1 <?xml version=
"1.0" encoding=
"utf-8"?>
2 <rss version='
2.0' xmlns:lj='http://www.livejournal.org/rss/lj/
1.0/' xmlns:
atom=
"http://www.w3.org/2005/Atom">
4 <title>Petter Reinholdtsen
</title>
5 <description></description>
6 <link>http://people.skolelinux.org/pere/blog/
</link>
7 <atom:link href=
"http://people.skolelinux.org/pere/blog/index.rss" rel=
"self" type=
"application/rss+xml" />
10 <title>OpenStreetmap one step closer to having routing on its front page
</title>
11 <link>http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html
</link>
12 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html
</guid>
13 <pubDate>Sun,
18 Jul
2010 16:
45:
00 +
0200</pubDate>
16 <a href=
"http://feedproxy.google.com/~r/Opengeodata/~
3/wUTCzDZk3lc/project-of-the-week-which-way-home
">todays
17 opengeodata blog entry
</a
>, I just discovered that the
18 OpenStreetmap.org site have gotten
19 <a href=
"http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT
">support
20 for calculating routes
</a
>. The support is still experimental and
21 only available from the development server, until more experience is
22 gathered on the user interface and any scalability issues.
</p
>
24 <p
>Earlier, the routing I knew about using the OpenStreetmap.org data
25 was provided by
<a href=
"http://maps.cloudmade.com/
">Cloudmade
</a
>,
26 but having it on the main page is required to make everyone aware of
27 the issue. I
've had people reject Openstreetmap.org as a viable
28 alternative for them because the front page lacked routing support,
29 and I hope their needs will be catered for when routing show up on the
30 www.openstreetmap.org front page.
</p
>
35 <title>What are they searching for - PowerDNS and ISC DHCP in LDAP
</title>
36 <link>http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html
</link>
37 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html
</guid>
38 <pubDate>Sat,
17 Jul
2010 21:
00:
00 +
0200</pubDate>
41 <a href=
"http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html
">followup
</a
>
43 <a href=
"http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html
">previous
45 <a href=
"http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html
">merging
46 all
</a
> the computer related LDAP objects in Debian Edu.
</p
>
48 <p
>As a step to try to see if it possible to merge the DNS and DHCP
49 LDAP objects, I have had a look at how the packages pdns-backend-ldap
50 and dhcp3-server-ldap in Debian use the LDAP server. The two
51 implementations are quite different in how they use LDAP.
</p
>
53 To get this information, I started slapd with debugging enabled and
54 dumped the debug output to a file to get the LDAP searches performed
55 on a Debian Edu main-server. Here is a summary.
57 <p
><strong
>powerdns
</strong
></p
>
59 <a href=
"http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend
">Clues
60 on how to
</a
> set up PowerDNS to use a LDAP backend is available on
63 <p
>PowerDNS have two modes of operation using LDAP as its backend.
64 One
"strict
" mode where the forward and reverse DNS lookups are done
65 using the same LDAP objects, and a
"tree
" mode where the forward and
66 reverse entries are in two different subtrees in LDAP with a structure
67 based on the DNS names, as in tjener.intern and
68 2.2.0.10.in-addr.arpa.
</p
>
70 <p
>In tree mode, the server is set up to use a LDAP subtree as its
71 base, and uses a
"base
" scoped search for the DNS name by adding
72 "dc=tjener,dc=intern,
" to the base with a filter for
73 "(associateddomain=tjener.intern)
" for the forward entry and
74 "dc=
2,dc=
2,dc=
0,dc=
10,dc=in-addr,dc=arpa,
" with a filter for
75 "(associateddomain=
2.2.0.10.in-addr.arpa)
" for the reverse entry. For
76 forward entries, it is looking for attributes named dnsttl, arecord,
77 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
78 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
79 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
80 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
81 spfrecord and modifytimestamp. For reverse entries it is looking for
82 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
83 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
84 locrecord, srvrecord, naptrrecord and modifytimestamp. The equivalent
85 ldapsearch commands could look like this:
</p
>
87 <blockquote
><pre
>
89 -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
90 -s base -x
'(associateddomain=tjener.intern)
' dNSTTL aRecord nSRecord \
91 cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
92 rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
93 nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
94 rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
97 -b dc=
2,dc=
2,dc=
0,dc=
10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
98 -s base -x
'(associateddomain=
2.2.0.10.in-addr.arpa)
'
99 dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
100 hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
101 srvrecord naptrrecord modifytimestamp
102 </pre
></blockquote
>
104 <p
>In Debian Edu/Lenny, the PowerDNS tree mode is used with
105 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
106 example LDAP objects used there. In addition to these objects, the
107 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
108 also exist.
