Sysadmin Mega Thread

Software & Operating Systems
1104

Done a while ago.

The new authselect tool managed to do all the pam stuff I was interested in via the sssd profile, but if you do want to manually configure pam, you should do so with a custom authselect profile.

For auditd I found a repository with the rulesets they use for OpenSCAP and copied those with some minor modifications.

1 Like
1105

Nothing more fun than waiting for cloud formation to deploy and waiting for it to tell you whats wrong and then pushing up to Jenkins to wait a while longer.

1106

Periodic reminder that if you put /bin/bash as your shebang I will hunt you down and I will
EOF

2 Likes
1107

uses zsh
still does /bin/bash

1108

what about /usr/bin/env bash

Trying to configure one way trust between a samba ad dc and freeipa is the most infuriating thing Iā€™ve done recently.

2 Likes
1109

Real talk, why are you upset about this?

2 Likes
1110

Oh fuck yeah

--------------------------------------------------------------
Added Active Directory trust for realm "ad.s.my.d"
--------------------------------------------------------------
  Realm name: ad.s.my.d
  Domain NetBIOS name: AD
  Domain Security Identifier:
  Trust direction: Trusting forest
  Trust type: Active Directory domain
  Trust status: Established and verified
1111

Does anyone have access to a AD DC (like a real Windows one, not Samba)? Sambaā€™s kerberos srv records arenā€™t complete and I want to add the missing one(s).

I just need the output of dig ad.domain.tld" axfr | grep kerberos (feel free to redact the fqdn).

nvm I think I got it

1112

Permissible though some Linux people will complain

1113

Because not everyone has bash in /bin, whereas /bin/sh is a standard shell and a standard location. I often have to convert bash scripts that donā€™t work on freebsd to portable shell scripts that do by just changing the shebang and occasionally fixing a few silly things like changing [[ tests to [

1 Like
1114

Ah, 100% understand now.

I guess #!/usr/bin/env bash would be acceptable then?

I wasnā€™t sure if this was hate for bash or the path. :smiley:

1115

Bash is fine if you must. I understand it has advantages. It adds a few extra dependencies but I can live with that. Hard coding paths in the source repo I am not a fan of. I much prefer to have env determine the path in development code, and let the tooling for packaging swap in the appropriate hard path for each distro/os packaging system. This is a common feature in many packaging systems already.

1 Like
1116

Thatā€™s what I always use.

I donā€™t use sh because I usually specifically want bash so I can do fun bash things in the curly brackets.

That said, old ass bash on macOS gives me headaches sometimes.

1 Like
1117

@Eden did you say once that youā€™ve set up a lot of FreeIPA/Idm domain controllers? Have you ever configured a trust with AD?

Iā€™ve got it partially working, but Iā€™m not really sure what all the way working looks likeā€¦

1118

Iā€™ve got a few scripts to change. :shame:

2 Likes
1119

If you feel like going overboardā€¦

https://bash3boilerplate.sh/

1 Like
1120

This. Unless youā€™re writing scripts in perl or something, use /bin/sh like god intended.

edit:
I guess bash does have some advantages, but imho if youā€™re wanting to do more complicated things than basic scripts that basic sh can handle, something like perl, python, etc. is probably a better fit anyhow.

1 Like
1121

Or powershell

:smiley:

#!/usr/local/bin/pwsh
"hi"
1122

http://whythefuckwasibreached.com/

notice the http

4 Likes
1123

My work offers some free courses from Udemy.

So now I have enrolled in the Chef for beginners course :slight_smile:

2 Likes