blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til____slutte____kj__pe_musikk.html">Digitale restriksjonsmekanismer fikk meg til å slutte å kjøpe musikk</a></div>
  24   <div class="date">2010-07-22 23:50</div>
  25   <div class="body">
  26 <p>For mange år siden slutte jeg å kjøpe musikk-CDer. Årsaken var at
  27 musikkbransjen var godt i gang med å selge platene sine med DRM som
  28 gjorde at jeg ikke fikk spilt av musikken jeg kjøpte på utstyret jeg
  29 hadde tilgjengelig, dvs. min datamaskin. Det var umulig å se på en
  30 plate om den var ødelagt eller ikke, og jeg hadde jo allerede en
  31 anseelig samling med plater, så jeg bestemme meg for å slutte å gi
  32 penger til en bransje som åpenbart ikke respekterte meg.</p>
  33
  34 <p>Jeg har mange titalls dager med musikk på CD i dag. Det meste er
  35 lagt i et stort arkiv som kan spilles av fra husets datamaskiner (har
  36 ikke rukket rippe alt). Jeg ser dermed ikke behovet for å skaffe mer
  37 musikk. De fleste av mine favoritter er i hus, og jeg er dermed godt
  38 fornøyd.</p>
  39
  40 <p>Hvis musikkbransjen ønsker mine penger, så må de demonstrere at de
  41 setter pris på meg som kunde, og ikke skremme meg bort med DRM og
  42 antydninger om at kundene er kriminelle.</p>
  43
  44 <p>Filmbransjen er like ille, men mens musikk gjerne varer lenge, er
  45 filmer mer ferskvare. Har dermed ikke helt sluttet å kjøpe filmer, men
  46 holder meg til DVD-filmer som kan spilles av på mine Linuxbokser.
  47 Kommer neppe til å ta i bruk Blueray, og ei heller de nye DRM-greiene
  48 «Ultraviolet» som be annonsert her om dagen.</p>
  49 </div>
  50   <div class="tags">
  51
  52
  53
  54    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>.
  55
  56   </div>
  57  </div>
  58  <div class="padding"></div>
  59
  60  <div class="entry">
  61   <div class="title"><a href="http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html">OpenStreetmap one step closer to having routing on its front page</a></div>
  62   <div class="date">2010-07-18 16:45</div>
  63   <div class="body">
  64 <p>Thanks to
  65 <a href="http://feedproxy.google.com/~r/Opengeodata/~3/wUTCzDZk3lc/project-of-the-week-which-way-home">todays
  66 opengeodata blog entry</a>, I just discovered that the
  67 OpenStreetmap.org site have gotten
  68 <a href="http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT">support
  69 for calculating routes</a>.  The support is still experimental and
  70 only available from the development server, until more experience is
  71 gathered on the user interface and any scalability issues.</p>
  72
  73 <p>Earlier, the routing I knew about using the OpenStreetmap.org data
  74 was provided by <a href="http://maps.cloudmade.com/">Cloudmade</a>,
  75 but having it on the main page is required to make everyone aware of
  76 the issue.  I've had people reject Openstreetmap.org as a viable
  77 alternative for them because the front page lacked routing support,
  78 and I hope their needs will be catered for when routing show up on the
  79 www.openstreetmap.org front page.</p>
  80 </div>
  81   <div class="tags">
  82
  83
  84
  85    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/kart">kart</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
  86
  87   </div>
  88  </div>
  89  <div class="padding"></div>
  90
  91  <div class="entry">
  92   <div class="title"><a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a></div>
  93   <div class="date">2010-07-17 21:00</div>
  94   <div class="body">
  95 <p>This is a
  96 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
  97 on my
  98 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
  99 work</a> on
 100 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
 101 all</a> the computer related LDAP objects in Debian Edu.</p>
 102
 103 <p>As a step to try to see if it possible to merge the DNS and DHCP
 104 LDAP objects, I have had a look at how the packages pdns-backend-ldap
 105 and dhcp3-server-ldap in Debian use the LDAP server.  The two
 106 implementations are quite different in how they use LDAP.</p>
 107
 108 To get this information, I started slapd with debugging enabled and
 109 dumped the debug output to a file to get the LDAP searches performed
 110 on a Debian Edu main-server.  Here is a summary.
 111
 112 <p><strong>powerdns</strong></p>
 113
 114 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
 115 on how to</a> set up PowerDNS to use a LDAP backend is available on
 116 the web.
 117
 118 <p>PowerDNS have two modes of operation using LDAP as its backend.
