Discuss July 2010

discuss@lists.centos.org

242 participants
193 discussions

kvm as non-root user
by David McGuffey 03 Jul '10

03 Jul '10

Tried as I might, I cannot get kvm on CentOS 5.4 to run as a non-root user. Have Googled and followed guidance I've found (put the regular user in the kvm group, change permissions on several files, etc.). Anyone have decent (e.g., working) guidance on how to do this? Dave M

2 3

Windows 2003 AD, Winbind, Kerberos and NFSv4
by James A. Peltier 03 Jul '10

03 Jul '10

Hi All, I'm having a bit of difficulty getting a CentOS 5.5 Kerberized NFSv4 server working. This server is configured as a Winbind client to a Windows 2003 Active Directory. I've successfully bound it to AD and I am able to authenticate. I've successfully created a NFSv4 entry in /etc/exports to export the /exports directory and I can successfully mount a non-Kerberized NFSv4 mount on a client machine. I now want to take it to the next step and add Kerberos and it doesn't seem to be working for me. Below are my configurations and the steps I performed. Fresh install of CentOS 5.5. Non-Kickstarted. Wanted to get it working manually first. Used the First Boot Authentication Wizard to configure Winbind Support for User Information. Configured Winbind and Kerberos under the Authentication Tab Checked Local auth is sufficient and Create home directories under options The computer successfully joins the domain and appears in the Computer container in AD. Below is the extract from /etc/samba/smb.conf for authconfig plus what I changed, everything else is stock. I disabled the firewall and SELinux is running in permissive mode on both the test server and test client. #======================= Global Settings ===================================== [global] #--authconfig--start-line-- # Generated by authconfig on 2010/07/01 18:32:54 # DO NOT EDIT THIS SECTION (delimited by --start-line--/--end-line--) # Any modification may be deleted or altered by authconfig in future workgroup = MY.AD.NAME password server = MY.AD.SERVER realm = MY.AD.NAME security = ads idmap uid = 16777216-33554431 idmap gid = 16777216-33554431 template shell = /bin/bash #--authconfig--end-line-- #-- my additions/changes-start -- template homedir = /home/%U winbind use default domain = true winbind offline logon = true winbind nested groups = true winbind refresh tickets = true use spnego = yes use kerberos keytab = yes #-- my additions/changes-end -- It also created an appropriate, I believe, /etc/krb5.conf to which I removed only the .example.com stuff resulting in the following file. [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = MY.AD.NAME dns_lookup_realm = false # with and without true tried for these dns_lookup_kdc = false ticket_lifetime = 24h forwardable = yes [realms] MY.AD.NAME = { kdc = MY.AD.SERVER admin_server = MY.AD.SERVER kdc = MY.AD.SERVER } [domain_realm] my.ad.name = MY.AD.NAME .my.ad.name = MY.AD.NAME [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } If I log into this host I am properly issued a Kerberos ticket from AD so it would appear that Kerberos is working properly [jpeltier@oak ~]$ ssh aconite klist jpeltier@aconite's password: klist: You have no tickets cached Ticket cache: FILE:/tmp/krb5cc_16777216_ltvWwy Default principal: jpeltier(a)MY.AD.NAME Valid starting Expires Service principal 07/02/10 10:46:43 07/02/10 20:46:43 krbtgt/MY.AD.NAME(a)MY.AD.NAME renew until 07/02/10 20:46:43 Kerberos 4 ticket cache: /tmp/tkt16777216 [jpeltier@oak ~]$ Now I configured NFSv4 exports on the server /exports *(rw,fsid=0) Edited /etc/sysconfig/nfs to change # Set to turn on Secure NFS mounts. #SECURE_NFS="yes" to # Set to turn on Secure NFS mounts. SECURE_NFS="yes" restarted NFS service and it appears as an export [root@aconite ~]# /etc/init.d/nfs restart Shutting down NFS mountd: [ OK ] Shutting down NFS daemon: [ OK ] Shutting down NFS quotas: [ OK ] Shutting down NFS services: [ OK ] Shutting down RPC svcgssd: [ OK ] Starting RPC svcgssd: [ OK ] Starting NFS services: [ OK ] Starting NFS quotas: [ OK ] Starting NFS daemon: [ OK ] Starting NFS mountd: [ OK ] [root@aconite ~]# exportfs /exports <world> [root@aconite ~]# To support NFSv4 with Kerberos security, we also need to generate service principal for NFS: [root@aconite ~]# net -U administrator ads keytab add nfs which then looks like this [root@aconite ~]# klist -k Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 3 host/aconite.my.ad.name(a)MY.AD.NAME 3 host/aconite.my.ad.name(a)MY.AD.NAME 3 host/aconite.my.ad.name(a)MY.AD.NAME 3 host/aconite(a)MY.AD.NAME 3 host/aconite(a)MY.AD.NAME 3 host/aconite(a)MY.AD.NAME 3 ACONITE$(a)MY.AD.NAME 3 ACONITE$(a)MY.AD.NAME 3 ACONITE$(a)MY.AD.NAME 3 nfs/aconite.my.ad.name(a)MY.AD.NAME 3 nfs/aconite.my.ad.name(a)MY.AD.NAME 3 nfs/aconite.my.ad.name(a)MY.AD.NAME 3 nfs/aconite(a)MY.AD.NAME 3 nfs/aconite(a)MY.AD.NAME 3 nfs/aconite(a)MY.AD.NAME Test on the client [root@celastrina ~]# showmount -e aconite Export list for aconite: /exports * [root@celastrina ~]# mount -t nfs4 aconite:/ /mnt [root@celastrina ~]# mount |grep -i nfs4 aconite:/ on /mnt type nfs4 (rw,addr=199.60.1.84) [root@celastrina ~]# So as you can see everything is now working *without* Kerberos. However, if I change the /etc/exports file on aconite to [root@aconite ~]# cat /etc/exports /exports gss/krb5(rw,fsid=0) [root@aconite ~]# exportfs /exports gss/krb5 and then try to mount with the -o sec=krb5 on the client [root@celastrina ~]# mount -t nfs4 -o sec=krb5 aconite:/ /mnt mount.nfs4: Permission denied and the entry in /var/log/messages on celastrina is Jul 2 11:21:57 celastrina rpc.gssd[3302]: Using keytab file '/etc/krb5.keytab' Jul 2 11:21:57 celastrina rpc.gssd[3302]: WARNING: Failed to obtain machine credentials for connection to server aconite.my.ad.name nothing appears in the logs on aconite. If you've been kind enough to read this entire thread could you be kind enough to let me know what I am missing or doing wrong? It seems so close now that I can taste it, but this one last piece doesn't seem to want to fall into place. :( -- James A. Peltier Systems Analyst (FASNet), VIVARIUM Technical Director HPC Coordinator Simon Fraser University - Burnaby Campus Phone : 778-782-6573 Fax : 778-782-3045 E-Mail : jpeltier(a)sfu.ca Website : http://www.fas.sfu.ca | http://vivarium.cs.sfu.ca http://blogs.sfu.ca/people/jpeltier MSN : subatomic_spam(a)hotmail.com TEAMWORK There's power in numbers. Learn to work together.

