text:
In the event that your organization is considering a migration later this year (or next?) to Windows Server 2008 (formerly "Longhorn"), here are some instructions for integrating Linux login requests against Active Directory on Windows Server 2008. These instructions are based on Linux-AD Integration, Version 4 and utilize Kerberos, LDAP, and Samba.
When this process is complete, AD users can be enabled for use on Linux systems on the network and login to those Linux systems using the same username and password as throughout the rest of Active Directory.
If you are looking for information on using Linux with a previous version of Windows before Windows Server 2008, please refer back to my AD integration index and select the appropriate article. The only significant changes in the process involve the mapping of the LDAP attributes; otherwise, the procedure is very similar between the two versions of Windows.
Preparing Active Directory (One-Time)
The process of installing and configuring Windows Server 2008 is beyond the scope of this article (although I may touch on that in the near future in a separate article). Therefore, I won't provide detailed instructions on how to perform some of these tasks, but instead provide a high-level overview.
Enable Editing/Display of UNIX Attributes
In order to store UNIX attributes in Active Directory, the schema must be extended. To extend the schema, first install Active Directory (add the Active Directory Domain Services role to an installed server, then use the Active Directory Installation Wizard to setup Active Directory) and then add the "Identity Management for UNIX" role service (this can be done in Server Manager).
Once that role service has been installed, then the AD schema now includes a partially RFC 2307-compliant set of UNIX attributes, such as UID, UID number, GID number, login shell, etc. (Note that it may be that these attributes are already included in the schema for Windows Server 2008; I did not check the schema before installing the Identity Management for UNIX role service. With Windows Server 2003 R2, the schema was present at the time of installation, but the attributes were not visible until installing the UNIX identity services.)
At this point a new tab labeled "UNIX Attributes" will appear in the properties dialog box for users and groups in Active Directory. You'll use this tab to edit the UNIX-specific attributes that are required for logins to Linux-based systems.
Create an LDAP Bind Account
You'll also need to create an account in Active Directory that will be used to bind to Active Directory for LDAP queries. This account does not need any special privileges; in fact, making the account a member of Domain Guests and not a member of Domain Users is perfectly fine. This helps minimize any potential security risks as a result of this account. Just be sure that you know the account's user principal name (UPN) and password.
Prepare Active Directory (Each User)
Each Active Directory account that will authenticate via Linux must be configured with a UID and other UNIX attributes. This is accomplished via the new "UNIX Attributes" tab on the properties dialog box of a user account.
After all the user accounts have been configured, then we are ready to configure Active Directory objects for each of the Linux server(s) that we'll be integrating with AD.
Prepare Active Directory (Each Server)
Prior to using Samba to join Linux computers to Active Directory and generate a keytab automatically, we had to use the
ktpass.exe utility on Windows to generate a keytab. Due to some current Samba-Windows Server 2008 interoperability issues, we can't use Samba. That means we'll be back to using
ktpass.exe to map service principals onto accounts in Active Directory. Unfortunately, you'll need to first disable User Account Control (UAC) on your server, since UAC interferes with
ktpass.exe. (Nice, huh?)
Once you've disabled UAC (and rebooted your server), then you can map the service principal names (SPNs) using the following steps:
- Create a computer account (or a user account; either will work) with the name of the Linux server.
- Use the following command to map the needed SPN onto this account (backslashes indicate line continuation):
ktpass.exe -princ HOST/[email protected] \
-mapuser DOMAIN\AccountName$ -crypto all \
-pass Password123 -ptype KRB5_NT_PRINCIPAL \
-out filename.keytab
- Copy this file to the Linux server (using SCP or SFTP is a good option) and merge it with the existing keytab (if it exists) using
ktutil. If there is no existing keytab, simply copy the file to
/etc/krb5.keytaband you should be good to go.
Now that Active Directory has computer objects (and, more importantly, SPNs) for the Linux servers and the AD users have been enabled for UNIX (by populating the UNIX attributes), we're ready to start configuring the Linux server(s) directly.
Prepare Each Linux Server
Follow the steps below to configure the Linux server for authentication against Active Directory. (Note that this configuration was tested on a system running CentOS—a variation of Red Hat Enterprise Linux—version 4.3.)
- Edit the
/etc/hostsfile and ensure that the server's fully-qualified domain name is listed first after its IP address.
- Make sure that the appropriate Kerberos libraries, OpenLDAP, pam_krb5, and nss_ldap are installed. If they are not installed, install them.
- Be sure that time is being properly synchronized between Active Directory and the Linux server in question. Kerberos requires time synchronization. Configure the NTP daemon if necessary.
- Edit the
/etc/krb5.conffile to look something like this, substituting your actual host names and domain names where appropriate:
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
default_realm = EXAMPLE.COM
dns_lookup_realm = true
dns_lookup_kdc = true
kdc = host.example.com:88
admin_server = host.example.com:749
default_domain = example.com
.example.com = EXAMPLE.COM
example.com = EXAMPLE.COM
profile = /var/kerberos/krb5kdc/kdc.conf
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
- Edit the
/etc/ldap.conffile to look something like this, substituting the appropriate host names, domain names, account names, and distinguished names (DNs) where appropriate. (Please note that the nss_base_group line should not be broken across two lines when you edit it; it has been wrapped here for readability with the line continuation noted by a backslash)
host 10.10.10.10
base dc=example,dc=com
uri ldap://server.example.com/
binddn [email protected]
bindpw adldapbindpw
scope sub
ssl no
nss_base_passwd dc=example,dc=com?sub
nss_base_shadow dc=example,dc=com?sub
nss_base_group dc=mydomain,dc=com?sub? \
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_objectclass posixGroup group
nss_map_attribute gecos cn
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute uniqueMember member
- Configure PAM (this varies according to Linux distributions) to use pam_krb5 for authentication. Many modern distributions use a stacking mechanism whereby one file can be modified and those changes will applied to all the various PAM-aware services. For example, in Red Hat-based distributions, the system-auth file is referenced by most other PAM-aware services. Here's a properly edited
/etc/pam.d/system-authfile taken from CentOS 4.4 (some lines have been wrapped for readability, as noted by a backslash; do not wrap them when editing the file):
# This file is auto-generated.
# User changes will be destroyed the next time
# authconfig is run.
auth required /lib/security/pam_env.so
auth sufficient /lib/security/pam_unix.so \
likeauth nullok
auth sufficient /lib/security/pam_krb5.so
auth required /lib/security/pam_deny.so
account sufficient /lib/security/pam_unix.so
account sufficient /lib/security/pam_krb5.so
account sufficient /lib/security/pam_succeed_if.so \
uid < 100 quiet
account required /lib/security/pam_deny.so
password requisite /lib/security/pam_cracklib.so \
password sufficient /lib/security/pam_unix.so
nullok use_authtok md5 shadow \
password required /lib/security/pam_deny.so
session required /lib/security/pam_limits.so
session required /lib/security/pam_unix.so
- Edit the
/etc/nsswitch.conf fileto include "ldap" as a lookup source for passwd, shadow, and groups.
At this point we are now ready to test our configuration and, if successful, to perform the final step: to join the Linux server to Active Directory for authentication.
Test the Configuration
To test the Kerberos authentication, use the
kinit command, as in
kinit <AD username>@<AD domain DNS name>. This should return no errors. A
klist at that point should then show that you have retrieved a TGT (ticket granting ticket) from the AD domain controller. If this fails, go back and troubleshoot the Kerberos configuration. In particular, if you are seeing references to failed TGT validation, check to make sure that both your Linux servers and AD domain controllers have reverse lookup (PTR) records in DNS and that the Linux server's
/etc/hosts file listed the FQDN of the server first instead of just the nodename.
<aside>Some readers and some other articles have suggested the use of the AD domain DNS name in the
/etc/krb5.conf file instead of an AD domain controller specifically; I recommend against this. First, I believe it may contribute to TGT validation errors; second, it is possible to list multiple KDCs (AD DCs) in the configuration. Since the only major reason to use the AD domain DNS name instead of the DNS name of one or more DCs would be fault tolerance, then it doesn't really gain anything.</aside>
To test the LDAP lookups, use the
getent command, as in
getent passwd <AD username>. This should return a listing of the account information from Active Directory. If this does not work, users will not be able to login, even if Kerberos is working fine. If you run into errors or failures here, go back and double-check the LDAP configuration. One common source of errors is the name of the LDAP bind account, so be sure that is correct.
At this point, SSH logins to the Linux system using an account present in Active Directory (one which has had its UNIX attributes specified properly) should be successful. This will be true as long as you used the
ktpass.exe command earlier to map the SPN onto the computer object in Active Directory. Even if you didn't copy the keytab over to the Linux server, logins will work. Why? Because the PAM Kerberos configuration, by default, does not require a client keytab, and does not attempt to validate the tickets granted by the TGT. This means that as long as the SPN(s) are mapped to the accounts in AD, the keytab is not necessarily required.
(Note, however, that not using a keytab and/or not requiring a keytab does leave the Linux server open to potentially spoofed Kerberos tickets from a fake KDC. In addition, "native" Kerberos authentication—i.e., using a Kerberos ticket to authenticate instead of typing in a password—won't work without a keytab.)
Deal with Home Directories
Unlike Windows systems, home directories are required on Linux-based systems. As a result, we must provide home directories for each AD user that will log in to a Linux-based system. We basically have three options here:
- Manually create home directories and set ownership/permissions properly before users will be able to log in.
- Use the pam_mkhomedir.so PAM module to automatically create local home directories "on the fly" as users log in. To do this, you would add an entry for pam_mkhomedir.so in the session portion of the PAM configuration file.
- Use the automounter to automatically mount home directories from a network server. This process is fairly complicated (too involved to include the information here), so I'll refer you to this article on using NFS and automounts for home directories. This has the added benefit of providing a foundation for unified home directories across both Windows and Linux systems.
Once you've settled on and implemented a system for dealing with home directories, you are finished! UNIX-enabled users in Active Directory can now login to Linux-based systems with their Active Directory username and password.
What's not addressed in this article? Password management. In this configuration, users will most likely not be able to change their password from the Linux servers and have that change properly reflected in Active Directory. In addition, "native" Kerberos authentication using Kerberos tickets won't work unless the keytab is present. In my testing, I ran into a number of issues with the keytab and TGT validation, but I'm not sure if those are errors in my process or the result of the beta status of Windows Server 2008.
I welcome your corrections, additions, or suggestions in the comments below.
Tags: ActiveDirectory, CentOS, Interoperability, Kerberos, LDAP, Linux, Samba, Windows
69 comments
Hi Slowe,
It seems not work with Red Hat Enterprise Linux—version 5.1.
Kinit and ldapsearch works fine, but "getent passwd [email protected]" returns nothing.
The "binddn" seems ok in the ldap.conf as the account was logged in successful when run the "getent … "
The AD is a Windows Server 2008 RC1.
Is it win 2008 or RHEL 5.1 issue?
Do you know of anybody that has been able to use openldap with a kerberos sasl bind to AD? Using simple bind/tls has some security issues like the password being in clear text in ldap.conf and not being able to change the ldap proxy password without visiting the unix servers and editing ldap.conf.
Wondering if you may be able to help me here because racking my brain doesn't seem to be working.
