Using Ubuntu 10.10 to Setup Inexpensive Network Storage

The cost of network storage can be reduced if many of the feature options offered by existing storage vendors are not required. For example if volume snapshots are not necessary. In this article, I will demonstrate how to setup a PC to act as an iscsi target to allow access to the systems storage from any designated system.

The first thing to consider when setting up a low cost storage solution is how much drive redundancy is required. Even if the end user tells you "It's no big deal if the data stored at this location gets lost," think twice about that. Ask yourself, is my company willing to risk data loss for an important file inadvertently saved in this location. Redundant Array of Inexpensive Disks (or RAID) has been a solution to single disk failures for many years. If drive redundancy is desired, do NOT implement a software based RAID solution. Many inexpensive motherboards exist on the market with RAID capabilities on-board. Additionally add-in hardware RAID controllers on todays market also very affordable. Both of these items make the decision to use a software RAID solution (when looking as robustness and performance) unsound.

All of this being said, let us assume that a system is available that has a Pentium Processor, 2GB of RAM, and a Array of hard disks. Onto this system install Ubuntu 10.10 server software. This can be obtained from their website. Once installed and patched follow the steps below

1. Install the iscsi target software using the command
   
   sudo apt-get install iscsitarget


2. Configure the storage location on the Target. The location can be a disk drive or a file:


1. To configure the storage inside of a file, as root create the file at the desired location using the command:
   
   dd if=/dev/zero of=<fileloaction>/<filename> bs=1024k count=<number of 1M blocks>


2. To configure storage as a drive, make certain that the drive is not mounted. Partition as necessary.




3. Enable iscsitarget by editing /etc/default/iscsitarget and set the line
   
   ISCSITARGET_ENABLE=True


4. Edit the ietd.conf in /etc/iet, enter the following lines
   
   Target iqn.<yyyy-mm>.<reversedomainname>:<global unique id>
   
   IncomingUser <username><secret>
   
   OutgoingUser <username><secret>
   
   Lun <#> Path=<path to drive or file>,Type=<Fileio or Blockio>
   
   :


5. Edit the initiators.allow in /etc/iet, enter the following:
   
   Target iqn.<yyyy-mm>.<reversedomainname>:<global unique id> <IP of Initiator>


6. Start the iscsitarget daemon by executing /etc/init.d/iscsitarget start

Review the startup messages by issuing dmesg to verify proper startup. Now configure the iscsi initiator from the client and all is good to go..

The meat of the configuration is in step 4 above. Lets look at this in more detail.

The first line identifies the target. This target name must be globally unique in the network. Typically the unique id could be configured with hostname.<some qualifier>. For example, assume a network called home.com exists. On this network an ISCSI Target host name exists called ISCT1. If this target was configured in March of 2010, we could set line 1 to:

Target iqn.2010-03.com.home:ISCT1.myid1

where myid1 is some random definition that is unique to the network.

Line 2 allows for specification of logon credentials to the device. Note that the intiators,allow setting s will limit access to the target from a specific initiator IP. If further access is restricted based on username, enter it here. If not required, enter no information after IncomingUser.

Line 3 allows for authentication of the Target to the initiator, if requried. If not enter no information after OutgoingUser.

Line 4 and on is the definition for each storage device in this target. Multiple LUNs can be defined. For example: if a entire partion (eg. /dev/sdh1) is to be presented to the initiator as well as 2 individual files (eg. /storage/lun5.img and /storage/lun6.img) The entries might appear as:

Lun 0 Path=/dev/sdh1.Type=Fileio

Lun 1 Path=/storage/lun5.img,Type=Fileio

Lun 2 Path=/storage/lun6.img,Type=Fileio

I've identified only some of the items the can be defined in the ietd.conf file. For complete information, refer to the ietd.conf man page

Finally, in step 5 above the initiators.allow file mapps the target name to the initiator IP. Thus only the IP of the specified initiator can access the Target.

