Apache 2.2 PAM troubles

This time i had to configure an apache to use pam to connect through winbind to an Active Directory.

Basically i was trying to port an Apache 2.0 vhost to Apache 2.2 since we are switching servers.

It took me some time until we found a bugreport indicating why it is not working anymore..

AuthBasicAuthorative Off

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=394097

SATA Problems Part II

Last weekend i got the replacement disk for my broken sata disk and reinstalled it. I found a manual quite quick but had some serious problems since i either got one of the two following errors while trying to rebuild the raid 1 array:

ata1: Timeout
ata1: DMA Timeout

Although i had some ideas what could be wrong my last solution was to change the SATA Cable and that was all it needed...


Rebuild Array

To rebuild an array with a clean disk i found this guide useful:
http://www200.pair.com/mecham/raid/raid1-degraded-etch.html

Although it was written for IDE Disks you can use it also for SATA..

Here the needed parts extracted:
We start by copying the partition structure from /dev/hda to /dev/hdc. We do this for what should now be an obvious reason: the secondary drive is empty, but it needs to have the same structure as the primary drive. If the disk was first cleaned, and is large enough, you should have no errors (but you may still have to --force it):

sfdisk -d /dev/hda | sfdisk /dev/hdc

We make sure the superblocks are zeroed out on the new drive (as always, be careful you do this to the correct drive). Edit as needed:

mdadm --zero-superblock /dev/hdc1
mdadm --zero-superblock /dev/hdc5
mdadm --zero-superblock /dev/hdc6

Now we add our three hdc partitions to the corresponding md's.
Understand what you are doing here before you do it, edit as needed:

mdadm --add /dev/md0 /dev/hdc1
mdadm --add /dev/md1 /dev/hdc5
mdadm --add /dev/md2 /dev/hdc6

Watch them sync:
watch -n 6 cat /proc/mdstat

Once the recovery is complete (and not until then), create a new boot records on both drives:
grub

From the grub> prompt (edit partition number if needed):
root (hd0,0)
setup (hd0)
root (hd1,0)
setup (hd1)
quit

SATA problems

I had some serious problems with my Server concerning some sata harddisks. Unfortunately not only my raid 0 system with a one year old Samsung SpinPoint was broken (i sent the disk to samsung) also another disk failed with serious failures and locked my system.

So i bought a new one and wanted to transfer the data from the broken one as good as possible to the new one before it completely fails. But i was stopped by my own ignorance.. the new 500GB disk was not working with the sata Controller onboard.. so when i went back to change it into a smaller disk (since i thought there are some size restriction in effect which stopps my controller to get it working with the disk) they just told me to jumper the disk to sata I and try again..

Not only is this jumper setting not explained in the small tiny manual which is normally shipped with the disks, i also called the support Hotline preview to this incident to confirm my theory (with the size) and was a little angry they have not told me this on the phone before.. Not that i have much to do, i am just a workaholic with a family and a little girl....

Never less i used the jumper setting they told me and tried again.. first the controller had troubles recognizing the disk but after another restart it was finally there.
Good, now all i have to do is partioning the disk and then create a filesystem.. but then the same errors appeared on the disk as on the old one.. NOT AGAIN...

Another mistake of me was to define the problem with the Controller... ok it's a via chipset and it has some troubles with maxtor 500GB disks and i am not very found of it and maybe it is also a reason for the problems. Either way i just bought a pci sata Controller and installed it.. and it found both sata disks (not my raid array, that is on another sata controller.... ok now that sounds more complicated than it really is.) and after booting linux i tried to mount both disks.

The new one did not have any problems, i was able to recreate the partition and installed a filesystem, but the old one still got some errors by mounting readonly:

sd 5:0:0:0: SCSI error: return code = 0x8000002
sdc: Current: sense key: Aborted Command
Additional sense: Scsi parity error
end_request: I/O error, dev sdc, sector 206307443
lost page write due to I/O error on sdc1
ATA: abnormal status 0xFF on port 0xFFFFC2000004439C
ata6: status=0xff { Busy }

Luckily i found a site which proposed to change the sata cable. Since i changed it to the one shipped with the controller the disk run as smooth as ever.

