Monthly Archives: December 2014

# XBMC for Wheezy, it also needs packages from wheezy-backports
deb https://people.debian.org/~rbalint/ppa/xbmc-ffmpeg xbmc-ffmpeg-wheezy-backports/
deb http://http.debian.net/debian wheezy-backports main contrib non-free

apt-get update && apt-get install xbmc... follow XBMC installation on Debian

RAID1

apt-get install mdadm

parted /dev/sd{b,c} mklabel msdos (or gpt if you have drive bigger than 2 TB)
parted /dev/sd{b,c} mkpart primary raid 1 -1
mdadm -v --create /dev/md0 --level=raid1 --raid-devices=2 /dev/sdb1 /dev/sdc1
cat /proc/mdstat

LVM

Create logical volume (LVM) on top of existing RAID1.

pvcreate /dev/md0
vgcreate vg_disk /dev/md0
lvcreate -L 2t -n lv_data vg_disk

Create logical volumes for {root,home,var/log,temp}.

parted /dev/sda mklabel msdos
pvcreate /dev/sda
vgcreate vg_system /dev/sda
lvcreate -L 7g -n lv_root /dev/vg_system/lv_{root,home,var/log,temp}

Luks encryption

Create encrypted disk on top of logical volume (lv_data) created above.

apt-get install cryptsetup

cryptsetup --verify-passphrase --verbose --hash=sha256 --cipher=aes-xts-plain --key-size=512 luksFormat /dev/vg_disk/lv_data
cryptsetup luksOpen /dev/vg_disk/lv_data disk
mkfs.ext4 -L Data -m 1 -O dir_index,filetype,sparse_super /dev/mapper/disk
mkdir /disk
mount /dev/mapper/disk /disk

Mounted file systems

My /etc/fstab layout on system drive.

Encrypted file systems

My /etc/crypttab file, no automount encrypted drive.

Localisations

/etc/locale.gen

cs_CZ.UTF-8 UTF-8
en_US.UTF-8 UTF-8
th_TH.UTF-8 UTF-8

/etc/default/locale

LANG=en_US.UTF-8
LANGUAGE=en_US.UTF-8
LC_ALL=en_US.UTF-8

locale-gen

User defaults

/etc/default/useradd

SHELL=/bin/bash
GROUP=100
HOME=/home
SKEL=/etc/skel
CREATE_MAIL_SPOOL=yes

Umask

Add following line.
/etc/pam.d/common-session

session optional pam_umask.so

Change default umask.
/etc/login.defs

UMASK    007

Users and groups

Add existing user to additional groups.
usermod -a -G adm,sudo,users username
Check content of passwd and group file and do necessary adjustments.
vipw [-s]
vigr [-s]
/etc/passwd

...
username:x:1000:1000::/home/username:/bin/bash

/etc/group

...
sudo:x:27:username
users:x:100:username,username1
username:x:1000:

Sudo

visudo
Change existing line to disable password confirmation when using sudo. I don’t like typing passwords, you may leave it in default.

%sudo ALL=(ALL) NOPASSWD:ALL

Linux kernel settings

/etc/sysctl.conf

NTP server

apt-get install ntp
Change your network address, mask and broadcast accordingly.
/etc/ntp.conf

Time zone

/etc/timezone

Europe/Prague

Network interfaces

/etc/network/interfaces

ASUS P8H61-M PRO build-in NIC
WAN network, interface eth0
MAC 10:bf:48:7a:42:cf
RTL8111/8168B (rev 06)

AXAGO PCEE-GR
LAN network, interface eth1
MAC 00:13:3b:10:1a:d4
RTL8111/8168B (rev 07)

Both card are using identical chipset Realtek RTL8111E.

AXAGO PCEE-GR gigabit ethernet PCI Express adapter is excellent, but cheap czech product which cost only $10.

UFW firewall

apt-get install ufw

Filter UFW messages from /var/log/syslog and log them only to /var/log/ufw.log.

