apt-get BADSIG 40976EAF437D05B5

As root, enter these commands;

apt-get clean
cd /var/lib/apt
mv lists lists.old
mkdir -p lists/partial
apt-get clean
apt-get update

Thanks to Luigi

LDAP Client Howto (8.04 LTS)

This is where we configure our client to authenticate with our LDAP server.

PLATFORM: Ubuntu 8.04 LTS (Hardy)

We are going to set up a Hardy client on a server machine, which involves using NFS for mounting the user homes)

apt-get install libpam-ldap libnss-ldap nss-updatedb libnss-db nfs-common nscd ldap-utils

You will again be asked a bunch of questions, the answers are the same;

LDAP server Uniform Resource Identifier: ldap://ldap.example.com
Distinguished name of the search base: dc=example,dc=com
ldap://ldap.example.com 3
Make local root Database admin: Yes
Does the LDAP database require login? No
LDAP account for root: cn=admin,dc=example,dc=com
LDAP root password: password

Now we need to edit the following files;

vi /etc/ldap.conf and add this line;

bind_policy soft

vi /etc/ldap/ldap.conf

BASE    dc=example,dc=com
URI     ldap://ldap.example.com 

SIZELIMIT       0
TIMELIMIT       0
DEREF           never

vi /etc/pam.d/common-account

account    sufficient   pam_ldap.so
account    required     pam_unix.so

vi /etc/pam.d/common-auth

auth       sufficient   pam_ldap.so
auth       required     pam_unix.so nullok_secure use_first_pass

vi /etc/pam.d/common-password

password   sufficient   pam_ldap.so
password   required     pam_unix.so nullok obscure min=4 max=8 crypt

vi /etc/pam.d/common-session

session    required     pam_unix.so
session    required     pam_mkhomedir.so skel=/etc/skel/
session    optional     pam_ldap.so

vi /etc/nsswitch.conf

passwd: files ldap
group: files ldap
shadow: files ldap

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

Now update nss to use ldap.

nss_updatedb ldap

If you get an error;
Failed to enumerate nameservice: No such file or directory

Check that your uri line in /etc/ldap.conf is correct.

You should now be able to check the server with;

ldapsearch -x

getent passwd

Mount a directory for users homes using NFS.

Create a mountpoint

mkdir /home/users

Add the following to /etc/fstab

servername:/home/users       /home/users   nfs defaults 0 0

You should now be able to login via ssh using the user "fred"s credentials

For Gnome Desktop users.

Assigning users to the correct groups at login

vi /etc/security/group.conf

gdm;*;*;Al0000-9000;floppy,audio,cdrom,video,plugdev,scanner

We need to override HALs behaviourl

vi /etc/dbus-1/system.d/hal.conf

Find and remove the following lines;

<deny send_interface="org.freedesktop.Hal.Device.Volume"/>
<deny send_interface="org.freedesktop.Hal.Device.Volume.Crypto"/>

We also need to tell pam to use the group.conf settings;

vi /etc/pam.d/gdm

Add this line;

auth optional pam_group.so

Reboot your PC and you should be able to login to gnome using ldap!

HOWTO: LDAP Server on 8.04 Hardy Heron

So, I've been playing around with LDAP and I have finally got it working. There are lots of howto's out there but none of them worked for me.

NOTE: For an up to date howto for 10.04 Lucid Lynx see this article

So, here we go!

PLATFORM:
* Ubuntu Server 8.04 LTS (Hardy)

PREREQUISITES:
* Working DNS with fqdn.
* An NFS server exporting the users home directorys

Network overview;
* domain name: example.com
* ldap-server ldap.example.com

Install The Packages

apt-get install slapd ldap-utils migrationtools

For some reason the install process doesn't ask you all of the necessary questions so when it is done we must reconfigure slapd.

dpkg-reconfigure slapd

It will ask you a bunch of questions

Omit OpenLDAP server configuration? No
DNS domain name: example.com
Name of your organization: Example Corp
Admin Password: password
Confirm Password: password
Database Type: HDB
Do you want your database to be removed when slapd is purged? ... No
Move old database? ... Yes
Allow LDAPv2 Protocol? ... No

Note: During this process, I will use "password" for simplicities sake. This is fine for setting up a test network for educational purposes but if you intend to use this in production then you should obviously choose a more appropriate password.

Oh, also, make sure you DONT FORGET IT! You will need it later.

