CCP14
Methods, Problems and Solutions
Linux Information for Crystallography
Installing a Redhat 6.2 Linux and Win95 Dual Boot System via Network/FTP/HTTP Install on a Generic Desktop PC
The CCP14 Homepage is at http://www.ccp14.ac.uk
As of 2000/2001 - Redhat 7.0, then 7.1 and then 7.2 have been released. The installation given below
is still pretty much valid - and when differences happen they are pretty obvious. Tutorials for
installing 7.2 will be done once a spare computer and (more difficult in London) some office
space for the computer becomes available.
Note: As of early March 2000, Redhat 6.2 was released. Workarounds have now
been determined in doing an equivalent secure 6.0 type install. Overall, Redhat 6.2 install is
quite good, but there are still some post install fixups to do after the install.
Disclaimer
Note: Because of variations in install, multiple toolsets, (never knowing whether
a previous install might have affected the next one); some/all(?) of the following information
might be wrong; and there are probably better methods for doing the following. Keep this in
mind and feel free to think a bit before blindly following the instructions.
Note 2: Redhat does have a reputation of loading more than you really need and running
deamons that you may not really need. After installing, doing a security audit and removing
deamons you do not require is pretty much mandatory. Some of this is explained at the end
of install file. As stated above, this installation tutorial has been modified to try and have
this as hacker safe an installation as possible with by default, no scannable ports open.
Warning: (was advised by local department network support group to insert
the following) In some organisations and departments, installing unauthorized software
or operating systems such as Linux could be a sackable offence. If in doubt, check with
your network support group. Also, take note that some distributions and setup options may
also install software deemed to be "hacker tools". Presence of "hacker tools" on a
computer system could prompt management or criminal action against "offenders".
Backup your old stuff
The following method does the dual boot installation of Linux and Win95 from scratch using
an unpartitioned disk. It is possible to install Linux on an existing Windows system
without destroying the Windows area using FIPS or other similar non-destructive reformatting
software (e.g., Partition Magic). However implementing that is possibly part of a "future" X
hour hacking session; so we are doing "clean the disk - then install" method here.
"FIPS is a program for non-destructive splitting of harddisk partitions" -
FIPs Webpage at: http://bmrc.berkeley.edu/people/chaffee/fips/fips.html.
Note that an up to date FIPS is included in the Redhat Linux tools area.
Partition-Magic is a commercial program with a good reputation for repartitioning without destroying
your data:
http://www.partitionmagic.com/
Also refer:
If new to Linux, Expect to Initially Waste a Lot of Time
Like Austen Powers(?), "It's UNIX Baby Yeahhhh!"
Also refer Unix-haters handbook -
http://catalog.com/hopkins/unix-haters/handbook.html
Noting down the PC System Information
Note down all the information on your system including chip-sets, monitor refresh rates, etc.
If Linux makes a wrong choice, or prompts for a decision, you have to give it the
correct information. If you have Win95/Win98 or WinNT installed, you can
gain this information quite easily from the control panel (assuming the PC is
setup with the correct drivers). This also includes all the network information;
IP address, name, domain, gateway/router, NetMask, etc. Too much information
does not hurt, only too little. For network cards and the like, you may have to
go into Win95 or Win98 and get the memory addresses and the IRQs used. You tend to
find out what extra information you need the hard way.
In this case:
- Viglan 300 MHZ Intel Pentium with 128 Meg RAM
- 3COMFast Etherlink XL 10/100 Mb TX Ethernet NIC (3C 905B-TX) on IRQ 9
- ATI Xpert@Work Video Card (ATI 3D RAGE PRO - DirectX) (MACH64 Drivers based for XFree86 Xwindows)
- iiyama 17" MT-9017T video monitor that can do (Frequency: 50/60Hz):
- 1024x768 at 75Hz VESA; 60.02kHz HorizontalFrequency; 75.0kHz Vertical Frequency
- 1280x1024 at 75Hz VESA; 79.98kHz HorizontalFrequency; 75.0kHz Vertical Frequency
- Generic Floppy Disk
- In board SYMBIOS Logic 875XSID (NCR53c8xx) (Hardcopy Manual: SYM8751SP) PCI Ultra SCSI
Host adapter
- 8 Gig SCSI Fujitsu Hard Disk drive
- Yamaha OPL3-Sax Sound System
- Atapi CD-ROM: TEAC CD-532E
- MS PS/2 3 button Intellimouse
Deciding now on the partitions
Summary: the old Redhat 5.2 manual recommends you partition the hard-disk into segments.
