Nick Porter's tech notes

First thoughts on Ubuntu Raring

2013-04-19T15:34:00.000+01:00

Being one who always like a new Ubuntu version to play with, I decided to upgrade slightly before the official release next Thursday.

So far, on the whole pretty good. Not startling changes, just incremental improvements. However, there were two "gotchas".

Firstly skype. There seems to be some clash between skype and proprietary nVidia drivers. The solution is easily applied as suggested here

The second one is CUPS. As of CUPS 1.6 the old CUPS browsing protocol that makes printers visible to other CUPS machines has been deprecated - which is a real shame for those of use used to just turning up and seeing all the relevant local printers from the CUPS server in the building.

After much searching, I finally found that the nice people at Ubuntu had determined not to let this change upset their users, and that the simple solution was to edit /etc/cupsd/cups-browsed.conf and add "CUPS" to the BrowseRemoteProtocols line and then restart the cups-browsed service. My list of printers is now back :)

Ford IDS software fault

2011-11-30T17:07:00.002+00:00

So today's fun was fighting the Ford IDS software. Our fleet garage has happily been installing many versions of this as new ones come out - until version 75 comes out. Then during the installation, where it is "updating the database" it comes up with an error UT0000 - very profound!

The solution turned out to be:

Install the new calibration data
Disable antivirus (not totally sure if this was needed, but some suggested it may be)
Do a repair install of IDS

and then it decided to go all the way through the install.

Fighting domain logins in a Samba domain

2011-09-07T16:07:00.002+01:00

A while ago, one of the servers I look after developed a strange fault with Samba domain logins.

Machines that were already part of the domain were fine, but new machines were not happy. You could join them to the domain as normal, but when you then tried to log in as a domain user, you got the error message "the system cannot log you on now because the domain is not available".

Much internet searching and scratching of the head didn't resolve it - so we went into "limp along" mode with some machines not being put in the domain. Even an upgrade to Samba didn't solve it.

A few weeks ago the same thing happened to another system I look after - so back to Google again. Whilst no-one seemed to be talking about exactly the same issue, I did get some ideas and bingo - found the answer.

Our Samba configs are quite old and back when we started using Samba, WINS was a good thing to help windows machines along so we had "wins support = yes" and our dhcp server was giving out the wins server details. It would appear that somehow WINS was the cuplrit. So I've turned "wins support" to "no" and removed the details from the dhcp server and now it all works as before.

Remote software installation on Windows workstations

2010-10-22T15:49:00.002+01:00

There are various articles out there about how such things may be done, but here are my collective thoughts on the matter.

Given a collection of machines that are members of an NT domain, and access to a domain user account that has administrative privileges on the workstations (such as a member of Domain Administrators).

Then you need to get hold of the PsTools suite from sysinternals. Just install this on the machine you will be running the installations from.

On the file server, I have a folder called swupdates which contains all the installers. In particular I have Firefox, Thunderbird, Adobe Reader, Flash Player, OpenOffice, Java JRE and RealVNC.

Firefox and Thunderbird need extracting from their original installers using 7-Zip. OpenOffice also needs extracting and this can be done by starting the installer and letting it run through the the extraction of files and then cancel the installation. I make sure that the folder names involved don't include spaces for the sake of simplicity in the scripts.

The installer for Flash Player can be downloaded from http://fpdownload.adobe.com/get/flashplayer/current/install_flash_player.exe to avoid the Adobe Download Manager.

For Thunderbird, I take advantage of this to put the custom Thunderbird customisation that I previously discussed on to the clients.

With OpenOffice I take the opportunity to install an extension that disables the first run wizard.

Configuring RealVNC is done by setting up one machine and then exporting the HLML\Software\RealVNC key to a .reg file which is then imported after the software is installed on the target machine.