/etc/rsyslog.d/20-ufw.conf

:msg,contains,"[UFW " /var/log/ufw.log
& ~

/etc/default/ufw

DEFAULT_FORWARD_POLICY="ACCEPT"

/etc/ufw/sysctl.conf

net/ipv4/ip_forward=1

/etc/ufw/before.rules

If you have existing set of rules, you can copy it from location below or use mine. The best way is to define your own rules using UFW. Or you can setup your firewall and router server following this guide.

/lib/ufw/user.rules

Dnsmasq (DNS and DHCP server)

apt-get install dnsmasq

/etc/dnsmasq.conf

touch /var/log/dnsmasq.log /var/lib/misc/dhcp.leases
chown dnsmasq /var/log/dnsmasq.log /var/lib/misc/dhcp.leases

/etc/resolv.conf

nameserver 127.0.0.1

/etc/resolv.dnsmasq

domain homelan
search homelan
nameserver 8.8.8.8
nameserver 8.8.4.4

chown dnsmasq /etc/resolv.dnsmasq

/etc/hosts
/etc/logrotate/dnsmasq

Squid

Setup Squid 3.4.8 transparent proxy.

For more about Squid transparent proxy installation and configuration you can read here.

OpenVPN server

apt-get install openvpn bridge-utils

/etc/network/interfaces
/etc/openvpn/easy-rsa/vars
/etc/openvpn/server.conf

ufw allow 1194

For more about OpenVPN installation and configuration you can read here.

NFS server

apt-get install nfs-kernel-server nfs-common portmap

Modify following parameters in the files below. You can read more about NFS installation here.

/etc/default/nfs-common

NEED_IDMAPD=YES

/etc/default/nfs-kernel-server

RPCMOUNTDOPTS="-p 13030"

/etc/exports

/disk 192.168.122.0/27(rw,no_root_squash,async,no_subtree_check,crossmnt,fsid=0)

Postfix

/etc/postfix/main.cf

/etc/postfix/master.cf

/etc/postfix/sender_access

/etc/postfix/virtual

/etc/aliases

/usr/local/bin/spamfilter.sh

/etc/postfix/canonical

arpwatch@home-router    arpwatch@faix.cz
root@home-router.homelan  root@faix.cz
ossecm@home-server    ossecm@faix.cz

/etc/postfix/generic

@faix.homelinux.net @faix.cz

/etc/postfix/rbl_override

77.75.76.26 OK
82.192.75.110 OK
ns35.mailserver.com OK

/etc/postfix/recipient_canonical

/^(.*)@(.*)\.homelan$/     ${1}.${2}@faix.cz
/^(.*)@(.*)\.localhost$/     ${1}.${2}@faix.cz

/etc/postfix/sender_canonical

/^(.*)@(.*)\.homelan$/       ${1}@faix.cz
/^(.*)@(.*)\.home-*$/        ${1}@faix.cz
/^(.*)@(.*)\.localhost$/     ${1}@faix.cz

/etc/postfix/sasl/smtpd.conf

pwcheck_method: saslauthd
mech_list: plain login

/etc/mailname

faix.cz

passwd mail
mkdir /var/spamchk

/etc/ssl/private/smtpd.key
/etc/ssl/certs/cacert.pem
/etc/ssl/certs/smtpd.crt

How to generate your certificate, see more in Sasl section.

For more about Postfix installation and configuration you can read here.

Spamassassin

apt-get install spamassassin spamc

/etc/spamassassin/local.cf

/etc/default/spamassassin

ENABLED=1
SAHOME="/var/log/spamassassin/"
OPTIONS="--create-prefs --max-children 2 --username debian-spamd -H ${SAHOME} -s ${SAHOME}spamd.log"
PIDFILE="/var/run/spamd.pid"
CRON=1

For more about Spamassasin installation and configuration you can read here.

