Ubuntu tips and trials

New Blog!

I haven't had a lot of stuff to put on this new blog for some time. My time has been spent on my new blog over here: http://mellowd.co.uk/ccie/

Comments now work! Feel free to pop by to take a look.

D

TACACS+ mini HOWTO

Why a mini HOWTO? Well I'm going to explain how I set up a simple TACACS+ server on a Linux box. If you want any sort of AD integration you'll need to look elsewhere.

I recently got given the project of installing a new linux box with a number of services. One of them was to replace the old TACACS+ server that has been claiming it's pension already for a number of years.

Server Configuration

The server I have running in a virtual machine is running RedHat Enterprise 5. However the instructions should work for any rpm-based distro.

Debian/Ubuntu distro's will be slightly different to install, but I would assume the config is identical. I'll expand this another time when I get the chance.

I'm using Cisco's free tac_plus server. You can find it here: ftp://ftpeng.cisco.com/pub/tacacs/

As you can see, Cisco provides only the source code. No binaries to be found. I attempted to compile the code but they've really made it difficult as you need to configure the makefile yourself :(

You can make your life a LOT easier by just downloading a compiled rpm. If you enjoy pain then knock yourself out installing from source.

By habit I do everything in /tmp/ so cd to that folder.

Download the rpm:
wget ftp://ftp.muug.mb.ca/mirror/redhat/contrib/libc6/i386/tac_plus-4.0.3-2.i386.rpm

Of course if you're using a Debian/Ubuntu based distro, you'll be looking for a .deb file or at least a repository that has tac_plus on it.

Install the rpm now:
rpm -i tac_plus-4.0.3-2.i386.rpm

TACACS+ is now installed and should be working fine. You can check this by running:
ps -ef | grep tac_plus

You should see something like the following:

root      6134     1  0 Aug02 ?        00:00:00 /usr/local/sbin/tac_plus -C /etc/tacacs/tac_plus.cfg
root     18325 18283  0 21:30 pts/0    00:00:00 grep tac_plus

The output also gives us a clue as to where the config file is. Go ahead and run this:
vi /etc/tacacs/tac_plus.cfg

I personally cleared this file out and started it from scratch. I believe this makes it easier for me and all the fluff is out. tac_plus gives us the option

of loading any file as a test. This is pretty handy. If you're still in /tmp/ create a new file called new_test

This is my initial config. Paste this into this new file and save (I'll go through what everything means later)

# Put your NAS key below
key = bl@hbl@hwh@t3v3r

# Accounting File
accounting file = /var/log/tac_accounting.log

# * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
# *                     USERS                             *
# * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


user = mellowd {
        login = cleartext southafrica
     #mellowd is a member of group NOC
        member = NOC
}

user = foo {
        login = cleartext bar
     #foo is a member of group NOC
        member = NOC
}

user = elvis {
     #elvis is a member of group F_OPS
        member = F_OPS
}



# * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
# *                       GROUPS                          *
# * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

group = NOC {
      #NOC is a member of group ALL_STAFF
        member = ALL_STAFF
}

group = F_OPS {
      #F_OPS is a member of group ALL_STAFF
        member = ALL_STAFF
}

group = ALL_STAFF {
}

# End config file

A pretty simple config right? I have defined 3 users: mellowd; foo and elvis. mellowd and foo are both part of the NOC group. elvis is a member of the F_OPS group. The groups themselves are part of a group called ALL_STAFF. A user will get all the benefits of their group. Groups also pick up all attributes of groups they belong to. Currently there is no config here, but this will change later.

Note that user level settings will override group settings. i.e. if I put a setting both under group and the user, the users setting will override the group setting.

Right at the top you have a key currently set as bl@hbl@hwh@t3v3r. This isn't needed but I would recommend having it. This same key would need to be on your routers and switches (We'll get to that config later)

There is also an accounting file set up. We'll get more into this later.

Now remember this file is currently saved as /tmp/new_test. How do we actually run this and test it out? First of all tac_plus allows us to check the syntax of the file which I recommend doing. You can do it like so:
tac_plus -P -C /tmp/new_test

If you have any errors it'll tell you on what line it is. (Real world tip. Open the file in vi and type :set number - This will show you line numbers)

If it passes without error it'll just show you your config and you'll be back at the prompt. This means all is okay so far.

