Su-log-2012-05-07

page_title: Su-log-2012-05-07 page_touched: 20120514164537 old_text: ===Monday=== * tripwire scan (5 min) * scan mail (5 min) * Status (20 min) * Munin cleanup on LDAP servers (30 min) * account-as-ws-(test|uat) certs deployed (30 min) * Modified application.properties for sunetid, stanfordyou, sponsorship and account-app (1 hr) * iDRAC research (20 min)

===Tuesday=== * Directory Team Meeting agenda (20 min) * Power supply for machine at Duke (1 hr) * Documentation of data owner process (45 min) * Investigation into iDRAC commands (1 hr) * iDRAC discussion with Jason (30 min) * WWW ticket requesting access to ldap data (20 min) * Quarterly patching for ldap-uat and production servers (1 hr) * Grant gsbWebAuthPrivileged access to gsb-lari2 (15 min) * Try and build zm01-test one more time and fail (30 min)

===Wednesday=== * Read mail. Update directory request for Tom Black. Send note to Adam to add Kevin and Arvinder to Development Practices meeting. (1 hr) * Tripwire (5 min) * Finish move of volumes from afssvr13 (5 min) * dist-upgrade afssvr13 and work through problems with mounting the local disk. To see the wwid's and uuid's of disks and partitions use the commands below. Ended up creating puppet template for excluding disks from multipath using wwid and hand creating an fstab that mounted disks by uuid. (1.5 hr) ls -l /dev/disk/by-uuid ls -l /dev/disk/by-id * Started moves of volumes from afssvr12 to afssvr13. (5 min) * Finish building zoot-vm3 as a lucid test machine. (30 min) * Move slapd_proxy::new to running the slapd process as the ldap user. Test on ubuntu, debian, and redhat. Spent way too long staring at a syntax error. (2 hr) * Submit firewall rule request for weblogin-liv1 to allow the keyring to be synchronized. * Rebuild stanford-server-lbdns package to use new djsdns package names (20 min) * iDRAC r610 research Get the mac address of the idrac port show /admin1/system1/sp1/lanendpt1 Get the dhcp properties show /admin1/system1/sp1/ipendpt1/dhcpendpt1 ** Set dhcp (http://en.community.dell.com/techcenter/systems-management/f/4469/t/19417109.aspx) set /admin1/system1/sp1/ipendpt1=>ElementSettingData=>/admin1/system1/sp1/settings1/ipsettings2 IsCurrent=1

===Thursday=== * Look at problems on zm01-liv * Install new AS signed certs in production for account services * Modify schema for suPrivilegeGroupObject

====Document how to install workgroup pam control on ubuntu system==== 1. Install kerberos clients.

 aptitude install krb5-user libsasl2-modules-gssapi-mit kstart

Copy a krb5.conf file into place.

scp sunetid@corn.stanford.edu:/etc/krb5.conf /etc/krb5.conf
Update aptitude sources so that wallet-client can be installed. This system is a lucid system so I added the stanford.list file below to /etc/sources.list.d.

deb http://debian.stanford.edu/debian-stanford squeeze main non-free contrib deb-src http://debian.stanford.edu/debian-stanford squeeze main non-free contrib deb http://debian.stanford.edu/debian-local squeeze main non-free contrib deb-src http://debian.stanford.edu/debian-local squeeze main non-free contrib
Create a preferences file so that no packages from the sqeeze repository get installed implicitly.

Package: * Pin: release a=squeeze Pin-Priority: 200
Obtain a root ticket and install the host keytab on the system using wallet

kinit -F sunetid/root wallet get -f /etc/krb5.keytab keytab host/zoot-vm3.stanford.edu
Install the openafs-client package.

aptitude install openafs-client scp sunetid@corn.stanford.edu:/etc/openafs/CellServDB /etc/openafs aptitude install module-assistant m-a prepare openafs-modules m-a a-b -t openafs-modules dpkg -i /usr/src/openafs-modules-2.6.32-41-server_1.4.12+dfsg-3+ubuntu0.1+2.6.32-41.88_amd64.deb
The PAM and NSS ldap packages. Set the host to 127.0.0.1, the base dn to cn=workgroupstem,cn=posixAccounts,dc=stanford,dc=edu, and don't configure any services.

aptitude install libpam-ldapd libnss-ldapd
Install PAM kerberos support.

aptitude install libpam-krb5
Install PAM afs support.

aptitude install libpam-afs-session
Update the following files in /etc/pam.d. Note these files contain no LDAP entries. LDAP is not used for authentication. LDAP is used to retrieve posix account information using using nsswitch.
common-auth

# /etc/pam.d/common-auth # Use the traditional Unix authentication mechanisms and fall back to # Kerberos if that fails. Include pam_openafs_session so that calls to # pam_setcred will acquire an AFS PAG and tokens. auth sufficient pam_unix.so try_first_pass nullok_secure auth [success=ok default=die] pam_krb5.so use_first_pass forwardable auth [default=done] pam_afs_session.so
common-account

# /etc/pam.d/common-account account required pam_unix.so account required pam_krb5.so
common-session

# /etc/pam.d/common-session session optional pam_krb5.so session optional pam_afs_session.so session required pam_unix.so
Configure libpam-ldapd and libnss-ldapd by creating the file /etc/nslcd.conf.

