This is an old revision of the document!
Table of Contents
Serial console
If the machine is only providing serial output during bootup, then it may not have been configured for serial logins. Check that the
/etc/inittab
file contains a line like
T0:23:respawn:/sbin/getty -L ttyS0 9600 vt100
which tells init to start the program to provide login prompts.
The original kernel shipped with Debian sarge has a broken serial driver for Ultra 5s. The version in the security updates should work.
Getting user information from [[ldap]]
The
libnss-ldap
package handles fetching account information from LDAP. Also make sure that
nscd
is installed, otherwise bad things may happen.
To tell
libnss-ldap
where to look, you need to edit the
/etc/libnss-ldap.conf
. At the very least, you'll need to give the host and base (
dc=tardis,dc=ed,dc=ac,dc=uk
).
To tell libc to use
libnss-ldap
, you need to amend the appropriate lines in
/etc/nsswitch.conf
:
passwd: files ldap group: files ldap shadow: files ldap
The other databases are best left alone; we don't bother putting host information or such like in LDAP because we don't see much benefit.
The
getent
program is useful for testing.
Authenticating with [[ldap]]
The
libpam-ldap
package is used for authentication against LDAP. You need to configure
/etc/pam_ldap.conf
along the same lines as
/etc/libnss_ldap.conf
. A typical example is:
host piper base dc=tardis,dc=ed,dc=ac,dc=uk rootbinddn cn=admin,dc=tardis,dc=ed,dc=ac,dc=uk ldap_version 3 # NSS lookups need to be restricted to the appropriate parts of the tree. # If other lookups are added to /etc/nsswitch.conf, they need to be put # here too. nss_base_passwd ou=People,dc=tardis,dc=ed,dc=ac,dc=uk nss_base_group ou=Group,dc=tardis,dc=ed,dc=ac,dc=uk nss_base_shadow ou=People,dc=tardis,dc=ed,dc=ac,dc=uk # Use funky generic LDAP password changing. pam_password exop
PAM needs to be told to use
libpam-ldap
, as well as the normal authentication for
root
. Canonical
/etc/pam.d/common-auth
:
# ** Use trick from /usr/share/doc/libpam-ldap/README.Debian # auth [success=1 default=ignore] pam_unix.so nullok_secure auth required pam_ldap.so use_first_pass auth required pam_permit.so
Note the
use_first_pass
option. Without it logins will ask for a password for pam_unix, then one for pam_ldap, and so on, causing every other attempt to enter your password to fail even when you get it right. You need to set up
/etc/pam.d/common-account
in the same way.
Restricting access to admins
In
/etc/security/access.conf
add
+:ALL:cron -:ALL EXCEPT root admin:ALL
[Hmmm… maybe that should be
LOCAL
instead of
cron
.]
Ensure that
/etc/pam.d/common-account
ensure that the pam_access module is used to restrict access. For example,
account [success=1 default=ignore] pam_unix.so debug account required pam_ldap.so debug account required pam_access.so
Multiple VLANs
Some systems need to appear on several VLANs, most notably the router. First, add
8021q
to the end of
/etc/modules
so that the kernel knows how to deal with the VLAN tagged packets. (Use
modprobe 8021q
to load it immediately if you don't want to reboot.) Then install the
vlan
Debian package, and add extra stanzas to
/etc/network/interfaces
for the new VLANs. For example,
# Admin VLAN
auto eth0.1
iface eth0.1 inet static
address 192.168.1.6
netmask 255.255.255.0
network 192.168.1.0
broadcast 192.168.1.255
where
eth0.1
means VLAN number
1
on interface
eth0
. Finally, configure the switch so that the port is on the extra VLANs.
Logging to the [[log_host]]
To make syslog send logs to the log host, put
*.* @loghost
into /etc/syslog.conf. It is a good idea to keep the local logging too, in case of network problems.
Email config
Install the exim4 package and execute 'dpkg-reconfigure exim4-config' to configure it with the details below:
Split configuration into small files: NO General type of mail configuration: mail sent by smarthost; no local mail System mail name: HOSTNAME.tardis.ed.ac.uk IP-addresses to listen on for incoming SMTP connections: 127.0.0.1 Other destinations for which mail is accepted: HOSTNAME.tardis.ed.ac.uk Visible domain name for local users: tardis.ed.ac.uk IP address or host name of the outgoing smarthost: mailhost.tardis.ed.ac.uk Keep number of DNS-queries minimal (Dial-on-Demand): NO
NTP
Our router,
davison
, provides other machine with an NTP service. In turn, it synchronises with the (external-facing) Informatics servers. Here's how to update '/etc/ntp.conf':
- – /etc/ntp.conf (revision 17)
+++ /etc/ntp.conf (working copy)
@@ -10,17 +10,8 @@ # You do need to talk to an NTP server or two (or three). -#server ntp.your-provider.example +server davison -# pool.ntp.org maps to more than 300 low-stratum NTP servers. -# Your server will pick a different set every time it starts up. -# *** Please consider joining the pool! *** -# *** <http://www.pool.ntp.org/join.html> *** -server 0.debian.pool.ntp.org iburst -server 1.debian.pool.ntp.org iburst -server 2.debian.pool.ntp.org iburst -server 3.debian.pool.ntp.org iburst - # By default, exchange time with everybody, but don't allow configuration. # See /usr/share/doc/ntp-doc/html/accopt.html for details. restrict -4 default kod notrap nomodify nopeer noquery
Munin
Install munin-node on the client (the new Linux box) and update '/etc/munin/munin-node.conf' like so:
--- etc/munin/munin-node.conf (revision 28) +++ etc/munin/munin-node.conf (working copy) @@ -34,4 +34,4 @@ # the allow line as many times as you'd like allow ^127\.0\.0\.1$ - +allow ^193.62.81.11$
Then run '/etc/init.d/munin-node restart' to update the daemon. Connect to the web server and update '/etc/munin/munin.conf' like so:
--- munin.conf.pert 2007-06-22 17:47:27.593900598 +0100
+++ munin.conf 2007-06-22 17:48:26.781493093 +0100
@@ -101,9 +101,11 @@
[mara.tardis.ed.ac.uk]
address 193.62.81.15
use_node_name yes
-
+[wotan.tardis.ed.ac.uk]
+ address 193.62.81.4
+ use_node_name yes
Server addresses
See also
Other stuff that should be documented here, but isn't
- Configuring machines to pass mail on to the mail hub
- Configuring ntp
- Booting our suns from the LAN
- Installing munin