Discuss December 2009

discuss@lists.centos.org

295 participants
272 discussions

Kerberos + NFSv4 difficulties
by Dan Burkland 03 Dec '09

03 Dec '09

Hey All, I recently have been trying to setup an NFSv4 share that utilizes Kerberos. My experience in general with NFS is very slim however I feel like I am very close to getting this project completed. Currently I have the following things in place: 1) NFS server nfs.example.net (VM#2) - Running CentOS 5.4 with all of the latest updates and NFS-related packages 2) Kerberos KDC running on Kerberos.example.net (VM#1) - Running CentOS 5.4 with all of the latest updates 3) NFS client nfs-client.example.net (VM#3) - Running CentOS 5.4 with all of the latest updates Before I give you the error message I receive when I enable NFS, I'll first describe my setup process. 1) Verified Kerberos works on all machines by attempting a kinit testuser which worked properly. 2) Verified that the clocks on all machines represent the same time (synced using a local NTP server) 3) Created a service principle for nfs.example.net by performing the following commands on the nfs.example.net machine: - (Performed on NFS server) a. kadmin (Logged in as an admin principle) b. addprinc -randkey nfs/nfs.example.net c. ktadd -e des-cbc-crc:normal nfs/nfs.example.net d. quit e. kinit nfs/nfs.example.net -k -t /etc/krb5.keytab f. klist to verify 4) Edited /etc/idmapd.conf with the following changes: - (Performed on NFS server) a. changed Nobody-{User,Group} to nfsnobody b. changed Domain to nfs.example.net 5) Mkdir /nfs/ - (Performed on NFS server) 6) Added the following to /etc/exports - (Performed on NFS server) a. /nfs gss/krb5p(rw,sync,fsid=0) 7) exportfs -rv - (Performed on NFS server) 8) Verified all relevant nfs services were stopped - (Performed on NFS server) 9) Uncommented and made the following changes to /etc/sysconfig/nfs - (Performed on NFS server) a. MOUNTD_NFS_V1="no" b. MOUNTD_NFS_V2="no" c. RPCNFSDARGS="-N 2 -N 3 -U" d. SECURE_NFS = "yes" 10) /etc/init.d/portmap start; /etc/init.d/rpcidmapd start; /etc/init.d/nfs start - (Performed on NFS server) 11) And I receive the following output when the nfs service starts: a. Starting RPC svcgssd: FAILED b. Starting NFS Services: OK c. Starting NFS quotas: OK d. Starting NFS daemon: NFSD: Using /var/lib/nfs/v4recovery as the NFSv4 state recovery directory e. NFSD: starting 90-second grace period f. Starting NFS mountd: OK 12) I then checked /var/log/messages to find the following log entries: a. Dec 2 12:16:51 nfs rpc.svcgssd[6018]: ERROR: GSS-API: error in gss_acquire_cred(): Unspecified GSS failure. Minor code may provide more information - No principal in keytab matches desired name b. Dec 2 12:16:51 nfs rpc.svcgssd[6018]: Unable to obtain credentials for 'nfs' c. Dec 2 12:16:51 nfs rpc.svcgssd[6018]: unable to obtain root (machine) credentials d. Dec 2 12:16:51 nfs rpc.svcgssd[6018]: do you have a keytab entry for nfs/<your.host>@<YOUR.REALM> in /etc/krb5.keytab? I seem to be stuck at this point and would appreciate your insight. Thank you, Dan

2 3

Re: [CentOS] Small proxy appliance hardware
by Chuck Munro 03 Dec '09

03 Dec '09

Regarding a small proxy appliance, my thanks to those who responded either on this list or by direct email. We are going to get one of the little Acer AspireRevo 3610 boxes and give it a try. It's small, quiet, runs cool, and has more than enough resources to handle our CentOS proxy application. It's a shame that we have to trash the Windows-7 install (a waste of money) but that's life. The only unanswered question is with regard to an external USB wired network adapter, so we'll have to go by the data on the various manufacturers' web sites about Linux support. Has anyone tried the Belkin USB2/Gbit, the D-Link DUB-E100 or the Linksys USB300M devices? Which adapter chips to they use (in other words, which driver)?

