FreeBSD System Setup

Contents

  1. FreeBSD System Setup
  2. Introduction
    1. Tips and Tricks
      1. FreeBSD User Ports
  3. Base Operating System Installation
  4. Post Installation Tasks
  5. Disk Mirroring Configuration
  6. Software Package Management
  7. Encrypted Filesystem Configuration
  8. Firewall Settings
  9. Main Applications to Install
  10. MySQL Configuration
  11. PHP Configuration
  12. Apache Configuration
    1. Basic Configuration
    2. Apache PHP module configuration
    3. Virtual Host Configuration
  13. Additional Tools Required for DrawMGT
    1. PERL modules, wget, zip
    2. htmldoc
    3. pdflatex
  14. WebDAV Configuration
  15. Secure (chroot-ed) access setting for external users
    1. SSH login to allow SSH port forwarding
    2. Allow SCP and SFTP only
  16. Setting logrotate
  17. Monitoring the Server

Introduction

This page explains how to setup a FreeBSD system capable of acting as a DrawMGT server. FreeBSD differs from Linux systems in that the basic installation includes very few users tools or applications by default. This means that you need to install all application support tools that DrawMGT requires, like Apache, MySQL and PHP.

This page describes the setup of the version 7.2. The procedure can be slightly different for other versions.

FreeBSD is well documented. See the FreeBSD Handbook

Installing FreeBSD applications, called ports is simple and is explained here.

The basic steps to prepare a FreeBSD server are:

  1. Install the base operating system
  2. Setup disk mirroring
  3. Install support software
  4. Install other support tools
  5. Install and test DrawMGT

These steps are described below.

Tips and Tricks

FreeBSD User Ports

If there is network problems accessing the pre-configured master databases, try an http server accessable from the internet browser, e.g.

Base Operating System Installation

  1. Donwload an ISO image of the latest production production release:

    • http://www.freebsd.org/where.html

    • Typically you want the ISO disk-1. E.g. for release 7.2 its:
      • 7.2-RELEASE-i386-disk1.iso
    • Alternatively download:
      • 7.2-RELEASE-i386-dvd1.iso.gz
    • Note that other the CDs are not required
  2. Put the CD (or DVD) in the system and boot

  3. Select Standard installation in sysinstall

  4. Disk partitions - Setup one fdisk partition with the following FreeBSD partitions (assuming disk > 300 GB):

    Partition

    Size

    Description/Contents

    /

    1 GB

    root partition

    swap

    2-4 GB

    swap parition

    /var

    10 GB

    MySQL DBs and logs

    /tmp

    10 GB

    Make big enough to store a DVD ISO

    /usr

    20 GB

    Applications and ports

    /e/vol001

    200 GB

    Web trees

    /e/vol002

    all remaining free space

    Backups (perhaps encrypted)

    Note: You should tune up the new large (>100GB) filesystems by hand in order to set the default freespace (normally 8%) to a smaller value (typically 1%). It can be done anytime on unounted filesystems. For example: 

    •       tunefs -m 1 /dev/ad0s1g

  5. Note: Later you will make a symbolic link from /home --> /e/vol001/home

  6. Select Everything (all development tools and sources) Minimal distribution

  7. Network configuration - You will need the following informaion:
    • Hostname and domain for the machine
    • IP address for the machine
    • IP address of gateway
    • IP address of primary and secondary DNS servers

Post Installation Tasks

  1. NTP Setup

    • Install openntpd port: Note: This port is probably not required. ntpd is included in a Everything distribution. 

      cd /usr/ports/net/openntpd
make
make install

    • Get full domain names of at least two NTP servers (called ntp1.domain and ntp2.domain below)

    • Set system time with ntpdate: 
      ntpdate -u ntp1.domain
    • Configure NTP servers, enable and start NTP daemon 
      vi /etc/ntp.conf
server ntp1.domain
server ntp2.domain
:x

vi /etc/rc.conf
# Add:
ntpd_enable="YES"
:x

/etc/rc.d/ntpd start
    • Check NTP is running and has connected to servers: 
      ntpq -p
  2. Install and run CVSUP.
    • CVSUP updates the ports collections and ensures that you install the latest applications and package versions. Basically
      • it updates all the make files in the directory tree /usr/ports (or other directory trees depending on the configuration).
    • Install cvsup (this can take 10-20 minutes) 
      cd /usr/ports/net/cvsup-without-gui
make install

