youtube-dl --hls-prefer-native fails with error "WARNING: hlsnative has detected features it does not support, extraction will be delegated to ffmpeg"

Error:  WARNING: hlsnative has detected features it does not support, extraction will be delegated to ffmpeg

OS: Centos 7.7

youtube-dl --version: 2020.03.24

Solution:  pip install pycrypto


Other things installed before this that might also need installed.

• pip install crypto
• yum install pycrypto
• yum install python-crypto

Syncing Time in CentoOS 7 (ntp/chrony)

For some reason, I couldn't get this to sync until I finally found 1 command that everyone never mentioned.  Here's how to set it up.

ntpd

1. yum install ntp ntpdate
2. systemctl start ntpd
3. systemctl enable ntpd
4. systemctl status ntpd
5. ntpdate -u -s 0.centos.pool.ntp.org 1.centos.pool.ntp.org 2.centos.pool.ntp.org
6. timedatectl set-ntp yes
7. timedatectl set-ntp 1
8. systemctl restart ntpd

chronyd

1. yum install chrony
2. systemctl enable chronyd
3. systemctl start chronyd
4. ntpdate pool.ntp.org
5. timedatectl set-ntp yes
6. timedatectl set-ntp 1
7. systemctl restart chronyd

Source: Link Link Link Link Link

How to rename your Spacewalk Server

This will also fix an error message if you are getting a certificate name error from your spacewalk clients.  This will cause the repos to show 0 packages even though spacewalk reports there are 1,000s of packages in the repo.  Other error messages "The SSL certificate failed verification."

On your spacewalk server you can check the cert:

openssl verify -CAfile /var/www/html/pub/RHN-ORG-TRUSTED-SSL-CERT /etc/pki/spacewalk/jabberd/server.pem

You can also verify if your server name matches the certificate name by running the spacewalk rename script.

Before running the command, you need to install the spacewalk-utils

yum spacewalk-utils

spacewalk-hostname-rename x.x.x.x

The Xs are your servers IP.  It'll tell you the name it is reading.  Compare that to the file in /root/ssl-build/rhn-ca-openssl.cnf.  You are looking for cn=.

Now assuming that names don't match or you want to change your server name:

RHEL 7

hostnamectl set-hostname newservername

RHEL6

hostname newname

vim /etc/sysconfig/network

Now verify the new name is working

hostname

Now we need to create new certs.

rhn-ssl-tool --gen-ca --force

rhn-ssl-tool --gen-server

Now you need to install the new certs.

rpm -ivh --force ~/ssl-build/spacewalk/rhn-org-httpd-ssl-key-pair-spacewalk-1.0-2.noarch.rpm

Copy the new files to the apache folder so the clients can access it

cp ~/ssl-build/rhn-org-trusted-ssl-cert-1.0-2.noarch.rpm /var/www/html/pub/

chown apache /var/www/html/pub/rhn-*

Note:  The rhn-org-trusted-ssl-cert-1.0-2.noarch.rpm changed on me.  The original was 1.0-1.

Now even though it's showing everything is right the spacewalk rename tool won't work until you reboot.  So reboot and then run:

spacewalk-hostname-rename x.x.x.x

Then do like you would normally:

rpm -Uvh http://servername.domain.com/pub/rhn-org-trusted-ssl-cert-1.0-2.noarch.rpm --force

Note: Notice that I added the --force argument

rhnreg_ks --serverUrl=https://servername.domain.com/XMLRPC --sslCACert=/usr/share/rhn/RHN-ORG-TRUSTED-SSL-CERT --activationkey=1-activationkeyname

Note: If the system is already registered, you must add --force to the rhnreg_ks command.

Error: /usr/lib64/python2.6/site-packages/pycurl.so: undefined symbol: CRYPTO_set_locking_callback

This error messages gets thrown when I run ANY yum command.  After lots of googling and finding nothing I stumbled upon part of the solution (First Link Below).

The page pointed out a system variable "LD_LIBRARY_PATH".  This variable was not set on working machines but it WAS set on machines that had Matlab installed.

I believe matlab must set this for root account which breaks yum.  Here is how I fixed it.  There was a user named matlab_user already created so I just moved the value to the user's bash profile.