# /etc/nslcd.conf
# # The user and group nslcd should run as.
uid nslcd gid nslcd # # The location at which the LDAP server(s) should be reachable.
uri ldap://127.0.0.1 # # The search base that will be used for all queries.
base cn=anesthesia,cn=posixAccounts,dc=stanford,dc=edu # # The LDAP protocol version to use.
ldap_version 3 # # The search scope.
scope sub # # Only return posix information for entries in the directory
# that match this filter.
filter passwd (suPrivilegeGroup=stanford:staff)
Install slapd. Accept the defaults for the server and shut it down once the installation is complete.

aptitude install slapd ldap-utils /etc/init.d/slapd stop
Remove the cn=config configuration of the LDAP server

rm -rf /etc/ldap/slapd.d
Create a files based configuration by creating the file /etc/ldap/slapd.conf.

# Module Configuration.
modulepath /usr/lib/ldap moduleload back_ldap.la #
loglevel stats sizelimit unlimited limits * size.pr=0 size.prtotal=none # # Allow everything that can be retrieved to be read
readonly on access to * by * read # # LDAP Proxy Options.
database ldap suffix "dc=stanford,dc=edu" uri "ldap://ldap.stanford.edu" idassert-authzFrom dn.regex:.* idassert-bind bindmethod=SASL saslmech=GSSAPI mode=none # # Connection reuse limit.
conn-ttl 3600
Copy in the schema files from AFS.

cp /afs/ir/service/directory/schema/* schema
Make needed directories in /var/run. We essentially ignore the directories created by the slapd install.

mkdir /var/run/ldap chown openldap:openldap /var/run/ldap
Install the /etc/default/slapd file with the following values.

# Location of the slapd configuration to use. If using the cn=config # backend to store configuration in LDIF, set this variable to the # directory containing the cn=config data; otherwise set it to the location
# of your slapd.conf file. If empty, use the compiled-in default
# (/etc/ldap/slapd.d). SLAPD_CONF=/etc/ldap/slapd.conf # SLAPD_USER="openldap" SLAPD_GROUP="openldap" SLAPD_SENTINEL_FILE=/etc/ldap/noldap SLAPD_OPTIONS="" export KRB5CCNAME=/var/run/slapd-proxy/slapd-proxy.tgt
Test the slapd configuration

slaptest -u
Start the slapd server

/etc/init.d/slapd start
To make it easier to test install the file /etc/ldap/ldap.conf. This file sets defaults used by ldapsearch.

# LDAP Defaults
host localhost base cn=anesthesia,cn=posixAccounts,dc=stanford,dc=edu
Install daemontools to manage the kerberos ticket cache required and start the svscan daemon.

aptitude install daemontools daemontools-run start svscan
Create the service directory to the ticket cache maintenance.

mkdir /etc/service/slapd-proxy
Create a run file to maintain the ticket cache.

#!/bin/sh # /etc/service/slapd-proxy/run - maintain slapd service ticket. if [ ! -d /var/run/slapd-proxy ]; then mkdir -p /var/run/slapd-proxy fi chmod 775 /var/run/slapd-proxy exec /usr/bin/k5start -U -l 10h -K 30 -o openldap -g openldap -f /etc/krb5.keytab -k /var/run/slapd-proxy/slapd-proxy.tgt
Start up the ticket cache maintenance daemon.

svc -u /etc/service/slapd-proxy
Restart slapd

/etc/init.d/slapd restart
Test with the ldapsearch. You should see a list of posixAccounts entries for the selected workgroup.

ldapsearch -x
Test with getent. You should be able to see entries for that have access to the system and not see entries for users that don't.

getent passwd sunetid

===Friday=== * Look in shibboleth problem for box (15 min) * Look at problem on zm01. Restart mailboxd (15 min) * Look at ldap-test replication problem (10 min) * Finish up posixAccount on ubuntu doc (1 hr) * Complete document for pam workgroup controls without puppet (1 hr) * Initial data owner role document (20 min) * Add SP metadata for pmg-prd.stanford.edu to farmfed (15 min) * Create audit tables for ldap auth and ldap acl changes (30 min) * Zimbra upgrade of zm04 and zm07 (3 hr)

SUDailyLogs 203. row