Old CentOS/RHEL packages

note to self When there is a need for an old RHEL or CentOS rpm, head over to http://vault.centos.org. They keep an archive of package trees of previous CentOS releases. It can not be used as a yum repo, but its good enough if you know what you need exactly. The security updates are not put in there, but this works for me.. -- Thank You CentOS.! :)

its rpm-build NOT rpmbuild..!

note to self "rpmbuild" is the tool used to build rpms ( something like a .deb in Debian flavours ). Whenever i want to build a rpm on a system where i don't have rpmbuild installed, its quite easy to get it installed on the system using "yum". The problem ( - not exactly a problem, just something that keeps on happening to me ) is that when i do "yum install rpmbuild" yum doesn't output what i need. Instead it outputs stuff which are not really even related to my requirement. The program that provides rpmbuild is named "rpm-build", which keeps causing me this problem. :( The packages given as results from yum, when the query string is given as "rpmbuild", all seem to have the word "rpmbuild" on their "info" meta data, but its strange, and quite frankly annoying that "rpm-build" ( the actual package that provides "rpmbuild" ) doesn't have the key "rpmbuild" which could be the reason for this. And, before i forget, the correct way would be "yum install rpm-build" :) I hate that i keep forgetting these.!!!

port forwarding using ssh

note to self ssh can be used in the below way to forward traffic over a secure channel, to make otherwise un-secure ( plain ) traffic to be encrypted. ssh access to the destination sever is required for this to work. For an example, to secure POP3 communications with a mail server at a.b.c.d one can do something like below on their local machine. ssh -N -f -L 127.0.0.1:1100:a.b.c.d:110 user@a.b.c.d -f is to put the connection to the background -N to wait infinitely for incoming connections -L binds the tunnel to the specified port ( 1100 in this case ) this will create a ssh tunnel bound to the local port 1100 with port 110 of a.b.c.d @a.b.c.d performs the authentication via ssh with the a.b.c.d once this is done, the POP client can be re-configured to talk to local port 1100. ssh will happily encrypt and decrypt what you put in the tunnel from the end-points. This mechanism can be used to secure systems that are not built with such capabilities. when you want to stop the tunnel, you can simply use "kill" -- FAQ at www.openssh.com was quite helpful in figuring this out. thanks bud for pointing out such things can be easily done with ssh. :)

squirrelmail preferences

Note to self SquirrelMail keeps user specific preferences, address books in /var/lib/squirrelmail/prefs/ It annoys me, that i keep forgetting this sort of things. Hopefully i won't, again!

No Audio with YouTube on Fedora?

Audio with Flash player doesn't seem to work on Fedora out-of-the-box. Quite an old thing really, but this is something i keep forgetting..thought of blogging this for my own references. Below is known to fix the problem. #yum install libflashsupport http://fedoraforum.org/forum/showthread.php?t=195224 2009/01/28 Update: Noticed that libflashsupport is not needed and is not there any more on Fedora 10. Installing the flash plugin rpm from Adobe does it.

Very Basic Mail Server setup with Postfix + Dovedot

This is just a very basic overview on setting up a MailServer with Postfix + Dovecot. I'm basing this on a Redhat flavored GNU/Linux, but this should work on other GNU/Linux's as well. 1. Install postfix and dovecot ( ex. if using yum, yum install postfix ) 2. Go in to /etc/postfix dirtectory and re-name the main.cf to main.cf.orig or something similar. 3. Create an empty main.cf myhostname = mail.domain.com mydomain = domain.com myorigin = $mydomain mydestination = domain.com, mail.domain.com, localhost, localhost.localdomain inet_interfaces = all mynetworks = 127.0.0.0/8 local_recipient_maps = unix:passwd.byname, $alias_maps smtpd_sasl_auth_enable = yes broken_sasl_auth_clients = yes smtpd_recipient_restrictions = reject_rbl_client bl.spamcop.net, reject_rbl_client dnsbl.njabl.org, reject_rbl_client cbl.abuseat.org, reject_rbl_client list.dsbl.org, reject_non_fqdn_sender, reject_invalid_hostname, reject_unauth_destination, reject_unlisted_recipient, reject_unauth_destination, reject_unknown_sender_domain, reject_unauth_pipelining, permit_sasl_authenticated, permit_mynetworks 4. Add/Change the below lines in /etc/dovecot.conf protocols = pop3 pop3_listen = * 5. Make sure your /etc/sysconfig/network has the correct FQDN ... HOSTNAME = mail.domain.com .. 6. Make sure your /etc/hosts is correct. 127.0.0.1 localhost.localdomain localhost interface_ip mail.domain.com mail 7. Do chkconfig service_name on for services postfix, dovecot and saslauthd and start the services with the service service_name start command. 8. Create the necessary user accounts with useradd command and assign passwords, and configure your mail clients to use the server for incoming(POP3) and outgoing(SMTP) with authentication. ex: useradd -s /sbin/nologin username ex: passwd username Thats it. You should be good to go..of course you have to have the necessary DNS settings and other changes, depending on your setup ( ex: firewall ), but for the Mail Server configuration, this is pretty much it. Please keep in mind, that this is a very basic setup, and i have not tested the configuration above. This is just in case someone wants to get an idea. There are so many good guides on the net in setting up postfix, just search around for a while and you will see. If you need any help, there is always helpful #postfix on freenode. But please examine the situation well before asking for help, so they can help you better. Other than that, put a comment or reach me at yajith at gmail dot com (yajith@gmail.com). I will help you ( or at least try ) with my limited knowledge.