This is for the root account

echo "export LD_LIBRARY_PATH=" >> /root/.bashrc
cat /root/.bashrc

This is for the matlab_user

echo "export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/opt/MATLAB/MATLAB_Runtime/v81/runtime/glnxa64:/opt/MATLAB/MATLAB_Runtime/v81/bin/glnxa64:/opt/MATLAB/MATLAB_Runtime/v81/sys/os/glnxa64:/opt/MATLAB/MATLAB_Runtime/v81/sys/java/jre/glnxa64/jre/lib/amd64/native_threads:/opt/MATLAB/MATLAB_Runtime/v81/sys/java/jre/glnxa64/jre/lib/amd64/server:/opt/MATLAB/MATLAB_Runtime/v81/sys/java/jre/glnxa64/jre/lib/amd64:/opt/MATLAB/MATLAB_Runtime/v84/runtime/glnxa64:/opt/MATLAB/MATLAB_Runtime/v84/bin/glnxa64:/opt/MATLAB/MATLAB_Runtime/v84/sys/os/glnxa64:/opt/MATLAB/MATLAB_Runtime/v85/runtime/glnxa64:/opt/MATLAB/MATLAB_Runtime/v85/bin/glnxa64:/opt/MATLAB/MATLAB_Runtime/v85/sys/os/glnxa64" >> /home/matlab_user/.bashrc

cat /home/matlab_user/.bashrc

Source:  Link

pam_sss(xxx:auth): received for user jsmith: 4 (System error) SSSD CentOS 6.7/RHEL 6.7

This error is very generic and I found out that it really could be many different things. Luckily every time it got fixed my doing the same thing.
Step 1: Determine if it is truly connected to the domain.

net ads leave domain.local -U jsmith.adm
No realm set, are we joined ?

Step 2: Retry joining domain

net ads join domain.local -U jsmith.adm

I've seen the following error:

libnet_join_ok: failed to get schannel session key from server dc.domain.local for domain DOMAIN. Error was NT_STATUS_NO_TRUST_SAM_ACCOUNT

Failed to join domain: failed to verify domain membership after joining: No trusted SAM account

Possible Fixes:
Double check the krb5.conf file for typos.
service smb restart; service winbind restart; service sssd restart;

I found another problem was that end users that had sudo access actually changed the ownership of the /tmp directory and while joining the domain, the process was able to create the temp files it needed. Here's how I figured it out.

Edit /etc/sssd/sssd.conf in the [domain] and [pam] sections set the value of: debug_level = 8. Restart sssd and log in again. Now check /var/log/sssd/krb5_child.log.

Here was my findings:

[root@box log]# tail sssd/krb5_child.log
(Thu Sep 22 13:34:17 2016) [[sssd[krb5_child[4528]]]] [unpack_buffer] (0x2000): No old ccache
(Thu Sep 22 13:34:17 2016) [[sssd[krb5_child[4528]]]] [unpack_buffer] (0x0100): ccname: [FILE:/tmp/krb5cc_569601190_XXXXXX] old_ccname: [not set] keytab: [/etc/krb5.keytab]
(Thu Sep 22 13:34:17 2016) [[sssd[krb5_child[4528]]]] [check_use_fast] (0x0100): Not using FAST.
(Thu Sep 22 13:34:17 2016) [[sssd[krb5_child[4528]]]] [check_parent_stat] (0x0020): Private directory can only be created below a directory belonging to root or to [569601190].

(Thu Sep 22 13:34:17 2016) [[sssd[krb5_child[4528]]]] [create_ccache_dir] (0x0010): Check the ownership and permissions of krb5_ccachedir: [/tmp].

(Thu Sep 22 13:34:17 2016) [[sssd[krb5_child[4528]]]] [k5c_precreate_ccache] (0x0040): ccache creation failed.
(Thu Sep 22 13:34:17 2016) [[sssd[krb5_child[4528]]]] [k5c_ccache_setup] (0x0040): Cannot precreate ccache
(Thu Sep 22 13:34:17 2016) [[sssd[krb5_child[4528]]]] [privileged_krb5_setup] (0x0020): k5c_ccache_setup failed.
(Thu Sep 22 13:34:17 2016) [[sssd[krb5_child[4528]]]] [main] (0x0020): privileged_krb5_setup failed.
(Thu Sep 22 13:34:17 2016) [[sssd[krb5_child[4528]]]] [main] (0x0020): krb5_child failed!

Another command that help troubleshoot this was:

KRB5_TRACE=/dev/stdout kinit admin

Source: Link Link Link Link Link

Configuring Xrdp in Redhat (RHEL) 7 / CentOS 7

First thing is to install some type of desktop:

yum groupinstall "Gnome Desktop"

You need to install the epel repo. ****(The Next two lines may change if the version is not 7.8)****

wget http://dl.fedoraproject.org/pub/epel/7/x86_64/e/epel-release-7-8.noarch.rpm

rpm -ivh epel-release-7-8.noarch.rpm

yum clean all
yum repolist

Next install VNC and XRDP

yum install tigervnc-server xrdp

cp /etc/pam.d/sshd /etc/pam.d/xrdp-sesman
systemctl restart xrdp
systemctl enable xrdp

cp /lib/systemd/system/vncserver\@.service /etc/systemd/system/vncserver@.service

Orginal:

[Service]
Type=forking
# Clean any existing files in /tmp/.X11-unix environment
ExecStartPre=/bin/sh -c '/usr/bin/vncserver -kill %i > /dev/null 2>&1 || :'
ExecStart=/usr/sbin/runuser -l  -c "/usr/bin/vncserver %i"
PIDFile=/home//.vnc/%H%i.pid
ExecStop=/bin/sh -c '/usr/bin/vncserver -kill %i > /dev/null 2>&1 || :'

