1 <?xml version=
"1.0" encoding=
"utf-8"?>
2 <rss version='
2.0' xmlns:lj='http://www.livejournal.org/rss/lj/
1.0/' xmlns:
atom=
"http://www.w3.org/2005/Atom">
4 <title>Petter Reinholdtsen
</title>
5 <description></description>
6 <link>http://people.skolelinux.org/pere/blog/
</link>
7 <atom:link href=
"http://people.skolelinux.org/pere/blog/index.rss" rel=
"self" type=
"application/rss+xml" />
10 <title>Magnetstripeinnhold i billetter fra Flytoget og Hurtigruten
</title>
11 <link>http://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html
</link>
12 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html
</guid>
13 <pubDate>Fri,
21 May
2010 16:
00:
00 +
0200</pubDate>
15 <p
>For en stund tilbake kjøpte jeg en magnetkortleser for å kunne
16 titte på hva som er skrevet inn på magnetstripene til ulike kort. Har
17 ikke hatt tid til å analysere mange kort så langt, men tenkte jeg
18 skulle dele innholdet på to kort med mine lesere.
</p
>
20 <p
>For noen dager siden tok jeg flyet til Harstad og Hurtigruten til
21 Bergen. Flytoget fra Oslo S til flyplassen ga meg en billett med
22 magnetstripe. Påtrykket finner jeg følgende informasjon:
</p
>
25 Flytoget Airport Express Train
27 Fra - Til : Oslo Sentralstasjon
30 Herav mva.
8,
00% : NOK
12,
59
32 Til - Fra : Oslo Lufthavn
34 Gyldig Fra-Til :
08.05.10-
07.11.10
35 Billetttype : Enkeltbillett
37 102-
1015-
100508-
48382-
01-
08
40 <p
>På selve magnetstripen er innholdet
41 <tt
>;E?+
900120011=
23250996541068112619257138248441708433322932704083389389062603279671261502492655?
</tt
>.
42 Aner ikke hva innholdet representerer, og det er lite overlapp mellom
43 det jeg ser trykket på billetten og det jeg ser av tegn i
44 magnetstripen. Håper det betyr at de bruker kryptografiske metoder
45 for å gjøre det vanskelig å forfalske billetter.
</p
>
47 <p
>Den andre billetten er fra Hurtigruten, der jeg mistenker at
48 strekkoden på fronten er mer brukt enn magnetstripen (det var i hvert
49 fall den biten vi stakk inn i dørlåsen).
</p
>
51 <p
>Påtrykket forsiden er følgende:
</p
>
59 Bookingno: SAX69
0742193
61 Dep:
09.05.2010 Arr:
12.05.2010
66 <p
>På selve magnetstripen er innholdet
67 <tt
>;
1316010007421930=
00000000000000000000?+E?
</tt
>. Heller ikke her
68 ser jeg mye korrespondanse mellom påtrykk og magnetstripe.
</p
>
73 <title>Pieces of the roaming laptop puzzle in Debian
</title>
74 <link>http://people.skolelinux.org/pere/blog/Pieces_of_the_roaming_laptop_puzzle_in_Debian.html
</link>
75 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Pieces_of_the_roaming_laptop_puzzle_in_Debian.html
</guid>
76 <pubDate>Wed,
19 May
2010 19:
00:
00 +
0200</pubDate>
78 <p
>Today, the last piece of the puzzle for roaming laptops in Debian
79 Edu finally entered the Debian archive. Today, the new
80 <a href=
"http://packages.qa.debian.org/libp/libpam-mklocaluser.html
">libpam-mklocaluser
</a
>
81 package was accepted. Two days ago, two other pieces was accepted
83 <a href=
"http://packages.qa.debian.org/p/pam-python.html
">pam-python
</a
>
84 package needed by libpam-mklocaluser, and the
85 <a href=
"http://packages.qa.debian.org/s/sssd.html
">sssd
</a
> package
86 passed NEW on Monday. In addition, the
87 <a href=
"http://packages.qa.debian.org/libp/libpam-ccreds.html
">libpam-ccreds
</a
>
88 package we need is in experimental (version
10-
4) since Saturday, and
89 hopefully will be moved to unstable soon.
</p
>
91 <p
>This collection of packages allow for two different setups for
92 roaming laptops. The traditional setup would be using libpam-ccreds,
93 nscd and libpam-mklocaluser with LDAP or Kerberos authentication,
94 which should work out of the box if the configuration changes proposed
95 for nscd in
<a href=
"http://bugs.debian.org/
485282">BTS report
96 #
485282</a
> is implemented. The alternative setup is to use sssd with
97 libpam-mklocaluser to connect to LDAP or Kerberos and let sssd take
98 care of the caching of passwords and group information.