3 4

File sharing solution
by Jussi Hirvi 02 Jul '10

02 Jul '10

I would like to offer my isp clients a solution for sharing (big) files, basically on one-to-one basis. This is how I imagine it: - an anonymous or registered user can upload a file - on response (s)he will get a file-specific (or batch-specific) username/password - (s)he can send a link and un/pw by email - the receiver can download the file - the file will be automatically deleted from the server in n days There must exist an opensource solution for this, but I could not find it by google. Where to look for it? - Jussi -- Jussi Hirvi * Green Spot Topeliuksenkatu 15 C * 00250 Helsinki * Finland Tel. +358 9 493 981 * Mobile +358 40 771 2098 (only sms) jussi.hirvi(a)greenspot.fi * http://www.greenspot.fi

2 2

NIC config documentation?
by Les Mikesell 01 Jul '10

01 Jul '10

Does anyone have a favorite howto or other succinct document that that describes how to set up networking on a multi-nic host when you don't know ahead of time which nic is which? I usually muddle through it by plugging in one wire at a time, using mii-tool to see which link is up, then ifconfig on that interface to get the HWaddr to put in the corresponding /etc/sysconfig/network-scipts/ifcfg-eth? file. But now I need to train some other people how to do it and it seems like there should be a better way. -- Les Mikesell lesmikesell(a)gmail.com

