To install pure-ftp do the following:

emerge -avq pure-ftp

The default use flags should be fine for most installations.

After it is done installing you need to edit the config file located in /etc/conf.d/pure-ftpd

Make sure to uncomment the following line:

#IS_CONFIGURED="yes"

So that it looks like this:

IS_CONFIGURED="yes"

Now you need to figure out how you want users to authenticate to the FTP server.

To allow login to the FTP server with local user accounts use the following setting for AUTH:

AUTH="-l unix"

For PAM authentication use the following:

AUTH="-l pam"

And finally for built in virtual user support use the following:

AUTH="-l puredb:/etc/pureftpd.pdb"

The virtual user method stores the user information in the file /etc/pureftpd.pdb. In order to setup FTP virtual users do the following:

First setup the ftpgroup and the ftpuser system user

groupadd ftpgroup
useradd -g ftpgroup -d /dev/null -s /etc ftpuser

Now virtual users can be created by using the following syntax:

pure-pw useradd someuser -u ftpuser -d /home/ftpusers/someuser [-m]

The -d flag specifies the user’s home directory. This can be changed to any location you like as long as the user has sufficient privileges on the folder.

The following commands can be used to manage virtual users:

To delete a user:

pure-pw userdel someuser [-m]

To change a user’s password:

pure-pw passwd someuser [-m]

To view a user’s status:

pure-pw show someuser [-m]

To commit changes (NOTE: changes are commited automatically when using the [-m] flag):

pure-pw mkdb

Lastly we need to start the pure-ftpd service and add it to the default runlevel:

/etc/init.d/pure-ftpd start
rc-update add pure-ftpd default

NOTE: If you are running iptables you will want to add the following rule to allow FTP traffic:

iptables -A INPUT -p tcp -m state --state NEW \
-m tcp --dport 21 -j ACCEPT

1. Get Root Access

sudo -s

2. Make The Source Directory

mkdir /usr/src/Zoneminder

3. Get The Source Package

cd /usr/src/Zoneminder

Stable: 1.24.2

wget http://www2.zoneminder.com/downloads/ZoneMinder-1.24.2.tar.gz

Development: svn

svn co http://svn.zoneminder.com/svn/zm/trunk zm

4. Unpack The Sources

tar xzf ZoneMinder-1.24.2.tar.gz

5. Install Required Dependencies

Add the following to /etc/portage/package.keywords:

#Zoneminder
www-misc/zoneminder
dev-perl/PHP-Serialization
virtual/perl-Module-Load
perl-core/Module-Load

Add the following to /etc/portage/package.use

#Zoneminder
www-misc/zoneminder ffmpeg

Check The Dependencies

emerge -pv zoneminder

That will show you all the packages that the ebuild would pull in for Zoneminder. You can just emerge them and let it fail on ZM or a cleaner way would be to add the required packages to /var/lib/portage/world and then do an emerge -avtDNuq world to build them all.

6. Configure and Build Zoneminder

cd /usr/src/Zoneminder/ZoneMinder-1.24.2

Configure the sources (note this is for a localhost install, you can change it to whatever vhost you want)

Make sure to change the zm db username and password to reflect your setup.

Setup the DB

1
mysql -u root -p
create database zm;
grant select,insert,update,delete on zm.* to '<database user>'@localhost identified by '<database password>';
flush privileges;
exit

Import the Initial DB

mysql -u root -p -D zm < db/zm_create.sql

Build it

make clean
make
make install

After all that Zoneminder should be installed on your system and ready to run. Here are is an init script that I created to get Zoneminder started, stopped and reset as well as allow it to start up and shutdown on a machine power cycle.

#!/sbin/runscript
# File:    /etc/init.d/zoneminder
# Purpose:  Startup the Zoneminder Server
# By:   Ronny L. Bull
# Date: 8-31-2010

ZM_START='/usr/local/bin/zmpkg.pl start'
ZM_STOP='/usr/local/bin/zmpkg.pl stop'

depend() {
    need net mysql
}

start() {
        ebegin "Starting Zoneminder"
        $ZM_START
        eend $? "Failed to start Zoneminder!"
}

stop() {
        ebegin "Stopping Zoneminder"
        $ZM_STOP
        eend $? "Failed to stop Zoneminder!"
}

Save the file as zoneminder and copy it to /etc/init.d/zoneminder then make sure to run

chmod +x /etc/init.d/zoneminder

Now you can start and stop your server by doing:

/etc/init.d/zoneminder start

If you want it to start on power up add it to the default runlevel

rc-update add zoneminder default

Thats it! You should now be able to access the Zoneminder web interface at http://serverip/zm.