Now i could be pretty angry for searching this little fellow for about two weeks but i am just relieved that the data on the disk are ok. Naturally the first thing i did was to backup the complete disk to the new one before laying my hand into the fire ;-)

vserver with different Architecture

My system is a little weird since i did a poor job installing linux: i installed a 32 bit system on a 64bit architecture and then just changed the kernel.

Now installing a new vserver with debootstrap it automatically uses the source system which in my case is 32bit and therefore i got the errors:

kernel: IA32 syscall 311 from ...

It finally annoyed me enough, so i asked a friend and with his help i finally managed to change the architecture when installing a new vserver:

newvserver --hostname name --domain domain --ip ip --dist testing --interface eth0 --arch amd64 --context context

Not only i got rid of the warnings, i experienced a slight boost in performance. But maybe this is because of the source of the error. Now i am installing all vservers again in 64bit and move forward.

LDAP the second - Apache2

After getting LDAP Working on PAM the next move was to get it working with Apache. I tried several ways:

• direct contact to the AD through LDAP
• using PAM
• using Kerberos

and i was able to get it working through LDAP. For that i needed the module authnz_ldap and lap. Then all i had to do is to get the correct Authorization config into the virtual host:

<directory>
...

AuthType Basic
AuthName "LDAP"
AuthBasicProvider ldap
AuthLDAPBindDN cn=ldapauth,ou=Users,dc=your,dc=domain,dc=com
AuthLDAPBindPassword password
AuthLDAPURL "ldap://yourdomain.com:389/ou=Users,dc=your,dc=domain,dc=com?sAMAccountName?sub?(objectClass=*)"
AuthzLDAPAuthoritative off

Require valid-user

...
</directory>

Some Explanations: The AuthBasicProvider is needed as of Apache 2.2 since else you will get an error Message.

Links:

• http://www.rrze.uni-erlangen.de/dienste/arbeiten-rechnen/linux/howtos/ldap/anwendungen/apache.shtml (German)
• http://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html#authldapgroupattributeisdn
• http://www.le.ac.uk/cc/sh23/adldap.html
• http://support.microsoft.com/kb/555092
• http://thomas-howard.com/Reference/Articles/Apache+AD/
• http://www.issociate.de/board/post/328656/LDAP_authentification_from_2.0_to_2.2.html
  

Ldapping the World - Active Directory and PAM

Introduction
Working with multiple vservers we started thinking about using a single user database for all authentications. Since we are using a MS Server with Exchange and so on it was decided that the Active Directory (AD) of that Server is our User database.

Next we had to get everything under Linux configured to authenticate against our AD, which meant we had to configure PAM to use our AD. Now there are two ways to do that: Winbind and LDAP. Winbind was used before and we had some real bad problems when the Windows Server has been restarted so we thought of using LDAP. Beside that, we did not want to install Samba on all Vservers.

Now to get LDAP working there are some small thoughts you have to consider: First, you need openldap (or similar) to get information from LDAP, but to authenticate you have to use at least kerberos. There are other ways also, but i wanted to keep it as simple as possible and security measurements (clear text passwords,...) were not in consideration at this point.

Our System:
- Windows Server 2003
- Debian Linux testing (at this point)

Windows
You will have to adjust also the Windows Server since it has to add some more Fields for Unix to the Active Directory. Depending on your system there are multiple ways and they are all explained in the links i added at the end. We used Microsofts Services for Unix 3.5 (SFU).

