Posts Tagged ‘modules’

ClearOS 6.3: I am an Access Point and So Can You

Despite the crappy things I’ve had to say about 6.3 I’ve decided to tough it out on my new home router. Normally, where the modem and router-ap are separate pieces of equipment you can simply turn off DHCP on the old router and keep using it as an access point by plugging the switch side of it into the local network and moving its LAN IP somewhere it won’t conflict with the new router. Unfortunately, my ISP has made the “step up” to all-in-one modem-router-APs and the only way to bypass the limitations of the built-in router is to put the device in “bridged mode;” effectively turning it into a modem and sacrificing all of its other functionality. This would require either purchasing a separate, stand-alone access point or adding AP functionality to the ClearOS router to keep wifi going.

I settled on the Ralink 3090 because at about $10 it’s the cheapest 802.11n card offered on eBay at present. Unfortunately, the kernel module for this card seems to be the only Ralink module missing from those distributed with ClearOS by default – necessitating building and swapping in a new kernel.

First, it’s necessary to install the build environment:

yum --enablerepo=clearos-developer,clearos-epel install clearos-devel

Now we’ll grab and install the kernel sources:

# wget http://mirror2-houston.clearsdn.com/clearos/community/6.3.0/dev/SRPMS/kernel-2.6.32-279.2.1.v6.src.rpm
# rpm -iv kernel-2.6.32-279.2.1.v6.src.rpm
# cd ~/rpmbuild

Now we need to install a few dependencies and patch the kernel according to the rpm spec:

# yum install xmlto asciidoc elfutils-libelf-devel binutils-devel newt-devel python-devel "perl(ExtUtils::Embed)" hmaccalc
# rpmbuild -bp --target=x86_64 SPECS/kernel.spec
# cp -a BUILD/kernel-2.6.32-279.2.1.el6/ /usr/src
# ln -s kernel-2.6.32-279.2.1.el6/linux-2.6.32-279.2.1.v6.x86_64/ linux

We need to install ncurses-devel to run make menuconfig.

# yum install ncurses-devel

Since we’re rolling our own kernel we can’t rely on the stock initrd to get us booting. Once you’re in menuconfig be sure to compile these modules into the kernel statically:

  • Your disk controller module(s)
  • Ext4
  • Multiple devices driver support (RAID and LVM)
  • Device mapper support
  • Wired network devices (optional but I’m fond of guarantees)

Once you’ve configured your kernel and module selection compile and install them:

# make
# make modules_install
# cp arch/x86_64/boot/bzImage /boot/vmlinuz-new

Now modify /boot/grub/grub.conf and copy-paste the existing entry so you have two identical entries. Modify the first one to reference the new kernel’s file name and leave the second intact so if we can’t boot the new kernel we can still get back in to do more tweaking without having to break out a livecd.

Your wireless card will probably require external firmware to be loaded with its module. Be sure to install the firmware image to /lib/firmware so it can be found easily on bootup. For the RT3090 a .bin image is available in the linux source code zip at http://www.ralinktech.com/en/04_support/support.php?sn=501.

You may at this point reboot, and if successful should be looking at a new interface (i.e. wlan0):

# iwconfig
lo        no wireless extensions.

eth0      no wireless extensions.

eth1      no wireless extensions.

wlan0     IEEE 802.11bgn  Mode:Master  Frequency:2.462 GHz  Tx-Power=27 dBm   
          Retry  long limit:7   RTS thr:off   Fragment thr:off
          Power Management:off

imq0      no wireless extensions.

imq1      no wireless extensions.

Now we need to install hostapd, which will take care of WPA authentication and putting your card into Master mode:

# yum install hostapd

Edit /etc/hostapd/hostapd.conf to reflect your environment:

ctrl_interface=/var/run/hostapd
ctrl_interface_group=wheel

# Some usable default settings...
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0

# Uncomment these for base WPA & WPA2 support with a pre-shared key
wpa=3
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP
rsn_pairwise=CCMP

# DO NOT FORGET TO SET A WPA PASSPHRASE!!
wpa_passphrase=mypassword

# Most modern wireless drivers in the kernel need driver=nl80211
driver=nl80211

# Customize these for your local configuration...
interface=wlan0
hw_mode=g
channel=11
ssid=mynetwork

# Wireless N
wme_enabled=1
ieee80211n=1
ht_capab=[HT40-][SHORT-GI-40][DSSS_CCK-40]

Now start hostapd and add it to the appropriate runlevels:

# /etc/init.d/hostapd start
# chkconfig --level 2345 hostapd on

If you want the wireless to be on the same subnet as your wired LAN you must bridge the wireless and wired interfaces using standard ifcfg config files and restart networking; webconfig will not allow you to edit a bridge interface’s IP settings so these must be included in the ifcfg file. Otherwise, assign a different subnet to the wireless device and choose the LAN role to allow routing between the two subnets. Alternatively, choose the Hot LAN role if you want to keep wireless clients from poking around on your wired network (probably a good idea!).

Be sure to enable DHCP for your bridged or wireless interface and congratulations on your new ClearOS access point.

Removing virbr0 or Why The Fsck is My Dom0 NATting?

I noticed one of my new Xen dom0s was coughing up our friend, the ip_conntrack: table full, dropping packet message today. If you like to get your money’s worth out of your dedis the RAM available to dom0 is probably limited – meaning a correspondingly low default ip_conntrack_max. I’m sure you can see how this might be a problem, even more so if it is lower than the ip_conntrack_max of your virtual machines.

