Category: Utilities

Disk Imaging and Partitioning Utilities

Disk Imaging and Partitioning Utilities

Description

So what do you do when you do not have an optical drive for a computer or server and you would like to install Linux?

You have two options, use a USB device (CD-ROM, Hard Drive, or Thumb drive) or PXE booting and doing a full network install. This article will discuss the latter.

Requirements

The following application(s) must be installed, configured and running before tftp-hpa is installed:

Preparation for Installation

Start PuTTY on a Windows PC, Terminal on a Mac or similar terminal application on a Linux PC.

In this example Terminal on a Mac is used.

Open a remote SSH session to the server with:

Mac:~ user$ ssh user@192.168.1.4 [enter]
N.B.: Replace user@192.168.1.4 with User ID and IP Address on Your server!
[user@server ~]$

Enable superuser privileges with:

[user@server ~]$ sudo -s [enter]
Password: <-- passwd [enter]
[root@server /usr/home/user]#

N.B.: Enter user password, not the root password!

Installation

The server used in this example is configured to contain one partition called /tftpboot used for PXE related files.

Add the Disk Imaging and Partitioning Utility option to the PXE Boot Main Menu with:

[root@server /usr/home/user]# ee /tftpboot/pxelinux.cfg/default [enter]

…the add the following text, example:

...
MENU COLOR HOTKEY 0 #ff00ff00 #ee000000 std
MENU COLOR HOTSEL 0 #ffffffff #85000000 std

LABEL f1
MENU LABEL ^1)  Disk Imaging and Partitioning Utilities
KERNEL vesamenu.c32
APPEND top.cfg f01.cfg bottom.cfg

LABEL blank
MENU LABEL
...

The PXE Boot Sub-Menu for Disk Imaging and Partitioning Utilities is defined in file /tftpboot/f01.cfg.

Create this file with:

[root@server /usr/home/user]# ee /tftpboot/f01.cfg [enter]

..and then add the following text, example:

MENU TITLE  Disk Imaging and Partitioning Utilities

Change file modes

Change file modes for file /tftpboot/f01.cfg with:

[root@server ~]# chmod -R 755 /tftpboot/f01.cfg [enter]
[root@server /usr/home/user]#

Create a folder for Disk Imaging and Partitioning Utilities files with:

[root@server /usr/home/user]# mkdir /tftpboot/f01 [enter]
[root@server /usr/home/user]#

NFSv4 Server Setup

Service start on boot

List installed NFS services with:

[root@server /usr/home/user]# service -r | grep /nfs [enter]
/etc/rc.d/nfsclient
/etc/rc.d/nfsuserd
/etc/rc.d/nfsd
/etc/rc.d/nfscbd
[root@server /usr/home/user]#

Find the rcvar for /etc/rc.d/nfsclient with:

[root@server /usr/home/user]# /etc/rc.d/nfsclient rcvar [enter]
# nfsclient : NFS client setup
#
nfs_client_enable="NO"
#   (default: "")

[root@server /usr/home/user]#

Find the rcvar for /etc/rc.d/nfsuserd with:

[root@server /usr/home/user]# /etc/rc.d/nfsuserd rcvar [enter]
# nfsuserd : Load user and group information into the kernel for NFSv4 services and support manage-gids for all NFS versions
#
nfsuserd_enable="NO"
#   (default: "")

[root@server /usr/home/user]#

Find the rcvar for /etc/rc.d/nfsd with:

[root@server /usr/home/user]# /etc/rc.d/nfsd rcvar [enter]
# nfsd : Remote NFS server
#
nfs_server_enable="NO"
#   (default: "")

[root@server /usr/home/user]#

Find the rcvar for /etc/rc.d/nfscbd with:

[root@server /usr/home/user]# /etc/rc.d/nfscbd rcvar [enter]
# nfscbd : NFSv4 client side callback daemon
#
nfscbd_enable="NO"
#   (default: "")

[root@server /usr/home/user]#

N.B.: Since an NFSv4 mount uses the host uuid to identify the client uniquely to the server, you cannot safely do an NFSv4 mount when
it is set to hostid_enable=”NO”!

Add the following to /etc/rc.conf, assuming they’re not already there:

[root@server /usr/home/user]# echo '' >> /etc/rc.conf; echo '# NFS Server' >> /etc/rc.conf; echo 'rpcbind_enable="YES"' >> /etc/rc.conf; echo 'mountd_enable="YES"' >> /etc/rc.conf; echo 'nfs_server_enable="YES"' >> /etc/rc.conf; echo 'nfsv4_server_enable="YES"' >> /etc/rc.conf; echo 'nfsuserd_enable="YES"' >> /etc/rc.conf [enter]

Export Settings

Now we need to create an NFS export settings file /etc/exports with:

[root@server /usr/home/user]# ee /etc/exports [enter]

…and the add the following text:

V4: /
/tmp \
-maproot=root -network 192.168.1.0 -mask 255.255.255.0

This example assumes your network is 192.168.1.0/24; if it’s something else, you’ll need to make appropriate changes.

Now start all of the above services:

[root@server /usr/home/user]# service rpcbind start [enter]
Starting rpcbind.
[root@server /usr/home/user]#
[root@server /usr/home/user]# service mountd start [enter]
Starting mountd.
[root@server /usr/home/user]#
[root@server /usr/home/user]# service nfsd start [enter]
Starting nfsd.
[root@server /usr/home/user]#

Verify that the NFS mount is being exported with:

[root@server /usr/home/user]# showmount -e [enter]
Exports list on localhost:
/tmp                               192.168.1.0
[root@server /usr/home/user]#

After you have performed an update of file /etc/exports, re-read the exports settings with:

[root@server /usr/home/user]# service mountd reload [enter]
[root@server /usr/home/user]#

If your NFS exported directories will not be accessed locally (and Samba counts as local access), then you can enable NFSv4 delegations to improve performance. On a FreeBSD NFS server, they may be enabled globally for all exports by adding the following line to /etc/sysctl.conf with:

[root@server /usr/home/user]# echo 'vfs.nfsd.issue_delegations=1' >> /etc/sysctl.conf [enter]
[root@server /usr/home/user]#

packet filter (pf)

Access to the tftpd service must be enabled in the packet filter (pf) configuration file.

Start editing file /etc/pf.conf with:

[root@server /usr/home/user]# ee /etc/pf.conf [enter]

…and add port information to enable access to the NFS service from clients on the local network as in this example:

...
# Ports:
...
#  111 TCP UDP   Open Network Computing Remote Procedure Call (ONC RPC, sometimes referred to as Sun RPC)
...
# 2049 TCP UDP	Network File System (NFS)
...
tcp_pass="{ ... 111, ... 2049, ... }"
udp_pass="{ ... 111, ... 2049, ... }"
...

Check /etc/pf.conf for errors, but do not load ruleset with:

[root@server /usr/home/user]# pfctl -vvnf /etc/pf.conf [enter]

…and then reload /etc/pf.conf with:

[root@server /usr/home/user]# service pf reload  [enter]
Reloading pf rules.
[root@server /usr/home/user]#

GParted Live

GNOME Partition Editor for creating, reorganizing, and deleting disk partitions. It uses libparted from the parted project to detect and manipulate partition tables. Optional file system tools permit managing file systems not included in libparted.

GParted Live is a small bootable GNU/Linux distribution for x86 based computers.

It enables you to use all the features of the latest versions of the GParted application.

WWW: http://gparted.sourceforge.net/livecd.php/.

Files: https://sourceforge.net/projects/gparted/files/.

Requirements

GParted is a free partition manager that enables you to resize, copy, and move partitions without data loss.

amd64

The 64-bit version of GParted runs on x86-64 based computers, with the ability to access more than 4 gigabytes of memory, and supports the use of multiple processor cores.

For newer (>2010) computers with UEFI instead of legacy BIOS try this one.

Download gparted-live-0.28.1-1-amd64.zip, 271 MB, with:

[root@server /usr/home/user]# wget https://sourceforge.net/projects/gparted/files/gparted-live-stable/0.28.1-1/gparted-live-0.28.1-1-amd64.zip [enter]

Create direcory /tftpboot/f01/gparted with:

[root@server /usr/home/user]# mkdir -p /tftpboot/f01/gparted [enter]
[root@server /usr/home/user]#

Extract zip file gparted-live-0.28.1-1-amd64.zip into directory /tftpboot/f01/gparted/i686/ with:

[root@server /usr/home/user]# unzip gparted-live-0.28.1-1-amd64.zip live/* -d /tftpboot/f01/gparted/amd64 [enter]
Archive:  gparted-live-0.28.1-1-amd64.zip
 extracting: /tftpboot/f01/gparted/amd64/live/memtest  
 extracting: /tftpboot/f01/gparted/amd64/live/GParted-Live-Version  
 extracting: /tftpboot/f01/gparted/amd64/live/initrd.img  
 extracting: /tftpboot/f01/gparted/amd64/live/filesystem.packages-remove  
 extracting: /tftpboot/f01/gparted/amd64/live/filesystem.packages  
 extracting: /tftpboot/f01/gparted/amd64/live/vmlinuz  
 extracting: /tftpboot/f01/gparted/amd64/live/filesystem.squashfs
[root@server /usr/home/user]#

Delete downloaded zip files with:

[root@server /usr/home/user]# rm gparted-live-0.28.1-1-amd64.zip [enter]
[root@server /usr/home/user]#

The TFTP root directory permission plays an important role. Make sure that the permission and ownership are set correctly with:

[root@server /usr/home/user]# chown -R tftpd:nobody /tftpboot/f01/gparted [enter]
[root@server /usr/home/user]# chmod -R 755 /tftpboot/f01/gparted/amd64/live [enter]
[root@server /usr/home/user]#

Edit file /tftpboot/f01.cfg with:

[root@server /usr/home/user]# ee /tftpboot/f01.cfg [enter]

…and add the following lines:

LABEL f1
MENU LABEL ^1)  GParted Live v. 0.28.1-1-amd64
MENU PASSWD
TEXT HELP
GParted is used for creating, reorganizing and deleting disk partitions.
The amd64 version runs on x86-64 based computers, with ability to access
more than 4 gigabytes of memory and supports use of multiple processor cores.
For newer (>2010) computers with UEFI instead of legacy BIOS 
ENDTEXT
KERNEL f01/gparted/amd64/live/vmlinuz
APPEND initrd=f01/gparted/amd64/live/initrd.img boot=live union=overlay username=tftpd config components quiet noswap edd=on nomodeset nodmraid noeject locales="en_US.UTF-8" keyboard-layouts="se" ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no vga=791 ip= net.ifnames=0 nosplash i915.blacklist=yes radeonhd.blacklist=yes nouveau.blacklist=yes vmwgfx.enable_fbdev=1 netboot=nfs nfsroot=$nfsserverIP:/tftpboot/f01/gparted/amd64/

N.B.: Replace $nfsserverIP with the IP address of your NFS server!

NFS Export Update

Edit file /etc/exports with:

[root@server /usr/home/user]# ee /etc/exports [enter]

…and add the following text:

V4: /
/tftpboot/f01/gparted/amd64 \
-maproot=root -network 192.168.1.0 -mask 255.255.255.0

Reload the NFS mount setup with:

[root@server /usr/home/user]# service mountd reload [enter]
[root@server /usr/home/user]#

Display the NFS mount setup with:

[root@server /usr/home/user]# showmount -e [enter]
Exports list on localhost:
/tftpboot/f01/gparted/amd64        192.168.1.0
[root@server /usr/home/user]#

i686 PAE (Physical Address Extension)

The 32-bit version of Gparted runs on x86 (i686 and higher) and x86-64 based computers, with Physical Address Extension to access more than 4 gigabytes of memory, and supports the use of multiple processor cores.

Download 0.28.1-1-i686-pae, 273 MB, with:

[root@server /usr/home/user]# wget https://sourceforge.net/projects/gparted/files/gparted-live-stable/0.28.1-1/gparted-live-0.28.1-1-i686-pae.zip [enter]

Extract zip file ~/gparted-live-0.28.1-1-i686-pae.zip into directory /tftpboot/f01/gparted/i686-pae/ with:

[root@server /usr/home/user]# unzip gparted-live-0.28.1-1-i686-pae.zip live/* -d /tftpboot/f01/gparted/i686-pae [enter]
Archive:  gparted-live-0.28.1-1-i686-pae.zip
 extracting: /tftpboot/f01/gparted/i686-pae/live/memtest  
 extracting: /tftpboot/f01/gparted/i686-pae/live/GParted-Live-Version  
 extracting: /tftpboot/f01/gparted/i686-pae/live/initrd.img  
 extracting: /tftpboot/f01/gparted/i686-pae/live/filesystem.packages-remove  
 extracting: /tftpboot/f01/gparted/i686-pae/live/filesystem.packages  
 extracting: /tftpboot/f01/gparted/i686-pae/live/vmlinuz  
 extracting: /tftpboot/f01/gparted/i686-pae/live/filesystem.squashfs
[root@server /usr/home/user]#

Delete downloaded zip files with:

[root@server /usr/home/user]# rm gparted-live-0.28.1-1-i686-pae.zip [enter]
[root@server /usr/home/user]#

The TFTP root directory permission plays an important role. Make sure that the permission and ownership are set correctly with:

[root@server /usr/home/user]# chown -R tftpd:nobody /tftpboot/f01/gparted [enter]
[root@server /usr/home/user]# chmod -R 755 /tftpboot/f01/gparted/i686-pae/live [enter]
[root@server /usr/home/user]#

Edit file /tftpboot/f01.cfg with:

[root@server /usr/home/user]# ee /tftpboot/f01.cfg [enter]

…and add the following lines:

LABEL f2
MENU LABEL ^2)  GParted Live v. 0.28.1-1-i686-pae (Physical Address Extension)
MENU PASSWD
TEXT HELP
GParted is used for creating, reorganizing and deleting disk partitions.
The i686-pae version runs on x86 (i686 and higher) and x86-64 based computers, with
Physical Address Extension to access more than 4 gigabytes of memory, and supports
use of multiple processor cores.
ENDTEXT
KERNEL f01/gparted/i686-pae/live/vmlinuz
APPEND initrd=f01/gparted/i686-pae/live/initrd.img boot=live union=overlay username=tftpd config components quiet noswap edd=on nomodeset nodmraid noeject locales="en_US.UTF-8" keyboard-layouts="se" ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no vga=788 ip= net.ifnames=0 nosplash i915.blacklist=yes radeonhd.blacklist=yes nouveau.blacklist=yes vmwgfx.enable_fbdev=1 netboot=nfs nfsroot=$nfsserverIP:/tftpboot/f01/gparted/i686-pae/

N.B.: Replace $nfsserverIP with the IP address of your NFS server!

NFS Export Update

Edit file /etc/exports with:

[root@server /usr/home/user]# ee /etc/exports [enter]

…and add the following text:

V4: /
/tftpboot/f01/gparted/amd64 \
/tftpboot/f01/gparted/i686-pae \
-maproot=root -network 192.168.1.0 -mask 255.255.255.0

Reload the NFS mount setup with:

[root@server /usr/home/user]# service mountd reload [enter]
[root@server /usr/home/user]#

Display the NFS mount setup with:

[root@server /usr/home/user]# showmount -e [enter]
Exports list on localhost:
/tftpboot/f01/gparted/i686-pae     192.168.1.0
/tftpboot/f01/gparted/amd64        192.168.1.0
[root@server /usr/home/user]#

i686

32-bit version of GParted runs on x86 and x86-64 based computers, limited to physical address space of 4 gigabytes, and uses one processor only.

If in doubt, try this one first!

Download gparted-live-0.28.1-1-i686.zip, 272 MB, with:

[root@server /usr/home/user]# wget https://sourceforge.net/projects/gparted/files/gparted-live-stable/0.28.1-1/gparted-live-0.28.1-1-i686.zip [enter]

Extract zip file ~/gparted-live-0.28.1-1-i686.zip into directory /tftpboot/f01/gparted/i686/ with:

[root@server /usr/home/user]# unzip gparted-live-0.28.1-1-i686.zip live/* -d /tftpboot/f01/gparted/i686 [enter]
Archive:  gparted-live-0.28.1-1-i686.zip
 extracting: /tftpboot/f01/gparted/i686/live/memtest  
 extracting: /tftpboot/f01/gparted/i686/live/GParted-Live-Version  
 extracting: /tftpboot/f01/gparted/i686/live/initrd.img  
 extracting: /tftpboot/f01/gparted/i686/live/filesystem.packages-remove  
 extracting: /tftpboot/f01/gparted/i686/live/filesystem.packages  
 extracting: /tftpboot/f01/gparted/i686/live/vmlinuz  
 extracting: /tftpboot/f01/gparted/i686/live/filesystem.squashfs
[root@server /usr/home/user]#

Delete downloaded zip files with:

[root@server /usr/home/user]# rm gparted-live-0.28.1-1-i686.zip [enter]
[root@server /usr/home/user]#

The TFTP root directory permission plays an important role. Make sure that the permission and ownership are set correctly with:

[root@server /usr/home/user]# chown -R tftpd:nobody /tftpboot/f01/gparted [enter]
[root@server /usr/home/user]# chmod -R 755 /tftpboot/f01/gparted/i686/live [enter]
[root@server /usr/home/user]#

Edit file /tftpboot/f01.cfg with:

[root@server /usr/home/user]# ee /tftpboot/f01.cfg [enter]

…and add the following lines:

LABEL f3
MENU LABEL ^3)  GParted Live v. 0.28.1-1-i686
MENU PASSWD
TEXT HELP
GParted is used for creating, reorganizing and deleting disk partitions.
The i686 version runs on x86 and x86-64 based computers, limited to physical
address space of 4 gigabytes, and uses one processor only.
-- If in doubt, try this one first! --
ENDTEXT
KERNEL f01/gparted/i686/live/vmlinuz
APPEND initrd=f01/gparted/i686/live/initrd.img boot=live union=overlay username=tftpd config components quiet noswap edd=on nomodeset nodmraid noeject locales="en_US.UTF-8" keyboard-layouts="se" ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no vga=788 ip= net.ifnames=0 nosplash i915.blacklist=yes radeonhd.blacklist=yes nouveau.blacklist=yes vmwgfx.enable_fbdev=1 netboot=nfs nfsroot=$nfsserverIP:/tftpboot/f01/gparted/i686/

N.B.: Replace $nfsserverIP with the IP address of your NFS server!