In order to test out this file you'll need to stop the daemon from running:

[root@Log2 ~]# /etc/init.d/tacacs stop
Shutting down tacacs+:                                     [  OK  ]

Now run the daemon forcing it to both use your new file and to send out debug output as well:
[root@Log2 tmp]# tac_plus -C /tmp/new_test -d 16

I'd now tail the log file to ensure all is okay when logging on via a router:

[root@Log2 tmp]# tail -f /var/tmp/tac_plus.log
Tue Aug  4 22:54:13 2009 [18632]: Reading config
Tue Aug  4 22:54:13 2009 [18632]: Version F4.0.3.alpha Initialized 1
Tue Aug  4 22:54:13 2009 [18632]: tac_plus server F4.0.3.alpha starting
Tue Aug  4 22:54:13 2009 [18633]: Backgrounded
Tue Aug  4 22:54:13 2009 [18634]: uid=0 euid=0 gid=0 egid=0 s=0

Router configuration

Now for the router itself. I've got here a standard 2612XM. The config has been wiped. The only initial config I've done is to configure one of the interfaces so it's on the same network as my TACACS+ server.

You'll need to tell the router that it needs to use TACACS+ as authentication:

Router#conf t
Router(config)#aaa new-model
Router(config)#aaa authentication login default group tacacs+ local
Router(config)#tacacs-server host x.x.x.x
Router(config)#tacacs-server key 0 bl@hbl@hwh@t3v3r

Here we have told the router the IP address of our TACACS+ server as well as the server key that we configured on the server earlier. We have also told the router that it needs to login via TACACS+ first. I recommend allowing authentication locally after that, as if your server is down you still want to have access to your network. It�ll only check the local database if the TACACS+ server is unreachable. If authentication fails via TACACS+ the router will NOT allow you to log in.

Telnet to your router and test:

User Access Verification
Username: mellowd
Password:
Router>

If you�re still tailing on the server you should see this:
Tue Aug 4 22:55:05 2009 [18637]: login query for 'mellowd' tty66 from x.x.x.x accepted

If you�re not seeing this then there is some sort of non-connectivity between the router and the server. Make sure port 49 incoming is open on the server (check iptables)

You can also console into the router at the same time and run this and then telnet in:
Router#debug tacacs

That should give you all the information you need to figure out the problem.

Server config again
If everything is okay you need to copy your TACACS+ config file on the server over to the actual live daemon config:
[root@Log2 tmp]# cp /tmp/new_test /etc/tacacs/tac_plus.cfg

This will require a restart of the daemon itself:
[root@Log2 tmp]# # /etc/init.d/tacacs restart

That�s pretty much it done. I�d like to add a few things later. For example I�ll show the configuration on a Foundry switch/router to use TACACS+. I�ll also show you how to encrypt the passwords in the configuration file.

Showing line numbers in vi or vim

Ever changed a line of config only for the application to spit out:

FATAL: Bungled squid.conf line 716: icp_access allow localnet

How to quickly find line 716? Open your file in vi or vim and type:

:set number

This setting is not saved when you exit so the next time you open a file it'll be gone. If you need the line numbers to dissapear while still in the file type:

:set nonumber

Converting .mdf files to .iso

So you've got a .mdf file and you need to convert it to iso? No problem!

There is a handy utility called mdf2iso that will do it for you. To install it first type the following:

sudo aptitude update
sudo aptitude install mdf2iso

Now all you need to do is the following:

mdf2iso /folder/file.mdf /folder/file.iso

Substitute folder and file for whichever folder and file you need.

Easy!

Upgrading Ubuntu server 8.04 to 8.10

So you need to upgrade your 8.04 server version to 8.10? Easy!

First of all, I wouldn't suggest you try any upgrade unless your server is fully backed up, BACK IT UP!

You'll need to first install the update manager (it might already be installed)
sudo aptitude install update-manager-core

As 8.04 is a LTS version, we need to let ubuntu know that we want to move out of lts and into the regular branch. Do that by editing this file:
sudo vi /etc/update-manager/release-upgrades

Look for the line the says, prompt=lts. Change it to this:
Prompt=normal

Save the file (:wq!)

Now finally, type this:
sudo do-release-upgrade

Converting .FLAC files to high quiality .MP3 files with only one command

So you have your nice lossless audio all compressed into FLAC. How do you quickly convert them to high quality mp3's to stick on your ipod or some other mp3 player? I've written a script below that will do it for you in one easy step. It takes a few steps to set it up first, but once it's done you'll only ever need to type one command.

