blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a></div>
  24   <div class="date">2010-07-11 22:00</div>
  25   <div class="body">
  26 <p>Vagrant mentioned on IRC today that ltsp_config now support
  27 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
  28 clients, and that this can be used to fetch configuration from LDAP if
  29 Debian Edu choose to store configuration there.</p>
  30
  31 <p>Armed with this information, I got inspired and wrote a test module
  32 to get configuration from LDAP.  The idea is to look up the MAC
  33 address of the client in LDAP, and look for attributes on the form
  34 ltspconfigsetting=value, and use this to export SETTING=value to the
  35 LTSP clients.</p>
  36
  37 <p>The goal is to be able to store the LTSP configuration attributes
  38 in a "computer" LDAP object used by both DNS and DHCP, and thus
  39 allowing us to store all information about a computer in one place.</p>
  40
  41 <p>This is a untested draft implementation, and I welcome feedback on
  42 this approach.  A real LDAP schema for the ltspClientAux objectclass
  43 need to be written.  Comments, suggestions, etc?</p>
  44
  45 <blockquote><pre>
  46 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
  47 #
  48 # Fetch LTSP client settings from LDAP based on MAC address
  49 #
  50 # Uses ethernet address as stored in the dhcpHost objectclass using
  51 # the dhcpHWAddress attribute or ethernet address stored in the
  52 # ieee802Device objectclass with the macAddress attribute.
  53 #
  54 # This module is written to be schema agnostic, and only depend on the
  55 # existence of attribute names.
  56 #
  57 # The LTSP configuration variables are saved directly using a
  58 # ltspConfig prefix and uppercasing the rest of the attribute name.
  59 # To set the SERVER variable, set the ltspConfigServer attribute.
  60 #
  61 # Some LDAP schema should be created with all the relevant
  62 # configuration settings.  Something like this should work:
  63 #
  64 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
  65 #     SUP top
  66 #     AUXILIARY
  67 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
  68
  69 LDAPSERVER=$(debian-edu-ldapserver)
  70 if [ "$LDAPSERVER" ] ; then
  71     LDAPBASE=$(debian-edu-ldapserver -b)
  72     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
  73         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
  74         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
  75             grep '^ltspConfig' | while read attr value ; do
  76             # Remove prefix and convert to upper case
  77             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
  78             # bass value on to clients
  79             eval "$attr=$value; export $attr"
  80         done
  81     done
  82 fi
  83 </pre></blockquote>
  84
  85 <p>I'm not sure this shell construction will work, because I suspect
  86 the while block might end up in a subshell causing the variables set
  87 there to not show up in ltsp-config, but if that is the case I am sure
  88 the code can be restructured to make sure the variables are passed on.
  89 I expect that can be solved with some testing. :)</p>
  90
  91 <p>If you want to help out with implementing this for Debian Edu,
  92 please contact us on debian-edu@lists.debian.org.</p>
  93 </div>
  94   <div class="tags">
  95
  96
  97
  98    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
  99
 100   </div>
 101  </div>
 102  <div class="padding"></div>
 103
 104  <div class="entry">
 105   <div class="title"><a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a></div>
 106   <div class="date">2010-07-09 12:55</div>
 107   <div class="body">
 108 <p>Since
 109 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
 110 last post</a> about available LDAP tools in Debian, I was told about a
 111 LDAP GUI that is even better than luma.  The java application
 112 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
 113 moving LDAP objects and subtrees using drag-and-drop, and can
 114 authenticate using Kerberos.  I have only tested the Kerberos
