Set-up PPTP virtual private network (VPN) server on Ubuntu Linux

This is short guide how to set-up VPN service on Ubuntu Linux server. VPN is intended to secure your internet traffic against local snooping by encrypting the traffic and tunneling it out from known good server. Possible use cases are

  • Secure your organization internal traffic between home office, mobile devices an the office
  • Hide internet traffic from the big brother
  • Spoof your location for TV and video streams: you are renting a server in a different country, like US, allowing you to watch US only video streams
  • Spoof your location for iPhone / iPad / iPod / Android apps
  • Visit sites which are otherwise unreachable (though in this case an SSH tunnel + SOCKS proxy is easier to set-up, more lightweight, alternative)
  • Test mobile applications against local servers during mobile app development

These instructions set-up VPN using PPTP protocol which is widely supported. After the server has been set-up you can use any modern OS or device to connect to the VPN: Windows, OSX, Linux, iOS, Android, etc.

Prerequisitements

  • Basics of UNIX command line (the hacker typing thing)
  • Basics of Linux server administration

Setting up PPTP daemon

We are using (old) Ubuntu 8.04 server though instructions should apply for later Ubuntu versions too. These installation instructions are restart free – however few commands must be placed into /etc/rc.local file to make the changed settings persist over Linux restarts.

First install some free software

sudo apt-get install pptpd telnet iptables

Pick up your server public fixed IP address. Usually this is what you see in ethernet 0 adapter.

ipconfig

Then edit /etc/pptpd.conf

sudo nano /etc/pptpd.conf

(Use sudo nano for editing other files too later in this tutorial)

Uncomment and change the localip line to your server public IP address

localip 70.164.204.106

Then edit /etc/ppp/pptpd-options

Make PPTP service to give DNS name resolving servers for the VPN clients. In optimal case you use the DNS server from your server provider, but Google’s public DNS servers (below) work fine:

sudo nano /etc/ppp/pptpd-options

Uncomment and change ms-dns lines to

ms-dns 8.8.8.8
ms-dns 8.8.4.4

Edit /etc/ppp/chap-secrets as sudo and add your PPTP username and password (plaintext)

sudo nano /etc/ppp/chap-secrets 

# Secrets for authentication using CHAP
# client    server    secret            IP addresses
opensource  pptpd     hacker            *

Run the following commands to enable IP NAT routing on your server (allows piping traffic through the public IP of the server):

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo sysctl net.ipv4.ip_forward=1

These settings above are effective only until the server restart. Put them into /etc/rc.local start-up script file to make sure Linux runs them on the start-up.

Restart PPTP daemon to make it read settings again

sudo /etc/init.d/pptpd restart

Setting VPN PPTP client

For the VPN client (iPad, Windows, OSX, Ubuntu Network Manager) the settings would be for the example above:

  • Protocol: PPTP
  • Server: your server public IP or DNS name
  • Login: opensource
  • Password: hacker
  • Encryption level: auto (or it should pick secure MPPE 128 by default)
  • Send all traffic: Yes (will forward all traffic through VPN, not just one inside your VPN devices)

Troubleshooting

If the VPN traffic is not going through, i.e. your internet stops working when VPN client is active, here are some instructions to pinpoint where the error happens.

Inspect the server syslog while connecting to the VPN service

sudo tail -f /var/log/syslog

These lines are “normal”:

Oct 22 18:34:05 ubuntu pppd[19129]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded.
Oct 22 18:34:05 ubuntu pppd[19129]: pppd 2.4.4 started by root, uid 0
Oct 22 18:34:05 ubuntu pppd[19129]: Using interface ppp0
Oct 22 18:34:05 ubuntu pppd[19129]: Connect: ppp0 <--> /dev/pts/1
Oct 22 18:34:05 ubuntu pptpd[19128]: GRE: Bad checksum from pppd.
Oct 22 18:34:08 ubuntu pppd[19129]: MPPE 128-bit stateless compression enabled
Oct 22 18:34:09 ubuntu pppd[19129]: Cannot determine ethernet address for proxy ARP
Oct 22 18:34:09 ubuntu pppd[19129]: local  IP address x.x.x.x
Oct 22 18:34:09 ubuntu pppd[19129]: remote IP address 192.168.0.234

On the client side, try to use ping command to reach servers by IP address to determine if you have problems with DNS set-up

  • Your server public IP
  • 8.8.8.8 (Internet IP, Google’s public DNS server)
  • google.com

E.g. run the command

ping 8.8.8.8

.. and see if the packets go through.

If you manage to ping numeric IPs, but not google.com the problem is with DNS settings.