Then i added a new user ldapauth for the communication, and i adjusted my own user for testing, which means i activated the Unix Attributes and set everything.

ldapsearch
First i had to get ldapsearch working. For that i installed ldap-client

apt-get install ldap-client libnss-ldap

and then i backuped the /etc/ldap/ldap.conf file because i made a symbolic link to /etc/libnss_ldap.conf:

HOST yourhost.com
base ou=Users,dc=your,dc=host,dc=com
uri ldap://yourhost.com/
ldap_version 3
binddn cn=ldapauth,ou=Users,dc=your,dc=host,dc=com
bindpw password
nss_base_passwd ou=Users,dc=your,dc=host,dc=com?one
ss_base_shadow ou=Users,dc=your,dc=host,dc=com?one
nss_base_group ou=Groups,dc=your,dc=host,dc=com?one
nss_map_attribute rfc2307attribute mapped_attribute
nss_map_objectclass rfc2307objectclass mapped_objectclass
nss_map_attribute uniqueMember msSFU30PosixMember
nss_map_objectclass posixGroup Group
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_attribute uid sAMAccountName
nss_map_attribute shadowLastChange pwdLastSet
pam_login_attribute sAMAccountName
pam_filter objectclass=User
pam_password ad
ssl off
nss_map_attribute uidNumber msSFU30UidNumber
nss_map_attribute gidNumber msSFU30GidNumber
nss_map_attribute userPassword msSFU30Password
nss_map_attribute homeDirectory msSFU30HomeDirectory
nss_map_attribute loginShell msSFU30LoginShell
nss_map_attribute gecos name

Then i was able to use ldapsearch:

ldapsearch -x -Hldap://yourdomain.com/ "(cn=User Name),dc=your,dc=domain,dc=com" -W -DAdministrator

passwd
Now i had to change the /etc/nsswitch.conf:

passwd:         ldap files
group:          ldap files
shadow:         ldap files

normally getent passwd should first show the activated AD User and then the linux user. I had some troubles get it working correctly and used strace getent passwd to see that my users from AD have been parsed but somehow did not return in the list. Unfortunately i am not sure anymore what i have done to get this working, but i am pretty sure that it was some change in the /etc/libnss_ldap.conf.

Kerberos
Now after we have got ldap talking with AD we need kerberos installed for PAM.

apt-get instal heimdal-clients libpam-heimdal

and then i had to configure the /etc/krb5.conf:

[logging]
default = FILE:/var/log/krb5lib.log
[libdefaults]
ticket_lifetime = 24000
default_realm = YOURDOMAIN.COM
default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc
default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc
krb4_config = /etc/krb.conf
krb4_realms = /etc/krb.realms
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
v4_instance_resolve = false
v4_name_convert = {
host = {
rcmd = host
ftp = ftp
}
plain = {
something = something-else
}
}
fcc-mit-ticketflags = true
[realms]
YOURDOMAIN.COM = {
kdc = yourdomain.com:88
admin_server = yourdomain.com
default_domain = yourdomain.com
}
[domain_realm]
yourdomain.com = YOURDOMAIN.COM
.yourdomain.com = YOURDOMAIN.COM
[login]
krb4_convert = true
krb4_get_tickets = false

You can test it with:

kinit testuser

PAM
Now finally i had to configure the pam configuration files:

• common-account

account sufficient pam_ldap.so
account required pam_unix.so

• common-auth

auth sufficient pam_krb5.so ccache=/tmp/krb5cc_%u
auth sufficient pam_ldap.so use_first_pass
auth required pam_unix.so nullok_secure

• common-password

password required /lib/security/pam_ldap.so use_authtok md5
password required pam_unix.so nullok obscure min=4 max=8 md5

• common-session

session required pam_unix.so
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

Enjoy!

