CVSup - slow, painful, annoying (imho, prove me wrong!).

For the last year or so I’ve exclusively used Portsnap.  From the handbook:

Portsnap is a system for securely distributing the FreeBSD ports tree. Approximately once an hour, a “snapshot” of the ports tree is generated, repackaged, and cryptographically signed. The resulting files are then distributed via HTTP.

Portsnap is VERY easy to use and requires practically no configuration, unlike cvsup.  It is included with FreeBSD 6+ (earlier versions of FreeBSD will need to have portsnap installed).

If you are installing Portsnap from ports, you’ll need to do 1 thing prior to use, and that is copy the configuration file to the correct location:

cp /usr/local/etc/portsnap.conf.sample /usr/local/etc/portsnap.conf

Also, if you’re running FreeBSD 6 and don’t have a ports collection already:

mkdir /usr/ports

Now we can get down to business!  First we fetch the portsnap image:

portsnap fetch

.. and then we extract the portsnap image:

portsnap extract

In the future, if we want to update the ports tree (which you WILL), issue the following commands:

portsnap fetch
portsnap update

If you’re lazy (I hope you are!), add a crontab line to execute:

portsnap cron && portsnap -I update

portsnap cron does the same as fetch, but adds a random wait time up to an hour to ensure that not everybody is hitting the servers at midnight or whatever.

Sharing media over the network using iTunes media sharing is easy, but it’s even better when you can set up FreeBSD as  your backend media library server.  We can achieve this by using mt-daapd and mDNSResponder.

Start with my favorite 2 commands:

portsnap fetch
portsnap update

Install daapd:

cd /usr/ports/audio/mt-daapd/
make install clean
cp /usr/local/etc/mt-daapd.conf.sample /usr/local/etc/mt-daapd.conf

Edit /usr/local/etc/daapd.conf to configure the service.  Change Root to the location of your music and ServerName/DBName to whatever you like. It’s quite clear what you can/should edit, the least of which are these two lines:

ServerName      Shared Library
Root            /media/warehouse/audio

There’s also a line art_filename in which you can specfy your album art.  It’s experimental at best but occasionally works

Install mDNSResponder:

cd /usr/ports/net/mDNSResponder/
make install clean

Create the file /usr/local/etc/mDNSResponder.conf and edit it to look like this (the blank line in intentional):

FreeBSDGuy iTunes server
_daap._tcp.

3689

Add these two lines to /etc/rc.conf:

mt_daapd_enable=YES
mdnsd_enable=YES

Fire up the services:

/usr/local/etc/rc.d/mt-daapd start
/usr/local/etc/rc.d/mdnsd start

Hopefully when you start iTunes you should see your new shared library!

Last year I bought a Mac Mini with the intention of using it as the front end for a media centre solution.

For my plan to work, I needed to share my media from the FreeBSD server to the Mac. Considering both of these operating systems are *nix based, I decided to go with the triied-and-tested NFS to do the sharing.

So, on the BSD machine, edit the file /etc/rc.conf to include these lines:
rpcbind_enable="YES"
nfs_server_enable="YES"
mountd_flags="-r"
nfs_reserved_port_only="NO"

This will enable the NFS server on boot. The nfs_reserved_port_only line is especially for OSX that likes to use ports above 1024 for NFS!

Next, edit /etc/exports to list the shares and also who is allowed to mount them:
/store/media -ro 192.168.1.0
This line configures /store/media to be mountable by clients, allows them to access it ReadOnly and allows access from anybody within the given address range 192.168.1.x.

If you change your exports file, you need to run the following command to allow the system to re-read the file:
/etc/rc.d/mountd onereload

There are several other options you can use (-maproot etc), which you can find from the FreeBSD handbook NFS page.

On the Mac it was quite simple to mount the share. Open finder and from the top menu Click Go > Connect To Server….

In the dialog that appears, type in the location of the share. In my example this would be:
nfs://192.168.1.1/store/media
OS X should make a pretty icon on your desktop for the share (and you can find it mounted in /Volumes too).

Last night a friend (on right) of mine tipped me off about an excellent X server for Windows. I got fed up using the cygwin so decided to try it out. Xming is a cool name too!

Here is what you need to get:

• Root Access
• Xorg installed
• SSH Access to the FreeBSD machine from the Windows machine
• Putty on the Windows machine
• Download Xming to the Windows machine

Xming can be downloaded from the Xming project homepage at Sourceforge.
Execute this after download and do a full install. It’s very straightforward and will just leave you with a small icon in the Windows system tray:

On the FreeBSD machine, if you’ve not got Xorg installed, quickly do a
pkg_add -r xorg
and you’ll have it soon enough.

