RHEL Winbind Authentication Against Active Directory

So you have a RHEL system and you want to authenticate it against your active directory. The good news is that Red Hat has made it easy for you to do this. The bad news is that they only get the most basic structure working for you. Here I will show you how to get WinBind authentication working using Authconfig, and how make it a little more seamless than this utility leaves it off.

It should be noted that while this works perfectly well, it is really not the best way to authenticate users against a UNIX host. Given the option, having your users in Open Ldap and PAM authenticating them against that would be a much better option. However, we don’t live in a perfect world, and sometimes we just have to make things work.

Let’s start by using authconfig to join your machine to the domain. This should all be done as the root user.

# authconfig

  • Select “Use Winbind” and Use “Winbind Authentication”. Remember to leave “Cache Information”, “Use MD5 Passwords” and “Use Shadow Passwords” selected.
  • Select “Next”
  • Under “Security Model” select “ads”
  • “Domains:” examplead (substatute with the name of your Active Directory)
  • “Domain Controllers:” adserver.domain.com (Again, substitute with the name of your Active Directory server)
  • “ADS Realm:” ADSERVER.DOMAIN.COM
  • “Template Shell:” /bin/bash
  • Select “Join Domain”
  • Select “OK”

Now your machine should be be on the domain. Test it to make sure you can see your AD users:

# wbinfo -u

You should see your users in the list.

The only problem is that to do anything with them, you have to express their user name in that annoying way Windows likes you to. Something like this:

“EXAMPLEAD\\username”

Not very usefull. To get around this, simply edit “/etc/samba/smb.conf” and change this line:

winbind use default domain = no

to this:

winbind use default domain = yes

You should now be able to express AD usernames without the domain nonsense before it. Try it:

# finger username
Login: username                            Name: Username
Directory: /home/EXAMPLEAD/username        Shell: /bin/bash
Never logged in.
No mail.
No Plan.

Finally check your “/etc/nsswhich.conf” file to make sure RHEL knows to use WinBind. Authconfig should have set this up for you, and it should have lines that look like this:

passwd:     files winbind
shadow:     files winbind
group:      files winbind

That should do it you should be able to create home directories for all your AD users and let them authenticate away. Have fun.

Revillagigedo Archipelago Dive Log – Day 6

On our sixth and final day of diving at the Socorro Islands, We headed back to San Benedicto to dive at “The Canyon” and, we had hoped, another stone pillar rising up from the sea floor called “The Boiler”. By this time in the trip, the weather had turned fairly bad for Mexico, and we were dealing with quite a bit of swell. As usual, we got up and had our pre-breakfast breakfast (they feed you well on the Nautilus) and started getting ready to dive. Since this was my last day of diving on the trip, I had made up my mind to do some deeper dives on my rebreather.

Keeping in mind that I did not have access to any TRIMIX I decided that I would not go much deeper than 155 feet, which is the point on rebreathers where you really should start using Helium in your mix. This is not only to buffer the narcosis, but because going deeper than 155 using air diluent at a 1.3 setpoint causes you to actually incur more decompression obligation than if you were simply breathing straight air.

The other thing to remember when doing deeper rebreather dives using air diluent is that the effects of narcosis can be much more troubling than when diving open circuit. When you are breathing off a tank, you feel a bit of narcosis in your head and you know exactly what it is and, assuming you have acclimated yourself to it slowly and over progressively deeper dives, how to deal with it. You can accept the narcosis and go on about your dive.

On a rebreather, however, you are breathing off a recirculating loop which is monitored by oxygen sensors. You constantly check the status of this loop and you depend on the sensors to give you accurate information, quite literally, with your life. Should you have too little or too much oxygen in your loop, your body will give you very little warning before you either fall asleep or go into convulsions. For this reason, you are not only constantly monitoring your loop, but also how you are feeling. In deep water, it becomes easy to ask yourself if the narcosis you think you are feeling might actually be lightheadedness from a C02 breakthrough or impending hypoxia.

Anyhow, to make a long story short, I really wished I had some helium, but I didn’t, so I was stuck going not much deeper then 155. On the first dive of the day, Rich and I went down the shotline, snaked around the outside of the canyon wall, and headed down the gentle-sloping topography. As we descended, there were a lot of little rock platforms that came up about 10 feet off the sea floor. We made our way from one of these to the next until we finally found ourselves at the top of one in exactly 150 feet. We hung out for a while, looking at several white-tip reef sharks, but finally decided to head back up into shallower water. We met up with our friends at about 80 feet where we all started making our way back to the line. The entire dive lasted 50 minuets and it was the deepest dive I had done on my Meg to date.

