Hive Awired wiki hive:system:home-network

http://www.gentoo.org/doc/en/gentoo-x86-quickinstall.xml

config_eth0=("192.168.1.2")
config_eth1=("192.168.0.2")
config_eth2=("192.168.2.2")
routes_eth1=("default via 192.168.0.1")

Auto start networks :

# cd /etc/init.d/
# ln -s net.lo net.eth1
# ln -s net.lo net.eth2
# rc-update add net.eth0 default
# rc-update add net.eth1 default
# rc-update add net.eth2 default

install Iptables

fw-prs ~ # emerge -vp iptables

configure iptable :

/root/fw.sh

#!/bin/sh -x

INET_IP="192.168.0.2"
INET_IFACE="eth1"
LAN_IP="192.168.2.2"
LAN_IFACE="eth2"
DMZ_IP="192.168.1.2"
DMZ_IFACE="eth0"
LO_IFACE="lo"
LO_IP="127.0.0.1"

#SERVERS
DMZ_GATE="192.168.1.4"
DMZ_AWIRED="192.168.1.6"
LAN_EX="192.168.2.4"
LAN_MNG="192.168.2.6"

IPTABLES="/sbin/iptables"

###########################################################################

#clean
iptables -F
iptables -t nat -F
iptables -X

# start drop all
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

# Create chain for bad tcp packets
$IPTABLES -N bad_tcp_packets
$IPTABLES -N allowed
$IPTABLES -N icmp_packets

# bad_tcp_packets chain
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG --log-prefix "New not syn:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
# allowed chain
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP
# Changed rules totally
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT

##################################################################

# Bad TCP packets we don't want
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets
# Packets from the Internet to this box
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
# From DMZ Interface to DMZ firewall IP
$IPTABLES -A INPUT -p ALL -i $DMZ_IFACE -d $DMZ_IP -j ACCEPT
# From LAN Interface to LAN firewall IP
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_IP -j ACCEPT

# From Localhost interface to Localhost IP's
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT

# Special rule for DHCP requests from LAN, which are not caught properly otherwise.
$IPTABLES -A INPUT -p UDP -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT
# All established and related packets incoming from the internet to the firewall
$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
# In Microsoft Networks you will be swamped by broadcasts. These lines will prevent them from showing up in the logs.
#$IPTABLES -A INPUT -p UDP -i $INET_IFACE -d $INET_BROADCAST --destination-port 135:139 -j DROP
# If we get DHCP requests from the Outside of our network, our logs will be swamped as well. This rule will block them from getting logged.
#$IPTABLES -A INPUT -p UDP -i $INET_IFACE -d 255.255.255.255 --destination-port 67:68 -j DROP
# If you have a Microsoft Network on the outside of your firewall, you may also get flooded by Multicasts. We drop them so we do not get flooded by logs
#$IPTABLES -A INPUT -i $INET_IFACE -d 224.0.0.0/8 -j DROP
# Log weird packets that don't match the above.
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "

# Bad TCP packets we don't want
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets

# DMZ General rules
$IPTABLES -A FORWARD -i $DMZ_IFACE -o $INET_IFACE -j ACCEPT
$IPTABLES -A FORWARD -i $INET_IFACE -o $DMZ_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $LAN_IFACE -o $DMZ_IFACE -j ACCEPT
$IPTABLES -A FORWARD -i $DMZ_IFACE -o $LAN_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT

###############################################################################################
###############################################################################################
# LAN section
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Log weird packets that don't match the above.
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "
# Bad TCP packets we don't want.
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
# Special OUTPUT rules to decide which IP's to allow.
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT
# Log weird packets that don't match the above.
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "

###############################################################################
## PREROUTING chain and FORWARD
###############################################################################
#$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $HTTP_IP --dport 80 -j DNAT --to-destination $DMZ_HTTP_IP
#$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE -d $DNS_IP --dport 53 -j DNAT --to-destination $DMZ_DNS_IP
#$IPTABLES -t nat -A PREROUTING -p UDP -i $INET_IFACE -d $DNS_IP --dport 53 -j DNAT --to-destination $DMZ_DNS_IP

#dns
$IPTABLES -t nat -A PREROUTING -p tcp --dport 53 -i $INET_IFACE -j DNAT --to $DMZ_GATE
$IPTABLES -t nat -A PREROUTING -p udp --dport 53 -i $INET_IFACE -j DNAT --to $DMZ_GATE
$IPTABLES -A FORWARD -p TCP -i $INET_IFACE -o $DMZ_IFACE -d $DMZ_GATE --dport 53 -j allowed
$IPTABLES -A FORWARD -p UDP -i $INET_IFACE -o $DMZ_IFACE -d $DMZ_GATE --dport 53 -j ACCEPT
#www
$IPTABLES -t nat -A PREROUTING -p tcp --dport 80 -i $INET_IFACE -j DNAT --to $DMZ_GATE
$IPTABLES -A FORWARD -p TCP -i $INET_IFACE -o $DMZ_IFACE -d $DMZ_GATE --dport 80 -j allowed
$IPTABLES -A FORWARD -p TCP -i $DMZ_IFACE -o $LAN_IFACE -d $LAN_EX --dport 80 -j allowed
#www ssl
$IPTABLES -t nat -A PREROUTING -p tcp --dport 443 -i $INET_IFACE -j DNAT --to $DMZ_GATE
$IPTABLES -A FORWARD -p TCP -i $INET_IFACE -o $DMZ_IFACE -d $DMZ_GATE --dport 443 -j allowed
$IPTABLES -A FORWARD -p TCP -i $DMZ_IFACE -o $LAN_IFACE -d $LAN_EX --dport 443 -j allowed
#mail
$IPTABLES -t nat -A PREROUTING -p tcp --dport 25 -i $INET_IFACE -j DNAT --to $DMZ_GATE
$IPTABLES -A FORWARD -p TCP -i $INET_IFACE -o $DMZ_IFACE -d $DMZ_GATE --dport 25 -j allowed

#################################################################################

# Enable simple IP Forwarding and Network Address Translation
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j SNAT --to-source $INET_IP

use SNAT instead of MASQUARADE

run iptable configuration and save it as init.d

# chmod +x ~/fw.sh
# ~/fw.sh
# /etc/init.d/iptables save
# /etc/init.d/iptables start
# rc-update add iptables default

allow routing :

# echo 1 > /proc/sys/net/ipv4/ip_forward
#

/etc/sysctl.conf

net.ipv4.ip_forward = 1
# Enables source route verification
net.ipv4.conf.default.rp_filter = 1
# Enable reverse path
net.ipv4.conf.all.rp_filter = 1

J- Gate-prs

2009-12-12T18:20:23+02:00

B- Hardware

2010-03-30T16:47:07+02:00

processor (crypto)
uninterrupted power supply
md1:50M md2:2G md3:120G md4:RAID
core2
4G ram
2 or more network cards

How my server will do RAID ?

You can do raid by a software or directly by an hardware device.

Hardware raid devices are very expensive, have compatibility probleme with drives, and is not usefull because you can do it easily by the motherboard processor.

warning: motherboard raid is not hardware raid and is useless for a linux server so disable it in the bios.

So you do not need to buy anything special to do your raid, linux will do it for you :)

Which RAID will I use ?

this is simple :

if you already have 4 to 6 small drives (~200G) with about the same size, you should use raid6
if you have big drives or if you do not by them yet, you should use raid1 with 2 drives

why RAID6 and not RAID5 ?
- nowerdays hard drives are too big, and a block failure could happen on a second drive while reconstruction
why RAID1 ? :
- if you have a problem with your raid you can take only one drive and plug it in another computer and take your data back.
- RAID1 will be faster than raid6
- you have to do backup so keep you money to buy backup drives

warning: RAID is not backup, you also have to backup your data ! this is why you do not have to build a very big RAID.

I have to buy drives to build my RAID

if you readed well :), you are going to buy 2 drives to create a RAID1.

Do not buy same drive model (and better: not the same brand), with same drives you have a big chance to have a failure at the same time on both drives.

L- Htpc-prs

2010-05-09T02:10:22+02:00

after that :

http://www.gentoo.org/doc/en/nvidia-guide.xml part 2 !

install xorg :

http://www.gentoo.org/doc/en/xorg-config.xml

emerge xterm

nvidia-configure

I- Mng-prs

2009-12-12T18:19:33+02:00

A- Network map

2009-12-06T13:05:47+02:00

home.loc

srv-prs

Z- Server installation-xen

2010-07-19T12:01:34+02:00

warning: Using Xen is deprecated and not modified anymore (too many problems)

Here we are going to install a linux server composed of :

A gentoo 64 Bit
Xen for paravirualisation and virtualisation
5 hard drives as raid6 for / and datas
Full encrypted partitions on different drives with AES
An initramfs to boot on and asking for decryption passwords

Bios configuration

Do not overclock your server, with a full time running overclocked computer you have good chance to have crash after few days running.
Configure your ATA with AHCI, you should have better performance.
Enable Intel Virtualization technology (for xen)
Set restore on power loss to Power On to reboot automaticaly
Set all your raid drives as boot sequence even if you boot on cdrom first (needed for grub configuration)

tip: On my I7 the computer crash on xen kernel boot, I had to disable USB legacy in the bios to be able to use xen (but USB legacy is needed to boot on USB during installation if you have a USB CD drive)

Installation

Download an iso of the latest version of gentoo (link). Burn it and boot on it.

