Tag Archives: dhcp

virtualbox: Disable DHCP server for host-only network

Recently I decided to install virtualbox headless on my server to have something to play around with. Ok... cool...
The installation went fine, creation couple of VMs also.

Also I wanted to have my DHCP server, controlled by me. So far so good. I installed isc-dhcp-server on host, I configured it just fine... but at some point I realized that there is something wrong in the logs.

Jan 24 02:11:00 server dhcpd: DHCPDISCOVER from 08:00:27:3f:03:fe via vboxnet0
Jan 24 02:11:00 server dhcpd: DHCPOFFER on 192.168.56.253 to 08:00:27:3f:03:fe via vboxnet0
Jan 24 02:11:00 server dhcpd: DHCPREQUEST for 192.168.56.106 (192.168.56.100) from 08:00:27:3f:03:fe via vboxnet0: lease 192.168.56.106 unavailable.

Hmm! Houston we have a problem! After digging a little bit, I discovered that there is rogue DHCP server in my network... At least now I know what I am looking for.
I stopped my DHCP server, I disabled virtualbox DCHP server (from phpvirtualbox... I know, I was lazy) and my VM was still getting IP address... Something is fishy here. Ok, then maybe something is wrong with phpvirtualbox! I decided not to trust GUIs, so I started with to play around with cli commands:

[codesyntax lang="bash"]

vboxmanage list dhcpservers

[/codesyntax]
NetworkName:    HostInterfaceNetworking-vboxnet0
IP:             192.168.56.100
NetworkMask:    255.255.255.0
lowerIPAddress: 192.168.56.101
upperIPAddress: 192.168.56.254
Enabled:        No

Note: And this was the output after disabling the DHCP server from phpvirtualbox.

No problem...

[codesyntax lang="bash"]

vboxmanage dhcpserver modify --netname HostInterfaceNetworking-vboxnet0 --disable
vboxmanage list dhcpservers

[/codesyntax]
NetworkName:    HostInterfaceNetworking-vboxnet0
IP:             192.168.56.100
NetworkMask:    255.255.255.0
lowerIPAddress: 192.168.56.101
upperIPAddress: 192.168.56.254
Enabled:        No

Ok... I checked it one more time...
[codesyntax lang="bash"]

ifdown eth1 && ifup eth1

[/codesyntax]

The VM received the same IP address! This is going to be though, I said to myself...

[codesyntax lang="bash"]

VBoxManage dhcpserver remove --netname HostInterfaceNetworking-vboxnet0

[/codesyntax]

And now, when I listed the dhcpservers the above command returned nothing.

Perfect... I checked it again:

[codesyntax lang="bash"]

ifdown eth1 && ifup eth0

[/codesyntax]

Still got the IP... Fuck!!!

Ok... This is my personal server, is not in production, I can afford to reboot it... (Please notice that I was lazy again... I could remove and add back the virtualbox kernel modules)

Guess what?! After rebooting my VM was able to get the right IP address from my DHCP server!

How to install dhcp, dns, pxe on debian squeeze

Introduction

This document describes how to install DHCP, DNS and PXE network services on a debian squeeze.

For this tutorial I use a machine that has two network interfaces:
eth0: 10.34.132.149/255.255.254.0 (WAN interface)
eth1: 172.20.30.1/255.255.255.0 (LAN interface)

To install a PXE server, you will need the following components:
DHCP Server
TFTP Server
NFS/FTP/HTTPD server (to store installing files)

Note: DHCP Server will listen only on eth1.
         In this tutorial I will use apache2 server.

Install required packages

[codesyntax lang="bash"]

apt-get install tftpd-hpa syslinux dhcp3-server bind9 dnsutils

[/codesyntax]

Configure DHCP Server

[codesyntax lang="bash"]

vim /etc/dhcp/dhcpd.conf

[/codesyntax]

ddns-update-style ad-hoc;
log-facility syslog;

option domain-name "test.org";
option domain-name-servers 172.20.30.1;
option subnet-mask 255.255.255.0;
subnet 172.20.30.0 netmask 255.255.255.0 {
    authoritative;
    range 172.20.30.10 172.20.30.90; # ip range
    option routers 172.20.30.1; # gateway for clients
    ######
    # in case want to deny clients that are not configured in dhcpd uncomment the following line
    ######
    #deny unknown-clients;
    allow booting;
    allow bootp;
    next-server 172.20.30.1; # tftpd server's IP
    filename "pxelinux.0";

    ######
    # sample of a client that has mac address reserved on dhcp
    ######
    #host guest1 {
    #    hardware ethernet 00:0C:29:14:DA:AD;
    #    fixed-address 172.20.30.15;
    #}
    ######
}

