A practical guide to Fedora and Red Hat Enterprise Linux, 7th Edition (2014)

---

Objectives

After reading this chapter you should be able to:

List and describe the uses of each hardware component of wired and wireless LANs

Determine which network interface card is installed in the local Linux system

List the software settings required to communicate on a network

Use NetworkManager to configure the system to use static network settings

List several types of network services and their uses

Monitor devices on the network using Cacti

Networks allow computers to communicate and share resources. A LAN (local area network; page 284) connects computers at one site, such as an office, a home, or library, and can allow the connected computers to share an Internet connection, files, and a printer. Smart homes make extensive use of networks. Of course, one of the most important reasons to set up a LAN is to allow systems to communicate while users enjoy multiplayer games.

This chapter covers the two aspects of configuring a LAN: setting up the hardware and configuring the software. It is not necessarily organized in the order you will perform the tasks involved in setting up a particular LAN. Instead, read the chapter through, figure out how you will set up your LAN, and then read the parts of the chapter in the order appropriate to your setup. The final section discusses how to monitor devices on a network using Cacti.

More Information

Web

Router operating systems: www.smoothwall.org, www.pfsense.com, m0n0.ch/wall

NetworkManager: projects.gnome.org/NetworkManager

Wireless NIC drivers: wireless.kernel.org/en/users/Drivers

PCI vendors, devices, and ID numbers: pciids.sourceforge.net/pci.ids and www.pcidatabase.com/reports.php?type=tab-delimeted.

NdisWrapper: sourceforge.net/projects/ndiswrapper

Cacti: cacti.net, cacti.net/additional_scripts.php

Cacti manual: cacti.net/downloads/docs/html

Cacti forums: forums.cacti.net

Cacti plugins and extensions: cacti.net/additional_scripts.php

RRDtool: oss.oetiker.ch/rrdtool

SNMP: www.net-snmp.org

Hardware compatibility list: hardware.redhat.com

Time zone list: php.net/date.timezone

HOWTOs

Linux Wireless LAN HOWTO: www.hpl.hp.com/personal/Jean_Tourrilhes/Linux

Wireless HOWTO

Linux Hardware Compatibility HOWTO

Setting Up the Hardware

Each system, or node, on a LAN must have a NIC (network interface card), and each system must connect to a central switch (or hub if it is an older setup). If the LAN is connected to another network, such as the Internet, it must also have a router.

Connecting the Computers

Computers are connected to a network using cables (wired; page 285) or radio waves (wireless or Wi-Fi, page 287). The cables can connect to a variety of devices, some of which are described in this section. See “LAN: Local Area Network” on page 284 for an explanation of cables and definitions of hub, switch, and router.

In the simple star network shown in Figure 16-1, four computers are connected to a single hub or switch. Assume computers 1 and 2 are communicating at the same time as computers 3 and 4. With a hub (page 285), each conversation is limited to a maximum of half the network bandwidth. With a switch (page 285), each conversation can theoretically use the full network bandwidth.

Figure 16-1 A simple star network

WAP (wireless access point)

A WAP (wireless access point) connects a wireless network to a wired one. Typically a WAP acts as a transparent bridge, forwarding packets between the two networks as if they were one. If you connect multiple WAPs in different locations to the same wired network, wireless clients can roam transparently between the WAPs.

Wireless networks do not require a hub or switch, although a WAP can optionally fill the role of a switch. In a wireless network, the bandwidth is shared among all nodes within range of one another; the maximum speed is limited by the slowest node.

Routers

A router (page 287) connects a LAN to another network, such as the Internet. A router can perform additional functions, the most common of which is allowing several systems to share a single Internet connection and IP address (NAT; page 910). With NAT, the packets from all systems on the LAN appear to come from a single IP address; the router passes return packets to the correct system. A router can also provide firewall services.

You have several choices for routers:

• A simple hardware router is relatively cheap and does most of the things required by a small network.

• You can set up a Fedora/RHEL system as a router. The Linux kernel can use firewalld (page 898) or iptables (page 908) to implement a firewall to help protect a system.

• The DSL or cable modem supplied by an ISP is a router and can also function as a firewall.

