blog/archive/2010/07/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen: entries from July 2010</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="07.rss" type="application/rss+xml">
   8  </head>
   9  <body>
  10 <!-- XML FEED -->
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20  <p>Entries from July 2010.</p>
  21
  22
  23 <div class="entry">
  24  <div class="title">
  25  <a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a>
  26  </div>
  27  <div class="date">
  28   2010-07-01 11:40
  29  </div>
  30
  31  <div class="body">
  32
  33 <p>For a laptop, centralized user directories and password checking is
  34 a bit troubling.  Laptops are typically used also when not connected
  35 to the network, and it is vital for a user to be able to log in or
  36 unlock the screen saver also when a central server is unavailable.
  37 This is possible by caching passwords and directory information (user
  38 and group attributes) locally, and the packages to do so are available
  39 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
  40 It is also possible to set up in Debian/Lenny, but require more manual
  41 setup there because pam-auth-update is missing in Lenny.</p>
  42
  43 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
  44
  45 This is the traditional method with a twist.  The password caching is
  46 provided by libpam-ccreds (version 10-4 or later is needed on
  47 Squeeze), and the directory caching is done by nscd.  The directory
  48 lookup and password checking is done using LDAP.  If one want to use
  49 Kerberos for password checking the libpam-ldapd package can be
  50 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
  51 local home directory with the path listed in LDAP, one can use the
  52 pam_mkhomedir module from pam-modules to make this happen instead of
  53 using libpam-mklocaluser.  A setup for pam-auth-update to enable
  54 pam_mkhomedir will have to be written until a fix for
  55 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
  56 archive.  Because I believe it is a bad idea to have local home
  57 directories using misleading paths like /site/server/partition/, I
  58 prefer to create a local user with the home directory in /home/.  This
  59 is done using the libpam-mklocaluser package.</p>
  60
  61 <p>These packages need to be installed and configured</p>
  62
  63 <blockquote><pre>
  64 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
  65 </pre></blockquote>
  66
  67 <p>The ldapd packages will ask for LDAP connection information, and
  68 one have to fill in the values that fits ones own site.  Make sure the
  69 PAM part uses encrypted connections, to make sure the password is not
  70 sent in clear text to the LDAP server.  I've been unable to get TLS
  71 certificate checking for a self signed certificate working, which make
  72 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
  73 is talking to the correct LDAP server), and very much welcome feedback
  74 on how to get this working.</p>
  75
  76 <p>Because nscd do not have a default configuration fit for offline
  77 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
  78 is fixed, this configuration should be used instead of the one
  79 currently in /etc/nscd.conf.  The changes are in the fields
  80 reload-count and positive-time-to-live, and is based on the
  81 instructions I found in the
  82 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
  83 instructions by Flyn Computing.</p>
  84
  85 <blockquote><pre>
  86         debug-level             0
  87         reload-count            unlimited
  88         paranoia                no
  89
  90         enable-cache            passwd          yes
  91         positive-time-to-live   passwd          2592000
  92         negative-time-to-live   passwd          20
  93         suggested-size          passwd          211
  94         check-files             passwd          yes
  95         persistent              passwd          yes
  96         shared                  passwd          yes
  97         max-db-size             passwd          33554432
  98         auto-propagate          passwd          yes
  99
 100         enable-cache            group           yes
 101         positive-time-to-live   group           2592000
 102         negative-time-to-live   group           20
 103         suggested-size          group           211
 104         check-files             group           yes
 105         persistent              group           yes
 106         shared                  group           yes
 107         max-db-size             group           33554432
 108         auto-propagate          group           yes
 109
 110         enable-cache            hosts           no
 111         positive-time-to-live   hosts           2592000
 112         negative-time-to-live   hosts           20
 113         suggested-size          hosts           211
 114         check-files             hosts           yes
 115         persistent              hosts           yes
 116         shared                  hosts           yes
 117         max-db-size             hosts           33554432
 118
 119         enable-cache            services        yes
 120         positive-time-to-live   services        2592000
 121         negative-time-to-live   services        20
 122         suggested-size          services        211
 123         check-files             services        yes
 124         persistent              services        yes
 125         shared                  services        yes
 126         max-db-size             services        33554432
 127 </pre></blockquote>
 128
 129 <p>While we wait for a mechanism to update /etc/nsswitch.conf
 130 automatically like the one provided in
 131 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
 132 content need to be manually replaced to ensure LDAP is used as the
 133 directory service on the machine.  /etc/nsswitch.conf should normally
 134 look like this:</p>
 135
 136 <blockquote><pre>
 137 passwd:         files ldap
 138 group:          files ldap
 139 shadow:         files ldap
 140 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 141 networks:       files
 142 protocols:      files
 143 services:       files
 144 ethers:         files
 145 rpc:            files
 146 netgroup:       files ldap
 147 </pre></blockquote>
 148
 149 <p>The important parts are that ldap is listed last for passwd, group,
 150 shadow and netgroup.</p>
 151
 152 <p>With these changes in place, any user in LDAP will be able to log
 153 in locally on the machine using for example kdm, get a local home
 154 directory created and have the password as well as user and group
 155 attributes cached.
