Racktable, Apache+LDAP authentication

Login to the Rack tables as admin:

Add the following line under configuration--> permission

allow {$tab_default}

* This is for read only account, assign extra permissions if required

Configure Apache + LDAP

< Directory /var/www/racktables >
Options +Indexes FollowSymLinks MultiViews
DirectoryIndex index.php
AuthName "Rack Tables"
AuthType Basic
AuthBasicProvider ldap
AuthzLDAPAuthoritative on
AuthLDAPURL "ldaps://ldaphost.com/dc=company,dc=com?uid?sub?(objectClass=< depends_on_ldap >)"



# Bind if required
AuthLDAPBindDN "uid=userid,ou=people,dc=company,dc=com"
AuthLDAPBindPassword "xxxxxx"
AuthLDAPGroupAttribute uniqueMember
AuthLDAPGroupAttributeIsDN on
require ldap-group cn=group_name,dc=company,dc=com
require ldap-attribute cn=group-name-allowed
< /Directory >

* Most of LDAP configs based on your setup

Configure Rack Tables:

Edit the inc/secret.php

Set :

$user_auth_src = 'httpd';
$require_local_account = FALSE;

NOTE: to get the logout working properly make sure the Apache AuthName matches with the one configured for Rack tables authentication.

Referene : http://sourceforge.net/apps/mediawiki/racktables/index.php?title=RackTablesAdminGuide

Reference

./arun

Rsnapshot Lchown

# rsnapshot du localhost
require Lchown
Lchown module not found

Install the Lchown module:

# wget http://www.rsnapshot.org/downloads/extras/Lchown-1.00.tar.gz

# tar xvzf Lchown-1.00.tar.gz

# cd Lchown-1.00

# perl Makefile.PL
Checking if your kit is complete...
Looks good

# make install

# rsnapshot du localhost
require Lchown
Lchown module loaded successfully

You can also try installing the module from Perl CPAN

# perl -MCPAN -e 'install qw(Lchown)'

./arun

My Favourite MAC OS X applications

Text Editor

vi

Text Edit

Smultron: http://www.peterborgapps.com/smultron/

Komodo Edit: http://www.activestate.com/komodo-edit

Voice/Video Calls

Skype : http://skype.com

Google talk (browser plugin): : http://www.google.com/chat/video

G+ hangout

Web Browser

Firefox: http://www.mozilla.com/en-US/firefox/fx/

Chrome: http://www.google.com/chrome

Twitter Client

A Plus: http://www.aplus-app.com/

IM

Adium: http://adium.im/

Office Documents

Libre office: http://www.libreoffice.org/

Video Player

VLC: http://www.videolan.org/vlc/

Miro: http://www.getmiro.com/ ( an excellent stream and bit torrent client as well)

VOIP

Express Talk(free edition) : http://www.nch.com.au/talk/talkmaci.zip

Virtulization

VMware Fusion : http://www.vmware.com/products/fusion/overview.html

Sun Virtual Box (free): http://www.virtualbox.org/

Parellels: http://www.parallels.com/

PDF viewer

Adobe Reader: http://get.adobe.com/reader/

Audio Editing

Audacity: http://audacity.sourceforge.net/

Disk burning

Burn: http://burn-osx.sourceforge.net/

Disk Image backup

Carbon copy cloner: http://www.bombich.com/

VNC client

Chicken of the VNC: http://sourceforge.net/projects/cotvnc/

IPSEC VPN

Cisco Any connect

Subversion

Command line as always

Cornerstone, good if you require an interface: http://www.zennaware.com/cornerstone/index.php

Image Manipulation

GIMP: http://www.gimp.org/

Picasa: http://picasa.google.com/mac/

Xee: http://wakaba.c3.cx/s/apps/xee

Password Management

KeePassX: http://www.keepassx.org/

GPG Key Chain

MAC GPG: http://macgpg.sourceforge.net/

Terminal

iTerm: http://iterm.sourceforge.net/

The default terminal is really nice in Lion

Mail

Thunderbird: http://www.mozillamessaging.com/en-US/thunderbird/

Diagram

OmniGraffle: http://www.omnigroup.com/products/omnigraffle/

Packet Analysis

wireshark: http://www.wireshark.org/

./arun

 

 

 

Install Cpanel on FreeBSD 8.2

- Install FreeBSD with proper network and file system configuration (Ref:  http://docs.cpanel.net/twiki/bin/view/AllDocumentation/InstallationGuide/Quick-StartInstallationGuide)

- Install dependency packages:

# pkg_add -r wget

# pkg_add -r perl

# pkg_add -r rsync (required later for ports sync)

# pkg_add -r gmake

To Fix:

creating glibconfig.h
config.status: executing default commands
gmake: not found
child exited with value 127
Died at /usr/local/cpanel/bin/rrdtoolinstall line 109.

