Sethos II's questions

I try to prepare a Windows 10 21H1 installation with sysprep for imaging. I activated OOBE and generalize. Sysprep says that it was successful, but it ran to quick and the log file (setupact.log) ends abrubtly, see below.

The problem is that after a reboot I'm not presented with the OOBE first run setup stuff but just with the login screen for "other user" and I can't login there.

The panther directory has an empty setuperr.log and setupact.log contains two warnings, no errors and a lot of entries like this at the end:

...
2021-08-12 10:07:51, Warning                      TapiSysPrep.dll:RetainTapiLocations:RegQueryValueEx() returned 2
...
2021-08-12 10:08:15, Warning               SYSPRP SPPNP: Failed to configure oem31.inf (fn.inf). Err = 0x430
...
2021-08-12 10:08:19, Info                  SYSPRP SPPNP: Configured oem53.inf (wiman.inf).
2021-08-12 10:08:19, Info                  SYSPRP SPPNP: Configured oem54.inf (qmuxmdm.inf).

I have an existing slurm cluster up and running but as of today without a configuration change I get an error when I run certain sacctmgr commands and slurmdbd crashes:

$ sacctmgr list associations
sacctmgr: error: slurm_persist_conn_open_without_init: failed to open persistent connection to slurm.domain.com:6819: Connection refused
sacctmgr: error: slurmdbd: Getting response to message type 1410
sacctmgr: error: slurmdbd: DBD_GET_ASSOCS failure: Connection refused
 Error with request: Connection refused

The systemctl status shows:

Jul 03 10:01:46 slurm systemd[1]: slurmdbd.service: Main process exited, code=killed, status=11/SEGV
Jul 03 10:01:46 slurm systemd[1]: slurmdbd.service: Failed with result 'signal'.

and the slurmdbd.log says:

[2020-07-03T10:01:45.816] debug2: Opened connection 9 from 127.0.0.1
[2020-07-03T10:01:45.817] debug:  REQUEST_PERSIST_INIT: CLUSTER:slurmcluster VERSION:8192 UID:0 IP:127.0.0.1 CONN:9
[2020-07-03T10:01:45.817] debug2: acct_storage_p_get_connection: request new connection 1
[2020-07-03T10:01:45.861] debug2: DBD_FINI: CLOSE:0 COMMIT:0
[2020-07-03T10:01:45.862] debug4: got 0 commits
[2020-07-03T10:01:45.949] debug2: DBD_GET_ASSOCS: called
[2020-07-03T10:01:45.950] debug4: 9(as_mysql_assoc.c:2032) query
call get_parent_limits('assoc_table', 'root', 'slurmcluster', 0); select @par_id, @mj, @msj, @mwpj, @mtpj, @mtpn, @mtmpj, @mtrm, @def_qos_id, @qos, @delta_qos;

However other commands work (restart of slurmdbd needed after crash):

$ sacctmgr show cluster
   Cluster     ControlHost  ControlPort   RPC     Share GrpJobs       GrpTRES GrpSubmit MaxJobs       MaxTRES MaxSubmit     MaxWall                  QOS   Def QOS
---------- --------------- ------------ ----- --------- ------- ------------- --------- ------- ------------- --------- ----------- -------------------- ---------
slurmclus+       127.0.0.1         6817  8192         1                                                                                           normal

I can connect to the database and execute commands. Also, I can connect via telnet slurm.domain.com 6819.

I'm using slurm 17.11.2 with MySQL 5.7 from the standard Ubuntu 18.04 repositories.

Is there a way to see which nfsd thread serves which client? Does such a mapping even exist or is a client request randomly distributed among idle nfsd threads?

I tried to install slurmdbd for accounting on a Ubuntu 16.04 from the standard repositories (version: 15.08.7-1build1).

