Section 7.3. Configuring a Local yum Server

7.3. Configuring a Local yum Server

The skills you need to configure a local yum server are not related to yum. They require knowledge of the FTP, Apache, or NFS services. While this section is not designed to provide a complete guide to any of these services, it provides a description of how you can configure a yum repository server based on the settings described earlier for Fedora Core 4 updates.

Because I personally prefer the efficiency of the FTP and NFS services for sharing files, I've covered the configuration steps required only for those services. For completeness, I've described how you can configure an Apache server to share files on a RHEL 4 yum repository near the end of this chapter. If you're configuring a yum server, what you do will vary based on the following factors:

Distribution and version

Preferred version of a server (configuration steps vary for different FTP and HTTP servers and, to some extent, the way different distributions implement NFS servers)

Availability of yum for the distribution (i.e., if it isn't available, be prepared to compile yum from a source RPM)

As with other network services, yum servers may be sensitive to any fire-walls that you may configure. If you have a firewall between the yum server computer and associated clients, you'll need to make sure traffic can travel through appropriate TCP/IP ports; for example, Apache services require access through TCP/IP port 80. Sure, there are ways to "tunnel" data through other services, such as SSH, but that should not be necessary for updates limited to your internal network. In any case, that level of detail is beyond the scope of this book.

7.3.1. Configuring an FTP yum Server

On current Red Hat/Fedora distributions, the default FTP server is vsFTP. According to its home page at http://vsftpd.beasts.org/, it's the default FTP server used to share a number of Linux distributions, including Red Hat and Debian. It's even used to share kernels through ftp.kernel.org.

The default version of vsFTP is configured in the vsftpd RPM. The default installation works well in most cases. The vsFTP configuration file is stored in /etc/vsftpd/vsftpd.conf for Red Hat/Fedora distributions (/etc/vsftpd.conf for SUSE and Debian distributions). In this case, we're working from the RHEL 4 version of vsFTP.

By default, vsFTP files are stored in the /var/ftp directory. By convention, files that you copy for downloads are stored in the pub/ subdirectory. Therefore, the repository that you create should be in the /var/ftp/pub directory. For the example described earlier, update RPMs are stored in the following directory:

/var/ftp/pub/yum/4/i386/updates 

If you've used the commands described earlier for Fedora Core 4, you'll find the update header database in the repodata/ subdirectory.

There is a substantial number of options for vsFTP, most of which you can configure in the vsftpd.conf configuration file. The following is a review of active options in the RHEL 4 version of this file. If you want to check the current defaults for these and other options, read the vsftpd.conf man page associated with your vsFTP RPM.

anonymous_enable=yes 

You absolutely want to enable anonymous access for a FTP-based yum server. Anonymous access is normally enabled by default on a vsFTP server.

local_enable=yes 

It's normally best to disable access by regular users to a FTP-based yum server. As it is disabled by default, all you need to do is comment out this option.

write_enable=yes 

Naturally, because you do not want anyone (unless authorized) to overwrite (or even add) to a yum-repository, you should disable write access.

local_umask=022 

If you do authorize write access (I believe you should not do so on an FTP-based yum server), this option sets the umask for any files created by users who are logged into your FTP server.

dirmessage_enable=yes 

If active, this option looks for and reads any .message file that exists in the local directory. This can be useful if you want to send messages to other administrators.

xferlog_enable=yes 

If active, this option logs downloads (and uploads) on the vsFTP server in the /var/log/xferlog file. For example, when I downloaded an updated version of yum, the vsFTP server placed the following entry in that file:

Mon Sep 2 17:18:25 2005 1 192.168.0.20 390363 /pub/yum/4/i386/updates/yum-2.4.0-0.fc4.noarch.rpm b _ o a anonymous@ ftp 0 * c 

As you can see, this lists the date and time of the transfer, the client IP address, as well as the size and location of the file. This is a standard format shared with the WU-FTP server and can be mined as a database for more information on client computers that connect to your server.

connect_from_port_20=yes 

Some FTP clients require this option, which uses TCP/IP port 20 for data transfers.