NFS Export Update

Edit file /etc/exports with:

[root@server /usr/home/user]# ee /etc/exports [enter]

…and add the following text:

V4: /
/tftpboot/f01/gparted/amd64 \
/tftpboot/f01/gparted/i686-pae \
/tftpboot/f01/gparted/i686 \
-maproot=root -network 192.168.1.0 -mask 255.255.255.0

Reload the NFS mount setup with:

[root@server /usr/home/user]# service mountd reload [enter]
[root@server /usr/home/user]#

Display the NFS mount setup with:

[root@server /usr/home/user]# showmount -e [enter]
Exports list on localhost:
/tftpboot/f01/gparted/i686-pae     192.168.1.0 
/tftpboot/f01/gparted/i686         192.168.1.0 
/tftpboot/f01/gparted/amd64        192.168.1.0
[root@server /usr/home/user]#

Clonezilla Live

You’re probably familiar with the popular proprietary commercial package Norton Ghost®. The problem with this kind of software packages is that it takes a lot of time to massively clone systems to many computers. You’ve probably also heard of Symantec’s solution to this problem, Symantec Ghost Corporate Edition® with multicasting. Well, now there is an OpenSource clone system (OCS) solution called Clonezilla with unicasting and multicasting!

Clonezilla, based on DRBL, Partclone and udpcast, allows you to do bare metal backup and recovery. Two types of Clonezilla are available, Clonezilla live and Clonezilla SE (server edition). Clonezilla live is suitable for single machine backup and restore. While Clonezilla SE is for massive deployment, it can clone many (40 plus!) computers simultaneously. Clonezilla saves and restores only used blocks in the harddisk. This increases the cloning efficiency. At the NCHC’s Classroom C, Clonezilla SE was used to clone 41 computers simultaneously. It took only about 10 minutes to clone a 5.6 GBytes system image to all 41 computers via multicasting!

WWW: http://clonezilla.org/.

Files: https://sourceforge.net/projects/clonezilla/files/.

amd64

Download Clonezilla Live Stable amd64, 187 MB, optimized for use on PCs with amd64 CPU computers with:

[root@server /usr/home/user]# wget https://sourceforge.net/projects/clonezilla/files/clonezilla_live_stable/2.5.0-25/clonezilla-live-2.5.0-25-amd64.zip [enter]

Create direcory /tftpboot/f01/clonezilla/amd64 with:

[root@server /usr/home/user]# mkdir -p /tftpboot/f01/clonezilla/amd64 [enter]
[root@server /usr/home/user]#

Extract zip file clonezilla-live-2.5.0-25-amd64.zip to /tftpboot/f01/clonezilla/amd64 with:

[root@srvgw ~]# unzip clonezilla-live-2.5.0-25-amd64.zip live/* -d /tftpboot/f01/clonezilla/amd64 [enter]
Archive:  /clonezilla-live-2.5.0-25-amd64.zip
 extracting: /tftpboot/f01/clonezilla/amd64/live/ipxe.efi  
 extracting: /tftpboot/f01/clonezilla/amd64/live/filesystem.packages-remove  
 extracting: /tftpboot/f01/clonezilla/amd64/live/vmlinuz  
 extracting: /tftpboot/f01/clonezilla/amd64/live/ipxe.lkn  
 extracting: /tftpboot/f01/clonezilla/amd64/live/initrd.img  
 extracting: /tftpboot/f01/clonezilla/amd64/live/freedos.img  
 extracting: /tftpboot/f01/clonezilla/amd64/live/filesystem.packages  
 extracting: /tftpboot/f01/clonezilla/amd64/live/memtest  
 extracting: /tftpboot/f01/clonezilla/amd64/live/Clonezilla-Live-Version  
 extracting: /tftpboot/f01/clonezilla/amd64/live/filesystem.squashfs
[root@server /usr/home/user]#

Delete downloaded .zip file with;

[root@server /usr/home/user]# rm clonezilla-live-2.5.0-25-amd64.zip [enter]
[root@server /usr/home/user]#

The TFTP root directory permission plays an important role. Make sure that the permission and ownership are set correctly with:

[root@server /usr/home/user]# chown -R tftpd:nobody /tftpboot/f01/clonezilla/amd64/live [enter]
[root@server /usr/home/user]# chmod -R 755 /tftpboot/f01/clonezilla/amd64/live [enter]
[root@server /usr/home/user]#

PXE Boot Sub-Menu

Edit file /tftpboot/f01.cfg with:

[root@server /usr/home/user]# ee /tftpboot/f01.cfg

..and add the following text, example:

LABEL f4
MENU LABEL ^4)  CloneZilla v. 2.5.0-25 amd64
MENU PASSWD
TEXT HELP
Cloning of PC hard disks for backup or deploy a common setup on a number
of PCs using a Server.
The amd64 version runs on x86-64 based computers, with ability to access more
than 4 gigabytes of memory and supports use of multiple processor cores.
ENDTEXT
KERNEL f01/clonezilla/amd64/live/vmlinuz
APPEND initrd=f01/clonezilla/amd64/live/initrd.img boot=live toram union=overlay username=tftpd config components quiet noswap edd=on nomodeset nodmraid noeject locales="en_US.UTF-8" keyboard-layouts="se" ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no vga=791 ip= net.ifnames=0 nosplash i915.blacklist=yes radeonhd.blacklist=yes nouveau.blacklist=yes vmwgfx.enable_fbdev=1 netboot=nfs nfsroot=$nfsserverIP:/tftpboot/f01/clonezilla/amd64/

N.B.: Replace $nfsserverIP with the IP address of your NFS server!

NFS Export Update

Edit file /etc/exports with:

[root@server /usr/home/user]# ee /etc/exports [enter]

…and add the following text:

V4: /
...
/tftpboot/f01/clonezilla/amd64 \
-maproot=root -network 192.168.1.0 -mask 255.255.255.0

Reload the NFS mount setup with:

[root@server /usr/home/user]# service mountd reload [enter]
[root@server /usr/home/user]#

Display the NFS mount setup with:

[root@server /usr/home/user]# showmount -e [enter]
Exports list on localhost:
...
/tftpboot/f01/clonezilla/amd64     192.168.1.0
[root@server /usr/home/user]#

i686-PAE (Physical Address Extension)

Download Clonezilla Live Stable i686-pae, 188 MB, optimized for use on PCs with i686 CPU computers with:

[root@server /usr/home/user]# wget https://sourceforge.net/projects/clonezilla/files/clonezilla_live_stable/2.5.0-25/clonezilla-live-2.5.0-25-i686-pae.zip [enter]

Create directory /tftpboot/f01/clonezilla/i686-pae with:

[root@server /usr/home/user]# mkdir -p /tftpboot/f01/clonezilla/i686-pae [enter]
[root@server /usr/home/user]#

Extract zip file clonezilla-live-2.5.0-25-i686-pae.zip to /tftpboot/f01/clonezilla/i686-pae with:

[root@srvgw ~]# unzip clonezilla-live-2.5.0-25-i686-pae.zip live/* -d /tftpboot/f01/clonezilla/i686-pae [enter]
Archive:  /clonezilla-live-2.5.0-25-i686-pae.zip
 extracting: /tftpboot/f01/clonezilla/i686-pae/live/ipxe.efi  
 extracting: /tftpboot/f01/clonezilla/i686-pae/live/filesystem.packages-remov  |
 extracting: /tftpboot/f01/clonezilla/i686-pae/live/vmlinuz  
 extracting: /tftpboot/f01/clonezilla/i686-pae/live/ipxe.lkn  
 extracting: /tftpboot/f01/clonezilla/i686-pae/live/initrd.img  
 extracting: /tftpboot/f01/clonezilla/i686-pae/live/freedos.img  
 extracting: /tftpboot/f01/clonezilla/i686-pae/live/filesystem.packages  
 extracting: /tftpboot/f01/clonezilla/i686-pae/live/memtest  
 extracting: /tftpboot/f01/clonezilla/i686-pae/live/Clonezilla-Live-Version  
 extracting: /tftpboot/f01/clonezilla/i686-pae/live/filesystem.squashfs
[root@server /usr/home/user]#

Delete downloaded .zip file with;

[root@server /usr/home/user]# rm clonezilla-live-2.5.0-25-i686-pae.zip [enter]
[root@server /usr/home/user]#

The TFTP root directory permission plays an important role. Make sure that the permission and ownership are set correctly with:

[root@server /usr/home/user]# chown -R tftpd:nobody /tftpboot/f01/clonezillai686-pae/live [enter]
[root@server /usr/home/user]# chmod -R 755 /tftpboot/f01/clonezilla/i686-pae/live [enter]
[root@server /usr/home/user]#

PXE Boot Sub-Menu

Edit file /tftpboot/f01.cfg with:

[root@server /usr/home/user]# ee /tftpboot/f01.cfg [enter]

..and add the following text, example:

LABEL f5
MENU LABEL ^5)  CloneZilla v. 2.5.0-25 i686-pae (Physical Address Extension)
MENU PASSWD
TEXT HELP
Cloning of PC hard disks for backup or deploy a common setup on a number
of PCs using a Server.
The i686-pae version runs on x86 (i686 and higher) and x86-64 based computers, with
Physical Address Extension to access more than 4 gigabytes of memory, and supports
use of multiple processor cores.
ENDTEXT
KERNEL f01/clonezilla/i686-pae/live/vmlinuz
APPEND initrd=f01/clonezilla/i686-pae/live/initrd.img boot=live union=overlay username=tftpd config components quiet noswap edd=on nomodeset nodmraid noeject locales="en_US.UTF-8" keyboard-layouts="se" ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no vga=791 ip= net.ifnames=0 nosplash i915.blacklist=yes radeonhd.blacklist=yes nouveau.blacklist=yes vmwgfx.enable_fbdev=1 netboot=nfs nfsroot=$nfsserverIP:/tftpboot/f01/clonezilla/i686-pae/

N.B.: Replace $nfsserverIP with the IP address of your NFS server!

NFS Export Update

Edit file /etc/exports with:

[root@server /usr/home/user]# ee /etc/exports [enter]

…and add the following text:

V4: /
...
/tftpboot/f01/clonezilla/amd64 \
/tftpboot/f01/clonezilla/i686-pae \
-maproot=root -network 192.168.1.0 -mask 255.255.255.0

Reload the NFS mount setup with:

[root@server /usr/home/user]# service mountd reload [enter]
[root@server /usr/home/user]#

Display the NFS mount setup with:

[root@server /usr/home/user]# showmount -e [enter]
Exports list on localhost:
...
/tftpboot/f01/clonezilla/i686-pae  192.168.1.0
/tftpboot/f01/clonezilla/amd64     192.168.1.0
[root@server /usr/home/user]#

i686

Download Clonezilla Live Stable i686, 188 MB, optimized for use on PCs with i686 CPU computers with:

[root@server /usr/home/user]# wget https://sourceforge.net/projects/clonezilla/files/clonezilla_live_stable/2.5.0-25/clonezilla-live-2.5.0-25-i686.zip [enter]

Create directory /tftpboot/f01/clonezilla/i686 with:

[root@server /usr/home/user]# mkdir -p /tftpboot/f01/clonezilla/i686 [enter]
[root@server /usr/home/user]#

Extract zip file clonezilla-live-2.5.0-25-i686.zip to /tftpboot/f01/clonezilla/i686 with:

[root@srvgw ~]# unzip clonezilla-live-2.5.0-25-i686.zip live/* -d /tftpboot/f01/clonezilla/i686 [enter]
Archive:  /clonezilla-live-2.5.0-25-i686.zip
 extracting: /tftpboot/f01/clonezilla/i686/live/ipxe.efi  
 extracting: /tftpboot/f01/clonezilla/i686/live/filesystem.packages-remove  
 extracting: /tftpboot/f01/clonezilla/i686/live/vmlinuz  
 extracting: /tftpboot/f01/clonezilla/i686/live/ipxe.lkn  
 extracting: /tftpboot/f01/clonezilla/i686/live/initrd.img  
 extracting: /tftpboot/f01/clonezilla/i686/live/freedos.img  
 extracting: /tftpboot/f01/clonezilla/i686/live/filesystem.packages  
 extracting: /tftpboot/f01/clonezilla/i686/live/memtest  
 extracting: /tftpboot/f01/clonezilla/i686/live/Clonezilla-Live-Version  
 extracting: /tftpboot/f01/clonezilla/i686/live/filesystem.squashfs
[root@server /usr/home/user]#

Delete downloaded .zip file with;

[root@server /usr/home/user]# rm clonezilla-live-2.5.0-25-i686.zip [enter]
[root@server /usr/home/user]#

The TFTP root directory permission plays an important role. Make sure that the permission and ownership are set correctly with:

[root@server /usr/home/user]# chown -R tftpd:nobody /tftpboot/f01/clonezilla/i686/live [enter]
[root@server /usr/home/user]# chmod -R 755 /tftpboot/f01/clonezilla/i686/live [enter]
[root@server /usr/home/user]#

PXE Boot Sub-Menu

Edit file /tftpboot/f01.cfg with:

[root@server /usr/home/user]# ee /tftpboot/f01.cfg [enter]

..and add the following text, example:

LABEL f6
MENU LABEL ^6)  CloneZilla v. 2.5.0-25 i686
MENU PASSWD
TEXT HELP
Cloning of PC hard disks for backup or deploy a common setup on a number
of PCs using a Server.
The i686 version runs on x86 and x86-64 based computers, limited to physical
address space of 4 gigabytes, and uses one processor only.
-- If in doubt, try this one first! --
ENDTEXT
KERNEL f01/clonezilla/i686/live/vmlinuz
APPEND initrd=f01/clonezilla/i686/live/initrd.img boot=live union=overlay username=tftpd config components quiet noswap edd=on nomodeset nodmraid noeject locales="en_US.UTF-8" keyboard-layouts="se" ocs_live_run="ocs-live-general" ocs_live_extra_param="" ocs_live_batch=no vga=791 ip= net.ifnames=0 nosplash i915.blacklist=yes radeonhd.blacklist=yes nouveau.blacklist=yes vmwgfx.enable_fbdev=1 netboot=nfs nfsroot=$nfsserverIP:/tftpboot/f01/clonezilla/i686/

N.B.: Replace $nfsserverIP with the IP address of your NFS server!

NFS Export Update

Edit file /etc/exports with:

[root@server /usr/home/user]# ee /etc/exports [enter]

…and add the following text:

V4: /
...
/tftpboot/f01/clonezilla/amd64 \
/tftpboot/f01/clonezilla/i686-pae \
/tftpboot/f01/clonezilla/i686 \
-maproot=root -network 192.168.1.0 -mask 255.255.255.0

Reload the NFS mount setup with:

[root@server /usr/home/user]# service mountd reload [enter]
[root@server /usr/home/user]#

Display the NFS mount setup with:

[root@server /usr/home/user]# showmount -e [enter]
Exports list on localhost:
...
/tftpboot/f01/clonezilla/i686-pae  192.168.1.0
/tftpboot/f01/clonezilla/i686      192.168.1.0
/tftpboot/f01/clonezilla/amd64     192.168.1.0
[root@server /usr/home/user]#

G4L

G4L is a hard disk and partition imaging and cloning tool. The created images are optionally compressed and transferred to an FTP server or cloned locally. CIFS(Windows), SSHFS and NFS support included, and udpcast and fsarchiver options.

WWW: https://sourceforge.net/projects/g4l/.

Download

Download ISO CD-ROM Image g4l-v0.52.iso, 99 MB, with:

[root@server /usr/home/user]# wget https://sourceforge.net/projects/g4l/files/g4l%20ISO%20images/g4l-v0.52.iso -P /tftpboot/f01/ [enter]

Change file mode with:

[root@server /usr/home/user]# chmod 755 /tftpboot/f01/g4l-v0.52.iso [enter]
[root@server /usr/home/user]#

PXE Boot Sub-Menu

The PXE Boot Sub-Menu for PXE Boot for G4L is defined in file /tftpboot/f01.cfg.

