FreeNAC - VLAN access management on Cisco Switches

I started playing around with FreeNAC recently in conjunction with several Cisco 3500XL switches. I tried playing around with the virtual machine they provided. It needs an upgrade on the FreeNAC source to the latest code in order for the windows GUI to work (there are schema errors unless you upgrade the FreeNAC source.)
    I was interrupted in the testing. I'll post more when I have results... most likely tips.

CentOS 5.5, Samba/Winbind, Windows 2008R2 Active Directory

In order to facilitate client backups, I set up samba on CentOS on a Windows 2008R2 based domain. I created an empty directory, /etc/skel2, as I was not planning on letting users log in via ssh or the console.

 Unfortunately, the samba 3.0.x line wouldn't work correctly. I could join the domain, but not connect to shares. Samba logged the following message every connection attempt:


  read_data: read failure for 4 bytes to client 192.168.70.23. Error = Connection reset by peer

I upgraded to the Samba3 package with yum (Samba 3.3.x) and rejoined. I added a pam.d entry in the samba config:

 session required pam_mkhomedir.so skel=/etc/skel2 umask=0077


( I don't want users to see each other's directories. I did not modify system-auth, as I did not want the users to log in with anything but samba.)

And added this to smb.conf:


  winbind separator = \
  # use uids from 10000 to 20000 for domain users
  idmap uid = 10000-20000
 # use gids from 10000 to 20000 for domain groups
 idmap gid = 10000-20000
 # allow enumeration of winbind users and groups
 winbind enum users = yes
 winbind enum groups = yes
 winbind use default domain = yes
 # give winbind users a real shell (only needed if they have telnet access)
 template homedir = /data/clientdata/backups/%D/%U
 template shell = /bin/bash
 obey pam restrictions = yes

An important note, the samba3 rpm separates the smbd and nmbd init scripts, so you'll need to do a separate "chkconfig nmb on."

Upgrading to ESXi 4.1 from 4.0.

I recently needed to update an ESXi 4.0 host to ESXi 4.1. After discovering that the host update utility was not supported with ESXi 4.1, I resorted to my other option, the vSphere CLI.
Here's the session (on Windows 7 64bit):

 C:\Program Files (x86)\VMware\VMware vSphere CLI>bin\vihostupdate.pl --server my_server -b upgrade-from-ESXi4.0-to-4.1.0-0.0.260247-release.zip -i

The output:


 Please wait patch installation is in progress ...
 The update completed successfully, but the system needs to be rebooted for the changes to be effective.


Followed by a reboot:


 C:\Program Files (x86)\VMware\VMware vSphere CLI> bin\vicfg-hostops.pl --server my_server -o reboot

 Host my_server rebooted successfully.

Netgear GSM Switches and LAGs/Port channels

Setting up port-channels/lags is pretty easy on Netgear GSM switches. In this example, we are assuming that we are connecting two Netgear GSM7324 switches, and adding vlan 10 to them. We'll link together ports 23 and 24 on both switches.

1. create the interface:

configure
port-channel lag_01

2. assign it to two ports:
configure
interface range 0/23-0/24
addport 1

3. Allow VLAN 10 and 1 to travel over it. Require them both to be tagged:
configure
interface lag 1
vlan participation include 1
vlan tagging 1
vlan participation include 10
vlan tagging 10

New Console Game Out...

This is a fake game cover I made for a friend. Not computer related, but since no one reads this blog anyway, who cares?

Trouble sending out email from Bacula 5.0.2 and CentOS 5.5

I recently noticed that Bacula installations on CentOS 5.x (primarily 5.5) boxes were not sending out email after job completion. It was baffling as bsmtp worked fine on the command line... at least when I ran it as root. I tried running it as the bacula user (my Bacula director runs as the Bacula user, not root) and it failed:

$ su - bacula -s "/usr/sbin/bsmtp"
-bsmtp: error while loading shared libraries: libbac-5.0.1.so: cannot open shared object file: Permission denied


Ah... I checked the file permissions:

ls -la /usr/lib/libbac-5.0.1.so
-rwxr-x--- 1 root root 330240 Jun 22 12:46 /usr/lib/libbac-5.0.1.so

Simple fix:

chmod o+r /usr/lib/libbac-5.0.1.so

On 64 bit CentOS/Rhel, it will be /usr/lib64/libbac-50.0.1.so

I'm guessing that there was a problem in the spec file (I built it from an srpm.)

Bacula Windows Client and error 1067

I recently ran into an error starting the bacula-fd service on a windows client: error 1067. I looked it up... several people had this error, but no resolution. I looked at the application log on the windows client, but there was no bacula message.

To figure it out, I started the bacula-fd.exe file by hand from a command prompt. It gave the full error message (I had a minor typo in the bacula-fd.conf file.)

I corrected the typo and was able to successfully start the service.

Coincidentally, a useful one liner for bconsole on Linux:

watch -n 1 --differences "echo status 2 2 | bconsole | \
    grep 'Files=' | sed -e 's/ */ /g' | cut -f 3 -d \" \""

In this case, my storage device is #2. It produces out put like this (every second):
Every 1.0s: echo status 2 2 | bconsole | grep 'Files=' | sed -e 's/ */ /g' | cut -f 3 -d " " Sun May 23 00:45:54 2010

Bytes=1,765,498,476

Unfortunately, this won't work on FreeBSD as the watch command from ports has different syntax.