blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html">OpenStreetmap one step closer to having routing on its front page</a></div>
  24   <div class="date">2010-07-18 16:45</div>
  25   <div class="body">
  26 <p>Thanks to
  27 <a href="http://feedproxy.google.com/~r/Opengeodata/~3/wUTCzDZk3lc/project-of-the-week-which-way-home">todays
  28 opengeodata blog entry</a>, I just discovered that the
  29 OpenStreetmap.org site have gotten
  30 <a href="http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT">support
  31 for calculating routes</a>.  The support is still experimental and
  32 only available from the development server, until more experience is
  33 gathered on the user interface and any scalability issues.</p>
  34
  35 <p>Earlier, the routing I knew about using the OpenStreetmap.org data
  36 was provided by <a href="http://maps.cloudmade.com/">Cloudmade</a>,
  37 but having it on the main page is required to make everyone aware of
  38 the issue.  I've had people reject Openstreetmap.org as a viable
  39 alternative for them because the front page lacked routing support,
  40 and I hope their needs will be catered for when routing show up on the
  41 www.openstreetmap.org front page.</p>
  42 </div>
  43   <div class="tags">
  44
  45
  46
  47    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/kart">kart</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
  48
  49   </div>
  50  </div>
  51  <div class="padding"></div>
  52
  53  <div class="entry">
  54   <div class="title"><a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a></div>
  55   <div class="date">2010-07-17 21:00</div>
  56   <div class="body">
  57 <p>This is a
  58 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
  59 on my
  60 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
  61 work</a> on
  62 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
  63 all</a> the computer related LDAP objects in Debian Edu.</p>
  64
  65 <p>As a step to try to see if it possible to merge the DNS and DHCP
  66 LDAP objects, I have had a look at how the packages pdns-backend-ldap
  67 and dhcp3-server-ldap in Debian use the LDAP server.  The two
  68 implementations are quite different in how they use LDAP.</p>
  69
  70 To get this information, I started slapd with debugging enabled and
  71 dumped the debug output to a file to get the LDAP searches performed
  72 on a Debian Edu main-server.  Here is a summary.
  73
  74 <p><strong>powerdns</strong></p>
  75
  76 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
  77 on how to</a> set up PowerDNS to use a LDAP backend is available on
  78 the web.
  79
  80 <p>PowerDNS have two modes of operation using LDAP as its backend.
  81 One "strict" mode where the forward and reverse DNS lookups are done
  82 using the same LDAP objects, and a "tree" mode where the forward and
  83 reverse entries are in two different subtrees in LDAP with a structure
  84 based on the DNS names, as in tjener.intern and
  85 2.2.0.10.in-addr.arpa.</p>
  86
  87 <p>In tree mode, the server is set up to use a LDAP subtree as its
  88 base, and uses a "base" scoped search for the DNS name by adding
  89 "dc=tjener,dc=intern," to the base with a filter for
  90 "(associateddomain=tjener.intern)" for the forward entry and
  91 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
  92 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
  93 forward entries, it is looking for attributes named dnsttl, arecord,
  94 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
  95 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
  96 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
  97 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
  98 spfrecord and modifytimestamp.  For reverse entries it is looking for
  99 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
 100 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
 101 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
 102 ldapsearch commands could look like this:</p>
 103
 104 <blockquote><pre>
 105 ldapsearch -h ldap \
 106   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 107   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 108   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 109   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 110   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 111   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 112
 113 ldapsearch -h ldap \
 114   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 115   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
 116   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
 117   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
 118   srvrecord naptrrecord modifytimestamp
 119 </pre></blockquote>
 120
 121 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
 122 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
 123 example LDAP objects used there.  In addition to these objects, the
 124 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
 125 also exist.</p>
 126
 127 <blockquote><pre>
 128 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
 129 objectclass: top
 130 objectclass: dnsdomain
 131 objectclass: domainrelatedobject
 132 dc: tjener
 133 arecord: 10.0.2.2
 134 associateddomain: tjener.intern
 135
 136 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
 137 objectclass: top
 138 objectclass: dnsdomain2
 139 objectclass: domainrelatedobject
 140 dc: 2
 141 ptrrecord: tjener.intern
 142 associateddomain: 2.2.0.10.in-addr.arpa
 143 </pre></blockquote>
 144
 145 <p>In strict mode, the server behaves differently.  When looking for
 146 forward DNS entries, it is doing a "subtree" scoped search with the
 147 same base as in the tree mode for a object with filter
 148 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
 149 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
 150 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
 151 naptrrecord and modifytimestamp.  For reverse entires it also do a
 152 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
 153 and the requested attributes are associateddomain, dnsttl and
 154 modifytimestamp.  In short, in strict mode the objects with ptrrecord
 155 go away, and the arecord attribute in the forward object is used
 156 instead.</p>
 157
 158 <p>The forward and reverse searches can be simulated using ldapsearch
 159 like this:</p>
 160
 161 <blockquote><pre>
 162 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 163   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 164   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 165   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 166   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 167   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 168
