Oracle: Unbreak my Linux Heart

We currently use SVN to enable us to do release management of deployments. The SVN server holds all our kickstart, post installation and configuration scripts, as well as distribution scripts for software packages (Oracle database, application server, OEM, the OEM agent and more). The actual packages are not in SVN but on an NFS server. CollabNet released a new version of Subversion (SVN) a few days ago. And I'm excited! Subversion 1.6 introduces several new features, including improved authentication (Apache + LDAP) and file system storage as well as better handling of tree conflicts. Check the release notes for full details. The new version also introduces a new public way to reference the history of the repository. You can now read older versions of files through the web interface without the need for a SVN client. This enables 3rd party tools do innovative things through an easy to use interface into SVN.

Computerworld has a great read about Samba 4 and how it'll improve AD integration of Linux and MS AD. Although it's been possible for a long time, bundled SAMBA version in distos can run behind the main development line and become a pain when trying to read documentation and configure older versions. SAMBA4 will run most things out of the box: Bartlett admitted Samba has a "nasty" reputation for being "impossible to configure" and believes Samba 4 should "just work" without administrators needing to read through documentation first. "For example, in Samba 4 we generate the DNS configuration and have an optional OpenLDAP backend and we have configured this as we know how Samba needs this setup." Over the past year Samba 4 has added multi-master replication leveraging OpenLDAP, making Samba no longer a single-server implementation. "Our users have also demonstrated how smart card logins work. I barely had to do anything in Samba 4 to ...

Central user administration has been a long desired feature by me for our data center. MS AD does it all for Windows, but Linux has been all stand-alone so far. I tried to do something quick with NIS in the past, but it never quite took off. So it's just me own (mngt and monitoring servers). For this year, Identity Management was made an issue. However, which one is still up in the air. AD, Oracle's OID , Centrify or just plain an simple standard openLDAP ? From my own experiences, openLDAP is great but distributions are behind on the latest official releases and this can wreak havoc in some obscure but critical situations. So time to read up on the subject. Someone recommended the IBM Redbook Understanding LDAP - Design and Implementation to me... Interesting!

Just received notice that Red Hat Enterprise Linux 5.3 Beta has been out since October 28th... Sjeez! Why didn't I know that sooner...? Anyway the bèta will last until January 9th, 2009, so when I get from holidays, I'll have my work cut of out for me. RHEL 5U3 brings many, many virtualization (Xen) improvements. A new kernel (kernel-2.6.18-120.el5), rebased versions of monitoring tools (lm-sensors, net-snmp, openIPMI, openldap), new versions of yum and rpm, updated Kerberos subsystem, newer SAMBA (3.0.32) with support for Vista and Windows Server 2008, a ton kernel fixes and features, new hardware drivers (bcm43xx, bnx2/bnx2x, cpufreq, e1000/e1000e, mptscsi, qla24xx, etc.) and some interesting Technology Previews! dm-multipath install, which should allow anaconda to install Linux on systems with 2 or more HBAs. Support for ext4 file systems. CIFS (aka SAMBA) enhancements in the form of kernel DFS support and Kerberos security. Check the complete Release Notes for a full upda...

A never ending problem when you run Linux in the enterprise, is security (and stability) of the systems and access control to allow users, contractors, developers to install software and create or tweak configurations so that some application or service runs. Ideally, only you the sysop can install or configure software and everyone else has to turn to Using sudo , you can define tons of ways for users or groups to be able to run (or not) some commands on some or all systems. You can setup that they may run commands as other users without needing their password. Or you can turn off passwords all together. However, as soon as you start building a list of commands that a certain user or user group can or cannot run, you create the possibility for knowledgeable hackers users to work their way around your system by creating loopholes, symbolic links or abuse buffer overflows. Perhaps, we should all use sudo to allow or deny general access to machines or users and use consolehelper to cre...

The sudo mailing list sent a message with instructions for using your Microsoft AD server (aka Domain Controller) as an LDAP host for hosting sudoers. I.e. integrating sudoers in an LDAP server so authentication and authorization on Unix/Linux servers can be managed in a consistent, central way. "Using LDAP to synchronize Users, Groups, Hosts, Mounts, and other commands across an enterprise can greatly reduce the administrative overhead." [from the sudo site ] This way, you extend the AD schema and prepare it for inclusion on your system-wide sudoers file. You then use or switch to an LDAP-enabled sudo version and from then on, access to your *nix hosts can be controlled through LDAP (nothing new there), but also authorization to let certain users use certain commands on certain hosts can be controlled from that same LDAP host. In this particular case, that LDAP host can be your existing Microsoft AD server, which many Unix and Linux administrator have to deal with anyway.....

