Plan: make my server into a good file server for Macs with Time Machine support.

Found this page: Howto: Make Ubuntu a Perfect Mac File Server and Time Machine Volume

Did:

sudo apt-get build-dep netatalk
sudo apt-get install cracklib2-dev fakeroot libssl-dev
sudo apt-get source netatalk
cd netatalk-2*
sudo DEB_BUILD_OPTIONS=ssl dpkg-buildpackage -rfakeroot
sudo dpkg -i ~/netatalk_2*.deb

Hm, got errors at this point. Hope it won't be a problem.

Did:

echo "netatalk hold" | sudo dpkg --set-selections

Followed the instructions modifying settings file. Left the printer service and old appletalk in, since it seems like the printer daemon was dependent on the old appletalk stuff.
Added -ipaddr to the /etc/netatalk/afpd.conf to make sure the intranet IP address was chosen.

To open up the firewall, did:

sudo ufw allow proto tcp from any to 172.16.1.21 port 548
sudo ufw allow proto udp from any to 172.16.1.21 port 5353

After a bit of 'fippling' by following the article's instructions for creating a disk image etc, it works!

Debugging why my squeezeboxserver (version 7.4 under Ubuntu 9.04) can't find my SliMP3 player.

The Squeezeboxserver perl stuff seems to be installed under /usr/share/perl/Slim.

I can see with tcpdump that the player is broadcasting, but the perl squeezeboxserver process doesn't seem to be listening.

Debugging the server with:

perl -d -w /usr/sbin/squeezeboxserver --prefsdir /var/lib/squeezeboxserver/prefs --logdir /var/log/squeezeboxserver/ --cachedir /var/lib/squeezeboxserver/cache --charset utf8 --playeraddr 172.16.1.21 --logfile debuglog --logging debug

which invokes the perl debugger.

Didn't get anywhere. I suspect it may have to do with the two network interfaces on cumulus. Apparently UDP broadcasts only go out on one interface, which is arbitrary unless the server binds to a particular address. That's why I tried the playeraddr command above, which actually helped move the broadcast to the right interface, but that wasn't enough.

The key thing seems to be that although the server is listening to UDP on port 3483 (according to netstat -l), the process isn't receiving or selecting on that socket.

Reinstalling didn't help. Disabled most plugins.

Did a lot of debugging, and playing around with the firewall. After removing the -playeraddr argument to squeezeboxserver, it found the SliMP3. May have been a firewall issue with broadcast addresses?

Problems which have a combination of causes can be so hard to track down...

Started looking at nagios on cumulus.

Created a host for cumulus in /etc/nagios3/conf.d/cumulus-host.cfg

Added user erl as having all access rights in /etc/nagios3/cgi.cfg

The nagios commands seem to be in /usr/lib/nagios/plugins

To check nagios configuration:

sudo nagios3 -v /etc/nagios3/nagios.cfg

Installed nagios (system watchdog) on cumulus with:

apt-get install nagios3

There are instructions here: http://www.sucka.net/2009/07/nagios-ubuntu-9-04-part-1/

Need to setup https, auth against my user database, integrate into cloud.voxi.com

Turned off ufw logging on cumulus:

ufw logging off

Because too much junk was ending up in the logs about blocket packets.

Worked on e-mail web interface at https://cloud.voxi.com.

Now looking at making exim get its info from mysql.

Needed to install an exim version with mysql driver:

apt-get install exim4-daemon-heavy

Did the above for cirrus as well.

This seems to be the way to test exim:

sudo exim4 -C /etc/exim4/exim4.conf.template-db -bv -d

Actually, the above didn't quite work, I think some other config file must also be included.

Had to reset replication for common database. Did this:

cumulus:

flush tables with read lock;

cirrus:

mysqldump --all-databases --master-data --host=www.lewin.nu --port=3306 --ssl --ssl-ca=mysql-ca-cert.pem -p >dbdump.db

cumlus:

unlock tables;

cirrus:

mysql1 -p

Wrote a backup script for the common mysql database, script & backups in /var/backup/mysql, hourly crontab action installed.

Trying to fix internal DNS for Mårten, and help Magnus set up his domain.

Added Magnus as user to the common and Magnus' SQL databases, requiring SSL for non-local accesses.

Set up interfaces on cirrus like so (in /etc/network/interfaces):

# The primary network interface
auto eth0 eth0:1

iface eth0 inet static
address 192.168.6.205
gateway 192.168.6.1
netmask 255.255.255.0

#iface eth0 inet dhcp

# Have a second IP address on eth0, to give the intraweb DNS a separate
# IP from the internet DNS server.
iface eth0:1 inet static
address 192.168.6.206
netmask 255.255.255.255

After ifup eth0:1, I can ping the intranetaddress, but it does not show up in the routing table.

Created /etc/mydns-lan.conf. Updated both conf files to listen on different addresses.

Should set up cumulus to be a replication slave for cirrus database on port 3308.

Asked Mårten to forward ports 3306-3309 to cirrus.