 119 One "strict" mode where the forward and reverse DNS lookups are done
 120 using the same LDAP objects, and a "tree" mode where the forward and
 121 reverse entries are in two different subtrees in LDAP with a structure
 122 based on the DNS names, as in tjener.intern and
 123 2.2.0.10.in-addr.arpa.</p>
 124
 125 <p>In tree mode, the server is set up to use a LDAP subtree as its
 126 base, and uses a "base" scoped search for the DNS name by adding
 127 "dc=tjener,dc=intern," to the base with a filter for
 128 "(associateddomain=tjener.intern)" for the forward entry and
 129 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
 130 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
 131 forward entries, it is looking for attributes named dnsttl, arecord,
 132 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
 133 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
 134 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
 135 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
 136 spfrecord and modifytimestamp.  For reverse entries it is looking for
 137 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
 138 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
 139 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
 140 ldapsearch commands could look like this:</p>
 141
 142 <blockquote><pre>
 143 ldapsearch -h ldap \
 144   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 145   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 146   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 147   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 148   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 149   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 150
 151 ldapsearch -h ldap \
 152   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 153   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
 154   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
 155   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
 156   srvrecord naptrrecord modifytimestamp
 157 </pre></blockquote>
 158
 159 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
 160 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
 161 example LDAP objects used there.  In addition to these objects, the
 162 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
 163 also exist.</p>
 164
 165 <blockquote><pre>
 166 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
 167 objectclass: top
 168 objectclass: dnsdomain
 169 objectclass: domainrelatedobject
 170 dc: tjener
 171 arecord: 10.0.2.2
 172 associateddomain: tjener.intern
 173
 174 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
 175 objectclass: top
 176 objectclass: dnsdomain2
 177 objectclass: domainrelatedobject
 178 dc: 2
 179 ptrrecord: tjener.intern
 180 associateddomain: 2.2.0.10.in-addr.arpa
 181 </pre></blockquote>
 182
 183 <p>In strict mode, the server behaves differently.  When looking for
 184 forward DNS entries, it is doing a "subtree" scoped search with the
 185 same base as in the tree mode for a object with filter
 186 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
 187 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
 188 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
 189 naptrrecord and modifytimestamp.  For reverse entires it also do a
 190 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
 191 and the requested attributes are associateddomain, dnsttl and
 192 modifytimestamp.  In short, in strict mode the objects with ptrrecord
 193 go away, and the arecord attribute in the forward object is used
 194 instead.</p>
 195
 196 <p>The forward and reverse searches can be simulated using ldapsearch
 197 like this:</p>
 198
 199 <blockquote><pre>
 200 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 201   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 202   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 203   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 204   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 205   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 206
 207 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 208   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
 209 </pre></blockquote>
 210
 211 <p>In addition to the forward and reverse searches , there is also a
 212 search for SOA records, which behave similar to the forward and
 213 reverse lookups.</p>
 214
 215 <p>A thing to note with the PowerDNS behaviour is that it do not
 216 specify any objectclass names, and instead look for the attributes it
 217 need to generate a DNS reply.  This make it able to work with any
 218 objectclass that provide the needed attributes.</p>
 219
 220 <p>The attributes are normally provided in the cosine (RFC 1274) and
 221 dnsdomain2 schemas.  The latter is used for reverse entries like
 222 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
 223
 224 <p>In Debian Edu, we have created DNS objects using the object classes
 225 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
 226 attributes) and domainrelatedobject (for associatedDomain).  The use
 227 of structural object classes make it impossible to combine these
 228 classes with the object classes used by DHCP.</p>
 229
 230 <p>There are other schemas that could be used too, for example the
 231 dnszone structural object class used by Gosa and bind-sdb for the DNS
 232 attributes combined with the domainrelatedobject object class, but in
 233 this case some unused attributes would have to be included as well
 234 (zonename and relativedomainname).</p>
 235
 236 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
 237 mode and not use any of the existing objectclasses (dnsdomain,
 238 dnsdomain2 and dnszone) when one want to combine the DNS information
 239 with DHCP information, and instead create a auxiliary object class
 240 defined something like this (using the attributes defined for
 241 dnsdomain and dnsdomain2 or dnszone):</p>
 242
 243 <blockquote><pre>
 244 objectclass ( some-oid NAME 'dnsDomainAux'
 245     SUP top
 246     AUXILIARY
 247     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
 248           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
 249           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
 250           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
 251           A6Record $ DNAMERecord
 252     ))
 253 </pre></blockquote>
 254
 255 <p>This will allow any object to become a DNS entry when combined with
 256 the domainrelatedobject object class, and allow any entity to include
 257 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
 258 developers asking for their view on this schema and if they are
 259 interested in providing such schema with PowerDNS, and I hope my
 260 message will be accepted into their mailing list soon.</p>
 261
 262 <p><strong>ISC dhcp</strong></p>
 263
 264 <p>The DHCP server searches for specific objectclass and requests all
 265 the object attributes, and then uses the attributes it want.  This
 266 make it harder to figure out exactly what attributes are used, but
 267 thanks to the working example in Debian Edu I can at least get an idea
 268 what is needed without having to read the source code.</p>
 269
 270 <p>In the DHCP server configuration, the LDAP base to use and the
 271 search filter to use to locate the correct dhcpServer entity is
 272 stored.  These are the relevant entries from
 273 /etc/dhcp3/dhcpd.conf:</p>
 274
 275 <blockquote><pre>
 276 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
 277 ldap-dhcp-server-cn "dhcp";
 278 </pre></blockquote>
 279
 280 <p>The DHCP server uses this information to nest all the DHCP
 281 configuration it need.  The cn "dhcp" is located using the given LDAP
 282 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
 283 search result is this entry:</p>
 284
 285 <blockquote><pre>
 286 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
 287 cn: dhcp
 288 objectClass: top
 289 objectClass: dhcpServer
 290 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 291 </pre></blockquote>
 292
 293 <p>The content of the dhcpServiceDN attribute is next used to locate the
 294 subtree with DHCP configuration.  The DHCP configuration subtree base
 295 is located using a base scope search with base "cn=DHCP
 296 Config,dc=skole,dc=skolelinux,dc=no" and filter
 297 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
 298 The search result is this entry:</p>
 299
 300 <blockquote><pre>
 301 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 302 cn: DHCP Config
 303 objectClass: top
 304 objectClass: dhcpService
 305 objectClass: dhcpOptions
 306 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
 307 dhcpStatements: ddns-update-style none
 308 dhcpStatements: authoritative
 309 dhcpOption: smtp-server code 69 = array of ip-address
 310 dhcpOption: www-server code 72 = array of ip-address
 311 dhcpOption: wpad-url code 252 = text
 312 </pre></blockquote>
 313
 314 <p>Next, the entire subtree is processed, one level at the time.  When
 315 all the DHCP configuration is loaded, it is ready to receive requests.