Installing Pidgin on RHEL5

It's over an year since the last time i wrote something about pidgin on my blog. Yesterday one of my friends installed her machine with RedHat Enterprise Linux 5, the OS that i have come to like so very much ;). During the installation she had forgotten to go in to the detailed package selection dialogs -probably because, on the text mode installation, anaconda keeps the package details hidden in a dialog which you have to access by pressing a function key- and ended up not having pidgin on her installation. A new comer to pidgin, she then went on and downloaded the Pidgin RHEL5 RPMs from the Official pidgin RHEL/CentOS 5 yum-repo as i have told her at a previous time. The problem here is like this. You can't just install the RPMs from there, as they seem to have a few dependencies, most of them are for the package libpurple. Now this by it self is not a problem at all, if you have been using RHEL for sometime, then you would know how to figure out the missing packages from the rpm dependancy error messages, which is what i started doing. There were few packages like cyrus-sasl-MD5 and gtkspell which fixed a lot of errors, but this error regarding some libsilc and silc-client which just wouldn't go away. The funny thing is, when you google for libsilc or silc-client you don't get anything that you can work on really. Yes, it does give you this site http://silcnet.org which seem to belong to them who maintain this component. Little look on to the site revealed that SILC is actually a method or a protocol for secure conference (chat). It actually took me a while to try and install the packages that are there..as they seem to be for Fedora 7, and i wasn't very sure how it might affect the system. SILC Client 1.1.4 SILC Toolkit 1.1.7 Finally, as i couldn't find any RPM for RHEL5 which fulfills my missing packages, i went ahead with the installation of these two packages. The problem still remained, and kept giving me an error. Then i tried a 3rd link from the same site. SILC Pidgin 2.4.0 and after clicking through few links i ended up on a Fedora mirror. I tried searching for the word silc and found this package libsilc which did the job for me finally. So far i have not been able to find a matching set of RPMs for RHEL5 which would install pidgin without a problem, its quite possible im looking at wrong places, but am i. Only place i didn't look in to yet is the CentOS 5 mirrors which could have all i need. But what i'm wondering is what has happned to all these RPM sites with huge collections of RPM, which have been doing a damn good job by the way over the years... Perhaps i should try my hand at creating a few RPMs on my own, and only problem there is i don't yet know how..but hey, rome wasn't built in one day, rite?

Listen to your CPU

Listen to your CPU..It knows whats best for you. ;) Found this cool way of "listening" to your cpu.. Try this out..and enjoy.. give the below command as root. cat /proc/kcore > /dev/dsp You can stop by pressing "Ctrl+C" when you are done listening. I'm not sure weather this is good or bad for your system, so don't blame me if you get your system screwed..i have already warned ya.

SSH with no passwords..

