Ubuntu setup guide

Install updates

Clean the apt cache (this needs to be done only once after installation):

rm -rf /var/lib/apt/lists

Then update:

apt-get update
apt-get dist-upgrade

Reboot:

reboot

Setup the console

The shell zsh is more user friendly than bash. Install it and set it as default shell for root and the user bob:

apt-get install zsh
chsh -s $(which zsh) root
chsh -s $(which zsh) bob

The zsh configuration file that you can find here offers some nice features, such as smarter command completion, colored prompt, git prompt, large command history and environment variables. Save it to /root/.zshrc and /home/bob/.zshrc:

cd
wget http://wiki.epfl.ch/git-epfl/documents/files/.zshrc
su bob
cd
wget http://wiki.epfl.ch/git-epfl/documents/files/.zshrc

The fonts used by Ubuntu in the terminal look ugly. It is possible to replace them with the more common VGA fonts:

dpkg-reconfigure console-setup
update-initramfs -u -k all
setupcon

Result: screenshot.

Midnight commander

Midnight commander or mc is a console-based file manager and editor:

apt-get install mc

Essential file manager (mc) shortcuts:

• View file: F3
• Edit file: F4
• Toggle terminal: Ctrl+O
• Select file: Ins
• Copy file: F5
• Move file: F6
• Delete file: F8
• Search: Alt+Shift+?
• Exit: F10 or exit

Essential text editor (mcedit) shortcuts:

• Save: F2
• Toggle selection mode: F3
• Copy selection to cursor: F5
• Move selection to cursor: F6
• Delete selection: F8
• Exit: Esc Esc

The FbTerm console

The default linux terminal is very limited in terms of colors and font sizes available. Another option is installing fbterm:

apt-get install fbterm

To enter fbterm, simply run:

fbterm

The Liberation fonts look better in fbterm, and mc also looks better with the darkfar color scheme:

apt-get install fonts-liberation
sed 's/skin=default/skin=darkfar/' -i ~/.config/mc/ini
sed 's/editor_visible_tabs=1/editor_visible_tabs=0/' -i ~/.config/mc/ini
sed 's/editor_visible_spaces=1/editor_visible_spaces=0/' -i ~/.config/mc/ini
sed 's/font-names=mono/font-names=Liberation Sans/' -i ~/.fbtermrc
sed 's/font-size=12/font-size=13/' -i ~/.fbtermrc

Finally, to make the fbterm font color lighter, run once inside fbterm:

echo -en "\e]P7dedede"

Result: screenshot 1 and screenshot 2.

Basic firewall configuration

Create the executable script /etc/iptables-setup.sh:

touch /etc/iptables-setup.sh
chmod 700 /etc/iptables-setup.sh

Write the following contents into /etc/iptables-setup.sh:

#!/bin/bash

# Ignore pings sent to broadcast/multi-cast addresses.
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Drop source routed packets
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route
# Enable TCP SYN cookies
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
# Ignore ICMP redirect packets
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
# Do not send ICMP redirects
echo 0 >/proc/sys/net/ipv4/conf/all/send_redirects
# Enable source spoofing protection
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter

# Delete all the rules and chains from the filter, nat, mangle and raw tables:
iptables -t filter -F
iptables -t filter -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -t raw -F
iptables -t raw -X

# By default, drop all input traffic and allow output traffic:
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow traffic originating from the loopback interface
iptables -A INPUT -i lo -j ACCEPT

# Allow traffic which is a reply to something we sent (allow web browsing etc):
iptables -A INPUT -m conntrack --ctstate related,established -j ACCEPT

Execute the script manually:

/etc/iptables-setup.sh

Check that the iptables rules correspond:

iptables -L -n -v

Add the script to be executed before each interface is activated by editing /etc/network/interfaces and adding the pre-up line for each interface:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp
    pre-up /etc/iptables-setup.sh

Opening ports through the firewall

To allow some incoming traffic to your machine, edit /etc/iptables-setup.sh and add at the end extra INPUT rules like this:

# Examples for opening ports:

# Allow incoming traffic from everywhere to TCP port 80 (web server):
iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# Allow incoming traffic on interface eth0 to TCP port 80 (web server):
iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT

# Allow incoming traffic from the IP range 1.2.3.0/24 to TCP port 80 (web server):
iptables -A INPUT -s 1.2.3.0/24 -p tcp --dport 80 -j ACCEPT

# Allow incoming ping traffic (ICMP with type 8):
iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT

Wireless

Install prerequisites:

apt-get install wpasupplicant

Let's say that you want to connect to an access point with name "Home" and password "complicated". First, you need to convert the password into a key:

wpa_passphrase 'Home' 'complicated'

The output looks like this:

network={
    ssid="Home"
    #psk="complicated"
    psk=df50a29570ab5c02ad2f482154f1a7113acc0d18169c07710eb351acb1076836
}

The key is printed after psk=, which is in our example df50a29570ab5c02ad2f482154f1a7113acc0d18169c07710eb351acb1076836.

Then we must add an entry for the wireless interface (which is usually named wlan0, it is possible to find out the name by running the command iwconfig) in /etc/network/interfaces:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp
    pre-up /etc/iptables-setup.sh

auto wlan0
iface wlan0 inet dhcp
    pre-up /etc/iptables-setup.sh
    wpa-ssid Home
    wpa-psk df50a29570ab5c02ad2f482154f1a7113acc0d18169c07710eb351acb1076836

Finally, activate the interface manually with:

ifup wlan0

Disable IPv6

If you do not have an IPv6 connection from your ISP, it is safer to disable it. Edit /etc/default/grub and find the line:

GRUB_CMDLINE_LINUX_DEFAULT=""

GRUB_CMDLINE_LINUX_DEFAULT="ipv6.disable=1"

update-grub

Use custom DNS servers

Let's say that we want to use Google's nameserver 8.8.8.8 instead of the one offered by DHCP. We must add the dns-nameservers option for each interface in /etc/network/interfaces:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp
    pre-up /etc/iptables-setup.sh
    dns-nameservers 8.8.8.8

auto wlan0
iface wlan0 inet dhcp
    pre-up /etc/iptables-setup.sh
    wpa-ssid Home
    wpa-psk df50a29570ab5c02ad2f482154f1a7113acc0d18169c07710eb351acb1076836
    dns-nameservers 8.8.8.8

It is also possible and even recommended to configure the DHCP client to accept less options when connecting. Edit /etc/dhcp/dhclient.conf and find the lines prepend domain-name-servers and request. Modify their content so that it looks like this:

prepend domain-name-servers 8.8.8.8;
request subnet-mask,
        broadcast-address,
        routers,
        interface-mtu,
        rfc3442-classless-static-routes;

update-grub

Enable routing

To enable routing until the next reboot, run:

echo 1 > /proc/sys/net/ipv4/ip_forward

To enable routing permanently, also add or uncomment in /etc/sysctl.conf:

net.ipv4.ip_forward=1

Setup NAT

To enable NAT, we need to edit the firewall settings from /etc/iptables-setup.sh. Let's assume that the network interface connected to the Internet (WAN) is eth0 and the network interface facing the local network (LAN) is wan0. The necessary firewall settings are:

# eth0 is WAN
# wlan0 is LAN

# Change the MTU of TCP SYN packets to 1400 for PPPoE or VPN
# 1500 - 20 reserved for encapsulation = 1480
# 1480 - 20 length of IP header without options = 1460 for transport
# 1460 - 60 maximum TCP header length = 1400
iptables -A OUTPUT  -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1400
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1400

# Allow all traffic coming from LAN to be routed
iptables -A FORWARD -i wlan0 -j ACCEPT

# Allow all traffic coming from WAN which is a reply to our traffic to be routed
iptables -A FORWARD -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Apply network address translation (NAT) to all traffic routed to WAN
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Apply the new rules:

/etc/iptables-setup.sh

Set a static IP address on the LAN interface

We need to configure the network interface facing the local network (LAN), which is wan0. It must have an IP address from one of the private IP ranges (10.0.0.0/8, 192.168.0.0/16 or 172.16.0.0/12). In this example we will use 192.168.100.1/24, which corresponds to the netmask 255.255.255.0. This is done by editing /etc/network/interfaces and assigning to wlan0 a static IP address:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp
    pre-up /etc/iptables-setup.sh

auto wlan0
iface wlan0 inet static
    pre-up /etc/iptables-setup.sh
    address 192.168.100.1
    netmask 255.255.255.0
    # Use a smaller MTU for VPN or PPPoE
    mtu 1480