Postgrey

/etc/defaults/postgrey

POSTGREY_OPTS="--inet=192.168.122.1:10023 --delay=60"

mkdir /var/log/spamassassin/

For more about Postgrey installation and configuration you can read here.

Sasl

apt-get install sasl2-bin libsasl2-2 libsasl2-modules

/etc/default/saslauthd

Don’t forget to add postfix to group sasl.
adduser postfix sasl

For more about Postfix SASL configuration you can read here.

CUPS

apt-get install cups cups-common cups-pdf

/etc/cups/cupsd.conf
/etc/cups/printers.conf

For more about CUPS configuration you can read here.

Cron

/etc/cron.d/reminder
/etc/cron.d/openbl
/etc/cron.daily/backup-configuration

/etc/crontab
Regularly launched various reminders, backups etc.

# m h dom mon dow user  command
50 1  *  *  *  root    /usr/local/bin/backup-pm-wol.sh

/usr/local/bin/backup-pm-wol.sh

#!/bin/sh
etherwake -i eth1 6c:f0:49:7a:52:10

Sarg

Install Sarg – Squid Analysis Report Generator to see the usage of Internet.

For more about Sarg report generator installation and configuration you can read here.

Rsyslog

Configure remote syslog server to capture log messages from important devices on your LAN.

mkdir /var/log/rsyslog
chown root:adm /var/log/rsyslog

/etc/rsyslog.d/90-rsyslog.conf
/etc/rsyslog.d/20-ufw.conf
/etc/rsyslog.conf

/etc/logrotate.d/rsyslog

#insert right after first line /var/log/syslog
#to rotate logs from remote syslog
/var/log/rsyslog/*/*.log

For more about Remote syslog configuration you can read here.

Logrotate

Don’t let your logs grow over reasonable limits. Here are some customised examples.

/etc/logrotate.d/rsyslog
/etc/logrotate.d/dnsmasq
/etc/logrotate.d/fail2ban
/etc/logrotate.d/monit

Duplicity and BackupNinja

/etc/backup.d/30.backup_filesystem.sh
/etc/backup.d/25.pkglist.sh
/usr/local/bin/duplicity-backup.sh
/usr/local/etc/duplicity-backup.conf
/etc/backupninja.conf

mkdir /var/log/duplicity
ln -s /root/.cache /disk/.cache

For more about Duplicity and BackupNinja configuration you can read here.

Rsnapshot

Local LAN data backups are done every day using rsnapshot which is configured and run from home-desktop to do snapshots to local RAID1 mirror (/mnt/mirror/.snapshots) from remote home-server NFS export (/disk).

/etc/crontab
/usr/local/bin/backup-rsnapshot.sh
/etc/rsnapshot.conf
/etc/rsnapshot.d/rsync-exclude.txt

Rsync

Local LAN ISO backup is done every day using rsync which is configured and run from home-desktop to sync to local RAID1 mirror “/mnt/mirror/iso” from remote home-server NFS export “/disk/iso“.

/etc/crontab
30 2 * * * root test -d /mnt/mirror/iso && /usr/bin/rsync -avz --stats --delete --progress /disk/iso/ /mnt/mirror/iso/ 2>&1|tee -a /var/log/rsync.log|mutt -s "rsync-backup $HOSTNAME" root@faix.cz

Rdiff-backup

Remote computers do differential backups using rdiff-backup tool.

apt-get install rdiff-backup

For more about Rdiff-backup configuration you can read here.

Lighttpd and Collect daemon monitoring

I liked Lighttpd before Nginx become famous and widely used. It serves me for redirecting http(s) requests for my faix.cz domain.

It also hosts my simple management server web page which is used as a list of all LAN web services.

Collectd monitoring web server is used for usage statistic of my home-server and home-wifi devices.

/etc/lighttpd/lighttpd.conf
/var/www/index.html
/etc/collectd/collectd.conf

/var/www/collection3/

chown -R www-data:www-data /var/www/*

For more about Lighttpd and Collectd configuration you can read here.

