Linux for MacSysAdmins

Introduction
The demos in this session are intended to provide you with my basic methods for getting started with Linux. The techniques demonstrated have have yielded consistent, reliable results for me. As there are so many possibilities there may be alternate ways to do things that work better for you.

Demo 1: Using VMware Fusion to set up a 'Minimal Desktop'

Create a New Virtual Machine in VMware Fusion.

Drag the Intallation ISO for your chosen Linux distribution (we are using CentOS) to the initial window.

Setup should detect the Linux Distribtion you are using, simply click Continue.

Verify the Operating System has been correctly identified, if not change the OS and/or Version.

The Easy Install will help us get started quickly, add user details (we are using Local Administrator / localadmin) and optionally Read & Write access to your home folder.
Note: Easy Install will install VMware Tools.

This is all you need to do to get started, but if you wish to ultimately transfer this VM to an ESXi host a few additional steps are required.

Click Customize Settings and save your VM.

Select the Network Adapter and change it to Bridged Networking, Autodetect.

Select the Hard Disk, Advanced options and un-check Split into 2 GB files
Note: If you do not intend to add this VM to an ESXi host and do not have an SSD in your system, it is not recommended to do this, as performance will be heavily impacted on your VMware Fusion host.

Start the Virtual Machine and simply watch it perform the installation for you.

When its finished you will be greeted with the Screen below:

	Fig 1: Image of the CentOS login window.

There are a few simple post-install tasks you should perform, as the Easy Install makes some assumptions on your behalf.

Log into your VM with the credentials you supplied during the installation process.

From the System menu, select Administration > Date & Time.
You will be prompted for the root password, which is the same as the password for your user account, similar to Mac OS X Server 10.6.x and earlier.

Once authenticated, you may choose to syncronise the date and time with a network time server.
Click the Time Zone tab an select the nearest location to you.
Note: By default the system clock is set to use UTC, which will be displayed in the menu bar, if you wish to see your local time, simply un-check this.

Click the clock in the menu bar and click Edit Locations.
Select Boston America/New_York and click Remove.

Finally we should (for security purposes)  allow sudo access for the user account created during the Easy Install, so you don't have to use the root account.

From the Applications menu, select System Tools > Terminal.
Escalate to root by typing:
su -
Enter the root password.

To edit the sudoers file, type:
visduo

This will invoke a vi-like editor and open the sudoers file. Scroll down and locate the following lines:
## Allow root to run any commands anywhere
root    ALL=(ALL)    ALL

Place the cursor immediately after this line, press i (for insert) and type the following:
localadmin    ALL=(ALL)    ALL

Press the esc key to finish editing, then quit and write out the file by typing:
:wq

You may now switch back to the localadmin account by typing logout or pressing ctl-d

Congratulations, you now have a basic Linux desktop to play with!

---

As you now have a basic system, you will want to do something with it. In order to do this you will need to know how to install additional software (and most likely) add additional software repositories for titles not contained within the basic CentOS repository.

The main tools for performing this task in Red Hat style distributions are rpm (Red Hat Package Manager) and yum (Yellow Dog Update Manager), while both perform dependency checks, the latter will install all the software required for packages you select, making things easier.

There is a comprehensive article on the CentOS website, which provides guidelines for adding additional repositories:
	http://wiki.centos.org/AdditionalResources/Repositories

Some common repositories which I use are:

	Extra Packages for Enterprise Linux (EPEL)
		http://fedoraproject.org/wiki/EPEL

	Adobe Repository
		http://get.adobe.com/flashplayer/otherversions/

	Webmin (Web-based Management UI)
		http://www.webmin.com/rpm.html

Demo 2: Adding a repository, installing additional software.

In order to use the vSphere web client we will need to install Adobe Flash Player.

