bnx2x stuff

note to self

Experienced this issue on HP 460c G6 Blades. Host Operating System RHEL5.4 is using Broadcom Corporation NetXtreme II driver module bnx2x in this setup. Fully Virtualized Windows 2003 Server Guests could not transfer files over the network, while there is no drop of packets when tested with "ping" etc. and even the Remote Desktop Connections over RDP are working without any issue. Additionally, the Host OS's (RHEL5.4 , RHEL5.3 etc. ) doesn't seem to have any problem either. -before upgrading to the latest firmware Finally, adding

options bnx2x disable_tpa=1

to /etc/modprobe.conf which disables LRO (or TPA) on the bnx2x-based netwrok cards resoled this issue. All this above was done on HP NC-Series Broadcom 1Gb and 10GbE Multifunction Driver for Linux although it seemed to me as if the Broadcom Driver provided from RHEL5.4 it self should do the job with the above module options. Got the solve through Red Hat Support and i quote,

FYI, LRO (Large Receive Offload) is a technique for increasing inbound throughput of high-bandwidth network connections by reducing CPU overhead. It works by aggregating multiple incoming packets from a single stream into a larger buffer before they are passed higher up the networking stack, thus reducing the number of packets that have to be processed.

Now the funny thing is, when i read the above it feels like this is something i would want to keep turned on and not* off! :-) Guess its gonna take me some googling to get that one figured out.

mptlinux stuff

note to self

Experienced this weird behavior with a HP-DL580 G5, while installing RHEL4(U2) on it. The installer was looping at the detection of LSI Logic HBA adapter. Removing the card allows the installation to go ahead without any problem, but once installed and at the re-insertion of the card, the system was still getting halted at the initial device detection( some sort of a loop at detecting the HBA ). Looked to me as if some module(scsi?) being used with the device, which is not capable of handling the device properly was causing this problem. Removing the card, and then installing the mptlinux .rpm that is provided by the vendor, and then re-inserting the card solves this problem. Yet to test this with a later release of RHEL4 & 5, most probably the fix is already in place.

Nmap5 RPMs

Just built RPMs of Nmap 5, have always been wanting to work on RPM building. If you are interested in checking them out, get them from the below links. nmap-5.00-1.i586.rpm zenmap-5.00-1.noarch.rpm ncat-5.00-1.i586.rpm nmap-debuginfo-5.00-1.i586.rpm Built them on my F11 box without any changes etc. to my current setup, not sure if that's how it should be done, still not very good at this rpmbuild stuff. Hope they are working. Used "rpmdevtools" to setup the rpm build env. and followed this in setting it up. Update: The official RPMs are here.

wget stuff

note to self

RHN doesn't seem to play well with download managers. "wget" used to be good but noticed a small problem lately. When wget -c is given to resume a download, it starts to download things from scratch. This probably has something to do with the expiring urls that are given on RHN. Renaming the old file part to the new one you can identify from the new download URL will work in this. Still not sure what's causing this, but remember quite well "wget" that wget didn't have this file-name problem earlier.

timezone stuff

note to self

On RHEL4+ systems, timezone data files are kept in /usr/share/zoneinfo/ with the /etc/localtime symbolic link pointing at the correct time zone the machine belonging to. If the time zone data file doesn't contain the correct information, then the system seem to assume its on GMT. Now if the system date and time is set manually to the current localtime, everything appears normal. One noticed problem that happens in such a setup is if this machine serves as a mail server, then the mail header contains these time zone details. This can cause strange problems with MS Outlook, as outlook seem to use this value and the local machines time-zone details to calculate the display time on mails. For some reason, the mail clients running on GNU/Linux systems appears to be immune to this problem. Still have find out how the mail clients such as evolution etc. display the received time on mails. On RHELs the time zone data are provided in tzdata package, and it's important to keep that up2date, specially if it is an online system.