xferlog_std_format=yes 

If you've activated the xferlog_enable option noted earlier, this option supports a standard format shared with the WU-FTP server.

pam_service_name=vsftpd 

The pam_service_name option defers to Pluggable Authentication Modules to help secure the vsFTP service. This particular option sets rules in /etc/pam.d/vsftpd. One of the key options in this file prohibits users listed in /etc/vsftpd.ftpusers from logging into this vsFTP server.

userlist_enable=YES 

As configured, this is redundant with the previous command. When enabled, it makes the vsFTP server read the /etc/vsftpd.user_list file and deny access to all who attempt to connect as one of the users listed in this file. By default, this file contains the same list of users as shown in /etc/vsftpd.users.

listen=YES 

By default, Red Hat / Fedora configures the vsFTP server as a standalone service, with a vsftpd activation script in the /etc/rc.d/init.d directory. In contrast, SUSE does not configure vsFTP as a stand-alone service and configures listen=NO by default.

tcp_wrappers=YES 

As configured, Red Hat / Fedora configures the vsFTP server for one more level of security, through TCP Wrappers support, which allows you to configure more security related commands in the /etc/hosts.allow and /etc/hosts.deny files. When you're satisfied with the configuration, you should activate the vsFTP server with the following command (which is not required if you've set listen=NO):

/etc/init.d/vsftpd start 

Finally, you can make sure that vsFTP is active the next time you reboot Linux with the following command:

chkconfig vsftpd on 

This command activates the vsFTP server whenever you're in run levels 2, 3, 4, or 5. (If you configure vsFTP in xinetd, it activates it in the /etc/xinetd.d directory.) For the purpose of this chapter, assume the name of this server is yum.example.com.

7.3.2. Configuring a yum Client for an FTP-Based yum Repository

After you've configured this FTP yum server, configuring the associated yum client is a straightforward process. As you've seen in Chapter 6, yum configuration files that point to yum servers are normally configured in the /etc/yum.repos.d directory. For Fedora Core 4, we will examine the client file that points to the yum Update server: fedora-updates.repo.

For the yum FTP server as configured, all you need to include in the fedora-updates.repo file is the following:

[updates-released] name=Fedora Core $releasever - $basearch - Released Updates baseurl=ftp://yum.example.com/pub/yum/4/i386/updates enabled=1 gpgcheck=1 

As described earlier, for a vsFTP server, this means that update RPMs as well as the associated repodata/ subdirectory are stored on the yum.example.com computer in the /var/ftp/pub/yum/4/i386/updates directory.

7.3.3. Configuring an NFS yum Server

On current Red Hat/Fedora distributions, an NFS server is installed by default, courtesy of the nfs-utils RPM. The default installation works well in most cases. You can specify shared NFS directories in the /etc/exports configuration file. In this case, we're working from the RHEL 4 version of NFS.

You can share directories as configured on an NFS server. For the example described earlier, update RPMs are stored in the following directory:

/var/ftp/pub/yum/4/i386/updates 

Therefore, you can share this directory at any level, as long as the mount point on the NFS client is consistent. For example, I've added the following line to my /etc/exports configuration file:

/var/ftp/pub    192.168.1.0/24(ro,sync) 

This particular configuration command shares the /var/ftp/pub directory. It limits access to clients in the noted IP address range. Clients are allowed read-only (ro) access. Changes are committed to disk before any new requests are made (sync).

Note

The notation shown in /etc/exports is associated with Classless Inter-Domain Routing (CIDR). The 192.168.1.0/24 address corresponds to a range of client IP addresses from 192.168.1.1 and 192.168.1.254 (the range excludes network and broadcast addresses).

For more information, see the exports man page Linux Administration Handbook by Evi Nemeth, Garth Snyder, and Trent Hein (Upper Saddle River, NJ: Prentice Hall, 2002). After you're satisfied with the configuration in /etc/exports, deactivate the NFS server with the following command:

/etc/init.d/nfs stop 

Note

Remember, this chapter is focused on Fedora/Red Hat. The NFS server script goes by different names on other Linux distributions.

