Debian dbus - ldap error messages on boot

I recently updated a system using LDAP for authorization/authentication and happily discovered it wouldn't reboot. The boot screen was scrolling ad infinitum with these helpful messages:
udevd: nss_ldap failed to bind to LDAP server .....

Quick search displayed many bug reports, obviously not fixed since I'm endured this on a freshly upgraded Debian Lenny system. Some comments I read were silly, like folks having the system boot with a nsswitch.conf using only "files" for passwd, group, and shadow, then switching to "ldap files" or "compat" after boot.

Fix for me was (2) steps:
1. Leave /etc/nsswitch.conf the way it was -- "compat ldap" only and add the problematic user to the LDAP server. And the problematic user is [drumroll] messagebus. All that did was prevent the infinite udevd messages on boot -- still errors though.

2. Edit /etc/libnss_ldap and add:
bind_policy soft

Server boots, fixed, no error messages, done, back to work...

OpenNMS and Apache2 on Debian Lenny

OpenNMS and Apache2 on Debian Lenny 5.0

What's the motivation? Jetty as built via OpenNMS does not have a configurable cipher suite or at least an obvious and/or intuitive method that wouldn't necessitate web crawling. Weak ciphers create noise on a Nessus scan listing it as a medium-level vulnerability. I found (2) how-tos on the OpenNMS wiki and both of them entailed using Jetty with AJP support. I wanted something simpler.

1. Edit /etc/opennms/opennms.properties and uncomment this line:
opennms.web.base-url = https://%x%c/

Restart OpenNMS

2. Install mod_proxy for Apache2 and add module:
$ a2enmod proxy

Beware that the default Debian proxy configuration disallows all proxy access. My installation required me to loosen it up a bit.
Edit "/etc/apache2/mods-available/proxy.conf", get rid of "Deny from all" and add:
Allow from 127.0.0.1/8 192.168.90.0/24

3. Add the virtual host entry for OpenNMS on Apache. Edit "/etc/apache2/sites-available/default-ssl" and add:

ProxyPass http://127.0.0.1:8980/opennms
ProxyPassReverse http://127.0.0.1:8980/opennms


Done. Everything works fine. Nessus is happy. Deployment secure.

Cray pas haunted house

I really like drawing with Cray pas. I don't feel any pressure to achieve something great when working with them. It is not technically demanding like, say, painting. I've tried my hand at painting and found it to be frustrating since my ideas never map themselves to the brush.

My daughter likes haunted houses...

Cray pas -- first go

Last night my older daughter was real demanding. In fact, the evening was so emotionally draining that after everyone went to bed I decided to grab a big piece of paper, sit on the floor with a box of cray pas, and draw a picture. It was actually cathartic. Here it is...

Mind mapping software: XMind vs. FreeMind vs. MindManager vs. Inspiration

I've always had a disorganized mind brimming with ideas and while it has served me well over the years I felt it was time to 1) optimize the way I think, 2) delineate and partition work, and 3) preserve state. Why do I need to preserve state? When I get distracted or pulled off on some wild tangent I need to focus quickly again. Likewise, when dragging myself into the office on Monday mornings I want to pick up precisely where I left off on Friday. Finally, and maybe it's because I'm getting older, I spend more time thinking about what I've been thinking about. It's a sort of vicious cycle wherein the moment I'm situated to perform a task, right when I've knifed fresh paints on the palette, I have to go to the restroom or get a coffee or eat lunch and all is lost.

Enter mind mapping. I've spent a considerable amount of time this past week evaluating various mind mapping software on OS X. The candidates were MindJet MindManager 7, Inspiration, FreeMind, and XMind

Here's a summary of my impressions:

Inspiration:

• Old MacOS9 look and feel
• Costs $$$$ -- but why should I pay that for a something that feels so outdated?
• Crashed twice and felt somewhat unwieldy for very large corporate or engineering projects
• Very very nice outline mode handy for cut and paste right into a doc or email.
  
• Might consider the Kidspiration for the youngins

MindManager7 for Mac:

• $$$ but the newer MM8 is only available on Windows
• Frequently crashed (due to evaluation? Doubt it)
• Overview mode was annoying with no automatic way of expanding every node in the tree
• Nice interface and keyboard shortcuts
• Good documentation
• Supports floating nodes
• Worked quite well -- felt productive from the start.

FreeMind:

• OpenSource. This is the product I wanted to like the most being a fan of the opensource community.
• Full export
• Cloud functionality mimics XMind boundaries.
  
• Text mode is somewhat clumsy -- how does one delete the text icon when there is no longer any text without deleting the node itself?? This is precisely the sort of information I don't want to waste time digging around for.
  
• Documented key-mappings for Mac didn't always match reality
• Overview mode?
• Annoying options menu -- especially choosing default colors
  
• No floating nodes and difficult to place nodes where you want them (they're always snapping back to the way FreeMind wants it)
• Somewhat primitive look and feel
• I took some time before I felt truly productive with this product

XMind:

• Some components OpenSource
• Extremely polished, friendly interface
• Good documentation
• Floating nodes
• Intuitive -- felt productive almost at once.
• Easy to both add and delete notes using function+F4
  
• Compact legend of key-bindings instantly accessible via ↑⌘L
• Optional tri-pane window featuring outline view and properties
• Cool Boundary and Summary functions
• Nice auto-styling like multi-branch coloring and line tapering
• Flexible node styling such as rounded, rectangle, callout, fishhead
• Useful templates
  
• Can't export to PDF in the free version

Ranking: 1) XMind, 2) FreeMind, 3) MindManager, 4) Inspiration.