You will need to update the sshd configuration:
edit /etc/ssh/sshd_config
adding the line:
X11Forwarding yes
to the end and saving.
Follow this up with a restart of the sshd daemon:
kill -HUP `cat /var/run/sshd.pid`

Then, on the Windows machine, load up your putty and change the connection settings to they have the X11 forwarding enabled:

Fire up your putty connection now. Once connected, become root and add an X application from packages and then exit back to normal user level:
su root
and then type your password…
pkg_add -r thunderbird
exit
Now we start the application:
thunderbird
Notice that it starts up on your Windows desktop. Try this out with loads of other applications too, it’s a doddle. I currently use it for email, web and xfce4 as a launcher of my unix apps. I’m also thinking of having Eclipse IDE installed centrally on a server and then connecting remotely every time I want to do some development - this one is ultra handy since that’s where my Tomcat server is too

As I work in a large corporation who have all their satellite offices (like my own) connect to the Internet through a central structure, I decided I didn’t want some IT nerd reading all my IM’s. SSH wasn’t good enough - I wanted a robust solution that didn’t take much tinkering and would support all the protocols I use (MSN, Yahoo, AIM, Gtalk, soon SIP).

That’s when I came across Jabber, mentioned by a friend of mine on his blog.

There’s a good list of Jabber components on Wikipedia, but for ease of install and use, I went with OpenFire. OpenFire has a free version and a commercial version. No guessing which version I chose to run

OpenFire can be found in ports (/usr/ports/net-im/openfire/) so is pretty easy to install.

Anyway, lets get cracking. First make sure you have these things:

• Up to date ports tree
• root
• Full firewall control (if needed)
• MySQL

Lets start:

cd /usr/ports/net-im/openfire
make install clean

then:

edit /etc/rc.conf

and insert this line:

openfire_enable=”YES”

Manually start the server

/usr/local/etc/rc.d/openfire.sh start

This should start the web interface. This interface runs on port 9090 (open your firewall if you need to!) and will guide you through the setup of OpenFire jabber server. You will need to have created a MySQL database and a user to authenticate against the database.

You also are given the option to use LDAP for users, this isn’t covered here because I don’t use LDAP.

Finally set the admin email and wait for it to complete the setup. Once that’s done it’ll take you to a login form for admin.

Login using the username AND password admin

You’ll get the gist of things from there.

Installing Java can be a pain in the ass. You have to download the files manually for licensing purposes

cd /usr/ports/java/diablo-jdk15
make install clean

You’ll see the notes regarding downloading the files. Access the urls with a browser, accept the agreements and download the two files it wants.
Note: you need an account at Sun.com for one of the files - a further pain in the ass.
diablo-caffe-freebsd5-i386-1.5.0_07-b01.tar.bz2 is the source, tzupdater-1_3_0-2007h.zip is the timezone update.

When that’s done, move them into your /usr/ports/distfiles directory.

cd /usr/ports/java/diablo-jdk15
make install clean

This time you should see the farmiliar port install config page. Make sure the timezone update is selected and continue.

Take a break, this takes a while. When it’s done, test it out by typing:

rehash
java -version

and you should see something similar to this:

Java(TM) 2 Runtime Environment, Standard Edition (build diablo-1.5.0-b01)
Java HotSpot(TM) Client VM (build diablo-1.5.0_07-b01, mixed mode)

RTIR is an incident response module for RT, so clearly we had to take a little peek at the goods. This is really meant for incident responmse / network operations teams.

RTIR is built on RT, but provides different functionality. Read here for more information regarding the usefulness of RT and RTIR.

Lets start by installing the needed Perl modules:

perl -MCPAN -e ‘install Business::Hours’
perl -MCPAN -e ‘install Net::Whois::RIPE’

and downloading rtir and extracting it:

wget http://download.bestpractical.com/pub/rt/release/rtir.tar.gz
tar xfzv rtir.tar.gz

Now we need to configure the Makefile so that it points to our installed RT, otherwise it’ll have no clue where to install. So we will use the path from our earlier install of RT.

cd rtir-1.0.5/
edit Makefile

Change the RT_ROOT to the location of your rt install. Mine happens to be /usr/local/RT
I did change the group rt to www also, since RT doesn’t install its own group in FreeBSD

Save the file and exit.

make install

This next step ensures that RT will not work unless the RTIR config is present.

edit /usr/local/RT/etc/RT_SiteConfig.pm

and add this:

# The RTIR config file
$RTIR_CONFIG_FILE = “/usr/local/RT/etc/RTIR_Config.pm”;
require $RTIR_CONFIG_FILE
|| die (”Couldn’t load RTIR config file ‘$RTIR_CONFIG_FILE’\n$@”);

Save the file and exit.

make initdb

This will request your root password. Enter it and hit enter. 10 seconds later the process is complete. Restart Apache for good luck!

apachectl restart

That’s the hard bit out of the way.

