blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html">Magnetstripeinnhold i billetter fra Flytoget og Hurtigruten</a></div>
  24   <div class="date">2010-05-21 16:00</div>
  25   <div class="body">
  26 <p>For en stund tilbake kjøpte jeg en magnetkortleser for å kunne
  27 titte på hva som er skrevet inn på magnetstripene til ulike kort.  Har
  28 ikke hatt tid til å analysere mange kort så langt, men tenkte jeg
  29 skulle dele innholdet på to kort med mine lesere.</p>
  30
  31 <p>For noen dager siden tok jeg flyet til Harstad og Hurtigruten til
  32 Bergen.  Flytoget fra Oslo S til flyplassen ga meg en billett med
  33 magnetstripe.  Påtrykket finner jeg følgende informasjon:</p>
  34
  35 <pre>
  36 Flytoget Airport Express Train
  37
  38 Fra - Til        : Oslo Sentralstasjon
  39 Kategori         : Voksen
  40 Pris             : Nok 170,00
  41 Herav mva. 8,00% : NOK 12,59
  42 Betaling         : Kontant
  43 Til - Fra        : Oslo Lufthavn
  44 Utstedt:         : 08.05.10
  45 Gyldig Fra-Til   : 08.05.10-07.11.10
  46 Billetttype      : Enkeltbillett
  47
  48 102-1015-100508-48382-01-08
  49 </pre>
  50
  51 <p>På selve magnetstripen er innholdet
  52 <tt>;E?+900120011=23250996541068112619257138248441708433322932704083389389062603279671261502492655?</tt>.
  53 Aner ikke hva innholdet representerer, og det er lite overlapp mellom
  54 det jeg ser trykket på billetten og det jeg ser av tegn i
  55 magnetstripen.  Håper det betyr at de bruker kryptografiske metoder
  56 for å gjøre det vanskelig å forfalske billetter.</p>
  57
  58 <p>Den andre billetten er fra Hurtigruten, der jeg mistenker at
  59 strekkoden på fronten er mer brukt enn magnetstripen (det var i hvert
  60 fall den biten vi stakk inn i dørlåsen).</p>
  61
  62 <p>Påtrykket forsiden er følgende:</p>
  63
  64 <pre>
  65 Romnummer 727
  66 Hurtigruten
  67 Midnatsol
  68 Reinholdtsen
  69 Petter
  70 Bookingno: SAX69   0742193
  71 Harstad-Bergen
  72 Dep: 09.05.2010 Arr: 12.05.2010
  73 Lugar fra Risøyhamn
  74 Kost: FRO=4
  75 </pre>
  76
  77 <p>På selve magnetstripen er innholdet
  78 <tt>;1316010007421930=00000000000000000000?+E?</tt>.  Heller ikke her
  79 ser jeg mye korrespondanse mellom påtrykk og magnetstripe.</p>
  80 </div>
  81   <div class="tags">
  82
  83
  84
  85    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
  86
  87   </div>
  88  </div>
  89  <div class="padding"></div>
  90
  91  <div class="entry">
  92   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Pieces_of_the_roaming_laptop_puzzle_in_Debian.html">Pieces of the roaming laptop puzzle in Debian</a></div>
  93   <div class="date">2010-05-19 19:00</div>
  94   <div class="body">
  95 <p>Today, the last piece of the puzzle for roaming laptops in Debian
  96 Edu finally entered the Debian archive.  Today, the new
  97 <a href="http://packages.qa.debian.org/libp/libpam-mklocaluser.html">libpam-mklocaluser</a>
  98 package was accepted.  Two days ago, two other pieces was accepted
  99 into unstable.  The
 100 <a href="http://packages.qa.debian.org/p/pam-python.html">pam-python</a>
 101 package needed by libpam-mklocaluser, and the
 102 <a href="http://packages.qa.debian.org/s/sssd.html">sssd</a> package
 103 passed NEW on Monday.  In addition, the
 104 <a href="http://packages.qa.debian.org/libp/libpam-ccreds.html">libpam-ccreds</a>
 105 package we need is in experimental (version 10-4) since Saturday, and
 106 hopefully will be moved to unstable soon.</p>
 107
 108 <p>This collection of packages allow for two different setups for
 109 roaming laptops.  The traditional setup would be using libpam-ccreds,
 110 nscd and libpam-mklocaluser with LDAP or Kerberos authentication,
 111 which should work out of the box if the configuration changes proposed
 112 for nscd in <a href="http://bugs.debian.org/485282">BTS report
 113 #485282</a> is implemented.  The alternative setup is to use sssd with
 114 libpam-mklocaluser to connect to LDAP or Kerberos and let sssd take
 115 care of the caching of passwords and group information.</p>
 116
 117 <p>I have so far been unable to get sssd to work with the LDAP server
 118 at the University, but suspect the issue is some SSL/GnuTLS related
 119 problem with the server certificate.  I plan to update the Debian
 120 package to version 1.2, which is scheduled for next week, and hope to
 121 find time to make sure the next release will include both the
 122 Debian/Ubuntu specific patches.  Upstream is friendly and responsive,
 123 and I am sure we will find a good solution.</p>
 124
 125 <p>The idea is to set up the roaming laptops to authenticate using
 126 LDAP or Kerberos and create a local user with home directory in /home/
 127 when a usre in LDAP logs in via KDM or GDM for the first time, and
