mn.sobieh

Connecting remote storage to your servers is essential task when you work with Virtualized environment like cloud or local vmware environment. There are two common ways to store data on remote location. use ISCSI or NFS share. This article explain how to setup ISCSI allowing your Linux to access remote storage.

What is ISCSI ?

It is an acronym for Internet Small Computer Systems Interface. an IP-based standard for transferring data over the network. In short, iSCSI is a block-level protocol for linking network-based storage to clients.

For example, ISCSI volume appears to the client operating system as a physical hard drive that you can install, configure. That way, your store your data in location-independent storage. for a detailed explanation check Wikipedia iSCSI.

ISCSI vs NFS

NFS and iSCSI are fundamentally different in various ways in which accessing remote storage.

Multiclient Support

For instance, NFS is built for data sharing among multiple clients. On the other hand, iSCSI is designed for a single client for each volume. Though ISCSI can provide shared multi-client storage, it requires a file system that supports that.

Speed

In old days, ISCSI provided more IO performance than NFS. However, with the rapid development in network speed, the gap isn’t noticeable anymore. If your network is 100M or 1G ISCSI, you can observe the performance difference.

File system management

Client OS manages ISCSI-disk’s File system. on the contrary, NFS service handles the file locking, and that allows very efficient concurrent access among multiple clients (for example a VMWare cluster).

ISCSI terms and Keywords

Before we setup ISCSI, We need to understand the following terms:

• Initiator
  In simple words, the software installed in client ( in our case a Linux server) that initiates SCSI requests to the iSCSI target.
• Target Portal:
  The IP of the device that provide ISCSI storage service.
• Target devices
  The iSCSI storage component
• Discovery
  The process that presents the initiator with a list of available targets
• iqn
  An iqn (iSCSI qualified name) address is the unique identifier for a device in an iSCSI network

Setup ISCSI on Linux

to enable ISCSI on Debian you need to install the open-iscsi package. in addition to, telnet to check connectivity between the two devices.

apt install -y open-iscsi
apt install -y telnet

Configure ISCSI on Linux

In our scenario, the Network-storage has multiple IPs. therefore, to set up ISCSI on our Linux server successfully.

First, check the connectivity between your server and ISCSI provided by using ping, telnet. So, use ping to check connectivity and telnet command to check port reachability. iSCSI normally uses TCP ports 860 and 3260

# ping STORAGE-IP 

# telnet STORAGE-IP 3260

Second, query ISCSI portal about the available services (target). repeat it with the number of NAS IPs

iscsiadm -m discovery -p 193.168.1.101 -t st
iscsiadm -m discovery -p 193.168.2.101 -t st
iscsiadm -m discovery -p 193.168.1.102 -t st
iscsiadm -m discovery -p 193.168.2.102 -t st

Third, Create a session by login into the storage portal IPs.

iscsiadm -m node -l all

Troubleshooting ISCSI

To delete /cleanup discovery Portals. In case of adding wrong IP or NAS IPs has changed. execute the following command and adjust it to the portal IP you want to remove.

iscsiadm -m discovery -o delete -p 193.168.1.101

List assigned LUNs

iscsiadm -m session  -P 3

If the server can not connect to storage check the network side first, then try:

sudo iscsiadm -m session -o show

restarting the services to make mount automated

sudo systemctl enable open-iscsi
sudo systemctl start open-iscsi

OR

sudo systemctl enable iscsi

sudo systemctl start iscsi

Check if iface is hardcoded by removing files in the following folder

/etc/iscsi/ifaces/
 

EXAMPLE OF iscsi.conf 

/etc/iscsi/iscsid.conf
iscsid.startup = /usr/sbin/iscsid
node.startup = automatic
node.leading_login = Yes
node.session.auth.authmethod = CHAP
node.session.auth.username = iqn.1993-08.org.debian:01:5da1cee3df7b
node.session.auth.password = mfcctv01iscsi
discovery.sendtargets.auth.authmethod = CHAP
discovery.sendtargets.auth.username = iqn.1993-08.org.debian:01:5da1cee3df7b
discovery.sendtargets.auth.password = mfcctv01iscsi
node.session.timeo.replacement_timeout = 120
node.conn[0].timeo.login_timeout = 15
node.conn[0].timeo.logout_timeout = 15
node.conn[0].timeo.noop_out_interval = 5
node.conn[0].timeo.noop_out_timeout = 5
node.session.err_timeo.abort_timeout = 15
node.session.err_timeo.lu_reset_timeout = 30
node.session.err_timeo.tgt_reset_timeout = 30
node.session.initial_login_retry_max = 8
node.session.cmds_max = 128
node.session.queue_depth = 32
node.session.xmit_thread_priority = -20
node.session.iscsi.InitialR2T = No
node.session.iscsi.ImmediateData = Yes
node.session.iscsi.FirstBurstLength = 262144
node.session.iscsi.MaxBurstLength = 16776192
node.conn[0].iscsi.MaxRecvDataSegmentLength = 262144
node.conn[0].iscsi.MaxXmitDataSegmentLength = 0
discovery.sendtargets.iscsi.MaxRecvDataSegmentLength = 32768
node.session.nr_sessions = 1
node.session.iscsi.FastAbort = Yes

PHPMyAdmin is an essential tool to access their MySQL database without exposing the database ports to the world. So, in this article, we will discuss how to install PHPMyAdmin and service it through Nginx using a Debian 10 machine.

Here, this article assumes that you have a Debian 10 machine with Nginx v1.14 and MariaDB v15 or later versions installed.

Contents

• PHPMyAdmin prerequisites
• Download & deploy PHPMyAdmin
• Configure PHPMyAdmin.
• Configure Nginx for PHPMyAdmin.
• PHPMyAdmin for multi Servers

PHPMyAdmin prerequisites

Starting from PHPMyAdmin version 5. It requires PHP 7.1+ to work properly in addition to a few other PHP libraries. Explained as follows:

• PHP and its libraries
  • Standard PHP Library (php-common) like ( SPL extension, hash ).
  • ctype (php-ctype) .
  • JSON (php-json) .
  • mbstring (php-mbstring) to improve the performance.
  • Zip (php-zip) allow uploading of ZIP files to PHPMyAdmin.
  • phpseclib (php-phpseclib) The PHP Secure Communications Library.
  • libxml (php-xml). allows import of XML and Open Document Spreadsheet files.
  • curl (php-curl) To support displaying phpMyAdmin’s latest version, you need to
  • GD2 (php-gd) to display inline thumbnails of JPEGs (“image/jpeg: inline”).
  • openssl (openssl) Needed for default authentication ( using cookies ), also If you want to enable reCAPTCHA.
  • Database connection (php-mysql) to connect to database connection.
• Nginx webserver.
• MariaDB or MySQL database.

To install PHPMyAdmin required packages in Debian 10. Check this article on how to install the latest PHP version on Debian. It’s mandatory to have Nginx, PHP, and MySQL installed to be able to continue.

Download & Install PHPMyAdmin

to get the latest version of the software, it’s strongly recommended to visit their website and download it.
or change the version of the file

wget https://files.phpmyadmin.net/phpMyAdmin/5.1.1/phpMyAdmin-5.1.1-all-languages.tar.gz

Extract phpMyAdmin archive 

sudo tar -zxvf phpMyAdmin-5.0.1-all-languages.tar.gz

Move the phpMyAdmin directory to the default Nginx html directory /var/www/html.

sudo mv phpMyAdmin-5.0.1-all-languages /var/www/html/phpMyAdmin

Configure PHPMyAdmin.

in order to start configuration, we will copy the sample configuration file or rename it to config.php.

cd /var/www/html/phpMyAdmin
sudo cp -pr config.sample.inc.php config.inc.php

Then, we edit the configuration file to:

• Configure Authintecation cookies settings by adding the blowfish secret key.
• Enter the database connection setting to the database
• Import meta-data database scription required for PHPMyAdmin to function.

cd /var/www/html/phpmyadmin
sudo vi config.inc.php

First: Configure config.inc.php

This is key is required for the default cookie-based authentication to encrypt passwords in the browser cookies. In addition, the required length of the string must be 32 chars long.