 316 The subtree in Debian Edu contain objects with object classes
 317 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
 318 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
 319 and information about netmasks, dynamic range etc.  Leaving out the
 320 details here because it is not relevant for the focus of my
 321 investigation, which is to see if it is possible to merge dns and dhcp
 322 related computer objects.</p>
 323
 324 <p>When a DHCP request come in, LDAP is searched for the MAC address
 325 of the client (00:00:00:00:00:00 in this example), using a subtree
 326 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
 327 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
 328 00:00:00:00:00:00))" as the filter.  This is what a host object look
 329 like:</p>
 330
 331 <blockquote><pre>
 332 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 333 cn: hostname
 334 objectClass: top
 335 objectClass: dhcpHost
 336 dhcpHWAddress: ethernet 00:00:00:00:00:00
 337 dhcpStatements: fixed-address hostname
 338 </pre></blockquote>
 339
 340 <p>There is less flexiblity in the way LDAP searches are done here.
 341 The object classes need to have fixed names, and the configuration
 342 need to be stored in a fairly specific LDAP structure.  On the
 343 positive side, the invidiual dhcpHost entires can be anywhere without
 344 the DN pointed to by the dhcpServer entries.  The latter should make
 345 it possible to group all host entries in a subtree next to the
 346 configuration entries, and this subtree can also be shared with the
 347 DNS server if the schema proposed above is combined with the dhcpHost
 348 structural object class.
 349
 350 <p><strong>Conclusion</strong></p>
 351
 352 <p>The PowerDNS implementation seem to be very flexible when it come
 353 to which LDAP schemas to use.  While its "tree" mode is rigid when it
 354 come to the the LDAP structure, the "strict" mode is very flexible,
 355 allowing DNS objects to be stored anywhere under the base cn specified
 356 in the configuration.</p>
 357
 358 <p>The DHCP implementation on the other hand is very inflexible, both
 359 regarding which LDAP schemas to use and which LDAP structure to use.
 360 I guess one could implement ones own schema, as long as the
 361 objectclasses and attributes have the names used, but this do not
 362 really help when the DHCP subtree need to have a fairly fixed
 363 structure.</p>
 364
 365 <p>Based on the observed behaviour, I suspect a LDAP structure like
 366 this might work for Debian Edu:</p>
 367
 368 <blockquote><pre>
 369 ou=services
 370   cn=machine-info (dhcpService) - dhcpServiceDN points here
 371     cn=dhcp (dhcpServer)
 372     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
 373       cn=10.0.2.0 (dhcpSubnet)
 374         cn=group1 (dhcpGroup/dhcpOptions)
 375     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
 376       cn=192.168.0.0 (dhcpSubnet)
 377         cn=group1 (dhcpGroup/dhcpOptions)
 378     ou=machines - PowerDNS base points here
 379       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
 380 </pre></blockquote>
 381
 382 <P>This is not tested yet.  If the DHCP server require the dhcpHost
 383 entries to be in the dhcpGroup subtrees, the entries can be stored
 384 there instead of a common machines subtree, and the PowerDNS base
 385 would have to be moved one level up to the machine-info subtree.</p>
 386
 387 <p>The combined object under the machines subtree would look something
 388 like this:</p>
 389
 390 <blockquote><pre>
 391 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
 392 dc: hostname
 393 objectClass: top
 394 objectClass: dhcpHost
 395 objectclass: domainrelatedobject
 396 objectclass: dnsDomainAux
 397 associateddomain: hostname.intern
 398 arecord: 10.11.12.13
 399 dhcpHWAddress: ethernet 00:00:00:00:00:00
 400 dhcpStatements: fixed-address hostname.intern
 401 </pre></blockquote>
 402
 403 </p>One could even add the LTSP configuration associated with a given
 404 machine, as long as the required attributes are available in a
 405 auxiliary object class.</p>
 406 </div>
 407   <div class="tags">
 408
 409
 410
 411    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 412
 413   </div>
 414  </div>
 415  <div class="padding"></div>
 416
 417  <div class="entry">
 418   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a></div>
 419   <div class="date">2010-07-14 23:45</div>
 420   <div class="body">
 421 <p>For a while now, I have wanted to find a way to change the DNS and
 422 DHCP services in Debian Edu to use the same LDAP objects for a given
 423 computer, to avoid the possibility of having a inconsistent state for
 424 a computer in LDAP (as in DHCP but no DNS entry or the other way
 425 around) and make it easier to add computers to LDAP.</p>
 426
 427 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
 428 information finally found a solution that seem to work.</p>
 429
 430 <p>The old setup required three LDAP objects for a given computer.
