Translations by Anderson Blaine

Ubuntu Server Guide

Configuration

References

Networking

The purpose of IP Masquerading is to allow machines with private, non-routable IP addresses on your network to access the Internet through the machine doing the masquerading. Traffic from your private network destined for the Internet must be manipulated for replies to be routable back to the machine that made the request. To do this, the kernel must modify the <emphasis>source</emphasis> IP address of each packet so that replies will be routed back to it, rather than to the private IP address that made the request, which is impossible over the Internet. Linux uses <emphasis>Connection Tracking</emphasis> (conntrack) to keep track of which connections belong to which machines and reroute each return packet accordingly. Traffic leaving your private network is thus "masqueraded" as having originated from your Ubuntu gateway machine. This process is referred to in Microsoft documentation as Internet Connection Sharing.

The above log will also appear in <filename>/var/log/messages</filename>, <filename>/var/log/syslog</filename>, and <filename>/var/log/kern.log</filename>. This behavior can be modified by editing <filename>/etc/syslog.conf</filename> appropriately or by installing and configuring <application>ulogd</application> and using the ULOG target instead of LOG. The <application>ulogd</application> daemon is a userspace server that listens for logging instructions from the kernel specifically for firewalls, and can log to any file you like, or even to a <application>PostgreSQL</application> or <application>MySQL</application> database. Making sense of your firewall logs can be simplified by using a log analyzing tool such as <application>fwanalog</application>, <application> fwlogwatch</application>, or <application>lire</application>.

Many other configuration directives for <application>sshd</application> are available for changing the server application's behavior to fit your needs. Be advised, however, if your only method of access to a server is <application>ssh</application>, and you make a mistake in configuring <application>sshd</application> via the <filename>/etc/ssh/sshd_config</filename> file, you may find you are locked out of the server upon restarting it, or that the <application>sshd</application> server refuses to start due to an incorrect configuration directive, so be extra careful when editing this file on a remote server.

Several tools are available for interacting with Ubuntu's package management system, from simple command-line utilities which may be easily automated by system administrators, to a simple graphical interface which is easy to use by those new to Ubuntu.

Ubuntu's package management system is derived from the same system used by the Debian GNU/Linux distribution. The package files contain all of the necessary files, meta-data, and instructions to implement a particular functionality or software application on your Ubuntu computer.

The <application>apt-get</application> command is a powerful command-line tool used to work with Ubuntu's <emphasis>Advanced Packaging Tool</emphasis> (APT) performing such functions as installation of new software packages, upgrade of existing software packages, updating of the package list index, and even upgrading the entire Ubuntu system.

<emphasis role="bold">Install a Package</emphasis>: Installation of packages using the <application>apt-get</application> tool is quite simple. For example, to install the network scanner <emphasis role="italics">nmap</emphasis>, type the following: <screen> <command>sudo apt-get install nmap</command> </screen>

<emphasis role="bold">Remove a Package</emphasis>: Removal of a package or packages is also a straightforward and simple process. To remove the nmap package installed in the previous example, type the following: <screen> <command>sudo apt-get remove nmap</command> </screen>

<emphasis role="bold">Multiple Packages</emphasis>: You may specify multiple packages to be installed or removed, separated by spaces.

<emphasis role="bold">Update the Package Index</emphasis>: The APT package index is essentially a database of available packages from the repositories defined in the <filename>/etc/apt/sources.list</filename> file. To update the local package index with the latest changes made in repositories, type the following: <screen> <command>sudo apt-get update</command> </screen>

Some examples of popular uses for the <application>apt-get</application> utility: <placeholder-1/>

For further information about the use of <application>APT</application>, read the comprehensive <ulink url="http://www.debian.org/doc/user-manuals#apt-howto">Debian APT User Manual</ulink> or type: <screen>apt-get help</screen>

Aptitude

<application>Aptitude</application> is a menu-driven, text-based front-end to the <emphasis>Advanced Packaging Tool</emphasis> (APT) system. Many of the common package management functions, such as installation, removal, and upgrade, are performed in <application>Aptitude</application> with single-key commands, which are typically lowercase letters.

When <application>Aptitude</application> starts, you will see a menu bar at the top of the screen and two panes below the menu bar. The top pane contains package categories, such as <emphasis role="italics">New Packages</emphasis> and <emphasis role="italics">Not Installed Packages</emphasis>. The bottom pane contains information related to the packages and package categories.

<emphasis role="bold">Install Packages</emphasis>: To install a package, locate the package via the Not Installed Packages package category, for example, by using the keyboard arrow keys and the <keycap>ENTER</keycap> key, and highlight the package you wish to install. After highlighting the package you wish to install, press the <keycap>+</keycap> key, and the package entry should turn <emphasis role="italics">green</emphasis>, indicating it has been marked for installation. Now press <keycap>g</keycap> to be presented with a summary of package actions. Press <keycap>g</keycap> again, and you will be prompted to become root to complete the installation. Press <keycap>ENTER</keycap> which will result in a Password: prompt. Enter your user password to become root. Finally, press <keycap>g</keycap> once more and you'll be prompted to download the package. Press <keycap>ENTER</keycap> on the <emphasis role="italics">Continue</emphasis> prompt, and downloading and installation of the package will commence.