1 0

LDAP for central authentication?
by Scott Ehrlich 03 Dec '09

03 Dec '09

I have the following on a network: 1) RHEL 5.0 Server acting as NIS and Samba domain controller 2) CentOS 5.x machines on NIS network 3) Win XP machines on Samba domain When I create an account for someone, I need to first type adduser new_person -d /home/new_person then passwd new_person, then cd /var/yp and make. Then smbpasswd -a new_person. Thus, two different databases. On another network, I have separate XP and Linux (CentOS 5.x, RHEL 5.x, and Suse) systems. No Samba, no NIS. Can I still set up a central LDAP directory for a single account database? For the NIS+Samba case, can I merge both credential files into a central database using LDAP? I would also want to control password length, complexity, aging, and other things. What is the best way to do this? Thanks. Scott

3 2

Skype version for CentOS 5.3
by Andrew 03 Dec '09

03 Dec '09

Which is the best version of skype to install in CentOS 5.3? skype.i586 2.0.0.72-fc5 from the skype repo or skype 2.1.0.47-fc10.i586.rpm from the 'skype for linux beta' downloads section of the skype website? Andy

3 5

Fedora 11 i386 Evolution address book --> CentOS 5.4 x86_64
by David McGuffey 03 Dec '09

03 Dec '09

Finally moved my home desktop from Fedora to CentOS. My spouse was unhappy with me upgrading from F9-->F10-->f11 etc and wanted something more stable. I built a second machine which is now running in parallel to the old F11 desktop. I moved my data (mail and files) from the F11 box to the CentOS 5.4 box. I used tar to move everything. Mail and files transferred A-OK...but the Evolution address book did not. Any tips on getting the old /home/.../.evolution/addressbook which worked with the version of Evolution on the new machine with an older version of Evolution? BTW, on CentOS, I cannot add new addresses to the address book. User_id on the new machine is the same as on the old machine, so perms should not be the problem. I checked the selinux context and it is the same as everything else in /home If I do a forced reinstall of Evolution would it mess up the mail files? DaveM

2 6

Centos-DS DSGW
by Alan McKay 03 Dec '09

03 Dec '09

Hey folks, I'm looking for DSGW. Google got me this thread : http://lists.centos.org/pipermail/centos-devel/2008-September/thread.html#3… Did it ever get added, or can I pick up a semi-official package anywhere? I don't see it out there : [root@sandbox1 html]# yum --enablerepo=* search centos-ds Loaded plugins: fastestmirror, priorities Loading mirror speeds from cached hostfile * addons: mirror.csclub.uwaterloo.ca * centosplus: centos.mirror.nac.net * contrib: centos.mbni.med.umich.edu * extras: mirror.csclub.uwaterloo.ca centosplus | 1.9 kB 00:00 centosplus/primary_db | 98 kB 00:00 contrib | 951 B 00:00 contrib/primary | 204 B 00:00 dag | 1.1 kB 00:00 443 packages excluded due to repository priority protections ============================================================== Matched: centos-ds =============================================================== centos-ds.x86_64 : CentOS Directory, Administration, and Console Suite centos-ds-admin.x86_64 : CentOS Administration Server (admin) centos-ds-base.x86_64 : CentOS Directory Server (base) centos-ds-base-devel.x86_64 : Development libraries for CentOS Directory Server centos-ds-console.noarch : CentOS Directory Server Management Console -- “Don't eat anything you've ever seen advertised on TV” - Michael Pollan, author of "In Defense of Food"

