The Linux Questions Thread, SCO non-infringing version

«‹›2 »

The Something Awful Forums > Discussion > Serious Hardware / Software Crap > The Linux Questions Thread, SCO non-infringing version

Xenomorph: Jun 13, 2001

a new version of Wubi came out. i'm gonna try out Ubuntu on my home computer.

quick question: is there an Email program that connects to an EXCHANGE server for Linux?

# ¿ Jul 16, 2007 20:59

Adbot: ADBOT LOVES YOU

# ¿ May 19, 2013 01:00

Xenomorph: Jun 13, 2001

running the latest Ubuntu at home (Wubi!), when I installed the latest ATI drivers, I lost YUY2 support, which prevents TVtime from running.

Is this a pretty common issue with ATI drivers? (I'm using a 9800 Pro)

Do the latest NVidia drivers support YUY2? I have a 5900XT as well that I could try.

# ¿ Jul 17, 2007 03:49

Xenomorph: Jun 13, 2001

I'm not sure where to check the compatibility of things, but I was going to use G4L and GParted to "ghost" a 2005 HP Proliant server to a brand new 2007 HP Proliant server.

G4L is current as of August 2007. I don't have the model number with me (ML370 G5 maybe?), but the HP Proliant server is using some pretty new parts. I'm afraid G4L won't work with its network card (Gigabit NIC) or the possibly weird SCSI setup it has.

It using two 300 Gig "SAS" drives with a hardware RAID. I don't know if the system has any PCI slots for me to use an old Realtek card for compatibility.

I'm not familiar with the drive options or how its RAID is set up, so I didn't want pull the drive(s) from one to put in the other, I was going to dump the 30 gig drive image over the network to another system.

# ¿ Sep 22, 2007 00:01

Xenomorph: Jun 13, 2001

I used G4L / Ghost 4 Linux today, and Hard Drive performance from a 5400RPM ATA33 IDE drive was about 17 megabytes/second for reading.

Under Windows, this drive benched 30 megabytes/sec sustained over USB2.

Does anyone know if G4L has performance issues? I tried direct to disk copying, and from the disk to the network (just to make sure it wasn't an issue with the system writing to the other drive). It would not get past 17 megabytes/sec.

# ¿ Sep 28, 2007 04:28

Xenomorph: Jun 13, 2001

teapot posted:

Use hdparm <device> to see the drive configuratuib and hdparm -Tt <device> to check the actual hard drive performance. It's possible that you have DMA or other modes supported by the drive turned off.

I'll see about trying this today.

Edit: I just did hdparm on the drive. It said this:
Timing buffer-cache reads: 7188 MB in 3.00 seconds = 2397.02 MB/sec
Timing buffered disk reads: 96 MB in 3.00 seconds = 31.96 MB/sec

That 31 megs/second thing looks more like what I was expecting.
However, I'm doing another run with g4l, and HD reading has again only made it up to about 19 megabytes/sec. It's connected via USB to the Linux system now, and is doing better than the 17megs/sec it was doing when connected via IDE yesterday.

I ran "hdparm" from the G4L boot CD I have, so it's not like the configuration is suddenly changing on it.

deimos posted:

did you use both through USB2 or did you plug it in to IDE on Linux? Maybe you used a 40 cable ribbon instead of an 80?

On the system running Linux, it was installed with an 80 wire IDE cable to the system's internal primary IDE port.
Wouldn't a 40 wire cable still support 33megs?

Xenomorph fucked around with this message at Sep 28, 2007 around 12:40

# ¿ Sep 28, 2007 11:52

Xenomorph: Jun 13, 2001

teapot posted:

Probably there is some overhead in a way how G4L handles data. Are you using raw or filesystem mode?

Raw, bit for bit copy.

# ¿ Sep 30, 2007 16:52

Xenomorph: Jun 13, 2001

I'm having a weird issue with Apache+PHP under Ubuntu 9.04.

I install Apache, I install PHP. Everything seemed to work.

I noticed a random directory not wanting to load the index correctly.

http://mysite/test/ -> application/x-httpd-php file prompt. (and when saved, does show the PHP source)
http://mysite/test/index.php -> loads correctly.