Then we require a script to actually do the installations - for the current software collection at the time of writing this is as follows:

swupdate.cmd:

@echo off
echo "checking for installers directory on the target..."
if not exist \\%1\C$\installers mkdir \\%1\C$\installers
if not exist \\%1\C$\installers\Firefox3.6.11 mkdir \\%1\C$\installers\Firefox3.6.11
if not exist \\%1\C$\installers\Thunderbird3.1.5 mkdir \\%1\C$\installers\Thunderbird3.1.5
if not exist \\%1\C$\installers\OOo mkdir \\%1\c$\installers\OOo
echo "copying installers..."
copy \\server\software\swupdates\AdbeRdr940_en_US.exe \\%1\C$\installers\
copy \\server\software\swupdates\install_flash_player.exe \\%1\C$\installers\
xcopy "\\server\software\swupdates\Firefox3.6.11\*" "\\%1\C$\installers\Firefox3.6.11\" /e /y
xcopy "\\server\software\swupdates\Thunderbird3.1.5\*" "\\%1\C$\installers\Thunderbird3.1.5\" /e /y
xcopy "\\server\software\swupdates\OOo\*" "\\%1\C$\installers\OOo\" /e/y
copy \\server\software\swupdates\jre-6u22-windows-i586-s.exe \\%1\C$\installers\
copy \\server\software\swupdates\vnc-4_1_3-x86_win32.exe \\%1\C$\installers\
copy \\server\software\swupdates\realvnc.reg \\%1\C$\installers\
echo "Installing Firefox..."
psexec.exe \\%1 "C:\installers\Firefox3.6.11\setup.exe" -ms
psexec.exe \\%1 "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultappGlobal
echo "Installing Thunderbird..."
psexec.exe \\%1 "C:\installers\Thunderbird3.1.5\setup.exe" -ms
copy \\exodus\software\swupdates\custom.cfg "\\%1\C$\Program Files\Mozilla Thunderbird\"
copy \\exodus\software\swupdates\custom.js "\\%1\C$\Program Files\Mozilla Thunderbird\defaults\pref\"
echo "Installing Adobe Reader...."
psexec.exe \\%1 "C:\installers\AdbeRdr940_en_US.exe" /sAll /rs
del "\\%1\C$\Documents and Settings\All Users\desktop\Adobe*.lnk"
echo "Installing Flash Player..."
psexec.exe \\%1 "C:\installers\install_flash_player.exe" -install
echo "Installing OpenOffice..."
psexec.exe \\%1 msiexec /qn /norestart /i C:\installers\OOo\openofficeorg32.msi ADDLOCAL=ALL REMOVE=gm_o_Onlineupdate
copy \\exodus\software\swupdates\DisableFirstStartWzd_ooo321.oxt "\\%1\C$\Program Files\OpenOffice.org 3\program"
psexec.exe \\%1 "C:\Program Files\OpenOffice.org 3\program\unopkg" add --shared "C:\Program Files\OpenOffice.org 3\program\DisableFirstStartWzd_ooo321.oxt"
echo "Installing Java VM"
psexec.exe \\%1 "C:\installers\jre-6u22-windows-i586-s.exe" /s /v/qn
echo "Installing RealVNC"
psexec.exe \\%1 "C:\installers\vnc-4_1_3-x86_win32.exe" /SP- /VERYSILENT /NORESTART
psexec.exe \\%1 regedit /s c:\installers\realvnc.reg
echo "All done"

Then from a second script you call this first one with the name of each machine:

updatemachine.cmd:

@echo off
call swupdate.cmd machine1
call swupdate.cmd machine2
call swupdate.cmd machine3

Providing each machine has firewall settings set so that File and Print access is allowed in, then this will suitably run the installations on each of the machines.

There are obviously many other variations that could be achieved with this - the key thing is to find the method to silent install each piece of software that you're interested in. A lot of useful info can be found on the AppDeploy site.

Using Ubuntu 10.04 ltsp workstations as character terminals

2010-08-09T10:15:00.003+01:00

I've finally got round to updating our LTSP setup to use Lucid. We have a number of LTSP terminals that work just at the character terminal level, with the screens doing a telnet into another system and with no X Window running on them at all.

Lucid's switch to the Plymouth startup system has an interesting side effect with this - namely that with the default setup, you are left just looking at the Plymouth screen and are not able to access any of the VTs to do anything else.

The solution is a custom entry in the pxelinux.cfg directory relevant to the Lucid boot set (in my case /srv/tftp/ltsp/lucidi386/pxelinux.cfg - note the change from previous versions where /var/lib/tftpboot has been replaced by /srv/tftp)

I've rearranged the IP addresses of my text only workstations so that they are all in a block of 16 IP addresses which will look for the same config file using the hex address notation that PXE uses. Then in that file I put

default ltsp-text

label ltsp-text
kernel vmlinuz
append ro initrd=initrd.img quiet splash nbdport=2004 vga=normal nomodeset

This has the added advantage that the console stays at 80x30 characters which is very usable for the application that we are using.