You can type whatever random letters you think of or just generate the whole line using the Generate blowfish secret. then update the line that contain the variable ‘blowfish_secret’.

$cfg['blowfish_secret'] = ''; / YOU MUST FILL IN THIS FOR COOKIE AUTH! */ 

should be similar to the following

$cfg['blowfish_secret'] = 'c3rDAfiWsVXDRQi1f/HfTM[HBda7n[HU';

Then save and exit the file

Second: Create meta-data Tables

It’s important to realize, that most applications require a meta-data structure that could be file-based or stored in a database. luckily In our case, PHPMyAdmin uses a database.

Thus, we will import the provided SQL script to create a new database tables structure for it.

cd /var/www/html/phpmyadmin/sql
mysql < ./create_tables.sql

Configure Nginx for PHPMyAdmin

In this position, we will enable Nginx PHP support. because, If you tried to access the path you will get either error messages the 403 Forbidden or 404 not found. this is because we didn’t configure the Nginx to understand PHP language or PHP does not have access permission to render the PHP files.

In our example, we put the PHPMyAdmin into the default Nginx directory so you can test accessing it using context

http://YOUR-SERVER-IP/phpmyadmin/

Configure nginx to understand PHP (Fix 404 Error)

At this point, we will edit the default virtual host file for Nginx. then, update it with the required settings.

Usually, you will a commented lines related to PHP. hence we will uncomment them. as bellow:

vim /etc/nginx/site-enabled/default.conf

Then change the following lines.

index index.html index.htm;

#location ~ \.php$ {
#        include snippets/fastcgi-php.conf;
#        # With php-fpm (or other unix sockets):
#        fastcgi_pass unix:/run/php/php7.3-fpm.sock;
#        # With php-cgi (or other tcp sockets):
#        # fastcgi_pass 127.0.0.1:9000;
#}

To be like the following. Notice the added index.php to the index directive. also uncommented the location related to PHP.

index index.php index.html index.htm;

location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        # With php-fpm (or other unix sockets):
        fastcgi_pass unix:/run/php/php7.3-fpm.sock;
        # With php-cgi (or other tcp sockets):
        # fastcgi_pass 127.0.0.1:9000;
}

now the Nginx can understand PHP. we need to make sure that the PHP engine can access the directory.

Grant php acess to PHPMyAdmin (Fix 403 Forbidden)

In case if you followed my instruction. the owner of the PHPMyAdmin directory would be root. however, the default owner and group for the PHP engine in Debian is the www-data user.

Therefore, we need to change the ownership of the PHPMyAdmin and all related files to be owned by www-date

chown -R www-data:www-data /var/www/html/phpmyadmin

This will allow PHP to access the directory and read the content

OPTIONAL : Create subdomain for your PHPMyAdmin

If you need to use a separate subdomain for you PHPMyAdmin. In this case, move the directory out of the html directory. then create a virtual host file named phpMyAdmin.conf in the /etc/nginx/conf.d or /etc/nginx/sites-enabled.

sudo mv /var/www/html/phpmyadmin /var/www/phpmyadmin

sudo nano /etc/nginx/site-enabled/phpMyAdmin.conf

Add the following making changes to the domain name. You can replace it with your own domain name or your server’s IP Address.

server {​​
   listen 80;
   server_name pma.gust.edu.kw;
   root /var/www/phpMyAdmin;

   location / {​​
      index index.php;
   }​​

   ## Images and static content is treated different
   location ~*  ^.+.(jpg|jpeg|gif|css|png|js|ico|xml)$ {​​
      access_log off;
      expires 30d;
   }​​

   location ~ /\.ht {​​
      deny all;
   }​​

   location ~ /(libraries|setup/frames|setup/libs) {​​
      deny all;
      return 404;
   }​​

   location ~ \.php$ {​​
      include /etc/nginx/fastcgi_params;
      fastcgi_pass 127.0.0.1:9000;
      fastcgi_index index.php;
      fastcgi_param SCRIPT_FILENAME /var/www/phpMyAdmin$fastcgi_script_name;
   }​​
}​​

sudo chmod 777 /var/lib/php/session/

Conculsion

In this final stage, you should be able to open phpMyAdmin home page normall either from context or subdomin. Just enter username and password

Linux has the capability to use a centralized authentication system ( LDAP). This article explains by example how to configure the authentication settings for Linux to use Active Directory authentication instead of the local password file. Thus, gives you the ability to manage users from like Active directory.