For this exemple I'will use 5 drives of about 200G for RAID6 the target partition sizes :

md1 : 50M as RAID1 for /boot (we don't need raid6 for 50M)
md2 : 150G as RAID6 for / and XEN drives
md3 : to the end of drives as RAID6 for data

warning: If you have more than 1 controller for your drives spread your drive on different controller, like that if a controller become crazy it will not destroy all drives.

My / takes about 8G.

My VMs are composed of (with swap files and data) :

ad : 10G
ex : 7G
fw : 5G
gate : 6G
mng : 20G
websrv1 : 11G
websrv2 : 27G

So we need about 100G for / and VMs (I put 150G to be sur ;))

open ssh server to Ctrl+C Ctrl+V commands :

livecd ~ # loadkeys fr
livecd ~ # passwd
livecd ~ # /etc/init.d/sshd start
livecd ~ # ifconfig

now you can connect from an other computer

Prepare hard drives

A visual representation of hard drives levels :

Devices	hdX	hdY	sdZ
Raid	RAID6
Crypto	AES
File System	EXT3
Mount Point	/

First you have to find your smallest HDD to create raid based on his size :

# fdisk -l

Disk /dev/hda: 203.9 GB, 203928109056 bytes
255 heads, 63 sectors/track, 24792 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System

Disk /dev/hdb: 203.9 GB, 203928109056 bytes
255 heads, 63 sectors/track, 24792 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System

Disk /dev/hdc: 251.0 GB, 251000193024 bytes
255 heads, 63 sectors/track, 30515 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System

Disk /dev/hde: 203.9 GB, 203928109056 bytes
255 heads, 63 sectors/track, 24792 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System

Disk /dev/hdf: 203.9 GB, 203928109056 bytes
255 heads, 63 sectors/track, 24792 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System

Disk /dev/sda: 200.0 GB, 200049647616 bytes
255 heads, 63 sectors/track, 24321 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System

Disk /dev/sdb: 203.9 GB, 203928109056 bytes
255 heads, 63 sectors/track, 24792 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System

I will use :

hda : PATA controller 1
hde, hdf : PATA controller 2
sda, sdb : SATA controller 1

For me sda is the smallest drive, so i will start with this one:

to calculate raid6 size : C = (n - 2) * c

150 = (5 - 2) * c

c = 150 / 3

c = 50G for /dev/sda2

livecd ~ # fdisk /dev/sda
Command (m for help): n
Command action
   e   extended
   p   primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-24321, default 1):
Using default value 1
Last cylinder, +cylinders or +size{K,M,G} (1-24321, default 24321): +50M

Command (m for help): n
Command action
   e   extended
   p   primary partition (1-4)
p
Partition number (1-4): 2
First cylinder (8-24792, default 8):
Using default value 8
Last cylinder, +cylinders or +size{K,M,G} (8-24321, default 24321): +1G

Command (m for help): n
Command action
   e   extended
   p   primary partition (1-4)
p
Partition number (1-4): 3
First cylinder (140-24792, default 140):
Using default value 140
Last cylinder, +cylinders or +size{K,M,G} (140-24321, default 24321): +50G

Command (m for help): n
Command action
   e   extended
   p   primary partition (1-4)
p
Selected partition 4
First cylinder (6668-24792, default 6668):
Using default value 6668
Last cylinder, +cylinders or +size{K,M,G} (6668-24321, default 24321):
Using default value 24321
Command (m for help): t
Partition number (1-4): 1
Hex code (type L to list codes): fd
Changed system type of partition 1 to fd (Linux raid autodetect)

Command (m for help): t
Partition number (1-4): 2
Hex code (type L to list codes): fd
Changed system type of partition 2 to fd (Linux raid autodetect)

Command (m for help): t
Partition number (1-4): 3
Hex code (type L to list codes): fd
Changed system type of partition 3 to fd (Linux raid autodetect)


Command (m for help): t
Partition number (1-4): 4
Hex code (type L to list codes): fd
Changed system type of partition 4 to fd (Linux raid autodetect)

Command (m for help): a
Partition number (1-4): 1

Command (m for help): p

Disk /dev/sda: 200.0 GB, 200049647616 bytes
255 heads, 63 sectors/track, 24321 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x48ee7660

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1           7       56196   fd  Linux raid autodetect
/dev/sda2               8          72      522112+  fd  Linux raid autodetect
/dev/sda3              73        6600    52436160   fd  Linux raid autodetect
/dev/sda4            6601       24321   142343932+  fd  Linux raid autodetect

Command (m for help): w
The partition table has been altered!

Calling ioctl() to re-read partition table.
Syncing disks.
livecd ~ #

For other disks you have to do the same thing except for the 3rd partition. Instead of just press enter for final size set smallest drive 3rd partition size.

Partition number (1-4): 3
First cylinder (6536-24321, default 6536):
Using default value 6536
Last cylinder, +cylinders or +size{K,M,G} (6536-24792, default 24792): 24321

Command (m for help):

Creating raid

livecd ~ # modprobe raid1
livecd ~ # modprobe raid6
livecd ~ # modprobe dm-mod

tip: see modules :

livecd ~ # lsmod | grep raid

livecd ~ # mknod /dev/md1 b 9 1
livecd ~ # mknod /dev/md2 b 9 2
livecd ~ # mknod /dev/md3 b 9 3
livecd ~ # mknod /dev/md4 b 9 4

livecd ~ # mdadm --create /dev/md1 --level=1 --raid-devices=6 /dev/sda1 /dev/sdb1 /dev/hda1 /dev/hdb1 /dev/hde1 /dev/hdf1
mdadm: array /dev/md1 started.
livecd ~ # mdadm --create /dev/md2 --level=1 --raid-devices=6 /dev/sda2 /dev/sdb2 /dev/hda2 /dev/hdb2 /dev/hde2 /dev/hdf2
mdadm: array /dev/md2 started.
livecd ~ # mdadm --create /dev/md3 --level=6 --raid-devices=5 /dev/sda3 /dev/sdb3 /dev/hda3 /dev/hdb3 /dev/hde3
mdadm: array /dev/md3 started.
livecd ~ # mdadm --create /dev/md4 --level=6 --raid-devices=5 /dev/sda4 /dev/sdb4 /dev/hda4 /dev/hdb4 /dev/hde4
mdadm: array /dev/md4 started.

add spare :

livecd ~ # mdadm --add /dev/md3 /dev/sdf3
livecd ~ # mdadm --add /dev/md4 /dev/sdf4

now wait for raid sync :

livecd ~ # watch cat /proc/mdstat
Every 2.0s: cat /proc/mdstat                                                      Fri Nov 13 21:49:39 2009

Personalities : [raid0] [raid1] [raid6] [raid5] [raid4] [raid10]
md3 : active raid6 hdf3[4] hde3[3] hda3[2] sdb3[1] sda3[0]
      428597760 blocks level 6, 64k chunk, algorithm 2 [5/5] [UUUUU]
        resync=DELAYED

md2 : active raid6 hdf2[4] hde2[3] hda2[2] sdb2[1] sda2[0]
      157308288 blocks level 6, 64k chunk, algorithm 2 [5/5] [UUUUU]
      [==>..................]  resync = 10.4% (5496896/52436096) finish=36.8min speed=21227K/sec

md1 : active raid1 hdf1[4] hde1[3] hda1[2] sdb1[1] sda1[0]
      56128 blocks [5/5] [UUUUU]

unused devices: <none>

tip: Ctrl+C to quit

Crypt partitions :

livecd ~ # cryptsetup luksFormat -c aes-xts-plain -h sha512 -s 512 -y /dev/md3

WARNING!
========
This will overwrite data on /dev/md3 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase:
Verify passphrase:
Command successful.
livecd ~ # cryptsetup luksFormat -c aes-xts-plain -s 512 -y /dev/md4

WARNING!
========
This will overwrite data on /dev/md4 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase:
Verify passphrase:
Command successful.
livecd ~ #

Open encrypted partitions

livecd ~ # cryptsetup luksOpen /dev/md3 md3
Enter LUKS passphrase:
key slot 0 unlocked.
Command successful.
livecd ~ # cryptsetup luksOpen /dev/md4 md4
Enter LUKS passphrase:
key slot 0 unlocked.
Command successful.

