|Revision v0.2||2003-05-02||Revised by: FM|
|Various updates, but still no configuration files as example|
|Revision v0.1||2002-12-28||Revised by: FM|
|Creation of this HOWTO|
This document demonstrates how to set up a Linux server to provide conferencing facilities in various locations as well as to provide Internet Access. The system is based around a GNU/Linux PC with a wireless network. The system can be used for conferences as well as for setting up a wireless extranet to the organisation.
Dear reader, you may be involved in organising conferences or just simple meeting. You know that it is sometime difficult for some participants to attend such meetings, travel costs, hotel bookings, important deadlines to meet, while they could be listening to the proceeding from work and interact from time to time with the speakers. I wanted to leverage my knowledge of Linux to provide an all in one solution on one machine to provide, Internet access to participants and allow everybody with an Internet connection to participate in the meeting.
Please, send me additional paragraphs and corrections. I can be reached at the following address:email@example.com.
This HOWTO is published on The Linux Documentation Project this is where you will find the latest version of this document.
This document is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
In short, if the advises given here break the security of your e-commerce application, then tough luck- it's never our fault. Sorry.
Copyright (c) 2002 by Franck Martin under GFDL (the GNU Free Documentation License).
Please freely copy and distribute (sell or give away) this document in any format. It's requested that corrections and/or comments be forwarded to the document maintainer. You may create a derivative work and distribute it provided that you:
Send your derivative work (in the most suitable format such as SGML) to the LDP (Linux Documentation Project) or the like for posting on the Internet. If not the LDP, then let the LDP know where it is available.
License the derivative work with this same license or use GPL. Include a copyright notice and at least a pointer to the license used.
Give due credit to previous authors and major contributors. If you're considering making a derived work other than a translation, it's requested that you discuss your plans with the current maintainer.
It is also requested that if you publish this HOWTO in hardcopy that you send the authors some samples for 'review purposes' :-). You may also want to send me something to cook my noodles ;-)
As indicated in the introduction, this documents is an hand-on HOWTO, and it is therefore required that you consult the man pages and documentation of the various softwares described here. I won't deal on how to install some software as nowadays RPM, APT and others do the job very well. I prefer to use this space to explain you how to configure this software for the desired effect. You should be familiar in how to install a GNU/Linux system, how to set up and troubleshoot a TCP/IP network and other “appropriate” tasks...
The main objective is to provide an hardware/software set up that allows quick relocation, re-deployment with minimum configuration. The system should allow seamless wireless access to conference participants. It should provide them Internet access (with some basic security), as well as standard resources access, directories to store and exchange files, printing facilities.
The other objectives is to provide Text/Audio/Video conferencing capabilities amongst the participants but also with other remote participants.
The whole configuration should be light, easy to ship, and easy to configure on site.
The equipment listed is indicative and should work with any other type of brand or distros. It is indicated as to provide some references on products that have proven usable in such configuration.
The base distro for GNU/Linux is the Mandrake distro. The system is installed on a standard PC, in fact an old Compaq Prosignia 800 with a Raid Card (for data security during transport). The system is installed with 2 9GB hard Drives set up in RAID 0 (mirroring for reliability). This configuration is overkill, but this was the hardware I had on hand. In fact a small PC with an IDE interface (or RAID IDE) and with an LCD screen should be the ideal configuration. There should be 2 drives set up with Raid 0 for reliability. It is to be noted that this equipment needs to be shipped so weight and reliability is required, therefore the LCD screen and mirroring the drive. A CD-RW drive is also installed to allow to do on-site archiving of the data. The PC is also installed with 2 network cards, one to connect to the Internet and one for the conference network.
For the conference network, a couple of 16 ports switches are used to provide the backbone of the network. A couple of Wireless IEEE802.11b (WiFi) hubs are added to provide Wireless Internet access to the participants laptops. It is recommended to have a few WiFi PC-Cards to lend or rent as most people are not yet used to these technologies. At the moment with 10 WiFi PC-Cards I can cater for about 50 participants (not everybody has a laptop either).