Using Ubuntu 64 10.10 to connect to a Cisco VPN Endpoint

Linux supports cisco VPN client via the vpnc application. To install, execute

sudo apt-get install vpnc

This installs the open source vpn client. The installation creates a folder in /etc called vpnc. In this folder is a sample connection file. Then:

1. As su, copy this file to another and name appropriately. Edit this file, remove the appropriate comments (#) and fill in the correct information.
2. In your home folder, create a vpn-up file and enter the following
   sudo vpnc-connect --local-port 0 /etc/vpnc/.conf
3. Change the attributes of this file to allow execution (chmod 770 vpn-up)
4. In your home folder, create a vpn-down file and enter the following
   sudo vpnc-disconnect
5. Change the attributes of this file to allow execution (chmod 770 vpn-down)

Now to create the connection, open a terminal session and execute ~/vpn-up to connect and ~/vpn-down to disconnect.

Moving AD Objects Via VBS

Sometimes in AD reorganization of objects needs to occur to ease management. With a high number of objects, it might be more convientient to do this programatically. Lucily Microsoft has mad this task some what painless with VB Scripting. The process involves essentially three steps:

1. Create a scripting object to the new OU in AD where this object is to move

2. Create a scripting object to the original AD object

3. Use the MoveHere method of the new OU object to move the original object to that location

Example:

Say a computer account exists under the OU tree OU=Desktops,OU=Company,dc=location,dc=local. Let us assume that this computer account is called MYPC. Additionally, it is desired to move this account to the OU tree defined at OU=NewOU,dc=location,dc=local. Here's a sample scripts to do this for you

-------

szNewLoc="OU=NewOU,dc=location,dc=local"

szOldObj="CN=MYPC,OU=Desktops,OU=Company,dc=location,dc=local"

set oNewOU=GetObject("LDAP://" & szNewLoc)

set oCpu=GetObject("LDAP://" & szOldObj)

oNewOU.MoveHere oCpu.ADsPath, oCpu.Name

---

That it. Now lets decipher the script.

Lines 1 and 2 set string variables to the new OU and the original object

Line 3: creates a scripting object identifying the new storage location

Line 4. Creates a scripting object identifying the original object

Line 5: This does the actual move of the object. The MoveHere method, moves the source object (identified by the oCpu.Name property) from the original path (identified by the ADsPath property) the the location of the object oNewOU.

Caveats when setting Internet Explorer Proxy Settings Via GPO

When configuring a proxy server to work in a windows domain, it is often convienient to set a GPO for IE8 to enforce the correct settings. However, there are time when certain web site access must bypass the proxy settings. For this reason, the GPO editor under User Configuration/Policies/Windows Settings/Internet Explorer Maintenance/Connections/Proxy Settings has a section to enter exceptions. Make careful note that when entering information in this section, there are NO [ / ] characters. Doing so will bypass the proxy for all web sites.

Installing and Configuring ISCSI Initiator on Ubuntu 10.10

To configure the iSCSI initiator on Ubuntu 10.10, do the following:

1. Install the initiator software if not already done: sudo apt-get install open-iscsi.

2. Edit the iscsi configuration file. It is located under /etc/iscsi
a. Set the startup to automatic by removing the comment from node.startup = automatic
b. Turn off the manual startup by placing a comment in front of node.startup = manual

3. Restart the initiator by executing sudo /etc/init.d/open-iscsi restart

4. Configure the iscsi target:
a. Execute iscsiadm -m discovery -t st -p <target_ip>. This will discover the target. It will create a configuration file under /etc/iscsi/nodes. THere will be a separte folder for each target and then for each interface.
b. If username and password are required by the target, edit the config files by executing the following series of commands:
iscsiadm -m node --targetname "iqn.2001-04.com.example:storage.lun1" --portal "<target_ip>:3260" --op=update --name node.session.auth.authmethod --value=CHAP
iscsiadm -m node --targetname "iqn.2001-04.com.example:storage.lun1" --portal "<target_ip>:3260" --op=update --name node.session.auth.username --value=someuser
iscsiadm -m node --targetname "iqn.2001-04.com.example:storage.lun1" --portal "<target_ip>:3260" --op=update --name node.session.auth.password --value=secret

5. Restart the initiator by executing sudo /etc/init.d/open-iscsi restart

You should now be connected to the target. Verify by executing fdisk -l. You should now see the disk. Using fdisk utilites partition as desired.

