• firewall behavior
• exporting file system syntax and use of pseudo file systems
• difference in mount command syntax

I am running systems that use SELinux and firewalls*. I have one Centos 5.3 NFS server and three client machines running as virtual machines** on the server. My goal was to establish remote file systems for the virtual machine clients. I’ll skip some of the introductory steps to set up the nfs server process that are listed in the doc.

I’ll list the commands that I used to export the file system from the server and the mount command I first used on the client. The file system that I was attempting to export was /junk/client1. On the server (server.stevens.net), I added the following to /etc/exports:

and I used the following mount command on client1.stevens.net (and received the error shown):

A bit surprised that it didn’t work, I poked around the Internet and I found some good info that ultimately helped me get on the right track at Miles Brennan’s Linux Home Server HOWTO page. He does an excellent job explaining the pseudo file system configuration required for version 4 of NFS.

I built out the following psuedo file system on the server:

I then created bindings in /etc/fstab between /NFS4exports and /junk directories as follows (Bindings are like symbolic links, but the files are available in both filesystems, rather than being linked to the source location.):

Then I list the pseudo file systems in the /etc/exports file, and it is critical to note that the fsid=0 option be defined on the /NFS4exports file system (even though /NFS4exports itself will not be mounted by a remote client). Then all exported file systems are sub-directories of this system. If I had additional file systems elsewhere on the server that I wanted to share (say, /home), I would need to create an entry in the pseudo file system and bind it to /home in fstab.

Then I mounted the file systems from the client1 system. A major difference between the NFSv3 and NFSv4 command is that the root pseudo filesystem is not included in the identity of the remote file system (i.e., the NFS4exports directory is omitted from the command.

And on client2, showing an example that it can mount the client1 directory, but can’t see anything or write to it:

And that completed my setup (except to modify /etc/fstab so that the new /remotesys file system will automount at boot). The main point was to learn about NFS, but I also ended up with a way to provide storage for my virtual machines outside of the .vmdk virtual file system.


Footnotes:
* NFSv4 plays better with firewall because, unlike NFSv3, it does not make use of portmapper and rpc.mountd, rpc.statd, and rpc.lockd. I just had to open port 2049 on the firewall for NFS. However, during some troubleshooting, I needed to execute “showmount -e sserver.stevens.net’ from a client machine. The firewall blocked it, because it uses rpc.mountd and portmapper picks a random port by default. I used /etc/sysconfig/nfs to define a static port for rpc.mountd and then opened this port on the firewall too.
** As a side note with respect to the virtualization setup, I created one vm and installed a small, simple Centos image. Then I copied the files twice to new folders in /var/lib/vmware/VirtualMachines. Then I imported these virtual machines into VMware Server to quickly make some clones. Just a quick edit of the /etc/sysconfig/network file to update each machine to a unique hostname, and I had 3 distinct client machines.

Then reboot the system, and make and mount the volumes.

Now, This volume will be used only as a Samba share. As discussed here by Walker, we do not need to reserve block space for the root user or system logs. Here is how to adjust it:

Ta-da! Now, on to a Logical Volumes. Logical volumes take more work to create and are more difficult to understand, but a quick read of Chapter 9 of the of the Redhat Deployment Guide will get you through. However, the deployment guide does not have a quick command line guide for creating LVMs.
I’m going to make a logical volume group VolGroup02, with two logical volumes, LogVol00 and LogVol01, each logical volume will be 100GB. I’ll start with the creation of the physical partition /dev/sdb2 using fdisk.

Then initialize the physical volume for use by LVM, create the Volume Group and Logical Volumes.

Then create the file systems, remove the reserved the space, make and mount the file systems.

And it is almost that easy. I did have some problems at the outset of this endeavor. After I installed the 500GB drive, I re-installed Linux (for an unrelated reason). I had thought that the installation ignored the 500GB drive, however, I learned that the installation process will allocate all unused space into a logical volume. I was confused at first when it would not make the filesystem, citing that it was in use. The folks over at the centos.org forum were able to help me out and get me on track.

So, I have a Linux machine with tons of HDD storage space (250 + 500 GB) .  The XP machine needs additional space.  And it must be transparent to the rest of the family.  I used Samba to create file shares on the Linux machine, then created mapped network drives on the XP machine that connect automatically to the Linux machine’s HDDs at login.  It wasn’t hard, but did trip me up on a couple points.