</p
>
110 <blockquote
><pre
>
111 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
113 objectclass: dnsdomain
114 objectclass: domainrelatedobject
117 associateddomain: tjener.intern
119 dn: dc=
2,dc=
2,dc=
0,dc=
10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
121 objectclass: dnsdomain2
122 objectclass: domainrelatedobject
124 ptrrecord: tjener.intern
125 associateddomain:
2.2.0.10.in-addr.arpa
126 </pre
></blockquote
>
128 <p
>In strict mode, the server behaves differently. When looking for
129 forward DNS entries, it is doing a
"subtree
" scoped search with the
130 same base as in the tree mode for a object with filter
131 "(associateddomain=tjener.intern)
" and requests the attributes dnsttl,
132 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
133 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
134 naptrrecord and modifytimestamp. For reverse entires it also do a
135 subtree scoped search but this time the filter is
"(arecord=
10.0.2.2)
"
136 and the requested attributes are associateddomain, dnsttl and
137 modifytimestamp. In short, in strict mode the objects with ptrrecord
138 go away, and the arecord attribute in the forward object is used
141 <p
>The forward and reverse searches can be simulated using ldapsearch
144 <blockquote
><pre
>
145 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
146 '(associateddomain=tjener.intern)
' dNSTTL aRecord nSRecord \
147 cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
148 rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
149 nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
150 rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
152 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
153 '(arecord=
10.0.2.2)
' associateddomain dnsttl modifytimestamp
154 </pre
></blockquote
>
156 <p
>In addition to the forward and reverse searches , there is also a
157 search for SOA records, which behave similar to the forward and
158 reverse lookups.
</p
>
160 <p
>A thing to note with the PowerDNS behaviour is that it do not
161 specify any objectclass names, and instead look for the attributes it
162 need to generate a DNS reply. This make it able to work with any
163 objectclass that provide the needed attributes.
</p
>
165 <p
>The attributes are normally provided in the cosine (RFC
1274) and
166 dnsdomain2 schemas. The latter is used for reverse entries like
167 ptrrecord and recent DNS additions like aaaarecord and srvrecord.
</p
>
169 <p
>In Debian Edu, we have created DNS objects using the object classes
170 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
171 attributes) and domainrelatedobject (for associatedDomain). The use
172 of structural object classes make it impossible to combine these
173 classes with the object classes used by DHCP.
</p
>
175 <p
>There are other schemas that could be used too, for example the
176 dnszone structural object class used by Gosa and bind-sdb for the DNS
177 attributes combined with the domainrelatedobject object class, but in
178 this case some unused attributes would have to be included as well
179 (zonename and relativedomainname).
</p
>
181 <p
>My proposal for Debian Edu would be to switch PowerDNS to strict
182 mode and not use any of the existing objectclasses (dnsdomain,
183 dnsdomain2 and dnszone) when one want to combine the DNS information
184 with DHCP information, and instead create a auxiliary object class
185 defined something like this (using the attributes defined for
186 dnsdomain and dnsdomain2 or dnszone):
</p
>
188 <blockquote
><pre
>
189 objectclass ( some-oid NAME
'dnsDomainAux
'
192 MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
193 DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
194 TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
195 NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
196 A6Record $ DNAMERecord
198 </pre
></blockquote
>
200 <p
>This will allow any object to become a DNS entry when combined with
201 the domainrelatedobject object class, and allow any entity to include
202 all the attributes PowerDNS wants. I
've sent an email to the PowerDNS
203 developers asking for their view on this schema and if they are
204 interested in providing such schema with PowerDNS, and I hope my
205 message will be accepted into their mailing list soon.
</p
>
207 <p
><strong
>ISC dhcp
</strong
></p
>
209 <p
>The DHCP server searches for specific objectclass and requests all
210 the object attributes, and then uses the attributes it want. This
211 make it harder to figure out exactly what attributes are used, but
212 thanks to the working example in Debian Edu I can at least get an idea
213 what is needed without having to read the source code.
</p
>
215 <p
>In the DHCP server configuration, the LDAP base to use and the
216 search filter to use to locate the correct dhcpServer entity is
217 stored. These are the relevant entries from
218 /etc/dhcp3/dhcpd.conf:
</p
>
220 <blockquote
><pre
>
221 ldap-base-dn
"dc=skole,dc=skolelinux,dc=no
";
222 ldap-dhcp-server-cn
"dhcp
";
223 </pre
></blockquote
>
225 <p
>The DHCP server uses this information to nest all the DHCP
226 configuration it need. The cn
"dhcp
" is located using the given LDAP
227 base and the filter
"(
&(objectClass=dhcpServer)(cn=dhcp))
". The
228 search result is this entry:
</p
>
230 <blockquote
><pre
>
231 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
234 objectClass: dhcpServer
235 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
236 </pre
></blockquote
>
238 <p
>The content of the dhcpServiceDN attribute is next used to locate the
239 subtree with DHCP configuration. The DHCP configuration subtree base
240 is located using a base scope search with base
"cn=DHCP
241 Config,dc=skole,dc=skolelinux,dc=no
" and filter
242 "(
&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))
".