You can if you want to just partition the disk into one large partition that
everything fits into if you want to - this can be much simpler but might hurt you
in the future. I prefer to put everything on one partition with this laptop as
expanding harddisk space is not a practical option - thus everything has to fit.
(Please note that decisions made now can cause much pain and gnashing of teeth later).
The following PC is configured to have 3 operating systems, Windows, Linux and FreeBSD.
In principle, if you set up a dual boot system, then a multiple boot system is a piece
of cake. The main limitation being that for PCs, each hard-disk can only have 4 primary
bootable partitions.
- 4 Gig for Win95
- 2 Gig for Linux (as /)
- 150 Meg for Linux Swap Area
- 2.4 Gig for FreeBSD (single BSD Slice)
Obtain the Ranish Partition Manager for DOS and create a Win95 Boot disk
After mucking around with a few utilities, the freeware Ranish Partition Manager for DOS
is a work of genius for managing partitions and boot managing.
Menu driven, it is a breeze to create and delete partitions,
multiple primary partitions, configure the MBR area. It easily will fit on a Windows/DOS
boot floppy with the rest of your boot utilities. (latest beta version at time of writing (27th April 2000) :
was dated March 14, 2000)
New facilities in Ranish Partition Manager 2.38 not yet covered in these tutorials:
- Handle disks over 8G
- Copy disks and partitions
- Format and Resize FAT partitions
- Boot MS-, PC-, DR- DOS and Windows NT from partitions above 2G
- Boot Partition Manager from a floppy without any OS
- Now added SIMULATION program which lets you play with Partition Manager without messing the real disk
- "The REAL Multi-boot": Tutorials on using shareware/freeware Ranish Partition boot manager and
partition manager to get around the 4 Primary Partition limit with PC:
http://members.tripod.it/Trombettworks/multi-boot.htm
- It should be noted that new boot and partition managers are being created all the time. The
GPL'd XOSL is one worth checking out for Windows which allows 24 boot items (gets around
the 4 Primary partition limit) -
http://www.xosl.org/
Now before you consider deleting Windows, create a boot disk (format a: /u/s) and copy
over the required utility software.
- Copy over the following to the floppy disk:
- Ranish Partition Manager
- format.com
- fdisk.exe
- edit.com
- sys.com
- xcopy.exe
- xcopy32.exe
- himem.sys
- scandisk.exe
- CD-ROM driver and MSCDEX.EXE
- Anything else you fancy and that will fit.
- Configure the config.sys and autoexec.bat on the floppy so that it
will enable the CD-ROM on bootup; plus himem.sys and any country
specific drivers. Set MSCDEX to use D: drive for the CD-ROM. (We will
be formatting the DOS partition of the hard-disk as C: drive.)
In the case of this Toshiba Laptop:
- Note: Having a loaded CD-ROM pointing to C: drive can possibly
stuff up the partitioning process later on; though Ranish Partition
Manager will probably warn you that something is going wrong.
If in doubt, remove the CD-ROM booting from the config.sys and autoexec.bat.
Creating the LINUX Boot Images on Floppy Disk
Using the files located on the Redhat Linux CD-ROM or a mirror,
create the three Image disks depending on how you are installing (local or
network) and hardware type; boot, netboot and pcmcia.
In theory, you only have to create the bootnet.img
disk to install Redhat Linux 6.2 from a generic (non Laptop PC via the internet).
These are generally in the images directory of the media you intend
to install from.
(choose closest Redhat Linux mirrors via:
http://www.redhat.com/mirrors.html or
ftp://ftp.redhat.com/pub/MIRRORS.html)
For example, via FTP, mirror.ac.uk:
Use rawrite or rawrite2 for DOS from the dosutils directory to write/burn the images
onto the CD. Standard "copy" command will not work. Just type rawrite and answer the questions.