PHP is installed and working, or the other PHP apps wouldn't work. Things like phpMyAdmin and eGroupWare load up, as well as the trouble application when I specify the filename.

Apache isn't parsing the PHP as the index in one location.
Everything is at default PHP and Apache settings. (index.php is specified in dirs.conf, and PHP parsing works everywhere else)

Anyone have any idea? Googling for the x-httpd-php error gives me a hundred pages on making sure PHP is installed. :/

Edit
I don't know if it was some issue with libapache2-mod-php5 not being installed before and Firefox caching the bad stuff, but clearing the Firefox cache seemed to allow the page to load.

Xenomorph fucked around with this message at Jul 8, 2009 around 15:55

# ¿ Jul 8, 2009 15:20

Xenomorph: Jun 13, 2001

What would be a good way to do a script to shut down Oracle, and then reboot the system?

I'm guessing I could just issue a command to reboot. Oracle isn't in the /etc/init.d/ anywhere to load on startup, so I doubt it would run any script to shut it down before reboot.

I haven't done scripting under Linux, but the command would be something like this:

$ /usr/lib/oracle/sucks/10.2.0/db_1/bin/dbstop
$ /usr/lib/oracle/sucks/10.2.0/db_1/bin/lsnrctl start
# shutdown -r now

If I create a script with those commands, will it run all at once? How can I verify that it will execute each command and then wait for it finish before running the next line? Or is this the default behavior?

Now, the first two commands need to be ran as user "oracle", and the last command needs to be ran by root.
How do I specify which command is ran by which user?

sudo -u oracle <commands>
sudo -u root <reboot>
?

How does it handle the password/authentication?

Wait, I think I may have it:

su - oracle -c '/usr/lib/oracle/sucks/10.2.0/db_1/bin/dbstop'
su - oracle -c '/usr/lib/oracle/sucks/10.2.0/db_1/bin/lsnrctl start'
shutdown -r now

But then my first question remains: if I make this a script - does the system wait for the first command to finish before moving down to the next command?

Xenomorph fucked around with this message at Oct 20, 2009 around 21:41

# ¿ Oct 20, 2009 21:25

Xenomorph: Jun 13, 2001

Misogynist posted:

Only one PCIe Geforce4 was ever produced, and it had an AGP->PCIe bridge on it. The majority of them were AGP and PCI.

Yeah, I was thinking how all the GeForce 4 cards I've had were PCI.

# ¿ Oct 22, 2009 15:03

Xenomorph: Jun 13, 2001

I have a server running Ubuntu 8.04.3 LTS.
All it does is run OpenSSH, Samba, and VMware Server 2.0.2.

I had the x64 version installed, but there is some APIC/HPET bug that caused nasty kernel panics. I've tried "noapic" and a dozen other things that supposedly help the issue. Nothing helped. It's some old Dell system, nForce2 chipset, Athlon FX2 dual-core CPU.

Instead of messing with x64 any more, I just went with the 32-bit version, which seems to run without issue.

Will it have any issue addressing the 4 Gigs RAM installed in the system?

Do I have to do something to make sure PAE is enabled?

I've seen 32-bit Windows system show everything from 2.5 Gigs to 3.75 Gigs, and never be able to use all 4 Gigs.

I'm trying to run virtual machines on this, and it would really suck if I try to give one VM 2 Gigs RAM and it leaves nothing else for the rest of the system or any other VM.

# ¿ Nov 4, 2009 04:47

Xenomorph: Jun 13, 2001

JHVH-1 posted:

I believe PAE will be enabled by default in Ubuntu server. On standard Debian you need to use kernel-bigmem but Ubuntu has its own server kernels.
Once you log in just type 'free' or run top and see if it has the full amount or the 3.36 etc.

code:

butts@lmao:~$ free
             total       used       free     shared    buffers     cached
Mem:       4149048    4000360     148688          0     167532    3577016
-/+ buffers/cache:     255812    3893236
Swap:      8305596          0    8305596

Looks like it's darn close to 4 Gigs. Thanks!

