Topics

1

Installation and Upgrades / HOWTO: Ubuntu client with LDAP authentication and pam_mount for mounting $HOME

« on: November 10, 2012, 11:23:53 am »

• Title: Configure a plain Ubuntu client for LDAP authentication and pam_mount for mounting the home folder
• Author(s): Udo Burghardt
• Date: 10. Nov. 2012
• Version: 0.9 (re-validation required)
• Zentyal profiles: Office (requires zentyal-samba) 
• Tested with Server: zentyal-core 3.0.5, zentyal-samba 3.0.6
  Hint inserted March 2014: NOT confirmed to work on Zentyal 3.2 and on Zentyal 3.3
• Tested with Client: Ubuntu 12.10. (Will work with other not-too-old Ubuntu releases too. Other distributions might have other packages and other configuration files.)
  Hint inserted April 2014: positive confirmed to work with Xubuntu 14.04 as a client with Zentyal 3.0.x  

Introduction
The goal is to use LDAP for authentification and pam_mount to mount user's $HOME during logon on a plain Ubuntu client. In this Howto this is done by command line only. (Command line might be a Terminal on the graphical Desktop of course.)

Requisite

• one machine is running Zentyal Server
• another machine is the client we are configuring now
• you know the IP addresses of both machines and "ping" in both directions does work
• Zentyal allows connection to Port 390 (LDAP). Configuration via Web Gui Firewall - Paketfilter

On the client
Open a Terminal and run sudo -i as all the following command require root.

Code: [Select]

lu@client:~$ sudo -i
[sudo] password for lu:
root@client:~# This prompt is shortened to ~# for being root from now on.

Code: [Select]

~# apt-get update && apt-get dist-upgrade
~# apt-get install ssh
~# reboot

After this you might run the following through an ssh session. While this is absolutely not required it is my usual way to work. Alternatively you might continue using "Terminal" on the Desktop.

Ldap

Code: [Select]

~# apt-get install libnss-ldap libpam-ldap libpam-mount  winbind smbclient cifs-utils ldap-utils
# ignore all requested user input, simple hit "enter"

~# cd /etc
~# rm ldap.conf
~# rm ldap/ldap.conf

Use you favorite $EDITOR to create the file /etc/ldap.conf with a content like the following block. To achieve this compact listing I used the command grep -v ^# ldap.conf | uniq

Code: [Select]

base dc=neo,dc=lan

uri ldap://10.1.100.1:390

ldap_version 3

binddn cn=zentyalro,dc=neo,dc=lan
bindpw jw4xF8KRS@IsEqxCbt=0

scope sub
bind_policy soft
pam_password md5

nss_base_passwd         ou=Users,dc=neo,dc=lan?one
nss_base_passwd         ou=Computers,dc=neo,dc=lan?one
nss_base_shadow         ou=Users,dc=neo,dc=lan?one
nss_base_group          ou=Groups,dc=neo,dc=lan?one
nss_schema              rfc2307bis
nss_map_attribute uniqueMember member
nss_reconnect_tries 2
nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,games,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,sync,sys,syslog,usbmux,uucp,whoopsie,www-data

Remarks:

• base - see "Users and Groups - LDAP settings - LDAP information - Base DN (in the Zentyal web frontend)
• uri - use the IP address of your Zentyal box and Port 390 to reach Ldap
• binddn - run grep ^binddn /etc/ldap.conf on your Zentyal server's shell
• bindpw - run grep ^bindpw /etc/ldap.conf on your Zentyal server's shell

To tell the command line tool ldapsearch to use the same settings create a link:

Code: [Select]

~# ln -s /etc/ldap.conf  /etc/ldap/ldap.conf
At this point the first check is useful. My userid on the Zentyal server is "ubt" and I want to know my where my homeDirectory is:

Code: [Select]

~# ldapsearch -D "uid=ubt,ou=Users,dc=neo,dc=lan"  -LLL  -W  uid=ubt  homeDirectory
Enter LDAP Password:
dn: uid=ubt,ou=Users,dc=neo,dc=lan
homeDirectory: /home/ubt
Omit the last parameter to get a much longer list of settings.

Name Service Switch
NSS converts usernames (and other information) into numerical IDs and vice versa. To let Ubuntu figure out that the user "ubt" has the numerical id 2003 we need to run:

Code: [Select]

~# auth-client-config -t nss -p lac_ldap
Now the system knows:

Code: [Select]

~# id ubt
uid=2003(ubt) gid=1901(__USERS__) groups=1901(__USERS__)
From now on "ssh ubt@client" works - but you do not get access to $HOME as it gets not mounted yet.