By default, this should stop any NFS services, quotas, the NFS daemon, as well as the mountd daemon. Next, export the changes to /etc/exports with the following command:

exportfs -a 

Now restart the NFS services with the following command:

/etc/init.d/nfs start 

Confirm the exports in from the local list with the following command:

showmount -e 

If you're on another system, you can find the shared NFS directories. For example, you can list those on a server named yum.example.com with the following command:

showmount -e yum.example.com 

Finally, you can make sure that NFS is active the next time you reboot Linux with the following command:

chkconfig nfs on 

This command activates the NFS server whenever you're in run levels 2, 3, 4, or 5.

7.3.4. Configuring an NFS yum Client

You'll need to mount the NFS share on an appropriate local directory, and then configure the associated file in /etc/yum.repos.d to point to that share. Because we're configuring a share for Fedora updates, we'll modify the fedora-updates.repo file.

First, on the NFS client, you should confirm your ability to connect to a shared NFS directory. The following command connects to the yum.example.com NFS server to find what shares are available on that server:

showmount -e yum.example.com 

You'll see the shared directories that you configured earlier, including /var/ftp/pub. I've mounted it on the local /var/yum directory with the following command:

mount yum.example.com:/var/ftp/pub /var/yum 

If the /var/yum directory does not yet exist, you'll get an error message. Now you can configure your fedora-updates.repo file in your /etc/yum.repos.d directory. For the yum NFS server as configured, all you need in fedora-updates.repo is the following:

[updates-released] name=Fedora Core $releasever - $basearch - Released Updates baseurl=file:///var/yum/yum/4/i386/updates enabled=1 gpgcheck=1 

As described earlier, for a vsFTP server, this means that update RPMs as well as the associated repodata/ subdirectory are stored in the yum/4/i386/updates subdirectory, mounted on the /var/yum directory.

Note the syntax associated with the baseurl command. The file: command works in place of ftp: or http:. The triple forward slash (///) is the standard syntax required for mounted directories.

If you've configured a Fedora Updates repository on a Fedora Core server, this command may be slightly different. Based on the directory specified earlier, you would substitute the following baseurl command:

baseurl=file:///var/ftp/pub/yum/4/i386/updates 

Naturally, you may want to configure this shared directory as part of the boot process for each NFS client. It's possible to configure it in the default /etc/fstab configuration file, as well as through the Automounter daemon. I recommend the latter, which avoids hangups when there are network problems. The Automounter daemon is easy to configure; it requires the autofs RPM. After that RPM is installed, here's how you can configure a NFS client for Fedora updates as configured in this chapter:

1. Install the autofs RPM; if you've configured yum, the simplest way is with the following command. Even if you're not sure if autofs is installed, this command makes sure that you have the latest version of the Automounter:

   yum install autofs 

2. Configure the Automounter master file to read from /etc/auto.misc. Open the /etc/auto.master configuration file. You'll see sample commands; activate the following to read from the noted file. The timeout prevents your system from hanging if there's a problem with your network or the NFS server.

   /misc   /etc/auto.misc --timeout=60 

   Automounter shares configured in /etc/auto.misc are configured as subdirectories of /misc.

3. Configure the Automounter /etc/auto.misc file to read from the shared NFS directory. Based on the shared directory and NFS server name described earlier, add the following line to that file:

   yum     -ro,soft,intr     yum.example.com:/var/ftp/pub 

4. Start the Automounter service with the following command:

   /etc/init.d/autofs start 

   Note

   Yes, it is possible to use the /etc/auto.net script to find and connect to shared NFS directories. But it might not be compatible with SE Linux. For more information, see bug 174156 on bugzilla.redhat.com.

   
   

5. Test the result. If your network is connected and the NFS server is running, you should be able to see the shared NFS directory with the following command:

   ls /misc/yum 

   Occasionally, you may need to run this command more than once to establish the connection.

6. Configure the /etc/yum.repos.d/fedora-updates.repo file to point to this directory as shared. Based on the previously shared NFS directory, the baseurl command would be

   baseurl=file:///var/ftp/pub/yum/4/i386/updates 

7. Test the result with the yum update command. You should see messages similar to a regular yum update from other local or remote servers.