 156
 157 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 158   libpam-mklocaluser/pam_mkhomedir</h2>
 159
 160 <p>Because nscd have had its share of problems, and seem to have
 161 problems doing proper caching, I've seen suggestions and recipes to
 162 use nss-updatedb to copy parts of the LDAP database locally when the
 163 LDAP database is available.  I have not tested such setup, because I
 164 discovered sssd.</p>
 165
 166 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
 167
 168 <p>A more flexible and robust setup than the nscd combination
 169 mentioned earlier that has shown up recently, is the
 170 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
 171 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
 172 to provide a Active Directory like directory service for Linux
 173 machines.  The sssd system combines the caching of passwords and user
 174 information into one package, and remove the need for nscd and
 175 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 176 1.2 do not support netgroups, but it is said that it will support this
 177 in version 1.5 expected to show up later in 2010.  Because the
 178 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
 179 was missing in Debian, I ended up co-maintaining it with Werner, and
 180 version 1.2 is now in testing.
 181
 182 <p>These packages need to be installed and configured to get the
 183 roaming setup I want</p>
 184
 185 <blockquote><pre>
 186 libpam-sss libnss-sss libpam-mklocaluser
 187 </pre></blockquote>
 188
 189 The complete setup of sssd is done by editing/creating
 190 <tt>/etc/sssd/sssd.conf</tt>.
 191
 192 <blockquote><pre>
 193 [sssd]
 194 config_file_version = 2
 195 reconnection_retries = 3
 196 sbus_timeout = 30
 197 services = nss, pam
 198 domains = INTERN
 199
 200 [nss]
 201 filter_groups = root
 202 filter_users = root
 203 reconnection_retries = 3
 204
 205 [pam]
 206 reconnection_retries = 3
 207
 208 [domain/INTERN]
 209 enumerate = false
 210 cache_credentials = true
 211
 212 id_provider = ldap
 213 auth_provider = ldap
 214 chpass_provider = ldap
 215
 216 ldap_uri = ldap://ldap
 217 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 218 ldap_tls_reqcert = never
 219 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 220 </pre></blockquote>
 221
 222 <p>I got the same problem here with certificate checking.  Had to set
 223 "ldap_tls_reqcert = never" to get it working.</p>
 224
 225 <p>With the libnss-sss package in testing at the moment, the
 226 nsswitch.conf file is update automatically, so there is no need to
 227 modify it manually.</p>
 228
 229 <p>If you want to help out with implementing this for Debian Edu,
 230 please contact us on debian-edu@lists.debian.org.</p>
 231
 232  </div>
 233  <div class="tags">
 234
 235
 236
 237   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 238
 239  </div>
 240 </div>
 241  <div class="padding"></div>
 242
 243 <div class="entry">
 244  <div class="title">
 245  <a href="http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html">Lenny->Squeeze upgrades, apt vs aptitude with the Gnome desktop</a>
 246  </div>
 247  <div class="date">
 248   2010-07-03 23:55
 249  </div>
 250
 251  <div class="body">
 252
 253 <p>Here is a short update on my <a
 254 href="http://people.skolelinux.org/~pere/debian-upgrade-testing/">my
 255 Debian Lenny->Squeeze upgrade testing</a>.  Here is a summary of the
 256 difference for Gnome when it is upgraded by apt-get and aptitude.  I'm
 257 not reporting the status for KDE, because the upgrade crashes when
 258 aptitude try because of missing conflicts
 259 (<a href="http://bugs.debian.org/584861">#584861</a> and
 260 <a href="http://bugs.debian.org/585716">#585716</a>).</p>
 261
 262 <p>At the end of the upgrade test script, dpkg -l is executed to get a
 263 complete list of the installed packages.  Based on this I see these
 264 differences when I did a test run today.  As usual, I do not really
 265 know what the correct set of packages would be, but thought it best to
