Blog Moved!!!

This blog has been moved to the Wordpress site.....

http://technicalmumblings.wordpress.com

Join Active Directory Domain on FC8

After struggling to fully join a linux box to the AD domain at work, I've now successfully managed it. This was done in Fedora Core 8, but theres no reason why this shouldn't work regardless of distro. Going to give it a go on Ubuntu next!!

Here's a checklist to follow:

1 - Ensure that the AD domain is correctly configured (DNS,DHCP, etc)
2 - Add the AD domain controller as the first DNS server on the linux box (and check using /etc/resolv.conf)
3 - Ensure the kerberos and samba packages are installed on the linux box
4 - Set the hostname on your linux box in /etc/sysconfig/network
5- Ensure you have the correct hostname (using your FQDN) in/etc/hosts. Mine looks like:

Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 RCFedora rcfedora.rc.local localhost
::1 localhost6.localdomain6 localhost6

6 - Ensure your linux box is set to use the Windows Domain controller as an NTP server and that your time zone is correct (this caught me out - the time zone was incorrectly set and it wouldn't allow me to join the domain!)

7 - Edit /etc/krb.conf to include the following on the FIRST 2 LINES!!

RC.LOCAL rcsrv01.rc.local:88
RC.LOCAL rcsrv01.rc.local:749 admin server

8 - Next I added the file /etc/krb.realms, and added the following line

.rc.local RC.LOCAL

9 - In /etc/krb5.conf, check that the following options are there and correct:

[libdefaults]

default_realm = RC .LOCAL

dns_lookup_realm = true

dns_lookup_kdc = true

[realms]

RC .LOCAL = {

kdc = rcsrv01.rc .local:88

admin_server = rcsrv01.rc .local:749

kpasswd_server = rcsrv01.rc .local:464

kpasswd_protocol = SET_CHANGE

}

[domain_realm]

*.addomain.local = RC .LOCAL

.addomain.local = RC .LOCAL

10 - Next check /etc/nsswitch.conf for the following entries:

passwd: compat winbind

group: compat winbind

hosts: files dns winbind

11 - Check /etc/pam.d/system-auth for the following in the session section

session required pam_mkhomedir.so skel=/etc/skel umask=0022

12 - Under the global settings in the /etc/samba/smb.conf you should have the following

unix charset = LOCALE
workgroup = RC
netbios name = RCFEDORA
password server = RCSRV01
realm = RC.LOCAL
server string = Fedora8
security = ads
allow trusted domains = No
idmap backend = idmap_rid:RC=16777216-33554431
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
log level = 1
syslog = 0
log file =var/log/samba/%m
max log size = 50
template shell = /bin/bash
template homedir = /home/%U
winbind use default domain = yes
winbind offline logon = true
winbind enum users = Yes
winbind enum groups = Yes
winbind nested groups = Yes
printcap name = CUPS printing = cups

and under HOMES you should have

comment = Home Directories
browseable = no
writable = yes
; valid users = %D\%U
; valid users = MYDOMAIN\%S

13 - Finally stop the Winbind and Samba services, and run the following commands:

rm -f /etc/samba/*tdb
rm -f /var/cache/samba/*tdb
rm -f /var/cache/samba/*dat
net ads join -U Administrator

then start the winbind and samba services again and reboot!

You should then be able to log on with domain credentials!

Sage Line 50 v10

I've just spent a couple of days screaming at Sage Line 50 trying to get it working over a VPN. The application finds the data path, allows the user to select a company, but when credentials are entered, it says:

"You have entered an invalid password". I've checked the credentials at the local site and they work, so spent some time mystified.

Eventually I found the solution, but it had nothing to do with the VPN - it was actually an issue with the directory access that is assigned to the Saqe user. If the application is installed by a different user (ie Administrator) then you need to allow Everyone full control access to the /Documents and Settings/All Users and all child objects within.

Syncing Data between Laptop and Desktop

I frequently flit between using a laptop and a desktop for work (both Ubuntu), and I use a lot of files on the go. I've always just copied the files across from the laptop when I returned to the office, but it's not really efficient, as I had to either

a) copy all data - which could be several GB
b) select individual files, of which there were often loads.

I just stumbled across a small application called Unison though, and it's pretty easy to install and configure.

Potentially using this method, you could even sync securely over the web, as it uses SSH :)

First install OpenSSH server

>sudo apt-get install openssh-server

Then install unison :

> sudo apt-get install unison unison-gtk

You then need to modify the profile (you can either set up a new one or modify the default) in ~/.unison

>sudo pico default.prf

Under the profile, you should have the local root path, remote (SSH) root path, and then any paths that you want to include, followed by any paths to exclude:

# Unison preferences file
root = /home/roachy/
root = ssh://roachy@10.204.4.35/
path = work/
path = Music/

ignore = Path work/archive/*

Save the file and either run the GUI version

>unison-gtk

or the command line version

>unison

:)

Avant Window Navigator on Ubuntu Gutsy

Just been rebuilding my Ubuntu Gutsy box after it had really started to crawl - mainly due to me playing with too many bits of software trying to learn new things. The advantages of hosting a separate partition for /home have saved me loads of time and effort as all my data is separate to the OS, so a quick format and within 10 mins I have a shiny new system.

