Phanto's questions

I am in the process of doing some thesis research about using ebtables and iptables on a KVM host to perform on-the-fly firewall restrictions to KVM guest VM's.

Here is the problem: I have a bridge set up on eth0 called br0. This works fine. I then have added two tap devices: tap0 and tap1 to use br0.

For some strange reason in the KVM GUI, only 1 of the tap devices is being recognized as a bridge device. The other one is saying macvtap. I don't understand why this is the case. I don't recall having this issue on another system that I am running this on, but I am having this issue on a ThinkPad.

Below is a screenshot of the GUI showing what I am talking about:

Why is tap1 getting the "(Bridge 'br0')" label instead of tap0? They both should be recognized as bridges.

I am running this on CentOS 6, and below are the ifcfg files for the taps:

For tap0:

DEVICE="tap0"
TYPE="Tap"
BRIDGE="br0"

and for tap1:

DEVICE="tap1"
TYPE="Tap"
BRIDGE="br0"

In theory, this should be working...

EDIT: Would re-installing CentOS be a good idea? I'm wondering if maybe the host's settings got screwed up somewhere...

EDIT 2: I examined my issues a bit more, and I am still very puzzled as to why only one tap interface is being seen as a bridged interface. Also strange, is that the br0 interface is not showing up in that list. I recall on my other system, it would also list that as well. Just to prove that tap0 and tap1 are in the bridge, here is the output from the brctl show command:

bridge name bridge id               STP enabled     interfaces
br0         8000.001c25990400       no              eth0
                                                    tap0
                                                    tap1

As you can see, eth0, tap0, and tap1 are added to the br0 bridge...so... this should be working....

I am working on a thesis research project, and I am having some difficulty figuring out how to get iptables (running on the KVM host) to block traffic (or rather, manipulate traffic) destined for a BRIDGED KVM guest. I am unable to get the iptables entries (pasted below) to block traffic to and from the VM's.

Effectively, I would like my host system to act as a firewall for those guest VM's, and for the time being, I would like to test this capability by simply dropping all packets that is destined for a specific VM. In the not-so-distant future, I would also like to implement more granular controls, and even have a proxy involved. Again, this should happen entirely at the HOST level, and not at the GUEST level.

I am running CentOS 6, and based on another question that I wrote: Use one NIC to create multiple interfaces for Linux KVM, I have the following interfaces configured:

eth0
br0
tap0

Below is my network setup scripts for each interface:

eth0's Configuation:

DEVICE="eth0"
BOOTPROTO="none"
NM_CONTROLLED="no"
ONBOOT=yes
TYPE="Ethernet"
UUID="<<UUID-HERE>>"
HWADDR=<<MAC-ADDR-HERE>>
DEFROUTE=yes
PEERDNS=yes
PEERROUTES=yes
IPV4_FAILURE_FATAL=yes
IPV6INIT=no
NAME="System eth0"
BRIDGE="br0"

br0's Configuration:

DEVICE="br0"
TYPE="Bridge"
ONBOOT="yes"
BOOTPROTO="dhcp"
DELAY=0

tap0's Configuration:

DEVICE="tap0"
TYPE="Tap"
BRIDGE="br0"
ONBOOT="yes"

I have a CentOS 6 VM running and it is configured to utilize the tap0 bridged interface. Networking on the VM is working properly. No other changes to the host system were made.

Below are the non-functioning iptables rules that I added to the FORWARD chain (it is worth noting that I am not a huge expert on iptables yet).

sudo iptables -I FORWARD -i any -o tap0 -j DROP
sudo iptables -I FORWARD -i tap0 -o any -j DROP

After running the commands, the FORWARD table looks like this:

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  tap0   any     anywhere             anywhere            
    0     0 DROP       all  --  any    tap0    anywhere             anywhere            
    0     0 REJECT     all  --  any    any     anywhere             anywhere            reject-with icmp-host-prohibited 

Unfortunately, this does not block the traffic. I don't understand why this would not work.