 431 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
 432 we switch powerdns to use its strict LDAP method (ldap-method=strict
 433 in pdns-debian-edu.conf), the forward and reverse DNS entries are
 434 merged into one while making it impossible to transfer the reverse map
 435 to a slave DNS server.</p>
 436
 437 <p>If we also replace the object class used to get the DNS related
 438 attributes to one allowing these attributes to be combined with the
 439 dhcphost object class, we can merge the DNS and DHCP entries into one.
 440 I've written such object class in the dnsdomainaux.schema file (need
 441 proper OIDs, but that is a minor issue), and tested the setup.  It
 442 seem to work.</p>
 443
 444 <p>With this test setup in place, we can get away with one LDAP object
 445 for both DNS and DHCP, and even the LTSP configuration I suggested in
 446 an earlier email.  The combined LDAP object will look something like
 447 this:</p>
 448
 449 <blockquote><pre>
 450   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 451   cn: hostname
 452   objectClass: dhcphost
 453   objectclass: domainrelatedobject
 454   objectclass: dnsdomainaux
 455   associateddomain: hostname.intern
 456   arecord: 10.11.12.13
 457   dhcphwaddress: ethernet 00:00:00:00:00:00
 458   dhcpstatements: fixed-address hostname
 459   ldapconfigsound: Y
 460 </pre></blockquote>
 461
 462 <p>The DNS server uses the associateddomain and arecord entries, while
 463 the DHCP server uses the dhcphwaddress and dhcpstatements entries
 464 before asking DNS to resolve the fixed-adddress.  LTSP will use
 465 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
 466
 467 <p>I am not yet sure if I can get the DHCP server to look for its
 468 dhcphost in a different location, to allow us to put the objects
 469 outside the "DHCP Config" subtree, but hope to figure out a way to do
 470 that.  If I can't figure out a way to do that, we can still get rid of
 471 the hosts subtree and move all its content into the DHCP Config tree
 472 (which probably should be renamed to be more related to the new
 473 content.  I suspect cn=dnsdhcp,ou=services or something like that
 474 might be a good place to put it.</p>
 475
 476 <p>If you want to help out with implementing this for Debian Edu,
 477 please contact us on debian-edu@lists.debian.org.</p>
 478 </div>
 479   <div class="tags">
 480
 481
 482
 483    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 484
 485   </div>
 486  </div>
 487  <div class="padding"></div>
 488
 489  <div class="entry">
 490   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a></div>
 491   <div class="date">2010-07-11 22:00</div>
 492   <div class="body">
 493 <p>Vagrant mentioned on IRC today that ltsp_config now support
 494 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
 495 clients, and that this can be used to fetch configuration from LDAP if
 496 Debian Edu choose to store configuration there.</p>
 497
 498 <p>Armed with this information, I got inspired and wrote a test module
 499 to get configuration from LDAP.  The idea is to look up the MAC
 500 address of the client in LDAP, and look for attributes on the form
 501 ltspconfigsetting=value, and use this to export SETTING=value to the
 502 LTSP clients.</p>
 503
 504 <p>The goal is to be able to store the LTSP configuration attributes
 505 in a "computer" LDAP object used by both DNS and DHCP, and thus
 506 allowing us to store all information about a computer in one place.</p>
 507
 508 <p>This is a untested draft implementation, and I welcome feedback on
 509 this approach.  A real LDAP schema for the ltspClientAux objectclass
 510 need to be written.  Comments, suggestions, etc?</p>
 511
 512 <blockquote><pre>
 513 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
 514 #
 515 # Fetch LTSP client settings from LDAP based on MAC address
 516 #
 517 # Uses ethernet address as stored in the dhcpHost objectclass using
 518 # the dhcpHWAddress attribute or ethernet address stored in the
 519 # ieee802Device objectclass with the macAddress attribute.
 520 #
 521 # This module is written to be schema agnostic, and only depend on the
 522 # existence of attribute names.
 523 #
 524 # The LTSP configuration variables are saved directly using a
 525 # ltspConfig prefix and uppercasing the rest of the attribute name.
 526 # To set the SERVER variable, set the ltspConfigServer attribute.
 527 #
 528 # Some LDAP schema should be created with all the relevant
 529 # configuration settings.  Something like this should work:
 530 #
 531 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
 532 #     SUP top
 533 #     AUXILIARY
 534 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
 535
 536 LDAPSERVER=$(debian-edu-ldapserver)
 537 if [ "$LDAPSERVER" ] ; then
 538     LDAPBASE=$(debian-edu-ldapserver -b)
 539     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
 540         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
 541         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
 542             grep '^ltspConfig' | while read attr value ; do
 543             # Remove prefix and convert to upper case
 544             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
 545             # bass value on to clients
 546             eval "$attr=$value; export $attr"
 547         done
 548     done
 549 fi
 550 </pre></blockquote>
 551
 552 <p>I'm not sure this shell construction will work, because I suspect
 553 the while block might end up in a subshell causing the variables set
 554 there to not show up in ltsp-config, but if that is the case I am sure
 555 the code can be restructured to make sure the variables are passed on.
