spidernik84's questions

I'm setting up a Cisco ASA as a client vpn server. The appliance is relying on freeradius to authenticate the users. Freeradius has in turn been configured to query OpenLDAP.

The modules/ldap file has been configured to check the groups ownership by using the following filter (members are listed under each group by using the attribute memberUid):

groupmembership_filter = "(&(objectClass=posixGroup)(memberUid=%{User-Name}))"

The file freeradius/users has this statement:

DEFAULT LDAP-Group != "cn=unixadm,ou=groups,dc=services,dc=company,dc=com", Auth-Type := Reject

I would like to use multiple membership checks, for example to allow only users belonging to a set of groups. Apparently, freeradius fails if more then one group is specified.

I'm looking for a way to list more than one group.

The operating system used for freeradius and openldap is ubuntu 10.04.

we're setting up an ubuntu server 10.04 host with kvm. The host is setup with a bond and bridged interfaces to allow the guests access to the network without natting. Our current configuration is working fine, except when we're restarting the network with an /etc/init.d/networking restart. After restarting the network, the guests lose connectivity. The only way to restore it is to halt the guest and start it again.

I've been looking around but I can't seem to find any known bug/issue/report of this behavior.

Here follows our network configuration file:

auto lo
iface lo inet loopback

auto bond0
iface bond0 inet manual
    bond-slaves none
    bond-mode active-backup
    bond-downdelay 250
    bond-updelay 120
    bond-miimon 100

auto eth0
iface eth0 inet manual
    bond-master bond0
    bond-primary eth0 eth1

auto eth1
iface eth1 inet manual
    bond-master bond0
    bond-primary eth0 eth1

#bridge used by host
auto br-vlan180
iface br-vlan180 inet static
    address 10.0.0.200
    netmask 255.255.255.0
    gateway 10.0.0.1
    vlan-raw-device bond0
    bridge_ports vlan180
    bridge_maxwait 0
    bridge_fd 0
    bridge_stp off
#bridge without address, used by vm
auto br-vlan120
iface br-vlan120 inet manual
    vlan-raw-device bond0
    bridge_ports vlan120
    bridge_maxwait 0
    bridge_fd 0
    bridge_stp off

Thank you

ADDENDUM - brctl show output before and after nw restart:

BRCTL SHOW BEFORE NW RESTART

brctl show
bridge name bridge id       STP enabled interfaces
br-vlan120      8000.984be1644072   no      vlan120
                            vnet0
                            vnet1
br-vlan180      8000.984be1644072   no      vlan180
virbr0      8000.000000000000   yes 

BRCTL SHOW AFTER NW RESTART

brctl show
bridge name bridge id       STP enabled interfaces
br-vlan120      8000.984be1644072   no      vlan120
br-vlan180      8000.984be1644072   no      vlan180
virbr0      8000.000000000000   yes

apparently, the two virtual interfaces fail to come back after network restart.

PS BEFORE NW RESTART

ps -ef | grep qemu
root      1784     1  6 11:45 ?        00:00:40 /usr/bin/kvm -S -M pc-0.12 -enable-kvm -m 512 -smp 1 -name test02 -uuid ee6d84b6-dbf8-d93c-b32f-8ae6b7d9b80e -chardev socket,id=monitor,path=/var/lib/libvirt/qemu/test02.monitor,server,nowait -monitor chardev:monitor -boot c -drive file=/dev/sysvg/test02,if=virtio,index=0,boot=on,format=raw -drive file=/root/ubuntu-10.04.2-server-amd64.iso,if=ide,media=cdrom,index=2,format=raw -net nic,macaddr=52:54:00:2c:d1:26,vlan=0,name=nic.0 -net tap,fd=48,vlan=0,name=tap.0 -chardev pty,id=serial0 -serial chardev:serial0 -parallel none -usb -vnc 127.0.0.1:0 -vga cirrus -soundhw es1370
root      2711     1 89 11:55 ?        00:00:14 /usr/bin/kvm -S -M pc-0.12 -enable-kvm -m 512 -smp 2 -name nttest -uuid 04ca381e-0510-7d3c-c7e2-8f7d7b6ea58f -chardev socket,id=monitor,path=/var/lib/libvirt/qemu/nttest.monitor,server,nowait -monitor chardev:monitor -localtime -boot c -drive file=/dev/sysvg/nttest,if=ide,index=0,boot=on,format=raw -drive file=/root/SW_DVD5_Windows_Svr_DC_EE_SE_Web_2008_R2_64Bit_English_w_SP1_MLF_X17-22580.ISO,if=ide,media=cdrom,index=2,format=raw -net nic,macaddr=52:54:00:62:1b:2e,vlan=0,name=nic.0 -net tap,fd=51,vlan=0,name=tap.0 -chardev pty,id=serial0 -serial chardev:serial0 -parallel none -usb -usbdevice tablet -vnc 127.0.0.1:1 -vga cirrus -soundhw es1370

