Email Available Updates for Debian

Before you proceed below please check:

• Simple apt daily update script, see here.
• Configure exim4 to send messages by smarthost, no local mail, see here.

We are going enhance daily update script by ability to send a list of new updates to mail.

#!/bin/sh

mailto=debian-updates@dev.local

# Download only; package files are only retrieved, not 
# unpacked or installed.
apt-get -dqq update
apt-get -dyqq upgrade

has_upgrades=$(apt-get -s upgrade | grep ^Inst)
if [ "$has_upgrades" ] ; then
    echo "$has_upgrades" | mail -s \
    "Updates for $(hostname) on $(date +%Y-%m-%d)" \
    $mailto
fi

Alternatively consider using apticron, read more here.

Configure exim4 to send messages by smarthost, no local mail

This option of exim4 configuration is suitable for a client system which is not responsible for a local e-mail domain. All locally generated e-mail is sent to the smarthost.

• Smarthost FQDN: mail.dev.local
• Client: deby01.dev.local

Here are few simple steps to configure:

1. The easiest way is to reconfigure exim4-config package:

   dpkg-reconfigure exim4-config
   

2. General type of mail configuration:
      mail sent by smarthost; no local mail
   System mail name:
      deby01.dev.local
   IP-addresses to listen on for incoming SMTP connections:
      127.0.0.1
   Other destinations for which mail is accepted:
      deby01.dev.local
   Visible domain name for local users:
      deby01.dev.local
   IP address or host name of the outgoing smarthost:
      mail.dev.local
   Keep number of DNS-queries minimal (Dial-on-Demand)?
      No
   Split configuration into small files?
      No
   

Let verify it is working:

echo "test message" | mail -s "test" user1@dev.local

... exim4 log (file /var/log/exim4/mainlog):

1PmoNq-0001or-55 <= root@deby01.dev.local H=deby01.dev.local (localhost) [192.168.XX.XXX] P=esmtps X=TLS1.0:RSA_AES_256_CBC_SHA1:32 S=715 id=E1PmoNq-0001f6-08@localhost
1PmoNq-0001or-55 => user1  R=local_user T=maildir_home
1PmoNq-0001or-55 Completed

At this point user1 should be able to receive your test message.

How to setup LDAP DNS Discovery

LDAP DNS discovery can simplify the client hosts setup. The following need to be added to zone file.

$ORIGIN dev.local.
_ldap._tcp  IN SRV 10 0 389 ldapk1
_ldap._tcp  IN SRV 20 0 389 ldapk2

The client configuration can now look like this (file /etc/ldap/ldap.conf):

# BASE    dc=dev,dc=local
# URI     ldap://ldapk1/

Let test it:

host -t SRV _ldap._tcp

Troubleshooting: dbus-daemon nss_ldap failed to bind to LDAP server

While installing Debian OpenLDAP client with Kerberos (see here) on Gnome desktop you might experience the following errors in auth.log.

dbus-daemon: GSSAPI Error: Unspecified GSS failure.  Minor code may provide more information (Credentials cache file '/tmp/krb5cc_101' not found)
dbus-daemon: nss_ldap: failed to bind to LDAP server ldap://ldapk1.dev.local/: Local error
dbus-daemon: nss_ldap: could not search LDAP server - Server is unavailable

At the same time you will might see a number of errors reported by slapd:

slapd: conn=2806 op=0 UNBIND
slapd: conn=2806 fd=27 closed
slapd: conn=2807 fd=27 ACCEPT from IP=192.168.XX.XXX:XXXXX (IP=0.0.0.0:XXX)

The problem is related to parallel boot of your system. By default dbus and nscd are started in parallel, the problem appears when dbus is launched before nscd daemon. In order to fix that you need to change boot sequence. Make sure you have the following in /etc/init.d/dbus (notice line Should-Start):

# Provides:          dbus
# Should-Start:      nscd
# Required-Start:    $remote_fs $syslog

Once above is done simple re-enable dbus service so it updates everything necessary:

rcconf --off dbus ; rcconf --on dbus

Notice changes in /etc/rc2.d:

# ls /etc/rc2.d/
S17nscd ... S18dbus

You need restart your computer (or at least restart dbus daemon) in order changes take place.

Debian OpenLDAP client with Kerberos

Before we proceed with client setup (let assume our client machine name is deby01.dev.local) you need to setup the following:

• Kerberos Client (look here).

Once the basic installation of the above is complete, here we go:

1. We need install few packages:

   apt-get -y install ldap-utils libpam-ldap \
   libsasl2-modules-gssapi-mit nscd libnss-ldap kstart
   

   During installation you will be prompted for few questions:
   • libnss-ldap

     LDAP server URI: ldap://ldapk1.dev.local/
     Distinguished name of the search base: dc=dev,dc=local
     LDAP version to use: 3
     cn=admin,ou=people,dc=dev,dc=local
     LDAP account for root: cn=admin,ou=people,dc=dev,dc=local
     LDAP root account password: <just hit enter>
     

   • libpam-ldap

     Allow LDAP admin account to behave like local root? No
     Does the LDAP database require login? No
     

2. Reconfigure libpam-runtime and disable LDAP Authentication:

   dpkg-reconfigure libpam-runtime
   

3. Configure kstart, add the following to /etc/inittab (It will check every 10 minutes of the Kerberos ticket needs to be renewed and set the ticket lifetime to 24 hours:

   KS:2345:respawn:/usr/bin/k5start -U -f /etc/krb5.keytab -K 10 -l 24h
   

   Force init to reload configuration:

   kill -HUP 1
   

   Ensure /tmp/krb5cc_0 file is created:

   ls -lh /tmp/krb5cc_0
   

4. Kerberise libnss-ldap (file /etc/libnss-ldap.conf), ensure the following:

   base dc=dev,dc=local
   uri ldap://ldapk1.dev.local/
   ldap_version 3
   rootbinddn cn=admin,ou=people,dc=dev,dc=local
   
   # Use SASL and GSSAPI and where to find the 
   # Kerberos ticket cache.
   use_sasl        on
   sasl_mech       gssapi
   krb5_ccname FILE:/tmp/krb5cc_0
   

5. Set defaults for LDAP clients (file /etc/ldap/ldap.conf). Note client configuration changes if ldap is configured via SSL (see here).

   BASE    dc=dev,dc=local
   URI     ldap://ldapk1.dev.local/
   SASL_MECH GSSAPI
   

6. Add LDAP support for login process by nscd (file /etc/nsswitch.conf):

   passwd:         compat ldap
   group:          compat ldap
   shadow:         compat ldap
   

7. Restart Name Service Cache daemon:

   /etc/init.d/nscd restart
   

8. Configure PAM to automatically create a user home directory (file /etc/pam.d/common-session):

   session  required  pam_mkhomedir.so
   

You should be ready to login with a user created in LDAP and password set in Kerberos.

Troubleshooting

• You might experience the following error while initializing kerberos ticket in Debian Gnome desktop:

  Cannot resolve network address for KDC in realm DEV.LOCAL
  

  This somehow conflicts with avahi-daemon, you will need disable it:

  rcconf --off avahi-daemon
  

• If you are using Debian Gnome desktop, have a look at Troubleshooting: dbus-daemon nss_ldap failed to bind to LDAP server, that you can find here.