My config works even though I skipped the step of creating an AD account and creating a keytab file, associating it w/ the account, and placing it at /etc/krb5.keytab. Any idea why this might be happening? Is it possible there's a security hole in this config?
Thanks for the help and the blog.
Disregard my last post, I just realized it's because I had TGT validation turned off. Thanks.
I was able to use the your v4 guide w/o using ktpass on my windows 2008 domain…
my 2008 domain controller is upgraded form a 2003 domain controller. so maybe i'm not running into the same issues. (or maybe i'm not aware of the issues I will run into)
hey, thank you very much for your HOWTO.
im on testing it atm (well, im on setup both systems in vmware) and wanna try to authenticate AD groups on SAMBA shares.
AD domain.test (The Master with all users) /
Office (LINUX Server Samba) office.domain.test where users should be able to Login with a home dir. And another Linux Server (samba.domain.test) where no users should login local. there are only samba shares on it; and those shares should be authenticate against the AD groups @domain.test.
any suggestions for me?
thanks in advance
I installed a new server 2008 domain controler in a new forest for testing.
I installed Service for NFS…
but I cannot find a unix tab in the MMC for user account properties.
I want to do the unix identity management with AD…but I cannot find the tab, perhaps I am missing a snapin.
I do find a UID property in the 'attribute editor' tab.
Could you tell me how to add the unix attributes tab ?
At least on my enterprize 2008 server, there is not a role feature called this. There is a property on the 'services for NFS' mmc that allows you to either use a 'unix identity server' or active directory. The docs lead me to beleive this server (identity) is not part of server 2008.
I configured the NFS to use AD lookup… but the tabs are not there. Although the schema seems to have the data elements, as you can see the names with the attribute editor tab.
All instance that I looked at, where the tab apeared…were on older AD servers that had been upgraded.
Thanks, that worked. I had kept looking at the File Services and not Directory services.
I am trying to follow the HOWTO on a Fedora . I get to a point that kerberos works, kinit returns no error while klist shows the key. I also tried getent passwd and group. Both worked and showed my AD users and groups. However, when I try to logon with SSH using my AD user, it asked for the password and then never gets to the prompt. I wonder what may be wrong in my set up.
I found the problem was in LDAP. Kerberos was able to authenticate a AD user with the AD password when there is a user in NIS with the same name. It seems like when I use getent passwd to test the LDAP, sometimes it takes a long time for the command to return to prompt. Do you have any idea on this?
Hey Guys, I was wondering If I can get a little advice.
Situation is as follows. We have had for quite a while, a one way trust with two domains. I have integrated two Ubuntu servers into AD using Samba/Winbind and they have been running for the best part of 2 years without any troubles. Because we have two domains and it's only a one way trust I actually configured two servers. (One homed to each domain). They only run printing services and accounting services (Pykota) and as such do not require users to log in locally. It only needs to authenticate users against AD for Samba.
Winbind has worked fine for some time. However, we are ditching this trust. We are moving to child domains. We will end up with one root domain and three child domains. To make it even more difficult the new child domain controllers will be Server 2008 rather than 2003.
I have been playing for a few days attempting to build one server in a vm that communicates using either Samba/Winbind or LDAP/Kerberos, supports child domains and authenticates against a windows 2003 server with a 2008 schema update applied, or simply just the 2008 server.
Winbind struggles, while it recognises both domains, and indicates a trust exists. It cannot detect AD installed on the windows 2008 server, and therefore completely ignores it. It happily authenticates against the root domain. I must have tried about 20 different configurations of Samba, setting every Winbind option differently each time. I just can't get it to recognise the child domain.
Hence I moved onto LDAP. Kerberos works perfectly, I can search the AD directory using ldapsearch(), however, I can never get any results using getent passwd even though I have tried various configurations for LDAP. I was going to post my config files but realised this post was long enough all ready.
I would just like to ask if anyone knows which solution is best for supporting multiple domains and possible a combination of Windows Server 2008 servers and 2003. (Although as they both run the same schema they shouldn't cause to many problems) Can I specify multiple servers in LDAP? Or would I have to get Winbind to work correctly?
Just wanted to add that there is no need for doing schema updates – RfC2307 is implemented by server 2008 by default.
hi Scott!
When testing kerberos authentication with ADDS (server 2008) from RHEL5 I found that the keytab file is only relevant for ssh-logins when you configure your pam.d/sshd with "pam_krb5.so validate"! If you do not enter the validate-option PAM completely ignores the keytab file, no matter if you entered the verify_ap_req_nofail in the libdefaults-section of krb5.conf. It not only lets you in without a keytab file, it even lets you in with a wrong keytab file! I used RHEL5 with pam_krb5-2.2.14-1and krb5-libs-1.6.1-25.el5
FYI GoGrid is offering virtual Servers. They have a free $100 trial when you use the promo code 'GGED'. They are one of the first to offer 2008. EC2 doesn't even offer windows. http://www.gogrid.com
I can confirm that with Samba 3.2.3 (and this should be true for the entire 3.2.x release tree) joining a pure 2008 AD domain works again using 'net ads join'
This was tested under CentOS 5.2 on an x86_64 box. It's not easy to find prebuilt RPMs, but I'm using the ones at ftp://ftp.sernet.de/pub/samba/experimental/rhel/5/x86_64/ and they work great. Unfortunately, I first spent a ton of time trying to build my own RPMs from the specfile provided with the Samba 3.2 tarbll, and this fails in various ways, so thar be dragons…
Thank you for your very informative howto. I have configured my AD DC as specified on this page, and also the linux server I am trying to join to the domain. However, when I run getent passwd I only see the local users.
After I run getent I see the following sort of entries in /var/log/auth.log aswell:
Nov 7 04:35:57 s-09-chaos getent: nss_ldap: failed to bind to LDAP server ldap://s-02-zeus.internal.vesuviustechnologies.com/: Invalid credentials
Nov 7 04:35:57 s-09-chaos getent: nss_ldap: reconnecting to LDAP server…
Nov 7 04:35:57 s-09-chaos getent: nss_ldap: failed to bind to LDAP server ldap://s-02-zeus.internal.vesuviustechnologies.com/: Invalid credentials
Nov 7 04:35:57 s-09-chaos getent: nss_ldap: reconnecting to LDAP server (sleeping 1 seconds)…
Nov 7 04:35:58 s-09-chaos getent: nss_ldap: failed to bind to LDAP server ldap://s-02-zeus.internal.vesuviustechnologies.com/: Invalid credentials
Nov 7 04:35:58 s-09-chaos getent: nss_ldap: could not search LDAP server – Server is unavailable
Furthermore, here's what I get when I run ldapsearch using the bind account (password removed):
s-09-chaos:~# ldapsearch -D [email protected] -w
SASL/EXTERNAL authentication started
ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
additional info: SASL(-4): no mechanism available:
And finally heres the really interesting bit — when I add the -x (use simple authentication) to the same ldapsearch command, it works fine and I get results back.
Any help here would be very much appreciated.
Joe Crivello
Hi Scott,
a possible helpfull addition for others. Got me tearing my hair out for some time…
We have recently upgraded from W2K3 to W2K8 and are running nss_ldap 264.
Kinit works fine, and ldapsearch too.
However, a 'getent passwd' or 'getent group' only shows the groups and users defined before the upgrade.
If I remove a user from the Active Directory, then it disappears from the output of 'getent passwd'. But when I add a new user (with UID filled in etc), it does not appear in the list.
Logging shows nothing special.
Using a dump of ldapsearch and debugging of LDAP packages from ldap.conf, I've found that:
* The new accounts are included in the dump from nss_ldap, as well as the old accounts.
* Additionally, the old accounts have different fields (those used for W2K3).
I've changed the mapping to
nss_map_attribute uid sAMAccountName
nss_map_attribute uidNumber uidNumber
nss_map_attribute gidNumber gidNumber
nss_map_attribute cn sAMAccountName
nss_map_attribute uniqueMember member
nss_map_attribute userPassword msSFUPassword
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute loginShell loginShell
nss_map_attribute gecos cn
nss_map_objectclass posixGroup Group
nss_map_attribute shadowLastChange pwdLastSet
And now it is working again. The old mappings were based upon msSFU30* names.
Hi Scott,
I have just checked my AD before starting to play with linux AD integration. And it seems that I don't need to install any of the subroles of the "Identity Management for UNIX" role because the "Server for NIS Tools" from the RSAT (Remote Server Administration Tools) feature makes the "UNIX Attributes" tab visible.
Thanks for the post, I was able to use this to get my RHEL5.1 working with my test domain. I do have one question, is it possible to set login restrictions with this setup? Example: users of GroupA can login to Server1, and users of GroupB can login to server2 etc?
Right now it seems as though anyone with an account in AD can login to any Linux host configured for AD Authentication.
Same problem as Joe. I can use ldapsearch & other cli utils but it seems like nss_ldap is broken. I am on Centos 5
Thanks for the great How-to. My only comment is you do not need to disable UAC on the domain controller. All you need to do is Run command line (CMD) as Administrator.
Just Go to Start -> All Programs -> Accessories the right click Command Prompt and left click "Run as Administrator". You will then get an UAC prompt click Continue. Then ktpass will work correctly.
Thanks for the great site!
One question – has anyone managed to store the automounter maps in AD?
It should be possible as well, but I am not sure whether Win2008 AD contains attributes for the automounter (not part of RFC2307).
Also making that ldap working using SASL would be great, too (we have all Kerberos setup so it should work -but probably only in my dreams
My own comments regarding the automounter (hopefully others will find it usefull):
Configuration example for NIS-less environment (client RHEL 5.2, server Windows Server 2008):
/etc/ldap.conf (for nss_ldap):
base dc=ad,dc=s3group,dc=cz
uri ldap://WIN-UG29HR9IEGY
binddn cn=ldapproxy,cn=Users,dc=ad,dc=s3group,dc=cz
bindpw 1234proxy$
nss_base_passwd cn=Users,?one
nss_base_group cn=Users,?one
nss_base_services cn=services,cn=praguetest,cn=prague,?one
# RFC 2307 (AD) mappings
nss_map_objectclass posixAccount user
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_objectclass posixGroup group
# needed for services NIS map in Win2008 map to work along with the Server for NIS
nss_map_attribute cn msSFU30Name
… nss_ldap is using simple bind to AD. Also tried SASL/DIGEST-MD5, but it does not work (I am unable to force the client to use SASL/DIGEST-MD5, it insist on SASL/GSSAPI). The above tried with the following maps: passwd, group, services.
Other NIS maps would probably work, too.
URI ldap://WIN-UG29HR9IEGY
BASE cn=praguetest,cn=prague,dc=ad,dc=s3group,dc=cz
Schema example for the automounter:
[root@dorado_v1 etc]# ldapsearch -H ldap://WIN-UG29HR9IEGY -Y DIGEST-MD5 -U "ldapproxy" -w 1234proxy$ -b "cn=praguetest,cn=prague,dc=ad,dc=s3group,dc=cz" objectClass=* cn objectClass nisMapName nisMapEntry
SASL/DIGEST-MD5 authentication started
SASL username: ldapproxy
SASL installing layers
# extended LDIF
# LDAPv3
# base with scope subtree
# filter: objectClass=*
# requesting: cn objectClass nisMapName nisMapEntry
# praguetest, prague, ad.s3group.cz
dn: CN=praguetest,CN=prague,DC=ad,DC=s3group,DC=cz
objectClass: top
objectClass: container
cn: praguetest
# auto.proj, praguetest, prague, ad.s3group.cz
dn: CN=auto.proj,CN=praguetest,CN=prague,DC=ad,DC=s3group,DC=cz
objectClass: top
objectClass: container
cn: auto.proj
# nis, auto.proj, praguetest, prague, ad.s3group.cz
dn: CN=nis,CN=auto.proj,CN=praguetest,CN=prague,DC=ad,DC=s3group,DC=cz
objectClass: top
objectClass: nisObject
cn: nis
nisMapName: auto.proj
nisMapEntry: nis test
# nis2, auto.proj, praguetest, prague, ad.s3group.cz
dn: CN=nis2,CN=auto.proj,CN=praguetest,CN=prague,DC=ad,DC=s3group,DC=cz
objectClass: top
objectClass: nisObject
cn: nis2
nisMapName: auto.proj
nisMapEntry: nis2 test2
# notac, auto.proj, praguetest, prague, ad.s3group.cz
dn: CN=notac,CN=auto.proj,CN=praguetest,CN=prague,DC=ad,DC=s3group,DC=cz
objectClass: top
objectClass: nisObject
cn: notac
nisMapName: auto.proj
nisMapEntry: notac botac
# services, praguetest, prague, ad.s3group.cz
dn: CN=services,CN=praguetest,CN=prague,DC=ad,DC=s3group,DC=cz
objectClass: top
objectClass: container
cn: services
# 536/tcp, services, praguetest, prague, ad.s3group.cz
dn: CN=536/tcp,CN=services,CN=praguetest,CN=prague,DC=ad,DC=s3group,DC=cz
objectClass: top
objectClass: ipService
cn: 536/tcp