Setting up my phpMyAdmin to access Mårten's master database.

Started working on an email system with the virtual addresses in a MySQL database.

Also, opened UDP ports 6112 and 30260 to be able to play Company of Heroes:

root@cumulus:/etc/exim4/virtualhosts# ufw allow proto udp from any to any port 6112
Rule added
root@cumulus:/etc/exim4/virtualhosts# ufw allow proto udp from any to any port 30260
Rule added

Preparing to plug in cumulus as router.

Updating MyDNS internet tables to change most references to sol to cumulus etc, activated all zones.

Enabled IP Masquerading (NAT) by instructions on: https://help.ubuntu.com/9.04/serverguide/C/firewall.html

Needed to add PIDFILE stuff to mydns in order for the daemon to start two versions of itself.

The new server is now router, and I think it works.

Lunchtime!

Installed smartmontools.

Printer works now after some fippling.

I should fix access control.

Started looking at the print server.

Modified /etc/cups/cupsd.conf to listen on intranet address.

Interrupted for dinner.

Started looking at dhcpd.

did:

sudo apt-get install dhcp3-server

got error:

Setting up dhcp3-server (3.1.1-5ubuntu8.1) ...
Generating /etc/default/dhcp3-server...
* Reloading AppArmor profiles ... [ OK ]
* Starting DHCP server dhcpd3 * check syslog for diagnostics.
[fail]
invoke-rc.d: initscript dhcp3-server, action "start" failed.

I think the only problem is that I have not created configuration files yet for it.

Added eth0 interface in /etc/default/dhcp3-server
Copied configuration file from sol to /etc/dhcpd.conf
still get error starting dhcpd.
Getting this error:

Oct 20 18:09:24 cumulus dhcpd: No subnet declaration for eth0 (172.16.1.21).
Oct 20 18:09:24 cumulus dhcpd: ** Ignoring requests on eth0. If this is not wh\
at
Oct 20 18:09:24 cumulus dhcpd: you want, please write a subnet declaration
Oct 20 18:09:24 cumulus dhcpd: in your dhcpd.conf file for the network segme\
nt
Oct 20 18:09:24 cumulus dhcpd: to which interface eth0 is attached. **

Which is strange, because /etc/dhcpd.conf has:

subnet 172.16.1.0 netmask 255.255.255.0

Ok, figured it out, I had put the conf file in /etc/dhcpd.conf, but under Ubuntu it is supposed to be under /etc/dhcp3/dhcpd.conf

It starts now. I stopped the dhcpd on sol.

Started looking at the firewall, docs at https://help.ubuntu.com/9.04/serverguide/C/firewall.html

First, did this so enabling the firewall wouldn't cut off my ssh connection(s):

sudo ufw allow proto tcp from any to any port 22

Then:

sudo ufw enable

Then (ports 3306-3309 are the mysql database servers, the ip number is Mårten's):

sudo ufw allow http
sudo ufw allow smtp
sudo ufw allow domain
sudo ufw allow proto tcp from 81.26.246.2 to any port 3306
sudo ufw allow proto tcp from 81.26.246.2 to any port 3307
sudo ufw allow proto tcp from 81.26.246.2 to any port 3308
sudo ufw allow proto tcp from 81.26.246.2 to any port 3309

Used "netstat -lp" to see what programs were listening on what ports on the new server. Noticed that I had an e-mail program called dovecot listening on imap and pop ports, so I did:

sudo apt-get remove dovecot-imapd dovecot-pop3d dovecot-common
sudo ufw allow proto tcp from 172.16.0.0/0 to any port 9090

Strangely, after the last rule above, ufw status says:

erl@cumulus:/etc/apache2$ sudo ufw status
Status: active

To Action From
-- ------ ----
22/tcp ALLOW Anywhere
80/tcp ALLOW Anywhere
25/tcp ALLOW Anywhere
53 ALLOW Anywhere
3306/tcp ALLOW 81.26.246.2
3307/tcp ALLOW 81.26.246.2
3308/tcp ALLOW 81.26.246.2
3309/tcp ALLOW 81.26.246.2
9090/tcp ALLOW Anywhere

As though the 'from' restriction didn't work for port 9090.

Also did:

sudo ufw allow proto tcp from 127.0.0.1 to 127.0.0.1 port 9092
sudo ufw allow proto tcp from 127.0.0.1 to 127.0.0.1 port 9000
sudo ufw allow https
sudo ufw allow from 172.16.0.0/16 to 172.16.0.0/16 port 3483
sudo ufw allow from 172.16.0.0/16 to any app Samba
sudo ufw allow from any to any proto udp port afs3-callback

Port 9000 is the SlimBoxServer's web interface. I will try to set up a proxy to forward web accesses from the regular web server to the SlimServer. Couldn't get it to work, will try more later.

Won't open ipp (print server) yet, havn't set it up.

Maybe we are ready to switch cables now? Perhaps I'll update the firewall rules to go by interface later.

All websites are set up, but the https sites don't seem to be working properly. All seem to be showing bilderna.nu.