Setting up s/w raid on gnu/linux

note to self mdadm can be used to create raid volumes easily in the below way. mknod -m 0640 /dev/mdX TYPE MAJOR MINOR chgrp disk /dev/mdX mdadm --create=/dev/mdX --level='RAID LEVEL' --raid-devices=n /dev/sdXX /dev/sdYY RAID LEVEL can be any value from linear, raid0, 0, stripe, raid1, 1, mirror, raid4, 4, raid5, 5, raid6, 6, raid10, 10, multipath, mp, faulty. Eg: Creating a RAID 0 with 2 physical devices /dev/sda1 and /dev/sdb1. mknod -m 0640 /dev/md0 b 9 0 chgrp disk /dev/md0 mdadm --create='/dev/md0' --level=0 --raid-devices=2 /dev/sda1 /dev/sdb1 mknod is quite important, as otherwise mdadm will complain about non-existent device. Make sure to specify unused MAJOR and MINOR numbers when creating the (block)device. Refer to mknod man page for more info. As usual, i keep forgetting this important step, and keep running in to trouble. Very useful guides are here and here. Some guides seem to suggest that the s/w raid configuration should be put on to a /etc/mdadm.conf, but i think this is no longer necessary. From what i've gathered, the actual RAID configurations are kept in a superblock in member physical devices. The linux kernel identifies the and reads out that information from the physical devices( partitions ), at the boot-up, and they have to be of the type 'Linux raid autodetect' OR 'fd' for this to work properly.

yum stuff

note to self When creating yum repositories with RHEL5 installation media, use createrepo -g with the comps-*.xml files inside {Server, Cluster, ClusterStorage, VT}/repodata directories. createrepo -g will add the necessary meta-data on to the repo, necessary for yum group functions to work properly. Eg. yum grouplist, yum groupinstall

Old CentOS/RHEL packages

note to self When there is a need for an old RHEL or CentOS rpm, head over to http://vault.centos.org. They keep an archive of package trees of previous CentOS releases. It can not be used as a yum repo, but its good enough if you know what you need exactly. The security updates are not put in there, but this works for me.. -- Thank You CentOS.! :)

its rpm-build NOT rpmbuild..!

note to self "rpmbuild" is the tool used to build rpms ( something like a .deb in Debian flavours ). Whenever i want to build a rpm on a system where i don't have rpmbuild installed, its quite easy to get it installed on the system using "yum". The problem ( - not exactly a problem, just something that keeps on happening to me ) is that when i do "yum install rpmbuild" yum doesn't output what i need. Instead it outputs stuff which are not really even related to my requirement. The program that provides rpmbuild is named "rpm-build", which keeps causing me this problem. :( The packages given as results from yum, when the query string is given as "rpmbuild", all seem to have the word "rpmbuild" on their "info" meta data, but its strange, and quite frankly annoying that "rpm-build" ( the actual package that provides "rpmbuild" ) doesn't have the key "rpmbuild" which could be the reason for this. And, before i forget, the correct way would be "yum install rpm-build" :) I hate that i keep forgetting these.!!!

Very Basic Mail Server setup with Postfix + Dovedot

This is just a very basic overview on setting up a MailServer with Postfix + Dovecot. I'm basing this on a Redhat flavored GNU/Linux, but this should work on other GNU/Linux's as well. 1. Install postfix and dovecot ( ex. if using yum, yum install postfix ) 2. Go in to /etc/postfix dirtectory and re-name the main.cf to main.cf.orig or something similar. 3. Create an empty main.cf myhostname = mail.domain.com mydomain = domain.com myorigin = $mydomain mydestination = domain.com, mail.domain.com, localhost, localhost.localdomain inet_interfaces = all mynetworks = 127.0.0.0/8 local_recipient_maps = unix:passwd.byname, $alias_maps smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_recipient_restrictions = reject_rbl_client bl.spamcop.net, reject_rbl_client dnsbl.njabl.org, reject_rbl_client cbl.abuseat.org, reject_rbl_client list.dsbl.org, reject_non_fqdn_sender, reject_invalid_hostname, reject_unauth_destination, reject_unlisted_recipient, reject_unauth_destination, reject_unknown_sender_domain, reject_unauth_pipelining, permit_sasl_authenticated, permit_mynetworks 4. Add/Change the below lines in /etc/dovecot.conf protocols = pop3 pop3_listen = * 5. Make sure your /etc/sysconfig/network has the correct FQDN ... HOSTNAME = mail.domain.com .. 6. Make sure your /etc/hosts is correct. 127.0.0.1 localhost.localdomain localhost interface_ip mail.domain.com mail 7. Do chkconfig service_name on for services postfix, dovecot and saslauthd and start the services with the service service_name start command. 8. Create the necessary user accounts with useradd command and assign passwords, and configure your mail clients to use the server for incoming(POP3) and outgoing(SMTP) with authentication. ex: useradd -s /sbin/nologin username ex: passwd username Thats it. You should be good to go..of course you have to have the necessary DNS settings and other changes, depending on your setup ( ex: firewall ), but for the Mail Server configuration, this is pretty much it. Please keep in mind, that this is a very basic setup, and i have not tested the configuration above. This is just in case someone wants to get an idea. There are so many good guides on the net in setting up postfix, just search around for a while and you will see. If you need any help, there is always helpful #postfix on freenode. But please examine the situation well before asking for help, so they can help you better. Other than that, put a comment or reach me at yajith at gmail dot com (yajith@gmail.com). I will help you ( or at least try ) with my limited knowledge.