I used the root account for testing. Use any account you would like.
Working:

[Service]
Type=forking
# Clean any existing files in /tmp/.X11-unix environment
ExecStartPre=/bin/sh -c '/usr/bin/vncserver -kill %i > /dev/null 2>&1 || :'
ExecStart=/usr/sbin/runuser -l root -c "/usr/bin/vncserver %i -geometry 1280x1024"
PIDFile=/root/.vnc/%H%i.pid
ExecStop=/bin/sh -c '/usr/bin/vncserver -kill %i > /dev/null 2>&1 || :'

I did the above with sed:

sed -i 's/ -c/root -c/g' /etc/systemd/system/vncserver@.service
sed -i 's/vncserver %i/vncserver %i -geometry 1280x1024/g' /etc/systemd/system/vncserver@.service
sed -i 's/\/home\//\/root/g' /etc/systemd/system/vncserver@.service

Reload the services

systemctl daemon-reload

Set the VNC Password

vncpasswd

Start the service and enable it on boot

systemctl start vncserver@:1.service
systemctl enable vncserver@:1.service

AWS EC2 Start/Stop Scripts using Tagging

So my first version of this just used a list of ec2 ids and stopped and started.  I need it to make it more "cloud like".  So what is more cloud like? Tagging!  I now have it building a list based on an explicit tag, then comparing it to another list that is dynamic based on a tag called shutdown with the value of Exclude.  Anything with the exclude value, I don't want it shut down.  As always, anyone has ways of making this better, post below.

Shutdown

#!/bin/bash

instance_list=$(aws ec2 describe-instances --filters Name=tag-value,Values="Enter-tag-value-here-no-quotes"| cut -f 8 | grep ^i-)

exclude_list=$(aws ec2 describe-instances --filters Name=tag-value,Values="Enter-tag-value-here-no-quotes"| cut -f 8 | grep ^i-)

while IFS= read -r instance_id
do
        echo "Shutting down: $instance_id";
        if [[ ${exclude_list[*]} =~ $instance_id ]]; then
   echo "The instance must stay powered on";
        else
            status=$(aws ec2 describe-instances --instance-ids $instance_id | cut -f 3 | grep 'stopped\|stopping\|running\|pending')

            if [ $status != "stopped" ];
            then
                aws ec2 stop-instances --instance-ids $instance_id
                sleep 10
                status=$(aws ec2 describe-instances --instance-ids $instance_id | cut -f 3 | grep 'stopped\|stopping\|running\|pending')
                echo "The $instance_id is $status";
             fi
        fi
done <<< "$instance_list"

Startup

#!/bin/bash

instance_list=$(aws ec2 describe-instances --filters Name=tag-value,Values="Enter-tag-value-here-no-quotes" | cut -f 8 | grep ^i-)

while IFS= read -r instance_id
do
        status=$(aws ec2 describe-instances --instance-ids $instance_id | cut -f 3 | grep 'stopped\|stopping\|running\|pending')
        echo "The instance $instance_id is $status"

        while [ "$status" != 'running' ];
        do
                aws ec2 start-instances --instance-ids $instance_id
                sleep 10
                status=$(aws ec2 describe-instances --instance-ids $instance_id | cut -f 3| grep 'stopped\|stopping\|running\|pending')
                echo "The instance $instance_id is $status"

                if [ "$status" == 'running' ]; then
                        echo "The $instance_id is $status"
                        break
                fi
        done
done <<< "$instance_list"

AWS EC2 Startup/Shutdown Scripts

Couple assumptions:

1.  You've already installed the aws cli
2.  You've already run aws configure
3.  You are running this from an instance that never gets shutdown

Shutdown

#!/bin/bash

instance_list="instance1
instance2"

while IFS= read -r instance_id
do
        status=$(aws ec2 describe-instances --instance-ids $instance_id | cut -f 3 | grep stopped)
        echo "The instance $instance_id is $status"

        while [ "$status" != 'stopped' ];
        do
                aws ec2 stop-instances --instance-ids $instance_id
                sleep 10
                status=$(aws ec2 describe-instances --instance-ids $instance_id | cut -f 3| grep stopped)
                echo "The instance $instance_id is $status"

                if [ "$status" == 'stopped' ]; then
                        echo "The $instance_id is $status"
                        break
                fi
        done
done <<< "$instance_list"

Startup

#!/bin/bash

instance_list="instance1
instance2"

while IFS= read -r instance_id
do
        status=$(aws ec2 describe-instances --instance-ids $instance_id | cut -f 3 | grep running)
        echo "The instance $instance_id is $status"

        while [ "$status" != 'running' ];
        do
                aws ec2 start-instances --instance-ids $instance_id
                sleep 10
                status=$(aws ec2 describe-instances --instance-ids $instance_id | cut -f 3| grep running)
                echo "The instance $instance_id is $status"

                if [ "$status" == 'running' ]; then
                        echo "The $instance_id is $status"
                        break
                fi
        done
done <<< "$instance_list"

Right now this is doing it based on the list you write.  I did out that if you could grab all instances like this:

instance_list=$(aws ec2 describe-instances | cut -f 8 | grep ^i-)

The problem is that your shutting down the box with the scripts.  Plus I do have a couple of servers I don't want to go down.  Good enough for now but I need to add a way to exclude instances and also save EIPs so I can reattach the same EIP when I bring it back up.  If you know how to do it, please feel free to improve this in the comments!