Samba is an open source software package that allows Linux/Unix machines to participate in Windows networking as nodes in the Windows “Network Neighborhood” and therefore provide file sharing between Linux and Windows machines.  It was easy to install the Samba package on CentOS, using the Add/Remove software package from the desktop GUI, and included a GUI configuration tool for Samba.  The CentOS deployment guide provides good guidance for configuration, and the samba.org site provide an excellent extra level of detail for the software.  A couple of points to add that were key learnings for me:

1. The Samba GUI provides a simple, easy configuration tool for the basic samba config, identifying the workgroup name, shared volumes and users/passwords.  The manual config is accomplished via the smb.conf file in /etc/samba.  Manual edit of the conf file provides more options than the GUI, including logging level, source IP address filtering, and preventing access to home directory.  However, if you make changes to this conf file, then make changes to the config via the GUI, your manual changes to the conf file will be removed.  So make the simple GUI config changes first, get a functioning system, then tweak the configuration with vi edits of the smb.conf file.
2. Windows XP required that I set samba up with “user” authentication, not “share”, and I had to encrypt the passwords on the Samba config.  Windows would not attempt to make connections when Samba was configured with unencrypted passwords.

The Samba config was easier to config than the Windows XP side.  Once I had the Samba server running, I was able to go into “Network Neighborhood”, view the “workgroup nodes” and connect with the user/password set up in Samba.  Then I could map a drive letter to a share folder on the Linux box.  Easy, right?  Almost.  Even though I asked Windows to ‘reconnect at login’, Windows could not.  Looking at the Samba logs in var/log/samba/smbd.log (with logging set to level 3 via the conf file “log level = 3) I could tell that the problem was with XP, not Samba, and I suspect that Windows was not chaching the password.

The solution was a batch file that runs at startup on the XP machine.  I found a forum post that explained the syntax very well, using the net use command.  My specific command was “net use S: \\server\storage passwd /USER:username”  Then I just had to store the batch file in the ’startup’ programs folder for “All Users”, and now the drive maps automatically at startup.  Then I’ll convert the “My Pictures” folder to a shortcut to a folder on the Samba shared volume.  Perfectly transparent to my family.

As long as the power is on the Linux box.

Update Jul 20, 2009:

I rebuilt my machine and used a firewall and Security Enhanced Linux (SELinux), which created a couple additional challenges.  First, the firewall had to be configured to allow smb protocol for Samba, which was easy.  Second, (and a bit more tricky) the smb.conf file had notes for SELinux, indicating that the shared folders needed to be marked with “samba_share_t”. The current labels can be displayed with “ls -ldZ /path”, and the label on a share folder can be set with “chcon -t samba_share_t /path”. Once I resolved these issues, all was fine.

Photo credit, eheçatzin

I downloaded the latest CentOS, 5.3 x86_64 (verified with a nice MD5 calculator from Microsoft), burned 7 .iso CD’s using our old PC, dropped disk 1 into the new PC’s DVD/CD drive, powered on and seemed to make some progress…but after a few text based screens realized that CentOS could not recognize my SATA HDD nor DVD/CD and would not launch the install GUI.  I was able to rig a connection between my old PC’s IDE CD drive to the new PC’s motherboard, changed boot preference in BIOS and was able to make better progress.  The install package would now launch its GUI, only to tell me that it could not find a HDD to partition.  Grrr…

I did some research on the web, and as with most things, I was not the first person to have this problem.  I was pretty sure it was an issue with my mobo/chipset and the SATA interface.  I was able to find a thread on the CenOS forum page that explained that I needed to type, at the boot prompt of the install: “linux pci=nomsi boot”.  Without really knowing what the command meant, I gave it a shot, and it worked.  I’ve since learned that I was preventing the use of Message System Interupts,  but don’t really understand yet why that fixed it.

I ran through a quick install and was pleased to get a booted PC, but quickly became dissapointed when I could not connect to the internet.  No Ethernet port discovered.  Back to the Centos forum.  I suspected an issue with the Ethernet controller, which was also on the chipset (nVidia GeForce 8300) and quickly found some advice that that fixed the problem.  I had to download a module using my old PC, transfer it to the new Linux box via USB stick sneakernet, and install it with rpm. A reboot of the PC (network services restart wasn’t enough), and I’m on the internet.  W00t!

By the end of the Memorial Day weekend, I had a functioning PC, ready for some more serious playing.  Maybe a second post later when I find additional components not recognized.

I worked with my friend Chris (computer aficionado) to assemble a list of components from newegg.  I wanted to build a cheap machine, but still have enough power to allow me to experiment with LAMP infrastructure and virtualization, and also enough storage to archive the family’s growing collection of digital photos and video.

Here is what we chose for hardware:

• GIGABYTE GZ-X5BPD-500 Black SECC Steel / ABS ATX Mid Tower Computer Case –Model #:GZ-X5BPD-500
• ASUS M3N78-EM AM2+/AM2 NVIDIA GeForce 8300 HDMI Micro ATX AMD Motherboard – Model M3N78-EM
  
• Thermaltake Purepower W0100RU 500W ATX 12V 2.0 Power Supply – Model #:W0100RU
• AMD Athlon 64 X2 4400+ Brisbane 2.3GHz Socket AM2 Dual-Core Processor –Model ADO4400IAA5DU
• Kingston 4GB (2 x 2GB) 240-Pin DDR2 SDRAM DDR2 800 (PC2 6400) Dual Channel Kit Desktop Memory Model KVR800D2N6K2/4G – Model #:KVR800D2N6K2/4G
• Seagate Barracuda 7200.10 ST3250410AS 250GB 7200 RPM SATA 3.0Gb/s 3.5″ Internal Hard Drive – Model #:ST3250410AS
• SAMSUNG 22X DVD Burner Black SATA – Model SH-S223F
• And a Thermaltake CPU cooler, TR2-R1 P/N A4022 (more about this later).
  

