TechAnswers

Create SSH bookmarks like Putty saved sessions

chrisw — Tue, 21 Feb 2012 16:39:14 +0000

You’re in Windows, and then you move back to your Linux box and its like breathing a breath of fresh air, mostly for me because of the command line. And most others probably feel the same way. Something that was bugging me though, was finding the SSH commands to connect to servers, and have to retype them if they weren’t in my BASH history or some other easy to find place.

Well, you can add these ‘bookmarks’ to your SSH config in your home directory, as follows:

Create or edit the ~/.ssh/config file with your favourite editor.
nano ~/.ssh/config
Add entries to the file as follows:
Host myhost HostName myhost.example.com User chris
Now save and exit the file (ctrl+O, ctrl+X for nano)
You can now do:
ssh myhost
and you will be connected! Combine this with generating and copying a public key to the server, and the login will be password free. Be aware of the obvious security implications here though.

You can also add other switches to the config that would normally form part of your SSH command. For example;
Host myhost HostName myhostname User root Port 9090 DynamicForward 9999 ServerAliveInterval 30
In this example, ‘myhostname’ has been added to /etc/hosts so you can change the IP in one place if you have many bookmarks pointing at the same host, if you have them for different users, ports or configurations.

Build and configure you own linux serial console server (reverse telnet)

andyn — Thu, 20 Oct 2011 10:17:31 +0000

One of the locations I look after has a stack of 16 Cisco switches that I manage remotely via the Internet. These switches often undergo some very complicated reconfigurations for certain customers of the site and from time to time I have found myself locked out via Telnet and have had to visit site with a serial console cable to put the configurations right.

To avoid any more of these unplanned site visits I decided to sort out a serial console server for this site. If your reading this you probably realize that a Serial Console server is basically a computer with a number of Serial Interfaces and an Ethernet port. You can connect to the console server and the out over one of its serial ports to control the attached devices.

I needed a device with 16 ports. Proper 16-port console servers like those produced by Avocent cost upwards of £1500, so I decided to build my own. I put together the cheapest barebones PC system i could find with a spare PCI-Express slot. Into this spare PCI-E Slot i Installed a Startech 16-port PCI-E Serial Card. (PEX16S952LP) shown below.

Startech PEX16S952LP

I then dug around the storerooms and found 16 standard blue Cisco Serial console cables and connected them from the 16-port breakout cable coming from the serial card and into each of the switches. I installed Ubuntu Server on the system. I could see 16 ttySx devices in /dev/ and i could use minicom to connect to the switch on the end of each /dev/ttySx port. The next stage, expose these serial ports via Reverse Telnet for easy remote management.

The ubuntu package ser2net package describes itself as:

This daemon allows telnet and tcp sessions to be established with a
unit’s serial ports. Combined with a terminal emulation like xterm or
the Linux console, this can be a very simple means of communicating
with routers, other systems’ serial consoles and other equipment with
a serial port. This is remarkably similar to the reverse telnet
feature of some Cisco routers.

I installed the package with:

sudo apt-get install ser2net

The next step is to configure which TCP ports you want ser2net to listen on and which serial ports to map these to. This is done in /etc/ser2net.conf my configuration file looks something like this:

BANNER:banner:\r\nser2net port \p device \d [\s] (Debian GNU/Linux)\r\n\r\n

2000:telnet:600:/dev/ttyS0:9600 8DATABITS NONE 1STOPBIT banner
2001:telnet:600:/dev/ttyS1:9600 8DATABITS NONE 1STOPBIT banner
2002:telnet:600:/dev/ttyS2:9600 8DATABITS NONE 1STOPBIT banner
2003:telnet:600:/dev/ttyS3:9600 8DATABITS NONE 1STOPBIT banner
2004:telnet:600:/dev/ttyS4:9600 8DATABITS NONE 1STOPBIT banner
2005:telnet:600:/dev/ttyS5:9600 8DATABITS NONE 1STOPBIT banner
2006:telnet:600:/dev/ttyS6:9600 8DATABITS NONE 1STOPBIT banner
2007:telnet:600:/dev/ttyS7:9600 8DATABITS NONE 1STOPBIT banner
2008:telnet:600:/dev/ttyS8:9600 8DATABITS NONE 1STOPBIT banner
2009:telnet:600:/dev/ttyS9:9600 8DATABITS NONE 1STOPBIT banner
2010:telnet:600:/dev/ttyS10:9600 8DATABITS NONE 1STOPBIT banner
2011:telnet:600:/dev/ttyS11:9600 8DATABITS NONE 1STOPBIT banner
2012:telnet:600:/dev/ttyS12:9600 8DATABITS NONE 1STOPBIT banner
2013:telnet:600:/dev/ttyS13:9600 8DATABITS NONE 1STOPBIT banner
2014:telnet:600:/dev/ttyS14:9600 8DATABITS NONE 1STOPBIT banner
2015:telnet:600:/dev/ttyS15:9600 8DATABITS NONE 1STOPBIT banner

Once ser2ner has been restarted with /etc/init.d/ser2net restart i was able to telnet into ports 2000 through to 2015 and gain direct access to the serial port connected to each switch.

