Tech: Setup of CLEO Linux Server

Over time, a heavily used system gradually deviates from the basic default system build. So long as you can do "in-place" version upgrades, things are relatively simple. With a system that has all "user files" (/home, /pictures, /music, /video etc) separate from "system files" (/bin, /usr, /var, /lib etc), a major system rebuild should also be fairly simple:

review the partitioning of the "system drive" (SSD or HDD) to make sure it has partitions for booting:
- EFI - 100MB-500MB FAT32 partition to be mounted on /boot/efi
- Boot - 1GB-2GB ext4 partition to be mounted as /boot
- / (root) - 30GB-100GB ext4 partition to become the system "root" file system
download an ISO file of the installation disk (to be written to a USB drive
install the system
add mount points for the non-system file systems
update /etc/fstab
add the "optional" software packages you need
test that everything actually works.

In practice, there are a number of issues that complicate things.

User and group IDs

Linux systems depend on major system software components running under separate user and group IDs, so that they are protected from each other. As you install software packages, the installation scripts will add these IDs to the system's user database if they do not already exist. The installation scripts will find an unused user number for the new ID. Over time, the user database (/etc/passwd, /etc/group etc) will grow somewhat big, and the items will be in a somewhat random order. (My current /etc/passwd and /etc/group are each about 75-100 lines.) Two systems may have the same entries, but each one has different values. When you load file systems carried over from a previous installation, it is necessary to ensure that the userIDs match up between the filesystems that are to be mounted together.

Firewall

Linux has several firewall systems, all derived from the "Berkeley Packet Filter".

iptables - what I have been using
npt - the current back-end component
firewalld - the recommended user interface for npt

The problem is that firewalld comes installed by default, and is integrated with a number of systemd components that change things in the firewall in ways that may conflict with what was set up in /etc/sysconfig/iptables. So long as we are using iptables, we must therefore uninstall firewalld.

Samba

Email "Post Office"

The term "email post office" refers to the feature set that allow you to receive and keep email messages received for the wide world, and then make them avalable to desktop clients through the network (LAN or Internet).

Postfix (MTA, i.e. SMTP)

postfix is the part of the pst office that receives mail messages from the world, placing them in a well-defined "Inbox" location, where clients can pick them up. In years past, this function was universally done by a program called sendmail that was originally written around 1970. Over the years, it has slowly added new features and functions to accomodate the way the networking environments have changed, but keeping backwards compatibility. Eventually, this accumulated so much complexity that new programs were written to make it easier to set up services with the features used today. postfix is by far the most successful of these. One of the fundamental decisions in setting up a "post office" is where to place the incoming messages. Traditionally, incoming messages were put in /var/spool/mail/user, and that is still the default when installing a mail server. This is not the best place for several reasons:

/var/spool/... is conceptually a temporary file storage. Files that may be kept for year and be expected to survive reinstallation of the operating system really should not be there
Most users leave some amount of mail in this "Inbox" area. Over the months and years it may grow quite large. File storage like that clearly belongs in /home/(user).

To make this work, postfix and dovecot must both be configured to agree on where this is located. On the postfix side, this configuration element is in /etc/postfix/main.cf

	mail_spool_directory = /home
	home_mailbox = Mail/Inbox

Dovecot (IMAP server)

dovecot is the server that allow the desktop PCs to connect to the post office to

receive incoming mail
organize mail in folders by subject or correspondents
periodically delete messages no longer needed.

In the environments where I work, the desktop program used for these functions is Thunderbird, a free and open source program provided by the Mozilla Foundation (which also maintains and provides the Firefox web browser). The configuration file for dovecot is /etc/dovecot/dovecot.conf. It needs to contain these lines in order to work with the postfix setup described above:

	mail_home = /home/%{user}
	mail_driver = mbox
	mail_path = ~/Mail
	mail_inbox_path = ~/Mail/Inbox

(It caused me some grief when the names and syntax of these parameters recently changed.)

Photo Archive (/pictures)

The photo archive (/pictures) is a group of filesystems exported via SAMBA as well as through the web server. It is also one of the few good reasons to actually login to the GNOME desktop where I browse it with the DigiKam program. Support for it is discussed in a bit more detail here.