Ok, fixed it. I had to add NameVirtualHost *:443 in the SSL section of /etc/apache2/ports.conf

I've commented out the Kerberos authentication in some places - I'll have to go back and fix that, and think about how to do authentication in the future.

Continuing with websites.

I need to install the apache connector to forward servlet calls to Tomcat.

Also enabled ssl.

Did this:

sudo apt-get install libapache2-mod-jk
sudo a2enmod ssl
sudo a2enmod rewrite
sudo a2enmod dav dav_fs

Copied SSL certificates from sol to /etc/apache2/ssl.key and /etc/apache2/ssl.crt.
Copied Certificate Authority and other certs from sol's /etc/mail/certs to newly created directory /etc/certs on cumulus.

To install subversion, and the webdav connection to subversion, I did this:

sudo apt-get install subversion libapache2-svn

Copied my svn repository from sol:/usr/local/src/svn to same dir on cumulus.

Hm, svn doesn't seem to work quite yet. Or at least something is strange about the virtual web hosts...

MyDNS strangeness:

erl@cumulus:~/src/mydns-1.2.8$ dig www.voxi.com

; <<>> DiG 9.5.1-P2 <<>> www.voxi.com
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15541 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0 ;; WARNING: Messages has 422 extra bytes at end ;; QUESTION SECTION: ;www.voxi.com. IN A ;; ANSWER SECTION: www.voxi.com. 66720 IN CNAME www.lewin.nu. www.lewin.nu. 62093 IN CNAME sol.lewin.nu. sol.lewin.nu. 62093 IN A 83.227.241.4 ;; Query time: 15 msec ;; SERVER: 172.16.1.21#53(172.16.1.21) erl@cumulus:~/src/mydns-1.2.8$ dig www.lewin.nu ; <<>> DiG 9.5.1-P2 <<>> www.lewin.nu
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3984 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1 ;; QUESTION SECTION: ;www.lewin.nu. IN A ;; ANSWER SECTION: www.lewin.nu. 86400 IN A 172.16.1.21 ;; AUTHORITY SECTION: lewin.nu. 86400 IN NS ns.lewin.nu. ;; ADDITIONAL SECTION: ns.lewin.nu. 86400 IN A 172.16.1.21 ;; Query time: 5 msec ;; SERVER: 172.16.1.21#53(172.16.1.21)

So, the first query tells me that www.voxi.com is CNAME www.lewin.nu which is CNAME sol.lewin.nu, while the second query says that www.lewin.nu is IN A 172.16.1.21. How can the same server give me two different answers for www.lewin.nu?

(while rebuilding mydns with debug enabled, installed package manpages-dev)

After debug-compiling mydns, it looks like the above query results in a recursive query, which in turn asks the bredbandsbolaget DNS server.

Found the problem - the www.voxi.com domain was not marked as 'active' in mydns' database. We should de-activate it when the new internet DNS server is online.
I'll continue debugging this tomorrow.

Web sites.

It seems like the place for web sites under Ubuntu is /var/www.
Will copy my old /srv/www/htdocs subdirectories there.

Work in progress.

Started looking at E-mail.

Installed exim4. Specified server type as 'handling incoming mail, outgoing mail by smarthost.'.

Setup virtual domains by following instructions at: http://www.debuntu.org/2006/05/17/52-how-to-exim4-virtual-host-on-debian-etch.

I think things work, but it's getting hard to test without having the server in its final extranet configuration.

Will later work on reading the exim virtual domains from the MySQL database.

Played around with Squeezeboxserver Music server on the new server.

Had some problems getting Swedish radio P1 to stream properly (it's in WMA format), worked after installing AlienBBC plugin, mplayer and lame, and specifying mms://wm-live.sr.se/sr-p1-high as the URL. Not sure what did it. Also added the following lines to /etc/squeezeboxserver/convert.conf:

wma wav * *
[mplayer] -really-quiet -vc null -vo null -cache 64 -af volume=0,resample=44100:0:1,channels=2 -ao pcm:nowaveheader:file=/dev/fd/4 $FILE$ 4>&1 1>/dev/null

wma mp3 * *
[mplayer] -really-quiet -vc null -vo null -cache 64 -af volume=0,resample=44100:0:1,channels=2 -ao pcm:nowaveheader:file=/dev/fd/4 $FILE$ 4>&1 1>/dev/null | [lame] --silent -q $QUALITY$ $RESAMPLE$ -v $BITRATE$ - -

Also downloaded Squeezeslave (from http://downloads.sourceforge.net/project/softsqueeze/squeezeslave/squeezeslave-0.9/squeezeslave-0.9-65-lnx26-alsa-display-i686.tar.gz?use_mirror=sunet). This is a command line software emulation of a Slim Devices music player. I intend to use it to play music in my living room, and control it from the web interface.

Did:

sudo cp squeezeslave /usr/local/bin

Created a startup script by modifying the one for mydns.

Installed it with:

update-rc.d squeezeslave defaults

Also made symbolic links from /media/music to my music library.