Category: Linux

Install likewise-open on Ubuntu

apt-get install likewise-open
User that can join AD should be an EID. The –ou option can also be used to place this in a Organizational Unit.
domainjoin-cli join domain.com UserThatCanJoinAD
domainjoin-cli join –ou path/organizationalUnitName domainName joinAccount

To remove the computer from the domain run:
domainjoin-cli leave

Edit sudoers to allow users to become elevated users.
root@alb-netmon1:~# visudo # /etc/sudoers
# # This file MUST be edited with the ‘visudo’ command as root.
# # See the man page for details on how to write a sudoers file.
# Defaults env_reset
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification root ALL=(ALL) ALL
#To add just one user account add the line below with the correct EID. TWCCORP\\e0NNNNN ALL=(ALL) ALL
# Allow members of group sudo to execute any command
# (Note that later entries override this, so you might need to move
# it further down) %sudo ALL=(ALL) ALL
# #includedir /etc/sudoers.d
# Members of the admin group may gain root privileges %admin ALL=(ALL) ALL
#To add an entire group use something like the line below
%domain\\AD_Group ALL=(ALL) ALL

After making changes in visudo restart sudo /etc/init.d/sudo restart
I’m currently only adding single users.
Then to login with SSH and your EID
ssh domain\\E0NNNNN@hostname

I also did this for Debian recently but two things are different. I couldn’t find a DEB package  and the shell wasn’t set by default. Also Likewise was taken over by another company and has a new name, Power Broker Identity Services.

wget http://www.beyondtrust.com/Technical-Support/Downloads/files/PBISO/7.0.1/886/pbis-open- 7.0.1.886.linux.x86.deb.sh
chmod +x filename
Run the install ./filename
Read and understand the installation agreement, current license is GPL/GPLv2.

As above add you user to sudo and join to the AD domain. Set a shell if needed, I like bash and wasn’t getting that by default. 

opt/likewise/bin/lwconfig LoginShellTemplate /bin/bash

Ubuntu and UFW

Blocking traffic using UFW a lot of this is available elsewhere and better explained. I did have some problems finding correct information on blocking out bound traffic though. So I’m putting it here for my own notes.
First the basics. UFW Uncomplicated Fire Wall.
ufw enable Turns UFW on.
ufw disable Turns UFW off.
The default is to block all inbound traffic and allow all outbound traffic. by running the rules above in that order I allow SSH in and block all other traffic. Since I’m not physically on the machine I will need SSH to allow me to stay connected and make more changes as I go along.
ufw allow ssh
ufw allow http
ufw allow https
The two above are if I am running a web server and want to allow connections from any IP to this machine.

ufw allow out to 10.10.240.0/24 port 161
ufw deny out 161
This rule allows 161 (SNMP) to one range of IP addresses 10.10.240.0/24 and the second rule blocks any traffic on 161 (SNMP) to any other IP addresses.
I know you don’t need to block outbound traffic if you know what you are doing, but I have no clue so I did it this way.

ufw status numbered

To Action From
— —— —-
[ 1] 22 ALLOW IN any
[ 2] 443 ALLOW IN any
[ 3] 80 ALLOW IN any
[ 4] 10.10.240.0/24 161 ALLOW OUT Anywhere (out)
[ 5] 161 DENY OUT Anywhere (out)

Will show a list of what has been written in UFW and show the rules with numbers. To delete a rule select the rule number and run:
ufw delete 2
This would delete rule number two.

Insert will add a new rule and insert at the number that you specify.
ufw insert 4 allow out to 10.182.96.41 port 161

It is important in what order you add a rule as they are processed in order a rule to allow any connection to port 22 with a rule like “ufw deny from 1.1.1.1 to any port 22” will be ignored unless it comes before “ufw allow ssh” at rule number one.

There are also UFW limit rules to slow things like brute force attacks.
ufw insert 1 limit ssh
This will limit the number of SSH attempts to connect slowing a possible dictionary attack on SSH. Unless someone has a reason to keep hitting your machine they will usually just move on to the next target. Again since rules are processed in order this would need to come before before any allow SSH rules if you want it to work on all SSH connections. I found a useful bit on using port forwarding with UFW here.

LVM grub not booting after upgrade to Ubuntu 11.04

I updated a Dell server that I use for work and ran into a few problems on the reboot. I ended up with a grub> prompt and it wouldn’t go any further after some research I figured out the system was unable to find my root file system.
I used an alternate install CD with the rescue option to sort out where root belonged. To do this I used vgdisplay and pv. The drive turned out to be /dev/octane/root instead of the default name and I think this was causing the problems. I passed grub the information:
linux /vmlinuz-version.number-generic.pae root=/dev/octane/root
initrd /initrd-matching.version-generic.pae
boot
The version numbers showed by using the tab key to auto complete and worked fine using the same version number on initrd and vmlinuz.
Everything is working correctly now but I have yet to try a reboot and see if it picks things up after running update-grub.

