I am not using network-manager in the following examples. And honestly network-manager only makes life easier on a laptop, or desktop when operating wirelessly.

Make sure your network interface is set to dhcp, as network-manager is installed by default the relevant line may be commented out (also if your not using it, purge network-manager from your system). The relevant entries from my /etc/network/interfaces:


# The primary network interface
auto eth0
iface eth0 inet dhcp


Add an script in /etc/dhcp3/dhclient-exit-hooks.d. It should check if GDM is running, as after it has started up you should not change the hostname. My script read as follows:
/etc/dhcp3/dhclient-exit-hooks.d/set_hostname

# If you want to enable this script, change SETHOSTNAME to "yes"

SETHOSTNAME="yes"

if [ "$SETHOSTNAME" = "yes" ]; then
	if test -r /var/run/gdm.pid && ps -ef | grep $(cat /var/run/gdm.pid) | g
rep -q /usr/sbin/gdm ; then
	echo "$(date): GDM running, not changing host name"
	else
		hostname $new_host_name;
	fi
fi

That should be it. Though you may need to remove some incorrect entries from /etc/hosts, and remove /etc/hostname if the file contents are wrong.

Setup IP Forwarding/Masquerading/Firewall

To turn on IP Forwarding:
# echo 1 > /proc/sys/net/ipv4/ip_forward

Set the change permanantly in /etc/sysctl.conf by uncommenting the line:
net.ipv4.ip_forward=1

To turn on IP Masquerading add the following IP Tables rule:

# iptables --table nat --append POSTROUTING \
--out-interface eth0 --jump MASQUERADE

Firewall
If you are running a firewall, and I strongly recommend you do on a public facing box you need to allow UDP on port 1194 into you box.
# iptables -A INPUT -udp -m udp --dport 1194 -j ACCEPT

But these rules need be persistant so we need to create a script to run when the interface starts up

# iptables-save > /etc/iptables.conf

Create a new file: /etc/network/if-up.d/iptables and paste in the following:

#!/bin/sh
/sbin/iptables-restore < /etc/iptables.conf

Set it to executable:
# chmod 755 /etc/network/if-up.d/iptables

Now when networking starts the firewall is brought up. If all you have done is what is above, your box is not really firewalled, as no traffic is dropped or blocked. For a basic firewall the following config, forwards everything, allows bind internally and only allows SSH and OpenVPN on the external interface.

/etc/iptables.conf (example):

#
*nat
:PREROUTING ACCEPT [36:18250]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [12:806]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
#
*filter
:INPUT ACCEPT [19:1037]
:FORWARD ACCEPT [420:191307]
:OUTPUT ACCEPT [314:39042]
# Allow everything on loopback
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
# Allow already established connections
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# Allow SSH
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
# Allow DNS to this machine fron the private network
# (If you plan to run you own DNS, I run dns_masq)
-A INPUT -p tcp --dport 53 -s 10.8.0.0/16 -j ACCEPT
# Allow OpenVPN
-A INPUT -p udp -m udp --dport 1194 -j ACCEPT
# DROP the rest
-A INPUT -i eth0 -j DROP
COMMIT
#

Setup Open VPN

Installation

Install OpenVPN:

# aptitude install openvpn openssl


Edit /etc/default/openvpn. Comment all lines, and add:

AUTOSTART="openvpn"

Create Certificates and Keys

On you server as root:

# cd /etc/openvpn

Copy the the following directory

# cp -r /usr/share/doc/openvpn/examples/easy-rsa .
# cd easy-rsa/2.0/

Edit the file “vars”. Change the default values at the bottom of the file to match your details.

Import you ssl settings:
# . ./vars

run: # ./cleann-all. Do not run this every time as it will remove all existing certificates.

Create your Certificate Authority

# ./build-ca

Give it a sensible common-name, something like: “OpenVPN CA”

Now build the key and certificate for you server

# ./build-key-server server

Set the common name to “server”

Answer yes to signing the certificate and commiting it.

Now let’s create Diffie Hellman parameters:

# ./build-dh

Most other guides now get you to generate client certs, but we are using  username and password authentication so we do not need to do this.