First, you'll need to install FLAC and lame 3.97

sudo aptitude install flac

sudo aptitude install lame

As of this writing the Ubuntu repositories still has lame 3.97 as the current. I've configured my script to take advantage of the new vbr algorithm with the --vbr-new switch. When the repositories are updated or you compile lame 3.98 yourself, edit the script to comment in the v3.98 line and comment out the v3.97 line

Now you'll need to get my script. Change to the /bin folder like so:

cd /bin

now type this:

wget www.mellowd.co.uk/scripts/encode

Now you'll need to make that file an excecutable like so:

chmod +x encode

Now all you need to do is go into the folder that has your flac files and type:

encode

The script will decode all the .flac files to .wav in a new subfolder, stripping the .wav suffix. It will then run lame to create mp3's in a new folder in the original folder using the -q0 setting which is the nest VBR setting available with lame. It will then delete all the .wav files and subfolder and finally it will add the .mp3 suffix to all your new mp3's.

When it's complete you'll have an mp3 folder in your original folder, full of high quality mp3's

This is the contents of the current script itself as of today:

# Encode
# v0.2 18.08.08 - Second draft, changed the default to lame 3.97 as this is what's in the Ubuntu repositories
# v0.1 17.08.08 - First created
# Darren O'Connor 

# This script, when run in a folder full of FLAC files, will create high quality VBR mp3's for use in mp3 players.
# This version uses lame 3.98 and 3.97. Please edit out the appropriate line below (Don't leave them both in!)

#!/bin/bash
mkdir wav/
flac -d *.flac
mv *.wav wav/
cd wav/
for f in *.wav; do mv "$f" "${f%.wav}";done
mkdir ../mp3/

# If you use lame 3.98 then comment IN the next line and comment out the following line
# find -maxdepth 1 -type f -name '*' -exec lame -V0 -q0 '{}' -o '../mp3/{}' \;

# If you use lame 3.97 then comment IN the next line and comment OUT the previous line
find -maxdepth 1 -type f -name '*' -exec lame --vbr-new -V0 -q0 '{}' -o '../mp3/{}' \;

cd ../mp3/
for FILE in *; do mv "$FILE" "$FILE.mp3"; done
cd ../
rm -r wav/

Setting up a terminal server on a cisco device

I've been practising a lot of various BGP/OSPF/EIGRP and IS-IS things at work. I've set up a lab there which will allow me from home to access all of these devices through their console ports without actually sitting in front of them.

In order to do that I've used an old 2600 with a 32 port async serial card. It's a very simple config and I've pasted it here:

! version 12.2 service timestamps debug uptime service timestamps log uptime service password-encryption ! hostname TerminalServer ! enable secret 5 ! ip subnet-zero ! ! no ip domain-lookup ip host R7 2048 192.168.1.1 ip host R5 2037 192.168.1.1 ip host R1 2033 192.168.1.1 ip host R2 2034 192.168.1.1 ip host R3 2035 192.168.1.1 ip host R4 2036 192.168.1.1 ip host R6 2038 192.168.1.1 ip host S1 2039 192.168.1.1 ip host S2 2040 192.168.1.1 ! call rsvp-sync ! ! ! ! ! ! ! ! interface Loopback0 ip address 192.168.1.1 255.255.255.0 ! interface FastEthernet0/0 ip address duplex auto speed auto ! ip default-gateway ip classless ip route 0.0.0.0 0.0.0.0 no ip http server ! ! dial-peer cor custom ! ! ! ! line con 0 line 33 64 no exec transport input all line aux 0 line vty 0 4 exec-timeout 60 0 password 7 login line vty 5 15 exec-timeout 60 0 password 7 login ! end

There are a few important things to note here. You need to set up an IP address on a loopback interface. I've used 192.168.1.1 on this example.

You then set up IP hosts in this format:
ip host R1 2033 192.168.1.1

R1 = The name I want to refer to the device, this case beig the first router.
2033 = The serial port. The serial port will be 2000 + the serial port number. 33 being my first serial port. (It could be different on yours, I'll add how to check at the end)
192.168.1.1 = The loopback interface. It doesn't matter which address you use, but I'd put on a private address.

The second important part is this:
line 33 64 transport input all

line 33 - 64= The available port on the async card I've used.
transport input all = Allow all protocols (including telnet) through these lines.