You should really at this stage add some restrictive firewall rules to your serial console server, or onto whatever hardware firewll device you use. An article detailing how to easily and effectively manage an ipTables firewall will follow on this site in a couple of days time.

Upgrading Trixbox or Elastix Endpoint Manager

andyn — Wed, 19 Oct 2011 17:49:04 +0000

The Endpoint Manager that ships with current Elastix or Trixbox PBXes is a little outdated and lacks support for many modern VoIP Phones currently being deployed. Thankfully there is an actively maintained FreePBX Module which uses the latest configurations and firmwares provided provisioner.net. So you should find support for just about any modern VoIP hardware you might be using.

Download this tarball: endpointmanager-v2.9.2.4.tar or if you want to check for a newer version you can visit the Endpoint Manager GitHub Repository to obtain the module. When I grabbed the tarball from Github I had to rename the file, and rename one of the archives internal folders before FreePBX would allow me to upload it. The version I have directly linked above has already been renamed and is ready to upload.

Next, login to Elastix/Trixbox and navigate to the FreePBX configuration area. You will need to click the “Unembedded freePBX” link if using Elastix to access the full range of FreePBX web panel options. IGNORE the Endpoint Configurator menu link on the Elastix or Trixbox menu bar. This is for the outdated configuration system.

In the new FreePBX window click the Tools Tab and select Module Admin. Click Upload Module and then once uploaded enable it and find the button to process the changes and install the module.

You should now have an End Point Manager section under the Tools menu of FreePBX. The first thing to do is enter the End Point Configuration menu to enable some handset types.

Enable any handset types you need to auto provision. FreePBX will download a number of files (firmwares, profiles etc) and unpack them to the correct location ready to be served up via TFTP when the phones boot.

Its worth noting at this point that I was Applying Configuration Changes whenever the orange bar appeared at the top of FreePBX as shown below. You might not need to do this until the point your going to reboot your handsets, but I was clicking it any time there were changes to apply before proceeding to the next step.

When you are done enabling device types click on the End Point Device List from the left hand menu. Enter the subnet your phones are in (e.g. 192.168.0.0/24 or 10.10.1.0/23 etc) and click Go! Endpoint Manager will sweep that subnet to discover supported devices.

In a few moments you should have a list of all devices discovered, and you can click the checkbox by the Mac Address to select the phones you wish to configure, assign each to an existing FreePBX Extension and then click Add Selected Phones to save the provisioning configurations.

At this point you should click the “Apply Configuration Changes” orange bar at the top of the FreePBX screen if it is present, and then reboot your phones, they should TFTP boot, grab firmware and config via TFTP and register with your Elastix server within a few minutes of being rebooted.

It is worth noting that I had to ensure that my DHCP tftp server option included the tftp:// prefix when provisioning Polycom phones. The entry in /etc/dhcpd.conf that worked for me is:

option tftp-server-name "tftp://172.16.10.2";

NetworkManager and /etc/network/interfaces

garyg — Sun, 16 Oct 2011 11:44:20 +0000

Ever wondered how to manage interfaces declared in /etc/network/interfaces with NetworkManager? I recently updated an Ubuntu desktop remotely, and to my horror she hadn’t re-appeared after 5000 pings, that’s longer than a disk check.

When I got back in front of the machine I could see she had rebooted just fine, but I had to login locally for NetworkManager to start up the interface. Not ideal.

So I checked /etc/network/interfaces and find these lines commented out:

# eth0 auto # iface eth0 inet dhcp

Uncomment; job done. The interface will now come up at boot time. Unfortunately NetworkManager ignores any interfaces declared there, which means I can’t easily use my saved VPN connexions, etc.

Checked /etc/NetworkManager/NetworkManager.conf and it was empty. On RTFM NetworkManager.conf man page its clear you can have a lot of control over how your interfaces are managed.

So, sudo vi /etc/NetworkManager/NetworkManager.conf and added the following lines:

[main] plugins=ifupdown [ifupdown] managed=true

The interface comes up at boot, so I can reliably reboot remotely but still have access to the nice NM features!

Configure VLAN Interfaces on Ubuntu or Debain systems

andyn — Fri, 14 Oct 2011 13:59:03 +0000

I manage several server systems that are connected to managed Cisco switches which carry a whole bunch of VLANs. Quite frequently I need to setup a host in one of these VLANs to provide a service or test something.