Using https with wget

2010-07-26T10:49:00.002+01:00

The version of wget installed on a debian box seems to not like doing https by default due to not knowing about the CA certificates.

Here's a solution I found:

Download cacert.pem from http://curl.haxx.se/docs/caextract.html and put it in /etc/ssl/certs

Then amend /etc/wgetrc to add the line

ca_certificate=/etc/ssl/certs/cacert.pem

Then wget knows about the CA certificates and all is well for https

Thunderbird 3 in a business setup

2010-05-24T09:34:00.006+01:00

For a number of years we've used Thunderbird as the mail client of choice. It has a good feature set and does IMAP well. However, the advent of Thunderbird 3 adds a little issue.

To reduce the size of roaming profiles (and therefore speed up login and log out) we have thunderbird profiles mapped to a directory within the users' login directory - and hence stored on the server. Thunderbird 3, automatically downloads copies of all the users' IMAP email to make both an offline cache and to index the mail for the new search facility.

This would mean that the server space used by the Thunderbird profile would grow considerably.

So there's two choices. Either disable the global indexing and off line store or put the off line store somewhere else.

As the new search is a good tool, I've opted for the second - though I'll leave it up to the users as to whether they use the search tool or not.

The solution here is to add a couple of files to each machine running Thunderbird:

Firstly in the defaults/pref/ folder (/usr/lib/thunderbird-3.0.4/defaults/pref on linux , C:\Program Files\Thunderbird\defaults\pref on windows) I add a little file custom.js

/* Custom local config */

pref("general.config.obscure_value", 0);
pref("general.config.filename", "custom.cfg");

The first of those settings means that you can write your config file in plain ASCII rather than a strange encoding and the second is the name of the custom config.

Next, the custom config goes in /usr/lib/thunderbird-3.0.4 for linux or C:\Program Files\Thunderbird for windows

//
/* This will disable indexation by default - can be enabled per user */
defaultPref("mailnews.database.global.indexer.enabled", false);

/* This will disable offline download by default */
defaultPref("mail.server.default.offline_download", false);

/* This will parse the prefs.js and set the directory for "offline_download" for each IMAP account */

if(getenv("USER") != "") {
 // *NIX settings
 var env_user    = getenv("USER");
 var env_home    = getenv("HOME");
 var env_os = "linux";
} else {
 // Windows settings
 var env_user    = getenv("USERNAME");
 var env_home    = getenv("HOMEPATH");
 var env_os = "windows"
}

if (getPref("mail.accountmanager.accounts")) {

  var listExistingAccounts = getPref("mail.accountmanager.accounts");
  var arrayExistingAccounts = listExistingAccounts.split(',');

  for (var i=0; i < arrayExistingAccounts.length; i++){
    var serverFromAccount = getPref("mail.account." + arrayExistingAccounts[i] + ".server");
    var configType = getPref("mail.server." + serverFromAccount + ".type");
    if (configType == "imap") {
      defaultPref("mail.server." + serverFromAccount + ".offline_download", false);
      lockPref("mail.server." + serverFromAccount + ".server_sub_directory", "INBOX.");
      var serverName = getPref("mail.server." + serverFromAccount + ".hostname");
      var userName = getPref("mail.server." + serverFromAccount + ".userName");
      if (env_os == "windows") {
        lockPref("mail.server." + serverFromAccount + ".directory", "[LocalAppData]Thunderbird/" + serverName + "/" + userName);
        lockPref("mail.server." + serverFromAccount + ".directory-rel", "[LocalAppData]Thunderbird/" + serverName + "/" + userName);
      }
      if (env_os == "linux") {
        lockPref("mail.server." + serverFromAccount + ".directory", "/opt/mailcache/" + env_user + "/" + serverName + "/" + userName);
        lockPref("mail.server." + serverFromAccount + ".directory-rel", "/opt/mailcache/" + env_user + "/" + serverName + "/" + userName);
      }
    }
  }
}

I also take advantage of this to set the server directory for the IMAP folders to INBOX. as that gives the better layout of mailboxes in Thunderbird when talking to a Courier IMAP server.

On a Windows machine, I set the users' offline cache to being in the Local Settings part of their profile - this keeps it safe to the user but avoids it being synced to the server.