For printing, I use one or two HP Laserjet 2200DN. These machines have a network interface card that allow to locate them anywhere on the conference network backbone, they also allow heavy quality printing to quickly re-print conference papers. Conferences usually need high speed reproduction facilities, because of the sheer load of documents being circulated. Hopefully this system should alleviate the number of documents by providing them online to all participants.
The PC has 2 network cards, one to connect to the Internet (via the local ISP) and one to provide the network access to participants. The most difficult part in the set-up is to negotiate an access to the local ISP as usually conference do not run for more than a few days to a few weeks. The ISP may have to install a leased line and provide access. It is important to minimize the requirements to the ISP. Therefore the conference network uses only a private range of IP addresses (192.168.0.0/24) with the IP address 192.168.0.1 given to the Conference Network Card and one real IP address given by the ISP and assigned to the Internet Network Card (IPInt). You may need here to have a router with a serial interface connected to DSU/CSU, ADSL modem or Dial-up modem. This router will interface between your conference server and the ISP. The number of public IP addresses is higher as you have a 2 IP addresses network now, one for the conference server, one for the ethernet port of the router. Adequate routing entry in the router will have to be set accordingly.
The Linux kernel 2.4 allows easy firewalling and Network Address Translation. The iptables command allows to configure it all, but it is rather complex. The best is to use a configurator tool such as Shorewall.
Shorewall allows any computer on the Conference Network to access the Internet and also protect these computers from any intrusion from the Internet. Most people laptop are not protected by any kind of firewall and you can't imagine what a network sniffer such as Nessus can find as vulnerabilities. You provide a service to your participants by offering a limited protection from the Internet.
The firewall will also protect your server from the Internet and from all your participants.
It is recommended to install on the servers some tools like iptraf and ethereal to enable you to monitor your traffic and act accordingly. An Intrusion Detection System could be a plus there too. You can't imagine how people can be bored during conferences and will test your security and others machines security.
A DHCP server needs to be installed on the server to provide IP addresses to machines connecting on the network. The DHCP server will also provides basic configuration to the machines. Apart from the IP address you want to affect to the connecting machine, you may want to provide information on the domain name in use, the location of the DNS servers, the gateway address, the default domain name for NetBios searches. The DHCP server will reserve the IP address 192.168.0.1 for the server as well as one IP address for each networked printer.
I use Webmin to configure the server. It is the easiest tool for such configuration.
I have noticed that some laptops have their TCP/IP settings manually set and that the access to the configuration is locked by the administrator. The minimum is to have the laptop using DHCP with only the name of the machine as a parameter set up manually, all other parameters (DNS servers, domain name, domain name to use for search, gateway, etc...) should come from the DHCP server.
The wireless hubs need to be properly configured. Some wireless hub will auto-configure themselves but there are a couple of points to verify.
First, some wireless hubs have an IP address, so it is important to configure them so that they request an IP address via DHCP.
Secondly, all security systems must be disabled. We want to provide seamless access to all participants to the conference. They bring their laptop in range and they are automatically connected on the network. It means that WEP (Wireless Encryption Protocol) must be disabled and any other authentication scheme such as EAP (Enhanced Authentication Protocol) found on Cisco Wireless hubs.
Thirdly, the zone name must be identical on all wireless hubs to allow easy roaming from one hub to the other, for Instance “CONFERENCE” is suitable.
Lastly the wireless hubs must be conveniently located and their channels adjusted so that they don't interfere with each others. Each hub must be at least 5 channels apart if their range must intersect. The best configuration is the honey (or hexagonal) configuration using the 3 channels 1,6 and 11.
           
This is quite easy in a 2D environment, but can be more complicated due to the design of the rooms and also one hub can be above another one, if your conference use several floors. Fortunately latest WiFi hubs of the same brand will self configure themselves to avoid intereferences and enable roaming.
To maximize the bandwidth and as all participants will connect through the server to the Internet, it can be interesting to set up a transparent proxy or web cache. I use Squid, using iptables you can redirect all traffic from the conference network to the port 80 (HTTP) to the port of the squid proxy, 3128. Squid need to be properly configured to understand this redirection, a few directives need to be switched on.