Force DHCP Server to listen only on eth1

[codesyntax lang="bash"]

vim /etc/default/isc-dhcp-server
:%s/INTERFACES=""/INTERFACES="eth1"/g
:wq

[/codesyntax]

Configure TFTP Server. Change the root directory on startup from /srv/tftp to /tftpboot

[codesyntax lang="bash"]

vim /etc/default/tftpd-hpa
:%s/\/srv\/tftp/\/tftpboot/g
:wq

[/codesyntax]

Setup TFTP Server network boot files

[codesyntax lang="bash"]

mkdir -p /tftpboot
chmod 777 /tftpboot

cp -v /usr/lib/syslinux/pxelinux.0 /tftpboot
cp -v /usr/lib/syslinux/menu.c32 /tftpboot
cp -v /usr/lib/syslinux/memdisk /tftpboot
cp -v /usr/lib/syslinux/mboot.c32 /tftpboot
cp -v /usr/lib/syslinux/chain.c32 /tftpboot

mkdir /tftpboot/pxelinux.cfg

[/codesyntax]

Create PXE menu file

[codesyntax lang="bash"]

vim /tftpboot/pxelinux.cfg/default

[/codesyntax]

default menu.c32
prompt 0
timeout 300
MENU TITLE test.org PXE Menu

LABEL centos6.3_i386
    MENU LABEL CentOS 6.3 i386
    KERNEL /netboot/centos/6.3/i386/vmlinuz
    APPEND console=tty0 console=ttyS0,9600N1 initrd=/netboot/centos/6.3/i386/initrd.img ks=http://172.20.30.1/netboot/centos/6.3/i386/centos6.3-ks.cfg  ksdevice=link

Share the internet connection with clients

[codesyntax lang="bash"]

vim /etc/sysctl.conf
:%s/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1
:wq

[/codesyntax]

Apply the settings:
[codesyntax lang="bash"]

sysctl -p

[/codesyntax]

Share internet connection using iptables:
[codesyntax lang="bash"]

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

[/codesyntax]

Configure bind9

[codesyntax lang="bash"]

echo "include \"/etc/bind/bind.keys\"; ">> /etc/bind/named.conf

vim /etc/bind/named.conf.options

[/codesyntax]

options {
        directory "/var/cache/bind";
        auth-nxdomain no;    # conform to RFC1035
        listen-on-v6 { none; };
        forwarders { 8.8.8.8; 8.8.4.4; };
        listen-on port 53 { any; };
        allow-query { any; };
        allow-query-cache { any; };
};

Add the following lines at the end of the named.conf.default-zones
[codesyntax lang="bash"]

vim /etc/bind/named.conf.default-zones

[/codesyntax]

zone "test.org" {
        type master;
        file "/etc/bind/test.org";
};

zone "30.20.172.in-addr.arpa" {
        type master;
        file "/etc/bind/30.20.172.in-addr.arpa";
};

[codesyntax lang="bash"]

vim /etc/bind/test.org

[/codesyntax]

$ORIGIN test.org.

$TTL 1H

test.org.          IN SOA ns.test.org. root.test.org. (
                                2012062600      ; serial
                                12H             ; refresh
                                2H              ; retry
                                1W              ; expiry
                                2D )            ; minimum

test.org.      IN    NS   ns.test.org.

ns.test.org.   IN    A    172.20.30.1

www10          IN    A    172.20.30.10
www11          IN    A    172.20.30.11
www12          IN    A    172.20.30.12
www13          IN    A    172.20.30.13
www14          IN    A    172.20.30.14
www15          IN    A    172.20.30.15

[codesyntax lang="bash"]

vim /etc/bind/30.20.172.in-addr.arpa

[/codesyntax]

$ORIGIN 30.20.172.in-addr.arpa.

$TTL 2D

@          IN SOA ns.test.org. root.test.org. (
                                2012062600      ; serial
                                12H             ; refresh
                                2H              ; retry
                                1W              ; expiry
                                2D )            ; minimum

@     IN    NS     ns.test.org.

1     IN    PTR    ns.test.org.

10    IN    PTR    www10.test.org.
11    IN    PTR    www11.test.org.
12    IN    PTR    www12.test.org.
13    IN    PTR    www13.test.org.
14    IN    PTR    www14.test.org.
15    IN    PTR    www15.test.org.

Let's use our DNS server

[codesyntax lang="bash"]

echo "search test.org" > /etc/resolv.conf
echo "nameserver 127.0.0.1" >> /etc/resolv.conf

[/codesyntax]

PXE boot/Kickstart CentOS 6.3 Install

A PXE install server allows your client computers to boot and install a Linux distribution over the network, without the need of burning Linux iso images, or human interaction.