• You can use a special-purpose distribution/operating system tailored for use as a router. For example, Smoothwall (www.smoothwall.org), pfSense (www.pfsense.com), Shorewall (shorewall.net), redWall (www.redwall-firewall.com), and m0n0wall (m0n0.ch/wall) provide browser-based configurations in the style of a hardware router.

NIC: Network Interface Card

The NIC for a system can be built into the motherboard or it can be a separate Ethernet card (wired or wireless).

Supported NICs

Linux supports most wired and many wireless Ethernet NICs. For a list of drivers for wireless NICs, visit wireless.kernel.org/en/users/Drivers.

Unsupported wireless NICs

If a wireless network card is not supported under Linux directly, you might be able to get it to work with NdisWrapper (sourceforge.net/projects/ndiswrapper), which uses Win32 drivers. NdisWrapper is a kernel module that provides a subset of the Windows network driver API. No Fedora/RHEL package contains this program.

Wireless bridge

An alternative to a wireless NIC is a wireless bridge. A wireless bridge forwards packets between wired and wireless interfaces, eliminating the need for wireless drivers. This simple device has an Ethernet port that plugs into a NIC and an 802.11 (wireless) controller. Although carrying a bridge around is usually not feasible for mobile users, a wireless bridge is an easy way to migrate a desktop computer to a wireless configuration.

Ad hoc and infrastructure modes

Wireless networks operate in either ad hoc or infrastructure mode. In ad hoc mode, individual nodes in the network communicate directly with one another. In infrastructure mode, nodes communicate via a WAP (previous page). Infrastructure mode is generally more reliable if the wireless LAN must communicate with a wired LAN.

If you do not want to use a WAP, it might be possible to set up a wireless bridge so it acts as a WAP. Consult the NIC/driver documentation for more information.

Tools

This section describes four tools you can use to examine system hardware.

lspci: Lists PCI Information

PCI (Peripheral Component Interconnect) devices include network, sound, video, and TV tuner cards; modems; USB ports; and disk controllers. For information about PCI vendors, devices, and ID numbers visit pciids.sourceforge.net/pci.ids and www.pcidatabase.com/reports.php?type=tab-delimeted. The lspci utility (pciutils package) lists PCI device information:

$ lspci
00:00.0 Host bridge: Intel Corporation 440BX/ZX/DX - 82443BX/ZX/DX Host bridge (rev 01)
00:01.0 PCI bridge: Intel Corporation 440BX/ZX/DX - 82443BX/ZX/DX AGP bridge (rev 01)
00:07.0 ISA bridge: Intel Corporation 82371AB/EB/MB PIIX4 ISA (rev 08)
00:07.1 IDE interface: Intel Corporation 82371AB/EB/MB PIIX4 IDE (rev 01)
00:07.3 Bridge: Intel Corporation 82371AB/EB/MB PIIX4 ACPI (rev 08)
00:07.7 System peripheral: VMware Virtual Machine Communication Interface (rev 10)
00:0f.0 VGA compatible controller: VMware SVGA II Adapter
00:10.0 SCSI controller: LSI Logic / Symbios Logic 53c1030 PCI-X Fusion-MPT Dual Ultra320 SCSI (rev 01)
00:11.0 PCI bridge: VMware PCI bridge (rev 02)
...
02:00.0 USB controller: VMware USB1.1 UHCI Controller
02:01.0 Ethernet controller: Intel Corporation 82545EM Gigabit Ethernet Controller (Copper) (rev 01)
02:02.0 Multimedia audio controller: Ensoniq ES1371 [AudioPCI-97] (rev 02)
02:03.0 USB controller: VMware USB2 EHCI Controller

With the –v option, lspci is more verbose. You can use the –vv or –vvv option to display even more information.