Format partitions

livecd ~ # mke2fs -j /dev/md1
mke2fs 1.41.3 (12-Oct-2008)
...
This filesystem will be automatically checked every 33 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.
livecd ~ # mkfs.ext4 /dev/mapper/md3
mke2fs 1.41.3 (12-Oct-2008)
...
This filesystem will be automatically checked every 26 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.
livecd ~ # mkfs.ext4 /dev/mapper/md4
mke2fs 1.41.3 (12-Oct-2008)
...
This filesystem will be automatically checked every 32 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.

tip: Do not use LVM as it “may” degrade (see) performance and is very unnecessary if you create well sized partitions

mount drives (md4 will only be used in xen later)

livecd ~ # mount /dev/mapper/md3 /mnt/gentoo/
livecd ~ # mkdir /mnt/gentoo/boot
livecd ~ # mount /dev/md1 /mnt/gentoo/boot/

Installation of /

swap

livecd ~ # cryptsetup -d /dev/urandom create swap /dev/md2
livecd ~ # mkswap /dev/mapper/swap
Setting up swapspace version 1, size = 1023996 KiB
no label, UUID=11c45e43-4a60-43a6-8a99-352b5b1dc939
livecd ~ # swapon /dev/mapper/swap
livecd ~ # swapon -s
Filename                                Type            Size    Used    Priority
/mnt/gentoo/swap.img                    file            1023992 0       -1

Stage3

Download stage3

livecd ~ # cd /mnt/gentoo/
livecd gentoo # links http://www.gentoo.org/main/en/mirrors.xml

select a mirror and download stage3 tar.gz file for your arch (amd64 for me)

tip: direct download:

livecd gentoo # wget ftp://ftp.free.fr/mirrors/ftp.gentoo.org/releases/amd64/current-stage3/stage3-amd64-*.tar.bz2

Extract stage3

livecd gentoo # time tar xjpf stage3*

real    1m10.811s
user    0m32.000s
sys     0m3.230s

warning: Be sur to mount boot partition before extracting stage3 or you will have problems with grub.

Portage

livecd gentoo # cd /mnt/gentoo/usr
livecd usr # links http://www.gentoo.org/main/en/mirrors.xml

select a mirror and download latest portage

tip: direct download :

livecd usr # wget ftp://ftp.free.fr/mirrors/ftp.gentoo.org/snapshots/portage-latest.tar.bz2

Extract portage

livecd usr # time tar xjf portage-lat*

real    1m31.991s
user    0m14.500s
sys     0m5.790s

Chroot and prepare system

Chroot

livecd usr # cd /
livecd / # mount -t proc proc /mnt/gentoo/proc
livecd / # mount -o bind /dev /mnt/gentoo/dev
livecd / # cp -L /etc/resolv.conf /mnt/gentoo/etc/
livecd / # chroot /mnt/gentoo /bin/bash
livecd / # source /etc/profile && env-update
>>> Regenerating /etc/ld.so.cache...

Root password

change root password

livecd / # passwd
New UNIX password:
Retype new UNIX password:
passwd: password updated successfully

Keyboard map

/etc/conf.d/keymaps

...
KEYMAP="fr"
...

fstab

/etc/fstab

...
/dev/md1                /boot           ext3            noauto,noatime  1 2
/dev/mapper/md3         /               ext4            noatime         0 1
/dev/mapper/swap        none            swap            sw              0 0
/dev/cdrom              /mnt/cdrom      auto            noauto,ro       0 0
...

warning: Do not forget /boot filesystem as ext3

livecd / # mkdir /etc/portage

Compilation optimization

Have a look on flags for your processor and populate your make.conf

exemple for my core2

/etc/portage/package.keywords

CHOST="x86_64-pc-linux-gnu"
CFLAGS="-march=core2 -O2 -pipe"
CXXFLAGS="${CFLAGS}"

MAKEOPTS="-j3"

USE="mmx sse sse2 -X unicode ipv6 -fortran"

tip: MAKEOPTS should be : number_of_processor_core + 1

XEN kernel

unmask xen packages :

app-emulation/xen ~amd64
app-emulation/xen-tools ~amd64
sys-kernel/xen-sources ~amd64

set flags :

/etc/portage/package.use

app-emulation/xen-tools hvm

install packages :

livecd / # emerge -a xen-sources xen xen-tools

Kernel configuration

livecd / # cd /usr/src/linux
livecd linux # make menuconfig

Processor type and features  --->
  [*] Enable Xen compatible kernel
      Processor family (Core 2/newer Xeon)  --->
Bus options (PCI etc.)  --->
  [*] PCI support
  [*]   Xen PCI Frontend
[*] Networking support  --->
  Networking options  --->
    <*> 802.1d Ethernet Bridging
Device Drivers  --->
  [*] Network device support  --->
    <*> Universal TUN/TAP device driver support
  [*] Block devices --->
    <M> Loopback device support
  [*] Multiple devices driver support (RAID and LVM)  --->
    <*>   RAID support
    <*>     RAID-1 (mirroring) mode
    <*>     RAID-4/RAID-5/RAID-6 mode
    <*>   Device mapper support
    <M>     Crypt target support
  XEN  --->
    [*] Privileged Guest (domain 0)
    <*> Backend driver support
    <*>   Block-device backend driver
    <*>   Network-device backend driver
    <*>   PCI-device backend driver
             PCI Backend Mode (Virtual PCI) --->
    [*] Scrub memory before freeing it to Xen
    [*] Disable serial port drivers
        Xen version compatibility (3.3.0 and later)
File systems  --->
    <*> The Extended 4 (ext4) filesystem
    [*]   Ext4 extended attributes
    [*]     Ext4 POSIX Access Control Lists
    [ ]     Ext4 Security Labels
-*- Cryptographic API  --->
<M>   XTS support (EXPERIMENTAL)
<M>   SHA224 and SHA256 digest algorithm
<M>   SHA384 and SHA512 digest algorithms
{M}   AES cipher algorithms (x86_64)
<M>   AES cipher algorithms (AES-NI)

warning: Do not forget to set your devices drivers !

network devices
HDD controller

# lspci in livecd will tell you

livecd linux # make -j3
...
Kernel: arch/x86/boot/vmlinuz is ready  (#1)
livecd linux # make modules_install
livecd linux # cp arch/x86/boot/vmlinuz /boot/

InitRamFs

Follow this link to build your initramfs :

Initramfs

Install grub

livecd initramfs # emerge grub
livecd initramfs # grub
grub> root (hd0,0)
grub> setup (hd0)
grub> root (hd1,0)
grub> setup (hd1)
grub> root (hd2,0)
grub> setup (hd2)
grub> root (hd3,0)
grub> setup (hd3)
grub> root (hd4,0)
grub> setup (hd4)
grub> root (hd5,0)
grub> setup (hd5)
grub> quit

tip: hdX in grub corresponds to bios hard drive boot sequences, drives have to be set in bios

/boot/grub/grub.conf

title GLX
root (hd0,0)
kernel /boot/xen.gz dom0_mem=300M
module /boot/vmlinuz root=/dev/mapper/md3 netloop.nloopbacks=32
module /boot/initramfs.gz

Finished!

livecd initramfs # exit
livecd / # umount /mnt/gentoo/proc/ /mnt/gentoo/dev /mnt/gentoo/boot /mnt/gentoo

sources:

for installation:

http://www.gentoo.org/doc/en/gentoo-x86+raid+lvm2-quickinstall.xml

for xen:

for initramfs:

lots of internet search ;)

D- System config

Network Configuration

For the moment we don't have router vm so we will be connected directly to the internet box.

config_eth0=("192.168.0.3/24")
routes_eth0=("default via 192.168.0.1")

localhost ~ # /etc/init.d/net.eth0 restart
 * Caching service dependencies ...
 * Starting eth0
 *   Bringing up eth0
 *     192.168.0.3/24
 *   Adding routes
 *     default via 192.168.0.1
localhost ~ #

Now add ssh deamon to runlevels

localhost ~ # rc-update add sshd default
 * sshd added to runlevel default
localhost ~ # /etc/init.d/sshd start
Generating public/private rsa1 key pair.
...
 * Starting sshd ...
localhost ~ #

Hostname configuration

...
127.0.0.1       srv-prs.home.loc srv-prs localhost
...