243 The search result is this entry:
</p
>
245 <blockquote
><pre
>
246 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
249 objectClass: dhcpService
250 objectClass: dhcpOptions
251 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
252 dhcpStatements: ddns-update-style none
253 dhcpStatements: authoritative
254 dhcpOption: smtp-server code
69 = array of ip-address
255 dhcpOption: www-server code
72 = array of ip-address
256 dhcpOption: wpad-url code
252 = text
257 </pre
></blockquote
>
259 <p
>Next, the entire subtree is processed, one level at the time. When
260 all the DHCP configuration is loaded, it is ready to receive requests.
261 The subtree in Debian Edu contain objects with object classes
262 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
263 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost. These provide options
264 and information about netmasks, dynamic range etc. Leaving out the
265 details here because it is not relevant for the focus of my
266 investigation, which is to see if it is possible to merge dns and dhcp
267 related computer objects.
</p
>
269 <p
>When a DHCP request come in, LDAP is searched for the MAC address
270 of the client (
00:
00:
00:
00:
00:
00 in this example), using a subtree
271 scoped search with
"cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
" as
272 the base and
"(
&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
273 00:
00:
00:
00:
00:
00))
" as the filter. This is what a host object look
276 <blockquote
><pre
>
277 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
280 objectClass: dhcpHost
281 dhcpHWAddress: ethernet
00:
00:
00:
00:
00:
00
282 dhcpStatements: fixed-address hostname
283 </pre
></blockquote
>
285 <p
>There is less flexiblity in the way LDAP searches are done here.
286 The object classes need to have fixed names, and the configuration
287 need to be stored in a fairly specific LDAP structure. On the
288 positive side, the invidiual dhcpHost entires can be anywhere without
289 the DN pointed to by the dhcpServer entries. The latter should make
290 it possible to group all host entries in a subtree next to the
291 configuration entries, and this subtree can also be shared with the
292 DNS server if the schema proposed above is combined with the dhcpHost
293 structural object class.
295 <p
><strong
>Conclusion
</strong
></p
>
297 <p
>The PowerDNS implementation seem to be very flexible when it come
298 to which LDAP schemas to use. While its
"tree
" mode is rigid when it
299 come to the the LDAP structure, the
"strict
" mode is very flexible,
300 allowing DNS objects to be stored anywhere under the base cn specified
301 in the configuration.
</p
>
303 <p
>The DHCP implementation on the other hand is very inflexible, both
304 regarding which LDAP schemas to use and which LDAP structure to use.
305 I guess one could implement ones own schema, as long as the
306 objectclasses and attributes have the names used, but this do not
307 really help when the DHCP subtree need to have a fairly fixed
310 <p
>Based on the observed behaviour, I suspect a LDAP structure like
311 this might work for Debian Edu:
</p
>
313 <blockquote
><pre
>
315 cn=machine-info (dhcpService) - dhcpServiceDN points here
317 cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
318 cn=
10.0.2.0 (dhcpSubnet)
319 cn=group1 (dhcpGroup/dhcpOptions)
320 cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
321 cn=
192.168.0.0 (dhcpSubnet)
322 cn=group1 (dhcpGroup/dhcpOptions)
323 ou=machines - PowerDNS base points here
324 cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
325 </pre
></blockquote
>
327 <P
>This is not tested yet. If the DHCP server require the dhcpHost
328 entries to be in the dhcpGroup subtrees, the entries can be stored
329 there instead of a common machines subtree, and the PowerDNS base
330 would have to be moved one level up to the machine-info subtree.
</p
>
332 <p
>The combined object under the machines subtree would look something
335 <blockquote
><pre
>
336 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
339 objectClass: dhcpHost
340 objectclass: domainrelatedobject
341 objectclass: dnsDomainAux
342 associateddomain: hostname.intern
344 dhcpHWAddress: ethernet
00:
00:
00:
00:
00:
00
345 dhcpStatements: fixed-address hostname.intern
346 </pre
></blockquote
>
348 </p
>One could even add the LTSP configuration associated with a given
349 machine, as long as the required attributes are available in a
350 auxiliary object class.
</p
>
355 <title>Combining PowerDNS and ISC DHCP LDAP objects
</title>
356 <link>http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html
</link>
357 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html
</guid>
358 <pubDate>Wed,
14 Jul
2010 23:
45:
00 +
0200</pubDate>
360 <p
>For a while now, I have wanted to find a way to change the DNS and
361 DHCP services in Debian Edu to use the same LDAP objects for a given
362 computer, to avoid the possibility of having a inconsistent state for
363 a computer in LDAP (as in DHCP but no DNS entry or the other way
364 around) and make it easier to add computers to LDAP.
</p
>
366 <p
>I
've looked at how powerdns and dhcpd is using LDAP, and using this
367 information finally found a solution that seem to work.
</p
>
369 <p
>The old setup required three LDAP objects for a given computer.
370 One forward DNS entry, one reverse DNS entry and one DHCP entry. If
371 we switch powerdns to use its strict LDAP method (ldap-method=strict
372 in pdns-debian-edu.conf), the forward and reverse DNS entries are
373 merged into one while making it impossible to transfer the reverse map
374 to a slave DNS server.
</p
>
376 <p
>If we also replace the object class used to get the DNS related
377 attributes to one allowing these attributes to be combined with the
378 dhcphost object class, we can merge the DNS and DHCP entries into one.