Fail2ban

apt-get install fail2ban

To protect myself from bot scanning zombies and script kiddies I love to use Fail2ban service. It protect my SSH, Postfix (SASL) and Lighttpd checking the failed logins and banning annoying zombies for one year based on their IP addresses.

/etc/fail2ban/jail.conf

Logwatch

apt-get install logwatch

Get your daily readers digest from your server logs. It may give you some hints if something is going wrong.

/usr/share/logwatch/default.conf/logwatch.conf

Detail = High

mkdir /var/cache/logwatch

OSSEC

Using HIDS (Host-based Intrusion Detection System) is a good way to monitor and analyze your server logs and get notifications immediately in case something goes wrong.

For more about OSSEC installation and configuration you can read here.

Transmission-daemon

apt-get install transmission-daemon

/etc/transmission-daemon/settings.json
/etc/default/transmission-daemon

For more about Transmission daemon Web interface installation and configuration you can read here.

Monit client

apt-get install monit install Monit client

/etc/monit/conf.d/home-server

For more about Transmission daemon Web interface installation and configuration you can read here.

Ntopng

Setup Ntop network traffic monitor.

For more about Ntopng installation and configuration you can read here.

LinuxCounter

Join more than one hundred thousands Linux registered users and their machines.

For more about LinuxCounter registration, installation and configuration you can read here.

DynDns

In case you don’t have static public IP address from your ISP, use DynDns service and grab some easy to remember domain name for your Linux machine.

For more about DynDns registration, installation and configuration you can read here.

Random generator

apt-get install rng-tools
/etc/default/rng-tools

HRNGDEVICE=/dev/urandom

Sensors

sensors-detect

SmartmonTools

/etc/default/smartmontools

start_smartd=yes

HDD temperature

/etc/default/hddtemp

RUN_DAEMON="true"

Safe LUKS headers

If you use LUKS encrypted drives and you ever lost your header, all your encrypted data get lost forever.
Keep your LUKS header backup file and it may save your sore ass.

cryptsetup luksHeaderBackup --header-backup-file luks_header_disk-backup /dev/mapper/vg0-lvDisk

M/Monit server on Ubuntu

29/12/2014 Články jan

M/Monit monitoring

Server
apt-get install libapache2-mod-proxy-html libxml2-dev

cd /usr/local/
wget https://mmonit.com/dist/mmonit-3.3-linux-x64.tar.gz
tar -zxvf mmonit-3.3-linux-x64.tar.gz

/etc/apache2/sites-available/monit

<VirtualHost *:80>
    ServerAdmin jan@faix.cz
    ServerName monit.faix.cz
    ServerAlias monitoring.faix.cz

    <Location />
         Order deny,allow
         Allow from all
    </Location>

    ProxyPass / http://localhost:8080/
    ProxyPassReverse / http://localhost:8080/
</VirtualHost>

a2enmod proxy proxy_http
a2ensite monit

service apache2 restart

/etc/hosts

127.0.0.1   localhost monit.faix.cz

/usr/local/mmonit/conf/server.xml

    <Connector address="*" port="8080" processors="10" proxyScheme="http" proxyName="monit.faix.cz" proxyPort="80" />
    <Engine name="mmonit" defaultHost="monit.faix.cz" fileCache="10MB">
    <Host name="monit.faix.cz" appBase=".">

/etc/init/mmonit.conf

 description "M/Monit system monitoring"

 limit core unlimited unlimited

 start on runlevel [2345]
 stop on runlevel [!2345]

 expect daemon
 respawn

 exec /usr/local/mmonit/bin/mmonit

 pre-stop exec /usr/local/mmonit/bin/mmonit stop

initctl reload-configuration
start mmonit

Go to http://monit.faix.cz/.
Login as user “admin” with password “swordfish“.