Browse RT and login as your root user.

Browse to: Configuration -> Queues -> Blocks -> Watchers
Add your network operations team email address to the ‘Administrative Cc:’ field.

Configure your default emails sent when an Investigation or Block is logged by:
Browse to: Configuration -> Queues -> Blocks -> Templates -> NewMessage
and customise the email.

Browse to: Configuration -> Queues -> Investigations -> Templates -> LaunchMessage
and customise the email.

Here are some other tips from the RTIR Readme:

• By default, RT3 has certain global Scrips. You should look through them, and disable any that don’t want.
• Staff members who handle incidents should be added to the DutyTeam group.

Incident reports need a mail alias, so again:

edit /etc/aliases

Add the following line:

rtir: “|/usr/local/RT/bin/rt-mailgate –queue ‘Incident Reports’ –action correspond –url http://yourhostname:81/”

Remember to change the hostname to match your install!

This should be RTIR installed. It worked for me. Remember to follow each step logically. If you get no luck, it might be a good plan to look in /var/log/httpd-error.log before getting worked up about it.

A friend of mine is installing RT for use in the company he works for. I thought I’d give it a spin to see what the fuss was about. Here’s what happened!

This was based on http://wiki.bestpractical.com/index.cgi?InstallationGuides and the README distributed with RT.

What we need:

• root
• Perl
• MySQL (Although you can use Oracle, Sqlite, Postgres)
• Apache

Download and extract RT:

wget http://download.bestpractical.com/pub/rt/release/rt-3.6.5.tar.gz
tar xzvf rt-3.6.5.tar.gz

Configure RT:

cd rt-3.6.5
./configure –help
./configure (with the flags you want)

Mine looked like this:

./configure –prefix=/usr/local/RT –with-db-type=mysql –with-db-database=rt –with-db-rt-user=rt –with-db-rt-pass=rtpass

Now we must fix dependancies as required with these commands:

make testdeps
make fixdeps

Sometimes you might have to run fixdeps several times to make sure all of the required Perl modules get installed!
…and eventually install:

make install

My install returned the following:

Congratulations. RT has been installed.
You must now configure RT by editing /usr/local/RT/etc/RT_SiteConfig.pm.

When I looked in /usr/local/RT/etc/ there is a file called RT_Config.pm which contains all the settings as specified in the configure command line. Looking in here I saw the line:

Set($DatabasePassword , ‘rtpass’);

So I added this line to the RT_SiteConfig.pm file.
Next step:

make initialize-database

Now that’s done, it’s time to get our web interface running since that’s what we want our users to use! This command installes a Perl/Apache module that’s needed for database integration:

perl -MCPAN -e’install Apache::DBI’

Now we need to edit our Apache configs so that we can see RT in our browsers. In this simple config, we get Apache to listen to requests on port 81, and serve RT from there. You should be able to modify this for your needs and will al little imagination, get RT served from any url you want.

edit /usr/local/etc/apache22/extra/httpd-vhosts.conf

…and add these lines…

NameVirtualHost *:81

# ServerName your.rt.server.hostname
DocumentRoot /usr/local/RT/share/html
AddDefaultCharset UTF-8

PerlModule Apache::DBI
PerlRequire /usr/local/RT3/bin/webmux.pl

< Location />
SetHandler perl-script
PerlHandler RT::Mason
Order allow,deny
Allow from all
< /Location >

RedirectMatch permanent (.*)/$ http://10.151.102.40:81$1/index.html

..and for good measure…

edit /usr/local/etc/apache22/httpd.conf

…and add this line…

Listen 10.151.102.40:81

Restart Apache:

apachectl restart

Configure mail:

edit /etc/aliases

and add these lines:

#rt stuff
rt: “|/usr/local/RT/bin/rt-mailgate –queue general –action correspond –url http://yourhostname:81″
rt-comment: “|/usr/local/RT/rt-mailgate –queue general –action comment –url http://yourhostname:81″

The www interface seems to work nicely and I get mails when work is assigned to me, edited etc. If this machine could accept external mail, I could reply and add to the tickets too

Remember that the default login is root and the default password is password

Have fun, RTIR coming soon…

As a precursor to researching Apache replacements for work, I decided to look at lighttpd at home. I already have php5 installed (incluing fast-cgi support). Here is how I installed lighttpd in my setup. These steps were carried out as root.

cd /usr/ports/www/lighttpd
make install clean

I had to make sure mysql support was included, and dropped ipv6 support (Serisouly, I’m not going to see v6 for years). Didn’t take long to compile, so straight to configuring:

Edit the file /usr/local/etc/lighttpd.conf and uncomment the line “mod_cgi”, “mod_fastcgi” and uncomment the entire section under #### fastcgi module. This enables php to work. Save the file and exit.

