Ubuntu

VPN enables two or more systems to communicate privately and securely over the public network or Internet. The network traffic is routed through the Internet, but is encrypted. You can use VPN to set up a secure connection between two datacenters or to access office resources from the leisure of your home. The VPN service is also used to protect your online activities, access location restricted contents, and bypass restrictions imposed by your ISP.

VPN services are implemented with a number of different protocols, such as Point-to-Point Tunneling Protocol (PPTP), Layer two tunneling protocol (L2TP), IPSec, and SSL. In this recipe, we will set up a free VPN server, OpenVPN. OpenVPN is an open source SSL VPN solution and provides a wide range of configurations. OpenVPN can be configured to use either TCP or UDP protocols. In this recipe, we will set up OpenVPN with its default UDP port 1194.

Getting ready…

You will need one server and one client system and root or equivalent access to both systems.

How to do it…

Install OpenVPN with the following command:

$ sudo apt-get update

$ sudo apt-get install openvpn easy-rsa

Now, set up your own certification authority and generate certificate and keys for the OpenVPN server.

Next, we need to edit the OpenVPN files that are owned by the root user, and the build-ca script needs root access while writing new keys. Temporarily, change to root account using sudo su:

$ sudo su

Copy the Easy-RSA directory to /etc/openvpn:

# cp -r /usr/share/easy-rsa /etc/openvpn/

Now edit /etc/openvpn/easy-rsa/vars and change the variables to match your environment:

export KEY_COUNTRY="US"

export KEY_PROVINCE="ca"

export KEY_CITY="your city"

export KEY_ORG="your Company"

export KEY_EMAIL="you@company.com"

export KEY_CN="MyVPN"

export KEY_NAME="MyVPN"

export KEY_OU="MyVPN"

Generate a Master certificate with the following commands:

# cd /etc/openvpn/easy-vars

# source vars

# ./clean-all

# ./build-ca

Next, generate a certificate and private key for the server. Replace the server name with the name of your server:

# ./build-key-server servername

Press the Enter key when prompted for the password and company name.

When asked for signing the certificate, enter y and then press the Enter key.

Build Diffie Hellman parameters for the OpenVPN server:

# ./build-dh

Copy all the generated keys and certificates to /etc/openvpn:

# cp /etc/openvpn/easy-rsa/keys/{servername.crt, servername.key, ca.crt, dh2048.pem} /etc/openvpn

Next, generate a certificate for the client with the following commands:

# cd /etc/openvpn/easy-rsa

# source vars

# ./build-key clientname

Copy the generated key, certificate, and server certificate to the client system. Use a secure transfer mechanism such as SCP:

/etc/openvpn/ca.crt

/etc/openvpn/easy-rsa/keys/clientname.crt

/etc/openvpn/easy-rsa/keys/clientname.key

Now, configure the OpenVPN server. Use the sample configuration files provided by OpenVPN:

$ gunzip -c /usr/share/doc/openvpn/examples/sample-config- files/server.conf.gz > /etc/openvpn/server.conf

Open server.conf in your favorite editor:

# nano /etc/openvpn/server.conf

Make sure that the certificate and key path are properly set:

ca ca.crt

cert servername.crt

key servername.key

dh dh2048.pen

Enable clients to redirect their web traffic through a VPN server. Uncomment the following line:

push "redirect-gateway def1 bypass-dhcp"

To protect against DNS leaks, push DNS settings to VPN clients and uncomment the following lines:

push "dhcp-option DNS 208.67.222.222"

push "dhcp-option DNS 208.67.220.220"

The preceding lines point to OpenDNS servers. You can set them to any DNS server of your choice.

Lastly, set OpenVPN to run with unprivileged user and group and uncomment the following lines:

user nobody

group nogroup

Optionally, you can enable compression on the VPN link. Search and uncomment the following line:

comp-lzo

Save the changes and exit the editor.

Next, edit /etc/sysctl to enable IP forwarding. Find and uncomment the following line by removing the hash, #, in front of it:

#net.ipv4.ip_forward=1

Update sysctl settings with the following command:

# sysctl -p

Now start the server. You should see an output similar to the following:

# service openvpn start

* Starting virtual private network daemon(s)

* Autostarting VPN 'server'

When it starts successfully, OpenVPN creates a new network interface named tun0. This can be checked with the ifconfig command:

# ifconfig tun0

tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00- 00-00-00-00-00-00-00-00-00

inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255

If the server does not start normally, you can check the logs at /var/log/syslog. It should list all the steps completed by the OpenVPN service.