<emphasis role="bold">Remove Packages</emphasis>: To remove a package, locate the package via the Installed Packages package category, for example, by using the keyboard arrow keys and the <keycap>ENTER</keycap> key, and highlight the package you wish to remove. After highlighting the package you wish to install, press the <keycap>-</keycap> key, and the package entry should turn <emphasis role="italics">pink</emphasis>, indicating it has been marked for removal. Now press <keycap>g</keycap> to be presented with a summary of package actions. Press <keycap>g</keycap> again, and you will be prompted to become root to complete the installation. Press <keycap>ENTER</keycap> which will result in a Password: prompt. Enter your user password to become root. Finally, press <keycap>g</keycap> once more, and you'll be prompted to download the package. Press <keycap>ENTER</keycap> on the <emphasis role="italics">Continue</emphasis> prompt, and removal of the package will commence.

<emphasis role="bold">p</emphasis>: Purged from system

<emphasis role="bold">v</emphasis>: Virtual package

<emphasis role="bold">B</emphasis>: Broken package

<emphasis role="bold">u</emphasis>: Unpacked files, but package not yet configured

The first column of information displayed in the package list in the top pane, when actually viewing packages lists the current state of the package, and uses the following key to describe the state of the package: <placeholder-1/>

To exit Aptitude, simply press the <keycap>q</keycap> key and confirm you wish to exit. Many other functions are available from the Aptitude menu by pressing the <keycap>F10</keycap> key.

Configuration of the <emphasis>Advanced Packaging Tool</emphasis> (APT) system repositories is stored in the /etc/apt/sources.list configuration file. An example of this file is referenced here, along with information on adding or removing repository references from the file.

You may edit the file to enable repositories or disable them. For example, to disable the requirement of inserting the Ubuntu CD-ROM whenever package operations occur, simply comment out the appropriate line for the CD-ROM, which appears at the top of the file:

Extra Repositories

Be advised that neither the <emphasis>Universe</emphasis> or <emphasis>Multiverse</emphasis> repositories contain officially supported packages. In particular, there may not be security updates for these packages.

Many other package sources are available, sometimes even offering only one package, as in the case of package sources provided by the developer of a single application. You should always be very careful and cautious when using non-standard package sources, however. Research the source and packages carefully before performing any installation, as some package sources and their packages could render your system unstable or non-functional in some respects.

Network Configuration

Ubuntu ships with a number of graphical utilities to configure your network devices. This document is geared toward server administrators and will focus on managing your network on the command line.

The TCP/IP protocol configuration consists of several elements which must be set by editing the appropriate configuration files, or deploying solutions such as the Dynamic Host Configuration Protocol (DHCP) server which in turn, can be configured to provide the proper TCP/IP configuration settings to network clients automatically. These configuration values must be set correctly in order to facilitate the proper network operation of your Ubuntu system.

<emphasis role="bold">Gateway Address</emphasis> A Gateway Address is the IP address through which a particular network, or host on a network, may be reached. If one network host wishes to communicate with another network host, and that host is not located on the same network, then a <emphasis>gateway</emphasis> must be used. In many cases, the Gateway Address will be that of a router on the same network, which will in turn pass traffic on to other networks or hosts, such as Internet hosts. The value of the Gateway Address setting must be correct, or your system will not be able to reach any hosts beyond those on the same network.

TCP is a connection-based protocol, offering error correction and guaranteed delivery of data via what is known as <emphasis>flow control</emphasis>. Flow control determines when the flow of a data stream needs to be stopped, and previously sent data packets should to be re-sent due to problems such as <emphasis>collisions</emphasis>, for example, thus ensuring complete and accurate delivery of the data. TCP is typically used in the exchange of important information such as database transactions.

The User Datagram Protocol (UDP), on the other hand, is a <emphasis>connectionless</emphasis> protocol which seldom deals with the transmission of important data because it lacks flow control or any other method to ensure reliable delivery of the data. UDP is commonly used in such applications as audio and video streaming, where it is considerably faster than TCP due to the lack of error correction and flow control, and where the loss of a few packets is not generally catastrophic.

Daemons are special system applications which typically execute continuously in the background and await requests for the functions they provide from other applications. Many daemons are network-centric; that is, a large number of daemons executing in the background on an Ubuntu system may provide network-related functionality. Some examples of such network daemons include the <emphasis>Hyper Text Transport Protocol Daemon</emphasis> (httpd), which provides web server functionality; the <emphasis>Secure SHell Daemon</emphasis> (sshd), which provides secure remote login shell and file transfer capabilities; and the <emphasis>Internet Message Access Protocol Daemon</emphasis> (imapd), which provides E-Mail services.

translator-credits