You can now check if you can access your ldap server by typing:

ldapsearch -x -b dc=example,dc=com

Installing phpldapadmin

apt-get install phpldapadmin
ln -s /usr/share/phpldapadmin/ /var/www/phpldapadmin

Increase php memory limit

vi /etc/php5/apache2/php.ini

Find this line and change the memory limit to 64M;

memory_limit = 64M ; Maximum amount of memory a script may consume (16MB)

Restart apache;

/etc/init.d/apache2 restart

You can then browse to http://ldap.example.com/phpldapadmin

and login using admin:password

Once you have logged in, expand the tree & you should see something like this;

+--> dc=example,dc=com (1)
---> cn=admin
---> Create new entry here

Lets add some users and groups;

cd /usr/share/migrationtools/

We need to create the default migrationtools' config file "migrate_common.ph"

vi migrate_common.ph

and add the following parameters:

$DEFAULT_MAIL_DOMAIN = "example.com";
$DEFAULT_BASE = "dc=example,dc=com";

Create an ldif file with the details for our ou entries

vi ~/usergroup.ldif

dn: ou=users, dc=example, dc=com
ou: users
objectclass: organizationalUnit

dn: ou=groups, dc=example, dc=com
ou: groups
objectclass: organizationalUnit

Note: If you cut and paste from this guide, ensure that there are no whitespace chars at the end of the file.

Now that the user and group info is saved in your file, we can add it to the ldap server

ldapadd -x -W -D "cn=admin,dc=example,dc=com" -f ~/usergroup.ldif

Possible errors;
ldap_add: Invalid syntax (21)
additional info: objectclass: value #0 invalid per syntax

Probable cause;
If you copy/pasted the above then check for whitespace at the end of the users_group.ldif file. You will also need to remove the first entry (ou=users stanza) if it has already gone through before or you will get "already exists" and the script will halt before reaching the second entry

ldap_add: Server is unwilling to perform (53)
additional info: no global superior knowledge

Probable cause;
You have used incorrect domain details. Make sure the uri setting in /etc/ldap.conf is correct and that the server is pingable.

Now, if you hit "refresh" in the phpldapadmin gui, you should see your Users and Groups ou's are there.

Of course you could have added those ou's using the clickety-clickety gui as well but I just wanted to show how stuff can be added via command line. Yes, yes, I know, I'm a cruel bastard.

So now we want to add a new test user to the ldap tree using the phpldapadmin gui, but first we need to create a group called "users" in the Groups ou.

Click on the Groups ou and click "Create a child entry". Select "Posix Group".

Call the group "users" with Group ID 100. Click "Save Changes" when done.

Next, create a user in the Users ou with the following details;

User: fred
Group: users
Password: password
Encryption: crypt

Note: When I do this, the drop down box does not list /bin/bash as an option for loginShell. If you click "Save" you get a second screen where it is possible to alter the loginShell parameter to use /bin/bash. This is less of an issue if your users just use GDM. I use crypt instead of md5. You can use md5 if you prefer but remember to change the encryption type when setting up client hosts to match.

Well, assuming everything is working up to this point, the server is ready to authenticate your users.

Let's go on and set up a client on Hardy or Lucid

grub-probe: error: Cannot find a GRUB drive for /dev/sdb1

I got this error;

grub-probe: error: Cannot find a GRUB drive for /dev/sdb1

after adding a drive to my laptop and running

sudo /usr/sbin/grub-mkconfig

I had to add an entry for the new drive in /boot/grub/device.map

sudo vi /boot/grub/device.map

I added the second line;

(hd0) /dev/sda
(hd1) /dev/sdb

I then regenerated the grub config

sudo /usr/sbin/grub-mkconfig

Finally, I updated grub with the new config

sudo update-grub2

Note: Initially, I failed to update grub with the new config and received another error "Invalid signature" when trying to boot Windows off the second drive.

Blank screen when logging in to VMware server

I use vmware server a lot and unfortunately this happens way too frequently. I'm not sure if the bug lies in Firefox or VMware but there should be a username and password entry box in the middle of that screenshot.

So far I have not found a cure for it.

I do have workaround however, but it's not a pretty one.

Basically, what you have to do is hit ctrl+shift+r quickly and repeatedly until the dialog appears. Stop every half a dozen or so presses to let it catch up and hopefully the dialog will appear. If not, rinse, lather, repeat until it does.

Hardly an elegant solution I know, but at least you will be able to log into your console.

P.S. Performing the same procedure using F5 does not produce the same result (well, not for me anyway)

Inheriting group ownership for shared files

Use the SGID attribute to allow users to create files that can be opened by other users in their group.

When the SGID (Set Group Identification) attribute is set on a directory, files created in that directory inherit its group ownership. If the SGID is not set the file's group ownership will be set to the user's default group.

To set the SGID on a directory or to remove it, use the following commands:

chmod g+s directory
chmod g-s directory

When set, the SGID attribute is represented by the letter "s" which replaces the "x" in the group permissions:

ls -l public
drwxrwsr-x  10 brett users  4096 2009-012-10 17:40 public

Can't view Vimeo videos in Firefox

sudo apt-get install swfdec-mozilla ubufox