How it works…

OpenVPN is the open source VPN solution. It is a traffic-tunneling protocol that works in client-server mode. You might already know that VPN is widely used to create a private and secure network connection between two endpoints. It is generally used to access your servers or access office systems from your home. The other popular use of VPN servers is to protect your privacy by routing your traffic through a VPN server. OpenVPN needs two primary components, namely a server and a client. The preceding recipe installs the server component. When the OpenVPN service is started on the OpenVPN host, it creates a new virtual network interface, a tun device named tun0. On the client side, OpenVPN provides the client with tools that configure the client with a similar setup by creating a tap device on the client's system.

Once the client is configured with a server hostname or IP address, a server certificate, and client keys, the client initiates a virtual network connection using a tap device on client to a tun device on the server. The provided keys and certificate are used to cross-check server authenticity and then authenticate itself. As the session is established, all network traffic on the client system is routed or tunneled via a tap network interface. All the external services that are accessed by the OpenVPN client, and you get to see the requests as if they are originated from the OpenVPN server and not from the client. Additionally, the traffic between the server and client is encrypted to provide additional security.

There's more…

In this recipe we have installed and configured OpenVPN server. To use the VPN service from your local system you will need a VPN client tool.

Following are the steps to install and configure VPN client on Ubuntu systems:

Install the OpenVPN client with a similar command the one we used to install the server:

$ sudo apt-get update

$ sudo apt-get install openvpn

Copy the sample client.conf configuration file:

$ sudo cp /usr/share/doc/openvpn/examples/sample-config- files/client.conf /etc/openvpn/

Copy the certificates and keys generated for this client:

$ scp user@yourvpnserver:/etc/openvpn/easy- rsa/keys/client1.key /etc/openvpn

You can use other tools such as SFTP or WinSCP on the Windows systems.

Now edit client.conf, enable client mode, and specify the server name or address:

client

remote your.vpnserver.com 1194

Make sure that you have set the correct path for keys copied from the server.

Now save the configuration file and start the OpenVPN server:

$ service openvpn start

This should create the tun0 network interface:

$ ifconfig tun0

Check the new routes created by VPN:

$ netstat -rn

You can test your VPN connection with any What's My IP service. You can also take a DNS leak test with online DNS leak tests.

For Windows and Mac OS systems, OpenVPN provides respective client tools. You need an OpenVPN profile with the .ovpn extension. A template can be found with the OpenVPN client you are using or on the server under OpenVPN examples. The following is the complete path:

/usr/share/doc/openvpn/examples/sample-config- files/client.conf

Note that OpenVPN provides a web-based admin interface to manage VPN clients. This is a commercial offering that provides an easy-to-use admin interface to manage OpenVPN settings and client certificates.

In this recipe, we will learn how to install the Ejabberd XMPP server. We will be using an integrated installation package that is available from the Ejabberd download site. You can also install Ejabberd from the Ubuntu package repository, but that will give you an older, and probably outdated, version.

Getting ready

You will need an Ubuntu server with root access or an account with sudo privileges.

How to do it…

The following are the steps to install Ejabberd:

Download the Ejabberd installer with the following command. We will be downloading the 64-bit package for Debian-based systems.

Make sure you get the updated link to download the latest available version:

$ wget https://www.process-one.net/downloads/downloads- action.php?file=/ejabberd/15.11/ejabberd_15.11-0_amd64.deb -O ejabberd.deb

Once the download completes, you will have an installer package with the .deb extension. Use the dpkg command to install Ejabberd from this package:

$ sudo dpkg -i ejabberd.deb

When installation completes, check the location of the Ejabberd executable:

$ whereis ejabberd

Now you can start the Ejabberd server, as follows:

$ sudo /opt/ejabberd-15.11/bin/ejabberdctl start

The start command does not create any output. You can check the server status with the ejabberdctl status command:

$ sudo /opt/ejabberd-15.11/bin/ejabberdctl status

Now your XMPP server is ready to use. Ejabberd includes a web-based admin panel. Once the server has started, you can access it at http://server_ip:5280/admin . It should ask you to log in, as shown in the following screenshot:

The admin panel is protected with a username and password. Ejabberd installation creates a default administrative user account with the username and password both set to admin.