# pkg_add -r png // To fix the following error

To Fix : configure: error: requested PNG backend could not be enabled

- Create the following symlinks

# ln -s /usr/local/bin/wget /usr/bin/wget

# ln -s /lib/libcrypt.so.5 /lib/libcrypt.so.2 // To Fix: Shared object "libcrypt.so.2" not found,

# ln -s /lib/libc.so.7 /lib/libc.so.5 // To Fix: Shared object "libc.so.5" not found

ln -s /lib/libm.so.5 /lib/libm.so.3 // To Fix: "libm.so.3" not found

- Install Cpanel

cd /home

wget -N http://httpupdate.cpanel.net/latest

sh latest

- Once installation successful activate the license (make sure the ip is licensed -  http://www.cpanel.net/apps/verify/)  :

#  /usr/local/cpanel/cpkeyclt

- Start Cpanel

- Touch the following file

# touch /etc/rc.d/init.d/function // To fix:  Could not find functions file, your system may be broken

# /etc/init.d/cpanel start

Now you should be able to access Cpanel at https://< yourip >:2087/

Try to upgrade

Exim: /scripts/eximup --force (this will get the free bsd ports as well)
Cpanel : # /scripts/upcp

./arun

 

 

Drupal 7 issue with SQL Mode TRADITIONAL

PDOException: SQLSTATE[42000]: Syntax error or access violation: 1231 Variable 'sql_mode' can't be set to the value of 'TRADITIONAL' in lock_may_be_available() (line 165 of /includes/lock.inc).

This was the case when I installed Drupal 7 with Cpanel/Fantastico, the drupal site was displaying the above error.

This issue is discussed at drupal issues . try to patch it as mentioned in the url.

But for me it works with the following change, just removed the TRADITIONAL mode, not  sure it is the correct way to fix it. You can verify the sql modes at http://dev.mysql.com/doc/refman/5.0/en/server-sql-mode.html ,  Anyway now there is no errors in drupal site and I am able to login.

(includes/database/mysql/database.inc) Line: 65

New file
<  $this->exec("SET sql_mode='ANSI,ONLY_FULL_GROUP_BY'");
---
Old file
>  $this->exec("SET sql_mode='ANSI,TRADITIONAL'");

Also setting up the sql connection mode to SET SESSION sql_mode = "ANSI,TRADITIONAL"; is an option instead of above change.

./arun

 

 

Install and configure RSA web agent with Redhat EL5 and Apache

Login to RSA interface:

- Create the apache server as agent host with type web agent
- Generate the config file (zip file containing sdconf.rec) from RSA interface, and download to your local machine

Login to the web server

- Download the RSA web agent installation files from RSA website.

# mkdir -p /var/ace

- Copy and extract (sdconf.rec) the downloaded config file
# chmod 755 sdconf.rec

- Create the sdopts.rec file with the ip address of the machine, if you have multiple ip address assigned to the server or if the RSA we agent is a virtual machine. Otherwise the authentication might break with following kind of errors
"100: Access denied. The RSA ACE/Server rejected the Passcode. Please try again." , "attempted to authenticate using authenticator “SecurID_Native”. The user belongs to security domain “SystemDomain”"

# echo "CLIENT_IP=" > sdopts.rec
# chown -R webuser:webuser /var/ace

- Now install the RSA web agent

# tar xvf WebAgent_70_Apache_RHEL5_32_379_08201024.tar
# cd CD/
# chmod u+x install
# ./install

- Enter the location of sdconf.rec

- Configure the apache virtual host

It was found that web agent breaks if apache starts multiple server thread, so would be better to limit the thread.

< IfModule prefork.c >
StartServers 1
MinSpareServers 1
MaxSpareServers 1
ServerLimit 256
MaxClients 256
MaxRequestsPerChild 4000
< /IfModule >

- Now start apache and you will be able to access the RSA web interface.

Once authenticated, the RSA server will create a node secret for the agent host and will be copied automatically to the web server.

This web interface is mainly useful for the token users to reset or enable to token assigned to him.

./arun

Changing RSA passwords

 

Reset SSH Password:
-------------------
Log in to Operations console (Master):

Administration --> Networking --> Configure connectivity using SSH

Do the same procedure on Replica also (if any), it is manual process.

Reset Operations console password:
----------------------------------
Login to the master appliance with SSH

$ sudo -s // sudo as root
# su - rsaadmin // change user to rsaadmin
$ cd /usr/local/RSASecurity/RSAAuthenticationManager/ //navigate to RSA installation path
$ cd utils
$ ./rsautil manage-oc-administrator -a update // Execute

// Enter Super administrators name
// Enter Super administrators password
// Enter operation console user
// Set the new password

Do the same steps on replica
Error: This operation can be performed only on a primary instance.
But the password got changed

Reset Master password:
---------------------
Login to the master appliance with SSH

$ sudo -s // sudo as root
# su - rsaadmin // change user to rsaadmin
$ cd /usr/local/RSASecurity/RSAAuthenticationManager/ //navigate to RSA installation path
$ cd utils
$ ./rsautil manage-secrets --action change --new-password <enter_the_new_password>

Do the same procedure on the replica device.

Reset Security Console Password:
---------------------------------
Login to Security Console

Identity-->Users-->Manage Existing // Search for your admin username in internal datase

Change password for the admin user
This action will be automatically replicated to replica.

./arun

Configure IPv6 squid

Squid 3.1+ support IPv6

- Compile and install 3.1.x version of squid.

# useradd -d /opt/squid squid

# wget http://www.squid-cache.org/Versions/v3/3.1/squid-3.1.11-20110228.tar.gz

# tar xvzf squid-3.1.11-20110228.tar.gz

# cd squid-3.1.11-20110228; ./configure --prefix=/opt/squid/

# make; make install

# /opt/squid/sbin/squid -z

Configure squid

edit /opt/squid/etc/squid.conf

cache_effective_user squid

acl manager proto cache_object
acl localhost src 127.0.0.1/32 ::1
acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1

acl to_ipv6 dst ipv6
http_access allow to_ipv6 !all
tcp_outgoing_address 2001:: to_ipv6
tcp_outgoing_address 12.34.56.78 !to_ipv6

And add necessary acls to allow access for your network to squid.

Testing:

$ telnet <v6_address> 3128
Trying 2001::...
Connected to 2001::..
Escape character is '^]'.
get http://ipv6.google.com/
HTTP/1.0 200 OK

Check the access.log to make sure

1298965141.719    477 2001:: TCP_MISS/200 25918 GET http://ipv6.google.com/ - DIRECT/2a00:1450:8002::6a text/html

Performance issues with KVM - Redhat

The general performance issue with KVM is due to DISK I/O

- by default the Redhat KVM guest are created with x86_64 architecuture, if you installed 32 bit operating system change this to i686.

<os>
<type arch='i686' machine='rhel5.6.0'>hvm</type>
<boot dev='hd'/>

- Make sure the hypervisor used is correct in the configuration , either qemu or kvm

<domain type='kvm'>

or

<domain type='kvm'>

- Use virtio drivers if the guest is paravirtulized (http://www.ibm.com/developerworks/linux/library/l-virtio/index.html?ca=dgr-lnxw97Viriodth-LX&S_TACT=105AGX59&S_CMP=grlnxw97 ,  http://publib.boulder.ibm.com/infocenter/lnxinfo/v3r0m0/index.jsp?topic=/liaat/liaatbpparavirt.htm)

./arun

yum update, IndexError: tuple index out of range

If you happen to get this error while updating server with yum update
--
.
.
.
File "/usr/lib/python2.4/site-packages/M2Crypto/m2urllib2.py", line 82, in https_open
h.request(req.get_method(), req.get_selector(), req.data, headers)
File "/usr/lib/python2.4/httplib.py", line 813, in request
if v[0] != 32 or not self.auto_open:
IndexError: tuple index out of range
--
disable the location aware access from rhn.

Ref:
http://kbase.redhat.com/faq/docs/DOC-16881

./arun