FreePBX on Debian

UPDATE:Try this to fix the problems with mysql permissions.  This was suggested by someone else.  I have not tried it myself.  "The 'astrundir' must be changed to  /var/run/asterisk before installing FreePBX. Otherwise, the owner for /var/run/mysqld will be changed to asterisk and that causes mysqld to fail starting. Or you can just change permission of /var/run/mysqld to 777"

I have updated the how-to build asterisk with freepbx on debian sarge with a minimal install that was originally located atsquishychicken.com.

The total install is around 500MB (after deb archives are removed of course :)  )... enjoy.  Please let me know if there are any glaring errors that I have over looked.

Just a quick note before we get started.... there are a couple of things that I assume here.  One is that you are familiar with your shell.  Be sure that you don't just blindly cut and paste this into a window... look at the command and think about what they are doing.  When you see cat > /some/file <<EOF  make sure you cut to the next EOF...

 YMMV and use at your own risk.

 #Install barebones Debian Sarge using the "linux26" command from the initial boot screen.

 boot:linux26
# update all packages and make sure we are current

 apt-get update
apt-get upgrade

 # install and configure etherconf for static IP
# specify the hostname and assign a static ip for later

 apt-get install etherconf

#install sshd so that you can do the rest of the install remotely without the need for a mouse/kb/monitor.  It is also handy for doing the cut and paste thing which Windows users know and love.

apt-get install ssh
# get needed software and dependencies

apt-get install vim libasound2 libgsm1 libltdl3 libpq3 libspeex1 libsqlite0 libtonezone1 odbcinst1 unixodbc openssl libssl0.9.7 libssl-dev libreadline4 libreadline4-dev libeditline0 libeditline-dev libedit-dev libedit2 libncurses5 libncurses5-dev zlib1g-dev bison libnet-telnet-perl mime-construct libipc-signal-perl libmime-types-perl libproc-waitstat-perl subversion libipc-signal-perl libproc-waitstat-perl apache2 mysql-server php4 php4-cli php4-mysql php4-pear libapache2-mod-php4 php4-curl libmysqlclient14-dev libmysqlclient14 php4-gd make gcc g++ fxload

# don't forget the kernel headers
apt-get install kernel-headers-`uname -r`

# get the latest asterisk  from cvs
cd /usr/src
svn checkout http://svn.digium.com/svn/asterisk/branches/1.2 asterisk-1.2
svn checkout http://svn.digium.com/svn/zaptel/branches/1.2 zaptel-1.2
svn checkout http://svn.digium.com/svn/libpri/branches/1.2 libpri-1.2
svn checkout http://svn.digium.com/svn/asterisk-addons/branches/1.2 asterisk-addons-1.2
svn checkout http://svn.digium.com/svn/asterisk-sounds/trunk asterisk-sounds

# build zaptel drivers for 2.6 kernel
cd zaptel-1.2
make clean; make linux26; make install
# if you need pri support
cd ../libpri-1.2
make clean; make install

#NOTE: In asterisk 1.2.x and above you no longer need the mpg123 player so the installation procedure has been removed from this document.  You DO need to install the asterisk-addons package in order to use the built in MOH.

cd ../asterisk-1.2
make clean; make install

# build asterisk addons with mysql patch to makefile

cd ../asterisk-addons-1.2

perl -p -i.bak -e 's/CFLAGS.*D_GNU_SOURCE/CFLAGS+=-D_GNU_SOURCE\nCFLAGS+=-DMYSQL_LOGUNIQUEID/' Makefile

make clean; make install
# build asterisk-sounds
cd ../asterisk-sounds
make clean; make install

# install lame for mp3 resample
cd /usr/src
wget http://easynews.dl.sourceforge.net/sourceforge/lame/lame-3.96.1.tar.gz
tar -xvzf lame-3.96.1.tar.gz
cd lame-3.96.1
./configure --prefix=/usr --sysconfdir=/etc
make && make install

# use xorcoms handy zaptel toolset
cd /usr/src
wget http://rapid.sunsite.dk/rapid/pool/main/z/zaptel/zaptel_1.2.5-3_i386.deb
dpkg -i zaptel_1.2.5-3_i386.deb