 115 authentication, but do not have a LDAP setup allowing me to rewrite
 116 LDAP with my test user yet.  It is
 117 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
 118 Debian</a> testing and unstable at the moment.  The only problem I
 119 have with it is how it handle errors.  If something go wrong, its
 120 non-intuitive behaviour require me to go through some query work list
 121 and remove the failing query.  Nothing big, but very annoying.</p>
 122 </div>
 123   <div class="tags">
 124
 125
 126
 127    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 128
 129   </div>
 130  </div>
 131  <div class="padding"></div>
 132
 133  <div class="entry">
 134   <div class="title"><a href="http://people.skolelinux.org/pere/blog/MS_Word_kr__ller_det_til_for_politiet_.html">MS Word krøller det til for politiet?</a></div>
 135   <div class="date">2010-07-08 14:00</div>
 136   <div class="body">
 137 <p>De siste dagene har Aftenposten
 138 <a href="http://www.aftenposten.no/nyheter/iriks/article3718597.ece">fortalt</a>
 139 <a href="http://www.aftenposten.no/nyheter/iriks/article3724249.ece">hvordan</a>
 140 politet har brukt skriveverktøy som ikke håndterer arabisk tekst og
 141 tekst som skal skrives fra høyre mot venstre når de har laget
 142 løpeseddel for å be om informasjon fra publikum.  Resultatet har vært
 143 en uleselig arabisk-bit på løpeseddelen.  Feilen har oppstått når
 144 teksten har blitt "kopiert inn i programvare som ikke har støtte for
 145 språk som skrives fra høyre mot venstre", og jeg er ganske sikker på
 146 at det er snakk om Microsoft Office i dette tilfellet.  Er det slik at
 147 MS Office i norsk språkdrakt ikke har støtte for tekst som skal
 148 skrives fra høyre mot venstre?  Jeg tror alle utgaver av
 149 OpenOffice.org har slik støtte, og det er jo ikke veldig vanskelig å
 150 la slik støtte finnes i alle utgaver av et program hvis støtten først
 151 er utviklet.  Aftenpostens melding får meg til å undre om problemet
 152 ville vært unngått hvis politiet brukte OpenOffice.org i stedet for MS
 153 Office.</p>
 154
 155 <p>Mon tro om det er flere eksempler på at MS Office har ødelagt for
 156 offentlig myndighet?</p>
 157 </div>
 158   <div class="tags">
 159
 160
 161
 162    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>.
 163
 164   </div>
 165  </div>
 166  <div class="padding"></div>
 167
 168  <div class="entry">
 169   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html">Lenny->Squeeze upgrades, apt vs aptitude with the Gnome desktop</a></div>
 170   <div class="date">2010-07-03 23:55</div>
 171   <div class="body">
 172 <p>Here is a short update on my <a
 173 href="http://people.skolelinux.org/~pere/debian-upgrade-testing/">my
 174 Debian Lenny->Squeeze upgrade testing</a>.  Here is a summary of the
 175 difference for Gnome when it is upgraded by apt-get and aptitude.  I'm
 176 not reporting the status for KDE, because the upgrade crashes when
 177 aptitude try because of missing conflicts
 178 (<a href="http://bugs.debian.org/584861">#584861</a> and
 179 <a href="http://bugs.debian.org/585716">#585716</a>).</p>
 180
 181 <p>At the end of the upgrade test script, dpkg -l is executed to get a
 182 complete list of the installed packages.  Based on this I see these
 183 differences when I did a test run today.  As usual, I do not really
 184 know what the correct set of packages would be, but thought it best to
 185 publish the difference.</p>
 186
 187 <p>Installed using apt-get, missing with aptitude</p>
 188
 189 <blockquote><p>
 190   at-spi cpp-4.3 finger gnome-spell gstreamer0.10-gnomevfs
 191   libatspi1.0-0 libcupsys2 libeel2-data libgail-common libgdl-1-common
 192   libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin
 193   libgtksourceview-common libpt-1.10.10-plugins-alsa
 194   libpt-1.10.10-plugins-v4l libservlet2.4-java libxalan2-java
 195   libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip
 196   python-4suite-xml python-eggtrayicon python-gtkhtml2
 197   python-gtkmozembed svgalibg1 xserver-xephyr zip