Now go buy some cameras!

IPTables should already be setup and running on the server, however no rules have been applied. You can verify this by doing the following as the root user:

chkconfig iptables --list

This should report the following:

iptables        0:off   1:off   2:on    3:on    4:on    5:on    6:off

Verify there are no rules present:

iptables -L -v

You should see:

Chain INPUT (policy ACCEPT 91 packets, 10124 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 75 packets, 8607 bytes)
 pkts bytes target     prot opt in     out     source               destination 

Now it’s time to add some rules. You can copy the following text to a file and import it into IPTables:

# Generated by iptables-save v1.3.5 on Sat Aug 13 17:34:43 2011
*filter
:INPUT DROP [19:2463]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [897:135843]
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 5060 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 10000:20000 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 69 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 123 -j ACCEPT
-A INPUT -j LOG
COMMIT
# Completed on Sat Aug 13 17:34:43 2011

Save the file as iptables.bak and copy it to /etc/iptables.bak

Now import the file into IPTables:

 iptables-restore < /etc/iptables.bak

And verify that the rules have been committed:

iptables -L -v

You should now see:

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere
   51  3852 ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            state NEW tcp dpt:ssh
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            state NEW tcp dpt:http
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            state NEW tcp dpt:https
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere            state NEW udp dpt:sip
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere            state NEW udp dpts:ndmp:dnp
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere            state NEW udp dpt:tftp
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere            state NEW udp dpt:ntp
    0     0 LOG        all  --  any    any     anywhere             anywhere            LOG level warning 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 26 packets, 2616 bytes)
 pkts bytes target     prot opt in     out     source               destination

Now save the new IPTables settings:

/etc/init.d/iptables save

That’s it! Your server is now blocking all incoming traffic by default, and only allowing connections to the ports that are necessary to do it’s job. Specifically:

Port 123 UDP for NTP (Time)
Port 69 UDP for TFTP (Phone provisioning)
Port 5060 UDP for SIP (Phone Calls)
Port 10000-20000 UDP for RTP (Phone Calls)
Port 22 TCP for SSH (SSH Connection)
Port 80 & 443 TCP for HTTP/HTTPS (Web)

If you need to open another port just use the following syntax at the command line:

example for SSH over TCP port 22

iptables -A INPUT -p tcp -m state --state NEW \
-m tcp --dport 22 -j ACCEPT

To specify a range of ports do the following:

example for RTP over UDP ports 10000-20000

iptables -A INPUT -p udp -m state --state NEW \
-m udp --dport 10000:20000 -j ACCEPT

You can then save the new configuration by doing:

/etc/init.d/iptabes save

And if your completely satisfied and want to back up the configuration do:

iptables-save > /etc/iptables.bak

dd if=/dev/cdrom of=filename.iso

This uses the dd command with the input set to /dev/cdrom and the output set to filename.iso. Change these values as necessary. Note that some Linux distros mount the cdrom drive to /media/cdrom.

To mount an ISO image and read it just as it was a CDROM loaded in the tray do the following:

mkdir /mnt/iso
mount -o loop -t iso9660 filename.iso /mnt/iso

The contents of the ISO can now be accessed in /mnt/iso.

Polycom SoundPoint IP 335	Polycom SoundPoint IP 550

The first step is to download the ISO image from here. Choose 32 bit or 64 bit depending on the hardware your installing on. Burn the ISO to a CD then boot the computer. You should then see the following screen:

Type 1 and press Enter to install Asterisk 1.6 with the FreePBX gui.

The installer will begin to load and if the hard disk has not been formatted yet it will ask if you would like to initialze the hard drive. Choose Yes. You will then see a screen that gives you partitioning options for your hard drive. If you are only using this computer for AsteriskNow then choose: “Remove all partitions on selected drives and create default layout”. Click next, then click Yes when it asks: “Are sure you want to do this”.

Choose your region and click next:

Then set the root password, click next and wait for the installation to complete. Once the installer completes press Reboot and remove the CD from the drive.