 556 I expect that can be solved with some testing. :)</p>
 557
 558 <p>If you want to help out with implementing this for Debian Edu,
 559 please contact us on debian-edu@lists.debian.org.</p>
 560
 561 <p>Update 2010-07-17: I am aware of another effort to store LTSP
 562 configuration in LDAP that was created around year 2000 by
 563 <a href="http://www.pcxperience.com/thinclient/documentation/ldap.html">PC
 564 Xperience, Inc., 2000</a>.  I found its
 565 <a href="http://people.redhat.com/alikins/ltsp/ldap/">files</a> on a
 566 personal home page over at redhat.com.</p>
 567 </div>
 568   <div class="tags">
 569
 570
 571
 572    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 573
 574   </div>
 575  </div>
 576  <div class="padding"></div>
 577
 578  <div class="entry">
 579   <div class="title"><a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a></div>
 580   <div class="date">2010-07-09 12:55</div>
 581   <div class="body">
 582 <p>Since
 583 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
 584 last post</a> about available LDAP tools in Debian, I was told about a
 585 LDAP GUI that is even better than luma.  The java application
 586 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
 587 moving LDAP objects and subtrees using drag-and-drop, and can
 588 authenticate using Kerberos.  I have only tested the Kerberos
 589 authentication, but do not have a LDAP setup allowing me to rewrite
 590 LDAP with my test user yet.  It is
 591 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
 592 Debian</a> testing and unstable at the moment.  The only problem I
 593 have with it is how it handle errors.  If something go wrong, its
 594 non-intuitive behaviour require me to go through some query work list
 595 and remove the failing query.  Nothing big, but very annoying.</p>
 596 </div>
 597   <div class="tags">
 598
 599
 600
 601    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 602
 603   </div>
 604  </div>
 605  <div class="padding"></div>
 606
 607  <div class="entry">
 608   <div class="title"><a href="http://people.skolelinux.org/pere/blog/MS_Word_kr__ller_det_til_for_politiet_.html">MS Word krøller det til for politiet?</a></div>
 609   <div class="date">2010-07-08 14:00</div>
 610   <div class="body">
 611 <p>De siste dagene har Aftenposten
 612 <a href="http://www.aftenposten.no/nyheter/iriks/article3718597.ece">fortalt</a>
 613 <a href="http://www.aftenposten.no/nyheter/iriks/article3724249.ece">hvordan</a>
 614 politet har brukt skriveverktøy som ikke håndterer arabisk tekst og
 615 tekst som skal skrives fra høyre mot venstre når de har laget
 616 løpeseddel for å be om informasjon fra publikum.  Resultatet har vært
 617 en uleselig arabisk-bit på løpeseddelen.  Feilen har oppstått når
 618 teksten har blitt "kopiert inn i programvare som ikke har støtte for
 619 språk som skrives fra høyre mot venstre", og jeg er ganske sikker på
 620 at det er snakk om Microsoft Office i dette tilfellet.  Er det slik at
 621 MS Office i norsk språkdrakt ikke har støtte for tekst som skal
 622 skrives fra høyre mot venstre?  Jeg tror alle utgaver av
 623 OpenOffice.org har slik støtte, og det er jo ikke veldig vanskelig å
 624 la slik støtte finnes i alle utgaver av et program hvis støtten først
 625 er utviklet.  Aftenpostens melding får meg til å undre om problemet
 626 ville vært unngått hvis politiet brukte OpenOffice.org i stedet for MS
 627 Office.</p>
 628
 629 <p>Mon tro om det er flere eksempler på at MS Office har ødelagt for
 630 offentlig myndighet?</p>
 631 </div>
 632   <div class="tags">
 633
 634
 635
 636    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>.