$ lspci -v | head -14
00:00.0 Host bridge: Intel Corporation 440BX/ZX/DX - 82443BX/ZX/DX Host bridge (rev 01)
Subsystem: VMware Virtual Machine Chipset
Flags: bus master, medium devsel, latency 0
Kernel driver in use: agpgart-intel

00:01.0 PCI bridge: Intel Corporation 440BX/ZX/DX - 82443BX/ZX/DX AGP bridge (rev 01) (prog-if 00 [Normal decode])
Flags: bus master, 66MHz, medium devsel, latency 0
Bus: primary=00, secondary=01, subordinate=01, sec-latency=64

00:07.0 ISA bridge: Intel Corporation 82371AB/EB/MB PIIX4 ISA (rev 08)
Subsystem: VMware Virtual Machine Chipset
Flags: bus master, medium devsel, latency 0

00:07.1 IDE interface: Intel Corp 82371AB/EB/MB PIIX4 IDE (rev 01) (prog-if 8a [Master SecP PriP])

lsblk: Lists Block Device Information

The lsblk utility (util-linux package) lists block devices in a tree format that shows which filesystems are mounted on each device.

$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 200G 0 disk
+-sda1 8:1 0 500M 0 part /boot
+-sda2 8:2 0 199.5G 0 part
+-fedora-swap 253:0 0 2G 0 lvm [SWAP]
+-fedora-root 253:1 0 50G 0 lvm /
+-fedora-home 253:2 0 147.5G 0 lvm /home
sr0 11:0 1 1024M 0 rom

lshw: Lists Hardware Information

The lshw utility (lshw package) lists information about the hardware configuration of the local system. Run this utility with root privileges to display a more detailed report. The –short option displays a brief report.

# lshw -short
H/W path Device Class Description
======================================================
system VMware Virtual Platform ()
/0 bus 440BX Desktop Reference Platform
/0/0 memory 87KiB BIOS
/0/4 processor Intel(R) Core(TM)2 Quad CPU Q9650 @ 3.00GHz
/0/4/54 memory 16KiB L1 cache
/0/4/55 memory 6MiB L2 cache
/0/5 processor CPU
...
/0/100 bridge 440BX/ZX/DX - 82443BX/ZX/DX Host bridge
/0/100/1 bridge 440BX/ZX/DX - 82443BX/ZX/DX AGP bridge
/0/100/7 bridge 82371AB/EB/MB PIIX4 ISA
/0/100/7.1 storage 82371AB/EB/MB PIIX4 IDE
/0/100/7.3 bridge 82371AB/EB/MB PIIX4 ACPI
/0/100/7.7 generic Virtual Machine Communication Interface
/0/100/f display SVGA II Adapter
/0/100/10 scsi2 storage 53c1030 PCI-X Fusion-MPT Dual Ultra320 SCSI
/0/100/10/0.0.0 /dev/sda disk 214GB SCSI Disk
/0/100/10/0.0.0/1 /dev/sda1 volume 500MiB EXT4 volume
/0/100/10/0.0.0/2 /dev/sda2 volume 199GiB Linux LVM Physical Volume partition
/0/100/11 bridge PCI bridge
/0/100/11/0 bus USB1.1 UHCI Controller
/0/100/11/1 ens33 network 82545EM Gigabit Ethernet Controller (Copper)
/0/100/11/2 multimedia ES1371 [AudioPCI-97]
/0/100/11/3 bus USB2 EHCI Controller
...

lsusb: Lists USB Devices

The lsusb utility (usbutils package) displays information about USBs and USB devices. Use the –v (––verbose) option to display additional information.

$ lsusb
Bus 002 Device 002: ID 0e0f:0003 VMware, Inc. Virtual Mouse
Bus 002 Device 003: ID 0e0f:0002 VMware, Inc. Virtual USB Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
Bus 002 Device 004: ID 04f9:0033 Brother Industries, Ltd

Configuring the Systems

After the hardware is in place, each system must be configured so it knows about the NIC that connects it to the network. Normally the system detects and configures new hardware automatically when you install Fedora/RHEL or the first time you boot it after you install a NIC. You can use NetworkManager (next page) to augment the information Fedora/RHEL collects or to set up things differently: For a server, you might want to assign a static IP address to the NIC and not use DHCP (page 641).