For a Linux machine, I set up an area called /opt/mailcache with the same kind of permissions as /tmp i.e. globally writable but with the sticky bit set. This has the result that individual users can't get at each others mail cache.

In our LTSP setup, /opt/mailcache will be excluded from the backup as there is no need to back this stuff up as it is simply a copy of what is already in the mailbox.

Windows 7 on a Samba domain

2010-04-06T19:17:00.002+01:00

After years of happily running Samba domains controlling Windows XP machines, I've had to investigate how Windows 7 integrates into that environment.

I usually use Debian as the server platform of choice. This has the benefit of a stable software platform at the detriment of not always being up to date. And in this instance that is a problem. Some of the bits that are required in Samba to support 7 in a domain environment don't appear until later versions of Samba than the one currently shipped with Debian "lenny" - the current stable release.

Fortunately the very nice people at SerNet provide Debian packages for the latest Samba release (http://enterprisesamba.com/index.php?id=148) - so by simply adding the relevant repository and installing sernet-samba in place of the normal samba, we can get these extra features.

There are still a couple of registry hacks needed to make 7 work:

HKLM\System\CCS\Services\LanmanWorkstation\Parameters
DWORD DomainCompatibilityMode = 1
DWORD DNSNameResolutionRequired = 0

And then it will join the domain. There is a warning that pops up about dns issues, but that is fine to ignore and it will work.

Now, the next fun part is that due to the drastic changes in profile data between XP and 7, the two won't share a profile - so you end up with two for each user if you are in a mixed environment. This is not a problem as such, but you will want to consider some folder redirection, particularly of My Documents to a location that both can see, otherwise you'll have a different copy of documents for each operating systems.

If you set that to be a network location - which would be the most sensible - then on desktop PCs you'll probably also want to disable offline files. While they're great for laptop users, there is no point in syncing each users files to the desktop in an environment where the machines never leave the network, plus the system tends to get rather confused as it keeps trying to connect to sync other users files without the appropriate permissions to do so.

Ubuntu machine with NFS home and LDAP authentication

2010-02-10T18:26:00.002+00:00

A while ago I posted about joining Ubuntu machines to an NFS / NIS setup. Well, things have moved on since then; both later Ubuntu distros and our authentication is now LDAP. So, here's the up to date procedure. This does assume some knowledge of linux commands and familiarity with editing config files.

As before, the first issue is that of moving /home. And that hasn't changed. When setting up the machine create a user who is local to the machine - pick a name that won't clash with any user in the LDAP - and then after the initial setup, boot in single user mode and move /home to /localhome. Then edit /etc/passwd to change references to /home into /localhome.

To allow NFS shares to be mounted install the nfs-common package. Then you can edit /etc/fstab to include the mounting of any NFS shares (after having made the mount point)

e.g.

bigserver:/home /home nfs defaults 0 0

Then to get the authentication going you want to install libnss-ldap and libpam-ldap. The installation of these packages will ask for the details of your LDAP setup such as the base dn and the admin cn and password.

Give it a re-boot and you should be off and running.

One caveat - due to the timing of things launching - you may see warnings about certain partitions not being mounted. This can be caused by delays in getting a network address.

A quick fix for this is to add "mount -a" to the /etc/rc.local file to force a re-try at any mounts that fail at the end of the boot process.

If you want to allow any of your users to have special powers on the desktop then /etc/security/group.conf is your friend. This grants extra group membership to logged in users depending on where they come from and what time / day it is.

You will probably want a line like:
gdm;*;*;Al0000-2400;cdrom, floppy, audio, video, plugdev

to allow all users at the desktop access to relevant hardware

But you may also want
gdm;*;importantuser;Al0000-2400;lpadmin, admin

To allow importantuser to do administrative things. You'll then need to add
auth optional pam_group.so
to /etc/pam.d/common-auth to make this active.

Creating user based firewalls on inbound pptp connections

2009-11-20T16:54:00.002+00:00

There are certain security situations where you want to be able to allow a remote user to connect to your network using pptp, but you want to lock down what devices on the network they have access to.

Usually with the linux pptp system, once the user is connected, assuming ip forwarding is running on the host that is the pptp end point, they have access to anything on the local subnet.