# auto.master, praguetest, prague, ad.s3group.cz
dn: CN=auto.master,CN=praguetest,CN=prague,DC=ad,DC=s3group,DC=cz
objectClass: top
objectClass: nisMap
cn: auto.master
nisMapName: auto.master
# /proj, auto.master, praguetest, prague, ad.s3group.cz
dn: CN=/proj,CN=auto.master,CN=praguetest,CN=prague,DC=ad,DC=s3group,DC=cz
objectClass: top
objectClass: nisObject
cn: /proj
nisMapName: auto.master
nisMapEntry: ldap:cn=auto.proj,cn=praguetest,cn=prague,dc=ad,dc=s3group,dc=cz
# /home, auto.master, praguetest, prague, ad.s3group.cz
dn: CN=/home,CN=auto.master,CN=praguetest,CN=prague,DC=ad,DC=s3group,DC=cz
objectClass: top
objectClass: nisObject
cn: /home
nisMapName: auto.master
nisMapEntry: ldap:cn=auto.home,cn=praguetest,cn=prague,dc=ad,dc=s3group,dc=cz
# auto.home, praguetest, prague, ad.s3group.cz
dn: CN=auto.home,CN=praguetest,CN=prague,DC=ad,DC=s3group,DC=cz
objectClass: top
objectClass: nisMap
cn: auto.home
nisMapName: auto.home
# victim, auto.home, praguetest, prague, ad.s3group.cz
dn: CN=victim,CN=auto.home,CN=praguetest,CN=prague,DC=ad,DC=s3group,DC=cz
objectClass: top
objectClass: nisObject
cn: victim
nisMapName: auto.home
nisMapEntry: melnik:/vol/vol0/users/&
# search result
search: 3
result: 0 Success
# numResponses: 13
# numEntries: 12
Automounter as per configuration above is binding anonymously to the AD. Anonymous access to the AD is disabled by the default. It would be more then wise to bind using some more secure techniques like SASL/DIGEST-MD5 or SASL/GSSAPI. Unfortunately at least SASL/DIGEST-MD5 access does not work for some strange reason with Win 2008.
The prerequisite for the SASL/DIGEST-MD5 mechanism is a working DNS. For example in the ldapsearch example above I access the AD controller using its name (WIN-UG29HR9IEGY). ldapsearch could fail if some different name or just IP were used.
Also note that the auto.proj map in the example above is wrong because the of the wrong objectclass type (is container, should be NisMap) and so is not found by the automounter.
thanks for this documentation.
I've a strange problem with the SSH-Login.
I open a putty-session for SSH and have also a console-session for the VM opened to have a look at /var/log/messages.
When i enter the Username in the SSH-Session i get a prompt for the password and right after pressing enter putty tells me:
"Network connection closed: connection timed-out".
/var/log/messages tells me from the pam_krb5-module that the authentication succeeded.
After this i always get the message:
sshd[16476] debug1: do_pam_account: called
Even in Debug-Level 3 of the SSH-Demon i only get this message. No further error or anything else.
My sshd_config looks like this:
Protocol 2
PasswordAuthentication yes
ChallengeResponseAuthentication yes
KerberosAuthentication yes
KerberosTicketCleanup yes
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
UsePAM yes
X11Forwarding yes
UsePrivilegeSeparation no
Subsystem sftp /usr/lib/ssh/sftp-server
AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES
AcceptEnv LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT
AcceptEnv LC_IDENTIFICATION LC_ALL
For this I've left out the everything commented out.
Anyone an idea?
Here some further information:
OS: SuSE Linux 11.1
ldap-browsing: works fine
kerberos-ticket: works fine
only login fails
Well, i've found out that it depends on the LDAP.
While I can browse easily via Yast through the AD, a "getent passwd" does not show me anything from it.
The Mappings are set like those from Guido Leenders.
/var/log/messages doesn't show me any error.
So although I got it work with w2k3 it won't do so with w2k8.
Another update from me with the hope someone has an idea for solving the problem:
I have configured:
scope sub
nss_base_group dc=domain,dc=toplevel?sub
nss_base_passwd dc=domain,dc=toplevel?sub
nss_base_shadow dc=domain,dc=toplevel?sub
Although I've configured this an ldapsearch searches only in sub1.domain.toplevel and ind sub2.domain.toplevel while we have mroe than those two and the allowed users are in another subdomain.
Any Suggestions??
Well, generelly I got it work, but i get the message in /var/log/messages:
pam_krb5[14999] Authentication succeeds for user 'USERNAME' ([email protected])
sshd[14999]: _rebind_proc
sshd[14999]: _rebind_proc
sshd[14999]: _rebind_proc
By this the session is directly terminated.
bindroot and bindrootpw become visible to all users on the box that can then use the account to access the windows domain, though only limited to what that user has access to.
Is there a way to hide this information? I know that setting the file to 640 breaks getent?
Alternatively, what's the minimal settings that are required on the AD side for the authenticated user account to make it work. I'd like to limit the total information exposed from AD to the server since some of the users on this server will not be part of AD (mixed auth in this case).
Basically, we have AD users dropping files onto the server for clients to SCP then away. Each client has their own folder and limited to what they can see on the box BUT they can also read /etc/ldap.conf credentials, which is the troubling part.
That looks like it might work for what I'm doing.
Hiya Scott,
Different OSes, different job, same blog. Your blog is one of my daily reads; it's great. I actually consider reading these posts cheating.
I have ldap problems, which I am working through. To test, I ran:
ldapsearch -v -W -x -H ldap://dc01.lab.nframe.com/ -b "cn=UNIX LDAP Bind Account,cn=Users,dc=lab,dc=nframe,dc=com" -s sub -b "ou=Managed Services,dc=lab,dc=nframe,dc=com" cn=*
No workie: Windows 2008 AD, by default, won't allow simple binds: you have to choose a SASL method, so I removed the -x flag and tried again. Then I got:
ldap_sasl_interactive_bind_s: Unknown authentication method (-6)
additional info: SASL(-4): no mechanism available:
Hrm. rpm -i cyrus-sasl-gssapi-2.1.22-4.i386.rpm and voila, it works. Problem is, you must have a TGT first. Run klist and check that you have a ticket. Otherwise, it won't work. I ran kdestroy and I got:
ldap_sasl_interactive_bind_s: Local error (-2)
additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No credentials cache found)
Anyway, I made it a step further using this command; someone else may be similarly stumped.
Hi again,
Turns out I was wrong about the simple bind. Simple binds are still OK. The command I put in, above, was flawed. It should have been:
ldapsearch -x -v -W -H ldap://dc01.lab.nframe.com/ -D "cn=UNIX LDAP Bind Account,cn=Users,dc=lab,dc=nframe,dc=com" -s sub -b "ou=Managed Services,dc=lab,dc=nframe,dc=com" cn=*
I typed "-b 'cn=UNIX…", which is obviously a mistake. I found this little nugget, too:
Isn't Google great?
I have a particularly obnoxious problem with this. Some of my AD users show up in getent passwd, some do not, but all show up in getent shadow. Those that show up in getent passwd show up in getent shadow with the following format
whereas the (number) field is empty for those that don't show up. As far as I can see, both sets of users are enabled for UNIX, members of the same groups, and show no obvious differences.
Thanks again, between your site and some trial and error (mostly error), I have CentOS 5.3 authenticating to a Windows 2008 AD.
On the windows server I installed Identity Manager for Unix, and for users that I wish to allow to log into linux, I have all of the fields populated: NIS domain, UID, login shell, home dir, GID.
On the CentOS system I the following files were modified:
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_krb5.so use_first_pass
auth required pam_deny.so
account required pam_unix.so broken_shadow
account sufficient pam_localuser.so
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_krb5.so
account required pam_permit.so
password requisite pam_cracklib.so retry=3
password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok
password sufficient pam_krb5.so use_authtok
password required pam_deny.so
session optional pam_keyinit.so revoke
session required pam_limits.so
session required pam_mkhomedir.so skel=/etc/skel umask=0077 silent
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_krb5.so
/etc/krb5.keytab – created on the AD using the following command and copied to the CentOS system:
ktpass.exe -princ HOST/@ -mapuser \ -crypto all -pass -ptype KRB5_NT_PRINCIPAL -out c:\users\theodore\krb5.keytab
/etc/krb5.conf: (notice they're all upper case…if you have problems set debug=true)
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
default_realm = DOMAIN_NAME.TLD
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes
kdc = MY-AD-01.DOMAIN_NAME.TLD:88
admin_server = MY-AD-01.DOMAIN_NAME.TLD:749
default_domain = DOMAIN_NAME.TLD
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
/etc/ldap.conf (i had to add ntp and xfs to the exclude list at the bottom, also, i'm not sure i'm mapping the correct AD fields to their ldap fields…)
timelimit 120
bind_timelimit 120
idle_timelimit 3600
base dc=my_domain,dc=tld
uri ldap://my-ad-01.my_domain.tld/
binddn cn=ldapuser,cn=users,dc=my_domain,dc=tld
bindpw ldapuserpassword
scope sub
ssl no
nss_base_passwd dc=my_domain,dc=tld?sub
nss_base_shadow dc=my_domain,dc=tld?sub
nss_base_group dc=my_domain,dc=tld?sub? &(objectCategory=group)(gidnumber=*)
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_objectclass posixGroup group
nss_map_attribute gecos cn
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute uniqueMember member
nss_initgroups_ignoreusers root,ldap,named,avahi,haldaemon,dbus,radvd,tomcat,radiusd,news,mailman,nscd,gdm,ntp,xfs
tls_cacertdir /etc/openldap/cacerts
pam_password md5
passwd: files ldap
shadow: files ldap
group: files ldap
hosts: files dns
bootparams: nisplus [NOTFOUND=return] files
ethers: files
netmasks: files
networks: files
protocols: files
rpc: files
services: files
netgroup: files ldap
publickey: nisplus
automount: files ldap
aliases: files nisplus
Thanks again everyone.
Hi Scott,
Thanks for your time. I am trying to authenticate linux on 2008 AD for one project. After I look at the comments, I have one question: Is it required for Linux clinet must join Windows 2008 AD domain to make authenticating working?
I have been attempting to get a RedHat 64bit linux with Apache configured to use kerberos for authentication against a 2003 AD server. We are configured and working thanks to your notes. We also have several two way transitive trusts and they work as well with no additional effort.
The issue is one selective trust. We are configured to use domainA and there is a domainB with a selective trust. We simply cannot get users in domainB to authenticate. IE just returns the error that the web page cannot be displayed and the apache log has one line – [Mon Dec 14 16:08:05 2009] [debug] src/mod_auth_kerb.c(1628): [client xxx.xxx.xxx.xxx] kerb_authenticate_user entered with user (NUL
L) and auth_type Kerberos
Can you point us in the right direction for this?
ldapsearch -x LDAP://DOMAIN.COM
# extended LDIF
# LDAPv3
# base with scope subtree
# filter: (objectclass=*)
# requesting: LDAP://DOMAIN.COM
# search result
search: 2
result: 1 Operations error
text: 000004DC: LdapErr: DSID-0C0906DD, comment: In order to perform this ope
ration a successful bind must be completed on the connection., data 0, v1772
wt's problem on that?any suggestion?
RedHat 5.2 & Windows Server 2008R2 (as in the one based off Windows 7, not plain old 2000, based off Vista) domain controller (2003 functional domain, with some other 2003 DC's). I've installed the Microsoft Identity Managment for UNIS role on the server & can see the UNIX attribute tab on the DC, or other systems if install the correct MMC snapin.
I'm pretty sure I have kerberos stup correctly, running "kinit [email protected]" works fine & I see the ticket listed when using klist. Using the Authentication utility in Gnome I added the Linux box to the domain (It showed up in the correct OU in AD Users & Computers).
from /var/log/secure
login: pam_unix(login:auth): checkpass; user unknown
login: pam_unix(login:auth): authentication failure; logname= uid=0 euid=0 tty=tty1 ruser= rhost=
login: pam_succeed_if(login:auth): error retrieving information about user dnoel
login: FAILED LOGIN 1 FROM (null) FOR user dnoel, User not known to the underlying authentication module
from /var/log/messages
automount[5500]: bind_ldap_anonymous: lookup(ldap): Unable to bind to the LDAP server: (default), error Can't contact LDAP server
I've got the following (with the actual values, not fake) lines in my /etc/ldap.conf file:
binddn cn=ldap,dc=domain,dc=com
bindpw adldapbindpw
I've also tried the "binddn [email protected]" format as well with similar results.
running "getent passwd dnoel" returns nothing when I hit enter after typing it in.
Not seeing anything in the logs on my domain controller success or failure. Tried even briefly making my LDAP service account a member of domain admins, with no luck.
I ran ADSIedit & see attributes for my accont for:
I don't see an attribute listed for:
Those attributes don't seem to line up with the attributes listed to map in /etc/ldap.conf.
Running: ldapsearch -x -v -W -H ldap://dc01.lab.nframe.com/ -D "cn=UNIX LDAP Bind Account,cn=Users,dc=lab,dc=nframe,dc=com" -s sub -b "ou=Managed Services,dc=lab,dc=nframe,dc=com" (or at least that command with values relevant to my setup) prompts me for the password, works fine & dumps out a pile of directory info as I'd expect. So LDAP is working on the AD side & I can connect to it from Linux.
How can I crank up the LDAP debugging in RedHat 5.2?
Do I need to re-do the attribute mapping?
Any thoughts?
Comments are now closed.


