My notes, things I have learned, and documentation I have created.

Let me just preface this post by saying “This is not a persistent configuration. If you boot the system, these settings will be lost unless you save them via the /etc/sysconfig/network-scripts files or through NetworkManager.

Here is how you can manually configure the IP address and gateway in CentOS/RHEL7:

Configure the IP address and subnet mask:

# ip addr add aaa.bbb.ccc.ddd/ss dev interface

For example:

# ip addr add 123.123.123.123/24 dev eno1

Likewise, to remove the IP address:

# ip addr del 123.123.123.123/24 dev eno1

To configure the default gateway:

# ip route add default via ddd.ccc.bbb.aaa dev interface

For example:

# ip route add default via 123.123.123.254 dev eno1

Same kind of thing to remove the currently configured gateway:

# ip route del default via 123.123.123.254 dev eno1

Once you have the interface configure, bring it up:

# if link set eno1 up

And to take it down:

# if link set eno1 down

The following procedures were used on RedHat Enterprise Linux 5.x.

The following previous post outlined how to get the linux server joined to domain and supporting ADS authentication. This link also contains information for RHEL6.x in the comments as well :

Howto Join An Active Directory Server using RHEL5.x/CentOS5.x and Samba 3.0.x

The key is getting the /etc/squid/squid/conf right. I have included the entire configuration used. A lot of the options are not required in all situations. I have a number of things going on here. Many of which I could clean up and make better, but I wanted to leave them in here because I know this configuration works. I actually have three proxy servers (two peers) in the configuration. The configuration forwards the requests to one of the two peers based upon the site accessed. This is probably not required for most deployments.

# cat /etc/squid/squid.conf

half_closed_clients off


The .acl files listed in the configuration are either just a list of usernames (ADS or otherwise), or a list of domains. In the case of the domains, you can use the following syntax to signify all host for a particular domain:

.mydomain.com


Below, I have tried to strip out the other things to demonstrate all that is needed to support proxy access via ADS group membership.

Excerpts from /etc/squid/squid.conf:
auth_param ntlm program /usr/bin/ntlm_auth --helper-protocol=squid-2.5-ntlmssp
auth_param ntlm children 10
auth_param ntlm keep_alive on
...
# Begin Group
external_acl_type WindowsGroup ttl=60 children=5 %LOGIN /usr/lib/squid/wbinfo_group.pl
# End Group
...
# Begin Group
acl InWindowsGroup external WindowsGroup ProxyAccess
acl InLocationsWindowsGroup external WindowsGroup ProxyAccessLocations
# End Group
...
# Begin store access test.
acl LocationAllowedSites url_regex -i "/etc/squid/LocationAllowedSites.acl"
acl LocationRestrictions dstdomain "/etc/squid/LocationRestrictions.acl"
# End store access test.
...
acl MyACL proxy_auth REQUIRED
...
# Begin Group
http_access allow InLocationsWindowsGroup LocationAllowedSites !LocationRestrictions
http_access allow InWindowsGroup
# End Group
...

Also, if you want to customize the default access denied page that users receive when they go to a site that they are not permitted to access, you can add you customizations to the /usr/share/squid/errors/English/ERR_ACCESS_DENIED file. I believe you can do a number of other creative things with error pages, but I have not looked in to that.

If you want to add/remove sites from the files, you just need to issue a “service squid reload” to activate the new settings.

I started looking into Hyper-V, and learned something quick. I installed Windows 2008 R2 Hyper-V on a server. Then, I used a Windows 7 client to access the host via the Hyper-V Manager. I created a virtual machine and installed an operating system, but found that I had no network connection. I had to configure the host network interfaces via the Hyper-V Manager Virtual Network Manager. Once I did this, I was able to adjust the network interface on my virtual machine to use the newly configured interface.

Installing RHEL6 on a Hyper-V server presented some new challenges as well. I was able to install the OS easily enough. The problem came when I actually tried to use it. There was no virtual network interface card driver loaded. I had to download and install the Linux Integration Services software from Microsoft. It is a 2.2MB ISO image, so you can either put it on CD/DVD, mount it from a flash drive or use it as your virtual CD drive (which I did).

From the RHEL6 VM:
# cd /media # If /media is the mount point you used.
# ./install.sh
# shutdown -r now

Now, in my case, I did a minimum install, so maybe it is different when you do a basic install, but I had to manually create the ifcfg-eth0 and network files. For now, I just wanted to get on the network, so I used a DHCP client configuration.

# vi /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
BOOTPROTO=dhcp
ONBOOT=yes

# vi /etc/sysconfig/network
GATEWAY=192.168.0.1

# service network restart
or
# shutdown -r now
or
# ifup eth0

mount.cifs has been moved from the samba-client package, for recent Redhat variants, to cifs-utils. I have been stung by this a couple times, so I figured I would note it here.

I used the following procedures to enable core dumps in RHEL6.

# vi /etc/security/limits.conf
…
#* soft core 0
* soft core unlimited
…

# vi /etc/sysctl.conf
…
kernel.core_pattern = /tmp/core-%e-%s-%u-%g-%p-%t
fs.suid_dumpable = 2
…
Note:
%e is the filename
%g is the gid the processs was running under
%p is the pid of the process
%s is the signal that caused the dump
%t is the time the dump occurred
%u is the uid the process was running under

# vi /etc/sysconfig/init
…
DAEMON_COREFILE_LIMIT=’unlimited’
…

# sysctl -p

To install the public release key:

rpm –import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

This allows you to install from the local source. For me, I had copied all the packages from the RHEL5 CDs to a directory to use “yum localinstall.” Importing the key as outlined above enabled me to install the packages without getting the following error:

warning: rpmts_HdrFromFdno: Header V3 DSA signature: NOKEY, key ID 37017186