Edit this file with:

[root@server /usr/home/user]# ee /tftpboot/f01.cfg [enter]

..and add the following text, example:

LABEL f7
MENU LABEL ^7)  G4L v. 0.52
TEXT HELP
G4L is a hard disk and partition imaging and cloning tool.
The created images are optionally compressed and transferred
to an FTP server or cloned locally.
ENDTEXT
KERNEL memdisk
APPEND initrd=f01/g4l-v0.52.iso iso raw

G4U (“ghosting for unix”)

G4U is a hard disk and partition imaging and cloning tool. The created images are optionally compressed and transferred to an FTP server or cloned locally. CIFS(Windows), SSHFS and NFS support included, and udpcast and fsarchiver options.

WWW: http://fehu.org/~feyrer/g4u/.

Download

Download ISO CD-ROM Image g4u-2.5.iso, 4.9 MB, with:

[root@server /usr/home/user]# wget http://fehu.org/~feyrer/g4u/g4u-2.5.iso -P /tftpboot/f01/ [enter]
[root@server /usr/home/user]# chmod 755 /tftpboot/f01/g4u-2.5.iso [enter]
[root@server /usr/home/user]#

PXE Boot Sub-Menu

The PXE Boot Sub-Menu for PXE Boot for G4U is defined in file /tftpboot/f01.cfg.

Edit this file with:

[root@server /usr/home/user]# ee /tftpboot/f01.cfg [enter]

..and add the following text, example:

LABEL f8
MENU LABEL ^8)  G4U v. 2.5
TEXT HELP
G4U is a NetBSD-based bootfloppy/CD-ROM that allows easy cloning of
PC harddisks to deploy a common setup on a number of PCs using FTP. 
ENDTEXT
KERNEL memdisk
APPEND initrd=f01/g4u-2.5.iso iso raw

SystemRescueCd 32bit and 64bit kernel

SystemRescueCd is a Linux system rescue disk available as a bootable CD-ROM or USB stick for administrating or repairing your system and data after a crash. It aims to provide an easy way to carry out admin tasks on your computer, such as creating and editing the hard disk partitions. It comes with a lot of Linux software such as system tools (parted, partimage, fstools, …) and basic tools (editors, midnight commander, network tools). It requires no installation. It can be used on Linux servers, Linux desktops or windows boxes. The kernel supports the important file systems (ext2/ext3/ext4, reiserfs, reiser4, btrfs, xfs, jfs, vfat, ntfs, iso9660), as well as network filesystems (samba and nfs).

WWW: http://www.sysresccd.org/.

Files: https://sourceforge.net/projects/systemrescuecd/files/.

Download and Install

Download systemrescuecd-x86-4.9.3.iso, 492 MB, with:

[root@server /usr/home/user]# wget https://sourceforge.net/projects/systemrescuecd/files/sysresccd-x86/4.9.3/systemrescuecd-x86-4.9.3.iso [enter]

Create a memory disk out of the cd9660 image file systemrescuecd-x86-4.9.3.iso, using the first available md(4) device, with:

[root@server /usr/home/user]# mdconfig -a -t vnode -f systemrescuecd-x86-4.9.0.iso [enter]
md0
[root@server /usr/home/user]#

…and then mount it with:

[root@server /usr/home/user]# mount -t cd9660 /dev/md0 /mnt [enter]
[root@server /usr/home/user]#

Create a new directory for the content of the iso image, using this command:

[root@server /usr/home/user]# mkdir -p /tftpboot/f01/rescuecd [enter]
[root@server /usr/home/user]#

Copy the content of the iso file to the new directories, using this commands:

[root@server /usr/home/user]# rsync -e ssh -avz --delete /mnt/ /tftpboot/f01/rescuecd/ [enter]
sending incremental file list
./
readme.txt
...
usb_inst/xorriso

sent 504,580,569 bytes  received 6,810 bytes  32,554,024.45 bytes/sec
total size is 514,891,736  speedup is 1.02
[root@server /usr/home/user]#

Unmount the iso image, using this command:

[root@server /usr/home/user]# umount /mnt [enter]
[root@server /usr/home/user]#

List configured and enabled memory disks on your system, using this command:

[root@server /usr/home/user]# mdconfig -lv [enter]
md0	vnode	  492M	/usr/home/user/systemrescuecd-x86-4.9.3.iso
[root@server /usr/home/user]#

Delete memory disk – in this example md0– with this command:

[root@server /usr/home/user]# mdconfig -d -u 0 [enter]
[root@server /usr/home/user]#

Delete the SystemRescueCd iso image with:

[root@server /usr/home/user]# rm systemrescuecd-x86-4.9.3.iso [enter]
[root@server /usr/home/user]#

Edit file ‘/tftpboot/f01.cfg’ and add the following lines:

[root@server /usr/home/user]# ee /tftpboot/f01.cfg [enter]
LABEL f9
MENU LABEL ^9)  SystemRescueCd 64bit kernel v. 4.9.3
MENU PASSWD
TEXT HELP
SystemRescueCd is a Linux system rescue disk available for administrating or
repairing your system and data after a crash.
ENDTEXT
KERNEL f01/rescuecd/isolinux/rescue64
APPEND setkmap=se initrd=f01/rescuecd/isolinux/initram.igz dodhcp dostartx netboot=nfs://$nfsserverIP:/tftpboot/f01/rescuecd
LABEL f0
MENU LABEL ^0)  SystemRescueCd 32bit kernel v. 4.9.3
MENU PASSWD
TEXT HELP
SystemRescueCd is a Linux system rescue disk available for administrating or
repairing your system and data after a crash.
ENDTEXT
KERNEL f01/rescuecd/isolinux/rescue32
APPEND setkmap=se initrd=f01/rescuecd/isolinux/initram.igz dodhcp dostartx netboot=nfs://$nfsserverIP:/tftpboot/f01/rescuecd
LABEL f9
MENU LABEL ^9)  Hardware Detection Tool v. 0.5.0
MENU PASSWD
TEXT HELP
Reports S.M.A.R.T. data, firmware errorlog, runs firmware tests, scans surface
reporting access times per sector and much more.
ENDTEXT
KERNEL memdisk
APPEND initrd=f01/rescuecd/bootdisk/hdt.img

N.B.: Replace $nfsserverIP with the IP address of your NFS server!

NFS Export Update

Edit file /etc/exports with:

[root@server /usr/home/user]# ee /etc/exports [enter]

…and add the following text:

V4: /
...
/tftpboot/f01/rescuecd \
-maproot=root -network 192.168.1.0 -mask 255.255.255.0

Reload the NFS mount setup with:

[root@server /usr/home/user]# service mountd reload [enter]
[root@server /usr/home/user]#

Display the NFS mount setup with:

[root@server /usr/home/user]# showmount -e [enter]
Exports list on localhost:
...
/tftpboot/f01/rescuecd             192.168.1.0
[root@server /usr/home/user]#
PXE Boot Menu with Sub-menus

PXE Boot Menu with Sub-menus

Description

A simple GUI menu system with sub-menus is used for selecting between different tasks.

WWW: http://syslinux.zytor.com/wiki/index.php/Menu.

Files: https://www.kernel.org/pub/linux/utils/boot/syslinux/.

Syslinux 5 Changelog:http://www.syslinux.org/wiki/index.php/Syslinux_6_Changelog#Changes_in_6.03/Menu.

Requirements

The following application(s) must be installed, configured and running before tftp-hpa is installed:

Preparation for Installation

Start PuTTY on a Windows PC, Terminal on a Mac or similar terminal application on a Linux PC.

In this example Terminal on a Mac is used.

Open a remote SSH session to the server with:

Mac:~ user$ ssh user@192.168.1.4 [enter]
N.B.: Replace user@192.168.1.4 with User ID and IP Address on Your server!
[user@server ~]$

Enable superuser privileges with:

[user@server ~]$ sudo -s [enter]
Password: <-- passwd [enter]
[root@server /usr/home/user]#

N.B.: Enter user password, not the root password!

Download

Download file syslinux-6.03.tar.xz, about 6.5M, with;;

[root@server /usr/home/user]# wget https://www.kernel.org/pub/linux/utils/boot/syslinux/syslinux-6.03.tar.xz --no-check-certificate [enter]
--2017-03-02 17:46:01--  https://www.kernel.org/pub/linux/utils/boot/syslinux/syslinux-6.03.tar.xz
Resolving www.kernel.org (www.kernel.org)... 199.204.44.194, 149.20.4.69, 198.145.20.140, ...
Connecting to www.kernel.org (www.kernel.org)|199.204.44.194|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 6855224 (6,5M) [application/x-xz]
Saving to: ‘syslinux-6.03.tar.xz’

syslinux-6.03.tar.xz                         100%[============================================================================================>]   6,54M   765KB/s    in 9,8s    

2017-03-02 17:46:12 (683 KB/s) - ‘syslinux-6.03.tar.xz’ saved [6855224/6855224]
[root@server /usr/home/user]#

Wait for download to be completed and than extract ~/syslinux-6.03.tar.xz with:

[root@server /usr/home/user]# tar -xf syslinux-6.03.tar.xz [enter]
[root@server /usr/home/user]#

Installation

For the lwIP embedded TCP/IP network stack copy file syslinux-6.03/bios/core/pxelinux.0 to /tftpboot/ with:

[root@server /usr/home/user]# cp syslinux-6.03/bios/core/pxelinux.0 /tftpboot/ [enter]
[root@server /usr/home/user]#

For the new lwIP embedded TCP/IP network stack copy file ~/syslinux-6.03/bios/core/lpxelinux.0 to /tftpboot/ with:

[root@server /usr/home/user]# cp syslinux-6.03/bios/core/lpxelinux.0 /tftpboot/ [enter]
[root@server /usr/home/user]#

For the legacy TCP/IP network stack copy file syslinux-6.03/bios/gpxe/gpxelinux.0 to /tftpboot/ with:

[root@server /usr/home/user]# cp syslinux-6.03/bios/gpxe/gpxelinux.0 /tftpboot/ [enter]
[root@server /usr/home/user]#

Copy file ~/syslinux-6.03/bios/com32/lib/libcom32.c32 to /tftpboot/ with:

[root@server /usr/home/user]# cp syslinux-6.03/bios/com32/lib/libcom32.c32 /tftpboot/ [enter]
[root@server /usr/home/user]#

Copy file ~/syslinux-6.03/bios/com32/libutil/libutil.c32 to /tftpboot/ with:

[root@server /usr/home/user]# cp syslinux-6.03/bios/com32/libutil/libutil.c32 /tftpboot/ [enter]
[root@server /usr/home/user]#

Copy file ~/syslinux-6.03/bios/com32/menu/menu.c32 to /tftpboot/ with:

[root@server /usr/home/user]# cp syslinux-6.03/bios/com32/menu/menu.c32 /tftpboot/ [enter]
[root@server /usr/home/user]#

Copy file ~/syslinux-6.03/bios/com32/menu/vesamenu.c32 to /tftpboot/ with:

[root@server /usr/home/user]# cp syslinux-6.03/bios/com32/menu/vesamenu.c32 /tftpboot/ [enter]
[root@server /usr/home/user]#

Copy file ~/syslinux-6.03/bios/com32/modules/linux.c32 to /tftpboot/ with:

[root@server /usr/home/user]# cp syslinux-6.03/bios/com32/modules/linux.c32 /tftpboot/ [enter]
[root@server /usr/home/user]#

Copy file ~/syslinux-6.03/bios/com32/elflink/ldlinux/ldlinux.c32 to /tftpboot/ with:

[root@server /usr/home/user]# cp syslinux-6.03/bios/com32/elflink/ldlinux/ldlinux.c32 /tftpboot/ [enter]
[root@server /usr/home/user]#

Copy file ~/syslinux-6.03/bios/com32/modules/reboot.c32 to /tftpboot/ with:

[root@server /usr/home/user]# cp syslinux-6.03/bios/com32/modules/reboot.c32 /tftpboot/ [enter]
[root@server /usr/home/user]#

Copy file ~/syslinux-6.03/bios/com32/chain/chain.c32 to /tftpboot/ with:

[root@server /usr/home/user]# cp syslinux-6.03/bios/com32/chain/chain.c32 /tftpboot/ [enter]
[root@server /usr/home/user]#

Copy file ~/syslinux-6.03/sample/syslinux_splash.jpg to /tftpboot/ with:

[root@server /usr/home/user]# cp syslinux-6.03/sample/syslinux_splash.jpg /tftpboot/ [enter]
[root@server /usr/home/user]#

Copy file ~/syslinux-6.03/bios/memdisk/memdisk to /tftpboot/ with:

[root@server /usr/home/user]# cp syslinux-6.03/bios/memdisk/memdisk /tftpboot/ [enter]
[root@server /usr/home/user]#

Display files in directory /tftpboot with:

[root@server /usr/home/user]# ls -l /tftpboot/ [enter]
total 1343
-rwxr-xr-x  1 root  wheel   24560 Mar  2 18:48 chain.c32
-rw-r--r--  1 root  wheel  111334 Mar  2 18:44 gpxelinux.0
drwxr-xr-x  2 root  wheel       2 Mar  2 11:37 images
-rwxr-xr-x  1 root  wheel  122308 Mar  2 18:48 ldlinux.c32
-rwxr-xr-x  1 root  wheel  186500 Mar  2 18:44 libcom32.c32
-rwxr-xr-x  1 root  wheel   24148 Mar  2 18:44 libutil.c32
-rwxr-xr-x  1 root  wheel    4660 Mar  2 18:44 linux.c32
-rw-r--r--  1 root  wheel   91550 Mar  2 18:43 lpxelinux.0
-rw-r--r--  1 root  wheel   26140 Mar  2 18:49 memdisk
-rwxr-xr-x  1 root  wheel   26596 Mar  2 18:44 menu.c32
-rw-r--r--  1 root  wheel   46909 Mar  2 18:41 pxelinux.0
drwxr-xr-x  2 root  wheel       2 Mar  2 11:37 pxelinux.cfg
-rwxr-xr-x  1 root  wheel    1376 Mar  2 18:48 reboot.c32
-rw-r--r--  1 root  wheel   56299 Mar  2 18:49 syslinux_splash.jpg
-rwxr-xr-x  1 root  wheel   27104 Mar  2 18:44 vesamenu.c32
[root@server /usr/home/user]#

Delete the extracted folder and the downloaded .xz file with;

[root@server /usr/home/user]# rm -R syslinux-6.03; rm syslinux-6.03.tar.xz [enter]
[root@server /usr/home/user]#

Configuration

Critical Tasks Password

openssl passwd command can be used to compute the MD5-based hash of password used in the PXE Boot Menus.

[root@server /usr/home/user]# openssl passwd -1 passwd
$1$./xB0ZYM$EaUHney4jC51AtxBjdln2/
[root@server /usr/home/user]#

PXE Boot Main Menu

The PXE Boot Main Menu is defined in file /tftpboot/pxelinux.cfg/default.

Create this file with:

[root@server /usr/home/user]# ee /tftpboot/pxelinux.cfg/default

…and add the following text:

DEFAULT vesamenu.c32
PROMT 0
NOESCAPE 1
TIMEOUT 300
TOTALTIMEOUT 450

MENU WIDTH 78
MENU MARGIN 1
MENU ROWS 20
MENU TIMEOUTROW 25
MENU HELPMSGROW 26

MENU BACKGROUND syslinux_splash.jpg

MENU MASTER PASSWD $1$./xB0ZYM$EaUHney4jC51AtxBjdln2/
MENU PASSPROMT Enter Password

MENU TITLE PXE Boot Main Menu - server.example.net

MENU COLOR BORDER 0 #ffffffff #ee000000 std
MENU COLOR TITLE 0 #ffffffff #ee000000 std
MENU COLOR SEL 0 #ff00ff00 #ff000000 std
MENU COLOR UNSEL 0 #ffffffff #ee000000 std
MENU COLOR PWDHEADER 0 #ff000000 #99ffffff rev
MENU COLOR PWDBORDER 0 #ff000000 #99ffffff rev
MENU COLOR PWDENTRY 0 #ff000000 #99ffffff rev
MENU COLOR HOTKEY 0 #ff00ff00 #ee000000 std
MENU COLOR HOTSEL 0 #ffffffff #85000000 std

LABEL blank
MENU LABEL

LABEL hd
MENU LABEL ^H)  Boot to Local Hard Disk
LOCALBOOT 0x80

LABEL floppy
MENU LABEL ^F)  Boot to Local Floppy Disk
LOCALBOOT 0x00

LABEL cr
MENU LABEL ^R)  Coold Reboot
COM32 reboot.c32

LABEL wr
MENU LABEL ^W)  Warm Reboot
COM32 reboot.c32
APPEND -w

LABEL next
MENU LABEL ^N)  Skip PXE Boot (Boot Next Device)
MENU DEFAULT
LOCALBOOT -1

N.B.: Remember to change MENU MASTER PASSWD and MENU TITLE PXE!

PXE Boot Sub-Menus – Top Part

PXE Boot Sub-Menus top part is defined in file tftpboot/top.cfg:

Create this file with:

[root@server /usr/home/user]# ee /tftpboot/top.cfg

…and add the following text:

DEFAULT vesamenu.c32
PROMT 0
NOESCAPE 1
TIMEOUT 300
TOTALTIMEOUT 450

MENU WIDTH 78
MENU MARGIN 1
MENU ROWS 20
MENU TIMEOUTROW 25
MENU HELPMSGROW 26

MENU BACKGROUND syslinux_splash.jpg

MENU MASTER PASSWD $1$./xB0ZYM$EaUHney4jC51AtxBjdln2/
MENU PASSPROMT Enter Password

MENU COLOR BORDER 0 #ffffffff #ee000000 std
MENU COLOR TITLE 0 #ffffffff #ee000000 std
MENU COLOR SEL 0 #ff00ff00 #ff000000 std
MENU COLOR UNSEL 0 #ffffffff #ee000000 std
MENU COLOR PWDHEADER 0 #ff000000 #99ffffff rev
MENU COLOR PWDBORDER 0 #ff000000 #99ffffff rev
MENU COLOR PWDENTRY 0 #ff000000 #99ffffff rev
MENU COLOR HOTKEY 0 #ff00ff00 #ee000000 std
MENU COLOR HOTSEL 0 #ffffffff #85000000 std

N.B.: Remember to change MENU MASTER PASSWD!

PXE Boot Sub-Menus – Bottom Part

PXE Boot Sub-Menus bottom part is defined in file tftpboot/bottom.cfg:

Create this file with:

[root@server /usr/home/user]# ee /tftpboot/bottom.cfg

…and add the following text:

LABEL blank
MENU LABEL

LABEL hd
MENU LABEL ^H)  Boot to Local Hard Disk
localboot 0x80

LABEL floppy
MENU LABEL ^F)  Boot to Local Floppy Disk
localboot 0x00

LABEL cr
MENU LABEL ^R)  Coold Reboot
COM32 reboot.c32

LABEL wr
MENU LABEL ^W)  Warm Reboot
COM32 reboot.c32
APPEND -w

LABEL  return
MENU LABEL ^R)  Return to PXE Boot Main Menu
MENU DEFAULT
KERNEL vesamenu.c32
APPEND ~

Change file modes

Change file modes for all files in directory /tftpboot with:

[root@server ~]# chmod -R 755 /tftpboot [enter]
[root@server /usr/home/user]#

The sub-menus in this example will be named tftpboot/f01.cfg, tftpboot/f02.cfg,… and any files used in the sub-menus will be stored in directory named tftpboot/f01, tftpboot/f02, …

arp-scan ARP scanning and fingerprinting tool

arp-scan ARP scanning and fingerprinting tool

Description

arp-scan is a command-line tool that uses the ARP protocol to discover and fingerprint IP hosts on the local network. It is available for Linux and BSD under the GPL licence.

WWW: http://www.isc.org/products/DHCP/.

Preparation for Installation

Start PuTTY on a Windows PC, Terminal on a Mac or similar terminal application on a Linux PC.

In this example Terminal on a Mac is used.

Open a remote SSH session to the server with:

Mac:~ user$ ssh user@192.168.1.4 [enter]
N.B.: Replace user@192.168.1.4 with User ID and IP Address on Your server!
[user@server ~]$

Enable superuser privileges with:

[user@server ~]$ sudo -s [enter]
Password: <-- passwd [enter]
[root@server /usr/home/user]#

N.B.: Enter user password, not the root password!

Installation

Search for isc-dhcp in the remote package repositories with:

[root@server /usr/home/user]# pkg search arp-scan [enter]
arp-scan-1.9                   ARP scanning and fingerprinting tool
[root@server /usr/home/user]#

In this example arp-scan will be installed.

Install arp-scan with;

[root@server /usr/home/user]# pkg install arp-scan [enter]
Updating FreeBSD repository catalogue...
FreeBSD repository is up-to-date.
All repositories are up-to-date.
The following 1 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
	arp-scan: 1.9

Number of packages to be installed: 1

252 KiB to be downloaded.

Proceed with this action? [y/N]: y [enter]
Fetching arp-scan-1.9.txz: 100%  252 KiB 258.2kB/s    00:01    
Checking integrity... done (0 conflicting)
[1/1] Installing arp-scan-1.9...
[1/1] Extracting arp-scan-1.9: 100%
[root@server /usr/home/user]#

Configuration

No configuration needed!n

How to Use

Display up Network Interface Cards with:

[root@server /usr/home/user]# ifconfig -u [enter]
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	options=4219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC,VLAN_HWTSO>
	ether 84:2b:2b:bf:b4:bf
	inet 192.168.1.4 netmask 0xffffff00 broadcast 192.168.1.255 
	nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
	media: Ethernet autoselect (1000baseT <full-duplex>)
	status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
	options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
	inet6 ::1 prefixlen 128 
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3 
	inet 127.0.0.1 netmask 0xff000000 
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
	groups: lo 
pflog0: flags=141<UP,RUNNING,PROMISC> metric 0 mtu 33160
	groups: pflog
[root@server /usr/home/user]#

In this example Network Interface Card em0 was found.

Scan local network and list all devices found:

[root@server /usr/home/user]# arp-scan --interface=em0 --localnet [enter]
Interface: em0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.1.1	50:c7:bf:01:cc:0f	(Unknown)
192.168.1.7	00:1b:21:a4:4e:cc	Intel Corporate
192.168.1.9	a4:5d:36:5d:30:e9	Hewlett Packard
192.168.1.10	00:08:9b:f8:db:03	ICP Electronics Inc.
192.168.1.11	00:11:32:0f:42:ec	Synology Incorporated
192.168.1.20	00:23:df:fd:6f:18	Apple, Inc
192.168.1.22	1c:1b:0d:66:e3:f0	(Unknown)
192.168.1.113	9c:20:7b:9a:d1:53	Apple Inc
192.168.1.210	00:04:a3:91:58:d1	Microchip Technology, Inc.
192.168.1.211	00:1d:ec:0a:e2:8b	Marusys
192.168.1.114	68:5b:36:00:8a:bd	POWERTECH INDUSTRIAL CO., LTD.
192.168.1.115	68:5b:36:00:81:0a	POWERTECH INDUSTRIAL CO., LTD.
192.168.1.132	60:c5:47:54:81:07	Apple, Inc.
192.168.1.201	d4:9a:20:5a:e8:0e	Apple, Inc
192.168.1.209	c8:69:cd:6e:26:30	(Unknown)
192.168.1.206	d0:ae:ec:4e:2e:67	Alpha Networks Inc.
192.168.1.205	68:5b:36:00:88:5b	POWERTECH INDUSTRIAL CO., LTD.

556 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9: 256 hosts scanned in 2.201 seconds (116.31 hosts/sec). 17 responded
[root@server /usr/home/user]#
isc-dhcp – ISC Dynamic Host Configuration Protocol server

isc-dhcp – ISC Dynamic Host Configuration Protocol server

Description

ISC’s Dynamic Host Configuration Protocol Distribution provides a freely redistributable reference implementation of all aspects of DHCP, through a suite of DHCP tools

  • A DHCP server (this port)
  • A DHCP client
  • A DHCP relay agent

WWW: http://www.isc.org/products/DHCP/.

Preparation for Installation

Start PuTTY on a Windows PC, Terminal on a Mac or similar terminal application on a Linux PC.

In this example Terminal on a Mac is used.

Open a remote SSH session to the server with:

Mac:~ user$ ssh user@192.168.1.4 [enter]
N.B.: Replace user@192.168.1.4 with User ID and IP Address on Your server!
[user@server ~]$

Enable superuser privileges with:

[user@server ~]$ sudo -s [enter]
Password: <-- passwd [enter]
[root@server /usr/home/user]#

N.B.: Enter user password, not the root password!

Installation

Search for isc-dhcp in the remote package repositories with:

[root@server /usr/home/user]# pkg search isc-dhcp [enter]
isc-dhcp43-client-4.3.5        The ISC Dynamic Host Configuration Protocol client
isc-dhcp43-relay-4.3.5         The ISC Dynamic Host Configuration Protocol relay
isc-dhcp43-server-4.3.5        ISC Dynamic Host Configuration Protocol server
[root@server /usr/home/user]#

In this example, sc-dhcp43-server will be installed.

Install isc-dhcp43-server with;

[root@server /usr/home/user]# pkg install isc-dhcp43-server [enter]
Updating FreeBSD repository catalogue...
FreeBSD repository is up-to-date.
All repositories are up-to-date.
The following 1 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
	isc-dhcp43-server: 4.3.5

Number of packages to be installed: 1

The process will require 4 MiB more space.
989 KiB to be downloaded.

Proceed with this action? [y/N]: y [enter]
Fetching isc-dhcp43-server-4.3.5.txz: 100%  989 KiB   1.0MB/s    00:01    
Checking integrity... done (0 conflicting)
[1/1] Installing isc-dhcp43-server-4.3.5...
===> Creating groups.
Creating group 'dhcpd' with gid '136'.
===> Creating users
Creating user 'dhcpd' with uid '136'.
[1/1] Extracting isc-dhcp43-server-4.3.5: 100%
Message from isc-dhcp43-server-4.3.5:
****  To setup dhcpd, please edit /usr/local/etc/dhcpd.conf.

****  This port installs the dhcp daemon, but doesn't invoke dhcpd by default.
      If you want to invoke dhcpd at startup, add these lines to /etc/rc.conf:

	    dhcpd_enable="YES"				# dhcpd enabled?
	    dhcpd_flags="-q"				# command option(s)
	    dhcpd_conf="/usr/local/etc/dhcpd.conf"	# configuration file
	    dhcpd_ifaces=""				# ethernet interface(s)
	    dhcpd_withumask="022"			# file creation mask

****  If compiled with paranoia support (the default), the following rc.conf
      options are also supported:

	    dhcpd_chuser_enable="YES"		# runs w/o privileges?
	    dhcpd_withuser="dhcpd"		# user name to run as
	    dhcpd_withgroup="dhcpd"		# group name to run as
	    dhcpd_chroot_enable="YES"		# runs chrooted?
	    dhcpd_devfs_enable="YES"		# use devfs if available?
	    dhcpd_rootdir="/var/db/dhcpd"	# directory to run in
	    dhcpd_includedir="<some_dir>"	# directory with config-
						  files to include

****  WARNING: never edit the chrooted or jailed dhcpd.conf file but
      /usr/local/etc/dhcpd.conf instead which is always copied where
      needed upon startup.
[root@server /usr/home/user]#

Configuration

List installed services dhcp with:

[root@server /usr/home/user]# service -r | grep dhcp [enter]
/usr/local/etc/rc.d/isc-dhcpd
/usr/local/etc/rc.d/isc-dhcpd6
[root@server /usr/home/user]#

Find the rcvar for /etc/rc.conf:

[root@server /usr/home/user]# /usr/local/etc/rc.d/isc-dhcpd rcvar [enter]
# dhcpd
#
dhcpd_enable="NO"
#   (default: "")

[root@server /usr/home/user]#

To start isc-dhcp43-server on system boot, add information to /etc/rc.conf with this commands:

[root@server /usr/home/user]# echo '' >> /etc/rc.conf; echo '# ISC dhcpd' >> /etc/rc.conf; echo 'dhcpd_enable="YES"' >> /etc/rc.conf; echo 'dhcpd_ifaces="em0"' >> /etc/rc.conf [enter]
[root@server /usr/home/user]#

Replace the ’em0′ interface name with the interface (or interfaces, separated by whitespace) that your DHCP server should listen on for DHCP client requests.

Edit /usr/local/etc/dhcpd.conf with:

[root@server /usr/home/user]# ee /usr/local/etc/dhcpd.conf [enter]

N.B.: This is an example with support for client PXE Boot!

#
# dhcpd.conf
#

authoritative;

default-lease-time 3600;
max-lease-time 86400;

ddns-updates on;
ddns-domainname "example.net.";
ddns-rev-domainname "in-addr.arpa.";
ddns-update-style interim;

log-facility local7;

server-name "server.example.net";
server-identifier server.example.net;

allow client-updates;
allow unknown-clients;
do-forward-updates true;

include "/usr/local/etc/namedb/rndc.key";

# example.net
subnet 192.168.1.0 netmask 255.255.255.0 {
        range 192.168.1.200 192.168.1.249;
        option domain-name-servers 192.168.1.4;
        option subnet-mask 255.255.255.0;
        option routers 192.168.1.1;
        option broadcast-address 192.168.1.255;
        option ntp-servers 192.168.1.4;
        option domain-name "example.net.";
        default-lease-time 3600;
        max-lease-time 86400;
        next-server 192.168.1.4;
        option root-path "192.168.1.4:/tftpboot";
        filename "/gpxelinux.0";
        }

# Hosts Forward
zone example.net. {
        primary 127.0.0.1;
        key rndc-key;
        }

# Hosts Reverse
zone 1.168.192.in-addr.arpa. {
        primary 127.0.0.1;
        key rndc-key;
        }

Make sure that file /usr/local/etc/dhcpd.conf is not world readable with:

[root@server /usr/home/user]# chmod 640 /usr/local/etc/dhcpd.conf [enter]
[root@server /usr/home/user]#

 

Start

Manually start isc-dhcp43-server with;

[root@server /usr/home/user]# service isc-dhcpd start [enter]
Starting dhcpd.
Internet Systems Consortium DHCP Server 4.3.5
Copyright 2004-2016 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/
Config file: /usr/local/etc/dhcpd.conf
Database file: /var/db/dhcpd/dhcpd.leases
PID file: /var/run/dhcpd/dhcpd.pid
Wrote 0 leases to leases file.
Listening on BPF/igb0/00:1b:21:a4:4e:cc/192.168.1.0/24
Sending on   BPF/igb0/00:1b:21:a4:4e:cc/192.168.1.0/24
Sending on   Socket/fallback/fallback-net
[root@srv /usr/home/stureah]#
[root@server /usr/home/user]#

Display isc-dhcp43-server status with:

[root@server /usr/home/user]# service isc-dhcpd status [enter]
dhcpd is running as pid 31662.
[root@server /usr/home/user]#

View content of dhcpd-leases

[root@server /usr/home/user]# cat /var/db/dhcpd/dhcpd.leases [enter]
# The format of this file is documented in the dhcpd.leases(5) manual page.
# This lease file was written by isc-dhcp-4.3.5

# authoring-byte-order entry is generated, DO NOT DELETE
authoring-byte-order little-endian;

lease 192.168.1.200 {
  starts 3 2017/03/01 14:32:06;
  ends 3 2017/03/01 15:32:06;
  tstp 3 2017/03/01 15:32:06;
  cltt 3 2017/03/01 14:32:06;
  binding state free;
  hardware ethernet e4:a7:a0:73:c4:ea;
  uid "\001\344\247\240s\304\352";
  set vendor-class-identifier = "MSFT 5.0";
.
.
[root@server /usr/home/user]#
BIND Domain Name Server

BIND Domain Name Server

Description

BIND is open source software that enables you to publish your Domain Name System (DNS) information on the Internet and to resolve DNS queries for your users. The name BIND stands for “Berkeley Internet Name Domain” because the software originated in the early 1980s at the University of California at Berkeley.

BIND is by far the most widely used DNS software on the Internet, providing a robust and stable platform on top of which organizations can build distributed computing systems with the knowledge that those systems are fully compliant with published DNS standards.

WWW: https://www.isc.org/software/bind.

Installed and configured package(s) requirement:

  1. OpenSSL – Open Secure Sockets Layer

Preparation for Installation

Start PuTTY on a Windows PC, Terminal on a Mac or similar terminal application on a Linux PC.

In this example Terminal on a Mac is used.

Open a remote SSH session to the server with:

Mac:~ user$ ssh user@192.168.1.4 [enter]
N.B.: Replace user@192.168.1.4 with User ID and IP Address on Your server!
[user@server ~]$

Enable superuser privileges with:

[user@server ~]$ sudo -s [enter]
Password: <-- passwd [enter]
[root@server /usr/home/user]#

N.B.: Enter user password, not the root password!

Installation

Search for bind in the remote package repositories with:

[root@server /usr/home/user]# pkg search bind <enter>
bind-tools-9.10.4P6            Command line tools from BIND: delv, dig, host, nslookup...
bind9-devel-9.12.0.a.2017.02.09 BIND DNS suite with updated DNSSEC and DNS64
bind910-9.10.4P6               BIND DNS suite with updated DNSSEC and DNS64
bind911-9.10.4P6               BIND DNS suite with updated DNSSEC and DNS64
bind99-9.9.9P6                 BIND DNS suite with updated DNSSEC and DNS64
bindgraph-0.3_1                RRDtool frontend for BIND statistics
bindtest-1.56_1                Test bind() semantics of IPv6 sockets
.
.
[root@server /usr/home/user]#

In this example, bind910 will be installed due to that bind911 has TCP_FASTOPEN error issues when running under FreeBSD 11.0-RELEASE-amd64.