What I've done to allow some control over this situation is create some custom scripts to go in /etc/ppp/ip-up.d and /etc/ppp/ip-down.d

For the "up" version I have:

#!/bin/sh

PPP_USER=`/usr/bin/w | /bin/grep "$PPP_IFACE" | sed "s/ .*//"`

if [ -x "/etc/ppp/userfw/$PPP_USER" ]; then
 "/etc/ppp/userfw/$PPP_USER"
fi

exit 0

and for the down version I have

#!/bin/sh

PPP_RULE=`/sbin/iptables -L FORWARD -n -v --line-numbers | /bin/grep "$PPP_IFACE" | /usr/bin/head -1 | /bin/sed "s/ .*//"`
while [ "$PPP_RULE" != "" ]
do
       /sbin/iptables -D FORWARD "$PPP_RULE"
       PPP_RULE=`/sbin/iptables -L FORWARD -n -v --line-numbers | /bin/grep "$PPP_IFACE" | /usr/bin/head -1 | /bin/sed "s/ .*//"`
done

PPP_RULE=`/sbin/iptables -L INPUT -n -v --line-numbers | /bin/grep "$PPP_IFACE" | /usr/bin/head -1 | /bin/sed "s/ .*//"`
while [ "$PPP_RULE" != "" ]
do
       /sbin/iptables -D INPUT "$PPP_RULE"
       PPP_RULE=`/sbin/iptables -L INPUT -n -v --line-numbers | /bin/grep "$PPP_IFACE" | /usr/bin/head -1 | /bin/sed "s/ .*//"`
done

exit 0

Then create a directory /etc/ppp/userfw and put in there per user scripts

e.g.

#!/bin/sh
/sbin/iptables -A FORWARD -i "$PPP_IFACE" -j ACCEPT
/sbin/iptables -A INPUT -i "$PPP_IFACE" -j ACCEPT

(yes - that's a silly example as it just gives complete access - which they had anyway)

With this lot, you have a simple method to lock certain users down to only be able to access certain things on your network - within the flexibility of the iptables system. The important thing to do is to make sure that your user based rules all reference the interface with $PPP_IFACE so that they are attached to the right connection and they're deleted again with the down script when the interface is removed.

Bluetooth pairing on the command line

2009-11-02T12:01:00.003+00:00

I use a debian linux box with the Gnokii SMS daemon to do computer based texting. Now normally on a server I wouldn't want to go to the bother of installing Gnome - after all, you don't sit at the server console. But, that can be an issue for doing the bluetooth pairing needed before you can use the phone with gnokii.

The answer is in /usr/share/doc/bluez-utils/examples. There's some C code in there called passkey-agent.c

Make sure you have build-essential and pkg-config and libdbus-1-dev installed then you can build it.

Then, in one terminal window run "passkey-agent 1234" and in another do "rfcomm connect rfcomm1 xx:xx:xx:xx:xx:xx" to connect to your device. The pairing will then be on the key 1234.

A useful trick to avoid installing a huge amount of stuff just to do a one off job.

Update:
Debian squeeze ships with a command "bluetooth-agent" which replaces the passkey-agent and is already complied, so you just need to do "bluetooth-agent 1234" in one terminal to set up the passkey.

Printing from SCO OpenServer to CUPS on Debian

2009-08-11T20:03:00.004+01:00

Ah the joys of the hideous SCO OpenServer!

So here's the plan - print jobs from a SCO OpenServer machine printing via CUPS queues so that everything's in one place. Jobs are sent by lpd from one machine to the other with the cups lpd daemon receiving the jobs and putting them in the queues for formatting as appropriate.

Now SCO's printing system is trying to be clever and do all sorts of driver things and that somehow is getting passed through as the banner page option or something like that. Either way the error:

Unable to create job - Bad job-sheets value "standard"!

Was coming up in /var/log/syslog on the debian box.

The solution - get the SCO box to include "-o nobanner" in its lp command e.g.

lp -o nobanner -p printer file

Then it all passes through properly.

Extracting addresses from a Maildir folder

2009-07-15T08:58:00.002+01:00

From time to time, one of our users wants to send an email to all the people who's addresses are in one of her mailboxes. Our IMAP setup uses Maildir folders as the back end, which have the very nice feature of each mail being a separate file.