Mount $HOME
Add a line in /etc/security/pam_mount.conf.xml below <!-- Volume definitions -->:

Code: [Select]

  <volume user="*" fstype="cifs" server="10.1.100.1" path="%(DOMAIN_USER)" mountpoint="/home/%(DOMAIN_USER)" options="sec=ntlm,nodev,nosuid" />Replace 10.1.100.1 with the IP address of your Zentyal box.

Test it. The initial connect via ssh requires the acceptance of the up until now unknown key/fingerprint:

Code: [Select]

~# ssh ubt@client
The authenticity of host 'localhost (127.0.0.1)' can't be established.
ECDSA key fingerprint is 38:53:9a:d6:4d:9e:ef:ab:a9:58:63:d2:ac:f3:91:c2.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.
ubt@client's password:
Welcome to Ubuntu 12.10 (GNU/Linux 3.5.0-18-generic i686)

 * Documentation:  https://help.ubuntu.com/

ubt@client:~$ pwd
/home/ubt
ubt@client:~$ ls
Pictures  Desktop  Documents  Downloads

That's it. Login will also work running the GUI login on the client.

Authors note: Initially I intended to put this into the community wiki as a user generated documentation snippet. Unfortunately I do not understand trac.../wiki. Most pages are read only - even the Sandbox (stating "Go ahead, edit it freely.") - and it is unclear where and how to add pages. At the end I was not sure if this specific kind of doc is welcome. Probably the quality level should be higher there, so I put it here. May it be read or ignored, at least I know where to look for this info when I prepare my next computer 

Added 25. July 2013 on page 4: modifications for debian (Wheezy called Raspbian on Raspberry Pi).

2

Installation and Upgrades / [SOLVED] Login for editing the wiki at trac.zentyal.org

« on: November 08, 2012, 09:07:34 pm »

Hello everybody,

is it only me or is this statement:

If you want to contribute, just  Register in the Forum or login with your Forum user account

grabbed from http://trac.zentyal.org/wiki/Documentation/Community simply not correct?

Clicking on "login" I am just not able to log in as "UdoB" using my Forum password. Should that work? What's the trick?

Best regards

3

Installation and Upgrades / _ldap._tcp.dc._msdcs missing / Join Domain

« on: November 04, 2012, 11:24:48 am »

Hello everybody,
the Bind instance of my uptodate Zentyal Box has "forgotten" an important SRV record. I am fairly sure it has been there as I was able to join some windows boxes without any problems a short while ago. Today a Win7 client refrained from joining. I had to add one entry manually to /etc/bind/db.$MYDOMAIN:

Code: [Select]

_ldap._tcp.dc._msdcs IN      SRV     100 100 390 zen
   
After restarting bind I could join Zentyal successfully. I am not sure how to make this change persistent.  Adding a SRV record through Zentyal web frontend does not work - it would ommit the dc._msdcs part.

This manual workaround works for me. Nevertheless I will report this to Trac as a bug report if someone can confirm this observation...

Best regards

4

Installation and Upgrades / Newer Kernel - how to???

« on: October 13, 2012, 10:37:47 am »

Hello everybody,

while definitely being happy that Zentyal 3 bases on Ubuntu LTS I run into the usual "hardware is too new" problem: my SATA-3 controller is not recognized by Kernel 3.2 - but it is running fine with Kernel 3.6 on this machine. (For lspci see Attachment). It seems my options are

• search and buy a supported controller. (Spend additional money)
• search for a trusted backport repository. (Which one?)
• build my own Kernel. (Again and again)

What would you guys do to get a 3.6 Kernel running on Zentyal 3 64bit with the smallest amount of re-occurring maintenance time for recompilation every time a security patch was rolled out?