Install bind910 with;

[root@server /usr/home/user]# pkg install bind910 [enter]
Updating FreeBSD repository catalogue...
FreeBSD repository is up-to-date.
All repositories are up-to-date.
The following 4 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
	bind911: 9.10.4P6
	lmdb: 0.9.18_1
	idnkit: 1.0_6
	json-c: 0.12.1

Number of packages to be installed: 4

The process will require 61 MiB more space.
8 MiB to be downloaded.

Proceed with this action? [y/N]: y [enter]
Fetching bind911-9.10.4P6.txz: 100%    8 MiB   2.7MB/s    00:03    
Fetching lmdb-0.9.18_1.txz: 100%   87 KiB  89.5kB/s    00:01    
Fetching idnkit-1.0_6.txz: 100%  194 KiB 198.4kB/s    00:01    
Fetching json-c-0.12.1.txz: 100%   38 KiB  39.2kB/s    00:01    
Checking integrity... done (0 conflicting)
[1/4] Installing lmdb-0.9.18_1...
[1/4] Extracting lmdb-0.9.18_1: 100%
[2/4] Installing idnkit-1.0_6...
[2/4] Extracting idnkit-1.0_6: 100%
[3/4] Installing json-c-0.12.1...
[3/4] Extracting json-c-0.12.1: 100%
[4/4] Installing bind911-9.10.4P6...
[4/4] Extracting bind911-9.10.4P6: 100%
Message from idnkit-1.0_6:
===>   NOTICE:

The idnkit port currently does not have a maintainer. As a result, it is
more likely to have unresolved issues, not be up-to-date, or even be removed in
the future. To volunteer to maintain this port, please create an issue at:

https://bugs.freebsd.org/bugzilla

More information about port maintainership is available at:

https://www.freebsd.org/doc/en/articles/contributing/ports-contributing.html#maintain-port
Message from bind911-9.10.4P6:
**********************************************************************
*            _  _____ _____ _____ _   _ _____ ___ ___  _   _         *
*           / \|_   _|_   _| ____| \ | |_   _|_ _/ _ \| \ | |        *
*          / _ \ | |   | | |  _| |  \| | | |  | | | | |  \| |        *
*         / ___ \| |   | | | |___| |\  | | |  | | |_| | |\  |        *
*        /_/   \_\_|   |_| |_____|_| \_| |_| |___\___/|_| \_|        *
*                                                                    *
*   BIND requires configuration of rndc, including a "secret" key.   *
*    The easiest, and most secure way to configure rndc is to run    *
*   'rndc-confgen -a' to generate the proper conf file, with a new   *
*            random key, and appropriate file permissions.           *
*                                                                    *
*     The /usr/local/etc/rc.d/named script will do that for you.     *
*                                                                    *
**********************************************************************
[root@server /usr/home/user]#

Configuration

List installed services named with:

[root@server /usr/home/user]# service -r | grep named
/usr/local/etc/rc.d/named
[root@server /usr/home/user]#

Find the rcvar for /etc/rc.conf:

[root@server /usr/home/user]# /usr/local/etc/rc.d/named rcvar
# named
#
named_enable="NO"
#   (default: "")

[root@server /usr/home/user]#

To start BIND at system boot, add information to /etc/rc.conf with this commands:

[root@server /usr/home/user]# echo '' >> /etc/rc.conf; echo '# BIND' >> /etc/rc.conf; echo 'named_enable="YES"' >> /etc/rc.conf; echo 'named_auto_forward="YES"' >> /etc/rc.conf [enter]
[root@server /usr/home/user]#

N.B.: named_auto_forward=”YES” tells BIND to pick forward Name Server(s) from file /etc/resolve.conf!

Automatically rotate the /var/named/var/log/named.log log file with:

[root@server /usr/home/user]# echo '/var/log/named.log                      600  9   100000 *     Z' >> /etc/syslog.conf [enter]
[root@server /usr/home/user]#

Update Resolve Config

Update file /etc/resolv.conf and set the local host as the primary DNS:

[root@server /usr/home/user]# ee /etc/resolv.conf [enter]
search		example.net
nameserver	127.0.0.1
nameserver	208.67.222.222
nameserver	208.67.220.220

N.B.: In this example OpenDNS Name Servers 208.67.222.222 and 208.67.220.220 is will be used by the local BIND Name Server for forward requests.

Generate Cryptograpic Key

Generate a rndc.key file with the following command:

[root@server /usr/home/user]# rndc-confgen -a [enter]
wrote key file "/usr/local/etc/namedb/rndc.key"
[root@server /usr/home/user]#

Change file modes on file /usr/local/etc/namedb/rndc.key with:

[root@server /usr/home/user]# chmod 440 /usr/local/etc/namedb/rndc.key [enter]
[root@server /usr/home/user]#

Display content of file /usr/local/etc/namedb/rndc.key with:

[root@server /usr/home/user]# cat /usr/local/etc/namedb/rndc.key [enter]
key "rndc-key" {
        algorithm hmac-md5;
        secret "XcwJ.............JSCMw==";
        };

N.B.: The content of file cat /usr/local/etc/namedb/rndc.key must be copied to the BIND configuration file /usr/local/etc/namedb/named.conf!

Configuration file

Edit the BIND configuration file for /usr/local/etc/namedb/named.conf with:

[root@server /usr/home/user]# ee /usr/local/etc/namedb/named.conf [enter]

N.B.: This is an example file. Please use it only as a template!

//
// named.conf
//

acl nets { 192.168.1/24; 127.0.0.1; };

options {
	// Relative to the chroot directory, if any, and should be fully qualified.
	directory       "/usr/local/etc/namedb/working";
	pid-file        "/var/run/named/pid";
	dump-file       "/var/dump/named_dump.db";
	statistics-file "/var/stats/named.stats";
	listen-on { 192.168.1.4; 127.0.0.1; };
	forwarders { 208.67.222.222; 208.67.220.220; };
	allow-query { nets; };
	allow-recursion { nets; };
	};

logging {
	channel log_file { file "/var/log/named/named.log" versions 3 size 5M;
	severity  debug 3 ; };
	category queries { log_file; };
	category xfer-in { log_file; };
	category xfer-out { log_file; };
	category default { log_file; };
	};

include "/usr/local/etc/namedb/rndc.key";

controls {
        inet 127.0.0.1 port 953 allow { nets; } keys { "rndc-key"; };
        inet 192.168.1.1 port 953 allow { nets; } keys { "rndc-key"; };
        };

//zone "." { type hint; file "named.root"; };
zone "localhost" { type master; file "/usr/local/etc/namedb/master/localhost-forward.db"; };
zone "127.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/localhost-reverse.db"; };
zone "255.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/empty.db"; };

zone "example.net" {
        notify yes;
        type master;
        file "/usr/local/etc/namedb/dynamic/hosts-forward.db";
        allow-update { key rndc-key; };
        };

zone "1.168.192.in-addr.arpa" {
        notify yes;
        type master;
        file "/usr/local/etc/namedb/dynamic/hosts-reverse.db";
        allow-update { key rndc-key; };
        };

“Seed” zone files

Prepare a “seed” zone file for the domain the server should update dynamically.

In this example, the dynamic subdomain is going to be example.net. Remember to replace example.net with your domain name, it must match what you have used in file /var/named/etc/namedb/named.conf.

The “seed” zone file is very minimal and should contain information that WON’T ever change. In this case, that will be the SOA record, the NS records, and the MX record.

Create the forward “seed” zone file with:

[root@server /usr/home/user]# ee /usr/local/etc/namedb/dynamic/hosts-forward.db [enter]

N.B.: This is an example file!

$ORIGIN .
$TTL 3600       ; 1 hour
example.net  IN SOA  server.example.net. admin.example.net. (
                                0          ; serial
                                10800      ; refresh (3 hours)
                                3600       ; retry (1 hour)
                                604800     ; expire (1 week)
                                86400      ; minimum (1 day)
                                )
                        NS      server.example.net.
                        MX      10 server.example.net.
$ORIGIN example.net.
server                  A       192.168.1.1
ftp                     CNAME   server
mx                      CNAME   server
ns                      CNAME   server
www                     CNAME   server

Create the reverse “seed” zone file with:

[root@server /usr/home/user]# ee /usr/local/etc/namedb/dynamic/hosts-reverse.db [enter]

N.B.: This is an example file:

$ORIGIN .
$TTL 3600       ; 1 hour
1.168.192.in-addr.arpa  IN SOA  server.example.net. admin.example.net. (
                                0          ; serial
                                10800      ; refresh (3 hours)
                                3600       ; retry (1 hour)
                                604800     ; expire (1 week)
                                86400      ; minimum (1 day)
                                )
                        NS      server.example.net.
                        MX      10 server.example.net.
$ORIGIN 1.168.192.in-addr.arpa.
1                       PTR     server.example.net.

Feel free to modify based on what you want to do, you can add more aliases, A or MX records, and make sure to change your domain name above from example.net to your domain name. Make sure to add a “.” after words, also change your hostname from server to the hostname you are using.

admin.example.net is the e-mail address of the person responsible for the zone. Here we use a “.” instead of an “@” sign in the e-mail address.

name service needs to update the configuration for the dynamic IPs itself. Set write permission for the user bind with:

[root@server /usr/home/user]# chown bind:bind /usr/local/etc/namedb/dynamic/hosts-* [enter]
[root@server /usr/home/user]#

Create a new directory called /var/log/named with:

[root@server /usr/home/user]# mkdir /var/log/named [enter]
[root@server /usr/home/user]#

Change file owner and group with:

[root@server /usr/home/user]# chown bind:bind /var/log/named [enter]
[root@server /usr/home/user]#

Change file modes with:

[root@server /usr/home/user]# chmod 777 /var/log/named [enter]
[root@server /usr/home/user]#

Create a empty log files called /var/log/named/named.log with:

[root@server /usr/home/user]# touch /var/log/named/named.log [enter]
[root@server /usr/home/user]#

/var/log/named/named.log files must have write permission for user bind:

[root@server /usr/home/user]# chown bind:bind /var/log/named/named.log [enter]
[root@server /usr/home/user]#

Syntax Checks

named-checkzone checks the syntax and integrity of a zone file. It performs the same checks as named does when loading a zone. This makes named-checkzone useful for checking zone files before configuring them into a name server.

[root@server /usr/home/user]# named-checkconf -zj [enter]
zone localhost/IN: loaded serial 42
zone 127.in-addr.arpa/IN: loaded serial 42
zone 255.in-addr.arpa/IN: loaded serial 42
zone example.net/IN: loaded serial 0
zone 1.168.192.in-addr.arpa/IN: loaded serial 0
[root@server /usr/home/user]#

Optional: rndc.conf

rndc.conf is the configuration file for rndc, the BIND 9 name server control utility. This file has a similar structure and syntax to named.conf. Statements are enclosed in braces and terminated with a semi-colon. Clauses in the statements are also semi-colon terminated.

Add /usr/local/etc/namedb/rndc.key to file /usr/local/etc/namedb/rndc.conf with:

[root@server /usr/home/user]# cat /usr/local/etc/namedb/rndc.key >> /usr/local/etc/namedb/rndc.conf
[root@server /usr/home/user]#

Edit the configuration file for rndc with:

[root@server /usr/home/user]# ee /usr/local/etc/namedb/rndc.conf [enter]

N.B.: This is an example file!

/*
 * rndc configuration file.
 */

options {
        default-server  localhost;
        default-key     "rndc-key";
};

server localhost {
        key             "rndc-key";
};

key "rndc-key" {
        algorithm hmac-md5;
        secret "XcwJ.............JSCMw==";
};

Start

Manually start BIND with;

[root@server /usr/home/user]# service named start [enter]
Starting named.
[root@server /usr/home/user]#

Test BIND status with:

[root@server /usr/home/user]# service named status [enter]
named is running as pid 64826.
[root@server /usr/home/user]#

Check the error logs with:

[root@server /usr/home/user]# grep named /var/log/messages [enter]
Mar  1 12:33:35 srv named[92074]: starting BIND 9.10.4-P6 <id:a6837d0> -u bind -c /usr/local/etc/namedb/named.conf
Mar  1 12:33:35 srv named[92074]: running on FreeBSD amd64 11.0-RELEASE-p2 FreeBSD 11.0-RELEASE-p2 #0: Mon Oct 24 06:55:27 UTC 2016     root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC
Mar  1 12:33:35 srv named[92074]: built with '--localstatedir=/var' '--disable-linux-caps' '--disable-symtable' '--with-randomdev=/dev/random' '--with-libxml2=/usr/local' '--with-readline=-L/usr/local/lib -ledit' '--with-dlopen=yes' '--sysconfdir=/usr/local/etc/namedb' '--disable-fetchlimit' '--disable-filter-aaaa' '--disable-fixed-rrset' '--without-geoip' '--with-idn=/usr/local' '--enable-ipv6' '--with-libjson' '--disable-largefile' '--without-python' '--disable-querytrace' '--enable-rpz-nsdname' '--enable-rpz-nsip' 'STD_CDEFINES=-DDIG_SIGCHASE=1' '--without-gssapi' '--with-openssl=/usr' '--disable-native-pkcs11' '--with-dlz-filesystem=yes' '--without-gost' '--enable-threads' '--prefix=/usr/local' '--mandir=/usr/local/man' '--infodir=/usr/local/info/' '--build=amd64-portbld-freebsd11.0' 'build_alias=amd64-portbld-freebsd11.0' 'CC=cc' 'CFLAGS=-O2 -pipe -DLIBICONV_PLUG -fstack-protector -isystem /usr/local/include -fno-strict-aliasing' 'LDFLAGS= -fstack-protector' 'LIBS=-L/usr/local/lib' 'CPPFLAGS=-DLIBICONV_P
Mar  1 12:33:35 srv named[92074]: ----------------------------------------------------
Mar  1 12:33:35 srv named[92074]: BIND 9 is maintained by Internet Systems Consortium,
Mar  1 12:33:35 srv named[92074]: Inc. (ISC), a non-profit 501(c)(3) public-benefit 
Mar  1 12:33:35 srv named[92074]: corporation.  Support and training for BIND 9 are 
Mar  1 12:33:35 srv named[92074]: available at https://www.isc.org/support
Mar  1 12:33:35 srv named[92074]: ----------------------------------------------------
Mar  1 12:33:35 srv named[92074]: command channel listening on 127.0.0.1#953
Mar  1 12:33:35 srv named[92074]: command channel listening on 192.168.1.4#953
[root@server /usr/home/user]#
[root@server /usr/home/user]# tail /var/log/named/named.log [enter]
.
zone_settimer: zone 100.51.198.IN-ADDR.ARPA/IN: enter
zone_timer: zone id.server/CH: enter
zone_maintenance: zone id.server/CH: enter
zone_settimer: zone id.server/CH: enter
[root@server /usr/home/user]#

Reload Config

Reload configuration file and zones after manual updates with:

[root@server /usr/home/user]# rndc reload [enter]
server reload successful
[root@server /usr/home/user]#

…or with:

[root@server /usr/home/user]# service named reload [enter]
server reload successful
[root@server /usr/home/user]#

How to use

Checked if the nameserver is working on the server:

[root@server /usr/home/user]# dig @localhost ns.example.net [enter]

; <<>> DiG 9.9.4 <<>> @localhost ns.example.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 15863
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;ns1.example.net.	IN	A

;; AUTHORITY SECTION:
example.net.	3600	IN	SOA	server.example.net. admin.server.example.net. 247 10800 3600 604800 86400

;; Query time: 0 msec
;; SERVER: 192.168.1.4#53(192.168.1.4)
;; WHEN: Mon Aug  8 23:52:15 2011
;; MSG SIZE  rcvd: 91

[root@server /usr/home/user]#

You can try to dig for google.com to make sure all is good with your DNS server:

[root@server /usr/home/user]# dig @localhost google.com [enter]
	
; <<>> DiG 9.9.4 <<>> @localhost google.com
; (2 servers found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4584
;; flags: qr rd ra; QUERY: 1, ANSWER: 11, AUTHORITY: 13, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;google.com.			IN	A

;; ANSWER SECTION:
google.com.		300	IN	A	173.194.32.36
google.com.		300	IN	A	173.194.32.33
google.com.		300	IN	A	173.194.32.32
google.com.		300	IN	A	173.194.32.41
google.com.		300	IN	A	173.194.32.39
google.com.		300	IN	A	173.194.32.38
google.com.		300	IN	A	173.194.32.35
google.com.		300	IN	A	173.194.32.46
google.com.		300	IN	A	173.194.32.40
google.com.		300	IN	A	173.194.32.37
google.com.		300	IN	A	173.194.32.34

;; AUTHORITY SECTION:
.			510352	IN	NS	f.root-servers.net.
.			510352	IN	NS	e.root-servers.net.
.			510352	IN	NS	k.root-servers.net.
.			510352	IN	NS	b.root-servers.net.
.			510352	IN	NS	j.root-servers.net.
.			510352	IN	NS	l.root-servers.net.
.			510352	IN	NS	m.root-servers.net.
.			510352	IN	NS	a.root-servers.net.
.			510352	IN	NS	h.root-servers.net.
.			510352	IN	NS	i.root-servers.net.
.			510352	IN	NS	g.root-servers.net.
.			510352	IN	NS	d.root-servers.net.
.			510352	IN	NS	c.root-servers.net.