 266 publish the difference.</p>
 267
 268 <p>Installed using apt-get, missing with aptitude</p>
 269
 270 <blockquote><p>
 271   at-spi cpp-4.3 finger gnome-spell gstreamer0.10-gnomevfs
 272   libatspi1.0-0 libcupsys2 libeel2-data libgail-common libgdl-1-common
 273   libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin
 274   libgtksourceview-common libpt-1.10.10-plugins-alsa
 275   libpt-1.10.10-plugins-v4l libservlet2.4-java libxalan2-java
 276   libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip
 277   python-4suite-xml python-eggtrayicon python-gtkhtml2
 278   python-gtkmozembed svgalibg1 xserver-xephyr zip
 279 </p></blockquote>
 280
 281 <p>Installed using apt-get, removed with aptitude</p>
 282
 283 <blockquote><p>
 284   bluez-utils dhcdbd djvulibre-desktop epiphany-gecko
 285   gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager
 286   libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-50
 287   libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcurl3
 288   libdirectfb-1.0-0 libdvdread3 libedata-cal1.2-6 libedataserver1.2-9
 289   libeel2-2.20 libepc-1.0-1 libepc-ui-1.0-1 libexchange-storage1.2-3
 290   libfaad0 libgd2-noxpm libgda3-3 libgda3-common libggz2 libggzcore9
 291   libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnome-desktop-2
 292   libgnome-pilot2 libgnomecups1.0-1 libgnomeprint2.2-0
 293   libgnomeprintui2.2-0 libgpod3 libgraphviz4 libgtkhtml2-0
 294   libgtksourceview1.0-0 libgucharmap6 libhesiod0 libicu38 libisccc50
 295   libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++10
 296   libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4
 297   libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5
 298   libparted1.8-10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3
 299   libpt-1.10.10 libraw1394-8 libsensors3 libsmbios2 libsoup2.2-8
 300   libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1
 301   libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj
 302   libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3
 303   mysql-common swfdec-gnome totem-gstreamer wodim
 304 </p></blockquote>
 305
 306 <p>Installed using aptitude, missing with apt-get</p>
 307
 308 <blockquote><p>
 309   gnome gnome-desktop-environment hamster-applet python-gnomeapplet
 310   python-gnomekeyring python-wnck rhythmbox-plugins xorg
 311   xserver-xorg-input-all xserver-xorg-input-evdev
 312   xserver-xorg-input-kbd xserver-xorg-input-mouse
 313   xserver-xorg-input-synaptics xserver-xorg-video-all
 314   xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati
 315   xserver-xorg-video-chips xserver-xorg-video-cirrus
 316   xserver-xorg-video-dummy xserver-xorg-video-fbdev
 317   xserver-xorg-video-glint xserver-xorg-video-i128
 318   xserver-xorg-video-i740 xserver-xorg-video-mach64
 319   xserver-xorg-video-mga xserver-xorg-video-neomagic
 320   xserver-xorg-video-nouveau xserver-xorg-video-nv
 321   xserver-xorg-video-r128 xserver-xorg-video-radeon
 322   xserver-xorg-video-radeonhd xserver-xorg-video-rendition
 323   xserver-xorg-video-s3 xserver-xorg-video-s3virge
 324   xserver-xorg-video-savage xserver-xorg-video-siliconmotion
 325   xserver-xorg-video-sis xserver-xorg-video-sisusb
 326   xserver-xorg-video-tdfx xserver-xorg-video-tga
 327   xserver-xorg-video-trident xserver-xorg-video-tseng
 328   xserver-xorg-video-vesa xserver-xorg-video-vmware
 329   xserver-xorg-video-voodoo
 330 </p></blockquote>
 331
 332 <p>Installed using aptitude, removed with apt-get</p>
 333
 334 <blockquote><p>
 335   deskbar-applet xserver-xorg xserver-xorg-core
 336   xserver-xorg-input-wacom xserver-xorg-video-intel
 337   xserver-xorg-video-openchrome
 338 </p></blockquote>
 339
 340 <p>I was told on IRC that the xorg-xserver package was
 341 <a href="http://git.debian.org/?p=pkg-xorg/xserver/xorg-server.git;a=commit;h=9c8080d06c457932d3bfec021c69ac000aa60120">changed
 342 in git</a> today to try to get apt-get to not remove xorg completely.