Here are the commands:

$ sudo apt-get install mysql-server
$ sudo mysql
> create user 'slurm'@'localhost' identified by '123456';
> grant all on *.* TO 'slurm'@'localhost' identified by '123456' with grant option;
> create database slurm_acct_db;
> flush privileges;
> exit
$ sudo apt-get install slurmdbd
$ sudo vi /etc/slurm-llnl/slurmdbd.conf
$ cat /etc/slurm-llnl/slurmdbd.conf
AuthType=auth/munge
AuthInfo=/var/run/munge/munge.socket.2
DbdHost=localhost
DebugLevel=debug5
StorageHost=localhost
StorageLoc=slurm_acct_db
StoragePass=123456
StorageType=accounting_storage/mysql
StorageUser=slurm
LogFile=/var/log/slurm-llnl/slurmdbd.log
PidFile=/var/run/slurm-llnl/slurmdbd.pid
SlurmUser=slurm

However starting slurmdbd fails:

$ sudo systemctl start slurmdbd.service
Job for slurmdbd.service failed because the control process exited with error code. See "systemctl status slurmdbd.service" and "journalctl -xe" for details.
$ systemctl status slurmdbd.service
● slurmdbd.service - Slurm DBD accounting daemon
   Loaded: loaded (/lib/systemd/system/slurmdbd.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Di 2018-02-06 08:42:59 CET; 21s ago
  Process: 5881 ExecStart=/usr/sbin/slurmdbd $SLURMDBD_OPTIONS (code=exited, status=1/FAILURE)

Feb 06 08:42:59 accslurm systemd[1]: Starting Slurm DBD accounting daemon...
Feb 06 08:42:59 accslurm systemd[1]: slurmdbd.service: Control process exited, code=exited status=1
Feb 06 08:42:59 accslurm systemd[1]: Failed to start Slurm DBD accounting daemon.
Feb 06 08:42:59 accslurm systemd[1]: slurmdbd.service: Unit entered failed state.
Feb 06 08:42:59 accslurm systemd[1]: slurmdbd.service: Failed with result 'exit-code'.
$ journalctl -xe
Feb 06 08:42:59 accslurm systemd[1]: Starting Slurm DBD accounting daemon...
-- Subject: Unit slurmdbd.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit slurmdbd.service has begun starting up.
Feb 06 08:42:59 accslurm systemd[1]: slurmdbd.service: Control process exited, code=exited status=1
Feb 06 08:42:59 accslurm systemd[1]: Failed to start Slurm DBD accounting daemon.
-- Subject: Unit slurmdbd.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit slurmdbd.service has failed.
-- 
-- The result is failed.

Trying to do so manually with verbose output:

$ sudo -u slurm slurmdbd -Dvvv
slurmdbd: error: mysql_query failed: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'ignore table cluster_table modify `creation_time` int unsigned not null, modify ' at line 1
alter ignore table cluster_table modify `creation_time` int unsigned not null, modify `mod_time` int unsigned default 0 not null, modify `deleted` tinyint default 0, modify `name` tinytext not null, modify `control_host` tinytext not null default '', modify `control_port` int unsigned not null default 0, modify `last_port` int unsigned not null default 0, modify `rpc_version` smallint unsigned not null default 0, modify `classification` smallint unsigned default 0, modify `dimensions` smallint unsigned default 1, modify `plugin_id_select` smallint unsigned default 0, modify `flags` int unsigned default 0, drop primary key, add primary key (name(20));
slurmdbd: Accounting storage MYSQL plugin failed
slurmdbd: error: Couldn't load specified plugin name for accounting_storage/mysql: Plugin init() callback failed
slurmdbd: error: cannot create accounting_storage context for accounting_storage/mysql
slurmdbd: fatal: Unable to initialize accounting_storage/mysql accounting storage plugin

So it seems there is an error in the syntax for the creation of the database?

Did I miss something?

I have a running Gitlab CE installation with LDAP authentication. Now I want to restrict the access based on group membership.

The option user_filter seems to be the option to go with. However, I can't seem to get anyone to be allowed to login based on group membership.