# If it asks you whether to keep the existing package or install the new one 
go with the default by hitting 'ENTER' or typing 'N'
# auto detect zaptel hardware

genzaptelconf -ds

# install asterisk perl
cd /usr/src
wget http://asterisk.gnuinter.net/files/asterisk-perl-0.08.tar.gz
tar zxf asterisk-perl-0.08.tar.gz
cd asterisk-perl-0.08
perl Makefile.PL
make install

# get freepbx

cd /usr/src
wget http://ufpr.dl.sourceforge.net/sourceforge/amportal/freepbx-2.1.1.tar.gz
tar -xvzf freepbx-2.1.1.tar.gz
cd freepbx-2.1.1

# create the databases and tables
mysqladmin create asteriskcdrdb
mysql asteriskcdrdb < /usr/src/freepbx-2.1.1/SQL/cdr_mysql_table.sql
mysqladmin create asterisk

mysql asterisk < /usr/src/freepbx-2.1.1/SQL/newinstall.sql

#grant access to asterisk user.  The usernames and passwords here MUST be the same as those configured during the freepbx install.  Freepbx defaults (username 'asteriskuser' and password 'amp109') are used here.  If you change them here you MUST also change them to the same during the freepbx install.

 echo "GRANT ALL ON  asterisk.* to asteriskuser@localhost identified by 'amp109'" | mysql

 echo "GRANT ALL ON  asteriskcdrdb.* to asteriskuser@localhost identified by 'amp109'" | mysql

 # add the asterisk user and group

 groupadd asterisk

useradd -g asterisk -d /var/lib/asterisk -s /bin/bash asterisk

# make the directory for the virtual host and for recordings.

mkdir -p /var/www/`uname -n`/cgi-bin

mkdir -p /var/www/`uname -n`/htdocs

mkdir -p /var/lib/asterisk/sounds/custom

# build the default zapata.conf

 cat > /etc/asterisk/zapata.conf << EOF
[channels]
language=en
language=en
context=from-pstn
signalling=fxs_ks
rxwink=300              ; Atlas seems to use long (250ms) winks
;
; Whether or not to do distinctive ring detection on FXO lines
;
;usedistinctiveringdetection=yes

usecallerid=yes
hidecallerid=no
callwaiting=yes
usecallingpres=yes
callwaitingcallerid=yes
threewaycalling=yes
transfer=yes
cancallforward=yes
callreturn=yes
echocancel=yes
echocancelwhenbridged=no
echotraining=800
rxgain=0.0
txgain=0.0
group=0
callgroup=1
pickupgroup=1
immediate=no
;faxdetect=both
relaxdtmf=yes
faxdetect=incoming
;faxdetect=outgoing
;faxdetect=no

; include zap extensions defined in AMP
#include zapata_additional.conf
#include zapata-channels.conf
EOF

# don't forget the run directory

mkdir /var/run/asterisk

# Now install freepbx.  During this install, it will ask for changes to the defaults.  If you hit ENTER the default will be used.  You MUST pay close attention to these defaults as they need to be changed to the defaults used earlier and in the next step after this one.  There is nothing preventing you from using different usernames, passwords, and directories as long as they are the same in the freepbx setup as they are through out the rest of this document which I have/will point out.

uname -n

#Change the defaults during the install to the following.  Substitute "uname -n" to whatever was returned when you typed in "uname -n" above:

#Enter the path to use for your AMP web root:[/var/www/"uname -n"/htdocs]
#Enter the path to use for your FOP web root:[/var/www/"uname -n"/htdocs/panel]
#Enter the path to your Apache cgi-bin:[/var/www/"uname -n"/cgi-bin]
#Enter the IP ADDRESS or hostname used to access the AMP web-admin:[xx.xx.xx.xx] The IP Address of your #Asterisk Machine

cd /usr/src/freepbx-2.1.1

./install_amp

# create the virtual host file with good defaults.  These original defaults MUST have been changed manually during the automated freepbx install above.

cat > /etc/apache2/sites-available/pbx.conf << EOF

NameVirtualHost *:80
<VirtualHost *:80>
ServerAdmin webmaster@localhost
ServerName `uname -n`
DocumentRoot /var/www/`uname -n`/htdocs
<Directory />

Options FollowSymLinks
AllowOverride None
</Directory>

<Directory /var/www/`uname -n`/htdocs>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all

</Directory>
ScriptAlias /cgi-bin/ /var/www/`uname -n`
<Directory "/var/www/`uname -n`/cgi-bin">
AllowOverride None
Options ExecCGI -MultiViews +SymLinksIfOwnerMatch
Order allow,deny
Allow from all
</Directory>

