NVidia linux driver fun

The desktop I use has an nVidia graphics card for which I use the enhanced Linux nVidia driver (on a Debian lenny machine). All was OK until a recent apt-get upgrade at which point the glx stuff stopped working. I had been using one of the GL screen savers and as soon as that started X crashed!

The answer was that the update had replaced the libglx.so library with a stock one, overwriting the nVidia custom one.

Simple answer - move /usr/lib/xorg/modules/extensions/libglx.so out of the way and put in a symlink from the nVidia one which was lurking at /usr/lib/xorg/modules/extensions/libglx.so.100.14.19

Restart X and all is happy again :)

Joining a Ubuntu / Kubuntu machine to an NIS domain with NFS shared home

Over the past few years, I have usually used Debian as my Linux distro of choice. The server on which our users are set up is sharing the login details with NIS and the home directories are shared by NFS.

This are then picked up by other servers such as our mail server and our LTSP server.

Having tried Kubuntu (the KDE based version of Ubuntu) for a while, I'm considering moving our LTSP server to that distribution as the user facing packages are all more up to date than you get with Debian.

There's a couple of "gotchas" in doing this.

First off, Ubuntu uses sudo rather than letting you log on directly as root. This means that you are always first of all logged on as a real user - who is then using files on /home - meaning that you can't easily NFS mount /home.

My solution to this was to boot to recovery mode which does give you a shell as root, then move /home to /localhome and amend /etc/passwd accordingly for the local user that was created during setup. Incidentally, I also made sure that this local user was not the same name or ID as any users that our main server has.

Next you install the nis stuff - and here's where the networking becomes interesting. The Network Manager doesn't bring the interface up properly once you're joined to an NIS domain - unless you explicitly set the interface to be "auto" - so /etc/network/interfaces looks like:

auto lo
iface lo inet loopback
address 127.0.0.1
netmask 255.0.0.0


iface eth0 inet dhcp

auto eth0


This ensures that the interface comes up before the machine attempts to join the NIS domain and so it is able to do so.


You then do the usual adding of +:::::: to /etc/passwd and similar to /etc/shadow, /etc/group and /etc/gshadow and the users become visible.

Add a suitable NFS mount for /home and lo and behold they can log in and see their files.

Xming and KDE 3.5

I often want to use an Xserver under Windows for connecting to a linux host.

After quite a while of using cygwin to acheive this, I discovered Xming which is based on the same xwindow code but is packaged specifically for providing a windows Xserver. Much simpler to use than installing and configuring cygwin which invariably involves editing the PATH variable on the windows machine and creating a suitable launch icon.

However, if your window manager on the client is KDE, you may well find that if you enable the clipboard support then the Xserver will hang immediately after login using XDMCP.

The solution to this is to edit your gdm.conf file and add the line

KillInitClients=false

in the [daemon] section

Restart gdm and you'll find that you can login and all will work.

Internal modem on a Dell Inspiron 5100 under Linux

Following an incident where I was forced to use GPRS on my mobile to connect back to work I've finally got round to sorting out the modem connection on the Inspiron 5100 that I use for remote work so that I can use it under linux.

It comes with a PC Tel soft modem which doesn't just appear as a /dev/ttyS? port.

The solution is quite simple

apt-get install build-essential module-assistant sl-modem-source

m-a update
m-a prepare
m-a a-i sl-modem

apt-get install sl-modem-daemon

This detects the modem and symlinks it to /dev/modem

Citrix Metraframe client on Linux

For a software demo we're having, I needed to install a Citrix Metaframe client. My desktop of choice is Linux and so I downloaded the linux version of the ICA client from http://www.citrix.com/English/SS/downloads/details.asp?dID=2755&downloadID=3323&pID=186

The software installed fine, as per the Admin guide, but there were a couple of extra bits needed.

Firstly the motif libraries. As I'm running debian etch, and there's no longer a debian version of the motif libraries, I had to download the .deb file for these from an old distro (sarge) and use dpkg to install it.

libmotif3_2.2.3-1_i386.deb was the file in question.

Then, having used Iceweasle (Firefox under any other name) to connect to the citrix box, I was getting 'You have not chosen to trust "Equifax Secure Global eBusiness CA-1", the issuer of the server's security certificate.' when launching one of the applications.

The solution was to go to
http://www.geotrust.com/resources/root_certificates/index.asp

and download the Equifax Secure Global eBusiness CA-1 certificates (note - use right click save as other wise you'll just be trying to install them in the browser) and then copy the files to
/usr/lib/ICAClient/keystore and restart Iceweasle

SMTP AUTH using exim and PAM

I want to use SMTP AUTH to enable road warriors to send though the office mail server - but I don't want yet another set of user names and passwords - so what I need is to use PAM to plug in to the existing Linux authentication mechanism.

This can actually be done quite easily with exim4 (the MTA that we use)

First of all, you'll want to be running the daemon-heavy debian version of exim with split up configuration files.

Then, in /etc/exim4/conf.d/auth add a local config file with:

plain:
driver = plaintext
public_name = PLAIN
server_prompts = :
server_condition = "${if pam{$2:$3}{1}{0}}"
server_set_id = $2

login:
driver = plaintext
public_name = LOGIN
server_prompts = "Username:: : Password::"
server_condition = "${if pam{$1:$2}{1}{0}}"
server_set_id = $1

You could rename these auth drivers if needed if they conflict with existing ones - or probably comment out the existing ones.

In /etc/exim4/conf.d/main set

MAIN_TLS_ENABLE = true

in a local config files (before the 03 TLS one) and

auth_advertise_hosts = ${if eq {$tls_cipher}{}{}{*}}

to only allow AUTH if TLS is running.

Then in /etc/pam.d create a config file for exim.

I have simply:

#
# The PAM config file for exim SMTP
#

# The standard Unix authentication modules, used with
# NIS (man nsswitch) as well as normal /etc/passwd and
# /etc/shadow entries.
@include common-auth
@include common-account
@include common-password
@include common-session

To make it match everything else on the host but you could tailor.

You'll need a set of certificates for the TLS communication. Self signed ones can be produces by /usr/share/doc/exim4-base/examples/exim-gencert

The final step is to make Debian-exim a member of the shadow group so that it can read the shadow passwords and actually do the authentication.


One further change I do is to prevent authenticated mails from being scanned by spamassassin.

In the rcpt acl I add

  # Prevent auth users from being scanned by Spamassassin
  warn     authenticated = *
           set acl_m0    = do-not-scan

Then in /etc/exim4/sa-exim.conf

SAEximRunCond: ${if and {{def:sender_host_address} {!match {$sender_host_address}{\N^(192\.168\.*)|(127\.0\.0\.1)$\N}} {!eq{$acl_m0}{do-not-scan}} } {1}{0}}

Which means that spamassassin won't be called for mail originating on the local network or with the acl_m0 header set to do-not-scan

Hiding accounts on XP

If you're running XP with the "chooser" login method, you can hide certain accounts from the list so that you have to do Ctrl-Alt-Del to login as them

Use regedit to access the registry and browse to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Add a DWORD in there who's name is the user name in question with a value of 0