# ¿ Nov 5, 2009 17:33

Xenomorph: Jun 13, 2001

I posted this in the Ubuntu thread, but I'm guessing it may be better to post here.

I recently figured out how to get one of our Linux systems to authenticate to an LDAP server (Apple OS X Server).

When they log in via LDAP, they didn't have a home folder. I have pam_mkhomedir.so run to create a home folder.

The users on the Apple server have a lot of home folders. Some are like /Volume/partition/whatever/something/user, or /share_name/misc/home, etc. pam_mkhomedir would try to re-create all those crazy folder structures off the root of the Linux system. I want a more uniform home folder when they log into Linux.

Is it possible to force a different home folder creation?
Like, force all users authenticating via LDAP into /home/<username>?

Right now, pam_mkhomedir.so is just trying to create whatever it sees in the passwd file on our Apple server.

In /etc/ldap.conf, I've tried things like this:

nss_override_attribute_value homeDirectory /home/${uid}
or
nss_map_attribute homeDirectory /home/${uid}

I'm trying to get the actual variable to work so it uses the users' name. It is making actual folders like /home/{uid} for a user.

Is there a way to make this work? I just want a /home/<username> folder created for each user that logs in.

If pam_mkhomedir.so isn't the answer, is there something else I could run on login to check for a home folder?

When I use this line in ldap.conf:
nss_map_attribute homeDirectory uid
pam_mkhomedir.so defaults to making /dev/<username>. Why would it default to the /dev folder?

Xenomorph fucked around with this message at Jul 11, 2010 around 00:17

# ¿ Jul 11, 2010 00:15

Xenomorph: Jun 13, 2001

If I have a Linux system running Apache, how can I make it so each user has their own /~username web page?

server.local/~john
server.local/~tom

Edit: I see now it is mod_userdir.

Xenomorph fucked around with this message at Jul 14, 2010 around 18:45

# ¿ Jul 14, 2010 18:43

Xenomorph: Jun 13, 2001

Yeah, it's been around for quite a while.
My first non-AOL webpage back in 1996 was someBBS/~myname.

I've been working on replacing an ancient Linux system (almost 300 local users) with a new Ubuntu server.
I have LDAP authentication working, and wanted to make sure each user could continue having their website (with the same URL) that they had on the old server.

The way Apache2 is set up and configured now makes managing things so much easier than it use to be. Before, everything went into one conf file. I guess it made it easier to back things up (1 file!), but it was also easier to break things, and multiple configurations/sites made that file awfully messy.

Now there are default configs, site configs, mod configs, etc. All strung together. Edit only what is needed, make a symbolic link to an enabled/ folder, and you're done. Enabling mod_userdir was as simple as typing a2enmod userdir; service apache2 restart.

No need to even touch a configuration file.

# ¿ Jul 14, 2010 21:55

Xenomorph: Jun 13, 2001

I'm having a little DNS issue.

I've set up a system (192.168.1.1) to do DNS caching. Systems on the same VLAN work fine with it. On a different VLAN (192.168.2.1), I get this stuff:

code:

$ nslookup google.com
Server:		192.168.1.1
Address:	192.168.1.1#53

** server can't find google.com: REFUSED

/hosts.allow has this:
ALL: 192.168.1.0/24
ALL: 192.168.2.0/24

The systems communicate back and forth just fine for everything else (SSH, web access, etc), it's just DNS doesn't work between the VLANs.

What else do I need to do to allow DNS queries to go through?

EDIT

Nevermind. I had to add this to named.conf

code:

allow-query {
                192.168.1.0/24;
                192.168.2.0/24;
        };

Xenomorph fucked around with this message at Oct 28, 2010 around 17:58

# ¿ Oct 28, 2010 17:51

Xenomorph: Jun 13, 2001

I will be moving more of our Linux systems to use LDAP authentication soon.

This question probably isn't a major issue, but it would be good to figure out.

Anyway, most of our users have their home on a certain NFS share.

Some will have this:
/zanyserver/home/username
Some will have this:
/evilserver/home/username

And some will have no home set.