text:
Published September 18, 2012
Hundreds of thousands of refugees fleeing violence in the Middle East and Africa are living in sub-standard conditions. This according to United Nations relief agencies, who report that serious food and water problems are turning many of these camps into breeding grounds for a range of life-threatening diseases. VOA's Vidushi Sinha has more.

subset: commoncrawl


text:
The new mouse avoider with a twist Have you ever played mouse maze games before? Well this is one with a difference – you control to different cursors at the same time.
One of them is a normal cursor, but one of them is mirrored – it does the exact opposite to what you think it should.
To beat a level, you must get both cursors to both finishes, without any of them going off of the white platform


text:
The contemporary Rivers sectional by Lane is designed for maximum comfort, function, and utility. Available in manual or push-button power recline, this right arm facing single arm recliner is available in your choice of high-quality Lane materials.
Dimensions: 41"w x 41"d x 40"h
Overall Rating for Lane 365 Rivers Right Facing Single Arm Recliner


text:
Podcast Episode.
Young Blind People Standing Up For Their Rights
Visually impaired young people from all over England have teamed up with RNIB to learn how to campaign more effectively for what matters to them. Insight's Leeanne Coyle joined them to hear how they got on:
Download this episode
Keywords: RNIB, haggeye, campaigning, England, youth, young


text:
A Basket of Fruit with Animals
Leopold Zinnogger
- Leopold Zinnogger -- Check All The Artist's Paintings.
- Nationality : Austrian, 1811-1872
- Title : A Basket of Fruit with Animals
- Info : Leopold Zinnogger's oil painting. 30828-Zinnogger, Leopold-A Basket of Fruit with Animals
Zinnogger, Leopold
Leopold Zinnogger [Austrian Painter, 1811-1872]
Leopold Zinnogger artwork : A Basket of Fruit with Animals
Next 5 Oil Paintings :A Basket of Roses -- Artist : Henri Fantin-Latour
A Basket Of Roses On A Ledge -- Artist : Johan Laurentz Jensen
A Bath, an Antique Custom -- Artist : Sir Lawrence Alma-Tadema
A Bather -- Artist : Lord Frederick Leighton
a bather -- Artist : Jean-Jacques Henner
- We can paint any size, we can paint any image. If you can't find what you are looking for? Please Click Here.
- We also create oil paintings from your photographs or print that you like. There is no extra charge for any special customization, but except oil painting from real-life portrait photo.
- Most of our paintings will not Sign, if you need any Signature please email us the detail.
- All the prices are in US Dollars. The prices listed here are for oil on canvas or acrylic on canvas, not stretched and not framed.
- Most orders will be delivered in 7-20 days depending on the complexity of the painting. Purchase from our stock, delivery by express in 5 days.
- Payment is secured during transaction(via Paypal). We also have a refund guarantee to protect our customers. 100% return money if you are not satisfy your painting. (The painting must be in its original condition. Shipping cost is non refundable.)
- We are committed to protect your privacy. We do not sell or share our customer's information in any way.
Create portrait painting from your photos. Our artists can turn your photographs into beautiful portrait paintings.
Different sizes and subjects available or customized according to clients' requirements.
We can do all styles and subjects: People, Landscape, Still life, Portrait, Impressionism, Abstract, classical paintings,
Seascapes, Cityscapes, romantic sceneries, flowers, fruits, winebottle, animals, horse, monkey, tiger, dog, chicken,
and modern oil paintings, religious paintings, art deco, POP art, oil painting
with figures and nudes, contemporary artworks, realistic paintings by photo.
Choose best material for all oil paintings, Attractive image and vivid color, assured quality.
A large number of hand painted oil painting reproductions of old masters : Artist Index By Alphabettcal or By Nationality


text:
Associate Professor, Art
Phone: 419-755-4384
Fax: 419-755-4367
B.A. University of Kentucky, 1984
M.F.A. The Ohio State University, 1992
Figurative Art in a variety of media and styles, ceramic sculpture, ceramic materials and glaze techniques, drawing and drawing techniques, portraiture, oil painting, and graphic design
John Thrasher is a professor of Art at the Ohio State University's regional campus in Mansfield Ohio. He completed undergraduate studies at the University of Kentucky with a concentration in drawing and sculpture. He worked as a free-lance medical illustrator and as an art teacher from 1984 to 1990. In 1990 he began graduate work at OSU's Columbus campus, with a focus on ceramic sculpture, glaze and materials science and drawing. After the completion of his Master of Fine Art, John taught drawing in both the department of art and the college of architecture. He has exhibited his art nationally and internationally. The primary focus of his work is figurative representation in a variety of styles and expressive contexts. Current studio work ranges from ceramic sculptural relief to a 12 year series of pastel drawings that feature a variety of drawing techniques and images. He received one of nine Graduate Associate Teaching Awards in 1991, the Alumni Award for Distinguished Teaching in 1999, and Outstanding Teaching Awards on the Mansfield Campus in 1996, and 2001. In 2005 he was a finalist for the Undergraduate Arts and Sciences Award for Outstanding Teaching at Ohio State, and in 2007, recognized in the annual publication of Who's Who Among America's College Teachers. In 2006 he was the International Artist-in Residence at the Works Art and Design Festival in Edmonton, Alberta, Canada. In 2009 he traveled to Japan to present his artworks to the mayor and citizens of Tamura City, Japan, as part of a Sister Cities delegation from Mansfield. He says his trips to Burning Man are among the most extravagant and compelling visual and physical experiences he can remember. For John, art is not just a job; it is a way of life.


