Kubuntu 20.04 Focal Fossa as a Gateway for Public Access

By John C. Rucker

Originally published on 1 June 2021. Last modified on 2 June 2021.
This guide is a quick step-by-step guide to 
how I implement E2Guardian on Ubuntu-type systems. 
The end result is a graphical system using the KDE 
desktop, so that staff can graphically manage print 
queues. This guide, however, is mostly command-line 
with no hand-holding.

Introduction

Below are my local install notes for putting together a public access server on Kubuntu 20.04 Focal Fossa, providing print management and statistics for wifi users as well as library-provided gear.

You'll need to be pretty comfortable with Linux and the command line to replicate this. But it's really nothing too complicated. Basic steps needing no explanation for someone experienced in Linux are omitted. Using this guide, it takes me about 2 hours to set up a new machine from starting installation to full working order. These notes are for my benefit, but I hope you find it useful, too.

Install Kubuntu

Change the hostname if you wish: 

$ sudo hostnamectl set-hostname [name-goes-here]

Prep things for basic server tasks: 

$ sudo apt-get install -y lamp-server^ samba-server^ openssh-server^

Tweak a Few Things 

$ sudo apt install vim exfat-fuse exfat-utils

Edit /etc/systemd/timesyncd.conf to include: 

NTP=us.pool.ntp.org
FallbackNTP=ntp.ubuntu.com

Restart the time service and check: 

$ sudo systemctl restart systemd-timesyncd.service
$ sudo systemctl status systemd-timesyncd.service

Edit /etc/ssh/sshd_config. Uncomment the line #Banner /etc/issue.net.

Edit /etc/issue.net to give whatever notice your lawyers say is appropriate to people trying to log into your server: 

*******************************************************************************
                              NOTICE TO USERS

This computer system is the property of the Branch District Library.  It is
for authorized use only.  Users (authorized or unauthorized) have no explicit
or implicit expectation of privacy.

Any or all uses of this system and all files on this system may be intercepted,
monitored, recorded, copied, audited, inspected, and disclosed to authorized
officials of law enforcement and government agencies.

By using this system, the user consents to such interception, monitoring,
recording, auditing, inspection, and disclosure at the discretion of the Branch
District Library or other authorized officials of law enforcement or government
agencies.

Unauthorized or improper use of this system may result in civil and criminal
penalties and administrative or disciplinary action, as appropriate.  By
continuing to use this system you indicate your awareness of and consent to
these terms and conditions of use.  LOG OFF IMMEDIATELY if you do not agree to
the conditions stated in this notice.

*******************************************************************************
network:
    ethernets:
        eno1:
            addresses:
            - 192.168.XX.XXX/24
            dhcp4: no
            gateway4: 192.168.XX.1
            nameservers:
                addresses:
                    - IP-OF-NS1
                    - IP-OF-NS2
        eno2:
            addresses:
            - 192.168.1.1/24
            dhcp4: no
            gateway4: 192.168.XX.1
            nameservers:
                addresses:
                    - IP-OF-NS1
                    - IP-OF-NS2
    version: 2

To apply the changes, execute: 

$ sudo netplan apply

Verify the changes: 

$ ip addr

DHCP Server

Install the DHCP server and back up the original config file: 

$ sudo apt install isc-dhcp-server && \
sudo mv /etc/dhcp/dhcpd.conf /etc/dhcp/dhcpd.conf.bak

Edit /etc/dhcp/dhcpd.conf as needed, adding static address assignments for your library-provided public computers. If you are using this DHCP server to give addresses to all your public and staff computers, make sure all library computers are defined in this file. The file should look something like this: 

authoritative;
default-lease-time 3600;
max-lease-time 3600;
ddns-update-style none;
option routers 192.168.1.1;
option domain-name-servers YOUR-DNS-SERVER-1,YOUR-DNS-SERVER-2;

subnet [Subnet of eno1, just ending in .0] netmask 255.255.255.0 
{
}

subnet 192.168.1.0 netmask 255.255.255.0 
{
    range 192.168.1.100 192.168.1.254; # desired public service IP address range
    host HOSTNAME-HERE # host names for static IP assignment
    {
        hardware ethernet MAC-ADDRESS-USING-COLONS;
        fixed-address DESIRED-IP-ADDRESS-FOR-THIS-MACHINE;
    }
}

Restart DHCP server: 

$ sudo service isc-dhcp-server restart

Shorewall

We'll use Shorewall to make it easier to maintain rules for public Internet access. Note: I highly recommend that you have this gateway behind another firewall, limiting access from the public Internet. In this case, think of "net" in all the examples below to mean your staff network and "loc" is your public access network.

Install shorewall and copy configuration files: 

$ sudo apt-get install shorewall shorewall-init && \ 
sudo cp /usr/share/doc/shorewall/examples/two-interfaces/interfaces /etc/shorewall/; \
sudo cp /usr/share/doc/shorewall/examples/two-interfaces/policy /etc/shorewall/; \
sudo cp /usr/share/doc/shorewall/examples/two-interfaces/rules /etc/shorewall/; \
sudo cp /usr/share/doc/shorewall/examples/two-interfaces/snat /etc/shorewall/; \
sudo cp /usr/share/doc/shorewall/examples/two-interfaces/zones /etc/shorewall/

$ sudo ZONE   INTERFACE    OPTIONS

net     eno1            dhcp,tcpflags,nosmurfs,routefilter,sourceroute=0
loc     eno2            dhcp,tcpflags,nosmurfs,routefilter

Edit /etc/shorewall/snat: 

eno1                  192.168.1.0/24

Edit /etc/shorewall/policy: 

loc             all             ACCEPT
fw              loc             ACCEPT
fw              net             REJECT
net             all             DROP
# THE FOLLOWING POLICY MUST BE LAST
all             all             REJECT
Edit /etc/shorewall/rules. At minimum, append the following rules to the end of the existing file and edit per your situation. 

# file sharing
SMB(ACCEPT)  net    fw
SMB(ACCEPT)  fw    net

# Accept SSH connections for administration
ACCEPT      net                     fw      tcp     22

# Accept HTTP for the wifi stats
ACCEPT      net                     fw      tcp     80,443

# let the other servers access apcupsd for shutdown commands
#     after a power failure
ACCEPT      net                     fw      tcp     3551 

# VNC
ACCEPT      net                     fw      tcp     5900

# Allow both sides of the firewall to access the filter
# (as in your staff side can use the filter, too)
ACCEPT      net       fw          tcp    8081

# Route all HTTP traffic from library computers to the filter
# make the IP address range match your needs
REDIRECT    loc:192.168.1.2-192.168.1.255 8081    tcp    80,8000,8001,8080   -

####################################################
# RULES TO LET CERTAIN TRAFFIC OUT OF THE FIREWALL #
####################################################


# ping
ACCEPT      fw      net                     icmp

#DNS
ACCEPT      fw      net                     udp     53
ACCEPT      fw      net                     tcp     53

# HTTP(s)
ACCEPT      fw      net                     tcp     80,8000,8001,8080,443

# NTP
ACCEPT      fw      net                     udp     123

# Security Cams
ACCEPT      fw      net                     tcp     7001,7002

# Allow all traffic out to the local staff and public networks
ACCEPT     fw      net:192.168.0.0/16     all
ACCEPT     fw      loc                    all

########################################################
# END RULES TO LET CERTAIN TRAFFIC OUT OF THE FIREWALL #
########################################################

# This last rule needs to be in place to allow for unfiltered library computers. It needs to be kept last.
ACCEPT      loc     net                     tcp     80 

#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE
fw      firewall
net     ipv4
loc     ipv4
$ sudo shorewall restart

Set Shorewall to start automatically on boot: 

$ sudo systemctl enable shorewall

Statistics 

$ sudo mysql -p -u root
mysql> CREATE USER 'phpMyAdmin'@'localhost' IDENTIFIED WITH mysql_native_password BY 'PASSWORD-HERE';
mysql> GRANT ALL PRIVILEGES ON *.* TO 'phpMyAdmin'@'localhost';
mysql> FLUSH PRIVILEGES;
$ sudo apt install phpmyadmin
$ sudo  mysql -u root -p
mysql> CREATE DATABASE IF NOT EXISTS `wifi_stats` DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;quit;
$ sudo mysql -u root -p wifi_stats < old_exported_wifi_stats.sql
$ sudo  mysql -u root -p wifi_stats < wifi_stats.sql
$ sudo chmod 755 /usr/lib/cgi-bin/reportdhcp.pl
$ sudo a2enmod cgi
$ sudo systemctl restart apache2
This program isn't actually used for any of the stats collection, but it can be useful for troubleshooting. Access it from http://YOUR-SERVER-IP-ADDRESS-OR-URL/cgi-bin/reportdhcp.pl.
  • Set a cron job to collect the stats every hour, and to preemptively restart the services hourly (for stability reasons):
    • 1 *  *   *   *     wget http://localhost/DHCPd-parse.php -O /dev/null > /dev/null 2>&1

    Temp Drive for Sharing Files and Ninite Update Cache 

    $ sudo mkdir /home/temp
$ sudo chown nobody:nogroup /home/temp
$ sudo chmod 777 /home/temp
    [temp]
 comment = Public file sharing space
 path = /home/temp
 read only = no
 user mask = nobody
 create mask = 0666
 directory mask = 0777
 browseable = no
 public = yes
 writeable = yes
 guest ok = yes
 guest only = yes
    $ sudo systemctl restart smbd

    Print Release Station