 128 cache the password for offline checking, as well as caching group
 129 memberhips and other relevant LDAP information.  The
 130 libpam-mklocaluser package was created to make sure the local home
 131 directory is in /home/, instead of /site/server/directory/ which would
 132 be the home directory if pam_mkhomedir was used.  To avoid confusion
 133 with support requests and configuration, we do not want local laptops
 134 to have users in a path that is used for the same users home directory
 135 on the home directory servers.</p>
 136
 137 <p>One annoying problem with gdm is that it do not show the PAM
 138 message passed to the user from libpam-mklocaluser when the local user
 139 is created.  Instead gdm simply reject the login with some generic
 140 message.  The message is shown in kdm, ssh and login, so I guess it is
 141 a bug in gdm.  Have not investigated if there is some other message
 142 type that can be used instead to get gdm to also show the message.</p>
 143
 144 <p>If you want to help out with implementing this for Debian Edu,
 145 please contact us on debian-edu@lists.debian.org.</p>
 146 </div>
 147   <div class="tags">
 148
 149
 150
 151    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 152
 153   </div>
 154  </div>
 155  <div class="padding"></div>
 156
 157  <div class="entry">
 158   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html">Parallellized boot is now the default in Debian/unstable</a></div>
 159   <div class="date">2010-05-14 22:40</div>
 160   <div class="body">
 161 <p>Since this evening, parallel booting is the default in
 162 Debian/unstable for machines using dependency based boot sequencing.
 163 Apparently the testing of concurrent booting has been wider than
 164 expected, if I am to believe the
 165 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 166 on debian-devel@</a>, and I concluded a few days ago to move forward
 167 with the feature this weekend, to give us some time to detect any
 168 remaining problems before Squeeze is frozen.  If serious problems are
 169 detected, it is simple to change the default back to sequential boot.
 170 The upload of the new sysvinit package also activate a new upstream
 171 version.</p>
 172
 173 More information about
 174 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 175 based boot sequencing</a> is available from the Debian wiki.  It is
 176 currently possible to disable parallel booting when one run into
 177 problems caused by it, by adding this line to /etc/default/rcS:</p>
 178
 179 <blockquote><pre>
 180 CONCURRENCY=none
 181 </pre></blockquote>
 182
 183 <p>If you report any problems with dependencies in init.d scripts to
 184 the BTS, please usertag the report to get it to show up at
 185 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 186 list of usertagged bugs related to this</a>.</p>
 187 </div>
 188   <div class="tags">
 189
 190
 191
 192    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 193
 194   </div>
 195  </div>
 196  <div class="padding"></div>
 197
 198  <div class="entry">
 199   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html">Sitesummary tip: Listing MAC address of all clients</a></div>
 200   <div class="date">2010-05-14 21:10</div>
 201   <div class="body">
 202 <p>In the recent Debian Edu versions, the
 203 <a href="http://wiki.debian.org/DebianEdu/HowTo/SiteSummary">sitesummary
 204 system</a> is used to keep track of the machines in the school
 205 network.  Each machine will automatically report its status to the
 206 central server after boot and once per night.  The network setup is
 207 also reported, and using this information it is possible to get the
 208 MAC address of all network interfaces in the machines.  This is useful
 209 to update the DHCP configuration.</p>
 210
 211 <p>To give some idea how to use sitesummary, here is a one-liner to
 212 ist all MAC addresses of all machines reporting to sitesummary.  Run
 213 this on the collector host:</p>
 214
 215 <blockquote><pre>
 216 perl -MSiteSummary -e 'for_all_hosts(sub { print join(" ", get_macaddresses(shift)), "\n"; });'
 217 </pre></blockquote>
 218
 219 <p>This will list all MAC addresses assosiated with all machine, one
 220 line per machine and with space between the MAC addresses.</p>
 221
 222 <p>To allow system administrators easier job at adding static DHCP
 223 addresses for hosts, it would be possible to extend this to fetch
 224 machine information from sitesummary and update the DHCP and DNS
 225 tables in LDAP using this information.  Such tool is unfortunately not
 226 written yet.</p>
 227 </div>
 228   <div class="tags">
 229
 230
 231
 232    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary</a>.