</p
>
100 <p
>I have so far been unable to get sssd to work with the LDAP server
101 at the University, but suspect the issue is some SSL/GnuTLS related
102 problem with the server certificate. I plan to update the Debian
103 package to version
1.2, which is scheduled for next week, and hope to
104 find time to make sure the next release will include both the
105 Debian/Ubuntu specific patches. Upstream is friendly and responsive,
106 and I am sure we will find a good solution.
</p
>
108 <p
>The idea is to set up the roaming laptops to authenticate using
109 LDAP or Kerberos and create a local user with home directory in /home/
110 when a usre in LDAP logs in via KDM or GDM for the first time, and
111 cache the password for offline checking, as well as caching group
112 memberhips and other relevant LDAP information. The
113 libpam-mklocaluser package was created to make sure the local home
114 directory is in /home/, instead of /site/server/directory/ which would
115 be the home directory if pam_mkhomedir was used. To avoid confusion
116 with support requests and configuration, we do not want local laptops
117 to have users in a path that is used for the same users home directory
118 on the home directory servers.
</p
>
120 <p
>One annoying problem with gdm is that it do not show the PAM
121 message passed to the user from libpam-mklocaluser when the local user
122 is created. Instead gdm simply reject the login with some generic
123 message. The message is shown in kdm, ssh and login, so I guess it is
124 a bug in gdm. Have not investigated if there is some other message
125 type that can be used instead to get gdm to also show the message.
</p
>
127 <p
>If you want to help out with implementing this for Debian Edu,
128 please contact us on debian-edu@lists.debian.org.
</p
>
133 <title>Parallellized boot is now the default in Debian/unstable
</title>
134 <link>http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html
</link>
135 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html
</guid>
136 <pubDate>Fri,
14 May
2010 22:
40:
00 +
0200</pubDate>
138 <p
>Since this evening, parallel booting is the default in
139 Debian/unstable for machines using dependency based boot sequencing.
140 Apparently the testing of concurrent booting has been wider than
141 expected, if I am to believe the
142 <a href=
"http://lists.debian.org/debian-devel/
2010/
05/msg00122.html
">input
143 on debian-devel@
</a
>, and I concluded a few days ago to move forward
144 with the feature this weekend, to give us some time to detect any
145 remaining problems before Squeeze is frozen. If serious problems are
146 detected, it is simple to change the default back to sequential boot.
147 The upload of the new sysvinit package also activate a new upstream
150 More information about
151 <a href=
"http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot
">dependency
152 based boot sequencing
</a
> is available from the Debian wiki. It is
153 currently possible to disable parallel booting when one run into
154 problems caused by it, by adding this line to /etc/default/rcS:
</p
>
156 <blockquote
><pre
>
158 </pre
></blockquote
>
160 <p
>If you report any problems with dependencies in init.d scripts to
161 the BTS, please usertag the report to get it to show up at
162 <a href=
"http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org
">the
163 list of usertagged bugs related to this
</a
>.
</p
>
168 <title>Sitesummary tip: Listing MAC address of all clients
</title>
169 <link>http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html
</link>
170 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html
</guid>
171 <pubDate>Fri,
14 May
2010 21:
10:
00 +
0200</pubDate>
173 <p
>In the recent Debian Edu versions, the
174 <a href=
"http://wiki.debian.org/DebianEdu/HowTo/SiteSummary
">sitesummary
175 system
</a
> is used to keep track of the machines in the school
176 network. Each machine will automatically report its status to the
177 central server after boot and once per night. The network setup is
178 also reported, and using this information it is possible to get the
179 MAC address of all network interfaces in the machines. This is useful
180 to update the DHCP configuration.
</p
>
182 <p
>To give some idea how to use sitesummary, here is a one-liner to
183 ist all MAC addresses of all machines reporting to sitesummary. Run
184 this on the collector host:
</p
>
186 <blockquote
><pre
>
187 perl -MSiteSummary -e
'for_all_hosts(sub { print join(
" ", get_macaddresses(shift)),
"\n
"; });
'
188 </pre
></blockquote
>
190 <p
>This will list all MAC addresses assosiated with all machine, one
191 line per machine and with space between the MAC addresses.
</p
>
193 <p
>To allow system administrators easier job at adding static DHCP
194 addresses for hosts, it would be possible to extend this to fetch
195 machine information from sitesummary and update the DHCP and DNS
196 tables in LDAP using this information. Such tool is unfortunately not
197 written yet.
