The only gotchya is that due to the replacement of init by systemd, when it came time to reboot, halt/reboot/etc were unable to send the correct signals to something that would shut the machine down, so I had to do a hard reboot (which never plays nice with my RAID arrays, but upon reboot there was no RAID re-sync which is either cool or scary, I’m not yet sure which). So that was a bit nerve-wracking. Otherwise it was just a lengthy process with yum telling me I had 2850 packages to deal with (including installing and removing). Instructions are good and clear. Highly recommended if you’re even moderately technically inclined.

Now I get a good look at GNOME3, which doesn’t work in my Fedora 15 vm’s (well, it works, but it looks a lot like GNOME2 due to the “poor” video support in a vm). I’m not sure what the big deal is… it’s a little wonky and takes some getting used to. I dislike that conky doesn’t show up on the desktop, but so far that’s my only real complaint. I had icons for Komodo and CrashPlan on the desktop that are no longer visible, so had to use alacarte (“yum install alacarte; alacarte”) to create new icons to go into the GNOME menu system. Then I could add them to my favourites and was off and running. It was about 1am when I finished so I haven’t had too much time to play with it yet (although I also installed LXDE to give it a go as well, in case I didn’t like GNOME3). So far I don’t mind it though.

Everything else seemed to work out of the box other than my apache configuration file. I have a few includes in /etc/httpd/conf/vhosts.d/*.conf and they weren’t loading, so I think the handling of virtual hosts has changed because once I removed the default virtualhost definition (““) that I had defined, the virtual hosts worked again.

All in all, I’m pleased. I’ve played with F15 in my vm’s since it came out (but mostly for testing security issues, etc.) so this is the first workstation with “stuff” that I’ve upgraded. So one work vm and one laptop to go and then F14 is history. Good job on this release, Fedora Folks!

Shadowman, on the other hand, is timeless and just plain cool. If Red Hat turned into Yellow Hat or Purple Frog tomorrow, I think they’d be hard pressed to develop an icon like Shadowman. And I’ve wanted Shadowman tattooed on the other leg for about a year now (my daughter is also very much enamoured with Shadowman and told me that he would make an extremely cool tattoo.. and I agree). So yesterday the deed was done. Probably the fastest tattoo I’ve ever gotten, and the greatest skin grinder to date.

RHEL6 is amazing, but the migration was.. painful. But I take full responsibility for that pain… if I had read the migration guide (or even pertinent parts of it), I could have saved myself two long nights. Oh well, live and learn. The other goal was to not copy any existing configs over, but to re-edit new configs (some of these configs hail from Annvix, some from Mandriva Corporate Server… it was due a cleaning and updating).

DNS was easy enough, and DHCP was a piece of cake. Kerberos was pretty good, but moving from Kerberos 1.6 to 1.8 had one interesting gotchya. I had to work around Kerberized NFS previously due to a 1.8-based client talking to a 1.6-based server and it seems that a similar work-around was required for the server (note this is the KDC, it doesn’t export anything for NFS). I needed to add to /etc/krb5.conf in the [libdefaults] section, the following:

 # for NFS
 allow_weak_crypto = true
 default_tgs_enctypes = des-cbc-crc
 default_tkt_enctypes = des-cbc-crc

Once that was done, Kerberos worked just as well as before and, more importantly, I wasn’t seeing any problems in my krb5kdc.log when my Fedora 14 box was trying to get a ticket. For Google’s sake, the log entry looked like this:

Feb 23 17:33:20 kerberos.example.com krb5kdc[1679](info): TGS_REQ
(7 etypes {18 17 16 23 3 1 2}) 192.168.250.52: BAD_ENCRYPTION_TYPE:
authtime 0,  vdanen@EXAMPLE.COM for nfs/nfsserver.example.com@EXAMPLE.COM,
KDC has no support for encryption type

LDAP was a severe PITA for me though. There were a few challenges. For one, it completely ignores /etc/openldap/slapd.conf now. If I would have read the Red Hat Enterprise Linux 6 Migration Planning Guide I would have known this. Sadly I chased my tail for two nights trying to figure out why TLS wasn’t working at all (I could do an ldapsearch against the directory with -Z, but tossing in -ZZ always crapped out). Eventually, I did get it working once I realized what was going on. The big thing here is, if you have an existing slapd.conf you plan to migrate, you need to do:

# rm -rf /etc/openldap/slapd.d; mkdir /etc/openldap/slapd.d
# slaptest -f /etc/openldap/slapd.conf -F /etc/openldap/slapd.d
# chown -R ldap:ldap /etc/openldap/slapd.d/

You could remove the slapd.conf, but I since I find it nice and easy and comfortable, I’ve kept it (realizing that it’s a template only, of sorts). Also keep in mind that if your LDAP server is, for example, ldap.foo.com, you better darn well make sure the CN in the SSL certificate matches, or SSSD will be very unhappy with you. I didn’t realize this before (although before I don’t believe I had enabled TLS (primarily because SSSD doesn’t enforce TLS when doing NSS lookups, by the looks of things, but only when requesting authentication information (or sending it, as the case may be)). It doesn’t matter much to nss_ldap (where you can tell it to not use SSL/TLS), but it sure matters a lot to SSSD (which I didn’t pay much attention to before because kerberos is handling the auth, not LDAP). That drove me bonkers for a bit (SSSD, or whatever it’s talking to, needs to be a little more helpful the error messages!).

Other gotchyas were that only gpg2 is available now, which played havoc with my AIDE+gpg scripts. That was a simple fix, once I figured it out (the problem is that gpg-agent is pretty much mandatory, and pinentry doesn’t seem to work too well if you don’t have a GUI and are su -’d to another user). Thankfully, I could work around this quite painlessly in my scripts.

All in all, it was a good brain flex. Frustrating as all get out, but now that it’s working, I’m happy. The next box is the internal intranet with kerberized apache, NFSv4 kerberized exports, nagios server, and internal subversion server. I think I’ll wait for the weekend on that one though. I don’t think it will be as painful as this box, but there will be a lot of SELinux policy tweaking on that one if I want to run it in enforcing mode. I’ve also been mucking with this since Saturday, and feel like doing something a little less taxing for the rest of my evening. =)

• Fedora project’s Package_update_HOWTO
• Fedora project’s Using_Fedora_GIT
• For know that I need a new version of fedora-packager
• and this for let git push to the branch you are tracking

Unfortunately, there still seems to be some issues:

Cloning into bare repository /cvs-scratch/fedora/opensc/fedpkg.git...
open log failed: Permission denied
fatal: The remote end hung up unexpectedly
Could not clone: Command '['git', 'clone', '--bare', 'ssh://me@pkgs.fedoraproject.org/opensc', '/cvs-scratch/fedora/opensc/fedpkg.git']' returned non-zero exit status 128

I’m not sure what this means. But the old CVS repository doesn’t seem to be usable either, which kinda stinks. I’m sure it’s just a minor buglet or two and will get worked out eventually. Very very happy that we’re no longer using CVS for this… I’d prefer SVN myself, but git is ok too.

Dear lazyweb, how can I make this system as quite on Fedora as it is on Windows? It’s absolutely silent when Win7 is running, but when Fedora is running the fans are quite noisy. Most of the time the system has a load average of 0.00 so it isn’t CPU spiking causing the fans to go full-bore. For temperatures I have Core0 at about 51C and Core1 at 44C and the other two cores at 48C, but the fans are running at 1583 and 1160 rpm. I can’t get the sensors to pick up temps or fan speeds on Win7 for some reason so don’t have a basis for comparison (tried a few of those “gadgets” and none show me temperatures).

There has to be a way to lower the fan speed on Fedora but I can’t find it. I tried fancontrol from lm_sensors but it complains about not being able to manually set the fans and there’s nothing I can see in the BIOS that’s even remotely relevant.

Am I doomed to a noisy Fedora box? Or is there a way I can make this thing quieter short of buying new fans? (The latter is an option I suppose, but if Win7 can run perfectly silent, then I’m of the frame of mind that Fedora should too). Running an up to date F13 (wheeee!!). Thanks for any suggestions.