Accessing moodle on local network with a firewall

Accessing moodle on local network with a firewall

by Miriam R -
Number of replies: 9

Hello, I'm running Moodle on Linux Ubuntu 11.4.  I installed it using these instructions and believe I'm using 1.9.9+.  (I'm also using MySQL, PHP5, and apache2.2.)

I can access the moodle site just fine from the server.

I'm trying to access Moodle on the local network (eventually I would also like to make it externally available), but other machines on the network can't find the site.  Actually, they can't find the server at all; I can't ping or traceroute or access a test file I made in /usr/share (the apache DocumentRoot directory).

- I have set wwwroot in config.php to the server ip address.

- As per these instructions, I've set /etc/apache2/sites-enabled/000-default to include this:

 <Directory "usr/share/moodle">
      DirectoryIndex index.php
      AcceptPathInfo on
      AllowOverride None
      Options None
      Order allow,deny
      Allow from all
</Directory
Alias /moodle "usr/share/moodle"

-The same bit of code is also in /etc/apache2/sites-available/default

- /etc/apache2/ports.conf includes:

NameVirtualHost *:80
Listen 80

 

I am assuming that this is an issue with Ubuntu's default firewall.  Yesterday I followed the directions on this page up to Configuration on Startup, at which point I became dubious about outdated instructions and whether or not Network Manager is still a problem, and a commenter indicated that following the directions as written could break things and suggested an alternate option that I don't know how to implement, so I stopped.  (After following the directions, I still couldn't find the server from the local network, and this morning iptables is back to default values.)

Does anyone have any suggestions?  Thanks.

Average of ratings: -
In reply to Miriam R

Re: Accessing moodle on local network with a firewall

by Visvanath Ratnaweera -
Picture of Particularly helpful Moodlers Picture of Translators
> believe I'm using 1.9.9+.

$ cat /usr/share/moodle/version.php

> I can access the moodle site just fine from the server.

How exactly? From a browser running in the server? What is the URL?

> but other machines on the network can't find the site. Actually, they can't find the server at all;

For Moodle to work, the network need to function.

> I can't ping or traceroute or access a test file I made in /usr/share (the apache DocumentRoot directory).

You can't ping nor traceroute a file, you do that to a network interface, means either an IP address or a DNS name.

> I have set wwwroot in config.php to the server ip address.

Like this?
$CFG->wwwroot = 'x.x.x.x';

Then it is wrong. It is either
$CFG->wwwroot = 'http://x.x.x.x';
or
$CFG->wwwroot = 'http://x.x.x.x/moodle';

Looking at your Apache configuration below, I say it is the latter.

> As per these instructions, I've set /etc/apache2/sites-enabled/000-default to include this:
>
> <Directory "usr/share/moodle">

Shouldn't it be
DocumentRoot /usr/share/moodle/
no brackets, no quote, leading slash in /usr/share/local ?

> -The same bit of code is also in /etc/apache2/sites-available/default

The recommended procedure is to have a real file in "sites-available" and (soft) link it in "sites-enabled". i.e.
$ cd /etc/apache2/sites-available
$ ls -l default
-rw-r--r-- 1 root root 1.3K 2011-09-21 10:54 default
$ cd ../sites-enabled
$ ln -s ../sites-available/default whatevername
$ ls -l whatevername
lrwxrwxrwx 1 root root 26 2011-04-15 13:43 whatevername -> ../sites-available/default
^
| soft link

> - /etc/apache2/ports.conf includes:
>
> NameVirtualHost *:80
> Listen 80

Looks fine.

> I am assuming that this is an issue with Ubuntu's default firewall.

Try my suggestions first.

Remember, security obstructs usability. If you don't know how this firewall works, deactivate it, at least until the basic issues are cleared.

> whether or not Network Manager is still a problem

You have a network manager running in a server? What for? A typical server has a fixed IP address. Or is this machine your "desktop"? Not that it is wrong, but a desktop is different from a server.

> Does anyone have any suggestions?