As in all network, people will want to check their mailboxes. This is not a problem as they will be able to do so transparently using a POP or IMAP (we are using NAT). However sending e-mails may be a problem as most SMTP servers will refuse to relay mail for users outside their local IP range. You have therefore to install a basic SMTP server that will relay mail for all the machine on the conference network, i.e. all the machines on the 192.168.0.0/24 network. I use postfix for this purpose, I configure it simply just to relay mail from 192.168.0.0/24 and not to accept mail from anywhere else except the loop interface (127.0.0.1).
I put DNS at the end of this section as a DNS server is not needed to provide Internet access to your participants but is needed to provide them access to resources on the conference server.
The best option is to enter an entry for the server name into your primary DNS located on another machine, for instance conf.myorganisation.org will point to the IP given by the ISP (IPInt). You have to enter this information at least 24hours before you will use your server. The systems on the Internet will take time to update their cache. You must ensure that your primary DNS send a message to the secondary DNS that a record in the zone has been modified and that they should reload the zone. It is important for you to check that all the secondary (or slave) DNS have updated their zones. Faster it happens, quicker people will be able to access the resources on your server. To check this information use dig to query each slave. If the master is properly configured it will send an event to the slaves to inform them of a zone change. The slave will reload the zone immediately, so a zone change should be immediately reflected on the master and all the slaves, however the 24 hours period is true for any DNS out there which may have cached the previous record.
As for your conference server, the best option is to install the DNS server, Bind usually, and make it a slave of the zone containing the entry conf.myorganisation.org. In the DHCP configuration you make sure that as part of the information uploaded to the client 192.168.0.1 is one of the DNS listed. The advantage of such configuration is that even if the Internet goes down or is not available, the client on the conference network will still be able to access the resources on the conference server as this particular entry will be able to be solved by the DNS.
Finally you have to ensure on your master (or primary) DNS that the IP of your conference server is authorized to make zone transfers and is alerted of changes in the zone. This means that the file /etc/named.conf be properly edited, use Webmin it is easier.
One of the first facility to provide to the users is a place where they can share files across machines. The use of Samba is evident for such purpose. For printing access, the best option is to use CUPS, CUPS uses IPP (Internet Printing Protocol), which is easy to install and configure and that advertises itself on the network.
Samba is therefore installed, authorizing users on the conference network to access shares. One share of type public is created to allow users (guests) to exchange files. This share is set up such as people can read, write and delete all files. Another share is created called drivers that is only readable by all. This share will store all the drivers for the printers and network cards for various operating systems. It helps in configuring people laptops on the network. It is good to carry an 128MB flash card with the network drivers for the wireless PC-Cards. Some slim laptops and PDA do not have a CD-ROM drive, but they all have a PC-Card slot. The flash card (with its PC-Card adapter) is also very handy to move files from one machine to the other. In all OSes I have seen, they never required to have a software driver installed, it is bundled with the OS.
For printing, we use CUPS for the management of all networked printers. I use some HP Laserjet 2200 DN, which have a network card and are duplex. For the network card, I usually connect the printer to the network, switch on and look in DHCP leases (using Webmin) what is the MAC address of the card. I then fix this IP address by reserving a lease for the corresponding printer, say 192.168.0.10 for the first printer, 192.168.0.20 for the second, etc... It is easy for some users to find the printer as such using their IP address. It will also allow me to configure them easily under CUPS using their IP address instead of the name, in case the DNS fails. We have a network that may or may not be connected to the Internet which creates various problems.
I declare the printers using the Mandrake Control Center, which has more configuration options (drivers) than the CUPS own configuration tool. You can access the CUPS configuration tool from the conference server by starting a browser and typing HTTP://127.0.0.1:631/.
Having a naming scheme for the printers is recommended to help your participants locate them. Something like [PRINTER-NAME]-[LOCATION]: HPLJ2200DN-ROOMA
When the printers are configured and a test page properly printed, I restart Samba (service smb restart) to ensure that Samba learns about the printers and provide them as resources on the network. Unfortunately for the moment, I have not been able to configure the automatic set up of the printer drivers using samba. In theory a MS-Windows PC that wants to connect to a printer will browse the network to identify the printer, then will look for a special share on the same machine as the printer share to download and install the drivers on the MS-Windows PC. I cannot place at the moment the correct drivers and configuration on this special share. The Samba team is working on it.
