Using OpenLDAP as Authentication Directory Service in RHEL 6

Installing OpenLDAP

$ yum install -y openldap openldap-clients openldap-servers

Configure OpenLDAP

Modify domain (olcSuffix) and the LDAP super username (olcRootDN).

$ egrep "Suffix|Root" olcDatabase\=\{2\}bdb.ldif 
olcSuffix: dc=example,dc=com
olcRootDN: cn=admin,dc=example,dc=com

Set password for the LDAP super user. To create password use slappasswd.

$ slappasswd 
New password: <redhat>
Re-enter new password: <redhat>
{SSHA}VG9HSAjxn19Qb3+gveyC2H5DlFRMIACD

And add password to configuration file.

$ grep olcRootPW /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif
olcRootPW: {SSHA}0aIvJ8mtnCYGqDc5YhW2C9rRLJwWv/HX

Create OpenLDAP Schema

Creat an empty text file /root/example.com.ldif, with

$ service slapd start

Configure OpenLDAP

# Root entry
dn: dc=example,dc=com
objectclass: dcObject
objectclass: organization
o: Example Company
dc: example

# Admin DN
dn: cn=admin,dc=example,dc=com
objectclass: organizationalRole
cn: admin

# Base DN for users
dn: ou=users,dc=example,dc=com
changetype: add
objectclass: top
objectclass: organizationalUnit
ou: users

# Base DN for groups
dn: ou=groups,dc=example,dc=com
changetype: add
objectclass: top
objectclass: organizationalUnit
ou: groups

Add this.

$ ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f /root/example.com.ldif 
Enter LDAP Password: <redhat>
adding new entry "dc=example,dc=com"

adding new entry "cn=admin,dc=example,dc=com"

adding new entry "ou=users,dc=example,dc=com"

adding new entry "ou=groups,dc=example,dc=com"

Verify add with search.

$ ldapsearch -x -b 'dc=example,dc=com'

Add User and Group OpenLDAP

# cat student.passwd.ldif
dn: uid=student,ou=users,dc=example,dc=com
uid: student
cn: student
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}!!
shadowLastChange: 16128
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
shadowExpire: 15770
loginShell: /bin/bash
uidNumber: 501
gidNumber: 501
homeDirectory: /home/student

$ ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f student.passwd.ldif 
Enter LDAP Password: 
adding new entry "uid=student,ou=users,dc=example,dc=com"

# cat student.group.ldif 
dn: cn=student,ou=groups,dc=example,dc=com
objectClass: posixGroup
objectClass: top
cn: student
userPassword: {crypt}x
gidNumber: 501

$ ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f student.group.ldif 
Enter LDAP Password: 
adding new entry "cn=student,ou=groups,dc=example,dc=com"

Configure Client Authentication through LDAP

$ yum install openldap-clients

You can configure this graphically

or you can do it via command line tool authconfig.

$ authconfig --enableldap --enableldapauth --ldapserver=192.168.122.10 --ldapbasedn="dc=example,dc=com" --disableldaptls --update
Starting sssd:                                             [  OK  

Test

$ getent passwd student
student:*:501:501:student:/home/student:/bin/bash

Reference

• http://spectlog.com/content/Minimal_LDAP_configuration_on_RHEL6_in_stages_and_details
• https://blog.christophersmart.com/articles/openldap-how-to-fedora/

Blogspot Blogger set Dynamic Width

It is quite silly with fix width layout for HTML pages, which indirectly means a web page will only use a small part of modern laptop or monitors screen. Why not make it dynamic? Let people self decide their size, by simply resizing theirs browser window. Static width does not make sense for me. So this is how I changed this blog. Simple and safe http://thewebthought.blogspot.com/2011/09/blogger-make-your-blog-fluid-fit-any.html.

How to Disable System Beep in Fedora 20

The default setup of Fedora 20 have a quite annoying feature and that is the system beep. The beep sounds when using auto completion in terminal window, but also in firefox when searching in page and not results are found.

To disable Terminal beep.

$ xset b off

To disable Firefox beep, when no search result are found in page.

about:config
accessibility.typeaheadfind.enablesound

Installing RHEL 6 Default Directory Servers, OpenLDAP

Introduction

In this blog I will show you how to install, configure and test the default directory service in RHEL 6 - OpenLDAP. LDAP directory services are common used for storing authentication credential.