Installing Pidgin on RHEL5

It's over an year since the last time i wrote something about pidgin on my blog. Yesterday one of my friends installed her machine with RedHat Enterprise Linux 5, the OS that i have come to like so very much ;). During the installation she had forgotten to go in to the detailed package selection dialogs -probably because, on the text mode installation, anaconda keeps the package details hidden in a dialog which you have to access by pressing a function key- and ended up not having pidgin on her installation. A new comer to pidgin, she then went on and downloaded the Pidgin RHEL5 RPMs from the Official pidgin RHEL/CentOS 5 yum-repo as i have told her at a previous time. The problem here is like this. You can't just install the RPMs from there, as they seem to have a few dependencies, most of them are for the package libpurple. Now this by it self is not a problem at all, if you have been using RHEL for sometime, then you would know how to figure out the missing packages from the rpm dependancy error messages, which is what i started doing. There were few packages like cyrus-sasl-MD5 and gtkspell which fixed a lot of errors, but this error regarding some libsilc and silc-client which just wouldn't go away. The funny thing is, when you google for libsilc or silc-client you don't get anything that you can work on really. Yes, it does give you this site http://silcnet.org which seem to belong to them who maintain this component. Little look on to the site revealed that SILC is actually a method or a protocol for secure conference (chat). It actually took me a while to try and install the packages that are there..as they seem to be for Fedora 7, and i wasn't very sure how it might affect the system. SILC Client 1.1.4 SILC Toolkit 1.1.7 Finally, as i couldn't find any RPM for RHEL5 which fulfills my missing packages, i went ahead with the installation of these two packages. The problem still remained, and kept giving me an error. Then i tried a 3rd link from the same site. SILC Pidgin 2.4.0 and after clicking through few links i ended up on a Fedora mirror. I tried searching for the word silc and found this package libsilc which did the job for me finally. So far i have not been able to find a matching set of RPMs for RHEL5 which would install pidgin without a problem, its quite possible im looking at wrong places, but am i. Only place i didn't look in to yet is the CentOS 5 mirrors which could have all i need. But what i'm wondering is what has happned to all these RPM sites with huge collections of RPM, which have been doing a damn good job by the way over the years... Perhaps i should try my hand at creating a few RPMs on my own, and only problem there is i don't yet know how..but hey, rome wasn't built in one day, rite?

SSH with no passwords..

This is quite handy, if you want to have a script to perform some activities on a remote host.. Very useful info can be found here and here. This is what you have to do.. 1. Generate a key-pair to be used in the ssh transactions. You can use "ssh-keygen" to create a key pair..

ssh-keygen -t dsa -b 2048

This would create a dsa key of size 2048 bits. If you prefer a rsa key, you can use something like below..

ssh-keygen -t rsa

Just press enter when it prompts for a password, otherwise you'll have to enter that password when you start ssh transaction. I am not exactly sure which encryption method is better, may be i'll post something later, on that..( -when i know better ) 2. Configuring the ssh server to trust the client's providing the newly created key. Depending on the key type you selected, you will be able to find the public key of the key pair in your home directory inside .ssh/ if you didn't specify a separate location for the keys to be saved. Normally the key will be under a name like id_rsa.pub or is_dsa.pub What you have to do is quite simple. Just copy the content of the key file, and put it in to the file $HOME/.ssh/authorized_keys on the OpenSSH server. $HOME is relative to the user you are loging in, as on the ssh server.. eg: if as root /root/.ssh/authorized_keys