To log in, you need a JID (XMPP ID) as a username, which is a username and hostname combination. The hostname of my server is ubuntu and the admin JID is admin@ubuntu. Once you have entered the correct username and password, an admin console will be rendered as follows:

How it works…

Ejabberd binaries are available as a Debian package. It includes a minimum Erlang runtime and all other dependencies. You can download the latest package from the Ejabberd download page.

The installer unpacks all the contents at the /opt/ejabberd-version directory. You can get an exact location of the installation with the whereis command. All executable files are generally located under the bin directory. We will mostly be working with ejabberdctl, which is a command line administrative tool. It provides various options to manage and monitor Ejabberd installation. You can see the full list of supported options by entering ejabberdctl without any options.

The following screenshot shows the partial output of executing ejabberdctl without any options:

If you have noticed, I am using sudo with each ejabberdctl command. You can avoid the use of the sudo command by switching to the ejabberd user, which is created at the time of Ejabberd installation. The installer creates a system user account, ejabberd, and sets its home directory to the Ejabberd installation directory, /opt/ejabberd-version. You will still need to use sudo to switch user accounts as the ejabberd user has no password set. Use the following command to log in as the ejabberd user:

$ sudo su ejabberd

In addition to creating the system user to run the Ejabberd process, the installer also creates an ejabberd admin account. The username and password for the administrator account is set to admin/admin. Make sure that you change this password before using your server in production. The installation process also creates a default XMPP host. The hostname is set to match your server hostname. It can be modified from the configuration file.

Once the server has started, you can access the handy web administrative console to manage most of the Ejabberd settings. You can add new users, create access control lists and set access rules, check the participating servers (node), and all hosted XMPP domains (host). Additionally, you can enable or disable Ejabberd modules separately for each domain. That means if you are using the same server to host xmpp1.example1.com and xmpp2.example2.com, you can enable a multi-user chat for xmpp1.example1.com and disable the same module for xmpp2.example2.com.

See also

Ejabberd download page at https://www.process-one.net/en/ejabberd/downloads/

If you no longer need a user account, it is good idea to delete that account.

Getting ready

You will need super user or root privileges to delete a group from the Ubuntu server.

How to do it...

Follow these steps to delete the user account:

1. Enter the following command to delete a user account:
   $ sudo deluser --remove-home john
2. Enter your password to complete addgroup with root privileges:

How it works…

Here, we used the deluser command with the option --remove-home. This will delete the user account named john and also remove the home and mail spool directories associated with john. By default, the deluser command will delete the user without deleting the home directory.

It is a good idea to keep a backup of user files before removing the home directory and any other files. This can be done with an additional flag along with the deluser command:

$ deluser --backup --remove-home john

This will create a backup file with the name john.tar.gz in the current working directory, and then the user account and the home directory will removed.

There's more…

When called with the --group option, the deluser command will remove the group. Similarly, when called with two non-option arguments, the deluser command will try to remove a user from a specific group:

$ deluser john guest # this will remove user john from group guest

$ deluser --group guest # this will remove a group

If you want to disable the user account rather than delete it, you can do it with the following commands:

$ sudo usermod --expiredate 1 john # disable the user account john

$ sudo usermod --expiredate "" john # re-enable user account john

$ sudo usermod -e YYYY-MM-DD john # specify expiry date

In this recipe, we will look at LXD network setup. By default, LXD creates an internal bridge network. Containers are set to access the Internet through Network Address Translation (NAT) but are not accessible from the Internet. We will learn to open a service on a container to the Internet, share a physical network with a host, and set a static IP address to a container.

Getting ready

As always, you will need access to the root account or an account with sudo privileges.

Make sure that you have created at least one container.

How to do it…

By default, LXD sets up a NAT network for containers. This is a private network attached to the lxdbr0 port on the host system. With this setup, containers get access to the Internet, but the containers themselves or the services running in the containers are not accessible from an outside network. To open a container to an external network, you can either set up port forwarding or use a bridge to attach the container directly to the host's network:

To set up port forwarding, use the iptables command, as follows:

$ sudo iptables -t nat -A PREROUTING -p tcp -i eth0 \

--dport 80 -j DNAT --to 10.106.147.244:80

This will forward any traffic on the host TCP port 80 to the containers' TCP port 80 with the IP 10.106.147.244. Make sure that you change the port and IP address as required.

