Backup and restore openldap 2.4

Backup

/etc/init.d/slapd stop
sudo slapcat -n 0 > backup/config.ldif
sudo slapcat -n 1 > backup/users.ldif
sudo cp /etc/ldap.secret backup/ldap.secret
/etc/init.d/slapd start

Restore

/etc/init.d/slapd stop
sudo slapadd -n 0 -l backup/config.ldif
sudo slapadd -n 0 -l backup/users.ldif
sudo cp backup/ldap.secret /etc/ldap.secret
/etc/init.d/slapd start

Openldap 2.4 and TLS

The HOWTOs I used were:

• TLS section of the admin guide
  
• The TLS FAQ entry - also includes a quick howto for creating your own CA
  

The most annoying thing about openldap is that pretty much every bit of advice and howto on the Internet is for the old version that uses slapd.conf. In the new version (2.4) everything is stored in the LDAP database in ldif itself. So where is the advice about how to add the TLS config directives? Nowhere! Not only that, but ldapadd and ldapmodify are really difficult to use, with poor error messages if you screw up your ldif syntax.

You need to write a file tls_ldap.ldif:

dn: cn=config
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ldap/ssl/demoCA/cacert.pem
-
add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/ssl/servercrt.pem
-
add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ldap/ssl/serverkey.pem

Then run:

sudo ldapmodify -f tls_config.ldif -D cn=admin,cn=config -x -y /etc/ldap.secret

This assumes that the admin password is stored in /etc/ldap.secret - this is how the debian package installs ldap. Most advice on the internet tells you to look in slapd.conf for rootpw - retarded. Interestingly, after I disabled regular ldap in favour of ldaps below, I couldn't use ldapmodify anymore, even when I specified ldaps:// with the -H parameter. Had to re-enable regular ldap, run the command then turn it off again.

Add the following line to /etc/default/slapd (if you only want SSL then just use ldaps):

SLAPD_SERVICES="ldap:/// ldaps:///"

Restart slapd.

On the client you need to copy over the cacert, and add these lines to /etc/ldap.conf:

uri ldaps://myserver.fqdn.com/
tls_cacertfile /etc/ssl/ldapcacert.pem
tls_checkpeer no

I had to turn off tls_checkpeer, even though this shouldn't be necessary. The server wasn't giving any error logs, until I ran it manually in super debug mode:

sudo slapd -d -1 -g openldap -u openldap -h ldaps:/// -F /etc/ldap/slapd.d/

When it gave "unable to get TLS client DN". I figured out what the problem was: I was just using "myserver" in the URI, instead of the FQDN in the certificate. So make sure you put the same domain in your ldaps uri as appears in your certificate (should be fully qualified like "myserver.fqdn.com").

Python distutils installer and user_options

I found the standard doco for distutils to be pretty appalling. It is really only useful for simple cases. The API Reference is slightly more useful, but still not great. I couldn't find a good explanation of how user_options worked to pass extra stuff into the setup script.

Here a few things I found out after a lot of mucking around:

• Tuples that go into the user_options array should look like:

  ('mysql-root-passwd=', "p", 'MySQL root password for local server [default: None]')

  The '=' on the first element tells distutils this options should have a value (i.e. it is not a boolean option)
  
• Options get stored as object variables in your class so the one above turns up as self.mysql_root_passwd - note the substitution for '-'.
  
• To subclass the install command inherit from

  from distutils.command.install import install

  and set

  'cmdclass': {'install': WhitetrashInstallData}

  in your call to setup.
  
• If the doco sucks, take a look at the code:

  /usr/lib/python2.5/distutils/command/install_data.py

  helped me.
  

