Monthly Archive for September, 2004

TACACS+ and AAA

Took us the whole day figuring how to setup the dial-in lines using TACACS+ and AAA on a Cisco 2500 series router and Maui.

It was doubly hard because although there was an existing config on the router, I only had very basic IOS knowledge. Thank goodness for Google, but even then I had to RTFM every once in a while to check up on what we’re doing.

Setting up Maui for TACACS+ was a breeze, though, since there was an existing tacacs database in MySQL. It was only a matter of building version 9, and tweaking the settings to match that of the AAA router.

Actually connecting through the dial-up modem was another matter altogether, though. We still can’t figure out why it would connect one moment, not connect at all the next, and when it does connect, it’s extremely slllooooowwww (around 9 - 11 kbps).

Probably a noisy line? Or a misconfig on the router? Perhaps. We’ll see.

Staging server configuration status

I’ve finally installed Jabber and Squid in the staging server, Jabber.

Squid is already running, and has been in use since yesterday. Jabber can peer with Maui, if given the routing permissions on the firewall. But my automatic proxy configuration script can already be used. (Tried it on Firefox in my workstation, but haven’t tried it out on IE yet.)

I’ve managed to build Jabberd 2 from source. I had a few hiccups building MySQL. While I already have MySQL 3.x on the server installed through rpm and yum, turned out Jabberd 2 needs *at least* version 4.

Jabberd is configured for localhost — can’t make it access the LAN just yet; problems with port assignment, I think, but I’ll get there.

Blog formatting woes

It’s probably just me, but I have this quirk of making my web pages validate.

When it comes to Blogger, it does, in a way. Before the cool Blogger bar (see above), they had that butt-ugly table banner. Well now, the table layout is okay, I guess, but whenever I try to validate my blog, that darn thing spoils everything. I even emailed Blogger support about this, but they replied that since it doesn’t break any functionality in Blogger, it’s their least of their priorities. Oh well. I’d like to think that the top bar was their reply to my complaint. Right, dream on.

And now that I’ve got two other ways to blog (Email-to-Blogger and BloGTK), my formatting problems have gone worse.

For the email functionality, my MUA (Thunderbird) breaks up text into whatever column width I specified. That means Blogger treats each line break as a prompt to insert <br /> tags. And, consequently, it looks just plain ugly when rendered on the web.

Same thing with BloGTK. It doesn’t have the provision for the post title so I had to manually add a custom tag for <h3 class="post-title">. Thing is, BloGTK adds a <p /> tag at the beginning of each new non-empty line so the header (post title) gets an extra paragraph spacing before it, resulting in too much white space on the page.

My only solution is to turn off the “smart” linebreaks feature in Blogger, manually add paragraph tags (in the email; BloGTK does it for me), and, in BloGTK, write the first paragraph immediately after the ending tag on the post title. The source code doesn’t look nice, but at least the rendered page becomes bearable to look at.

Active Directory-OpenLDAP replication

Apparently, it can’t be done, because, as pointed out in one mailing list thread I read: Active Directory != OpenLDAP.

The best I could do is try out “synchronization” between the two servers. Maybe set up a master server (probably the Win2K3 box) from which to sync the directory schema.

More work! Well, at least, it’s interesting. Once I get this done, I can move on to my (and every sysad’s) Holy Grail: single sign-on. Pipedream…

Proxy load-balancing

I got Squid load balancing to work. All I did was tweak squid.conf on both web cache servers to make them peer siblings.

Then I cranked up a automatic proxy configuration script based on hints from the Netscape site. What it basically does is compute the hashes based on the URL string of the site to be visited. The script then chooses between the two proxies from which to connect.

For direct connections, i.e. for local servers and servers on the DMZ, connections are to be made directly. The http_direct directive in Squid doesn’t seem to work for my setup, though. Trivial Boolean logic, I guess. Will have to look into that.

Finally, I got the proxies to work. Now on to LDAP authentication. And, oh, I’m also currently installing Jabberd 2. Turns out the staging server doesn’t have gcc installed so I had to install them first. (Thank goodness for yum. That Yellow Dog is cool.)