I have been battling with setting up one of these for a long time. It so happens most areas of the internet, forget to mention one vital piece of the DHCP6 puzzle – DHCP6 is not standalone. It is an addition to RADVD. Thus you need to run both for it to work correctly.

Why would you want DHCP6 instead of RADVD? Well, RADVD may be good for your simple home use with a few computers, and MDNS name resoultion. But when you look at a business, a LAN party, or those who want DDNS updates, it is essential.

First, we need to setup RADVD properly. The order of these directives is very important.

interface eth0
{
	AdvManagedFlag on;
	AdvOtherConfigFlag on;
	AdvSendAdvert on;
	MinRtrAdvInterval 5;
	MaxRtrAdvInterval 60;
	prefix 2001:db8:1234:4321/64
	{
		AdvOnLink on;
		AdvAutonomous on;
		AdvRouterAddr on;
	};
};

Next, we need to configure DHCP6. I am using the ISC-DHCP4 server. DHCP6 needs its own instance, it cannot serve DHCP4 and DHCP6 at the same time. Fedora provides a seperate script for this (dhcpd6.service) that you can use. On other OSes you may not have this and will need to start DHCPD manually with the -6 flag. Here is the config you need.

server-name "server.example.com" ;
server-identifier server.example.com ;

authoritative;
option dhcp6.name-servers 2001:db8:1234:4321::1 ;
ddns-update-style interim ;
ddns-domainname "example.com";

subnet6 2001:db8:1234:4321::/64 {
        range6 2001:db8:1234:4321::10 2001:db8:1234:4321::110 ;
}

Now, since DHCP6 uses UDP / TCP (Its layer 3, and runs across link local), you must consider your firewall. On both client and server you need to accept icmp6, port 546 and 547 from the following addresses

Server:
Source – fe80::/16
Destination – ff02::1:2

Client
Source – ff02::1:2
Source – fe80::/16
Destination – fe80::/16

A set of example iptables rules on the server side would be

-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -s fe80::/16 -d ff02::1:2 -i eth0 -p udp -m udp --dport 546 -j ACCEPT
-A INPUT -s fe80::/16 -d ff02::1:2 -i eth0 -p tcp -m tcp --dport 546 -j ACCEPT
-A INPUT -s fe80::/16 -d ff02::1:2 -i eth0 -p udp -m udp --dport 547 -j ACCEPT
-A INPUT -s fe80::/16 -d ff02::1:2 -i eth0 -p tcp -m tcp --dport 547 -j ACCEPT

And similar enough for the client.

Now start radvd, dhcp6 and your firewalls. Then on your client run. Enjoy your DHCP6!

dhclient -d -v -6 interface

From here, it is very similar to DHCP4 to add things like DDNS updates to your DHCP6 server.

Recently at UofA, It was mentioned in passing “Wouldn’t it be nice to have CAS auth on the webserver instead of ldap basic auth?”.

“Yes, It would be “, I said. But it got me thinking about the issues involved. While nice to use CAS, CAS only provides authentication, not authorization. We rely on ldap attributes for determining access to content.

After a few minutes of reading, I found the solution.

Installation

I tested this on CentOS 5 (As we use RHEL at work), so adjust this for your needs.

If EPEL is not enabled you can enable it with this

EPEL[http://fedoraproject.org/wiki/EPEL]

If you wish to only install the one package, you can set the repository to disabled, and install with the following command

yum install --enablerepo=epel mod_auth_cas

Also install the ldap module. It is part of the base repo in RHEL.

yum install mod_authz_ldap

Configuration

Stop your apache server

We need the modules to load in a certain order, so we need to rename our configs.

cd /etc/httpd/conf.d/
mv auth_cas.conf 00_auth_cas.conf
mv authz_ldap.conf 10_authz_ldap.conf
mv ssl.conf 20_ssl.conf

In /etc/httpd/conf.d/00_auth_cas.conf

#
# mod_auth_cas is an Apache 2.0/2.2 compliant module that supports the
# CASv1 and CASv2 protocols
#

LoadModule auth_cas_module modules/mod_auth_cas.so
<IfModule mod_auth_cas.c>
    CASVersion 2
    CASDebug On

    # Validate the authenticity of the login.goshen.edu SSL certificate by
    # checking its chain of authority from the root CA.
    CASCertificatePath /etc/pki/tls/certs/
    CASValidateServer Off
    CASValidateDepth 9