379 I
've written such object class in the dnsdomainaux.schema file (need
380 proper OIDs, but that is a minor issue), and tested the setup. It
381 seem to work.
</p
>
383 <p
>With this test setup in place, we can get away with one LDAP object
384 for both DNS and DHCP, and even the LTSP configuration I suggested in
385 an earlier email. The combined LDAP object will look something like
388 <blockquote
><pre
>
389 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
391 objectClass: dhcphost
392 objectclass: domainrelatedobject
393 objectclass: dnsdomainaux
394 associateddomain: hostname.intern
396 dhcphwaddress: ethernet
00:
00:
00:
00:
00:
00
397 dhcpstatements: fixed-address hostname
399 </pre
></blockquote
>
401 <p
>The DNS server uses the associateddomain and arecord entries, while
402 the DHCP server uses the dhcphwaddress and dhcpstatements entries
403 before asking DNS to resolve the fixed-adddress. LTSP will use
404 dhcphwaddress or associateddomain and the ldapconfig* attributes.
</p
>
406 <p
>I am not yet sure if I can get the DHCP server to look for its
407 dhcphost in a different location, to allow us to put the objects
408 outside the
"DHCP Config
" subtree, but hope to figure out a way to do
409 that. If I can
't figure out a way to do that, we can still get rid of
410 the hosts subtree and move all its content into the DHCP Config tree
411 (which probably should be renamed to be more related to the new
412 content. I suspect cn=dnsdhcp,ou=services or something like that
413 might be a good place to put it.
</p
>
415 <p
>If you want to help out with implementing this for Debian Edu,
416 please contact us on debian-edu@lists.debian.org.
</p
>
421 <title>Idea for storing LTSP configuration in LDAP
</title>
422 <link>http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html
</link>
423 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html
</guid>
424 <pubDate>Sun,
11 Jul
2010 22:
00:
00 +
0200</pubDate>
426 <p
>Vagrant mentioned on IRC today that ltsp_config now support
427 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
428 clients, and that this can be used to fetch configuration from LDAP if
429 Debian Edu choose to store configuration there.
</p
>
431 <p
>Armed with this information, I got inspired and wrote a test module
432 to get configuration from LDAP. The idea is to look up the MAC
433 address of the client in LDAP, and look for attributes on the form
434 ltspconfigsetting=value, and use this to export SETTING=value to the
435 LTSP clients.
</p
>
437 <p
>The goal is to be able to store the LTSP configuration attributes
438 in a
"computer
" LDAP object used by both DNS and DHCP, and thus
439 allowing us to store all information about a computer in one place.
</p
>
441 <p
>This is a untested draft implementation, and I welcome feedback on
442 this approach. A real LDAP schema for the ltspClientAux objectclass
443 need to be written. Comments, suggestions, etc?
</p
>
445 <blockquote
><pre
>
446 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
448 # Fetch LTSP client settings from LDAP based on MAC address
450 # Uses ethernet address as stored in the dhcpHost objectclass using
451 # the dhcpHWAddress attribute or ethernet address stored in the
452 # ieee802Device objectclass with the macAddress attribute.
454 # This module is written to be schema agnostic, and only depend on the
455 # existence of attribute names.
457 # The LTSP configuration variables are saved directly using a
458 # ltspConfig prefix and uppercasing the rest of the attribute name.
459 # To set the SERVER variable, set the ltspConfigServer attribute.
461 # Some LDAP schema should be created with all the relevant
462 # configuration settings. Something like this should work:
464 # objectclass (
1.1.2.2 NAME
'ltspClientAux
'
467 # MAY ( ltspConfigServer $ ltsConfigSound $ ... )
469 LDAPSERVER=$(debian-edu-ldapserver)
470 if [
"$LDAPSERVER
" ] ; then
471 LDAPBASE=$(debian-edu-ldapserver -b)
472 for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk
'{print $
5}
'|sort -u) ; do
473 filter=
"(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))
"
474 ldapsearch -h
"$LDAPSERVER
" -b
"$LDAPBASE
" -v -x
"$filter
" | \
475 grep
'^ltspConfig
' | while read attr value ; do
476 # Remove prefix and convert to upper case
477 attr=$(echo $attr | sed
's/^ltspConfig//i
' | tr a-z A-Z)
478 # bass value on to clients
479 eval
"$attr=$value; export $attr
"
483 </pre
></blockquote
>
485 <p
>I
'm not sure this shell construction will work, because I suspect
486 the while block might end up in a subshell causing the variables set
487 there to not show up in ltsp-config, but if that is the case I am sure
488 the code can be restructured to make sure the variables are passed on.
489 I expect that can be solved with some testing. :)
</p
>
491 <p
>If you want to help out with implementing this for Debian Edu,
492 please contact us on debian-edu@lists.debian.org.
