Here is where the fun begins. This section is rather network-centric, though many other tasks await you.
Networking is a vast subject which cannot be fully covered here. The reference is the NET-3 HOWTO, and most distributions provide documentation on setting up network services. Only a few points will be recalled here.
A quick to-do list for the services you may want to install: cron and timed tasks like calendar or reminder, Http, Samba, telnet/ssh access, anonymous ftp, POP/IMAP server, NFS...
If your network card wasn't recognised at install time, don't worry: in most
cases it's either NE2000 or 3c59x compatible. Issue the command
modprobe ne or modprobe 3c59x and see if the relevant
module is loaded, then add this line in /etc/conf.modules:
alias eth0 ne # or 3c59x
Now you're ready to use netcfg or similar tool to set up the
network configuration. The relevant files
are /etc/HOSTNAME, etc/hosts,
/etc/resolv.conf, /etc/sysconfig/network, and
/etc/sysconfig/network-scripts/ifcfg-eth0; services should be
started with scripts in /etc/rc.d/init.d.
This is a sample etc/hosts:
127.0.0.1 localhost
192.168.1.1 paleo.eocene.net paleo
192.168.1.2 nautilus.eocene.net nautilus
This is /etc/resolv.conf:
search df.unibo.it,eocene.net
nameserver 195.210.91.100
This is /etc/sysconfig/network (Red Hat-dependent):
NETWORKING=false
FORWARD_IPV4=true
HOSTNAME=nautilus.eocene.net
DOMAINNAME=eocene.net
And finally, /etc/sysconfig/network-scripts/ifcfg-eth0. This one, too, is Red Hat-dependent; it must be executable.
DEVICE=eth0
IPADDR=192.168.1.2
NETMASK=255.255.255.0
NETWORK=192.168.1.0
BROADCAST=192.168.1.255
ONBOOT=no
Although the actual method of starting network services of your distribution may be much more complex, the following script should be enough to get you started:
#!/bin/sh
# net-up.sh: set up network access
DEVICE=eth0
IPADDR=192.168.1.100
NETMASK=255.255.255.0
NETWORK=192.168.1.0
GATEWAY=192.168.1.1
ifconfig $DEVICE $IPADDR netmask $NETMASK up
route add -net $NETWORK netmask $NETMASK $DEVICE
route add default gw $GATEWAY
This script is handy for enabling network access when you use a rescue disk. Obviously, this lets you only ping, ftp and telnet to the outside; it won't start any daemon.
When you plug the network PC card in, the script /etc/pcmcia/network will be executed. All it needs is a properly set up /etc/sysconfig/network-scripts/ifcfg-eth0.
Setting up the network can become a bit trickier, though. In fact, you must provide the right settings for each network you connect to, as well as settings for the notebook when it's not connected.
I rolled up a rough but functional solution. I use my notebook as a stand-alone machine, connecting to the net via PPP; at home, IP address 192.168.1.2; and at university, IP 137.204.x.y. So, I created a set of configuration files for each network; all these are kept in /etc/mobnet. A script is then used to select the working environment. For instance, this is /etc/mobnet/home.cfg:
# /etc/mobnet/home.conf
HOSTNAME=nautilus.eocene.net # complete hostname
DOMAINNAME=eocene.net # your domain
IPADDR=192.168.1.2
NETMASK=255.255.255.0
NETWORK=192.168.1.0
BROADCAST=192.168.1.255
GATEWAY=192.168.1.1
FORWARD_IPV4=true
NAMESERVER=195.210.91.100 # required
SEARCH=df.unibo.it,eocene.net # optional
SERVICES="inet httpd smb sshd"
This is mnet, the script I use to choose the network profile:
#!/bin/sh
# mnet: script to set up the "mobile network" configuration.
# Last modified: 15 July 2000
# start or stop services
activate_services()
{
for service in $(echo $SERVICES) ; do
[ -x /etc/rc.d/init.d/$service ] && /etc/rc.d/init.d/$service $1
done
}
# usage
if [ $# = 0 ] ; then
echo "Usage: mnet <config name>"
echo "Example: mnet office"
exit 1
fi
# check if the configuration exists
if [ ! -e /etc/mobnet/$1.conf ]; then
echo "This configuration doesn't exist."
exit 1
fi
# read the configuration
. /etc/mobnet/$1.conf
# set up the host name
echo $HOSTNAME > /etc/HOSTNAME
/bin/hostname $HOSTNAME
# set up the name server(s)
cat <<EOF > /etc/resolv.conf
# /etc/resolv.conf
search $SEARCH
nameserver $NAMESERVER
EOF
# stop previous services, if any
if [ -f /etc/mobnet/services.prev ]; then
NEWSERVICES=$SERVICES
. /etc/mobnet/services.prev
activate_services stop
SERVICES=$NEWSERVICES
fi
if [ $1 != "none" ]; then
# set up the network parameters
cat <<EOF > /etc/sysconfig/network
NETWORKING=yes
FORWARD_IPV4=true
HOSTNAME=$HOSTNAME
DOMAINNAME=$DOMAINNAME
GATEWAY=$GATEWAY
GATEWAYDEV=eth0
EOF
cat <<EOF > /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
IPADDR=$IPADDR
NETMASK=$NETMASK
NETWORK=$NETWORK
BROADCAST=$BROADCAST
ONBOOT=no
EOF
/bin/chmod +x /etc/sysconfig/network-scripts/ifcfg-eth0
# copy the other config files
/bin/cp -f /etc/mobnet/hosts.$1 /etc/hosts
/bin/cp -f /etc/mobnet/smb.conf.$1 /etc/smb.conf
echo -n "Insert the network PC card and press <enter> when done: "
read
# OK, now start services
activate_services start
echo "SERVICES=\"$SERVICES\"" > /etc/mobnet/services.prev
else # it's not "none"
cat <<EOF > /etc/sysconfig/network
NETWORKING=false
FORWARD_IPV4=false
HOSTNAME=$HOSTNAME
DOMAINNAME=$DOMAINNAME
EOF
/bin/rm -f /etc/sysconfig/network-scripts/ifcfg-eth0*
/sbin/ifconfig eth0 down
echo "SERVICES=$SERVICES" > /etc/mobnet/services.prev
echo "Now you may remove the PC card."