The second dive of the day was supposed to be at a site called “The Boiler“, a stone pillar jutting up from the seabed, and peaking just slightly below the surface of the water. It is an extremely exposed site, and it became clear on the boat ride out that there was no way we would be diving it. At one point the skiff broke loose from the Nautilus and the crew had to go rescue it. I’m also sad to report that a very nice camera took a digger because of the high seas, breaking the dome and bending the lens. Overall, it was a very bad boat ride!

Cutting our losses, we returned to the Canyon, which was in fairly protected waters and still very divable. The Nautilus anchored directly at the dive site, so we could splash right off the back and stay down for as long as we liked. The divemasters had also rigged a trapeze underneath the Nautilus at about 30 feet, allowing divers to pull themselves from the dive deck on the stern to the main anchor line on the bow. I made my way down the line, and as before I rounded the wall and headed down the bottom, making my way from platform to platform. On this dive, I decided to go alone and stay down a little longer than before. I stopped when I arrived at 160 feet, and stayed there for about 5 minuets. As before I saw some sharks, but little else, and finally decided to head back. I saw a few other divers on my way back, but not wanting to get into too much deco, I decided to leisurely make my way back to the anchor and complete my decompression.

All told, I stayed down for an hour and decompressed for 20 minuets, adding about 10 extra on pure oxygen just for safety. Many of the other divers decided to do one more dive before we pulled anchor and headed back to Cabo, but I was happy to stay dry. My last dive had been great fun, and I thought it a great way to say goodbye to the Revillagigedo Archipelago.

That evening, we began the long, 27 hour journey back. The next day we spent cleaning gear, settling tabs, sharing pictures and videos and generally chatting about a great trip. The ocean was quite rough, so I spent a great deal of the ride back with a twinge of seasickness, but nothing too bad. We finally arrived in Cabo San Lucas at about 10:30 PM. We all wanted to get off the boat pretty badly, so a bunch of us headed out to Cabo Wabo to see if we could find Sammy Hagar, or at least some burritos and tequila. Luckily we found both, but we headed Sten’s warnings and stayed away from the police and the people looking to make “new friends”. Cabo really is just a big old party.

We made our way back to the boat by midnight, and headed out to the airport the next day at 9:00AM and just like that the trip was over. It was wonderful diving and wonderful people. I highly recommend the Socorro Islands to anyone who loves diving, and loves large sea creatures!

Sexy Comments WordPress Plugin

I’m proud to be the first to test out Matt’s new Sexy Comments plugin. Since the comments on a few of my stories have taken on feel similar to that of a discussion group, I was glad to see Matt working on a layout that allowed the user to personalize their comment by adding an avatar. Last evening we discussed it and I convinced him to turn the jazzed-up comments layout into a WordPress plugin so that the whole world could benefit from it. Apparently the poor guy stayed up all night working on it, although I don’t feel bad for him since he kept me up until 10:30 with constant billiards challenges and I had to be at work by 5:00 AM! Not to mention I’m mad because he never told me he was such a pool shark.

It gets the picture from Gravatar, so if you have not uploaded an avatar to the service, do so, and your picture will show up next to your comments. Thanks Matty for the great plugin!

Giant Rabbits in North Korea

Back in in February 2006, an East German named Karl Szmolinsky won a prize for breeding Germany’s largest rabbit, a 23 pound “German Gray Giant” named “Robert”. It sounds like something from a science fiction film, but when you consider the fact that these creatures are the size of dogs and that they breed like, well — rabbits, you can easily begin to see how farming them could help to solve part of the world’s hunger problem.

North Korea has a population of 23 million, many of whom, according to the United Nations Food Program, are suffering from widespread food shortages and sustain themselves on a diet lacking critical proteins and fats. When the communist country heard about these huge rabbits, they wasted no time in asking Szmolinsky to help them set up a rabbit farm to help relieve the country’s hunger problems.

“I’ll be travelling to North Korea in April to advise them on how to set up a breeding farm. A delegation was here and I’ve already given them a book of tips”, Szmolinsky said back in January. Recently he sent them 12 of the huge bunnies, but when he went to arrange his visit, he was told that the Government had canceled his trip because it was unhappy with news coverage of the sale.

While North Korea denies it, Szmolinsky suspects that the animals have already been sold and eaten. It’s a shame that they most likely ended up on the tables of some rich people who fancied the novelty of it all rather than helping to provide nutrition to the poor and starving.