;; Query time: 48 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sun Dec 15 23:10:43 CET 2013
;; MSG SIZE  rcvd: 426

[root@server /usr/home/user]#

Manual dynamic DNS update

A dynamic DNS update can be performed with the nsupdate tool. The nsupdate tool requires that you have a valid key-file, /usr/local/etc/namedb/rndc.key that matches the key in file /usr/local/etc/namedb/named.conf.

In this example a new A record will be added for myhost.example.net with IP address 192.168.1.248:

[root@server /usr/home/user]# nsupdate -k /usr/local/etc/namedb/rndc.key [enter]
> update add myhost.example.net 3600 A 192.168.1.248 [enter]
> send [enter]
> [ctrl][D][root@server /usr/home/user]#

Verify the add of host myhost.example.net with:

[root@server /usr/home/user]# host myhost.example.net [enter]
myhost.example.net has address 192.168.1.248
[root@server /usr/home/user]#

Remove the A record entry for myhost.example.net so it doesn’t cause problems later with:

[root@server /usr/home/user]# nsupdate -k /usr/local/etc/namedb/rndc.key [enter]
> update delete myhost.example.net [enter]
> send [enter]
> [ctrl][D][root@server /usr/home/user]#

Verify the delete of host myhost.example.net with:

[root@server /usr/home/user]# host myhost.example.net [enter]
Host myhost.example.net not found: 3(NXDOMAIN)
[root@server /usr/home/user]#
sSMTP – Simple MTA to get Mail off the System

sSMTP – Simple MTA to get Mail off the System

Description

A secure, effective and simple way of getting mail off a system to your mail hub. It does not include a mail spool to poke around in, and no daemons running in the background. Mail is simply forwarded to the configured mailhost. Extremely easy configuration.

WARNING: the above is all it does; it does not receive mail, expand aliases or manage a queue. That belongs on a mail hub with a system administrator.

WWW: http://packages.debian.org/stable/mail/ssmtp.

Preparation for Installation

Start PuTTY on a Windows PC, Terminal on a Mac or similar terminal application on a Linux PC.

In this example Terminal on a Mac is used.

Open a remote SSH session to the server with:

Mac:~ user$ ssh user@192.168.1.4 [enter]
N.B.: Replace user@192.168.1.4 with User ID and IP Address on Your server!
[user@server ~]$

Enable superuser privileges with:

[user@server ~]$ sudo -s [enter]
Password: <-- passwd [enter]
[root@server /usr/home/user]#

N.B.: Enter user password, not the root password!

Installation

Install sSMTP with;

[root@server /usr/home/user]# pkg install ssmtp [enter]
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
        ssmtp: 2.64_2

Number of packages to be installed: 1

19 KiB to be downloaded.

Proceed with this action? [y/N]: y [enter]
[1/1] Fetching ssmtp-2.64_2.txz: 100%   19 KiB  19.8kB/s    00:01
Checking integrity... done (0 conflicting)
[1/1] Installing ssmtp-2.64_2...
===> Creating groups.
Creating group 'ssmtp' with gid '916'.
Extracting ssmtp-2.64_2: 100%
Message from ssmtp-2.64_2:
sSMTP has been installed successfully.

To replace sendmail with ssmtp type "make replace" or change
your /etc/mail/mailer.conf to:

sendmail        /usr/local/sbin/ssmtp
send-mail       /usr/local/sbin/ssmtp
mailq           /usr/local/sbin/ssmtp
newaliases      /usr/local/sbin/ssmtp
hoststat        /usr/bin/true
purgestat       /usr/bin/true


However, before you can use the program, you should copy the files
"revaliases.sample" and "ssmtp.conf.sample" in /usr/local/etc/ssmtp
to "revaliases" and "ssmtp.conf" respectively and edit them to suit
your needs.
[root@server /usr/home/user]#

Configuration

Stop the Sendmail daemon if it is running:

[root@server /usr/home/user]# service sendmail stop [enter]
Stopping sendmail.
Waiting for PIDS: 739.
Stopping sendmail_msp_queue.
Waiting for PIDS: 742.
[root@server /usr/home/user]#

To disable sendmail on system boot, add information to /etc/rc.conf with this commands:

[root@server /usr/home/user]# echo '' >> /etc/rc.conf; echo '# Disable Sendmail' >> /etc/rc.conf; echo 'sendmail_enable="NONE"' >> /etc/rc.conf
[root@server /usr/home/user]#

Edit file /etc/mail/mailer.conf with

[root@server /usr/home/user]# ee /etc/mail/mailer.conf [enter]

It should look like this:

#
# Use "ssmtp" for sending mail
#
sendmail        /usr/local/sbin/ssmtp
send-mail       /usr/local/sbin/ssmtp
mailq           /usr/libexec/sendmail/sendmail
newaliases      /usr/libexec/sendmail/sendmail
hoststat        /usr/libexec/sendmail/sendmail
purgestat       /usr/libexec/sendmail/sendmail

The command sendmail will invoke the ssmtp executable. But you have not told sSMTP which SMTP server to use with which credentials. These settings are looked for in the sSMTP configuration files /usr/local/etc/ssmtp/revaliases and /usr/local/etc/ssmtp/ssmtp.conf.

Copy the sample file /usr/local/etc/revaliases.sample to /usr/local/etc/revaliases with:

[root@server /usr/home/user]# cp /usr/local/etc/ssmtp/revaliases.sample /usr/local/etc/ssmtp/revaliases [enter]

…and edit appropriately with this command:

[root@server /usr/home/user]# ee /usr/local/etc/ssmtp/revaliases [enter]

Example:

# sSMTP aliases
#
# Format:       local_account:outgoing_address:mailhub
#
# Example: root:your_login@your.domain:mailhub.your.domain[:port]
# where [:port] is an optional port number that defaults to 25.
root:your.mail@example.net:mail.example.net
postmaster:your.mail@example.net:mail.example.net

Create an ssmtp user with:

[root@server /usr/home/user]# pw useradd ssmtp -g ssmtp -h - -s /usr/sbin/nologin -d /nonexistent -c "sSMTP pseudo-user" [enter]
[root@server /usr/home/user]#

This will add the ssmtp user in the ssmtp group, disallowing password-based logins (-h).

Set the correct owner and permissions on the sSMTP configuration directory. We set the setuid bit (see chmod(1) to make sure new files in the directory will be owned by the user ssmtp as well:

[root@server /usr/home/user]# chown -R ssmtp:wheel /usr/local/etc/ssmtp/; chmod 4750 /usr/local/etc/ssmtp [enter]
[root@server /usr/home/user]#

Now the configuration file is set up and protected from unauthorized eyes, the ssmtp executable should be given access to the file. To accomplish this, we will let it run as the ssmtp user.

Make the ssmtp executable owned by the ssmtp user:

[root@server /usr/home/user]# chown ssmtp:nogroup /usr/local/sbin/ssmtp; chmod 4555 /usr/local/sbin/ssmtp [enter]
[root@server /usr/home/user]#

Copy the sample file /usr/local/etc/smartd.conf.sample to /usr/local/etc/smartd.conf with:

[root@server /usr/home/user]# cp /usr/local/etc/ssmtp/ssmtp.conf.sample /usr/local/etc/ssmtp/ssmtp.conf [enter]

…and edit appropriately with this command:

[root@server /usr/home/user]# ee /usr/local/etc/ssmtp/ssmtp.conf [enter]

Example:

#
# /etc/ssmtp.conf -- a config file for sSMTP sendmail.
#

# The person who gets all mail for userids < 1000
# Make this empty to disable rewriting.
root=your.mail@example.net

# The place where the mail goes. The actual machine name is required
# no MX records are consulted. Commonly mailhosts are named mail.domain.com
# The example will fit if you are in domain.com and your mailhub is so named.
mailhub=mail.example.net:465

# Example for SMTP port number 2525
# mailhub=mail.your.domain:2525
# Example for SMTP port number 25 (Standard/RFC)
# mailhub=mail.your.domain
# Example for SSL encrypted connection
# mailhub=mail.your.domain:465

# Where will the mail seem to come from?
rewriteDomain=example.net

# The full hostname
hostname=server.example.net

# Set this to never rewrite the "From:" line (unless not given) and to
# use that address in the "from line" of the envelope.
FromLineOverride=YES

# Use SSL/TLS to send secure messages to server.
UseTLS=YES

# Use SSL/TLS certificate to authenticate against smtp host.
#UseTLSCert=YES

# Use this RSA certificate.
#TLSCert=/usr/local/etc/ssmtp/ssmtp.pem

# Get enhanced (*really* enhanced) debugging information in the logs
# If you want to have debugging of the config file parsing, move this option
# to the top of the config file and uncomment
#Debug=YES

# Username/Password
AuthUser=username
AuthPass=password

Edit file /etc/crontab with:

[root@server /usr/home/user]# ee /etc/crontab [enter]

Add the following two lines (example):

# /etc/crontab - root's crontab for FreeBSD
#
# $FreeBSD: src/etc/crontab,v 1.33.2.1.4.1 2010/06/14 02:09:06 kensmith Exp $
#
SHELL=/bin/sh
PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin
HOME=/var/log
MAILTO="your.mail@example.net"
#
.

Run some tests as an unprivileged user – user should not a member of groupe ssmtp – with:

[user@server ~]$ cat /usr/local/etc/ssmtp/ssmtp.conf [enter]
cat: /usr/local/etc/ssmtp/ssmtp.conf: Permission denied
[user@server ~]$

Test your mail settings with this two examples:

Create a textfile with the message that you are going to send with:

[user@server ~]$ ee ~/ssmtp-test.txt [enter]

Example Test Message:

To: youre.mail@example.net
From: youre.mail@example.net
Subject: Test message via sSMTP

This is a test message sent via sSMTP

Run this two command to send the testmessage:

[user@server ~]$ ssmtp -v youre.mail@example.net < ~/ssmtp-test.txt [enter]
[<-] 220 smtpout.example.net cmsmtp ESMTP server ready
[->] EHLO server.example.net
[<-] 250 OK
[->] AUTH LOGIN
[<-] 334 VXNlcm5hbWU6
[->] dTMxNTE0NDE1
[<-] 334 UGFzc3dvcmQ6
[<-] 235 2.7.0 ... authentication succeeded
[->] MAIL FROM:<youre.mail@example.net>
[<-] 250 2.1.0 <youre.mail@example.net> sender ok
[->] RCPT TO:<youre.mail@example.net>
[<-] 250 2.1.5 <youre.mail@example.net> recipient ok
[->] DATA
[<-] 354 OK
[->] Received: by server.example.net (sSMTP sendmail emulation); Wed, 06 Jan 2016 13:09:02 +0100
[->] Date: Wed, 06 Jan 2016 13:09:02 +0100
[->] To: youre.mail@example.net
[->] From: youre.mail@example.net
[->] Subject: Test message
[->] 
[->] This is a test meesage sent via sSMTP
[->] .
[<-] 250 2.0.0 Gmt................U9X mail accepted for delivery
[->] QUIT
[<-] 221 2.0.0 smtpout.example.net cmsmtp closing connection
[user@server ~]$

N.B.: Mail transfer output to the terminal has been edited for security reasons!

[user@server ~]$ sendmail your.mail@example.net < ~/ssmtp-test.txt [enter]
[user@server ~]$
[root@user ~]# mail -s "Testing sSMTP" your.address@example.net [enter]
This is a test with sSMTP [enter]

Type <Ctr><D> on a blank line to send message.

[root@user ~]$

Change user to root and heck error log with:

[root@server /usr/home/user]# tail /var/log/maillog [enter]
Jan  6 13:00:00 server newsyslog[1427]: logfile first created
Jan  6 13:09:02 server sSMTP[8552]: Creating SSL connection to host
Jan  6 13:09:03 server sSMTP[8552]: SSL connection using DHE-RSA-AES256-GCM-SHA384
Jan  6 13:09:04 server sSMTP[8552]: Sent mail for your.mail@example.net (221 2.0.0 smtpout.example.net cmsmtp closing connection) uid=1000 username=user outbytes=404
Jan  6 13:24:48 server sSMTP[8735]: Creating SSL connection to host
Jan  6 13:24:48 server sSMTP[8735]: SSL connection using DHE-RSA-AES256-GCM-SHA384
Jan  6 13:24:49 server sSMTP[8735]: Sent mail for your.mail@example.net (221 2.0.0 smtpout.example.net cmsmtp closing connection) uid=1000 username=user outbytes=404
Jan  6 13:25:12 server sSMTP[8740]: Creating SSL connection to host
Jan  6 13:25:12 server sSMTP[8740]: SSL connection using DHE-RSA-AES256-GCM-SHA384
Jan  6 13:25:14 server sSMTP[8740]: Sent mail for your.mail@example.net (221 2.0.0 smtpout.example.net cmsmtp closing connection) uid=1000 username=user outbytes=404
[root@server /usr/home/user]#

Additional Reading

SecureSSMTP

FreeBSD: Use Gmail For Outgoing Mail

FreeBSD: Send mails over an external SMTP server

unzip

unzip

Description

Unzip will list, test, or extract files from a ZIP archive, commonly found on MS-DOS systems. The default behavior (with no options) is to extract into the current directory (and subdirectories below it) all files from the specified ZIP archive. Unzip is compatible with archives created by PKWARE’s PKZIP, but in many cases the program options or default behaviors differ.

Zipinfo lists technical information about files in a ZIP archive, most commonly found on MS-DOS systems. Such information includes file access permissions, encryption status, type of compression, version and operating system or file system of compressing program, and the like.

Funzip acts as a filter; that is, it assumes that a ZIP archive is being piped into standard input, and it extracts the first member from the archive to stdout. If there is an argument, then the input comes from the specified file instead of from stdin.

Unzipsfx may be used to create self-extracting ZIP archives from previously created ZIP archives.

WWW: http://www.info-zip.org/UnZip.html

Preparation for Installation

Start PuTTY on a Windows PC, Terminal on a Mac or similar terminal application on a Linux PC.

In this example Terminal on a Mac is used.

Open a remote SSH session to the server with:

Mac:~ user$ ssh user@192.168.1.4 [enter]
N.B.: Replace user@192.168.1.4 with User ID and IP Address on Your server!
[user@server ~]$

Enable superuser privileges with:

[user@server ~]$ sudo -s [enter]
Password: <-- passwd [enter]
[root@server /usr/home/user]#

N.B.: Enter user password, not the root password!

Installation

Install unzip with:

[root@server /usr/home/user]# pkg install unzip [enter]
Updating FreeBSD repository catalogue...
FreeBSD repository is up-to-date.
All repositories are up-to-date.
The following 1 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
	unzip: 6.0_7

Number of packages to be installed: 1

132 KiB to be downloaded.

Proceed with this action? [y/N]: y [enter]
Fetching unzip-6.0_7.txz: 100%  132 KiB 135.6kB/s    00:01    
Checking integrity... done (0 conflicting)
[1/1] Installing unzip-6.0_7...
[1/1] Extracting unzip-6.0_7: 100%
[root@server /usr/home/user]#

How to use

To use unzip to extract all members of the archive letters.zip into the current directory and subdirectories below it, creating any subdirectories as necessary:

[root@server /usr/home/user]# unzip letters [enter]

To get a basic, short-format listing of the complete contents of a ZIP archive storage.zip, with both header and totals lines, use only the archive name as an argument to zipinfo:

[root@server /usr/home/user]# zipinfo storage [enter]

To use funzip to extract the first member file of the archive test.zip and to pipe it into more(1):

[root@server /usr/home/user]# funzip test.zip | more [enter]

To create a self-extracting archive letters from a regular zipfile letters.zip and change the new archive’s permissions to be world-executable under Unix:

[root@server /usr/home/user]# cat unzipsfx letters.zip > letters [enter]
[root@server /usr/home/user]# chmod 755 letters [enter]
[root@server /usr/home/user]# zip -A letters [enter]
[root@server /usr/home/user]#
rsync

rsync

Description

rsync is an open source utility that provides fast incremental file transfer. rsync is freely available under the GNU General Public License and is currently being maintained by Wayne Davison.

WWW: http://rsync.samba.org/

Preparation for Installation

Start PuTTY on a Windows PC, Terminal on a Mac or similar terminal application on a Linux PC.

In this example Terminal on a Mac is used.

Open a remote SSH session to the server with:

Mac:~ user$ ssh user@192.168.1.4 [enter]
N.B.: Replace user@192.168.1.4 with User ID and IP Address on Your server!
[user@server ~]$

Enable superuser privileges with:

[user@server ~]$ sudo -s [enter]
Password: <-- passwd [enter]
[root@server /usr/home/user]#

N.B.: Enter user password, not the root password!