XMind just wins hands-down in $$$, ease of use, form, and function. I would even consider purchasing the yearly subscription for some advanced features (Gantt charting) @ $49 a bargain.

Freemind is nice, too, but not as polished, full-featured, or easy to use as XMind. As mentioned before, I like opensource community projects, but in the end I need to get work done.

Shortly after XMind was made available at no cost, one of the FreeMind developers initiated a thread on the FreeMind mailing list asking whether or not it was worthwhile to continue that project (see here). Obviously the answer should be yes -- why crumple in the face of competition? Reading through the thread, however, I noticed a lot of commentors stated that while XMind is good, it's also slow whereas Freemind is lean and fast and, as such, Freemind is more suitable for quick off-the-cuff mapping. While it is true that Freemind is a bit spryer I feel this is negligable -- at least on a modern desktop.

Keeping my iTunes Library on an external hard drive across systems

Real simple: I have both an Apple desktop and laptop with limited disk space and want all my iTunes media to reside on an external HD that I can switch between systems.

This is fairly straight-forward.  In "Advanced Preferences" I changed the "iTunes Music folder location" to my external drive (in my case:  WD Passport/iTunes:).  This worked well for me until today.  Now to backtrack a little, when I first set-up this schema I even symlinked the ~/User/Music/iTunes directory to my external disk with the notion that I'd even want " iTunes Music Library.xml" (the dictionary file that maps every file in iTunes) on the external drive.  Ultimately this was stupid because if the external drive was not connected I couldn't fire up iTunes to listen to, say, the radio, without the application wanting to create an new library (equivalent to launching iTunes while pressing alt).

But that was then and this is now.  I'm not sure why my iTunes directory got screwed today but it did.

What happened was I accidentally "reset" the "iTunes Music folder location" which defaulted to my local hard drive.  When I tried to add the external hard drive location, the iTunes directory was greyed out (grayed out). Greyed out meaning I couldn't add it.  Then I attempted "Add to Library" (command+o) and the external iTunes directory was also greyed out.  WTF??

At first I thought there was some defaults com.apple.iTunes RootDirectory entry I could fool with like I did when I wanted to default my iPhoto Library to the external hdd some time ago.  But no go (another case of an OS X inconsistency).

It wasn't until I thought about doing something inane with permissions that I noticed that the iTunes directory on the external disk was an iPhoto-esque package content directory.  "Get Info" on iTunes even listed "open with iPhoto".  Hmmm. I stupidly changed it to "open with iTunes" but that was low-brow desperation.

Opening a shell and doing a "ls -lad" on iTunes showed:

drwxr-xr-x@ 20 rpetkus staff 680 Dec 17 19:40 iTunes/

What is "@"?  "man ls" informs me that @ = extended attributes which I can list with "-@"

$ ls -lad@ iTunes/

drwxr-xr-x@ 20 rpetkus staff 680 Dec 17 19:40 iTunes/
  com.apple.FinderInfo 32

What is com.apple.FinderInfo? Turns out this is a Uniform Type Identifier (UTI) which ascribes a lot more meaningful type data to a file than a mere file extension (.jpeg) or MIME type.  I found this older link which was a informative read about UTIs on OS X.  

After my reading assignment I surmised that I want to get rid of this extended attribute using the "xattr" command which doesn't have a man page but "xattr -help" is pretty self-explanatory.

Make iTunes a normal folder again:

$ xattr -d com.apple.FinderInfo iTunes/

Viola! iTunes on my external hard drive is no longer greyed-out, I can set it as my Music Folder location and "Add to Library".  Resolution.

As a side note, if you're doing the same thing with your external hdd, make sure under "Advanced Preferences" that you select "Copy files to iTunes Music folder when adding to library".  This way, if you add more media to iTunes on one system with the external drive, it indeed gets copied there for consumption on the second system.

Solaris 10, Kerberos, and OpenLDAP

Solaris 10 - Solaris in general - annoys me and Linux is favored for all instances except those where I need to reap the benefits of ZFS. Today as a precursor to deploying SUDO on a number of Solaris systems, I sought to eliminate ssh-key access and allow individual accounts to logon. Piece of cake in Linux but Solaris?

I want to use kerberos for authentication and ldap for authorization. I'm using OpenLDAP and not SUN LDAP so this already creates a bit of chafe, but I'm not going to install SUN LDAP or install a 3rd party PAM module - I want everything to be default so the next person to inherit this mess doesn't go mad.

Now I don't want to use pam_ldap for account authorization since this implies 1) I'm using SUN LDAP and 2) I'm storing account information like PASSWD in LDAP. We don't.

I *do* want to use vanilla pam_unix_account and rely on nsswitch.conf to state my name service preferences.

Now one would assume, given my requirements, that a reasonable SSH PAM stack would look like this:

other auth requisite pam_authtok_get.so.1

other auth required pam_dhkeys.so.1

other auth required pam_unix_cred.so.1

other auth sufficient pam_krb5.so.1

other auth required pam_unix_auth.so.1

other account requisite pam_roles.so.1

other account required pam_projects.so.1

other account sufficient pam_unix_account.so.1

Then why doesn't it work???? Why, in debug mode, does it always complain that account so and so is not found?

After some investigation it turns out that if using OpenLDAP for authorization one needs to add "objectClass=shadowAccount", and that's it, as an attribute to every single uid=xxx,ou=People,dc=place,dc=org. At least for those users that want to be authorized for login.

What a pain. And how much precious time did I waste on this? 2, maybe 3 hours? Unbelievable.