</p
>
494 <p
>Update
2010-
07-
17: I am aware of another effort to store LTSP
495 configuration in LDAP that was created around year
2000 by
496 <a href=
"http://www.pcxperience.com/thinclient/documentation/ldap.html
">PC
497 Xperience, Inc.,
2000</a
>. I found its
498 <a href=
"http://people.redhat.com/alikins/ltsp/ldap/
">files
</a
> on a
499 personal home page over at redhat.com.
</p
>
504 <title>jXplorer, a very nice LDAP GUI
</title>
505 <link>http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html
</link>
506 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html
</guid>
507 <pubDate>Fri,
9 Jul
2010 12:
55:
00 +
0200</pubDate>
510 <a href=
"http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html
">my
511 last post
</a
> about available LDAP tools in Debian, I was told about a
512 LDAP GUI that is even better than luma. The java application
513 <a href=
"http://jxplorer.org/
">jXplorer
</a
> is claimed to be capable of
514 moving LDAP objects and subtrees using drag-and-drop, and can
515 authenticate using Kerberos. I have only tested the Kerberos
516 authentication, but do not have a LDAP setup allowing me to rewrite
517 LDAP with my test user yet. It is
518 <a href=
"http://packages.qa.debian.org/j/jxplorer.html
">available in
519 Debian
</a
> testing and unstable at the moment. The only problem I
520 have with it is how it handle errors. If something go wrong, its
521 non-intuitive behaviour require me to go through some query work list
522 and remove the failing query. Nothing big, but very annoying.
</p
>
527 <title>MS Word krøller det til for politiet?
</title>
528 <link>http://people.skolelinux.org/pere/blog/MS_Word_kr__ller_det_til_for_politiet_.html
</link>
529 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/MS_Word_kr__ller_det_til_for_politiet_.html
</guid>
530 <pubDate>Thu,
8 Jul
2010 14:
00:
00 +
0200</pubDate>
532 <p
>De siste dagene har Aftenposten
533 <a href=
"http://www.aftenposten.no/nyheter/iriks/article3718597.ece
">fortalt
</a
>
534 <a href=
"http://www.aftenposten.no/nyheter/iriks/article3724249.ece
">hvordan
</a
>
535 politet har brukt skriveverktøy som ikke håndterer arabisk tekst og
536 tekst som skal skrives fra høyre mot venstre når de har laget
537 løpeseddel for å be om informasjon fra publikum. Resultatet har vært
538 en uleselig arabisk-bit på løpeseddelen. Feilen har oppstått når
539 teksten har blitt
"kopiert inn i programvare som ikke har støtte for
540 språk som skrives fra høyre mot venstre
", og jeg er ganske sikker på
541 at det er snakk om Microsoft Office i dette tilfellet. Er det slik at
542 MS Office i norsk språkdrakt ikke har støtte for tekst som skal
543 skrives fra høyre mot venstre? Jeg tror alle utgaver av
544 OpenOffice.org har slik støtte, og det er jo ikke veldig vanskelig å
545 la slik støtte finnes i alle utgaver av et program hvis støtten først
546 er utviklet. Aftenpostens melding får meg til å undre om problemet
547 ville vært unngått hvis politiet brukte OpenOffice.org i stedet for MS
550 <p
>Mon tro om det er flere eksempler på at MS Office har ødelagt for
551 offentlig myndighet?
</p
>
556 <title>Lenny-
>Squeeze upgrades, apt vs aptitude with the Gnome desktop
</title>
557 <link>http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html
</link>
558 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html
</guid>
559 <pubDate>Sat,
3 Jul
2010 23:
55:
00 +
0200</pubDate>
561 <p
>Here is a short update on my
<a
562 href=
"http://people.skolelinux.org/~pere/debian-upgrade-testing/
">my
563 Debian Lenny-
>Squeeze upgrade testing
</a
>. Here is a summary of the
564 difference for Gnome when it is upgraded by apt-get and aptitude. I
'm
565 not reporting the status for KDE, because the upgrade crashes when
566 aptitude try because of missing conflicts
567 (
<a href=
"http://bugs.debian.org/
584861">#
584861</a
> and
568 <a href=
"http://bugs.debian.org/
585716">#
585716</a
>).
</p
>
570 <p
>At the end of the upgrade test script, dpkg -l is executed to get a
571 complete list of the installed packages. Based on this I see these
572 differences when I did a test run today. As usual, I do not really
573 know what the correct set of packages would be, but thought it best to
574 publish the difference.