 343 No idea when it hits Squeeze, but when it does I hope it will reduce
 344 the difference somewhat.
 345
 346  </div>
 347  <div class="tags">
 348
 349
 350
 351   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 352
 353  </div>
 354 </div>
 355  <div class="padding"></div>
 356
 357 <div class="entry">
 358  <div class="title">
 359  <a href="http://people.skolelinux.org/pere/blog/MS_Word_kr__ller_det_til_for_politiet_.html">MS Word krøller det til for politiet?</a>
 360  </div>
 361  <div class="date">
 362   2010-07-08 14:00
 363  </div>
 364
 365  <div class="body">
 366
 367 <p>De siste dagene har Aftenposten
 368 <a href="http://www.aftenposten.no/nyheter/iriks/article3718597.ece">fortalt</a>
 369 <a href="http://www.aftenposten.no/nyheter/iriks/article3724249.ece">hvordan</a>
 370 politet har brukt skriveverktøy som ikke håndterer arabisk tekst og
 371 tekst som skal skrives fra høyre mot venstre når de har laget
 372 løpeseddel for å be om informasjon fra publikum.  Resultatet har vært
 373 en uleselig arabisk-bit på løpeseddelen.  Feilen har oppstått når
 374 teksten har blitt "kopiert inn i programvare som ikke har støtte for
 375 språk som skrives fra høyre mot venstre", og jeg er ganske sikker på
 376 at det er snakk om Microsoft Office i dette tilfellet.  Er det slik at
 377 MS Office i norsk språkdrakt ikke har støtte for tekst som skal
 378 skrives fra høyre mot venstre?  Jeg tror alle utgaver av
 379 OpenOffice.org har slik støtte, og det er jo ikke veldig vanskelig å
 380 la slik støtte finnes i alle utgaver av et program hvis støtten først
 381 er utviklet.  Aftenpostens melding får meg til å undre om problemet
 382 ville vært unngått hvis politiet brukte OpenOffice.org i stedet for MS
 383 Office.</p>
 384
 385 <p>Mon tro om det er flere eksempler på at MS Office har ødelagt for
 386 offentlig myndighet?</p>
 387
 388  </div>
 389  <div class="tags">
 390
 391
 392
 393   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>.