Setting up an C-ICAP Server using the "The c-icap project"

Couple things first:

Documentation: http://c-icap.sourceforge.net/documentation.html
Install: http://c-icap.sourceforge.net/install.html
Download info:

• Main Software - http://sourceforge.net/projects/c-icap/files/latest/download
• Modules - http://sourceforge.net/projects/c-icap/files/c-icap-modules/

I built this from multiple articles that are linked some where on here.  Not one had all the answers.  Here is my brain dump from it.

Download c-icap and c-icap modules

c-icap

tar xvf c_icap-x.x.x.tar.gz

cd c_icap-x.x.x

./configure --prefix=/usr/local/c-icap

make

make install 

vim /usr/local/c-icap/etc/c-icap.conf 

Under ServerAdmin: Enter your email

Under ServerName: Enter your hostname of the server

The ModulesDir is wrong and needs to be changed to:

• Wrong: ModulesDir /usr/local/c-icap/lib/c_icap
• Correct: ModulesDir /usr/local/lib/c_icap

The ServicesDir is wrong and needs to be changed to: 

• Wrong: ServicesDir /usr/local/c-icap/lib/c_icap
• Correct: ServicesDir /usr/local/lib/c_icap

 The TemplateDir  is wrong also and needs to be changed to:

• Wrong: TemplateDir /usr/local/c-icap/share/c_icap/templates/ 
• Correct: TemplateDir /usr/local/share/c_icap/templates/

 Next Step, test your server:

/usr/local/c-icap/bin/c-icap -N -D -d 10

Instructions: Link

If everything is correct, it should start up.  Kill it and we will continue. Next we need to configure the module to scan using clamav.  This is assuming you already have clamav installed and working.

If you want to create a c-icap service do the following:
vi /etc/rc.d/init.d/c-icap

# bin/bash
# c-icap: Start/Stop c-icap
# chkconfig: - 70 30
# description: c-icap is an implementation of an ICAP server.
# processname: c-icap
# pidfile: /var/run/c-icap/c-icap.pid

. /etc/rc.d/init.d/functions
. /etc/sysconfig/network

CONFIG_FILE=/usr/local/c-icap/etc/c-icap.conf
PID_DIR=/var/run/c-icap

RETVAL=0
start() {
   echo -n $"Starting c-icap: "
   daemon /usr/local/c-icap/bin/c-icap -f $CONFIG_FILE
   RETVAL=$?
   echo
   [ $RETVAL -eq 0 ] && touch /var/lock/subsys/c-icap
   return $RETVAL
}
stop() {
   echo -n $"Stopping c-icap: "
   killproc c-icap
   rm -f /var/run/c-icap/c-icap.ctl
   RETVAL=$?
   echo
   [ $RETVAL -eq 0 ] && rm -f $PID_DIR/c-icap.pid /var/lock/subsys/c-icap
   return $RETVAL
}
case "$1" in
   start)
      start
   ;;
   stop)
      stop
   ;;
   status)
      status c-icap
   ;;
   restart)
      stop
      start
   ;;
   *)
      echo $"Usage: $0 {start|stop|status|restart}"
   exit 1
esac
exit $?

This was taken from one of the links below but I had to modify it to make it work with changes in a recent update to the project.

Test that it starts:

 /etc/rc.d/init.d/c-icap start 

Create the final pieces to the service:

chkconfig --add c-icap

chkconfig c-icap on 

We need to extract the c-icap modules

tar xvf c_icap_modules-x.x.x.tar.gz

cd c_icap-x.x.x

./configure --with-c-icap=/usr/local/c-icap --prefix=/usr/local/c-icap

make

make install 

vim /usr/local/c-icap/etc/c-icap.conf 

Now we need to add the virus scan module.  You already have the c-icap config open so at the end of the file add:

• Include /usr/local/etc/virus_scan.conf

Instructions:  Link

The virus_scan.conf needs to me modified.

vim /usr/local/etc/virus_scan.conf

Add to the bottom:

Include /usr/local/etc/clamd_mod.conf


I also changed the one line to:
virus_scan.DefaultEngine clamav

The clamd needs to modified for the correct Socket Location:
vim /usr/local/etc/clamd_mod.conf

Change the Socket Location to:
clamd_mod.ClamdSocket /var/run/clamav/clamd.sock

service c-icap restart

You can test it by running the following commands:

No Virus Test File: 

/usr/local/c-icap/bin/c-icap-client -f /bin/ls  \

            -s "srv_clamav?allow204=on&force=on&sizelimit=off&mode=simple"

Virus Test File:

/usr/local/c-icap/bin/c-icap-client -f /usr/local/share/clamav-0.x.x/test/clam.exe \

   -s "srv_clamav?allow204=on&force=on&sizelimit=off&mode=simple"

Log Files are located:

• ServerLog /usr/local/c-icap/var/log/server.log 
• AccessLog /usr/local/c-icap/var/log/access.log

A lot of the errors will show up in the server.log file.