 637
 638   </div>
 639  </div>
 640  <div class="padding"></div>
 641
 642  <div class="entry">
 643   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html">Lenny->Squeeze upgrades, apt vs aptitude with the Gnome desktop</a></div>
 644   <div class="date">2010-07-03 23:55</div>
 645   <div class="body">
 646 <p>Here is a short update on my <a
 647 href="http://people.skolelinux.org/~pere/debian-upgrade-testing/">my
 648 Debian Lenny->Squeeze upgrade testing</a>.  Here is a summary of the
 649 difference for Gnome when it is upgraded by apt-get and aptitude.  I'm
 650 not reporting the status for KDE, because the upgrade crashes when
 651 aptitude try because of missing conflicts
 652 (<a href="http://bugs.debian.org/584861">#584861</a> and
 653 <a href="http://bugs.debian.org/585716">#585716</a>).</p>
 654
 655 <p>At the end of the upgrade test script, dpkg -l is executed to get a
 656 complete list of the installed packages.  Based on this I see these
 657 differences when I did a test run today.  As usual, I do not really
 658 know what the correct set of packages would be, but thought it best to
 659 publish the difference.</p>
 660
 661 <p>Installed using apt-get, missing with aptitude</p>
 662
 663 <blockquote><p>
 664   at-spi cpp-4.3 finger gnome-spell gstreamer0.10-gnomevfs
 665   libatspi1.0-0 libcupsys2 libeel2-data libgail-common libgdl-1-common
 666   libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin
 667   libgtksourceview-common libpt-1.10.10-plugins-alsa
 668   libpt-1.10.10-plugins-v4l libservlet2.4-java libxalan2-java
 669   libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip
 670   python-4suite-xml python-eggtrayicon python-gtkhtml2
 671   python-gtkmozembed svgalibg1 xserver-xephyr zip
 672 </p></blockquote>
 673
 674 <p>Installed using apt-get, removed with aptitude</p>
 675
 676 <blockquote><p>
 677   bluez-utils dhcdbd djvulibre-desktop epiphany-gecko
 678   gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager
 679   libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-50
 680   libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcurl3
 681   libdirectfb-1.0-0 libdvdread3 libedata-cal1.2-6 libedataserver1.2-9
 682   libeel2-2.20 libepc-1.0-1 libepc-ui-1.0-1 libexchange-storage1.2-3
 683   libfaad0 libgd2-noxpm libgda3-3 libgda3-common libggz2 libggzcore9
 684   libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnome-desktop-2
 685   libgnome-pilot2 libgnomecups1.0-1 libgnomeprint2.2-0
 686   libgnomeprintui2.2-0 libgpod3 libgraphviz4 libgtkhtml2-0
 687   libgtksourceview1.0-0 libgucharmap6 libhesiod0 libicu38 libisccc50
 688   libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++10
 689   libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4
 690   libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5
 691   libparted1.8-10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3
 692   libpt-1.10.10 libraw1394-8 libsensors3 libsmbios2 libsoup2.2-8
 693   libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1
 694   libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj
 695   libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3
 696   mysql-common swfdec-gnome totem-gstreamer wodim
 697 </p></blockquote>
 698
 699 <p>Installed using aptitude, missing with apt-get</p>
 700
 701 <blockquote><p>
 702   gnome gnome-desktop-environment hamster-applet python-gnomeapplet
 703   python-gnomekeyring python-wnck rhythmbox-plugins xorg
 704   xserver-xorg-input-all xserver-xorg-input-evdev
 705   xserver-xorg-input-kbd xserver-xorg-input-mouse
 706   xserver-xorg-input-synaptics xserver-xorg-video-all
 707   xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati
 708   xserver-xorg-video-chips xserver-xorg-video-cirrus
 709   xserver-xorg-video-dummy xserver-xorg-video-fbdev
 710   xserver-xorg-video-glint xserver-xorg-video-i128
 711   xserver-xorg-video-i740 xserver-xorg-video-mach64
 712   xserver-xorg-video-mga xserver-xorg-video-neomagic
 713   xserver-xorg-video-nouveau xserver-xorg-video-nv
 714   xserver-xorg-video-r128 xserver-xorg-video-radeon
 715   xserver-xorg-video-radeonhd xserver-xorg-video-rendition
 716   xserver-xorg-video-s3 xserver-xorg-video-s3virge
 717   xserver-xorg-video-savage xserver-xorg-video-siliconmotion
 718   xserver-xorg-video-sis xserver-xorg-video-sisusb
 719   xserver-xorg-video-tdfx xserver-xorg-video-tga
 720   xserver-xorg-video-trident xserver-xorg-video-tseng
 721   xserver-xorg-video-vesa xserver-xorg-video-vmware
 722   xserver-xorg-video-voodoo
 723 </p></blockquote>
 724
 725 <p>Installed using aptitude, removed with apt-get</p>
 726
 727 <blockquote><p>
 728   deskbar-applet xserver-xorg xserver-xorg-core
 729   xserver-xorg-input-wacom xserver-xorg-video-intel
 730   xserver-xorg-video-openchrome
 731 </p></blockquote>
 732
 733 <p>I was told on IRC that the xorg-xserver package was
 734 <a href="http://git.debian.org/?p=pkg-xorg/xserver/xorg-server.git;a=commit;h=9c8080d06c457932d3bfec021c69ac000aa60120">changed
 735 in git</a> today to try to get apt-get to not remove xorg completely.
 736 No idea when it hits Squeeze, but when it does I hope it will reduce
 737 the difference somewhat.
 738 </div>
 739   <div class="tags">
 740
 741
 742
 743    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 744
 745   </div>
 746  </div>
 747  <div class="padding"></div>
 748
 749  <div class="entry">
 750   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a></div>
 751   <div class="date">2010-07-01 11:40</div>
 752   <div class="body">
 753 <p>For a laptop, centralized user directories and password checking is
 754 a bit troubling.  Laptops are typically used also when not connected
 755 to the network, and it is vital for a user to be able to log in or
 756 unlock the screen saver also when a central server is unavailable.