UPDATE: 11/25/2014: It's been a while since I last updated this. As it turns out, iptables has the physdev plugin, which is actually what I successfully use in my research and is more flexible then ebtables.

I am working on a thesis research project, and I am having some difficulty figuring out how to make one NIC spawn several "bridge" interfaces such that each KVM VM can be seen on the local network. I am very new to KVM, and am still exploring what it can do. Below is the scenario that I am attempting to make (on a CentOS/RHEL 6 system):

1. Linux KVM Host has 1 NIC (eth0) connected to a switch.
2. Create multiple "bridge" or equivalent interfaces that are spawned off of eth0 that would provide a unique IP for each VM. This is so that each VM can communicate with other hosts on the network, and that other hosts on the network can communicate with the VM.
3. IMPORTANT: I would like iptables on the KVM host to be able to manipulate/control/restrict the traffic that would be sent on those "bridge" interfaces.
4. I would like to create a minimum of three VM's, each using their own unique "bridge" interfaces.

I have previously made a br0 interface off of eth0, but unfortunately, I am unable to add any more to it. It appears that you can only bridge 1 interface to the NIC. I would like to bridge many to one.

Would a tap device be able to do this? If so, how would it be set up?

Effectively, I am attempting to replicate what can easily be created with VirtualBox on Windows, where each VM is given a "bridged" interface, and can live on the network. I want to achieve this very same thing with Linux KVM.

Thank You

EDIT: To be more descriptive, I want to achieve something that looks like this:

This can be found on this page: http://en.gentoo-wiki.com/wiki/KVM#Networking_2

              HOST
        +---------------+
        |               |      KVM GUEST1
        |               |   +--------------+
        |  +------+     |   |              |
 LAN ---+--- eth0 |  +--+---+---- nic0     |      KVM GUEST2
        |  | tap0----+  |   |192.168.1.13  |   +--------------+
        |  | tap1----+  |   +--------------+   |              |
        |  +------+  |  |                      |              |
        |     br0    +--+----------------------+---- nic0     |
        |192.168.1.12   |                      |192.168.1.14  |
        +---------------+                      +--------------+

I have a RHEL 6 system with TigerVNC installed. It is configured to only allow VNC connections through SSH. Thus, a user can only connect to VNC if they successfully establish an SSH connection to the system.

However, despite the SSH requirement, a user must still run the vncpasswd command and create a VNC password. Isn't this password redundant since an SSH tunnel is required and must already be established?

Thus, my question is: Can you disable the TigerVNC server's requirement for a VNC Password if it will only listen on an SSH tunnel? (Assuming that the password is actually redundant)

Thank You

EDIT: I have a theory. Is the reason why it is not redundant because once you SSH in, you can then VNC into any VNC user's account?

I am having a problem with SFTP and SCP where files that are copied are not inheriting the permissions of the remote parent directory. I have seen similar questions on serverfault where the umask of the SFTP/SCP session is modified, however, that does not necessarily solve my issue, as some directories will need to have different permissions than others. Thus, I do not to have a default umask set.

Thus, I want to force the copied file to have the permissions that are set by the parent directory on the remote system. Basically, I want SCP/SFTP to work the same way that cp works without the -p option. Currently SFTP/SCP is mimicking cp -p behavior.

Here is what I want to have happen:

1.) User wants to copy file foo.txt with permissions:

-rw-------. 1 user user        0 Feb 29 09:08 foo.txt

2.) User uses SCP to copy foo.txt to the server under directory /bar. /bar has permissions (setgid is set):

drwxrws---+  3 root usergroup  4096 Feb 28 12:19 bar

3.) /bar has the following facl's set:

user::rwx
group::rwx
group:usergroup:rwx
default:user::rwx
default:group::rwx
default:group:usergroup:rw-

4.) foo.txt should have the following permissions (and facl):

-rw-rw----+ 1 user usergroup     0 Feb 29 09:33 foo.txt
user::rw-
group::rwx     #effective: rw-
group:usergroup:rw-

5.) Instead, foo.txt has permissions:

-rw-------+ 1 user usergroup     0 Feb 29 09:36 foo.txt
user::rw-
group::rwx          #effective:---
group:usergroup:rw-     #effective:---

Is there an easy way to get the file obtain expected permissions above?