</p
>
576 <p
>Installed using apt-get, missing with aptitude
</p
>
578 <blockquote
><p
>
579 at-spi cpp-
4.3 finger gnome-spell gstreamer0.10-gnomevfs
580 libatspi1.0-
0 libcupsys2 libeel2-data libgail-common libgdl-
1-common
581 libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin
582 libgtksourceview-common libpt-
1.10.10-plugins-alsa
583 libpt-
1.10.10-plugins-v4l libservlet2.4-java libxalan2-java
584 libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip
585 python-
4suite-xml python-eggtrayicon python-gtkhtml2
586 python-gtkmozembed svgalibg1 xserver-xephyr zip
587 </p
></blockquote
>
589 <p
>Installed using apt-get, removed with aptitude
</p
>
591 <blockquote
><p
>
592 bluez-utils dhcdbd djvulibre-desktop epiphany-gecko
593 gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager
594 libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-
50
595 libbluetooth2 libcamel1.2-
11 libcdio7 libcucul0 libcurl3
596 libdirectfb-
1.0-
0 libdvdread3 libedata-cal1.2-
6 libedataserver1.2-
9
597 libeel2-
2.20 libepc-
1.0-
1 libepc-ui-
1.0-
1 libexchange-storage1.2-
3
598 libfaad0 libgd2-noxpm libgda3-
3 libgda3-common libggz2 libggzcore9
599 libggzmod4 libgksu1.2-
0 libgksuui1.0-
1 libgmyth0 libgnome-desktop-
2
600 libgnome-pilot2 libgnomecups1.0-
1 libgnomeprint2.2-
0
601 libgnomeprintui2.2-
0 libgpod3 libgraphviz4 libgtkhtml2-
0
602 libgtksourceview1.0-
0 libgucharmap6 libhesiod0 libicu38 libisccc50
603 libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++
10
604 libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4
605 libneon27 libnm-glib0 libnm-util0 libopal-
2.2 libosp5
606 libparted1.8-
10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3
607 libpt-
1.10.10 libraw1394-
8 libsensors3 libsmbios2 libsoup2.2-
8
608 libssh2-
1 libsuitesparse-
3.1.0 libswfdec-
0.6-
90 libtalloc1
609 libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj
610 libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3
611 mysql-common swfdec-gnome totem-gstreamer wodim
612 </p
></blockquote
>
614 <p
>Installed using aptitude, missing with apt-get
</p
>
616 <blockquote
><p
>
617 gnome gnome-desktop-environment hamster-applet python-gnomeapplet
618 python-gnomekeyring python-wnck rhythmbox-plugins xorg
619 xserver-xorg-input-all xserver-xorg-input-evdev
620 xserver-xorg-input-kbd xserver-xorg-input-mouse
621 xserver-xorg-input-synaptics xserver-xorg-video-all
622 xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati
623 xserver-xorg-video-chips xserver-xorg-video-cirrus
624 xserver-xorg-video-dummy xserver-xorg-video-fbdev
625 xserver-xorg-video-glint xserver-xorg-video-i128
626 xserver-xorg-video-i740 xserver-xorg-video-mach64
627 xserver-xorg-video-mga xserver-xorg-video-neomagic
628 xserver-xorg-video-nouveau xserver-xorg-video-nv
629 xserver-xorg-video-r128 xserver-xorg-video-radeon
630 xserver-xorg-video-radeonhd xserver-xorg-video-rendition
631 xserver-xorg-video-s3 xserver-xorg-video-s3virge
632 xserver-xorg-video-savage xserver-xorg-video-siliconmotion
633 xserver-xorg-video-sis xserver-xorg-video-sisusb
634 xserver-xorg-video-tdfx xserver-xorg-video-tga
635 xserver-xorg-video-trident xserver-xorg-video-tseng
636 xserver-xorg-video-vesa xserver-xorg-video-vmware
637 xserver-xorg-video-voodoo
638 </p
></blockquote
>
640 <p
>Installed using aptitude, removed with apt-get
</p
>
642 <blockquote
><p
>
643 deskbar-applet xserver-xorg xserver-xorg-core
644 xserver-xorg-input-wacom xserver-xorg-video-intel
645 xserver-xorg-video-openchrome
646 </p
></blockquote
>
648 <p
>I was told on IRC that the xorg-xserver package was
649 <a href=
"http://git.debian.org/?p=pkg-xorg/xserver/xorg-server.git;a=commit;h=
9c8080d06c457932d3bfec021c69ac000aa60120
">changed
650 in git
</a
> today to try to get apt-get to not remove xorg completely.
651 No idea when it hits Squeeze, but when it does I hope it will reduce
652 the difference somewhat.
657 <title>Caching password, user and group on a roaming Debian laptop
</title>
658 <link>http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html
</link>
659 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html
</guid>
660 <pubDate>Thu,
1 Jul
2010 11:
40:
00 +
0200</pubDate>
662 <p
>For a laptop, centralized user directories and password checking is
663 a bit troubling. Laptops are typically used also when not connected
664 to the network, and it is vital for a user to be able to log in or
665 unlock the screen saver also when a central server is unavailable.
666 This is possible by caching passwords and directory information (user
667 and group attributes) locally, and the packages to do so are available
668 in Debian. Here follow two recipes to set this up in Debian/Squeeze.
669 It is also possible to set up in Debian/Lenny, but require more manual
670 setup there because pam-auth-update is missing in Lenny.
