| |
 also on this site:
| |
| also in this section: | |
| tech index
most popular pages
| |
 search:
| |
|
Like this site? Your donation is welcome! |
|
with respect and in deference to The FreeBSD Diary
The aim of this project is to produce a unix server which provides SSH, FTP, SMTP, POP, IMAP, NTP, HTTP (Apache, PERL and PHP), SQL (MySQL), SMB file and print sharing (Samba and CUPS), and email filtering (SpamAssassin) service. An all-in-one drop-in replacement for Windows and Netware servers, basically, with some extra features. I know that unix is more reliable and secure, and is more powerful, than any version of Windows, and I wish to pass these benefits onto my customers.
Note, this server will be on a NATted LAN inside the corporate firewall, which is a separate device, and doubles as a router, DNS server, and ADSL uplink. DHCP is not used.
|
Looking for a unix desktop instead of a server platform? Check out PC-BSD - This is FreeBSD + KDE (a popular GUI), with a sexy installer, some smart scripts and a bunch of services preinstalled and preconfigured. It doesn't try to be a server - this is a system designed to do the same job as Windows XP. It's very slick indeed. |
I then needed to select a distribution - there's NetBSD, OpenBSD and FreeBSD. NetBSD is optimised for portability... I don't need that. OpenBSD's main advantage seems to be security - I didn't feel the need to encrypt my swapspace... so I opted for the high-performance FreeBSD instead. See also a comparison of BSD operating systems and/or Distrowatch for more information.
Hardware-wise, BSD runs on pretty well anything, including the 333MHz AMD K6 in the test server, with 128Mb of RAM and 4Gb of disk (note that I currently recommend a minimum of 10Gb for a FreeBSD 8.x install). BSD can run with less resources than these - but it's not recommended. A BIOS with support for ACPI and bootable CD-ROMs is also suggested. While BSD can run on ancient hardware, the limitations this imposes on the flexibility of the system may be excessive. Certainly, for production servers I hope to use the latest and fastest hardware. Note that BSD, being a community-supported OS, does not immediately support new devices; nor do manufacturers usually ship BSD drivers. Ensure that drivers are available, working and stable before committing to a specific device.
Software-wise, aside from the operating system I also had to decide which servers and applications to deploy. I stuck with the tools I knew.
Note: once you've settled on a distribution, you might like to stick with the particular version of the distribution you download, at least for a while. This will allow you to compare and contrast between your builds (you will no doubt do several). If you always use the latest version of the distribution, you will be introducing inconsistencies between your builds, this will be confusing if you are still learning how the system works. So, select your download very carefully. As always, avoid ".0" releases, you want a version number x.1 or higher.
Next, I had to get the FreeBSD CDs. I downloaded the full distribution as an ISO from a mirror; after verifying the MD5 hash for each ISO, I then burned the ISOs onto CDs. If you're not sure how to burn an ISO from a mirror onto a CD, or verify the hashes, this is your cue to open a new browser window and zoom over to your favourite search engine. I did try using BitTorrent to get the ISOs, but it was going to take twice as long, plus saturate my outbound, so I aborted BitTorrent and went for good old FTP.
Assemble the hardware. Try and use known-good hardware if possible. Ensure the drive you are installing FreeBSD on is connected to the Primary IDE channel, and is configured as Master. This is not strictly necessary, and certainly for SCSI setups is not applicable, however unless you know what you're doing, keep it simple. You may need to use a boot manager if you do not install to a drive configured as master on the primary IDE channel. Ensure the machine can see the hard disk and CD-ROM before continuing.
Configure the BIOS. Usually, there's nothing to change, but the system date should be set correctly. Also, the CD-ROM needs to be a bootable device, higher in the boot order than the primary hard disk (just during installation - once the install is complete, it's good security to set the hard disk as the first bootable device, unless otherwise needed). Finally, ACPI should be enabled. If your BIOS does not support booting from CD, or ACPI, my advice is to find a computer that does, and use that, since these features will make your life as admin simpler and faster. Check the BIOS settings, especially the clock, before installing the software.
