Linux Setting processor affinity for a certain task or process

Just recently I wanted to be able to lock a single process to a specific CPU for testing purposes. A bit of googling lead me to thisnice explanation of how it works.

Essentially you use the taskset command to run a new proc locked to a specific CPU:

% taskset -c 1 sleep 10

Will run ‘sleep 10’ locked to CPU #0.

% taskset -c -p 1
pid 1's current affinity list: 0,1

Shows you what PID 1 has its affinity set to.

SELinux tit bits

I’ve just discovered you can switch selinux into Permissive mode whilst the machine is running
This shows that we are currently enforcing:

# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 21
Policy from config file:        targeted

To switch into permissive mood:

# setenforce Permissive

And another sestatus shows the change

# sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   permissive
Mode from config file:          enforcing
Policy version:                 21
Policy from config file:        targeted

vt1211 module for Centos or RedHat Enterprise 5

I’ve a couple of machines running Centos 5 on Via Epia motherboards.

Sadly kernel versions up to and including 2.6.18 dont ship with the required vt1211 kernel module. This means that both Centos and Redhat Enterprise 5 lack the module required to gather sensors data. Because it is a bit of a chore to patch the kernel source and compile the driver any I compile I’ll keep here.

i686 Kernels

Documenting the use of this module is beyond the scope of this post, for information regarding that please see the home page for lm_sensors.

Many thanks to Lars Ekman for writing and maintaining this module!

Linux authentication from Active Directory

Just needed to auth a Redhat (actually Centos) 4 update 4 machine from an Active Directory server, thought I ought to make a note for future reference
It is worth gathering some information before you start, you will need the follow:

AD Domain, in the example I use HILDEBRANDTECH
Domain Controllers, in the example i use win23kent.hildebrandtechnology.local
ADS Realm, mine was HILDEBRANDTECHNOLOGY.LOCAL

It seems that for all of this case is important. Thanks Microsoft.

Other things to watch for are:

  1. Your client machine can resolve the hostname of your ad server, try with ping now and if it fails fix it before you start.
  2. Check your clocks are in sync, kerberos uses time based tickets so any clock skew at all will cause problems.

Because I was using RedHat Enterprise I had the luxury of using the authconfig. Login as root or su and run authconfig from the command line, you will be presented with some options for where the machine should source user and authentication data from. You need to tick the ‘Use Winbind’ option in both columns, after making my selections mine looked like this:

Authconfig AD Setup Page 1

After making the correct settings, hit next. On the next screen you need to enter all the information you gathered before starting. Additionally I chose /bin/bash as the template shell:

Authconfig AD Setup Page 2

After typing all the above in hit Ok. You can choose ‘Join Domain’ at this point but I prefer to do that manually so you can ensure it was successful.

Once you are at your prompt again, run the following:

[root@adc-a04 ~]# net ads join -U administrator
administrator's password:
Using short domain name -- HILDEBRANDTECH
Joined 'ADC-A04' to realm 'HILDEBRANDTECHNOLOGY.LOCAL'
[root@adc-a04 ~]#

If you see a message similar to the above your machine should now be joined to the domain.

If you now run ‘getent passwd’ you should see some extra users are displayed, the ones gathered from the AD. An example of one is shown below.

HILDEBRANDTECH\robin:*:16777223:16777216:Robin Kearney:/home/HILDEBRANDTECH/robin:/bin/bash

You should now be able to login as ‘HILDEBRANDTECH\robin’. By default winbind requires the domain to be entered as part of the username. If your linux machine is only going to authenticate from a single AD realm you can make a small change to smb.conf to avoid this.

In /etc/samba/smb.conf look for the line which reads:

winbind use default domain = no

And change the no to yes. Then issue a ‘service winbind restart’ and re-run your ‘getent passwd’ you should notice the domain component of all the usernames has gone. Now you can simple use ‘robin’ to login.

Your users should now be able to login. There is a slight problem in that they will have no home accounts, pam can help with this though.

If you edit /etc/pam.d/login and add the following as the last line:

session required pam_mkhomedir.so skel=/etc/skel/ umask=0077

Pam will auto create the user a home account when they first login.

There is one minor issue with the default winbind settings for home accounts, by default winbind is configured set AD users’ home accounts to /home/DOMAIN/USER this is fine in our setup but pam refuses to create the DOMAIN directory, so none of the home accounts will get created.

You can fix this in one of two ways. First, manually create the /home/DOMAIN for each of your AD domains, this will likely be just the one. Or and this might suit better, change the structure of home accounts for AD users. This is done in /etc/samba/smb.conf. You need to add or edit a line like the following:

template homedir = /home/%U

The default here is %D/%U. %D gets expanded to the DOMAIN. The official samba documentation for this setting is here

Hopefully after all that you can still login, and your AD users can too.

getent truncating output

This little chestnut just caught me out. I’m trying to test some theories with maximum users and groups etc on linux using a ldap backend for authentication. I’ve run a little script which happily created me 65536 groups and 65536 users but when I use ‘getent group’ or ‘getent password’ it only seems to return 500 ldap entries.

It turns out the problem lies not with getent but with slapd limiting the returned results for any given query, the default is 500 (man 5 slapd.conf). The solution is to add ‘sizelimit -1’ to slapd.conf, restart and now getent should return the correct answer.