Workstations

This is a compilation of useful hints on configuring an Ubuntu workstation at CNI.

Kerberizing the System

apt-get install krb5-user libpam-krb5
mv /etc/krb5.conf /etc/krb5.conf.dpkg-dist
wget -O /etc/krb5.conf http://web.stanford.edu/dept/its/support/kerberos/dist/krb5.conf

## generate keytab for host-based kerberos principal (needed for kerberos-based passwordless remote logins)
ssh corn 'wallet -f keytabs/krb5.keytab.cnibox get keytab host/cnibox.stanford.edu'
scp corn:keytabs/krb5.keytab.cnibox /etc/krb5.keytab

Adding a Kerberos User with Correct Stanford UID

ssh corn 'ldapsearch -x -h ldap uid=UID' | grep -e uidNumber -e gecos
adduser --disabled-password --uid UID_NUMBER --gecos "GECOS" UID

## give power to new user
usermod -aG adm,cdrom,sudo,dip,plugdev,lpadmin,sambashare UID

Enabling autofs

apt-get install autofs5 
## configure autofs in /etc/auto.master and /etc/auto.home
service autofs restart

Adding NeuroDebian Repository and Installing AFNI

Follow installation instructions on NeuroDebian website.

apt-get update && apt-get install afni afni-atlases

Adding Berkeley CRAN Repository and Installing R

echo "deb http://cran.cnr.Berkeley.edu/bin/linux/ubuntu lucid/" > /etc/apt/sources.list.d/cran.cnr.Berkeley.edu.sources.list
wget -O - "http://keyserver.ubuntu.com:11371/pks/lookup?op=get&search=0x51716619E084DAB9" | apt-key add -
apt-get update && apt-get install g++ gfortran libatlas3gf-sse2 r-base

Manage Restricted Drivers via the Command Line

jockey-text

Letting Your System Send Email

apt-get install ssmtp
cat << EOF > /etc/ssmtp/ssmtp.conf
root=YOUR EMAIL
mailhub=smtp.stanford.edu
usestarttls=yes
hostname=HOSTNAME.stanford.edu
EOF

Kerberos Authentication, LDAP Accounts, & AFS Home Directories

This setup is not necessarily recommended and has not been tested extensively. And there is no guarantee that whoever configured the corn machines did it well.

apt-get install openafs-client openafs-krb5 krb5-user libpam-krb5 libnss-ldap libpam-afs-session libpam-foreground

# optional: krb5-clients

cd /etc
mv openafs openafs.dpkg-dist
mv krb5.conf krb5.conf.dpkg-dist
mv pam.d pam.d.dpkg-dist
mv ldap.conf ldap.conf.dpkg-dist
mv nsswitch.conf nsswitch.conf.dpkg-dist
scp -pr corn:'/etc/openafs /etc/krb5.conf /etc/pam.d /etc/ldap.conf /etc/nsswitch.conf' .

echo "nss_override_attribute_value loginShell /bin/bash" >> /etc/ldap.conf

cp -a /etc/bash.bashrc /etc/bash.bashrc.dpkg-dist
vim /etc/bash.bashrc        # comment "sudo hint" section to avoid "afs group id" error upon login