You need to check which ports are available on your router. Check to see if those ports are recognised in the first hand by doing a simple show ver

1 FastEthernet/IEEE 802.3 interface(s)
32 terminal line(s)
32K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read/Write)

This particular device has 32 terminal lines, through the add on card. If the router has these ports built in it will be slightly different. Cisco reserves the first 32 lines for built-in ports, whether the router has it or not. As this router has an add-on card, I can't use the first 32 lines. If I try I'll get this:

#line 1 No physical hardware support for line 1

A quick way to check which lines are available is to type this:

show line


TerminalServer#sh line
   Tty Typ     Tx/Rx    A Modem  Roty AccO AccI   Uses   Noise  Overruns   Int
     0 CTY              -    -      -    -    -      0       0     0/0       -
    33 TTY   9600/9600  -    -      -    -    -      1      15  2828/8487    -
    34 TTY   9600/9600  -    -      -    -    -      1      21  2846/8541    -
*   35 TTY   9600/9600  -    -      -    -    -      0      18  3112/9338    -
*   36 TTY   9600/9600  -    -      -    -    -      0      44  3363/10099   -
*   37 TTY   9600/9600  -    -      -    -    -      0      11  3085/9254    -
*   38 TTY   9600/9600  -    -      -    -    -      0      11  3149/9446    -
*   39 TTY   9600/9600  -    -      -    -    -      0       0  3303/9905    -
*   40 TTY   9600/9600  -    -      -    -    -      0       0  3266/9800    -
    41 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    42 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    43 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    44 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    45 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    46 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    47 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
*   48 TTY   9600/9600  -    -      -    -    -      0       0  3319/9957    -
    49 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    50 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    51 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    52 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    53 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    54 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    55 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    56 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    57 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    58 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    59 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    60 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    61 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    62 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    63 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    64 TTY   9600/9600  -    -      -    -    -      0       0     0/0       -
    65 AUX   9600/9600  -    -      -    -    -      0       0     0/0       -
*   66 VTY              -    -      -    -    -      6       0     0/0       -
    67 VTY              -    -      -    -    -      1       0     0/0       -
    68 VTY              -    -      -    -    -      0       0     0/0       -
    69 VTY              -    -      -    -    -      0       0     0/0       -
    70 VTY              -    -      -    -    -      0       0     0/0       -
    71 VTY              -    -      -    -    -      0       0     0/0       -
    72 VTY              -    -      -    -    -      0       0     0/0       -
    73 VTY              -    -      -    -    -      0       0     0/0       -
    74 VTY              -    -      -    -    -      0       0     0/0       -
    75 VTY              -    -      -    -    -      0       0     0/0       -
    76 VTY              -    -      -    -    -      0       0     0/0       -
    77 VTY              -    -      -    -    -      0       0     0/0       -
    78 VTY              -    -      -    -    -      0       0     0/0       -
    79 VTY              -    -      -    -    -      0       0     0/0       -
    80 VTY              -    -      -    -    -      0       0     0/0       -
    81 VTY              -    -      -    -    -      0       0     0/0       -

Line(s) not in async mode -or- with no hardware support:
1-32

That output will straight away tell me which lines I can and cannot use

Converting .daa files to .iso files

so you've just downloaded a .daa file and want a quick easy way to convert it to a .iso image?

First you need the freeware poweriso application:

sudo wget http://poweriso.com/poweriso-1.1.tar.gz

Extract it like so:

sudo tar -zxvf poweriso-1.1.tar.gz

Then convert like so:

./poweriso convert /folder/file.daa -o file.iso -ot iso

Substitute your file and folder names for the above.

Job done!

Finding which hardware you've got

Let's say you need to list all your current hardware, or maybe you just need to know what type of network card you got? Easy!

sudo lshw

this will simply list all your hardware. If there is way too much to take in and it scrolls off you can do one of two things, either this:
sudo lshw >> /home/yourname/hardware.log
vim /home/yourname/hardware.log

This will shove the output into a file called hardware.log in your home directory which you can then view with vim or your favourite text editor.
On the other land, let's say you only need to know what network card you have. You can do it like so:
sudo lshw -C Network

This command will simply only display the network part of the output. Change network to whatever you need to see.

Check folder size

Need a quick way to check the size of any folder from the terminal?

du -hs /folder/

-h will show it in human readable format as opposed to block size, and -s will give you a summary.