 169 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 170   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
 171 </pre></blockquote>
 172
 173 <p>In addition to the forward and reverse searches , there is also a
 174 search for SOA records, which behave similar to the forward and
 175 reverse lookups.</p>
 176
 177 <p>A thing to note with the PowerDNS behaviour is that it do not
 178 specify any objectclass names, and instead look for the attributes it
 179 need to generate a DNS reply.  This make it able to work with any
 180 objectclass that provide the needed attributes.</p>
 181
 182 <p>The attributes are normally provided in the cosine (RFC 1274) and
 183 dnsdomain2 schemas.  The latter is used for reverse entries like
 184 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
 185
 186 <p>In Debian Edu, we have created DNS objects using the object classes
 187 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
 188 attributes) and domainrelatedobject (for associatedDomain).  The use
 189 of structural object classes make it impossible to combine these
 190 classes with the object classes used by DHCP.</p>
 191
 192 <p>There are other schemas that could be used too, for example the
 193 dnszone structural object class used by Gosa and bind-sdb for the DNS
 194 attributes combined with the domainrelatedobject object class, but in
 195 this case some unused attributes would have to be included as well
 196 (zonename and relativedomainname).</p>
 197
 198 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
 199 mode and not use any of the existing objectclasses (dnsdomain,
 200 dnsdomain2 and dnszone) when one want to combine the DNS information
 201 with DHCP information, and instead create a auxiliary object class
 202 defined something like this (using the attributes defined for
 203 dnsdomain and dnsdomain2 or dnszone):</p>
 204
 205 <blockquote><pre>
 206 objectclass ( some-oid NAME 'dnsDomainAux'
 207     SUP top
 208     AUXILIARY
 209     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
 210           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
 211           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
 212           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
 213           A6Record $ DNAMERecord
 214     ))
 215 </pre></blockquote>
 216
 217 <p>This will allow any object to become a DNS entry when combined with
 218 the domainrelatedobject object class, and allow any entity to include
 219 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
 220 developers asking for their view on this schema and if they are
 221 interested in providing such schema with PowerDNS, and I hope my
 222 message will be accepted into their mailing list soon.</p>
 223
 224 <p><strong>ISC dhcp</strong></p>
 225
 226 <p>The DHCP server searches for specific objectclass and requests all
 227 the object attributes, and then uses the attributes it want.  This
 228 make it harder to figure out exactly what attributes are used, but
 229 thanks to the working example in Debian Edu I can at least get an idea
 230 what is needed without having to read the source code.</p>
 231
 232 <p>In the DHCP server configuration, the LDAP base to use and the
 233 search filter to use to locate the correct dhcpServer entity is
 234 stored.  These are the relevant entries from
 235 /etc/dhcp3/dhcpd.conf:</p>
 236
 237 <blockquote><pre>
 238 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
 239 ldap-dhcp-server-cn "dhcp";
 240 </pre></blockquote>
 241
 242 <p>The DHCP server uses this information to nest all the DHCP
 243 configuration it need.  The cn "dhcp" is located using the given LDAP
 244 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
 245 search result is this entry:</p>
 246
 247 <blockquote><pre>
 248 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
 249 cn: dhcp
 250 objectClass: top
 251 objectClass: dhcpServer
 252 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 253 </pre></blockquote>
 254
 255 <p>The content of the dhcpServiceDN attribute is next used to locate the
 256 subtree with DHCP configuration.  The DHCP configuration subtree base
 257 is located using a base scope search with base "cn=DHCP
 258 Config,dc=skole,dc=skolelinux,dc=no" and filter
 259 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
 260 The search result is this entry:</p>
 261
 262 <blockquote><pre>
 263 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 264 cn: DHCP Config
 265 objectClass: top
 266 objectClass: dhcpService
 267 objectClass: dhcpOptions
 268 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
 269 dhcpStatements: ddns-update-style none
 270 dhcpStatements: authoritative
 271 dhcpOption: smtp-server code 69 = array of ip-address
 272 dhcpOption: www-server code 72 = array of ip-address
 273 dhcpOption: wpad-url code 252 = text
 274 </pre></blockquote>
 275
 276 <p>Next, the entire subtree is processed, one level at the time.  When
 277 all the DHCP configuration is loaded, it is ready to receive requests.
 278 The subtree in Debian Edu contain objects with object classes
 279 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
 280 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
 281 and information about netmasks, dynamic range etc.  Leaving out the
 282 details here because it is not relevant for the focus of my
 283 investigation, which is to see if it is possible to merge dns and dhcp
 284 related computer objects.</p>
 285
 286 <p>When a DHCP request come in, LDAP is searched for the MAC address
 287 of the client (00:00:00:00:00:00 in this example), using a subtree
 288 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
 289 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
 290 00:00:00:00:00:00))" as the filter.  This is what a host object look
 291 like:</p>
 292
 293 <blockquote><pre>
 294 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 295 cn: hostname
 296 objectClass: top
 297 objectClass: dhcpHost
 298 dhcpHWAddress: ethernet 00:00:00:00:00:00
 299 dhcpStatements: fixed-address hostname
 300 </pre></blockquote>
 301
 302 <p>There is less flexiblity in the way LDAP searches are done here.
 303 The object classes need to have fixed names, and the configuration
 304 need to be stored in a fairly specific LDAP structure.  On the
 305 positive side, the invidiual dhcpHost entires can be anywhere without
 306 the DN pointed to by the dhcpServer entries.  The latter should make
 307 it possible to group all host entries in a subtree next to the
 308 configuration entries, and this subtree can also be shared with the
 309 DNS server if the schema proposed above is combined with the dhcpHost
 310 structural object class.
 311
 312 <p><strong>Conclusion</strong></p>
 313
 314 <p>The PowerDNS implementation seem to be very flexible when it come
 315 to which LDAP schemas to use.  While its "tree" mode is rigid when it
 316 come to the the LDAP structure, the "strict" mode is very flexible,
 317 allowing DNS objects to be stored anywhere under the base cn specified
 318 in the configuration.</p>
 319
 320 <p>The DHCP implementation on the other hand is very inflexible, both
 321 regarding which LDAP schemas to use and which LDAP structure to use.
 322 I guess one could implement ones own schema, as long as the
 323 objectclasses and attributes have the names used, but this do not
 324 really help when the DHCP subtree need to have a fairly fixed
 325 structure.</p>
 326
 327 <p>Based on the observed behaviour, I suspect a LDAP structure like
 328 this might work for Debian Edu:</p>
 329
 330 <blockquote><pre>
 331 ou=services
 332   cn=machine-info (dhcpService) - dhcpServiceDN points here
 333     cn=dhcp (dhcpServer)
 334     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
 335       cn=10.0.2.0 (dhcpSubnet)
 336         cn=group1 (dhcpGroup/dhcpOptions)
 337     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
 338       cn=192.168.0.0 (dhcpSubnet)
 339         cn=group1 (dhcpGroup/dhcpOptions)
 340     ou=machines - PowerDNS base points here
 341       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
 342 </pre></blockquote>
 343
 344 <P>This is not tested yet.  If the DHCP server require the dhcpHost
 345 entries to be in the dhcpGroup subtrees, the entries can be stored
 346 there instead of a common machines subtree, and the PowerDNS base
 347 would have to be moved one level up to the machine-info subtree.</p>
 348
 349 <p>The combined object under the machines subtree would look something
 350 like this:</p>
 351
 352 <blockquote><pre>
 353 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
 354 dc: hostname
 355 objectClass: top
 356 objectClass: dhcpHost
 357 objectclass: domainrelatedobject
 358 objectclass: dnsDomainAux
 359 associateddomain: hostname.intern
 360 arecord: 10.11.12.13
 361 dhcpHWAddress: ethernet 00:00:00:00:00:00
 362 dhcpStatements: fixed-address hostname.intern
 363 </pre></blockquote>
 364
 365 </p>One could even add the LTSP configuration associated with a given
 366 machine, as long as the required attributes are available in a
 367 auxiliary object class.</p>
 368 </div>
 369   <div class="tags">
 370
 371
 372
 373    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 374
 375   </div>
 376  </div>
 377  <div class="padding"></div>
 378
 379  <div class="entry">
 380   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a></div>
 381   <div class="date">2010-07-14 23:45</div>
 382   <div class="body">
 383 <p>For a while now, I have wanted to find a way to change the DNS and
 384 DHCP services in Debian Edu to use the same LDAP objects for a given
 385 computer, to avoid the possibility of having a inconsistent state for
 386 a computer in LDAP (as in DHCP but no DNS entry or the other way
 387 around) and make it easier to add computers to LDAP.</p>
 388
 389 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
 390 information finally found a solution that seem to work.</p>
 391
 392 <p>The old setup required three LDAP objects for a given computer.
 393 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
 394 we switch powerdns to use its strict LDAP method (ldap-method=strict
 395 in pdns-debian-edu.conf), the forward and reverse DNS entries are
 396 merged into one while making it impossible to transfer the reverse map
 397 to a slave DNS server.</p>
 398
 399 <p>If we also replace the object class used to get the DNS related
 400 attributes to one allowing these attributes to be combined with the
 401 dhcphost object class, we can merge the DNS and DHCP entries into one.
