7.1   2008-05-05 Build and install Debian packages completely from source

Package srcinst is used to build and install Debian packages completely from source. All dependencies and build-dependencies are also built recursively from source. No binary .debs are required to install packages with this tool; however, it does generate binary .debs for your use.

8.1   ups/nut is broke:

Command 'upsdrvctl -v start' can be used to detect the error message. In this case, it's "hiddev path open /dev/usb/hiddev0: Permission denied". After 'chown nut.nut /dev/usb/hiddev0', it starts to work. (2006-10-10) but still lots of unhandled evenets came up.

8.2   sound is broke (new kernel 2.6.16-2-686-smp):

2006-10-17 run 'alsaconf' and /dev/dsp and /dev/audio will appear. Then chmod 666 to all sound devices, /dev/dsp, /dev/mixer, /dev/audio, /dev/snd/..., then logout and relogin, with the sound volume applet showing ok.

Catch: The sound box has to be plugged into the right adaptor.

2006-12-03 sound device was always occupied by someone else while i tried to open movie player or other program. I installed yiff (a sound server), removed esound and then movie player started to work.

8.3   alt+ctrl+f1 is broke in xorg:

2006-10-17 it's due to the wrong keyboard map. setxkbmap -keymap pc104 goes back to the USA keyboard. The wrong keyboard map even disables the shift key. The "keyboard indicator" applet is a good indicator whether your keyboard map is right or not.

8.4   printer (cups) is broke, "/usr/lib/cups/backend/parallel failed":

remove old printer and add a new one through cups web interface, localhost:631

8.5   2006-10-10 make of 'annot':

g++-4.1 becomes the default c++ compiler, which causes the make to break down. So resort to the old 3.3 compiler. "make CxxCompiler=g++-3.3"

11.1   2007-07-29 PUBKEY for gscan2pdf

error by apt-get update:

W: GPG error: http://gscan2pdf.sourceforge.net binary/ Release: The following signatures
couldn't be verified because the public key is not available: NO_PUBKEY 5430209C4DD7CC93
W: You may want to run apt-get update to correct these problems

2007-07-29 ways to fix it

• gpg --keyserver www.keyserver.net --recv-keys 4DD7CC93
• gpg --export --armor 4DD7CC93 | sudo apt-key add -

The file storing gpg keys is /etc/apt/trusted.gpg.

11.2   2008-04-13 etch-backports

doc: http://www.backports.org/dokuwiki/doku.php?id=instructions

1. Add this line

deb http://www.backports.org/debian etch-backports main contrib non-free

to your /etc/apt/sources.list.

2. Run apt-get update. NO_PUBKEY error will appear.
3. apt-get install debian-backports-keyring. Then run apt-get update again.

14.1   2008-04-22 export a nfs-mounted directory to another client

In this case, server A exports a dir a to machine B. Then machine B exports dir a (with a possible different dir name on B) to machine C.

Then in /etc/exports:

/usr/local      192.168.0.147(rw,no_root_squash,nohide,crossmnt)

15.1   2007-02-14

change the hostname of the whole machine: network-admin or base-config-network-console or base-config

• edit /etc/hostname
• run /etc/init.d/hostname.sh start

/etc/apache/http.conf and /etc/apache/conf.d/: replace every old hostname with the new hostname , regenerate its ssl certificate to match hostname

exim4: dpkg-reconfigure exim4-config

gforge: dpkg-reconfigure for gforge-common, gforge-db-postgresql, gforge-web-apache

courier imap server: regenerate its ssl certificate to match hostname (2007-02-14)

• vi /etc/courier/imapd.cnf
• mkimapdcert

refdb web interface, it embedded the old hostname into its webpages

One stupid error today is that 'NameVirtualHost' of rewrite.conf is not specifying localhost(127.0.0.1) but new hostname(dl403k-1.cmb.usc.edu) points to localhost in /etc/hosts, which leads to weird error(i.e. '/ could not be found')

2007-10-29

error "failed connect imap server secure mode ssl negotiations"

an option in /etc/courier/imapd-ssl called TLS_STARTTLS_PROTOCOL. It appears to set the minimum require protocol version; by default it is set to TLS1. If I set it to SSL3 then Evolution can connect with TLS! So it seems Evolution is trying to negotiate an SSL3 connection after all.

error "error while scanning folders imap server connection reset peer"

restart the evolution client and it'll be fixed

16.1   URLs

http://www.debuntu.org/ldap-server-and-linux-ldap-clients-p2, given by keyan. No theory, just tell you which files need to be changed.

http://www.cendio.com/support/tag/LDAP-auth.html concise theory and how to practice.

Using LDAP & PAM for SSO Authentication, full theory and diagram, also explaining relationship between PAM, NSS, LDAP (howto of PAM authentication using ldap)

LDAP Linux HOWTO, ldap client and server setup

Python-ldap module doc. First link covers sasl part.

2008-05-31 Centralize user accounts with OpenLDAP (OpenLDAP on Red Hat provides secure, reliable account management): http://www.ibm.com/developerworks/library/l-openldap/index.html

16.2   packages to install

libldap2 and libldap-2.3-0

run-time libraries for OpenLDAP, configuration file: /etc/ldap/ldap.conf

ldap-utils

ldap client package, provides several commands, search, modify, add etc.

libpam-ldap

connect PAM to LDAP, configuration files: /etc/pam_ldap.conf, /etc/pam_ldap.secret, /etc/pam.d/common*(need to be modified)

libnss-ldap

connect NSS to LDAP, configuration files: /etc/libnss-ldap.conf, /etc/libnss-ldap.secret, /etc/nsswitch.conf (need to be modified)

nscd

name service caching daemon (cache all queries to ldap server for commands, passwd, group, hosts) configuration file: /etc/nscd.conf

libsasl2-modules

a communication/authentication mechanism (SASL) between ldap client and server. papaya uses it for binding/authentication. my localhost uses simple binding. Papaya doesn't require binding to authentication, mine requires that.

libpam-foreground

2009-2-4 this module missing on mahogany might be the reason that pub/private key authentication doesn't work all the time. This PAM module creates a lockfile whenever a user logs in, specifying the username and the console. This allows software to check whether the user making a request is on the current foreground console or not.