 198 </p></blockquote>
 199
 200 <p>Installed using apt-get, removed with aptitude</p>
 201
 202 <blockquote><p>
 203   bluez-utils dhcdbd djvulibre-desktop epiphany-gecko
 204   gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager
 205   libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-50
 206   libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcurl3
 207   libdirectfb-1.0-0 libdvdread3 libedata-cal1.2-6 libedataserver1.2-9
 208   libeel2-2.20 libepc-1.0-1 libepc-ui-1.0-1 libexchange-storage1.2-3
 209   libfaad0 libgd2-noxpm libgda3-3 libgda3-common libggz2 libggzcore9
 210   libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnome-desktop-2
 211   libgnome-pilot2 libgnomecups1.0-1 libgnomeprint2.2-0
 212   libgnomeprintui2.2-0 libgpod3 libgraphviz4 libgtkhtml2-0
 213   libgtksourceview1.0-0 libgucharmap6 libhesiod0 libicu38 libisccc50
 214   libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++10
 215   libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4
 216   libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5
 217   libparted1.8-10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3
 218   libpt-1.10.10 libraw1394-8 libsensors3 libsmbios2 libsoup2.2-8
 219   libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1
 220   libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj
 221   libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3
 222   mysql-common swfdec-gnome totem-gstreamer wodim
 223 </p></blockquote>
 224
 225 <p>Installed using aptitude, missing with apt-get</p>
 226
 227 <blockquote><p>
 228   gnome gnome-desktop-environment hamster-applet python-gnomeapplet
 229   python-gnomekeyring python-wnck rhythmbox-plugins xorg
 230   xserver-xorg-input-all xserver-xorg-input-evdev
 231   xserver-xorg-input-kbd xserver-xorg-input-mouse
 232   xserver-xorg-input-synaptics xserver-xorg-video-all
 233   xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati
 234   xserver-xorg-video-chips xserver-xorg-video-cirrus
 235   xserver-xorg-video-dummy xserver-xorg-video-fbdev
 236   xserver-xorg-video-glint xserver-xorg-video-i128
 237   xserver-xorg-video-i740 xserver-xorg-video-mach64
 238   xserver-xorg-video-mga xserver-xorg-video-neomagic
 239   xserver-xorg-video-nouveau xserver-xorg-video-nv
 240   xserver-xorg-video-r128 xserver-xorg-video-radeon
 241   xserver-xorg-video-radeonhd xserver-xorg-video-rendition
 242   xserver-xorg-video-s3 xserver-xorg-video-s3virge
 243   xserver-xorg-video-savage xserver-xorg-video-siliconmotion
 244   xserver-xorg-video-sis xserver-xorg-video-sisusb
 245   xserver-xorg-video-tdfx xserver-xorg-video-tga
 246   xserver-xorg-video-trident xserver-xorg-video-tseng
 247   xserver-xorg-video-vesa xserver-xorg-video-vmware
 248   xserver-xorg-video-voodoo
 249 </p></blockquote>
 250
 251 <p>Installed using aptitude, removed with apt-get</p>
 252
 253 <blockquote><p>
 254   deskbar-applet xserver-xorg xserver-xorg-core
 255   xserver-xorg-input-wacom xserver-xorg-video-intel
 256   xserver-xorg-video-openchrome
 257 </p></blockquote>
 258
 259 <p>I was told on IRC that the xorg-xserver package was
 260 <a href="http://git.debian.org/?p=pkg-xorg/xserver/xorg-server.git;a=commit;h=9c8080d06c457932d3bfec021c69ac000aa60120">changed
 261 in git</a> today to try to get apt-get to not remove xorg completely.
 262 No idea when it hits Squeeze, but when it does I hope it will reduce
 263 the difference somewhat.
 264 </div>
 265   <div class="tags">
 266
 267
 268
 269    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 270
 271   </div>
 272  </div>
 273  <div class="padding"></div>
 274
 275  <div class="entry">
 276   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a></div>
 277   <div class="date">2010-07-01 11:40</div>
 278   <div class="body">
 279 <p>For a laptop, centralized user directories and password checking is
 280 a bit troubling.  Laptops are typically used also when not connected
 281 to the network, and it is vital for a user to be able to log in or
 282 unlock the screen saver also when a central server is unavailable.