Troubleshooting:

ERROR: Unable to find specified template: /usr/local/p/share/c_icap/templates//virus_scan/en/VIRUS_FOUND

Means the path is wrong.

 clamd_connect: Can not connect to clamd server on /var/run/clamav/clamd.ctl!

This means that the Socket Location in clamav is different then what you have listed.

Check these two files for the location: /usr/local/etc/clamd.conf /etc/clamd.conf

Source:  Link Link
Virus Test: Link ******REMEMBER THESE ARE ACTUAL VIRUSES!!!!******

Joining CentOS/RHEL (6.x) to Active Directory (Windows Server Domain) [Updated]

***CASE MATTERS FOR EVERYTHING POSTED BELOW***

Install the following packages

yum install pam_krb5 pam_ldap nss-pam-ldapd samba ntp

*If you already have any of these installed, it'll skip them.

First make a backup of the config.
cp /etc/krb5.conf /etc/krb5.conf.bak

</etc/krb5.conf>

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = DOMAIN.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 DOMAIN.COM = {
  kdc = DC.DOMAIN.COM
  admin_server = DC.DOMAIN.COM
  kdc = x.x.x.x
 }

[domain_realm]
 .domain.com = DOMAIN.COM
 domain.com = DOMAIN.COM

Again backup the config
cp /etc/samba/smb.conf /etc/samba/smb.conf.bak

You can also use system-config-authentication if you have a gui.

</etc/samba/smb.conf>
Note:  The workgroup is the left most part of the domain

[global]

workgroup = DOMAIN
password server = x.x.x.x
realm = DOMAIN.COM
security = ADS
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = No
winbind separator = +
idmap config * : backend = autorid
idmap config * : range = 1000000-19999999
idmap config * : rngesize = 1000000
template homedir= /home/%D/%U
template shell = /bin/bash

*Note*
If you don't want the users to have to type DOMAIN+username then remove the winbind separator line and change the winbind user default domain = yes.  Restart smb and winbind.

Again backup the config
cp /etc/nsswitch.conf /etc/nsswitch.conf.bak

</etc/nsswitch.conf>

passwd:     files winbind
group:      files winbind
shadow:     files winbind

Again backup the config
cp /etc/ntp.conf /etc/ntp.conf.bak

</etc/ntp.conf>
Note:  The 1.1.1.1 is the ip of your server

server 1.1.1.1 

Pick one of these ways:
1. authconfig-tui (select Winbind, click ok. Select Use Shadow Passwords, Use Winbind Authentication, Local authorization is sufficient)

2. Create the files manually.

Again backup the config
cp /etc/pam.d/system-auth /etc/pam.d/system-auth.bak

</etc/pam.d/system-auth>

auth        required      pam_env.so
auth        sufficient    pam_unix.so try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_sss.so use_first_pass
auth        sufficient    pam_winbind.so use_first_pass
auth        required      pam_deny.so

account     required      pam_access.so
account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     [default=bad success=ok user_unknown=ignore] pam_winbind.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so difok=4 dcredit=-2 ucredit=-2 ocredit=-2 lcredit=-2 minlen=12 retry=3
password    sufficient    pam_unix.so sha512 shadow try_first_pass use_authtok
password    sufficient    pam_sss.so use_authtok
password    sufficient    pam_winbind.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     optional      pam_oddjob_mkhomedir.so skel=/etc/skel umask=0644
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_sss.so

</etc/pam.d/sshd>

auth       required     pam_sepermit.so
auth       include      password-auth
auth    sufficient      pam_winbind.so
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      password-auth

Edit your /etc/hosts file
</etc/hosts>

1.1.1.1 dc.server.centos.com dc

Restart the following services:

service smb restart
service winbind restart
service sshd restart
service ntpd restart
chkconfig winbind on

*If any of those fail, you have something configured wrong.
Then run:  [root@node001user1]# kinit domainadmin@CENTOS.COM (THIS MUST BE IN ALL CAPS!)

Confirm the ticket was obtained: [root@node001 user1]# klist

Get the time from the server: [root@node001 user1]# net time

Sync the time from the server: [root@node001 user1]# ntpdate -u

Then run the following command to join it to the domain.