What I tried is this (gitlabaccess being the group that should be allowed to login):

user_filter: '(&(objectclass=group)(samaccountname=gitlabaccess))'

or:

user_filter: '(memberOf=cn=gitlabaccess,DC=my,DC=domain,DC=com)'

The documentation states the following but it also doesn't work and I have no idea what the numbers should be:

user_filter: '(memberOf:1.2.840.113556.1.4.1941:=cn=gitlabaccess,DC=my,DC=domain,DC=com)'

Specific users work like this:

user_filter: '(&(objectclass=user)(samaccountname=jon.doe))'

Gitlab CE version 9.5.5 installed from omnibus package.

How can one restrict the access to Gitlab based on LDAP group membership?

I want to monitor the status of several services via SNMP.

The manpage says:

proc NAME [MAX [MIN]]
              monitors the number of processes called NAME (as reported by "/bin/ps -e") running on the local system.

So I added these lines to /etc/snmp/snmpd.conf:

proc smbd
proc nfsd

but the corresponding OIDs still return zero:

iso.3.6.1.4.1.2021.2.1.100.4 = INTEGER: 0
iso.3.6.1.4.1.2021.2.1.100.5 = INTEGER: 0

allthough ps -e shows smbd and nfsd processes:

> ps -e | grep "smbd\|nfsd"
 8267 ?        00:00:01 smbd
10179 ?        00:00:04 smbd
11068 ?        00:00:00 nfsd4_callbacks
11072 ?        00:12:53 nfsd
11073 ?        00:13:33 nfsd
11074 ?        00:14:35 nfsd
11075 ?        00:16:23 nfsd
11076 ?        00:21:52 nfsd
11077 ?        00:33:34 nfsd
11078 ?        00:48:10 nfsd
11079 ?        01:02:44 nfsd
15135 ?        00:00:03 smbd
15137 ?        00:00:17 smbd
15141 ?        00:00:05 smbd
20603 ?        00:00:00 smbd

I'm also able to get the list of running processes with OID 1.3.6.1.2.1.25.4.2.1.2 which also contains smbd and nfsd processes:

> snmpwalk -v 2c -c secret host 1.3.6.1.2.1.25.4.2.1.2 | grep "smbd\|nfsd"
iso.3.6.1.2.1.25.4.2.1.2.11068 = STRING: "nfsd4_callbacks"
iso.3.6.1.2.1.25.4.2.1.2.11072 = STRING: "nfsd"
iso.3.6.1.2.1.25.4.2.1.2.11073 = STRING: "nfsd"
iso.3.6.1.2.1.25.4.2.1.2.11074 = STRING: "nfsd"
iso.3.6.1.2.1.25.4.2.1.2.11075 = STRING: "nfsd"
iso.3.6.1.2.1.25.4.2.1.2.11076 = STRING: "nfsd"
iso.3.6.1.2.1.25.4.2.1.2.11077 = STRING: "nfsd"
iso.3.6.1.2.1.25.4.2.1.2.11078 = STRING: "nfsd"
iso.3.6.1.2.1.25.4.2.1.2.11079 = STRING: "nfsd"
iso.3.6.1.2.1.25.4.2.1.2.11724 = STRING: "smbd"
iso.3.6.1.2.1.25.4.2.1.2.12367 = STRING: "smbd"
iso.3.6.1.2.1.25.4.2.1.2.15135 = STRING: "smbd"
iso.3.6.1.2.1.25.4.2.1.2.15137 = STRING: "smbd"
iso.3.6.1.2.1.25.4.2.1.2.15141 = STRING: "smbd"
iso.3.6.1.2.1.25.4.2.1.2.29897 = STRING: "smbd"

Is it supposed to work like this and is monitoring services with the proc directive of SNMP a good idea or should I use extends (already got them working for ZFS and SLURM status)?