Also refer:
- RawWrite 0.3 for windows (NT & 95)
- "rawwrite (or rawrite) is the essential utility for creating boot and root disks for installing Linux.
Unfortunately, it required DOS to operate, so here is the long awaited WIN32 version. It works
under NT and 95."
- http://uranus.it.swin.edu.au/~jn/linux/rawwrite.htm
Alternatively, if you are already on a LINUX PC, you can use the command:
- dd if=filename.img of=/dev/fd0 bs=1440k
- dd if=bootnet.img of=/dev/fd0 bs=1440k
- dd if=pcmcia.img of=/dev/fd0 bs=1440k
- dd if=rescue.img of=/dev/fd0 bs=1440k
Determined the Install Process/Method you are going to Use
You have a variety of options to install the Redhat 6.2 Linux
distribution. Initially, I decided on FTP as the CD installation seemed a
bit quirky and FTP from Imperial College from Daresbury Laboratory
was very quick at nights and on weekends (10-12 minutes). This is compared
to around 90 minutes to do a much abbreviated install during a weekday
between 9am-5pm. However, for repetative installation, creation of a
CD installation disk can spead things up and avoid nuances of the network
and this is the subject of a separate install page.
Whatever you do, if you use the internet, choose the closest
mirror. If you are isolated from the internet, or have slow
links, CD-ROM or Hard-disk based install are obvious things to
choose from. Linux can install from NFS or Windows SMB based
shared hard-disks (but I have never got installing either
locally from a Windows partition-harddisk or from a Windows SMB to work - at least
with Redhat 5.2).
Thus in this case:
FTP Load
IP Address = 193.63.255.4
Name = src.doc.ic.ac.uk
/pub/Mirrors/ftp.redhat.com/redhat/redhat-7.2-en/os/i386/
or
FTP Load
IP Address = 148.88.2.15 or 148.88.2.11
Name = ftp.mirror.ac.uk
/sites/ftp.redhat.com/pub/redhat/redhat-7.2-en/os/i386/
(restricted to academic users during normal working hours)
Or use the CD-ROM method and boot using the standard non-network boot image.
Booting from Your DOS/Windows Floppy Boot Disk, Deleting Existing Partitions and Editing Master Boot Manager (MBR) Options
Boot from your DOS/Windows Floppy Boot Disk and run the menu driven Ranish Partition Manager.
- Delete the existing partitions.
- Highlight the MBR (Master Boot Record) and:
- Set the MBR Executable to "Boot Manager"
- Boot Interface type to "Compact"
- Check for Viruses "No" (otherwise you may not be allowed to save to the MBR)
- Boot prompt timeout = "6" is nice?
- Default Boot Choice of "Prompt User"
- Save (F2), then out of habit from using DOS, reboot to the floppy again. This may or
may not be optional.
Booting from Your DOS/Windows Floppy Boot Disk and Creating Partitions
Note: There are many possible permutations and combinations but the following
seems to work for me. Despite the literature, setting active partitions and
boot managers can be quite quirky due to limitations/nuances in PC hardware and the
various pieces of software.
Boot from your DOS/Windows Floppy Boot Disk and run the menu driven Ranish Partition Manager.
- (If you want a nice graphical boot manager, select Text 25x80
under the MBR config, then add a "small" "Boot Manager" Partition (4 Meg) as the first Primary partition
using the INS key (which gives a menu list of the possible file systems that can be added)) and
set this as the Bootable Partition . Then, taking into account the above, continue on with the following.
- In the first "Primary" Partition, create a 4 Gig Windows FAT-32 Partition (when promped, save
but DO NOT format as results may not be predictable. We use the Windows format.com program later.)
Set this as your default Boot area using the B key. (Don't be too worried at this point if Ranish is
unhappy about not letting it format the partition and says the DOS/Windows Boot Sector does not have valid information.
Once it is formatted using the format.com program, it should have valid information).
- In the second "Primary" Partition, create a 130 Meg Linux SWAP area
Partition (when promped, save)
- In the third "Primary" Partition, create a 2 Gig Linux Partition (this will be "/") (when promped, save)
- Leave the rest for BSD - though if you wanted a dual boot system, you could use the entire 4 Gig
for Linux.
