Today I tried to put in production an update of Samba 3 (3.5.4) to allow Windope 7 clients to join the domain.

After having performed what's on the samba wiki page about this topic [here], I could join the machine to the domain but I was not able to login !? :(

In the log :

[2010/08/20 16:55:20.682477,  0] rpc_server/srv_netlog_nt.c:714(_netr_ServerAuthenticate3)
  _netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client RO-BACKUP machine account RO-BACKUP$
[2010/08/20 16:55:30.993850,  0] lib/util_sock.c:474(read_fd_with_timeout)
[2010/08/20 16:55:30.993958,  0] lib/util_sock.c:1432(get_peer_addr_internal)
  getpeername failed. Error was Transport endpoint is not connected
  read_fd_with_timeout: client 0.0.0.0 read error = Connection reset by peer.

The problem was easy to solve but not easy to find : the two machines had not the same time (30 secs delay !)

Fixing the time sync fixed the problem (and I'm not using kerberos and AD)

After having setup squid and dansguardian (using clamd) on Centos 5, I wasn't able to use it :(

I had always the following error, even if the dansguardian user was the same as clamd (clamav) :

2010.7.9 12:22:41 - 10.0.200.6 http://www.eicar.org/anti_virus_test_file.htm
 *INFECTED* *DENIED* /tmp/tfIlR1j6: lstat() failed: Permission denied. 
ERROR GET 15590 0 Content scanning 1 403 text/html  

I just realize after having searched too long that SELinux (I know life is too short for it) was the culprit.
It was my mistake as I completely forgot that this machine had selinux enabled :-S

So in /var/log/audit/audit.log I had :

type=AVC msg=audit(1278673113.470:3489): avc:  denied  { getattr } for
pid=32164 comm="clamd" path="/tmp/tfCSCirx" dev=dm-3 ino=17 
scontext=user_u:system_r:clamd_t:s0 
tcontext=user_u:object_r:initrc_tmp_t:s0 tclass=file
type=SYSCALL msg=audit(1278673113.470:3489): arch=c000003e 
syscall=6 success=no exit=-13 a0=8cce370 a1=421f2dc0 a2=421f2dc0 
a3=8 items=0 ppid=1 pid=32164 auid=1004 uid=102 gid=114 euid=102 
suid=102 fsuid=102 egid=114 sgid=114 fsgid=114 tty=(none) ses=437 
comm="clamd" exe="/usr/sbin/clamd" subj=user_u:system_r:clamd_t:s0 
key=(null)

Note to myself: Never forget to check in audit.log !

To create the selinux policies, I used the following commands, which are quiet easy:

audit2allow -a -m dansguardian > dansguardian.te
checkmodule -M -m dansguardian.te 
checkmodule -M -m dansguardian.te -o dansguardian.mod
semodule_package -o dansguardian.pp -m dansguardian.mod
semodule -i dansguardian.pp 

Et voilà ! Dansguardian is running and I didn't disable selinux :-)

I've been fighting several weeks (and making a huge number of typo's due to that) with the touchpad of my macbook pro on Fedora/Gnome.

I've tested several solutions :

- disable it in Gpointing Device Settings --> fail (it always comes back after a short moment)
- use synclient TouchpadOff=1 --> fail
- creating udev rules : --> fail

ACTION=="add", SUBSYSTEM=="input", ENV{ID_CLASS}="mouse", RUN+="/usr/bin/synclient TouchpadOff=1"
ACTION=="remove", SUBSYSTEM=="input", ENV{ID_CLASS}="mouse", RUN+="/usr/bin/synclient TouchpadOff=0

So the best solution I've found (one that works) is : rmmod bcm5974

Now I'll try to add it into the udev rules too.

I used preupgrade to updgrade Fedora from 12 to 13.

After the process, I had to resync the partition in refit to be able to boot Linux.

I rebuilded the needed packages for nvidia and the broadcom wireless card.

I needed also to do some modifications to be able to use the integrated iSight webcam:

1. download the apple firmware :

wget http://www.i-nz.net/files/projects/linux-kernel/isight/against-revision-...

then extract it (using the Fedora 12 package isight-firmware-tools) :

[root@delvaux ~]# su -c "ift-extract --apple-driver AppleUSBVideoSupport"

after this operation it should be working for most of the macbook pro, but not for this model, another change is needed.

first find the idProduct number:

[fred@delvaux Desktop]$ lsusb -v | grep  iSight -B 3 | grep idProduct
  idProduct          0x8507 

and mofify the file /etc/udev/rules.d/isight.rules with the returned value :

[root@delvaux rules.d]# cat isight.rules 
ACTION=="add", SYSFS{idVendor}=="05ac", SYSFS{idProduct}=="8507", RUN+="/usr/lib64/udev/ift-load --firmware /lib/firmware/isight.fw"

I have tested 3 Twitter clients to use on my gnome desktop:

- Gwibber (gwibber-1.2.0-3.349bzr.fc12.noarch)
- Pino (pino-0.2.6-1.fc12.x86_64)
- Turpial (turpial-1.0-b1.fc12.noarch)

I've found Gwibber very nice, doing what I need but it's very slow and sometimes freezes (becomes dark). It has also facebook support (nice to see the status updates of your friends).

Pino is my favorite one for the moment, it's fast, doesn't support facebook (yet?).
Something I don't like is that you have to switch between the accounts (twitter and identi.ca) which is annoying.

Turpial is not was I really wanted, it doesn't fit really in the desktop and it's only in Spanish.

I hope that Pino will keep improving and stay fast as now.

http://gwibber.com/
http://code.google.com/p/pino-twitter/
http://code.google.com/p/turpial/

Update !

I've just tested Gwibber 2 (gwibber-2.30.0.1-1.fc12.noarch) and it has very nice features: possibility to see all the messages or only by account, possibility also to see images (updated in facebook for example). I will for sure test it and discover it a bit longer, nice improvements !

banquise (yet another package manager) is now released ! :)

The website is online : www.banquise.be

This is a server/client application both written in python. The server is written with django.

This post is dedicated to sdog

and of course toi (the lord of sushi's) enjoyed it !

The place : zaowang - Antwerpen

As requested by the audience, the slides of my presentation are now online. You can find them on slideshare

I had a few of interesting questions after the talk and some nice chats.

I won't also a nice book at the business card lottery : Automating System Administration with Perl.

See you next year :)

PS: the sushi's were wonderful ! (poor sdog)

Sunday 11th April, I will be at LOAD to talk about the daily management of huge (and ugly) tables in MySQL.

It's a reviewed talk of my previous FOSDEM session. I just finished the review of the slides.

I hope to see you there :-)

As requested by Pieter, here are the spec files I used to create the openERP rpms for fedora and centos.

As some packages have different names or different user management commands, I need two different spec files for same pakages in each distro.

(only the client can be the same)

I wait for your feedback