1 0

Firefox slower on GMail since update to CentOS 5.5
by Mathieu Baudier 01 Jul '10

01 Jul '10

Hello, since I upgraded from CentOS x86_64 5.4 to 5.5, I noticed that Firefox has become significantly slower on GMail (or Google Apps Mail). The page becomes slow to scroll as soon as there are more than a few mails in a conversation (like in a typical CentOS mailing list thread). Did anyone else notice that as well? (I guess that I'm not the only GMail user around) Could I have missed something / do something wrong? More details: - I did a fresh install from the 5.5 install DVD, keeping only the home directories - I'm using the Nvidia driver from elrepo (but I had the pb also with the default driver) Cheers, Mathieu

8 20

Anyone seen the Adobe update?
by m.roth＠5-cent.us 01 Jul '10

01 Jul '10

Well, here it is, the day after the Adobe update was announced, and they say that I should go for 9.3.3... but there's still no update visible to yum. Anyone have an ETV on this? mark

1 0

GNBD/LVM problem
by Kwan Lowe 01 Jul '10

01 Jul '10

Hello all: I'm having a strange problem with GNBD and LVM on two fully updated CentOS 5.5 x86_64 systems. On node1, I have exported a gnbd volume. lvcreate -L 500M -n mirrortest_lv01 mirrorvg gnbd_serv gnbd_export -d /dev/mirrorvg/mirrortest_lv01 -e node1_lv01 On node2 I have imported the volume: gnbd_import -i node1 Next, on node2 I attempt to create a mirrored LV with the imported GNBD volume and a local disk: fdisk /dev/gnbd/node1_lv01 then create an LVM partition fdisk /dev/sdb then create an LVM partition I can then create a volume group with those two disks: pvs vgcreate mirrorvg /dev/sdb1 /dev/gnbd0 The problem occurs when I try to create a mirrored LV using the above VG. [root@vm-helios-002 ~]# lvcreate --mirrorlog core -L 256M -n mirroredlv01 -m 1 mirrortestvg Insufficient suitable allocatable extents for logical volume : 64 more required Unable to allocate extents for mirror(s). It doesn't matter what disk sizes are available. Even creating a non-mirrored LV causes issues: [root@vm-helios-002 ~]# lvcreate -L 256M -n mirroredlv01 mirrortestvg Error locking on node 192.168.8.152: device-mapper: create ioctl failed: Device or resource busy Error locking on node 192.168.8.151: Volume group for uuid not found: xCTR5M2kOEBiLM7eSRntez2y2VKy9vvqnSs6LTC99x9kIsAdNI2l8CH90h6BYKsH Aborting. Failed to activate new LV to wipe the start of it. [root@vm-helios-002 ~]# The other issue that's occurring is that even if I remove the GNBD PV from the mirrortestvg, it still gives the error (i.e., using just local disk). Not sure where to look at this point. I suspect it has something to do with the cluster locking, but the configuration is really basic and specifies no clustered volumes.

1 0

RHEL 6b2 Release
by b.j. mcclure 01 Jul '10

01 Jul '10

For those who might be interested, RHEL 6b2 has just been announced. http://www.redhat.com/rhel/beta Cheers, B.J. CentOS 5.5, Linux 2.6.18-194.3.1.el5 x86_64 10:47:08 up 8 days, 14:45, 1 user, load average: 0.56, 0.55, 0.49

5 5

An Interview with Karan
by didi 01 Jul '10

01 Jul '10

A nice little insight into CentOS : http://distrowatch.com/weekly.php?issue=20100628#feature Cheers Didi p.s. Sorry if this has already been posted :) -- Hoffmann Geerd-Dietger http://contact.ribalba.de

4 3

Re: [CentOS] Update update failed on filesystem-2.4.0-3.el5.x86_64
by Emmanuel Noobadmin 01 Jul '10

01 Jul '10

On 7/1/10, Bond Masuda <bond.masuda(a)jlbond.com> wrote: > I believe the filesystem RPM basically owns all the main directories on the > system. One of them being /media. I suspect you have something mounted on > /media, and since installing filesystem will try to create /media, that > results in an error it wasn't expecting. > > can you umount /media and try again? I think that would allow 'filesystem' > to complete its install process.... Thank you very much for the help, didn't realized /media was still mounted.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Discuss July 2010