ErrorLog /var/log/apache2/error.log

# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn

CustomLog /var/log/apache2/access.log combined
ServerSignature On

</VirtualHost>
EOF

# make apache run as user asterisk and enable the virtual host

ln -s /etc/apache2/sites-available/pbx.conf  /etc/apache2/sites-enabled

perl -p -i.bak -e 's/User www-data/User asterisk/' /etc/apache2/apache2.conf

perl -p -i.bak -e 's/Group www-data/Group asterisk/' /etc/apache2/apache2.conf

# make tweeks for php to allow for file uploads

perl -p -i.bak -e 's/upload_max_filesize.*$/upload_max_filesize = 20M/' /etc/php4/apache2/php.ini

perl -p -i.bak -e 's#AddType application/x-httpd-php-source .phps#AddType application/x-httpd-php-source .phps\nLimitRequestBody 20000000#' /etc/apache2/mods-available/php4.conf

# restart to get changes

/etc/init.d/apache2 restart

# change the security to database authentication.  The username and password must be the same as those used during the freepbx install earlier in this document.  The freepbx defaults (username=admin, password=amp111) are used

perl -p -i.bak -e 's/AUTHTYPE=none/AUTHTYPE=database/' /etc/amportal.conf

echo "insert into ampusers values ('admin','amp111','','','','*');" | mysql asterisk

# You will probably get an error/warning here.  Something about "duplicate entry 'admin' for  key 1".  Just ignore it.

# install astmanproxy for astapi dialing

cd /usr/src/

svn checkout http://svncommunity.digium.com/svn/astmanproxy/tags/1.20

cd 1.20

make && make install

# modify /etc/asterisk/astmanproxy.conf and assign username/password

eg: host = localhost, 5038, proxy, 1234, on

# modify /etc/asterisk/manager_custom.conf to add the following

[proxy]
secret = 1234
deny=0.0.0.0/0.0.0.0
permit=127.0.0.1/255.255.255.255
read = system,call,log,verbose,command,agent,user
write = system,call,log,verbose,command,agent,user

[astapi]
secret = 1234
deny=0.0.0.0/0.0.0.0
permit=10.0.0.0/255.255.255.0
read = system,call,log,verbose,command,agent,user
write = system,call,log,verbose,command,agent,user

# build an rc.local startup script

echo '#!/bin/bash' > /etc/init.d/local

chmod +x /etc/init.d/local

update-rc.d local defaults 80

echo '/usr/local/sbin/astmanproxy' >> /etc/init.d/local

# change the user that astmanproxy runs as

perl -p -i -e 's/proc_user.*$/proc_user = asterisk/' /etc/asterisk/astmanproxy.conf

perl -p -i -e 's/proc_group.*$/proc_group = asterisk/' /etc/asterisk/astmanproxy.conf

# change permissions and start amp

amportal chown

amportal start

#If you don't have a zaptel card

modprobe ztdummy

#build a freepbx automatic start and stop script as last to start and first to stop.  I know there is a way to do it with just one script but I haven't figured out how to modify the "skeleton" file included in init.d yet.

echo '#!/bin/bash' > /etc/init.d/amportal-start

chmod +x /etc/init.d/amportal-start

update-rc.d amportal-start start 99 2 3 4 5 .

# Add this line if you do NOT have a zaptel card

echo 'modprobe ztdummy' >> /etc/init.d/amportal-start

# Now complete the start script and add the stop script

echo '/usr/sbin/amportal start' >> /etc/init.d/amportal-start

echo '#!/bin/bash' > /etc/init.d/amportal-stop

chmod +x /etc/init.d/amportal-stop

update-rc.d amportal-stop stop 10 0 1 6 .

echo '/usr/sbin/amportal stop' >> /etc/init.d/amportal-stop

SugarCRM Install on Redhat Enterprise Linux

This install procedure was tested using the Redhat Enterprise Linux distribution known as CentOS.

Software used:

CentOS v5.7 or CentOS v6.2
SugarCRM 6.3 Community Edition

Linux commands executed at a command prompt are in courier font.

Let's get started

If you are installing Linux from scratch using Anaconda via install CD select "basic server" and proceed with the install which will install with no groups.   Skip down to the yum -y update part.