Put in the CD (use disk 1 for FreeBSD 7.x and below) and boot off it. From the welcome screen that appears, select 1. Boot FreeBSD [default] (if you have problems with crashes during startup or install, try the other options on this first screen, especially ACPI). The next two screens allow country and keymap selection (in FreeBSD 4.11, these options are selected later). I suggest UK, then from the next screen, UK CP850. The sysinstall Main Menu is then displayed; select standard install.
If you have multiple drives in your system, you will now be prompted to select which drive to install to. Select this VERY carefully. If you select the incorrect drive, you are likely to lose all the data on that drive during the install. If you have multiple drives, but you are not prompted to select a drive, that means that FreeBSD has not detected your other drive(s). Check your hardware setup in this case.
FDISK the partition editor will now appear. Check that you are installing to the correct drive - the top-left corner of the FDISK screen shows the Disk Name, which should be ad0 if you are installing to the master drive on your primary IDE channel. If the disk name is correct, press A (to use the entire disk), press down-arrow (to select the new FreeBSD partition), press S (to make the new FreeBSD partition bootable), and finally press Q to quit FDISK. [Note to fellow DOS refugees: FreeBSD calls partitions 'slices'. FreeBSD has partitions too but they are different to DOS-style partitions - in fact they are sub-partitions, and are called labels.]
The installer then prompts to install a boot manager. Select install a standard MBR. If you are doing multiboot, I still recommend you select standard MBR here, I had problems with the FreeBSD boot manager (admittedly, a few years back). You'll need to install a Boot Manager separately in this case (see my multiboot notes for more on this).
Next, the disklabel editor appears; press A to create the default scheme. Customise label sizes as needed, then press Q to quit the label editor. The disklabel editor can be tricky to use, especially if customising the label sizes - fortunately the defaults are often acceptable. For reference, the following FreeBSD-style partitions are required:
| / | 250Mb minimum |
| swap | 250Mb minimum |
| /tmp | 250Mb minimum |
| /usr | 2Gb minimum |
| /var | 500Mb minimum |
Smaller values may work, but will probably not be useful (especially over time). /usr should be as big as possible. Think carefully before proceeding - ensure the scheme you define will suit the machine's intended usage (a mailserver, which by default puts spools in /var, will probably need an extra-large /var, for example). You may need to juggle the sizes of the various labels, particularly if you are installing on a disk 4Gb or less in size. Once the label sizes are defined, it's difficult to change them without reinstalling the system from scratch. Unfortunately, FreeBSD is not yet blessed with tools like Ghost and Partition Magic (although you could try PING if you were brave).
With label sizes defined, the installer then prompts for an installation type - select Developer, unless you have a preference otherwise.
In FreeBSD 8.x, the next screen to appear asks whether to install documentation. Selecting the correct documentation for your language is recommended.
The installer then asks whether to install the ports collection. If the ports collection is not installed, this can cause difficulty in some circumstances, so electing to install the ports here is recommended.
The installer then returns to the "choose distribution" screen - your previous selection should now be marked with an X. If this is the case, press the Tab key to move the cursor to the OK button, then press the Space bar to press OK.
Select your installation media.
Read the next screen carefully - if you're happy that you're about to erase your hard disk, press Enter to continue! The hard disk will then be partitioned and formatted, and system files will be copied to the disk (this process takes some time). When the install is completed, a congratulations message will appear.
The installer then proceeds to the "final configuration questions". These vary depending on previous choices and the distribution being installed (docs: handbook).
Press the X key to exit the installer and reboot, not forgetting to eject the CD.
FreeBSD 7.x and below only: to complete the install, enter some "random entropy" for SSH key generation - this is done on first boot, follow the onscreen instructions (this step won't appear if you did not elect to enable SSH during install).
This done, you should be able to login as root, and immediately ping yahoo.com!
Note: if installing FreeBSD in a dual- or multi-boot system, a boot manager should be installed at this point. You may also wish to remove the ability to boot from CD from the BIOS.