 394
 395  </div>
 396 </div>
 397  <div class="padding"></div>
 398
 399 <div class="entry">
 400  <div class="title">
 401  <a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a>
 402  </div>
 403  <div class="date">
 404   2010-07-09 12:55
 405  </div>
 406
 407  <div class="body">
 408
 409 <p>Since
 410 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
 411 last post</a> about available LDAP tools in Debian, I was told about a
 412 LDAP GUI that is even better than luma.  The java application
 413 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
 414 moving LDAP objects and subtrees using drag-and-drop, and can
 415 authenticate using Kerberos.  I have only tested the Kerberos
 416 authentication, but do not have a LDAP setup allowing me to rewrite
 417 LDAP with my test user yet.  It is
 418 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
 419 Debian</a> testing and unstable at the moment.  The only problem I
 420 have with it is how it handle errors.  If something go wrong, its
 421 non-intuitive behaviour require me to go through some query work list
 422 and remove the failing query.  Nothing big, but very annoying.</p>
 423
 424  </div>
 425  <div class="tags">
 426
 427
 428
 429   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 430
 431  </div>
 432 </div>
 433  <div class="padding"></div>
 434
 435 <div class="entry">
 436  <div class="title">
 437  <a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a>
 438  </div>
 439  <div class="date">
 440   2010-07-11 22:00
 441  </div>
 442
 443  <div class="body">
 444
 445 <p>Vagrant mentioned on IRC today that ltsp_config now support
 446 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
 447 clients, and that this can be used to fetch configuration from LDAP if
 448 Debian Edu choose to store configuration there.</p>
 449
 450 <p>Armed with this information, I got inspired and wrote a test module
 451 to get configuration from LDAP.  The idea is to look up the MAC
 452 address of the client in LDAP, and look for attributes on the form
 453 ltspconfigsetting=value, and use this to export SETTING=value to the
 454 LTSP clients.</p>
 455
 456 <p>The goal is to be able to store the LTSP configuration attributes
 457 in a "computer" LDAP object used by both DNS and DHCP, and thus
 458 allowing us to store all information about a computer in one place.</p>
 459
 460 <p>This is a untested draft implementation, and I welcome feedback on
 461 this approach.  A real LDAP schema for the ltspClientAux objectclass
 462 need to be written.  Comments, suggestions, etc?</p>
 463
 464 <blockquote><pre>
 465 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
 466 #
 467 # Fetch LTSP client settings from LDAP based on MAC address
 468 #
 469 # Uses ethernet address as stored in the dhcpHost objectclass using
 470 # the dhcpHWAddress attribute or ethernet address stored in the
 471 # ieee802Device objectclass with the macAddress attribute.
 472 #
 473 # This module is written to be schema agnostic, and only depend on the
 474 # existence of attribute names.
 475 #
 476 # The LTSP configuration variables are saved directly using a
 477 # ltspConfig prefix and uppercasing the rest of the attribute name.
 478 # To set the SERVER variable, set the ltspConfigServer attribute.
 479 #
 480 # Some LDAP schema should be created with all the relevant
 481 # configuration settings.  Something like this should work:
 482 #
 483 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
 484 #     SUP top
 485 #     AUXILIARY
 486 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
 487
 488 LDAPSERVER=$(debian-edu-ldapserver)
 489 if [ "$LDAPSERVER" ] ; then
 490     LDAPBASE=$(debian-edu-ldapserver -b)
 491     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
 492         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
 493         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
 494             grep '^ltspConfig' | while read attr value ; do
 495             # Remove prefix and convert to upper case
 496             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
 497             # bass value on to clients
 498             eval "$attr=$value; export $attr"
 499         done
 500     done
 501 fi
 502 </pre></blockquote>
 503
 504 <p>I'm not sure this shell construction will work, because I suspect
 505 the while block might end up in a subshell causing the variables set
 506 there to not show up in ltsp-config, but if that is the case I am sure
 507 the code can be restructured to make sure the variables are passed on.
 508 I expect that can be solved with some testing. :)</p>
 509
 510 <p>If you want to help out with implementing this for Debian Edu,
 511 please contact us on debian-edu@lists.debian.org.</p>
 512
 513  </div>
 514  <div class="tags">
 515
 516
 517
 518   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 519
 520  </div>
 521 </div>
 522  <div class="padding"></div>
 523
 524 <div class="entry">
 525  <div class="title">
 526  <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a>
 527  </div>
 528  <div class="date">
 529   2010-07-14 23:45
 530  </div>
 531
 532  <div class="body">
 533
 534 <p>For a while now, I have wanted to find a way to change the DNS and
 535 DHCP services in Debian Edu to use the same LDAP objects for a given
 536 computer, to avoid the possibility of having a inconsistent state for
 537 a computer in LDAP (as in DHCP but no DNS entry or the other way
 538 around) and make it easier to add computers to LDAP.</p>
 539
 540 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
 541 information finally found a solution that seem to work.</p>
 542
 543 <p>The old setup required three LDAP objects for a given computer.
 544 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
 545 we switch powerdns to use its strict LDAP method (ldap-method=strict
 546 in pdns-debian-edu.conf), the forward and reverse DNS entries are
 547 merged into one while making it impossible to transfer the reverse map
 548 to a slave DNS server.</p>
 549
 550 <p>If we also replace the object class used to get the DNS related
 551 attributes to one allowing these attributes to be combined with the
 552 dhcphost object class, we can merge the DNS and DHCP entries into one.
 553 I've written such object class in the dnsdomainaux.schema file (need
 554 proper OIDs, but that is a minor issue), and tested the setup.  It
 555 seem to work.</p>
 556
 557 <p>With this test setup in place, we can get away with one LDAP object
 558 for both DNS and DHCP, and even the LTSP configuration I suggested in
 559 an earlier email.  The combined LDAP object will look something like
 560 this:</p>
 561
 562 <blockquote><pre>
 563   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 564   cn: hostname
 565   objectClass: dhcphost
 566   objectclass: domainrelatedobject
 567   objectclass: dnsdomainaux
 568   associateddomain: hostname.intern
 569   arecord: 10.11.12.13
 570   dhcphwaddress: ethernet 00:00:00:00:00:00
 571   dhcpstatements: fixed-address hostname
 572   ldapconfigsound: Y
 573 </pre></blockquote>
 574
 575 <p>The DNS server uses the associateddomain and arecord entries, while
 576 the DHCP server uses the dhcphwaddress and dhcpstatements entries
 577 before asking DNS to resolve the fixed-adddress.  LTSP will use
 578 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
 579
 580 <p>I am not yet sure if I can get the DHCP server to look for its
 581 dhcphost in a different location, to allow us to put the objects
 582 outside the "DHCP Config" subtree, but hope to figure out a way to do
 583 that.  If I can't figure out a way to do that, we can still get rid of
 584 the hosts subtree and move all its content into the DHCP Config tree
 585 (which probably should be renamed to be more related to the new
 586 content.  I suspect cn=dnsdhcp,ou=services or something like that
 587 might be a good place to put it.</p>
 588
 589 <p>If you want to help out with implementing this for Debian Edu,
 590 please contact us on debian-edu@lists.debian.org.</p>
 591
 592  </div>
 593  <div class="tags">
 594
 595
 596
 597   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 598
 599  </div>
 600 </div>
 601  <div class="padding"></div>
 602
 603  <p style="text-align: right;"><a href="07.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14"></a></p>
 604
 605
 606
 607 <div id="sidebar">
 608
 609 <h2>Archive</h2>
 610 <ul>
 611
 612 <li>2010
 613 <ul>
 614
 615 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 616
 617 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 618
 619 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 620
 621 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 622
 623 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 624
 625 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 626
 627 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (6)</a></li>
 628
 629 </ul></li>
 630
 631 <li>2009
 632 <ul>
 633
 634 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 635
 636 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 637
 638 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 639
 640 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 641
 642 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 643
 644 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 645
 646 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 647
 648 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 649
 650 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 651
 652 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 653
 654 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 655
 656 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 657
 658 </ul></li>
 659
 660 <li>2008
 661 <ul>
 662
 663 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 664
 665 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 666
 667 </ul></li>
 668
 669 </ul>
 670
 671
 672
 673 <h2>Tags</h2>
 674 <ul>
 675
 676  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 677
 678  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 679
 680  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 681
 682  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
 683
 684  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (33)</a></li>
 685
 686  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (33)</a></li>
 687
 688  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (46)</a></li>
 689
 690  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 691
 692  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (7)</a></li>
 693
 694  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
 695
 696  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (7)</a></li>
 697
 698  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
 699
 700  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 701
 702  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 703
 704  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (70)</a></li>
 705
 706  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (83)</a></li>
 707
 708  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (13)</a></li>
 709
 710  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (13)</a></li>
 711
 712  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 713
 714  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 715
 716  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (9)</a></li>
 717
 718  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
 719
 720  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
 721
 722  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 723
 724  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 725
 726  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 727
 728  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
 729
 730 </ul>
 731
 732 </div>
 733 </body>
 734 </html>