Links:

• http://www.linux-magazin.de/heft_abo/ausgaben/2002/04/zentrale_meldestelle (German)
• http://www.linux-magazin.de/heft_abo/ausgaben/2005/05/fenster_oeffnung (German)
• http://adminspotting.net/articles/windows/Linux-and-Active-Directory.html
• http://developer.novell.com/wiki/index.php/HOWTO:_Configure_Ubuntu_for_Active_Directory_Authentication
• http://gentoo-wiki.com/HOWTO_Adding_a_Samba_Server_into_an_existing_AD_Domain
• http://wiki.freaks-unidos.net/linux%20ldap%20howto#setting-up-active-directory
• http://www.microsoft.com/technet/solutionaccelerators/cits/interopmigration/unix/usecdirw/17wsdsu.mspx
• http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/tkerberr.mspx
• http://technet2.microsoft.com/WindowsServer/en/library/8196d68e-776a-4bbc-99a6-d8c19f36ded41033.mspx?mfr=true
• http://www.linuxquestions.org/questions/showthread.php?t=287606
  

Apache2 proxy on vservers

I have recently changed my internal structure from chroot to vserver, and therefore i was able to split my development system from my live system.

But unfortunately that also meant that there is only one vserver who gets the port 80 requests. I thought a long time about that and decided there must be a possibility to use apache2 as a proxy, but also to use wildcards. (I did not want to have multiple files on different systems).

For that i have installed apache2 on both machines. On the live one i have one configuration file for all proxy requests:

<virtualhost>
ServerName www.sub.example.com
ServerAlias *.sub.example.com

CustomLog sub.example.com-access.log combined
ErrorLog sub.example.com-error.log

ProxyRequests On

<proxy>
Order deny,allow
Allow from live-ip
</proxy>

ProxyPass / http://develop-ip/
ProxyPassReverse / http://develop-ip/
ProxyPreserveHost On
</virtualhost>

That way all Requests are send to the development vserver and i don't have any more headaches about it.

See also:
http://www.debian-administration.org/articles/358
http://kpumuk.info/ruby-on-rails/upgrading-apache-to-version-2-2-in-debian/

ubuntu your way

I just installed ubuntu on my new/old company notebook and must say it was quite easy. Last time i tried this i had troubles with about everything, but that was about two years ago. This time everything went smooth.. i mean i had some troubles and had to install it about two times to get it up and running, but that's my fault.

The only real Program which made serious troubles was eclipse. Normally i use Vim to code but with growing projects i had to use a ide which was able to handle them. So i use eclipse and configured it to use Vim whenever i like to. (Added the editor to the php files).

Since i have a windows client i thought i just have to export my eclipse bookmarks and import them on the notebook.. wrong way.. i had so many errors that i did not know which way to go. Fortunately all was saved in the .eclipse directory in my home and i just had to delete it to start from scratch.

This time i started with one Bookmark after another, starting with PDT (since i code php) and installing all needed addons. Finally got it working.

Then subversive where i had to disable a certain update since it uses Win32 libraries (at least that what's the error message told me.)

After installing all addons i had troubles getting svn working since it showed me some kind of PROPFIND error..
Luckily i found some Sites which described the error and that i had to update java at least to version 6 and then tell eclipse to use it instead of the gcj runtime. (german site: http://forum.ubuntuusers.de/viewtopic.php?p=757773#757773)

Installing Java was not the problem, getting eclipse use it was harder. Although i changed it in my private eclipse settings (eclipserc) it still used the global java_home configuration instead so i had to change it there too.

Then finally I got it up and running with all I wanted ever..

Last Program I installed was synergy which is pretty cool! (you should try it)

svn your system

After my friend used subversion also for the linux system for quite some time now i thought i give it finally a try.

Installing svn or importing the system was not the problem, but how am i able to add the system into svn without having to checkout at the end.

Goggling with the right words i found this.

The Trick is to add the directories by hand into the svn with mkdir and then checkout the empty directory into your system. Then all you have to do is to add all files and directories and commit everything:

# svn mkdir file:///root/svn-repository/etc
      -m "Make a directory in the repository to correspond to /etc"
# cd /etc
# svn co file:///root/svn-repository/etc .
# svn add *
# svn ci -m "Initial version of my config files"

debian update => uninstalled samba?

I did not update my etch installation for a longer time so i thought it's time to run the update...

The long list of updates was another indication of the long time i missed updating, but i looked it through and started the process.