You can also set a bridge that connects all containers directly to your local network. The bridge will use an Ethernet port to connect to the local network. To set a bridge network with the host, we first need to create a bridge on the host and then configure the container to use that bridge adapter.

To set up a bridge on the host, open the /etc/network/interfaces file and add the following lines:

auto br0

iface br0 inet dhcp

bridge_ports eth0

Make sure that you replace eth0 with the name of the interface connected to the external network.

Enable IP forwarding under sysctl. Find the following line in /etc/sysctl.conf and uncomment it:

net.ipv4.ip_forward=1

Start a new bridge interface with the ifup command:

$ sudo ifup br0

If required, you can restart the networking service, as follows:

$ sudo service networking restart

Next, we need to update the LXD configuration to use our new bridge interface. Execute a reconfiguration of the LXD daemon and choose  when asked to create a new bridge:

$ sudo dpkg-reconfigure -p medium lxd

Then on the next page, choose to use an existing bridge:

Enter the name of the newly created bridge interface:

This should configure LXD to use our own bridge network and skip the internal bridge. You can check the new configuration under the default profile:

$ lxc profile show default

Now, start a new container. It should receive the IP address from the router on your local network. Make sure that your local network has DHCP configured:

How it works…

By default, LXD sets up a private network for all containers. A separate bridge, lxdbr0, is set up and configured in the default profile. This network is shared (NAT) with the host system, and containers can access the Internet through this network. In the previous example, we used IPtables port forwarding to make the container port 80 available on the external network. This way, containers will still use the same private network, and a single application will be exposed to the external network through the host system. All incoming traffic on host port 80 will be directed to the container's port 80.

You can also set up your own bridge connected to the physical network. With this bridge, all your containers can connect to and be directly accessible over your local network. Your local DHCP will be used to assign IP addresses to containers. Once you create a bridge, you need to configure it with LXD containers either through profiles or separately with container configuration. In the previous example, we reconfigured the LXD network to set a new bridge.

LXD supports more advanced network configuration by attaching the host eth interface directly to a container. The following settings in the container configuration will set the network type to a physical network and use the host's eth0 directly inside a container. The eth0 interface will be unavailable for the host system till the container is live:

$ lxc config device add c1 eth0 nic nictype=physical parent=eth0

There's more…

LXD creates a default bridge with the name lxdbr0. The configuration file for this bridge is located at /etc/default/lxd-bridge. This file contains various configuration parameters, such as the address range for the bridge, default domain, and bridge name. An interesting parameter is the additional configuration path for dnsmasq configurations.

The LXD bridge internally uses dnsmasq for DHCP allocation. The additional configuration file can be used to set up various dnsmasq settings, such as address reservation and name resolution for containers.

Edit /etc/default/lxd-bridge to point to the dnsmasq configuration file:

# Path to an extra dnsmasq configuration file

LXD_CONFILE="/etc/default/dnsmasq.conf"

Then, create a new configuration file called /etc/default/dnsmasq.conf with the following contents:

dhcp-host=c5,10.71.225.100

server=/lxd/10.71.225.1

#interface=lxdbr0

This will reserve the IP 10.71.225.100 for the container called c5, and you can also ping containers with that name, as follows:

$ ping lxd.c5

See also

Read more about bridge configuration at https://wiki.debian.org/LXC/SimpleBridge

Find out more about LXD bridge at the following links:

https://insights.ubuntu.com/2016/04/07/lxd-networking-lxdbr0-explained/

http://askubuntu.com/questions/754323/lxd-2-0-local-networking

https://insights.ubuntu.com/2015/11/10/converting-eth0-to-br0-and-getting-all-your-lxc-or-lxd-onto-your-lan /

Read more about dnsmasq at https://wiki.debian.org/HowTo/dnsmasq

Sample dnsmasq configuration file: http://oss.segetech.com/intra/srv/dnsmasq.conf

Check the dnsmasq manual pages with the man dnsmasq command

In this article, we will cover the following recipes:

• Creating virtual machine with KVM
• Managing virtual machines with virsh
• Setting up your own cloud with OpenStack
• Adding a cloud image to OpenStack
• Launching a virtual instance with OpenStack
• Installing Juju a service orchestration framework
• Managing services with Juju

In this recipe, we will learn how to back up the MySQL database.