16.3   overview

console login, gdm login, ssh login, su, etc goes to PAM, which could go to either LDAP server (through pam_ldap.so) or NSS (through library calls passwd, group etc). And then NSS would go to LDAP server (/etc/nsswitch.conf). So you could skip or ignore libpam-ldap and still achieve ldap authentication. But if libpam-ldap is skipped, you can only authenticate (not change your password) against ldap server.

16.4   test command from ldap-utils

(-x is used to specify simple authentication):

ldapsearch -h loquat.usc.edu -b 'dc=loquat,dc=usc,dc=edu' -x

16.5   problem with papaya's setup

The rootbinddn is not uid=root,cn=users,dc=papaya,dc=usc,dc=edu, but uid=diradmin,cn=users,dc=papaya,dc=usc,dc=edu with the usual papaya root password.

16.6   web managing software

phpldapadmin is a debian package to allow management through web interface.

16.7   2009-6-26 too much log in /var/log/syslog and /var/log/auth.log

In /var/log/syslog, following shows up very often:

CRON[13154]: Authentication token is no longer valid; new one required

In /var/log/auth.log, this shows up often:

... nscd: nss_ldap: reconnecting to LDAP server...
... nscd: nss_ldap: reconnected to LDAP server ldap://papaya.usc.edu after 1 attempt

Way to solve this is edit /etc/nscd.conf and change positive-time-to-live to a larger number like 28800 (8-hr measured in seconds).

2009-8-20 change hard to soft on this line in /etc/ldap.conf:

bind_policy soft

22.1   Through samba (for windows)

The printer is administered under cups. Leave the cups printing section open in smb.conf. The authentication is tight (user based and the backend is tdbsam). However, circumvent it (forgot how to set the users up) and open the printers to public.:

[printers]
  comment = All Printers
  browseable = yes
  path = /var/spool/samba
  printable = yes
  public = yes
  writable = no
  create mode = 0700

22.2   Through cups(IPP protocol)

add following to /etc/cups/cupsd.conf:

ServerName 128.125.86.114
BrowseAddress 128.125.255.255   #2008-01-01 by yh
BrowseAddress 207.151.255.255
<Location />
  # Allow shared printing...
  Order allow,deny
  Allow @LOCAL
  Allow 128.125.*.*     #2008-01-01 by yh
  Allow 207.151.*.*
</Location>

23.1   2008-01-10 install DbVisualizer-4.1

In order for /Network/linux/DbVisualizer-4.1/dbvis to work, settings in /Network/linux/DbVisualizer-4.1/dbvis.lax has to be modified, such as dbvis.home=/Network/linux/DbVisualizer-4.1.

But machines in the lab have different directories mounted. So choose to install it locally on my linux box.

1. install the DbVisualizer

/Network/linux/DbVisualizer-4.1/dbvis41.bin 

Choose your own java environment if you have one installed already.

2. Run it and choose the correct mysql driver.

/Network/linux/mysql-connector-java-3.1.1-alpha/mysql-connector-java-3.1.1-alpha-bin.jar

wrong connector will get you an error like this:

java.sql.SQLException: Communication link failure: java.io.IOException, underlying cause: Unexpected end of input screen

23.2   2008-05-20 dbvisualizer on fujitsu lifebook

• download the rpm from http://www.minq.se/products/dbvis/download/install.jsp
• use alien to convert rpm to deb
• install the deb. it's mostly in /opt/. weird.
• export INSTALL4J_JAVA_HOME=/usr/lib/jvm/java-1.5.0-sun can't fine jvm home by default.
• /opt/DbVisualizer-6.0.10/dbvis

26.1   2008-05-13 slapd disallow anonymous binding

• modify /etc/ldap/slapd.conf, add disallow bind_anon
• restart the server. /etc/init.d/slapd restart

26.2   2008-05-13 requires authentication prior to directory operations.

require authc added to slapd.conf. SASL is another option for require to tightening security.

28.1   setup certificates

• openvpn has easy-rsa scripts:

  export KEY_CONFIG=/usr/share/doc/openvpn/examples/easy-rsa/openssl.cnf 
  mkdir /tmp/openvpn
  export KEY_DIR=/tmp/openvpn
  export KEY_SIZE=2048
  export KEY_COUNTRY=US
  export KEY_PROVINCE=CA
  export KEY_CITY=LA
  export KEY_ORG=USC
  export KEY_CITY="Los Angeles"
  export KEY_EMAIL="yuhuang@usc.edu"
  /usr/share/doc/openvpn/examples/easy-rsa/clean-all #setup init. files
  /usr/share/doc/openvpn/examples/easy-rsa/build-ca
  /usr/share/doc/openvpn/examples/easy-rsa/build-key-server server
  /usr/share/doc/openvpn/examples/easy-rsa/build-key client
  

• copy ca.crt, server.crt, server.key, client.crt (probably not needed) into server's /etc/openvpn.

• copy ca.crt, client.crt, client.key into client's /etc/openvpn.