Configure OpenVPN

Edit the file /etc/openvpn/openvpn.conf and add the following (the comments are unnecessary they are just there for explanation):

    dev tun
    ## udp is recommended, avoid TCP over TCP
    proto udp
    ## any port will do, this is the standard
    port 1194 

    ## certs we created earlier
    ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
    cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
    key /etc/openvpn/easy-rsa/2.0/keys/server.key
    dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem

    user nobody
    group nogroup
    ## You can make this any private subnet you like
    server 10.8.0.0 255.255.255.0

    persist-key
    persist-tun

    #status openvpn-status.log
    #verb 3
    client-to-client

    ## make this connection the default gateway for network traffic
    push "redirect-gateway def1"
    ## I am running dns_masq, you may want to put your server's DNS here
    ## or even google: 8.8.8.8
    push "dhcp-option DNS 10.8.0.1"

    log-append /var/log/openvpn

    ## User authentication settings. Usernames must be able to authenticate with PAM
    ## To use radius or another auth mechanism create /etc/pam.d/openvpn
    ## by default it is doing common-auth (a user must have a local accout and pasword)
    plugin /usr/lib/openvpn/openvpn-auth-pam.so login
    client-cert-not-required
    username-as-common-name

    ## A management interface allows you to telnet from local host to use
    ## telnet localhost 7505
    management localhost 7505

Restart OpenVPN: # /etc/init.d/openvpn restart

So this is the server done. We haven’t configured anything to connect to it yet.
Client how-to comming up next time.

Update. Client how-to is available

For an easy to install Ubuntu package use this PPA, from pmcenery.

For whatever reason, nothing has been done other than having the big confirmed.

If you depend on the tsclient applet, as I do, grab the package from debian and install it.

Grab the package for you architecture from here.

And simply install it with dpkg:

$ sudo dpkg -i tsclient_0.150-3_i386.deb

The only difference between this release and the one previous is the removal of this bug, which is a fairly serious bug. Including this in the karmic repo would be trivial, and it should have been done before the 9.10 went final.

Supposedy blueman can do this very easily (www.blueman-project.org). To install blueman just run:
$ sudo aptitude install blueman.

My experience with blueman has been very hit and miss however, the connection appears to be made via bluetooth but I can rarely seem to get NetworkManager to make a network connection. Sometimes I have success pairing the devices again.

Using the older pand binary I have had a lot more success. If you are not scared of the terminal, it isn’t difficult and appears far more reliable

Install the older bluez tools:

$ sudo aptitude install bluez-compat

$ hcitool scan

Find the address of your phone from the list

$ sudo pand --connect 00:25:00:96:13:BB -n

This command will pair you phone to your computer and create a pan device. Of course replacing the MAC address with the address of your phone. This command will re-pair you devices each time it is run. If, like me you have an iPhone, you need to have you iPhone in the Bluetooth System Preference app to accept the pairing.

$ sudo dhclient bnep0

You are now tethered.

To kill the tether:

$ sudo pand -K

To enable it:
$ sudo apt-get install pulseaudio padevchooser pulseaudio-module-raop pulseaudio-module-zeroconf

Then run System -> Preferences -> Pulse Audio Preference. Tick “Make discovereable Apple AirTunes devices available locally”.

Run RhythmBox, or any app which uses pulse-audio as its backend, and play some audio.

Run Applications -> Sound & Video -> PulseAudio Volume control.

Select Airport Express as the output for this app.

But unlike Fedora, there is no preferences tool to change the background and gtk theme that GDM is going to use. So there appears no easy way of customizing the login screen without editing gconf, but there is a fairly simple way of doing this.

If you want to play with the look of GDM in Karmic, open a terminal and run this:

$ gksudo -u gdm dbus-launch gnome-appearance-properties

Changing the gnome appearance properties for user gdm, changes them at login.

Epiphany is still the Gnome web browser, though I think Debian is the only major distro to make it the default. I like Epiphany, it’s smart bookmarks are tremendous, but the gecko backend is pretty crumby and the cause of a few major unresolved bugs. With Gnome 2.28 webkit has become the standard backend for epiphany making it a very cool option.

If you want some webkit goodness your current Ubuntu 9.04 (Jaunty) release, it is pretty simple.

Edit the file “/etc/apt/sources.list” (use sudo to gain priveleges)

Add following lines:

deb http://ppa.launchpad.net/webkit-team/epiphany/ubuntu jaunty main
deb http://ppa.launchpad.net/webkit-team/ppa/ubuntu jaunty main


Import the correct GPG key:
$ sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 2D9A3C5B


Update the source list and install epiphany
$ sudo apt-get update
$ sudo apt-get install epiphany-webkit