You should now continue to the next section.
SSH: (docs: handbook; manpage - daemon; manpage - config file)
During install, you may have slected "Yes, enable SSH login" - while this generates keys and configures the SSH daemon to start on boot, it crucially does not automatically allow anyone to login remotely (including root). To permit a user to login, first login to the console as root, then:
# denied users DenyUsers Administrator Guest Root # permitted users AllowUsers username@IP.address.you.use
username is usually the username associated with the sysadmin's personal account (created above, member of group 'wheel'). Do not permit root to login remotely. A more secure configuration is to permit a user who can 'su' to root instead.
IP.address.you.use is the IP address of the computer you use to connect to the server. Failing to add the AllowUsers line permits users to login from anywhere. Failing to add the IP address permits the user specified to login from anywhere.
Remember to restart the daemon after you save your changes to its configuration file. It only reads the file when it starts up.
Note: this configuration permits use of password-based authentication, which is vulnerable to brute-forcing. Key-based authentication is more secure. However, in the configuration above an IP address is specified on the AllowUsers line, which means that a brute-force attack can only be successful if it is made from that IP address. denyhosts can also be used to ban problem IPs.
The rest of the build can be completed remotely (via SSH), if desired. If you wish to connect remotely via SSH, and a firewall is in between, forward the SSH port 22/TCP to the server now. Also, check that port 22/TCP is open on the firewall. It's good security to use an alternate port, if possible (forward, for example, firewall/external port 6666 to server/internal port 22 - you then specify port 6666 in your SSH client and the firewall maps the traffic to port 22 on the server).
SSH issues? Have a look in /var/log/auth.log
You should now continue to the next section.
CVSup: (docs: handbook; homepage)
If you're doing a new install, skip this section and go straight to portaudit. If you want to update an existing system, which is currently FreeBSD 6.3 or higher, please see the Handbook page on the subject, and do not use the instructions below. The instructions below are for FreeBSD 6.2 and below only, as these systems do not include the freebsd-update utility.
I installed CVSup when I installed FreeBSD itself, so next, after logging in as root, I updated the source tree, so as to get the latest patches:
The source tree updated, rebuild the system (docs: handbook):
Don't skip the reboots, without them the new kernel does not become active (not sure about world).
The step below is no longer recommended. Use portsnap instead.
The system rebuilt, update the ports collection:
Notes:
Failing to update the system would have left me with a bunch of bugs and security issues that have already been fixed.
portaudit: (docs: manpage)
portaudit is a useful tool that prevents the installation of ports containing known vulnerabilities. It also checks existing ports for known vulnerabilities.
How to install:
At any time, you can now check all ports for vulnerabilities with the command:
/usr/local/sbin/portaudit -Fda
Notes:
You should now continue to the next section.
portsnap: (docs: handbook)
portsnap is used to update the ports collection. portsnap is installed with the base system, for FreeBSD 6 and up (earlier versions require it to be installed from the ports collection).
To initialise portsnap, and update to the latest ports tree, login as root, and do this:
portsnap fetch extract
This command is only required when portsnap is first run. To update the ports tree at a later time (eg. once portsnap has been initialised, as above):
portsnap fetch update
Notes:
denyhosts: (docs: FAQ)
denyhosts can be used to stop many kinds of brute-force attacks. While the SSH configuration above is quite secure, using denyhosts gives an extra layer of security, and may allow some of the other restrictions to be relaxed (eg. restricting login from certain IP addresses only). In addition, denyhosts can be used to simultaneously block attacks on protocols other than SSH. denyhost's drawbacks include its Python dependency, and also its use of TCP wrappers. However this use of TCP wrappers means that it does not need a firewall in order to operate.
NOTE: if you do not plan on exposing any ports to the public internet, you do not need to install denyhosts.