 233
 234   </div>
 235  </div>
 236  <div class="padding"></div>
 237
 238  <div class="entry">
 239   <div class="title"><a href="http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html">systemd, an interesting alternative to upstart</a></div>
 240   <div class="date">2010-05-13 22:20</div>
 241   <div class="body">
 242 <p>The last few days a new boot system called
 243 <a href="http://www.freedesktop.org/wiki/Software/systemd">systemd</a>
 244 has been
 245 <a href="http://0pointer.de/blog/projects/systemd.html">introduced</a>
 246
 247 to the free software world.  I have not yet had time to play around
 248 with it, but it seem to be a very interesting alternative to
 249 <a href="http://upstart.ubuntu.com/">upstart</a>, and might prove to be
 250 a good alternative for Debian when we are able to switch to an event
 251 based boot system.  Tollef is
 252 <a href="http://bugs.debian.org/580814">in the process</a> of getting
 253 systemd into Debian, and I look forward to seeing how well it work.  I
 254 like the fact that systemd handles init.d scripts with dependency
 255 information natively, allowing them to run in parallel where upstart
 256 at the moment do not.</p>
 257
 258 <p>Unfortunately do systemd have the same problem as upstart regarding
 259 platform support.  It only work on recent Linux kernels, and also need
 260 some new kernel features enabled to function properly.  This means
 261 kFreeBSD and Hurd ports of Debian will need a port or a different boot
 262 system.  Not sure how that will be handled if systemd proves to be the
 263 way forward.</p>
 264
 265 <p>In the mean time, based on the
 266 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 267 on debian-devel@</a> regarding parallel booting in Debian, I have
 268 decided to enable full parallel booting as the default in Debian as
 269 soon as possible (probably this weekend or early next week), to see if
 270 there are any remaining serious bugs in the init.d dependencies.  A
 271 new version of the sysvinit package implementing this change is
 272 already in experimental.  If all go well, Squeeze will be released
 273 with parallel booting enabled by default.</p>
 274 </div>
 275   <div class="tags">
 276
 277
 278
 279    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 280
 281   </div>
 282  </div>
 283  <div class="padding"></div>
 284
 285  <div class="entry">
 286   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html">Parallellizing the boot in Debian Squeeze - ready for wider testing</a></div>
 287   <div class="date">2010-05-06 23:25</div>
 288   <div class="body">
 289 <p>These days, the init.d script dependencies in Squeeze are quite
 290 complete, so complete that it is actually possible to run all the
 291 init.d scripts in parallell based on these dependencies.  If you want
 292 to test your Squeeze system, make sure
 293 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 294 based boot sequencing</a> is enabled, and add this line to
 295 /etc/default/rcS:</p>
 296
 297 <blockquote><pre>
 298 CONCURRENCY=makefile
 299 </pre></blockquote>
 300
 301 <p>That is it.  It will cause sysv-rc to use the startpar tool to run
 302 scripts in parallel using the dependency information stored in
 303 /etc/init.d/.depend.boot, /etc/init.d/.depend.start and
 304 /etc/init.d/.depend.stop to order the scripts.  Startpar is configured
 305 to try to start the kdm and gdm scripts as early as possible, and will
 306 start the facilities required by kdm or gdm as early as possible to
 307 make this happen.</p>
 308
 309 <p>Give it a try, and see if you like the result.  If some services
 310 fail to start properly, it is most likely because they have incomplete
 311 init.d script dependencies in their startup script (or some of their
 312 dependent scripts have incomplete dependencies).  Report bugs and get
 313 the package maintainers to fix it. :)</p>
 314
 315 <p>Running scripts in parallel could be the default in Debian when we
 316 manage to get the init.d script dependencies complete and correct.  I
 317 expect we will get there in Squeeze+1, if we get manage to test and
 318 fix the remaining issues.</p>
 319
 320 <p>If you report any problems with dependencies in init.d scripts to
 321 the BTS, please usertag the report to get it to show up at
 322 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 323 list of usertagged bugs related to this</a>.</p>
 324 </div>
 325   <div class="tags">
 326
 327
 328
 329    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 330
 331   </div>
 332  </div>
 333  <div class="padding"></div>
 334
 335  <div class="entry">
