpd source code for installation, get it from Poptop official page.
Confirm the Linux kernel supports MPPE for encrypted tunnel:
```
modprobe ppp-compress-18 && echo ok
```
If you see “ok” printed after execution, meaning that the MPPE is enabled and nothing need to be done. Otherwise, refer to this guide for help.
Install pptpd:
```
rpm -Uvh pptpd-rpm-file
```
Edit /etc/pptpd.conf file to set the IP of VPN server and clients using private network address space defined by RFC 1918. For example:
```
localip 172.20.20.1
remoteip 172.20.20.2-6
```
Where VPN server IP is 172.20.20.1 and only 5 VPN clients allowed connecting concurrently (because remoteip is limited to allocate IP 172.20.20.2 to 172.20.20.6 for connected client).
Edit /etc/ppp/chap-secrets file to set VPN login ID and password. E.g.
```
walker   pptpd   vpn123:)   *
```
Where 1st column is VPN login ID, 2nd field is fixed to “pptpd”, 3rd field is the VPN login password, and fourth field is an asterisk to indicate any VPN client IP (defined by “remoteip” in previous step).
Configure RHEL/CentOS to auto start pptpd at each reboot:
```
chkconfig --level 345 pptpd on
```
Start up pptpd immediately (without reboot Linux) and confirm the VPN server is up and listening for client connection:
```
service pptpd start
netstat -tulpan | grep pptpd
```
Temporarily stop Firewall for first VPN connection attempt (to confirm the pptpd setup is good to go):
```
service iptables stop
```

On Windows 7 (64-bit Ultimate edition), nothing need to be installed as the bundled VPN client is capable to connect with pptpd server:

Right click the connection icon at Notification Area (bottom-right corner where the Date/Time is displayed) then choose “Open Network and Sharing Center”.
Click “Setup a new connection or network”, “Connect to a workplace”, “Use my Internet connection (VPN)”.
For “Internet address”, enter the VPN server’s public/WAN IP (not the 172.20.20.1) which can be “seen” and ping-ed by Windows 7. The “Destination name” is friendly name defined by user to identify this particular VPN connection.
Next, enter the VPN login ID and password (as what you’ve defined in /etc/ppp/chap-secrets) and click Connect.

Suppose the login credential is correct, Windows 7 should have no problem connecting with pptpd VPN server.

How To Do Interactive Search And Replace Using Vi Editor?

Walker — Sun, 05 Jun 2011 11:39:09 +0000

It’s pretty fast and easy to have Vi automatically search and replace all existence of a target word in text file, if you’re confident with your regular expression (e.g no error).

For example, this command :1,%s/the/WALKER/g effectively replace any words containing “the” to “WALKER”, e.g. “the”, “other”, “these”, etc.

Obviously, the regular expression is not correct, if your intention is to replace the exact word. In this case, it should be this:
:1,%s/\/WALKER/g
where

1,% means from first to last line, i.e. all lines in the edited file. So, to perform on 3rd to 5th line, write it as 3,5.

s/\/WALKER/ means search exact word “the” and replace it with “WALKER”,

g means all occurrence of the search text found in each line. Without this “g” command, “s” only find and replace the first occurrence found in each line.

So, would be great if it’s possible to get Vi editor confirms text replacement with you for each the target text it found in text file (e.g. source code)?

Using Vi editor to perform search and replace interactively

Just use “c” command (short for confirmation). For example:

:1,%s/\/WALKER/gc

You’ll see it prompts replace with WALKER (y/n/a/q/l/^E/^Y)?, where

y for yes
n for no
a for all (as if “c” option is not used)
q for quit
l for last (i.e. quit after replace this)
^E and ^Y indicate CTTL+E and CTRL+Y respectively for scrolling text. Seriously, I don’t know how to use these two CTRL keys :(

How To Configure VNC Server To Use GNOME Desktop On CentOS?

Walker — Wed, 11 May 2011 17:34:49 +0000

When connecting to Linux VNC server running on RHEL or CentOS, you only see a boring xterm window instead of getting access to normal Linux Desktop (GNOME Desktop, by default).

No worry, it can be easily fixed in no time. Let’s see how to setup Linux VNC server xstartup script to access the graphical GNOME Desktop on RHEL / CentOS:

1. Stop VNC server by execute vncserver -kill :1 (if VNC server display number is 1; otherwise replace this number accordingly).

2. Execute cd $HOME/.vnc (this hidden folder and its files are created in user’s home directory when VNC server started for the first time).

3. Create a backup copy of $HOME/.vnc/xstartup.

4. Now, there are two ways to deal with this $HOME/.vnc/xstartup script file (choose one that works for your case):

Option 1: Open $HOME/.vnc/xstartup and remove comment character “#” in front of the blue text, i.e. the file content will looks like this eventually:

#!/bin/sh

# Uncomment the following two lines for normal desktop:
unset SESSION_MANAGER
exec /etc/X11/xinit/xinitrc

[ -x /etc/vnc/xstartup ] && exec /etc/vnc/xstartup
[ -r $HOME/.Xresources ] && xrdb $HOME/.Xresources
xsetroot -solid grey
vncconfig -iconic &
xterm -geometry 80x24+10+10 -ls -title "$VNCDESKTOP Desktop" &
twm &

Option 2: Overwrite $HOME/.vnc/xstartup content with these lines:

#!/bin/sh

vncconfig -iconic &

if test -z "$DBUS_SESSION_BUS_ADDRESS" ; then
   eval `dbus-launch --sh-syntax --exit-with-session`
fi
exec  gnome-session

After saving changes made to xstartup script file, you may start VNC server to test it. Now, the VNC client should be able access to GNOME Desktop of RHEL/CentOS.