Installation

Install the rsync port with:

[root@server /usr/home/user]# pkg install net/rsync [enter]
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
        rsync: 3.1.2_7

Number of packages to be installed: 1

298 KiB to be downloaded.

Proceed with this action? [y/N]: y [enter]
[1/1] Fetching rsync-3.1.2_7.txz: 100%  298 KiB 305.3kB/s    00:01
Checking integrity... done (0 conflicting)
[1/1] Installing rsync-3.1.2_7...
Extracting rsync-3.1.2_7: 100%
[root@server /usr/home/user]#

Configuration

List installed services with:

[root@server /usr/home/user]# service -r | grep rsync [enter]
/usr/local/etc/rc.d/rsyncd
[root@server /usr/home/user]#

Find the rcvar for /etc/rc.conf:

[root@server /usr/home/user]# /usr/local/etc/rc.d/rsyncd rcvar [enter]
# rsyncd
#
rsyncd_enable="NO"
#   (default: "")

[root@server /usr/home/user]#

To start rsync automatically on system boot with –ipv4 as the prefered option add information to /etc/rc.conf with this commands:

[root@server /usr/home/user]# echo '' >> /etc/rc.conf; echo '# rsync using IPv4' >> /etc/rc.conf; echo 'rsyncd_enable="YES"' >> /etc/rc.conf; echo 'rsyncd_flags="--ipv4"' >> /etc/rc.conf [enter]
[root@server /usr/home/user]#

If you run rsyncd manually and your server only uses IPv4, then make sure you add the “–ipv4” argument to the manual start command_args with:

[root@server /usr/home/user]# perl -pi -e 's/--daemon/--ipv4 --daemon/g' /usr/local/etc/rc.d/rsyncd [enter]
[root@server /usr/home/user]#

Create a logfile with:

[root@server /usr/home/user]# touch /var/log/rsyncd.log [enter]
[root@server /usr/home/user]#

Automatically rotate /var/log/rsyncd.log log file with:

[root@server /usr/home/user]# echo '/var/log/rsyncd.log                     600  9   100000 *     Z' >> /etc/newsyslog.conf [enter]
[root@server /usr/home/user]#

Create the rsync Secret File with:

[root@server /usr/home/user]# ee /usr/local/etc/rsync/rsyncd.secrets [enter]

Add the following text, example:

tridge:passwd1
susan:passwd2

Make file /usr/local/etc/rsync/rsyncd.secrets non-world readable with:

[root@server /usr/home/user]# chmod 440 /usr/local/etc/rsync/rsyncd.secrets [enter]
[root@server /usr/home/user]#

…and then set owner and group with:

[root@server /usr/home/user]# chown root:wheel /usr/local/etc/rsync/rsyncd.secrets [enter]
[root@server /usr/home/user]#

Create group rsync and user rsync with:

[root@server /usr/home/user]# pw group add -n rsync -g 4002; pw user add -n rsync -u 4002 -c "rsync daemon" -d /nonexistent -s /usr/sbin/nologin [enter]
[root@server /usr/home/user]#

The rsync group is added to /etc/group and should look similar to the following:

[root@server /usr/home/user]# grep rsync /etc/group [enter]
rsync:*:4002:
[root@server /usr/home/user]#

The rsync user is added to /etc/passwd and should look similar to the following:

[root@server /usr/home/user]# grep rsync /etc/passwd [enter]
rsync:*:4002:4002:rsync daemon:/nonexistent:/usr/sbin/nologin
[root@server /usr/home/user]#

Edit file /usr/local/etc/rsync/rsyncd.conf with:

[root@server /usr/home/user]# ee /usr/local/etc/rsync/rsyncd.conf [enter]

Example:

# rsyncd.conf - Example file, see rsyncd.conf(5)
#

# Set this if you want to stop rsync daemon with rc.d scripts
pid file = /var/run/rsyncd.pid

# Edit this file before running rsync daemon!!

#uid = rsync
#gid = rsync
#use chroot = no
#max connections = 4
#syslog facility = local5

#[ftp]
#       path = /var/ftp/pub
#       comment = whole ftp area (approx 6.1 GB)

#[sambaftp]
#       path = /var/ftp/pub/samba
#       comment = Samba ftp area (approx 300 MB)

#[rsyncftp]
#       path = /var/ftp/pub/rsync
#       comment = rsync ftp area (approx 6 MB)

#[sambawww]
#       path = /public_html/samba
#       comment = Samba WWW pages (approx 240 MB)

#[cvs]
#       path = /data/cvs
#       comment = CVS repository (requires authentication)
#       auth users = tridge, susan
#       secrets file = /usr/local/etc/rsync/rsyncd.secrets

Manually Start

Manualy start the rsyncd with:

[root@server /usr/home/user]# service rsyncd start [enter]
Starting rsyncd.
[root@server /usr/home/user]#

View rsyncd status with:

[root@server /usr/home/user]# service rsyncd status [enter]
rsyncd is running as pid 902.
[root@server /usr/home/user]#
[root@server /usr/home/user]# ps aux | grep rsync  [enter]
root    3527   0.0  0.0 12808  2448  -  Ss   10:36PM   0:00.00 /usr/local/bin/rsync --ipv4 --ipv4 --daemon --config /usr/local/etc/
root    3535   0.0  0.0 18824  2332  0  S+   10:37PM   0:00.00 grep rsync
[root@server /usr/home/user]#
[root@server /usr/home/user]# sockstat | grep rsync [enter]
root     rsync      3527  3  dgram  -> /var/run/logpriv
root     rsync      3527  4  tcp4   *:873                 *:*
[root@server /usr/home/user]#

Verify that you can connect to the daemon with:

[root@server /usr/home/user]# telnet localhost 873 [enter]
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
@RSYNCD: 30.0
[root@server /usr/home/user]#

rsync Client Setup

N.B.: You may have to install rsync on the client as well!

Create a password file for user user with:

[root@server /usr/home/user]# echo "passwd" > /usr/local/etc/rsyncd.passwd_user [enter]
[root@server /usr/home/user]#

Note: Echo password ONLY! Do NOT echo username!

Make file /usr/local/etc/rsyncd.passwd_user non-world readable with:

[root@server /usr/home/user]# chmod 440 /usr/local/etc/rsyncd.passwd_user [enter]
[root@server /usr/home/user]#

Set owner and group with:

[root@server /usr/home/user]# chown root:wheel /usr/local/etc/rsyncd.passwd_user [enter]
[root@server /usr/home/user]#

Howto use

You use rsync in the same way you use rcp. You must specify a source and a destination, one of which may be remote.

This is a syntax example for a manual file transfer from a remote host:

[root@server /usr/home/user]# rsync -avz --delete --stats --safe-links --password-file=/usr/local/etc/rsyncd.passwd_user user@192.168.1.100::ftp /var/ftp/pub/ [enter]

This is a syntax example for a manual file transfer to a remote host:

[root@server /usr/home/user]# rsync -avz --delete --stats --safe-links --password-file=/usr/local/etc/rsyncd.passwd_user /var/ftp/pub/ user@192.168.1.100::ftp [enter]

rsync can execute commands on the remote computer to generate a list of files to copy. The shell command is expanded by the remote shell before rsync is called.

The following command will run a find command on the remote host in directory ‘/tmp/test’ and rsync all “txt” files it finds to directory ‘/temp/test/’ on the local host:

[root@server /usr/home/user]# rsync -avR ssh user@remotehost:'`find /tmp/test -name "*.[txt]"`' /tmp/test/ [enter]

rsync to Remote Server without Password

No-password authentication works because of public key crypto. Let’s say you have a local machine server and a remote machine remote. You want to be able to ssh from server to remote without having to enter your password.

The server remote in this document is the server that has files that is to be transferred to the local server server.

The server server in this document is the local server that will receive files from the remote server remote.

First step is to prepare the remote server remote by generate a public/private RSA key pair.

Next, we generate a public/private RSA key pair on on the local server, server and then we send the public key to the remote server, remote, so that remote knows that the server key belongs to a list of authorized keys. Then when we try to ssh from server to remote, RSA authentication is performed automatically.

On the Remote Server remote:

Generate keys on the remote server, remote as the user that will be connect to from the local server server:

[user@remote ~]$ ssh-keygen -t dsa -f ~/.ssh/id_dsa [enter]

NOTE: When prompted for a password, do NOT enter one, just press [enter]!

Generating public/private dsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_dsa):
Enter passphrase (empty for no passphrase): [enter]
Enter same passphrase again: [enter]
Your identification has been saved in /home/user/.ssh/id_dsa.
Your public key has been saved in /home/user/.ssh/id_dsa.pub.
The key fingerprint is:
ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff user@remote.example.net
The key's randomart image is:
+--[ DSA 1024]----+
|.B+o . |
|.+= + . |
|o... . |
|.... |
| . .... S |
| .o+o . . |
| E += |
| ..o |
| . |
+-----------------+
[user@remote ~]$

This will create folder /usr/home/.ssh if it do not exist, generate a password-less key /usr/home/.ssh/id_dsa, and a public key /usr/home/.ssh/id_dsa.pub.

On the Local Server server:

Generate keys on the local server, server as the user that will perform the ssh connection to the remote server:

[user@server ~]$ ssh-keygen -t dsa -f ~/.ssh/id_dsa [enter]

NOTE: When prompted for a password, do NOT enter one, just press [enter]!

Generating public/private dsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_dsa):
Enter passphrase (empty for no passphrase): [enter]
Enter same passphrase again: [enter]
Your identification has been saved in /home/user/.ssh/id_dsa.
Your public key has been saved in /home/user/.ssh/id_dsa.pub.
The key fingerprint is:
ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff user@server.example.net
The key's randomart image is:
+--[ DSA 1024]----+
|.B+o . |
|.+= + . |
|o... . |
|.... |
| . .... S |
| .o+o . . |
| E += |
| ..o |
| . |
+-----------------+
[user@server ~]$

This will create folder /usr/home/.ssh if it do not exist, generate a password-less key /usr/home/.ssh/id_dsa, and a public key /usr/home/.ssh/id_dsa.pub.

Copy the id_dsa.pub key over to the remote server, remote:

[user@server ~]$ scp ~/.ssh/id_dsa.pub user@remote.example.net:~/.ssh/server.pub [enter]
The authenticity of host 'remote.example.net (192.168.1.3)' can't be established.
DSA key fingerprint is ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff.
Are you sure you want to continue connecting (yes/no)? yes [enter]
Warning: Permanently added 'remote.example.net' (DSA) to the list of known hosts.
Password: ******* [enter]
id_dsa.pub                                    100%  622     0.6KB/s   00:00    
[user@server ~]$

Next, log in to remote server, remote, as the user that will perform the ssh connections:

[user@server ~]$ ssh user@remote.example.net
Password: ******* [enter]
Last login: Thu May 22 20:47:16 2009 from server.example.net
Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994
 The Regents of the University of California. All rights reserved.

Welcome to remote.example.net/192.168.1.nn Running FreeBSD 11.0-RELEASE!
[user@remote ~]$

Add the public key from server to the list of authorized keys on remote with:

[user@remote ~]$ cat ~/.ssh/server.pub >> ~/.ssh/authorized_keys [enter]
[user@remote ~]$

..and to protect the file ‘authorized_keys file from beeng changed do:

[user@remote ~]$ chmod 640 ~/.ssh/authorized_keys [enter]
[user@remote ~]$

Delete the transferd key file with:

[user@remote ~]$ rm -f ~/.ssh/server.pub [enter]
[user@remote ~]$

At this point the remote server remote should accept a password-less login from local server server by the user user.

If the ssh connection is to be performed as user root the following extra configuration must be performed to permit root to login:

[root@server ~]$ su - [enter]
Password: ****** [enter]
[root@server /usr/home/user]#
[root@server /usr/home/user]# ee /etc/ssh/sshd_config [enter]

Go to line 45:

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6

…and edit line 45 to look like this:

# Authentication:

#LoginGraceTime 2m
PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6

Save file /etc/sshd_config and exit to local server server with:

[root@server /usr/home/user]# exit [enter]
logout
[techpc@remote ~]$ exit [enter]
Connection to remote.example.net closed.
[user@server ~]$

To verify that the password-less ssh login to the remote server remote from the local server, server, works:

[user@server ~]$ ssh user@remote.example.net

…should – without any password request – result in somthing like this example:

Last login: Sat Feb 19 16:32:09 2011 from 192.168.1.101
Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994
	The Regents of the University of California.  All rights reserved.

FreeBSD 11.0-RELEASE (GENERIC) #0: Mon Jul 19 02:36:49 UTC 2010

Welcome to remote.example.net running FreeBSD 8.1-RELEASE!
[user@remote ~]$

We have successfully logged on to remote!

Issue the following command to log out from remote server remote:

[user@remote ~]$ exit [enter]
Connection to remote.example.net closed.
[user@server ~]$

To backup directory /srv/test on remote server remote to local server server issue the following command, example:

[user@server ~]$ /usr/local/bin/rsync -aquz -e "ssh -l user" remote.example.net:/srv/test/ /srv/test/

rsync – synchronizing two file trees

This section describes how to use rsync to synchronize file trees on two servers.

Remote Server Setup

In this example, we’re going to be using a remote rsync server containing the file tree that we like to syncronize with.

On the remote server edit file /usr/local/etc/rsyncd.conf with:

[root@server /usr/home/user]# ee /usr/local/etc/rsyncd.conf [enter]

Edit file, example:

#
# rsyncd.conf
#
uid             = nobody
gid             = nobody
use chroot      = yes
max connections = 4
syslog facility = local5
pid file        = /var/run/rsyncd.pid

[example]
  path          = /srv/example/
  comment       = all of the example
  auth users    = tridge, susan
  secrets file  = /usr/local/etc/rsyncd.secrets

Make /usr/local/etc/rsyncd.conf non-world readable with:

[root@server /usr/home/user]# chmod 640 /usr/local/etc/rsyncd.conf [enter]
[root@server /usr/home/user]#

On the remote server create file /usr/local/etc/rsyncd.secrets with:

[root@server /usr/home/user]# ee /usr/local/etc/rsyncd.secrets [enter]

Edit file, example:

#
# rsyncd.secrets
#
tridge:mypass
susan:herpass

Make /usr/local/etc/rsyncd.secrets non-world readable with:

[root@server /usr/home/user]# chmod 640 /usr/local/etc/rsyncd.secrets [enter]
[root@server /usr/home/user]#

Local Server Setup

rsync should have been installed on the local server too.

Manually synchronize files using ssh with:

[root@server /usr/home/user]# rsync -e ssh -avz --delete susan@remote.example.net:example /srv/example [enter]
Password: ****** [enter]
receiving file list ... done
[root@server /usr/home/user]#

Additional Reading

Backup FreeNAS Files Remotely Using FreeBSD and rsync

phpSysInfo

phpSysInfo

Description

phpSysInfo is a PHP script that displays information about the host being accessed. It will displays things like Uptime, CPU, Memory, SCSI, IDE, PCI, Ethernet, Floppy, and Video Information.

WWW: http://phpsysinfo.github.io/phpsysinfo/.

Requirements

The following applications must be installed, configured and running:

  1. Apache HTTP Server
  2. PHP (v. 7.0)
  3. GNU wget

Preparation for Installation

Start PuTTY on a Windows PC, Terminal on a Mac or similar terminal application on a Linux PC.

In this example Terminal on a Mac is used.

Open a remote SSH session to the server with:

Mac:~ user$ ssh user@192.168.1.4 [enter]
N.B.: Replace user@192.168.1.4 with User ID and IP Address on Your server!
[user@server ~]$

Enable superuser privileges with:

[user@server ~]$ sudo -s [enter]
Password: <-- passwd [enter]
[root@server /usr/home/user]#

N.B.: Enter user password, not the root password!