Lighttpd logs to /var/log/, so lets create the files now to avoid problems later:

cd /var/log
touch lighttpd.error.log
touch lighttpd.access.log
chown www:www lighttpd.error.log
chown www:www lighttpd.access.log

and for good measure create the folder for the pid file and make www the owner and group:

/var/run/lighttpd/ and
chown www:www /var/run/lighttpd/

Configuring the server to start on boot is as simple as editing /etc/rc.conf, but we also need to specify the location of the configuration file in another parameter. Add these lines to /etc/rc.conf:

lighttpd_enable=yes
lighttpd_conf=/usr/local/etc/lighttpd.conf

and now start it up with something like:

/usr/local/etc/rc.d/lighttpd.sh start

Mine started flawlessly.

At work, we currently have deployed apps that run on JBoss under Windows 2003. No big deal really, apart from other services on the Windows servers tend to kill the entire box now and again - quite a pain in the backside. So I’m trying to convince them to move to a more stable OS, that being FreeBSD.

I documented the whole thing (as you should), so here is my guide to installing and configuing JBoss4 on a fresh install of FreeBSD Before we start, we’d better check we have all the requirements:

• FreeBSD 6.2 installed and ready to rock
• A root login account
• SFTP / FTP access to the server

First we’d better update our ports quickly. We need to make sure we’re getting the most up to date sources:

portsnap fetch
portsnap update

Obviously JBoss is a Java application server, so common sense would say we need to install Java first.  According to RedHat, the latest JBoss releases (4.2) only need the JRE (runtime environment) to run, but on FreeBSD that isn’t the case - it still wants to JDK (development kit) so lets install that:

cd /usr/ports/java/diablo-jdk15 && make install clean

But you’ll find that complains:

 ===>  diablo-jdk-1.5.0.07.01_7 :
Because of licensing restrictions, you must fetch the distribution
manually.
Please access

http://www.FreeBSDFoundation.org/cgi-bin/download?download=diablo-caffe-freebsd6-i386-

1.5.0_07-b01.tar.bz2

with a web browser and “Accept” the End User License Agreement for
“Caffe Diablo 1.5.0″.  Please place the downloaded
diablo-caffe-freebsd6-i386-1.5.0_07-b01.tar.bz2 in /usr/ports/distfiles.

Please open http://java.sun.com/javase/downloads/index.jsp
in a web browser and follow the “Download” link for
“JDK US DST Timezone Update Tool - 1.2.2″ to obtain the
time zone update file, tzupdater-1_2_2-2007g.zip.

.*** Error code 1

Stop in /usr/ports/java/diablo-jdk15.

Ok, so we need to get the files manually.  The first file is easy to pick up.  The Timezone update is not as you are forced to register an account with Sun.  No biggie really, just a bit of a pain.

FTP/SFTP these two files to your /usr/ports/distfiles and we’re ready to continue:

 cd /usr/ports/java/diablo-jdk15 && make install clean

Make sure you enable the TZUPDATE option.  This took about 15 minutes on my box, but might take longer on yours.  Go get something to eat or get a coffee.

If that suceeded, then you’re already half way there!  Now it’s time to actually install JBoss itself……

 cd /usr/ports/java/jboss4 && make install clean

Wait for that to build.

There’s a couple of configuration changes you’ll need to make if you want it to a.Work b.Work on the network.

Edit /usr/local/jboss4/bin/run.conf and setup the JAVA_HOME variable to equal “/usr/local/diablo-jdk1.5.0/” so it can find Java where FreeBSD installs it.  In this file you can also add extra classpaths, configure memory allocations etc.

Out of the box, JBoss uses port 8080.  To change that, edit the file  /usr/local/jboss4/server/default/deploy/http-invoker.sar/META-INF/jboss-service.xml
Search for 8080 and replace it with whatever port number you want to use.

Starting JBoss is simple:

/usr/local/jboss4/bin/run.sh

Starting JBoss binded to an ip other that 127.0.0.1 is simple also:

/usr/local/jboss4/bin/run.sh -b 192.168.0.1 (or whatever ip you’re using)