System information

In addition to information about the NIC, each system needs to be configured with:

• The system’s IP address (page 1256)

• The netmask (network mask or subnet mask) for the system’s address (page 483)

• The IP address of the router or gateway (page 633)

• The IP addresses of the nameservers (DNS addresses—specify two or three for more reliable network connections) unless you specify IP addresses in the /etc/hosts file (page 507)

• The system’s hostname (set when you install Linux or run hostnamectl [page 219])

If a DHCP server (page 491) distributes network configuration information to systems on the LAN, you do not need to specify the preceding information on each system. Instead, you just specify that the system is using DHCP to obtain this information (which Fedora/RHEL does by default). You must specify this information when you set up the DHCP server.

Private address space

When you set up a LAN, the IP addresses of the systems on the LAN are generally not made public on the Internet. Special IP addresses, which are part of the private address space defined by IANA (page 1254), are reserved for private use and are appropriate to use on a LAN (Table 16-1). Unless you have been assigned IP addresses for the systems on the LAN, choose addresses from the private address space.

Table 16-1 Private IP ranges (defined in RFC 1918)

NetworkManager: Configures Network Connections

By default, the NetworkManager daemon (projects.gnome.org/NetworkManager) configures and manages the network. When it detects a new wired or wireless connection, NetworkManager starts the appropriate interface. For a wireless connection, it prompts for and stores keys and passwords. It also detects new hardware—for example, when you plug a USB wireless adapter into the system.

NetworkManager applet

The NetworkManager applet appears toward the right end of the Top panel. It appears as an outline of a monitor when the system is using a wired connection and as a series of radiating curves when the system is using a wireless connection (Figure 16-2). Exactly what appears when you click the NetworkManager applet depends on the system hardware and the items you have previously set up.

Figure 16-2 The NetworkManager applet on the Top panel

The NetworkManager Applet Menu

Right- or left-click the NetworkManager applet to display the NetworkManager applet menu that allows you to turn on/off wired networking and, if available, wireless networking (Wi-Fi). With wireless networking turned on, this menu also displays a list of available wireless networks (Figure 16-3). Click the switch adjacent to Wired or Wi-Fi to enable or disable the respective service.

Figure 16-3 The NetworkManager applet menu

With wireless networking turned on, click the name of a wireless network (under the word Wi-Fi) to connect to that network. The NetworkManager applet shows activity while it connects to the new network. It then prompts for a password if one is required and displays the wireless applet (Figure 16-2). Normally NetworkManager uses DHCP (page 491) to set up the network automatically so you do not have to open the Network window.

The Network Window

Selecting Network Settings from the NetworkManager menu displays the Network window (Figure 16-4), which allows you to modify the configuration of wired and wireless NICs. Alternately, you can open this window from the Settings window (page 107) or by giving the commandgnome-control-center network from an Enter a Command window (ALT-F2) or a terminal emulator.

Figure 16-4 The Network window showing a Wired NIC

The frame on the left side of the Network window holds a list of the available types of networks. The list matches the list in the NetworkManager menu and can include Wired and Wi-Fi. When you click the plus sign (+) at the bottom of the this list, the Network window gives you the choice of which type of NIC you want to add (VPN, bond, bridge, or VLAN). However, this step is not normally necessary because NetworkManager configures NICs automatically. See “Identity” on the next page for a method of naming multiple NICs of the same type. Click the minus sign (–) to remove a NIC (if NetworkManager permits you to do so).

See page 643 if you want to modify the connection of a wireless NIC. To modify the configuration of a wired NIC, highlight the description of the connection you want to modify (Wired) and click the gear at the lower-right of the window; NetworkManager displays a window named for the type of connection (i.e., Wired; Figure 16-5).

Figure 16-5 The Wired window, Details screen

The Wired/Wi-Fi Window

The Wired window (Figure 16-5) holds a list of screens in the frame on the left. Click an item in the list to display the corresponding screen. The Wi-Fi window (Figure 16-8, page 643) holds the same list. You can change most of the items in these screens. The list includes

• Details—Lists connection information including IP, MAC, and DNS addresses. You cannot make changes in this screen.

• Security—For a wired connection, displays and allows you to turn on/off and modify 802.1x PNAC (port-based Network Access Control). For a Wi-Fi connection, displays the type of security (e.g., WEP, WPA) and password.