This is quite handy, if you want to have a script to perform some activities on a remote host.. Very useful info can be found here and here. This is what you have to do.. 1. Generate a key-pair to be used in the ssh transactions. You can use "ssh-keygen" to create a key pair..

ssh-keygen -t dsa -b 2048

This would create a dsa key of size 2048 bits. If you prefer a rsa key, you can use something like below..

ssh-keygen -t rsa

Just press enter when it prompts for a password, otherwise you'll have to enter that password when you start ssh transaction. I am not exactly sure which encryption method is better, may be i'll post something later, on that..( -when i know better ) 2. Configuring the ssh server to trust the client's providing the newly created key. Depending on the key type you selected, you will be able to find the public key of the key pair in your home directory inside .ssh/ if you didn't specify a separate location for the keys to be saved. Normally the key will be under a name like id_rsa.pub or is_dsa.pub What you have to do is quite simple. Just copy the content of the key file, and put it in to the file $HOME/.ssh/authorized_keys on the OpenSSH server. $HOME is relative to the user you are loging in, as on the ssh server.. eg: if as root /root/.ssh/authorized_keys

Squid, LDAP and Active Directory

Below is procedure i used in integrating squid with OpenLDAP, and the Active Directory with the information gathered from numerous google searches, and various links from friends.. Integrating squid with LDAP ( I used OpenLDAP 2.3, on ubuntu 7.10 ) is quite straight-forward.. I used a squid 2.5 on a RHEL4 for this.. Below are the steps i followed.. 1. Installing OpenLDAP. I used the apt to install openldap server ( slapd )..which was quite easy.. I had below in my default configuration, which allows everyone to read from the LDAP db..,without requiring to authenticate.

access to * by dn="cn=admin,dc=multios,dc=net" write by * read

2. Installing PHP-LDAP-Admin I believe it's possible to install PHPLDAPAdmin from apt..but i was too dumb not to check it there, i downloaded it directly from the site and configured it.. I only had to copy config.php.example to config.php and put the below entries..Was not difficult at all..

$ldapservers->SetValue($i,'server','name','My LDAP Server');

You can put any name for 'My LDAP Server'. It's just a name so you can identify between multiple LDAP servers you can manage from PHPLDAPAdmin panel.

$ldapservers->SetValue($i,'server','host','127.0.0.1');

In my case the LDAP server was running on the same host as PHPLDAPAdmin, therefore the '127.0.0.1' is used.. To point it to a different host, you can simply put the host name-as long as the name resolution is working- or ip.

$ldapservers->SetValue($i,'server','port','389');

I think this is the standard LDAP port.. If your LDAP service is running on a different port only, you will have to change this.

$ldapservers->SetValue($i,'server','base',array('dc=multios,dc=net'));

Here you have to specify the base of your LDAP hierarchy.. This is what i preferred as mine.. Interesting articles i found are here and here.

$ldapservers->SetValue($i,'login','dn','cn=admin,dc=multios,dc=net');

This is the LDAP db administrator account..PHPLDAPAdmin use this, if you plan to update LDAP entries using PHPLDAPAdmin ( believe me, you'll need this.. ) You can even explore your active directory LDAP with this too.. Below is my configuration on PHPLDAPAdmin to work with a Active Directory.

$ldapservers->SetValue(2,'server','name','Active Directory'); $ldapservers->SetValue(2,'server','host','192.168.128.141'); $ldapservers->SetValue(2,'server','port','389'); $ldapservers->SetValue(2,'server','base',array('dc=msmgt,dc=local')); $ldapservers->SetValue(2,'login','dn','cn=Administrator,cn=Users,dc=msmgt,dc=local');

Notice the "2" on each line...You have to assign different values for this, to each connection you configure on PHPLDAPAdmin. At the begining this is set to a "0". You can simply keep on increasing, as it works as some sort of an array -i think.. 3. Configuring Squid to use OpenLDAP for authentication.. As i mentioned above, i used squid-2.5 on a RHEL4 box.. There was this "squid_ldap_auth" authentication helper module out of the box. The funny thing is i installed squid 2.6 on ubuntu from apt, and there's no such authenticator.. I searched around a lot, but had no luck finding the exact thing, but i found a lot of similar modules, which -sadly- did not work for me.. Below are the squid settings..

auth_param basic program /usr/lib/squid/squid_ldap_auth -v 3 -b "cn=Internet,dc=multios,dc=net" -f uid=%s lnx1.multios.net

