Moved to a new hosting location

meltingrobot — Tue, 29 Nov 2011 17:01:48 +0000

I have started posting my guides on a new site that I setup at http://passwdshadow.com Please follow me on there if you like my posts.

Attaching Fedora 16 to an Active Directory domain for logins

meltingrobot — Mon, 14 Nov 2011 15:17:22 +0000

After a couple of days spent figuring out what was missing in terms of packages and configuration stuff. I finally got my test workstation talking to the Active Directory at the location I work at. It was a bit tricky because a few settings have changed with the newer version of Samba that were very different from the settings I use with RHEL5/6.

First, this assumes that iptables and selinux is off, and it also assumes that all updates are applied. Outside of that, this is with a basic Desktop install of Fedora 16.

Some extra packages need to be installed that aren’t installed by default, use the following command for that:

yum -y install samba-winbind samba samba-winbind-krb5-locator

Next, as root, run the following command

system-config-authentication

Change User Account Database to “Winbind“

Winbind Domain = Your Active Directory Domain Short Name, Example: MYDOMAIN

Security Model = ads

Winbind ADS Realm = Your Active Directory Domain Long Name, Example: DS.MYDOMAIN.COM

Winbind Domain Controllers = Your Active Directory Domain Controllers separated by commas, Example: dc1.mydomain.com,dc2.mydomain.com

Template Shell: This is the default shell you want for all domain users, for mine, I choose /bin/bash

If you click over to the Advanced Options tab, you may want to check “Create home directories on the first login“

Then click Join Domain, then Save, then type in an AD user that has permissions to join computers to the domain and the password that accompanies that user. Then click Okay. Back in the terminal, you should see a message like Joined ‘YOURWORKSTATION’ to realm ‘ds.Mydomain.com’ You may see some DNS Update failed messages after that, but they shouldn’t matter.

To test if your join worked, do the following:

service winbind restart
wbinfo -u

If wbinfo returns nothing, then your join wasn’t fully successful. You may need to look at /var/log/messages to see if selinux stopped you or something else went wrong. If wbinfo -u returns a list of users, then you are doing good so far. You can also test an individual user by typing “id MYDOMAIN\\myuser” You should even be able to login with your users via SSH, but we are not quite there yet with logging into Gnome with a domain user.

I found a missing setting(which might be a bug) that prevents you from logging into Gnome using the system-config-authentication tool. Use the following command as root to add the missing line into the correct file. *You should backup the file by making a copy of it just in case something goes wrong*

echo "session     required      pam_winbind.so" >> /etc/pam.d/password-auth

After this, you should be able to login to the main screen by choosing “Not Listed” and putting YOURDOMAIN\\login for the Username and then your domain password. If you checked on to auto-create the home directory earlier, that should all happen automatically. If for some reason, it still doesn’t work, you may want to try a reboot. During one test while writing this, I had to do that. During another, it just worked right away.

After this, I noticed I had an issue where I was not getting my full listing of group memberships. I found a setting in /etc/nsswitch.conf that wasn’t documented in the man page that fixed this problem. Took forever to troubleshoot. There is a new line called initgroups that defaults to just files. I changed it to the following:

initgroups: files winbind

Extra Settings for different options:

I figured I would add some other useful things that you can do to your configuration that I generally do to make things work better.

Pull UID/GID numbers from AD instead of local database

Be default, Samba/Winbind authentication is setup to generate it’s own database of UID/GID numbers for users and groups. If you are setting up a group of computers that mount a shared filesystem and you want to make sure that all users and groups on each workstation have the same UID/GID. You can change some settings to have those numbers pulled from AD instead of generated locally. To fix this, we make changes in the /etc/samba/smb.conf file

Below are the settings configured by system-config-authentication:

idmap uid = 16777216-33554431
idmap gid = 16777216-33554431

Here is what I replace them with to get UID/GID numbers pulled from AD.

idmap config * : backend = rid
idmap config * : range = 2000-50000000

After applying that conf change, do the following to clean out the winbind local database caches.

service winbind stop && rm -f /var/lib/samba/*.tdb && service winbind start

Remove domain name from username/login and change home directory location

To fix your login names from being something like MYDOMAIN\mylogin or mylogin@MYDOMAIN and instead have it just be mylogin, you will need to change a setting in the /etc/samba/smb.conf file. Below is the setting and it defaults to false, you just have to change it to true.

winbind use default domain = true

Another helpful setting is the one below for changing the default location where home directories are created. By default, they are created as /home/DOMAIN/username, this is best added in /etc/samba/smb.conf above the template shell line.

template homedir = /home/%U

Spotify installation on Fedora 16

meltingrobot — Tue, 08 Nov 2011 18:51:36 +0000

With the release of Fedora 16 today, I decided I would post the hoops I jump through to get Spotify running. In case you don’t know what Spotify is, it’s a music streaming service that for 5$ a month allows you to stream unlimited music from a very large collection that gets new releases every week.

Below are the commands in the the correct order to run post installation with Desktop chosen with no custom package changes, selinux, and iptables are off.

yum -y install perl-ExtUtils-MakeMaker gcc qt-webkit rpm-build git
cd /tmp
git clone git://git.kitenet.net/alien
cd alien
perl Makefile.PL; make; make install
wget http://repository.spotify.com/pool/non-free/s/spotify/spotify-client-qt_0.6.2.291.gcccc1f5.116-1_amd64.deb
/usr/local/bin/alien --to-rpm spotify-client-qt_0.6.2.291.gcccc1f5.116-1_amd64.deb
rpm -Uvh --nodeps spotify-client-qt-0.6.2.291.gcccc1f5.116-2.x86_64.rpm
ln -s /usr/lib64/libssl.so.1.0.0g /usr/lib64/libssl.so.0.9.8
ln -s /lib64/libcrypto.so.1.0.0g /lib64/libcrypto.so.0.9.8

Okay, so that covers the installation part, now to address the problem with Spotify crashing upon opening after it working fine the first time. Apparently, there is some corruption that happens with the local cache that causes problems. So below, I have instructions on creating a bash script to workaround this issue.

Again, as root, do the following:

mv /usr/bin/spotify /usr/bin/spottify

Then using your favorite editor, open a new /usr/bin/spotify “gedit /usr/bin/spotify — if you need a new user friendly editor” Then paste the following into the file and save it.

#!/bin/bash
/bin/rm -rf ~/.cache/spotify
/usr/bin/spottify

Then run the following line to make the file executable:

chmod ugo+x /usr/bin/spotify

After that, you should be able to use the shortcut in your Gnome menu by finding it under Applications > Sound & Video or searching for Spotify.

Cron job for monthly top 50 directories by space usage

meltingrobot — Mon, 24 Oct 2011 16:10:37 +0000

Below is a little cron item I conjured up today to report the top 50 directories sorted by space. At some point, I may work on fixing it so it only reports bottom level directories.

du -h /exports/projects/ | sort -h -r | head -n 51 > /tmp/topproject.txt && mail -s "Linux Projects Top 50" myemail@mydomain.com < /tmp/topproject.txt