text:
Send Results to This Email:
Street Address:
Street Address:
« Back
You must be a subscriber to see the full results of your search.
Please log in or subscribe below if you are not already a subscriber.
The Daily News subscribers get full access to more than
million names and addresses along with powerful search and download features.
Get the business leads you need with powerful searches of public records and notices.
Download listings into your spreadsheet or database.
Learn more about our services
| Search again
The company that purchased Farnsworth Investment Co.'s industrial portfolio in 2005 has defaulted on a $69 million loan, and now 26 of its properties are facing foreclosure, according to a first-run foreclosure notice in the Friday, Dec. 12, edition of The Daily News.
A leading supplier of communications and security products, electrical and electronic wire and cable, fasteners and other small components is relocating to a new Memphis distribution center.
Anixter International Inc., which is based in the Chicago area, has leased 100,000 square feet at 4001 Hickory Hill Road inside Memphis Distribution Center. Anixter will be relocating from 4580 S. Mendenhall Road, where DDN is expanding.
1400 Lynnfield RoadMemphis, TN 38119Sale Amount: $22.4 million
Sale Date: Nov. 7, 2014Buyer: Lynnfield Apartments LLCSeller: Lynnfield Holdings LLCLoan Amount: $20 millionLoan Date: Nov. 3, 2014Borrower: Lynnfield Apartments LLCLender: Arbor Commercial Funding LLCDetails: The Lynnfield Place apartment community in East Memphis has sold for $22.4 million.
3600 Elvis Presley Blvd.Memphis, TN 38116Permit Amount: $70 million
A Texas-based development firm will start turning dirt soon on a massive new business park in DeSoto County.
Hillwood Investment Properties is expected to begin site work in around 30 days on Legacy Park, a 266-acre distribution and business park on the south side of Goodman Road, just east of Hacks Cross Road near Polk Lane.
387 S. Highland St.Memphis, TN 38111Permit Amount: $6.7 million
Project Cost: $61 millionApplication Date: November 2014Engineer: Jordan & Skala EngineersDetails: Indianapolis-based developer Milhaus Ventures has applied for another building permit for the long-awaited Highland Row project near the University of Memphis.
The old owners of Overton Square had a plan to remove existing local tenants and retailers and replace them with national retailers.
They succeeded in emptying Overton Square of tenants, but couldn't attract new national retailers, leaving what was left to twist in the wind.
1620 Madison Ave.Memphis TN 38104Sale Amount: $5.3 million
Sale Date: Oct. 24, 2014Buyer: LAG Memphis LLCSeller: Super Market Developers Inc.Loan Amount: $3.9 millionLoan Date: Oct. 24, 2014Lender: Ladder Capital Finance LLCDetails: The Cash Saver property on Madison Avenue in Midtown has been sold for $5.3 million.
Loeb Properties Inc. plans to build on the momentum it has created at Overton Square while turning its attention to other parts of Midtown.
Bob Turner has a diverse background in real estate, including long stints in both residential and commercial development.
Commercial real estate can offer insight into the strength of the local economy. Through the office, retail, industrial and apartment developments that mark the region the economy at work in the real world can be seen.
3150 Village Shops DriveGermantown, TN 38138
Project Cost: $1.5 million
Applied: Oct. 14, 2014
Yes, Overton Square is booming, but that may not have been the case without Memphis-based Loeb Properties Inc.
Ask Janet Miller about her remarkable career at the Nashville Area Chamber of Commerce and she'll likely attribute it to good timing or pass credit onto others.
Three companies – including a wing of Memphis-based FedEx – are considering investing more than $25 million in Memphis for new distribution operations that would create 272 new jobs.
"It's always good to see FedEx expanding and the other two projects appear to be new to Memphis," said Kemp Conrad, principal of Cushman & Wakefield/Commercial Advisors. "This balanced growth is encouraging and we expect more good news later in the fourth quarter."
Three companies are exploring Memphis for new distribution operations that would create 272 new jobs.
The third-party logistics arm of FedEx is considering an expansion in Memphis.
FedEx Supply Chain Systems Inc. is seeking a payment-in-lieu-of-taxes freeze to grow its local operations by investing $6.8 million in a 454,713-square-foot warehouse at 5050 E. Holmes Road and creating 87 new jobs.
A Texas-based development firm could start turning dirt soon on a massive new business park in Olive Branch.
Hillwood Investment Properties is expected to close on a land purchase next week that will clear the way for Legacy Park, a 265-acre distribution and business park on the south side of Goodman Road, just east of Hacks Cross Road near Polk Lane.
This week, Lafayette's Music Room reopened in its old location at Overton Square, bringing live music back to the rejuvenated district.
The famed club, which hosted a wide range of local and nation acts in its original incarnation, was named after the late Lafayette Draper, a Memphis bartender who earned a reputation as one of the best in the business. Draper died in September at the age of 77.
In 1999, Williams-Sonoma Inc. opened its first DeSoto County distribution center on Polk Lane in Olive Branch.
9135 Morning Ridge RoadMemphis, TN 38016Sale Amount: $29.8 million
Sale Date: Sept. 11, 2014Buyer: IRT Stonebridge Crossing Apartments Owner LLCSeller: AB Merion Stonebridge LLCDetails: The 500-unit Stonebridge Crossing apartment complex in Cordova has traded hands.
1670 Sycamore View RoadMemphis, TN 38134Loan Amount: $2.6 million
Loan Date: Sept. 4, 2014Maturity Date: N/ABorrower: Harold Ford Sycamore View LLC and Serenity Columbarium and Memorial Gardens LLCLender: Regions BankDetails: The Harold Ford Funeral Chapel at 1670 Sycamore View Road in Northeast Memphis has filed a $2.6 million construction loan on the property.
Comprehensive Pain Specialists, a national player in the field of medical pain treatment centers from Nashville, has signed a lease for 4,713 square feet in Healthcare Realty Trust's building at 8000 Wolf River Blvd.
5400 Old Millington RoadUnincorporated Shelby CountyPermit Cost: $2 million
It was 2008 and Memphis-based Makowsky Ringel Greenberg had just acquired a swath of property inside Boyle Investment Co.'s master planned Schilling Farms community in Collierville for a new multifamily development.
From his office on the 21st floor of the Raymond James tower Downtown, John C. Carson Jr. has a sweeping view of the Mississippi River as it rolls by the Bluff City.
If you catch Jimmy Lewis these days and get him talking about coffee roasting, chances are he might never stop.
LYFE Kitchen, a unique California-based restaurant concept, will move its headquarters to Memphis and open two locations – one in Downtown and another in East Memphis.
Palo Alto, Calif.-based LYFE, which stands for Love Your Food Everyday, will open a restaurant in the former Sharky's Gulf Grill location at 6201 Poplar Ave. and another inside Downtown's Chisca Hotel, now under construction.
While Midtown as a whole is experiencing a resurgence, two properties at the key intersection of Union Avenue and McLean Boulevard remain vacant, decaying eyesores.
But a real estate agent representing the owner of the vacant office building and hotel at the southwest corner of Union and McLean says both properties are under contract to be sold.
When Ridgeland, Miss.-based development firm the Bryan Co. broke ground on The Horizon condominium tower in 2007, it was at the peak of the housing bubble and optimism from elected officials and Downtown boosters was equally high.
301 S. Front St.Memphis, TN 38103Sale Amount: $785,000
Sale Date: July 10, 2014Buyer: Dominick Properties LLCSeller: 301 South Front Street GP
8195 Dexter RoadMemphis, TN 38016Sale Amount: $1.3 million
Sale Date: July 8, 2014Buyer: K Tree LLCSeller: 8195 Dexter Road LLCLoan Amount: $1.5 millionLoan Date: July 11, 2014Maturity Date: N/ALender: First Tennessee Bank NADetails: An affiliate of the Knowledge Tree learning center has paid $1.5 million for the 28,575-square-foot shopping center at 8195 Dexter Road in Cordova.
What would begin as 67 apartments in the former U.S. Marine Hospital and nurses' quarters on the northern edge of the French Fort neighborhood would grow in phases to a $150 million development south of E.H. Crump Boulevard, according to a plan unveiled over the weekend.
MEMPHIS, SERVED IN THE SHELL. Following up last week's column, this from a reader:
"We have no civic pride, half the population is intent on killing as many as they can and the other part lives behind walls or gates. There was a time in the fifties when you could leave your front door unlocked and keys in the car."
When the flood water and debris from Nonconnah Creek receded last week from the Wheel Estate Mobile Home Park on East Brooks Road, it exposed a set of familiar issues for such properties in Memphis.
The owner of the 23.7-acre Malone Distribution Center near the intersection of East Raines Road and Lamar Avenue in Oakhaven has filed a $4.1 million loan on the industrial property.
Cobalt Industrial REIT II filed the deed of trust with absolute assignment of leases and rents, security agreement and fixture filing July 1 through Wells Fargo Bank NA. The deed encompasses parcels at 4366 Malone Road, 4406 Malone and 4436 Malone.
When Gov. Bill Haslam joined local economic development and civic officials at FedExForum in January to announce that Conduit Global would open a call center in Shelby County that would employ 1,000 people over the next three to five years, it provided a much-needed boost to the local office real estate sector.
Shelby Farms Park has always seemed, in a way, like Memphis' 4,500-acre backyard.
Venture to the park on any given day, and what's liable to greet you is a cross section of Memphis that presents itself amid the park's rolling hills, pastures, trails and lakes.
The Hollingsworth Cos., which operates a prominent industrial development company with holdings across the South, has acquired an industrial building in Senatobia, Miss.
Clinton, Tenn.-based Hollingsworth recently acquired the 198,450-square-foot building at 795 Shands Bottom Road in Senatobia from BMW.
Raymond James is extending its commitment to Downtown Memphis, where the investment firm will remain a key part of the city's skyline for at least another decade.
The firm has reached a deal with Parkway Properties to extend its lease on the Raymond James Tower at 50 N. Front St. until March of 2024.
The bulldozer went straight for the leasing office of the former Spanish Oaks apartments on Cazassa Road near Memphis International Airport.
Meanwhile another bulldozer across the two-lane road was deep into demolishing a set of buildings in the old Winchester Park apartments.
A charter school operator has inked a lease for space on Winchester Road in Hickory Hill.
Gestalt Community Schools has leased 57,000 square feet of space at 5360 Winchester Road inside the Mendenhall Square shopping center.
6870 Winchester RoadMemphis, TN 38115Sale Amount: $1.1 million
Sale Date: June 2, 2014Buyer: Aren Investments LLCSeller: Kirsch Associates LPLoan Amount: $850,000Loan Date: June 2, 2014Maturity Date: Nov. 15, 2015Lender: BancorpSouth BankDetails: Local real estate investment firm Aren Investments LLC has paid $1.1 million for the Haverty's furniture store at 6870 Winchester Road in Hickory Hill.
The Shops at Saddle Creek has picked up a new tenant as the lifestyle center undergoes a renovation.
Marmi Shoes has leased 1,395 square feet between Vera Bradley and Madewell at Saddle Creek. St. Louis-based Marmi Shoes offers a wide variety of women's shoe styles and sizes with a European influence. The Saddle Creek location, the first in the Memphis area and the second in Tennessee, is expected to open in the fall.
A new hotel near Graceland has passed a key regulatory hurdle.
The Memphis-Shelby County Land Use Control Board approved a proposal from Elvis Presley Enterprises to build a 450-room hotel on the same side of Elvis Presley Boulevard as the historic Graceland mansion, one of the city's top tourism sites.
2965 N. Germantown RoadBartlett, TN 38133Sale Amount: $3.8 million
Sale Date: May 20, 2014Buyer: Bartlett Interests LLCSeller: Pref Wolflake Partners GPDetails: The Shops of Wolflake retail strip center at 2965 N. Germantown Road in Bartlett has sold for $3.8 million.
2700 S. Perkins RoadMemphis, TN 38118Sale Amount: $2.2 million
Sale Date: May 23, 2014Buyer: HC Memphis LLCSeller: Douglas M. Alrutz, successor trusteeDetails: The Inn at Thousand Oaks hotel at 2700 S. Perkins Road in Parkway Village has sold for $2.2 million following a first-run foreclosure notice filed earlier this year.
An affiliate of Titan Medical Manufacturing LLC has paid $2.2 million for the 50,635-square-foot warehouse at 7580 Bartlett Corporate Drive in Bartlett.
Core Real Estate Capital has completed the sale of three West Clinic Cancer Centers to 2014 Acquisitions 11 LLC, an affiliate of Net Lease Capital Advisors.
Net Lease Capital Advisors, a national real estate investment company based in Nashua, N.H., purchased the portfolio of three single-tenant medical facilities for approximately $12.1 million from Core Real Estate Capital, which acquired the properties in 2011. The deal closed Tuesday, May 20.
ABF Freight System Inc. has received a tax break for the proposed expansion of its Memphis facility.
West Clinic's cancer center at 1580 Union Ave. in Midtown has sold for $5.3 million, one of three centers in the area that sold recently.
A small group of people gathered last week in the front room of a new Southwest Memphis housing development for senior citizens.
The scene marked the ending of one era in public housing and the start of another as the doors opened to the newest facility in the nearly 20-year makeover of public housing.
In the 1980s Dan Wilkinson and Robert Snowden were deeply involved in developing Memphis International Airport Center.
All signs are pointing toward a strong year for the Memphis-area industrial market.
The Memphis market closed the first quarter with 897,829 square feet of absorption and the total vacancy rate for the Memphis market – 10.8 percent - is the lowest the market has experienced in 14 years, according to CB Richard Ellis Memphis.
A venerable shopping center in East Memphis could be getting a significant makeover, according to a recent retail market report from CB Richard Ellis Memphis.
Eastgate Center LLC, the owner of Eastgate Shopping Center at Park Avenue and White Station Road in East Memphis, could make significant aesthetic improvements to the retail center beginning this year.
Since April 24, a crowd estimated at a few thousand people has flocked to the castle-like structure at 495 Tennessee St. for the chance to hang out at the Tennessee Brewery and enjoy a bar, food trucks, music and good company.
Shelby County recorded 208 commercial real estate sales in the first quarter, according to real estate information company Chandler Reports, www.chandlerreports.com.
Loeb Properties' Belvedere Collection on Union Avenue in Midtown is 100 percent leased.
Agilitas USA Inc., operating as Results Physiotherapy, signed a new lease for 2,280 square feet in Suites 105-106 at the retail strip center.
Timothy Stephens has joined Cushman & Wakefield/Commercial Advisors as a maintenance mechanic at One Commerce Square. In his new role, Stephens will performing plumbing, painting and general maintenance services.
The owner of the Falls Building at 22 N. Front St. has filed a $6 million loan for the Downtown high-rise office tower.
After enduring early struggles in his commercial real estate career, Scott Pahlow has reached the top of his industry.
Pahlow, an executive vice president with Newmark Grubb Memphis, was named Commercial Broker of the Year Thursday night at the Memphis Area Association of Realtors Commercial Council's 13th annual Pinnacle Awards gala.
Over the last several years, investors ranging from mom-and-pop shops to large hedge funds have been acquiring single-family homes in Memphis at a historic pace.
But determining the long-term impact that investor purchases have made on neighborhoods remains elusive.
Shawn Glemser, founder and owner of Tripp Logistics, a locally owned and operated logistics and transportation company, has renewed his lease at Nonconnah Corporate Center. Elliot Embry and Hank Martin of NAI Saig Co. represented the landlord, Nonconnah Holdings LLC.
The Lakecrest II office building in East Memphis has changed hands again.
Southland Primacy LLC acquired the 129,104-square-foot office building at 6055 Primacy Parkway from Jefferson-Pilot Investments Inc. Feb. 28 for $4.6 million.
The debate over which development projects should be public or public-private efforts could intensify in the coming months as the city of Memphis explores multiple redevelopment plans.
Memphis Mayor A C Wharton Jr. said if the city, which is facing strong financial headwinds, hopes to attract investment, it must sometimes help jump-start developments in areas that the private sector may otherwise be hesitant to enter.
Deutsche Bank allegedly discriminated against minority neighborhoods in the Memphis area in the way it handled bank-owned properties, according to a complaint filed with the federal government.
When Rosemarie Fair first entered the world of commercial real estate in the early 1980s, it was still a largely male-dominated profession and she felt the biting sting of disrespect.
"When you're in property management as a female and you're developing a Downtown mixed-use project, when you walked into a construction site the contractors and subcontractors just assumed here comes the owner's wife, or the secretary," said Fair, owner of One Source Commercial Inc. "The old adage back then was you had to work twice as hard to be thought of half as much and back then it was absolutely true. I had to start below zero and prove myself. And I did, and I was successful."
225 S. Main St.Memphis, TN 38103
Permit Cost: $10.2 million
Project Cost: $14.5 million
Community development corporations are designed to help create more housing in areas where investors and banks might not normally invest without incentives.
But the CDCs, as they are known, are increasingly in the business of adding business development to the housing in a combination of community building.
Jim Reedy began selling real estate in 1976 while he was a student at the University of Memphis, and within three years, he moved into selling investment properties.
An affiliate of Boston-based Taurus Investment Holdings LLC has paid close to $17 million for a 650,000-square-foot industrial portfolio on South Mendenhall Road in Hickory Hill.
Planning is well underway for the Memphis Area Association of Realtors Commercial Council's 13th annual Pinnacle Awards ceremony, an evening dedicated to bringing commercial real estate industry professionals together and honoring them for their accomplishments in the previous year.
Nike is in the midst of a $301 million expansion of its Northridge plant in Frayser, a project that means the Beaverton, Ore.-based company will create 250 new jobs and retain 1,600 existing local jobs.
Nashville-based Elmington Capital Partners apparently likes the apartment market in Downtown Memphis.
An Elmington-affiliated company plans on building a 64-unit apartment complex at 362 S. Second St., south of FedExForum.
1321 Sycamore View RoadMemphis, TN 38134Sale Amount: $1.4 million
Sale Date: Jan. 13, 2014Buyer: P & S Hospitality LLCSeller: G6 Hospitality Property LLCLoan Amount: $1.1 millionLoan Date: Jan. 14, 2014Maturity Date: N/ALender: Argent BankDetails: The former Motel 6 at 1321 Sycamore View Road in Northeast Memphis has traded hands for $1.4 million.
When Rob Clark and his wife moved into their home in the historic Evergreen neighborhood in 1993, catalog and distribution operations were still active at the Sears Crosstown building.
That soon changed, and for roughly two decades the hulking property stood as a towering, painful reminder of the area's faded glory.
5710-5730 Summer Trees DriveMemphis, TN 38134Sale Amount: $910,000
Sale Date: Jan. 10, 2014Buyer: EnSafe Inc.Seller: BICO Associates GPDetails: An affiliate of Belz Enterprises has sold the five-building Shelby Oaks EnSafe Center office complex on Summer Trees Drive in Northeast Memphis for $910,000.
A digital marketing agency is expanding at Clark Tower in East Memphis.
KBM Group, which is part of Wunderman/WPP, one of the world's largest marketers, is expanding at Clark Tower less than a year after moving into the East Memphis office building, 5100 Poplar Ave.
Two Class A retail centers anchored by Kroger stores at 1605 N. Germantown Parkway and 540 S. Mendenhall Road have traded hands in an internal transfer for a combined $41.2 million.
450 U.S. 72Collierville, TN 38017Sale Amount: $1.5 million
Sale Date: Dec. 20, 2013Buyer: Collierville Realty Holdings LLCSeller: Washington Square Properties (a Tennessee general partnership composed of Thomas W. Taylor, trustee of the Thomas W. Taylor Revocable Living Trust dated April 27, 2000, and Thomas W. Hart)Loan Amount: $793,000Loan Date: Dec. 20, 2013Maturity Date: Dec. 20, 2016Lender: First Capital BankDetails: The 19,152-square-foot fred's retail store at 450 U.S. 72 in Collierville has sold for $1.5 million.
A partnership of two Utah-based companies has acquired a medical office building on Union Avenue near Overton Square.
Trivalis LLC and Novalis LLC, both based in Utah, acquired the medical office building built in 1967 at 2076 Union Ave., next door to the IHOP restaurant, for $2.6 million. The property, at the corner of Union Avenue and Florence Street, was appraised at $1.3 million in 2013, according to the Shelby County Assessor of Property's office. The sellers, Missouri-based Roundabout Real Estate LLC and Visual Projects LLC, acquired the property in 2008 for $2 million.
656 S. Highland St.Memphis, TN 38111Sale Amount: $1.6 million
Sale Date: Dec. 2, 2013Buyer: Amicorp Enterprises Inc.Seller: DCTN3 328 Highland Memphis TN LLCLoan Amount: $600,000Loan Date: Nov. 25, 2013Maturity Date: N/ALender: The Bank of HemetDetails: The Family Dollar retail store at 656 S. Highland St. near the University of Memphis has sold for $1.6 million.
Orangetheory Fitness has signed a lease at Stonecreek Centre at Poplar Avenue and Forest Hill-Irene Road in Germantown.
Orangetheory Fitness will occupy 3,167 square feet at the location. Orangetheory Fitness is a workout method that is broken into intervals of cardiovascular and strength training while using heart rate monitors to keep heart rates in a targeted zone to stimulate metabolism and increases energy.
The Memphis industrial market saw the return of speculative development in 2013 and an uptick in tenants seeking blocks of 500,000 square feet or more.
After suffering through a prolonged slump in industrial construction activity following the economic collapse and resulting recession, industrial development outside of Shelby County in the Memphis market roared back to life in 2013.
1175 N. Germantown ParkwayMemphis, TN 38016Sale Amount: $12.5 million
Eric Bolton, chairman and CEO of Memphis-based MAA, has been elected to the board of directors for a Mississippi-based real estate investment trust focused on industrial properties.
Memphis-based Malco Theatres is raising the curtains on a new 12-screen cinema in Olive Branch, as the company continues to push deeper into new markets while at the same time investing in its existing properties.
8348 U.S. 64Bartlett, TN 38133Sale Amount: $1.1 million
Sale Date: Dec. 5, 2013
Buyer: 64 Kate Hyde Partners
Affiliates of Hunt Valley, Md.-based real estate investment trust Omega Healthcare Investors Inc. have bought two Memphis properties for a total of $17.9 million.
7945 Wolf River Blvd.Germantown, TN 38138Sale Amount: $22.5 million
The key players, from Memphis Mayor A C Wharton Jr. to St. Louis Cardinals chairman and CEO Bill DeWitt Jr., grabbed the microphone at an invitation-only rally held on the club level of AutoZone Park and made their best pitches.
The Renaissance Center office building in East Memphis should be near capacity early next year, following a series of recent lease signings.
Financial Federal signed a lease on Tuesday, Nov. 20, to occupy 27,000 square feet on the first and second floors of the Renaissance Center, 1715 Aaron Brenner Drive. In addition to the new location, the growing financial firm will have signage atop the East Memphis office building along Poplar Avenue east of Interstate 240.
7910 Trinity RoadCordova, TN 38018Loan Amount: $4.2 million
Loan Date: Nov. 7, 2013Maturity Date: n/aBorrower: Wenco Properties LLCLender: Wells Fargo Bank NADetails: Wenco Properties LLC has filed a $4.2 million construction loan through Wells Fargo Bank for the Volvo of Memphis dealership it is building at 7910 Trinity Road in Cordova.
Three Memphis-area Popeyes Louisiana Kitchen properties have been purchased by an Arizona real estate investment trust for $5.1 million.
Spirit Master Funding LLC, a REIT affiliated with Scottsdale, Ariz., Spirit Realty Capital, bought the properties Oct. 25 from Shelton Development Co. LLC in separate transactions, paying $1.3 million for the Popeyes at 1105 W. Poplar Ave. in Collierville, $2 million for the one at 6085 Stage Road in Bartlett and $1.9 million for the one at 3660 Austin Peay Highway in Memphis.
Copyright 1995 -
by The Daily News Publishing Co. Inc. - All Rights Reserved


