Ok first off let me start by saying that this is probably the coolest piece of home computing hardware that I have ever laid my hands on. Yes the setup was easy, and yes the thing is rock solid, and yes wireless range is awesome. But for approx $200 USD you really should not expect anything less. I’m not going to go into its specs or features, as I’ll leave that to the professionals. Read up on it here.

Anyway out of the box it supported telnet, but I wanted ssh, so I dropped the default firmware and went with Asuswrt-Merlin. It was at this point I started to explore the Busybox OS and decided I wanted to monitor the device via my HomeLab Zenoss install.

However, much to my chagrin net-snmp was not installed out of the box.

So how do you install it you ask? Would you believe via a package manager?

First, you need to find the package name

#ipkg list | grep snmp

Then install the snmp package

#ipkg install net-snmp

Then configure it to start at boot time.

#app_set_enabled.sh net-snmp yes

In order to configure it, you are going to have to search for the snmp.conf

#find / -name snmpd.conf

I found two files and one of them clearly states that you should not edit it directly. The other one does not so this is the one that I modified to include my custom rocommunity. See below.

rocommunity lab

Now I just need to figure out how to allow port 161 udp/tcp on my local LAN segment and I am in business. However, I will probably tackle that tomorrow.

Additional Info (2016)

Note, you can restart snmp as shown below.

Stopping:

admin@RT-AC66U:/tmp/home/root# app_stop.sh net-snmp
killall: dm2_transmission-daemon: no process killed
killall: asus_lighttpd: no process killed
killall: dm2_snarfmaster: no process killed
killall: dm2_nzbget: no process killed
killall: dm2_amuled: no process killed
iptables: No chain/target/match by that name
iptables: Bad rule (does a matching rule exist in that chain?)

Starting:

admin@RT-AC66U:/tmp/home/root# app_set_enabled.sh net-snmp yes
The field(Enabled) was set “yes” already.
Restarting the package…

2016 Update – Configuring SNMP via the WebUI

Figured that I would add an update to this post as it seems that there are plenty of folks who are looking to setup SNMP on their Asus routers. Note that SNMP can now be configured directly from the WebUI.

In the left pane, click on “Advanced Setting”. Then click on the “SNMP” tab. See example below. Note that the webui does not seem to pick up your configuration if you have configured it via the cli. I have not tested to see if the WebUI overwrites the CLI configuration or if it creates another configuration file.

Additional Resources

Fatmin: How to Add a Static Route on the Asus RT-AC66U

Fatmin: Install and Configure SNMP on the Asus RT-AC66U

You are not allowed to access to (crontab) because of pam configuration.

Linux Redhat

09/27/2013

Hey look a real live Linux post.

Sure enough, and right as rain I am back with something that is not about networking (yeah!) and not about Solaris (boo!).

This is a short story about how we had a user who was a member of our database team who was attempting to make modifications to the oracle user’s crontab. They kept running into the error below.

Authentication token expired
You (oracle) are not allowed to access to (crontab) because of pam configuration.

Remembering that the oracle account is a special account without a password, or the ability to login, I figured that it had something to do with the fact the lack or password or something related.

I used the chage command to determine that while the password was not expired, rather that the account was considered inactive. Probably due to the fact that we locked down login permissions for service users on this box, but did not take into account that this user needed to login from time to time to keep the account from becoming inactive.

# chage -l oracle
Last password change                                    : Mar 25, 2013
Password expires                                        : Apr 22, 2013
Password inactive                                       : May 06, 2013
Account expires                                         : never
Minimum number of days between password change          : 7
Maximum number of days between password change          : 28
Number of days of warning before password expires       : 7

Now whats funny about this issue is that its pretty much a time bomb waiting to go off. You lock down logins for service accounts and forget to modify the inactive or expiration dates, and some day in the near future your users cron jobs will stop running, which possibly could cause all hell to break loose depending on whats running out of cron.

The fix is as follows.

# chage -I -1 -m 0 -M 99999 -E -1 oracle

Then use chage again to check out the sexy new settings.

# chage -l oracle
Last password change                                    : Mar 25, 2013
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 99999
Number of days of warning before password expires       : 7

TCPDUMP Tricks — Find a Port’s Configured Vlan and Port Number

Linux

05/20/2013

So this was a new one to me. I never knew that you could get a network ports vlan configuration using Tcpdump. In the past I've used cdpr to determine an interface's uplink port, but I never knew that you could use tcpdump to get the same information and also determine the VLAN.