 336   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html">Forcing new users to change their password on first login</a></div>
 337   <div class="date">2010-05-02 13:47</div>
 338   <div class="body">
 339 <p>One interesting feature in Active Directory, is the ability to
 340 create a new user with an expired password, and thus force the user to
 341 change the password on the first login attempt.</p>
 342
 343 <p>I'm not quite sure how to do that with the LDAP setup in Debian
 344 Edu, but did some initial testing with a local account.  The account
 345 and password aging information is available in /etc/shadow, but
 346 unfortunately, it is not possible to specify an expiration time for
 347 passwords, only a maximum age for passwords.</p>
 348
 349 <p>A freshly created account (using adduser test) will have these
 350 settings in /etc/shadow:</p>
 351
 352 <blockquote><pre>
 353 root@tjener:~# chage -l test
 354 Last password change                                    : May 02, 2010
 355 Password expires                                        : never
 356 Password inactive                                       : never
 357 Account expires                                         : never
 358 Minimum number of days between password change          : 0
 359 Maximum number of days between password change          : 99999
 360 Number of days of warning before password expires       : 7
 361 root@tjener:~#
 362 </pre></blockquote>
 363
 364 <p>The only way I could come up with to create a user with an expired
 365 account, is to change the date of the last password change to the
 366 lowest value possible (January 1th 1970), and the maximum password age
 367 to the difference in days between that date and today.  To make it
 368 simple, I went for 30 years (30 * 365 = 10950) and January 2th (to
 369 avoid testing if 0 is a valid value).</p>
 370
 371 <p>After using these commands to set it up, it seem to work as
 372 intended:</p>
 373
 374 <blockquote><pre>
 375 root@tjener:~# chage -d 1 test; chage -M 10950 test
 376 root@tjener:~# chage -l test
 377 Last password change                                    : Jan 02, 1970
 378 Password expires                                        : never
 379 Password inactive                                       : never
 380 Account expires                                         : never
 381 Minimum number of days between password change          : 0
 382 Maximum number of days between password change          : 10950
 383 Number of days of warning before password expires       : 7
 384 root@tjener:~#
 385 </pre></blockquote>
 386
 387 <p>So far I have tested this with ssh and console, and kdm (in
 388 Squeeze) login, and all ask for a new password before login in the
 389 user (with ssh, I was thrown out and had to log in again).</p>
 390
 391 <p>Perhaps we should set up something similar for Debian Edu, to make
 392 sure only the user itself have the account password?</p>
 393
 394 <p>If you want to comment on or help out with implementing this for
 395 Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 396
 397 <p>Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the
 398 shadow(8) page in Debian/testing now state that setting the date of
 399 last password change to zero (0) will force the password to be changed
 400 on the first login.  This was not mentioned in the manual in Lenny, so
 401 I did not notice this in my initial testing.  I have tested it on
 402 Squeeze, and '<tt>chage -d 0 username</tt>' do work there.  I have not
 403 tested it on Lenny yet.</p>
 404
 405 <p>Update 2010-05-02-19:05: Jim Paris tells me via email that an
 406 equivalent command to expire a password is '<tt>passwd -e
 407 username</tt>', which insert zero into the date of the last password
 408 change.</p>
 409 </div>
 410   <div class="tags">
 411
 412
 413
 414    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 415
 416   </div>
 417  </div>
 418  <div class="padding"></div>
 419
 420  <div class="entry">
 421   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html">Thoughts on roaming laptop setup for Debian Edu</a></div>
 422   <div class="date">2010-04-28 20:40</div>
 423   <div class="body">
 424 <p>For some years now, I have wondered how we should handle laptops in
 425 Debian Edu.  The Debian Edu infrastructure is mostly designed to
 426 handle stationary computers, and less suited for computers that come
 427 and go.</p>
 428
 429 <p>Now I finally believe I have an sensible idea on how to adjust
 430 Debian Edu for laptops, by introducing a new profile for them, for
 431 example called Roaming Workstations.  Here are my thought on this.