Jabber gTalk notifications

server: talk.google.com
port: 5222
user: jan.faix@gmail.com
password: app specific

Client
apt-get install monit

/etc/monit/conf.d/myserver

set daemon 120
set logfile /var/log/monit.log
set idfile /var/lib/monit/id
set statefile /var/lib/monit/state
set eventqueue basedir /var/lib/monit/events slots 1000

set httpd port 2812
use address localhost
    allow 0.0.0.0/0.0.0.0
    allow monit:password

set mailserver localhost
set mmonit http://monit:password@monit.faix.cz/collector

check system faix.cz
    if loadavg (1min) > 4 then alert
    if loadavg (5min) > 2 then alert
    if memory usage > 75% then alert
    if swap usage > 25% then alert
    if cpu usage (user) > 70% then alert
    if cpu usage (system) > 30% then alert
    if cpu usage (wait) > 20% then alert

check process sshd with pidfile /var/run/sshd.pid
    start program "/etc/init.d/ssh start"
    stop program "/etc/init.d/ssh stop"
    if failed port 22 protocol ssh then restart
    if 5 restarts within 5 cycles then timeout

check process apache with pidfile /run/apache2.pid
    start program = "/etc/init.d/apache2 start" with timeout 60 seconds
    stop program  = "/etc/init.d/apache2 stop"

check filesystem data with path /dev/mapper/data
    start program  = "/bin/mount /mnt/data"
    stop program  = "/bin/umount /mnt/data"
    if failed permission 660 then unmonitor
    if failed uid root then unmonitor
    if failed gid disk then unmonitor
    if space usage > 80% for 5 times within 15 cycles then alert
    if space usage > 99% then stop
    if inode usage > 100000000 then alert
    if inode usage > 99% then stop

monit -t
service monit restart
monit monitor all
monit status

Transmission Web Interface on Debian

29/12/2014 Články jan

apt-get install transmission-daemon

Your server is running nonstop, so why to download torrents from your desktop, when you can conveniently start the download from your web browser using Transmission-daemon running on your server.

service transmission-daemon stop

usermod -a -G users debian-transmission
usermod -d /var/lib/transmission-daemon debian-transmission
chown -R debian-transmission:debian-transmission /etc/transmission-daemon /var/lib/transmission-daemon/info
rm /var/lib/transmission-daemon/info/settings.json

There has to be link to current /etc/transmission-daemon/setting.json:
ls -l /var/lib/transmission-daemon/info/settings.json

/var/lib/transmission-daemon/info/settings.json -> /etc/transmission-daemon/settings.json

If it doesn’t exists, create it:
ln -s /var/lib/transmission-daemon/info/settings.json /etc/transmission-daemon/settings.json

/etc/transmission-daemon/settings.json
These are my custom setting suites my needs.

"blocklist-enabled": true,
"blocklist-url": "http://list.iblocklist.com/?list=bt_level1&amp;fileformat=p2p&amp;archiveformat=gz",
"download-dir": "/disk/downloads",
"incomplete-dir": "/home/xbmc/Downloads",
"message-level": 1,
"peer-id-ttl-hours": 6,
"peer-port": 9058,
"peer-port-random-high": 9098,
"peer-port-random-low": 9026,
"port-forwarding-enabled": true,
"rpc-authentication-required": false,
"rpc-password": "{MyTopSecretToken",
"rpc-whitelist": "127.0.0.1,192.168.122.*",
"rpc-whitelist-enabled": false,
"speed-limit-up": 30,
"speed-limit-up-enabled": true,
"umask": 1,

/etc/default/transmission-daemon

ENABLE_DAEMON=1
CONFIG_DIR="/var/lib/transmission-daemon/info" 
OPTIONS="--config-dir $CONFIG_DIR"

service transmission-daemon start

You can access your Transmission using your web browser:
http://your_server_address:9091/transmission/web/

Firewall and router on Debian

29/12/2014 Články jan

Network interfaces

/etc/network/interfaces

# The loopback network interface
auto lo
iface lo inet loopback

# WAN network interface
auto eth0
iface eth0 inet static
address 172.16.2.19
netmask 255.255.255.240
network 172.16.2.16
broadcast 172.16.2.31
gateway 172.16.2.17