Getting ready

You will need administrative access to the MySQL database.

How to do it…

Follow these steps to set up the backups:

Backing up the MySQL database is the same as exporting data from the server. Use the mysqldump tool to back up the MySQL database as follows:

$ mysqldump -h localhost -u admin -p mydb > mydb_backup.sql

You will be prompted for the admin account password. After providing the password, the backup process will take time depending on the size of the database.

To back up all databases, add the --all-databases flag to the preceding command:

$ mysqldump --all-databases -u admin -p alldb_backup.sql

Next, we can restore the backup created with the mysqldump tool with the following command:

$ mysqladmin -u admin -p create mydb

$ mysql -h localhost -u admin -p mydb mydb_backup.sql

To restore all databases, skip the database creation part:

$ mysql -h localhost -u admin -p alldb_backup.sql

How it works…

MySQL provides a very general tool, mysqldump, to export all data from the database server. This tool can be used with any type of database engine, be it MyISAM or InnoDB or any other. To perform an online backup of InnoDB tables, mysqldump provides the --single-transaction option. With this option set, InnoDB tables will not be locked and will be available to other applications while backup is in progress.

Oracle provides the MySQL Enterprise backup tool for MySQL Enterprise edition users. This tool includes features such as incremental and compressed backups. Alternatively, Percona provides an open source utility known as Xtrabackup. It provides incremental and compressed backups and many more features.

Some other backup methods include copying MySQL table files and the mysqlhotcopy script for InnoDB tables. For these methods to work, you may need to pause or stop the MySQL server before backup.

You can also enable replication to mirror all data to the other server. It is a mechanism to maintain multiple copies of data by automatically copying data from one system to another. In this case, the primary server is called Master and the secondary server is called Slave. This type of configuration is known as Master-Slave replication. Generally, applications communicate with the Master server for all read and write requests. The Slave is used as a backup if the Master goes down. Many times, the Master-Slave configuration is used to load balance database queries by routing all read requests to the Slave server and write requests to the Master server. Replication can also be configured in Master-Master mode, where both servers receive read-write requests from clients.

See also

MySQL backup methods at http://dev.mysql.com/doc/refman/5.6/en/backup-methods.html

Percona XtraBackup at https://www.percona.com/doc/percona- xtrabackup/2.2/index.html

MySQL binary log at http://dev.mysql.com/doc/refman/5.6/en/binary-log.html

This recipe covers the installation and initial configuration of LDAP. The Ubuntu package repository makes the installation easy by providing the required packages for the LDAP service.

Getting ready

You will need access to a root account or an account with sudo privileges.

How to do it…

Let's start with installing the LDAP package and helper utilities:

Update your repository using the apt-get update command and then install the OpenLDAP package, slapd:

$ sudo apt-get update

$ sudo apt-get install slapd ldap-utils

You will be asked to enter the admin password and to confirm it.

The installation process simply installs the package without any configuration. We need to start the actual configuration process with the reconfiguration of the slapd package. Use the following command to start the re-configuration process:

$ sudo dpkg-reconfigure slapd

This command will ask you a series of questions including the domain name, admin account, password, database type, and others. Match your answers as follows:

Omit LDAP server configuration – NO.

DNS Domain name – Enter your domain name. You can use any domain name. For this setup, I will be using example.com. This domain name will determine the top structure of your directory:

Organization name – Enter your organization name. I am using example as my organization.

Admin password – Enter a password for the admin account. It can be the same as the one entered during installation, or a totally different one. Make sure you note this password as it will be used to access the admin account.

Database backend – HDB

Remove the database when slapd is purged - this is about removing the database in case you uninstall the slapd package. Choose NO as you don't want the database to be deleted:

Move old database - YES

Allow the LDAPv2 protocol - unless you are planning to use some old tools, choose NO:

Once you have answered all the questions, the process will reconfigure the LDAP service. Now your LDAP service is installed and ready to use:

Now you can use utility commands to query existing data. To test whether the LDAP service is installed and running properly, use the ldapsearch -x command. You should see output similar to following screenshot:

Use ldapsearch as follows to query our newly added domain, example.com:

$ ldapsearch -x -LLL -H ldap:/// -b dc=example,dc=com dn

The following command will query the default content for example.com:

$ ldapsearch -x -LLL -b dc=example,dc=com

The ldap-utils package also provides more commands to configure the LDAP service, but it is quite a lengthy and complex task. In the next recipe, we will learn how to set up a web-based admin interface that make things a little easier.