Download

[root@server /usr/home/user]# wget https://github.com/phpsysinfo/phpsysinfo/archive/v3.2.7.tar.gz
--2017-02-20 19:03:01--  https://github.com/phpsysinfo/phpsysinfo/archive/v3.2.7.tar.gz
Resolving github.com (github.com)... 192.30.253.112, 192.30.253.113
Connecting to github.com (github.com)|192.30.253.112|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://codeload.github.com/phpsysinfo/phpsysinfo/tar.gz/v3.2.7 [following]
--2017-02-20 19:03:01--  https://codeload.github.com/phpsysinfo/phpsysinfo/tar.gz/v3.2.7
Resolving codeload.github.com (codeload.github.com)... 192.30.253.120, 192.30.253.121
Connecting to codeload.github.com (codeload.github.com)|192.30.253.120|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 986821 (964K) [application/x-gzip]
Saving to: ‘v3.2.7.tar.gz’

v3.2.7.tar.gz       100%[===================>] 963,69K   837KB/s    in 1,2s    

2017-02-20 19:03:03 (837 KB/s) - ‘v3.2.7.tar.gz’ saved [986821/986821]

[root@server /usr/home/user]#

Installation

Extract file v3.2.7.tar.gz to /usr/local/www/ with:

[root@server /usr/home/user]# tar -zxvf v3.2.7.tar.gz  -C /usr/local/www/ [enter]
[root@server /usr/home/user]#

Delete file v3.2.7.tar.gz with:

[root@server /usr/home/user]# rm v3.2.7.tar.gz [enter]
[root@server /usr/home/user]#

Install shared php extension php70-mbstring and php70-xml with:

[root@server /usr/home/user]# pkg install php70-mbstring php70-xml [enter]
[root@server /usr/home/user]#

Configuration

Create a configure file for phpSysInfo with:

[root@server /usr/home/user]# cp /usr/local/www/phpsysinfo-3.2.7/phpsysinfo.ini.new /usr/local/www/phpsysinfo-3.2.7/phpsysinfo.ini [enter]
[root@server /usr/home/user]#

Edit file /usr/local/www/phpsysinfo-3.2.7/phpsysinfo.ini if needed with: with:

[root@server /usr/home/user]# ee /usr/local/www/phpsysinfo-3.2.7/phpsysinfo.ini

To make phpsysinfo available through the local web site:

[root@server /usr/home/user]# ee /usr/local/etc/apache24/Includes/phpsysinfo.conf

…and add the following text:

Alias /phpsysinfo/ "/usr/local/www/phpsysinfo-3.2.7/"
<Directory "/usr/local/www/phpsysinfo-3.2.7/">
  AllowOverride All
  Require all granted
</Directory&gt

Restart apache24 with:

[root@server /usr/home/user]# service apache24 restart [enter]
Performing sanity check on apache24 configuration:
Syntax OK
Stopping apache24.
Waiting for PIDS: 1302.
Performing sanity check on apache24 configuration:
Syntax OK
Starting apache24.
[root@server /usr/home/user]#

How to use

Start a browser and go to URL: http://server.example.net/phpsysinfo/.

phpMyAdmin with PHP v. 7.0

phpMyAdmin with PHP v. 7.0

Description

phpMyAdmin is a free software tool written in PHP, intended to handle the administration of MySQL over the Web. phpMyAdmin supports a wide range of operations on MySQL and MariaDB. Frequently used operations (managing databases, tables, columns, relations, indexes, users, permissions, etc) can be performed via the user interface, while you still have the ability to directly execute any SQL statement.

WWW: http://www.phpmyadmin.net.

Requirentments

The following applications must be installed, configured and running before installation of phpMyAdmin:

Preparation for Installation

Start PuTTY on a Windows PC, Terminal on a Mac or similar terminal application on a Linux PC.

In this example Terminal on a Mac is used.

Open a remote SSH session to the server with:

Mac:~ user$ ssh user@192.168.1.4 [enter]
N.B.: Replace user@192.168.1.4 with User ID and IP Address on Your server!
[user@server ~]$

Enable superuser privileges with:

[user@server ~]$ sudo -s [enter]
Password: <-- passwd [enter]
[root@server /usr/home/user]#

N.B.: Enter user password, not the root password!

Warning!

N.B.: Do NOT install phpMyAdmin from port if the PHP version installed is > 5.6!

Verify version of PHP installed with:

[root@server /usr/home/user]# php -v [enter]
PHP 7.0.15 (cli) (built: Jan 24 2017 01:18:59) ( NTS )
Copyright (c) 1997-2017 The PHP Group
Zend Engine v3.0.0, Copyright (c) 1998-2017 Zend Technologies
    with Zend OPcache v7.0.15, Copyright (c) 1999-2017, by Zend Technologies
[root@server /usr/home/user]#

In this example PHP version 7.0 is installed. Due to this phpMyAdmin will be downloaded from the phpMyAdmin site.

Download and Verification

[root@server /usr/home/user]# wget https://files.phpmyadmin.net/phpMyAdmin/4.6.6/phpMyAdmin-4.6.6-all-languages.zip [enter]
Resolving files.phpmyadmin.net (files.phpmyadmin.net)... 185.59.222.19
Connecting to files.phpmyadmin.net (files.phpmyadmin.net)|185.59.222.19|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 11349727 (11M) [application/zip]
Saving to: ‘phpMyAdmin-4.6.6-all-languages.zip’

phpMyAdmin-4.6.6-al 100%[===================>]  10,82M  2,62MB/s    in 4,3s    

2017-02-22 00:00:00 (2,55 MB/s) - ‘phpMyAdmin-4.6.6-all-languages.zip’ saved [11349727/11349727]

[root@server /usr/home/user]#
[root@server /usr/home/user]# wget https://files.phpmyadmin.net/phpMyAdmin/4.6.6/phpMyAdmin-4.6.6-all-languages.zip.asc [enter]
--2017-02-22 12:12:36--  https://files.phpmyadmin.net/phpMyAdmin/4.6.6/phpMyAdmin-4.6.6-all-languages.zip.asc
Resolving files.phpmyadmin.net (files.phpmyadmin.net)... 185.76.9.11
Connecting to files.phpmyadmin.net (files.phpmyadmin.net)|185.76.9.11|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 819 [application/octet-stream]
Saving to: ‘phpMyAdmin-4.6.6-all-languages.zip.asc’

phpMyAdmin-4.6.6-al 100%[===================>]     819  --.-KB/s    in 0s      

2017-02-22 00:00:00 (61,9 MB/s) - ‘phpMyAdmin-4.6.6-all-languages.zip.asc’ saved [819/819]
[root@server /usr/home/user]#

Download the keyring from the phpMyAdmin download server with:

[root@server /usr/home/user]# wget https://files.phpmyadmin.net/phpmyadmin.keyring [enter]
--2017-02-22 12:49:01--  https://files.phpmyadmin.net/phpmyadmin.keyring
Resolving files.phpmyadmin.net (files.phpmyadmin.net)... 185.76.9.11
Connecting to files.phpmyadmin.net (files.phpmyadmin.net)|185.76.9.11|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 34198 (33K) [application/octet-stream]
Saving to: ‘phpmyadmin.keyring’

phpmyadmin.keyring  100%[===================>]  33,40K  --.-KB/s    in 0,006s  

2017-02-22 00:00:00 (5,27 MB/s) - ‘phpmyadmin.keyring’ saved [34198/34198]
[root@server /usr/home/user]#

…and then import the keyring data with:

[root@server /usr/home/user]# gpg --import phpmyadmin.keyring [enter]
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key 9C27B31342B7511D: public key "Michal Čihař <michal@cihar.com>" imported
gpg: key FEFC65D181AF644A: public key "Marc Delisle <marc@infomarc.info>" imported
gpg: key CE752F178259BD92: public key "Isaac Bennetch <bennetch@gmail.com>" imported
gpg: key DA68AB39218AB947: public key "phpMyAdmin Security Team <security@phpmyadmin.net>" imported
gpg: Total number processed: 4
gpg:               imported: 4
[root@server /usr/home/user]#

N.B.: Verify the public keys corresponds with the information publiced the phpMyAdmin web site: Verifying phpMyAdmin releases.

[root@server /usr/home/user]# gpg --verify phpMyAdmin-4.6.6-all-languages.zip.asc [enter]
gpg: assuming signed data in 'phpMyAdmin-4.6.6-all-languages.zip'
gpg: Signature made Mon 23 Jan 20:22:46 2017 CET
gpg:                using RSA key CE752F178259BD92
gpg: Good signature from "Isaac Bennetch <bennetch@gmail.com>" [unknown]
gpg:                 aka "Isaac Bennetch <isaac@bennetch.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 3D06 A59E CE73 0EB7 1B51  1C17 CE75 2F17 8259 BD92
[root@server /usr/home/user]#

Beginning in January 2016, the release manager for phpMyAdmin is Isaac Bennetch. His RSA key id is:

CE752F178259BD92

…and his PGP primary key fingerprint is:

3D06 A59E CE73 0EB7 1B51 1C17 CE75 2F17 8259 BD92

You should verify that the signature matches the archive you have downloaded. This way you can be sure that you are using the same code that was released. You should also verify the date of the signature to make sure that you downloaded the latest version.

Installation

Extract file phpMyAdmin-4.6.6-all-languages.zip to /usr/local/www/ with:

[root@server /usr/home/user]# unzip phpMyAdmin-4.6.6-all-languages.zip  -d /usr/local/www [enter]
Archive:  phpMyAdmin-4.6.6-all-languages.zip
   creating: /usr/local/www/phpMyAdmin-4.6.6-all-languages/
 extracting: /usr/local/www/phpMyAdmin-4.6.6-all-languages/CONTRIBUTING.md  
 extracting: /usr/local/www/phpMyAdmin-4.6.6-all-languages/ChangeLog  
 extracting: /usr/local/www/phpMyAdmin-4.6.6-all-languages/DCO  
 extracting: /usr/local/www/phpMyAdmin-4.6.6-all-languages/LICENSE  
 extracting: /usr/local/www/phpMyAdmin-4.6.6-all-languages/README  
 extracting: /usr/local/www/phpMyAdmin-4.6.6-all-languages/RELEASE-DATE-4.6.6  
.
.
.
 extracting: /usr/local/www/phpMyAdmin-4.6.6-all-languages/url.php  
 extracting: /usr/local/www/phpMyAdmin-4.6.6-all-languages/user_password.php  
 extracting: /usr/local/www/phpMyAdmin-4.6.6-all-languages/version_check.php  
 extracting: /usr/local/www/phpMyAdmin-4.6.6-all-languages/view_create.php  
 extracting: /usr/local/www/phpMyAdmin-4.6.6-all-languages/view_operations.ph  |
[root@server /usr/home/user]#

Delete file phpMyAdmin-4.6.6-all-languages.zip with:

[root@server /usr/home/user]# rm phpMyAdmin-4.6.6-all-languages.zip [enter]
[root@server /usr/home/user]#

Rename folder /usr/local/www/phpMyAdmin-4.6.6-all-languages to /usr/local/www/phpMyAdmin with:

[root@server /usr/home/user]# mv /usr/local/www/phpMyAdmin-4.6.6-all-languages /usr/local/www/phpMyAdmin [enter]
[root@server /usr/home/user]#

N.B.: Only not installed required PHP shared extension will be installed with the following command!

Install shared PHP extension required by phpMyAdmin with:

[root@server /usr/home/user]# pkg install php70-session php70-xml php70-bz2 php70-ctype php70-filter php70-zip php70-openssl php70-gd php70-mcrypt php70-mbstring php70-mysqli php70-json php70-zlib [enter]
Updating FreeBSD repository catalogue...
FreeBSD repository is up-to-date.
All repositories are up-to-date.
The following 9 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
	php70-session: 7.0.15
	php70-bz2: 7.0.15
	php70-ctype: 7.0.15
	php70-openssl: 7.0.15
	php70-mcrypt: 7.0.15
	php70-mbstring: 7.0.15
	php70-json: 7.0.15
	libltdl: 2.4.6
	libmcrypt: 2.5.8_3

Number of packages to be installed: 9

The process will require 5 MiB more space.
988 KiB to be downloaded.

Proceed with this action? [y/N]: y [enter]
Fetching php70-session-7.0.15.txz: 100%   32 KiB  32.3kB/s    00:01    
Fetching php70-bz2-7.0.15.txz: 100%   11 KiB  11.0kB/s    00:01    
Fetching php70-ctype-7.0.15.txz: 100%    7 KiB   6.8kB/s    00:01    
Fetching php70-openssl-7.0.15.txz: 100%   44 KiB  44.7kB/s    00:01    
Fetching php70-mcrypt-7.0.15.txz: 100%   15 KiB  14.9kB/s    00:01    
Fetching php70-mbstring-7.0.15.txz: 100%  712 KiB 728.9kB/s    00:01    
Fetching php70-json-7.0.15.txz: 100%   19 KiB  19.9kB/s    00:01    
Fetching libltdl-2.4.6.txz: 100%   36 KiB  36.6kB/s    00:01    
Fetching libmcrypt-2.5.8_3.txz: 100%  114 KiB 116.9kB/s    00:01    
Checking integrity... done (0 conflicting)
[1/9] Installing libltdl-2.4.6...
[1/9] Extracting libltdl-2.4.6: 100%
[2/9] Installing libmcrypt-2.5.8_3...
[2/9] Extracting libmcrypt-2.5.8_3: 100%
[3/9] Installing php70-session-7.0.15...
[3/9] Extracting php70-session-7.0.15: 100%
[4/9] Installing php70-bz2-7.0.15...
[4/9] Extracting php70-bz2-7.0.15: 100%
[5/9] Installing php70-ctype-7.0.15...
[5/9] Extracting php70-ctype-7.0.15: 100%
[6/9] Installing php70-openssl-7.0.15...
[6/9] Extracting php70-openssl-7.0.15: 100%
[7/9] Installing php70-mcrypt-7.0.15...
[7/9] Extracting php70-mcrypt-7.0.15: 100%
[8/9] Installing php70-mbstring-7.0.15...
[8/9] Extracting php70-mbstring-7.0.15: 100%
[9/9] Installing php70-json-7.0.15...
[9/9] Extracting php70-json-7.0.15: 100%
Message from libmcrypt-2.5.8_3:
===>   NOTICE:

The libmcrypt port currently does not have a maintainer. As a result, it is
more likely to have unresolved issues, not be up-to-date, or even be removed in
the future. To volunteer to maintain this port, please create an issue at:

https://bugs.freebsd.org/bugzilla

More information about port maintainership is available at:

https://www.freebsd.org/doc/en/articles/contributing/ports-contributing.html#maintain-port
Message from php70-session-7.0.15:
****************************************************************************

The following line has been added to your /usr/local/etc/php/ext-18-session.ini
configuration file to automatically load the installed extension:

extension=session.so

****************************************************************************
Message from php70-bz2-7.0.15:
****************************************************************************

The following line has been added to your /usr/local/etc/php/ext-20-bz2.ini
configuration file to automatically load the installed extension:

extension=bz2.so

****************************************************************************
Message from php70-ctype-7.0.15:
****************************************************************************

The following line has been added to your /usr/local/etc/php/ext-20-ctype.ini
configuration file to automatically load the installed extension:

extension=ctype.so

****************************************************************************
Message from php70-openssl-7.0.15:
****************************************************************************

The following line has been added to your /usr/local/etc/php/ext-20-openssl.ini
configuration file to automatically load the installed extension:

extension=openssl.so

****************************************************************************
Message from php70-mcrypt-7.0.15:
****************************************************************************

The following line has been added to your /usr/local/etc/php/ext-20-mcrypt.ini
configuration file to automatically load the installed extension:

extension=mcrypt.so

****************************************************************************
Message from php70-mbstring-7.0.15:
****************************************************************************

The following line has been added to your /usr/local/etc/php/ext-20-mbstring.ini
configuration file to automatically load the installed extension:

extension=mbstring.so

****************************************************************************
Message from php70-json-7.0.15:
****************************************************************************

The following line has been added to your /usr/local/etc/php/ext-20-json.ini
configuration file to automatically load the installed extension:

extension=json.so

****************************************************************************
[root@server /usr/home/user]#

Configuration

Change file owner and group recursively for /usr/local/www/phpMyAdmin with:

[root@server /usr/home/user]# chown -R www:www /usr/local/www/phpMyAdmin [enter]
[root@server /usr/home/user]#

To make phpMyAdmin available on the web site:

[root@server /usr/home/user]# ee /usr/local/etc/apache24/Includes/phpmyadmin.conf [enter]

Add the following lines;

Alias /phpmyadmin/ "/usr/local/www/phpMyAdmin/"
<Directory "/usr/local/www/phpMyAdmin/">
  AllowOverride All
  Require all granted
</Directory>

…the restart the apache24 service with:

[root@server /usr/home/user]# service apache24 restart [enter]
Performing sanity check on apache24 configuration:
Syntax OK
Stopping apache24.
Waiting for PIDS: 12555.
Performing sanity check on apache24 configuration:
Syntax OK
Starting apache24.
[root@server /usr/home/user]#

N.B.: The phpMyAdmin documentation is stored on your server at: http://www.example.com/phpmyadmin/doc/html/!

Start your browser and go to: http://server.example.net/phpmyadmin/setup/

Login as the MySQL root user and complete the configured by enabling the phpMyAdmin extended features.

Create file /usr/local/www/phpMyAdmin/config.inc.php with:

[root@server /usr/home/user]# ee /usr/local/www/phpMyAdmin/config.inc.php [enter]

…and copy the following text – example – that was created for you:

<?php
/*
 * Generated configuration file
 * Generated by: phpMyAdmin 4.6.6 setup script
 * Date: Tue, 22 Feb 2017 00:00:00 +0000
 */

/* Servers configuration */
$i = 0;

/* Server: localhost [1] */
$i++;
$cfg['Servers'][$i]['verbose'] = '';
$cfg['Servers'][$i]['host'] = 'localhost';
$cfg['Servers'][$i]['port'] = '';
$cfg['Servers'][$i]['socket'] = '';
$cfg['Servers'][$i]['ssl'] = true;
$cfg['Servers'][$i]['connect_type'] = 'tcp';
$cfg['Servers'][$i]['compress'] = true;
$cfg['Servers'][$i]['auth_type'] = 'cookie';
$cfg['Servers'][$i]['user'] = 'root';
$cfg['Servers'][$i]['password'] = '';

/* End of servers configuration */

$cfg['blowfish_secret'] = '----------------------------------';
$cfg['DefaultLang'] = 'en';
$cfg['ServerDefault'] = 1;
$cfg['UploadDir'] = '';
$cfg['SaveDir'] = '';
?>