1 0

RIPd not announcing routes (CentOS 5.4)
by Timo Schoeler 03 Dec '09

03 Dec '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi list, yesterday I sent this eMail to quagga mailing list, however I didn't receive an answer yet. Unfortunately, I really need this stuff running or have to switch to another strategy achieving the goals. Maybe one of you has some experience on this topic and can shed some light on it -- I really appreciate it. - -----8<-----8<-----8<----- I have a setup here that requires me to announce dynamic route that are created (within some virtual machines) on my CentOS-based machine. Config looks like this: (ripd.conf) ! hostname bla.foo.org password something enable password somethingother log file /var/log/quagga/ripd.log debug rip events ! router rip ~ version 2 ~ redistribute kernel ~ passive-interface default ~ network eth1.123 ~ network eth1.124 ! ~ no passive-interface eth1.123 ~ no passive-interface eth1.124 ! line vty ! Now, the problem is that it seems to distribute its routes (as my Cisco network guy told me), but it does not learn the routes announced by the (Cisco) neighbours: The speaks to a bunch of Cisco routers (which do, among OSPF and BGP routing, redistriubution of lots of stuff via RIPv2, which should feed my machines). The logfile (as configured above in the config) seems okay (except a "RIP: update timer fire!" entry every now and then): 2009/11/30 10:16:47 RIP: RIPd 0.98.6 starting: vty@2602 2009/11/30 10:16:47 RIP: turn on eth1.123 2009/11/30 10:16:47 RIP: Redistribute new prefix x.x.x.x/14 on the interface eth1.123 2009/11/30 10:16:47 RIP: triggered update! 2009/11/30 10:16:47 RIP: turn on eth1.124 2009/11/30 10:16:47 RIP: Redistribute new prefix y.y.y.y/16 on the interface eth1.124 2009/11/30 10:16:48 RIP: multicast join at eth1.123 2009/11/30 10:16:48 RIP: multicast request on eth1.123 2009/11/30 10:16:48 RIP: SEND to 224.0.0.9.520 2009/11/30 10:16:48 RIP: multicast join at eth1.124 2009/11/30 10:16:48 RIP: multicast request on eth1.124 2009/11/30 10:16:48 RIP: SEND to 224.0.0.9.520 2009/11/30 10:16:48 RIP: RECV packet from z.z.z.1 port 520 on eth1.123 2009/11/30 10:16:48 RIP: RECV packet from z.z.z.2 port 520 on eth1.123 2009/11/30 10:16:48 RIP: RECV packet from z.0.0.3 port 520 on eth1.123 2009/11/30 10:16:48 RIP: RECV packet from z.z.z.121 port 520 on eth1.124 2009/11/30 10:16:48 RIP: RECV packet from z.z.z.122 port 520 on eth1.124 2009/11/30 10:16:48 RIP: RECV packet from z.z.z.123 port 520 on eth1.124 ... A 'sh ip rip status' shows me following: QUAGGA# sh ip rip status Routing Protocol is "rip" ~ Sending updates every 30 seconds with +/-50%, next due in 28 seconds ~ Timeout after 180 seconds, garbage collect after 120 seconds ~ Outgoing update filter list for all interface is not set ~ Incoming update filter list for all interface is not set ~ Default redistribution metric is 1 ~ Redistributing: kernel ~ Default version control: send version 2, receive version 2 ~ Interface Send Recv Key-chain ~ eth1.123 2 2 ~ eth1.124 2 2 ~ Routing for Networks: ~ eth1.123 ~ eth1.124 ~ Routing Information Sources: ~ Gateway BadPackets BadRoutes Distance Last Update ~ z.z.z.1 60 0 120 00:00:16 ~ z.z.z.3 60 0 120 00:00:22 ~ z.z.z.2 60 0 120 00:00:25 ~ z.z.z.6 67 0 120 00:00:05 ~ z.z.z.5 69 0 120 00:00:28 ~ z.z.z.121 68 0 120 00:00:22 ~ z.z.z.123 68 0 120 00:00:16 ~ z.z.z.122 69 0 120 00:00:10 ~ z.z.z.7 61 0 120 00:00:11 ~ z.z.z.6 4423 0 120 00:00:27 ~ z.z.z.5 5556 0 120 00:00:00 ~ z.z.z.7 3460 0 120 00:00:09 ~ Distance: (default is 120) So, I got a *lot* of BadPackets. tcpdump shows nothing 'weird', so I don't see the problem. Maybe this is something trivial but I don't see it as I'm new to quagga. Help greatly appreciated. Best regards, Timo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFLFO+ifg746kcGBOwRAsvOAJ9jSJ2vJ6Ir02N7DB1tWHgsPR6LCQCgnT1O j1B+IbniBypTttFLcwmCHlk= =ZuLM -----END PGP SIGNATURE-----

2 2

Latency Monitor
by Matt 03 Dec '09

03 Dec '09

Does anyone know of a utillity I can run on a server to periodically ping several hosts and record the result? Does not need to be anything fancy at all. Matt

5 4

(re)load new kernel with rebooting host node?
by Rudi Ahlers 02 Dec '09

02 Dec '09

Hi all, Is it possible to reload the dom0 / host node's kernel with a newer one, without rebooting the server? I know kexec can do something like this for security patches, but I don't know much about kexec, and I don't want to mess up a production server either. So, has anyone done something like this before? I need to load a new kernel for one of the domU's iptables to work, but don't want to reboot the whole server and cause downtime for the other domU's. -- Kind Regards Rudi Ahlers CEO, SoftDux Hosting Web: http://www.SoftDux.com Office: 087 805 9573 Cell: 082 554 7532

4 3

CentOS 5.3 - changing display settings
by Andrew 02 Dec '09

02 Dec '09

I've just installed CentOS 5.3 on my desktop and need to change the installed display setting from 1280x1024 to 1024x768 (more suitable for my monitor). When I try this on the Display Settings tab, I get the message: "Display settings changed You need to log out and restart the X server for the changes to take effect. Configuration was written to /etc/X11/xorg.conf, original configuration saved as /etc/X11/xorg.conf.backup." Trouble is, I don't know how to restart the X server apart from rebooting the computer, but that has no effect and the display settings remain unchanged! Any help appreciated, Andy

4 4

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss December 2009