PowerBook Off To Apple For Repair

It’s been almost two months since a shelf fell down and hit my recently aquired PowerBook. I finally called Apple again to make arrangements to send it for repair. The cost estimate is still just under $700, with the possibility that it could be higher if they find that other parts also have to be replaced. The turn around time is supposed to be about a week. How sad it is that at a time when I should be looking forward to the features of the upcoming release of Mac OS X 10.4 (Tiger) I’m praying that my PowerBook comes back from it’s repair trip as good as new.

Update (4:53pm 30 Jun 04): I just got an email from Apple indicating that they have recieved my PowerBook and repairs have begun. Since it made it to Houston, Texas so quickly now I wondering if I should hope for to be back in my hands on Friday. That’s probably too much to ask for, I think Tuesday is more likely since Monday is a holiday.

Update (8:05am 1 Jul 04): Another email from Apple support, dated 30 Jun 04 at 6:50pm. The repair has been completed and my “product” is on the way back. Here’s to hoping it makes it back to the office by the end of the work day on Friday.

PHP over XML-RPC

If you’ve followed Tim O’Reilly‘s theme for the last few years, the Internet Operating System, then maybe you are also wondering what sort of steps will be needed to really make such things possible. Back in October 2003 he listed a few “basic” features revolving around the idea that all applications should be network aware. It was thinking with these things in mind that I came up with what seemed to be a simple idea, what if you could expose an entire programming language (more or less) as a web service? Let me scale that back a bit, what if you could expose all of the functions for a programming language as a web service? Would doing so even be possible without a lot of hand holding in the code? So just to see where that might go I wanted to try it out.

I’m doing most of my work lately in PHP so I picked that as my target. Right off the back PHP saved me a lot headache by making use of get_defined_functions() to get a list of PHP’s functions (along with any user defined functions). There are plenty of XML-RPC PHP libraries out there, for this project I went with Simon Willison‘s nicely done XML-RPC library for PHP. I did have to make one small change, I removed the method signature enforcement from the IXR_IntrospectionServer class because I had no way of determining what the correct signature should be for each function without writing customer code for each function, which I didn’t want to do. It’s a fairly small change, you can grab my modified version if you want to try this at home. The PHP over XML-RPC server simply goes through all of the PHP functions and adds callbacks for each one. All of the internal PHP functions are under php.* and user defined functions are under php_user.*. Take a quick look at it, it gets the job done in about 30 lines of code.

So what can you do with such a beast? An over simplification is that you can now access all of the internal PHP functions. A more correct analysis would be you can access all of the PHP functions, but some of them aren’t very useful over XML-RPC, like database functions. Other functions work but have reduced functionality, like preg_match which can optionally populate an array with matches from the given regular expression. That doesn’t work in our case because we can only return one value. Getting the return value works fine, but to make the match array work would require code to deal with exactly that function, which something I was trying to avoid. Here is a client example that does work as expected, calling PHP’s strlen:

##
## PHP over XML-RPC client
##
require('./IXR_Library.inc.php');
$client = new IXR_Client('http://localhost/php-rpc/server.php');
if(!$client->query('php.strlen', 'teststring')) {
    print("Error: (" . $client->getErrorCode() . ") " .
        $client->getErrorMessage());
    exit();
}
print("PHP over XML-RPC: php.strlen('teststring'): ");
print($client->getResponse());


The big downside for something like this is speed, using XML-RPC adds considerable overhead. In my simple benchmarks for strlen('teststring'), natively it takes about 0.0000730 seconds, using PHP over XML-RPC it takes about 0.1438220 seconds. I’m sure that this could be made to vary by either using different XML-RPC libraries or moving to something completely different like SOAP. I doubt that either of those options would increase the speed much. The speed hit is simply too much to take, but this was all just an experiment anyway.

It might be interesting to see what it would take to create structures that would support database operations. This would increase the complexity of the server but would add some useful possibilities. If you didn’t like the Java approach to your database you could use PHP’s database functions over XML-RPC. The speed hit would still be the killer hold up making this realistic though.

Active Directory With nss_ldap And pam_ldap On FreeBSD

UPDATE Tue 8 Nov 2005 4:05pm: If you are interested in using Active Directory users and groups on FreeBSD please read the updated version of this post: FreeBSD Users and Groups with Samba (Winbind) and Active Directory. This updated version doesn’t have the LDAP requirements that his how to does.


Back in January of I had mentioned using SFU with nss_ldap on FreeBSD on my old blog. Now that I’ve got a couple of fresh Windows 2000 servers with Active Directory and SFU (Windows Services For Unix) I figured now was a good time to write a howto on making FreeBSD use nss_ldap and pam_ldap in conjunction with Active Directory. I’m using Windows 2000, SFU 3.5, FreeBSD 5.2.1-RELEASE, nss_ldap 1.204_5 and pam_ldap 1.6.9 for this write up.