HOSTNAME="srv-prs"

localhost ~ # hostname srv-prs
localhost ~ # hostname -f
srv-prs.home.loc
localhost ~ #

Timezone

localhost ~ # cp /usr/share/zoneinfo/Europe/Paris /etc/localtime

...
TIMEZONE="Europe/Paris"
...

localhost ~ # emerge ntp
...
localhost ~ # rc-update add ntp-client default
localhost ~ # /etc/init.d/ntp-client start

Rebuild for optimisation

localhost ~ # time emerge -vae world
...

real    183m54.743s
user    155m45.326s
sys     86m24.708s

Installation of basic softwares

localhost ~ # emerge syslog-ng vixie-cron sendmail logrotate cryptsetup mdadm htop
...
localhost ~ # rc-update add syslog-ng default
 * syslog-ng added to runlevel default
localhost ~ # rc-update add vixie-cron default
 * vixie-cron added to runlevel default
localhost ~ # rc-update add sendmail default
 * sendmail added to runlevel default

Hdparm

To save power and hard drive life you can configure your hard drive to Spindown after a time without using it :

localhost ~ # emerge -v hdparm

The Time (in seconds) after which the Drive spins down is the value of your x multiplied with 5 From the manpage:

A value of zero means “timeouts are disabled”: the device will not automatically enter standby mode. Values from 1 to 240 specify multiples of 5 seconds, yielding timeouts from 5 seconds to 20 minutes. Values from 241 to 251 specify from 1 to 11 units of 30 minutes, yielding timeouts from 30 minutes to 5.5 hours. A value of 252 signifies a timeout of 21 minutes. A value of 253 sets a vendor-defined timeout period between 8 and 12 hours. A value of 255 is interpreted as 21 minutes plus 15 seconds. The value 254 is reserved. Note that some older drives may have very different interpretations of these values.

/etc/conf.d/hdparm

...
sda_args="-S241"
sdd_args="-S241"
...

localhost ~ # /etc/init.d/hdparm start
localhost ~ # rc-update add hdparm default

Xen network configuration

We are going to configure 3 networks :

eth0 → xen-red → red network (will be removed when we will install router)
eth1 → xen-green → green network
br0 → xen-dmz → dmz network

Removing eth0 from auto plug

Remove eth0 from auto plug

/etc/conf.d/rc

...
RC_PLUG_SERVICES="!net.*"
...

Network configuration

h /etc/xen/scripts/my-network-bridge

config_xendmz=("192.168.1.3/24")
brctl_xendmz=(
        "setfd 0"
        "stp off"
)

config_xenred=("192.168.0.3/24")
bridge_xenred=("peth0")
brctl_xenred=(
        "setfd 0"
        "stp off"
)
routes_xenred=("default via 192.168.0.1")


config_xengreen=("192.168.2.3/24")
bridge_xengreen=("peth1")
brctl_xengreen=(
        "setfd 0"
        "stp off"
)
routes_xengreen=("default via 192.168.2.2")

Creation of network scripts and adding dmz to runlevels

localhost ~ # cd /etc/init.d/
localhost ~ # ln -s net.lo net.xenred
localhost ~ # ln -s net.lo net.xengreen
localhost ~ # ln -s net.lo net.xendmz
localhost ~ # rc-update add net.xendmz default

Home server script

We need peth0 that is the virtual version of eth0 to mount xenred network bridge. This bridge will be created by xen but peth0 too. A problem in the sequence cause that the first time we start xen it will fail to create bridges. This is why i created a runlevel script that restart xen sequence a second time. I actually don't know how to solve this problem.

Add a runlevel script to reload networks

/etc/init.d/homesrv

#!/sbin/runscript

depend() {
        need net
        after xend
}


start() {
        ebegin "Starting home server :)"
        /etc/init.d/xend restart
        /etc/init.d/net.xenred restart
        /etc/init.d/net.xengreen restart
        /etc/init.d/xendomains restart
}

localhost ~ # chmod +x /etc/init.d/homesrv
localhost ~ # rc-update add homesrv default

Xen network scripts

We are going to create script that mount red and green network at same times by xen :

#!/bin/sh

XENDIR="/etc/xen/scripts"

$XENDIR/network-bridge "$@" netdev=eth0 bridge=xenred vifnum=1
$XENDIR/network-bridge "$@" netdev=eth1 bridge=xengreen vifnum=2

localhost ~ # chmod +x /etc/xen/scripts/my-network-bridge

Now tell xen configuration use this script instead of default one

/etc/xen/xend-config.sxp

...
(network-script my-network-bridge)
...

tell gentoo to load loop modules on start

nano /etc/modules.autoload.d/kernel-2.6

...
loop
...

Xen daemon

Add xend to runlevels

localhost ~ # rc-update add xend default
localhost ~ # /etc/init.d/xend start

Guest paravirtualization Kernel compilation

Separation of dom0 and domU kernels

We are going to create 2 scripts to compile the domU and dom0.

localhost ~ # cd /usr/src/linux/
localhost linux # echo "mkdir -p _dom0 && make O=_dom0 \$@" > make0.sh
localhost linux # echo "mkdir -p _domU && make O=_domU \$@" > makeU.sh
localhost linux # chmod +x make?.sh
localhost linux # ./make0.sh menuconfig

Just Exit and Save.

localhost linux # ./makeU.sh menuconfig
localhost linux # cp .config _dom0/
localhost linux # cp .config _domU/
localhost linux # make mrproper

Same thing, Exit and save.

now you can compile :

your dom0 kernel by doing ./make0.sh … in /usr/src/linux and take the kernel in /usr/src/linux/_dom0
your domU kernel by doing ./makeU.sh … in /usr/src/linux and take the kernel in /usr/src/linux/_domU

domU compilation

Device Drivers  --->
  XEN  --->
[ ] Privileged Guest (domain 0)
< > Backend driver support
<*> Block-device frontend driver
<*> Network-device frontend driver
<M>   Network-device frontend driver acceleration for Solarflare
<M> SCSI frontend driver
<M> USB frontend driver
[*]   Taking the HCD statistics (for debug)
<*> User-space granted page access driver
<*> Framebuffer-device frontend driver
<*>   Keyboard-device frontend driver
[*] Disable serial port drivers
<*> Export Xen attributes in sysfs
(256) Number of guest devices
    Xen version compatibility (no compatibility code)  --->
[*] Place shared vCPU info in per-CPU storage

Now compile :

localhost linux # ./makeU.sh -j3
...
localhost linux # cp _domU/arch/x86/boot/vmlinuz ../

E- Guest installation

Paravirtualization installation

Creation of vm directory :

localhost ~ # mkdir /var/xen/def-gentoo
localhost ~ # dd if=/dev/zero of=/var/xen/def-gentoo/def-gentoo.img bs=1M count=3500
localhost ~ # dd if=/dev/zero of=/var/xen/def-gentoo/def-gentoo.swap bs=1M count=1000
localhost ~ # mkfs.ext4 -N 600000 /var/xen/def-gentoo/def-gentoo.img
localhost ~ # mkswap /var/xen/def-gentoo/def-gentoo.swap

This will create a disk image of 3G and a swap of 1G.

Configuration file

/var/xen/def-gentoo/def-gentoo.conf

kernel = "/usr/src/vmlinuz"
memory = 500
maxmem = 650
name = "def-gentoo"
vcpus = 2
vif = [ 'bridge=xenred' ]
disk = [ 'file:/var/xen/def-gentoo/def-gentoo.img,hda1,w', 'file:/var/xen/def-gentoo/def-gentoo.swap,hda2,w' ]
root = "/dev/hda1 ro"
extra = "xencons=tty"

install /

localhost ~ # mkdir /mnt/gentoo
localhost ~ # mount -o loop /var/xen/def-gentoo/def-gentoo.img /mnt/gentoo
localhost ~ # cd /mnt/gentoo
localhost gentoo # wget ftp://ftp.free.fr/mirrors/ftp.gentoo.org/releases/amd64/current-stage3/stage3-amd64-*.tar.bz2
localhost gentoo # tar xjpf stage3-amd64-*.tar.bz2
localhost gentoo # rm stage3-amd64-*.tar.bz2
localhost gentoo # cd usr/
localhost usr # wget ftp://ftp.free.fr/mirrors/ftp.gentoo.org/snapshots/portage-latest.tar.bz2
localhost usr # tar xjf portage-latest.tar.bz2
localhost usr # rm portage-latest.tar.bz2

/mnt/gentoo/etc/fstab

...
#/dev/BOOT              /boot           ext2            noauto,noatime  1 2
/dev/hda1               /               ext4            noatime         0 1
/dev/hda2               none            swap            sw              0 0
/dev/cdrom              /mnt/cdrom      auto            noauto,ro       0 0
#/dev/fd0               /mnt/floppy     auto            noauto          0 0
...

Now we are going to copy the kernel to the vm.

localhost usr # rm -Rf /mnt/gentoo/usr/src/*
localhost usr # cp -R /usr/src/linux-2.6.31-xen-r7/ /mnt/gentoo/usr/src/
localhost usr # cd /mnt/gentoo/usr/src
localhost src # ln -s linux-2.6.31-xen-r7 linux
localhost src # chroot /mnt/gentoo /bin/bash
localhost / # env-update && source /etc/profile
localhost / # passwd
New password:
Retype new password:
passwd: password updated successfully
localhost / # cd /usr/src/linux
localhost linux # ./makeU.sh modules_install
localhost linux # exit
localhost src # cd
localhost ~ # umount /mnt/gentoo

boot the kernel

localhost src # xm create -c /var/xen/def-gentoo/def-gentoo.conf
...
This is localhost.unknown_domain (Linux x86_64 2.6.31-xen-r7) 17:24:49

localhost login: root
Password:

warning: To detach the vm screen :

ctrl + ] (on english keyboard)
ctrl + $ (on french keyboard)

To be attached back to the screen :

# xm console def-gentoo

warning: Do not use less on vm console it will crash return lines in your current shell, use an ssh connection instread.

Set network

config_eth0=("192.168.0.254/24")
routes_eth0=("default via 192.168.0.1")

/etc/resolv.conf

nameserver 212.27.40.240
nameserver 212.27.40.241

warning: use your provider dns servers

localhost ~ # /etc/init.d/net.eth0 start

rebuild

configure make.conf

CFLAGS="-march=core2 -O2 -pipe"
CXXFLAGS="${CFLAGS}"
# WARNING: Changing your CHOST is not something that should be done lightly.
# Please consult http://www.gentoo.org/doc/en/change-chost.xml before changing.
CHOST="x86_64-pc-linux-gnu"

MAKEOPTS="-j3"

# These are the USE flags that were used in addition to what is provided by the
# profile used for building.
USE="mmx sse sse2 -X unicode ipv6 -fortran"

localhost ~ # emerge -vae world

localhost ~ # rm -Rf /usr/portage/distfiles/
localhost ~ # rc-update add sshd default
localhost ~ # emerge syslog-ng vixie-cron logrotate
localhost ~ # rc-update add syslog-ng default
localhost ~ # rc-update add vixie-cron default

Timezone

localhost ~ # cp /usr/share/zoneinfo/Europe/Paris /etc/localtime

...
TIMEZONE="Europe/Paris"
...

localhost ~ # emerge ntp
...
localhost ~ # rc-update add ntp-client default
localhost ~ # /etc/init.d/ntp-client start

Set hostname

...
127.0.0.1 VMNAME.home.loc VMNAME localhost
...

/var/xen/def-2003/def-2003.conf

HOSTNAME="VMNAME"

localhost ~ # hostname VMNAME

fw-prs.img 4000 fw-prs.swap 1024

Virtualization installation

Virtualisation is for unmodified guest like windows :

srv-mvl ~ # mkdir /var/xen/def-2003/
srv-mvl ~ # dd if=/dev/zero of=/var/xen/def-2003/def-2003.img bs=1M count=15000

warning: I dit not found a solution to resize virtual drive after installation, so you need to give a good size to your img file

Copy an iso of 2003 from an other computer to your host using scp:

# scp FR_WS03VL.iso 192.168.0.3:/usr/src/

Configure your VM

kernel = "/usr/lib/xen/boot/hvmloader"
builder='hvm'
memory = 512
#maxmem=600
vcpus=1
on_poweroff='destroy'
on_reboot='restart'
on_crash='restart'
##acpi=1
##apic=1
name = "mng-mvl"
vif = [ 'type=ioemu, mac=aa:00:b0:00:00:11, bridge=xenred' ]
disk = [ 'file:/var/xen/def-2003/def-2003.img,hda,w', 'file:/usr/src/FR_WS03VL.iso,hdb:cdrom,r'  ]
device_model = '/usr/lib64/xen/bin/qemu-dm'
cdrom="file:/usr/src/FR_WS03VL.iso,hdb:cdrom,r"
boot="d"
sdl=0
vnc=1
vncviewer=0
ne2000=0
keymap='fr'
usbdevice='tablet'

Configure your xen vnc password :

/etc/xen/xend-config.sxp

...
(vnc-listen '0.0.0.0')

(vncpasswd 'yourpassword')
...

srv-mvl ~ # /etc/init.d/xend restart
srv-mvl ~ # xm create /var/xen/def-2003/def-2003.conf

now use a vnc client to connect to your vm on 192.168.0.3:5900 and follow installation of windows

Read or add comments to this article

C- Server installation

2010-07-28T12:03:05+02:00

Here we are going to install a linux server composed of :

A gentoo 64 Bit
KVM for paravirualisation and virtualisation
5 hard drives as raid6 for / and datas
Full encrypted partitions on different drives with AES
An initramfs to boot on and asking for decryption passwords

Bios configuration

Do not overclock your server, with a full time running overclocked computer you have good chance to have crash after few days running.
Configure your ATA with AHCI, you should have better performance.
Enable Intel Virtualization technology (for kvm)
Set restore on power loss to Power On to reboot automaticaly
Set all your raid drives as boot sequence even if you boot on cdrom first (needed for grub configuration)

Installation

Download an iso of the latest version of gentoo (link). Burn it and boot on it.

For this exemple I'will use 5 drives of about 200G for RAID6 the target partition sizes :

md1 : 50M as RAID1 for /boot (we don't need raid6 for 50M)
md2 : 150G as RAID6 for / and KVM drives
md3 : to the end of drives as RAID6 for data

warning: If you have more than 1 controller for your drives spread your drive on different controller, like that if a controller become crazy it will not destroy all drives.

My / takes about 8G.

My VMs are composed of (with swap files and data) :

ad : 10G
ex : 7G
fw : 5G
gate : 6G
mng : 20G
websrv1 : 11G
websrv2 : 27G

So we need about 100G for / and VMs (I set 150G to be sur ;))

open ssh server to Ctrl+C Ctrl+V commands :

livecd ~ # loadkeys fr
livecd ~ # passwd
livecd ~ # /etc/init.d/sshd start
livecd ~ # ifconfig

now you can connect from an other computer

Prepare hard drives

A visual representation of hard drives levels :

Devices	hdX	hdY	sdZ
Raid	RAID6
Crypto	AES
File System	EXT3
Mount Point	/

First you have to find your smallest HDD to create raid based on his size :

# fdisk -l

Disk /dev/hda: 203.9 GB, 203928109056 bytes
255 heads, 63 sectors/track, 24792 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System

Disk /dev/hdb: 203.9 GB, 203928109056 bytes
255 heads, 63 sectors/track, 24792 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System

Disk /dev/hdc: 251.0 GB, 251000193024 bytes
255 heads, 63 sectors/track, 30515 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System

Disk /dev/hde: 203.9 GB, 203928109056 bytes
255 heads, 63 sectors/track, 24792 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System

Disk /dev/hdf: 203.9 GB, 203928109056 bytes
255 heads, 63 sectors/track, 24792 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System

Disk /dev/sda: 200.0 GB, 200049647616 bytes
255 heads, 63 sectors/track, 24321 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System

Disk /dev/sdb: 203.9 GB, 203928109056 bytes
255 heads, 63 sectors/track, 24792 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System

I will use :

hda : PATA controller 1
hde, hdf : PATA controller 2
sda, sdb : SATA controller 1

For me sda is the smallest drive, so i will start with this one:

to calculate raid6 size : C = (n - 2) * c

C : total capacity of your raid
n : number of disks
c : single disk partition capacity

150 = (5 - 2) * c

c = 150 / 3

c = 50G for /dev/sda2

So we have to create partitions of 50G on each drives to have a raid6 of 150G

livecd ~ # fdisk /dev/sda
Command (m for help): n
Command action
   e   extended
   p   primary partition (1-4)
p
Partition number (1-4): 1
First cylinder (1-24321, default 1):
Using default value 1
Last cylinder, +cylinders or +size{K,M,G} (1-24321, default 24321): +50M

Command (m for help): n
Command action
   e   extended
   p   primary partition (1-4)
p
Partition number (1-4): 2
First cylinder (8-24792, default 8):
Using default value 8
Last cylinder, +cylinders or +size{K,M,G} (8-24321, default 24321): +50G

Command (m for help): n
Command action
   e   extended
   p   primary partition (1-4)
p
Partition number (1-4): 3
First cylinder (140-24792, default 140):
Using default value 140
Last cylinder, +cylinders or +size{K,M,G} (140-24321, default 24321):
Using default value 24321
Command (m for help): t
Partition number (1-4): 1
Hex code (type L to list codes): fd
Changed system type of partition 1 to fd (Linux raid autodetect)

Command (m for help): t
Partition number (1-4): 2
Hex code (type L to list codes): fd
Changed system type of partition 2 to fd (Linux raid autodetect)

Command (m for help): t
Partition number (1-4): 3
Hex code (type L to list codes): fd
Changed system type of partition 3 to fd (Linux raid autodetect)

Command (m for help): a
Partition number (1-4): 1

Command (m for help): p

Disk /dev/sda: 200.0 GB, 200049647616 bytes
255 heads, 63 sectors/track, 24321 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x48ee7660

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1           7       56196   fd  Linux raid autodetect
/dev/sda2               8        6600    52958272   fd  Linux raid autodetect
/dev/sda3            6601       24321   142343932+  fd  Linux raid autodetect

Command (m for help): w
The partition table has been altered!

Calling ioctl() to re-read partition table.
Syncing disks.
livecd ~ #

For other disks you have to do the same thing except for the 3rd partition. Instead of just press enter for final size set smallest drive 3rd partition size.

Partition number (1-4): 3
First cylinder (6536-24321, default 6536):
Using default value 6536
Last cylinder, +cylinders or +size{K,M,G} (6536-24792, default 24792): 24321

Command (m for help):

Creating raid

livecd ~ # modprobe raid1
livecd ~ # modprobe raid6
livecd ~ # modprobe dm-mod

tip: see modules :

livecd ~ # lsmod | grep raid

livecd ~ # mknod /dev/md1 b 9 1
livecd ~ # mknod /dev/md2 b 9 2
livecd ~ # mknod /dev/md3 b 9 3

livecd ~ # mdadm --create /dev/md1 --level=1 --raid-devices=6 /dev/sda1 /dev/sdb1 /dev/hda1 /dev/hdb1 /dev/hde1 /dev/hdf1
mdadm: array /dev/md1 started.
livecd ~ # mdadm --create /dev/md2 --level=6 --raid-devices=5 /dev/sda2 /dev/sdb2 /dev/hda2 /dev/hdb2 /dev/hde2
mdadm: array /dev/md2 started.
livecd ~ # mdadm --create /dev/md3 --level=6 --raid-devices=5 /dev/sda3 /dev/sdb3 /dev/hda3 /dev/hdb3 /dev/hde3
mdadm: array /dev/md3 started.

add spare :

livecd ~ # mdadm --add /dev/md2 /dev/sdf2
livecd ~ # mdadm --add /dev/md3 /dev/sdf3

now wait for raid sync :

livecd ~ # watch cat /proc/mdstat
Every 2.0s: cat /proc/mdstat                                                      Fri Nov 13 21:49:39 2009

Personalities : [raid0] [raid1] [raid6] [raid5] [raid4] [raid10]
md3 : active raid6 hdf3[4] hde3[3] hda3[2] sdb3[1] sda3[0]
      428597760 blocks level 6, 64k chunk, algorithm 2 [5/5] [UUUUU]
        resync=DELAYED

md2 : active raid6 hdf2[4] hde2[3] hda2[2] sdb2[1] sda2[0]
      157308288 blocks level 6, 64k chunk, algorithm 2 [5/5] [UUUUU]
      [==>..................]  resync = 10.4% (5496896/52436096) finish=36.8min speed=21227K/sec

md1 : active raid1 hdf1[4] hde1[3] hda1[2] sdb1[1] sda1[0]
      56128 blocks [5/5] [UUUUU]

unused devices: <none>

tip: Ctrl+C to quit

Crypt partitions :

livecd ~ # cryptsetup -y -v -c aes-xts-benbi:sha512 -h sha512 -s 512 luksFormat /dev/md2

WARNING!
========
This will overwrite data on /dev/md2 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase:
Verify passphrase:
Command successful.
livecd ~ # cryptsetup -y -v -c aes-xts-benbi:sha512 -h sha512 -s 512 luksFormat /dev/md3

WARNING!
========
This will overwrite data on /dev/md3 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter LUKS passphrase:
Verify passphrase:
Command successful.
livecd ~ #

Open encrypted partitions

livecd ~ # cryptsetup luksOpen /dev/md2 md2
Enter LUKS passphrase:
key slot 0 unlocked.
Command successful.
livecd ~ # cryptsetup luksOpen /dev/md3 md3
Enter LUKS passphrase:
key slot 0 unlocked.
Command successful.

Format partitions

livecd ~ # mke2fs -j /dev/md1
mke2fs 1.41.3 (12-Oct-2008)
...
This filesystem will be automatically checked every 33 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.
livecd ~ # mkfs.ext4 /dev/mapper/md2
mke2fs 1.41.3 (12-Oct-2008)
...
This filesystem will be automatically checked every 26 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.
livecd ~ # mkfs.ext4 /dev/mapper/md3
mke2fs 1.41.3 (12-Oct-2008)
...
This filesystem will be automatically checked every 32 mounts or
180 days, whichever comes first.  Use tune2fs -c or -i to override.

tip: Do not use LVM as it “may” degrade (see) performance and is very unnecessary if you create well sized partitions

mount drives (md3 will only be used in xen later)

livecd ~ # mount /dev/mapper/md2 /mnt/gentoo/
livecd ~ # mkdir /mnt/gentoo/boot
livecd ~ # mount /dev/md1 /mnt/gentoo/boot/

Installation of /

swap

livecd ~ # dd if=/dev/zero of=/mnt/gentoo/swap.img bs=1M count=1000
livecd ~ # mkswap /mnt/gentoo/swap.img
Setting up swapspace version 1, size = 1023996 KiB
no label, UUID=11c45e43-4a60-43a6-8a99-352b5b1dc939
livecd ~ # swapon /mnt/gentoo/swap.img
livecd ~ # swapon -s
Filename                                Type            Size    Used    Priority
/mnt/gentoo/swap.img                    file            1023992 0       -1

Stage3

Download stage3

livecd ~ # cd /mnt/gentoo/
livecd gentoo # links http://www.gentoo.org/main/en/mirrors.xml

select a mirror and download stage3 tar.gz file for your arch (amd64 for me)

tip: direct download:

livecd gentoo # wget ftp://ftp.free.fr/mirrors/ftp.gentoo.org/releases/amd64/current-stage3/stage3-amd64-*.tar.bz2

Extract stage3

livecd gentoo # time tar xjpf stage3*

real    1m10.811s
user    0m32.000s
sys     0m3.230s

warning: Be sur to mount boot partition before extracting stage3 or you will have problems with grub.

Portage

livecd gentoo # cd /mnt/gentoo/usr
livecd usr # links http://www.gentoo.org/main/en/mirrors.xml

select a mirror and download latest portage

tip: direct download :

livecd usr # wget ftp://ftp.free.fr/mirrors/ftp.gentoo.org/snapshots/portage-latest.tar.bz2

Extract portage

livecd usr # time tar xjf portage-lat*

real    1m31.991s
user    0m14.500s
sys     0m5.790s

Chroot and prepare system

Chroot

livecd usr # cd /
livecd / # mount -t proc proc /mnt/gentoo/proc
livecd / # mount -o bind /dev /mnt/gentoo/dev
livecd / # cp -L /etc/resolv.conf /mnt/gentoo/etc/
livecd / # chroot /mnt/gentoo /bin/bash
livecd / # source /etc/profile && env-update
>>> Regenerating /etc/ld.so.cache...

Root password

change root password

livecd / # passwd
New UNIX password:
Retype new UNIX password:
passwd: password updated successfully

Keyboard map

/etc/conf.d/keymaps

...
KEYMAP="fr"
...

fstab

/etc/fstab

...
/dev/md1                /boot           ext3            noauto,noatime  1 2
/dev/mapper/md2         /               ext4            noatime         0 1
/swap.img               none            swap            sw              0 0
/dev/cdrom              /mnt/cdrom      auto            noauto,ro       0 0
...

warning: Do not forget /boot filesystem as ext3 and / as ext4

livecd / # mkdir /etc/portage

Compilation optimization

Have a look on flags for your processor and populate your make.conf

exemple for my core2

CHOST="x86_64-pc-linux-gnu"
CFLAGS="-march=core2 -O2 -pipe"
CXXFLAGS="${CFLAGS}"

MAKEOPTS="-j3"

USE="mmx sse sse2 -X unicode ipv6 -fortran"

tip: MAKEOPTS should be : number_of_processor_core + 1

Kernel

Install package :

livecd / # emerge -a gentoo-sources

Kernel configuration

livecd / # cd /usr/src/linux
livecd linux # make menuconfig

Processor type and features  --->
  [*] Paravirtualized guest support  --->
    [ ]   Xen guest support
    [*]   KVM paravirtualized clock
    [*]   KVM Guest support
    -*-   Enable paravirtualization code
    [*]     Paravirtualization layer for spinlocks
      Processor family (Core 2/newer Xeon)  --->
[*] Networking support  --->
  Networking options  --->
    <*> 802.1d Ethernet Bridging
Device Drivers  --->
  [*] Network device support  --->
    <*> Universal TUN/TAP device driver support
    <*>   Virtio network driver (EXPERIMENTAL)
  [*] Block devices --->
    <*> Loopback device support
    <*>   Virtio block driver (EXPERIMENTAL)
      Character devices  --->
    <*> Virtio console
    <*>   VirtIO Random Number Generator support
  [*] Multiple devices driver support (RAID and LVM)  --->
    <*>   RAID support
    <*>     RAID-1 (mirroring) mode
    <*>     RAID-4/RAID-5/RAID-6 mode
    <*>   Device mapper support
    <*>     Crypt target support

    <M> I2C support  --->
        <M> I2C device interface
            I2C Hardware Bus support --->
            # Activate everything
    <M> Hardware Monitoring Support --->
        # Activate everything

File systems  --->
    <*> The Extended 4 (ext4) filesystem
    [*]   Ext4 extended attributes
    [*]     Ext4 POSIX Access Control Lists
    [*]     Ext4 Security Labels
    <*> FUSE (Filesystem in Userspace) support
-*- Cryptographic API  --->
  <*>   XTS support (EXPERIMENTAL)
  <*>   SHA224 and SHA256 digest algorithm
  <*>   SHA384 and SHA512 digest algorithms
  -*-   AES cipher algorithms (x86_64)
  <*>   AES cipher algorithms (AES-NI)
[*] Virtualization --->
    --- Virtualization
    <*>   Kernel-based Virtual Machine (KVM) support
    <*>     KVM for Intel processors support
    < >     KVM for AMD processors support
    <*>   Host kernel accelerator for virtio net (EXPERIMENTAL)
    <*>   PCI driver for virtio devices (EXPERIMENTAL)
    <*>   Virtio balloon driver (EXPERIMENTAL)

warning: Do not forget to set your devices drivers !

network devices
HDD controller

# lspci in livecd will tell you

livecd linux # make -j3
...
Kernel: arch/x86/boot/vmlinuz is ready  (#1)
livecd linux # make modules_install
livecd linux # cp arch/x86/boot/bzImage /boot/kernel

InitRamFs

Follow this link to build your initramfs :

build your initramfs

warning: we have to use an initramfs to open encrypted drive during boot

Install grub

livecd initramfs # emerge grub
livecd initramfs # grub
grub> root (hd0,0)
grub> setup (hd0)
grub> root (hd1,0)
grub> setup (hd1)
grub> root (hd2,0)
grub> setup (hd2)
grub> root (hd3,0)
grub> setup (hd3)
grub> root (hd4,0)
grub> setup (hd4)
grub> root (hd5,0)
grub> setup (hd5)
grub> quit

tip: hdX in grub corresponds to bios hard drive boot sequences, drives have to be set in bios

/boot/grub/grub.conf

title GLK
root (hd0,0)
kernel /boot/kernel root=/dev/mapper/md2
module /boot/initramfs.gz

Finished!

livecd initramfs # exit
livecd / # umount /mnt/gentoo/proc/ /mnt/gentoo/dev /mnt/gentoo/boot /mnt/gentoo

sources:

for installation:

http://www.gentoo.org/doc/en/gentoo-x86+raid+lvm2-quickinstall.xml

for xen:

for initramfs:

lots of internet search ;)

Read or add comments to this article

D- System config

2010-07-20T15:08:38+02:00

Network Configuration

config_eth0=("null")
config_eth1=("null")

config_red=("192.168.0.3/24")
bridge_red=("eth0")
rc_need_red="net.eth0"
brctl_red=(
        "setfd 0"
        "stp off"
)
routes_red=("default via 192.168.0.2")

config_green=("192.168.2.3/24")
bridge_green=("eth1")
rc_need_green="net.eth1"
brctl_green=(
        "setfd 0"
        "stp off"
)

config_dmz=("null")
brctl_dmz=(
        "setfd 0"
        "stp off"
)

localhost ~ # cd /etc/init.d
localhost init.d # ln -s net.lo net.eth1
localhost init.d # ln -s net.lo net.red
localhost init.d # ln -s net.lo net.green
localhost init.d # ln -s net.lo net.dmz
localhost init.d # rc-update add net.eth0 default
localhost init.d # rc-update add net.eth1 default
localhost init.d # rc-update add net.red default
localhost init.d # rc-update add net.green default
localhost init.d # rc-update add net.dmz default
localhost init.d # /etc/init.d/net.eth0 start
localhost init.d # /etc/init.d/net.eth1 start
localhost init.d # /etc/init.d/net.red start
localhost init.d # /etc/init.d/net.green start
localhost init.d # /etc/init.d/net.dmz start

Now add ssh deamon to runlevels

localhost ~ # rc-update add sshd default
 * sshd added to runlevel default
localhost ~ # /etc/init.d/sshd start
Generating public/private rsa1 key pair.
...
 * Starting sshd ...
localhost ~ #

Hostname configuration

...
127.0.0.1       srv-prs.home.loc srv-prs localhost
...

HOSTNAME="srv-prs"

localhost ~ # hostname srv-prs
localhost ~ # hostname -f
srv-prs.home.loc
localhost ~ #

Timezone

localhost ~ # cp /usr/share/zoneinfo/Europe/Paris /etc/localtime

/var/vm/def-gentoo/def-gentoo.xml

...
TIMEZONE="Europe/Paris"
...

localhost ~ # emerge ntp
...
localhost ~ # rc-update add ntp-client default
localhost ~ # /etc/init.d/ntp-client start

Rebuild for optimisation

localhost ~ # time emerge -vae world
...

real    183m54.743s
user    155m45.326s
sys     86m24.708s

Installation of basic softwares

localhost ~ # emerge -a syslog-ng vixie-cron sendmail logrotate cryptsetup mdadm bridge-utils usermode-utilities htop pci-utils usbutils
...
localhost ~ # rc-update add syslog-ng default
 * syslog-ng added to runlevel default
localhost ~ # rc-update add vixie-cron default
 * vixie-cron added to runlevel default
localhost ~ # rc-update add sendmail default
 * sendmail added to runlevel default

syslog-ng log system
vixie-cron cron system
sendmail to send administration mails
logrotate rotate logs to prevend hard drive fill
cryptsetup to manage encrypted drives
mdadm to manage raid
htop a better top
pci-utils to privide lspci
usbutils to provide lsusb
bridge-utils to manage bridge if we have to do things by hand
usermode-utilities to manage tun(tunctl) if we have to do things by hand

Hdparm

To save power and hard drive life you can configure your hard drive to Spindown after a time without using it :

localhost ~ # emerge -v hdparm

The Time (in seconds) after which the Drive spins down is the value of your x multiplied with 5 From the manpage:

/etc/conf.d/hdparm

...
sda_args="-S241"
sdd_args="-S241"
...

localhost ~ # /etc/init.d/hdparm start
localhost ~ # rc-update add hdparm default

Iptables

As you can see in network configuration the server has 2 legs in 2 networks : red and green.

the green one will be the default one and the red one is an admin interface to the world(next to red network), where we are going to allow only ssh access :

# emerge -va iptables

#!/bin/bash -x

iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

iptables -A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A INPUT -i eth0 -p tcp --destination-port 22 -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --source-port 22 -j ACCEPT

iptables -A INPUT -i eth0 -j REJECT
iptables -A OUTPUT -o eth0 -j REJECT

# IPV6
ip6tables -F INPUT
ip6tables -F OUTPUT
ip6tables -F FORWARD
ip6tables -F

ip6tables -P INPUT DROP
ip6tables -P OUTPUT DROP
ip6tables -P FORWARD DROP

echo "0" >/proc/sys/net/ipv6/conf/all/forwarding

/root/fw.sh

# chmod +x /root/fw.sh
# rc-update add iptables default
# rc-update add ip6tables default
# /etc/init.d/iptables start
# /etc/init.d/ip6tables start
# /root/fw.sh
# /etc/init.d/iptables save
# /etc/init.d/ip6tables save

KVM

Layers used by to manage virtualisation :

LAYERS
Hardware
KVM
qemu
libvirt
virsh	virt-manager	archipel?
cli	client	web?

warning: We are currently not going to install the web part of administration

/etc/portage/package.use

app-emulation/libvirt qemu udev
x11-libs/cairo X

# emerge -va cairo dbus qemu-kvm libvirt virt-manager
# rc-update add libvirtd default
# rc-update add dbus default
# /etc/init.d/libvirtd start
# /etc/init.d/dbus start

Guest Kernel compilation

May not be needed…

Separation of dom0 and domU kernels

We are going to create 2 scripts to compile the domU and dom0.

localhost ~ # cd /usr/src/linux/
localhost linux # echo "mkdir -p _dom0 && make O=_dom0 \$@" > make0.sh
localhost linux # echo "mkdir -p _domU && make O=_domU \$@" > makeU.sh
localhost linux # chmod +x make?.sh
localhost linux # ./make0.sh menuconfig

Just Exit and Save.

localhost linux # ./makeU.sh menuconfig
localhost linux # cp .config _dom0/
localhost linux # cp .config _domU/
localhost linux # make mrproper

Same thing, Exit and save.