This can be tested before actually putting on to the squid.conf in below way.. /usr/lib/squid/squid_ldap_auth -v 3 -b "cn=Internet,dc=multios,dc=net" -f uid=%s lnx1.multios.net then you have to type a LDAP username and the associated password with a space in between. If it prints "OK" to the terminal, you are set..Otherwise check the parameters with your setup.. -v - to use LDAP version 3 -b - is the search base. You have to make sure your useraccounts are below this level in the LDAP hierarchy, or else the authenticator will never see your accounts when it's querying the LDAP server. -f - search filter. LDAP objects have lot of attributes on them. I used posixAccount as user accounts and i chose the "uid" attribute to be used as the username to authenticate with the proxy.. If you wish to use a different attribute you have to specify it here.. Leave =%s part intact, it tells the authenticator to match the user input with the uid. If you configured your LDAP without allowing anonymous queries, then you will have to specify -D and -w or -W with appropriate values, ( a username and the password that is allowed to query the LDAP database ) Took me a while to get it to work...but finally used "-v 3" which made it work. Quite helpful information was found from here. Worked quite fine.. I wanted to have a web based interface, so that the users them selves can change their passwords..After a bit of googling around found this nice php program developed by Karyl F. Stein, which does exactly the same thing.. It is no longer maintained though, but it worked nicely for me.. This requires that you allow authenticated users to change their password on the LDAP. Below on the slapd.conf did it for me.

access to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=multios,dc=net" write by anonymous auth by self write by * none

If i recall correctly, i didn't have to put it manually, it was on the default settings. To configure phpLdapPasswd i had to make the below changes to the config.php

$LDAPSERVER = "ldap://lnx1.multios.net/"; $LDAPPORT = 389; $LDAPBASEDN = "dc=multios,dc=net";

This program has a nice feature, if a user forgets the password, they can request a reset, and the new auto-generated password is e-mailed to them, provided that your users have their email address on the LDAP db. You have to put the below settings on config.php to make it work, but i didn't test this yet. Default attribute it searches is "mail", but if you want to change it, i believe you can set it from the config.php as below.

$RESETBINDDN = "cn=admin,dc=multios,dc=net"; $RESETBINDPW = "redhat"; $MAILATTRIBUTE = mail;

Finally i wanted to integrate squid with an Active Directory Server, so in a MS Windows environment, user/password information can be centrally handled from the domain controller it-self. I believe there are two methods for this, or at least i have tried two methods successfully.. 1. To use ldap,kerberos, smb-winbind, ntlm_auth This method, i used some time back and was a little difficult to get it to work.. It depends on all the above components, and even the system times of the squid server and the Active Directory has to be the same, for this to work.. But i think, it's possible to achieve a single-sign-on setup for the proxy with this.. May be i'll post the steps i took for this on a separate post.. 2. To use ldap, squid_ldap_auth This method is quite straight-forward, and comparatively easier than the winbind method. All you have to do is put the below, in the squid.conf for auth_param

auth_param basic program /usr/lib/squid/squid_ldap_auth -R -b "dc=msmgt,dc=local" -D "cn=Administrator,cn=Users,dc=msmgt,dc=local" -w "vcs123" -f sAMAccountName=%s -h ad.multios.net

A very helpful guide is here. -b as explained above is the search base. My Active Directory base was msmgt.local -D is used to authenticate on to the LDAP as Active Directory LDAP service doesn't allow anonymous queries. I used the domain Administrator password, which is not advisable..You can simply create a user on Active Directory just for this..user doesn't need to have administrative privileges. -w is the Active Directory Administrator password.. It is possible to put this on to a separate file and store the password there with -W, which i didn't try. -f as above is the search filter "sAMAccountName" is an attribute under which the Active Directory login name is kept. -h specifies the Active Directory hostname, ip should work here too.. All this worked quite nicely and comparatively easier with other methods.. I have yet to try out the helper module "squid_ldap_group" and the external_acls on squid.. I will be posting the findings later on, once i try that out.. till then, cheers..!

Google Releases Android SDK and Emulator

OSNews reports that Google has finally released Android, the opensource platform that will be used by the Open Handset Alliance. The platform is based in the Linux kernel, freetype, sqlite, webkit, a 2D/3D subsystem and other pieces, but the application framework is built in Java using a embedded-optimized VM called Dalvik. The SDK is available for Linux, Mac and Win and it includes an emulator." The official Google channel has published few videos, on Android platform. Androidology - Part 1 of 3 - Architecture Overview Androidology - Part 2 of 3 - Application Lifecycle Androidology - Part 3 of 3 - APIs