• Identity—Displays the name, MAC address, and other information that identifies the connection. If multiple NICs of the same type exist, this screen allows you to assign a different name to each one.

• IPv4—Displays IPv4 connection information including DHCP, network addresses, DNS addresses, and routes.

• IPv6—Displays IPv6 connection information including network addresses, DNS addresses, and routes.

• Reset—Allows you to reset or forget the connection.

The next sections describe how to use this window to set up a NIC with a static IP address and how to set up a W-Fi NIC. When you are finished making changes in these screens, click Apply.

Configuring a Static IP Address for a Wired NIC

By default, DHCP (page 491) assigns a dynamic IP address to a NIC, so the IP address might not stay the same over time. To make the server easy for clients to find on the Internet, it must have the same IP address all the time (a static IP address). See page 298 for information on static IP addresses and page 494 if you want to set up a static IP address using DHCP.

This section describes how to configure a static IPv4 address that does not use DHCP. You can perform the same task by editing the appropriate configuration file in /etc/sysconfig/network-scripts (e.g., ifcfg-ens33); see the sample file on the next page.

First, select Wired in the Network window. If there is more than one connection highlight the one you want to configure and click the gear at the lower-right. NetworkManager displays the Details screen of the Wired window (Figure 16-5).

IPv4

If you are setting up an IPv4 address, select IPv4 (Figure 16-6); for an IPv6 address, select IPv6. Make sure the switch at the upper-right (across from IPv4) is set to ON. Select Manual from the drop-down list just below the switch. Enter the IP address of the NIC, the netmask, and the IP address of the gateway (router) for the connection you are setting up.

Figure 16-6 The Wired window, IPv4 screen

Set the switch across from DNS to OFF if you want to configure DNS manually. Enter the IP address of the DNS server in the text box labeled Server. Click the plus sign (+) just below the text box to add additional DNS servers. Click the trash can at the right of a text box to remove an entry. These actions set the values of IPADDR0, PREFIX0, GATEWAY0, and DNS1 in /etc/sysconfig/network-scripts/ifcfg* (below). With no entries in the Routes section, NetworkManager sets up default routes (DEFROUTE=yes). A tick in the check box labeled Use this connection only for resources on its network limits connections to the local network.

Identity

The Identity screen has two important check boxes. A tick in the check box labeled Connect automatically causes the system to bring up the connection when it boots and sets ONBOOT=yes in ifcfg*. Without a tick you must bring up the connection manually.

A tick in the check box labeled Make available to other users causes the connection to be available to all users and to be up even when the user who set up the connection is not logged in. Without a tick, the connection is up only when the user who set up the connection is logged in. Typically you want a tick in this check box.

Activating changes

When you are finished, click Apply to update the configuration files.Turn the interface off and then on again to make the changes active.

Next is the ifcfg* file that results from running NetworkManager and following the preceding instructions. For more information about this type of file, see /usr/share/doc/initscripts-*/sysconfig.txt.

$ cat /etc/sysconfig/network-scripts/ifcfg-Wired_connection_1
HWADDR=00:0C:29:13:F4:35
TYPE=Ethernet
BOOTPROTO=none
IPADDR0=192.168.206.180
PREFIX0=24
GATEWAY0=192.168.206.2
DNS1=192.168.206.2
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=no
NAME="Wired connection 1"
UUID=d4511286-79bb-4e53-9cfc-6cfbf54ff475
ONBOOT=yes

nmcli

You can use the nmcli utility to control NetworkManager from the command line. See the nmcli man page for more information.

system-config-network

The system-config-network utility (system-config-network package) presents a simple, pseudographical window you can use to configure a device or DNS from the command line.

Wireless Settings

It is usually easier to configure a wireless connection using the NetworkManager applet menu (Figure 16-3, page 638) than using the Settings window. To use the Settings window, click Wi-Fi on the left side of the Network window (Figure 16-7); NetworkManager displays a list of wireless networks on the right. Click the gear in the line with name of the network you want to set up; if there is no gear, click the name of the network.

Figure 16-7 The Network window showing a Wi-Fi NIC

If you click the name of the network, NetworkManager might ask for a password. You do not need to enter a password at this time to set up the connection: Even if you click Cancel in the authentication window, NetworkManager will add a gear to the name of the network. Click the gear.

