Permissions on USB devices on LTSP terminals

In our linux environment, all our users have the same primary group, rather than having a private group. For the vast majority of stuff this is fine and keeps things simpler. However the method that ltsp uses for mounting USB sticks (or other local media) creates a directory called /media/ on the server which is has the group set to the primary group of the user and the owner set to root with permissions of rwxr_x___

This, combined with the users all being in the same primary group leads to the devices that users plug in being shown on all users' desktops. They can't actually access the devices - those have different permissions - but they can see their existence which at the least is annoying and in the case of several people using CD drives, confusing.

My current solution is a little convoluted - but does the trick.

Firstly you need a program that can change ownership of a directory. This has to be installed as a suid program as the mounting script is run by the user who is logged into the terminal.

I just have a little piece of C to do the job:

#include
#include
#include

int main(int argc, char *argv[]) {

char buff[100];

if (argc != 2)
exit(1);

sprintf(buff, "/bin/chown %s:root /media/%s", argv[1], argv[1]);
system(buff);

return(0);
}

I call this program mediafix and have installed it in /usr/local/bin

Then, in /usr/sbin/ltspfsmounter, add a line saying

call(['mediafix'], username)

towards the end of the main function after the mounting has taken place.

This ensures that any time a device is mounted, the containing directory has it's ownership amended and keeps the icons hidden from other users.

Debian Lenny on a Poweredge 2600

Usually the Debian upgrade procedure is pretty straight forward, and my recent upgrade of a Poweredge 2600 from etch to lenny was no exception. Just change the sources and do an apt-get update; aptitude dist-upgrade and answer some questions along the way.

Occasionally there's a gotcha - and this one had an issue with our lvm based file system. Using the new kernel that comes with lenny (2.6.26), it failed to find the lvm and therefore wouldn't boot.

A little googling revealed a potential solution - add the option "rootdelay=9" to the kernel options for boot - and surely enough the machine was back to life.

Flashing the firmware on a 3c905c network card

There's two revisions of the 3C905C out there. The earlier one has an issue when using boot code on the card in that you can't make use of the "next server" option in your dhcp config - it simply fails to boot from the correct server reporting a timeout during the TFTP.

The later version works fine - so here's the trick - take the firmware from a later one and flash it to the earlier.

Using a debian box this is relatively simple.

Install the etherboot package to get the tools needed.

Then in /usr/share/doc/etherboot/contrib/3c90xutil/ gunzup cromutil.c.gz and bromutil.c.gz

Make sure you have built-essential on your system and then use make to compile the tools

Now, with the good card in the system, do

lspci -v | less

and look for the ethernet controller. Make a note of it's I/O port address (ours was a000

Then to get the rom image type

./cromutil [ioport] read > [imagename]

e.g.

./cromutil a000 read > working.rom

Now shut down the machine and replace the good card with the one that needs programming

Once you've booted back up, go to /usr/share/doc/etherboot/3x90xutil/

Use lspci -v again to check the address of this card

Then do

./cromutil [ioport] erase
./cromutil [ioport] prog < [imagename]

You should now have a card programmed with the later firmware and capable of correct remote booting where the boot host is other than the dhcp host.

Using LDAP for email aliases

As I gradually migrate various servers to using LDAP as the auth back end, it occured to me that there was some duplication going on in terms of adding the users' email addresses to the LDAP so that they could be looked up on clients and then having an aliases file that was being used by exim to do the delivery.

So I've come up with the following for allowing exim to take advantage of the email addresses stored in the LDAP database:

### router/450_local_ldap_aliases
#################################

# This router handles aliasing looking up email addresses in an ldap database.
#

ldap_aliases:
debug_print = "R: ldap_aliases for $local_part@$domain"
driver = redirect
domains = +local_domains
allow_fail
allow_defer
data = ${lookup ldap {ldap://127.0.0.1/ou=Users,dc=...?uid?sub?(mail=$local_part@$domain)}}

Ubuntu on a Dell XPS M1530

With the release of Ubuntu 8.10 (Intrepid Ibex) the vast majority of stuff on a Dell XPS M1530 works out of the box. One caveat is the touchpad. It jumps around like a demented rabbit!

The solution is simple.

Edit /boot/grub/menu.lst

Find the line that starts
# kopt=root=UUID....

Add i8042.nomux=1 to the end of that line

Then run update-grub and reboot.

Office 97 as a normal user

Usually when you put a Windows XP machine on a user's desktop you want to have them logging in as a standard user rather than a power user. However various bits of software have issues with that due to poor design of the way they handle the registry. They try to write to keys or create keys in areas that they don't have permission.

One such delight is Office 97. There are two specific problems. Firstly, spelling and grammar checking is disabled. This has to be fixed with a registry permissions edit.

HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Proofing Tools\Spelling

HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Proofing Tools\Grammar

both need to have Set Value and Create Subkey enabled for the group Users

The other issue is VBA macros. There are two solutions here. One is another set of permissions changes - but these open up quite a lot in the registry. Much better is this solution.

As administrator run a macro - doesn't matter what - just something to get the macro system used.

Then in

C:\Documents and Settings\Administrator\Local Settings\Temp\VBE\

you will find MSForms.EXD

Copy that to somewhere accessible. Then for each user who needs to run VBA macros, copy this file into their Local Settings\Temp\VBE folder.

LTSP 5 local devices fun

Been working on using LTSP 5 on a Kubuntu machine to replace our current LTSP 4 set up on debian. Part of this has been about getting local devices operational which, on the whole, works "out of the box" with the (k)ubuntu ltsp packages. The local devices appear under /media/ - which you could create a symlink to on the desktop for the users to easily access their devices.

However, I plugged in one of my USB memory sticks and nothing happened. So I went through the debugging routine:
Check that the device is partitioned (/dev/sdb1 rather than just /dev/sdb when plugged into my linux laptop)
Check that the ltsp workstation is seeing the device by logging into the local shell as root and using dmesg after plugging it in
Check the udev stuff is happening (look for an entry in /var/run/ltspfs_fstab)

That was where it was failing - no entry.

So I dug around in the udev rules and looked at the script that adds the entry to the fstab. Here was the source of the problem. This script uses the label on the volume to create the mount point and the volume label on my usb stick had a space in it - that was enough to prevent it from running the script properly.

So - if you want your removable media to work on a (k)ubuntu LTSP set up then make sure that any volume labels are without spaces.