 757 This is possible by caching passwords and directory information (user
 758 and group attributes) locally, and the packages to do so are available
 759 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
 760 It is also possible to set up in Debian/Lenny, but require more manual
 761 setup there because pam-auth-update is missing in Lenny.</p>
 762
 763 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
 764
 765 This is the traditional method with a twist.  The password caching is
 766 provided by libpam-ccreds (version 10-4 or later is needed on
 767 Squeeze), and the directory caching is done by nscd.  The directory
 768 lookup and password checking is done using LDAP.  If one want to use
 769 Kerberos for password checking the libpam-ldapd package can be
 770 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
 771 local home directory with the path listed in LDAP, one can use the
 772 pam_mkhomedir module from pam-modules to make this happen instead of
 773 using libpam-mklocaluser.  A setup for pam-auth-update to enable
 774 pam_mkhomedir will have to be written until a fix for
 775 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
 776 archive.  Because I believe it is a bad idea to have local home
 777 directories using misleading paths like /site/server/partition/, I
 778 prefer to create a local user with the home directory in /home/.  This
 779 is done using the libpam-mklocaluser package.</p>
 780
 781 <p>These packages need to be installed and configured</p>
 782
 783 <blockquote><pre>
 784 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
 785 </pre></blockquote>
 786
 787 <p>The ldapd packages will ask for LDAP connection information, and
 788 one have to fill in the values that fits ones own site.  Make sure the
 789 PAM part uses encrypted connections, to make sure the password is not
 790 sent in clear text to the LDAP server.  I've been unable to get TLS
 791 certificate checking for a self signed certificate working, which make
 792 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
 793 is talking to the correct LDAP server), and very much welcome feedback
 794 on how to get this working.</p>
 795
 796 <p>Because nscd do not have a default configuration fit for offline
 797 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
 798 is fixed, this configuration should be used instead of the one
 799 currently in /etc/nscd.conf.  The changes are in the fields
 800 reload-count and positive-time-to-live, and is based on the
 801 instructions I found in the
 802 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
 803 instructions by Flyn Computing.</p>
 804
 805 <blockquote><pre>
 806         debug-level             0
 807         reload-count            unlimited
 808         paranoia                no
 809
 810         enable-cache            passwd          yes
 811         positive-time-to-live   passwd          2592000
 812         negative-time-to-live   passwd          20
 813         suggested-size          passwd          211
 814         check-files             passwd          yes
 815         persistent              passwd          yes
 816         shared                  passwd          yes
 817         max-db-size             passwd          33554432
 818         auto-propagate          passwd          yes
 819
 820         enable-cache            group           yes
 821         positive-time-to-live   group           2592000
 822         negative-time-to-live   group           20
 823         suggested-size          group           211
 824         check-files             group           yes
 825         persistent              group           yes
 826         shared                  group           yes
 827         max-db-size             group           33554432
 828         auto-propagate          group           yes
 829
 830         enable-cache            hosts           no
 831         positive-time-to-live   hosts           2592000
 832         negative-time-to-live   hosts           20
 833         suggested-size          hosts           211
 834         check-files             hosts           yes
 835         persistent              hosts           yes
 836         shared                  hosts           yes
 837         max-db-size             hosts           33554432
 838
 839         enable-cache            services        yes
 840         positive-time-to-live   services        2592000
 841         negative-time-to-live   services        20
 842         suggested-size          services        211
 843         check-files             services        yes
 844         persistent              services        yes
 845         shared                  services        yes
 846         max-db-size             services        33554432
 847 </pre></blockquote>
 848
 849 <p>While we wait for a mechanism to update /etc/nsswitch.conf
 850 automatically like the one provided in
 851 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
 852 content need to be manually replaced to ensure LDAP is used as the
 853 directory service on the machine.  /etc/nsswitch.conf should normally
 854 look like this:</p>
 855
 856 <blockquote><pre>
 857 passwd:         files ldap
 858 group:          files ldap
 859 shadow:         files ldap
 860 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 861 networks:       files
 862 protocols:      files
 863 services:       files
 864 ethers:         files
 865 rpc:            files
 866 netgroup:       files ldap
 867 </pre></blockquote>
 868
 869 <p>The important parts are that ldap is listed last for passwd, group,
 870 shadow and netgroup.</p>
 871
 872 <p>With these changes in place, any user in LDAP will be able to log
 873 in locally on the machine using for example kdm, get a local home
 874 directory created and have the password as well as user and group
 875 attributes cached.
 876
 877 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 878   libpam-mklocaluser/pam_mkhomedir</h2>
 879
 880 <p>Because nscd have had its share of problems, and seem to have
 881 problems doing proper caching, I've seen suggestions and recipes to
 882 use nss-updatedb to copy parts of the LDAP database locally when the
 883 LDAP database is available.  I have not tested such setup, because I
 884 discovered sssd.</p>
 885
 886 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
 887
 888 <p>A more flexible and robust setup than the nscd combination
 889 mentioned earlier that has shown up recently, is the
 890 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
 891 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
 892 to provide a Active Directory like directory service for Linux
 893 machines.  The sssd system combines the caching of passwords and user
 894 information into one package, and remove the need for nscd and
 895 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 896 1.2 do not support netgroups, but it is said that it will support this
 897 in version 1.5 expected to show up later in 2010.  Because the
 898 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
 899 was missing in Debian, I ended up co-maintaining it with Werner, and
 900 version 1.2 is now in testing.
 901
 902 <p>These packages need to be installed and configured to get the
 903 roaming setup I want</p>
 904
 905 <blockquote><pre>
 906 libpam-sss libnss-sss libpam-mklocaluser
 907 </pre></blockquote>
 908
 909 The complete setup of sssd is done by editing/creating
 910 <tt>/etc/sssd/sssd.conf</tt>.