Users with an existing home log in and have their home on the NFS share. Users with no home would log in with an error that they have no home, and are dropped in / root with no access to anything.

Looking up info on creating a home on log in lead me to some info. So I added this to /etc/pam.d/common-session to create a home on login:

code:

session required          pam_mkhomedir.so skel=/etc/skel/ umask=0022

So users with no home get a home created on login. That works for them. But then when a user that already has a home on an NFS share logs in, the login process errors-out because it tries to create a home on the NFS share (when it is already there), but fails because the system doesn't have permission to that share (only the user logging in has permission to the location). The system then kicks out the user back to the login prompt.

Is there a way for it to have it not try to create a home on the NFS share? Maybe not "cancel login" even if it fails to make a home?

I don't know if I'm explaining this correctly.

# ¿ Nov 24, 2010 20:36

Xenomorph: Jun 13, 2001

FISHMANPET posted:

Maybe you could change required to requisite, sufficient, or optional? I don't know much about PAM, but that would be where I look first.

'sufficient' and 'optional' allow it to work! (I don't know why I didn't even think to try that. v___v )

It gives the error about unable to create the directory, and then the user logs in.

So, now I'm wondering if I could suppress that error so it doesn't frighten users...

I may just drop the whole <i>pam_mkhomedir.so</i> part and make sure homes are set up already. Part of the new server upgrade has to be a more logical and common home structure.

# ¿ Nov 24, 2010 20:48

Xenomorph: Jun 13, 2001

I'm getting some funny time-out style errors on one of our Linux systems with LDAP authentication.

Ubuntu Server 10.04 LTS

If no one has logged in with their LDAP account for a while, the server seems to lose its connection or something.

If I try to log in with my user account, it tells me permission denied.

quote:

$ssh -l username server
username@server's password:
Permission denied, please try again.

The log has this line in it:
/var/log/auth.log:
"nscd: nss_ldap: could not search LDAP server - Server is unavailable"

If I wait a few moments, log in as a local account, etc, then I can log in as the LDAP user.

It uses Kerberos for authentication, but NSCD caches the username from the LDAP server. NSCD can't get the username, so no authentication can occur.

How do I get NSCD or whatever to keep querying the LDAP server? The server is up, and it connects to it eventually. If I disable NSCD, the user can log right in, but I get the weird "I have no name!@server:~$" prompt.

# ¿ Mar 22, 2011 16:27

Xenomorph: Jun 13, 2001

Misogynist posted:

Basically, that's it. That's all it does. nscd doesn't have anything to do with name service lookup besides the fact that it's a dumb in-memory cache that happens to interface with glibc for the sole purpose of caching name service lookups.

If this issue is intermittent, I'm inclined to believe one of two things:

Somehow, the LDAP lookup is taking a long time and glibc is returning that the LDAP lookup failed, but still waiting on the response and caching it after the fact. I don't think this actually happens.

Something is wrong with your LDAP server or connectivity to your LDAP server.

I'm almost completely certain that something's up with your LDAP server or your network, and that's where you should be focusing your attention.

If it helps in troubleshooting, disable nscd outright and see if you still experience the problem. It doesn't affect anything besides performance.

I followed this guide:
http://storg.org/2010/05/ubuntu-10-...ation-via-ldap/

Just like the guide also mentions at the bottom, if I stop/disable nscd, then I can log on immediately, but my login prompt looks like this:

quote:

groups: cannot find name for group ID 10000
groups: cannot find name for group ID 10001
groups: cannot find name for group ID 10002
I have no name!@server:~$

The "LDAP server" is a Windows Server 2003 R2 Active Directory install (with the schema updated with all the needed Unix information).

We log into it from several Mac OS X 10.6 and 10.5 desktop clients, and a few Apple OS X Server 10.5 systems.
We had another Linux system in the past that seemed to work just fine, and I don't recall any differences with the configuration files.

This one just seems to "time out".

# ¿ Mar 22, 2011 20:29

Xenomorph: Jun 13, 2001

Misogynist posted:

Long shot, but is ldap.conf world-readable?

