Archy's Blog

By default, chromium does not have kerberos authentication enabled. In order to enable it, you'll have to set the "--auth-server-whitelist=" flag to the startup script which starts the browser. [archy@castle-bravo ~]$ sudo vim /usr/lib64/chromium-browser/chromium-browser.sh You'll have to add the "--auth-server-whitelist=" to the "CHROMIUM_DISTRO_FLAGS="-directive so that it should look like this: CHROMIUM_DISTRO_FLAGS=" --enable-plugins \ --enable-extensions \ --enable-user-scripts \ --enable-printing \ --enable-sync \ --auto-ssl-client-auth \ --auth-server-whitelist=*.archyslife.lan " For Google Chrome you'll have to edit the /usr/bin/google-chrome-File [archy@castle-bravo ~]$ sudo vim /usr/bin/google-chrome and add the "--auth-server-whitelist="-Flag to the last exec-line like so: exec -a "$0" "$HERE/ch...

Since I upgraded some servers to RHEL 7.5 / CentOS 7.5, I've noticed that when I use teaming for LACP instead of bonding, it only utilizes one nic. I was using the following teamd-runner and it was working flawlessly in 7.4. "{\"runner\": {\"name\": \"lacp\", \"active\": true, \"fast_rate\": true, \"tx_hash\": [\"eth\", \"ipv4\", \"ipv6\"]},\"link_watch\": {\"name\": \"ethtool\"}}" So I assume, the runner is not the problem. I did not dig deeper into the problem since I switched back to bonding. In case you've got some old configurations still active on your network cards, you'll need to remove them before you create an 802.3ad bond. First, add the bonding interface [archy@server ~]$ sudo nmcli connection add type bond con-name bond0 ifname bond0 mode 802.3ad This just creates the interface. We need to manually assign IP address...

What is teaming? Teaming or LACP (802.3ad) is a technique used to bond together multiple interfaces to achieve higher combined bandwith. NOTE: every clients speed can only be as high as the single link speed of one of the members. That means, if the interfaces I use in the bond have 1 Gigabit, every client will only have a maximum speed of 1 Gigabit. The advantage of teaming is, that it can handle multiple connections with 1 Gigabit. How many connections depends on the amount of your network cards. I'm using 2 network cards for this team on my server. That means I can handle 2 Gigabit connections at full rate on my server provided the rest of the hardware can deliver that speed. There also exists 'Bonding' in the Linux world. They both do the same in theory but  for a detailed comparison check out this  article about teaming in RHEL7 . To create a teaming-interface, we will first have to remove all the interface configurations we've done on the (soon to be) sla...

I personally prefer to work with hostnames instead of ip-addresses. If you have anything like freeipa or active directory, it will do that for you by registering the client you added to your realm to the managed dns and edit the records dynamically. We can achieve the same goal with just bind and isc-dhcp. I'll use a raspberry pi with raspbian 9 for this setup. So here is a quick tutorial on how to configure the isc-dhcp-server to dynamically update bind. First set a static ip to your server. [archy@ddns ~]$ sudo vim /etc/network/interfaces # interfaces(5) file used by ifup(8) and ifdown(8) # Please note that this file is written to be used with dhcpcd # For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf' # Include files from /etc/network/interfaces.d: source-directory /etc/network/interfaces.d auto eth0 iface eth0 inet static address 172.31.30.5 network 172.31.30.0 broadcast 172.31.30.255 netmask 255.255.255.0 ...

Recently I've deployed a few raspberry pi nodes running raspbian and I did not want to have local users (except the 'pi' one) but have it using ldap for authentication. So here is what I did to get it working with raspbian 9. You'll have to start by installing the necessary package in this case, which is libnss-ldapd. [archy@rpi3 ~]$ sudo apt-get -y install libnss-ldapd When the installation is complete, we'll need to edit the config. Edit the /etc/nslcd.conf in your favorite editor [archy@rpi3 ~]$ sudo vim /etc/nslcd.conf uid nslcd # The user which nslcd will run as gid nslcd # The group which nslcd will run as uri ldap://ipa01.archyslife.lan # My ldap-servers which are queried uri ldap://ipa02.archyslife.lan # for authentication requests, base dc=archyslife,dc=lan # This base will be used for all queries. Next up is the name service switch file where we'll need to add a few things. Open up the file in your favorite editor an...

This is a follow up on my previous post  in which I'm writing on how to set up a pxe-server on CentOS 7.4. But since I do not only want CentOS being pxe-bootable, I'll also add Ubuntu to the mix. So here is what I did to be able to boot Ubuntu 16.04 via pxe: Setting up the directory for pxe-booting [archy@pxe-server ~]$ mkdir /var/lib/tftpboot/ubuntu1604 Downloading the ubuntu-netboot archive and extract the necessary files to the boot-directory: [archy@pxe-server ~]$ wget http://cz.archive.ubuntu.com/ubuntu/dists/xenial/main/installer-amd64/current/images/netboot/netboot.tar.gz [archy@pxe-server ~]$ tar -xzf netboot.tar.gz [archy@pxe-server ~]$ sudo cp ubuntu-installer/amd64/{initrd.gz,linux} /var/lib/tftpboot/ubuntu1604 Now it's time to edit the pxelinux.cfg/default file. Add the following entry for ubuntu: sudo vim /var/lib/tftpboot/pxelinux.cfg/default label 4 menu label ^4) Install Ubuntu 16.04 kernel ubuntu1604/linux append initr...