# LAN network interface
auto eth1
iface eth1 inet static
address 192.168.122.1
netmask 255.255.255.224
network 192.168.122.0
broadcast 192.168.122.31

UFW

apt-get install ufw

/etc/default/ufw

DEFAULT_FORWARD_POLICY="ACCEPT"

/etc/ufw/sysctl.conf

net/ipv4/ip_forward=1

/etc/ufw/before.rules

#add the following code to the top

# NAT table rules
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

# Port Forwardings
-A PREROUTING -i eth0 -p tcp --dport 10000 -j DNAT --to-destination 192.168.122.14:10000

# Forward traffic through eth0 (Internet)
-A POSTROUTING -s 192.168.122.0/27 -o eth0 -j MASQUERADE

# don't delete the 'COMMIT' line or these nat table rules won't
# be processed
COMMIT

#insert lines between ='"#allow dhcp client to work' and '#ufw-not-local'

# allow dhcp server (broadcast requests)
-A ufw-before-input -p udp -i eth1 --sport 67:68 --dport 67:68 -j ACCEPT

ufw allow in on eth1 to any
ufw allow out on eth1 to any

ufw allow ssh
ufw allow smtp
ufw allow https
ufw allow http
ufw allow 9058

ufw disable && ufw enable

Dnsmasq

apt-get install dnsmasq

/etc/dnsmasq.conf

domain-needed
bogus-priv
resolv-file=/etc/resolv.dnsmasq
local=/homelan/
user=dnsmasq
listen-address=127.0.0.1
listen-address=192.168.122.1
no-dhcp-interface=eth0
expand-hosts
domain=homelan
dhcp-range=192.168.122.2,192.168.122.20,255.255.255.224,72h
dhcp-host=home-desktop,192.168.122.2,6c:f0:49:7a:52:10
dhcp-host=home-laptop,192.168.122.3,00:13:e8:99:4b:f7
dhcp-host=home-receiver,192.168.122.4,00:1e:b8:06:4e:11
dhcp-host=faix-desktop,192.168.122.5,00:18:8b:68:aa:4b
dhcp-host=faix-laptop,192.168.122.6,00:13:ce:11:02:fc
dhcp-host=faix-receiver,192.168.122.7,00:1e:b8:06:4c:72
dhcp-host=jan-phone,192.168.122.8,d4:20:6d:44:72:ac
dhcp-host=wassana-phone,192.168.122.9,e8:99:c4:02:2c:00
dhcp-host=home-printer,192.168.122.10,00:01:e6:7d:14:36
dhcp-host=faix-printer,192.168.122.11,00:01:e6:31:6d:e7
dhcp-host=home-tablet,192.168.122.12,ac:22:0b:a1:af:f6
dhcp-host=faix-xbmc,192.168.122.13,b8:27:eb:ad:47:a5
dhcp-host=home-alarm,192.168.122.14,00:19:ba:02:6a:49
dhcp-option=option:router,192.168.122.1
dhcp-option=option:ntp-server,192.168.122.1
dhcp-option=27,1
dhcp-option=vendor:MSFT,2,1i
dhcp-lease-max=20
dhcp-leasefile=/var/lib/misc/dnsmasq.leases
dhcp-authoritative
neg-ttl=3600
mx-target=home-server
localmx
log-facility=/var/log/dnsmasq.log
conf-dir=/etc/dnsmasq.d
dns-forward-max=200
log-async

touch /var/log/dnsmasq.log /var/lib/misc/dhcp.leases
chown dnsmasq /var/log/dnsmasq.log /var/lib/misc/dhcp.leases

