1 <?xml version=
"1.0" encoding=
"utf-8"?>
2 <rss version='
2.0' xmlns:lj='http://www.livejournal.org/rss/lj/
1.0/' xmlns:
atom=
"http://www.w3.org/2005/Atom">
4 <title>Petter Reinholdtsen
</title>
5 <description></description>
6 <link>http://people.skolelinux.org/pere/blog/
</link>
7 <atom:link href=
"http://people.skolelinux.org/pere/blog/index.rss" rel=
"self" type=
"application/rss+xml" />
10 <title>Idea for storing LTSP configuration in LDAP
</title>
11 <link>http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html
</link>
12 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html
</guid>
13 <pubDate>Sun,
11 Jul
2010 22:
00:
00 +
0200</pubDate>
15 <p
>Vagrant mentioned on IRC today that ltsp_config now support
16 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
17 clients, and that this can be used to fetch configuration from LDAP if
18 Debian Edu choose to store configuration there.
</p
>
20 <p
>Armed with this information, I got inspired and wrote a test module
21 to get configuration from LDAP. The idea is to look up the MAC
22 address of the client in LDAP, and look for attributes on the form
23 ltspconfigsetting=value, and use this to export SETTING=value to the
24 LTSP clients.
</p
>
26 <p
>The goal is to be able to store the LTSP configuration attributes
27 in a
"computer
" LDAP object used by both DNS and DHCP, and thus
28 allowing us to store all information about a computer in one place.
</p
>
30 <p
>This is a untested draft implementation, and I welcome feedback on
31 this approach. A real LDAP schema for the ltspClientAux objectclass
32 need to be written. Comments, suggestions, etc?
</p
>
34 <blockquote
><pre
>
35 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
37 # Fetch LTSP client settings from LDAP based on MAC address
39 # Uses ethernet address as stored in the dhcpHost objectclass using
40 # the dhcpHWAddress attribute or ethernet address stored in the
41 # ieee802Device objectclass with the macAddress attribute.
43 # This module is written to be schema agnostic, and only depend on the
44 # existence of attribute names.
46 # The LTSP configuration variables are saved directly using a
47 # ltspConfig prefix and uppercasing the rest of the attribute name.
48 # To set the SERVER variable, set the ltspConfigServer attribute.
50 # Some LDAP schema should be created with all the relevant
51 # configuration settings. Something like this should work:
53 # objectclass (
1.1.2.2 NAME
'ltspClientAux
'
56 # MAY ( ltspConfigServer $ ltsConfigSound $ ... )
58 LDAPSERVER=$(debian-edu-ldapserver)
59 if [
"$LDAPSERVER
" ] ; then
60 LDAPBASE=$(debian-edu-ldapserver -b)
61 for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk
'{print $
5}
'|sort -u) ; do
62 filter=
"(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))
"
63 ldapsearch -h
"$LDAPSERVER
" -b
"$LDAPBASE
" -v -x
"$filter
" | \
64 grep
'^ltspConfig
' | while read attr value ; do
65 # Remove prefix and convert to upper case
66 attr=$(echo $attr | sed
's/^ltspConfig//i
' | tr a-z A-Z)
67 # bass value on to clients
68 eval
"$attr=$value; export $attr
"
72 </pre
></blockquote
>
74 <p
>I
'm not sure this shell construction will work, because I suspect
75 the while block might end up in a subshell causing the variables set
76 there to not show up in ltsp-config, but if that is the case I am sure
77 the code can be restructured to make sure the variables are passed on.
78 I expect that can be solved with some testing. :)
</p
>
80 <p
>If you want to help out with implementing this for Debian Edu,
81 please contact us on debian-edu@lists.debian.org.
</p
>
86 <title>jXplorer, a very nice LDAP GUI
</title>
87 <link>http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html
</link>
88 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html
</guid>
89 <pubDate>Fri,
9 Jul
2010 12:
55:
00 +
0200</pubDate>
92 <a href=
"http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html
">my
93 last post
</a
> about available LDAP tools in Debian, I was told about a
94 LDAP GUI that is even better than luma. The java application
95 <a href=
"http://jxplorer.org/
">jXplorer
</a
> is claimed to be capable of
96 moving LDAP objects and subtrees using drag-and-drop, and can
97 authenticate using Kerberos. I have only tested the Kerberos
98 authentication, but do not have a LDAP setup allowing me to rewrite
99 LDAP with my test user yet. It is
100 <a href=
"http://packages.qa.debian.org/j/jxplorer.html
">available in
101 Debian
</a
> testing and unstable at the moment. The only problem I
102 have with it is how it handle errors. If something go wrong, its
103 non-intuitive behaviour require me to go through some query work list
104 and remove the failing query. Nothing big, but very annoying.