Environement:

• NET-SNMP 5.7.3
• Ubuntu Server 16.04

I'm trying to get a samba share working with correct IDs on Windows (SID) and Linux (uid/gid) clients. The problem is that the uids and gids are not properly mapped back to SIDs and SIDs are not resolved to names. What could lead to this problem and how can it be fixed?

What works

• mapping from Active Directory UNIX attributes to uid/gid on Linux
• access to the share
  • Windows: UNC-Path in Explorer, Kerberos ticket is accepted (no question for credentials)
  • Linux: sudo mount -t cifs //ribonas2/test /mnt/ribonas2/smb/ -o domain=DOMAIN,username=paul.jaehne
• working with files on the share

What doesn't work

• files created on Windows have Unix User\ and Unix Group\ (the UNIX uid and gid is also visible for a very short time when opening the security tab) instead of DOMAIN\ as prefix for users and groups
• adding permissions is flawed: I can add principals from the domain and shortly afterwards the DOMAIN\whatever is displayed correctly. When I wait for some time or look at the share from another computer then only the SID is displayed (the SID is correct, but not resolved to the name):

Environement/Configuration

• I used the following guides (can't add real links because of reputation requirements):
  • Ubuntu 16.04 SAMBA fileserver guide
  • Ubuntu 16.04 SSSD AD guide
  • SAMBA wiki domain member
  • SAMBA wiki ACL
• multiple domain controllers (Windows Server 2003 and Windows Server 2012 R2)
• Active Directory schema from Windows Server 2003
• Ubuntu Server 16.04
  • SSSD 1.13.4-1ubuntu1.1
  • SMB 2:4.3.8+dfsg-0ubuntu1
  • joined with both realm join and net ads join

sssd.conf:

[sssd]
domains = domain.company.com
config_file_version = 2
services = nss, pam

[domain/domain.company.com]
realmd_tags = manages-system joined-with-adcli
ad_domain = domain.company.com
krb5_realm = DOMAIN.COMPANY.COM

id_provider = ad
cache_credentials = True
krb5_store_password_if_offline = True
enumerate = True
use_fully_qualified_names = False

fallback_homedir = /home/%d/%u
default_shell = /bin/bash

# use uid and gid from active directory
ldap_id_mapping = False

# needed to use correct active directory properties (Windows Server 2003)
ldap_schema = ad
ldap_user_object_class = person
ldap_user_name = msSFU30Name
ldap_user_uid_number = msSFU30UidNumber
ldap_user_gid_number = msSFU30GidNumber
ldap_user_home_directory = msSFU30HomeDirectory
ldap_user_shell = msSFU30LoginShell
ldap_user_gecos = displayName
ldap_group_object_class = group
ldap_group_name = msSFU30Name
ldap_group_gid_number = msSFU30GidNumber

smb.conf (settings from standard config file are indented):

[global]
server role = member server
workgroup = DOMAIN
realm = DOMAIN.COMPANY.COM
security = ads
password server = dc1.domain.company.com # shouldn't be necessary and same problem without this line
idmap config * : backend = tdb
idmap config * : range = 100000-999999
idmap config DOMAIN : backend = ad
idmap config DOMAIN : range = 10000-20000 # the UNIX attributes are manually assigned in this range
kerberos method = secrets and keytab

    server string = %h server (Samba, Ubuntu)

    dns proxy = no

    log file = /var/log/samba/log.%m
log level = 10
    max log size = 1000
    syslog = 0

    panic action = /usr/share/samba/panic-action %d

    passdb backend = tdbsam
    obey pam restrictions = yes
    unix password sync = yes
    passwd program = /usr/bin/passwd %u
    passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
    pam password change = yes

    map to guest = bad user

    usershare allow guests = yes

# needed for Windows ACL/ACE
vfs objects = acl_xattr
map acl inherit = yes
store dos attributes = yes

[test]
    path = /srv/samba/test
    writable = yes

TL;DR: Why aren't the UNIX attributes resolved to SIDs and why aren't the SIDs resolved to names?