 283 This is possible by caching passwords and directory information (user
 284 and group attributes) locally, and the packages to do so are available
 285 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
 286 It is also possible to set up in Debian/Lenny, but require more manual
 287 setup there because pam-auth-update is missing in Lenny.</p>
 288
 289 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
 290
 291 This is the traditional method with a twist.  The password caching is
 292 provided by libpam-ccreds (version 10-4 or later is needed on
 293 Squeeze), and the directory caching is done by nscd.  The directory
 294 lookup and password checking is done using LDAP.  If one want to use
 295 Kerberos for password checking the libpam-ldapd package can be
 296 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
 297 local home directory with the path listed in LDAP, one can use the
 298 pam_mkhomedir module from pam-modules to make this happen instead of
 299 using libpam-mklocaluser.  A setup for pam-auth-update to enable
 300 pam_mkhomedir will have to be written until a fix for
 301 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
 302 archive.  Because I believe it is a bad idea to have local home
 303 directories using misleading paths like /site/server/partition/, I
 304 prefer to create a local user with the home directory in /home/.  This
 305 is done using the libpam-mklocaluser package.</p>
 306
 307 <p>These packages need to be installed and configured</p>
 308
 309 <blockquote><pre>
 310 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
 311 </pre></blockquote>
 312
 313 <p>The ldapd packages will ask for LDAP connection information, and
 314 one have to fill in the values that fits ones own site.  Make sure the
 315 PAM part uses encrypted connections, to make sure the password is not
 316 sent in clear text to the LDAP server.  I've been unable to get TLS
 317 certificate checking for a self signed certificate working, which make
 318 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
 319 is talking to the correct LDAP server), and very much welcome feedback
 320 on how to get this working.</p>
 321
 322 <p>Because nscd do not have a default configuration fit for offline
 323 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
 324 is fixed, this configuration should be used instead of the one
 325 currently in /etc/nscd.conf.  The changes are in the fields
 326 reload-count and positive-time-to-live, and is based on the
 327 instructions I found in the
 328 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
 329 instructions by Flyn Computing.</p>
 330
 331 <blockquote><pre>
 332         debug-level             0
 333         reload-count            unlimited
 334         paranoia                no
 335
 336         enable-cache            passwd          yes
 337         positive-time-to-live   passwd          2592000
 338         negative-time-to-live   passwd          20
 339         suggested-size          passwd          211
 340         check-files             passwd          yes
 341         persistent              passwd          yes
 342         shared                  passwd          yes
 343         max-db-size             passwd          33554432
 344         auto-propagate          passwd          yes
 345
 346         enable-cache            group           yes
 347         positive-time-to-live   group           2592000
 348         negative-time-to-live   group           20
 349         suggested-size          group           211
 350         check-files             group           yes
 351         persistent              group           yes
 352         shared                  group           yes
 353         max-db-size             group           33554432
 354         auto-propagate          group           yes
 355
 356         enable-cache            hosts           no
 357         positive-time-to-live   hosts           2592000
 358         negative-time-to-live   hosts           20
 359         suggested-size          hosts           211
 360         check-files             hosts           yes
 361         persistent              hosts           yes
 362         shared                  hosts           yes
 363         max-db-size             hosts           33554432
 364
 365         enable-cache            services        yes
 366         positive-time-to-live   services        2592000
 367         negative-time-to-live   services        20
 368         suggested-size          services        211
 369         check-files             services        yes
 370         persistent              services        yes
 371         shared                  services        yes
 372         max-db-size             services        33554432
 373 </pre></blockquote>
 374
 375 <p>While we wait for a mechanism to update /etc/nsswitch.conf
 376 automatically like the one provided in
 377 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
 378 content need to be manually replaced to ensure LDAP is used as the
 379 directory service on the machine.  /etc/nsswitch.conf should normally
 380 look like this:</p>
 381
 382 <blockquote><pre>
 383 passwd:         files ldap
 384 group:          files ldap
 385 shadow:         files ldap
 386 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 387 networks:       files
 388 protocols:      files
 389 services:       files
 390 ethers:         files
 391 rpc:            files
 392 netgroup:       files ldap
 393 </pre></blockquote>
 394
 395 <p>The important parts are that ldap is listed last for passwd, group,
 396 shadow and netgroup.</p>
 397
 398 <p>With these changes in place, any user in LDAP will be able to log
 399 in locally on the machine using for example kdm, get a local home
 400 directory created and have the password as well as user and group
 401 attributes cached.