</p
>
109 <title>MS Word krøller det til for politiet?
</title>
110 <link>http://people.skolelinux.org/pere/blog/MS_Word_kr__ller_det_til_for_politiet_.html
</link>
111 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/MS_Word_kr__ller_det_til_for_politiet_.html
</guid>
112 <pubDate>Thu,
8 Jul
2010 14:
00:
00 +
0200</pubDate>
114 <p
>De siste dagene har Aftenposten
115 <a href=
"http://www.aftenposten.no/nyheter/iriks/article3718597.ece
">fortalt
</a
>
116 <a href=
"http://www.aftenposten.no/nyheter/iriks/article3724249.ece
">hvordan
</a
>
117 politet har brukt skriveverktøy som ikke håndterer arabisk tekst og
118 tekst som skal skrives fra høyre mot venstre når de har laget
119 løpeseddel for å be om informasjon fra publikum. Resultatet har vært
120 en uleselig arabisk-bit på løpeseddelen. Feilen har oppstått når
121 teksten har blitt
"kopiert inn i programvare som ikke har støtte for
122 språk som skrives fra høyre mot venstre
", og jeg er ganske sikker på
123 at det er snakk om Microsoft Office i dette tilfellet. Er det slik at
124 MS Office i norsk språkdrakt ikke har støtte for tekst som skal
125 skrives fra høyre mot venstre? Jeg tror alle utgaver av
126 OpenOffice.org har slik støtte, og det er jo ikke veldig vanskelig å
127 la slik støtte finnes i alle utgaver av et program hvis støtten først
128 er utviklet. Aftenpostens melding får meg til å undre om problemet
129 ville vært unngått hvis politiet brukte OpenOffice.org i stedet for MS
132 <p
>Mon tro om det er flere eksempler på at MS Office har ødelagt for
133 offentlig myndighet?
</p
>
138 <title>Lenny-
>Squeeze upgrades, apt vs aptitude with the Gnome desktop
</title>
139 <link>http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html
</link>
140 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html
</guid>
141 <pubDate>Sat,
3 Jul
2010 23:
55:
00 +
0200</pubDate>
143 <p
>Here is a short update on my
<a
144 href=
"http://people.skolelinux.org/~pere/debian-upgrade-testing/
">my
145 Debian Lenny-
>Squeeze upgrade testing
</a
>. Here is a summary of the
146 difference for Gnome when it is upgraded by apt-get and aptitude. I
'm
147 not reporting the status for KDE, because the upgrade crashes when
148 aptitude try because of missing conflicts
149 (
<a href=
"http://bugs.debian.org/
584861">#
584861</a
> and
150 <a href=
"http://bugs.debian.org/
585716">#
585716</a
>).
</p
>
152 <p
>At the end of the upgrade test script, dpkg -l is executed to get a
153 complete list of the installed packages. Based on this I see these
154 differences when I did a test run today. As usual, I do not really
155 know what the correct set of packages would be, but thought it best to
156 publish the difference.