With a little appropriate use of some linux command line tools, the following will give a list of the senders addresses that are found in the given Maildir folder:

grep Return-path ~username/Maildir/.mailboxname/cur/* | sed -e 's/^.*<//' | sed -e 's/>//' | sort -u > ~/email.addr

replace username with the user in question and mailboxname with the appropriate mailbox and you will have a list of addresses in email.addr

Kyocera FS2020 network printing

2009-06-30T01:50:00.002+01:00

This is tentative post - as we're not sure this is solved yet.

A new Kyocera FS2020 was having trouble printing over the network. This appears to have been solved by setting up the host name on the printer's network interface to match the name set on the DNS.

Setting mailman user passwords

2009-06-30T01:38:00.002+01:00

Been doing so stuff using a bunch of email addresses that are handled by scripts to customise various mailman behaviour - in particular a script that does a subscribe via email command, then reads the result and then mails the user to determine if they are already on the list or not.

However, to do this we needed to set all the users up with a pre-determined password, but the initial listing of mailing list recipients was done using the mass subscription which generates random passwords.

Some hunting on the internet didn't yield anything for resetting them - they could be seen using

/var/lib/mailman/bin/dumpdb /var/lib/mailman/lists//config.pck | less

but nothing poped out about changing them - then I looked in the bin directory and found reset_pw.py.

This is intented to be used to reset the passwords to new random ones - but a little edit to the script and you can use it to set the password to whatever you want running it with:

withlist -l -r reset_pw -v

Connecting to the Internet from Ubuntu using bluetooth to a Nokia E65

2009-06-09T18:31:00.003+01:00

Having just set this up for about the 4th time, I thought it was about time to record what I actually do - rather than working it out each time!

First off, I get the phone and laptop paired - easy enough using the bluetooth icon on the gnome panel.

Then, edit /etc/bluetooth/rfcomm.conf to look like:

#
# RFCOMM configuration file.
#

rfcomm0 {
# # Automatically bind the device at startup
bind yes;
#
# # Bluetooth address of the device
device 00:AA:BB:CC:DD:EE;
#
# # RFCOMM channel for the connection
channel 2;
#
# # Description of the connection
comment "Nokia E65";

}

using the appropriate device MAC. If you don't know this then
hcitool scan

will reveal devices that are visible in your locality and then
sdptool browse

will let you find the channel number for Dialup Networking.

Restart bluetooth after this change.

Next create /etc/ppp/peers/orange

noauth
#change this if you move the path to your connect script
connect "/usr/sbin/chat -v -f /etc/chatscripts/orange-connect"
#change this if you move the path to your disconnect script
disconnect "/usr/sbin/chat -v -f /etc/chatscripts/orange-disconnect"
#I found that I needed this to remove problems with loopback on connecting
silent
#remove this if you don't want lots of information going to /var/log/messages
debug
#this is the device specified in your rfcomm.conf file
/dev/rfcomm0
#speed at which to connect - might be worth trying higher...
115200
#this is needed so that a default route is added to your routing table
defaultroute
#this is needed so that you pick up Orange's DNS settings
usepeerdns

lcp-echo-failure 0
lcp-echo-interval 0
nomagic
noccp

And /etc/chatscripts/orange-connect:

TIMEOUT 5
ECHO ON
ABORT '\nBUSY\r'
ABORT '\nERROR\r'
ABORT '\nNO ANSWER\r'
ABORT '\nNO CARRIER\r'
ABORT '\nNO DIALTONE\r'
ABORT '\nRINGING\r\n\r\nRINGING\r'
'' \rAT
TIMEOUT 12

OK ATE1
#here's the magic bit!
OK 'AT+CGDCONT=1,"IP","orangeinternet"'
OK ATD*99***1#
TIMEOUT 30
CONNECT ""

And /etc/chatscripts/orange-disconnect

ABORT "BUSY"
ABORT "ERROR"
ABORT "NO DIALTONE"
SAY "\nSending break to the modem\n"
"" "\K"
"" "\K"
"" "\K"
"" "+++ATH"
"" "+++ATH"
"" "+++ATH"
SAY "\nPDP context detached\n"

With all this in place, sudo pon orange should make the connection and sudo poff orange should break it.

Scanning documents using SANE and an ADF on a Fujitus M4097Ddm

2009-06-08T11:17:00.002+01:00

Working on a document scanning project to sort out some paperless office systems, I came across an interesting problem while using the ADF on our Fujitsu M4097Ddm scanner.