When the machine comes back up you will be presented with the Setup Agent menu. You can use this tool to configure your network interface card if you need to supply a static IP address. For now we will assume DHCP and just let it time out or exit to proceed. You can call up the network setup utility at any time later and add a static IP, configure the hostname, or add DNS entries by using the command:

system-config-network

The system should now be at a login prompt. Log in as the user root with the password you setup during the installation. Now it is time to update the system with the most current software.

yum update

This command will download all of the latest software updates and then ask you if you want to install them. Type y during any prompts. Once the updates are complete reboot your computer by issuing the command:

reboot

After the server comes back up from the reboot you will see the login prompt. Above the prompt there should be a line that tells you where to point your web browser to configure AsteriskNow with FreePBX. Point your web browser to the address, click on the FreePBX Administration link, and log in with the user freepbx and the password fpbx. You should now see the FreePBX Status Page.

Now for security purposes we need to change the admin user’s password. This will also prevent you from being locked out after we upgrade FreePBX, since for some reason the freepbx user becomes inaccessible after the upgrade. To do this click on the Administrators link in the Setup menu. You will see a small list in the top left, one button says Add User and the other says admin. Click on admin then change the password in the password box and hit Submit Changes.

Notice the orange button that now appears on top of the page. You need to click that every time you make a configuration change so that the change can be committed to the system, and Asterisk can be reloaded so the changes can take effect.

Now you can log out and log back in as admin with your new password. Use this account to log in from now on instead of the freepbx user.

Now it is time to update FreePBX from 2.7 to 2.9. There are a few steps to this and they must be performed in the correct order. If you are doing this installation in a Virtual Machine I highly suggest you make a snapshot now that you can revert back to if something goes wrong. If you don’t know what a Virtual Machine is then just disregard that last statement!

To upgrade FreePBX select Module Admin from the Setup menu. In the drop down box select extended repository, click Ok on the prompt then click on Check for updates online.

You will now see a list of packages, some of them will be marked with an available update, and some will be marked as not installed. The only package we are concerned with at the moment is the 2.8 Upgrade Tool. Click on it and then select Download and Install. Then click on Process.

Confirm the installation, click return when the orange box pops up, then click the orange Apply Configuration Changes button at the top. Another orange box will pop up, click Continue with reload.

You will now have a new menu item in the Setup menu called 2.8 Upgrade Tool. Click on it to use the upgrade tool.

Follow the instructions on the page TO THE LETTER!. First you will press the Upgrade Now button on the page to update the database. Then you will go back over to the module admin page, click on check for updates online, and ONLY UPDATE the FreePBX Framework module. After the FreePBX Framework is updated select extended repository from the drop down list and check for updates online again. This time click on the Upgrade All link to select all modules that need to be updated, change the 2.9 Upgrade tool to “No Action”, and then click process. Apply the configuration changes and reload.

Now we can proceed to the 2.9 Upgrade which is basically the same exact process as the 2.8 upgrade except we need to install a few dependency modules first. In the module admin click on check for updates online then select the following 2 modules and set them to “Download and Install”:

FreePBX ARI Framework
FreePBX FOP Framework

After they are installed apply the configuration changes and reload Asterisk. Then in module admin click check for updates online again, select the 2.9 Upgrade Tool and choose “Download and Install”, then click on process to install it. When it is finished installing apply the configuration changes and reload. Then select 2.9 Upgrade Tool from the Setup menu.

Follow the instructions on the page TO THE LETTER!. First you will press the Upgrade Now button on the page to update the database. Then you will go back over to the module admin page, click on check for updates online, and ONLY UPDATE the FreePBX Framework module. After the FreePBX Framework is updated select the basic and extended repositories, and check for updates online again. This time click on the Upgrade All link to select all modules that need to be updated, and then click process. Apply the configuration changes and reload. Now make sure the basic and exended repositories are selected and check for updates online again. Choose Upgrade All and then click process. Once it is finished updating the modules apply the changes and reload. Your system should now be fully updated to FreePBX 2.9. Now we can install the Endpoint Manager module that will be used to setup our Polycom phones.

In the module admin make sure the basic and extended repositories are selected then click check for updates online. Now scroll down the list a bit and look for the Endpoint Manager section. Click on PBX End Point Manager and choose “Download and Install” then click on process. Apply the configuration changes and reload Asterisk. You should now have a few End Point Manager links in your tools menu.

Now it is time to take a step back from the FreePBX interface and get our hands dirty at the command line! We need to setup and install a few utilities that will be used by the End Point manager to configure the phones. Specifically we need to install nmap, and configure a tftp server that the phones will use to download their configurations and firmware from. We will also need to setup an NTP server that the phones will synchronize their time with.