How to install:
denyhosts_enable="YES" syslogd_flags="-c"
ALL : ALL : allow
# denyhosts sshd : /etc/hosts.deniedssh : deny sshd : ALL : allow
BLOCK_SERVICE = sshd
Notes:
# mysql mysqld : ALL : allowAll hosts will be then allowed to connect to mysqld. Ensure to remove any mistakenly blocked hosts from /etc/hosts.deniedssh (denyhosts will probably have added any clients that attempted to use mysql while it was blocked to the /etc/hosts.deniedssh file). A restart of denyhosts, mysqld or anything else is NOT required.
This example permits a single IP access to SWAT (Samba's configuration tool):
# SWAT swat : 192.168.0.1 : allow swat : ALL : deny
NTP: (docs: handbook; manpage)
An NTP daemon is installed by default; use this procedure to configure and start it:
ntpdate_flags="time.server.to.use" ntpdate_enable="YES"ntpd_enable="YES" ntpd_sync_on_start="YES"
Notes:
FTP: (docs: handbook - ftp; handbook - inetd; manpage - inetd)
An FTP server is installed by default; use this procedure to configure and start it:
Notes:
SMTP (sendmail):
Sendmail is installed and enabled by default. Use this procedure to configure it:
The instructions once given here, which were for configuring sendmail in outbound-only mode, are no longer recommended for use, and instead, ssmtp is suggested (I hope to add instructions for this soon).
PHP: (docs: PHP)
Note: install PHP before installing Apache.
To install PHP:
Note: if this is a production server, use /usr/local/etc/php.ini-production instead. The production INI is more secure, but less flexible.
Note: older versions of PHP come with differently-named sample INIs, try /usr/local/etc/php.ini-recommended in this case. List /usr/local/etc/ and look for files starting with php, if you have problems.
There are too many options to cover here, but recommended options, in addition to the defaults, include CURL, GD, MCRYPT, MYSQL, MSYQLI, and OPENSSL
Notes:
HTTP (Apache): (docs: handbook; homepage: Apache)
Note: newer versions of FreeBSD seem to install Apache, if it is not installed when PHP was installed; so if you've already installed PHP, skip to step 3 of the instructions below. If you get an error, "file not found" you need to start at step 1.
Note, ensure to change the second instance of the <Directory> line - it's underneath the text "This should be changed to whatever you set DocumentRoot to."
DirectoryIndex index.php index.html index.htm
## BEGIN extra PHP filetypes ## AddType application/x-httpd-php .php AddType application/x-httpd-php .phtml AddType application/x-httpd-php .php3 AddType application/x-httpd-php .php4 AddType application/x-httpd-php .php5 AddType application/x-httpd-php-source .phps ## END extra PHP filetypes ##
Notes:
SMB (Samba): (docs: handbook; manpages; HOW-TO collection)
There are many ways to use Samba. Below are five different methods:
Samba has a web-based administration tool called SWAT. Note that SWAT will rewrite smb.conf, removing all comments and unnecessary settings. Do not open SWAT if you want to keep your smb.conf 'as is'. To install it:
SWAT will then be accessible at http://localhost:901/ (the root username and password are required)
Note also that SWAT uses inetd. Enable it if necessary with the following:
To start inetd manually: /etc/rc.d/inetd start
Notes:
CUPS (and printserving with Samba): (docs: samba CUPS)
CUPS is not installed by default. Note that Samba should be installed before CUPS. Install CUPS as follows:
IP.address.you.use is the IP address of the computer you use to connect to the server.
The Samba/CUPS interface must then be configured:
enable and run CUPS:
Then configure a printer:
This done, Windows users will be able to browse for the printer and add it as usual to their systems. They will be prompted for drivers which they must install locally.
Note: the above notes assume the printer is connected directly to the server's parallel port. If the printer is connected via a printserver, substitute the protocol and device path above as appropriate, examples: lpd://192.168.0.90/p1 or lpd://yourprintserver/p2
Note: it may take a few minutes for the printer you have shared ("published") to become visible to client computers.