Installing zenoss-core on Ubuntu Intrepid

Zenoss only has instructions for older versions of ubuntu. I had to install the following packages to get it to compile on intrepid:

sudo apt-get install \
libpango1.0-dev \
libcairo2-dev \
libxml-2 \
python-cairo-dev \
gettext \
mysql-dev \
python-setuptools bzip2 \
mysql-server mysql-client python-dev build-essential subversion snmpd autoconf snmp

Which got me to this error:

/usr/include/asm-generic/fcntl.h:117: error: redefinition of ‘struct flock’
/usr/include/asm-generic/fcntl.h:140: error: redefinition of ‘struct flock64’

but thankfully someone has a patch already:

--- Samba/source/ntvfs/sysdep/inotify.c.~1~   2008-07-30 15:44:55.000000000 -0400
+++ Samba/source/ntvfs/sysdep/inotify.c   2008-11-11 15:56:44.000000000 -0500
@@ -29,10 +29,10 @@
 #include "lib/util/dlinklist.h"
 #include "libcli/raw/smb.h"
 
-#include 
-#include 
+#include 
 
-#ifndef HAVE_INOTIFY_INIT
+#if 0
+#include 
 /*
   glibc doesn't define these functions yet (as of March 2006)
 */

apply with:

$ cd inst/build/wmi-*/
$ patch -p0 < patchfile 

Configuring ssh on a cisco switch or router

To get ssh working on cisco gear, you first need an image which actually supports it. Seriously? This is retarded. Upgrading is fairly easy via the web interface once you have navigated the cisco downloads maze. They have a HOWTO enable ssh, that boils down to:

aaa new-model
username someuser password 0 thisisabadpword
service password-encryption
line vty 0 4
transport input telnet

Test with telnet and the username/password you used above then:

ip domain-name mydomain.com
cry key generate rsa
ip ssh time-out 60
ip ssh authentication-retries 2

Disable everything except ssh:

line vty 0 4
transport input ssh

If there is another vty line, then do the same for that one.

Bridging a bonded network interface on ubuntu to a cisco switch using LACP 802.3ad

There are a lot of out of date howto's for doing bridging on linux. I found a good one - it is really easy (this is works on Ubuntu intrepid):

apt-get install ifenslave

Then change your /etc/network/interfaces - this setup bonds the two interfaces together so both are used to maximise throughput:

auto bond0
iface bond0 inet dhcp
  slaves all
  bond-mode 4
  bond-miimon 100

It is also possible to bridge a bonded interface, with a interfaces file like this (you'll also need bridge-utils):

auto bond0
iface bond0 inet manual
    slaves eth1 eth0
    bond-mode 4
    bond-miimon 100

auto br0
iface br0 inet static
 address 192.168.0.1
 netmask 255.255.255.0
 network 192.168.0.0
 broadcast 192.168.0.255
 gateway 192.168.0.254
        bridge_ports bond0
        bridge_fd 9
        bridge_hello 2
        bridge_maxage 12
        bridge_stp off
 dns-nameservers 192.168.0.1
 dns-search my.lan

You switch needs to support 802.3ad, which apparently most modern ones do. I have it working with cisco following their howto, which boils down to:

Router> enable 
Router# configure terminal
Router(config)# interface port-channel 1
Router(config-if)# interface g1/0/24
Router(config-if)# channel-group 1 mode active 
Router(config-if)# exit
Router(config)# interface g1/0/23
Router(config-if)# channel-group 1 mode active 
Router(config-if)# end
Router# copy run start

This should give you lines like this (show run):

interface GigabitEthernet1/0/23
 channel-group 1 mode active
!
interface GigabitEthernet1/0/24
 channel-group 1 mode active
!

Vmware server console 1.0.4 broken on 64bit intrepid

I was getting the following errors on intrepid amd64 when trying to install vmware server console 1.0.4:

/usr/lib/vmware-server-console/lib/wrapper-gtk24.sh: 316: /usr/lib/vmware-server-console/bin/vmware-server-console: not found
/usr/lib/vmware-server-console/lib/wrapper-gtk24.sh: 370: /usr/lib/vmware-server-console/bin/vmware-server-console: not found

The fix was to install the ia32-libs package.