First we need to install the repository package using rpm, in a terminal type:
sudo rpm -i -p http://linuxdownload.adobe.com/linux/i386/adobe-release-i386-1.0-1.noarch.rpm

Now we need to know our package name, the following command will list any packages containing 'flash'
yum list *flash*

We can see from the output of the previous command our package name is 'flash-player'. Now we can simply install the package using yum:
sudo yum install flash-plugin
	
In the demo, we downloaded the Client Integration Plug-in for vCenter 5.1. When double-clicked the bundle file attempted to open with GEdit (the equivalent of TextEdit).

Using the file command in the terminal it lets us know the file is an executable:
file '/home/localadmin/Downloads/VMware-ClientIntegrationPlugin-5.1.0.i386.bundle'

So we need to invoke the installer form the command line, which is to simple execute the bundle using the shell:
sudo sh '/home/localadmin/Downloads/VMware-ClientIntegrationPlugin-5.1.0.i386.bundle'

Once the installation is complete the bundle can be deleted.

We now have the ability to use the VMware Client through the web browser on Linux.

Demo 3: Configuring the Kerio Connect Appliance

The original reference for this demo comes directly from Kerio's knowledgebase, but I've found the article to be a little confusing and sometimes out of order, so this is the way I configure the Kerio apliance once its been deployed.
Its also a good way to highlight some of the key differences between the Red Hat family of distributions (Demo 1 & 2) and the Debian family (the Kerio Connect appliance).
Due to time constraints not all of the processes describedwere performed in the Demo, but to provide a complete reference point they have been detailed in this document.

The Kerio knowledgebase article can be found at:
	http://kb.kerio.com/article.php?id=784

In this example we're using the following settings, which are pre-configured in our AD server:
	AD Server:	ad.macsysadmin.private
	AD Server IP:	172.16.223.222
	AD Domain:	macsysadmin.private
	DNS Name:	kerio.macsysadmin.private
	IP Address:	172.16.223.223

Note: The AD server also has the Kerio Active Directory Extensions installed

First we log into the vSphere Client power on and open the console to our Kerio appliance.
Perform initial setup within the console window, with the following information:

The username you are prompted for is the account you will use to administer the Kerio appliance from the web interface.
Username: kadmin
Note: The Kerio appliance has the ability to enable an in-built administrator account (named Admin) which doesn't use a mailbox. If you create the default Admin account at the setup assistant, you will have to mess around with multiple administrator accounts in order the activate th in-built one.

Email domain: macsysadmin.private

Internet hostname: kerio.macsysadmin.private

Store directory:	/opt/kerio/mailserver/store
Note: The store directory should be left at its default, we will manipulate this later

When the initial setup is complete, log into the console (default passowrd is kerio) and perform the following tasks:
	- Network Configuration (Assign IP Address: 172.16.223.223, DNS Server: 172.16.223.222)
	- SSH Settings (Enable SSH)
	- Time Zone Settings (Set the default time zone)

Once the initial steps are performed in the console you can now log in using ssh from a local terminal, making it a lot easier to copy and paste commands into the shell, rather than typing them in the vSphere Console.
ssh root@172.16.223.223
You will log in with the default password you used for the console (not the one you entered in the setup assistant).
The appliance will request you change the root password, do so, but do not forget it.

Now we need to set the correct Hostname, which is done by editing 2 of the system config files:
The first contains the simple hostname of the appliance
nano /etc/hostname
/etc/hostname should contain the unqualified server name
Edit the line:
kerio-connect-appliance
So it reads:
kerio

The second contains the self-referencing record for the fully-qualified name of the appliance
nano /etc/hosts
/etc/hosts should contain the fqdn and the unqualified name
Edit the line:
127.0.1.1        kerio-connect-appliance
So it reads:
127.0.1.1        kerio.macsysadmin.private kerio

Debian, like windows needs to restart after renaming the computer, so type:
reboot
Note: after reboot youwill need to re-connect via ssh again.