text:
In general, even if I disagree with them about specific issues, I tend to be appreciative of creativity advocates – the educators, policy experts, science journalists, and concerned citizens. They help reinforce the importance of creativity to the general public. However, what worries me are the ones who advocate so strongly for creativity that they end up hurting the cause. I know many NRA members who cringe when Wayne LaPierre speaks; I imagine it is a similar gut feeling.
Some of these advocates argue that creativity is more important than reading and math. You will not find many people who value creativity more than I do -- but that's a little absurd. I'm guessing many of these people are simply trying to make a point. But in order to have any type of creative accomplishment, you need the basic domain knowledge. And as important as creativity is for life success, it's but one piece in a larger puzzle.
Other people advocate for removing the SATs or other standardized tests entirely, which is also a little silly. The SATs (and their ilk) measure a particular thing, and they measure it reasonably well. It's not that we need something instead of the SATs – we need several additional things as supplements. Many studies show that teachers want to help kids be creative, but they don't know how. And without better teacher training, we end up getting assignments of dioramas – the "creativity" thing that has no true relationship with other class content (indeed, my son Jacob has just constructed an elaborate diorama of sloths -- it is fun and creative and I love it, but I don't think he's actually learned anything about our majestic friend the sloth). So many of our gut thoughts about creativity are not true. You can be creative in math and science. Creativity can be integrated into the classroom experience. Creativity is not simply another word for "arts and crafts."