After the traffic is flowing through check the public IP address your device using duckduckgo.com:

https://duckduckgo.com/?q=!what+is+my+ip

It should give your VPN server IP address instead of your lcoal public IP address.

Random notes

  • iOS devices and Android devices also may use crowdsourced WLAN / 3G station data for determining yout location, so you might need to spoof your local WLAN connection somehow
  • To determine if WLAN is being used just open Google Maps, show your location and if it doesn’t go to the location of VPN server then it is using your WLAN position
  • Practical workaround: Just set a temporary tethering WLAN access point using your mobile phone (e.g. Android) and walk to somewhere where your device cannot hear WLAN to work around this – most of apps check the location only once during the launch

 

\"\" Subscribe to RSS feed Image Follow me on Twitter Image Follow me on Facebook Image Follow me Google+

Zend Server installation potentially kills your SSH

Zend Server installation on your server can potentially kill your server, as in you cannot SSH into it anymore. SSH gets suicidal:

Aug 31 11:12:54 xxx kernel: sshd[4246]: segfault at 7fff237db000 ip 7f871b7bfc84 sp 7fff237d93d0 error 6 in sshd[7f871b77a000+61000]

SSH’ing to localhost from a local console can give more information:

ssh: /usr/local/zend/lib/libcrypto.so.0.9.8: no version information available (required by ssh)
ssh_exchange_identification: Connection closed by remote host

You don’t see the error reason above unless you have a local console available. So, when realizing what has happened might make you panic for few seconds.

However after getting into a local console you can cure Zend with fire:

cd /usr/local/
rm -rf zend

Then kill all processes related to zend

 ps -ef | grep zend | awk '{ print $2 }' | xargs kill

Restart SSH to make it load a working libcrypto from /usr/lib

/etc/init.d/ssh restart

… and never look back to Zend Server.

“Tested” on Ubuntu 8.04 Linux.

\"\" Subscribe to RSS feed Image Follow me on Twitter Image Follow me on Facebook Image Follow me Google+

Copy/move phpBB3 forum from a server to another computer (Ubuntu/Linux)

Here are short instructions what you need to do in order to move / copy phpBB3 forum.

Prerequisites

What you need in order to benefit from these instructions

  • Basic UNIX command-line knowledge
  • SSH access to the server
  • MySQL access to the database
  • LAMP stack ready on the new server

These instructions have been tested on Ubuntu/Debian/Linux but they should work in other environments too.

Write down database access information

Get password from config.php file on the old server:

cd /var/www/phpBB3
cat config.php

Write down database name, username and password.

Copy files

Use rsync to remotely copy forum files to a new computer. On new computer, in /var/www folder

rsync -av --compress-level=9 user@oldserver.com:/var/www/phpBB3 .

Dump and copy database

Execute the following command on the new server. It takes SSH connection to the old server and dumps phpBB3 database to the new server over the SSH connection.

ssh user@oldserver.com -C -o CompressionLevel=9 mysqldump -u databaseuser --password=databasepassword --skip-lock-tables --add-drop-table databasename > phpbb3.sql

Create a new database

Use the old access information from config.php to create a database with identical access information on the new server. You need a MySQL root access to create new databases.

mysql -uroot -p

Create database and grant access to phpBB3 user for it.

mysql> create database databasename;
mysql> GRANT ALL ON databasename.* TO 'databaseuser'@'localhost' identified by 'databasepassword';

Load the database on the new server from the dump file:

mysql> connect databasename;
mysql> source phpbb3.sql

Configure Apache virtualhost for the new server

The last step is to set-up Apache virtual host on the new server, so you can access the phpBB3 using a domain name. Note that this doesn’t need to be a real domain name, but you can spoof the domain name using /etc/hosts file on your local workstation.

Add file /etc/apache2/sites-enabled/phpbb3.conf (or pick a filename based on forum name if you host multiple forums)

<VirtualHost *>
 ServerName yourdomainname.com

 DocumentRoot /var/www/phpBB3
 <Directory />
   Options FollowSymLinks
   AllowOverride None
 </Directory>

</VirtualHost>

Note that <virtualhost *> may change depending on how Apache has been set up to listen IP addresses and ports. Also if you are using a shared hosting package or VPS you might need to use the server control panel (cPanel) to do this step.

Then check if your new config file is ok and restart Apache:

apache2ctl configtest
apache2ctl graceful

Hosts spoofing trick

If you are not having a DNS server of your own which you can use for the copy you can always use /etc/hosts file trick to spoof domain names. This way you can make Apache to serve the forum from the server even if the forum is not connected to any real domain name yet.