 402 I've written such object class in the dnsdomainaux.schema file (need
 403 proper OIDs, but that is a minor issue), and tested the setup.  It
 404 seem to work.</p>
 405
 406 <p>With this test setup in place, we can get away with one LDAP object
 407 for both DNS and DHCP, and even the LTSP configuration I suggested in
 408 an earlier email.  The combined LDAP object will look something like
 409 this:</p>
 410
 411 <blockquote><pre>
 412   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 413   cn: hostname
 414   objectClass: dhcphost
 415   objectclass: domainrelatedobject
 416   objectclass: dnsdomainaux
 417   associateddomain: hostname.intern
 418   arecord: 10.11.12.13
 419   dhcphwaddress: ethernet 00:00:00:00:00:00
 420   dhcpstatements: fixed-address hostname
 421   ldapconfigsound: Y
 422 </pre></blockquote>
 423
 424 <p>The DNS server uses the associateddomain and arecord entries, while
 425 the DHCP server uses the dhcphwaddress and dhcpstatements entries
 426 before asking DNS to resolve the fixed-adddress.  LTSP will use
 427 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
 428
 429 <p>I am not yet sure if I can get the DHCP server to look for its
 430 dhcphost in a different location, to allow us to put the objects
 431 outside the "DHCP Config" subtree, but hope to figure out a way to do
 432 that.  If I can't figure out a way to do that, we can still get rid of
 433 the hosts subtree and move all its content into the DHCP Config tree
 434 (which probably should be renamed to be more related to the new
 435 content.  I suspect cn=dnsdhcp,ou=services or something like that
 436 might be a good place to put it.</p>
 437
 438 <p>If you want to help out with implementing this for Debian Edu,
 439 please contact us on debian-edu@lists.debian.org.</p>
 440 </div>
 441   <div class="tags">
 442
 443
 444
 445    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 446
 447   </div>
 448  </div>
 449  <div class="padding"></div>
 450
 451  <div class="entry">
 452   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a></div>
 453   <div class="date">2010-07-11 22:00</div>
 454   <div class="body">
 455 <p>Vagrant mentioned on IRC today that ltsp_config now support
 456 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
 457 clients, and that this can be used to fetch configuration from LDAP if
 458 Debian Edu choose to store configuration there.</p>
 459
 460 <p>Armed with this information, I got inspired and wrote a test module
 461 to get configuration from LDAP.  The idea is to look up the MAC
 462 address of the client in LDAP, and look for attributes on the form
 463 ltspconfigsetting=value, and use this to export SETTING=value to the
 464 LTSP clients.</p>
 465
 466 <p>The goal is to be able to store the LTSP configuration attributes
 467 in a "computer" LDAP object used by both DNS and DHCP, and thus
 468 allowing us to store all information about a computer in one place.</p>
 469
 470 <p>This is a untested draft implementation, and I welcome feedback on
 471 this approach.  A real LDAP schema for the ltspClientAux objectclass
 472 need to be written.  Comments, suggestions, etc?</p>
 473
 474 <blockquote><pre>
 475 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
 476 #
 477 # Fetch LTSP client settings from LDAP based on MAC address
 478 #
 479 # Uses ethernet address as stored in the dhcpHost objectclass using
 480 # the dhcpHWAddress attribute or ethernet address stored in the
 481 # ieee802Device objectclass with the macAddress attribute.
 482 #
 483 # This module is written to be schema agnostic, and only depend on the
 484 # existence of attribute names.
 485 #
 486 # The LTSP configuration variables are saved directly using a
 487 # ltspConfig prefix and uppercasing the rest of the attribute name.
 488 # To set the SERVER variable, set the ltspConfigServer attribute.
 489 #
 490 # Some LDAP schema should be created with all the relevant
 491 # configuration settings.  Something like this should work:
 492 #
 493 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
 494 #     SUP top
 495 #     AUXILIARY
 496 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
 497
 498 LDAPSERVER=$(debian-edu-ldapserver)
 499 if [ "$LDAPSERVER" ] ; then
 500     LDAPBASE=$(debian-edu-ldapserver -b)
 501     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
 502         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
 503         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
 504             grep '^ltspConfig' | while read attr value ; do
 505             # Remove prefix and convert to upper case
 506             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
 507             # bass value on to clients
 508             eval "$attr=$value; export $attr"
 509         done
 510     done
 511 fi
 512 </pre></blockquote>
 513
 514 <p>I'm not sure this shell construction will work, because I suspect
 515 the while block might end up in a subshell causing the variables set
 516 there to not show up in ltsp-config, but if that is the case I am sure
 517 the code can be restructured to make sure the variables are passed on.
 518 I expect that can be solved with some testing. :)</p>
 519
 520 <p>If you want to help out with implementing this for Debian Edu,
 521 please contact us on debian-edu@lists.debian.org.</p>
 522
 523 <p>Update 2010-07-17: I am aware of another effort to store LTSP
 524 configuration in LDAP that was created around year 2000 by
 525 <a href="http://www.pcxperience.com/thinclient/documentation/ldap.html">PC
 526 Xperience, Inc., 2000</a>.  I found its
 527 <a href="http://people.redhat.com/alikins/ltsp/ldap/">files</a> on a
 528 personal home page over at redhat.com.</p>
 529 </div>
 530   <div class="tags">
 531
 532
 533
 534    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 535
 536   </div>
 537  </div>
 538  <div class="padding"></div>
 539
 540  <div class="entry">
 541   <div class="title"><a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a></div>
 542   <div class="date">2010-07-09 12:55</div>
 543   <div class="body">
 544 <p>Since
 545 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
 546 last post</a> about available LDAP tools in Debian, I was told about a
 547 LDAP GUI that is even better than luma.  The java application
 548 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
 549 moving LDAP objects and subtrees using drag-and-drop, and can
 550 authenticate using Kerberos.  I have only tested the Kerberos
 551 authentication, but do not have a LDAP setup allowing me to rewrite
 552 LDAP with my test user yet.  It is
 553 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
 554 Debian</a> testing and unstable at the moment.  The only problem I
 555 have with it is how it handle errors.  If something go wrong, its
 556 non-intuitive behaviour require me to go through some query work list
 557 and remove the failing query.  Nothing big, but very annoying.</p>
 558 </div>
 559   <div class="tags">
 560
 561
 562
 563    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 564
 565   </div>
 566  </div>
 567  <div class="padding"></div>
 568
 569  <div class="entry">
 570   <div class="title"><a href="http://people.skolelinux.org/pere/blog/MS_Word_kr__ller_det_til_for_politiet_.html">MS Word krøller det til for politiet?</a></div>
 571   <div class="date">2010-07-08 14:00</div>
 572   <div class="body">
 573 <p>De siste dagene har Aftenposten
 574 <a href="http://www.aftenposten.no/nyheter/iriks/article3718597.ece">fortalt</a>
 575 <a href="http://www.aftenposten.no/nyheter/iriks/article3724249.ece">hvordan</a>
 576 politet har brukt skriveverktøy som ikke håndterer arabisk tekst og
 577 tekst som skal skrives fra høyre mot venstre når de har laget
 578 løpeseddel for å be om informasjon fra publikum.  Resultatet har vært
 579 en uleselig arabisk-bit på løpeseddelen.  Feilen har oppstått når
 580 teksten har blitt "kopiert inn i programvare som ikke har støtte for
 581 språk som skrives fra høyre mot venstre", og jeg er ganske sikker på
 582 at det er snakk om Microsoft Office i dette tilfellet.  Er det slik at
 583 MS Office i norsk språkdrakt ikke har støtte for tekst som skal
 584 skrives fra høyre mot venstre?  Jeg tror alle utgaver av
 585 OpenOffice.org har slik støtte, og det er jo ikke veldig vanskelig å
 586 la slik støtte finnes i alle utgaver av et program hvis støtten først
 587 er utviklet.  Aftenpostens melding får meg til å undre om problemet
 588 ville vært unngått hvis politiet brukte OpenOffice.org i stedet for MS
 589 Office.</p>
 590
 591 <p>Mon tro om det er flere eksempler på at MS Office har ødelagt for
 592 offentlig myndighet?</p>
 593 </div>
 594   <div class="tags">
 595
 596
 597
 598    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>.