My suggestions are generic, I don't have an Ubuntu server to compare.
In reply to Visvanath Ratnaweera

Re: Accessing moodle on local network with a firewall

by Miriam R -

> $ cat /usr/share/moodle/version.php

Yes, that's where I found it.

> How exactly? From a browser running in the server? What is the URL?

Yes, in a browser, either http://localhost/moodle or http://x.x.x.x/moodle .  (the actual IP address, not 127.0.0.1)

> You can't ping nor traceroute a file, you do that to a network interface, means either an IP address or a DNS name.

Sorry, the phrasing of that sentence was unclear.  I can't ping or traceroute the machine or access the moodle site at http://x.x.x.x/moodle or the test file at http://x.x.x.x/testpage.html .

>> I have set wwwroot in config.php to the server ip address.

$CFG->wwwroot = 'http://192.168.2.113/moodle';

> Shouldn't it be
> DocumentRoot /usr/share/moodle/
> no brackets, no quote, leading slash in /usr/share/local ?

I think you're right about the leading slash (though the moodle installer put one of those there; I haven't edited the sites-enabled file).  I'm suspicious that the quotes don't matter, because <Directory /var/www/> doesn't have them, and all the other directories (/usr/lib/cgi-bin , /usr/share/doc) do, but I'll try without.

No, no luck with either adding a leading slash or removing the quotes.

Could you please explain further about the soft link, what it does, and why I need one?

> Try my suggestions first.

Do the settings in my apache and moodle configuration files really affect whether machines on the same network can see each other (if there isn't a firewall in the way)?  If so, this seems like very poor planning on someone's part.

> Remember, security obstructs usability. If you don't know how this firewall works, deactivate it, at least until the basic issues are cleared.

Firstly, I don't even know enough about this firewall to deactivate it.  Secondly, network security is enough of an issue here (and I am aware of enough holes in my security already) that I'm very leery of deactivating it unless there's no other recourse.  Also, if, as I suspect, deactivating the firewall fixes the problem, I'm in an only marginally better position than I am right now: I would be sure (as opposed to almost sure) that the firewall was the problem, but still not know how to fix it in a way that is feasible for the long term.

> You have a network manager running in a server? What for? A typical server has a fixed IP address. Or is this machine your "desktop"? Not that it is wrong, but a desktop is different from a server.

Considering how long it may take before the actual server arrives, it seemed prudent to try to get Moodle up and running before it arrived.  (And considering that I've been working on this project for over a week now, I think that was the right decision.)  The 'server' that I'm running Moodle on has non-server Ubuntu with all of the packages necessary to behave as a server, and is a machine dedicated to this purpose.  (At one point the Moodle documentation recommended testing a first-time installation on a home server.)  This machine has a fixed (local) IP address.

In reply to Miriam R

Re: Accessing moodle on local network with a firewall

by Marcus Green -
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Plugin developers Picture of Testers

Deactivate your file wall just long enough to see if it is the problem. If it is the problem. If it is the problem you can re-activate it and find out about configuring it so it will work as you want. Linux firewalls are complex to configure but there are huge amounts of documentation on them.

In reply to Miriam R

Re: Accessing moodle on local network with a firewall

by Visvanath Ratnaweera -
Picture of Particularly helpful Moodlers Picture of Translators
Hi

> Yes, in a browser, either http://localhost/moodle or http://x.x.x.x/moodle . (the actual IP address, not 127.0.0.1)

Since the site is meant to be accessed by other computers in the LAN, the latter URL is the right one.

> I can't ping or traceroute the machine or access the moodle site at http://x.x.x.x/moodle or the test file at http://x.x.x.x/testpage.html .

Until the first part works, no point in trying the second part.

>>> I have set wwwroot in config.php to the server ip address.
>
> $CFG->wwwroot = 'http://192.168.2.113/moodle';

That's right.

>> DocumentRoot /usr/share/moodle/
>> no brackets, no quote, leading slash in /usr/share/local ?
>
> I think you're right about the leading slash (though the moodle installer put one of those there; I haven't edited the sites-enabled file). I'm suspicious that the quotes don't matter, because doesn't have them, and all the other directories (/usr/lib/cgi-bin , /usr/share/doc) do, but I'll try without.

Don't guess. Read the original docs http://httpd.apache.org/docs/2.2/mod/core.html#documentroot

> No, no luck with either adding a leading slash or removing the quotes.

Did you restart the Apache service. In most of the Linuxes the start script is in /etc/rcN.d/, where N is the run level. Testing a Debian box
# runlevel
N 2
(so it is in run level 2)
# /etc/rc2.d/S91apache2
Usage: /etc/init.d/apache2 {start|stop|restart|reload|force-reload|start-htcacheclean|stop-htcacheclean|status}.

In your case a reload is enough:
# /etc/rc2.d/S91apache2 reload

> Could you please explain further about the soft link, what it does, and why I need one?

The equivalent in the Windows world is the "shortcut" http://en.wikipedia.org/wiki/File_shortcut. That way you avoid duplicating a file, instead create a special file which is just a link. Read about soft and hard links in your favourite Unix book.

> Do the settings in my apache and moodle configuration files really affect whether machines on the same network can see each other (if there isn't a firewall in the way)?

No.

> If so, this seems like very poor planning on someone's part.

Yes, on the part of the person who started the firewall.
smile

>> Remember, security obstructs usability. If you don't know how this firewall works, deactivate it, at least until the basic issues are cleared.

> Firstly, I don't even know enough about this firewall to deactivate it. Secondly, network security is enough of an issue here (and I am aware of enough holes in my security already) that I'm very leery of deactivating it unless there's no other recourse.

You don't even know, whether there is a firewall running but happy about the security "it" gives? What is "it"? Against what "it" protects you?
sad

> Also, if, as I suspect, deactivating the firewall fixes the problem, I'm in an only marginally better position than I am right now:

See Marcus' answer.

> I would be sure (as opposed to almost sure) that the firewall was the problem, but still not know how to fix it in a way that is feasible for the long term.

If the other side is too far for a long jump, some stepping stones might help.

> You have a network manager running in a server? What for? A typical server has a fixed IP address. Or is this machine your "desktop"? Not that it is wrong, but a desktop is different from a server.

> Considering how long it may take before the actual server arrives, it seemed prudent to try to get Moodle up and running before it arrived.

Sure. That is the nice thing about Unixes. I run all sorts of services in my netbook if various occasions. No switching between client and server versions (XP, Vista, Seven ageinst NT, Server 2003, 2008) no harassments on licence codes, no ressource hogging, ...

> (And considering that I've been working on this project for over a week now, I think that was the right decision.) The 'server' that I'm running Moodle on has non-server Ubuntu with all of the packages necessary to behave as a server, and is a machine dedicated to this purpose.

It is the right decision so far. You have made commendable progress in one week. Just two things to keep in mind: 1) Continue to maintain your test "server" like the real server, means don't use a GUI for the server part, then you can just continue in the real server. 2) Don't make the "security" your first concern at this stage. First get everything working, understand how it works, then decide which security you need against what, select the tool(s), learn them then apply.

> This machine has a fixed (local) IP address.

Yet another reason to put security behind, you are in a private LAN!

PS. To know whether there is an IP firewall running,
a) read the boot message (dmesg)
b) check for suspicious scrpts in /etc/rcN.d/
f) get nmap (in Ubuntu: $ sudo apt-get install nmap) and run "nmap localhost", "nmap IP-address" in the server itself. Then move to another linux box in the LAN and run "nmap IP-address" and compare the open ports.
In reply to Visvanath Ratnaweera

Re: Accessing moodle on local network with a firewall

by Miriam R -

I've been attempting to restart apache using

/etc/init.d/apache2 restart

and getting errors like this:

linknet@linknet-OptiPlex-GX620:/etc/apache2$ /etc/init.d/apache2 restart
 * Restarting web server apache2                                                apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1 for ServerName
apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1 for ServerName
(13)Permission denied: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
Action 'start' failed.
The Apache error log may have more information.
                                                                         [fail]

(Though [13] is new since I started messing with firewalls.  Friday I just had the error about reliably determining the server's name, and got [OK] instead of [fail].)