After restart you can verify the new hostname, by typing:
hostname -f
which should return the FQDN you assigned to the appliance, in this case:
kerio.macsysadmin.private

Something I've noticed with the Kerio appliance, when working from the terminal in OS X 10.7 or later is the current system locale isn't passed through, which can have an unusual effect on the auto-configure of packages when they're installed.
To ensure this doesn't cause you any issues, it's best to verify that your OS X Locale is installed on the appliance.
Open a new Terminal window on your local system and type the following command:
defaults read ~/Library/Preferences/.GlobalPreferences AppleLocale
It should return the current system locale, mine is:
en_AU

We now need to ensure this is enabled in the Appliance, using the package configuration tool in Debian:
dpkg-reconfigure locales

Scroll through the list and enable the UTF-8 version of your local system locale, if it's not surrently enabled
Press tab to exit the list, select OK and press enter.
In the next screen highlight your system locale and press enter.
The local list will re-generate, and any auto-configuration of packages we install from here on won't complain or fail.

We now need to install Kerberos 5 and join the AD Kerberos Realm

The primary installation tool in the Debain-based linux distributions is apt-get (Advanced Package Toolkit)

First we need to update apt-get itself, so that it can locate installation mirrors, type the following:
apt-get update

Now we can install the required Kerberos 5 packages:
apt-get install krb5-clients krb5-config krb5-user
	
There is a section in the Kerio Admin Guide relating to Kerberos Configuration, which is at:
	http://manuals.kerio.com/connect/adminguide/en/sect-krblin.html

The simple way to achieve what we need is to edit the krb5.conf file so it's correct. Type the following:
nano /etc/krb5.conf

Delete all of the existing text (ctrl-k, will delete lines) and paste the following into the file:

[logging]
	default = FILE:/var/log/krb5libs.log
	kdc = FILE:/var/log/krb5kdc.log
	admin_server = FILE:/var/log/kadmind.log

[libdefaults]
	ticket_lifetime = 36000
	default_realm = MACSYSADMIN.PRIVATE
	dns_lookup_realm = false
	dns_lookup_kdc = yes

[realms]
	MACSYSADMIN.PRIVATE = {
		kdc = ad.macsysadmin.private
		admin_server = ad.macsysadmin.private
		default_domain = macsysadmin.private
	}

[domain_realm]
	.macsysadmin.private = MACSYSADMIN.PRIVATE
	macsysadmin.private = MACSYSADMIN.PRIVATE

[kdc]
	profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]
	pam = {
		debug = false
		ticket_lifetime = 36000
		renew_lifetime = 36000
		forwardable = true
		krb4_convert = false
	}

All that remains is to create the appropriate AD components.
Log into the AD server and open Active Directory Users and Computers
Select your AD domain (macsysadmin.private)
Select the Computers container
Right-click in the window and choose New > Computer from the contextual menu
Name the computer object kerio
Click OK to close the window and save the object.
Open Command Prompt
Type the following to create a Kerberos service principal:
setspn.exe –R kerio
It should return the following text if DNS and the krb5.conf file are correct on the Appliance:
Registering ServicePrincipalNames for CN=kerio,CN=Computers,DC=macsysadmin,DC=private
	HOST/kerio.macsysadmin.private
	HOST/kerio 
Updated object
Log out of the AD server.

Return to the ssh session to the Kerio Appliance and type the following to test Kerberos:
kinit -S host/kerio.macsysadmin.private@MACSYSADMIN.PRIVATE Administrator

You will be prompted for the AD Administrator credentials, if everything is OK, the cursor should return to the next line, with Kerberos' no news is good news response.

Log into the Kerio Admin Console
https://172.16.223.223:4040
Use the credentials you entered during the setup assistant, ie. kadmin and the password
Dismiss the initial setup dialogs and navigate to:
Configuration > Domains > macsysadmin.private
Double-click the domain and select the Directory Service tab
Check the box to map users and groups from directory service
Ensure Microsoft Active Directory is selected
Enter the information in the fields below
Hostname:	ad.macsysadmin.private
Username:	Administrator
Password:	<AD Administrator's Password>
Click Test Connection, and you should get a success notification.