All said and done, minus rebates and including shipping, about 380  bucks.

I ordered the gear on Sunday morning, and received the shipment Thursday afternoon.  My son and I split the assembly pretty evenly, while my daughter even helped mount the HDD.  I won’t review the steps I took to build it, you can find that info many places on the web, such as here, here and here.  For the sake of transparency, I will mention the two mistakes that I made while building it:

1. I mistakenly bought a CPU without a cooling fan.  Dumb. I had the correct CPU picked out, then at the last minute saw a cheaper/nearly identical version, and quickly picked it, not paying attention to the details (or the picture, clearly showing a CPU only).  Impact? Since I didn’t want to wait for the delivery of a fan, or attempt to exchange the CPU, I went out to CompUSA/TigerDirect and picked up a $23 Thermaltake CPU cooler and some thermal paste (more than I ’saved’ on my last-minute CPU choice).
2. Despite very good and very clear instructions from ASUS, I forgot to attach the 4 pin 12V ATX power cable to the motherboard.  I got the 24 pin power connection, but I guess I had seen too many web pages showing the connection of the 24 pin connector and convinced myself that was all that was needed.  The impact? When I turned on the machine, the CPU fan and the case fan would spin, but that was it.  The power LED would not come on, the monitor showed nothing, and I couldn’t turn off the motherboard with the soft switch, but rather had to cut the AC.  I started looking on the web for possible solutions.  I reseated the memory, & CPU, disconnected the HDD and DVD, and checked the power switch connections.  I had all but given up and was ready to contact ASUS for an RMA, when I gave the board one last look over and spotted the 4 pin ‘hole’, then rechecked the ASUS manual and found a very clear statement (as well as a picture): “Do not forget to connect the  4 pin ATX 12V power plug. Otherwise the system will not boot.” Duhuhh.  I’m lucky that I didn’t fry the board with my power cycles.

So, with only a couple of stumbles (er, rather,  “learning opportunities”), I now have a system that will POST.  More importantly, the day after completing the build, my son asked me, “I wonder if my Nintendo DS has the same parts as the computer?”  That alone was worth the time and energy spent. I like seeing the lightbulbs ignite.

Next adventure on the new PC, loading CentOS Linux.

It wasn’t until I started bookmarking the hosting sites on on my del.icio.us page that I noticed a distinction.  While most of the sites listed on webhostinggeeks were bookmarked a few hundred times, Bluehost was bookmarked 10 times more often, over 3500 times!  An important rule of social media is to “trust the masses.” This may just be a volume decission, as it seems that Bluehost is the only host to crack the top 50 webhosts, out of the sites I bookmarked.

So a few weeks ago I bit the bullet and signed up for a site with Bluehost.  As for domain name, I chose markstevens20.net.  I tried to be more creative, but

• A) I’m not that creative and
• B) Anything creative I did come up with, was already parked by someone else.  Annoying, isn’t it?

But markstevens20.net suits me fine.  It’s easy to remember, albeit somewhat narcisistic, and I like that the 20 hints at 2.0.  Whether that’s web 2.0, enterprise 2.0 or just Mark Stevens 2.0, I’ll figure that out as I go.

My strengths are in data networks, having worked with Nortel Ethernet Routing Switches and earning a CCNA (twice).  I know quite a bit about VoIP systems, especially SIP based gear, and plan to upgrade my CCNA credentials to CCNA Voice  in the near future, maybe eventually a CCVP.  I seek to learn more about other aspects and technologies of the web.  This web presence is a place to experiment with xhtml and css initially, and with any luck, I’ll be able to move on to MySQL databases and php.  I’ve done a little simple coding here, first learning FORTRAN 77 in college, then noodling around with VBA and C.  I can fumble my way around UNIX and LINUX machines, but only know enough to be dangerous.

In addition to some foundational stuff, I seek to learn more about  “Web 2.0″ technologies, especially those that enable enterprise collaboration.  I have been exploring the human side of these tools for about a year, investigating what makes people, of any age, able to adopt them, while others are stuck working independently, connected to their colleagues by email, phone and maybe IM.  I had hoped to find that large enterprises could change and embrace new ways of working.  But I’m afraid that I’ve concluded, at least at my current organization, that it is not possible.  Hence a journey begins, to explore on my own; to seek a new home.