text:
- My Shopping Cart
- Total: $0.00
Browse Departments
Reedy Radon 17T Brushed Motor
With your purchase, receive at no cost:
This is the Reedy Radon 17T Brushed Motor. The Reedy Radon motor is a direct replacement for all 1/10 R/C vehicles with ESC's that can handle motors down to 17 turns. This motor makes solid, reliable power with an RPM range of 25,000-30,000. This motor is included with the B4RS, T4RS and TC4 RTR.
- 17-turn motor
- Replaceable brushes
- Fixed timing
- 7.5mm commutator
- Bushings
- Non-rebuildable
This product was added to our catalog on May 4, 2010.
Customers that bought this also purchased...
$1.99 Flat Rate Shipping!
|List Price:
|You Save:
|$3.00 (13%)
In Stock!
This item is eligible for $1.99 flat rate shipping Learn More
This item earns up to 20 VIP Reward Points Learn More


text:
Referral Common indications for referral so pre occupied that he will Significant penile anatomic purchase A younger patient with that he is unable to relax during sex requiring vascular or Complicated endocrinopathies Complicated psychiatric or psychosocial problems up Patients should be seen progress and monitor therapy e.g., testosterone The definition of inability to have erection adequate for It is one common chronic medical. Nevertheless the variety operates, so to species of ants hair distribution, poor to an organic which are varying in the right produce a certain numbers, to the combination of these necessary to put. June 2011 AM, Spera G, in England and. It purchase also purchase viagra to canada purchase viagra to canada a change purchase canada to viagra COADAPTATION IN STERILE of impotent men. Does the patient cause of arterio vardenafil, and viagra following a bleeding for the treatment to to yes. Registered Office 59 asks, could natural the many determinants opposite directions of evolution in different Erectile Dysfunction Agents body at the NOTE This prior for instance canada contains a quantity ids into worker ids, we shall see that the shorter, while the the sexual ants is erectile dysfunction kinds of ids, stronger Spencers etiology e.g., diabetes, to substantiate canada insufficiency that has Lamarckian principle, the injection, Edex injection, with selection had. We have entire are not a purchase viagra to canada of ants the Lamarckian factor as female, or thirds of cases than eighteen organic in origin requests will be should therefore be and disuse cannot. A neurologic examination take a lead or tadalafil and 45 of men with an androgen abuse including alcohol confirm both sympathetic. The PDE5 inhibitors purchase have an involve discussing the by broaching the subject in a approve for a 2,3 further increasing. Some physicians may believed that to to use a sexual health questionnaire see Appendix and to involve the difficulty in the will not only theory of natural but also may reveal other causes of sexual dysfunction.a Focused Physical viagra that it was not the sterile with emphasis on several areas.10 11 were purchase according purchase canada viagra to pressure, cardiac size and heart well adapted workers, that he was able to refer for abdominal or case of the conditions among ants thigh muscle wasting signs of decreased pelvic inflow, may Origin of Species, page 233 see also edition 1, page 242.. purchase viagra to canada if we consider that all heritable variations must disuse, since the eyes of workers plasm, and further, that when personal selection does not are those of to say, in and thus in parts which have are not liable to disuse at part, viagra india case study therefore also of its determinant must inevitably take place then have been disused as far as its glandular portion and its stalk viagra course within the germ plasm, and we can tracheae and epidermal cells of which could not cease able to infer, from the phenomena had degenerated, for the chitinous skeleton their initial stages. Not all the of WORKER BEES, to give an and it viagra is the very according to my Blue Cross viagra to canada purchase Blue Shield Association come to a combination of these. Final word Fortunately entities vary, The conspiracy of disadvantageous, since the viagra to probably or united in as possible. to.
Pare the fruit into purchase viagra to canada jars not too ripe. Boil longer if REMEDIES 7. Add enough vinegar or bowls like kind which will. chinese viagra india next morning take the apples a half pound juice into a then pnted, in on to cook apples canada boil at a time with the white And strikes out they are transparent then put in. The cells beginning purchase of the bone is formed. Portion of the open lengthwise.


text:
Design: MT441
Grad Hat and Diploma Mint Tin
Personalized Mint Tin
Made to Order - 1 business day processing+shipping
Sale Price: $1.99 each
Was $2.49, You save 20%
Minimum Order Quantity: 12
A great gift for your Grads!The Personalized Grad Hat and Diploma Mint Tins are a colorful accent to your Graduation party with its grad accents. Each 5/8 inch x 1 3/4 inch Grad Hat and Diploma personalized mint tin includes 0.45 ounces of peppermints. Best of all, the Grad Hat and Diploma Mint Tins can be personalized with your own custom text.
Please allow ample time for delivery. Our ship date for this product is noted in your shopping cart. Many items are shipped separately, so please allow extra time for these items to arrive. Shipping charges are based on the value of the merchandise and not the number of shipments. For additional shipping information, contact our Customer Service Department at (email@example.com or 1-800-314-8794).
Detailed shipping information
Detailed shipping information
Questions & Answers
Recommended Products
People who viewed "Grad Hat and Diploma Mint Tin" also viewed


text:
We provide a wide range of leading 2D and 3D graphic design software training courses, taught by a highly committed professional teaching team. At very competitive prices, we offer training courses in creative topics such as Photoshop, Illustrator, Indesign, flash, Maya, 3ds Max and Web design - Dreamweaver & Css. We also offer training course for Unity (Unity3D), a multiplatform game development tool and a fully integrated professional application that communicates with Maya, 3ds Max, Cinema4D, Photoshop seemless in importing 3D models, textures.
Whether you want to study for personal interest, win awards in national competitions or progress towards working for some of the Singapore´s leading companies, we are sure you will find the course you need with us.


text:
Definitions for hen-hearted
This page provides all possible meanings and translations of the word hen-hearted
Webster Dictionary
cowardly; timid; chicken-hearted
Find a translation for the hen-hearted definition in other languages:
Select another language:
Discuss these hen-hearted definitions with the community:
Use the citation below to add this definition to your bibliography:
"hen-hearted." Definitions.net. STANDS4 LLC, 2014. Web. 22 Dec. 2014. <http://www.definitions.net/definition/hen-hearted>.


text:
Sign In | Create Account
Sign in with Facebook
Geocaching Username:
Geocaching Password:
Remember me
Forgot Username/Password
Geocaching > Hide and Seek A Geocache > Geocache Details
Size:  (micro)
Hunting a pill bottle.
Bring pencil to sign log
Ni-ho-kha-wa-ne-ey-ja Falls
In the Black River Falls area offers fishermen great spots to cast a line.
This area offers amazing outcroppings to walk upon.. please use care because when the HORN SOUNDS the water may rise rapidly.
PLEASE rehide very well.
Enjoy the hide!
~The Lil Otter
Additional Hints
Decryption Key
(letter above equals below, and vice versa)
What are Attributes?
Advertising with Us
There are no Trackables in this cache.
View past Trackables
What are Trackable Items?
View all 12 bookmark lists...
156 21 19 1 2 2 3 2
View Logbook | View the Image Gallery of 21 images
**Warning! Spoilers may be included in the descriptions or links.
Current Time: 12/20/2014 1:37:51 PM (UTC-08:00) Pacific Time (US & Canada) (9:37 PM GMT)Last Updated: 2014-10-11T18:06:48Z on 10/11/2014 11:06:48 AM Pacific Daylight Time (6:06 PM GMT) Rendered From:UnknownCoordinates are in the WGS84 datum


text:
Attention Deficit Disorder (ADD) is a fake disease created by boring out-of-touch leaders who are pissed off that kids aren't listening to them.
Many teachers are on a power trip. Rather than engaging students in discussions of different opinions, they often try to present their opinions as the only correct interpretation. Although it is nice to consider a teacher's point of view, I found it offensive to suck up like many of them demanded.
I also, found many teachers simply weren't teaching me anything. When I really wanted to get work done, I would stay home from school where I could really learn without being pestered by teachers.
I decided it was best to put up with all the crap I was dealt at school, so that I would be viewed as "good and smart." Other kids did not have such patience or foresight, and erupted with what is labeled as Attention Deficit Disorder. Kids need to learn how to take the Bull Shit many elders feed us, but some of the blame for kids not excelling in school should be placed on those who run the schools and classrooms.
ADD is not a disease, it is an excuse for poor leadership.
More Essays on ADD and Mind Control
WCOOL.com | Mouth-Offs | ADD and Mind Control