To enable the built-in administrator account and re-claim the mailbox from the initial setup, navigate to:
Configuration > Administration Settings
Enable the account and set the password.
Log out of the web interface and log back in with admin and the password you just set.
Navigate to:
Accounts > Users
Delete the mailbox from the original setup (kadmin).

You may also want to install ClamAV if you haven't purchased a license for the Integrated Sophos engine or you wish to have to antivirus programs checking mail for additional security.
The following is for the current Debain appliance, the generic instructions can be found at:
	http://kb.kerio.com/article.php?id=282

To install ClamAV return to the ssh session and type: 
apt-get install clamav-daemon

Edit the ClamAV configuration file (/etc/clamav/clamd.conf)

Ensure the following lines are commented out:
#LocalSocket /var/run/clamav/clamd.ctl
#FixStaleSocket true

Ensure the following entries exist and aren't commented out:
PidFile /var/run/clamav/clamd.pid
LogFile /var/log/clamav/clamav.log
TCPSocket 3310
TCPAddr 127.0.0.1
User clamav
DetectPUA true
DetectBrokenExecutables true
HeuristicScanPrecedence true
ArchiveBlockEncrypted true
StreamMaxLength 30M

Start the ClamAV daemon with the following command:
/etc/init.d/clamav-daemon start

In the web interface, navigate to:
Configuration > Content Filter > Antivirus
Check the /usr/sbin/clamd check box and select Clam AntiVirus from the drop-down menu

The Kerio Appliance is configured with very little disk space, so it is necessary to add some additional storage to the VM and configure kerio to use it.

Shut down the appliance from the Hypervisor
At this point in time, take a snapshot, so you can roll back if anything goes wrong.
Add a new hard drive of appropriate size to the VM, ensure there will be enough room to grow.
Start the Appliance back up and log in via ssh.

To verify the new hard disk is present, type:
fdisk -l
You should see that the disk at /dev/sdb is being picked up but there are no partitions yet for this drive.

Create a new partition on your new drive:
cfdisk /dev/sdb

The cfdisk controller will load up and here you can create a new partition on your drive. From the menus at the bottom select the following:
1. New > Primary > Size in MB
2. Once done select Write
3. Select Quit

Your new partition will be created at /dev/sdb1

Format the new disk:
mkfs.ext3 /dev/sdb1

This will now format our partition with the ext3 filesystem which should work fine for your Debian system.

Mount the new drive:
mkdir /store
mount -t ext3 /dev/sdb1 /store

The above commands create a new directory for the drive to be mounted in and then we mount the drive to this directory. To check that the drive has been mounted run the following:
ls -lsa /store

Everything is now up and running however we need to add our new drive to /etc/fstab so that it will be mounted automatically when the server is rebooted.

Edit fstab:
nano /etc/fstab
At the end of the file add the following line:
/dev/sdb1 /store ext3 defaults,errors=remount-ro 0 1

Now we need to move existing message store to the new disk

Stop Kerio Conect server:
/etc/init.d/kerio-connect stop

Copy all data from old message store:
cp -R -p /opt/kerio/mailserver/store /store

Change message store directory path in Kerio Connect configuration:
sed -i -e "s/\/opt\/kerio\/mailserver\/store/\/store/" /opt/kerio/mailserver/mailserver.cfg

Start Kerio Connect:
/etc/init.d/kerio-connect start

We will want to set log rotation up, so the boot volume doesn't fill with log files.
This can be done by following the steps at:
	http://manuals.kerio.com/connect/adminguide/en/sect-setlogs.html

Finally we are ready to import our users from AD, detailed instructions are available at:
	http://manuals.kerio.com/connect/adminguide/en/sect-mapad.html

If you need to update the version of Kerio installed in the future, you can download the update from kerio and install with the following commands (note the commands are for the current version, the package name and url will change in future releases):
cd /tmp
wget http://download.kerio.com/dwn/connect/connect-7.4.3-7813/kerio-connect-7.4.3-7813-linux.deb
/etc/init.d/kerio-connect stop
dpkg –i kerio-connect-7.4.3-7813-linux.deb
/etc/init.d/kerio-connect start
rm kerio-connect-7.4.3-7813-linux.deb

Demo 5: Building a JeOS Appliance Base

This is the process I use to create a minimal system with a Web-based UI for further configuration and management, essentially it is 'my' JeOS base for most of the Appliances I create and deploy.