For this tutorial I use a machine that has two network interfaces:
eth0: 10.34.132.149/255.255.254.0 (WAN interface)
eth1: 172.20.30.1/255.255.255.0 (LAN interface)

To install a PXE server, you will need the following components:
DHCP Server
TFTP Server
NFS/FTP/HTTPD server (to store installing files)

Note:

* DHCP Server will listen only on eth1.
* In this tutorial I will use HTTPD server.

1. Install required packages

[codesyntax lang="bash"]

yum install dhcp tftp tftp-server syslinux wget vim httpd

[/codesyntax]

2. Configure DHCP Server

[codesyntax lang="bash"]

vim /etc/dhcp/dhcpd.conf

[/codesyntax]

#--SystemImager vars - if you don't have SystemImager you can delete the following lines
######
option option-100 code 100 = string;
option option-128 code 128 = string;
option option-129 code 129 = text;
option option-140 code 140 = string;
option option-141 code 141 = unsigned integer 32;
option option-142 code 142 = string;
option option-143 code 143 = string;
option option-144 code 144 = string;
option option-144 "n";
option option-140 "172.20.30.1"; # this must be the IP address of the SI server where images reside
######

ddns-update-style ad-hoc;
log-facility syslog;

option domain-name "test.org";
option domain-name-servers 172.20.30.1;
option subnet-mask 255.255.255.0;
subnet 172.20.30.0 netmask 255.255.255.0 {
    authoritative;
    range 172.20.30.10 172.20.30.90; # ip range
    option routers 172.20.30.1; # gateway for clients
    ######
    # in case want to deny clients that are not configured in dhcpd uncomment the following line
    ######
    #deny unknown-clients;
    allow booting;
    allow bootp;
    next-server 172.20.30.1; # tftpd server's IP
    filename "pxelinux.0";

    ######
    # sample of a client that has mac address reserved on dhcp
    ######
    #host guest1 {
    #    hardware ethernet 00:0C:29:14:DA:AD;
    #    fixed-address 172.20.30.15;
    #}
    ######
}

3. Force DHCP Server to listen only on eth1

[codesyntax lang="bash"]

vim /etc/sysconfig/dhcpd
:%s/DHCPDARGS=/DHCPDARGS=" eth1 "/
:wq

[/codesyntax]

 

4. Configure TFTP Server. Set disable from yes to no, and change the root directory on startup from /var/lib/tftpboot to /tftpboot

[codesyntax lang="bash"]

vim /etc/xinetd.d/tftp

[/codesyntax]

service tftp
{
        socket_type             = dgram
        protocol                = udp
        wait                    = yes
        user                    = root
        server                  = /usr/sbin/in.tftpd
        server_args             = -s /tftpboot
        disable                 = no
        per_source              = 11
        cps                     = 100 2
        flags                   = IPv4
}

5. Setup TFTP Server network boot files

 

[codesyntax lang="bash"]

mkdir -p /tftpboot
chmod 777 /tftpboot

cp -v /usr/share/syslinux/pxelinux.0 /tftpboot
cp -v /usr/share/syslinux/menu.c32 /tftpboot
cp -v /usr/share/syslinux/memdisk /tftpboot
cp -v /usr/share/syslinux/mboot.c32 /tftpboot
cp -v /usr/share/syslinux/chain.c32 /tftpboot

mkdir /tftpboot/pxelinux.cfg
mkdir -p /tftpboot/netboot/centos/6.3/i386

cd /tftpboot/netboot/centos/6.3/i386
wget -c ftp://ftp.ines.lug.ro/centos/6.3/os/i386/images/pxeboot/initrd.img
wget -c ftp://ftp.ines.lug.ro/centos/6.3/os/i386/images/pxeboot/vmlinuz

[/codesyntax]

 

6. Encode root password used for clients
[codesyntax lang="bash"]

openssl passwd -1 "your_password"

[/codesyntax]

 

$1$LY1EPt3P$BvVLJ.7yyzaDy/7zxmakr.

7. Create a new kickstart file
[codesyntax lang="bash"]

vim /var/www/html/netboot/centos/6.3/i386/centos6.3-ks.cfg

[/codesyntax]

 

install
firewall --disabled
url --url="ftp://ftp.ines.lug.ro/centos/6.3/os/i386"
network  --bootproto=dhcp --device=eth0
rootpw --iscrypted $1$LY1EPt3P$BvVLJ.7yyzaDy/7zxmakr.
text

%include /tmp/network.ks

keyboard us
lang en_US
selinux --disabled
skipx
logging --level=info
reboot
timezone --utc Europe/Bucharest
bootloader --location=mbr  --driveorder=sda,sdb --append="console=tty0 console=ttyS0,115200N1"
zerombr
clearpart --all --initlabel 
part / --fstype="ext4" --size=10000
part swap --fstype="swap" --size=8000
part pv.01 --fstype="ext4" --grow --size=1
volgroup vg0 pv.01
logvol /data --vgname=vg0 --percent=90 --name=lv0 --fsoptions=noatime --fstype=ext4 --size=1 --grow 