/etc/resolv.conf

nameserver 127.0.0.1

/etc/resolv.dnsmasq

domain homelan
search homelan
nameserver 8.8.8.8
nameserver 8.8.4.4

chown dnsmasq /etc/resolv.dnsmasq

/etc/hosts

127.0.0.1 localhost
192.168.122.1 home-server server
192.168.122.2 home-desktop
192.168.122.3 home-laptop
192.168.122.4 home-receiver
192.168.122.5 faix-desktop
192.168.122.6 faix-laptop
192.168.122.7 faix-receiver
192.168.122.8 jan-phone jan
192.168.122.9 wassana-phone wassana
192.168.122.10 home-printer printer1
192.168.122.11 faix-printer printer2
192.168.122.12 home-tablet tablet
192.168.122.13 faix-xbmc
192.168.122.14 home-alarm alarm
192.168.122.29 home-switch switch
192.168.122.30 home-wifi wifi

/etc/logrotate.d/dnsmasq

/var/log/dnsmasq.log {
    weekly
    missingok
    rotate 5
    notifempty
    delaycompress
    sharedscripts
    postrotate
        [ ! -f /var/run/dnsmasq/dnsmasq.pid ] || kill -USR2 `cat /var/run/dnsmasq/dnsmasq.pid`
    endscript
    create 0640 dnsmasq root

NTP server

apt-get install ntp

/etc/ntp.conf

driftfile /var/lib/ntp/ntp.drift
statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable

server 195.113.144.201
server 195.113.144.238
server 127.127.1.0
fudge 127.127.1.0 stratum 10

restrict -4 default kod notrap nomodify nopeer noquery
restrict 127.0.0.1
restrict 192.168.122.0 mask 255.255.255.224 nomodify notrap noquery

broadcast 192.168.122.224

Linux kernel settings

/etc/sysctl.conf

net.ipv4.ip_forward=1
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
net.ipv4.tcp_rfc1337 = 1
fs.file-max = 100000
vm.swappiness = 10
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.rmem_default = 16777216
net.core.wmem_default = 16777216
net.core.optmem_max = 40960
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.core.netdev_max_backlog = 50000
net.ipv4.tcp_max_syn_backlog = 30000
net.ipv4.tcp_max_tw_buckets = 2000000
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 10
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.udp_rmem_min = 8192
net.ipv4.udp_wmem_min = 8192
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.tcp_window_scaling = 0
net.ipv4.tcp_timestamps = 0

OpenWRT TP-Link TL-WR1043ND

25/12/2014 Články BarrierBreaker, OpenWRT, TL-WR1043ND, TP-Link jan

Back in the past I have installed OpenWRT BackFire 10.03 on my TP-Link TL-WR1043ND v1. It was quite pita that time, because I was using WAN port which get disabled after flashing OpenWRT firmware. It was necessary to revert back to crafted TP-Link firmware, which will not disable WAN port after flashing DD-WRT or OpenWRT firmware.

Now come the time to upgrade to currently newest OpenWRT BarrierBreaker 14.07. I decided not to use WAN port anymore (replaced by my Debian Server Router/Firewall/NAS/HTPC) and start with fresh configuration without keeping previous settings.

I have downloaded upgrade OpenWRT firmware to use it over existing OpenWRT installation. I used ‘Flash new firmware image’ option and unchecked ‘Keep setting’.

I did following basic settings:

'System' - 'System' - 'hostname' and 'Timezone'
'System' - 'System' - 'Logging' - 'External system log server' - '192.168.122.1'
'System' - 'Administration' - 'router password'

'Network' - 'Interfaces' - 'LAN' - check 'Bring up on boot', 'Protocol' - 'Static address', check 'Disable DHCP for this interface' (I use Dnsmasq on my primary server).
'Network' - 'Interfaces' - 'WAN' - uncheck 'Bring up on boot'

'Network' - 'Wifi' - 'Scan' and see what channels are less busy
'Network' - 'Wifi' - 'Add' new wireless network

'General Setup' - 'ESSID', 'Mode' - 'Access Point' - 'Network' - 'LAN' - 'Network security' - 'Encryption' - 'WPA2-PSK'
'Advanced Settings' - 'Band' - 2,4GHz, 'Country Code' CZ

Don’t forget to Enable new WiFi network and Restart Log daemon in ‘System -> Startup’ services.