Formatting the C: Drive - Windows FAT-32
Boot from your DOS/Windows Floppy Boot Disk and run the menu driven Ranish Partition Manager.
- From the floppy disk, type format c: /s and when prompted:
Y - you want to proceed. (/s puts the boot files on the hard-disk)
- Give it a volume name of DOS
- If you want to, you can now install Win95; but I would wait until after getting Linux
happily installed in case some partition nuances (didn't allocate enough space to an
important partition) come to haunt you.
- Take the floppy disk out of the disk drive (to check the boot manager is happy).
- Reboot the PC and you should be given a prompt of HD/1. If you have a Compact boot manager
menu, entering 1 should take you into a command line based Win95/DOS prompt. You
can install more elaborate boot manager menus described in this text (Text
25x80 menu system on startup) if you want to but I was in a "minimalist" mood on this particular occassion.
But now the Text 25x80 menu system is my favourite.
Also Refer:
- reading linux ext2fs partitions with DOS/Windows
Redhat Linux Install
- When prompted for packages to Install, in the list of options I tend to go for the KDE desktop but
it is up to you to choose the desktop of your liking (Gnome or KDE). KDE presently seems slicker
and more oriented towards users.
- Change from old documentation for the following - select the extra Extra Documentation as
it may have information required to tighten up on security.
- When prompted for packages to Install, I tend to go for the defaults except:
- Deselect Gnome and go for KDE
- DOS/Windows Connectivity
- Graphics Manipulation
- Games
- Disable Dialup Workstation
- Development (need this for compilers(?))
- Extra Documentation
- Utilities
- I normally do not load Emacs (I am a "vi" type of person)
- I normally do not load Emacs with X windows (nuff said though
this can be quite user friendly if you don't like the UNIX "vi" editor)
- Important: At the end, go into Select Individual Packages and
select OK, using the space bar, expand Development/Languages
and manually select the compat-egcs options and egcs-g77; otherwise you will
not have a Fortran 77 compiler for compiling up crystallographic programs.
- Then select DONE to continue.
- If you are prompted about Dependencies, go with "Install packages to satisfy dependencies" and
continue.
- The install then does X probe for the graphics card and says it detects the video card, (in this case a
3D Rage Pro AGP 1X/2X, X server: Mach64)
A happy event indeed given getting X-windows to actually work can be a major pain and this is
encouraging. Thus select OK to continue; after which the relevant XFree-86 program will
be downloaded for installation.
- Redhat Install might(?) tell you it will be keeping a log of everything in /tmp/install.log With this
reassurance, continue by selecting OK
- Redhat Install will then create the partitions/filesystems then download the packages.
- Redhat will then say it is preparing to install, then will start downloading the packages
off the Internet. Don't be too concerned if some things seem to stall for a
while or you get a long download time. This can change over time once it
starts getting into the install. In this example, it first stated that
package installation would take around an hour, but this went down to 8 minutes
after the first few packages came across the net at this particular time.
- After downloading, Redhat will then do some post install configuration
- When prompted whether you wish to create a Boot Disk, you would normally say yes, but
I tend not to due to installing and reinstalling operating systems all the time.
- Prompt for Monitor Setup: Be wary that giving the wrong monitor setup can
damage the video monitor so check this
out with the hardware manual. In this case, it is quite easy as the Iiyama Vision Maker Pro17 is
on the Redhat list of known monitors.
Also, if some of the following does go pear shaped, continue on
and after installation, you can run Setup, then call Xconfigurator to try
another Xwindows setup. This information is given below.
- When probing has finished, choose Let Me Choose to pick the video mode/resolution.
In this case, I will be choosing 1280x1024 16bit colour mode.
(In select video mode: you can can select more than one graphics mode and
then use [cntrl] [alt] + to cycle through the available graphics modes.
- Redhat will then run Xwindows to test the configuraiton.
Click OK if you get the screen. (if the screen does go a bit strange, this can be
fixed up later by going into setup as root). When prompted if you
want to start X on booting, I tend to respond No. I like to boot
up in the command line, then type "startx" to start Xwindows.