Setting up a PXE server can be very usefull in home and enterprise networks, whether you want to provision a bunch of machines or just be lazy when it comes to OS installations (kickstart is your friend). For this setup, I'm using a fully up-to-date CentOS 7 installation. For making PXE possible, we need a few services which we can install by running the following command: [archy@pxe-server ~]$ sudo yum -y install dhcp syslinux tftp-server nfs-utils I think most of them are pretty self explanatory. Syslinux is a bunch of bootloaders for network-booting. When everything is installed, let's dig in to the configuration. First up, the dhcp-config, I'll configure a simple subnet. [archy@pxe-server ~]$ sudo vim /etc/dhcp/dhcpd.conf subnet 172.31.10.0 netmask 255.255.255.0 { range 172.31.10.100 172.31.10.200; option subnet-mask 255.255.255.0; # my 2 ipa-servers as dns ... option domain-name-servers 172.31.10.250, 172.31.10.251; ...

I've run into a little problem lately, the mailbox of my internal mx filled up and filled its maximum of 50MB. To make changes to your mailbox, you will have to adjust the maximum allowed size. this can be done by the following changes: [archy@mx01 ~]$ sudo vim /etc/postfix/main.cf and insert the line mailbox_size_limit = 0 # for no limit at all, not recommended! mailbox_size_limit = 104857600 # 100MB in bytes save and close the file. You now have to restart postfix in order to reread the config file. To restart, run [archy@mx01 ~]$ sudo systemctl restart postfix.service The mailbox will now be allowed to reach 100MB in size at maximum. Feel free to comment and / or sugguest a topic.

So for my private workstation and laptop I'm using Ubuntu. Even though I spent most of my time in a fully tweaked out terminal (terminator, I'd recommend it), I still do not really like the way Unity 'feels' and 'handles'. So, for reverting to gnome there are not much steps to do. First install the gdm-package. You can do so by running [archy@castle-bravo ~]$ sudo apt-get -y install gdm gnome-shell-extensions This might take a while, depending on your internet-connection. After that, you can remove the ubuntu-desktop packages. This is done by [archy@castle-bravo ~]$ sudo apt-get -y remove unity lightdm After that, let the machine reboot. [archy@castle-bravo ~]$ sudo reboot After the machine booted up, you should be greeted by the gnome login screen. Feel free to comment and / or suggest a topic.

Host Based Access Control (short hbac) is a good way to limit access to specific hosts from specific users / groups using specifig services. A small example can be seen at the end of my blogpost about spacewalk and freeipa as authentication source ( link ). Add a hbac-rule: [archy@ipa01 ~]$ ipa hbacrule-add nfs-access Add a user: [archy@ipa01 ~]$ ipa hbacrule-add-user --users=archy nfs-access Add a group: [archy@ipa01 ~]$ ipa hbacrule-add-user --groups=admins nfs-access Add a host: [archy@ipa01 ~]$ ipa hbacrule-add-host --hosts=stor01.archyslife.lan nfs-access Add a group of hosts [archy@ipa01 ~]$ ipa hbacrule-add-host --hostgroups=storage-servers nfs-access Add a service: [archy@ipa01 ~]$ ipa hbacrule-add-service --hbacsvcs=nfs nfs-access Add a servicegroup: [archy@ipa01 ~]$ ipa hbacrule-add-service --hbacsvcgroups=storage nfs-access Removing a hbac-rule: [archy@ipa01 ~]$ ipa hbacrule-del nfs-access Removing a user: [archy@ipa01 ~]$ ipa ...

This post is about setting up Spacewalk to integrate to FreeIPA'sauthentication (ldap/kerberos). First of all, why should you integrate Spacewalk to FreeIPA? FreeIPA gives you the option to control the access policies using keytabs and you can manage your users centrally.  So let's get started. I assume you have a functional Spacewalk and FreeIPA-Server set up and the Spacewalk-Server added as client to your domain. Log in to your FreeIPA-Server and add the http-keytab to your Spacewalk-Server: [archy@ipa01 ~]$ ipa service-add HTTP/spacewalk01.archyslife.lan Next run the script provided by the spacewalk-project / red hat to set up the spacewalk-services [archy@spacewalk ~]$ sudo spacewalk-setup-ipa-autchentication When that's finished, sign in to your IPA-Server again and add the H ost B ased A ccess C ontrol Service. I've named it 'spacewalk' [archy@ipa01 ~]$ ipa hbacsvcs-add spacewalk Next add a hbac-rule for allowing defined users t...

FreeIPA DNS-Management Cheatsheet show ipa's dns-configuration on your local server [archy@ipa01 ~]$ ipa dnsconfig-show modify dns-configuration on your local server [archy@ipa01 ~]$ ipa dnsconfig-mod --forwarder=208.67.222.222 --forwarder=208.67.220.220 --forward-policy=[only|first|none] show all dns servers in an ipa domain [archy@ipa01 ~]$ ipa dnsserver-find show one specific ipa-dnsserver that was found by 'ipa dnsserver-find' [archy@ipa01 ~]$ ipa dnsserver-show ipa02.archyslife.lan modify a remote ipa-dns' configuration [archy@ipa01 ~]$ ipa dnsserver-mod --forwarder=208.67.222.222 --forwarder=208.67.220.220 --forward-policy=[only|first|none] ipa02.archyslife.lan a quick note on forward-policies: only: The dns will search the local database first and if an authoritative answer can be found, return it. Otherwise it will forward and query its forwarders. If the forwarders did not reply, the dns will return a SERVFAIL. first: The dns ...