Edit: What's the output of getent passwd when nscd isn't running?

/etc/ldap.conf is word-readable.

"getent passwd" does not list anyone from LDAP when ran as a regular user.

When ran as root, "getent passwd" lists everyone in LDAP/AD.

Edit, now that I notice that users can't even query the LDAP database, I think I found I know what the issue is.

I didn't have a "binddn" specified in the ldap.conf (only rootbinddn) since ldap.conf is world-readable (I didn't want people to see the password used).

I made an LDAP-only AD account with no access to anything, and then used it with bindnd.

Xenomorph fucked around with this message at Mar 23, 2011 around 05:02

# ¿ Mar 23, 2011 04:31

Xenomorph: Jun 13, 2001

We have a CentOS 5.x (?) box that is having an NFS/network load issue (I'm not sure of the version at the moment).

Basically, it is trying to load NFS automounts before eth0 is fully brought up.

Like, the logs look like this:

code:

15:55:32 localhost mount: mount: mount to NFS server 'goonbox' failed:
15:55:32 localhost mount: System Error: No route to host.
15:55:38 localhost kernel: tg3: eth0: Link is up at 100 Mbps, full duplex.

Then if log in, do mount -a, it makes the connection.

Searching Google tells me "tg3" is a Broadcom driver or something.

How do I change the order of whatever it's doing to make it attempt mounts after the Network is brought up?

# ¿ Jun 7, 2011 22:11

Xenomorph: Jun 13, 2001

Social Animal posted:

Thanks for the responses guys. I'm going to load up CentOS and jump between that and Ubuntu to check it out. I think what I'm for sure going to do is checkout the Linux+ study material and get some basics with that and then set up a server just to see if I can figure it all out.

Again thanks for the responses, you guys got me off to a good start.

I had a lot of fun poking around Slackware back in the 1990s. I was so excited when I got 3.3 on CD (I had only used Floppy installs before).

Most of what I do now is command-line in Ubuntu Server. I think we're sticking with CentOS on the Desktop.

Does anyone still recommend Gentoo?

# ¿ Jun 8, 2011 17:10

Xenomorph: Jun 13, 2001

Bob Morales posted:

Nothing like booting Windows, visiting a couple websites, printing them out or writing stuff down, then booting back into Linux and trying poo poo out. Then having to go back to Windows. Or hell, not even being able to boot Linux in the first place.

drat kids today with their laptops, able to surf while they install. I remember helping people out in IRC. They'd keep popping in and out of the channel, between reboots and dialing up, and if they were lucky, and persistent, eventually they'd be back using Linux

My shiny new 28.8 was a Winmodem. So besides reading documentation and downloading Linux while in Windows, I was completely offline once I got Linux to boot.
I even put my 14.4 back in for a little while since it was only an RPI modem and I could then get online with Linux.

I made damned sure my next modem was a hardware one after using three software modems in a row (2400, 14.4, 28.8).

# ¿ Jun 8, 2011 22:22

Xenomorph: Jun 13, 2001

waffle iron posted:

Add _netdev as an option in your fstab file. That makes it not be mounted until your network connection is up.

Edit: Alternatively you could use autofs (or similar) so that the NFS share is only mounted when the mountpoint is accessed.

_netdev didn't seem make any difference.

What the user ended up doing is something like this:

code:

server:/whatever/share /bacon nfs defaults 0 0
server:/whatever/share /bacon nfs defaults 0 0
server:/whatever/share /bacon nfs defaults 0 0

The first two give the error that the network isn't up, and by the time the third one tried, the network is loaded then and the NFS mount is established.

I saw on some other forum where a user was putting in the "sleep" command in the system's NFS mount script. I checked /etc/rc.d/rc5.d/S60nfs, but didn't see anything that matched up with the example I found. Just as something to try, we renamed S60nfs to S94nfs to see if it would try to load it later in the startup. It still tried to load NFS before the network was up.

We may look into the automount thing next.

# ¿ Jun 9, 2011 20:44

Xenomorph: Jun 13, 2001

CentOS 6 / RHEL 6 issue.

