Ubuntu LTSP for the Enterprise

Ubuntu LTSP (ltsp-server package) provides a very easy and convenient method for deploying a thin-client environment (see ltsp.org), but is centered primarily around one server being the DHCP/TFTP/NBD and image build server.  Being in an enterprise environment, I needed to be able to split these functions in order to deploy thin clients.  The image below depicts what I needed to achieve. Essentially I wanted to have ubuntu 14.04 images served by older release servers, so my "build" server needs to be 14.04.  Plus I wanted to be able to server multiple custom images off the same server(s).  Note:  I have existing DHCP/TFTP and NBD servers - so this post assumes these are already established - If you do not, then the ltsp-server package has everything you need, and this post is kinda moot.

First, on my build server, I did the following:

apt-get install ltsp-server
ltsp-build-client --dist trusty --arch amd64 --base /opt/ltsp-trusty

This builds your base client system, in my case an amd64 architecture ubuntu 14.04 base.  It takes about 20 minutes depending on your Internet connection and system speed.  Then any customizations can be done via ltsp-chroot:

ltsp-chroot -a amd64 -b /opt/ltsp-trusty --mount-package-cache

(more on what I customized in later post)

And to build the image:

ltsp-update-image --base /opt/ltsp-trusty

So what we have now on the build server, is the image in /opt/ltsp-trusty/images called amd64.img and the needed tftpboot files in /var/lib/tftpboot/ltsp.  In very simple terms, we now need to deploy the image "amd64.img" to the NBD server, and the PXE boot environment to the TFTP server, and then tweak configuration files to point to the right places.

NBD server (Network Block Device)

For every different image you want to deploy, you need nbd-server listening on a different port.  I am using inetd to spawn the nbd-server instances.  Here is my inetd.conf, which is configured for 3 images on ports 2000 thru 2002:


2000  stream  tcp nowait  nobody /usr/sbin/tcpd /usr/sbin/nbdrootd /opt/ltsp/images/i386.img
2001  stream  tcp nowait  nobody /usr/sbin/tcpd /usr/sbin/nbdrootd /opt/ltsp-trusty/images/amd64.img
2002  stream  tcp nowait  nobody /usr/sbin/tcpd /usr/sbin/nbdrootd /opt/ltsp-trusty/images/i386.img

The image files have to be accessible directly, so in my case I copied them from my build server.

TFTP server (Trivial File Transfer Protocol)

For every different image, you need a specific PXE environment defined in /var/lib/tftpboot.  In my case I have 3:

/var/lib/tftpboot/ltsp/i386
/var/lib/tftpboot/ltsp-trusty/amd64
/var/lib/tftpboot/ltsp-trusty/i386

These can be copied as is from the same location on the build server - each environment can have its own lts.conf file.

Now, there is some tweaking required in order for the client to grab the correct NBD image.  You need to add nbdroot={ipaddress}:{port} to the kernel boot parameters for any image served by the non-standard 2000 NBD port.  This is done in the pxelinux.cfg/ltsp file - snippet below.

# This file is regenerated when update-kernels runs.
# Do not edit, see /etc/ltsp/update-kernels.conf instead.
default ltsp-NBD
ontimeout ltsp-NBD

# This file is regenerated when update-kernels runs.
# Do not edit, see /etc/ltsp/update-kernels.conf instead.
label ltsp-NBD
menu label LTSP, using NBD
kernel vmlinuz-3.13.0-37-generic
#append ro initrd=initrd.img-3.13.0-37-generic init=/sbin/init-ltsp quiet splash root=/dev/nbd0
append ro initrd=initrd.img-3.13.0-37-generic init=/sbin/init-ltsp nosplash root=/dev/nbd0 nbdroot=192.168.202.4:2001
ipappend 2

DHCP server (Dynamic Host Configuration Protocol)

Your DHCP configuration is key, as it directs the PXE booting client to the correct TFTP server and PXE path.  I use an Etherboot gPXE image served by a local TFTP server to fix issues with older network cards - but you may not need that.  Here is one client config section example:

host webc2 {     hardware ethernet 20:cf:30:6f:0a:9e;

     fixed-address webc2;

     option host-name "webc2";

     if substring (option vendor-class-identifier, 0, 9) = "PXEClient"           {

   if exists user-class and option user-class = "gPXE" {

      next-server 192.168.202.4;

      filename "/ltsp-trusty/i386/pxelinux.0";

   } else { filename "/tftpboot/undionly.kpxe"; }

} else {

  next-server 192.168.202.4;

  filename "/ltsp-trusty/i386/nbi.img";}}

The "next-server" portion points it to the TFTP server and PXE file.

You'll probably notice that in my case, my TFTP server and NBD server are on the same server, but its not necessary.

Anyway, in another post I'll discuss an improvement I made to LTSP to allow better scripting via TFTP.

PXE booting of Webconverger

Webconverger is a great web kiosk tool.  This post briefly explains how to customize it and have it boot over a network (PXE boot).  These instructions apply to Ubuntu servers, but concept is adaptable.

First, download the webconverger ISO - I used version 8.0 since I already had it kicking around.

You need a DHCP server, a TFTP server and an NFS server.  Of course, the workstation has to support PXE booting, and be on the same network as these 3 servers.

You can use one physical machine for all three services, but in my scenario I have two machines, one acts as DHCP server, and the other is both the TFTP and NFS server.

DHCP

Using dhcp3-server.. entry in /etc/dhcp3/dhcpd.conf:

        host temp {
                hardware ethernet 00:14:c2:c4:5f:38;
                fixed-address temp.abc.com;
                option host-name "temp";
                option root-path "192.168.202.4:/tftpboot/webc/";
                if substring (option vendor-class-identifier, 0, 9) = "PXEClient" {
                next-server 192.168.202.4;
                filename "webc/pxelinux.0"; }
        }

 Note:  Here the "next-server" is required to redirect to the TFTP server.. obviously change the MAC and ip addresses according to your workstation and servers.  Be sure to restart your DHCP server.

