Differences

This shows you the differences between two versions of the page.

--- linux_installation [2007/02/04 21:20] – /* Authenticating with [[LDAP]] */ _bacam
+++ linux_installation [2026/09/27 05:11] (current) – removed - external edit (Unknown date) 127.0.0.1
@@ Line 1: / Line 1: @@
-====== Serial console ======
-If the machine is only providing serial output during bootup, then it may not have been configured for serial logins.  Check that the <code>/etc/inittab</code> file contains a line like
-  T0:23:respawn:/sbin/getty -L ttyS0 9600 vt100
-which tells init to start the program to provide login prompts.
-The original kernel shipped with Debian sarge has a broken serial driver for Ultra 5s.  The version in the security updates should work.
-====== Getting user information from [[ldap]] ======
-The <code>libnss-ldap</code> package handles fetching account information from LDAP.
-Also make sure that <code>nscd</code> is installed, otherwise [[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=190072|bad things]] may happen.
-To tell <code>libnss-ldap</code> where to look, you need to edit
-the <code>/etc/libnss-ldap.conf</code>.  At the very least, you'll need to
-give the host and base (<code>dc=tardis,dc=ed,dc=ac,dc=uk</code>).
-To tell libc to use <code>libnss-ldap</code>, you need to amend the appropriate lines in <code>/etc/nsswitch.conf</code>:
-  passwd:         files ldap
-  group:          files ldap
-  shadow:         files ldap
-The other databases are best left alone; we don't bother putting host
-information or such like in LDAP because we don't see much benefit.
-The <code>getent</code> program is useful for testing.
-====== Authenticating with [[ldap]] ======
-The <code>libpam-ldap</code> package is used for authentication against LDAP.  You need to configure <code>/etc/pam_ldap.conf</code> along the same lines as <code>/etc/libnss_ldap.conf</code>.  A typical example is:
-  host piper
-  base dc=tardis,dc=ed,dc=ac,dc=uk
-  rootbinddn cn=admin,dc=tardis,dc=ed,dc=ac,dc=uk
-  ldap_version 3
-  # NSS lookups need to be restricted to the appropriate parts of the tree.
-  # If other lookups are added to /etc/nsswitch.conf, they need to be put
-  # here too.
-  nss_base_passwd ou=People,dc=tardis,dc=ed,dc=ac,dc=uk
-  nss_base_group   ou=Group,dc=tardis,dc=ed,dc=ac,dc=uk
-  nss_base_shadow ou=People,dc=tardis,dc=ed,dc=ac,dc=uk
-  # Use funky generic LDAP password changing.
-  pam_password exop
-PAM needs to be told to use <code>libpam-ldap</code>, as well as the normal authentication for <code>root</code>.  Canonical <code>/etc/pam.d/common-auth</code>:
-  # ** Use trick from /usr/share/doc/libpam-ldap/README.Debian
-  #
-  auth    [success=1 default=ignore]      pam_unix.so nullok_secure
-  auth    required                        pam_ldap.so use_first_pass
-  auth    required                        pam_permit.so
-Note the <code>use_first_pass</code> option.  Without it logins will ask for a password for pam_unix, then one for pam_ldap, and so on, causing every other attempt to enter your password to fail even when you get it right.  You need to set up <code>/etc/pam.d/common-account</code> in the same way.
-===== Restricting access to admins =====
-In <code>/etc/security/access.conf</code> add
-  +:ALL:cron
-  -:ALL EXCEPT root admin:ALL
-[Hmmm... maybe that should be <code>LOCAL</code> instead of <code>cron</code>.]
-Ensure that <code>/etc/pam.d/common-account</code> ensure that the pam_access
-module is used to restrict access.  For example,
-  account [success=1 default=ignore]      pam_unix.so debug
-  account required                        pam_ldap.so debug
-  account required                        pam_access.so
-====== Multiple VLANs ======
-Some systems need to appear on several VLANs, most notably the router.  First, add
-q
-to the end of <code>/etc/modules</code> so that the kernel knows how to deal with the VLAN tagged packets.  (Use <code>modprobe 8021q</code> to load it immediately if you don't want to reboot.)  Then install the <code>vlan</code> Debian package, and add extra stanzas to <code>/etc/network/interfaces</code> for the new VLANs.  For example,
-  # Admin VLAN
-  auto eth0.1
-  iface eth0.1 inet static
-          address 192.168.1.6
-          netmask 255.255.255.0
-          network 192.168.1.0
-          broadcast 192.168.1.255
-where <code>eth0.1</code> means VLAN number <code>1</code> on interface <code>eth0</code>.  Finally, configure the switch so that the port is on the extra VLANs.
-====== Logging to the [[log_host]] ======
-To make syslog send logs to the log host, put
-  *.*     @loghost
-into ''/etc/syslog.conf''.  It is a good idea to keep the local logging too, in case of network problems.
-====== See also ======
-  *  [[updating_systems]]
-  *  [[log_host]]
-====== Other stuff that should be documented here, but isn't ======
-  *  Configuring machines to pass mail on to the mail hub
-  *  Configuring ntp
-  *  Booting our suns from the LAN
-  *  Installing munin