Setting up a wireless connection is similar to setting up a wired connection (page 641) except for the Security screen (Figure 16-8). In this screen select the type of security you want to use from the drop-down list labeled Security and enter the connection password in the text box labeledPassword. Click Apply. See “Activating changes” on page 642.

Figure 16-8 The Wi-Fi Secuity screen

Setting Up Servers

Setting up local clients and servers can make a LAN both easier to use and more useful. The following list briefly describes some clients and servers, and it references the pages that describe each in detail.

Firewall

Although not a server, a firewall is an important part of a LAN. See Chapter 25 for more information.

LDAP

LDAP is a database server that can hold names and addresses, authentication information, and other types of data. It can provide a uniform login regardless of which system you log in on. See page 786 for more information.

NIS

The NIS authentication server is covered on page 779 and the client on page 773. NIS is often combined with home directories that are mounted using NFS. Although still popular, NIS is at the end of its life: If you are setting up a new system, choose LDAP over NIS.

NFS

NFS allows you to share directory hierarchies. Sharing directories using NFS requires that the server export the directory hierarchy (page 814) and that clients mount the directory hierarchy (page 806).

Using NFS, you can store all home directories on one system and mount them from other systems as needed. This configuration works well with LDAP login authentication. With this setup, it can be convenient to create a world-writable directory—for example, /home/shared—that users can use to exchange files. If you set the sticky bit (page 1275) on this directory (chmod 1777 /home/shared), users can delete only files they created. If you do not set the sticky bit, any user can delete any file.

OpenSSH

OpenSSH tools include ssh (logs in on a remote system; page 693) and scp (copies files to and from a remote system; page 695). You can also set up automatic logins using OpenSSH: If you set up a shared home directory using NFS, each user’s ~/.ssh directory (page 688) is the same on each system; a user who sets up a personal authentication key (page 700) will be able to use OpenSSH tools between systems without entering a password. See page 700 for information on how to set up an OpenSSH server. You can use the ssh and scp clients as installed—you do not have to set them up.

DNS cache

Setting up a local DNS cache can reduce the traffic between the LAN and the Internet and can improve response times. For more information refer to “JumpStart I: Setting Up a DNS Cache” on page 866.

DHCP

DHCP enables a client system to retrieve network configuration information from a server each time it connects to a network. See page 491 for more information.

Samba

Samba allows Linux systems to participate in a Windows network, sharing directories and printers, and accessing those directories and printers shared by Windows systems. Samba includes a special share for accessing users’ home directories. For more information on the [homes] share see page 840.

You can also use Samba to set up a shared directory similar to the one described under “NFS.” To share a Linux directory with Windows computers, the value of Workgroup in /etc/samba/smb.conf must be the same as that of the Windows workgroup (frequently MSHOME or WORKGROUP by default). Place the following code in smb.conf (page 841):

[public]
comment = Public file space
path = /home/shared
read only = no
public = yes
browseable = yes

By default, SELinux will not allow you to share your home directory. Use system-config-selinux (page 475) to activate the samba_enable_home_dirs Boolean if you want to allow sharing. Any Windows or Mac user can access this share, which can be used to exchange files between users and among Linux, Mac, and Windows systems.

Introduction to Cacti

Cacti (cacti.net) is a network monitoring tool that graphs system and network information over time (time-series data) and provides a comprehensive Web interface for browsing and examining the ongoing performance of the devices on a network.

For example, Cacti can monitor the network traffic passing through the network ports on local servers and the switch and router ports on the local network. Cacti graphs provide information on traffic levels on the various parts of the network. When the network is slow, for example, you can refer to the historical graphs and see if anything out of the ordinary has occurred. In addition to network traffic levels, Cacti can collect data on CPU usage, disk space usage, page views on a Web server, and almost any other data points available on the local network.

Cacti collects baseline (typical) data over time. You can use that information to gain insight into the ongoing behavior of a system and network, and to help resolve problems. The information can even predict what might happen in the future (e.g., when a disk is likely to become full).