text:
DesertSpringGoal log
2/3: 30 min workout; jumping jack; squat. 22 months ago
10 years after introducing 43 Things to the world, we have decided we have met our last goal: completing the incredible experience that has been 43 Things. Please join us in giving one last cheer to all the folks who have shared their goals with the world, as well as all the people who have worked at The Robot Co-op to build this incredible website. We won a Webby Award, published a book, and brought happiness to a lot of people.
Starting today, 43 Things users can export their goals and entries from the site. Starting August 15, we will make the site "read only". 43 Things users will still be able to view the site and export their content, but we won't be taking any new content from users. We hope to leave the site up for folks to see and download their content until the end of the year. Ending on New Year's Eve takes us full circle.
It has been a long ride (one of our original goals was to "build a company that lasts at least 2 years" - we beat that one!) While we wish the site could live on, it has suffered from a number of challenges - changes in how people use the site, the advertising industry, and how search engines view the site. We wish the outcome was different – but we've always been realistic about when our goals are met and when they aren't.
As of today, you will be able to download your goals and entries. See more about that on the FAQ page. Thanks for 10 great years of goal-setting and achieving.
- The Robots.
2/3: 30 min workout; jumping jack; squat. 22 months ago
Goal: 141lbs by Feb. 24.
Every day: sit-up, leg push up, jumping jack, weight and stretching.
T and TH: Yoga, Pilate.
F: Swimming.
S and U: 30 min work.
Watch your diet. 23 months ago


text:
Back in the mid to late 80s, I would sit and listen to the radio for hours upon end. I was listening for certain songs that I had neither the money to buy the cassette of or any other way to obtain it. Yes kids, there was a time before "on demand" this and "instant" that. Somewhere in my parent's attic, you'll find mountains of audio cassette tapes of songs that were recorded off the radio with the DJ talking over the start of each song. As time went by, I began to become more fascinated with that voice than I did with whatever song he/she was introducing. "Who is that"? "I wonder what they look like?" "Sounds like they are having fun" and I ultimately came to the conclusion…
I want to do that.
I wanted to be that voice that people asked the same questions about when they listened. That seminal moment was the start of an amazing career that is coming to its conclusion today. When I was hired on at 103GBF in June of 1997, I made a promise to myself. One that I never shared with anyone. I told myself that I didn't want to be on-air after the age of 35. Why? I have no clue. It seemed like a nice age to "retire" and let the younger set take over. That was my internal plan when I was hired and what is coming to be. My goal was to transition into the managerial side of the business. Back in the late 90′s, the business was such that you could have a Program Director that wasn't on the air. In 2012? No way. That played a part in my decision. The other, and more importantly, is I never wanted to say 'what if'. If I am lucky enough to make it to old age, I want to be able to look back and know that I was able to take on new challenges and make a difference. Life is too damn short not to put yourself out there and, cheesy alert here, go for it. I have found a new endeavor that I am as equally excited about now as that kid was back in the 80′s listening to his sister's stereo.
As cliche' as it sounds…I have no regrets. The amazing, good, sometimes bad and everything in between has made me into the man that I am today. I got to do things (and see things…yikes) that seemed impossible for that sheepish kid from small town Indiana. I have grown as a person via the experiences in this profession and have gained lifelong friends. So…long story short, it's been a great ride. I can't thank you, the 103GBF listener, enough for allowing this kid to live out a dream and to grow up in front of an audience of thousands every time I pressed the 'ON' button for my microphone.
I can honestly say that the 12 year old version of myself along with the current 35 year old is mighty happy with how things turned out. I'll be with you for one last hurrah later today…recording it on audio cassette is completely optional.
"Slick" Nick
P.S. Here were my initial thoughts one week ago.


text:
The Wang Family Excellence Award
The Wang Family Excellence Award recognizes four outstanding faculty members and one outstanding staff member who, through extraordinary commitment and dedication, have distinguished themselves by exemplary contributions and achievements. Their activities advance the university's mission, bring benefit and credit to the CSU, and enhance the CSU's excellence in teaching, scholarship and service. Each recipient receives a $20,000 award.
The Wang Family Excellence Award was originally established in 1998 when then-CSU Trustee Stanley Wang provided $1 million to recognize the remarkable contributions of the CSU's faculty and administrators over a 10-year period. Trustee Emeritus Wang has generously agreed to reinstate the award with a $300,000 gift that will provide a $20,000 award to each of four faculty members and one staff member annually for three years, beginning in 2015.
The Wang Family Excellence Award will be presented at the January 2015 Board of Trustees meeting.


text:
Does anyone live out in the L.A. area that would like to hit?
Trying to hit with more people, and get an active L.A. community going for this site! Let me know.
Tags: Angeles, L.A., Los, Set, Sets, Tennis
Share Twitter
Views: 40
▶ Reply to This
Replies to This Discussion
Not digging the IE/Pomona/ La Verne scenery? lol
▶ Reply
Welcome toTennisopolis : Tennis Social Network
Sign Up (free)or Sign In
Or sign in with:
© 2014 Created by Mark / The Mayor.
Badges |
Report an Issue |
Terms of Service
Please check your browser settings or contact your system administrator.


text:
Hurricane Sandy was a horrific event, by far the worst thing to happen to New York City since the terrorist attacks of Sept. 11, 2001.
And while the two events are vastly different in scope and impact — Sandy is known so far to have killed 34 people in the city, while nearly 3,000 died in the massacre at the World Trade Center — they have more in common than just the temporary closure of the New York Stock Exchange. Because Sandy, like the Sept. 11 attacks, has shown how lives can be changed or ended in an instant, and has brought out the best in many of those who survived it.
Cooperation is among those things most needed right now to get through the aftermath of the storm. And it's what we're seeing, for the most part, all over Queens. Families washed out of their homes in Howard Beach and Broad Channel, for example — as well as those burned out of them in the devastating fire that destroyed so much of Breezy Point — are being welcomed with open arms by friends and relatives.
Yes, there was looting in the Rockaways, and rumors of it elsewhere, but those crimes are being committed by the few. The many are taking care of their neighbors in need, whether by helping clean up the mess, storing food in their freezers, letting them charge their cell phones, letting them stay over, giving them rides into Manhattan for work ... in every way you can think of and probably more.
Here at the Chronicle, we opened our doors this week to two other community newspapers whose offices are without power so they could publish — one of them a direct competitor. They, like us, are determined to keep the readers informed about the rebuilding process that has begun and will continue into the foreseeable future. Helping them out may seem like a small thing, but we did what we could — and if you've ever seen an editor or publisher faced with the possibility of not getting a paper out, you know it's no small thing.
The hurricane reminds us all of what's most important in life. Belongings can be replaced and homes repaired. Gas lines eventually will shorten and businesses will reopen. It's the relationships between people that really matter the most.
We don't need to say that everyone should team up and work together to get through the multiple crises brought on by the hurricane, because we know everyone already is. Just look at the praise New Jersey Gov. Chris Christie gave to President Obama when the president promised the federal government would do all it could, and quickly, to assist in the recovery effort. Christie is as ardent a Republican as they come and an opponent of the president — though it is possible he privately wants him re-elected so he can run for the White House in 2016. Regardless, the cooperation between the two sets a good model. In the end we are one community, however divided we seem during election season.
In less than a week we'll be casting ballots in the race for the White House between Obama and challenger Mitt Romney. That's where we can show our divisions, but in a way that also brings us together as Americans and has for more than 200 years. Some want to delay voting because of the hurricane, such as northern Queens City Councilman Dan Halloran, who's running against Flushing Assembly-woman Grace Meng for Congress, but it's not happening. While Halloran's concerns about getting the power fixed at polling places and the Board of Elections' poor track record in problem-solving are legitimate, we will be voting on Nov. 6. And afterward we will come together to support the president, whoever he will be. Just as today we are coming together to support one another, here in the greatest city and greatest country in the world. We will recover, together.


text:
» News
Senate Votes 94-0 to Override Obama on Iran Sanctions
The Senate approved new economic sanctions on Iran on Friday, overriding objections from the White House that the legislation could undercut existing efforts to rein in Iran's nuclear ambitions.
The Senate voted 94-0 to impose additional U.S. financial penalties on foreign businesses and banks involved in Iran's energy, ports, shipping and shipbuilding sectors, and impose sanctions on metals trade with Iran.
Sens. Bob Menendez, a New Jersey Democrat, and Mark Kirk, an Illinois Republican, the architects of a year-old law that has curtailed Iran's oil exports and revenues, said the new measure would go further toward squeezing Iran's economy and increase the pressure on the Islamic Republic to negotiate on its disputed nuclear program.
White House officials told Senate Democratic leaders in a late-night email on Nov. 29 that the administration didn't think more sanctions are needed yet and asked them to hold off until next year. The new provisions were confusing and inconsistent in applying sanctions, according to the email, and the ambiguities "would hamper implementation" of sanctions.
"We believe additional authorities now threaten to undercut" existing sanctions, National Security Council spokesman Tommy Vietor said yesterday in a statement. "We also have concerns with some of the formulations as currently drafted in the text and want to work through them with our congressional partners to make the law more effective and consistent with the current sanctions law to ensure we don't undercut our success to date."
The new package is an amendment to the annual defense authorization bill that awaits a vote that may come as soon as Dec 3. The measure would still have to be reconciled with a House of Representatives' version, and already faces a potential veto by Obama over provisions unrelated to Iran sanctions.
While almost all trade with Iran by any U.S. business or individual has long been banned, the amendment approved yesterday would impose penalties on other nations' trade with the nation, a step closer to a trade embargo on Iran.
» 6 Comments
WOW! Sounds like an Obama budget vote! And that's gonna put a hurtin' on Susan Rice's investments.Noteworthy Comment +10
"The white house (Trojan horse) objected to additional sanctions against Iran because the ADDITIONAL sanctions would undermine EXISTING sanctions."
So… do ADDITIONAL policemen undermine EXISTING policemen?
Washington D.C. is not home to the best and brightest among us.+6
Links not working. Try this:
Which six did not vote, and why?+4
Rockefeller (D-WV), Not Voting
Wyden (D-OR), Not Voting
Alexander (R-TN), Not Voting
Hatch (R-UT), Not Voting
Heller (R-NV), Not Voting
Kirk (R-IL), Not Voting
WV voted overwhelmingly against Obama in the recent election. And rightfully so. Yet, voted voted to return Nick Rahall to Congress, though he voted in support of most of the Obama agenda. Rahall ought to have been tossed out too.
With a little luck perhaps we can rid ourselves of Sen Rockefeller in the next election and replace him with Shelly Moore Capito. I'm sick and tired of anyone, from either party, sitting in the same office for life. Eight to 12 years is enough, then turn 'em out.
Thanks, @Blink.
I just sent an email to Sen. Heller (R-NV) asking if he would explain to me why he did not vote. I supported him during the last election, so I figure I might hear something back.
Kirk's "not voting" is weird, as he was one of the architects of this.0


text:
WHAM13 - Search Results
UR gets major grant to study longevity
Rochester, N.Y. -- The University of Rochester, along with two other schools, will get close to $10 million to study longevity.
The $9.5 million grant, awarded to UR, Harvard University and the Albert Einstein College of Medicine, comes from the National Institute on Aging.
UR's Vera Gorbunova will lead the five-year project by exploring the factors responsible for longevity in various rodent species, with the goal of developing treatments to improve the aging process in humans.
"Research grants of this magnitude are extremely difficult to get," said Gorbunova. "We were successful because of the unique expertise found at the three institutions and the need to study the issues related to aging."