During the time of a conference, you have notice boards, messages to participants, updated agenda, addendum, supplementary papers, conference documents... Agendas can be updated twice daily. A convenient web server is needed to inform participants.
I use Apache for the web server with the mod_php module.
You have to take into account that the secretariat of a conference may not be really computer literate and even tools like FrontPage may be too long for them to learn. You need something very easy, web based, with a very strict formatting. Wiki is such tool (Wiki means quick in Hawaiian). It allows you to create a themed web site by just editing online a text box. It uses special formating characters such as %link% that will create a link called link to a page called link too in the table of content. If the page does not exist yet then the link will be marked with ?link? and you will be able to edit the page. This is very easy. Wiki allow also full HTML formating with all the HTML tags, so for experts you can render tables and more complex documents. You can also upload files and images so you can use them in your pages. You then give to some people in the conference secretariat authors priviledges to this themed web site.
I use PHP-Wiki which works with PHP and there is an RPM for Mandrake.
I have made a special topic for Wiki that explains to newcomers all the settings of the network, so that when they go on the conference home page they are guided in all the capabilities of the system. It can be also advantageous to have a one page summary of the online resources offered and inserted inside the conference folder given to all participants at registration time or pre-registration time.
PHP-Nuke is a great tool to make online forums and allows many people to post and comment. This can be used as noticed board, but also can contain the papers of a particular conference and be used to have people make comments on them.
The only problem with PHP-Nuke is that there is a lot of cross-scripting vulnerabilities. I think the authors are more or less aware of the problems, but it seems more a feature before security approach. Fortunately PHP4 is establishing some more secure behavior. I think to preserve yourself is to disable the file manager by changing all the permissions of the nuke directory so that the web server cannot write to it. In our case apache should not be the owner of the directories/files.
PHP-Nuke allows anybody to post, but all posting can be reviewed by an editor, making sure that the topics stay focused.
Most conferences are difficult to attend and are located in some remote places. As I said earlier it could be difficult to attend some of them due to travel cost, location, and other job and duties. The bare minimum for conferencing is to be able to provide audio of the main sessions so you can tune in to your preferred “radio station”, then video to see what is happening and the slides presented, then some feedback may be needed so that people in the room and outside the room can interact with the presenter or make comments on what is happening.
The easiest way is to broadcast audio. Audio in fully compressed mode and for speech only can be send easily on a 8kb/s stream with perfect earing. The voice has some Donald-Duck tone, but is perfectly understood. Most of the tools and streamers for Linux are based on MP3, some can do Ogg Vorbis, but they are still, as today (December 2002), very experimental. The players for Linux or Windows can receive with no problem an MP3 stream or a Vorbis stream (with some plug ins), but all are unicast. It means you can hardly leverage your conference bandwidth by sending only one stream that will be duplicated later via a multicast network. The problem is that multicast is “deployed” on the Internet backbone, but rarely up to the end user (ISP customer). So the Linux developer that makes all these fancy technology cannot test multicast therefore does not develop for it. Fortunately IPv6, brings ANYcast, which works much like unicast, the source address is fixed, but the destination address is a list of IPs where the packets should be delivered to. It adds some overhead to the stream, but its lesser than duplicating that many time this stream. A 8kb/s stream can easily reach any standard modem with some spare bandwidth for browsing the web.
At the moment I use Icecast as an MP3 streamer and DarkIce for generating the MP3 stream from a laptop with a standard sound card. I have been obliged to recompile my self both package to include the lame library that allows re-compression of the stream in several format and compression schemes. MP3 is patented, decoding is free, but encoding is not, therefore in some countries it is illegal to use freely an MP3 encoder. You can now find some appropriate icecast RPMs on some European web sites. For audio capture it is important to have a good microphone that is able to capture everything the speaker says. This seems obvious, but most speakers will not realize that they have “moved away” from the microphone.