Squid, LDAP and Active Directory

Below is procedure i used in integrating squid with OpenLDAP, and the Active Directory with the information gathered from numerous google searches, and various links from friends.. Integrating squid with LDAP ( I used OpenLDAP 2.3, on ubuntu 7.10 ) is quite straight-forward.. I used a squid 2.5 on a RHEL4 for this.. Below are the steps i followed.. 1. Installing OpenLDAP. I used the apt to install openldap server ( slapd )..which was quite easy.. I had below in my default configuration, which allows everyone to read from the LDAP db..,without requiring to authenticate.

access to * by dn="cn=admin,dc=multios,dc=net" write by * read

2. Installing PHP-LDAP-Admin I believe it's possible to install PHPLDAPAdmin from apt..but i was too dumb not to check it there, i downloaded it directly from the site and configured it.. I only had to copy config.php.example to config.php and put the below entries..Was not difficult at all..

$ldapservers->SetValue($i,'server','name','My LDAP Server');

You can put any name for 'My LDAP Server'. It's just a name so you can identify between multiple LDAP servers you can manage from PHPLDAPAdmin panel.

$ldapservers->SetValue($i,'server','host','127.0.0.1');

In my case the LDAP server was running on the same host as PHPLDAPAdmin, therefore the '127.0.0.1' is used.. To point it to a different host, you can simply put the host name-as long as the name resolution is working- or ip.

$ldapservers->SetValue($i,'server','port','389');

I think this is the standard LDAP port.. If your LDAP service is running on a different port only, you will have to change this.

$ldapservers->SetValue($i,'server','base',array('dc=multios,dc=net'));

Here you have to specify the base of your LDAP hierarchy.. This is what i preferred as mine.. Interesting articles i found are here and here.

$ldapservers->SetValue($i,'login','dn','cn=admin,dc=multios,dc=net');

This is the LDAP db administrator account..PHPLDAPAdmin use this, if you plan to update LDAP entries using PHPLDAPAdmin ( believe me, you'll need this.. ) You can even explore your active directory LDAP with this too.. Below is my configuration on PHPLDAPAdmin to work with a Active Directory.

$ldapservers->SetValue(2,'server','name','Active Directory'); $ldapservers->SetValue(2,'server','host','192.168.128.141'); $ldapservers->SetValue(2,'server','port','389'); $ldapservers->SetValue(2,'server','base',array('dc=msmgt,dc=local')); $ldapservers->SetValue(2,'login','dn','cn=Administrator,cn=Users,dc=msmgt,dc=local');

Notice the "2" on each line...You have to assign different values for this, to each connection you configure on PHPLDAPAdmin. At the begining this is set to a "0". You can simply keep on increasing, as it works as some sort of an array -i think.. 3. Configuring Squid to use OpenLDAP for authentication.. As i mentioned above, i used squid-2.5 on a RHEL4 box.. There was this "squid_ldap_auth" authentication helper module out of the box. The funny thing is i installed squid 2.6 on ubuntu from apt, and there's no such authenticator.. I searched around a lot, but had no luck finding the exact thing, but i found a lot of similar modules, which -sadly- did not work for me.. Below are the squid settings..

auth_param basic program /usr/lib/squid/squid_ldap_auth -v 3 -b "cn=Internet,dc=multios,dc=net" -f uid=%s lnx1.multios.net

This can be tested before actually putting on to the squid.conf in below way.. /usr/lib/squid/squid_ldap_auth -v 3 -b "cn=Internet,dc=multios,dc=net" -f uid=%s lnx1.multios.net then you have to type a LDAP username and the associated password with a space in between. If it prints "OK" to the terminal, you are set..Otherwise check the parameters with your setup.. -v - to use LDAP version 3 -b - is the search base. You have to make sure your useraccounts are below this level in the LDAP hierarchy, or else the authenticator will never see your accounts when it's querying the LDAP server. -f - search filter. LDAP objects have lot of attributes on them. I used posixAccount as user accounts and i chose the "uid" attribute to be used as the username to authenticate with the proxy.. If you wish to use a different attribute you have to specify it here.. Leave =%s part intact, it tells the authenticator to match the user input with the uid. If you configured your LDAP without allowing anonymous queries, then you will have to specify -D and -w or -W with appropriate values, ( a username and the password that is allowed to query the LDAP database ) Took me a while to get it to work...but finally used "-v 3" which made it work. Quite helpful information was found from here. Worked quite fine.. I wanted to have a web based interface, so that the users them selves can change their passwords..After a bit of googling around found this nice php program developed by Karyl F. Stein, which does exactly the same thing.. It is no longer maintained though, but it worked nicely for me.. This requires that you allow authenticated users to change their password on the LDAP. Below on the slapd.conf did it for me.