1. Install

$ yum install -y openldap openldap-clients openldap-servers

2. Configure

The OpenLDAP configuration has been altered in RHEL 6. Previously it was a configuration file /etc/openldap/slapd.conf, but now it is a configuration database located in /etc/openldap/slapd.d/.

Global configuration is stored in /etc/openldap/slapd.d/cn\=config.ldif.

$ cat /etc/openldap/slapd.d/cn\=config.ldif
dn: cn=config
objectClass: olcGlobal
cn: config
olcConfigFile: /etc/openldap/slapd.conf.bak
olcConfigDir: /etc/openldap/slapd.d
olcAllows: bind_v2
olcArgsFile: /var/run/openldap/slapd.args
...

Database specific configuration is stored in /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif.

We will here change the olcSuffix (the domain for which the LDAP server provides information) and the olcRootDN (the LDAP super username).

$ grep olcSuffix /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif
olcSuffix: dc=magnuskkarlsson,dc=com

$ grep olcRootDN /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif
olcRootDN: cn=Manager,dc=magnuskkarlsson,dc=com

Finally we need to generate a password for olcRootDN. To generate the password we use the slappasswd tool. And to add it, we add the directive olcRootPW to the /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif.

$ slappasswd 
New password: <redhat>
Re-enter new password: <redhat>
{SSHA}0aIvJ8mtnCYGqDc5YhW2C9rRLJwWv/HX

$ grep olcRootPW /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}bdb.ldif
olcRootPW: {SSHA}0aIvJ8mtnCYGqDc5YhW2C9rRLJwWv/HX

3. Start

$ service slapd start

And to automatically start OpenLDAP at boot time.

$ chkconfig slapd on

4. Test

To test the installation we perform a simple search (query for you SQL people).

$ ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts
...
dn:
namingContexts: dc=magnuskkarlsson,dc=com
...

Now we are going to add entries to your directory. To add entries we use the ldapadd tool. The ldapadd expects LDIF (LDAP Data Interchange Format) file.

$ cat /tmp/example.ldif
dn: dc=magnuskkarlsson,dc=com
objectclass: dcObject
objectclass: organization
o: Magnus K Karlsson AB
dc: magnuskkarlsson

dn: cn=Manager,dc=magnuskkarlsson,dc=com
objectclass: organizationalRole
cn: Manager

$ ldapadd -x -D "cn=Manager,dc=magnuskkarlsson,dc=com" -W -f /tmp/example.ldif
Enter LDAP Password: <redhat>
adding new entry "dc=magnuskkarlsson,dc=com"

adding new entry "cn=Manager,dc=magnuskkarlsson,dc=com"

Finally we test the added entries.

$ ldapsearch -x -b 'dc=magnuskkarlsson,dc=com' '(objectclass=*)'
...
# magnuskkarlsson.com
dn: dc=magnuskkarlsson,dc=com
objectClass: dcObject
objectClass: organization
o: Magnus K Karlsson AB
dc: magnuskkarlsson

# Manager, magnuskkarlsson.com
dn: cn=Manager,dc=magnuskkarlsson,dc=com
objectClass: organizationalRole
cn: Manager

Automatic RHEL 6 Installation with Kickstart

Introduction

Today the requirement are higher to quicker responds to the market. For a computer operation that means, they must be quicker to bring up new machine. The Red Hat solution for this is to use kickstart to standardize and automate the installation of a new RHEL instances.

The simplest way to create a working kickstart file is to actually install a new system (the way you want) and then use the kickstart created by anaconda to install new machine with.

The more advanced way is to start from scratch and use the system-config-kickstart tool and create you kickstart file. But there are some shortcoming with this tool and that is it can not handle LVM.

The pragmatic way is to start from a anaconda generated kickstart file and then edit with system-config-kickstart and finally manually add the LVM partition.

Here I will show you the easy way and use the anaconda generated file.

Prerequisite

Lets get started and install a new RHEL instance the manually way. We will install this machine as a virtualized machine and as hypervisor we will use KVM.

The requirement for this machine are:

• 8 GB Disk Space
• Basic Storage Devices
• Use All Space

We will select the last checkbox 'Review and modify...', so we can see what is actually done.

What we see above is that two primary partitions are created - vda1 and vda2.

• vda1 will contain standard ext4 file system for boot. The size of 500 MB is good for boot partition and should rarely be changed.
• vda2 will be formatted with LVM and will fill up the rest of the available disk. This is also good.

The next step is the logical volumes: lv_root and lv_swap.