Activate the LAN interface:

ifup wlan0

Run a DHCP server for the LAN

We install a DHCP server:

apt-get install isc-dhcp-server

We edit the configuration in /etc/dhcp/dhcpd.conf, making sure we set options compatible to the settings for the LAN interface given above:

default-lease-time 600;
max-lease-time 7200;

option subnet-mask 255.255.255.0;
option broadcast-address 192.168.100.255;

# This is the IP address of our LAN interface
option routers 192.168.100.1;

option domain-name-servers 8.8.8.8;

# If we do not have a domain name, we just leave it like this
option domain-name "example.com";

# This is the pool of addresses which will be offered to the clients:
subnet 192.168.100.0 netmask 255.255.255.0 {
    range 192.168.100.100 192.168.100.200;
    # Use a smaller MTU for VPN or PPPoE
    option interface-mtu 1480;
}

We also need to add a firewall rule in /etc/iptables-setup.sh to allow incoming DHCP traffic from LAN, and also to allow ping (it is useful):

iptables -I INPUT -i wlan0 -p udp --dport 67:68 --sport 67:68 -j ACCEPT
iptables -I INPUT -i wlan0 -p icmp --icmp-type 8 -j ACCEPT

Finally, we need to start the DHCP server:

service isc-dhcp-server restart

Use the wireless interface as an Access Point

For a wired LAN interface, the steps above are sufficient. However, for a wireless LAN interface we need to install and configure a software wireless access point:

apt-get install hostapd
touch /etc/hostapd/hostapd.conf
chmod 600 /etc/hostapd/hostapd.conf

We use 802.11g protected with WPA2 Personal running on channel 7. The network name is "Home" and the password is "complicated". For security, it is important that wpa is set to 2 (WPA2) and that the pairwise algorithms use only CCMP (AES) and not TKIP (insecure). Also, the password must be much more complex than in this example!

We fill in the file /etc/hostapd/hostapd.conf:

interface=wlan0
driver=nl80211
country_code=US
ssid=Home
hw_mode=g
channel=7
wpa=2
wpa_passphrase=complicated
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP
rsn_pairwise=CCMP
auth_algs=1
macaddr_acl=0

We must also edit the file /etc/default/hostapd:

DAEMON_CONF="/etc/hostapd/hostapd.conf"
RUN_DAEMON=yes
DAEMON_OPTS="-dd"

Finally, we start hostapd:

service hostapd restart

Reduce latency over the LAN interface

This is especially useful for wireless. Add to /etc/iptables-setup.sh:

# Disable hardware checksumming, fragmentation etc.
# These increase latency on routers because they cause the packets to be processed in bursts.
for i in wlan0
do
    for f in rx tx sg tso ufo gso gro lro rxvlan txvlan ntuple rxhash
    do
        ethtool --offload $i $f off 1>/dev/null 2>/dev/null || true
    done
done

# Set low latency options
# Reduce the length of the wlan0 buffer from 1000 to 200 (lower might work well too, BSD uses only 50!)
ifconfig wlan0 txqueuelen 100

# Instead of FIFO buffers, use randomized fair queuing (i.e. behaves as if there are different buffers for different
# flows)
tc qdisc add dev wlan0 root sfq perturb 10 1>/dev/null 2>/dev/null || true
tc qdisc add dev eth0 root sfq perturb 10 1>/dev/null 2>/dev/null || true

Apply the new rules:

/etc/iptables-setup.sh

Accessing the virtual machine through the network

Configure the virtual machine to use NAT. Then, in the main VirtualBox window, go to File -> Preferences -> Network -> Host-only networks, add a new host-only network, click on Configure and make sure the DHCP server is enabled.

Turn off the virtual machine, then go to Settings -> Network -> Adapter 2 and select a host-only adapter attached to the host-only network we have just created. Save and reboot the virtual machine.

In the virtual machine, a new network interface appears. Configure it with DHCP, then find its IP address. The virtual machine is now accessible from the host using this IP address.