 911
 912 <blockquote><pre>
 913 [sssd]
 914 config_file_version = 2
 915 reconnection_retries = 3
 916 sbus_timeout = 30
 917 services = nss, pam
 918 domains = INTERN
 919
 920 [nss]
 921 filter_groups = root
 922 filter_users = root
 923 reconnection_retries = 3
 924
 925 [pam]
 926 reconnection_retries = 3
 927
 928 [domain/INTERN]
 929 enumerate = false
 930 cache_credentials = true
 931
 932 id_provider = ldap
 933 auth_provider = ldap
 934 chpass_provider = ldap
 935
 936 ldap_uri = ldap://ldap
 937 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 938 ldap_tls_reqcert = never
 939 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 940 </pre></blockquote>
 941
 942 <p>I got the same problem here with certificate checking.  Had to set
 943 "ldap_tls_reqcert = never" to get it working.</p>
 944
 945 <p>With the libnss-sss package in testing at the moment, the
 946 nsswitch.conf file is update automatically, so there is no need to
 947 modify it manually.</p>
 948
 949 <p>If you want to help out with implementing this for Debian Edu,
 950 please contact us on debian-edu@lists.debian.org.</p>
 951 </div>
 952   <div class="tags">
 953
 954
 955
 956    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 957
 958   </div>
 959  </div>
 960  <div class="padding"></div>
 961
 962  <div class="entry">
 963   <div class="title"><a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">LUMA, a very nice LDAP GUI</a></div>
 964   <div class="date">2010-06-28 00:30</div>
 965   <div class="body">
 966 <p>The last few days I have been looking into the status of the LDAP
 967 directory in Debian Edu, and in the process I started to miss a GUI
 968 tool to browse the LDAP tree.  The only one I was able to find in
 969 Debian/Squeeze and Lenny is
 970 <a href="http://luma.sourceforge.net/">LUMA</a>, which has proved to
 971 be a great tool to get a overview of the current LDAP directory
 972 populated by default in Skolelinux.  Thanks to it, I have been able to
 973 find empty and obsolete subtrees, misplaced objects and duplicate
 974 objects.  It will be installed by default in Debian/Squeeze.  If you
 975 are working with LDAP, give it a go. :)</p>
 976
 977 <p>I did notice one problem with it I have not had time to report to
 978 the BTS yet.  There is no .desktop file in the package, so the tool do
 979 not show up in the Gnome and KDE menus, but only deep down in in the
 980 Debian submenu in KDE.  I hope that can be fixed before Squeeze is
 981 released.</p>
 982
 983 <p>I have not yet been able to get it to modify the tree yet.  I would
 984 like to move objects and remove subtrees directly in the GUI, but have
 985 not found a way to do that with LUMA yet.  So in the mean time, I use
 986 <a href="http://www.lichteblau.com/ldapvi/">ldapvi</a> for that.</p>
 987
 988 <p>If you have tips on other GUI tools for LDAP that might be useful
 989 in Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 990
 991 <p>Update 2010-06-29: Ross Reedstrom tipped us about the
 992 <a href="http://packages.qa.debian.org/g/gq.html">gq</a> package as a
 993 useful GUI alternative.  It seem like a good tool, but is unmaintained
 994 in Debian and got a RC bug keeping it out of Squeeze.  Unless that
 995 changes, it will not be an option for Debian Edu based on Squeeze.</p>
 996 </div>
 997   <div class="tags">
 998
 999
1000
1001    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1002
1003   </div>
1004  </div>
1005  <div class="padding"></div>
1006
1007  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
1008
1009 <div id="sidebar">
1010
1011
1012
1013
1014
1015 <h2>Archive</h2>
1016 <ul>
1017
1018 <li>2010
1019 <ul>
1020
1021 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
1022
1023 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
1024
1025 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1026
1027 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1028
1029 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1030
1031 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1032
1033 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (9)</a></li>
1034
1035 </ul></li>
1036
1037 <li>2009
1038 <ul>
1039
1040 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1041
1042 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1043
1044 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1045
1046 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1047
1048 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1049
1050 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1051
1052 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1053
1054 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1055
1056 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1057
1058 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1059
1060 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1061
1062 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1063
1064 </ul></li>
1065
1066 <li>2008
1067 <ul>
1068
1069 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1070
1071 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1072
1073 </ul></li>
1074
1075 </ul>
1076
1077
1078
1079 <h2>Tags</h2>
1080 <ul>
1081
1082  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
1083
1084  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1085
1086  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1087
1088  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
1089
1090  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (34)</a></li>
1091
1092  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (34)</a></li>
1093
1094  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (48)</a></li>
1095
1096  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
1097
1098  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (8)</a></li>
1099
1100  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (3)</a></li>
1101
1102  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
1103
1104  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
1105
1106  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1107
1108  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
1109
1110  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (71)</a></li>
1111
1112  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (85)</a></li>
1113
1114  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (14)</a></li>
1115
1116  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (14)</a></li>
1117
1118  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
1119
1120  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1121
1122  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (9)</a></li>
1123
1124  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
1125
1126  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
1127
1128  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
1129
1130  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
1131
1132  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
1133
1134  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (7)</a></li>
1135
1136 </ul>
1137
1138 </div>
1139
1140 <p style="text-align: right">
1141 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
1142 </p>
1143 </body>
1144 </html>