 599
 600   </div>
 601  </div>
 602  <div class="padding"></div>
 603
 604  <div class="entry">
 605   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html">Lenny->Squeeze upgrades, apt vs aptitude with the Gnome desktop</a></div>
 606   <div class="date">2010-07-03 23:55</div>
 607   <div class="body">
 608 <p>Here is a short update on my <a
 609 href="http://people.skolelinux.org/~pere/debian-upgrade-testing/">my
 610 Debian Lenny->Squeeze upgrade testing</a>.  Here is a summary of the
 611 difference for Gnome when it is upgraded by apt-get and aptitude.  I'm
 612 not reporting the status for KDE, because the upgrade crashes when
 613 aptitude try because of missing conflicts
 614 (<a href="http://bugs.debian.org/584861">#584861</a> and
 615 <a href="http://bugs.debian.org/585716">#585716</a>).</p>
 616
 617 <p>At the end of the upgrade test script, dpkg -l is executed to get a
 618 complete list of the installed packages.  Based on this I see these
 619 differences when I did a test run today.  As usual, I do not really
 620 know what the correct set of packages would be, but thought it best to
 621 publish the difference.</p>
 622
 623 <p>Installed using apt-get, missing with aptitude</p>
 624
 625 <blockquote><p>
 626   at-spi cpp-4.3 finger gnome-spell gstreamer0.10-gnomevfs
 627   libatspi1.0-0 libcupsys2 libeel2-data libgail-common libgdl-1-common
 628   libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin
 629   libgtksourceview-common libpt-1.10.10-plugins-alsa
 630   libpt-1.10.10-plugins-v4l libservlet2.4-java libxalan2-java
 631   libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip
 632   python-4suite-xml python-eggtrayicon python-gtkhtml2
 633   python-gtkmozembed svgalibg1 xserver-xephyr zip
 634 </p></blockquote>
 635
 636 <p>Installed using apt-get, removed with aptitude</p>
 637
 638 <blockquote><p>
 639   bluez-utils dhcdbd djvulibre-desktop epiphany-gecko
 640   gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager
 641   libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-50
 642   libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcurl3
 643   libdirectfb-1.0-0 libdvdread3 libedata-cal1.2-6 libedataserver1.2-9
 644   libeel2-2.20 libepc-1.0-1 libepc-ui-1.0-1 libexchange-storage1.2-3
 645   libfaad0 libgd2-noxpm libgda3-3 libgda3-common libggz2 libggzcore9
 646   libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnome-desktop-2
 647   libgnome-pilot2 libgnomecups1.0-1 libgnomeprint2.2-0
 648   libgnomeprintui2.2-0 libgpod3 libgraphviz4 libgtkhtml2-0
 649   libgtksourceview1.0-0 libgucharmap6 libhesiod0 libicu38 libisccc50
 650   libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++10
 651   libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4
 652   libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5
 653   libparted1.8-10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3
 654   libpt-1.10.10 libraw1394-8 libsensors3 libsmbios2 libsoup2.2-8
 655   libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1
 656   libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj
 657   libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3
 658   mysql-common swfdec-gnome totem-gstreamer wodim
 659 </p></blockquote>
 660
 661 <p>Installed using aptitude, missing with apt-get</p>
 662
 663 <blockquote><p>
 664   gnome gnome-desktop-environment hamster-applet python-gnomeapplet
 665   python-gnomekeyring python-wnck rhythmbox-plugins xorg
 666   xserver-xorg-input-all xserver-xorg-input-evdev
 667   xserver-xorg-input-kbd xserver-xorg-input-mouse
 668   xserver-xorg-input-synaptics xserver-xorg-video-all
 669   xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati
 670   xserver-xorg-video-chips xserver-xorg-video-cirrus
 671   xserver-xorg-video-dummy xserver-xorg-video-fbdev
 672   xserver-xorg-video-glint xserver-xorg-video-i128
 673   xserver-xorg-video-i740 xserver-xorg-video-mach64
 674   xserver-xorg-video-mga xserver-xorg-video-neomagic
 675   xserver-xorg-video-nouveau xserver-xorg-video-nv
 676   xserver-xorg-video-r128 xserver-xorg-video-radeon
 677   xserver-xorg-video-radeonhd xserver-xorg-video-rendition
 678   xserver-xorg-video-s3 xserver-xorg-video-s3virge
 679   xserver-xorg-video-savage xserver-xorg-video-siliconmotion
 680   xserver-xorg-video-sis xserver-xorg-video-sisusb
 681   xserver-xorg-video-tdfx xserver-xorg-video-tga
 682   xserver-xorg-video-trident xserver-xorg-video-tseng
 683   xserver-xorg-video-vesa xserver-xorg-video-vmware
 684   xserver-xorg-video-voodoo
 685 </p></blockquote>
 686
 687 <p>Installed using aptitude, removed with apt-get</p>
 688
 689 <blockquote><p>
 690   deskbar-applet xserver-xorg xserver-xorg-core
 691   xserver-xorg-input-wacom xserver-xorg-video-intel
 692   xserver-xorg-video-openchrome
 693 </p></blockquote>
 694
 695 <p>I was told on IRC that the xorg-xserver package was
 696 <a href="http://git.debian.org/?p=pkg-xorg/xserver/xorg-server.git;a=commit;h=9c8080d06c457932d3bfec021c69ac000aa60120">changed
 697 in git</a> today to try to get apt-get to not remove xorg completely.
 698 No idea when it hits Squeeze, but when it does I hope it will reduce
 699 the difference somewhat.
 700 </div>
 701   <div class="tags">
 702
 703
 704
 705    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 706
 707   </div>
 708  </div>
 709  <div class="padding"></div>
 710
 711  <div class="entry">
 712   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a></div>
 713   <div class="date">2010-07-01 11:40</div>
 714   <div class="body">
 715 <p>For a laptop, centralized user directories and password checking is
 716 a bit troubling.  Laptops are typically used also when not connected
 717 to the network, and it is vital for a user to be able to log in or
 718 unlock the screen saver also when a central server is unavailable.