Also, do my facl's make sense, or are they redundant?

EDIT: Fixed post to display properly. (Serverfault's code and numbering doesn't work too well. I needed to wrap things in pre tags.)

I have a system running RHEL 5.5, and I am trying to mount a Windows share on a server using autofs. (Due to the network not being ready upon startup, I do not want to utilize fstab.) I am able to mount the shares manually, but autofs is just not mounting them.

Here are the files I am working with:

At the end of /etc/auto.master, I have:

## Mount this test share:
/test    /etc/auto.test    --timeout=60

In /etc/auto.test, I have:

test    -fstype=cifs,username=testuser,domain=domain.com,password=password ://server/test

I then restart the autofs service.

However, this does not work. ls-ing the directory does not return any results. I have followed all these guides on the web, and I either don't understand them, or they.just.don't.work.

Thank You

For back-up and restoration purposes the purpose of retiring an old server, I will need to create a perfect mirror image of an NFS share. This mirror is not a simple re-direct, but rather, an exact copy of the contents of an NFS Share (including file-permissions).

I have tried simple tasks, such as copying files as root with the command:

cp -pR /path-to-nfs-share/ /local-directory-to-mirror-nfs-share-contents/

Unfortunately, the command above does not copy all files, as it returns permission denied errors for some of the files and directories it encounters. Thus, to avoid potential permissions issues, I wanted to create a perfect mirror (i.e. preserving all permissions) of the files.

Unfortunately, I can't seem to find much documentation on performing this task. Is this doable?

Thank you.

I need to configure SAMBA and Winbind on Ubuntu 10.04.1 clients to get their UID, GID, and home directory from Windows Active Directory.

I have Windows Services for Unix installed with the relevant information entered in there (i.e. the UID, GID, shell, etc.).

The problem is that no matter what I try, I cannot get winbind to properly get that information and use it. I know the problem lies in my /etc/samba/smb.conf file. Unfortunately I just can't find any decent documentation whatsoever on how to properly set this up.

Below is my /etc/samba/smb.conf file:

[global]
    security = ads
    realm = DOMAINSERVER.COM
    password server = <<IP.of.domain.server>>
    workgroup = DOMAINSERVER
    winbind refresh tickets = yes
    idmap backend = ad      ## Important
    winbind enum users = yes
    winbind enum groups = yes
    template homedir = /home/%U  ## I tried commenting this out, and it didn't work
    template shell = /bin/bash  ## I tried commenting this out, and it didn't work
    client use spnego = yes
    client ntlmv2 auth = yes
    encrypt passwords = yes
    winbind nss info = sfu     ## Important
    winbind use default domain = yes
    restrict anonymous = 2

I REALLY appreciate the help on this one!

EDIT: The only other thing I can think of that is causing an issue is the fact that I haven't yet cleared the old winbind mapping stored in the /var/lib/samba/ directory. If I clear that out, will that resolve the issue? BTW, I have begun examining this document, however, its age may be of a problem: http://www.ccs.neu.edu/home/battista/articles/winbindenterprise/winbindenterprise.pdf

I have a mixed Linux/Windows software development environment where the Linux clients are migrating to a system where they are able to authenticate against Active Directory. (That part I figured out)

Our lab is currently using CVS to conduct version control on our source code. In the migration, we will need users to be able to authenticate to our CVS server. I have it planned such that when the migration occurs, we will set up the CVS server to also authenticate users against AD.

Unfortunately, I do not have a lot of experience with CVS. Is this task even possible? From what I understand, it can be set up to authenticate users based on the local users on the system. However, since the actual users won't have their credentials stored locally on the server (as it's pulling them from AD), is it possible to point CVS to rely upon pam for authentication?

