Differences

This shows you the differences between two versions of the page.

--- linux_installation [2007/06/22 17:04] – mediawiki_default
+++ linux_installation [2026/09/27 05:11] (current) – removed - external edit (Unknown date) 127.0.0.1
@@ Line 1: / Line 1: @@
-====== Serial console ======
-If the machine is only providing serial output during bootup, then it may not have been configured for serial logins.  Check that the <code>/etc/inittab</code> file contains a line like
-  T0:23:respawn:/sbin/getty -L ttyS0 9600 vt100
-which tells init to start the program to provide login prompts.
-The original kernel shipped with Debian sarge has a broken serial driver for Ultra 5s.  The version in the security updates should work.
-====== Getting user information from [[ldap]] ======
-The <code>libnss-ldap</code> package handles fetching account information from LDAP.
-Also make sure that <code>nscd</code> is installed, otherwise [[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=190072|bad things]] may happen.
-To tell <code>libnss-ldap</code> where to look, you need to edit
-the <code>/etc/libnss-ldap.conf</code>.  At the very least, you'll need to
-give the host and base (<code>dc=tardis,dc=ed,dc=ac,dc=uk</code>).
-To tell libc to use <code>libnss-ldap</code>, you need to amend the appropriate lines in <code>/etc/nsswitch.conf</code>:
-  passwd:         files ldap
-  group:          files ldap
-  shadow:         files ldap
-The other databases are best left alone; we don't bother putting host
-information or such like in LDAP because we don't see much benefit.
-The <code>getent</code> program is useful for testing.
-====== Authenticating with [[ldap]] ======
-The <code>libpam-ldap</code> package is used for authentication against LDAP.  You need to configure <code>/etc/pam_ldap.conf</code> along the same lines as <code>/etc/libnss_ldap.conf</code>.  A typical example is:
-  host piper
-  base dc=tardis,dc=ed,dc=ac,dc=uk
-  rootbinddn cn=admin,dc=tardis,dc=ed,dc=ac,dc=uk
-  ldap_version 3
-  # NSS lookups need to be restricted to the appropriate parts of the tree.
-  # If other lookups are added to /etc/nsswitch.conf, they need to be put
-  # here too.
-  nss_base_passwd ou=People,dc=tardis,dc=ed,dc=ac,dc=uk
-  nss_base_group   ou=Group,dc=tardis,dc=ed,dc=ac,dc=uk
-  nss_base_shadow ou=People,dc=tardis,dc=ed,dc=ac,dc=uk
-  # Use funky generic LDAP password changing.
-  pam_password exop
-PAM needs to be told to use <code>libpam-ldap</code>, as well as the normal authentication for <code>root</code>.  Canonical <code>/etc/pam.d/common-auth</code>:
-  # ** Use trick from /usr/share/doc/libpam-ldap/README.Debian
-  #
-  auth    [success=1 default=ignore]      pam_unix.so nullok_secure
-  auth    required                        pam_ldap.so use_first_pass
-  auth    required                        pam_permit.so
-Note the <code>use_first_pass</code> option.  Without it logins will ask for a password for pam_unix, then one for pam_ldap, and so on, causing every other attempt to enter your password to fail even when you get it right.  You need to set up <code>/etc/pam.d/common-account</code> in the same way.
-===== Restricting access to admins =====
-In <code>/etc/security/access.conf</code> add
-  +:ALL:cron
-  -:ALL EXCEPT root admin:ALL
-[Hmmm... maybe that should be <code>LOCAL</code> instead of <code>cron</code>.]