While searching the sudo manual for samples and explanations, I discovered that my Oracle Enterprise Linux 4 update 5 uses sudo version 1.6.7p5. The official version is up to version 1.6.9p9. Interesting is, however, that the new version has means to integrate with LDAP! That means, that instead of maintaining a central /etc/sudoers file, you can build your authorization tree in LDAP, where you can also handle your authentication! Cool! Of course, by LDAP I mean OpenLDAP , Novell NDS, Oracle OID or even Microsoft AD...

After political and time pressure not to pursue any commercial products to integrate Linux user authentication into MS AD, I'm falling back to my original plan to set-up NIS(+) for now and deal with AD later... I followed instructions at Linux Home Networking and got the NFS server running but would get an error when logging in as a user: "unable to chdir to home directory". Fortunately, it seems a common error when using NIS and NFS (and Kerberos). It turns out my NFS client wasn't correctly configured. The automount file /etc/auto.home for /home listed my subnetwork (10.X.0.0/16). That's what I had the NFS server configured for. The automount file should just list '*' there... Next is NIS...

While setting up a schema to handle Linux user authentication and authorization using our big corporate Windows Active Directory (AD) server, I ran across a TechEd session that mentioned Scott Lowe's blog. On his very nice looking tech blog, I found a great article describing clearly how to integrate Linux into an AD running on Windows Server 2003 R2. Mind you, Server 2008 - the next release - will be somewhat different and older version of Windows Server as well. It mainly has to do with the RFC2307 or the Server for Unix (SfU) from Microsoft.

Just to be fair, I've been looking for ways to integrate user, account and policy management between Linux and Windows. I have a corporate Active Directory they want me to adhere to/with. So using AD as the main system, because they know how to maintain it and procedures are in place, I'd couple Oracle Linux's user accounts and groups with AD. Vintela also claims to do this, just like Centrify and Unix Components of Windows Server 2003 R2. But personally, I'm still charmed by PADL's NIS/LDAP gateway. I like using NIS to provide seamless account and access rights management with some other system that uses LDAP. That way I could potentially choose to work with MS AD, Novell NDS or a home built openLDAP authentication back-end.

My investigation of Linux/Windows integration for user authentication also showed that Windows Server 2003 R2 has UNIX Interoperability Components , also for Linux but Microsoft tends to put them all onto one pile i.e. non-Microsoft. The UNIX Components claim to be able to give a Kerberos trust between Linux and Windows servers, probably through winbind. It has Active Directory (AD) schema updates for NIS and Kerberos authentication and lets NIS slaves sync with the AD. Using Identity Management for UNIX (IDMU), you also get a Windows-based NIS server... hmmm, I can't help but read "milage may vary" between the lines... We'll see.

PADL has loads of good links to LDAP Documentation for various parts of the process of tying Linux into LDAP authentication, with or without the use of Active Directory NOTE: PADL also offers useful (and free) NSS and PAM modules on their site.

When diving into Linux user authentication and authorization, you will definitely need to read the PAM documentation .

From the LPIC pre-exam tests by snow.nl , I got an idea confirmed that one should be able to implement a layered "fall-through" user authentication schema using PAM in Linux. The idea was to maintain a small set of power user and sysadmin information in NIS, because NIS provides access control as well as authentication and ties into su/sudo/sudoers at the OS level. LDAP would be used to maintain and administer several hundred or thousand accounts for customers, vendors, suppliers and other people who need access to certain machines or control specific services (such as web, application or database servers). The PAM authentication (2.210.4) from snow.nl outlines just that. Utilizing PAM's fall-through mechanism, you first check authentication credentials using NIS (sufficient), if it fails you check LDAP (sufficient) and finally the OS itself (required).

Found another set of Conversion Tools for LDAP , many free (GPL) and some commercial. Bottom-line: LDAP is a safe path to build and store your authentication directory information with/in. You can easily (relatively) convert form LDAP to standard Linux passwd and shadow files, or to NIS...

Been looking some more into the user administration issues I face when maintaining a few hunderd Linux servers for various people, customers and developers... Centrify seems to have a nice product that allows me to authenticate Linux users against an (existing) MS Active Directory Server (AD). While that is nice, it is not enough. Granted, their DirectControl family of products covers a lot and is nice, what I miss is the ability to control which user can issue what commands on a Linux/Unix level. That is, DirectControl does not seem to link into the su/sudo/sudoers facilities of Linux. NIS is a common way to centralize Linux user management on a network and control access to servers, do password management and so on. However, I thought NIS was largely incompatible with more common, cross-platform directory solutions such as LDAP. Even MS AD can talk LDAP! ;) So I was more than happy to discover that PADL provides free toosl to help migrate from flat access files (passwd, NIS, etc.) ...