debian

The repository 3DM2/CLI for Etch was removed from http://jonas.genannt.name.

Thanks to IP Exchange GmbH for sponsoring my Debian packages.

The last years I have used several tools to distribute the public ssh keys of my users across the servers but they don't fit anymore. I use puppet for my infrastructure but the build in puppet feature ssh_authorized_key does not fit.

I have different users across my servers and same users on many servers (e.g. web farms).

One public ssh key can be an member of:

• an ssh public key group that is mapped to an user on an server


• an ssh public key group that is mapped to an user on an sever group


• an user mapped to an server


• an user mapped to an server group

I have created an Webapp with an ajax interface. You can drag & drop the ssh key groups or ssh keys to an user.

The key will be deployed via an puppet parser function, you need the storeconfig feature in puppet.

The webapp has got an own database (postgres) but you can merge the puppet storeconfig database to the server manager database (via an rake task). If you specify an regular expression on your server groups, an new merged server will be automatically added to the group and on the next run of puppet the keys from the server group will be deployed without any action from you.

Puppet stuff:

• puppet module


• puppet function to fetch the keys from the webapp


• fact to fetch existing users on the servers (not needed, but features auto complete in the app)

drag & drop the ssh keys or the ssh key groups from right to left into the users on the servers or server groups

public ssh key distribution with puppet and ajax interface from Jonas on Vimeo.

For keeping that stuff in my mind:

smtpd_client_restrictions = check_policy_service inet:127.0.0.1:60000
smtpd_recipient_restrictions = permit_mynetworks,permit_mx_backup, reject_unauth_destination
permit_mx_backup_networks = 10.0.0.0/16

There are tons of manuals, howtos and blog posts, but they all depend on old samba versions.

I have get it working with Samba 3.3.7 and CUPS 1.3.8 on an Debian Lenny system.

smb.conf:

[global]
security = user
load printers = yes
printing = CUPS
printcap name = CUPS
printcap = CUPS
force printername = yes
enable privileges = yes

[printers]
comment = All Printers
browseable = no
guest ok = yes
path = /var/spool/samba
public = yes
printable = yes
writable = no
use client driver = no

[print$]
comment = Printer Driver Download Area
path = /var/lib/samba/printers
browseable = no
guest ok = yes
read only = yes
write list = @printeradms root
directory mask = 0775
create mask = 0664

Tasks

• create an group named printeradms


• add users to the group


• /var/lib/samba/printers: writeable for the group printeradms


• set printer rights for the group: net rpc rights grant 'DOMAINNAME\printeradms' SePrintOperatorPrivilege


• add first printer to cups


• restart samba

Login to an Windows computer

• connect to the samba server \\servername


• go to subfolder printers


• right click on you printer


• klick on option


• there will be an error message about missing driver. CANCEL here!


• install new driver in the option dialog


• done!

Your printer queue will now blow up, because windows printer queue shows also the completed cups printer jobs. You have to add the following lines to cupsd.conf:

PreserveJobFiles No
PreserveJobHistory No

I have added an new feature to my Server Manager. You can now use that manager to maintain the /etc/network/interfaces file on debian.

Server Manager - Debian Interfaces configuration from Jonas on Vimeo.

I have updated my 3Ware 3dm2 debian packages.

Now version 10.0 is available on jonas.genannt.name. The CLI tools 10.0 are also available.

An Debian Repository is also available.

Playing with nginx. Here are some random hints:

1.) nginx with php:

/usr/bin/spawn-fcgi -a 127.0.0.1 -p 9000 -u www-data -g www-data -f "/usr/bin/php-cgi -c /etc/php5/cgi/php-nginx.ini" -P /var/run/fcgi-php.pid

2.) Deny access to .svn directories:

location ~ \.svn { deny all; }

3.) rewrite urls

if ( !-f $request_filename ) {
rewrite ^/images/([A-Za-z]+)\/(.*)$ /images/default/$2 break;
}

The rewrite rule will redirect /images/bar/foo.png if it does not exists to /images/default/foo.png

spwan-fcgi is included in the lighttpd package if you are using lenny. On squeeze and sid spawn-fcgi is an standalone package!