[root@node001 user1]# net ads join -U domainadmin (replace with your domain admin username)

Run some more tests:

wbinfo -t
wbinfo -u
wbinfo -g

getent passwd
getent groups

If any of those fail, something isn't configured correctly.

If you want the domain admins and admins to have privileged access, you need to add this to the bottom of your sudoers file.  You may have to over write the read only file to save it.

</etc/sudoers> ***NEED TO VERIFY IF THIS STILL WORKS****

[root@node001 user1]# cat /etc/sudoers

%BUILTIN\administrators ALL=(ALL) ALL
%"domain admins" ALL=(ALL) ALL

Some great additional trouble shooting commands can be found here -> Link

Also if you need to find your base dn to locate the group your user accounts are stored, I explain how to do that here -> Link

Another Great reference is here:  Link

If you have a Red Hat Subscription, they provide some good additional information:  Link

Integrating Red Hat Enterprise Linux 6 with Active Directory (Last updated 2014): Link

Link

Tested: RHEL 6.4+Windows 2k8 R2, RHEL 6.4+Windows 2k12 R2

kinit: Cannot find KDC for requested realm while getting initial credentials

The error message doesn't really give you a clear "this is your problem" error.

Possible Problems

1.  krb5.conf is wrong (see here for more information on that Link)
2. kinit command is wrong. The case matters.
   -CORRECT SYNTAX:  kinit username@DOMAINNAME.COM

*if the domain name is not in ALL CAPS, you will get this error message.

How to Build a Yum Repository [Updated]

yum install yum-utils createrepo vsftpd

Create the directory: /var/ftp/pub/yum/*OSName*/*RELEASE*/*PATCH*/base/*ARCH*

examples:

/var/ftp/pub/yum/centos/6/6/base/i386
/var/ftp/pub/yum/centos/6/6/base/x86_64
/var/ftp/pub/yum/RHEL/7/1/base/x86_64

mkdir -p /var/ftp/pub/yum/centos/6/6/base/x86_64

Option 1:  From Install CD

Required:  Installation Media

cp -ar /*CDMOUNTPOINT*/Packages/* /var/ftp/pub/yum/centos/6/6/base/x86_64
cp /*CDMOUNTPOINT*/repodata/*comps*.xml /opt/yum/rhel6.3/repodata/comps.xml

Option 2:  From an Internet Repo

Required:  Internet Connection

If you do it this way, you are grabbing the latest patches from a repository on the internet.

reposync --gpgcheck -l -p /etc/yum.repos.d/redhat-rhui.repo --download_path=/var/ftp/pub/yum/RHEL/7/1/base/x86_64 --downloadcomps --download-metadata

Source:  Link Link Link 

Server Config

service vsftpd start

*If running iptables, you will have to allow it through the firewall

cd /var/ftp/pub/yum/centos/6/6/base/x86_64
createrepo -v .

vim /etc/yum.reposb.d/custom.repo

[name]
name=Centos $releasever Base Updates 6.6
baseurl=ftp://*ip-of-the-computer*/pub/centos/6/6/base/x86_64 enable=1 gpgcheck=0 (this can be changed to 1 once the certs are installed on the system)

yum clean all
yum repolist

Your repo should now be listed

Couple of Notes:
SELinux and the firewall was turned off while doing this

Note:  Some systems may require you to run yum-arch /var/ftp/pub/yum/centos

Tested In: CentOS 4.3, 6.6, RHEL 6.4 (just change version numbers above to match your version of the OS)

Troubleshooting:

repomd.xml: [Errno 14] PYCURL ERROR 9 - "Server denied you to change to the given directory" Trying other mirror."

After building your own yum repo you get the error: "repomd.xml: [Errno 14] PYCURL ERROR 9 - "Server denied you to change to the given directory" Trying other mirror."

You setup a server to be a repo server.  You've installed ftp and everything seems to be correct.  You've also checked the permissions on all the files and they are correct at 755.  Always test the ftp address in a browser.  This error is deceving and it has nothing to do with repomd.xml.  This has to do with the ftp address in your repo being wrong.

For instance:

Using ftp the path should be:

ftp://x.x.x.x/pub/...../.../../... (anything after pub can be whatever you created)

The key here is don't forget to pub!

Additional info: Link

CentOS 7 GDM forces you to create a local account even when using LDAP, NIS, etc

This is a super annoying issue.  Here is how I got around it.

After install switch to tty2 Ctrl+Alt+F2.  Login as root.  Setup your choice of authentication..

Before logging out change this setting.

Edit /etc/gdm/custom.conf

Look for the section that says [daemon]  and add the following:

InitialSetupEnable=false

Save and exit.  Reboot the machine and login.

 Source:  Link

Setting up KVM in Centos 6.5 with Bridged Networking

NOTE:  This is all assuming your computer supports virtualization.  If you aren't sure run this command as root -> more /proc/cpuinfo | grep vmx  If it returns anything, it should work assuming it is turned on in the bios.