Note that I did not discover this one myself. So if you happen to be the person who told me how to do this, thanks and pipe down.

Anyway here is the command, note that my interface is em1, your's will probably be different.

tcpdump -nn -vvv -i em1 -s 1500 -c 1 'ether[20:2] == 0x2000'

From the command above you get a nice little bit of output, which you have to poke through a bit to get the meaty parts out. Hey look its my port, and the name and ip of the switch upstream.

Device-ID (0x01), length: 27 bytes: 'SW2.corp.example.com.'
Address (0x02), length: 13 bytes: IPv4 (1) 172.22.10.254
Port-ID (0x03), length: 16 bytes: 'FastEthernet3/28'

Now check out this sweet nugget. A VLAN!

Native VLAN ID (0x0a), length: 2 bytes: 246

Ubuntu Linux- Locate Failed Dimms without Pain

Linux Ubuntu

03/17/2013

So I have recently made the switch to Kubuntu 12.10 on my new desktop. Basically I am building a monster workstation and I ran into issue running Fedora 18. Since I wanted Steam support too I decided not to try to move to an earlier Fedora version, but rather, I chose to give Ubuntu another try (its been years since I have run Ubuntu).

Anyway, I am building this hoss of a work station that has 12 Dimm slots, which I fully populated with 4GB dims. However when I booted my new monster, I found that I was 8GB short in the Memory department.

So, how do I figure out which two dimms are bad? I certainly dont want to have to pull all of them out and boot the machine and test each dimm one by one.

So this is where lshw comes to the rescue. Which I blogged about back in 2010 here.

Anyway. Here is how you find the empty slots.

# lshw -short -C memory

which output what you see below.

0/14                           memory      System Memory
/0/14/0                         memory      4GiB DIMM DDR3 1066 MHz (0.9 ns)
/0/14/1                         memory      4GiB DIMM DDR3 1066 MHz (0.9 ns)
/0/14/2                         memory      4GiB DIMM DDR3 1066 MHz (0.9 ns)
/0/14/3                         memory      4GiB DIMM DDR3 1066 MHz (0.9 ns)
/0/14/4                         memory      4GiB DIMM DDR3 1066 MHz (0.9 ns)
/0/14/5                         memory      4GiB DIMM DDR3 1066 MHz (0.9 ns)
/0/22                           memory      System Memory
/0/22/0                         memory      DIMM DDR3 [empty]
/0/22/1                         memory      DIMM DDR3 [empty]
/0/22/2                         memory      4GiB DIMM DDR3 1066 MHz (0.9 ns)
/0/22/3                         memory      4GiB DIMM DDR3 1066 MHz (0.9 ns)
/0/22/4                         memory      4GiB DIMM DDR3 1066 MHz (0.9 ns)
/0/22/5                         memory      4GiB DIMM DDR3 1066 MHz (0.9 ns)

Basically this is telling me that my first two dimms on CPU two are dead and are the ones that need to be replaced.

Now all I have to do is powerdown and pull and replace two dimms.. which will save my fingers from much discomfort.

I have no name! – RHEL 6 and SSSD Issue.

Linux Redhat

03/08/2013

This is an interesting one that I ran into today on an RHEL 6.3 VM that is using SSSD for authentication against LDAP.

User contacted me stating that he was unable to su to a particual user.

# su – app
cannot find name for user ID 650
[I have no name!@localhost ~]

So I jumped on the box and attempted to "finger" the user "app". This command retured the expected output, as did the "id" command. Thinking that the issue was a temporary failure for the server to connect to the ldap server, I figured we were probably fine now. But when I attempted to su to the user above, I ran into the same issue that the user ran into. So I restarted sssd and tried again. Same issue. So in order to isolate the issue a bit more I then attempted to su to another user, and was successful.

Huh?

Remebering that I had run into a similar issue before I decided to stop sssd and then delete its cache

service sssd stop ; cd /var/lib/sss/db ;rm cache_default.ldb; service sssd start.

Boom, su now works like a charm.

A bit of research shows that this is a known issue. See bugzilla here.