Otherwise, it is assumed you already have a server with a base CentOS installation before you begin.  Do NOT install a GUI such as Gnome or KDE.  We only want to be running in console text mode not GUI graphics mode.  If you already have a desktop or server GUI installed you will want to exit to console mode.  You do that by typing init 3 from a terminal or console window.  You will need to be logged in as root in order to do this so if not you can su root.  All instructions in this guide are assuming you are always logged in as root.

Get rid of all installed groups except 'Yum Utilities' so we are starting with a clean slate.  Check the delete list before entering 'y' to make sure none of these remove 'sshd' or 'yum' (they don't but check just in case things change with newer revisions).

yum grouplist installed

Installed Groups:
   DNS Name Server
   Editors
   Legacy Network Server
   Mail Server
   Network Servers
   System Tools
   Text-based Internet
   Web Server
   Windows File Server
   Yum Utilities

yum groupremove 'DNS Name Server'
yum groupremove 'Editors'
yum groupremove 'Legacy Network Server'
yum groupremove 'Mail Server'
yum groupremove 'Network Servers'
yum groupremove 'System Tools'
yum groupremove 'Text-based Internet'
yum groupremove 'Web Server'
yum groupremove 'Windows File Server'

Now update the base install

yum -y update

Install the basic set of packages required for a linux server.

yum -y groupinstall core
yum -y groupinstall base

Install required packages for sugarcrm install and nano editor.
yum -y install php php-pear php-mbstring mysql-server php-mysql httpd nano

Set mysql and apache to start on boot then start them.

chkconfig httpd on
chkconfig mysqld on
service httpd start
service mysqld start

Selinux is not required or recommended.  This will create the required file if it does not already exist.  If it already exists copy paste or edit the contents indicated here to be sure selinux never runs.

nano /etc/selinux/config
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#       enforcing - SELinux security policy is enforced.
#       permissive - SELinux prints warnings instead of enforcing.
#       disabled - SELinux is fully disabled.
SELINUX=disabled
# SELINUXTYPE= type of policy in use. Possible values are:
#       targeted - Only targeted network daemons are protected.
#       strict - Full SELinux protection.

SELINUXTYPE=targeted
# SETLOCALDEFS= Check local definition changes
SETLOCALDEFS=0

(Ctrl-x> y >Enter)

Make sure selinux is turned off for this session

setenforce 0

RHEL v5 Section:
If using RHEL v6 skip over this section

SugarCRM currently requires PHP v5.2 at a minimum.  RHEL v5 comes with php v5.1.  We can find php v5.2 in the testing repository.  If running RHEL v6 we would have PHP v5.3 and shouldn't have to do this.

cd /etc/yum.repos.d/
wget http://dev.centos.org/centos/5/CentOS-Testing.repo
yum -y --enablerepo=c5-testing update php*

Restart httpd for the new version of php to take effect
service httpd restart

verify we are now running php v5.2
php -v

On RHEL 5 shutdown unnecessary daemon brcm-iscsi which is enabled by default and tends to do a lot of logging even when not used. This creates unnecessary I/O load.

chkconfig iscsi off
chkconfig iscsid off
service iscsi stop
service iscsid stop

Replace syslog with the improved and backwards compatible rsyslog (standard in RHEL6 but not RHEL5).  This also prevents a problem that comes up with improper timestamps in /var/log/secure when you get disconnects. 

NOTE:This is only for RHEL5 based systems.  You do not need to do this for RHEL6.

yum -y install rsyslog
chkconfig syslog off
chkconfig rsyslog on
service syslog stop
service rsyslog start

End of RHEL v5 Section-------------

Set Timezone
Copy your timezone from this link.

System timezone
Create a symbolic link to the appropriate timezone from /etc/localtime.
Example:
ln -sf /usr/share/zoneinfo/America/Vancouver /etc/localtime

PHP timezone
for RHEL5:
nano +633 /etc/php.ini
for RHEL6
nano +946 /etc/php.ini

Uncomment (;) date.timezone = and add your timezone.  For example:
date.timezone = America/Vancouver

Restart apache for the changes to take effect.
service httpd restart

MySQL security enhancement
This will prevent outside IP's from connecting to the MySQL port

nano /etc/my.cnf
[mysqld]
.
.
.
bind-address = 127.0.0.1

(Ctl-x > y > ENTER)

MySQL performance tuning for low memory (optional)
This will reduce memory usage significantly without affecting performance.  RHEL 6 does not include bdb so do not add the skip-bdb line.

nano /etc/my.cnf
[mysqld]
.
.
.
skip-innodb
skip-bdb

(Ctl-x > y > ENTER)

Restart service for the changes to take effect
service mysqld restart

Improving SugarCRM Performance
Using this sugarcrm performance tutorial as a reference and the 2 most important suggestions.

MySQL optimization

Note:  If you have already set mysql root password use mysql -p instead of mysql

mysql

mysql> SHOW VARIABLES LIKE "query_cache%";

If query_cache_type is set to something other than “ON” or query_cache_size is set to 0, you will want to change these! 32MB is a fine start, but depending on your workload you may need (a lot) more to get the full benefit from this:

mysql> SET GLOBAL query_cache_type = 'ON';
mysql> SET GLOBAL query_cache_size = 32000000;
mysql> \q

This one change can make a significant difference in mysql performance when running SugarCRM.  After some time has passed and some usage taken place you can check the status of this optimization as follows:

mysql> SHOW STATUS LIKE "Qcache%";

The two numbers to pay the most attention to are free_memory and lowmem_prunes.  If free_memory is approaching 0 and lowmem_prunes keeps increasing that means you should probably increase the query_cache_size.

PHP Performance optimization
Perhaps the single biggest perfomance enhancement that you can make for SugarCRM and many other PHP applications is OpCode Caching.  One of the ways of doing this is by installing Alternative PHP Cache otherwise known as APC.  For php v5.2, php-pecl-apc-3.0.19 from one of the 3rd party archives is the version we need.

For RHEL 5
rpm -ivh http://rpms.famillecollet.com/enterprise/5/olds/i386/php-pecl-apc-3.0.19-1.el5.remi.i386.rpm

The 64bit version can be found at the same domain replacing "i386" with "x86_64".

For RHEL 6 the package is already included in the repositories
yum -y install php-pecl-apc

Configuration is done in /etc/php.d/apc.ini.  The defaults should be fine for now.  To monitor this optimization after some time has passed copy the apc.php file to your webroot and view it on a browser.

cp /usr/share/doc/php-pecl-apc*/apc.php /var/www/html

then from a web browser go to http://myserverIP/apc.php

On the left hand side compare File Cache Information>Hits with Cache full count.  Over time you want Hits vs Cache Full count to be at least 98%.   Same thing with the Hits & Misses graph on the right.  If it's lower than this you will probably benefit from increasing apc.shm_size in /etc/php.d/apc.ini.  Remember to issue service httpd restart in order for the changes to take effect.  Wait for memory usage to reach 100% or to stay steady over a period of time before making this measurement.

SugarCRM Install

Using this SugarCRM install guide as a reference.

RHEL 5
nano +302 /etc/php.ini

RHEL  6
nano +457 /etc/php.ini

memory_limit = 128M
(Ctl-x > y > ENTER)

RHEL 5
nano +573 /etc/php.ini

RHEL 6
nano +878 /etc/php.ini

upload_max_filesize = 20M
(Ctl-x > y > ENTER)

RHEL 5
nano +327 /etc/httpd/conf/httpd.conf

RHEL 6
nano +338 /etc/httpd/conf/httpd.conf

AllowOverride All
(Ctl-x > y > ENTER)

Make the changes take effect.
service httpd restart

Download and unpack sugarcrm and rename it "crm" (or whatever you want to call the webroot directory)
cd /var/www/html
wget http://www.sugarforge.org/frs/download.php/8724/SugarCE-6.3.1.zip
unzip SugarCE-6.3.1.zip
mv SugarCE-Full-6.3.1 crm

Set ownership and permissions
This is an important step that has to be correct in order for the install to work and for sugarcrm to run correctly.  User and group ownership needs to be set to whatever user and group ownership are set to in Apache.

If unsure what Apache user/group ownership is set to:

RHEL 5
nano -v +231 /etc/httpd/conf/httpd.conf

RHEL 6
nano -v +242 /etc/httpd/conf/httpd.conf

Default is "apache".  You can set it to whatever you want as long as you make the sugarcrm folders the same.  We are going to keep the defaults in this procedure. The "-R" means that in addition to the root folder we are going to recursively set all subfolders and all files in those folders as well.

chown -R apache:apache /var/www/html/crm

SugarCRM recommends permissions set to 755
chmod -R 755 /var/www/html/crm

Before running the install we should set mysql root password.  This is the database administrator password that the sugarcrm installer will ask for so it can create the sugarcrm database.