How it works…

With the respective packages available in the Ubuntu package repository, installing OpenLDAP is quite an easy task. All we have to do is install the required binaries and then configure the LDAP system to serve our desired domain. We have installed two packages: one is slapd, the LDAP daemon, and the other is ldap-utils, which provides various commands to work with the LDAP daemon. After installation is complete, we have re-configured LDAP to match our required directory setup. We have chosen to go with LDAPv3 API and disabled LDAPv2. If you have any older systems working with LDAPv2, then you will need to enable support for old APIs.

Before we access the admin page, let's make some small changes in the configuration file. The file is located at /etc/phpldapadmin/config.php. By default, phpLDAPadmin shows warning messages for unused template files. These warning messages get shown in the main interface before the actual content. To hide them, search for hide_template_warning in the configuration file and set it to true. You will also need to uncomment the same line:

$config->custom->appearance['hide_template_warning'] = true;

The other settings should have already been set by the installation process. You can cross-check the following settings:

$servers->setValue('server','host','127.0.0.1');

$servers->setValue(

'login','bind_id',

'cn=admin,dc=example,

dc=com'

);

$servers->setValue(

'server','base',array('dc=example,dc=com')

);

Once you are done with the configuration file changes, save and close it and then access the admin interface through your browser:

Click on the login link on the left of the page to get the login dialogue box. The username (Login DN) field is already filled with details for the admin account. Make sure the details match the domain you have set up. Enter the password for the admin account and click the Authenticate button:

You should have noticed the warning on the login box saying the connection is unencrypted. This is just a reminder that you are using the admin console over a non-HTTPs connection. You can set up Apache with SSL certificates to get an encrypted, secure connection with your LDAP server. Check article 3, Working with Web Servers, for more details on how to set up SSL certificates on the Apache web server.

Once you log in to phpLDAPadmin, you can see the domain listed in the left-hand side menu. Click on the domain link to view its details.

Next, click on the small plus link (+) to expand the domain link and see its children. With the default settings, it should show only the admin account:

Along with the link for the admin account, you will see an option to create a new entry. Clicking on this link will show you a list of templates for the new entry:

While clicking on some of these templates, for example Generic: User Account, you may notice a PHP error saying Error trying to get non-existent value. The form rendering fails and you cannot see the complete form the with submit button. This is a small bug and can be fixed with a small edit. Open /usr/share/phpldapadmin/lib/TemplateRender.php. Search for the following line: $default = $this->getServer() ->getValue('appearance','password_hash'); Now update the preceding command as follows: $default = $this->getServer() ->getValue('appearance','password_hash_custom');

Now you are ready to create groups and respective user accounts on your LDAP server.

How it works…

In this recipe, we have installed a web-based administration console for the LDAP server. The ldap-utils package provides various commands to work with the LDAP server, but it is quite a complex and lengthy task. A graphical user interface gives you a better listing of all options and existing configurations, making things a little easier.

The phpLDAPadmin package is a PHP/Apache-based web application that provides a graphical interface for the LDAP server. It displays all options and configurations in an easy-to-use graphical format and passes all user actions to LDAP APIs.

There's more…

Apache directory studio is another user interface for LDAP administration. It is a desktop application based on Java. You can get more details at https://directory.apache.org/studio/ .

See also

A StackOverflow answer for the phpLDAPadmin error message at http://stackoverflow.com/a/21195761/1012809

In this recipe, we will cover some common issues with Apache and Nginx and list the basic steps for overcoming those issues. The steps mentioned here are general troubleshooting methods; you may need to change them based on your setup and environment.

Getting ready

You may need root level access to your web server system.

How to do it…

Web server problems can be grouped in a few broad categories, such as a server not working, a particular domain or virtual host is not accessible, problems with a specific module configuration, and access denied errors. The following section lists each of these problems and their possible solutions.

Web server not accessible

The first step is to check your local Internet connection. Try to access the server from another system from another network.