Video is much more difficult. It takes a lot of bandwidth and to minimize the bandwidth you use low resolution with a poor frame rate. It means that if you are trying to capture the speaker and his slides, you won't be able to read the slides. I haven't experimented yet with a system that would capture the slides only and send them when needed. You have to realize that speakers come with their laptops using various OS's. Installing a program on their machine to send the slides may be difficult. Most of the time, you don't have the slides beforehand, I see many people finishing their presentation 5mn before it starts. So there should be some kind of device that interface between the laptop and the video projector (Video capture card?). It means also you may want to have 2 video sources. One for the slides and one for the overall (speaker and screen).
Most of the Video streamers are proprietary or semi proprietary. Real Networks is releasing some of its stream servers free of charge and Apple is releasing Darwin Streaming Server under the Apple Open Source License. It looks good for the future but I haven't successfully tested any. For standard capture cards for the moment they are very close to MJPEG, which is motion JPEG, JPEG images send one after the other one. The compression ratio is very bad. The most promising, would be to interface a Digital Camera (miniDV) via firewire and use the input as a stream. If GNU/Linux has some tools to capture a Firewire Video, it cannot be re-compressed or streamed easily. The most promising tool seems the FFMPEG project. You have to use the code in CVS for testing at the moment as many codecs are not implemented in the last release. FFMepg can now read a DV encoded file but cannot yet get it from a firewire card. FFMepg can also stream Ogg-Vorbis and many other formats. Some of these streamers can also record at the same time they stream so someone missing the beginning of the talk can rewind back from the start or hear it another day.
To be noted most of these tools have a high latency, several seconds, so it is impossible to hear the stream and the speaker at the same time. They are purely made for people outside the room of the speaker. I have used icecast to duplicate the conference audio into the room of the record people with an MP3 recorder. It enables them to follow the conference while working on previous records and also to rewind back to passages that were not well understood.
An IRC server could be used to provide a real time conferencing system between participants. However they need to be carefully monitored to avoid security exploits and they do not have much memory and capabilities in conference systems.
A more promising solution is to use an Instant Messaging (IM) system. Jabber is such system. It has a well known interface which is now being submitted to the IETF as a standard and also offers conferencing capabilities. It means you can open a special room that will host your conference between IM clients. When someone enter the conference room, the log of past discussion is sent to this new person. It is also logged as a text file so it can be displayed in a web page. The clients exist for all platforms and it is most likely to become a standard in the coming years. Not all clients are alike, and they are still buggy, but development is progressing fast. Moreover a jabber server have several plug-ins that allows you to register to other IM proprietary services such as AIM, Yahoo, MSN,...
The main difficulty is to get the participants to go through the process of installing and configuring the appropriate client, connect to the right conference room and interact. This is not a simple task, knowing that most people that come to conferences are not computer literate. All the success of an online conference is therefore in preparing it. You have to prepare the participants to the technology before they leave their office or before the conference start. Make a few sessions before the conference to get some feed back on the agenda, themes,...
Running conferences is quite expensive. In the business of international organisations or not for profit organisations (UN style), having conferences and meetings put a huge financial burden on the organiser as well as the participants. Moreover, to be meaningful, a conference must have the highest level stakeholders or a large number of people attending. To leverage attendance and participation, the best way is to use the Internet. More and more people will be come proeficient in participating to semi-virtual and then virtual conferences. It is a new set of techno skills to acquire, but they will be acquired like people now cannot survive without a video projected slide presentation.
What is the relation with GNU/Linux? A small and dedicated server will be able to be created to cater for a increasing need for people across continents to meet. The Internet has brought that: we no longer meet because we are in the same location but because we have the same interests.
New opensource applications need to be developped and integrated to allow the broadcast of live audio/video. For the text world most of these applications already exist, however a little bit of standardisation will help a lot.
Furthermore, a conference server can be also used as a guest access network for your company, organisation or university. The wireless specification (WiFi) is highly unsecured, but if you put it on its own backbone separated from your organisation internal network, you give access to any visitor to the Internet and other appropriate resources.
By the way, to see it all configured and working (hopefully) check http://conf.sopac.org/