access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=multios,dc=net" write by anonymous auth by self write by * none

If i recall correctly, i didn't have to put it manually, it was on the default settings. To configure phpLdapPasswd i had to make the below changes to the config.php

$LDAPSERVER = "ldap://lnx1.multios.net/"; $LDAPPORT = 389; $LDAPBASEDN = "dc=multios,dc=net";

This program has a nice feature, if a user forgets the password, they can request a reset, and the new auto-generated password is e-mailed to them, provided that your users have their email address on the LDAP db. You have to put the below settings on config.php to make it work, but i didn't test this yet. Default attribute it searches is "mail", but if you want to change it, i believe you can set it from the config.php as below.

$RESETBINDDN = "cn=admin,dc=multios,dc=net"; $RESETBINDPW = "redhat"; $MAILATTRIBUTE = mail;

Finally i wanted to integrate squid with an Active Directory Server, so in a MS Windows environment, user/password information can be centrally handled from the domain controller it-self. I believe there are two methods for this, or at least i have tried two methods successfully.. 1. To use ldap,kerberos, smb-winbind, ntlm_auth This method, i used some time back and was a little difficult to get it to work.. It depends on all the above components, and even the system times of the squid server and the Active Directory has to be the same, for this to work.. But i think, it's possible to achieve a single-sign-on setup for the proxy with this.. May be i'll post the steps i took for this on a separate post.. 2. To use ldap, squid_ldap_auth This method is quite straight-forward, and comparatively easier than the winbind method. All you have to do is put the below, in the squid.conf for auth_param

auth_param basic program /usr/lib/squid/squid_ldap_auth -R -b "dc=msmgt,dc=local" -D "cn=Administrator,cn=Users,dc=msmgt,dc=local" -w "vcs123" -f sAMAccountName=%s -h ad.multios.net

A very helpful guide is here. -b as explained above is the search base. My Active Directory base was msmgt.local -D is used to authenticate on to the LDAP as Active Directory LDAP service doesn't allow anonymous queries. I used the domain Administrator password, which is not advisable..You can simply create a user on Active Directory just for this..user doesn't need to have administrative privileges. -w is the Active Directory Administrator password.. It is possible to put this on to a separate file and store the password there with -W, which i didn't try. -f as above is the search filter "sAMAccountName" is an attribute under which the Active Directory login name is kept. -h specifies the Active Directory hostname, ip should work here too.. All this worked quite nicely and comparatively easier with other methods.. I have yet to try out the helper module "squid_ldap_group" and the external_acls on squid.. I will be posting the findings later on, once i try that out.. till then, cheers..!

Setting up a simple Gateway on a Linux Machine

Quite easy
1. Set "net.ipv4.ip_forward = 1" in /etc/sysctl.conf
2. Enter command "sysctl -p" as root.
3. Enter command "iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE"
4. Enter command "/etc/init.d/iptables save" to make the settings permanent.
( only on Redhat,Fedora and alike ) Use some other means on different distros like rc.local file.

RHEL 4 , Gaim and Lotus Sametime

Couple weeks back I wanted to access the lotus sametime service from Gaim. Since gaim support so many protocols(chat related), I thought this too was just a matter of putting the server info in the account creation dialogue. It was a Redhat box with enterprise 4 Update 1 , so the gaim version was something like gaim-1.2.1-6 It didn't have a protocol that I could use to connect to a sametime server. I googled a little and found out that there is a project called Meanwhile which works exactly on what I've been looking for. What I did in short, * downloading meanwhile, gaim-meanwhile sources from the meanwhile home. * downloading gaim 1.5 sources from the Gaim home. * building and installing. It worked fine. The integration is seamless, seamless enough to attract few fellows to gaim , who're actually Lotus Domino techies. But one thing though.. I tried to do the same thing in my fedora 3 box, but after compiling and installing the new protocol didn't show up in there. It was that simple, and was fun. I'll list down the sites that I had to go in ... to whoever might be interested. * Gaim home http://gaim.sourceforge.net * Meanwhile home http://meanwhile.sourceforge.net Just another bunch of cool free'n opensource stuff. This is great guys.. keep doing what you're doing. My hat is off to all of you, opensource people.