The command scanimage -y 297 --source="ADF Front" resulted in a message back from sane of

scanimage: rounded value of br-y from 297 to 279.364

I.e. the page was getting truncated to US Letter length - not very helpful.

The solution is to change the order of the parameters and add an extra one:

scanimage --source="ADF Front" --pageheight=297 -y 297

Once the document source is specified then the list of available options changes and the pageheight and pagewidth options become available.

Permissions on USB devices on LTSP terminals

2009-05-06T08:35:00.002+01:00

In our linux environment, all our users have the same primary group, rather than having a private group. For the vast majority of stuff this is fine and keeps things simpler. However the method that ltsp uses for mounting USB sticks (or other local media) creates a directory called /media/ on the server which is has the group set to the primary group of the user and the owner set to root with permissions of rwxr_x___

This, combined with the users all being in the same primary group leads to the devices that users plug in being shown on all users' desktops. They can't actually access the devices - those have different permissions - but they can see their existence which at the least is annoying and in the case of several people using CD drives, confusing.

My current solution is a little convoluted - but does the trick.

Firstly you need a program that can change ownership of a directory. This has to be installed as a suid program as the mounting script is run by the user who is logged into the terminal.

I just have a little piece of C to do the job:

#include
#include
#include

int main(int argc, char *argv[]) {

char buff[100];

if (argc != 2)
exit(1);

sprintf(buff, "/bin/chown %s:root /media/%s", argv[1], argv[1]);
system(buff);

return(0);
}

I call this program mediafix and have installed it in /usr/local/bin

Then, in /usr/sbin/ltspfsmounter, add a line saying

call(['mediafix'], username)

towards the end of the main function after the mounting has taken place.

This ensures that any time a device is mounted, the containing directory has it's ownership amended and keeps the icons hidden from other users.

Debian Lenny on a Poweredge 2600

2009-05-06T08:04:00.002+01:00

Usually the Debian upgrade procedure is pretty straight forward, and my recent upgrade of a Poweredge 2600 from etch to lenny was no exception. Just change the sources and do an apt-get update; aptitude dist-upgrade and answer some questions along the way.

Occasionally there's a gotcha - and this one had an issue with our lvm based file system. Using the new kernel that comes with lenny (2.6.26), it failed to find the lvm and therefore wouldn't boot.

A little googling revealed a potential solution - add the option "rootdelay=9" to the kernel options for boot - and surely enough the machine was back to life.

Flashing the firmware on a 3c905c network card

2008-12-10T11:12:00.002+00:00

There's two revisions of the 3C905C out there. The earlier one has an issue when using boot code on the card in that you can't make use of the "next server" option in your dhcp config - it simply fails to boot from the correct server reporting a timeout during the TFTP.

The later version works fine - so here's the trick - take the firmware from a later one and flash it to the earlier.

Using a debian box this is relatively simple.

Install the etherboot package to get the tools needed.

Then in /usr/share/doc/etherboot/contrib/3c90xutil/ gunzup cromutil.c.gz and bromutil.c.gz

Make sure you have built-essential on your system and then use make to compile the tools

Now, with the good card in the system, do

lspci -v | less

and look for the ethernet controller. Make a note of it's I/O port address (ours was a000

Then to get the rom image type

./cromutil [ioport] read > [imagename]

e.g.

./cromutil a000 read > working.rom

Now shut down the machine and replace the good card with the one that needs programming

Once you've booted back up, go to /usr/share/doc/etherboot/3x90xutil/

Use lspci -v again to check the address of this card

Then do

./cromutil [ioport] erase
./cromutil [ioport] prog < [imagename]

You should now have a card programmed with the later firmware and capable of correct remote booting where the boot host is other than the dhcp host.

Using LDAP for email aliases

2008-11-26T14:29:00.003+00:00

As I gradually migrate various servers to using LDAP as the auth back end, it occured to me that there was some duplication going on in terms of adding the users' email addresses to the LDAP so that they could be looked up on clients and then having an aliases file that was being used by exim to do the delivery.