> a) read the boot message (dmesg)

Is there a particular portion of the boot message I should look at, or something I should read the boot message for?  I have more than a thousand lines of boot message.

> b) check for suspicious scrpts in /etc/rcN.d/

If by that you mean rcN.d | 0<= N <7, N=S, they all look to me like they're doing things other than firewalls.  S37apparmor is the only thing that's even security-related.

In reply to Visvanath Ratnaweera

Re: Accessing moodle on local network with a firewall

by Miriam R -

And my computer mysteriously believes that nmap doesn't exist:

$ sudo apt-get install nmap
[sudo] password for linknet:
Reading package lists... Done
Building dependency tree       
Reading state information... Done
E: Unable to locate package nmap
$ sudo aptitude install nmap
Couldn't find any package whose name or description matched "nmap"
Couldn't find any package whose name or description matched "nmap"
No packages will be installed, upgraded, or removed.
0 packages upgraded, 0 newly installed, 0 to remove and 4 not upgraded.
Need to get 0 B of archives. After unpacking 0 B will be used.


In reply to Miriam R

Re: Accessing moodle on local network with a firewall

by Visvanath Ratnaweera -
Picture of Particularly helpful Moodlers Picture of Translators
Hi

> I've been attempting to restart apache using
> $ /etc/init.d/apache2 restart
> Restarting web server apache2
> apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1 for ServerName

Which is correct. You don't have DNS for the LAN, also not necessary since you don't plan to call the server by a DNS-name, but by its IP address.

> (13)Permission denied: make_sock: could not bind to address 0.0.0.0:80
> no listening sockets available, shutting down
> Unable to open logs
> Action 'start' failed.

Did you run the start script as a non-priviledged user? Under Ubuntu you set sudo in front, as in "sudo /etc/init.d/apache2 restart". I usually run "sudo -s" once and remain "root" after that. In conventional Linux, use either login as the user root or do "su -".

> The Apache error log may have more information.

Did you look there?

>> a) read the boot message (dmesg)
>
> Is there a particular portion of the boot message I should look at, or something I should read the boot message for? I have more than a thousand lines of boot message.

Boot scripts are at the end. It is not a bad idea to have a rough idea of the boot messages in general.

>> b) check for suspicious scrpts in /etc/rcN.d/
>
> If by that you mean rcN.d | 0<= N <7, N=S,

No, N is you current run level. See my previous posting

> they all look to me like they're doing things other than firewalls. S37apparmor is the only thing that's even security-related.

Does it get started at boot time (look in /etc/rcN.d/). You can always stop the service /path/to/script stop).

I've installed Ubuntu 10.04 Server on VirtualBox for comparison. apparmor is not started at boot time.

> $ sudo apt-get install nmap
> [sudo] password for linknet:
> Reading package lists... Done
> Building dependency tree
> Reading state information... Done
> E: Unable to locate package nmap

How are the (Ubuntu/Debian) repositories configured?

Your problems sofar are not Moodle related, something is wrong with the networking. Can your Moodle machine ping other machines in the LAN? You have to sort it out in a Ubuntu forum or a newsgroup.

(off topic) On Slashdot since the weekend
http://linux.slashdot.org/story/11/09/25/1211203/newb-friendly-linux-flavor-for-lamp-server
In reply to Miriam R

Re: Accessing moodle on local network with a firewall

by Miriam R -

It turns out that there was nothing wrong with my configuration.  We have two NAT networks, the 192.x.x.x network and the 10.x.x.x network, and I was trying to get to the 192 network from 10 network machines.  When I found a 192 network machine, it worked fine.

 

Thanks for your time.