	CASCookiePath /var/lib/cas/

    CASLoginURL https://auth.example.com/cas/login
    CASValidateURL https://auth.example.com/cas/serviceValidate
    CASTimeout 7200
    CASIdleTimeout 7200
  </IfModule>

You need to create the cas tickets directory, else the module will barf.

cd /var/lib
sudo mkdir cas
sudo chown apache:apache cas
sudo chmod 750 cas
sudo semanage fcontext -a -s system_u -t httpd_var_lib_t /var/lib/cas
sudo restorecon -r -v ./

This applies the needed SELinux policy to allow httpd to write to that directory. If you have set SELinux to permissive or disabled, these steps are worth taking incase you enable SELinux again in the future.

Configuration with LDAP authorization

Now we can add our ldap attributes we need. Check that 10_authz_ldap.conf matches the following

#
# mod_authz_ldap can be used to implement access control and
# authenticate users against an LDAP database.
# 

LoadModule authz_ldap_module modules/mod_authz_ldap.so

<IfModule mod_authz_ldap.c>

## Some commented code

</IfModule>

Now, in your SSL Directory directive add

<Directory "/var/www/ms1">
    Order allow,deny
    Allow from all
    AuthType CAS
    AuthName "TEST CAS AUTH"
    AuthLDAPURL ldaps://ldap.example.com:636/ou=People,dc=example,dc=com?uid?one?
    require ldap-filter &(uid=username)
  </Directory>

You can start apache again after reading the filter section

Filter

This ldap filter can be anything you desire. It can be a list of UID’s, sets of attributes, etc.

examples:

#Will check for this attribute
&(department=marketing)
#Checks that one has both this class and this department
&(class=compsci1001)(department=marketing)
#Your name is either foo or bar
|(uid=foo)(uid=bar)
#These can be nested as well. This would allow anyone with attr and other attr OR the uid= foo into the site.
|(&((attr=true)(other attr=true)) (uid=foo))

You can read more about filters here

Alternately, one can change the configuration to be like so

    AuthLDAPURL ldaps://ldap.example.com:636/ou=People,dc=example,dc=com?uid?one?(&(attr=foo)(attr=bar))
    Require valid-user

Note the filters are the same, but require the whole filter to be enclosed in a set of ().

I am currently in the middle of creating an email solution for the doctors surgery that I work for. I have previously tried exchange, but found it to slow, and unreliable for my needs. Instead, I have decided to go with postfix + dovecot for the doctors needs.

In my experimenting, I have been using a fedora VM, with SElinux enabled. However, SELinux has decided to hate on everything I do for this, and thus in my inability to accept defeat, I have created an SELinux module that should allow postfix and dovecot to work as per following this email setup guide

the module is

module postfixmysql 1.0;

require {
	type mysqld_var_run_t;
	type postfix_map_t;
	type usr_t;
	type mysqld_t;
	type mysqld_db_t;
	type postfix_virtual_t;
	type postfix_smtpd_t;
	type postfix_cleanup_t;
	class sock_file write;
	class unix_stream_socket connectto;
	class file getattr;
	class dir search;
}

#============= postfix_cleanup_t ==============
allow postfix_cleanup_t mysqld_db_t:dir search;
allow postfix_cleanup_t mysqld_t:unix_stream_socket connectto;
allow postfix_cleanup_t mysqld_var_run_t:sock_file write;
allow postfix_cleanup_t usr_t:file getattr;

#============= postfix_map_t ==============
allow postfix_map_t mysqld_db_t:dir search;
allow postfix_map_t mysqld_t:unix_stream_socket connectto;
allow postfix_map_t mysqld_var_run_t:sock_file write;

#============= postfix_smtpd_t ==============
allow postfix_smtpd_t mysqld_db_t:dir search;
allow postfix_smtpd_t mysqld_t:unix_stream_socket connectto;
allow postfix_smtpd_t mysqld_var_run_t:sock_file write;

#============= postfix_virtual_t ==============
allow postfix_virtual_t mysqld_db_t:dir search;
allow postfix_virtual_t mysqld_t:unix_stream_socket connectto;
allow postfix_virtual_t mysqld_var_run_t:sock_file write;

This can be built and installed with a command like such (as root)

checkmodule -M -m -o postfixmysql.mod postfixmysql.te; semodule_package -m postfixmysql.mod -o postfixmysql.pp; semodule -i postfixmysql.pp