Ubuntu Server or any other Debian based Linux OS makes it simple to connect a server or PC to a trunk port on a switch and then create multiple virtual interfaces on the system.

The example below assumes you have a server with two Ethernet cards: eth0 and eth1. eth0 is the servers primary network interface and is connected to a normal switchport and configured in /etc/network/interfaces statically.

eth1 is connected into a cisco switch and that port is configured as vlan trunk port. VLANs with IDs 3,4 and 101 are being presented over this trunk port and you would like the Server to bring up an interface in each of these VLANs and configure an IP address for each.

First of all you need to ensure you have the userspace VLAN tools installed on your system. Modern debian and ubuntu releases call this package: vlan some older distros call it vconfig so run either:

sudo apt-get install vlan

sudo apt-get install vconfig

Thats all the extra software you will need. The remainder of the configuration takes place in the /etc/network/interfaces file, the example below should be fairly self explanatory.

# The loopback network interface
auto lo
iface lo inet loopback
 
# The primary network interface
auto eth0
iface eth0 inet static
    address 172.16.16.2
    netmask 255.255.255.0
    network 172.16.16.0
    broadcast 172.16.16.255
    gateway 172.16.16.1
    dns-nameservers 172.16.16.1 8.8.8.8
 
# You could make the following interface a static or DHCP interface if needed,
# if it is just going to be used for vlan trunks then all your need is:
auto eth1
iface eth1 inet manual
 
# virtual interface for VLAN ID 3
auto eth1.3
iface eth1.3 inet static
    address 192.168.8.1
    netmask 255.255.255.0
 
# virtual interface for VLAN ID 4
auto eth1.4
iface eth1.4 inet static
    address 10.34.12.45
    netmask 255.255.254.0
 
# virtual interface for VLAN ID 101
auto eth1.101
iface eth1.101 inet static
    address 172.25.12.4
    netmask 255.255.255.0

So you simply specify the physical interface the vlan tagged packets will come in on and the ID of the vlan separated by a period “.” e.g. eth2.556

These interfaces will now be brought up when the system boots, if you want to bring one up or down straight away without a reboot you can:

sudo ifup eth1.3

You should see some output similar to:

$ sudo ifup eth1.3 Set name-type for VLAN subsystem. Should be visible in /proc/net/vlan/config Added VLAN with VID == 3 to IF -:eth1:- ssh stop/waiting ssh start/running, process 10882 $

Running ifconfig should report something along the following lines:

eth1.3 Link encap:Ethernet HWaddr 00:00:00:00:5e:5f inet addr:192.168.8.1 Bcast:192.168.8.255 Mask:255.255.255.0 inet6 addr: fe80::0001:0001:0001:0001/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:35 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:7389 (7.3 KB)

Now any 802.1q tagged packets tagged with VLAN ID 3 coming into the eth1 interface will be unwrapped by the kernel and handed to your brand new eth1.3 virtual ethernet interface.

You can use iface type “inet dhcp” in your definitions but beware, if the DHCP server issues a default gateway this will likely override any existing default route on your system and you may loose connectivity or experience weired routing behavior. If you do need to have a vlan interface configured by DHCP and want to avoid this you can install the ifmetric package:

sudo apt-get install ifmetric

You then need to specify a higher metric for this interface in its definition. e.g.

auto eth1.3 iface eth1.3 inet dhcp metric 1

Not specifying a metric for an interface is the same as it having metric 0, so you dont need to explicitly set metric 0 this for your primary interface.

Using tcpdump to save captures for analysis in Wireshark

taadmin — Thu, 13 Oct 2011 18:29:03 +0000

Wireshark is a great network protocol analyser which runs on Linux, Windows and OSX. You can capture data from within Wireshark, but often you need to run captures on remote machines without a graphical desktop and without the ability to install any extra software such as “tshark”. Many, if not most *nix sytems ship with the tcpdump as standard and this can capture data for later analysis in Wireshark.

In its simplest form the command to get TCP dump to capture sufficient data for useful analysis in Wireshark is:

tcpdump -i INTERFACE -s 65535 -w FILENAME

Obviously replacing the INTERFACE and FILEAME placeholders with the network interface you wish to capture from, and the path/filename you wish to capture to.

Auto Rotating Capture Files

Sometimes when capturing data for analysis you dont know quite when an anomaly that requires attention will occur. In these situation leaving the GUI Wireshark capturing for days or weeks is not an option, and even capturing to a single file with tcpdump is unworkable due to the volumes of data involved. Thankfully tcpdump allows you to automatically rotate your capture files and name them by date. When you finally experience some network problem that needs analysis you can just pull the required file of a manageable size from the remote machine and open it in Wireshark.