I have updated my 3Ware CLI debian packages.

Now version 9.5.2 is available on jonas.genannt.name.

Useful links for converting filenames from one encoding to another:

• http://www.j3e.de/linux/convmv/


• http://hektor.umcs.lublin.pl/~mikosmul/computing/articles/linux-unicode.html

convmv is also available at debian. But I suggest you to use alway the newest version of convmv.

convmv, recursively converting filenames from ISO-8859-15 to UTF-8:

convmv -r --notest -f ISO-8859-15 -t UTF-8 /home

I have uploaded an new version of my linux user management script. This new version fixes an Passwd:Unix bug - The library has got an problem with the umask. You can download it on jonas.genannt.name.

You may have noticed that the perl library Passwd::Unix is not available at debian lenny. I have created an ITP #525340 to upload Passwd::Unix into debian.

If my packages passes the NEW-Queue I will create an backport for lenny and upload it to backports.org.

If you are using libnss-ldap to connect to your LDAP server it's possible that you get the following message on startup

Can't contact LDAP server udevd[374]: nss_ldap: failed to bind to LDAP server ldaps://foo.bar:
Can't contact LDAP server udevd[374]: nss_ldap: could not connect to any LDAP server as (null) -
Can't contact LDAP server udevd[374]: nss_ldap: failed to bind to LDAP server ldaps://foo.bar:
Can't contact LDAP server

This is an known problem, please have a look at the debian BTS: #375215, #375077, #375215

To get it working, you have to add bind_policy soft to /etc/libnss-ldap.conf.

If you are using Cfengine and use RCS to store your cfagent.conf file, you could use your RCS version control number inside Cfengine.

Example on editfiles:

{ /etc/screenrc
Append "#CFEngine: $(RCSRev)"
Append "vbell off"
}

The $(RCSRev) will hold the current RCS version number. So you will distribute the version of cfagent.conf in your files.

I had some problems to get this working, therefore an little guide for other guys around the net:

Precondition: cfagent.conf is controlled via SVN

Add the following code to your control selection:

RCSRev = ( ExecShellResult("/bin/echo \"$Id: $\" | /usr/bin/cut -f3 -d \" \" " ) )

Save your cfagent.conf and run svn propset svn:keywords "Id" cfagent.conf && svn -m "RCS" commit cfagent.conf.

This command tells subversion that svn should replace $Id: $ with the current RCS version and commit it.

If you open your cfagent.conf again, you will notice that the line above changed to:

RCSRev = ( ExecShellResult("/bin/echo \"$Id: cfagent.conf 20 2009-02-03 18:21:33Z jonas $\" | /usr/bin/cut -f3 -d \" \" " ) )

That's all - you can now use $(RCSRev) inside your cfagent.conf.

I have updated my 3Ware 3dm2 debian packages.

Please have a look at: jonas.genannt.name.

Packaging these 3DM2 software was the same shit like the versions before - I was not able to install the 32bit Java package from 3ware.com to an normal debian lenny system.

I have informed 3Ware three times about this problem - they are always telling me 'Thanks, We will have a look at this problem'. I have received my last email from 3Ware on 25 Sep 2008 with the body 'Will check', after this email nothing! But the installer bug is included into the newest version again.

So - have fun with my packages

If you are using IPv6, you know that webalizer truncates IPv6 addresses, this is very bad for the statistics.

The IPv6 patch is available at #452259.

I have included the patch and rebuild the package for etch. You can download the debian package at jonas.genannt.name.

I have set up an Debian Repository for my 3Ware packages. You can now install your 3dm2 and cli packages via apt.

Add the following line to your sources.list:

deb http://jonas.genannt.name/debian etch restricted

For testing aka Lenny you have to replace etch with lenny.

This repository is signed with my GPG key (0xB616FFFA), you should add my key in your apt-keyring:

wget -O - http://jonas.genannt.name/debian/jonas_genannt.pub | apt-key add -