In a terminal on the AsteriskNow server do the following as the root user:

First install NMAP, type y for any prompts:

yum install nmap

That was easy! Ok now we need to configure a NTP time server, the package is already installed but the service is not running. To start it up and set it to autostart on boot type the following:

chkconfig ntpd on
/etc/init.d/ntpd start

Now let’s setup the tftp server:

chkconfig tftp on
/etc/init.d/xinetd restart
chmod 777 /tftpboot/

Thats it for the command line! You can now exit out of the terminal and log back into the FreePBX web interface. Next we will configure the End Point Manager so that it can support the Polycom phones.

Click on the Tools menu then click End Point Manager Advanced Settings. Click the Determine for me link next to the IP address of phone server box. Then make sure the NMAP executable path is set to /usr/bin/nmap. Then click on the Update Globals button.

Next click on the End Point Configuration link. Then click the Check for Updates button, you should now see a list of company names.

Now click the green install button under the Polycom section to download configuration files for all of the supported polycom phones.

Now click the green Enable button under the SoundPoint IP 335 and SoundPoint IP 550 listings to enable them to be used when configuring an endpoint.

Now we need to install the firmware for the PolyCom phones to the /tftpboot folder. This is done by clicking the Install Firmware button under the SoundPoint/Station/VVX In-Production Models [320,330,321,331,335,450,550,560,650,670,5000,6000,7000,1500] heading. This process will take a few moments to download the files.

Now we need to create a SIP extension that we can bind a phone to. Click on the Setup menu then choose Extensions and then choose Generic SIP Device in the drop down box. For now lets just get the extension working and not worry about any of the other settings. Enter in information for the following variables:

User Extension
Display Name
secret

Then apply the configuration changes and reload Asterisk.

Next click on the newly created extension in the list on the right hand side and change the nat value to Yes.

Now let’s configure an End Point device that will be assigned to this extension. Click on the Tools menu and then End Point Device List. Enter the MAC Address of the phone (usually located on the bottom), select the brand from the drop down list (Polycom), use line 1, select the extension you just created, then click the Add button.

Thats it for the End Point Configuration. All that is left to now is setup the phone’s boot server option to point to the IP address of the AsteriskNow server.

Power up your PolyCom phone enter the setup menu and use the password 456 when prompted. Make sure DHCP is set to enabled and in the DHCP Menu the Boot Server option is set to Custom+Opt.66. Next in the Server Menu make sure the Server Type is set to TrivialFTP then set the Server Address option to the IP address of your AsteriskNow server. Once this is all set reboot the phone and it should connect to the server, synchronize it’s time, download and install the new firmware files, and update it’s configuration with the extension settings.

To setup more phones just create more extensions and corresponding devices in the End Point Manager. Then setup the phone boot options and you should be good to go!

Turns out the LVM volume group was inconsistent after the clone, my guess is because the hard drives were of the same capacity but different brands so there may have been some differences. Using the lvs and vgs commands did not show the LVM volume information, but instead displayed a kernel dump with a plethora of information. The main error being about the inconsistency of the volume group. In order to solve the problem I had to perform the following command:

vgextend --master VG_XenStorage-7eb4d8dc-3fa4-5db5-4512-5dc5a671c638 \
 /dev/sda

Then restart the xapi service:

/etc/init.d/xapi restart

Time to see if we can make it crash again with the new drive!

First we have to configure the kernel to support the framebuffer devices. You will need the following options enabled in your kernel config:

CONFIG_CONNECTOR=y
CONFIG_FB=y
CONFIG_FIRMWARE_EDID=y
CONFIG_FB_MODE_HELPERS=y
CONFIG_FB_VESA=y
CONFIG_VGACON_SOFT_SCROLLBACK=y
CONFIG_VGACON_SOFT_SCROLLBACK_SIZE=64
CONFIG_FRAMEBUFFER_CONSOLE=y
CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y
CONFIG_FB_CON_DECOR=y

Next we need to setup some use flags in /etc/portage/package.use:

#splashutils
media-gfx/splashutils fbcondecor
media-libs/jpeg static-libs
virtual/jpeg static-libs
media-libs/lcms static-libs
media-libs/libpng static-libs

Then we need to unmask and install the necessary packages:

echo "media-gfx/splashutils fbcondecor" >> /etc/portage/package.use
emerge -av splashutils splash-themes-livecd splash-themes-gentoo