Installing and Configuring SQUIDGUARD on Ubuntu 10.10

Squidguard is a content filtering daemon that working in conjunction with Squid proxy on Linux. Many articles have been written that discusses installation and configuration. Most notably for Ubuntu see https://help.ubuntu.com/community/SquidGuard. This document briefly outlines what I did to get it working in my environment.

1. sudo apt-get install squid

2. sudo apt-get install squidguard

3. sudo apt-get update && sudo apt-get upgrade

This install squid and squidguard on the system. The following are the working directories and files

/etc/squid - squid and squidguard configuration folders

/usr/bin/squidGuard - application file

/var/log/squid - default squid and squidguard logging folder

/var/lib/squidguard/db - location of blocking database files

Now to go to the configuration...

1. Download a list of publicly available database blacklists. In my case I got them from urlblacklist.com.

2. As root, extract the contents into /var/lib/squidguard/db. The compressed file has a blacklist subfolder in it. Copy the items under this compressed subfolder into /var/lib/squidguard/db. The folder structure should now be /var/lib/squidguard/db/<category>.

3. As root, alter the ownership of all files in /var/lib/squidguard/db and under to the proxy account. Issue the command sudo chown -R proxy:proxy /var/lib/squidguard/db to accomplish this.

4. Change permissions on all of these files using the command sudo chmod -R 755 /var/lib/squidguard/db. While this is not the most secure thing, it's the only way I got it to work.

5. Modify the squid.conf file in /etc/squid to do the following:
a. Locate the url_rewrite_program line to read url_rewrite_program /usr/bin/squidGuard –c /etc/squid/squidGuard.conf
b. Uncomment #http_access allow localnet
c. Add visible_hostname localhost

6. Save the squid.conf file

7. Alter the squidGuard.conf file in /etc/squid to perform the following:
a. Remove all entries after logdir /var/log/squid
b. Add category definitions and acl lists in the following format:

dest <category_name> {
domainlist <category_name>/domains
urllist <category_name>/urls
}
acl {
default {
pass !<category_name>
redirect http://<url_of_blocking_page>
}

}

Note: THis file can have multiple dest categories. The category_names are those extracted in step 2. If blocking multiple categories, specify those as multiple category entries in the acl section. For noob's (!) means to block the list contents

8. Save the file and change the owner to proxy by issuing the command sudo chown proxy:proxy /etc/squid/squidGuard.conf

9. Issue the following commands to change permissions on these required files:

chmod 644 /etc/squid/squidGuard.conf
chmod -R 644 /var/log/squid/
chmod 755 /var/log/squid

10. Import all definitions configured in squidGuard.conf by issuing the command sudo squidGuard -C all.

11. Restart squidguard by issuing sudo squid -k reconfigure

12. Verify proper startup by reviewing the logs in /var/log/squid/squidGuard.log

Squidguard is now configured. Set the client to proxy all requests through <squid_server>:3128

Install Java on Ubuntu 10.10 64

After upgrading to Ubuntu 10.10, I noticed that the ice-tea firefox plugin for Java was installed. THis caused some issues with devices I was attempting to access. Here's how I resolved it:

1. From the synaptec package manager, I removed icetea6-plugin.
2. Add the repository: sudo add-apt-repository "deb http://archive.canonical.com/ maverick partner"
3. Update the repository cache: sudo apt-get update
4. Perform the install: sudo apt-get install sun-java6-bin sun-java6-jre sun-java6-plugin
5. Restart Firefox

Now all is working.