None of my previous CentOS dedis had NAT/conntrack modules loaded by default and this dom0 had no need for NAT – being of a fully bridged configuration and routing only public IPs. My first guess was that this dedi’s redhatty initrd loaded the modules through the typical mash-everything-against-the-kernel-and-see-what-sticks approach so I tried removing the NAT and connection tracking related modules:

# rmmod iptable_nat
ERROR: Module iptable_nat is in use

OK, let’s take a look at the tables:

[root@cl-t067-252cl ~]# iptables-save
# Generated by iptables-save v1.3.5 on Sat Jul 21 21:27:40 2012
*nat
:PREROUTING ACCEPT [931:50495]
:POSTROUTING ACCEPT [446:25128]
:OUTPUT ACCEPT [7:502]
-A POSTROUTING -s 192.168.122.0/255.255.255.0 -d ! 192.168.122.0/255.255.255.0 -p tcp -j MASQUERADE --to-ports 1024-65535 
-A POSTROUTING -s 192.168.122.0/255.255.255.0 -d ! 192.168.122.0/255.255.255.0 -p udp -j MASQUERADE --to-ports 1024-65535 
-A POSTROUTING -s 192.168.122.0/255.255.255.0 -d ! 192.168.122.0/255.255.255.0 -j MASQUERADE 
COMMIT

It seems I have a subnet I was not aware of…

virbr0    Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

Who put that there? libvirt, apparently. According to that article not only is our problem ip_conntrack_max, but:

However, NAT slows down things and only recommended for desktop installations.

Seems highly logical to me. Their solution didn’t look very permanent so I first deleted the symlink in the autostart directory for “default”:

# cd /etc/libvirt/qemu/networks/autostart/
# ls -lsah
total 16K
8.0K drwx------ 2 root root 4.0K Jul 21 21:17 .
8.0K drwx------ 3 root root 4.0K May 14 09:18 ..
   0 lrwxrwxrwx 1 root root   14 Jul 21 21:17 default.xml -> ../default.xml
# mv default.xml
# cd ..
# cp default.xml ~/
# /etc/init.d/libvirtd restart

That didn’t do anything at all. Still had virbr0, still had the iptables rules and still had the kernel modules.

Reboot.

Apparently that was the wrong thing to do. All of my interfaces, bridges, etc seemed to come back up (except virbr0) and the NAT/conntrack modules were missing but not a single VM was routing.

On to their method:

# virsh net-destroy default
# virsh net-undefine default
# service libvirtd restart

Everything looks great. You still have the NAT/conntrack modules loaded but we should be able to take those out one by one.

# lsmod | grep nat
iptable_nat            40517  0 
ip_nat                 52973  2 ipt_MASQUERADE,iptable_nat
ip_conntrack           91749  4 ipt_MASQUERADE,iptable_nat,ip_nat,xt_state
nfnetlink              40457  2 ip_nat,ip_conntrack
ip_tables              55329  2 iptable_nat,iptable_filter
x_tables               50377  7 xt_physdev,ipt_MASQUERADE,iptable_nat,xt_state,ipt_REJECT,xt_tcpudp,ip_tables

Reboot.

Boned again.`Now default.xml is missing (I’m assuming that’s what net-destroy does) – good thing we made a backup first!

# cd /etc/libvirt/qemu/networks/
# cp ~/default.xml ./
# ln -s default.xml autostart/
# reboot

OK. Screw it. We’ll do it the hard way.

#!/bin/bash
ifconfig virbr0 down
iptables -t nat -D POSTROUTING -s 192.168.122.0/255.255.255.0 -d ! 192.168.122.0/255.255.255.0 -p tcp -j MASQUERADE --to-ports 1024-65535
iptables -t nat -D POSTROUTING -s 192.168.122.0/255.255.255.0 -d ! 192.168.122.0/255.255.255.0 -p udp -j MASQUERADE --to-ports 1024-65535
iptables -t nat -D POSTROUTING -s 192.168.122.0/255.255.255.0 -d ! 192.168.122.0/255.255.255.0 -j MASQUERADE
iptables -D INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT 
iptables -D INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT 
iptables -D INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT 
iptables -D INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT 
iptables -D FORWARD -d 192.168.122.0/255.255.255.0 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
iptables -D FORWARD -s 192.168.122.0/255.255.255.0 -i virbr0 -j ACCEPT 
iptables -D FORWARD -i virbr0 -o virbr0 -j ACCEPT 
iptables -D FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable 
iptables -D FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
rmmod iptable_nat
rmmod ipt_MASQUERADE
rmmod ip_nat
rmmod xt_state
rmmod ip_conntrack

HOW DO YOU LIKE ME NOW?!

A Note on HTTP Authentication in the Era of APACHE2_MODULES

Gentoo started using the APACHE2_MODULES USE-flag-extending variable to manage Apache’s modules in portage some time ago. The list of modules I migrated with (likely provided by the Gentoo documentation as a recommendation) seems to be missing those responsible for http authentication so every now and then on an outdated web server I will run into errors when adding directives like AuthUserFile.

To resolve this, make sure the following modules are contained in the APACHE2_MODULES variable in your make.conf:

authn_file auth_basic auth_digest authz_user

Recompile Apache with the –newuse flag:

# emerge --update --newuse --deep apache --ask
Return top
foxpa.ws
Online Marketing Toplist
Internet
Technology Blogs - Blog Rankings

Internet Blogs - BlogCatalog Blog Directory

Technology blogs
Bad Karma Networks

Please Donate!


Made in Canada  •  There's a fox in the Gibson!  •  2010-12