</p
>
158 <p
>Installed using apt-get, missing with aptitude
</p
>
160 <blockquote
><p
>
161 at-spi cpp-
4.3 finger gnome-spell gstreamer0.10-gnomevfs
162 libatspi1.0-
0 libcupsys2 libeel2-data libgail-common libgdl-
1-common
163 libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin
164 libgtksourceview-common libpt-
1.10.10-plugins-alsa
165 libpt-
1.10.10-plugins-v4l libservlet2.4-java libxalan2-java
166 libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip
167 python-
4suite-xml python-eggtrayicon python-gtkhtml2
168 python-gtkmozembed svgalibg1 xserver-xephyr zip
169 </p
></blockquote
>
171 <p
>Installed using apt-get, removed with aptitude
</p
>
173 <blockquote
><p
>
174 bluez-utils dhcdbd djvulibre-desktop epiphany-gecko
175 gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager
176 libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-
50
177 libbluetooth2 libcamel1.2-
11 libcdio7 libcucul0 libcurl3
178 libdirectfb-
1.0-
0 libdvdread3 libedata-cal1.2-
6 libedataserver1.2-
9
179 libeel2-
2.20 libepc-
1.0-
1 libepc-ui-
1.0-
1 libexchange-storage1.2-
3
180 libfaad0 libgd2-noxpm libgda3-
3 libgda3-common libggz2 libggzcore9
181 libggzmod4 libgksu1.2-
0 libgksuui1.0-
1 libgmyth0 libgnome-desktop-
2
182 libgnome-pilot2 libgnomecups1.0-
1 libgnomeprint2.2-
0
183 libgnomeprintui2.2-
0 libgpod3 libgraphviz4 libgtkhtml2-
0
184 libgtksourceview1.0-
0 libgucharmap6 libhesiod0 libicu38 libisccc50
185 libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++
10
186 libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4
187 libneon27 libnm-glib0 libnm-util0 libopal-
2.2 libosp5
188 libparted1.8-
10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3
189 libpt-
1.10.10 libraw1394-
8 libsensors3 libsmbios2 libsoup2.2-
8
190 libssh2-
1 libsuitesparse-
3.1.0 libswfdec-
0.6-
90 libtalloc1
191 libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj
192 libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3
193 mysql-common swfdec-gnome totem-gstreamer wodim
194 </p
></blockquote
>
196 <p
>Installed using aptitude, missing with apt-get
</p
>
198 <blockquote
><p
>
199 gnome gnome-desktop-environment hamster-applet python-gnomeapplet
200 python-gnomekeyring python-wnck rhythmbox-plugins xorg
201 xserver-xorg-input-all xserver-xorg-input-evdev
202 xserver-xorg-input-kbd xserver-xorg-input-mouse
203 xserver-xorg-input-synaptics xserver-xorg-video-all
204 xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati
205 xserver-xorg-video-chips xserver-xorg-video-cirrus
206 xserver-xorg-video-dummy xserver-xorg-video-fbdev
207 xserver-xorg-video-glint xserver-xorg-video-i128
208 xserver-xorg-video-i740 xserver-xorg-video-mach64
209 xserver-xorg-video-mga xserver-xorg-video-neomagic
210 xserver-xorg-video-nouveau xserver-xorg-video-nv
211 xserver-xorg-video-r128 xserver-xorg-video-radeon
212 xserver-xorg-video-radeonhd xserver-xorg-video-rendition
213 xserver-xorg-video-s3 xserver-xorg-video-s3virge
214 xserver-xorg-video-savage xserver-xorg-video-siliconmotion
215 xserver-xorg-video-sis xserver-xorg-video-sisusb
216 xserver-xorg-video-tdfx xserver-xorg-video-tga
217 xserver-xorg-video-trident xserver-xorg-video-tseng
218 xserver-xorg-video-vesa xserver-xorg-video-vmware
219 xserver-xorg-video-voodoo
220 </p
></blockquote
>
222 <p
>Installed using aptitude, removed with apt-get
</p
>
224 <blockquote
><p
>
225 deskbar-applet xserver-xorg xserver-xorg-core
226 xserver-xorg-input-wacom xserver-xorg-video-intel
227 xserver-xorg-video-openchrome
228 </p
></blockquote
>
230 <p
>I was told on IRC that the xorg-xserver package was
231 <a href=
"http://git.debian.org/?p=pkg-xorg/xserver/xorg-server.git;a=commit;h=
9c8080d06c457932d3bfec021c69ac000aa60120
">changed
232 in git
</a
> today to try to get apt-get to not remove xorg completely.
233 No idea when it hits Squeeze, but when it does I hope it will reduce
234 the difference somewhat.
239 <title>Caching password, user and group on a roaming Debian laptop
</title>
240 <link>http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html
</link>
241 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html
</guid>
242 <pubDate>Thu,
1 Jul
2010 11:
40:
00 +
0200</pubDate>
244 <p
>For a laptop, centralized user directories and password checking is
245 a bit troubling. Laptops are typically used also when not connected
246 to the network, and it is vital for a user to be able to log in or
247 unlock the screen saver also when a central server is unavailable.