 719 This is possible by caching passwords and directory information (user
 720 and group attributes) locally, and the packages to do so are available
 721 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
 722 It is also possible to set up in Debian/Lenny, but require more manual
 723 setup there because pam-auth-update is missing in Lenny.</p>
 724
 725 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
 726
 727 This is the traditional method with a twist.  The password caching is
 728 provided by libpam-ccreds (version 10-4 or later is needed on
 729 Squeeze), and the directory caching is done by nscd.  The directory
 730 lookup and password checking is done using LDAP.  If one want to use
 731 Kerberos for password checking the libpam-ldapd package can be
 732 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
 733 local home directory with the path listed in LDAP, one can use the
 734 pam_mkhomedir module from pam-modules to make this happen instead of
 735 using libpam-mklocaluser.  A setup for pam-auth-update to enable
 736 pam_mkhomedir will have to be written until a fix for
 737 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
 738 archive.  Because I believe it is a bad idea to have local home
 739 directories using misleading paths like /site/server/partition/, I
 740 prefer to create a local user with the home directory in /home/.  This
 741 is done using the libpam-mklocaluser package.</p>
 742
 743 <p>These packages need to be installed and configured</p>
 744
 745 <blockquote><pre>
 746 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
 747 </pre></blockquote>
 748
 749 <p>The ldapd packages will ask for LDAP connection information, and
 750 one have to fill in the values that fits ones own site.  Make sure the
 751 PAM part uses encrypted connections, to make sure the password is not
 752 sent in clear text to the LDAP server.  I've been unable to get TLS
 753 certificate checking for a self signed certificate working, which make
 754 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
 755 is talking to the correct LDAP server), and very much welcome feedback
 756 on how to get this working.</p>
 757
 758 <p>Because nscd do not have a default configuration fit for offline
 759 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
 760 is fixed, this configuration should be used instead of the one
 761 currently in /etc/nscd.conf.  The changes are in the fields
 762 reload-count and positive-time-to-live, and is based on the
 763 instructions I found in the
 764 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
 765 instructions by Flyn Computing.</p>
 766
 767 <blockquote><pre>
 768         debug-level             0
 769         reload-count            unlimited
 770         paranoia                no
 771
 772         enable-cache            passwd          yes
 773         positive-time-to-live   passwd          2592000
 774         negative-time-to-live   passwd          20
 775         suggested-size          passwd          211
 776         check-files             passwd          yes
 777         persistent              passwd          yes
 778         shared                  passwd          yes
 779         max-db-size             passwd          33554432
 780         auto-propagate          passwd          yes
 781
 782         enable-cache            group           yes
 783         positive-time-to-live   group           2592000
 784         negative-time-to-live   group           20
 785         suggested-size          group           211
 786         check-files             group           yes
 787         persistent              group           yes
 788         shared                  group           yes
 789         max-db-size             group           33554432
 790         auto-propagate          group           yes
 791
 792         enable-cache            hosts           no
 793         positive-time-to-live   hosts           2592000
 794         negative-time-to-live   hosts           20
 795         suggested-size          hosts           211
 796         check-files             hosts           yes
 797         persistent              hosts           yes
 798         shared                  hosts           yes
 799         max-db-size             hosts           33554432
 800
 801         enable-cache            services        yes
 802         positive-time-to-live   services        2592000
 803         negative-time-to-live   services        20
 804         suggested-size          services        211
 805         check-files             services        yes
 806         persistent              services        yes
 807         shared                  services        yes
 808         max-db-size             services        33554432
 809 </pre></blockquote>
 810
 811 <p>While we wait for a mechanism to update /etc/nsswitch.conf
 812 automatically like the one provided in
 813 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
 814 content need to be manually replaced to ensure LDAP is used as the
 815 directory service on the machine.  /etc/nsswitch.conf should normally
 816 look like this:</p>
 817
 818 <blockquote><pre>
 819 passwd:         files ldap
 820 group:          files ldap
 821 shadow:         files ldap
 822 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 823 networks:       files
 824 protocols:      files
 825 services:       files
 826 ethers:         files
 827 rpc:            files
 828 netgroup:       files ldap
 829 </pre></blockquote>
 830
 831 <p>The important parts are that ldap is listed last for passwd, group,
 832 shadow and netgroup.</p>
 833
 834 <p>With these changes in place, any user in LDAP will be able to log
 835 in locally on the machine using for example kdm, get a local home
 836 directory created and have the password as well as user and group
 837 attributes cached.