How To Load And Remove Linux USB Mass Storage Driver?

Walker — Sun, 08 May 2011 16:53:27 +0000

On Linux, the modprobe command allows user dynamically loads and unloads Linux kernel modules, i.e. one can easily add and remove Linux device driver (e.g. USB mass storage driver) without having to reboot the system.

What’s a Linux kernel module? Simply put, it’s a program (e.g. driver) that can be added to and removed from Linux kernel upon demand to extend the kernel functionality. These programs are usually kept in /lib/modules/$(uname -r) folder and ended with .ko file extension.

Now, let’s say you’ve previously disabled or turned off Linux mass storage device and now you desperately need to use an USB drive for file transfer. So, how can you load the Linux USB mass storage driver without reboot the server or disrupt connecting users?

On RHEL 5.2, the Linux kernel automatically detects and mounts an USB drive upon plug in, just like Windows, unless the driver is disabled.

Here is the trick:

1. Login as root and undo the change made to disable USB mass storage driver, i.e. edit /etc/modprobe.d/no-usb file and use “#” to remark (comment out) the “install usb-storage” line, e.g.:

#install usb-storage /bin/true

2. Execute this command to load usb-storage.ko into kernel:

modprobe usb-storage

To confirm the kernel module has loaded successfully, you can use these commands to check:

[walker@test] tail /var/log/messages
May 9 00:16:38 test kernel: Initializing USB Mass Storage driver...
May 9 00:16:38 test kernel: usbcore: registered new driver usb-storage
May 9 00:16:38 test kernel: USB Mass Storage support registered.
[walker@test] lsmod | grep -i usb
usb_storage            76577  0
scsi_mod              134605  11 usb_storage,megaraid

Now, plug in the USB drive to do file transfer. When it’s done, you can unload / remove USB mass storage driver using this command:

modprobe -r usb-storage

Next, remove the “#” character that’s used (step-1) to comment out the line in /etc/modprobe.d/no-usb file, if the driver has to be disabled.

How To Disable Linux USB Drive?

Walker — Sun, 08 May 2011 15:05:17 +0000

For security’s sake, IT auditor and security team normally request system administrator to disable or turn off USB mass storage device to minimize risk of data theft.

Now, let’s see how to disable USB mass storage device on Redhat Linux (RHEL 5.2 particularly; should be applicable to other Linux distributions too):

Login as root,
Open /etc/modprobe.d/no-usb for edit (create this file if it’s not exists),
Append this line to the no-usb file (in step-2) and save it:
```
install usb-storage /bin/true
```

Reboot server to enforce change. To confirm USB mass storage support has disabled, just execute lsmod | grep -i usb or try plug in USB drive to confirm.

Simple Trick Used To Monitor Website Uptime

Walker — Sat, 07 May 2011 17:15:46 +0000

There are many sites offer service to check and track website uptime, but I haven’t found one that allows user to run check at every minute except the paid premium plan.

So, I make a simple Linux shell script (below) that uses wget to check website uptime (replace blue texts with your own value accordingly):

#!/bin/sh

DMSG="Unknown at "`date`
WGETLOG=$HOME/.wget.log

wget -O $WGETLOG http://www.walkernews.net 2>>$WGETLOG

[ $? -ne 0 ] && mail -s "$DMSG" email@example.com <$WGETLOG

If the Linux web hosting server allows you to schedule cronjob, send email, and run wget at command prompt, then configure crontab to auto execute the shell script every minutes:

If the website is down (caused by failure of web server/Apache, PHP, MySQL, etc), it will send an alert to notify you at the given email address.
If the Internet connection to the web hosting server is down, the shell script can’t detect it and thus can’t alert you :(

Alternatively, power on a Linux machine 24×7 at home or somewhere else to run the shell script. Though this way allows it to detect both Internet connection and website problem (therefore can notify you via email alert), but it can’t tell which side of the Internet connection is down (unless running another check using ping) and you’ve to find a Linux machine running 24×7 :(

If that is not your ideal solution, then go subscribe free service to track website uptime (at longer interval) or get a paid premium service with great features (e.g. email + SMS alert, monthly / daily reports, online statistics, multiple checks from different sites, etc).

How To Create Auto FTP Script On Linux?

Walker — Mon, 02 May 2011 16:48:28 +0000

FTP is an insecure file transfer protocol and thus prohibited by most system administrators and IT auditors. The best alternate is using SCP or SFTP to transfer files over SSH protocol.

However, security or vulnerability of FTP is only side info, not the concern of this topic. If you would like to create an auto FTP script that can be scheduled as cronjob to automate file transfer, here you go.

First, there must be a .netrc file in home directory. If this file is not exists, just manually create one:

vi $HOME/.netrc

A sample of .netrc contains 2 sets of auto-FTP information:

machine ftp_ip_or_hostname
login ftp_login_id
password ftp_login_password
macdef init
prompt
bi
mput fin*.rpt
quit

machine 192.168.22.45
login walker
password abc123
macdef init
prompt
as
mget rpt*.log
quit

Where texts in red are mandatory keywords, texts in italic style are user-supplied values for the respective keywords, texts in blue are FTP commands to be executed after login FTP server successfully.

There must be a blank line immediately after the last FTP command (blue texts). Otherwise, you’ll get “Macro definition missing null line terminator.” rejection.

The password is written as plain text in .netrc – one of the obvious reasons you shouldn’t use FTP for file transfer, especially auto-FTP (if can be avoided).

Next, set .netrc permission to 600:

chmod 600 .netrc

Now, the auto-FTP setup is done. Using the .netrc sample (above), when I execute ftp 192.168.22.45 at Linux command prompt, the FTP client will automatically login, set interactive mode to off, switch to ASCII mode, download rpt*.log and then logout!