 402
 403 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 404   libpam-mklocaluser/pam_mkhomedir</h2>
 405
 406 <p>Because nscd have had its share of problems, and seem to have
 407 problems doing proper caching, I've seen suggestions and recipes to
 408 use nss-updatedb to copy parts of the LDAP database locally when the
 409 LDAP database is available.  I have not tested such setup, because I
 410 discovered sssd.</p>
 411
 412 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
 413
 414 <p>A more flexible and robust setup than the nscd combination
 415 mentioned earlier that has shown up recently, is the
 416 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
 417 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
 418 to provide a Active Directory like directory service for Linux
 419 machines.  The sssd system combines the caching of passwords and user
 420 information into one package, and remove the need for nscd and
 421 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 422 1.2 do not support netgroups, but it is said that it will support this
 423 in version 1.5 expected to show up later in 2010.  Because the
 424 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
 425 was missing in Debian, I ended up co-maintaining it with Werner, and
 426 version 1.2 is now in testing.
 427
 428 <p>These packages need to be installed and configured to get the
 429 roaming setup I want</p>
 430
 431 <blockquote><pre>
 432 libpam-sss libnss-sss libpam-mklocaluser
 433 </pre></blockquote>
 434
 435 The complete setup of sssd is done by editing/creating
 436 <tt>/etc/sssd/sssd.conf</tt>.
 437
 438 <blockquote><pre>
 439 [sssd]
 440 config_file_version = 2
 441 reconnection_retries = 3
 442 sbus_timeout = 30
 443 services = nss, pam
 444 domains = INTERN
 445
 446 [nss]
 447 filter_groups = root
 448 filter_users = root
 449 reconnection_retries = 3
 450
 451 [pam]
 452 reconnection_retries = 3
 453
 454 [domain/INTERN]
 455 enumerate = false
 456 cache_credentials = true
 457
 458 id_provider = ldap
 459 auth_provider = ldap
 460 chpass_provider = ldap
 461
 462 ldap_uri = ldap://ldap
 463 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 464 ldap_tls_reqcert = never
 465 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 466 </pre></blockquote>
 467
 468 <p>I got the same problem here with certificate checking.  Had to set
 469 "ldap_tls_reqcert = never" to get it working.</p>
 470
 471 <p>With the libnss-sss package in testing at the moment, the
 472 nsswitch.conf file is update automatically, so there is no need to
 473 modify it manually.</p>
 474
 475 <p>If you want to help out with implementing this for Debian Edu,
 476 please contact us on debian-edu@lists.debian.org.</p>
 477 </div>
 478   <div class="tags">
 479
 480
 481
 482    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 483
 484   </div>
 485  </div>
 486  <div class="padding"></div>
 487
 488  <div class="entry">
 489   <div class="title"><a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">LUMA, a very nice LDAP GUI</a></div>
 490   <div class="date">2010-06-28 00:30</div>
 491   <div class="body">
 492 <p>The last few days I have been looking into the status of the LDAP
 493 directory in Debian Edu, and in the process I started to miss a GUI
 494 tool to browse the LDAP tree.  The only one I was able to find in
 495 Debian/Squeeze and Lenny is
 496 <a href="http://luma.sourceforge.net/">LUMA</a>, which has proved to
 497 be a great tool to get a overview of the current LDAP directory
 498 populated by default in Skolelinux.  Thanks to it, I have been able to
 499 find empty and obsolete subtrees, misplaced objects and duplicate
 500 objects.  It will be installed by default in Debian/Squeeze.  If you
 501 are working with LDAP, give it a go. :)</p>
 502
 503 <p>I did notice one problem with it I have not had time to report to
 504 the BTS yet.  There is no .desktop file in the package, so the tool do
 505 not show up in the Gnome and KDE menus, but only deep down in in the
 506 Debian submenu in KDE.  I hope that can be fixed before Squeeze is
 507 released.</p>
 508
 509 <p>I have not yet been able to get it to modify the tree yet.  I would
 510 like to move objects and remove subtrees directly in the GUI, but have