LVM grub not booting after upgrade to Ubuntu 11.04

I updated a Dell server that I use for work and ran into a few problems on the reboot. I ended up with a grub> prompt and it wouldn’t go any further after some research I figured out the system was unable to find my root file system.
I used an alternate install CD with the rescue option to sort out where root belonged. To do this I used vgdisplay and pv. The drive turned out to be /dev/octane/root instead of the default name and I think this was causing the problems. I passed grub the information:
linux /vmlinuz-version.number-generic.pae root=/dev/octane/root
initrd /initrd-matching.version-generic.pae
boot
The version numbers showed by using the tab key to auto complete and worked fine using the same version number on initrd and vmlinuz.
Everything is working correctly now but I have yet to try a reboot and see if it picks things up after running update-grub.

Ubuntu 11.04 X fails on boot

I get a flicker of a screen on boot and then no graphics.
Error in dmesg | grep fb
fb: conflicting fb hw usage inteldrmfb vs EFI VGA – removing generic driver

To get graphics ctrl+alt+F1 and login. Then run “sudo service gdm restart” and I have a full X session. Login as my user and things work well until I reboot again.
I’m having a tough time understanding the fix for this, but I have found some references that state setting the resolution in /etc/default/grub might fix things.
I found a GUI to fix this, “apt-get install startupmanager” and changed the resolution from 640×480 to 800×600 under both the boot options and the advanced tab.
Reboot and I get a GUI that works.

Ubuntu 11.04 X fails on boot

I get a flicker of a screen on boot and then no graphics.
Error in dmesg | grep fb
fb: conflicting fb hw usage inteldrmfb vs EFI VGA – removing generic driver

To get graphics ctrl+alt+F1 and login. Then run “sudo service gdm restart” and I have a full X session. Login as my user and things work well until I reboot again.
I’m having a tough time understanding the fix for this, but I have found some references that state setting the resolution in /etc/default/grub might fix things.
I found a GUI to fix this, “apt-get install startupmanager” and changed the resolution from 640×480 to 800×600 under both the boot options and the advanced tab.
Reboot and I get a GUI that works.

Add Ubuntu to AD for authentication

My guess is this would work about the same for Debian Squeeze as well.

Install likewise-open
apt-get install likewise-open

User that can join AD should be a valid user ID. The –ou option can also be used to place this in a Organizational Unit.
domainjoin-cli join domain.com UserThatCanJoinAD
domainjoin-cli join –ou path/organizationalUnitName domainName joinAccount

To remove the computer from the domain run:
domainjoin-cli leave

Edit sudoers to allow users to become elevated users.

root@box:~# visudo
# /etc/sudoers
#
# This file MUST be edited with the ‘visudo’ command as root.
#
# See the man page for details on how to write a sudoers file.
#

Defaults env_reset
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL) ALL
#To add just one user account add the line below with the correct EID.
DOMAIN\e0NNNNN ALL=(ALL) ALL

# Allow members of group sudo to execute any command
# (Note that later entries override this, so you might need to move
# it further down)
%sudo ALL=(ALL) ALL

#
#includedir /etc/sudoers.d

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
#To add an entire group use something like the line below
%Domain\AD_Group ALL=(ALL) ALL

After making changes in visudo restart sudo

/etc/init.d/sudo restart

I’m currently only adding single users. Then to login with SSH and your EID

ssh DOMAIN\E0NNNNN@hostname

Add Ubuntu to AD for authentication

My guess is this would work about the same for Debian Squeeze as well.

Install likewise-open
apt-get install likewise-open

User that can join AD should be a valid user ID. The –ou option can also be used to place this in a Organizational Unit.
domainjoin-cli join domain.com UserThatCanJoinAD
domainjoin-cli join –ou path/organizationalUnitName domainName joinAccount

To remove the computer from the domain run:
domainjoin-cli leave

Edit sudoers to allow users to become elevated users.

root@box:~# visudo
# /etc/sudoers
#
# This file MUST be edited with the ‘visudo’ command as root.
#
# See the man page for details on how to write a sudoers file.
#

Defaults env_reset
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL) ALL
#To add just one user account add the line below with the correct EID.
DOMAIN\\e0NNNNN ALL=(ALL) ALL

# Allow members of group sudo to execute any command
# (Note that later entries override this, so you might need to move
# it further down)
%sudo ALL=(ALL) ALL

#
#includedir /etc/sudoers.d

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
#To add an entire group use something like the line below
%Domain\\AD_Group ALL=(ALL) ALL

After making changes in visudo restart sudo

/etc/init.d/sudo restart

I’m currently only adding single users. Then to login with SSH and your EID

ssh DOMAIN\\E0NNNNN@hostname

Cacti from apt-get repositories and PIA to use weathermap

It took me a long time to find this much information on getting the PIA system running on cacti when I installed it from apt-get. I also assume you have already installed mysql, Apache and anything else that you might need.