The first thing you need to do is install the KVM Packages

sudo yum install @Virt*
sudo yum install kvm*
sudo yum install libvirt* 

Next you will want to restart the libvertd

sudo service libvertd restart

Now check to make sure its set to start on boot

sudo chkconfig --list | grep libvirtd

if it is not run the following

sudo chkconfig libvrtd on

At this point the KVM should be installed and working.

To run the GUI manager type:

sudo virt-manager

If you are having trouble with connecting to the qemu then run the following:

lsmod | grep kvm

If this doesn't return a value there is an issue.  Double check that your bios has VT enabled.

Now if you want each VM to act as if they are their own entity on the network with their own IP we need to change some things.  I will say this.... I was on a machine with NIS configured and was doing all these changes while my user and once the network is broken, you as the user become unknown when the NIS server can't be reached.  Do all the following as root.

Locate your ethernet config file in /etc/sysconfig/network-scripts/

Lets back it up first

cp /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0.bak

Open up the ifcfg file and this is all I have in mine.

DEVICE="eth0"
HWADDR=XX:XX:XX:XX:XX:XX
ONBOOT=yes
BRIDGE=br0
NM_CONTROLLED=no

The hwaddr is probably already there so don't change the value.  Also the bridge name is what I called the next file so it can be whatever as long as the two match.

Lets create a new file

vim /etc/sysconfig/network-scripts/ifcfg-br0

DEVICE="br0"
TYPE=Bridge
DELAY=0
ONBOOT="yes"
BOOTPROTO=static
IPADDR=X.X.X.X
NETWMASK=X.X.X.X
GATEWAY=X.X.X.X
DNS1=X.X.X.X
DNS2=X.X.X.X
DOMAIN=test.local
PEERNDS="yes"
NM_CONTROLLED="no"

Like I mentioned the DEVICE name must match the BRIDGE name above.

Now run:

service network restart

To show if the bridge is up and working run

brctl show

If you are running iptables we need to add some new rules to it

iptables -I FORWARD -m physdev --physdev-is-bridged -j ACCEPT
service iptables save
service iptables restart

Next we need to add some kernel settings.  Open /etc/sysctl.conf

Add the following:

net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0

Close and save. Run the following to verify they were added.

sysctl -p /etc/sysctl.conf
service libvirtd reload

I had issues with NetworkManager so I turned it off

chkconfig NetworkManager off

Now reboot and run virt-manager to start building your VM.

Source:  Link Link Link

Error (SHUTDOWN_MSG: Shutting down NameNode at .... ) when trying to format hadoop name node

Ever get this error while trying to format your namenode in hadoop?

 hadoop namenode -format
13/03/29 16:34:11 INFO namenode.NameNode: STARTUP_MSG:
/************************************************************
STARTUP_MSG: Starting NameNode
STARTUP_MSG:   host = node001/10.10.10.158
STARTUP_MSG:   args = [-format]
STARTUP_MSG:   version = 1.1.2
STARTUP_MSG:   build = https://svn.apache.org/repos/asf/hadoop/common/branches/b                                                                             ranch-1.1 -r 1440782; compiled by 'hortonfo' on Thu Jan 31 02:06:43 UTC 2013
************************************************************/
Re-format filesystem in /tmp/hadoop-root/dfs/name ? (Y or N) y
Format aborted in /tmp/hadoop-root/dfs/name
13/03/29 16:34:14 INFO namenode.NameNode: SHUTDOWN_MSG:
/************************************************************
SHUTDOWN_MSG: Shutting down NameNode at
node001/10.10.10.158
************************************************************/

You have to be very careful and you must type a CAPITAL Y and not a lower case y!

Source:  Link

How to Create a Theme in CentOS 4.3

The themes are located in /usr/share/gdm/themes/<some-theme-name>

For instance the GdmGreeterTheme.desktop

[GdmGreaterTheme]
Encoding=UTF-8
Greeter=circles.xml
Name=Circles
Description=Theme with blue circles
Author=James Smith
Copyright=(c) 2002 James Smith
Screenshot=screenshot.png

To test the theme you built, you need to install/yum the Xnest package.  Once installed, type:
gdmthemetester xdmcp "theme-name"

If you like what you saw, to set it for good, edit the gdm file in /etc/x11/gdm/gdm.conf:
GraphicalTheme="your-theme-name"

In the xml file, you can modify the row of buttons.
Position if changed from -0 to 0 moves from right to left
Anchor will put it on certain area on the screen.  Possible choices are: N, S, E, W, NE, NW, SE, SW

To remove the log on loading box when you first login, edit the file located in /usr/share/pixmaps/splash/gnome-splash.png

To modify the screen resolution, the settings can be found in the /etc/x11/xorg.conf file.

Security Enhanced Linux (SELinux) General Notes

CentOS 4.3 was based off of Fedora Core (FC) 3 with Fedora Core 4 Auditing.

