This is a list of things I learned setting up a Linux lab for my university. The lab contains 10 workstations, and 1 server. The users are authenticated centrally against LDAP, and their home directories are mounted as NFS shares on the server. The lab is powered by Scientific Linux, which is a Red Hat Enterprise Linux derivative.
Network Service Not Working? Check the Firewall
Do you have a service running on one machine, but cannot access it on the
another? Then you might have an issue with the firewall. The default
firewall settings are very restrictive on the lab server, and you might
think that you enabled the port permanently, but you didn’t. So FirewallD
can be kind of weird. Remember to pass the
--permanent flag to
firewall-cmd when adding services or ports to the firewall rules,
otherwise that rule be wiped out during a reboot.
BIND Configuration Files are Strict
BIND is considered the standard DNS server, it is pretty much the reference implementation. However writing the zone files for the first time and configuring the forwarding can be a bit of a challenge for the first time, but after you get it done the first time it runs smoothly. For instance, indentation matters when it comes to NS records, if you don’t indent the NS records it will fail to start with a cryptic message.
If you just remember two tools for working with bind, it should be
named-checkconf. You use the tools as shown below.
<zone-name> in the example above is the name of the actual domain you
are configuring, like lets say every machine’s name in your domain ends
.lan, then your zone would be named
OpenLDAP is Very Touchy
OpenLDAP is probably one of the most touchy programs out there. This
program was the biggest pain to get setup for the lab, when combined with
PAM. If you modified the
slapd.conf file and restart the service, it
would complain and just quit with an incredibly cryptic error message
regarding some checksum does not match. Every configuration change has to
be made via OLC, while the service is running. Webmin is amazing when
it comes to setting up LDAP, it is smart enough to install all of the
required packages, configure the rootdn, and create users.
However, if I didn’t have LDAP configured, it would not work nearly as well as it does now. As I would not be able to create as many users as quickly and manage them as easily. Additionally, LDAP is infinitely better than NIS, which passes passwords to the server in clear text, and has a two step update process. Also, LDAP actually supports logging who logged in at which workstation, while NIS does not, due to clients ability to cache the entire database.
UNIX File Permissions Are Awesome
The simplicity of the whole permissions system of UNIX is pure genius. It is broken down to be just granular enough to do the job right. Starting from user, group, and world permissions is just beautiful. It is so simple, and it makes perfect sense. After all, if we were storing every single user who has access to a file it would get big very quickly, but if we just create a group of users, and say that this group has access to the following files, it reduces the amount of storage required to store the access list, due to smaller constant factor. These permissions are real helpful when it comes to limiting who can do what on the system, and what these users do. It is pure genius for working with any number of people who needed to have the permissions limited.
These are just a few of the lessons I learned setting up the lab. When I actually start administrating the lab, I will make another post about what I learned dealing with the users of the lab when it is full swing, when I have some experience with that.