Note in the demo I installed the nano text editor, in these notes I use vi.

In VMware Fusion, create a new VM, with the following settings:
	Uncheck Easy Install
	Reduce RAM to 512 MB
	Set the Network Configuration to Bridged
	Uncheck Split into 2 GB files for the Hard Disk
	Remove Sound Card
	Remove USB Controller
	Remove Printer Port

Start up the VM and perform a minimal install from DVD.

Once installed and restarted log in with root and the password you set during setup

Activate network with the following commands:
ifup eth0
ifconfig
Note the IP Address returned by the ifconfig command

Connect to the VM using ssh
ssh root@<IPAddress>

Set the Ethernet interface to activate at startup
vi /etc/sysconfig/network-scripts/ifcfg-eth0

Change line:
ONBOOT="no"
to
ONBOOT="yes"

Add the Webmin YUM Repository
vi /etc/yum.repos.d/webmin.repo

Paste the following text into the file created:
[Webmin]
name=Webmin Distribution Neutral
#baseurl=http://download.webmin.com/download/yum
mirrorlist=http://download.webmin.com/download/yum/mirrorlist
enabled=1
Save and close the file.

Add the Webmin GPG key with which the packages are signed
Download the key:
curl -O http://www.webmin.com/jcameron-key.asc
Import the key:
rpm --import jcameron-key.asc

Install Webmin using yum
yum install webmin

Setup Webmin (accept the defaults):
/usr/libexec/webmin/setup.sh

Cento 6 and later have the firewall enabled by default in the minimal install, so you will need to configure it to allow connection to the webmin interface.

The simplest way to do so is to install the text-based firewall configuration utility:
yum install system-config-firewall-tui

Start the config utility:
system-config-firewall-tui

Add a rule to allow connection on TCP port 10000

You should now be able to connect using a browser and log in with the root account for the system.
	http://<IPAddress>:10000

There is a document in the Webmin reference library on Securing Webmin, for the security conscious.
	http://doxfer.webmin.com/Webmin/SecuringWebmin

The simple way to do it is to log into the Webmin interface

In the menu on the left navigate to:
Others > Perl Modules 

Choose to install a module From CPAN, named: Net::SSLeay
When the Install is complete, navigate to:
Webmin > Webmin Configuration > SSL Encryption

You can now connect your browser using SSL
	https://<IPAddress>:10000

If you need to update any Webmin modules, you can do so, by navigating to:
System Information > Install Updates Now

If you want to update System components or installed packages, navigate to:
System Information > XX package updates are available

To set the System's Hostname, navigate to:
Networking > Network Configuration > Hostname and DNS Client

If deploying to a ESXi host you may want to install VMware Tools. While the VM is running choose Install VMware Tools from the Virtual Machine menu

In your ssh session, do the following:
Mount the VMware Tools CD:
mount /dev/cdrom /media

Extract the VMware Tools tarball to the tmp directory:
tar -xzf /media/VMwareTools-9.2.1-818201.tar.gz -C /tmp
Note: The filename may vary with different versions of VMware (this is for Fusion 5.0.1)

Unmont the VMware Tools CD:
umount /media

Install VMware Tools:
/tmp/vmware-tools-distrib/vmware-install.pl

Remove the temporary files:
rm -rf /tmp/vmware-tools-distrib

Shut down the VM and remove the CD/DVD drive

You now have a minimal appliance which can be used as a base for creating your own appliances.