now you can compile :

your dom0 kernel by doing ./make0.sh … in /usr/src/linux and take the kernel in /usr/src/linux/_dom0
your domU kernel by doing ./makeU.sh … in /usr/src/linux and take the kernel in /usr/src/linux/_domU

domU compilation

Processor type and features  --->
  [*] Paravirtualized guest support  --->
    [ ]   Xen guest support
    [*]   KVM paravirtualized clock
    [*]   KVM Guest support
    -*-   Enable paravirtualization code
    [*]     Paravirtualization layer for spinlocks
      Processor family (Core 2/newer Xeon)  --->
[*] Networking support  --->
  Networking options  --->
    <*> 802.1d Ethernet Bridging
Device Drivers  --->
  [*] Network device support  --->
    <*> Universal TUN/TAP device driver support
    <*>   Virtio network driver (EXPERIMENTAL)
  [*] Block devices --->
    <*> Loopback device support
    <*>   Virtio block driver (EXPERIMENTAL)
      Character devices  --->
    <*> Virtio console
    <*>   VirtIO Random Number Generator support
  [*] Multiple devices driver support (RAID and LVM)  --->
    <*>   RAID support
    <*>     RAID-1 (mirroring) mode
    <*>     RAID-4/RAID-5/RAID-6 mode
    <*>   Device mapper support
    <*>     Crypt target support
File systems  --->
    <*> The Extended 4 (ext4) filesystem
    [*]   Ext4 extended attributes
    [*]     Ext4 POSIX Access Control Lists
    [*]     Ext4 Security Labels
    <*> FUSE (Filesystem in Userspace) support
-*- Cryptographic API  --->
  <*>   XTS support (EXPERIMENTAL)
  <*>   SHA224 and SHA256 digest algorithm
  <*>   SHA384 and SHA512 digest algorithms
  -*-   AES cipher algorithms (x86_64)
  <*>   AES cipher algorithms (AES-NI)
[*] Virtualization --->
    --- Virtualization
    <*>   Kernel-based Virtual Machine (KVM) support
    <*>     KVM for Intel processors support
    < >     KVM for AMD processors support
    <*>   Host kernel accelerator for virtio net (EXPERIMENTAL)
    <*>   PCI driver for virtio devices (EXPERIMENTAL)
    <*>   Virtio balloon driver (EXPERIMENTAL)

Now compile :

localhost linux # ./makeU.sh -j3
...
localhost linux # cp _domU/arch/x86/boot/bzImage ../

-->

E- Guest installation

2010-07-20T20:09:06+02:00

VM supervision

go to virt-top and download a binary package of the virt-top

Gentoo installation

Creation of vm directory :

localhost ~ # mkdir /var/vm/
localhost ~ # mkdir /var/vm/def-gentoo
localhost ~ # dd if=/dev/zero of=/var/vm/def-gentoo/def-gentoo.img bs=1M count=3500
localhost ~ # dd if=/dev/zero of=/var/vm/def-gentoo/def-gentoo.swap bs=1M count=1000
localhost ~ # mkfs.ext4 -N 600000 /var/vm/def-gentoo/def-gentoo.img
localhost ~ # mkswap /var/vm/def-gentoo/def-gentoo.swap

We provide a huge inode size during ext4 format to be prepare to resize disk

This will create a disk image of 3.5G and a swap of 1G.

Configuration file

<domain type='kvm'>
  <name>def-gentoo</name>
  <memory>1048576</memory>
  <currentMemory>1048576</currentMemory>
  <vcpu>2</vcpu>
  <os>
    <type arch='x86_64'>hvm</type>
    <boot dev='hd'/>
    <kernel>/usr/src/bzImage</kernel>
    <!--<initrd>/usr/src/initrd</initrd>-->
    <cmdline>root=/dev/vda console=ttyS0</cmdline>
  </os>
  <features>
    <acpi/>
    <apic/>
  </features>
  <cpu>
    <topology sockets='1' cores='2' threads='1' />
  </cpu>
  <clock offset='localtime' />
  <on_poweroff>destroy</on_poweroff>
  <on_reboot>restart</on_reboot>
  <on_crash>restart</on_crash>
  <devices>
    <emulator>/usr/bin/kvm</emulator>

    <!-- DRIVES -->
    <disk type='file' device='disk'>
      <driver name='qemu' type='raw' cache='none' />
      <source file='/var/vm/def-gentoo/def-gentoo.img'/>
      <!--<shareable/>-->
      <target dev='vda' bus='virtio'/>
    </disk>
    <disk type='file' device='disk'>
      <driver name='qemu' type='raw' />
      <source file='/var/vm/def-gentoo/def-gentoo.swap'/>
      <target dev='vdb' bus='virtio'/>
    </disk>

    <!-- NETWORK -->
    <interface type='bridge'>
      <mac address='52:54:00:2a:00:02' />
      <source bridge='red'/>
      <model type='virtio' />
    </interface>
    <interface type='bridge'>
      <mac address='52:54:00:2a:02:02' />
      <source bridge='green'/>
      <model type='virtio' />
    </interface>

    <serial type='pty'>
      <target port='0'/>
    </serial>
    <console type='pty'>
      <target port='0'/>
    </console>
    <graphics type='vnc' port='-1' keymap='fr' listen='127.0.0.1' />
  </devices>
</domain>

warning: Do not forget to update mac addresses of network interfaces

install /

localhost ~ # mkdir /mnt/gentoo
localhost ~ # mount -o loop /var/vm/def-gentoo/def-gentoo.img /mnt/gentoo
localhost ~ # cd /mnt/gentoo
localhost gentoo # wget ftp://ftp.free.fr/mirrors/ftp.gentoo.org/releases/amd64/current-stage3/stage3-amd64-*.tar.bz2
localhost gentoo # tar xjpf stage3-amd64-*.tar.bz2
localhost gentoo # rm stage3-amd64-*.tar.bz2
localhost gentoo # cd usr/
localhost usr # wget ftp://ftp.free.fr/mirrors/ftp.gentoo.org/snapshots/portage-latest.tar.bz2
localhost usr # tar xjf portage-latest.tar.bz2
localhost usr # rm portage-latest.tar.bz2

/mnt/gentoo/etc/fstab

...
#/dev/BOOT              /boot           ext2            noauto,noatime  1 2
/dev/vda               /               ext4            noatime         0 1
/dev/vdb               none            swap            sw              0 0
/dev/cdrom              /mnt/cdrom      auto            noauto,ro       0 0
#/dev/fd0               /mnt/floppy     auto            noauto          0 0
...

localhost src # chroot /mnt/gentoo /bin/bash
localhost / # env-update && source /etc/profile
localhost / # passwd
New password:
Retype new password:
passwd: password updated successfully

Now we are going to add serial output console (uncomment serial console)

/etc/inittab

...
# SERIAL CONSOLES
s0:12345:respawn:/sbin/agetty 9600 ttyS0 vt100
...

localhost linux # exit
localhost src # cd
localhost ~ # umount /mnt/gentoo

add vm to libvirt

localhost src # ln -s /var/vm/def-gentoo.xml /etc/libvirt/qemu/def-gentoo.xml
localhost src # ln -s /etc/libvirt/qemu/def-gentoo.xml /etc/libvirt/qemu/autostart/def-gentoo.xml
localhost src # /etc/init.d/libvirtd reload
localhost src # virsh list --all
 Id Name                 State
----------------------------------
  - def-gentoo           shut off

localhost src # virsh create def-gentoo
localhost src # virsh console def-gentoo
...
This is localhost.unknown_domain (Linux x86_64 2.6.31-xen-r7) 17:24:49

localhost login: root
Password:

warning: To detach the vm screen :

ctrl + ] (on english keyboard)
ctrl + $ (on french keyboard)

warning: Do not use less on vm console it will crash return lines in your current shell, use an ssh connection instread.

Set network

config_eth0=("192.168.0.254/24")
routes_eth0=("default via 192.168.0.1")

/etc/resolv.conf

nameserver 212.27.40.240
nameserver 212.27.40.241

warning: use your provider dns servers

localhost ~ # /etc/init.d/net.eth0 start

rebuild

configure make.conf

CFLAGS="-march=core2 -O2 -pipe"
CXXFLAGS="${CFLAGS}"
# WARNING: Changing your CHOST is not something that should be done lightly.
# Please consult http://www.gentoo.org/doc/en/change-chost.xml before changing.
CHOST="x86_64-pc-linux-gnu"

MAKEOPTS="-j3"

# These are the USE flags that were used in addition to what is provided by the
# profile used for building.
USE="mmx sse sse2 -X unicode ipv6 -fortran"

localhost ~ # emerge -vae world

localhost ~ # rm -Rf /usr/portage/distfiles/
localhost ~ # rc-update add sshd default
localhost ~ # emerge syslog-ng vixie-cron logrotate
localhost ~ # rc-update add syslog-ng default
localhost ~ # rc-update add vixie-cron default

Timezone

localhost ~ # cp /usr/share/zoneinfo/Europe/Paris /etc/localtime

...
TIMEZONE="Europe/Paris"
...

localhost ~ # emerge ntp
...
localhost ~ # rc-update add ntp-client default
localhost ~ # /etc/init.d/ntp-client start

Set hostname

...
127.0.0.1 VMNAME.home.loc VMNAME localhost
...