I just got a new install to authenticate against our LDAP server. It reads users, passwords, home, etc from the database.
Homes are mounted locally via NFS.

On a GUI login, the user is logged in correctly. Their Desktop is there, Documents, all files.

On a text login, they get the message that it can't load /share/home/user, and are dropped at root /.

Now, the thing is, "/share/home/user" does exist, and they can immediately change to that directory. It loads it correctly when they log in via the GUI.

Where should I be looking at to see what the problem is? I have the same config under CentOS 5, and it just works.

# ¿ Aug 6, 2011 09:16

Xenomorph: Jun 13, 2001

I know these were updated by "authconfig" to include the pam_ldap.so settings:
/etc/pam.d/system-auth
/etc/pam.d/password-auth

I had to open "/etc/sysconfig/authconfig" and change "FORCELEGACY=no" to "FORCELEGACY=yes" to get it to use insecure LDAP instead of something called "SSS" (which uses TLS with LDAP, something that doesn't work with our server).

I can try to compare line for line the PAM settings on both our RHEL5 systems and Ubuntu systems (which both log in fine).

# ¿ Aug 6, 2011 17:58

Xenomorph: Jun 13, 2001

Xenomorph posted:

CentOS 6 / RHEL 6 issue.

I just got a new install to authenticate against our LDAP server. It reads users, passwords, home, etc from the database.
Homes are mounted locally via NFS.

On a GUI login, the user is logged in correctly. Their Desktop is there, Documents, all files.

On a text login, they get the message that it can't load /share/home/user, and are dropped at root /.

Now, the thing is, "/share/home/user" does exist, and they can immediately change to that directory. It loads it correctly when they log in via the GUI.

Where should I be looking at to see what the problem is? I have the same config under CentOS 5, and it just works.

I found the cause of this: SELinux.

Now, I'm not too familiar with it, but I know all our other Linux systems are unpatched 2005 crap boxes that don't even have SELinux, so killing SELinux isn't a massive change.

I opened /etc/selinux/config and changed SELINUX from "enforcing" to "permissive", and now users can log in correctly.

A typical login attempt before was like this:

code:

login: xeno
Password: xxx 
Last login: Mon, Aug 8
No directory /network/home/xeno!
Logging in with home = "/".

$ cd /network/home/xeno
$ pwd
/network/home/xeno

It said the directory didn't exist, but I could immediately change to it. Stopping SELinux made it work.

# ¿ Aug 8, 2011 15:43

Xenomorph: Jun 13, 2001

I use Ubuntu Linux + Windows 2003 R2 AD.
Session info is pulled from LDAP, authentication is done through Kerberos.

Under Windows, you can do an Add/Remove Windows feature things to make sure all the UNIX extensions are set up. Any Linux distro can then read the UID/GID, home, etc from AD (a panel to modify that info is added in AD Users & Computers).

No need for any third-party software.

# ¿ Aug 13, 2011 08:27

Xenomorph: Jun 13, 2001

OK, we have our Ubuntu Servers authenticating against Windows AD via LDAP+Kerberos.

Is it possible to have an Ubuntu Server host L2TP/IPSec VPN server, using the same Windows AD accounts users log into the system with?

# ¿ Aug 15, 2011 16:47

Xenomorph: Jun 13, 2001

I just installed Ubuntu 12.04 on my ThinkPad T43, and I'm having a weird issue.

Atheros, "AR922X Wireless Network Adapter"

The WLAN LED is reversed.

Turn On WiFi (via Fn+F5 or menu), LED goes OFF.
Turn Off WiFi (via Fn+F5 or menu), LED goes ON.

Loading it with "modprobe ath9k blink=1" causes it to blink for traffic. The LED is still ON when WiFi is OFF, but it at least blanks to show traffic when on.

How can I tell Ubuntu to reverse when it shows the LED??