Config File Location = /etc/sysconfig/selinux
Policy File Location = /etc/selinux/"name-of-policy"/src/policy

Because audit support is not part of FC3, login is trying to audit it.  There for you receive an error.  To fix it add this code to the local.te in /etc/selinux/"name-of-policy"/domains/misc/ 

allow auth_chkpwd self:netlink_audit_socket *;
allow auth_chkpwd self:capability { audit_write audit_control };

Users need to be added tot he users file located in /etc/selinux/"name-of-policy"/src/policy/users
Ex: user roadzy roles { user_r };

Roles must be created in the user.te file located in /etc/selinux/"name-of-policy"/domains/user.te
Ex: full_user_role (user) <- notice there is no _r
Ex: role_tty_type_change (user, admin)  <- This allows the user role to transfer to admin role

id -z will show the current user you are logged in as and include the SELinux Security Contexts

If you want to enforce SELinux at boot, add enforcing = 1 to /boot/grub/grub/conf

If you want to switch policies, for example say from the targeted policy to strict, you have to run touch /.autorelabel to enable the new policy.  This relabels the whole file system.

/etc/selinux/"name-of-policy"/src/policy/assert.te contains never allow statements that force the policy not to allow those instances

local.te allows you to add random allow statements in this file to be built into the policy.  The file is located in /etc/selinux/"name-of-policy"/src/policy/domains/misc/local.te


Each new domain needs an fc & te file
fc's are located in /etc/selinux/"name-of-policy"/src/policy/file_context/program
te's are located in /etc/selinux/"name-of-policy"/src/policy/domains/program


To relabel a file file run the command " restorecon "filename"
If you want to relabel a whole directory run the command: restorecon -R "foldername"

To transition into a new role run:  newrole "somerole"_r
*You'll be prompted to enter the root password

To allow a domain to transfer to another domain, you need to write an allow statement.  It needs to be added to local.te or another.te file
Ex: role "name-of-role"_r types "name-of-domain"_t

Domain auto transfers are written in the .te files.
Ex:  domain_auto_trans("some-role"_t, "the-program"_exec_t, "program"_t)

To create your own policy, cd in to /etc/selinux/"name-of-policy"/src/policy.
Next run make clean -> make install -> make load - > make enable audit
*If you want to chain them together run -> make clean; make install; make load; make enable audit

Macros are located in /etc/selinux/"name-of-policy"/src/policy/macros


Examples of macros:
sudo_domain (role) -> used for sudo
r_dir_file (domain, reading domain) -> reads files of that domain
rw_dir_file (domain, reading & writing domain ) -> reads & writes to files of that domain
base_file_read_access (domain)
can-exec (domain, bin_t) -> allows executing of the bin_t domain

To audit a domain transfer add teh following tot he te file or local.te:
Ex:  audit allow "domain"_t "domain2"_t; process transition;

A possible fix when no AVC messages show up add the following to a te or local.te file:
Ex:  allow "domain1"_t self:netlink_audit_socket *;
Ex:  allow "domain1"_t self:capabity audit_write *;

If you want to receive more information about an error run the following command:
Ex: auditctl -e 1


One big important thing... this is from pre-RHEL 5 which SELinux changed a great deal.

Two great books that helped me with a lot of this are below:

http://www.amazon.com/Selinux-Source-Security-Enhanced-Linux/dp/0596007167/ref=as_li_tf_sw?&linkCode=wsw&tag=tech03fe-20

http://www.amazon.com/SELinux-Example-Using-Security-Enhanced/dp/0131963694/ref=as_li_tf_sw?&linkCode=wsw&tag=tech03fe-20

How to Create your own Yum Repo Package Group

The big part was figuring out the xml syntax for it.

<group>
<id>groupidname</id>
<description>Description of what this group does</description>
<default>true</default>
<uservisible>yes</uservisible>
<packagelist>
<packagereq type="mandatory">What you want yum to search for </packagereq>
</packagelist>
</group>

Once created, run:

createrepo -g yumgroups.xml /*LOCATION OF REPODATA*/

For more information on a yum repo see http://roadzy.blogspot.com/2012/02/how-to-build-yum-directory-in-centos-43.html

Tested on CentOS 4.3

How to Create an Boot Image for a Linux Live CD

First off:  The image can not exceed 640x300 and can only contain 16 colors.

yum -y install syslinux
*You need ppmtolss16 and lsstoppm from syslinux package

To convert a gif to lss16: giftopnm <"name-of-the-pic".gif | ppmtolss16 > "name-of-boot-image".lss

*Before you type it remove the quotes

The splash image is located in ../livecd-2.0.4/linux-live.sl4/cd-root/boot

The splash config file can change the txt at the beginning.

/etc/redhat-release is what the text shows while booting

Menus work just like the normal install in "/"

Desktop background is located in /livecd-2.0.4/customize/s1/default.png

*default.png can't be named anything else.  The directory is either s1 or sl.

CentOS 4.3 was the version used when trying to complete this.