2008 - Debian 4 - Xen domU - Base (Golden image)
The Slovak original of this document: 2008 - Debian 4 - Xen domU - Base (Golden image) (slovensky).
|=---------------------------------=[ XEN ]=-------------------------------=| +---------------------------------------------------------------------------+ | | | XEN-server domU (REAL SERVER HW) | | Debian 4.0 Etch | | BASE SYSTEM | | | +---------------------------------------------------------------------------+ |=-------------------------------=[ BH 2008 ]=-----------------------------=|
1. Vytvorenie noveho virtualneho stroja (LVM)
Nainstalujeme utilitky pre spravu xen hostov
============================================
# apt-get install xen-tools
Set the parameters the new VM host needs (32 BIT)
=================================================
# nano /etc/xen-tools/xen-tools.conf
------------------------------------
lvm = system_vhosts
debootstrap = 1
size = 1.5Gb
memory = 256Mb
swap = 256Mb
fs = ext3
dist = etch
image = full
gateway = 10.0.0.254
netmask = 255.0.0.0
passwd = 1
kernel = /boot/vmlinuz-2.6.18-6-686
pr. /boot/vmlinuz-2.6.18-5-xen-686
initrd = /boot/initrd.img-2.6.18-6-686
pr. /boot/initrd.img-2.6.18-5-xen-686
------------------------------------END-/etc/xen-tools/xen-tools.conf
Set the parameters the new VM host needs (64 BIT)
=================================================
# nano /etc/xen-tools/xen-tools.conf
------------------------------------
lvm = system_vhosts
debootstrap = 1
size = 1.5Gb
memory = 256Mb
swap = 256Mb
fs = ext3
dist = etch
image = full
gateway = 10.0.0.254
netmask = 255.0.0.0
passwd = 1
kernel = /boot/vmlinuz-2.6.18-6-amd64
pr. /boot/vmlinuz-2.6.18-5-xen-686
initrd = /boot/initrd.img-2.6.18-6-amd64
pr. /boot/initrd.img-2.6.18-5-xen-686
------------------------------------END-/etc/xen-tools/xen-tools.conf
Vytvorime VM host s nazvom 'base' a ip adresou 10.0.0.1
=======================================================
# xen-create-image --ip=10.0.0.1 --hostname=base
Create the logical partitions for the remaining mount points (/var, /var/log, /tmp, /usr)
=========================================================================================
# lvcreate -L 1G -n base-var system_vhosts
# lvcreate -L 1G -n base-varlog system_vhosts
# lvcreate -L 0.5G -n base-tmp system_vhosts
# lvcreate -L 2G -n base-usr system_vhosts
# mkfs.ext3 /dev/system_vhosts/base-var
# mkfs.ext3 /dev/system_vhosts/base-varlog
# mkfs.ext3 /dev/system_vhosts/base-tmp
# mkfs.ext3 /dev/system_vhosts/base-usr
Pridame diskove particie do konfiguracneho suboru virtualneho stroja 'base'
===========================================================================
# nano /etc/xen/base.cfg
------------------------
# BASE SYSTEM
# The kernel image, the initrd and the memory for this virtual machine
kernel = '/boot/vmlinuz-2.6.18-6-xen-amd64'
ramdisk = '/boot/initrd.img-2.6.18-6-xen-amd64'
memory = '256'
# Diskove zariadenia
root = '/dev/sda1 ro'
disk = [ 'phy:system_vhosts/base-disk,sda1,w', 'phy:system_vhosts/base-swap,sda2,w', 'phy:system_vhosts/base-var,sda3,w', 'phy:system_vhosts/base-varlog,sda4,w', 'phy:system_vhosts/base-tmp,sda5,w', 'phy:system_vhosts/base-usr,sda6,w' ]
# Hostname
name = 'base'
# Siet
vif = [ 'ip=10.0.0.1' ]
# Spravanie
on_poweroff = 'destroy'
on_reboot = 'restart'
on_crash = 'restart'
------------------------END->/etc/xen/base.cfg
Start the newly created VM host and switch to its console (-c)
==============================================================
# xm create -c base.cfg
Nainstalujeme 2 balicky na zabranenie warningov od APT
======================================================
# apt-get install locales console-data
Nakonfigurujeme balicek locales
===============================
# dpkg-reconfigure locales
Nainstalujeme zakladne nastroje
===============================
# apt-get install mc syslog-ng
Opustenie konzoly virtualneho stroja
====================================
CTRL + ]
Vratenie sa do konzoly virtualneho stroja
=========================================
# xm console base
Shutdown virtualneho stroja
===========================
# xm shutdown -H base
Zrusenie virtualneho stroja [destroy] (!!! nerobi cisty shutdown !!!)