 511 not found a way to do that with LUMA yet.  So in the mean time, I use
 512 <a href="http://www.lichteblau.com/ldapvi/">ldapvi</a> for that.</p>
 513
 514 <p>If you have tips on other GUI tools for LDAP that might be useful
 515 in Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 516
 517 <p>Update 2010-06-29: Ross Reedstrom tipped us about the
 518 <a href="http://packages.qa.debian.org/g/gq.html">gq</a> package as a
 519 useful GUI alternative.  It seem like a good tool, but is unmaintained
 520 in Debian and got a RC bug keeping it out of Squeeze.  Unless that
 521 changes, it will not be an option for Debian Edu based on Squeeze.</p>
 522 </div>
 523   <div class="tags">
 524
 525
 526
 527    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 528
 529   </div>
 530  </div>
 531  <div class="padding"></div>
 532
 533  <div class="entry">
 534   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">Idea for a change to LDAP schemas allowing DNS and DHCP info to be combined into one object</a></div>
 535   <div class="date">2010-06-24 00:35</div>
 536   <div class="body">
 537 <p>A while back, I
 538 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">complained
 539 about the fact</a> that it is not possible with the provided schemas
 540 for storing DNS and DHCP information in LDAP to combine the two sets
 541 of information into one LDAP object representing a computer.</p>
 542
 543 <p>In the mean time, I discovered that a simple fix would be to make
 544 the dhcpHost object class auxiliary, to allow it to be combined with
 545 the dNSDomain object class, and thus forming one object for one
 546 computer when storing both DHCP and DNS information in LDAP.</p>
 547
 548 <p>If I understand this correctly, it is not safe to do this change
 549 without also changing the assigned number for the object class, and I
 550 do not know enough about LDAP schema design to do that properly for
 551 Debian Edu.</p>
 552
 553 <p>Anyway, for future reference, this is how I believe we could change
 554 the
 555 <a href="http://tools.ietf.org/html/draft-ietf-dhc-ldap-schema-00">DHCP
 556 schema</a> to solve at least part of the problem with the LDAP schemas
 557 available today from IETF.</p>
 558
 559 <pre>
 560 --- dhcp.schema    (revision 65192)
 561 +++ dhcp.schema    (working copy)
 562 @@ -376,7 +376,7 @@
 563  objectclass ( 2.16.840.1.113719.1.203.6.6
 564         NAME 'dhcpHost'
 565         DESC 'This represents information about a particular client'
 566 -       SUP top
 567 +       SUP top AUXILIARY
 568         MUST cn
 569         MAY  (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
 570         X-NDS_CONTAINMENT ('dhcpService' 'dhcpSubnet' 'dhcpGroup') )
 571 </pre>
 572
 573 <p>I very much welcome clues on how to do this properly for Debian
 574 Edu/Squeeze.  We provide the DHCP schema in our debian-edu-config
 575 package, and should thus be free to rewrite it as we see fit.</p>
 576
 577 <p>If you want to help out with implementing this for Debian Edu,
 578 please contact us on debian-edu@lists.debian.org.</p>
 579 </div>
 580   <div class="tags">
 581
 582
 583
 584    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 585
 586   </div>
 587  </div>
 588  <div class="padding"></div>
 589
 590  <div class="entry">
 591   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Calling_tasksel_like_the_installer__while_still_getting_useful_output.html">Calling tasksel like the installer, while still getting useful output</a></div>
 592   <div class="date">2010-06-16 14:55</div>
 593   <div class="body">
 594 <p>A few times I have had the need to simulate the way tasksel
 595 installs packages during the normal debian-installer run.  Until now,
 596 I have ended up letting tasksel do the work, with the annoying problem
 597 of not getting any feedback at all when something fails (like a
 598 conffile question from dpkg or a download that fails), using code like
 599 this:
 600
 601 <blockquote><pre>
 602 export DEBIAN_FRONTEND=noninteractive
 603 tasksel --new-install
 604 </pre></blockquote>
 605
 606 This would invoke tasksel, let its automatic task selection pick the
 607 tasks to install, and continue to install the requested tasks without
 608 any output what so ever.