    • Configure a ports supfile 

      cd /root
mkdir cvsup
cd cvsup

vi ports-supfile
# Add the following
*default host=cvsup.ch.FreeBSD.org
*default base=/var/db
*default prefix=/usr
*default release=cvs tag=.
*default delete use-rel-suffix

*default compress

#src-all
#doc-all
ports-all
:x
    • Create script to run the runs the ports file: Put the following code
      • into the file /root/cvsup/run-cvsup.sh, then set execute permissions on the file. 
      #
# cvsup options:
#
#  -g         Disables GUI
#  -L 2       Log verbosity=2
#

PROD=$0
TS=`/bin/date +'%Y%m%d-%H%M'`

CVSUP=/usr/local/bin/cvsup

CVSUP_OPTS='-g -L 2'
CVSUP_SUPFILE='ports-supfile'
LOG_FILE=${CVSUP_SUPFILE}-${TS}.log

if [ ! -f ${CVSUP_SUPFILE} ]
then
  echo "${PROD}: No such file: ${CVSUP_SUPFILE}"
  exit 1
fi

echo "${PROD}: Log file: ${LOG_FILE}"
echo "${PROD}: SUP file: ${CVSUP_SUPFILE}"
echo "${PROD}: Start: `date`"

${CVSUP} ${CVSUP_OPTS} ${CVSUP_SUPFILE} > ${LOG_FILE}

echo "${PROD}: Done:  `date`"
    • Run cvsup: This could take 10-15 minutes (depending on the network connection) 
      chmod +x run-cvsup.sh
./run-cvsup.sh ports-supfile
  3. Install manpages 
    • mount /cdrom
cd /cdrom/7.2-RELEASE/manpages/
./install.sh
  4. Install vim 
    • cd /usr/ports/editors/vim
make install # Note: it installs python26 also
  5. Install bash 
    • cd /usr/ports/shells/bash
make install

Disk Mirroring Configuration

See: FreeBSD Handbook Chapter 19 GEOM: Modular Disk Transformation Framework Note that the device files /dev/ad1 and /dev/ad2 can be different depending on the hardvare, e.g. /dev/ad4 and /dev/ad5 on the bp.softxs.ch server.

  1. Boot in single user mode.
  2. Mount all file systems in read/write mode: 
    • mount -u /
mount -a -t ufs
  3. Start entering gnome command: 
    • sysctl kern.geom.debugflags=16

gmirror label -v -b round-robin gm0 /dev/ad0
Metadata value stored on /dev/ad0
Done.

echo 'geom_mirror_load="YES"' > /boot/loader.conf
  4. Update /etc/fstab 
    • cp /etc/fstab /etc/fstab.orig
vi /etc/fstab
# Change each adN to gm0, and insert a mirror after /dev. For example:
#  /dev/ad0s1a --> /dev/mirror/gm0s1a.
:x
  5. Reboot, and look for messages like the following: 
    • ad0: 238475MB <HDT722525DLAT80 V44OA40A> at ata0-master UDMA133
acd0: DVDR <NEC DVD RW ND-3540A/1.01> at ata0-slave UDMA33
ad2: 238475MB <HDT722525DLAT80 V44OA40A> at ata1-master UDMA133
GEOM_MIRROR: Device gm0 created (id=577175128).
GEOM_MIRROR: Device gm0: provider ad0 detected.
GEOM_MIRROR: Device gm0: provider ad0 activated.
GEOM_MIRROR: Device gm0: provider mirror/gm0 launched.
Trying to mount root from ufs:/dev/mirror/gm0s1a
  6. Add the second disk to the mirror 
    • gmirror insert gm0 /dev/ad2
  7. Check in /var/log/messages 
    • Dec 29 13:46:11 thor kernel: GEOM_MIRROR: Device gm0: provider ad2 detected.
Dec 29 13:46:11 thor kernel: GEOM_MIRROR: Device gm0: rebuilding provider ad2.
..
  8. Check status on command line 
    • gmirror status
      Name    Status  Components
mirror/gm0  COMPLETE  ad0
                      ad2
    • Should show two components.