For this example we are making the password somepassword.
mysqladmin -u root password 'somepassword'

Now run the sugarcrm setup wizard from a webbrowser replacing serverIP with the IP address of your server.
http://ServerIP/crm/install.php

When you get to the database configuration screen you can leave database name at default
Database Name = sugarcrm

Assuming you have followed this guide and are therefore installing sugarcrm on the same machine as the database:
Host Name = localhost

Change password to whatever you used when setting mysql root password above.
Database Administrator Username = root
Database Administrator password = somepassword

Sugar Database Username.   Probably best to define a user.
Sugar Database Username = someusername
Sugar Database password = someotherpassword

Choose Demo Data.  If you are new to sugarcrm and want to see what it looks like with typical data choose yes.  You can delete the data later.  Otherwise choose no.

After you log in the first time you should see a confirm settings page.  Check for any errors or warnings and modify as necessary.  If you don't have IMAP installed you will get a warning which should explain that it is required for inbound email campaigns only.  Remember to restart httpd for any changes to /etc/php.ini to take effect.

Lastly, setup crontab schedule as explained at the bottom of the confirm settings page.

First change default editor to nano then add the cron job.
export EDITOR=nano
crontab -e
*  *  *  *  *   cd /var/www/html/crm; php -f cron.php > /dev/null 2>&1

You can verify it was added by checking:
nano -v /var/spool/cron/root

It's best to use the crontab -e command to edit this file.  Editing directly is not recommended

Press install.  

The rest of the settings from here on are self explanatory GUI based administrator level.  Make sure to complete them before exiting otherwise ownership isn't set correctly for the theme and cache folder which gets created at the very end.  If that happens you will see strange formatting on your screen with things scattered all over the place.  

If you find yourself with this problem or with a problem of the screen being blank after logging in then try the chown -Rcommand above once again.

How to Install OpenVPN and PPTP on RHEL v6

This procedure can be used to install OpenVPN and/or PPTP VPN access on a Redhat Enterprise Linux v6 server or OpenVZ RHEL v6 virtual server.  For OpenVZ you also require root access to the physical server or you need your service provider to enable virtual server access to tun and ppp on the physical server for you. 

This install procedure was tested on CentOS v6 using the 64bit distribution.  I have not tried on v5 or 32bit distribution.  For pptp on an OpenVZ virtual server I believe your OS needs to be the same bit type as the physical server.  Ie. if the OpenVZ physical server is 64bit then your virtual server OS must also be 64bit in order for pptp to work

Software used:

CentOS v6 x86_64

Linux commands executed at a command prompt are in courier font.

Let's get started

If you are installing Linux from scratch using Anaconda via install CD select "minimal" and proceed with the install which will install with no groups.   Skip down to the yum -y update part.

Otherwise, it is assumed you already have a server with a base CentOS installation before you begin.  Do NOT install a GUI such as Gnome or KDE.  We only want to be running in console text mode not GUI graphics mode.  If you already have a desktop or server GUI installed you will want to exit to console mode.  You do that by typing init 3 from a terminal or console window.  You will need to be logged in as root in order to do this so if not you can su root.  All instructions in this guide are assuming you are always logged in as root.

Get rid of all installed groups except 'Yum Utilities' so we are starting with a clean slate.  Check the delete list before entering 'y' to make sure none of these remove 'sshd' or 'yum' (they don't but check just in case things change with newer revisions).

yum grouplist installed

Installed Groups:
   DNS Name Server
   Editors
   Legacy Network Server
   Mail Server
   Network Servers
   System Tools
   Text-based Internet
   Web Server
   Windows File Server
   Yum Utilities

DNS Name Server'
yum groupremove 'Editors'
yum groupremove 'Legacy Network Server'
yum groupremove 'Mail Server'
yum groupremove 'Network Servers'
yum groupremove 'System Tools'
yum groupremove 'Text-based Internet'
yum groupremove 'Web Server'
yum groupremove 'Windows File Server'

Now update the base install

yum groupinstall core
yum groupinstall base
yum update

Check if tun is active

Required for OpenVPN

cat /dev/net/tun
File descriptor in bad state
If you see something like device not found that means tun is not active and we need to load it.  With root access to the physical server load tun.