PS AFTER NW RESTART

ps -ef | grep qemu
root      1784     1  4 11:45 ?        00:00:59 /usr/bin/kvm -S -M pc-0.12 -enable-kvm -m 512 -smp 1 -name test02 -uuid ee6d84b6-dbf8-d93c-b32f-8ae6b7d9b80e -chardev socket,id=monitor,path=/var/lib/libvirt/qemu/test02.monitor,server,nowait -monitor chardev:monitor -boot c -drive file=/dev/sysvg/test02,if=virtio,index=0,boot=on,format=raw -drive file=/root/ubuntu-10.04.2-server-amd64.iso,if=ide,media=cdrom,index=2,format=raw -net nic,macaddr=52:54:00:2c:d1:26,vlan=0,name=nic.0 -net tap,fd=48,vlan=0,name=tap.0 -chardev pty,id=serial0 -serial chardev:serial0 -parallel none -usb -vnc 127.0.0.1:0 -vga cirrus -soundhw es1370
root      2711     1 39 11:55 ?        00:03:51 /usr/bin/kvm -S -M pc-0.12 -enable-kvm -m 512 -smp 2 -name nttest -uuid 04ca381e-0510-7d3c-c7e2-8f7d7b6ea58f -chardev socket,id=monitor,path=/var/lib/libvirt/qemu/nttest.monitor,server,nowait -monitor chardev:monitor -localtime -boot c -drive file=/dev/sysvg/nttest,if=ide,index=0,boot=on,format=raw -drive file=/root/SW_DVD5_Windows_Svr_DC_EE_SE_Web_2008_R2_64Bit_English_w_SP1_MLF_X17-22580.ISO,if=ide,media=cdrom,index=2,format=raw -net nic,macaddr=52:54:00:62:1b:2e,vlan=0,name=nic.0 -net tap,fd=51,vlan=0,name=tap.0 -chardev pty,id=serial0 -serial chardev:serial0 -parallel none -usb -usbdevice tablet -vnc 127.0.0.1:1 -vga cirrus -soundhw es1370

I'm trying to manipulate an ldif file with multiple entries. My purpose is to parse this existing ldif file, extracting the "givenName" and "sn" attributes, so to generate a "mail" attribute. I was thinking about AWK or Sed, but unfortunately I'm not an expert on the two nice tools. An example:

original file

dn: cn=fremer, ou=people, dn=domain, dn=com
cn: fremer
givenName: Freddy
sn: Mercury

dn: cn=markno, ou=people, dn=domain, dn=com
cn: markno
givenName: Mark
sn: Knopfler

Output:

dn: cn=fremer, ou=people, dn=domain, dn=com
mail: [email protected]

dn: cn=markno, ou=people, dn=domain, dn=com
mail: [email protected]

The dn is needed since I will take the resulting ldif and pass it to "ldapadd" for LDAP update. Any suggestion or hint on where should I look at? Thank you!

I'm facing a challenge with my PF firewall on an OpenBSD machine.

From a client (A) I'm connecting to a server (B) using a target ip (SRV-IP-1). The server is replying to my request, but sourcing the reply from a different IP (SRV-IP-2).

The firewall is dropping the reply, since it's unable to understand that the reply is part of a conversation originated from the inside network (it thinks that the reply is a connection started from outside).

Is there a way to instruct the firewall to consider a reply valid if coming from, say, a "pool" of addresses instead of the address used as the conversation target (SRV-IP-1)? For example, it would be nice to map a specified address with other addresses, to "chain" the state.

Thank you.

I'm trying to make an HP DL170 G6 server boot via the "virtual media" feature.
The system doesn't even try to boot from the virtual media, it seems unable to see it!

Here's the test we've been doing:

• Checked correct boot order to force CD/DVD and removable drives
• Disabled all the other boot items and tested CD/DVD and removable drives singularly
• Checked if ISOs are bootable, tried multiple ISOs (Knoppix, Ubuntu, Damn Small Linux)
• Successfully tried to boot from USB stick (so the ISO is good)
• Tried different client OSes (windows XP 64, Ubuntu 10.04.2 LTS, Ubuntu 11.04)
• Tried different Java JVM (1.4.2_19, the bare minimum)
• Checked if the USB subsystem was enabled in BIOS
• Removed any USB peripheral attached to the system like USB keyboards (stated as a possible problem)
• Upgraded BIOS and iLO firmwares to the latest revisions
• Excluded network problems (blocked ports, etc.) by connecting the iLO straight to a laptop with an Ethernet cable
• removed vlan config from the iLO
• Rebooted the system multiple times, cold booted the system as well
• Tried different browsers (Opera 11.50, Firefox 4, Firefox 5, Chrome, Internet Explorer 8)
• Checked, double checked, triple checked that the "connect" button in the virtual media applet was pressed and the ISO correctly mounted
• Ran the browser as root

All these tests have been done and nothing succeeded so far. Anybody know what's wrong?