Debian provides this amazingly beautiful tool called debootstrap that makes the work seem like a piece of cake.

#apt-get install debootstrap

#mkdir -p /var/chroot/sarge

#debootstrap sarge /var/chroot/sarge http://archive.debian.org/debian-archive/debian/

This will install a minimal version of sarge in the /var/chroot/sarge directory. You only need to chroot to this directory to do your work.

#apt-get install chroot

You may also install dchroot (I prefer dchroot)

#apt-get install dchroot

Now we need to change the /etc/fstab file a bit. Append the following lined to the /etc/fstab file.

/home /var/chroot/sarge/home    none    bind    0    0
/tmp /var/chroot/sarge/tmp    none    bind    0    0
/dev /var/chroot/sarge/dev    none    bind    0    0
/proc /var/chroot/sarge/proc    none    bind    0    0

The home directory is required if you wish to follow the last part of this post.

#mount -a

#chroot /var/chroot/sarge

# cat /etc/debian_version
3.1

If this is what you get than you are done.

If you wish to make your user settings work in the chroot environment then you have to work a little extra.

First come out of the chroot environment.

Open the /etc/passwd file and copy the line that has your user-name to the /etc/passwd file of the chroot installation.

Also make similar changes to the two /etc/group file. Make sure that the changes are consistent. Add yourself to any group you feel required.

[ N.B.: For chroot installation of any release the steps are similar. Also the steps are similar for chroot installation of Debian in any Linux distribution that has the debootstrap package. I think Fedora, Gentoo and Ubuntu has the package.]

Now if you want to try out somethin extra…try this. Open urxvt or any GUI-terminal.

#chroot /var/chroot/sarge

#apt-get install totem

Try to play a Video file whose codec is by-default supported by Totem (like an MPEG file). See what happens.  Try installing and runing something like gedit too.

This cant be done the usual way i.e. view the computers in the WORKGROUP and then find the folders shared by them. This is a bit more complicated than that. For this you have to know the IP-address of the host whose shared stuff you want to access.

1. Goto Start -> My Network Places.
2. In Network Tasks goto Add a Network Place.
3. Keep clicking Next until you get this windowHere choose Choose another network location and click Next.
4. In the Internet or network address part write the shared folder address like :
   \\192.168.1.8\SharedFolder1

   as shown in this figureClick Next, give a name for the folder and that’s it.

I think that ought to do the trick.

If you have read my previous post, you will know what I had to go through, just to implement a few seurity measures. I had effectively seperated every user into a different Subnet. Now it so happens that a few (pathetic) friends of mine still use (things as useless, pathitic, outdated and primitive as) Windows. They within a few days complained that they could not access the shared files of other (Windows) users on the network. After some tinkering about I found that this was because if file-sharing is turned on in windows it is normally done in something called WORKGROUPS. This (using the windows firewall) restricts the files shared to only the subnet to which the computer belongs.

There are two possible solutions to this problem :

1. If you have a problem with a leg just amputate it i.e. turn off the Windows firewall (it generally does not do anything useful). But somehow this is not an optimal solution (what if there is a problem with the head… ).
2. So here’s a better solution.
   • Goto Control Panel -> Windows Firewall.
   • Uncheck the Don’t Allow Exceptions checkbox.
   • Goto the Exceptions tab, find File and Printer Sharing in the Program and Services list. This should be checked. Click on Edit. Select each of those services and click Change Scope. You get something like this.Check the Radio button for Custom List. Here you may specify the IP addresses of the hosts you want to make your file available to mention an address and subnet mask as you may deem required.…Well its just clicking OKs after that. I think you can manage that.

This was just the sharing part.There is something left that I will give in the next post.

First I replaced the firmware in the router (i.e. the one provided by Linksys) with DDWRT, free Linux-based.

So I had to resort to this very crude method.

• Use a 30 bit Subnet mask so as to restrict only one user per subnet.
• Implement firewall rules to check traffic across subnets.

Well it is easier said than done, especially on a router that has only 2 MB Flash memory and 8 MB RAM.

So, for anyone who is interested, here’s how it can be done.

1. Goto Setup -> Basic Setup . In the Network Setup part :
   • set the Subnet Mask to 255.255.255.252.
   • Set the Maximum DHCP Users parameter to 1.
   • Check the checkboxs for Use DNSMasq for DHCP and DHCP-Authoritative.
2. Goto Services -> Services.
   • In the DHCP Server part assign Static-IP to every host in the network by MAC-address in Static Leases.
   • Set DNSMasq and Local DNS to Enable. (LocalDNS is sometimes very useful. If you really don’t need it, you may disable it.)
   • In the Additional DNSMasq Options, create a virtual network for every host and assign its IP-range thus:
     interface=vlan0
     dhcp-range=192.168.1.2,192.168.1.2,255.255.255.252,1440m

     This is to ensure that only one host is allowed in the subnet. If the Subnet-mask is 30 bit, it allows for 4 IP-addresses. Both the 31^st and 32^nd bit as 0 is used as the network address and both the 31^st and 32^nd bit as 1 is used as the broadcast address. Thus only 2 are left as host address. But one is used by the router interface. So effectively only one host is allowed per subnet.

3. Goto Administrationn -> Management and set Cron to Enable.
4. Goto Administrationn -> Commands and do the following.
   • Create a virtual interface for the bridge interface in each subnet :
     ifconfig br0:2
     ifconfig br0:2 192.168.1.5 netmask 255.255.255.252
   • Write iptables rules to restrict traffic to and from hosts with authorized MAC-address only (if you need help on this, write to me because its a bit hard to elaborate here if you do not know how to write iptables rules).

I may have missed out a few points. If you find any inconsistencies or anything missing or wrong, please write to me.

Now, if every user in the network had a laptop, I would have just forced them all to use WI-FI (which supports MAC address based filters as well as several wireless security protocols). But unfortunately almost all of them use desktops without WI-FI cards. Also I could stop unwanted users from accessing the Internet pretty easily simply by implementing a few basic Iptables rules.But I could not stop an unwanted user from just plugging one of our cables into his computer and access everything on the LAN. Even if I allowed only a specific number of DHCP users at a time, the problem is not solved as he could just use a Static-IP.

1. Download the source from here.
2. Extract the files from the archive.
3. Rename the folder (which is named like sphinx3-x.x) to sphinx3
4. Download “sphinxbase” from here.
5. Extract the files and rename the folder( which is named sphinxbase-x.x.x) to sphinxbase.
6. Note: sphinxbase and sphinx3 should be in the same path. ( eg: “..install/sphinxbase/” and “..install/sphinx3/“)
7. In the sphinxbase folder run the script “autogen.sh” twice.
8. Run: make. (N.B.: If this gives an error, check that all dependencies are met. I was getting errors because the header file Python.h was missing. It is included in the package “python-dev” for debian).
9. Just to check run: make check.
10. Run: make install.
11. Go to the sphinx3 folder.
12. Run the “autogen.sh” script twice (please do not run the “configure” script after this).
13. Run: make.
14. Just to check run: make check.
15. Run: make install.

I am planning to package this application for both Debian and Ubuntu as soon as I have time enough to do it.

In this blog I will mostly talk about the problems that I face while I continue working with Linux. I would be equally glad to help you I can if you tell me about your problem and if there is any help that I can provide.