Ok - thats the easy part..  now you have to prep for the TFTP/NFS server setup:


For PXE booting, you need syslinux, nfs-kernel-server, and tftpd-hpa.

TFTP

First, make root tftpboot directory for webconverger, then mount the ISO and copy files into the root dir:

mkdir -p /var/lib/tftpboot/webc/webconverger/8.0
mount -o loop webc8.iso /mnt
cp -a /mnt/* /var/lib/tftpboot/webc/webconverger/8.0
umount /mnt
cp /usr/lib/syslinux/pxelinux.0 /var/lib/tftpboot/webc
cp /usr/lib/syslinux/vesamenu.c32 /var/lib/tftpboot/webc
mkdir /var/lib/tftpboot/webc/pxelinux.cfg

In /var/lib/tftpboot/webc/pxelinux.cfg create a file called "default" with the following contents:

DEFAULT vesamenu.c32
TIMEOUT 10
ONTIMEOUT wc
PROMPT 0
NOESCAPE 1
MENU BEGIN Webconverger
MENU TITLE Webconverger
        MENU INCLUDE webconverger/webconverger.menu
MENU END

NOTE:  The TIMEOUT 10 is basically allowing no time to show menu.. I just want it booting "wc" entry (ONTIMEOUT wc) - adjust accordingly.

Last thing needed is the file /var/lib/tftpboot/webc/webconverger/webconverger.menu:

# nfsroot ip is pxe server's address

LABEL wc
        MENU LABEL Webconverger 8
        KERNEL /webconverger/8.0/live/vmlinuz
APPEND initrd=/webconverger/8.0/live/initrd.img boot=live config homepage=http://www.google.com hostname=webconverger nonetworking nopersistent quickreboot nomodeset noroot splash username=webc vga=current quiet netboot=nfs nfsroot=192.168.202.4:/var/lib/tftpboot/webc/webconverger/8.0
        TEXT HELP
        Boot Webconverger 8.0
ENDTEXT

NFS

Essentially you just need one entry /etc/exports:

/var/lib/tftpboot/webc *(ro,sync,no_subtree_check)

Then do:  exportfs -a

Workstation

Enter BIOS and configure station to boot from network.

You can customize by workstation, by creating additional entries in pxelinux.cfg..    a file called "01-00-14-c2-c4-5f-38" for example, will be used for workstation with MAC of 00:14:c2:c4:5f:38.  Essentially you just copy the "default" file and adjust the ONTIMEOUT to point to a LABEL in webconverger.menu.

 

PXE chaining to modernize legacy PXE NICs

Ok - so we have faulty/legacy PXE implementation in some onboard NICs, that don't support "next-server"...  Here is how to fix...   VERY cool!  It basically replaces the faulty PXE with a modern gPXE.

Following these instructions.. build undionly.kpxe and place in local /tftpboot/

http://etherboot.org/wiki/pxechaining

Then do something like the following in dhcpd.conf:

group {
        allow booting;
        option root-path "192.168.202.4:/opt/ltsp/i386";

        host ws042 {
                hardware ethernet 00:06:29:DF:2C:52;
                fixed-address ws042.dainty.ca;
                option host-name "ws042";

                if substring (option vendor-class-identifier, 0, 9) = "PXEClient" {
                        if exists user-class and option user-class = "gPXE" {
                                next-server 192.168.202.4;
                                filename "/ltsp/i386/pxelinux.0"; #secondary PXEclient
                        } else {
                        filename  "/tftpboot/undionly.kpxe"; #first boot.. loads gPXE
                        }
                } else {
                        next-server 192.168.202.4;
                        filename  "/ltsp/i386/nbi.img";  #normal boot image
                 }

        }
}

Automatic Proxy Howto

For business laptops, moving from home to the office - proxy settings can be a pain. You can use browser plugins like "foxy proxy" - but the best solution - bar none - is automatic proxy configuration.

To get automatic proxy configuration working (at the office where proxy is required), you need a webserver (eg. apache2), a name server (eg. bind9), and a DHCP server (eg. dhcp3).

Apache2 config
* Put javascript into setProxy.pac in you webserver root directory (change it for your domains/proxy)

function FindProxyForURL(url, host)

{

if (isPlainHostName(host) ||

dnsDomainIs(host, ".yourdomain1.ca") ||

dnsDomainIs(host, ".yourdomain2.ca"))

return "DIRECT";

else return "PROXY yourproxy.yourdomain.ca:8080; DIRECT";

}

* Link wpad.dat to it (ln -s setProxy.pac wpad.dat)
* add the following to apache mime.types file (on ubuntu just /etc/mime.types):

 application/x-ns-proxy-autoconfig dat

 application/x-javascript-config pac

* restart apache  (/etc/init.d/apache2 restart)

Bind9 config
* add the following to /var/cache/bind/db.yourdomain.ca

wpad IN CNAME apachehost.yourdomain.ca.

* restart named (don't forget to change serial number) - /etc/init.d/bind9 restart

In other words, "wpad" has to resolve to your apache server... so client can "ping wpad"

DHCP config
* add the following to /etc/dhcp3/dhcpd.conf:

 option wpad code 252 = text;

 option wpad "http://apachehost.yourdomain.ca/setProxy.pac ";

 (last space is MANDATORY - IE strips last char)

* restart dhcp


That should do it!

This works with KDE 4 - w/ Google Chrome (set in KDE network settings).  And with Firefox 3.0.14 with "Automatic proxy" option selected.