-Ensure that <code>/etc/pam.d/common-account</code> ensure that the pam_access
-module is used to restrict access.  For example,
-  account [success=1 default=ignore]      pam_unix.so debug
-  account required                        pam_ldap.so debug
-  account required                        pam_access.so
-====== Multiple VLANs ======
-Some systems need to appear on several VLANs, most notably the router.  First, add
-q
-to the end of <code>/etc/modules</code> so that the kernel knows how to deal with the VLAN tagged packets.  (Use <code>modprobe 8021q</code> to load it immediately if you don't want to reboot.)  Then install the <code>vlan</code> Debian package, and add extra stanzas to <code>/etc/network/interfaces</code> for the new VLANs.  For example,
-  # Admin VLAN
-  auto eth0.1
-  iface eth0.1 inet static
-          address 192.168.1.6
-          netmask 255.255.255.0
-          network 192.168.1.0
-          broadcast 192.168.1.255
-where <code>eth0.1</code> means VLAN number <code>1</code> on interface <code>eth0</code>.  Finally, configure the switch so that the port is on the extra VLANs.
-====== Logging to the [[log_host]] ======
-To make syslog send logs to the log host, put
-  *.*     @loghost
-into ''/etc/syslog.conf''.  It is a good idea to keep the local logging too, in case of network problems.
-====== Email config ======
-Install the exim4 package and execute 'dpkg-reconfigure exim4-config' to configure it with the details below:
-<code>Split configuration into small files:                      NO
-General type of mail configuration:                        mail sent by smarthost; no local mail
-System mail name:                                          HOSTNAME.tardis.ed.ac.uk
-IP-addresses to listen on for incoming SMTP connections:   127.0.0.1
-Other destinations for which mail is accepted:             HOSTNAME.tardis.ed.ac.uk
-Visible domain name for local users:                       tardis.ed.ac.uk
-IP address or host name of the outgoing smarthost:         mailhost.tardis.ed.ac.uk
-Keep number of DNS-queries minimal (Dial-on-Demand):       NO</code>
-====== NTP ======
-Our router, <code>davison</code>, provides other machine with an NTP service.  In turn, it synchronises with the (external-facing) Informatics servers.  Here's how to update '/etc/ntp.conf':
-  --- /etc/ntp.conf       (revision 17)
-  +++ /etc/ntp.conf       (working copy)
-  @@ -10,17 +10,8 @@
-   # You do need to talk to an NTP server or two (or three).
-  -#server ntp.your-provider.example
-  +server davison
-  -# pool.ntp.org maps to more than 300 low-stratum NTP servers.
-  -# Your server will pick a different set every time it starts up.
-  -#  *** Please consider joining the pool! ***
-  -#  *** <http://www.pool.ntp.org/join.html> ***
-  -server 0.debian.pool.ntp.org iburst
-  -server 1.debian.pool.ntp.org iburst
-  -server 2.debian.pool.ntp.org iburst
-  -server 3.debian.pool.ntp.org iburst
-  -
-   # By default, exchange time with everybody, but don't allow configuration.
-   # See /usr/share/doc/ntp-doc/html/accopt.html for details.
-   restrict -4 default kod notrap nomodify nopeer noquery
-====== Munin ======
-Install munin-node on the client (the new Linux box) and update '/etc/munin/munin-node.conf' like so:
-<code>--- etc/munin/munin-node.conf   (revision 28)
-+++ etc/munin/munin-node.conf   (working copy)
-@@ -34,4 +34,4 @@
- # the allow line as many times as you'd like
- allow ^127\.0\.0\.1$
--
-+allow ^193.62.81.11$</code>
-Then run '/etc/init.d/munin-node restart' to update the daemon.   Connect to the web server and update '/etc/munin/munin.conf' like so:
-<code>--- munin.conf.pert     2007-06-22 17:47:27.593900598 +0100
-+++ munin.conf  2007-06-22 17:48:26.781493093 +0100
-@@ -101,9 +101,11 @@
- [mara.tardis.ed.ac.uk]
-     address 193.62.81.15
-     use_node_name yes
--
-+[wotan.tardis.ed.ac.uk]
-+    address 193.62.81.4
-+    use_node_name yes</code>
-====== Server addresses ======
-{{:Server addresses}}
-====== See also ======
-  *  [[updating_systems]]
-  *  [[log_host]]
-====== Other stuff that should be documented here, but isn't ======
-  *  Configuring machines to pass mail on to the mail hub
-  *  Configuring ntp
-  *  Booting our suns from the LAN
-  *  Installing munin