 432 The setup would consist of the following:</p>
 433
 434 <ul>
 435
 436  <li>During installation, the user name of the owner / primary user of
 437    the laptop is requested and a local home directory is set up for
 438    the user, with uid and gid information fetched from the LDAP
 439    server.  This allow the user to work also when offline.  The
 440    central home directory can be available in a subdirectory on
 441    request, for example mounted via CIFS.  It could be mounted
 442    automatically when a user log in while on the Debian Edu network,
 443    and unmounted when the machine is taken away (network down,
 444    hibernate, etc), it can be set up to do automatic mounting on
 445    request (using autofs), or perhaps some GUI button on the desktop
 446    can be used to access it when needed.  Perhaps it is enough to use
 447    the fish protocol in KDE?</li>
 448
 449  <li>Password checking is set up to use LDAP or Kerberos
 450    authentication when the machine is on the Debian Edu network, and
 451    to cache the password for offline checking when the machine unable
 452    to reach the LDAP or Kerberos server.  This can be done using
 453    <a href="http://www.padl.com/OSS/pam_ccreds.html">libpam-ccreds</a>
 454    or the Fedora developed
 455    <a href="https://fedoraproject.org/wiki/Features/SSSD">System
 456    Security Services Daemon</a> packages.</li>
 457
 458  <li>File synchronisation with the central home directory is set up
 459    using a shared directory in both the local and the central home
 460    directory, using unison.</li>
 461
 462  <li>Printing should be set up to print to all printers broadcasting
 463    their existence on the local network, and should then work out of
 464    the box with CUPS.  For sites needing accurate printer quotas, some
 465    system with Kerberos authentication or printing via ssh could be
 466    implemented.</li>
 467
 468  <li>For users that should have local root access to their laptop,
 469    sudo should be used to allow this to the local user.</li>
 470
 471  <li>It would be nice if user and group information from LDAP is
 472    cached on the client, but given that there are entries for the
 473    local user and primary group in /etc/, it should not be needed.</li>
 474
 475 </ul>
 476
 477 <p>I believe all the pieces to implement this are in Debian/testing at
 478 the moment.  If we work quickly, we should be able to get this ready
 479 in time for the Squeeze release to freeze.  Some of the pieces need
 480 tweaking, like libpam-ccreds should get support for pam-auth-update
 481 (<a href="http://bugs.debian.org/566718">#566718</a>) and nslcd (or
 482 perhaps debian-edu-config) should get some integration code to stop
 483 its daemon when the LDAP server is unavailable to avoid long timeouts
 484 when disconnected from the net.  If we get Kerberos enabled, we need
 485 to make sure we avoid long timeouts there too.</p>
 486
 487 <p>If you want to help out with implementing this for Debian Edu,
 488 please contact us on debian-edu@lists.debian.org.</p>
 489 </div>
 490   <div class="tags">
 491
 492
 493
 494    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 495
 496   </div>
 497  </div>
 498  <div class="padding"></div>
 499
 500  <div class="entry">
 501   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html">Great book: "Content: Selected Essays on Technology, Creativity, Copyright, and the Future of the Future"</a></div>
 502   <div class="date">2010-04-19 17:10</div>
 503   <div class="body">
 504 <p>The last few weeks i have had the pleasure of reading a
 505 thought-provoking collection of essays by Cory Doctorow, on topics
 506 touching copyright, virtual worlds, the future of man when the
 507 conscience mind can be duplicated into a computer and many more. The
 508 book titled "Content: Selected Essays on Technology, Creativity,
 509 Copyright, and the Future of the Future" is available with few
 510 restrictions on the web, for example from
 511 <a href="http://craphound.com/content/">his own site</a>. I read the
 512 epub-version from
 513 <a href="http://www.feedbooks.com/book/2883">feedbooks</a> using
 514 <a href="http://www.fbreader.org/">fbreader</a> and my N810. I
 515 strongly recommend this book.</p>
 516 </div>
 517   <div class="tags">
 518
 519
 520
 521    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 522
 523   </div>
 524  </div>
 525  <div class="padding"></div>
 526
 527  <div class="entry">
 528   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Kerberos_for_Debian_Edu_Squeeze_.html">Kerberos for Debian Edu/Squeeze?</a></div>
 529   <div class="date">2010-04-14 17:20</div>
 530   <div class="body">
 531 <p><a href="http://www.nuug.no/aktiviteter/20100413-kerberos/">Yesterdays
 532 NUUG presentation</a> about Kerberos was inspiring, and reminded me
 533 about the need to start using Kerberos in Skolelinux.  Setting up a
 534 Kerberos server seem to be straight forward, and if we get this in
 535 place a long time before the Squeeze version of Debian freezes, we
 536 have a chance to migrate Skolelinux away from NFSv3 for the home
 537 directories, and over to an architecture where the infrastructure do