%packages 
@core
sed.i686           
perl.i686
less.i686          
dmidecode.i686     
bzip2.i686         
iproute.i686       
iputils.i686       
sysfsutils.i686    
rsync.i686         
nano.i686          
mdadm.i686         
setserial.i686     
man-pages.noarch     
findutils.i686     
tar.i686           
net-tools.i686     
tmpwatch.i686      
lsof.i686           
python.i686         
screen.i686
lvm2.i686             
curl.i686             
ypbind.i686           
yp-tools.i686          
smartmontools.i686     
openssh-clients.i686   
acpid.i686             
irqbalance.i686        
which.i686             
bind-utils.i686        
ntsysv.i686            
ntp.i686               
man.i686                   
mysql.i686                 
postfix.i686               
chkconfig.i686             
gzip.i686                  
net-snmp.i686
%end

%pre
#!/bin/sh

echo "network --device eth0 --bootproto dhcp --hostname localhost.localdomain" > /tmp/network.ks

for x in `cat /proc/cmdline`; do
        case $x in SERVERNAME*)
            eval $x
        echo "network --device eth0 --bootproto dhcp --hostname ${SERVERNAME}" > /tmp/network.ks
                ;;
            esac;
    done
%end

%post

cat > /etc/cron.d/ntpdate <<EOF
0 */2 * * * /usr/sbin/ntpdate pool.ntp.org 1> /dev/null 2>&1
EOF

cat > /etc/snmp/snmpd.conf <<EOF
com2sec readonly     default       AW_PUB
com2sec readwrite    default      AW_RW_PRIV
group MyRWGroup  v1        readwrite
group MyROGroup  v1        readonly
view all    included  .1                               80
access MyROGroup ""      any       noauth    exact     all    none   none
access MyRWGroup ""      any       noauth    exact      all    all    all
syslocation Unknown (edit /etc/snmp/snmpd.conf)
syscontact Root <root@localhost> (configure /etc/snmp/snmp.local.conf)
disk / 10000
pass .1.3.6.1.4.1.2021.255 /usr/sbin/ucd-snmp-vmstat
extend .1.3.6.1.4.1.2021.8.101 vs /usr/sbin/vendiostats.pl
EOF

chkconfig ntpd on
chkconfig snmpd on
chkconfig sshd on
chkconfig ypbind on
chkconfig iptables off
chkconfig ip6tables off
chkconfig yum-updatesd off
chkconfig haldaemon off
chkconfig mcstrans off
chkconfig sysstat off

cat > /etc/motd <<EOF

This server was deployed with kickstart with the centos6.3-ks.cfg configuration file. 

Install finished at:
EOF

date >> /etc/motd

echo >> /etc/motd
%end

8. Create PXE menu file
[codesyntax lang="bash"]

vim /tftpboot/pxelinux.cfg/default

[/codesyntax]

 

default menu.c32
prompt 0
timeout 300
MENU TITLE test.org PXE Menu

LABEL centos6.3_i386
    MENU LABEL CentOS 6.3 i386 
    KERNEL /netboot/centos/6.3/i386/vmlinuz
    APPEND console=tty0 console=ttyS0,9600N1 initrd=/netboot/centos/6.3/i386/initrd.img ks=http://172.20.30.1/netboot/centos/6.3/i386/centos6.3-ks.cfg ksdevice=link

9. Disable SELINUX

[codesyntax lang="bash"]

vim /etc/sysconfig/selinux
:%s/SELINUX=enforcing/SELINUX=disabled
:wq

[/codesyntax]

 

10. Share the internet connection with clients

[codesyntax lang="bash"]

vim /etc/sysctl.conf
:%s/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1
:wq

[/codesyntax]

 

Apply the settings:

[codesyntax lang="bash"]

sysctl -p

[/codesyntax]

Share internet connection using iptables:
[codesyntax lang="bash"]

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
service iptables save

[/codesyntax]

11. Final service setup
[codesyntax lang="bash"]

chkconfig dhcpd on
chkconfig xinetd on
chkconfig iptables on
chkconfig httpd on
chkconfig iptables6 off
chkconfig ip6tables off

[/codesyntax]

12. Reboot the server
[codesyntax lang="bash"]

reboot

[/codesyntax]

Links:
http://monzell.com/post/15547967527/automatically-set-the-hostname-during-kickstart
http://kaivanov.blogspot.ro/2010/09/how-to-install-centos-pxe-server.html