Anyway, one of the things I find essential now on a desktop is AWN (Avant Window Navigator) - it adds that nice Mac dock at the bottom of the screen. The steps to install are as follows

First add the repository containing AWN:

In a terminal

>sudo pico /etc/apt/sources.list

Add the following lines:
## Avant Window Navigator
deb http://download.tuxfamily.org/syzygy42/ gutsy avant-window-navigator
deb-src http://download.tuxfamily.org/syzygy42/ gutsy avant-window-navigator

Download/install/remove the reaocard

>wget http://download.tuxfamily.org/syzygy42/reacocard.asc
>sudo apt-key add reaocard.asc
>rm reaocard.asc

Install Avant Window Navigator

>sudo apt-get install avant-window-navigator-bzr

For extra applets, just add

>sudo apt-get install awn-core-applets-bzr

Done :)

Direct Push on Windows Mobile using Self Signed SSL

I was just looking through some old notes on how to set up Windows Mobile Devices for Direct Push (Calendar, Tasks, Contacts and Email!!!) with a self signed SSL certificate (you can't just install the 64bit .cer file as it won't allow the file type). Anyway, thought I'd publish the solution here....

Note: this only works on Windows Mobile 5 and above - not WM 2003 :(

I'll assume here that people know how to create the SSL certificate (if not theres a good guide at http://www.petri.co.il/install_windows_server_2003_ca.htm)

Next download the SSLChainsaver tool to the root of your C: drive

http://blogs.msdn.com/windowsmobile/archive/2006/08/11/sslchainsaver.aspx

Follow the instructions on the page to pull a copy of the root and leaf certificates, then export the ROOT certificate in Base-64 encoded format.

Open the certificate from a command prompt using the line:

C:\Type rootcert.cer

Which will output the hash of the certificate, which will look like:

C:\>type rootcert.cer

-----BEGIN CERTIFICATE-----

MIIEYzCCA0ugAwIBAgIQG4HnhkoEsahFnmBPR65JWjANBgkqhkiG9w0BAQUFADA9
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
A1UEAxMHYmhzcnYwMjAeFw0wNTEwMDMxNzA3NTRaFw0xMDEwMDMxNzE1MjFaMD0x
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
VQQDEwdiaHNydjAyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2GTQ
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
N2RtoT4HcNUHYyDTlLrydD4tCOq21o4cNHRk67UsRGRHjZz/BI1YsdOXl1rakOva
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
COsC4ULQDytkuw9gCifqiCyxnT0k7+zkIgNxF4ncFdbnESLm3Bw2wCBz1G/MtUwY
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2AiOz+jgGeYKv9jD8wIDAQABo4IBXTCCAVkwEwYJKwYBBAGCNxQCBAYeBABDAEEw
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
5a5dW4PRqcsXEAMtMIHyBgNVHR8EgeowgecwgeSggeGggd6GgatsZGFwOi8vL0NO
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
dmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1iaCxEQz1sb2Nh
bD9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JM
RGlzdHJpYnV0aW9uUG9pbnSGLmh0dHA6Ly9iaHNydjAyLmJoLmxvY2FsL0NlcnRF
bnJvbGwvYmhzcnYwMi5jcmwwEAYJKwYBBAGCNxUBBAMCAQAwDQYJKoZIhvcNAQEF
BQADggEBAEGdXuUfA7kvCxLLOI+W3+Nbz7lENOZF59cNVaQJ5HwjIGtLhw2tv2c0
SibjlB68ecuyuD6K4gYLVlhZrLelDKqGYsV3uF+Q4293+t2S+D3cMXW/gPAYeBU2
Ld+P6dm4tjmzcSC/Xpi3mQpw8kQF93rEEkApbP4LOXh/X5LpyZ2iS15RTMMomxvL
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ILk4wkjERNGgRRl5eOF3QZ/hMWRu1UMb1C6mrcxs4pBW1qyOJQNJB+Y3eHuWCzfw
oZMi16R2/MCkY6xCqvDRj302UKLHUbU=

-----END CERTIFICATE-----

Create a new file in notepad using the following template and call it _setup.xml, then paste the cert above into the section as below.




Then open your root certificate, look at the thumbprint of the certificate and copy that into the characteristic type section (highlighted in red above, without the spaces). My Thumbprint looked like 963688b77d91307e0164661f9550e2a2

Finally, all you need to do is make the .xml file into a cab file for installation into the Windows Mobile Device using the command line makecab (which ships is %systemroot%\system32 with windows

Makecab _setup.xml rootcert.cab

Copy this to your Windows Mobile device with Activesync, then run.

You should now have an appropriate certificate to allow you to use Direct Push Email through Exchange Activesync…..

Hoorah!!

Business Contact Manager

Following on from the previous post....I had been unable to install Business Contact Manager for Outlook as a preinstalled option, and every time the user went into Outlook a nagging screen popped up to create a BCM database....

After much swearing as I repeatedly got the error "unable to complete the un/installation" - which was highly descriptive I found the following:

http://support.microsoft.com/kb/903094/en-us?spid=2520&sid=904

Although not strictly an uninstall, it would have done....

As a last ditch effort though I thought I'd log on as the original local account for the machine, attempted the uninstall and it worked straight away....