exit 0
fi
# end of mnet.
As I said, it is rough and even not complete: other files may depend on the network, like /etc/fstab, /etc/exports, and /etc/printcap. Think about network printers and NFS shares. Feel free to adapt this bare-bone solution to your needs.
One of the most useful tasks for a Linux server. Currently, most stock kernels come with IP firewalling, masquerading and forwarding enabled by default; if in doubt, consult the IP-Masquerade mini-HOWTO to learn how to enable them. Then install ipfwadm (kernels 2.0.x; http://www.xos.nl/linux/ipfwadm/) or ipchains (kernels 2.2.x; http://www.adelaide.net.au/~rustcorp/ipfwchains/ipfwchains.html). Remember to enable kernel modules for the services you need, e.g. for ftp you'll add this line to /etc/rc.d/rc.sysconfig:
/sbin/modprobe ip_masq_ftp
Other modules are usually found in /lib/modules/KERNEL-VERSION/ipv4.
Enabling IP masquerading for other machines in your local network is
very simple. First, check the network initialisation scripts
(/etc/sysconfig/network should be the right place) to see if
they contain a line that reads FORWARD_IPV4=true. It's used to set
/proc/sys/net/ipv4/ip_forward to 1 when the network subsystem
comes up.
Add these lines to /etc/rc.d/rc.sysinit:
# default: packets cannot reach the outside
/sbin/ipfwadm -F -p deny
# allow all machines on the local network to reach the Internet
/sbin/ipfwadm -F -a m -S 192.168.1.0/24 -D 0.0.0.0/0
# alternatively, allow only these two machines
# /sbin/ipfwadm -F -a m -S 192.168.1.100/24 -D 0.0.0.0/0
# /sbin/ipfwadm -F -a m -S 192.168.1.101/24 -D 0.0.0.0/0
If you use a kernel of the 2.2.x series, use ipfwadm-wrapper
instead of ipfwadm to get started quickly.
More information at
http://ipmasq.cjb.net.
Now you'll want something to let client machines dial the ISP; I use Mserver ( http://cpwright.villagenet.com/mserver/). Edit etc/mserver.conf; the only entries that you should modify are ``checkhost'', ``shadow'', and ``cname''. Then define your connection(s). Obviously, install a suitable client on the client machines.
Let's suppose you connect to the Internet via PPP. Once you're connected, your machine may become vulnerable to attacks. Insert this in /etc/hosts.allow:
# only allow access to localhost
ALL: 127.
and this in /etc/hosts.deny:
# deny access to everyone
ALL: ALL
If you belong to a network with direct Internet access, you had better
disable finger, telnet, and possibly other services for security reasons;
use ssh instead of telnet. The file to edit is
/etc/inet.conf. Alternatively, you can restrict network access
putting this in /etc/hosts.allow:
in.telnetd: 192.168.1., .another.trusted.network
in.ftpd: 192.168.1., .another.trusted.network
and this in /etc/hosts.deny:
in.telnetd: ALL
in.ftpd: ALL
It is common to export home directories on the server; a problem arises
if a user's UID and GID are not consistent across different machines.
If user `guido' has UID/GID = 500 on server and UID/GID = 512 on
client, a convenient configuration is this:
# /etc/exports
/tmp my.client.machine(rw)
/home/guido my.client.machine(rw,all_squash,anonuid=512,anongid=512)
Almost trivial, but there's always a little bit to do. If you want to connect Windows 98/NT clients, did you remember to read the docs and, in case, enable clear text passwords? The distribution includes .reg files for Win9x/NT/2000; if your clients can't connect to the Linux server, load them on every client.
Samba comes with a fairly complete sample /etc/smb.conf, but
strangely it lacks a section showing how to (un)mount removable media. The
clauses preexec and postexec do the trick:
[cdrom]
comment = CD-ROM
path = /mnt/cdrom
public = yes
read only = yes
; you might need to use "root preexec/postexec"
preexec = mount /mnt/cdrom
postexec = umount /mnt/cdrom
Also: you know what Swat is, don't you? Enable it adding this line in your /etc/inetd.conf:
swat stream tcp nowait.400 root /usr/sbin/swat swat
and this in /etc/services:
swat 901/tcp
Restart inetd with SIGHUP, and point your browser to
http://localhost:901.