Also I could have used the ldbsearch command to verify that the particular users database/cache entry was corrupt.

ldbsearch -H /var/lib/sss/db/cache_default.ldb uidNumber=650

RHEL6 – Mount: Could Not Find Any Free Loop Device

Linux Redhat

09/05/2012

So I ran into this one today on RHEL 6.0 when trying to mount up a few additional isos on one of my remote kickstart servers. I have actually run into this issue before in RHEL 5 ( see here) however being that this particular kickstart server was built using RHEL 6.0 and not RHEL 5 I figured that there was probably a new process to resolve as RHEL 6 no longer uses the traditional /etc/modprobe.conf.

Note that a loop device is a pseudo device that makes a file accessible as a block device. In this case, the iso is the file.

So here is how you fix it.

First run the following command to increase the total number of loop devices to the max number of 256.

MAKEDEV -v /dev/loop

Then you need to make sure that this command runs at boot time, so stick it in /etc/rc.local. I think you can also pass this kernel option to the OS at boot in the /etc/grub.conf however I have not tried it.

RHEL6 – Quick and Easy Samba Configuration Guide – Part II

Linux Redhat

08/29/2012

A few weeks ago i published a Quick and Easy Samba Configuration Guide, which can be found here. After messing around with samba on and off since then I have learned a few things that I wanted to document before I totally forgot them. So lets down to business.

Samba Password Failures

So I have read a few things here and there that say that passwords can be a sticky issue in samba. Such was the case for me when I was trying to set a simple password of “myuser” for the user myuser.

As you can see below I got a bit of output from the command however in the end I was able to add the user, I quick check of google showed that the output below was supposed to be bogus anyway.

# smbpasswd -a myuser
New SMB password:
Retype new SMB password:
tdbsam_open: Converting version 0.0 database to version 4.0.
tdbsam_convert_backup: updated /var/lib/samba/private/passdb.tdb file.
for type 1 (min password length), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 2 (password history), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 3 (user must logon to change password), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 4 (maximum password age), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 5 (minimum password age), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 6 (lockout duration), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 7 (reset count minutes), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 8 (bad lockout attempt), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 9 (disconnect time), returning 0
account_policy_get: tdb_fetch_uint32 failed for type 10 (refuse machine password change), returning 0

Added user myuser

But when I attempted to test with the samba client I got the following error

# smbclient -L localhost -U myuser
Enter myuser’s password:
session setup failed: NT_STATUS_LOGON_FAILURE

So at this point I decided to change the password to something more complex and tried again and this time no issues at all. Just to be cheeky, I then changed the password for myuser back to “myuser” and it worked again.

Lesson learned here if if you see this message try changing your password to something else.

Troubleshooting Samba Share Write Issues

Holy Cow, this one was driving me nuts and I probably spent a good hour trying to fix it. And the fix was super easy. Below I am just trying to put a file on the share using smbclient

# smbclient //localhost/samba -U myuser
Enter myuser’s password:
Domain=[WORKGROUP1] OS=[Unix] Server=[Samba 3.5.10-125.el6]
smb: \> put /var/tmp/test test
NT_STATUS_ACCESS_DENIED opening remote file \test

I tried selinux, various smb.conf changes, checking ip tables, and in the end the issue was as simple as permissions on the directory

chmod 2775 /shared/samba

Once I set this everything worked fine.

Additional Smb.conf Configuration Items

Just do get samba up and running on a basic level you don’t really have to know too many configuration directives, and most of those are documented in smb.conf anyway. However there are a few more options that I think are either useful or interesting. They are below.

admin users – a user configured as an admin user can perform actions as root.

invalid users – any user here is denied access, even if the group that the user is a member of has access.

Like this:

Like this:

Like this:

Like this:

Like this:

Like this:

Like this:

Category: Linux

Install and Configure SNMP on the Asus RT-AC66U Router

Additional Info (2016)

2016 Update – Configuring SNMP via the WebUI

Additional Resources

Like this:

You are not allowed to access to (crontab) because of pam configuration.

Like this:

TCPDUMP Tricks — Find a Port’s Configured Vlan and Port Number

Like this:

Ubuntu Linux- Locate Failed Dimms without Pain

Like this:

I have no name! – RHEL 6 and SSSD Issue.

Like this:

RHEL6 – Mount: Could Not Find Any Free Loop Device

Like this:

RHEL6 – Quick and Easy Samba Configuration Guide – Part II

Samba Password Failures

Troubleshooting Samba Share Write Issues

Like this: