Difference between revisions of "Linux Installation"

From Tardis
Jump to: navigation, search
(Getting user information from LDAP)
Line 11: Line 11:
 
== Getting user information from [[LDAP]] ==
 
== Getting user information from [[LDAP]] ==
  
Make sure that <code>nscd</code> is installed, otherwise [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=190072 bad things] may happen.
+
The <code>libnss-ldap</code> package handles fetching account information from LDAP.
 +
Also make sure that <code>nscd</code> is installed, otherwise [http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=190072 bad things] may happen.
  
Lots more should go here, but [[User:bacam]] doesn't have time right now.
+
To tell <code>libnss-ldap</code> where to look, you need to edit
 +
the <code>/etc/libnss-ldap.conf</code>.  At the very least, you'll need to
 +
give the host and base (<code>dc=tardis,dc=ed,dc=ac,dc=uk</code>).
 +
 
 +
To tell libc to use <code>libnss-ldap</code>, you need to amend the appropriate lines in <code>/etc/nsswitch.conf</code>:
 +
<pre>
 +
passwd:        files ldap
 +
group:          files ldap
 +
shadow:        files ldap
 +
</pre>
 +
The other databases are best left alone; we don't bother putting host
 +
information or such like in LDAP because we don't see much benefit.
 +
 
 +
The <code>getent</code> program is useful for testing.
  
 
== Authenticating with [[LDAP]] ==
 
== Authenticating with [[LDAP]] ==

Revision as of 21:07, 4 February 2007

Serial console

If the machine is only providing serial output during bootup, then it may not have been configured for serial logins. Check that the /etc/inittab file contains a line like

T0:23:respawn:/sbin/getty -L ttyS0 9600 vt100

which tells init to start the program to provide login prompts.

The original kernel shipped with Debian sarge has a broken serial driver for Ultra 5s. The version in the security updates should work.

Getting user information from LDAP

The libnss-ldap package handles fetching account information from LDAP. Also make sure that nscd is installed, otherwise bad things may happen.

To tell libnss-ldap where to look, you need to edit the /etc/libnss-ldap.conf. At the very least, you'll need to give the host and base (dc=tardis,dc=ed,dc=ac,dc=uk).

To tell libc to use libnss-ldap, you need to amend the appropriate lines in /etc/nsswitch.conf:

passwd:         files ldap 
group:          files ldap
shadow:         files ldap

The other databases are best left alone; we don't bother putting host information or such like in LDAP because we don't see much benefit.

The getent program is useful for testing.

Authenticating with LDAP

Canonical /etc/pam.d/common-auth:

# ** Use trick from /usr/share/doc/libpam-ldap/README.Debian
#
auth    [success=1 default=ignore]      pam_unix.so nullok_secure
auth    required                        pam_ldap.so use_first_pass
auth    required                        pam_permit.so

Note the use_first_pass option. Without it logins will ask for a password for pam_unix, then one for pam_ldap, and so on, causing every other attempt to enter your password to fail even when you get it right.

Some more should go here, but User:bacam doesn't have time right now.

Multiple VLANs

Some systems need to appear on several VLANs, most notably the router. First, add

8021q

to the end of /etc/modules so that the kernel knows how to deal with the VLAN tagged packets. (Use modprobe 8021q to load it immediately if you don't want to reboot.) Then install the vlan Debian package, and add extra stanzas to /etc/network/interfaces for the new VLANs. For example,

# Admin VLAN
auto eth0.1
iface eth0.1 inet static
        address 192.168.1.6
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255

where eth0.1 means VLAN number 1 on interface eth0. Finally, configure the switch so that the port is on the extra VLANs.

Logging to the Log host

To make syslog send logs to the log host, put

*.*     @loghost

into /etc/syslog.conf. It is a good idea to keep the local logging too, in case of network problems.

See also

Other stuff that should be documented here, but isn't

  • Configuring machines to pass mail on to the mail hub
  • Configuring ntp
  • Booting our suns from the LAN
  • Installing munin