Random Tech Articles » linux

Debugging Unix

analogrithems — Sun, 14 Jun 2009 23:15:44 +0000

When ever I come across a command or service in Unix that crashes or fails to run properly I quickly go to the trace tools to trace the system commands. I often find that If I just follow the system trace i can usually see what was supposed to happen and didn’t. Unfortunatley not every unix flavor uses the same tracing commands.

In linux it is very simple prefix any command with strace and it will give you lots of system trace info.

In Solaris use the truss command.

In Irix use the par command.

Share on Facebook

Why nscd sucks….

analogrithems — Wed, 17 Sep 2008 01:27:53 +0000

The name service cache daemon has some serious flaws. One that I notice pretty often in Linux arises when you are using LDAP. It seems that nscd will crash and burn when/if ldap is unavailable. Unfortunately when nscd bombs, it usually takes the entire system with it. Actually what will happen is nscd sockets will start getting broken pipe’s and becoming stale until you have several nscd. Eventually your system will slow to a halt. Mind you the box hasn’t crashed, but the box is in a dos state. If you do an ‘$# netstat -an‘ you’ll notice several entries in reference to ‘/var/run/nscd/socket’. This bug has been listed by several distros, I’ve yet to see any of them address it properly.

From what I’ve discovered about nscd this issue is a design flaw in nscd. Several people have just recommended disabling nscd. While this is a solution, it isn’t an acceptable solution in an enterprise environment. Especially if you are using oracle. Several oracle tools and apps will freeze or crash if they can’t talk to the nscd socket. Lame I know, but I’ve observed this in at least Oracle 10i.

Solutions

Now there are tow ways to get around this. One is to make your LDAP service load balanced and highly available. You can do replication in OpenLDAP with slurpd and then use something like balance to make the service highly available. Another option though is to fix nscd so it doesn’t bomb your machine when it dies.

In this article we are going to go over the fix nscd solution. nscd comes with a config file located in ‘/etc/nscd.conf’ This file tells the nscd daemon how long to cache which name service. See the man page to understand what each option means. The quick way to fix nscd is to tell the service here not to cache passwd and group info. This will make nscd not go to LDAP and freak out if LDAP is not available. Randomly I also came across a drop in replacement for nscd that dosen’t suffer from this issue. unscd-033.c The compile instructions are in the file. I can’t guarantee this safe, but I’ve used it for a while in an enterprise environment and seem haven’t had any nscd issues since

Refferences:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248271

Share on Facebook

ldap with linux a basic primmer

analogrithems — Tue, 16 Sep 2008 22:59:37 +0000

LDAP has been around for over a decade, and yet it is still considered a newer technology. Many modern vendors have added LDAP authentication. This document is a brief generic howto for configuring linux to use LDAP. This will be a fairly detailed recipe as most of my docs are.

Linux Name Services
Name Server Switch is the engine that really enables Linux to harness LDAP. In linux you have two different ldap.conf files that the modules and services use to configure their ldap communications ‘/etc/ldap.conf’ and ‘/etc/openldap/ldap.com’. The first gives the dn’s for passwd, group and sudoers. You can also specify the server and communication protocol. One really cool bonus is that you get to enable the host_acl based of users with this config file

host    ldap.analogrithems.com
base    dc=analogrithems,dc=com,dc=us
ldap_version    3
#Validate cert
tls_checkpeer no
ssl     start_tls
#ssl on
nss_map_attribute       uniqueMember member
pam_password_prohibit_message Please visit http://enterprise.company.com/password_policy.html.
pam_groupdn cn=ldap.analogrithems.com,ou=Computers,dc=analogrithems,dc=com,dc=us
pam_member_attribute uniquemember
pam_filter accountStatus=active
nss_base_passwd         ou=People,dc=analogrithems,dc=com,dc=us?one
nss_base_shadow         ou=People,dc=analogrithems,dc=com,dc=us?one
nss_base_group          ou=Groups,dc=analogrithems,dc=com,dc=us?one
sudoers_base    ou=SUDOers,dc=analogrithems,dc=com,dc=us
#This options is VERY helpful for debugging sudo ldap extension
#sudoers_debug 2

PAM
PAM is an authentication and accounting module that allows Linux services to use different methods for authenticating users (MySQL, LDAP, NIS, etc..). Their are two different pam config versions. You should look up the version your gnu/linux vedor uses for exact details on ldap setup, for SuSE you modify “/etc/security/pam_unix2.conf” to include the following. This system makes it so you don’t have to modify every pam service to use ldap, you just let them all use the standard unix2 module which then handles the ldap lookup.

auth:   use_ldap
account:        use_ldap
password:       use_ldap
session:        none

NSS
Edit your ‘/etc/nsswitch.conf’ place the word ldap before files for the passwd and group name service. You can also add it to sudoers if you want to store your sudo configs in ldap also

passwd: compat
shadow: compat
group: compat
sudoers: files ldap

passwd_compat: files ldap
shadow_compat: files ldap
group_compat: files ldap

Share on Facebook