-<p>One of the new features in the next Debian/Lenny based release of
-Debian Edu/Skolelinux, which is scheduled for release in the next few
-days, is automatic configuration of the service monitoring system
-Nagios. The previous release had automatic configuration of trend
-analysis using Munin, and this Lenny based release take that a step
-further.</p>
-
-<p>When installing a Debian Edu Main-server, it is automatically
-configured as a Munin and Nagios server. In addition, it is
-configured to be a server for the
-<a href="http://wiki.debian.org/DebianEdu/HowTo/SiteSummary">SiteSummary
-system</a> I have written for use in Debian Edu. The SiteSummary
-system is inspired by a system used by the University of Oslo where I
-work. In short, the system provide a centralised collector of
-information about the computers on the network, and a client on each
-computer submitting information to this collector. This allow for
-automatic information on which packages are installed on each machine,
-which kernel the machines are using, what kind of configuration the
-packages got etc. This also allow us to automatically generate Munin
-and Nagios configuration.</p>
-
-<p>All computers reporting to the sitesummary collector with the
-munin-node package installed is automatically enabled as a Munin
-client and graphs from the statistics collected from that machine show
-up automatically on http://www/munin/ on the Main-server.</p>
-
-<p>All non-laptop computers reporting to the sitesummary collector are
-automatically monitored for network presence (ping and any network
-services detected). In addition, all computers (also laptops) with
-the nagios-nrpe-server package installed and configured the way
-sitesummary would configure it, are monitored for full disks, software
-raid status, swap free and other checks that need to run locally on
-the machine.</p>
-
-<p>The result is that the administrator on a school using Debian Edu
-based on Lenny will be able to check the health of his installation
-with one look at the Nagios settings, without having to spend any time
-keeping the Nagios configuration up-to-date.</p>
-
-<p>The only configuration one need to do to get Nagios up and running
-is to set the password used to get access via HTTP. The system
-administrator need to run "<tt>htpasswd /etc/nagios3/htpasswd.users
-nagiosadmin</tt>" to create a nagiosadmin user and set a password for
-it to be able to log into the Nagios web pages. After that,
-everything is taken care of.</p>
+<p>Today, the last piece of the puzzle for roaming laptops in Debian
+Edu finally entered the Debian archive. Today, the new
+<a href="http://packages.qa.debian.org/libp/libpam-mklocaluser.html">libpam-mklocaluser</a>
+package was accepted. Two days ago, two other pieces was accepted
+into unstable. The
+<a href="http://packages.qa.debian.org/p/pam-python.html">pam-python</a>
+package needed by libpam-mklocaluser, and the
+<a href="http://packages.qa.debian.org/s/sssd.html">sssd</a> package
+passed NEW on Monday. In addition, the
+<a href="http://packages.qa.debian.org/libp/libpam-ccreds.html">libpam-ccreds</a>
+package we need is in experimental (version 10-4) since Saturday, and
+hopefully will be moved to unstable soon.</p>
+
+<p>This collection of packages allow for two different setups for
+roaming laptops. The traditional setup would be using libpam-ccreds,
+nscd and libpam-mklocaluser with LDAP or Kerberos authentication,
+which should work out of the box if the configuration changes proposed
+for nscd in <a href="http://bugs.debian.org/485282">BTS report
+#485282</a> is implemented. The alternative setup is to use sssd with
+libpam-mklocaluser to connect to LDAP or Kerberos and let sssd take
+care of the caching of passwords and group information.</p>
+
+<p>I have so far been unable to get sssd to work with the LDAP server
+at the University, but suspect the issue is some SSL/GnuTLS related
+problem with the server certificate. I plan to update the Debian
+package to version 1.2, which is scheduled for next week, and hope to
+find time to make sure the next release will include both the
+Debian/Ubuntu specific patches. Upstream is friendly and responsive,
+and I am sure we will find a good solution.</p>
+
+<p>The idea is to set up the roaming laptops to authenticate using
+LDAP or Kerberos and create a local user with home directory in /home/
+when a usre in LDAP logs in via KDM or GDM for the first time, and
+cache the password for offline checking, as well as caching group
+memberhips and other relevant LDAP information. The
+libpam-mklocaluser package was created to make sure the local home
+directory is in /home/, instead of /site/server/directory/ which would
+be the home directory if pam_mkhomedir was used. To avoid confusion
+with support requests and configuration, we do not want local laptops
+to have users in a path that is used for the same users home directory
+on the home directory servers.</p>
+
+<p>One annoying problem with gdm is that it do not show the PAM
+message passed to the user from libpam-mklocaluser when the local user
+is created. Instead gdm simply reject the login with some generic
+message. The message is shown in kdm, ssh and login, so I guess it is
+a bug in gdm. Have not investigated if there is some other message
+type that can be used instead to get gdm to also show the message.</p>
+
+<p>If you want to help out with implementing this for Debian Edu,
+please contact us on debian-edu@lists.debian.org.</p>