Check if the DNS settings point to your web server.

If your network is working properly, then try to ping to the server IP address.

On the web server, check the firewall or any other tool that may block communication.

Open a telnet connection to web server on port 80, or whatever port you have used for web server. If you see output similar to following screenshot, then your web server is working:

Make sure that the web server port is not being used by some other process:

$ sudo netstat -plutn

If required, reload or restart the web server process:

$ sudo service apache2 reload/restart

Check the Apache/Nginx logs listed under the /var/log/ directory and view the entire file in a scrollable format:

$ less /var/log/apache2/error.log

See the continuous stream of logs as they are added to the log file:

$ tail -f /var/log/nginx/error.log

You may want to run Apache with extended log levels. Find the variable LogLevel in /etc/apache2/apache2.conf and set its value to debug:

$ sudo nano /etc/apache2/apache2.conf

LogLevel debug

Run Apache in debug single process mode:

$ sudo apache2ctl -X # debug mode single worker

Virtual host not accessible

Make sure you have enabled virtual host configuration:

ubuntu@ubuntu:~$ a2query -s

example.com (enabled by site administrator)

Check the virtual host configuration for any syntax errors:

ubuntu@ubuntu:~$ sudo apache2ctl -t

Syntax OK

On Nginx, use the following command:

ubuntu@ubuntu:~$ sudo nginx -t

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok

nginx: configuration file /etc/nginx/nginx.conf test is successful

Check the virtual host's details and other Apache configurations:

$ sudo apache2ctl -S

Make sure your virtual host IP and port configuration matches the one defined with NamedVirtualHost.

Check DocumentRoot - does it point to proper files?

On Apache:

DocumentRoot /var/www/html

On Nginx:

server {

root /usr/share/nginx/html;

}

Crosscheck your ServerName and ServerAlias variables - do they match your domain name?

On Apache, these settings should look similar to this:

ServerName example.com

ServerAlias www.example.com

On Nginx, the ServerName is defined as this:

server {

server_name example.com www.example.com;

}

Access denied or forbidden errors

Check directory permissions for the virtual host root directory. Are they accessible to the web server? Check the web server user and group (commonly www-data) have ready permissions. If required, you can set permissions with chown and chmod commands.

ubuntu@ubuntu:~$ ls -l /var/www/

drwxr-x--- 3 ubuntu www-data 4096 Aug 4 23:00 example.com

drwxr-xr-x 2 ubuntu www-data 4096 Aug 2 23:04 public_html

Secondly, make sure that you have properly set directory permissions in the virtual host configuration. Are they restricting file access?

Use the following commands to set directory permissions in the virtual host configuration:

AllowOverride None

Order Deny,Allow

Deny from all

Apache downloads .php files

Make sure that the mod_php module is installed and enabled:

ubuntu@ubuntu:~$ ls -l /etc/apache2/mods-available | grep php

-rw-r--r-- 1 root root 897 Jul 2 21:26 php7.0.conf

-rw-r--r-- 1 root root 59 Jul 2 21:26 php7.0.load

ubuntu@ubuntu:~$ a2query -m | grep php

php7.0 (enabled by maintainer script)

One of the more interesting features of Git is hooks. With hooks, you can tie an arbitrary script to various Git events. Whenever a particular event, such as a git commit or git push, occurs, the script attached to that event gets executed.

Typically, an event consists of several steps, and a script can be attached to each of these steps. The most common steps are pre-event and post-event, with pre hooks executed before the event and post hooks after the event. A pre hook, such as pre-commit, is generally used to cross-check the updates and can approve or reject an actual event. A post hook is used to execute additional activities after an event, such as start a built process when a new push is received or a notification sent.

Every Git repository consists of a .git/hooks directory with sample scripts. You can start using those hooks by removing the .sample extension from the script name. Additionally, the hook scripts belong to a single repository instance and do not get copied with the repository clone. So, if you add some hooks to your local repository and then push changes to the remote, the hooks will not get replicated on the remote. You will need to manually copy those scripts on the remote system. Built-in sample hooks generally use the shell scripts, but you can use any scripting language, such as Python or even PHP.

In this recipe, we will learn how to use Git hooks. We will create our own post-commit hook that deploys to a local web server.