 

 

 

 

 

\"\" Subscribe to RSS feed Image Follow me on Twitter Image Follow me on Facebook Image Follow me Google+

Zope Zeo vs. standalone setups

We do some Plone development here at Redi. As known, Plone is a powerful, but unfortunately quite a heavy CMS which is best suited for Intranets. Thus, we are always looking for speed increase.

Enter Zeo cluster – a feature that nowadays comes bundled with Zope and allows one database (practically Data.fs) to be used by multiple Zope instances, or more accurately Zeo clients. In standalone installation only one CPU / CPU core can be used for processing requests (as Zope / Python implementation is single-threaded AFAIK). So if there are any concurrent requests the database (ZODB, the Zope Object Database) usually has to wait for the request processing before it is asked for the data and only part of the processing power is used as requests are queued. Using Zeo server-client architecture however, each Zeo client can do the processing on their own CPU/core (thus efficiently using the whole CPU prosessing power available) and also minimize the hard disk idle time by asking for data in an ~asynchronous manner (in separate queues). Actually ZODB even serves the same object simultaneously to different client processes for performance reasons. This might raise database ConflictErrors, which are nothing to fear of, however, as noted some paragraphs below.

Similarly, you could also deploy Zeo clients on different computers in local network (or wherever you want), but that’s not the scope of this article. Having clients running on different machines is a similar case with the same performance basis, but there are connection lags, bandwith limits and such that decrease performance.

Theory vs. practice

Deploying a Zeo cluster instead of standalone Zope instance should theoretically increase the performance by factor of extra available CPUs / CPU cores. There might be some overheads from this setup though, so we tested it out using ApacheBenchmark – the benchmarking module that comes bundled with Apache nowadays. But first something about…

Setting up Zeo & converting from standalone mode

In the easiest scenario, setting Zeo up is rather easy: the unified installer supports Zeo-server setup out of the box (=there is a recipe for it). Just run the unified installer like:

$ ./install.sh zeo

Luckily, the unified installer uses buildout from Plone 3.1 onwards. Thus, converting your current buildout instances to Zeo cluster is nothing but change of buildout configuration. Where you would normally need ‘instance’ section in your buildout.cfg you will now need the following:

[zeoserver]
recipe = plone.recipe.zope2zeoserver
zope2-location = ${zope2:location}
zeo-address = 127.0.0.1:12000
#effective-user = __EFFECTIVE_USER__
[client1]
recipe = plone.recipe.zope2instance
zope2-location = ${zope2:location}
zeo-client = true
zeo-address = ${zeoserver:zeo-address}
# The line below sets only the initial password. It will not change an
# existing password.
user = admin:mysecretpassword
http-address = 12001
#effective-user = __EFFECTIVE_USER__
#debug-mode = on
#verbose-security = on

# If you want Zope to know about any additional eggs, list them here.
# This should include any development eggs you listed in develop-eggs above,
# e.g. eggs = ${buildout:eggs} ${plone:eggs} my.package
eggs =
    ${buildout:eggs}
    ${plone:eggs}

# If you want to register ZCML slugs for any packages, list them here.
# e.g. zcml = my.package my.other.package
zcml =

products =
    ${buildout:directory}/products
    ${productdistros:location}
    ${plone:products}

To add more clients (which is quite the point here), append as many times the extra client sections like this:

[client2]
recipe = plone.recipe.zope2instance
zope2-location = ${zope2:location}
zeo-client = true
zeo-address = ${zeoserver:zeo-address}
user = ${client1:user}
http-address = 12002
#effective-user = __EFFECTIVE_USER__
#debug-mode = on
#verbose-security = on
eggs = ${client1:eggs}
zcml = ${client1:zcml}
products = ${client1:products}

That minimizes the need for retyping user names, password etc. These examples were taken from Plone unified installer buildout.cfg with ports changed.

Starting, stopping & restarting

Now, to start your Zeo-powered Plon clients you could type:

bin/zeoserver start
bin/client1 start
bin/client2 start
...same for all the clients...

However, the unified installer has a recipe which automatically generates nice and simple shell scripts to control your cluster. In the end of your buildout.cfg, add:

[unifiedinstaller]
recipe = plone.recipe.unifiedinstaller
user = ${client1:user}
primary-port = ${client1:http-address}

That should generate the scripts. In fact, it propably does also something else, something which I’m not aware of. However, I didn’t bump into any problems, yet 🙂 Anyway, to start the whole cluster (server & clients), type:

bin/startcluster.sh

And that does it (it start server and the clients). Shut it down via:

bin/shutdowncluster.sh

And restart:

bin/restartcluster.sh

ConflictErrors – not that errerous

As noted before, in Zeo mode the ZODB might serve the same objects to two more clients at the same time. If one client manipulates the object before others (ie. edits values and saves changes) the other requests will propably fail. This raises ConflicError which looks like this:

ConflictError: database conflict error (oid 0x0f39, class HelpSys.HelpSys.ProductHelp)

In this case ZODB tries to reprocess the failed requests. This should be common database approach and thus a feature, not a bug (although Zope might want to tell that in error message!). For more accurate explanation see Plone discussion.