 838
 839 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 840   libpam-mklocaluser/pam_mkhomedir</h2>
 841
 842 <p>Because nscd have had its share of problems, and seem to have
 843 problems doing proper caching, I've seen suggestions and recipes to
 844 use nss-updatedb to copy parts of the LDAP database locally when the
 845 LDAP database is available.  I have not tested such setup, because I
 846 discovered sssd.</p>
 847
 848 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
 849
 850 <p>A more flexible and robust setup than the nscd combination
 851 mentioned earlier that has shown up recently, is the
 852 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
 853 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
 854 to provide a Active Directory like directory service for Linux
 855 machines.  The sssd system combines the caching of passwords and user
 856 information into one package, and remove the need for nscd and
 857 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 858 1.2 do not support netgroups, but it is said that it will support this
 859 in version 1.5 expected to show up later in 2010.  Because the
 860 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
 861 was missing in Debian, I ended up co-maintaining it with Werner, and
 862 version 1.2 is now in testing.
 863
 864 <p>These packages need to be installed and configured to get the
 865 roaming setup I want</p>
 866
 867 <blockquote><pre>
 868 libpam-sss libnss-sss libpam-mklocaluser
 869 </pre></blockquote>
 870
 871 The complete setup of sssd is done by editing/creating
 872 <tt>/etc/sssd/sssd.conf</tt>.
 873
 874 <blockquote><pre>
 875 [sssd]
 876 config_file_version = 2
 877 reconnection_retries = 3
 878 sbus_timeout = 30
 879 services = nss, pam
 880 domains = INTERN
 881
 882 [nss]
 883 filter_groups = root
 884 filter_users = root
 885 reconnection_retries = 3
 886
 887 [pam]
 888 reconnection_retries = 3
 889
 890 [domain/INTERN]
 891 enumerate = false
 892 cache_credentials = true
 893
 894 id_provider = ldap
 895 auth_provider = ldap
 896 chpass_provider = ldap
 897
 898 ldap_uri = ldap://ldap
 899 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 900 ldap_tls_reqcert = never
 901 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 902 </pre></blockquote>
 903
 904 <p>I got the same problem here with certificate checking.  Had to set
 905 "ldap_tls_reqcert = never" to get it working.</p>
 906
 907 <p>With the libnss-sss package in testing at the moment, the
 908 nsswitch.conf file is update automatically, so there is no need to
 909 modify it manually.</p>
 910
 911 <p>If you want to help out with implementing this for Debian Edu,
 912 please contact us on debian-edu@lists.debian.org.</p>
 913 </div>
 914   <div class="tags">
 915
 916
 917
 918    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 919
 920   </div>
 921  </div>
 922  <div class="padding"></div>
 923
 924  <div class="entry">
 925   <div class="title"><a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">LUMA, a very nice LDAP GUI</a></div>
 926   <div class="date">2010-06-28 00:30</div>
 927   <div class="body">
 928 <p>The last few days I have been looking into the status of the LDAP
 929 directory in Debian Edu, and in the process I started to miss a GUI
 930 tool to browse the LDAP tree.  The only one I was able to find in
 931 Debian/Squeeze and Lenny is
 932 <a href="http://luma.sourceforge.net/">LUMA</a>, which has proved to
 933 be a great tool to get a overview of the current LDAP directory
 934 populated by default in Skolelinux.  Thanks to it, I have been able to
 935 find empty and obsolete subtrees, misplaced objects and duplicate
 936 objects.  It will be installed by default in Debian/Squeeze.  If you
 937 are working with LDAP, give it a go. :)</p>
 938
 939 <p>I did notice one problem with it I have not had time to report to
 940 the BTS yet.  There is no .desktop file in the package, so the tool do
 941 not show up in the Gnome and KDE menus, but only deep down in in the
 942 Debian submenu in KDE.  I hope that can be fixed before Squeeze is
 943 released.</p>
 944
 945 <p>I have not yet been able to get it to modify the tree yet.  I would
 946 like to move objects and remove subtrees directly in the GUI, but have
 947 not found a way to do that with LUMA yet.  So in the mean time, I use
 948 <a href="http://www.lichteblau.com/ldapvi/">ldapvi</a> for that.</p>
 949
 950 <p>If you have tips on other GUI tools for LDAP that might be useful
 951 in Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 952
 953 <p>Update 2010-06-29: Ross Reedstrom tipped us about the
 954 <a href="http://packages.qa.debian.org/g/gq.html">gq</a> package as a
 955 useful GUI alternative.  It seem like a good tool, but is unmaintained
 956 in Debian and got a RC bug keeping it out of Squeeze.  Unless that
 957 changes, it will not be an option for Debian Edu based on Squeeze.</p>
 958 </div>
 959   <div class="tags">
 960
 961
 962
 963    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 964
 965   </div>
 966  </div>
 967  <div class="padding"></div>
 968
 969  <div class="entry">
 970   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">Idea for a change to LDAP schemas allowing DNS and DHCP info to be combined into one object</a></div>
 971   <div class="date">2010-06-24 00:35</div>
 972   <div class="body">
 973 <p>A while back, I
 974 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">complained
 975 about the fact</a> that it is not possible with the provided schemas
 976 for storing DNS and DHCP information in LDAP to combine the two sets