Getting ready

We will need a local web server installed. I have used an Apache installation; feel free to use your favorite server:

Set up a new virtual host under Apache and enable it:

$ cd /var/www/

$ sudo mkdir git-hooks-demo

$ sudo chown ubuntu:ubuntu git-hooks-demo

$ cd git-hooks-demo

Create index.html and add the following contents to it:

$ vi index.html

Deployed Manually

Networking consists of various components and services working together to enable systems to communicate with each other. A lot of times it happens that everything seems good, but we are not able to access other servers or the Internet. In this recipe, we will look at some tools provided by Ubuntu to troubleshoot the network connectivity issues.

Getting ready

As you are reading this recipe, I am assuming that you are facing a networking issue. Also, I am assuming that the problems are with a primary network adapter, eth0.

You may need access to root account or account with similar privileges.

How to do it…

Follow these steps to troubleshoot network connectivity:

Let's start with checking the network card. If it is working properly and is detected by Ubuntu. Check boot time logs and search for lines related to Ethernet, eth:

$ dmesg | grep eth

If you don't find anything in the boot logs, then most probably, your network hardware is faulty or unsupported by Ubuntu.

Next, check whether the network cable is plugged in and is working properly. You can simply check the LED indicators on the network card or use the following command:

$ sudo mii-tool

If you can see a line with link ok, then you have a working Ethernet connection.

Next, check whether a proper IP address is assigned to the eth0 Ethernet port:

$ ifconfig eth0

Check whether you can find a line that starts with inet addr. If you cannot find this line or it is listed as inet addr 169.254, then you don't have an IP address assigned.

Even if you see a line stating the IP address, make sure that it is valid for network that you are connected to.

Now assuming that you have not assigned an IP address, let's try to get dynamic IP address from the DHCP server. Make sure that eth0 is set for dynamic configuration. You should see line similar to iface eth0 inet dhcp:

$ cat /etc/network/interfaces

Execute the dhclient command to query the local DHCP server:

$ sudo dhclient -v

If you can see a line similar to bound to 10.0.2.15, then you are assigned with a new IP address. If you keep getting DHCPDISCOVER messages, this means that your DHCP server is not accessible or not assigning an IP address to this client.

Now, if you check the IP address again, you should see a newly IP address listed:

$ ifconfig eth0

Assuming that you have received a proper IP address, let's move on to the default gateway:

$ ip route

The preceding command lists our default route. In my case, it is 10.0.2.2. Let's try to ping the default gateway:

$ ping –c 5 10.0.2.2

If you get a response from the gateway, this means that your local network is working properly. If you do not get a response from gateway, you may want to check your local firewall.

Check the firewall status:

$ sudo ufw status

Check the rules or temporarily disable the firewall and retry reaching your gateway:

$ sudo ufw disable

Next, check whether we can go beyond our gateway. Try to ping an external server. I am trying to ping a public DNS server by Google:

$ ping -c 5 8.8.8.8

If you successfully receive a response, then you have a working network connection. If this does not work, then you can check the problem with the mtr command. This command will display each router between your server and the destination server:

$ mtr -r -c 1 8.8.8.8

Next, we need to check DNS servers:

$ nslookup www.ubuntu.com

If you received an IP address for Ubuntu servers, then the DNS connection is working properly. If it's not, you can try changing the DNS servers temporarily. Add the nameserver entry to /etc/resolve.conf above other nameserver, if any:

nameserver 8.8.8.8

At this point, you should be able to access the Internet. Try to ping an external server by its name:

$ ping -c 3 www.ubuntu.com

There's more…

The following are some additional commands that may come handy while working with a network:

lspci lists all pci devices. Combine it with grep to search for specific device.

Lsmod shows the status of modules in Linux kernels.

ip link lists all the available network devices with status and configuration parameters.

ip addr shows the IP addresses assigned for each device.

ip route displays routing table entries.

tracepath/traceroute lists all the routers (path) between local and remote hosts.

iptables is an administration tool for packet filtering and NAT.

dig is a DNS lookup utility.

ethtool queries and controls network drivers and hardware settings.

route views or edits the IP routing table.

telnet was the interface for telnet protocol. Now it is a simple tool to quickly check remote working ports.

Nmap is a powerful network mapping tool.

netstat displays network connections, routing tables, interface stats, and more.

ifdown and ifup start or stop the network interface. They are similar to ifconfig down or ifconfig up.