 609
 610 Recently I revisited this problem while working on the automatic
 611 package upgrade testing, because tasksel would some times hang without
 612 any useful feedback, and I want to see what is going on when it
 613 happen.  Then it occured to me, I can parse the output from tasksel
 614 when asked to run in test mode, and use that aptitude command line
 615 printed by tasksel then to simulate the tasksel run.  I ended up using
 616 code like this:
 617
 618 <blockquote><pre>
 619 export DEBIAN_FRONTEND=noninteractive
 620 cmd="$(in_target tasksel -t --new-install | sed 's/debconf-apt-progress -- //')"
 621 $cmd
 622 </pre></blockquote>
 623
 624 <p>The content of $cmd is typically something like "<tt>aptitude -q
 625 --without-recommends -o APT::Install-Recommends=no -y install
 626 ~t^desktop$ ~t^gnome-desktop$ ~t^laptop$ ~pstandard ~prequired
 627 ~pimportant</tt>", which will install the gnome desktop task, the
 628 laptop task and all packages with priority standard , required and
 629 important, just like tasksel would have done it during
 630 installation.</p>
 631
 632 <p>A better approach is probably to extend tasksel to be able to
 633 install packages without using debconf-apt-progress, for use cases
 634 like this.</p>
 635 </div>
 636   <div class="tags">
 637
 638
 639
 640    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 641
 642   </div>
 643  </div>
 644  <div class="padding"></div>
 645
 646  <div class="entry">
 647   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Vinmonopolet_bryter_loven___penlyst___og_flere_planlegger____gj__re_det_samme.html">Vinmonopolet bryter loven åpenlyst - og flere planlegger å gjøre det samme</a></div>
 648   <div class="date">2010-06-16 11:00</div>
 649   <div class="body">
 650 <p><a href="http://www.dagbladet.no/2010/06/16/nyheter/innenriks/streik/arbeidsliv/12157858/">Dagbladet
 651 melder</a> at Vinmonopolet med bakgrunn i vekterstreiken som pågår i
 652 Norge for tiden, har bestemt seg for med vitende og vilje å bryte
 653 sentralbanklovens paragraf 14 ved å nekte folk å betale med
 654 kontanter, og at flere butikker planlegger å følge deres eksempel.
 655 Jeg synes det er hårreisende hvis de slipper unna med et slikt
 656 soleklart lovbrudd, og lurer på hva slags muligheter jeg vil ha hvis
 657 jeg blir nektet å handle med kontanter.  Jeg handler i hovedsak med
 658 kontanter selv, da jeg anser det som en borgerrett å kunne handle
 659 anonymt uten at det blir registrert.  For meg er det et angrep på mitt
 660 personvern å nekte å ta imot kontant betaling.</p>
 661
 662 <p><a href="http://www.lovdata.no/all/tl-19850524-028-003.html#14">Paragrafen
 663 i sentralbankloven</a> lyder:</p>
 664
 665 <blockquote>
 666 <p>§ 14. Tvungent betalingsmiddel</p>
 667
 668 <p>Bankens sedler og mynter er tvungent betalingsmiddel i Norge. Ingen
 669 er pliktig til i én betaling å ta imot mer enn femogtyve mynter av
 670 hver enhet.</p>
 671
 672 <p>Sterkt skadde sedler og mynter er ikke tvungent
 673 betalingsmiddel. Banken gir nærmere forskrifter om erstatning for
 674 bortkomne, brente eller skadde sedler og mynter.</p>
 675
 676 <p>Selv om en avtale inneholder klausul om betaling av en
 677 pengeforpliktelse i gullverdi, kan skyldneren frigjøre seg med tvungne
 678 betalingsmidler uten hensyn til denne klausul.</p>
 679 </blockquote>
 680
 681 <p>Det er med bakgrunn i denne lovet ikke tillatt å nekte å ta imot
 682 kontakt betaling.  Det er en lov jeg har sans for, og som jeg mener må
 683 håndheves strengt.</p>
 684 </div>
 685   <div class="tags">
 686
 687
 688
 689    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>.