=====================================================================
# xm destroy base
To have the virtual machine start when the dom0 machine boots
=============================================================
# mkdir /etc/xen/auto
# ln -s /etc/xen/base.cfg /etc/xen/auto/
Spustenie noveho systemu
========================
# xm create -c base.cfg
Konfiguracia domU - base
========================
# nano /etc/hostname
--------------------
base
# nano /etc/network/interfaces
------------------------------
auto eth0
iface eth0 inet static
address 10.0.0.1
gateway 10.0.0.254
netmask 255.0.0.0
-------------------------------
# cat /etc/fstab
----------------
/dev/sda1 / ext3 errors=remount-ro 0 1
proc /proc proc rw,nodev,nosuid,noexec 0 0
/dev/sda2 none swap sw 0 0
/dev/sda3 /var ext3 defaults,nodev 0 2
/dev/sda4 /var/log ext3 defaults,nodev,nosuid,noexec 0 2
/dev/sda5 /tmp ext3 defaults,nodev,nosuid,noexec 0 2
/dev/sda6 /usr ext3 defaults,nodev 0 2Installing the SSH server (openbsd ssh)
-------------
Install ssh
-------------
# apt-get install ssh
------------
Config ssh
------------
# nano /etc/ssh/sshd_config
---------------------------
ListenAddress 10.0.0.1
PermitRootLogin no
AllowUsers bh skupko firefox
X11Forwarding no
Banner /etc/issue.net
#Subsystem sftp /usr/lib/openssh/sftp-server
---------------------------END->/etc/ssh/sshd_config
--------------------
Nastavenie banneru
--------------------
# nano /etc/issue
-----------------
***************************************************************************
UPOZORNENIE
This computer system is private property. It may be used only by
authorised users. Privacy on this system is not
zarucene.
Akekolvek pouzitie tohto pocitacoveho systemu moze byt zaznamenavane,
monitorovane, podrobene auditu, inspekcii ci inej kontrole zamestnavatela,
majitela ci legislativnych organov.
Pouzivanim tohto systemu uzivatel suhlasi so zaznamenavanim a monitorovanim
svojich aktivit v pocitacovom systeme, rovnako suhlasi s pripadnou inspekciou
svojich aktivit v systeme majitelom alebo legislativnymi organmi. Neopravnene
pouzitie systemu moze viest k disciplinarnym trestom zamestnavatela a k
criminal investigation. By using this system the user confirms that they
has been made aware of the conditions above. Should anything above
uvedenym nesuhlasite, okamzite sa so systemu odhlaste.
****************************************************************************
-----------------END->/etc/issue
# cat /etc/issue > /etc/issue.net
---------------------------------
to iste ako /etc/issue ;-)
--------------------------
Firewall - Kernel tuning
--------------------------
# nano /etc/sysctl.conf
-----------------------
# TCP SYN Cookie Protection - ON
net.ipv4.tcp_syncookies = 1
# IP Source Routing - OFF
net.ipv4.conf.all.accept_source_route = 0
# ICMP Redirect Acceptance - OFF
net.ipv4.conf.all.accept_redirects = 0
# IP Spoofing Protection - ON
net.ipv4.conf.all.rp_filter = 1
# Ignoring to ICMP Requests - ON
net.ipv4.icmp_echo_ignore_all = 1
# Ignoring Broadcasts Request - ON
net.ipv4.icmp_echo_ignore_broadcasts = 1
# Bad Error Message Protection - ON
net.ipv4.icmp_ignore_bogus_error_responses = 1
# Logging of Spoofed Packets, Source Routed Packets, Redirect Packets - ON
net.ipv4.conf.all.log_martians = 1
# IPV4 Forwarding
net.ipv4.conf.all.forwarding=0
-----------------------END->/etc/sysctl.confInstalacia Bastille linuxu
------------------
Install bastille
------------------
# apt-get install bastille
-----------------
Config bastille
-----------------
# InteractiveBastille
---------------------
>accept
Q: Would you like to set more restrictive permissions on the administration utilities? [yes]
Q: Would you like to disable SUID status for mount/umount? [yes]
Q: Would you like to disable SUID status for ping? [yes]
Q: Would you like to disable SUID status for at? [Yes]
Q: Would you like to disable SUID status for traceroute? [yes]
Q: Should Bastille disable clear-text r-protocols that use IP-based authentication? [yes]
Q: Would you like to enforce password aging? [no]
Q: Would you like to restrict the use of cron to administrative account? [yes]
Q: Do you want to set the default umask? [yes]
Q: What umask would you like to set for users on the system? [077]
Q: Should we disallow root login on all ttys? [yes]
Q: Would you like to password-protect the GRUB prompt? [no]
Q: Would you like to disable CTRL-ALT-DELETE rebooting? [yes]
Q: Would you like to password protect single-user mode? [no]
Q: Would you like to set a default-deny on TCP Wrappers and xinetd? [no]
Q: Should Bastille ensure the telnet service does not run on this system? [yes]
Q: Should Bastille ensure inetd's FTP service does not run on this system? [yes]
Q: Would you like to display "Authorized Use" message at log-in time? [no]
Q: Would you like to put limits on system resource usage? [yes]
Q: Should we restrict console access to small group of the user accounts? [yes]
Q: Which accounts should be able to login at console? [root bh skupko firefox]
Q: Would you like to add additional logging? [no]
Q: Would you like to install TMPDIR/TMP scripts? [no]
Q: Would you like to run the packet filtering script? [no]
Q: Are you finished answering the questions, i.e. may we make the changes? [yes]Instalacia SeLinuxu
Postup podla: BH_Debian4.0_SeLinux
2. Setting up the network (NAT-ed network)
----
dom0
----
# nano /etc/xen/xend-config.sxp
===============================
(network-script network-nat)
(vif-script vif-nat)
Zapneme SNAT pre siet 10.0.0.0/255.0.0.0
========================================
# iptables -t nat -A POSTROUTING -s 10.0.0.0/255.0.0.0 -j SNAT --to-source 192.168.254.254
Presmenurejeme poziadavky na 192.168.254.254:22221 na 10.0.0.1:22
=================================================================
# iptables -t nat -A PREROUTING -p tcp -s xx.xx.xx.xx -d 192.168.254.254 --dport 22221 -j DNAT --to-destination 10.0.0.1:22