Software Package Management

Encrypted Filesystem Configuration

Firewall Settings

Main Applications to Install

Recommended installation sequence is as listed here.

  1. MySQL Server/Client 
    • cd /usr/ports/databases/mysql54-server
make install # Note: it installs mysql54-client also
/usr/local/bin/mysql_install_db
  2. Apache 
    • cd /usr/ports/www/apache22
make install # Use default options plus MYSQL
  3. PHP5, PEAR and PECL_HTTP (use defaults is not otherwise noted) 
    • cd /usr/ports/lang/php5
make install # Use default options plus APACHE2
cd /usr/ports/lang/php5-extensions
make install # Use default options plus MBSTRING, MYSQL, BUNDLED_PCRE, UTF8
cd /usr/ports/devel/pear
make install
cd /usr/ports/databases/pear-DB
make install
cd /usr/ports/sysutils/pear-Log
make install # Select options PEAR_DB, PEAR_Mail, PEAR_NET_SMTP
cd /usr/ports/net/pear-XML_RPC
make install
cd /usr/ports/mail/pear-Mail_Mime
make install
cd /usr/ports/www/pecl-http
make install
  4. Perl packages 
    • cd /usr/ports/devel/p5-Config-General
make install
  5. mb-string
    • If on any reason PHP4 is used then the multibyte string packege is needed 
      cd /usr/ports/converters/php4-mbstring
make install

MySQL Configuration

PHP Configuration

Apache Configuration

Basic Configuration

Apache PHP module configuration

Virtual Host Configuration

Additional Tools Required for DrawMGT

PERL modules, wget, zip

htmldoc

pdflatex

WebDAV Configuration

See here.

Secure (chroot-ed) access setting for external users

SSH login to allow SSH port forwarding

Create a minimal chroot environment for user who logs in the system with ssh. Only the shell will be enabled. Perform the whole procedure as root.

Allow SCP and SFTP only

Create a minimal chroot environment for user who should have the rights only to use scp and sftp limited to his home directory. A good and free SFTP and FTP client for Windows is WinSCP. Perform the whole procedure below as root.

Setting logrotate

Monitoring the Server

  1. File system space
  2. Backups
  3. Mirroring ok
    • By hand 
      gmirror status -s
mirror/gm0  COMPLETE  ad0
mirror/gm0  COMPLETE  ad2
    • Via cron 
      # lofn.softxs.ch:crontab
# $Id$
#
# -- Gmirror monitoring
#
57 02 * * * /root/bin/mailcron -x -u"alan@softxs.ch" -s"lofn: Gmirror monitoring" /root/bin/checkGmirror.pl -v
#
# -- end --
    • Script: /root/bin/checkGmirror.pl 
      #
# Check that gmirror disks are present and OK.
# By default expects that two disks are present.
#
# Usage: checkGmirror.pl [-v]
#
# Typical output of 'gmirror status -s'
#
#   mirror/gm0  COMPLETE  ad0
#   mirror/gm0  COMPLETE  ad2
#
#   $component  $status   $device
#

use strict;

my $V = ( $ARGV[ 0 ] eq '-v' ) ? 1 : 0;

my $RC = 0;

my $EXPECTED_DEVICE_COUNT = 2;

my $CMD="/sbin/gmirror status -s";

open( CMD, "$CMD|" ) or die( "$0: Unable to run command: \'$CMD\'\n" );

my %components;
my $line;
while( defined( $line = <CMD> ) ) {
  chomp ( $line );
  my( $component, $status, $device ) = split( /\s+/, $line );
  $components{ $device } = $status;
  $RC = 1 if ( $status eq 'DEGRADED' );
}
close( CMD );

if ( scalar( keys( %components ) ) != $EXPECTED_DEVICE_COUNT ) {
  $RC = 1;
  $V = 1;
}

if ( $RC || $V ) {
  if ( $RC ) {
    print( "$0: ERROR: gmirror: status: BAD\n" );
  } else {
    print( "$0: gmirror: status OK\n" );
  }
  foreach my $device ( keys( %components ) ) {
    my $status = $components{ $device };
    print( "  device: $device, status: $status\n" );
  }
}

exit $RC;

# -- end --

FreeBsdSystemSetup (last edited 2012-09-07 08:46:39 by 195)

Copyright 2008-2014, SoftXS GmbH, Switzerland