- At this point, the Installer should be saying something like Congratulations. (If not,
such is life and it implies things are not happy - most likely in the file partitions)
Before selecting OK to continue, take out the
Boot Floopy you created and if you used a commercial CD or generated a CD from an ISO,
remove the CD as well (it could be bottable) otherwise. If you don't do this, on reboot, it will
prompt to re-install the operating system. If you do end
up booting from the Boot Floppy or CD-ROM. into the installer, exit at first available
opportunity. (or press [CNTRL] [ALT] [DELETE] to restart)
- When the PC restarts, you should now be prompted with HD/1 Press 2 (the second
primary partition) to boot up linux. (A minimalist boot manager I have already admitted but
it should get the job done in a reproduceable manner - But installing a more visually
exiting menu implementation of the boot manager is described above)
- (this relates more to Redhat 6.1 - but mentioned just in case)
To check the network is working, try and
ping a local or foreign computer, e.g., "ping www.apple.com. If you get no response
or a host unknown, it would look like Redhat did not correctly setup the network. This can be
fixed in a relatively user-friendly way by running linuxconf from the command line. The
main problem is usually the default domain and DNS server information not be retained correctly.
- As root, run linuxconf from the command line.
- Redhat Linux 6.2 is quite woeful in letting lots of un-necessary services run that could be
a hacker's dream so, we will be runing these off.
- As root, run /usr/sbin/setup and enter System Services. From the menu, disable:
- indentd
- linuxconf (deamon)
- lpd
- nfslock
- portmap
- sendmail
- The above changes in services will be enabled on reboot.
- To not advertise port 6000 while running Xwindows, edit the "/usr/X11R6/bin/startx" file
and under "clientargs" and "serverargs" add -nolisten tcp within the quotes.
- Now might be a good time to reboot to enable all the above changes to the network services .
- Warning: Doing the following - and even just downloading nmap - may be a sackable offense
in many organisations. Check with your network support group first before downloading nmap and any other related
tools.
Providing this is consistent with your network usage policies (check with your network support people),
you can now try running a "scanner/probe" on the new Linux machine once it is connected to
the network. A very good scanner program is nmap (http://www.insecure.org/nmap/).
Nmap (using "nmap -sS -O -vv 127.0.0.1") should say there are no open ports.
Then run Xwindows (using the startx command), nmap should still state that there are no open ports. If
there are open ports, you may have forgot to turn a System Service off when using /usr/sbin/setup.
NMAP gives the following result on the above setup Linux computer:
nmap -sS computername
Starting nmap V. 2.30BETA20 by fyodor@insecure.org ( www.insecure.org/nmap/ )
All 1518 scanned ports on computername (ip_address) are: closed
Nmap run completed -- 1 IP address (1 host up) scanned in 3 seconds
Or trying to detect the operating system.
nmap -sS -O computername
Starting nmap V. 2.30BETA20 by fyodor@insecure.org ( www.insecure.org/nmap/ )
All 1518 scanned ports on computername (ip_address) are: closed
Remote OS guesses: Linux 2.0.27 - 2.0.30, Linux 2.0.32-34, Linux 2.0.35-38, Linu
x 2.1.24 PowerPC, Linux 2.1.76, Linux Kernel 2.1.88, Linux 2.1.91 - 2.1.103, Lin
ux 2.1.122 - 2.2.14, Linux 2.2.12, Linux 2.3.12, NetBSD 1.4 / Generic mac68k (Qu
adra 610)
Nmap run completed -- 1 IP address (1 host up) scanned in 2 seconds
- When running KDE desktop, you can change that the active Window is the one the Mouse is over by
going into Settings, Window Behavoir, Properties
and set "Focus Policy" to Focus Follows Mouse.
- A KDE FAQ on the Window manager is at:
http://www.kde.org/documentation/faq/kdefaq-7.html
- For getting back to programs you have minimised or switched from:
- While the mouse is on the desktop, click the middle mouse button will bring up a list of running applications
that you can select from.
Some other things
- As root, you may like to edit /etc/passwd and make the default shell for users, csh. Bash can
crash System S/Platon but runs fine with csh
- As root, edit /etc/aliases and set the the alias for root to your E-mail so you receive system
messages from root.