File Systems

While the photo archive looks to its users like one file system mounted at /pictures, is actually several, in order to limit the sizes of each one.

pictures - /pictures - the main one. Contains a top level folder for each year for which we have images (1970-2026) although the ones for the years 2000-2019 are symbolic links into the Pic-2000-2019 filesystem. It also contains
- /pictures/bin - collection of scripts used for managing the archive and for browsing it through the webserver.
- /pictures/data - metadata related to the archive
- /pictures/StockPhotos - pictures not taken by me that are useful for my blog pages etc.
Pic-2000-2019 - /Pic-2000-2019 contains 20 years, but it is pretty transparent extension of the main file system. Each folder in this file system is pointed to by a symbolic link in /pictures
PicImports - /pictures/Imports - a staging area used when bringing new collections into the archive
PicSmall - /pictures/small - 3 subfolders:
- Thumb - Thumbnails (less than 200x200 pixels) of files in the main archive; used to accellerate loading of web instantiations of folders in the archive.
- Medium - lightweigh versions of JPG files in the archive. For use in blog pages or in browsing, these are good enough for most on-screen use, but much faster to load. Less than 800 px on the longest side.
- HEIC - for files imported from iPhones/iCloud, the original Apple format version of the image.

Web-scripts (.cgi)

To display a picture folder through the web browser, we have configured httpd.conf to display the local folder index by means of the file index.cgi if it exists. This is a hard link in each folder pointing to /pictures/bin/album.cgi. Since hard links only work within the local file system, folders in Pic-2000-2019 are linked to a copy of that file in /Pic-2000-2019/album.cgi.

That script requires a custom large icon for a folder (so that it matches the thumbnails for actual pictures in the same folder). In the past, we added that to the global set of icons for the webserver. We now keep it in /pictures/data/folder94.png

For the iCloud import to work, we also need to have

    sudo dnf install python3-pip
    sudo pip install icloudpd

Plex Media Server

https://linuxcapable.com/install-plex-media-server-on-fedora-linux/

Plex is a server program that allows music players and smart TVs to access media files on your Linux server workstation.

Other Things to Configure

hostname - For the running system,
sudo hostname cleo.beagle-ears.com
To come up with the right name, edit /etc/hostname

Tricky Parts of System Installation

Initial System Installation

Partitioning

We really want to pre-build a system drive partitioned with a GPT partition table. If we just let the Anaconda installer "do what it wants", it will create a btrfs file system. I do not want this, for two reasons:

btrfs is a NEW file system. It has a lot of features that some people really like, but there is a big learning curve to get to understand those features well enough to make use of them
being new, there are still some bugs in the code, that can lead to a corrupted file system. I really do not want to be exposed to those risks.

To manipulate the partitions of a file system, these are the tools:

parted - old command line tool, works with MBR partition tables
Disk Utility - GUI tool; can work with MBR and GPT disk layouts.
gdisk - can convert an MBR drive into a GPT drive without losing the data in the partitions on the drive.

Do not allow "sleep", "suspend" or "hibernation"

Fedora/systemd/GNOME assumes that a workstation is an interactive system, and want to suspend the system if there is no keyboard activity. This cannot be allowed, if there needs to be remote access (over the network) to the system. To correct this problem solidly, apply these 3 fixes:

Tell systemd not to sleep:
- create a file named /etc/systemd/sleep.conf.d/sleep.conf

	[Sleep]
	AllowSuspend=no
	AllowSuspendThenHibernate=no
	AllowHibernation=no
	AllowHybridSleep=no

Tell systemd to deactivate sleep-initiating events:

        sudo systemctl mask --now sleep.target suspend.target hibernate.target
		hybrid-sleep.target

Can the / and /boot partitions be in an LVM?

While this can be done, it is a lot of work to set up. initramfs must support LVM, both in the startup kernel and in GRUB2. This stanza of GRUB commands illustrates it:

set root=(hd0,gpt1) # /boot partition
insmod normal
normal
(then)
insmod lvm
linux /vmlinuz- root=dev/mapper/-root
initrd /initrd-.img
boot

Until I am familiar with how to get into grub, I'm not going to mess with this.

SELINUX

It is pretty hard to get SELINUX to run cleanly, and it gets in the way of a lot of things when yoour are configuring components. So I set it to "permissive" mode.

	sudo setenforce 0

That does it for now. But to have it survive a restart, ..

	sudo vim /etc/selinux/config
	(SELINUX=permissive)

These blog pages are found at http://www.beagle-ears.com/lars/pages/

(End of page)