Note the few partition that are here created. For a server installation you would probably create more partitions, e.g. a separate partition for /var/log directory for a production server and for desktop installation you would probably create a separate partition for /home. But here we will keep to the basic suggested partition layout.

The second thing that is noteworthy is the small swap space. The thumb rule for a minimal installation production server is:

• < 2GB RAM, use 2 * RAM
• >= 2GB RAM, use RAM + 2GB

But remember these are not hard rules and dependce how often you will restart you system. For a desktop installation you will get away with smaller swap space.

Finally we will select to install a minimal installation. When installation is finish we will end up with a anaconda generated kickstart file located in /root/anaconda-ks.cfg.

Kickstart file

To make this kickstart file automatic we need to do three things:

1. Uncomment the LVM partitioning. I also renamed the volume group to vg_rhel6.
2. Add zerombr, to answer yes to the prompt question that all existing partitions will be destroyed.
3. And finally automatically restart the system after installation.

# Kickstart file automatically generated by anaconda.

#version=DEVEL
install
cdrom
lang en_US.UTF-8
keyboard sv-latin1
network --onboot yes --device eth0 --bootproto dhcp --noipv6
rootpw  --iscrypted $6$...$...
firewall --service=ssh
authconfig --enableshadow --passalgo=sha512
selinux --enforcing
timezone --utc Europe/Stockholm
bootloader --location=mbr --driveorder=vda --append="crashkernel=auto rhgb quiet"
# The following is the partition information you requested
# Note that any partitions you deleted are not expressed
# here so unless you clear all partitions first, this is
# not guaranteed to work
zerombr
clearpart --all --drives=vda --initlabel

part /boot --fstype=ext4 --size=500
part pv.253002 --grow --size=1
volgroup vg_rhel6 --pesize=4096 pv.253002
logvol / --fstype=ext4 --name=lv_root --vgname=vg_rhel6 --grow --size=1024 --maxsize=51200
logvol swap --name=lv_swap --vgname=vg_rhel6 --grow --size=819 --maxsize=819

reboot

%packages
@core
@server-policy
%end

Test

The last step is to test it. First we need to make it accessible during installation. The easiest way to do that, is to use either a FTP or HTTP server. There are also other ways, such as using a shared network disk, accessible via NFS or CIFS. But I would recommend using a known FTP server.

Now start a new RHEL installation. At the first menu, press TAB.

Then at the end enter 'ks=ftp://<server>/<path>' and press ENTER.

Reference

• Starting a Kickstart Installation - https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Installation_Guide/s1-kickstart2-startinginstall.html
• Kickstart Options - https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Installation_Guide/s1-kickstart2-options.html

Configure OpenJDK Source Code From Eclipse on RHEL 6

Introduction

In most Linux distribution is the source code for OpenJDK already available via RPM or Debian Package, but not for RHEL 6. The reason is probably the RHEL 6 main aim is for server OS and not for client development. Anyhow here is the way to make the source code available in Eclipse.

Installation

First you need to download the source zip from http://download.java.net/openjdk/jdk7/.

Then move the zip to the java home directory and name it src.zip.

$ cp /home/magnus/Downloads/jdk7u-ea798405286d.zip /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51.x86_64/src.zip

Finally restore SELinux security policy.

$ restorecon -RFv /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51.x86_64/src.zip
$ restorecon reset /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.51.x86_64/src.zip context unconfined_u:object_r:lib_t:s0->system_u:object_r:lib_t:s0

Test

If everything works fine, you should now be able to browse the java source code from Eclipse.

Troubleshoot

If the source code is not directly found, you might need to adjust the java home search path.

If that did not help, you could also verify the path to the source zip.

Finally you might need to restart Eclipse (I did not). Happy coding!

Install Flashplayer on RHEL 6

Download

Download the plug-in for Linux 64-bit (tar.gz) from http://get.adobe.com/flashplayer/.

Install

Move the tar file to /tmp and extract it.

$ mv /home/magnus/Downloads/install_flash_player_11_linux.x86_64.tar.gz /tmp/

$ cd /tmp

$ tar xvfz install_flash_player_11_linux.x86_64.tar.gz

Before proceeding close you web browser. Then move the flash player module to Firefox plugin directory.

$ cp libflashplayer.so /usr/lib64/mozilla/plugins

$ chmod 0755 -v /usr/lib64/mozilla/plugins/libflashplayer.so
mode of `/usr/lib64/mozilla/plugins/libflashplayer.so' changed to 0755 (rwxr-xr-x)

Test

Start Firefox and test against any youtube video.