 538 not have to trust IP addresses and machines, and instead can trust
 539 users and cryptographic keys instead.</p>
 540
 541 <p>A challenge will be integration and administration.  Is there a
 542 Kerberos implementation for Debian where one can control the
 543 administration access in Kerberos using LDAP groups?  With it, the
 544 school administration will have to maintain access control using flat
 545 files on the main server, which give a huge potential for errors.</p>
 546
 547 <p>A related question I would like to know is how well Kerberos and
 548 pam-ccreds (offline password check) work together.  Anyone know?</p>
 549
 550 <p>Next step will be to use Kerberos for access control in Lwat and
 551 Nagios.  I have no idea how much work that will be to implement.  We
 552 would also need to document how to integrate with Windows AD, as such
 553 shared network will require two Kerberos realms that need to cooperate
 554 to work properly.</p>
 555
 556 <p>I believe a good start would be to start using Kerberos on the
 557 skolelinux.no machines, and this way get ourselves experience with
 558 configuration and integration.  A natural starting point would be
 559 setting up ldap.skolelinux.no as the Kerberos server, and migrate the
 560 rest of the machines from PAM via LDAP to PAM via Kerberos one at the
 561 time.</p>
 562
 563 <p>If you would like to contribute to get this working in Skolelinux,
 564 I recommend you to see the video recording from yesterdays NUUG
 565 presentation, and start using Kerberos at home.  The video show show
 566 up in a few days.</p>
 567 </div>
 568   <div class="tags">
 569
 570
 571
 572    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 573
 574   </div>
 575  </div>
 576  <div class="padding"></div>
 577
 578  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
 579
 580 <div id="sidebar">
 581
 582
 583
 584
 585
 586 <h2>Archive</h2>
 587 <ul>
 588
 589 <li>2010
 590 <ul>
 591
 592 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 593
 594 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 595
 596 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 597
 598 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 599
 600 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (7)</a></li>
 601
 602 </ul></li>
 603
 604 <li>2009
 605 <ul>
 606
 607 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 608
 609 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 610
 611 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 612
 613 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 614
 615 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 616
 617 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 618
 619 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 620
 621 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 622
 623 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 624
 625 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 626
 627 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 628
 629 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 630
 631 </ul></li>
 632
 633 <li>2008
 634 <ul>
 635
 636 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 637
 638 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 639
 640 </ul></li>
 641
 642 </ul>
 643
 644
 645
 646 <h2>Tags</h2>
 647 <ul>
 648
 649  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 650
 651  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 652
 653  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 654
 655  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (18)</a></li>
 656
 657  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (18)</a></li>
 658
 659  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (29)</a></li>
 660
 661  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 662
 663  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (6)</a></li>
 664
 665  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
 666
 667  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
 668
 669  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 670
 671  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 672
 673  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (65)</a></li>
 674
 675  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (74)</a></li>
 676
 677  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (12)</a></li>
 678
 679  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (11)</a></li>
 680
 681  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 682
 683  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 684
 685  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (8)</a></li>
 686
 687  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (1)</a></li>
 688
 689  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (11)</a></li>
 690
 691  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 692
 693  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 694
 695  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 696
 697  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
 698
 699 </ul>
 700
 701 </div>
 702
 703 <p style="text-align: right">
 704 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
 705 </p>
 706 </body>
 707 </html>