Cacti periodically polls devices on a network for the data it needs, and stores the data in RRD files for use with RRDtool (round-robin database tool; oss.oetiker.ch/rrdtool). The Cacti Web interface allows you to browse a list of devices and graphs and see visual representations of device activity over time.

Cacti builds on the lessons learned from tools such as MRTG (oss.oetiker.ch/mrtg; page 975) and Cricket (sourceforge.net/projects/cricket). Each of these tools has the following characteristics:

• Periodically polls tracked devices for data. The tool most commonly used to collect this data is SNMP (Simple Network Management Protocol; www.net-snmp.org).

• Stores the data in an RRD file.

• Has a Web interface that allows you to examine graphs generated from the stored data. These graphs typically display daily, weekly, monthly, and yearly information.

Cacti’s configuration is performed through its Web interface, whereas MRTG and Cricket are configured by editing text files.

RRD files and RRDtool are the key to much of Cacti’s functionality. The Cacti Web site describes Cacti as “the complete RRDtool-based graphing solution.” RRD files store time-series data efficiently and, through the use of aggregation functions, make it easy to keep a lot of detail for recent time periods but progressively less detail as the data in the files ages. RRDtool easily generates both simple and complex graphs from RRD files.

Extending Cacti

Many extensions and plugins are available for Cacti. Once you are familiar with the basic use and operation of Cacti, visit cacti.net/additional_scripts.php for a partial list of these additions. Also visit the documentation and the user forums at the same site to obtain more information about Cacti and to learn how you can add functionality and support for different devices and data sources.

Configuring SNMP

To monitor data sources on a system, you must install and run the SNMP daemon on that system as explained under “Setting Up a Data Source” on page 652. Displaying the automatically generated default graphs based on the local system is a good way to check that Cacti is working. To do so you must install and run the SNMP daemon on the local system. However, see the tip on page 647.

Setting Up LAMP

Cacti is a LAMP (Linux, Apache, MariaDB/MySQL, PHP) application; you must install and configure these applications before you can configure Cacti. This section explains how to set up the software on the system running Cacti.

Notes

See page 1114 for an explanation of why MySQL is now MariaDB.

When you set up LAMP, you use the MariaDB/MySQL databases named mysql and cacti. Fedora/RHEL sets up the mysql database when you install the MySQL/ MariaDB server. You set up and populate the cacti database as explained under “Configuring MariaDB” on the next page.

The following database users must be set up. Each of these accounts should have a password:

• A user named root for the database named mysql. This user must be named root. The MariaDB installation script sets up this user.

• A user named cactiuser for the database named mysql. You can change this username, but as installed, Cacti is set up to use cactiuser.

• A Cacti administrative user for the database named cacti. As set up when you install Cacti, this user has the name admin and the password admin. You can set up additional Cacti user accounts.

As of this writing, Fedora/RHEL has Cacti 0.8.8a-8 in its repositories. Do not be misled by the pre-1.0 version number: Cacti is stable and in use on many systems.

Prerequisites

Install the following packages:

• cacti

• mariadb (page 1118)

• mariadb-server (page 1118)

• php (installed with cacti)

• httpd (Apache; page 931; installed with cacti)

• rrdtool (installed with cacti)

• net-snmp (optional; needed only to monitor the local system)

• net-snmp-utils (optional)

Firewall

If you want to work with Cacti from a browser on a system other than the one running Cacti, and the system running Cacti is running a firewall or is behind a firewall, you need to open TCP port 80 on the system running Cacti. Give the following commands to open the port each time the system boots (permanently) and on the running system; see page 906 for information on firewall-cmd.

# firewall-cmd --add-port=80/tcp
# firewall-cmd --permanent --add-port=80/tcp

SELinux

When SELinux is set to use a targeted policy, httpd on the system running Cacti is protected by SELinux. For more information refer to “Setting the Targeted Policy with system-config-selinux” on page 475.

Configuring MariaDB

Install MariaDB and run systemctl to enable and start the mysqld daemon as explained under “Installing a MariaDB Server and Client” on page 1118. Be sure to assign a password to the MariaDB user named root by using either or mysqladmin or mysql_secure_installation. For more help, see “Setting Up MariaDB” on page 1119.