Monday, March 22, 2010

Using Ketarin to Automatically Update Software Packages

Program Overview
After using Debian, it quickly becomes frustrating switching to Windows... especially when you want to easily and quickly check and update all of your software packages.  There are several programs that allow some similar functionality, such as AppSnap and AppUpdater, but I find that Ketarin has the most features and offers the most flexibility and customization.
When you first launch Ketarin, you will not have any applications in your window, and as a first step we will quickly add an application from an online database.
Adding Applications - the Easy Way
Click on the arrow for "Add new application" and from the drop down menu select "Import from online database".  Next you just need to search for the application you need, select it and hit "Import".  The application will automatically be added to your list.
Next, we need to configure the application so that it automatically downloads to the correct directory.  To do this, we need to understand Ketarin variables.  Below is a list of common variables from the Ketarin Howto, found here.

NameContentExample
{file}Location of the downloaded file (only for commands)
Remember to enclose this variable in double quotes (”) if the path contains spaces.
c:\…\x.exe
{filesize}Size of the downloaded file in bytes1482245
{root}Root of the application startup pathc:\
{category}Category of the applicationSecurity
{appname}Name of the applicationKetarin
{appguid}GUID of the application{AC1DB…}
{url:ext}Extension of the file that is being downloadedexe
{url:basefile}Base file name of the file that is being downloadedKetarin-0.9

Now, we can use the variables to create a download path and name for our application, so we can copy and paste the line into every single application we download.  Let us take a look at a sample application shown below.
We can see the application we are downloading is the ffdshow codec, and that we are downloading it into the Media category.  Using the variables we can see that we are downloading the file to C:\Apps\Media\ffdshowx64.exe.  
Adding Applications From FileHippo
You will notice that there is an option for "FileHippo ID".  This is another excellent option for downloading programs.  Just search for a program on filehippo, and use the last part of the URL (after download) as the ID.  For example, for Trillian Astra, the FileHippo URL is http://filehippo.com/download_trillian_astra/. The FileHippo ID would be "trillian_astra".  These two options are the easy options for step one for obtaining the most updated program files from the internet.
Installing Applications Automatically
The second step can be found in the "Commands" section.  There is an option for Ketarin to run commands before or after downloading the application.  In this instance, since we want to install the application after it is downloaded, we need to get the application to install silently after download.  This is actually the tricky part.  It can be a challenge to discover what switches are needed to make sure the application installs silently.  Unfortunately, some applications do not even offer the option of installing silently, and those will have to be installed manually.

Above is show the command we are executing after ffdshowx64 to get it to install correctly.  Using the Ketarin variable {file}, we do not have to enter the entire path manually, which is a very nice feature.  Some of the common silent install switches are: /s /S /q (/q is for msi files mostly) /SILENT /VERYSILENT /quiet.
You can also run the installer with the /? switch, and sometimes it will tell you the silent install option.  If all else fails, Google it.
 Installing Applications - the Hard Way
Unfortunately, you will run into applications that require a little bit more work to download easily.  While filehippo has a good amount of files, it will certainly not have all of the files you may need.  This is where things get tricky.   You will need to specify where to download the file, and (even more difficult) tell the program how to determine what the filename will be.  Lets take a look at an example, namely Virtualdub x64.  Virtualdub is available for download from Sourceforge, which is a tricky site to use.  First, we need to determine what the latest version of Virtualdub is.  To do so, the author's website becomes quite helpful.
http://virtualdub.org.  The current version is easily noticed.  Now we need to tell Ketarin to use that number to dynamically update the version number.
To do this, we need load the page in and select a variable, but before we can do that we need to specify a download location, which is where we use our sourceforge link:
http://prdownloads.sourceforge.net/virtualdub/VirtualDub-{version}-AMD64.zip?download
This is what the regular download page looks like on sourceforge:

However, you will notice the download link is different, the download URL is different from the page download process, so our download URL becomes: http://prdownloads.sourceforge.net/virtualdub/VirtualDub-{version}-AMD64.zip?download
Now, of course we need to specify a value for the {version} variable.  For that we click on the variable button, which loads the following screen:
First, click on the plus button to add a variable, and name it version.  Then add http://www.virtualdub.org to the "Contents from URL:" field, and hit load.  Next search for your version number inside of the page.  You should easily find it.  Next, select the part of the line before it.. how much you select is up to you, and select "Use selection as start".  Do the same for the part of the line after the version number.  I assume Ketarin uses the start and end selections to make sure it has the correct version number, so choose carefully.  If you program has a particularly tricky version number, you can specify multiple variables. 
There!  You added one program using the advanced method.  Many of these programs will present a new challenge as they will all be different, but using these tools, you should be able to figure out how to extract the necessary information.

Now, to update all of your applications, all that is needed is to select "Check for updates and download" from the Ketarin Menu,

and all of your applications should automatically download, and install themselves in the background, without ever bothering you.
As well, if you are really a fanatic you can schedule a task to run with the following command:
 C:\Apps\Ketarin\Ketarin.exe /silent /notify /log=C:\Users\Administrator\Desktop\SoftwareUpdates.log
This will cause Ketarin to run silently in the background updating, so you never even have to think about it.

The one drawback to Ketarin is that sometimes when you silently install applications, they can fail for whatever reason, and you will not be notified, and if the program continuously fails, you will NEVER know that your application is out of date.
Ketarin is a powerful program, and a program that saves you a large amount of time downloading and installing your applications.  I suggest you use it.


Monday, March 8, 2010

Tutorial on how to Setup an Openvpn Server on Debian, with a Windows Client

Installation

First, we need to quickly install openvpn on our debian server.
aptitude install openvpn
 Next we need to locate our easy-rsa folder, on debian it is located at /usr/share/doc/openvpn/examples/easy-rsa
If you are having trouble finding it, try the following:
updatedb
locate easy-rsa
Once we find the folder, we need to copy it to /etc/openvpn:
cp -R /usr/share/doc/openvpn/examples/easy-rsa /etc/openvpn
cd /etc/openvpn/easy-rsa/2.0

Editing the vars (variables) file

Now we need to edit some variables, to make things easier for us.
sudo nano vars
Once you open up the file vars, you should see the something like the following at the bottom:

 Change those values to reflect your values.
Now we need to build the certificate authority, so in the /etc/openvpn/easy-rsa/2.0 directory run the following commands:
. ./vars
(dot space ./vars)
./clean-all  ./build-ca
This should build the certificate authority (CA) certificate
 Many of the values should be autopopulated since we filled out the information. The one value you may need to fill is the Common Name. Enter the name of your server for the value.

Building the Server and Client Keys

Next we need to generate the server key:
build-key-server server

Next, we need to setup some keys for the clients, so that they can connect to the server. You have two choices for setting up clients. You can require the clients to enter a password to connect, or just generate the key files needed to connect. In this example we will be generating the files without password. If you wish to use a password, replace ./build-key with ./build-key-pass.
./build-key client1
 Again, it will ask you for a client name, enter the name of the client. When it asks for a challenge password just leave it black and press enter.

Next we need to generate Diffie Hellman paramaters.
./build-dh
This command may take a while to complete. Once the command completes, you should be able to navigate to /etc/openvpn/easy-rsa/keys/ and the files you generated should be located within.

Placing the Server Keys and Creating Server Config

Next, we need to copy the keys that are needed for the OpenVPN server into the correct folder:
cp ca.crt ca.key dh1024.pem server.crt server.key /etc/openvpn

 Obviously, whatever the name will reflect whatever you entered originally. Next, navigate to /etc/openvpn, to edit the configuration file.
sudo nano openvpn.conf
This is an example configuration, very basic, change the names of the .crt and .key files to the ones you made, and you should be all set. As well, I added the client-to-client line because I want my clients to be able to talk to eachother.
NOTE:  You may want to change the "server" line from 172.17.0.0 to something that won't possibly cause routing issues depending on your (and remote) network setups.  This won't happen in every use case, but it can come into play.  Something like "172.17.2.0" may work.