</p
>
672 <h2
>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir
</h2
>
674 This is the traditional method with a twist. The password caching is
675 provided by libpam-ccreds (version
10-
4 or later is needed on
676 Squeeze), and the directory caching is done by nscd. The directory
677 lookup and password checking is done using LDAP. If one want to use
678 Kerberos for password checking the libpam-ldapd package can be
679 replaced with libpam-krb5 or libpam-heimdal. If one is happy having a
680 local home directory with the path listed in LDAP, one can use the
681 pam_mkhomedir module from pam-modules to make this happen instead of
682 using libpam-mklocaluser. A setup for pam-auth-update to enable
683 pam_mkhomedir will have to be written until a fix for
684 <a href=
"http://bugs.debian.org/
568577">bug #
568577</a
> is in the
685 archive. Because I believe it is a bad idea to have local home
686 directories using misleading paths like /site/server/partition/, I
687 prefer to create a local user with the home directory in /home/. This
688 is done using the libpam-mklocaluser package.
</p
>
690 <p
>These packages need to be installed and configured
</p
>
692 <blockquote
><pre
>
693 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
694 </pre
></blockquote
>
696 <p
>The ldapd packages will ask for LDAP connection information, and
697 one have to fill in the values that fits ones own site. Make sure the
698 PAM part uses encrypted connections, to make sure the password is not
699 sent in clear text to the LDAP server. I
've been unable to get TLS
700 certificate checking for a self signed certificate working, which make
701 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
702 is talking to the correct LDAP server), and very much welcome feedback
703 on how to get this working.
</p
>
705 <p
>Because nscd do not have a default configuration fit for offline
706 caching until
<a href=
"http://bugs.debian.org/
485282">bug #
485282</a
>
707 is fixed, this configuration should be used instead of the one
708 currently in /etc/nscd.conf. The changes are in the fields
709 reload-count and positive-time-to-live, and is based on the
710 instructions I found in the
711 <a href=
"http://www.flyn.org/laptopldap/
">LDAP for Mobile Laptops
</a
>
712 instructions by Flyn Computing.
</p
>
714 <blockquote
><pre
>
716 reload-count unlimited
719 enable-cache passwd yes
720 positive-time-to-live passwd
2592000
721 negative-time-to-live passwd
20
722 suggested-size passwd
211
723 check-files passwd yes
724 persistent passwd yes
726 max-db-size passwd
33554432
727 auto-propagate passwd yes
729 enable-cache group yes
730 positive-time-to-live group
2592000
731 negative-time-to-live group
20
732 suggested-size group
211
733 check-files group yes
736 max-db-size group
33554432
737 auto-propagate group yes
739 enable-cache hosts no
740 positive-time-to-live hosts
2592000
741 negative-time-to-live hosts
20
742 suggested-size hosts
211
743 check-files hosts yes
746 max-db-size hosts
33554432
748 enable-cache services yes
749 positive-time-to-live services
2592000
750 negative-time-to-live services
20
751 suggested-size services
211
752 check-files services yes
753 persistent services yes
755 max-db-size services
33554432
756 </pre
></blockquote
>
758 <p
>While we wait for a mechanism to update /etc/nsswitch.conf
759 automatically like the one provided in
760 <a href=
"http://bugs.debian.org/
496915">bug #
496915</a
>, the file
761 content need to be manually replaced to ensure LDAP is used as the
762 directory service on the machine. /etc/nsswitch.conf should normally
763 look like this:
</p
>
765 <blockquote
><pre
>
769 hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
776 </pre
></blockquote
>
778 <p
>The important parts are that ldap is listed last for passwd, group,
779 shadow and netgroup.
</p
>
781 <p
>With these changes in place, any user in LDAP will be able to log
782 in locally on the machine using for example kdm, get a local home
783 directory created and have the password as well as user and group
786 <h2
>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
787 libpam-mklocaluser/pam_mkhomedir
</h2
>
789 <p
>Because nscd have had its share of problems, and seem to have
790 problems doing proper caching, I
've seen suggestions and recipes to
791 use nss-updatedb to copy parts of the LDAP database locally when the
792 LDAP database is available. I have not tested such setup, because I
793 discovered sssd.
</p
>
795 <h2
>LDAP/Kerberos + sssd + libpam-mklocaluser
</h2
>
797 <p
>A more flexible and robust setup than the nscd combination
798 mentioned earlier that has shown up recently, is the
799 <a href=
"https://fedorahosted.org/sssd/
">sssd
</a
> package from Redhat.
800 It is part of the
<a href=
"http://www.freeipa.org/
">FreeIPA
</A
> project
801 to provide a Active Directory like directory service for Linux
802 machines. The sssd system combines the caching of passwords and user
803 information into one package, and remove the need for nscd and
804 libpam-ccreds. It support LDAP and Kerberos, but not NIS. Version
805 1.2 do not support netgroups, but it is said that it will support this
806 in version
1.5 expected to show up later in
2010. Because the
807 <a href=
"http://packages.qa.debian.org/s/sssd.html
">sssd package
</a
>
808 was missing in Debian, I ended up co-maintaining it with Werner, and
809 version
1.2 is now in testing.
811 <p
>These packages need to be installed and configured to get the
812 roaming setup I want
</p
>
814 <blockquote
><pre
>
815 libpam-sss libnss-sss libpam-mklocaluser
816 </pre
></blockquote
>
818 The complete setup of sssd is done by editing/creating
819 <tt
>/etc/sssd/sssd.conf
</tt
>.