modprobe tun
at which point
lsmod | grep tun
should return something like
tun          19221  2

Create a file so that this occurs automatically on reboot.  Again, this needs to be done on the physical server. Not on the virtual server if that is what you are running.
nano /etc/sysconfig/modules/vpn.modules

#!/bin/sh
/sbin/modprobe tun

Make it executable
chmod +x /etc/sysconfig/modules/vpn.modules

If you are using a virtual server on OpenVZ you also need to do the following on the physical server so that the virtual server can use the tun device (change CTID=101 to your container ID):
CTID=101
vzctl set $CTID --devnodes net/tun:rw --save
vzctl set $CTID --devices c:10:200:rw --save
vzctl set $CTID --capability net_admin:on --save
vzctl exec $CTID mkdir -p /dev/net
vzctl exec $CTID chmod 600 /dev/net/tun

You may need to reboot the virtual server afterwards.

Check if ppp is active

Do this on the virtual server if using OpenVZ virtual server.  This is required for pptp to work:
yum install ppp
pppd

You should see gibberish similar to the following which will continue for about 30seconds then return to command prompt.
~�}#�!}!}!} }4}"}&} } } } }%}&)Q�}4}'}"}(}"p})

If you get an error message instead you may need to load the ppp modules on the physical server
modprobe ppp_async
modprobe ppp_deflate
modprobe ppp_mppe
at which point
lsmod | grep ppp
should return something like
ppp_mppe         6420  2
ppp_deflate        9793  2
zlib_deflate         21977  1 ppp_deflate
ppp_async          15169  1
crc_ccitt              6337  1 ppp_async
ppp_generic        30165  6 ppp_deflate,ppp_async
slhc                     10561  1 ppp_generic
 

Create a file or add to existing file so that the ppp modules are automatically loaded on reboot.  Again, this is required on the physical server only.
nano /etc/sysconfig/modules/vpn.modules

#!/bin/sh
/sbin/modprobe ppp_async
/sbin/modprobe ppp_deflate
/sbin/modprobe ppp_mppe


Make it executable
chmod +x /etc/sysconfig/modules/vpn.modules
 

If you are using a VPS on OpenVZ virtual server you also need to do the following on the physical server so that the VPS container can use the ppp device (change CTID=101 to your container ID):
CTID=101
vzctl set $CTID --features ppp:on --save
vzctl set $CTID --devices c:108:0:rw --save
vzctl exec $CTID mknod /dev/ppp c 108 0
vzctl exec $CTID chmod 600 /dev/ppp

You may need to reboot the virtual server afterwards.

Install packages

if not using a physical server this is done on the virtual server

yum install yum install gcc make rpm-build autoconf.noarch zlib-devel pam-devel openssl-devel ppp

Install OpenVPN

We currently use the repoforge repository for Openvpn.  Using the epel or Openvpn repositories are not recommended because they currently do not include the openvpn pam authentication module which is used for the preferred authentication method.  If you use one of those repositories you will have to alter this procedure to use a different Openvpn authentication method.
rpm -Uvh http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.i686.rpm
or for 64bit OS use
rpm -Uvh http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm

yum install openvpn

Install pptp

rpm -Uvh http://poptop.sourceforge.net/yum/stable/rhel6/x86_64/pptpd-1.3.4-2.el6.x86_64.rpm

Configure OpenVPN

cp -R /usr/share/doc/openvpn*/easy-rsa/ /etc/openvpn/
nano /etc/openvpn/easy-rsa/2.0/vars
change
export KEY_CONFIG=`$EASY_RSA/whichopensslcnf $EASY_RSA`
to
export KEY_CONFIG=/etc/openvpn/easy-rsa/2.0/openssl-1.0.0.cnf

Create the certificate:

cd /etc/openvpn/easy-rsa/2.0
chmod 755 *
source ./vars
./vars
./clean-all

Build Certificate Authority

./build-ca
Country Name: may be filled or press enter
State or Province Name: may be filled or press enter
City: may be filled or press enter
Org Name: may be filled or press enter
Org Unit Name: may be filled or press enter
Common Name: your server hostname
Email Address: may be filled or press enter