  1. Windows: Have Active Directory up and running. If you are starting from scratch you may want to look at my entry on installing a new Windows 2000 server.
  2. Windows: Have SFU installed, specifically ‘Server for NIS’. Installing that will alter the Active Directory LDAP schema and add a ‘Unix Attributes’ tab to the user properties window.
  3. Windows: Add unix attributes to groups and users that you need to use via nss_ldap.
  4. FreeBSD: Install net/nss_ldap and security/pam_ldap from the FreeBSD ports collection.
  5. FreeBSD: Create the file /usr/local/etc/ldap.conf, add the following (using your own info instead of the example.com info):
    uri ldap://yourldapserver.example.com/
    base dc=example,dc=com
    ldap_version 3
    binddn administrator@example.com
    bindpw AdminPasswordHere
    scope sub
    pam_login_attribute msSFU30Name
    pam_password ad
    nss_base_passwd cn=users,dc=example,dc=com?one
    nss_base_group cn=users,dc=example,dc=com?one
    nss_map_objectclass posixAccount User
    nss_map_attribute uid msSFU30Name
    nss_map_attribute uidNumber msSFU30UidNumber
    nss_map_attribute gidNumber msSFU30GidNumber
    nss_map_attribute loginShell msSFU30LoginShell
    nss_map_attribute gecos name
    nss_map_attribute userPassword msSFU30Password
    nss_map_attribute homeDirectory msSFU30HomeDirectory
    nss_map_objectclass posixGroup Group
    nss_map_attribute uniqueMember posixMember
    nss_map_attribute cn sAMAccountName
    
  6. FreeBSD: Restrict access to /usr/local/etc/ldap.conf with chmod 400 ldap.conf.
  7. FreeBSD: Create a symlink for /usr/local/etc/nss_ldap.conf pointing to /usr/local/etc/ldap.conf (ln -s ldap.conf nss_ldap.conf). You can use two different config files, but in this example I’m putting everything in one file.
  8. FreeBSD: Create the file /etc/nsswitch.conf, add the following:
    passwd: files ldap
    group: files ldap
    
  9. FreeBSD: In /etc/pam.d add the following line to the service files (in the auth section of each file) that will need to use ldap authentication, likely targets would include sshd, imap, ftpd and other.
    auth            sufficient      /usr/local/lib/pam_ldap.so
    

That’s it, at this point your FreeBSD system should know about Active Directory users and groups and also authenticate those users against Active Directory. You can test it by using finger or id for an Active Directory user that has unix attributes. Remember to include an auth line for pam_ldap in every service that will need to authenticate users.

Even though everything works at this point, there are still a couple of things to be aware of. First off, all of the ldap traffic is in the clear on the network. Wrapping up all of that traffic in SSL would be a good idea. There are a couple of different ways to do that, that will have to wait for another post though. Also, there are no home directories created for users. If you expect an Active Directory user to ssh into your FreeBSD box then you’ll want to create their home directory and give it correct permissions. There are a couple of pam modules floating around that support automatic creation of home directories, but as far as I know they haven’t been ported to FreeBSD (see pam_mkhomedir for Solaris and Linux-PAM which has a linux version of pam_mkhomedir). Leave a comment if you find (or do it yourself) a pam_mkhomedir that works with FreeBSD, I’ll be happy to include it in this howto.

I'm Old

This week my body let me know that I’m officially old. I started running with a friend mine early in the morning before work this last week. I knew I was out of shape (the asthma doesn’t help I suppose), so it was going to be a bit of a challenge. After just one week the right side of my hip joint is sore. With turning 31 last May combined with a sore hip after one week of running, I think I’m now officially old :-(

Software For A New Windows 2000 Server

At work I’m putting together a couple of fresh Windows 2000 servers, mostly just to be fancy ldap servers, but that’s another story. I wanted to note what software (and version as of this writing) I’m installing so that I’ll have it around if I ever (please NO!) have to do this again.

  1. During the Windows install
    • Included DNS, Internet Authentication Service (radius support) and WINS under ‘Networking Services’.
    • Included Print Services for Unix under ‘Other Network File and Print Services’.
  2. Go through Windows Update madness. It’s no fun, takes forever, but you’ve got to do it. Now that I’m thinking about it, why isn’t there an option for your windows box to email you when it has downloaded a new critical update?
  3. Anti-Virus Software. At work we’ve purchased McAfee.
  4. Firefox version 0.9. IE is really only good for the Windows Update service, after that it is Firefox all the way.
  5. SSH Client. There are a couple of different options, since we are attached to CSU Sacramento I’ve been using SSH Communications ssh client under their non-commercial license. Looks like licensing may have changed for version 4 of their product, so were are sticking with version 3.2.9. There are other Windows ssh clients out there, Putty is probably the next in line.
  6. WinZip. Work purchased licenses ages ago, so I’ve been using that version, 8.0.
  7. TightVNC for remote admin. I’m even living on the edge by using version 1.3-dev5 with the DFMirage driver.
  8. Optional: Install Active Directory if this server is going to hold domain user accounts. With this particular install that is the case.
    • I selected ‘Permissions compatible with pre-Windows 2000 servers’ on the permissions screen in the wizard. I believe this makes life a little easier when getting Samba to play nice with Active Directory. It’s also the default option.
  9. Optional: Install Windows Services for Unix version 3.5. There are all softs of goodies in here. In my case the only part that I’m interested in is the ‘Server for NIS’ because that extends the Active Directory ldap schema for users. That allows me to use things like nss_ldap on un*x boxes.
    • To just get ‘Server for NIS’, do a customer install of SFU and make sure that everything is deselected (X’ed out) except for ‘Server for NIS’.

As I mentioned, these Windows servers will just be storing user accounts so I’ve kept everything to a minimum. Ideally I’d like to have all of our users accounts stored on a unix box somewhere, but to make all of the Windows client systems and servers happy, having a ‘real’ Windows server seems to be the only way. Don’t get me wrong, Samba has come a long way, and I’ll continue to use it, just not for holding domain user accounts. In the end the most important goal is now able to be meet: keeping one set of user and group accounts. With NSS support in FreeBSD 5.x making use of those accounts is now possible, thanks to nss_ldap and pam_ldap.