After it was finished i had a problem with my network directories.. there were no network directories anymore... so i looked the status of samba, not running.
Ok then start it up, nothing in return... status, nothing... what the f*** ??

After some research (which did not get me any conclusion) i tried to get the version by using
apt-show-versions samba

but it returned that samba is not installed... what?

apt-get install samba and it runs smooth as before. But why the hack was it uninstalled when i tried to update it?

Win XP Shares

Since i had my part of Harddisk failures i implemented a backup system (rsync and cron) to my linux server to prevent any dataloss. But i had some error messages and never got the time to look into that matter, until today.

I was never sure if it is a Windows or a samba problem but first what my script does:
1.) connect a windows share through samba mount.
2.) backup via rsync the data to my linux system
3.) disconnect.

So everythin i have to do is to share a directory under xp and that's all... or is it not. Working through my google results i learned that there are some difficulties to think of. First: i don't like the guest account and i left it disabled. I just used the "easy" sharing model of xp and that worked fine.

Ok, so where is the Problem: The Problem is when you are sharing directories under a folder that is not accessible by everyone (for example, individual folders under "Documents and
Settings").

Although i clicked on share this Directory and User have all rights, windows don't give you this rights. You have to disable the "easy sharing" model and then go to the folder permissions (of the shared directory) and on the security Tab.

There you can find a setting which tells that if there are permission settings on the parent directory (which there are for Documents and Settings) it will use them instead of anything else. Which meant: Nobody has rights on that Directory except the User who owns the individual parent folder...

%$&!! only windows can be so complicated. That's why i like linux. You tell the right permission to a folder and that's all, nothing more....

So all you have to do is to disable that parent overwrite.. (or to be exact: enable the overwrite parent settings checkbox).

Now i don't get any permission denied errors anymore!

ide troubles

After i got my Raid Array working i had another Problem with the debian kernel i upgraded (kernel-image-2.6.8-11-amd64-k8), my ide harddisk was not working..

Tracking the problem i found that there were no hd devices in /dev. I checked the config of the kernel and the kernel uses ide as a module. Ok, now all i had to do is to load the right module.

Since i was not very familiar with installing specific modules, or knowing which module was the right i had some troubles getting it working. ide-cd and ide-disk were loaded, still something was missing.

Today i found it: ide-generic. After loading it with modprobe everything was there in /dev and i was able to mount the disk. Now all i had to do is to add it in /etc/modules.

Promise Raid at Linux

For two days now i have been tracking a problem on my new server. Grub was not able to read the updates debian at the menu.list. I was triing almost everything, but everytime i booted, the Menu from Grub did not change, until i found the Problem this night.

The Reason i had so much trouble was that the Promise (378) Raid Array was not recognized right by sarge. So every change i made was written to the second Disk, while the first Disk was the one i booted from...

After some research i found out that Promise has stopped supporting drivers for their controllers after kernel 2.4.22 (or so.) So the only good way is to create a linux software raid instead.

Took some time to get that information.

If you want to create a Raid 1 system with mdadm you can try that:

mdadm --create /dev/md0 --chunk=64 --level=raid1 --raid-devices=2 /dev/hda1 /dev/hdc1

Some times /dev/md0 is not there yet, so you can either add it manually or add --auto to the mdadm string and it will create it automatically.

debian updates Berkely DB => svn troubles...

Usually i update our linux server in periodic times. Now there was this bis security update where they also switched to Berkely DB 4.3. Subversion Users may notice that this is a little tricky, since you have to move your repository from 4.2 to 4.3.

It really can be messy, if you haven't updatet yet, look here for instructions.

Otherwise there is a good description here, how to get your old 4.2 repository to work on the new 4.3 Database when you already updated the Database.

Took me some time to backup our repository here.

ssh problem solved

I actually can't belive it yet.. i solved my ssh problem which was givin me some sleepless nights since april this year.