 690
 691   </div>
 692  </div>
 693  <div class="padding"></div>
 694
 695  <div class="entry">
 696   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Officeshots_taking_shape.html">Officeshots taking shape</a></div>
 697   <div class="date">2010-06-13 11:40</div>
 698   <div class="body">
 699 <p>For those of us caring about document exchange and
 700 interoperability, <a href="http://www.officeshots.org/">OfficeShots</a>
 701 is a great service.  It is to ODF documents what
 702 <a href="http://browsershots.org/">BrowserShots</a> is for web
 703 pages.</p>
 704
 705 <p>A while back, I was contacted by Knut Yrvin at the part of Nokia
 706 that used to be Trolltech, who wanted to help the OfficeShots project
 707 and wondered if the University of Oslo where I work would be
 708 interested in supporting the project.  I helped him to navigate his
 709 request to the right people at work, and his request was answered with
 710 a spot in the machine room with power and network connected, and Knut
 711 arranged funding for a machine to fill the spot.  The machine is
 712 administrated by the OfficeShots people, so I do not have daily
 713 contact with its progress, and thus from time to time check back to
 714 see how the project is doing.</p>
 715
 716 <p>Today I had a look, and was happy to see that the Dell box in our
 717 machine room now is the host for several virtual machines running as
 718 OfficeShots factories, and the project is able to render ODF documents
 719 in 17 different document processing implementation on Linux and
 720 Windows.  This is great.</p>
 721 </div>
 722   <div class="tags">
 723
 724
 725
 726    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/standard">standard</a>.
 727
 728   </div>
 729  </div>
 730  <div class="padding"></div>
 731
 732  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
 733
 734 <div id="sidebar">
 735
 736
 737
 738
 739
 740 <h2>Archive</h2>
 741 <ul>
 742
 743 <li>2010
 744 <ul>
 745
 746 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 747
 748 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 749
 750 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 751
 752 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 753
 754 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 755
 756 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 757
 758 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (5)</a></li>
 759
 760 </ul></li>
 761
 762 <li>2009
 763 <ul>
 764
 765 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 766
 767 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 768
 769 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 770
 771 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 772
 773 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 774
 775 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 776
 777 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 778
 779 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 780
 781 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 782
 783 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 784
 785 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 786
 787 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 788
 789 </ul></li>
 790
 791 <li>2008
 792 <ul>
 793
 794 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 795
 796 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 797
 798 </ul></li>
 799
 800 </ul>
 801
 802
 803
 804 <h2>Tags</h2>
 805 <ul>
 806
 807  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 808
 809  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 810
 811  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 812
 813  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
 814
 815  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (32)</a></li>
 816
 817  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (32)</a></li>
 818
 819  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (45)</a></li>
 820
 821  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 822
 823  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (7)</a></li>
 824
 825  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
 826
 827  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (6)</a></li>
 828
 829  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
 830
 831  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 832
 833  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 834
 835  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (70)</a></li>
 836
 837  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (82)</a></li>
 838
 839  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (13)</a></li>
 840
 841  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (13)</a></li>
 842
 843  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 844
 845  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 846
 847  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (9)</a></li>
 848
 849  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
 850
 851  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
 852
 853  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 854
 855  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 856
 857  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 858
 859  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
 860
 861 </ul>
 862
 863 </div>
 864
 865 <p style="text-align: right">
 866 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
 867 </p>
 868 </body>
 869 </html>