Next, lets start OpenVPN:
/etc/init.d/openvpn start
You can ping yourself as a quick test to see if you are up and running.

$ ping 172.17.0.1
 PING 172.17.0.1 (172.17.0.1) 56(84) bytes of data.
 64 bytes from 172.17.0.1: icmp_seq=1 ttl=64 time=0.041 ms 64 bytes from 172.17.0.1: icmp_seq=2 ttl=64 time=0.030 ms

Client Configuration

Next, we need to configure the clients.  In this example, I am using two windows clients to connect to the server.
I like the gui for OpenVpn, available here: http://openvpn.se.  (See below for Windows 7 fix). Once you install it, navigate to  C:\Program Files\OpenVPN\config.  Now, you need to copy the following files to our config folder from our server:
client.crt
client.key
ca.crt

Next, we need to create a client configuration file to use.  For windows, the client configurations all end with .ovpn.  So lets create a file called config.ovpn, and use the following:

You will need to change the name of your .key and .crt files, and your remote IP address as well.  Obviously, if you are connecting remotely, you can enter a domain name as well.

Once you connect, you should now be able to easily ping the Openvpn server.  If not you may need to check your firewall to make sure everything is working.  Don't forget to port forward the correct port to your OpenVPN server, or you will not be able to access your server from outside of your network.

If you need clients to be able to talk to eachother, you may need to execute the following command on your linux box.
echo 1 > /proc/sys/net/ipv4/ip_forward

Windows Client Options

Currently, setup on Windows 7 requires a little bit more setup than other versions of windows.  First, download the latest release client, from http://openvpn.net/release/, and run the program in compatibility mode for Windows Vista Service Pack 1, and run as administrator.  This will give the program the permissions it needs.

Another option is securepoint client at http://sourceforge.net/projects/securepoint/.  I have run it successfully on Windows 7 without any issues.

If you encounter problems, remember to turn off any firewalls that may be in the way.

Connecting to Internal Resources

This is a rather important point, that should have been here from the beginning (my bad).  This setup allows you to connect to the internal device that you have openvpn setup on.  Look at the picture below:


If your OpenVPN client needs to connect to your other server or desktop on your LAN, it has no way to do so!  If you attempt to ping 192.168.1.105 from your remote OpenVPN client, you will not get a response, or if you do, it will be the local network, not the remote network.  This requires further setup.  

Server Setup for Internal Access

You will need to push a route to your client.  To do so add the following line to your server conf file:
push "route 192.168.1.0 255.255.255.0"
Now when the OpenVPN client connects, it will know that to access the 192.168.1.0 network it needs to forward the traffic through the VPN connection.

Router Setup for Internal Access

However, when you attempt to ping 192.168.1.105, you will still not be able to ping (or RDP, or w/e protocol you want to test if ping is disabled).  This is because the router (192.168.1.1) still does not know the route back to the 172.17.0.0 network.  In dd-wrt it is simple to add the network route.


Now when you attempt to connect to an internal resource it should work correctly.

Logging

If you experience problems and need to troubleshoot the server, openvpn logging is pushed to syslog, but if you want the log file separate, you can add the following line to your server conf file:  "log openvpn.log" or "log-append openvpn.log".  This will output the OpenVPN log separately instead of adding it to syslog.

Web Management of OpenVPN

I need programmers :D.  I am attempting to create a web interface to simplify OpenVPN installation and management at github:  https://github.com/deranjer/OpenVPN-PHP-Management-Gui.  I am really busy with school and work so only have it working in beta (not to be run on production servers).  But if you know PHP at all (I am barely able to code in PHP so this won't be too complex) I would love to have help on this. 

Conclusion

I will try and keep this blog post updated and post answers or solutions to common issues with OpenVPN configuration and management.