Parsing it together with web server

The Zeo components (server and clients) talk to each other via standard Internet protocols (TCP or UDP, not sure). In the default setup, the Zeo server listens to port 8100 and Zeo clients to 8080, 8081, etc. Thus, to access the separate clients as ‘one site’ we need to serve the requests to multiple clients. This can be achieved with load balancers. Apache has at least one: mod_proxy_balancer which should do exactly what we need. Apache isn’t the best choice for achieving high requests per second values, but it will do for our tests (compare to more lightweight but also more limited lighttpd). Just remember that there are other alternatives/methods available, like using squid as load balancer.

Our configuration is as follows (inside VirtualHost-directive):

  <Proxy balancer://lb>
    BalancerMember http://127.0.0.1:12001/
    BalancerMember http://127.0.0.1:12002/
    BalancerMember http://127.0.0.1:12003/
    BalancerMember http://127.0.0.1:12004/
  </Proxy>

  <Location /balancer-manager>
    SetHandler balancer-manager
    Order Deny,Allow
    Allow from all
  </Location>

  ProxyPass /balancer-manager !
  ProxyPass             / balancer://lb/http://localhost/VirtualHostBase/http/www.mydomain.com:80/plonesite/VirtualHostRoot/
  ProxyPassReverse      / balancer://lb/http://localhost/VirtualHostBase/http/www.mydomain.com:80/plonesite/VirtualHostRoot/

This setup also allows us to use the balancer-manager (accessible at /balancer-manager) that comes with mod_proxy_balancer. It’s useful for checking if the configuration is working and balancer is dividing the requests equally. In my setup the balancer is using the default Request Counting -algorithm which divides the requests numerically equally between the instances, but you might want to also try Weighted Traffic Counting, which should be for actual use. In our test only the frontpage is accessed however, so each request’s data transfer is equal and the weighted traffic counting isn’t of use.

The test

The server machine

  • Ubuntu 8.04 virtual server
  • Intel Xeon 2.0Ghz (4 cores)
  • 2 GB of RAM
  • Hard disk drive (7200rpm?)

The setup

  • Standalone Plone instance
  • Plone via Zeo server with 4 clients (as many clients as cores in processor)
  • Plone via Zeo server with 6 clients (for curiosity)

The tests where run locally in development environment to minimize the network lag (was 0-1ms).

The test commands

ApacheBenchmark commands:

$ ab -n N -c C myurl

where N was either 1000 or 9000 (requests) and C 1, 10, 100 or 1000 (concurrent requests).

The results

You can download the more in-depth test sheet Plone Standalone vs. Zeo installation (PDF).

To put it simple: theory and practise meet well – Zeo server is a lot more powerful with concurrent requests. On non-concurrent requests the results are about the same.

Having as many Zeo clients as CPUs / CPU cores can boost the performance up to number of extra CPUs/cores. For example, in our quad-core server with Zeo setup we gained nearly 4 times the requests per second of standalone installation (~370% to be accurate). Increasing Zeo clients to 6 didn’t help any as there’s no processing power left from 4 heavily stressed client processes. Also to be noted is that the waiting times for clients nearly tripled (median jumped from 126 to 305 ms) when raising concurrency from 1 to 10. This isn’t bad though – those are still low figures compared to standalone’s median of 1215 ms! Only when raising concurrency to 100 we began to see some 3,6 seconds waiting times (6 seconds for standalone). Increasing concurrency didn’t bring down the requests/second rates much (less than 5%) as expected.

Overall, the results were expected, but now we have evidence of it: under concurrent request load Zeo server is a good option to multiply the performance of your site. With very low traffic sites which rarely get more than 1 request at time this doesn’t matter.

One bad word about the resource requirements though: The used RAM increase for 6 client Zeo setup (standard Plone 3.1.2 + 12 additional Products) was whopping 621 MB (1132 MB -> 1753 MB). That means about 100 MB per Zeo client as the Zeo server memory intake was only about 12-15 MB. Thus, only use as many Zeo clients as absolutely necessary or you might find your beloved server machine under very serious Zope flu!