 977 of information into one LDAP object representing a computer.</p>
 978
 979 <p>In the mean time, I discovered that a simple fix would be to make
 980 the dhcpHost object class auxiliary, to allow it to be combined with
 981 the dNSDomain object class, and thus forming one object for one
 982 computer when storing both DHCP and DNS information in LDAP.</p>
 983
 984 <p>If I understand this correctly, it is not safe to do this change
 985 without also changing the assigned number for the object class, and I
 986 do not know enough about LDAP schema design to do that properly for
 987 Debian Edu.</p>
 988
 989 <p>Anyway, for future reference, this is how I believe we could change
 990 the
 991 <a href="http://tools.ietf.org/html/draft-ietf-dhc-ldap-schema-00">DHCP
 992 schema</a> to solve at least part of the problem with the LDAP schemas
 993 available today from IETF.</p>
 994
 995 <pre>
 996 --- dhcp.schema    (revision 65192)
 997 +++ dhcp.schema    (working copy)
 998 @@ -376,7 +376,7 @@
 999  objectclass ( 2.16.840.1.113719.1.203.6.6
1000         NAME 'dhcpHost'
1001         DESC 'This represents information about a particular client'
1002 -       SUP top
1003 +       SUP top AUXILIARY
1004         MUST cn
1005         MAY  (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
1006         X-NDS_CONTAINMENT ('dhcpService' 'dhcpSubnet' 'dhcpGroup') )
1007 </pre>
1008
1009 <p>I very much welcome clues on how to do this properly for Debian
1010 Edu/Squeeze.  We provide the DHCP schema in our debian-edu-config
1011 package, and should thus be free to rewrite it as we see fit.</p>
1012
1013 <p>If you want to help out with implementing this for Debian Edu,
1014 please contact us on debian-edu@lists.debian.org.</p>
1015 </div>
1016   <div class="tags">
1017
1018
1019
1020    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1021
1022   </div>
1023  </div>
1024  <div class="padding"></div>
1025
1026  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
1027
1028 <div id="sidebar">
1029
1030
1031
1032
1033
1034 <h2>Archive</h2>
1035 <ul>
1036
1037 <li>2010
1038 <ul>
1039
1040 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
1041
1042 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
1043
1044 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1045
1046 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1047
1048 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1049
1050 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1051
1052 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (8)</a></li>
1053
1054 </ul></li>
1055
1056 <li>2009
1057 <ul>
1058
1059 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1060
1061 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1062
1063 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1064
1065 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1066
1067 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1068
1069 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1070
1071 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1072
1073 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1074
1075 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1076
1077 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1078
1079 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1080
1081 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1082
1083 </ul></li>
1084
1085 <li>2008
1086 <ul>
1087
1088 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1089
1090 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1091
1092 </ul></li>
1093
1094 </ul>
1095
1096
1097
1098 <h2>Tags</h2>
1099 <ul>
1100
1101  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
1102
1103  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1104
1105  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1106
1107  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
1108
1109  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (34)</a></li>
1110
1111  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (34)</a></li>
1112
1113  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (48)</a></li>
1114
1115  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
1116
1117  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (7)</a></li>
1118
1119  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (3)</a></li>
1120
1121  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
1122
1123  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
1124
1125  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1126
1127  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
1128
1129  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (70)</a></li>
1130
1131  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (84)</a></li>
1132
1133  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (13)</a></li>
1134
1135  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (13)</a></li>
1136
1137  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
1138
1139  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1140
1141  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (9)</a></li>
1142
1143  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
1144
1145  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
1146
1147  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
1148
1149  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
1150
1151  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
1152
1153  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (7)</a></li>
1154
1155 </ul>
1156
1157 </div>
1158
1159 <p style="text-align: right">
1160 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
1161 </p>
1162 </body>
1163 </html>