Best regards

5

Installation and Upgrades / Strange Samba problem: can not READ my own files

« on: October 16, 2011, 12:42:59 pm »

Hello everybody,

probably this is a pure Samba problem, but as I am on an up to date Ubuntu 10.04.03 Zentyal Box I would like to ask for a hint here in this community.

it seems that I can not read any file I've just created. I have tested this on more than one client with exactly the same result. The following sequence is copy-pasted from my stand alone Zentyal machine "ms". For this test sequence I do use a Zentyal user "uba" with administrative rights:

root@ms:~# id uba
uid=2005(uba) gid=1901(__USERS__) Gruppen=1901(__USERS__),4(adm),110(lpadmin),512(Domain Admins),513(Domain Users),544(Administrators),2003(semiadmin),2004(allusers)

Exercpt from /etc/samba/smb.conf:

[temp]
   comment = Zwischenlager
   path = /srv/temp
   valid users = @allusers
   write list = @allusers
   read only = No
   force create mode = 0660
   force directory mode = 0660
   vfs objects = full_audit, vscan-clamav
   vscan-clamav: config-file = /etc/samba/vscan-clamav.conf

I can mount and enter that share:

root@ms:~# mkdir /tmp/testmount;  mount -t cifs //ms/temp /tmp/testmount -o username=uba,ip=127.0.0.1
Password:
root@ms:~# mkdir /tmp/testmount/testfolder && cd /tmp/testmount/testfolder
root@ms:/tmp/testmount/testfolder#

Now it gets exciting, I can touch a new file several times and I can delete it also:

root@ms:/tmp/testmount/testfolder# touch testfile
root@ms:/tmp/testmount/testfolder# touch testfile
root@ms:/tmp/testmount/testfolder# touch testfile
root@ms:/tmp/testmount/testfolder# rm testfile
root@ms:/tmp/testmount/testfolder#

Everything is fine up to this point. But writing content into a file succeeds ONCE, the second line fails:

root@ms:/tmp/testmount/testfolder# echo testtext > testfile
root@ms:/tmp/testmount/testfolder# echo testtext > testfile
-bash: testfile: Permission denied

... and so does a simple attempt to read its content:

root@ms:/tmp/testmount/testfolder# cat testfile
cat: testfile: Permission denied

The shared folder and the testolder seem to have correct settings:

root@ms:/srv# ls -al -d temp
drwxrwxr-t+ 12 root __USERS__ 4096 Oct 16 12:15 temp

root@ms:/srv# ls -al -d temp/testfolder
drwxrwxr-x 2 uba __USERS__ 4096 Oct 16 12:16 temp/testfolder

And last but not least my user "uba" can read that testfile /without/ samba:

root@ms:/srv/temp/testfolder# su -c "cat testfile " uba
testtext

While I suspect this to be a trivial fault caused by myself I am not able to "google" the solution...


Best regards
Udo

6

Installation and Upgrades / Z. as virtual guest?

« on: October 01, 2011, 11:04:37 pm »

Hello,

my try to install Lucid LTS / Zentyal 2.2 failed for me because the hardware is not Lucid compatible (probably because of the  S-ATA controllers present on that mainboard). This problematic hardware has been chosen because a) it uses low power (Atom 330) and b) it is available.   

So I went with Natty as the base OS on that hardware and tried hard to install Zentyal in a Linux Container, lxc. This works... partially. Zentyal core is okay and so the Web front end is. Unfortunately the services I would like to use (Email/-filter/-Webmail + DNS, no more) pulls the Zentyal-firewall as a required dependency. This is where my current problem starts. The iptables-based firewall tries to load kernel modules which are not available in the container. This lead to unfinished/unsuccessful installation messages and staying disabled modules.

Has anybody had success with

a) running Zentyal Email + DNS server in a lx-container?
b) is there a chance to avoid installing Zentyal-firewall as a dependency? I do not need this functionality on this system as my DMZ is firewalled by another router. Perhaps I could replace the installation script with a dummy without function - simply returning "success" to the framework?
c) has anybody success installing these modules (Email/-filter/-Webmail + DNS) on Natty instead of Lucid?

For sure I do know that these installation variants are not officially supported nor recommended, but perhaps... 
 
Best regards from Germany
Udo, private SOHO user

7

Installation and Upgrades / Master/Slave anyone?

« on: September 15, 2010, 05:54:51 pm »

Hello everybody.

I am unsure what the actual state of the Master/Slave mechanism of UsersAndGroups "in the field" is. Could those who gave it a try please reply with a "+1" below one of the following options?

( x ) I've tried it. But it did not work / did not work reliable. I do not use it.

(   ) For me it works fine, it works as documented.


Thanks in advance.
Udo

8

Installation and Upgrades / Master/Slave: /var/lib/user/conf/userjournal wrong owner?

« on: August 28, 2010, 04:02:16 pm »

First: thanks to the developers for the hard work!

