Centos5 LDAP Woes
So it appears my problem was CentOS 5 itself. I made the exact same config on CentOS 4.4 and didn't have any problems.
Looks like all of my VMWare Servers will be rebuilt with CentOS 4.4. I'm going to try to make a test environment in CentOS 5 (in VMWare, oddly enough) to see if I can track down the problem further and then attempt to open up a ticket with the CentOS devel team.
VMWare Server Project
And here beings the tech portion of the blog.
We're rolling out the first phase of our virtualization project. We're going with VMWare Server (their free product - used to be GSX Server) and (hopefully) VMWare VirtualCenter (centralized management of GSX.) We bought five Dell Poweredge 1950's with dual quad core Xeon's, 16GB RAM, 136GB 15k SAS drives, and TOE nics.
The servers are all racked, and we went ahead and loaded CentOS 5 64 bit. Everything went well, and I loaded VMWare Server on all of the boxes.
I wanted to see if I could get VMWare to authenticate against our Active Directory. Since I have a fleet of Red Hat and CentOS boxes that do that I figured it would be pretty easy. Just install OpenLDAP, put a SSL cert on the box, setup the ldap and PAM config files, and voila. Well, it turned out to be not so easy.
First off, there was some weird problem with the architecture of the OpenSSL RPM's that ship on CentOS by default. It seems that the OpenSSL x86_64 package gets loaded, but when you try to load OpenLDAP, it wants to install OpenSSL.i686, and the two packages conflict on man pages. It's apparently a bug in CentOS (Red Hat?) with a pretty lousy "workaround" that doesn't help if you're trying to load something like OpenLDAP. The weird thing is, I had some boxes that would show (presumably) both arch versions of OpenSSL installed by default:
[root@vmsvr2 ~]# rpm -q openssl
openssl-0.9.8b-8.3.el5
openssl-0.9.8b-8.3.el5
and others that would show it only having one:
[root@vmsvr3 ~]# rpm -q openssl
openssl-0.9.8b-8.3.el5
The boxes are all identical, and built at the same time. The only thing that I can think of that differed was that I did a text mode install on vmsvr2 and a graphical on vmsvr3. I reinstalled CentOS in text mode on vmsvr3 and 4 and they both ended up getting both the i686 and x86_64 versions loaded during the install.
Finally, I got LDAP authentication working on two of the boxes, but on vmware4 when you try to log in, LDAP authenticates you (can be seen in tcpdump as well as in /var/log/secure) but then the login hangs. I attempted an strace today, but being a newbie to that I am going to have to ask some more experienced people tomorrow.
I wish I had accomplished more today. I spent a lot of effort to not make much headway. I'm beginning to wonder if I should have stuck with CentOS 4.4 64 bit for this project. There's too many stupid, weird things going on with CentOS 5.
The good news is that VMWare with authenticate against LDAP for the boxes that do allow me to log in, which will be nice so I don't have to give out the root password on all of the vmware boxes.
Selling a House Sucks
I suppose this will be the first "real" blog entry.
I'm selling my house. I've been in this ~1200 sq. ft. ranch in Brick, NJ since I closed on my birthday, January 25, 2001. I've done a moderate amount of work to it, but the entire time I've owned it I haven't wanted to put too much effort into a plain and (in my opinion) boring ranch. Here's a rundown of what I have done:
- Replaced most of the carpet with laminate. I love hardwood floors but I just couldn't afford to install them here. And again, why invest the money into a ranch? I got a great deal on a Pergo clone at BJ's and have done most of the house - with the exception of the master bedroom - in it. It's worn quite well, although in some areas it has started to pull apart. I think I can fix those relatively quickly with a few taps of the hammer.
- Removed "old lady" wallpaper. When I moved in, there was this godawful white with silver thread wall paper in the old living room (which has since become my dining room.) I painted the two opposite walls grey, and left the other opposite walls and the hallway the original white.
- Installed wainscotting in the dining room and hallway. The walls here aren't that great, and when we got our small dog Zoe she made fast work of a lot of the lower surfaces of the walls. I put birch plywood wainscot panels up, and put some trim up. That sat for about a year, and now (June '07) I am re-doing some of the trim - now that I have a nice compound mitre saw and can cut angles - and may paint all of the trim and panels high gloss white.
- Turned the 2nd bedroom into a nursery. We obviously needed a place to keep our baby when not in use. I ripped out the brown shag carpet, put more matching laminate down, and painted the walls a pale pink, and repainted all of the trim white.
- Installed a new kitchen. The old cabinets, while sturdy, were dated. The weird looking old lady white countertop had to go. I spent about $7000 in new cabinets and countertop at Home Depot. We also added a dishwasher and a new sink and hardware. Recently I put up a plastic copper tin-panel backsplash. It's really done wonders for the house. Plus having a dishwasher is very convenient.
- Paver Walkway. I made the mistake of hiring a "mason" off of Craigslist to install a paver walkway. I'm not really impressed with the results, but it does save the lawn from some foot traffic. Not that the lawn is anything great to look at.
We put the house on the market for $285,000. We haven't had any bites on it yet. This could be due to our real estate agent virtually disappearing, or due to our house being too expensive. I'm going to lower the house in the next week or so. Maybe we'll get some bites at $270k? Either way, we may fire our agent and go with a new one. Here's a hint - don't hire a friend to sell your house.
Friday, after work, we're going to look at a old colonial house in New Egypt. We're going to see how long it takes to get there from here (and thus see how far Laura will have to drive to get to the gym). The commute to Manhattan should be the same, or a little bit better. The house needs a lot of work (new roof, possibly new heating system, closing up an underground oil tank, etc.) but if we can get it cheap, we'll have a lot of money to invest into the house to restore it. And when we're done, the house will be worth a lot of money.
Blog Started Anew
I decided to restart the blog. It seems to be the new thing to do, since all of my co-workers now seem to have them.
I originally wanted to write a tech blog, and perhaps some of my posts will be tech related, but for now I think it will be mostly personal.