Now start the fbcondecor service and add it to the default runlevel:

/etc/init.d/fbcondor start
rc-update add fbcondecor default

Then create an initrid image and add it’s entry to grub.conf. Note: themes are located in /etc/splash.

splash_geninitramfs --verbose --res 1280x800 --generate /boot/initramfs-bootsplash theme_name

grub.conf example:

kernel /boot/kernel-2.6.37-gentoo-r4 root=/dev/sdb3 splash=verbose,fadein,theme:natural_gentoo video=vesafb:mtrr:3,ywrap vga=0x361 quiet CONSOLE=/dev/tty1
initrd /boot/fbsplash-natural_gentoo-1280x800

Grub Notes:

• splash=verbose – means you will see text scroll by, set to silent to just see a fancy progress bar. (Depends on theme)
• fadein – will fade into the framebuffer on boot
• theme:theme_name – the theme you are using
• video=vesafb:mtrr:3,ywrap – vesa framebuffer options
• vga=0x361 – The resolution supported by your video card in hex. Set to Auto to see a list of supported resolutions and their codes for your monitor, experiment, then set it to the one that works.
• CONSOLE=/dev/tty1 – what console do we start the framebuffer on

Reboot and behold the wonders of your new framebuffer!

Simply install the package through emerge:

emerge -avq app-admin/denyhosts

The initial configuration in /etc/denyhosts.conf should suffice, however it is well commented and you can edit it to suit your needs. You may want to add your email address in the ADMIN_EMAIL = variable so that denyhosts can email you alerts.

Once it is installed and configured start it up and add it to the default runlevel:

/etc/init.d/denyhosts start
rc-update add denyhosts default

Thats it! Your server will now block an IP address after 3 failed ssh login attempts.

But what do I do if I accidentally lock out a valid IP address? Glad you asked!

You need to remove the wrongfully accused IP address from the following files using this process:

First stop the denyhosts service:

/etc/init.d/denyhosts stop

Then remove the IP from the following files:

/etc/hosts.deny
/var/lib/denyhosts/hosts
/var/lib/denyhosts/hosts-restricted
/var/lib/denyhosts/hosts-root
/var/lib/denyhosts/hosts-valid

Now restart the service:

/etc/init.d/denyhosts start

You should now be able to ssh from the blocked IP address once again.

#!/bin/bash

#Backup script
#By: Ronny L. Bull

SUBJECT="System Backup";
TO="youremail@yourdomain.com";
MESSAGE="System backup completed";

#backup from one location to another
nice -19 rdiff-backup --exclude /boot/lost+found /boot/ /var/backup/boot/

nice -19 rdiff-backup --exclude /home/lost+found /home/ /var/backup/home/

nice -19 rdiff-backup /etc/ /var/backup/etc/

nice -19 rdiff-backup /root/ /var/backup/root/

echo "Subject: $SUBJECT
$MESSAGE" | sendmail $TO

exit

Script Notes:

The script uses a nice value of -19 so that it does not interfere too much with other running processes since file copying is a fairly taxing IO process. Also passing the –exclude flag to rdiff-backup allows you to exclude certain directories from being backed up, such as LOST+FOUND.

#!/bin/bash

#Script to report public IP address change
#By: Ronny L. Bull

TO="youremail@yourdomain.com"
FROM="alerts@yourdomain.com"

#The file that contains the current pubic IP
EXT_IP_FILE="/path/to/ipaddress"

#Get the current public IP from whatsmyip.com
CURRENT_IP=$(curl http://automation.whatismyip.com/n09230945.asp)

#Check file for previous IP address
if [ -f $EXT_IP_FILE ]; then
KNOWN_IP=$(cat $EXT_IP_FILE)
else
KNOWN_IP=
fi

#See if the IP has changed
if [ "$CURRENT_IP" != "$KNOWN_IP" ]; then
echo $CURRENT_IP > $EXT_IP_FILE

#If so send an alert
echo "Subject: The IP Address at home has changed
The IP address at home has been changed to $CURRENT_IP" | sendmail -f ${FROM} ${TO}

logger -t ipcheck -- IP changed to $CURRENT_IP
else

#If not just report that it stayed the same
echo "Subject: The IP Address at home is the same
The IP address at home stayed the same $CURRENT_IP" | sendmail -f ${FROM} ${TO}
logger -t ipcheck -- NO IP change
fi