Stacknerd's questions

I have an OpenLDAP server setup. I currently have two users added to my server. As far as my testing goes, a single user instance work just perfectly. My first issue arise when i have two users on the LDAP repository.

Directly after adding my 2nd user, i have attempted to login to my linux machine, and it's always asking me to change password when it's the first login (which is perfect).

Although, when i log-in with my first temporary password, you can see in the output below that User2 is attempting to log in, but then when it's asking to change the password, it's attempting to change it for User1.

login as: user2
Authenticating with public key "user2-rsa-key"
Further authentication required
[email protected]'s password:
You are required to change your password immediately (root enforced)
You are required to change your LDAP password immediately.
Last login: 'Date' From 'Hostname'
WARNING: Your password has expired.
You must change your password now and login again!
Changing password for user user1.    <----- This is where it messes up !
Enter login(LDAP) password:

I beleive this is an issue with my ACL, so i will let you guys see what my current acls are on the olcDatabase={2}bdb.ldif

olcAccess: {0}to attrs=userPassword by self write by dn.base="cn=admin,dc=domain,dc=com" write by anonymous auth by * none
olcAccess: {1}to * by dn.base="cn=admin,dc=domain,dc=com" write by self write by * read

Now assuming it's not an issue with my ACL's, I am wondering if it's simply how I add users to my LDAP server. I normally add users using this command :

ldapadd -x -W -D "cn=admin,dc=domain,dc=com" -f user.ldif 

Finally, here is the output on what there currently is on my server

[root@localhost ~]# ldapsearch -x -W -D "cn=admin,dc=domain,dc=com" -b "dc=domain,dc=com" "(objectclass=*)"
Enter LDAP Password:
# extended LDIF
#
# LDAPv3
# base <dc=domain,dc=com> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# domain.com
dn: dc=domain,dc=com
objectClass: dcObject
objectClass: organization
o: domain.com
dc: domain
# users, domain.com
dn: ou=users,dc=domain,dc=com
objectClass: organizationalUnit
objectClass: top
ou: users
# groups, domain.com
dn: ou=groups,dc=domain,dc=com
objectClass: organizationalUnit
objectClass: top
ou: groups
# user1, users, domain.com
dn: uid=user1,ou=users,dc=domain,dc=com
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
objectClass: ldapPublicKey
cn: user1
uid: user1
uidNumber: 16859
gidNumber: 100
homeDirectory: /home/user1
loginShell: /bin/bash
gecos: user1
shadowMax: 0
shadowWarning: 0
sshPublicKey: some rsa keys
userPassword:: crypted password
shadowLastChange: 16991

# user2, users, domain.com
dn: uid=user2,ou=users,dc=domain,dc=com
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
objectClass: ldapPublicKey
cn: user2
uid: user2
uidNumber: 16859
gidNumber: 100
homeDirectory: /home/user2
loginShell: /bin/bash
gecos: user2
shadowLastChange: 0
shadowMax: 0
shadowWarning: 0
sshPublicKey: some rsa keys
userPassword:: crypted password
# search result
search: 2
result: 0 Success
# numResponses: 6
# numEntries: 5

I have fully configured a LDAP server which works perfectly for authenticating users across my multiple nodes.

I wanted to add an extra layer of security with the usual two factor public private key.

I followed this guide : https://github.com/jirutka/ssh-ldap-pubkey

I added the schema, i can see that my users contains a public key as their parameters.

I am able to run the script and it returns me the users public keys.

The problem is that whenever i attempt an ssh connections to my machine, it just never ask for a private key. I was wondering if there is something i am missing ?

As the guide says, i have added to my sshd.conf :

AuthorizedKeysCommand /usr/bin/ssh-ldap-pubkey-wrapper
AuthorizedKeysCommandUser nobody

Rebooted, restarted but still my server never prompts for a private key. I am still able to log-in with just a user/password while it should deny me because i dind't provide a private key.

I am running on a test centos 6 machine, anybody knows if i am missing something in my PAM file ?

After receiving an Abuse Notice from my server provider, i was wondering how they make to check up all my traffic and send me these abuses. I would possible like to know if there is some kind of software that i can download so that i can stop my clients from doing malicious activities.. or atleast notice me before my provider treathens me.

I have seen some things like Snort, NodeWatch and VPSmon, but none of them 'Control' VPS machines from port scanning.

Any help out here would be far more than appreciated

Edit : I am not trying to stop people from the outside to port scan, but people from the inside to port-scan the internet, AKA my clients from doing malicious activites :)

Im using a mdadm software raid system on my new server which runs 3x120GB ssd drives.

Currently, this is the preinstalled configuration that came with the server

cat /proc/mdstat
Personalities : [raid1] 
md2 : active raid1 sdb2[1] sda2[0] sdc2[2]
      96211904 blocks [3/3] [UUU]

md1 : active raid1 sda1[0] sdc1[2] sdb1[1]
      20478912 blocks [3/3] [UUU]

unused devices: <none>

I would like to have more space available than 120gb, because right now its using only 1 drive for the data, 1 in raid + the other 1 in spare backup.

My question goes as is : Is it possible to have 3 drives running a raid 1 ?

Example : 3x120GB = 360GB. Have 180GB available and 180GB in raid

Any help would be really appreciated.

For more information on my current setup to show the 120GB only

df -h
Filesystem      Size  Used Avail Use% Mounted on
devtmpfs         16G  208K   16G   1% /dev
tmpfs            16G     0   16G   0% /dev/shm
/dev/md1         20G  1.3G   17G   7% /
/dev/md2         91G  200M   86G   1% /vz
/dev/md1         20G  1.3G   17G   7% /var/named/chroot/etc/named
/dev/md1         20G  1.3G   17G   7% /var/named/chroot/var/named
/dev/md1         20G  1.3G   17G   7% /var/named/chroot/etc/named.conf
/dev/md1         20G  1.3G   17G   7% /var/named/chroot/etc/named.rfc1912.zones
/dev/md1         20G  1.3G   17G   7% /var/named/chroot/etc/rndc.key
/dev/md1         20G  1.3G   17G   7% /var/named/chroot/usr/lib64/bind
/dev/md1         20G  1.3G   17G   7% /var/named/chroot/etc/named.iscdlv.key
/dev/md1         20G  1.3G   17G   7% /var/named/chroot/etc/named.root.key

Whenver i use the official debian source link, and run the

apt-get install rsync

Debian automatically install me the rsync version 2.6.9.

I can confirm with the following command :

rsync --version

it ouput : rsync version 2.6.9 protocol version 29

Now my question is the next : Is it possible to install rsync version 3.x on a debian 4 etch ? I have tried changing the source link to newer ones but that just brough more error with unverifiable packages and apt-get update that fails.

I mainly need this to make this script work : http://www.rackspace.com/knowledge_center/article/migrating-a-linux-server-from-the-command-line-scripted

I need to use this to copy my machine to a new server, and it crashes on line 527, saying that the version variable is not yet set. From what i have seen in the script, it looks like its because it needs rsync version 3 or higher.

EDIT : The goal of this rsync is to transfer my current machine onto a newer one, with better hardware. Since the machine is mainly a mail and a dns server, i have to make sure there is nothing that is lost or not reinstalled. It is the reason why i opted in for a script that will ensure me that nothing is left.

Suggestion are welcomed.

Thanks for your help community !