Under Windows, it works like this:
WiFi Off: LED Off
WiFi On: LED blinks for traffic

----------

Edit, just got this script going (and posted it on my website).
I placed it in /etc/NetworkManager/dispatcher.d/

code:

#!/bin/bash
#
# Script to fix the reversed WLAN LED on
# my ThinkPad T43 w/ Atheros 802.11N WiFi
#

INTERFACE=$1	# wlan0 only for this one
STATUS=$2	# connection status

# comment out just ONE of the LED options below:

if [ "$INTERFACE" = "wlan0" ]; then

	case "$STATUS" in
	'up')
		# enable the WLAN LED (blinks on transmit):
		#echo phy0tpt > /sys/class/leds/ath9k-phy0/trigger
		# enable the WLAN LED (no blinking):
		echo 0 > /sys/class/leds/ath9k-phy0/brightness
	;;
	'down')
		# turn the WLAN LED off:
		echo 255 > /sys/class/leds/ath9k-phy0/brightness
	;;
	esac
fi

You can comment out which one you want/don't want (solid LED or blinking). I have no idea if this is the *wrong* way to do something like that, but it seems to work GREAT for me.

My terrible Ubuntu on T43 guide:
http://xenomorph.net/misc/guides/ubuntu-t43/

My LED fix for third-party WiFi cards on a T43:
http://xenomorph.net/misc/guides/wifi-led-thinkpad/

Xenomorph fucked around with this message at Apr 28, 2012 around 09:16

# ¿ Apr 28, 2012 05:55

Xenomorph: Jun 13, 2001

I'm having some issues with LDAP.
I'm using LDAP as the identity provider with Kerberos for authentication.

Under Ubuntu, I have it configured and working. I can query users (LDAP) and authenticate as users (Kerberos).

Under CentOS 6.2, the getent passwd command isn't working as expected.

Under Ubuntu, this command lists all local & all LDAP users:

code:

# getent passwd

Under CentOS, it only lists local users. I was thinking LDAP wasn't working, however, if I run this:

code:

# getent passwd username

It returns just that user's information properly from LDAP. How do I get "getent passwd" to list ALL LDAP users under CentOS 6.2?

I can log in just find using LDAP/Kerberos, it just seems like the "getent passwd" command isn't working. What should I check?

Trying to Google for "getent passwd" not working gives me TONS of pages where LDAP in general isn't working. I can query LDAP just fine.

EDIT
loving hell. *Every* time I spend hours on something, then post here asking for help, I always seem to find the answer IMMEDIATELY after.

I had "enumeration = true" instead of "enumerate = true" in my sssd.conf file (what tells it to list all).

Xenomorph fucked around with this message at May 8, 2012 around 19:03

# ¿ May 8, 2012 18:55

Xenomorph: Jun 13, 2001

I have another question, on RHEL/CentOS, viewing a user's info ("id username") results in context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 as the output if SELinux is enabled.

When I disable SELinux, the output is normal (it lists just their UID and GID). Anyone know why I see "context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023" or how to fix it?

# ¿ May 8, 2012 22:46

Xenomorph: Jun 13, 2001

Misogynist posted:

Something's weird with your configuration. You're viewing the output of id -Z, but that invocation won't allow you to specify another user's username.

Is your user named -Z?

I can log in as any network user, type just "id" (nothing else), and I get "context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023".

This is a clean install of CentOS 6.2 where I've _only_ added my LDAP/Kerberos information.

SELinux was causing weird stuff under CentOS 6.0 for me as well.
After login, I'd see this something like this telling me their home folder didn't exist, when it did:

code:

No directory /network/home/user!
Logging in with home = "/".
$ cd /network/home/user
$ pwd
/network/home/user

(It said "/network/home/user" wasn't there when I could change to it after login just fine.)
That was fixed by changing SELinux from "enforcing" to "permissive". The "context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023" thing is fixed by changing SELinux to simply "disabled".

# ¿ May 9, 2012 02:12

Xenomorph: Jun 13, 2001

spankmeister posted:

I think id just shows you the current SELinux context of that user and is intended behavior.

So you're saying that displaying "context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023" behind their UID/GID information is the intended (correct) behavior?

# ¿ May 9, 2012 18:54

Xenomorph: Jun 13, 2001

Well, OK then. SELinux will remain on.