I made some changes to the original I found for this but someone else did all the heavy lifting. Mostly I left the lines I changed in and commented them out, just in case.
It took me a long time to find this much information on getting the PIA system running on cacti when I installed it from apt-get. I also assume you have already installed mysql, Apache and anything else that you might need.
This worked for Ubuntu 10.10 Maverick Meerkat and Debian 6.0 Squeeze.

Thank you to Note to Self blog for dummies.

apt-get install cacti
apt-get install cacti-spine
apt-get install php5-gd

wget http://mirror.cactiusers.org/downloads/plugins/cacti-plugin-0.8.7g-PA-v2.8.tar.gz
tar xvf cacti-plugin-0.8.7g-PA-v2.8.tar.gz
wget http://www.network-weathermap.com/files/php-weathermap-0.97a.zip
unzip php-weathermap-0.97a.zip
cd cacti-plugin-arch/files-0.8.7g
sudo cp -R * /usr/share/cacti/site/

cd ..
mysql cacti < pa.sql -u root -p

sudo nano /usr/share/cacti/site/include/global.php

At row 107:
$config["rra_path"] = $config["base_path"]."/rra";
Change it to:
/* $config["rra_path"] = $config["base_path"]."/rra"; */
$config["rra_path"] = '/var/lib/cacti/rra';

At row 197
include($config["library_path"]."/adodb/adodb.inc.php");
Change it to:
/* include($config["library_path"]."/adodb/adodb.inc.php"); */
include("/usr/share/php/adodb/adodb.inc.php");

At row 100
$config['url_path'] = $url_path;
Change to
/* $config['url_path'] = $url_path; */
$config['url_path'] = '/cacti/';

Below row 42 $cacti_session_name = "Cacti"; add
/* Weathermap */
$plugins = array();
$plugins[] = 'monitor';
$plugins[] = 'weathermap';

Save and quit

sudo chmod 644 /usr/share/cacti/site/lib/plugins.php
sudo chmod 644 /usr/share/cacti/site/include/plugins.php

cd ..
mv weathermap/ /usr/share/cacti/site/plugins
chown -R www-data:www-data /usr/share/cacti/site/plugins

Cacti from apt-get repositories and PIA to use weathermap

I made some changes to the original I found for this but someone else did all the heavy lifting. Mostly I left the lines I changed in and commented them out, just in case.
It took me a long time to find this much information on getting the PIA system running on cacti when I installed it from apt-get. I also assume you have already installed mysql, Apache and anything else that you might need.
This worked for Ubuntu 10.10 Maverick Meerkat and Debian 6.0 Squeeze.

Thank you to Note to Self blog for dummies. This site has died 8/29/2012

apt-get install cacti
apt-get install cacti-spine
apt-get install php5-gd

wget http://mirror.cactiusers.org/downloads/plugins/
I ended up getting the plugin from here.
I just redid this 7/27/2012 and used cacti-plugin-0.8.7h-PA-v2.8.tar.gz
tar xvf cacti-plugin-0.8.7g-PA-v2.8.tar.gz

make a backup of /usr/share/cacti/site
mkdir /home/user/cactibackup
cp -R /usr/share/cacti/site/* /home/user/cactibackup/

cd cacti-plugin-arch/files-0.8.7g
sudo cp -R * /usr/share/cacti/site/

wget http://www.network-weathermap.com/files/php-weathermap-0.97a.zip
unzip php-weathermap-0.97a.zip

cd ..
mysql cacti < pa.sql -u root -p

sudo nano /usr/share/cacti/site/include/global.php

At row 107:
$config[“rra_path”] = $config[“base_path”].”/rra”;
Change it to:
/* $config[“rra_path”] = $config[“base_path”].”/rra”; */
$config[“rra_path”] = ‘/var/lib/cacti/rra’;

7/27/2012 I just created a link this time and skipped the step above.
ln -s /var/lib/cacti/rra /usr/share/cacti/site/rra
Without this link I had broken links for the images.

At row 197
include($config[“library_path”].”/adodb/adodb.inc.php”);
Change it to:
/* include($config[“library_path”].”/adodb/adodb.inc.php”); */
include(“/usr/share/php/adodb/adodb.inc.php”);

At row 100
$config[‘url_path’] = $url_path;
Change to
/* $config[‘url_path’] = $url_path; */
$config[‘url_path’] = ‘/cacti/’;

Below row 42 $cacti_session_name = “Cacti”; add
/* Weathermap */
$plugins = array();
$plugins[] = ‘monitor’;
$plugins[] = ‘weathermap’;

Save and quit

sudo chmod 644 /usr/share/cacti/site/lib/plugins.php
sudo chmod 644 /usr/share/cacti/site/include/plugins.php

cd ..
mv weathermap/ /usr/share/cacti/site/plugins
chown -R www-data:www-data /usr/share/cacti/site/plugins