I have read about accessing CVS over SSH with user credentials. Would that be a requirement for this to occur? If so, how does one set this up?

I greatly appreciate the assistance!

I am setting up a testbed environment where Linux (Ubuntu 10.04) clients will authenticate to a Windows Server 2008 R2 Domain Server.

I am following the official Ubuntu guide to set up a Kerberos client here: https://help.ubuntu.com/community/Samba/Kerberos, but I have encountered a problem when running the kinit command to connect to the domain server.

The command I am running is: kinit [email protected]. This command returns the following error:

Realm not local to KDC while getting initial credentials. Unfortunately, I cannot find any one else via Google searches that have experienced this exact error, so I have no idea what it means.

The client is able to ping the server's hostname, so the DNS server is pointing to the domain server.

Below is my krb5.conf file:

[libdefaults]
default = DS.DOMAIN.COM
dns_lookup_realm = true
dns_lookup_kdc true

[realms]
    DS.DOMAIN.COM = {
        kdc = ds.domain.com:88
        admin_server = ds.domain.com
        default_domain = domain.com
    }

[domain_realm]
    .domain.com = DS.DOMAIN.COM
    domain.com = DS.DOMAIN.COM

How can I correct these errors? I would greatly appreciate all help I can get!

I just can't seem to figure this one out.

I want to use the command line to connect to a MySQL database residing on another server. I went ahead and created the username and password for the user. I have also granted all privileges on that user for that database.

When using the command: mysql -h <hostname> -u <username> -p, I get the following error:

ERROR 1045 (28000): Access denied for user '<username>'@'<local_machine_hostname>' (using password: YES)

The problem is that it keeps appending the current machine's hostname into the username. Obviously, that user@<local_machine_hostname> is not correct.

It doesn't matter what I type. For instance, if I type:

mysql -h <hostname> -u '<username>'@'<hostname>' -p

It does the same, only in the error output, it says:

Access denied for user '<username>@<hostname>'@'<local_machine_hostname>'

Is there a setting in a configuration file which is allowing this to happen? It's really quite annoying. I need to set up a tikiwiki server, and it cannot connect because during the step where you set up mysql, it keeps appending the local machine's hostname to the mysql login name.

In our lab, we have a server running Ubuntu Linux 8.04.4 x64, with VMware Server 2.1 hosting 4 VM's.

I have a major concern with regards to shutting down the host server. Mostly, how do I ensure that the guest VM's are being shut down safely?

In the VMware web interface console, I have enabled:

• "Allow virtual machines to start and stop automatically with the system"
• I enabled the Default Startup Delay for 15 seconds along with the "Start next VM immediately if the VMware Tools start" option checked
• I enabled the Default Shutdown Delay with a 60 second shutdown delay and a Shutdown Action of "Shut Down Guest"

All VM's have the VMware Tools installed and properly working. All VM's are moved up into the "Specified Order" section of "Startup Order", thus when powering the server back on, all those VM's should start up again in that specified order.

When I went to shut down the server, I used the shutdown -h now command. Based on the settings I entered above, I was expecting a 4 minute shutdown, as there is an option to delay the shutdown of each VM by 60 seconds. However, that is not what happened. Instead, the server shutdown in under a minute.

When I powered the server back on, only 2 VM's properly loaded. The other 2 showed the following error:

"Power on Virtual Machine" failed to complete

If these problems problems persist, please contact your system administrator.

Details: Cannot open the disk '[location to .vmdk]' or one of the snapshot disks it depends on. Reason: Failed to lock the file.

Obviously, if this error occured, then it is clear to me that the VM's were not properly shutdown, or the server powered off before the VM's were completely shutdown. I have fixed the above error by deleting the .lck files in the respective VM directories.

How would I know if the VM's were properly shut down? I checked the VMware-server logs, but they only seem to display the logs of when the vmware-mgmt service is running in the current session. I'm mostly running Linux VM's, so is there an easy way to know whether or not a server was properly shut down in Linux?

Thank you all for the help!