Generate certificate & private key for server

./build-key-server server

Almost the same as build.ca
Common Name: server
A challenge password: leave blank
Optional company name: fill or enter
sign the certificate: y
1 out of 1 certificate requests: y

Generate Diffie Hellman parameters

./build-dh

Create Server Config file 

See /usr/share/doc/openvpn-2.2.2/sample-config-files/server.conf for reference.  You can also copy that file over and edit if you prefer:

nano /etc/openvpn/server.conf
And enter the following:

local 11.22.33.44 #- your_server_ip goes here
port 1194 #- port
proto udp #- protocol
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
# if you install openvpn with a repository other than rpmforge the following module may not be installed and openvpn may not start
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login
client-cert-not-required
username-as-common-name
server 10.9.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status 1194.log
verb 3

See if openvpn starts

service openvpn start
if this doesn't work double check the server.conf file

configure start on reboot

chkconfig openvpn on

Configure pptp

nano /etc/pptpd.conf
make sure the following lines are added if they do not already exist.
require-mschap-v2
require-mppe-128
ms-dns 8.8.4.4
ms-dns 8.8.8.8
# replace the following with your server IP
localip 11.22.33.44
# replace the following with the desired private IP 
# and range handed out to connecting pptp clients
# the private IP should not be on the same subnet 
# as openvpn to avoid problems.
remoteip 10.10.0.1-100

 

Create OpenVPN usernames and passwords

useradd username -s /bin/false
passwd username

If you wanted to delete a user you would use:
userdel username

Now create a server.ovpn config file and enter the following:

client
dev tun
proto udp
remote 11.22.33.44 1194 # - Your server IP and OpenVPN Port
resolv-retry infinite
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ca ca.crt
auth-user-pass
comp-lzo
verb 3

Make sure you change 11.22.33.44 to your server IP.

Download ca.crt file in /etc/openvpn/easy-rsa/2.0/keys/ directory and place it in the same directory as your server.ovpn in your OpenVPN client

Now download a OpenVPN client and import your config file and enter your username and password created above

 

Create pptp usernames and passwords

nano /etc/ppp/chap-secrets

username1  pptpd  password1  *
username2  pptpd  password2  *
where the format is [username] [space] [server] [space] [password] [space][IP addresses]

start pptp

service pptpd start
enable start on reboot
chkconfig pptpd on

Configure IPTables NAT

This is required for Openvpn and pptp.

If using a phyical server
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

If using an OpenVZ virtual server
iptables -t nat -A POSTROUTING -j SNAT --to-source 11.22.33.44
and replace 11.22.33.44 with your virtual server ip

If you have other iptables rules that prevent everything by default you also need to open up the required ports.  pptp also requires gre protocol enabled (ie. iptables -A INPUT -i eth0 -p gre -j ACCEPT)

service iptables save

Enable IP packet forwarding

This is required for Openvpn and pptp

nano /etc/sysctl.conf
and change the following line
net.ipv4.ip_forward = 1

run the following to enable the change immediately

sysctl -p

Troubleshooting

If you have problems connecting to some websites via pptp such as godaddy.com whereas other websites such as google.com work fine you may have an mtu problem.  If you do a search you will find a lot of posts instructing people to add an mtu setting to various configuration files.  However, none of that seems to affect the mtu setting of the ppp device that is created when clients connect.  To see if you have this problem do an ifconfig while a pptp client is connected.  You will see a venet0 or eth0 device with an mtu of 1500 or perhaps some other number.  However your mtu for the connected client (first client is ppp0, second is ppp1 etc.) device might be something like 1396.

In order to verify this fix works, from command line type ifconfig ppp0 mtu 1500 assuming we want to fix the first connected client (ie. ppp0) and assuming our mtu for venet0 or eth0 is 1500.  If that works add the following to /etc/ppp/ip-up. Alternatively, create a file /etc/ppp/ip-up.local and chmod +x /etc/ppp/ip-up.local.  Adding the following makes the change occur automatically each time a client connects via pptp because a new pppX device is created each time a client connects.

/sbin/ifconfig $1 mtu 1500

Where "$1" is the pppX variable of each connecting client as assigned in /etc/ppp/ip-up script.

Change the 1500 to whatever mtu your venet0 or eth0 is set to.  If you try put that mtu setting somewhere else such as /etc/ppp/options.pptpd or /etc/ppp/options it will NOT effect the mtu setting of connecting clients and therefore will not solve this particular problem.