-<p>For some years now, I have wondered how we should handle laptops in
-Debian Edu. The Debian Edu infrastructure is mostly designed to
-handle stationary computers, and less suited for computers that come
-and go.</p>
-
-<p>Now I finally believe I have an sensible idea on how to adjust
-Debian Edu for laptops, by introducing a new profile for them, for
-example called Roaming Workstations. Here are my thought on this.
-The setup would consist of the following:</p>
-
-<ul>
-
- <li>During installation, the user name of the owner / primary user of
- the laptop is requested and a local home directory is set up for
- the user, with uid and gid information fetched from the LDAP
- server. This allow the user to work also when offline. The
- central home directory can be available in a subdirectory on
- request, for example mounted via CIFS. It could be mounted
- automatically when a user log in while on the Debian Edu network,
- and unmounted when the machine is taken away (network down,
- hibernate, etc), it can be set up to do automatic mounting on
- request (using autofs), or perhaps some GUI button on the desktop
- can be used to access it when needed. Perhaps it is enough to use
- the fish protocol in KDE?</li>
-
- <li>Password checking is set up to use LDAP or Kerberos
- authentication when the machine is on the Debian Edu network, and
- to cache the password for offline checking when the machine unable
- to reach the LDAP or Kerberos server. This can be done using
- <a href="http://www.padl.com/OSS/pam_ccreds.html">libpam-ccreds</a>
- or the Fedora developed
- <a href="https://fedoraproject.org/wiki/Features/SSSD">System
- Security Services Daemon</a> packages.</li>
-
- <li>File synchronisation with the central home directory is set up
- using a shared directory in both the local and the central home
- directory, using unison.</li>
-
- <li>Printing should be set up to print to all printers broadcasting
- their existence on the local network, and should then work out of
- the box with CUPS. For sites needing accurate printer quotas, some
- system with Kerberos authentication or printing via ssh could be
- implemented.</li>
-
- <li>For users that should have local root access to their laptop,
- sudo should be used to allow this to the local user.</li>
-
- <li>It would be nice if user and group information from LDAP is
- cached on the client, but given that there are entries for the
- local user and primary group in /etc/, it should not be needed.</li>
-
-</ul>
-
-<p>I believe all the pieces to implement this are in Debian/testing at
-the moment. If we work quickly, we should be able to get this ready
-in time for the Squeeze release to freeze. Some of the pieces need
-tweaking, like libpam-ccreds should get support for pam-auth-update
-(<a href="http://bugs.debian.org/566718">#566718</a>) and nslcd (or
-perhaps debian-edu-config) should get some integration code to stop
-its daemon when the LDAP server is unavailable to avoid long timeouts
-when disconnected from the net. If we get Kerberos enabled, we need
-to make sure we avoid long timeouts there too.</p>
-
-<p>If you want to help out with implementing this for Debian Edu,
-please contact us on debian-edu@lists.debian.org.</p>
+<p>My file system sematics program
+<a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">presented
+a few days ago</a> is very useful to verify that a file system can
+work as a unix home directory,and today I had to extend it a bit. I'm
+looking into alternatives for home directory access here at the
+University of Oslo, and one of the options is sshfs. My friend
+Finn-Arne mentioned a while back that they had used sshfs with Debian
+Edu, but stopped because of problems. I asked today what the problems
+where, and he mentioned that sshfs failed to handle umask properly.
+Trying to detect the problem I wrote this addition to my fs testing
+script:</p>
+
+<pre>
+mode_t touch_get_mode(const char *name, mode_t mode) {
+ mode_t retval = 0;
+ int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, mode);
+ if (-1 != fd) {
+ unlink(name);
+ struct stat statbuf;
+ if (-1 != fstat(fd, &statbuf)) {
+ retval = statbuf.st_mode & 0x1ff;
+ }
+ close(fd);
+ }
+ return retval;
+}
+
+/* Try to detect problem discovered using sshfs */
+int test_umask(void) {
+ printf("info: testing umask effect on file creation\n");
+
+ mode_t orig_umask = umask(000);
+ mode_t newmode;
+ if (0666 != (newmode = touch_get_mode("foobar", 0666))) {
+ printf(" error: Wrong file mode %o when creating using mode 666 and umask 000\n",
+ newmode);
+ }
+ umask(007);
+ if (0660 != (newmode = touch_get_mode("foobar", 0666))) {
+ printf(" error: Wrong file mode %o when creating using mode 666 and umask 007\n",
+ newmode);
+ }
+
+ umask (orig_umask);
+ return 0;
+}
+
+int main(int argc, char **argv) {
+ [...]
+ test_umask();
+ return 0;
+}
+</pre>
+
+<p>Sure enough. On NFS to a netapp, I get this result:</p>
+
+<pre>
+Testing POSIX/Unix sematics on file system
+info: testing symlink creation
+info: testing subdirectory creation
+info: testing fcntl locking
+ Read-locking 1 byte from 1073741824
+ Read-locking 510 byte from 1073741826
+ Unlocking 1 byte from 1073741824
+ Write-locking 1 byte from 1073741824
+ Write-locking 510 byte from 1073741826
+ Unlocking 2 byte from 1073741824
+info: testing umask effect on file creation
+</pre>
+
+<p>When mounting the same directory using sshfs, I get this
+result:</p>
+
+<pre>
+Testing POSIX/Unix sematics on file system
+info: testing symlink creation
+info: testing subdirectory creation
+info: testing fcntl locking
+ Read-locking 1 byte from 1073741824
+ Read-locking 510 byte from 1073741826
+ Unlocking 1 byte from 1073741824
+ Write-locking 1 byte from 1073741824
+ Write-locking 510 byte from 1073741826
+ Unlocking 2 byte from 1073741824
+info: testing umask effect on file creation
+ error: Wrong file mode 644 when creating using mode 666 and umask 000
+ error: Wrong file mode 640 when creating using mode 666 and umask 007
+</pre>
+
+<p>So, I can conclude that sshfs is better than smb to a Netapp or a
+Windows server, but not good enough to be used as a home
+directory.</p>
+
+<p>Update 2010-08-26: Reported the issue in
+<a href="http://bugs.debian.org/594498">BTS report #594498</a></p>
+
+<p>Update 2010-08-27: Michael Gebetsroither report that he found the
+script so useful that he created a GIT repository and stored it in
+<a href="http://github.com/gebi/fs-test">http://github.com/gebi/fs-test</a>.</p>
projects / homepage.git / blobdiff