</p
>
202 <title>systemd, an interesting alternative to upstart
</title>
203 <link>http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html
</link>
204 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html
</guid>
205 <pubDate>Thu,
13 May
2010 22:
20:
00 +
0200</pubDate>
207 <p
>The last few days a new boot system called
208 <a href=
"http://www.freedesktop.org/wiki/Software/systemd
">systemd
</a
>
210 <a href=
"http://
0pointer.de/blog/projects/systemd.html
">introduced
</a
>
212 to the free software world. I have not yet had time to play around
213 with it, but it seem to be a very interesting alternative to
214 <a href=
"http://upstart.ubuntu.com/
">upstart
</a
>, and might prove to be
215 a good alternative for Debian when we are able to switch to an event
216 based boot system. Tollef is
217 <a href=
"http://bugs.debian.org/
580814">in the process
</a
> of getting
218 systemd into Debian, and I look forward to seeing how well it work. I
219 like the fact that systemd handles init.d scripts with dependency
220 information natively, allowing them to run in parallel where upstart
221 at the moment do not.
</p
>
223 <p
>Unfortunately do systemd have the same problem as upstart regarding
224 platform support. It only work on recent Linux kernels, and also need
225 some new kernel features enabled to function properly. This means
226 kFreeBSD and Hurd ports of Debian will need a port or a different boot
227 system. Not sure how that will be handled if systemd proves to be the
228 way forward.
</p
>
230 <p
>In the mean time, based on the
231 <a href=
"http://lists.debian.org/debian-devel/
2010/
05/msg00122.html
">input
232 on debian-devel@
</a
> regarding parallel booting in Debian, I have
233 decided to enable full parallel booting as the default in Debian as
234 soon as possible (probably this weekend or early next week), to see if
235 there are any remaining serious bugs in the init.d dependencies. A
236 new version of the sysvinit package implementing this change is
237 already in experimental. If all go well, Squeeze will be released
238 with parallel booting enabled by default.
</p
>
243 <title>Parallellizing the boot in Debian Squeeze - ready for wider testing
</title>
244 <link>http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html
</link>
245 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html
</guid>
246 <pubDate>Thu,
6 May
2010 23:
25:
00 +
0200</pubDate>
248 <p
>These days, the init.d script dependencies in Squeeze are quite
249 complete, so complete that it is actually possible to run all the
250 init.d scripts in parallell based on these dependencies. If you want
251 to test your Squeeze system, make sure
252 <a href=
"http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot
">dependency
253 based boot sequencing
</a
> is enabled, and add this line to
254 /etc/default/rcS:
</p
>
256 <blockquote
><pre
>
258 </pre
></blockquote
>
260 <p
>That is it. It will cause sysv-rc to use the startpar tool to run
261 scripts in parallel using the dependency information stored in
262 /etc/init.d/.depend.boot, /etc/init.d/.depend.start and
263 /etc/init.d/.depend.stop to order the scripts. Startpar is configured
264 to try to start the kdm and gdm scripts as early as possible, and will
265 start the facilities required by kdm or gdm as early as possible to
266 make this happen.
</p
>
268 <p
>Give it a try, and see if you like the result. If some services
269 fail to start properly, it is most likely because they have incomplete
270 init.d script dependencies in their startup script (or some of their
271 dependent scripts have incomplete dependencies). Report bugs and get
272 the package maintainers to fix it. :)
</p
>
274 <p
>Running scripts in parallel could be the default in Debian when we
275 manage to get the init.d script dependencies complete and correct. I
276 expect we will get there in Squeeze+
1, if we get manage to test and
277 fix the remaining issues.
</p
>
279 <p
>If you report any problems with dependencies in init.d scripts to
280 the BTS, please usertag the report to get it to show up at
281 <a href=
"http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org
">the
282 list of usertagged bugs related to this
</a
>.
</p
>
287 <title>Forcing new users to change their password on first login
</title>
288 <link>http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html
</link>
289 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html
</guid>
290 <pubDate>Sun,
2 May
2010 13:
47:
00 +
0200</pubDate>
292 <p
>One interesting feature in Active Directory, is the ability to
293 create a new user with an expired password, and thus force the user to
294 change the password on the first login attempt.
</p
>
296 <p
>I
'm not quite sure how to do that with the LDAP setup in Debian
297 Edu, but did some initial testing with a local account. The account
298 and password aging information is available in /etc/shadow, but
299 unfortunately, it is not possible to specify an expiration time for
300 passwords, only a maximum age for passwords.