Windows 95, OS/2, Irix64 (Silicon Graphics), and Sun Solaris systems are more common where I work than anything that runs SELinux, so I find myself checking Google for every little thing it does.

# ¿ May 10, 2012 03:31

Xenomorph: Jun 13, 2001

Yeah, university setting. The Win9x systems are almost all gone. The DOS and Win16 stuff they do runs just fine under XP. However, one Win9x system may be required because of good ol' VXD drivers for some old piece of equipment that came from some company that died off in 1995. That is the same reason we still have a Mac OS 9 box going. When a department spends $100,000 on some moon-laser, many times they don't want to buy another one just to have something compatible with Windows XP/7/whatever.
The OS/2 system is still running (24/7 for 20+ years or something) because "it just works" (why replace it?). I'm not looking forward to the day it dies and we need to some how recover whatever it's doing.

Something I'm fighting with now: changing Windows AD user passwords from Linux systems. On Ubuntu:

code:

$ passwd
Current Kerberos password: *****
Enter new Kerberos password: *****
Retype new Kerberos password: *****
Password change rejected
passwd: Authentication token manipulation error
passwd: password unchanged

code:

$ kpasswd
Password for user@DOMAIN.EDU: *****
Enter new password: *****
Enter it again: *****
Password change rejected

Many users do not have a Windows desktop to log into to change their password, so Linux is the only network login access they have. I'd like to allow them to change their password on their own.

None of Ubuntu's or Windows' logs show any errors.

# ¿ May 10, 2012 17:40

Xenomorph: Jun 13, 2001

xdice posted:

Is the connection to the LDAP server (AD in your case) encrypted or not? If not, password changes may not be allowed. You generally have to be going over LDAPS or LDAP+TLS for that to work.

LDAP is used for user info, but Kerberos for authentication.

Does Windows work with LDAPS or LDAP+TLS?

# ¿ May 11, 2012 04:47

Xenomorph: Jun 13, 2001

MrHyde posted:

Is there any reason not to use the windows installer to put Ubuntu on my old T61? (As opposed to downloading an ISO and partitioning and all that junk myself) I want to dual boot just to try it out for a while.

I use Wubi to put Ubuntu on my T43. It works really well.
There will be reduced disk I/O performance, but that is the only downside compared to a full repartition and install.

And unlike a virtual machine, you'll actually be booting in Linux and have full access to your hardware.

If you're not happy with Ubuntu/Linux, the Wubi install is super-simple to remove. The uninstaller is quick, and no need to worry about partitions.

# ¿ May 13, 2012 18:23

Xenomorph: Jun 13, 2001

Not that anyone cares, but the password change issue I had was because of restrictive Active Directory group policies.

Namely the (default) ones that require a password be 1+ day old before a user can change it, and require that the user not use any of their previous passwords.

So basically, Kerberos under Ubuntu and CentOS was working correctly, and it was in fact the AD server rejecting a password change request.
I didn't need to use LDAPS or TLS or anything like that. Plain old LDAP+Kerberos works just fine.

quote:

code:

$ passwd
Current Kerberos password: *****
Enter new Kerberos password: *****
Retype new Kerberos password: *****
Password change rejected
passwd: Authentication token manipulation error
passwd: password unchanged

code:

$ kpasswd
Password for user@DOMAIN.EDU: *****
Enter new password: *****
Enter it again: *****
Password change rejected

# ¿ May 14, 2012 22:22

Adbot: ADBOT LOVES YOU

# ¿ May 19, 2013 01:00

Xenomorph: Jun 13, 2001

I just hooked up a thermal sensor made in the 1990s ("Hot Little Therm") to a system running Ubuntu 12.04. I was able to compile the source code, last updated in 1997, and it ran just fine.

I was pretty impressed that some mid-90s Unix code was able to compile unmodified and without any errors on a 2012 Linux install.

# ¿ May 16, 2012 22:56

«‹›2 »

The Something Awful Forums > Discussion > Serious Hardware / Software Crap > The Linux Questions Thread, SCO non-infringing version