The following command will rotate the capture file after a certain number of seconds. Maybe 3600 for hour-long capture files or 43200 for 12 hour length captures.

tcpdump -i INTERFACE -G NUM_SECONDS -w 'trace_%Y%m%d-%H%M%S.pcap'

In some situations you may experience unexpectedly large data throughput which could make your hourly capture files so large as to be unmanageable. The -C option lets you set a maximum file-size for each capture file (in millions of bytes, not megabytes!) and adds an incremental number to each file and starts a new file. So to write hour long capture files but limit any individual file to ~650mb:

tcpdump -i eth0 -G 3600 -C 680 -w 'trace_%Y%m%d-%H%M%S.pcap'

Finally, you might need to leave some traces running for weeks or months to catch a very intermittent network fault in your capture files. You could easily fill available disk space up at these lengths of time, so the -W option lets you specify the maximum number of files being captured before rotating and deleting the first capture file, a so very much like a ringbuffer style capture. The example below allows a max filesize of about 65mb and loops every 10 files.:

tcpdump -i eth0 -C 68 -W 10 -w 'ringbuffer-trace.pcap'

A sample of the directory output for this trace which has been running for a while. Notice the times for the .pcap0 and .pcap1 files in this 10 file buffer are newer than the rest as tcpdump had rotated at the 10th file. Also notice the size of .pcap1 is only 9.6mb, this is the file tcpdump is currently writing to up to the 65M limit.

-rw-r--r-- 1 root root  65M 2011-10-16 11:59 ringbuffer-trace.pcap0
-rw-r--r-- 1 root root 9.6M 2011-10-16 12:01 ringbuffer-trace.pcap1
-rw-r--r-- 1 root root  65M 2011-10-16 11:57 ringbuffer-trace.pcap2
-rw-r--r-- 1 root root  65M 2011-10-16 11:57 ringbuffer-trace.pcap3
-rw-r--r-- 1 root root  65M 2011-10-16 11:57 ringbuffer-trace.pcap4
-rw-r--r-- 1 root root  65M 2011-10-16 11:58 ringbuffer-trace.pcap5
-rw-r--r-- 1 root root  65M 2011-10-16 11:58 ringbuffer-trace.pcap6
-rw-r--r-- 1 root root  65M 2011-10-16 11:58 ringbuffer-trace.pcap7
-rw-r--r-- 1 root root  65M 2011-10-16 11:58 ringbuffer-trace.pcap8
-rw-r--r-- 1 root root  65M 2011-10-16 11:58 ringbuffer-trace.pcap9

Provisioning Polycom SoundPoint IP 321 Phones – Elastix / Trixbox

taadmin — Thu, 13 Oct 2011 16:43:58 +0000

I recently had the task of deploying a new Elastix PBX and a hundred Polycom SoundPoint IP 321 Handsets. Managing this many handsets manually via the embedded web interfaces is daft as both Elastix and Trixbox come with an Endpoint Configurator that allows you to autoprovison phones. The problem is that the Endpoint Configurator that ships with the latest versions of Elastix and Trixbox doesnt support many of the newer phones available today.

The solution I found was to manually download the latest version of the FreePBX Endpoint Manager from Github. The process below is based on Elastix, but i have also deployed the same module on TrixboxCE and the process is identical once the FreePBX module is uploaded.

This tutorial assumes that you have something like the following setup to begin with:

An Elastix or Trixbox server installed, with layer 3 connectivity to your handsets.
The Elastix Box acting as a DHCP server for your handsets (not a requirement but you will have to ensure you properly setup TFTP options on whatever DHCP server you are using, see end of post)
A number of Polycom phones that haven’t been messed with too much (factory fresh or reset)
All the extensions you wish to assign to a handset already created in FreePBX (hint, maybe use the Bulk Extentions upload feature if you have a lot to do)

Next, login to Elastix and navigate to the PBX tab. You will need to click the “Unembedded freePBX” link to access the full range of FreePBX web panel options. IGNORE the Endpoint Configurator menu link on the Elastix menu bar. This is for the outdated configuration system.

You should now have an End Point Manager section under the Tools menu of FreePBX. The first thing to do is enter the End Point Configuration menu to enable some handset types.

It is worth noting that I had to ensure that my DHCP tftp server option included the tftp:// prefix when provisioning the Polycom phones. The entry in /etc/dhcpd.conf that worked for me is:

option tftp-server-name "tftp://172.16.10.2";

Useful Links:

http://www.polycom.com/products/voice/desktop_solutions/soundpoint/desk_phones/soundpoint_ip321_331.html

http://www.elastix.org/