</p
>
302 <p
>A freshly created account (using adduser test) will have these
303 settings in /etc/shadow:
</p
>
305 <blockquote
><pre
>
306 root@tjener:~# chage -l test
307 Last password change : May
02,
2010
308 Password expires : never
309 Password inactive : never
310 Account expires : never
311 Minimum number of days between password change :
0
312 Maximum number of days between password change :
99999
313 Number of days of warning before password expires :
7
315 </pre
></blockquote
>
317 <p
>The only way I could come up with to create a user with an expired
318 account, is to change the date of the last password change to the
319 lowest value possible (January
1th
1970), and the maximum password age
320 to the difference in days between that date and today. To make it
321 simple, I went for
30 years (
30 *
365 =
10950) and January
2th (to
322 avoid testing if
0 is a valid value).
</p
>
324 <p
>After using these commands to set it up, it seem to work as
327 <blockquote
><pre
>
328 root@tjener:~# chage -d
1 test; chage -M
10950 test
329 root@tjener:~# chage -l test
330 Last password change : Jan
02,
1970
331 Password expires : never
332 Password inactive : never
333 Account expires : never
334 Minimum number of days between password change :
0
335 Maximum number of days between password change :
10950
336 Number of days of warning before password expires :
7
338 </pre
></blockquote
>
340 <p
>So far I have tested this with ssh and console, and kdm (in
341 Squeeze) login, and all ask for a new password before login in the
342 user (with ssh, I was thrown out and had to log in again).
</p
>
344 <p
>Perhaps we should set up something similar for Debian Edu, to make
345 sure only the user itself have the account password?
</p
>
347 <p
>If you want to comment on or help out with implementing this for
348 Debian Edu, please contact us on debian-edu@lists.debian.org.
</p
>
350 <p
>Update
2010-
05-
02 17:
20: Paul Tötterman tells me on IRC that the
351 shadow(
8) page in Debian/testing now state that setting the date of
352 last password change to zero (
0) will force the password to be changed
353 on the first login. This was not mentioned in the manual in Lenny, so
354 I did not notice this in my initial testing. I have tested it on
355 Squeeze, and
'<tt
>chage -d
0 username
</tt
>' do work there. I have not
356 tested it on Lenny yet.
</p
>
358 <p
>Update
2010-
05-
02-
19:
05: Jim Paris tells me via email that an
359 equivalent command to expire a password is
'<tt
>passwd -e
360 username
</tt
>', which insert zero into the date of the last password
366 <title>Thoughts on roaming laptop setup for Debian Edu
</title>
367 <link>http://people.skolelinux.org/pere/blog/Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html
</link>
368 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html
</guid>
369 <pubDate>Wed,
28 Apr
2010 20:
40:
00 +
0200</pubDate>
371 <p
>For some years now, I have wondered how we should handle laptops in
372 Debian Edu. The Debian Edu infrastructure is mostly designed to
373 handle stationary computers, and less suited for computers that come
376 <p
>Now I finally believe I have an sensible idea on how to adjust
377 Debian Edu for laptops, by introducing a new profile for them, for
378 example called Roaming Workstations. Here are my thought on this.
379 The setup would consist of the following:
</p
>
383 <li
>During installation, the user name of the owner / primary user of
384 the laptop is requested and a local home directory is set up for
385 the user, with uid and gid information fetched from the LDAP
386 server. This allow the user to work also when offline. The
387 central home directory can be available in a subdirectory on
388 request, for example mounted via CIFS. It could be mounted
389 automatically when a user log in while on the Debian Edu network,
390 and unmounted when the machine is taken away (network down,
391 hibernate, etc), it can be set up to do automatic mounting on
392 request (using autofs), or perhaps some GUI button on the desktop
393 can be used to access it when needed. Perhaps it is enough to use
394 the fish protocol in KDE?
</li
>
396 <li
>Password checking is set up to use LDAP or Kerberos
397 authentication when the machine is on the Debian Edu network, and
398 to cache the password for offline checking when the machine unable
399 to reach the LDAP or Kerberos server. This can be done using
400 <a href=
"http://www.padl.com/OSS/pam_ccreds.html
">libpam-ccreds
</a
>
401 or the Fedora developed
402 <a href=
"https://fedoraproject.org/wiki/Features/SSSD
">System
403 Security Services Daemon
</a
> packages.
</li
>
405 <li
>File synchronisation with the central home directory is set up
406 using a shared directory in both the local and the central home
407 directory, using unison.