248 This is possible by caching passwords and directory information (user
249 and group attributes) locally, and the packages to do so are available
250 in Debian. Here follow two recipes to set this up in Debian/Squeeze.
251 It is also possible to set up in Debian/Lenny, but require more manual
252 setup there because pam-auth-update is missing in Lenny.
</p
>
254 <h2
>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir
</h2
>
256 This is the traditional method with a twist. The password caching is
257 provided by libpam-ccreds (version
10-
4 or later is needed on
258 Squeeze), and the directory caching is done by nscd. The directory
259 lookup and password checking is done using LDAP. If one want to use
260 Kerberos for password checking the libpam-ldapd package can be
261 replaced with libpam-krb5 or libpam-heimdal. If one is happy having a
262 local home directory with the path listed in LDAP, one can use the
263 pam_mkhomedir module from pam-modules to make this happen instead of
264 using libpam-mklocaluser. A setup for pam-auth-update to enable
265 pam_mkhomedir will have to be written until a fix for
266 <a href=
"http://bugs.debian.org/
568577">bug #
568577</a
> is in the
267 archive. Because I believe it is a bad idea to have local home
268 directories using misleading paths like /site/server/partition/, I
269 prefer to create a local user with the home directory in /home/. This
270 is done using the libpam-mklocaluser package.
</p
>
272 <p
>These packages need to be installed and configured
</p
>
274 <blockquote
><pre
>
275 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
276 </pre
></blockquote
>
278 <p
>The ldapd packages will ask for LDAP connection information, and
279 one have to fill in the values that fits ones own site. Make sure the
280 PAM part uses encrypted connections, to make sure the password is not
281 sent in clear text to the LDAP server. I
've been unable to get TLS
282 certificate checking for a self signed certificate working, which make
283 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
284 is talking to the correct LDAP server), and very much welcome feedback
285 on how to get this working.
</p
>
287 <p
>Because nscd do not have a default configuration fit for offline
288 caching until
<a href=
"http://bugs.debian.org/
485282">bug #
485282</a
>
289 is fixed, this configuration should be used instead of the one
290 currently in /etc/nscd.conf. The changes are in the fields
291 reload-count and positive-time-to-live, and is based on the
292 instructions I found in the
293 <a href=
"http://www.flyn.org/laptopldap/
">LDAP for Mobile Laptops
</a
>
294 instructions by Flyn Computing.
</p
>
296 <blockquote
><pre
>
298 reload-count unlimited
301 enable-cache passwd yes
302 positive-time-to-live passwd
2592000
303 negative-time-to-live passwd
20
304 suggested-size passwd
211
305 check-files passwd yes
306 persistent passwd yes
308 max-db-size passwd
33554432
309 auto-propagate passwd yes
311 enable-cache group yes
312 positive-time-to-live group
2592000
313 negative-time-to-live group
20
314 suggested-size group
211
315 check-files group yes
318 max-db-size group
33554432
319 auto-propagate group yes
321 enable-cache hosts no
322 positive-time-to-live hosts
2592000
323 negative-time-to-live hosts
20
324 suggested-size hosts
211
325 check-files hosts yes
328 max-db-size hosts
33554432
330 enable-cache services yes
331 positive-time-to-live services
2592000
332 negative-time-to-live services
20
333 suggested-size services
211
334 check-files services yes
335 persistent services yes
337 max-db-size services
33554432
338 </pre
></blockquote
>
340 <p
>While we wait for a mechanism to update /etc/nsswitch.conf
341 automatically like the one provided in
342 <a href=
"http://bugs.debian.org/
496915">bug #
496915</a
>, the file
343 content need to be manually replaced to ensure LDAP is used as the
344 directory service on the machine. /etc/nsswitch.conf should normally
345 look like this:
</p
>
347 <blockquote
><pre
>
351 hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
358 </pre
></blockquote
>
360 <p
>The important parts are that ldap is listed last for passwd, group,
361 shadow and netgroup.
</p
>
363 <p
>With these changes in place, any user in LDAP will be able to log
364 in locally on the machine using for example kdm, get a local home
365 directory created and have the password as well as user and group
368 <h2
>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
369 libpam-mklocaluser/pam_mkhomedir
</h2
>
371 <p
>Because nscd have had its share of problems, and seem to have
372 problems doing proper caching, I
've seen suggestions and recipes to
373 use nss-updatedb to copy parts of the LDAP database locally when the
374 LDAP database is available. I have not tested such setup, because I
375 discovered sssd.
</p
>
377 <h2
>LDAP/Kerberos + sssd + libpam-mklocaluser
</h2
>
379 <p
>A more flexible and robust setup than the nscd combination
380 mentioned earlier that has shown up recently, is the
381 <a href=
"https://fedorahosted.org/sssd/
">sssd
</a
> package from Redhat.
382 It is part of the
<a href=
"http://www.freeipa.org/
">FreeIPA
</A
> project
383 to provide a Active Directory like directory service for Linux
384 machines. The sssd system combines the caching of passwords and user
385 information into one package, and remove the need for nscd and
386 libpam-ccreds. It support LDAP and Kerberos, but not NIS. Version
387 1.2 do not support netgroups, but it is said that it will support this
388 in version
1.5 expected to show up later in
2010. Because the
389 <a href=
"http://packages.qa.debian.org/s/sssd.html
">sssd package
</a
>
390 was missing in Debian, I ended up co-maintaining it with Werner, and
391 version
1.2 is now in testing.
393 <p
>These packages need to be installed and configured to get the
394 roaming setup I want
</p
>
396 <blockquote
><pre
>
397 libpam-sss libnss-sss libpam-mklocaluser
398 </pre
></blockquote
>
400 The complete setup of sssd is done by editing/creating
401 <tt
>/etc/sssd/sssd.conf
</tt
>.
403 <blockquote
><pre
>
405 config_file_version =
2
406 reconnection_retries =
3
414 reconnection_retries =
3
417 reconnection_retries =
3
421 cache_credentials = true
425 chpass_provider = ldap
427 ldap_uri = ldap://ldap
428 ldap_search_base = dc=skole,dc=skolelinux,dc=no
429 ldap_tls_reqcert = never
430 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
431 </pre
></blockquote
>
433 <p
>I got the same problem here with certificate checking. Had to set
434 "ldap_tls_reqcert = never
" to get it working.
</p
>
436 <p
>With the libnss-sss package in testing at the moment, the
437 nsswitch.conf file is update automatically, so there is no need to
438 modify it manually.
</p
>
440 <p
>If you want to help out with implementing this for Debian Edu,
441 please contact us on debian-edu@lists.debian.org.
</p
>
446 <title>LUMA, a very nice LDAP GUI
</title>
447 <link>http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html
</link>
448 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html
</guid>
449 <pubDate>Mon,
28 Jun
2010 00:
30:
00 +
0200</pubDate>
451 <p
>The last few days I have been looking into the status of the LDAP
452 directory in Debian Edu, and in the process I started to miss a GUI
453 tool to browse the LDAP tree. The only one I was able to find in
454 Debian/Squeeze and Lenny is
455 <a href=
"http://luma.sourceforge.net/
">LUMA
</a
>, which has proved to
456 be a great tool to get a overview of the current LDAP directory
457 populated by default in Skolelinux. Thanks to it, I have been able to
458 find empty and obsolete subtrees, misplaced objects and duplicate
459 objects. It will be installed by default in Debian/Squeeze. If you
460 are working with LDAP, give it a go. :)
</p
>
462 <p
>I did notice one problem with it I have not had time to report to
463 the BTS yet. There is no .desktop file in the package, so the tool do
464 not show up in the Gnome and KDE menus, but only deep down in in the
465 Debian submenu in KDE. I hope that can be fixed before Squeeze is
468 <p
>I have not yet been able to get it to modify the tree yet. I would
469 like to move objects and remove subtrees directly in the GUI, but have
470 not found a way to do that with LUMA yet. So in the mean time, I use
471 <a href=
"http://www.lichteblau.com/ldapvi/
">ldapvi
</a
> for that.
</p
>
473 <p
>If you have tips on other GUI tools for LDAP that might be useful
474 in Debian Edu, please contact us on debian-edu@lists.debian.org.
</p
>
476 <p
>Update
2010-
06-
29: Ross Reedstrom tipped us about the
477 <a href=
"http://packages.qa.debian.org/g/gq.html
">gq
</a
> package as a
478 useful GUI alternative. It seem like a good tool, but is unmaintained
479 in Debian and got a RC bug keeping it out of Squeeze. Unless that
480 changes, it will not be an option for Debian Edu based on Squeeze.
</p
>
485 <title>Idea for a change to LDAP schemas allowing DNS and DHCP info to be combined into one object
</title>
486 <link>http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html
</link>
487 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html
</guid>
488 <pubDate>Thu,
24 Jun
2010 00:
35:
00 +
0200</pubDate>
490 <p
>A while back, I
491 <a href=
"http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html
">complained
492 about the fact
</a
> that it is not possible with the provided schemas
493 for storing DNS and DHCP information in LDAP to combine the two sets
494 of information into one LDAP object representing a computer.
</p
>
496 <p
>In the mean time, I discovered that a simple fix would be to make
497 the dhcpHost object class auxiliary, to allow it to be combined with
498 the dNSDomain object class, and thus forming one object for one
499 computer when storing both DHCP and DNS information in LDAP.
</p
>
501 <p
>If I understand this correctly, it is not safe to do this change
502 without also changing the assigned number for the object class, and I
503 do not know enough about LDAP schema design to do that properly for
504 Debian Edu.
</p
>
506 <p
>Anyway, for future reference, this is how I believe we could change
508 <a href=
"http://tools.ietf.org/html/draft-ietf-dhc-ldap-schema-
00">DHCP
509 schema
</a
> to solve at least part of the problem with the LDAP schemas
510 available today from IETF.
</p
>
513 --- dhcp.schema (revision
65192)
514 +++ dhcp.schema (working copy)
516 objectclass (
2.16.840.1.113719.1.203.6.6
517 NAME
'dhcpHost
'
518 DESC
'This represents information about a particular client
'
522 MAY (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
523 X-NDS_CONTAINMENT (
'dhcpService
' 'dhcpSubnet
' 'dhcpGroup
') )
526 <p
>I very much welcome clues on how to do this properly for Debian
527 Edu/Squeeze. We provide the DHCP schema in our debian-edu-config
528 package, and should thus be free to rewrite it as we see fit.
</p
>
530 <p
>If you want to help out with implementing this for Debian Edu,
531 please contact us on debian-edu@lists.debian.org.
</p
>
536 <title>Calling tasksel like the installer, while still getting useful output
</title>
537 <link>http://people.skolelinux.org/pere/blog/Calling_tasksel_like_the_installer__while_still_getting_useful_output.html
</link>
538 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Calling_tasksel_like_the_installer__while_still_getting_useful_output.html
</guid>
539 <pubDate>Wed,
16 Jun
2010 14:
55:
00 +
0200</pubDate>
541 <p
>A few times I have had the need to simulate the way tasksel
542 installs packages during the normal debian-installer run. Until now,
543 I have ended up letting tasksel do the work, with the annoying problem
544 of not getting any feedback at all when something fails (like a
545 conffile question from dpkg or a download that fails), using code like
548 <blockquote
><pre
>
549 export DEBIAN_FRONTEND=noninteractive
550 tasksel --new-install
551 </pre
></blockquote
>
553 This would invoke tasksel, let its automatic task selection pick the
554 tasks to install, and continue to install the requested tasks without
555 any output what so ever.
557 Recently I revisited this problem while working on the automatic
558 package upgrade testing, because tasksel would some times hang without
559 any useful feedback, and I want to see what is going on when it
560 happen. Then it occured to me, I can parse the output from tasksel
561 when asked to run in test mode, and use that aptitude command line
562 printed by tasksel then to simulate the tasksel run. I ended up using
565 <blockquote
><pre
>
566 export DEBIAN_FRONTEND=noninteractive
567 cmd=
"$(in_target tasksel -t --new-install | sed
's/debconf-apt-progress -- //
')
"
569 </pre
></blockquote
>
571 <p
>The content of $cmd is typically something like
"<tt
>aptitude -q
572 --without-recommends -o APT::Install-Recommends=no -y install
573 ~t^desktop$ ~t^gnome-desktop$ ~t^laptop$ ~pstandard ~prequired
574 ~pimportant
</tt
>", which will install the gnome desktop task, the
575 laptop task and all packages with priority standard , required and
576 important, just like tasksel would have done it during
577 installation.
</p
>
579 <p
>A better approach is probably to extend tasksel to be able to
580 install packages without using debconf-apt-progress, for use cases
586 <title>Vinmonopolet bryter loven åpenlyst - og flere planlegger å gjøre det samme
</title>
587 <link>http://people.skolelinux.org/pere/blog/Vinmonopolet_bryter_loven___penlyst___og_flere_planlegger____gj__re_det_samme.html
</link>
588 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Vinmonopolet_bryter_loven___penlyst___og_flere_planlegger____gj__re_det_samme.html
</guid>
589 <pubDate>Wed,
16 Jun
2010 11:
00:
00 +
0200</pubDate>
591 <p
><a href=
"http://www.dagbladet.no/
2010/
06/
16/nyheter/innenriks/streik/arbeidsliv/
12157858/
">Dagbladet
592 melder
</a
> at Vinmonopolet med bakgrunn i vekterstreiken som pågår i
593 Norge for tiden, har bestemt seg for med vitende og vilje å bryte
594 sentralbanklovens paragraf
14 ved å nekte folk å betale med
595 kontanter, og at flere butikker planlegger å følge deres eksempel.
596 Jeg synes det er hårreisende hvis de slipper unna med et slikt
597 soleklart lovbrudd, og lurer på hva slags muligheter jeg vil ha hvis
598 jeg blir nektet å handle med kontanter. Jeg handler i hovedsak med
599 kontanter selv, da jeg anser det som en borgerrett å kunne handle
600 anonymt uten at det blir registrert. For meg er det et angrep på mitt
601 personvern å nekte å ta imot kontant betaling.
</p
>
603 <p
><a href=
"http://www.lovdata.no/all/tl-
19850524-
028-
003.html#
14">Paragrafen
604 i sentralbankloven
</a
> lyder:
</p
>
607 <p
>§
14. Tvungent betalingsmiddel
</p
>
609 <p
>Bankens sedler og mynter er tvungent betalingsmiddel i Norge. Ingen
610 er pliktig til i én betaling å ta imot mer enn femogtyve mynter av
611 hver enhet.
</p
>
613 <p
>Sterkt skadde sedler og mynter er ikke tvungent
614 betalingsmiddel. Banken gir nærmere forskrifter om erstatning for
615 bortkomne, brente eller skadde sedler og mynter.
</p
>
617 <p
>Selv om en avtale inneholder klausul om betaling av en
618 pengeforpliktelse i gullverdi, kan skyldneren frigjøre seg med tvungne
619 betalingsmidler uten hensyn til denne klausul.
</p
>
622 <p
>Det er med bakgrunn i denne lovet ikke tillatt å nekte å ta imot
623 kontakt betaling. Det er en lov jeg har sans for, og som jeg mener må
624 håndheves strengt.
</p
>
629 <title>Officeshots taking shape
</title>
630 <link>http://people.skolelinux.org/pere/blog/Officeshots_taking_shape.html
</link>
631 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Officeshots_taking_shape.html
</guid>
632 <pubDate>Sun,
13 Jun
2010 11:
40:
00 +
0200</pubDate>
634 <p
>For those of us caring about document exchange and
635 interoperability,
<a href=
"http://www.officeshots.org/
">OfficeShots
</a
>
636 is a great service. It is to ODF documents what
637 <a href=
"http://browsershots.org/
">BrowserShots
</a
> is for web
640 <p
>A while back, I was contacted by Knut Yrvin at the part of Nokia
641 that used to be Trolltech, who wanted to help the OfficeShots project
642 and wondered if the University of Oslo where I work would be
643 interested in supporting the project. I helped him to navigate his
644 request to the right people at work, and his request was answered with
645 a spot in the machine room with power and network connected, and Knut
646 arranged funding for a machine to fill the spot. The machine is
647 administrated by the OfficeShots people, so I do not have daily
648 contact with its progress, and thus from time to time check back to
649 see how the project is doing.
</p
>
651 <p
>Today I had a look, and was happy to see that the Dell box in our
652 machine room now is the host for several virtual machines running as
653 OfficeShots factories, and the project is able to render ODF documents
654 in
17 different document processing implementation on Linux and
655 Windows. This is great.
</p
>