Currently I have a brand new and clean (test-) installation with rc2. Installation went fine, no hickups.

Then I installed a nearly empty virtual machine destined to be a slave.

    1) Establishing Master/Slave relationship did work.
    2) Initial data transfer did work!

Then I added a new user on the Master. This failed with an error leading to
 
    /var/lib/ebox/conf/userjournal

owned by root. The script tried to create a folder named by the Slave box. I did "chown ebox userjournal" and now it seems to work :-)

Best regards

9

Installation and Upgrades / [Solved] 1.5 Master/Slave "stringify"???

« on: July 23, 2010, 03:13:52 pm »

Solved 23.August:
using the brand new RC1 I re-installed my Slave from scratch. Now I can successfully establish the Master-Slave relationship. I did also purge the Master, don't know if this was really necessary...


Original message:
Hello,

I am testing 1.5 on a Lucid Server box and I have one system running. This shall be an Ldap Master of Users and Groups.

When preparing the Slave I did install only some console tools and

root@egw:~# dpkg -l |grep ebox
ii  ebox                                1.5.7-0ubuntu1~ppa1~lucid1        common library used by eBox platform modules
ii  ebox-firewall                       1.5.3-0ubuntu1~ppa1~lucid1        eBox - Firewall
ii  ebox-network                        1.5.5-0ubuntu1~ppa1~lucid1        eBox - Network Configuration
ii  ebox-objects                        1.5.1-0ubuntu1~ppa1~lucid1        eBox - Network Objects
ii  ebox-samba                          1.5.6-0ubuntu1~ppa1~lucid1        eBox - File Sharing
ii  ebox-services                       1.5.3-0ubuntu1~ppa1~lucid1        eBox - Network Services
ii  ebox-software                       1.5.1-0ubuntu1~ppa1~lucid1        eBox - Software Management
ii  ebox-usersandgroups                 1.5.3-0ubuntu1~ppa1~lucid1        eBox - Users and Groups
ii  libebox                             1.5.5-0ubuntu1~ppa1~lucid1        eBox - Common Library
ii  liborbit2                           1:2.14.18-1+ebox1                 libraries for ORBit2 - a CORBA ORB


After enabling the Network and the Firewall module I did an additional reboot. Then, without playing around, I was directly going to enable Slave mode. I entered my master's IP and password. The result is:

Can't locate object method "stringify" via package "HTML::Mason::Exception::Params" at /usr/share/perl5/EBox/CGI/ServiceModule/ConfigureModuleController.pm line 74.

The line in question reads:

throw EBox::Exceptions::Internal("Failed to enable: " .
$excep->stringify());

Unfortunately I do not know perl enough to debug this...

I did remove everything ebox-* plus slapd, rebootet and did try the same sequence again... with the same result. (Actually I did this several times, with small changes.) So this error is reproducible for me.  

A search for "stringify" didn't really help me though.


Additional info: during the installation of ebox-samba I got one additional error:

Use of uninitialized value $dn in concatenation (.) or string at /usr/share/perl5/EBox/UsersAndGroups.pm line 472.

The script /usr/share/ebox-usersandgroups/ebox-usersandgroups-reinstall generates the same error twice:
Use of uninitialized value $dn in concatenation (.) or string at /usr/share/perl5/EBox/UsersAndGroups.pm line 472.
Use of uninitialized value $dn in concatenation (.) or string at /usr/share/perl5/EBox/Ldap.pm line 282.

The log of the last -reinstall sequence is here: http://paste.ubuntu.com/467991/

Any hints are welcome ;-)

10

Installation and Upgrades / Is it possible to change "base dc"?

« on: December 22, 2009, 04:31:34 pm »

Hi everybody,

first let me thank all contributors for this superb compilation of infrastructure services.

I am beta testing 1.3.12, updated from a fresh install using the hardy based installer with 1.3.10 inside a virtual machine. I've never used ebox before.

During installation I had entered some random Text (e.g. "mylocal") which led to several entries in /etc/ldap.conf like "base dc=mylocal" (and some more entries) and is present in every single ldap distinguished name as element "dc=mylocal".

Probably it is also present in other configuration data for samba, email, certificates and so on. I am fairly sure that it is not a good idea to edit ldap.conf manually, so here is my obvious question:

Is there a realistic way to change this configuration value without re-installing ebox-* ?

Actually I could restart from scratch as this is a testbed for now... But if there is a documented way on how to achieve this I would feel happier...

Best regards