Contents.

• prepare the Linux machine.

Assumptions

You already have a network managed by Active directory 192.168.2.10. furthermore, the you have a local DNS.

Step1 : prepare the machine

There are few packages that are required for CentOS 8 / RHEL 8 to be integrated with Active Directory. Firstly, Install them on your system by running the following commands:

dnf install realmd sssd oddjob oddjob-mkhomedir adcli samba-common samba-common-tools krb5-workstation authselect-compat -y

Then, make sure that your CentOS/RHEL 8 machine can resolve and discover AD domain.

cat /etc/resolv.conf

In my example, it should have the IP of my local DNS server 192.168.2.10. After that, check if AD domain discovery is successful.

realm  discover cloudadminclub.local

Step2 : join AD

Next, make sure you have privileged username and password. Then, run the following command to allow your machine to join the Active Directory domain.

realm join cloudadminclub.local -U adminUsername

Confirm that the join was successful.

sudo realm list

Once the machine is joined, run the commands below. It will update the authentication mechanism to validate from AD instead of local files.

authselect select sssd
authselect select sssd with-mkhomedir

Your sssd.conf configuration file should look like below,

$ cat /etc/sssd/sssd.conf 

[sssd]
domains = gust.local config_file_version = 2 services = nss, pam default_domain_suffix = gust.local

[nss]
homedir_substring = /home

[pam]

[domain/cloudadminclub.local]
ad_domain = cloudadminclub.local
krb5_realm = CLOUDADMINCLUB.LOCAL
realmd_tags = manages-system joined-with-samba 
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
use_fully_qualified_names = True
fallback_homedir = /home/%u@%d
access_provider = ad

When a change is made in the config file, a service restart is required.

systemctl restart sssd

Status should be running.

If the integration is working, it should be possible to get AD user info.

Step 3: Access Control – to allow users/groups

As soon you joined the AD. Access to the machine became limited to allowed users only specific users/ and groups.

except for any sessions already active

Permit user by name

To permit a user or multiple users to access via SSH and console, use the command:

$ realm permit [email protected]
$ realm permit [email protected] [email protected]

Permit access to Active directory group – Examples

$ realm permit -g sysadmins
$ realm permit -g 'Security Users'

These commands will affect and modify sssd.conf file. So, you need to restart the service again.

Step 4: Configure Sudo Access

By default, the domain users won’t have permission to escalate their privilege to root. Users have to be granted access based on usernames or groups.

Let’s first create sudo permissions grants file.

$ sudo vi /etc/sudoers.d/domain_admins

Add single user:

[email protected]        ALL=(ALL)       ALL

or Add multiple users :

[email protected]     ALL=(ALL)   ALL
[email protected]     ALL=(ALL)   ALL

Adding a group is easy as users, however, I didn’t test it, as i prefer to assign access by user

%[email protected]     ALL=(ALL)   ALL

Finally, update the SSH service to allow authentication from the active directory. make sure the /etc/ssh/sshd_confing contains the following

#Allow Authentication using password
PasswordAuthentication yes

# To allow a Group Enable the following line
#AllowGroups "adGroup1"

# Kerberos options
KerberosAuthentication yes
KerberosTicketCleanup yes   

# GSSAPI options
GSSAPIAuthentication yes

UsePAM yes

Finally, restart the ssh service to activate the changes.

systemctl restart sshd

Conclusion

The machine should be ready and accessible using active Directory passwords. You can easily test within the same session using the following ssh example to test the connectivity of coolUsername.

ssh coolUsername@localhost

,