821 <blockquote
><pre
>
823 config_file_version =
2
824 reconnection_retries =
3
832 reconnection_retries =
3
835 reconnection_retries =
3
839 cache_credentials = true
843 chpass_provider = ldap
845 ldap_uri = ldap://ldap
846 ldap_search_base = dc=skole,dc=skolelinux,dc=no
847 ldap_tls_reqcert = never
848 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
849 </pre
></blockquote
>
851 <p
>I got the same problem here with certificate checking. Had to set
852 "ldap_tls_reqcert = never
" to get it working.
</p
>
854 <p
>With the libnss-sss package in testing at the moment, the
855 nsswitch.conf file is update automatically, so there is no need to
856 modify it manually.
</p
>
858 <p
>If you want to help out with implementing this for Debian Edu,
859 please contact us on debian-edu@lists.debian.org.
</p
>
864 <title>LUMA, a very nice LDAP GUI
</title>
865 <link>http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html
</link>
866 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html
</guid>
867 <pubDate>Mon,
28 Jun
2010 00:
30:
00 +
0200</pubDate>
869 <p
>The last few days I have been looking into the status of the LDAP
870 directory in Debian Edu, and in the process I started to miss a GUI
871 tool to browse the LDAP tree. The only one I was able to find in
872 Debian/Squeeze and Lenny is
873 <a href=
"http://luma.sourceforge.net/
">LUMA
</a
>, which has proved to
874 be a great tool to get a overview of the current LDAP directory
875 populated by default in Skolelinux. Thanks to it, I have been able to
876 find empty and obsolete subtrees, misplaced objects and duplicate
877 objects. It will be installed by default in Debian/Squeeze. If you
878 are working with LDAP, give it a go. :)
</p
>
880 <p
>I did notice one problem with it I have not had time to report to
881 the BTS yet. There is no .desktop file in the package, so the tool do
882 not show up in the Gnome and KDE menus, but only deep down in in the
883 Debian submenu in KDE. I hope that can be fixed before Squeeze is
886 <p
>I have not yet been able to get it to modify the tree yet. I would
887 like to move objects and remove subtrees directly in the GUI, but have
888 not found a way to do that with LUMA yet. So in the mean time, I use
889 <a href=
"http://www.lichteblau.com/ldapvi/
">ldapvi
</a
> for that.
</p
>
891 <p
>If you have tips on other GUI tools for LDAP that might be useful
892 in Debian Edu, please contact us on debian-edu@lists.debian.org.
</p
>
894 <p
>Update
2010-
06-
29: Ross Reedstrom tipped us about the
895 <a href=
"http://packages.qa.debian.org/g/gq.html
">gq
</a
> package as a
896 useful GUI alternative. It seem like a good tool, but is unmaintained
897 in Debian and got a RC bug keeping it out of Squeeze. Unless that
898 changes, it will not be an option for Debian Edu based on Squeeze.
</p
>
903 <title>Idea for a change to LDAP schemas allowing DNS and DHCP info to be combined into one object
</title>
904 <link>http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html
</link>
905 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html
</guid>
906 <pubDate>Thu,
24 Jun
2010 00:
35:
00 +
0200</pubDate>
908 <p
>A while back, I
909 <a href=
"http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html
">complained
910 about the fact
</a
> that it is not possible with the provided schemas
911 for storing DNS and DHCP information in LDAP to combine the two sets
912 of information into one LDAP object representing a computer.
</p
>
914 <p
>In the mean time, I discovered that a simple fix would be to make
915 the dhcpHost object class auxiliary, to allow it to be combined with
916 the dNSDomain object class, and thus forming one object for one
917 computer when storing both DHCP and DNS information in LDAP.
</p
>
919 <p
>If I understand this correctly, it is not safe to do this change
920 without also changing the assigned number for the object class, and I
921 do not know enough about LDAP schema design to do that properly for
922 Debian Edu.
</p
>
924 <p
>Anyway, for future reference, this is how I believe we could change
926 <a href=
"http://tools.ietf.org/html/draft-ietf-dhc-ldap-schema-
00">DHCP
927 schema
</a
> to solve at least part of the problem with the LDAP schemas
928 available today from IETF.
</p
>
931 --- dhcp.schema (revision
65192)
932 +++ dhcp.schema (working copy)
934 objectclass (
2.16.840.1.113719.1.203.6.6
935 NAME
'dhcpHost
'
936 DESC
'This represents information about a particular client
'
940 MAY (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
941 X-NDS_CONTAINMENT (
'dhcpService
' 'dhcpSubnet
' 'dhcpGroup
') )
944 <p
>I very much welcome clues on how to do this properly for Debian
945 Edu/Squeeze. We provide the DHCP schema in our debian-edu-config
946 package, and should thus be free to rewrite it as we see fit.
</p
>
948 <p
>If you want to help out with implementing this for Debian Edu,
949 please contact us on debian-edu@lists.debian.org.
</p
>
projects / homepage.git / blob