I like to use few extra services on my WiFi access point:

First of all update package database: opkg update

LuCI web interface

In case you did system upgrade from existing OpwnWrt, you may want to install administartion web interface.
opkg install luci

Swap on USB

I already created swap partition on my USB key /dev/sda2, which is automatically detected after installing necessary packages below.
opkg install block-mount kmod-usb-storage swap-utils
swapon -s

Filename        Type    Size  Used  Priority
/dev/sda2        partition  157132  1120  -1

DNS local resolution

I have my own local DNS server and I want name resolution from OpenWrt shell.
opkg install bind-host
/etc/resolv.conf

search homelan
nameserver 192.168.122.1

NFS client

opkg install nfs-utils kmod-fs-nfs kmod-fs-nfs-common
mkdir /disk
touch /etc/diskmount.sh
chmod 755 /etc/diskmount.sh
/etc/diskmount.sh

#!/bin/sh
mount -t nfs home-server:/disk /disk -o nolock

Mail client

opkg install msmtp-nossl

/etc/msmtprc

account default
host 192.168.122.1
auto_from on
maildomain home-wifi.homelan
syslog LOG_MAIL

Cron backup task

ln -sf /etc/crontabs/root /etc/crontab

/etc/crontabs/root

30 0 * * * /usr/bin/test -d /disk/backup || mount home-server:/disk /disk;/usr/bin/test -d /disk/backup; /bin/tar -zcf /disk/backup/home-wifi/home-wifi.tar.gz -C / bin etc lib root sbin tmp usr www

/etc/init.d/cron restart

Arpwatch new MAC monitoring

opkg install http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/packages/oldpackages/arpwatch_2.1a15-3_ar71xx.ipk

ln -s /usr/bin/msmtp /usr/lib/sendmail
/etc/init.d/arpwatch start
/etc/init.d/arpwatch enable

Htop

opkg install htop

Collect daemon client

opkg install collectd collectd-mod-load collectd-mod-memory collectd-mod-network collectd-mod-cpu collectd-mod-df collectd-mod-disk collectd-mod-interface collectd-mod-wireless

mkdir /var/lib/collectd
/etc/init.d/collectd start
/etc/init.d/collectd enable

Monit monitoring client

opkg install monit-nossl
mkdir /etc/monit.d/
/etc/monitrc
Comment ‘#’ everything except:
include /etc/monit.d/*

/etc/monit.d/wifi

set daemon 120
set logfile syslog facility log_daemon
set idfile /var/.monit.id
set statefile /var/.monit.state
set eventqueue basedir /var/monit slots 1000

set httpd port 2812
use address localhost
    allow 0.0.0.0/0.0.0.0
    allow user:password

set mailserver home-server
set mmonit http://user:password@monit.faix.cz/collector

check system home-wifi
    if loadavg (1min) > 4 for 5 times within 15 cycles then alert
    if loadavg (5min) > 2 for 5 times within 15 cycles then alert
    if memory usage > 75% for 5 times within 15 cycles then alert
    if swap usage > 25% for 5 times within 15 cycles then alert
    if cpu usage (user) > 98% for 5 times within 15 cycles then alert
    if cpu usage (system) > 70% for 5 times within 15 cycles then alert
    if cpu usage (wait) > 60% for 5 times within 15 cycles then alert

check process sshd with pidfile /var/run/dropbear.1.pid
    start program "/etc/init.d/dropbear start"
    stop program "/etc/init.d/dropbear stop"
    if failed port 22 protocol ssh then restart
    if 5 restarts within 5 cycles then timeout

check filesystem root with path /
    if space usage > 80% for 5 times within 15 cycles then alert

/etc/init.d/monit start
/etc/init.d/monit enable