So I've come up with the following for allowing exim to take advantage of the email addresses stored in the LDAP database:

### router/450_local_ldap_aliases
#################################

# This router handles aliasing looking up email addresses in an ldap database.
#

ldap_aliases:
debug_print = "R: ldap_aliases for $local_part@$domain"
driver = redirect
domains = +local_domains
allow_fail
allow_defer
data = ${lookup ldap {ldap://127.0.0.1/ou=Users,dc=...?uid?sub?(mail=$local_part@$domain)}}

Ubuntu on a Dell XPS M1530

2008-11-06T09:27:00.002+00:00

With the release of Ubuntu 8.10 (Intrepid Ibex) the vast majority of stuff on a Dell XPS M1530 works out of the box. One caveat is the touchpad. It jumps around like a demented rabbit!

The solution is simple.

Edit /boot/grub/menu.lst

Find the line that starts
# kopt=root=UUID....

Add i8042.nomux=1 to the end of that line

Then run update-grub and reboot.

Office 97 as a normal user

2008-10-31T10:54:00.003+00:00

Usually when you put a Windows XP machine on a user's desktop you want to have them logging in as a standard user rather than a power user. However various bits of software have issues with that due to poor design of the way they handle the registry. They try to write to keys or create keys in areas that they don't have permission.

One such delight is Office 97. There are two specific problems. Firstly, spelling and grammar checking is disabled. This has to be fixed with a registry permissions edit.

HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Proofing Tools\Spelling

HKEY_LOCAL_MACHINE\Software\Microsoft\Shared Tools\Proofing Tools\Grammar

both need to have Set Value and Create Subkey enabled for the group Users

The other issue is VBA macros. There are two solutions here. One is another set of permissions changes - but these open up quite a lot in the registry. Much better is this solution.

As administrator run a macro - doesn't matter what - just something to get the macro system used.

Then in

C:\Documents and Settings\Administrator\Local Settings\Temp\VBE\

you will find MSForms.EXD

Copy that to somewhere accessible. Then for each user who needs to run VBA macros, copy this file into their Local Settings\Temp\VBE folder.

LTSP 5 local devices fun

2008-06-11T13:19:00.003+01:00

Been working on using LTSP 5 on a Kubuntu machine to replace our current LTSP 4 set up on debian. Part of this has been about getting local devices operational which, on the whole, works "out of the box" with the (k)ubuntu ltsp packages. The local devices appear under /media/ - which you could create a symlink to on the desktop for the users to easily access their devices.

However, I plugged in one of my USB memory sticks and nothing happened. So I went through the debugging routine:
Check that the device is partitioned (/dev/sdb1 rather than just /dev/sdb when plugged into my linux laptop)
Check that the ltsp workstation is seeing the device by logging into the local shell as root and using dmesg after plugging it in
Check the udev stuff is happening (look for an entry in /var/run/ltspfs_fstab)

That was where it was failing - no entry.

So I dug around in the udev rules and looked at the script that adds the entry to the fstab. Here was the source of the problem. This script uses the label on the volume to create the mount point and the volume label on my usb stick had a space in it - that was enough to prevent it from running the script properly.

So - if you want your removable media to work on a (k)ubuntu LTSP set up then make sure that any volume labels are without spaces.

Exim SMTP AUTH from LDAP

2008-05-30T16:15:00.006+01:00

This turned out to be very simple indeed.

Here's a suitable config for LOGIN and PLAIN type auth:


ldap_login:
 driver = plaintext
 public_name = LOGIN
 server_prompts = Username:: : Password::
 server_condition = ${if ldapauth {user="uid=${quote_ldap:$1},ou=Users,dc=....." pass="$2" ldap://localhost/}{yes}{no}}
 server_set_id = $1
 server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}

ldap_plain:
 driver = plaintext
 public_name = PLAIN
 server_prompts = :
 server_condition = ${if ldapauth {user="uid=${quote_ldap:$2},ou=Users,dc=...." pass="$3" ldap://localhost/}{yes}{no}}
 server_set_id = $2
 server_advertise_condition = ${if eq{$tls_cipher}{}{}{*}}

The bit which wasn't explained very well (or at least not obvious to me) was what ldapauth did. There were various examples around which were pulling passwords out of a directory, having logged in with a suitable dn, but what this simple solution does is attempt to log into the LDAP directory using the credentials that "user" and "pass" are set to and since the LDAP directory contains the user authentication data as used by other systems (such as PAM or the unix NSS) it is authenticating against exactly the same thing.

This method won't work with the cram_md5 authentication driver as that requires a password to be pulled from somewhere and given to exim to work with.