</li
>
409 <li
>Printing should be set up to print to all printers broadcasting
410 their existence on the local network, and should then work out of
411 the box with CUPS. For sites needing accurate printer quotas, some
412 system with Kerberos authentication or printing via ssh could be
413 implemented.
</li
>
415 <li
>For users that should have local root access to their laptop,
416 sudo should be used to allow this to the local user.
</li
>
418 <li
>It would be nice if user and group information from LDAP is
419 cached on the client, but given that there are entries for the
420 local user and primary group in /etc/, it should not be needed.
</li
>
424 <p
>I believe all the pieces to implement this are in Debian/testing at
425 the moment. If we work quickly, we should be able to get this ready
426 in time for the Squeeze release to freeze. Some of the pieces need
427 tweaking, like libpam-ccreds should get support for pam-auth-update
428 (
<a href=
"http://bugs.debian.org/
566718">#
566718</a
>) and nslcd (or
429 perhaps debian-edu-config) should get some integration code to stop
430 its daemon when the LDAP server is unavailable to avoid long timeouts
431 when disconnected from the net. If we get Kerberos enabled, we need
432 to make sure we avoid long timeouts there too.
</p
>
434 <p
>If you want to help out with implementing this for Debian Edu,
435 please contact us on debian-edu@lists.debian.org.
</p
>
440 <title>Great book:
"Content: Selected Essays on Technology, Creativity, Copyright, and the Future of the Future
"</title>
441 <link>http://people.skolelinux.org/pere/blog/Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html
</link>
442 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html
</guid>
443 <pubDate>Mon,
19 Apr
2010 17:
10:
00 +
0200</pubDate>
445 <p
>The last few weeks i have had the pleasure of reading a
446 thought-provoking collection of essays by Cory Doctorow, on topics
447 touching copyright, virtual worlds, the future of man when the
448 conscience mind can be duplicated into a computer and many more. The
449 book titled
"Content: Selected Essays on Technology, Creativity,
450 Copyright, and the Future of the Future
" is available with few
451 restrictions on the web, for example from
452 <a href=
"http://craphound.com/content/
">his own site
</a
>. I read the
454 <a href=
"http://www.feedbooks.com/book/
2883">feedbooks
</a
> using
455 <a href=
"http://www.fbreader.org/
">fbreader
</a
> and my N810. I
456 strongly recommend this book.
</p
>
461 <title>Kerberos for Debian Edu/Squeeze?
</title>
462 <link>http://people.skolelinux.org/pere/blog/Kerberos_for_Debian_Edu_Squeeze_.html
</link>
463 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Kerberos_for_Debian_Edu_Squeeze_.html
</guid>
464 <pubDate>Wed,
14 Apr
2010 17:
20:
00 +
0200</pubDate>
466 <p
><a href=
"http://www.nuug.no/aktiviteter/
20100413-kerberos/
">Yesterdays
467 NUUG presentation
</a
> about Kerberos was inspiring, and reminded me
468 about the need to start using Kerberos in Skolelinux. Setting up a
469 Kerberos server seem to be straight forward, and if we get this in
470 place a long time before the Squeeze version of Debian freezes, we
471 have a chance to migrate Skolelinux away from NFSv3 for the home
472 directories, and over to an architecture where the infrastructure do
473 not have to trust IP addresses and machines, and instead can trust
474 users and cryptographic keys instead.
</p
>
476 <p
>A challenge will be integration and administration. Is there a
477 Kerberos implementation for Debian where one can control the
478 administration access in Kerberos using LDAP groups? With it, the
479 school administration will have to maintain access control using flat
480 files on the main server, which give a huge potential for errors.
</p
>
482 <p
>A related question I would like to know is how well Kerberos and
483 pam-ccreds (offline password check) work together. Anyone know?
</p
>
485 <p
>Next step will be to use Kerberos for access control in Lwat and
486 Nagios. I have no idea how much work that will be to implement. We
487 would also need to document how to integrate with Windows AD, as such
488 shared network will require two Kerberos realms that need to cooperate
489 to work properly.
</p
>
491 <p
>I believe a good start would be to start using Kerberos on the
492 skolelinux.no machines, and this way get ourselves experience with
493 configuration and integration. A natural starting point would be
494 setting up ldap.skolelinux.no as the Kerberos server, and migrate the
495 rest of the machines from PAM via LDAP to PAM via Kerberos one at the
498 <p
>If you would like to contribute to get this working in Skolelinux,
499 I recommend you to see the video recording from yesterdays NUUG
500 presentation, and start using Kerberos at home. The video show show
501 up in a few days.
</p
>
projects / homepage.git / blob