System Administration 2018/19 spring

Before you continue log into ETAIS https://minu.etais.ee -> Select your project -> Resources -> Virtual Machines -> Click on your machine name -> Backups -> Create

• Identify correct path and name of your secondary @@1GB disk
  • # lsblk
  • 
• Now we need to configure (format) it before we can use it.
  • # fdisk /dev/vdb
  • hit o to create a new empty DOS partition table
  • hit n to add a new partition
  • hit p to select primary type
  • hit 1 - Partition number (1-4, default 1):
  • hit 2048 - First sector (2048-2097151, default 2048)
  • hit ENTER if asked Last sector, +sectors or +size{K,M,G,T,P} (2048-2097151, default 2097151):
  • hit w to write table to disk and exit
• # mkfs.ext4 /dev/vdb1
• # mkdir /mnt/vdb1
• # mount -t ext4 /dev/vdb1 /mnt/vdb1

• Install quota package
• Initialize the user quotas on newly created file system
  • Edit the /etc/fstab and add mount point to /dev/vdb1 with usrquota parameter enabled.

  • /dev/vdb1       /mnt/vdb1       ext4    errors=remount-ro,usrquota,grpquota 0 1
    

• remount the /mnt/vdb1 file system with mount -o remount /mnt/vdb1 command
• Perform a quotacheck wit quotacheck -cugm /mnt/vdb1 command
• Turn on quotas by running quotaon /mnt/vdb1

• Create new user account called dataguy (use adduser command)

Now we can change dataguy UID and GID to 2001 (they dont have to match but we like to keep them same)

• # usermod -u 2001 dataguy
• # groupmod -g 2001 dataguy

Following two command finds all files with old UID and GID and changes them to new ones. PS! <...ID> fields needs to be modified with correct parameters.

• # find / -user <OLDUID> -exec chown -h <NEWUID> {} \;
• # find / -group <OLDGID> -exec chgrp -h <NEWGID> {} \;

i.e. in teacher correct commands looked like this

• # find / -user 1005 -exec chown -h 2001 {} \;
• # find / -group 1005 -exec chgrp -h 2001 {} \;

Finally lets update dataguy group memberships status.

• # usermod -g 2001 dataguy

• Set the quotas for dataguy with a command edquota dataguy
  • You can exit the editor with CTRL-K then q followed by y key combination
  • Set the soft quota of user dataguy to 10MB (10240kB)
  • Set the hard quota of user dataguy to 20MB (20480kB)

• Install samba server and client packages

# apt install samba smbclient

• Main samba configuration file is /etc/samba/smb.conf, what contains numerous parameters whose explanation can be read from man pages man smb.conf.

# nano /etc/samba/smb.conf

• Most default parameters are very good, but add two new shares by adding a new blocks at the end

 [smbshare]
    comment = Some files from folder /mnt/vdb1/data/rw
    writable = yes
    locking = no
    path = /mnt/vdb1/data/rw
    guest ok = no
    browseable = yes

 [smbreadonly]
   comment = Some files from folder /mnt/vdb1/data/ro
   read only = yes
   locking = no
   path = /mnt/vdb1/data/ro
   guest ok = yes
   browseable = yes

• Now lets create those folders we specified earlier in the configuration.

# mkdir -p /mnt/vdb1/data/rw
# mkdir -p /mnt/vdb1/data/ro
# chown -R dataguy:users /mnt/vdb1/data/rw
# chown -R dataguy:users /mnt/vdb1/data/ro
# chmod -R ug+rwx,o+rx-w /mnt/vdb1/data/rw
# chmod -R u+rwx,go+rx-w /mnt/vdb1/data/ro

Now lets add user dataguy to users group

# usermod -a -G users dataguy

• Samba uses it's own password system so users need to be added by root with a command # smbpasswd -a <user> . Note that the users have to exist in /etc/passwd.

# smbpasswd -a dataguy

• You will be prompted for a password for the user. (It can be different from the one the user has already). For dataguy use Biad5up2rzkobslVrdfn as password.
• Restart smbd service.

Now lets add Firewall rules to allow other machines to access our shares:

NB! You need to do this only if you did not specify allow-all as security group during VM creation.

• Use netstat -utpln command to check which ports are used by smbd and nmbd service.
• Add new security group with name smb in ETAIS and add TCP and UDP rules to allow incoming connections to those ports.
  • Add previously created security group smb to your virtual machine

• NFS Server side
  1. Update package indexes
  2. Install packages nfs-common and nfs-kernel-server
  3. Restart service nfs-kernel-server
  4. Add Firewall rules to enable incoming NEW traffic to ports 111 and 2049 for both TCP and UDP
  5. Add new security group with name nfs in ETAIS and add TCP and UDP rules to allow incoming connections to those ports. Add previously created security group nfs to your virtual machine
  6. Data directories should be already created at samba manual

 /mnt/vdb1/data
 /mnt/vdb1/data/ro
 /mnt/vdb1/data/rw

7. Assign all previously created directories ownership to user dataguy and set group owner to users. (we expect you to know how to complete this task without help.)
8. Edit file /etc/exports and add lines

 /mnt/vdb1/data 193.40.154.0/22(rw,sync,fsid=0,crossmnt,subtree_check)
 /mnt/vdb1/data/ro 193.40.154.0/22(ro,nohide,insecure,sync,subtree_check)
 /mnt/vdb1/data/rw 193.40.154.0/22(rw,nohide,insecure,sync,subtree_check)

9. Repeat this with internal IP (what you see from ip a i.e. 192.168.42.XX)
10. Use command exportfs -a to make the newly created shares public

• NFS Client side

Client side mounting in our labs can be done in one of 3 ways

1. Mounting shares from localhost - good for testing but has no use
2. Mounting shares from a friends VM - the way most NFS shares are commonly used, to share data between 2 machines
3. Mounting the testshares from student-test.est - this will give you a place to test nfs-client side but not the server side.

Ideally you can find a lab partner to test this with. The procedure for mounting NFS shares looks a little like this.

1. We will use package nfs-common you installed previously
2. Use command rpcinfo -p <vm_name>.est
3. Where <vm_name>.est is either your own, or someone else's VM name. (Recommended trying it with other people)
4. For testing you can also use student-test.est

 You should see:

    program vers proto   port  service
    100000    4   tcp    111  portmapper
    100000    3   tcp    111  portmapper
    100000    2   tcp    111  portmapper
    100000    4   udp    111  portmapper
    100000    3   udp    111  portmapper
    100000    2   udp    111  portmapper
    100024    1   udp  33446  status
... many more lines

3. Create directories

 /media/nfs_ro
 /media/nfs_rw

4. Mount the remote FS using commands:

 mount -vvv -t nfs4 <vm_name>:/ro -oro,vers=4,proto=tcp,port=2049,sec=sys /media/nfs_ro/
 mount -vvv -t nfs4 <vm_name>:/rw -orw,vers=4,proto=tcp,port=2049,sec=sys /media/nfs_rw/