I have a debian sarge running with a chroot environment (debian etch). In etch i was not able to get ssh running after an update. It was always saying: Server was not able to allocate pty...

Now i found my mistake.. somehow the mount option was deleted and so it was never able to activate the pts..

Here is what was missing:
mount -t devpts devpts /chroot/dev/pts

Where chroot is the Directory to your chroot System. Maybe there are also some people having problems with this..

Raid? What for?

A couple of months ago i had a terrible Harddisk crash and lost all my data. Therefore i buyed 2 SATA Discs and build a RAID Array for more protection.

Yesterday i thought it is about time to make a Backup (which means burining all sensitive Data on CD)....

As i went home and started the computer my Raid Controller said good Evening and i have a critical Error in the Array.... WHAT THE *%/§)%"!!!

I mean 3 months and already problems is not a good way is it? I am now triing to save as much as i can, but why had i build the damn array if it fails so soon?

running PHP4 and PHP5 parallel

I have installed both versions on my development server and am running two instances of apache, one for each. Now this is running since last year and i have got no problem what so ever.

Now i have got this new Project, which is a relaunch of a website. The site, as you can imagine, is written in php4, and is pretty big. So they decided a step by step relaunch, beginning with its shop system.
Naturally i decided to write the new shop module in php5, because the data is too sensitive to handle it just in php4, no offense intendend.

Now we have got the Problem, the administrator of their server is not really a technical genius.. in other words, he is able to keep the machine going, but has abolutely no idea how to install php5 parallel to php4.

While my solution (2 instances of apache) works fine for me, i don't think it is the solution for the customer, so i looked into the net and found a real cool solution. (in a matter of seconds ;-)

This solutions works like this: They install both PHP versions (one, php5, from source) and configured apache that it will use php5 in the directory you like, by enabling mod_action.

Real cool! Here is the link

debian sarge released stable

After several years and a week later they finally managed to release sarge as stable....
My first action was to update my woody/stable debian installation to sarge...

Error?? ... ok .. look into the sources.list... ahh.. some servers are not up to date.. ok change it... all worked fine!!! ;-)

Then i did something i don't like.. i let them update everythink... waited and then rebooted the server..

If everythink worked fine it should get up without problems, if not, i will not get any sleep today...

And then everythink worked just perfect....

Today i will update my sarge/testing chroot installation to etch...

never change a running system

This is the first rule every technician learn. But what if the server will not work anymore... After about 8 months our Debian Server run without big problems.. but today when i got to work, nor ssh or samba was working. Only apache still ran without any problems.
I went to the server room and triied to start ssh by hand.. but nothing happend...

So i took a good breath.. waited a little time and then entered this magical words... shutdown...-h...now .... and stared shocked at the monitor if anythink bad happend and wondered if i did the right thing...

Then i waited .. it must have been hours.. but it was surely not more than some seconds... boot screen... linux starting up... no error message.. good..initilizing... ok... login prompt...wow.. nothing happend?... i logged in to check further... samba is running, ssh is runnning.. apache ...and everythink else...

I got up and back to my workstation and checked again.. everythink is working fine.. i checked the log files.. nothing reported between the 4 of Mai and today after i rebooted the server.. strange very strange..

although everythink works probably normal, i don't know why it did not work in the first place.

ssh Problems after upgrade

My development server at home runs with debian. At First i installed debian woody with a chroot sarge environment. Then i bought a 200 GB Harddisk and was forced to upgrade my woody kernel to 2.6.10. I managed to get woody to work with the new Harddisk and everythink else, but in my sarge chroot environment my ssh will not work anymore.

It says: could not allocate tty or stdin: is not tty.

I checked the usual thinks, /dev/pty are more than enough, mtab and fstab are ok for an chroot environment. The sshd_config is also allright. The only version how i managed to get ssh to work was from linux typing: ssh root@localhost -p sh -i

Uninstalling and then reinstalling ssh again will not work. And i could not find anythink on the net. I will not give up, but i do not know what option i have to try?