Note: if the server is being configured remotely with SSH, it's possible to create a tunnel to port 631, and then use a local web browser to connect, through the tunnel, to the CUPS control panel, using an address such as http://localhost:3000/ (where 3000 is the local port where the SSH tunnel terminates).
Note: the CUPS logfile, very useful for troubleshooting, can be found in /var/log/cups/
Note: the CUPS admin panel may autodetect network printers, if so it provides a wizard to add them to the CUPS configuration. However this wizard creates sharenames that are incompatible with/invisible to Windows 9x clients. Ensure to use short sharenames (11 characters or less) if Windows 9x clients are in use. The printer will need to be added manually in order to define a sharename.
Note: printing under unix is not straight-forward, and I'm not an expert. While this section works, in that Windows clients can print to the unix printer, this section leaves out certain things (ie. the ability to print from the server to the printer, and loading Windows drivers onto the server).
Issues? See troubleshooting printing with CUPS
POP/IMAP (Dovecot): (docs: Dovecot)
A POP server is not installed by default. I installed Dovecot from the ports collection (it supports IMAP as well):
The server can be started manually with the command: dovecot
Note that SSL must be disabled if SSL certificates have not been generated.
SQL (MySQL): (docs: MySQL)
MySQL is not installed by default. How to install and configure it from the ports collection:
cd /usr/ports/databases/mysql50-server make install clean
mkdir /data mkdir /data/db mkdir /data/db/mysql chown -R mysql /data/db/mysql/ chgrp -R mysql /data/db/mysql/
Note: the default directory MySQL uses is /var/db/mysql/ however it has been changed to /data/db/mysql/ in this example.
Note: a MySQL user and group are required, however these are created automatically by the installer.
/usr/local/bin/mysql_install_db -u mysql --datadir=/data/db
Note: If a bunch of 'cannot find file' messages appear here, check the permissions on the data directory.
echo mysql_enable=\"YES\" >> /etc/rc.conf echo mysql_dbdir=\"/data/db/mysql\" >> /etc/rc.conf
If there are problems, check the file server.err in the MySQL data directory for error messages (the actual name of the file will not be server.err, "server" is substituted for your machine's hostname). Don't skip the reboot - it can fix at least one transient post-install issue.
mysqladmin -u root password 'ROOT_PASSWORD'
mysql -uroot -pROOT_PASSWORD -e"GRANT ALL PRIVILEGES ON *.* TO 'root'@'IP.address.you.use' IDENTIFIED BY 'ROOT_PASSWORD'" mysql -uroot -pROOT_PASSWORD -e"GRANT SHUTDOWN ON *.* TO 'root'@'IP.address.you.use' IDENTIFIED BY 'ROOT_PASSWORD'"
IP.address.you.use is the IP address of the computer you use to connect to the server.
Notes:
mysqladmin -uroot -pROOT_PASSWORD -hlocalhost CREATE DATABASENAME mysql -uroot -pROOT_PASSWORD -e"GRANT ALL PRIVILEGES ON DATABASENAME.* TO 'USERNAME'@'localhost' IDENTIFIED BY 'SECRET_PASSWORD'"
In the above commandlines, substitute ROOT_PASSWORD, DATABASENAME, USERNAME and SECRET_PASSWORD for the correct values for your environment.
Installing software from the packages collection is done as follows:
The ports collection (docs: handbook)
I've only played with this a bit so nothing in-depth here, however I did try installing FreeBSD on an empty second hard disk in a machine running Windows 2000 Server. During FreeBSD's install I elected to install the Boot Manager, as suggested by the installer, so I could select which operating system to boot.
However the Boot Manager seemed to corrupt my MBR. I got a nasty message from W2KS when I tried to log in - "your paging file is too small", a known fault but after running the fix and rebooting I got an even nastier message from W2KS asking me to reboot in Directory Services Restore Mode. At this point I broke out my Ghost image and restored my W2KS installation from a backup.
I found a third-party boot manager called GAG which did the trick. I reinstalled FreeBSD, this time telling it to leave the MBR alone, then installed GAG. Sorted.