Things to do Now that Basic Linux has been Installed
- For some strange reason, Redhat put updates in a separate area and has no transparent way to
check for updates during and after installation. So when installing a version of Redhat fresh
off the internet, you may still be getting the old, buggy programs that may have security flaws. Thus
go to the Redhat website and find out what updates are available and relevant for your installation.
To to the updates directory at the FTP site you are downloading from; grab and install any updates
for programs you are using. These are in the form of RPMs. Thus install via rpm -Uvh filename.rpm.
An automatic/pseudo-transparent way of doing automatic updates or packages and RPMs with Redhat Linux
(and other versions of Linux) is to use autorpm that will do all of this for you once it
has been installed.
Debian Linux does a much better job of this having an automated update system warning that newer programs
are available. (http://www.debian.org using the apt program
- refer: http://www.debian.org/security/).
- The updates may have installed some "open" services you do not know about.
Thus you can now again try running a "scanner/probe" on the new Linux machine once it is connected to
the network such as nmap (http://www.insecure.org/nmap/).
Nmap should say there are no open ports. Then run Xwindows (using the startx command), nmap should
still state that there are no open ports.
- Get and compile the excellent snarf program for being able to quickly get programs via FTP and HTTP via a command line -
http://www.xach.com/snarf/
ftp://ftp.mint.net/pub/snarf/snarf-latest.tar.gz
One of the advantages for UNIX is that it can work on a command line. Useful when you have limited memory or are
remotely logging in. Snarf can be a lifesaver to quickly pull over install files off the internet,
saving you loading up a GUI netscape or bothering with Lynx which can occassionaly be quite finicky for downloading.
- Compile/Install Secure Shell (SSH) for Linux
and disable superfluous inetd.conf based deamons - telnetd, logind, rshd - which should not be running
as inetd was disabled in the installation.
- Add a user or two (yourself for one). As per the above note: if you are adding
users and groups; check if they have to conform to some UID/GID naming scheme consistent over
the entire site.
- The above install makes this superfluous but just in case you did not go this way:
Disable unnecessary deamons in the portmapper, inetd.conf
(pretty much everything you don't need; ftpd, telnetd, fingerd, etc)
This means edit the /etc/inetd.conf file and remove everything you don't like the
look of. If you have installed SecureShell, you can pretty much REM out everything.
Then type killall -HUP inetd to restart inetd deamon.
- Refer to the TinityOS documentation which is quite excellent on how to
secure up and administer Linux - http://www.ecst.csuchico.edu/~dranch/LINUX/TrinityOS.wri
- For limiting hacking on your system, by default, Redhat Linux comes with TCPWrappers enabled (tcpd) - which
can protect defined services or a global ALL for programs run from within inetd.
Again, superfluous if you followed the above in disabling inetd but you may have ignored this advice.
Do a man tpcd which sort of describes what this is about and gives some examples.
If you only want people from your domain to be able to access services, following are examples of
/etc/hosts.allow and /etc/hosts.deny that you can modify. You can create a banner depending on whether
the user is authorized or not to use this service from the particular domain they are logging in from.
- /etc/hosts.deny
ALL: ALL : banners /usr/etc/tcpwrap/banner1
- /etc/hosts.deny
ALL: LOCAL, 127.0.0.1 : banners /usr/etc/tcpwrap/banner2
ALL: .dl.ac.uk, .ccp14.ac.uk : banners /usr/etc/tcpwrap/banner2
- Where the /usr/etc/tcpwrap/banner1 directory has files depending on the service you wish to
give a message about - ftpd nul rlogind telnetd
e.g, for telnetd:
*********************************************************
* UNAUTHORIZED ACCESS TO THIS MACHINE IS PROHIBITED *
(and very naughty) *
*********************************************************
- Where the /usr/etc/tcpwrap/banner2 directory has files depending on the service you wish to
give a message about - ftpd nul rlogind telnetd
e.g., for telnetd: Hello, Hello %u@%h.
- Unlike the standard UNIX portmapper, the Redhat linux portmapper is protected by TCP Wrappers as described above.
This is important if you are running NFS and allowing some systems to nfs mount your directory areas; and
limit probes on your system.
- Check around some Securing Linux sites for extra info on keeping your system "unhacked":
- Fill up hard-disk with stuff (StarOffice office/word processing suite, etc)