<atom:link href="http://people.skolelinux.org/pere/blog/index.rss" rel="self" type="application/rss+xml" />
<item>
- <title>One step closer to single signon in Debian Edu</title>
- <link>http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html</link>
- <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html</guid>
- <pubDate>Sun, 25 Jul 2010 10:00:00 +0200</pubDate>
+ <title>Debian in 3D</title>
+ <link>http://people.skolelinux.org/pere/blog/Debian_in_3D.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Debian_in_3D.html</guid>
+ <pubDate>Tue, 9 Nov 2010 16:10:00 +0100</pubDate>
<description>
-<p>The last few months I have been working hard to get the
-Debian/Squeeze based version of Debian Edu/Skolelinux into shape.
-This future version will use Kerberos for authentication, and services
-are slowly migrated to single sign, getting rid of password questions
-one at the time.</p>
-
-<p>It will also feature a roaming workstation profile with local home
-directory, for laptops that are only some times on the Skolelinux
-network, and for this profile a shortcut is created in Gnome and KDE
-to gain access to the users home directory on the file server. This
-shortcut uses SMB at the moment, and yesterday I had time to test if
-SMB mounting had started working in KDE after we added the cifs-utils
-package. I was surprised how well it worked.</p>
-
-<p>Thanks to the recent changes to our samba configuration to get it
-to use Kerberos for authentication, there were no question about user
-password when mounting the SMB volume. A simple click on the shortcut
-in the KDE menu, and a window with the home directory popped
-up. :)</p>
-
-<p>One step closer to a single signon solution out of the box in
-Debian Edu. We already had PAM, LDAP, IMAP and SMTP in place, and now
-also Samba. Next step is Cups and hopefully also NFS.</p>
-
-<p>We had planned a alpha0 release of Debian Edu for today, but thanks
-to the autobuilder administrators for some architectures being slow to
-sign packages, we are still missing the fixed LTSP package we need for
-the release. It was uploaded three days ago with urgency=high, and if
-it had entered testing yesterday we would have been able to test it in
-time for a alpha0 release today. As the binaries for ia64 and powerpc
-still not uploaded to the Debian archive, we need to delay the alpha
-release another day.</p>
-
-<p>If you want to help out with implementing Kerberos for Debian Edu,
-please contact us on debian-edu@lists.debian.org.</p>
+<p><img src="http://thingiverse-production.s3.amazonaws.com/renders/23/e0/c4/f9/2b/debswagtdose_preview_medium.jpg"></p>
+
+<p>3D printing is just great. I just came across this Debian logo in
+3D linked in from
+<a href="http://blog.thingiverse.com/2010/11/09/participatory-branding/">the
+thingiverse blog</a>.</p>
</description>
</item>
<item>
- <title>Digitale restriksjonsmekanismer fikk meg til å slutte å kjøpe musikk</title>
- <link>http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til____slutte____kj__pe_musikk.html</link>
- <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til____slutte____kj__pe_musikk.html</guid>
- <pubDate>Thu, 22 Jul 2010 23:50:00 +0200</pubDate>
+ <title>Datatilsynet mangler verktøyet som trengs for å kontrollere kameraovervåkning</title>
+ <link>http://people.skolelinux.org/pere/blog/Datatilsynet_mangler_verkt__yet_som_trengs_for____kontrollere_kameraoverv__kning.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Datatilsynet_mangler_verkt__yet_som_trengs_for____kontrollere_kameraoverv__kning.html</guid>
+ <pubDate>Tue, 9 Nov 2010 14:35:00 +0100</pubDate>
<description>
-<p>For mange år siden slutte jeg å kjøpe musikk-CDer. Årsaken var at
-musikkbransjen var godt i gang med å selge platene sine med DRM som
-gjorde at jeg ikke fikk spilt av musikken jeg kjøpte på utstyret jeg
-hadde tilgjengelig, dvs. min datamaskin. Det var umulig å se på en
-plate om den var ødelagt eller ikke, og jeg hadde jo allerede en
-anseelig samling med plater, så jeg bestemme meg for å slutte å gi
-penger til en bransje som åpenbart ikke respekterte meg.</p>
-
-<p>Jeg har mange titalls dager med musikk på CD i dag. Det meste er
-lagt i et stort arkiv som kan spilles av fra husets datamaskiner (har
-ikke rukket rippe alt). Jeg ser dermed ikke behovet for å skaffe mer
-musikk. De fleste av mine favoritter er i hus, og jeg er dermed godt
-fornøyd.</p>
-
-<p>Hvis musikkbransjen ønsker mine penger, så må de demonstrere at de
-setter pris på meg som kunde, og ikke skremme meg bort med DRM og
-antydninger om at kundene er kriminelle.</p>
-
-<p>Filmbransjen er like ille, men mens musikk gjerne varer lenge, er
-filmer mer ferskvare. Har dermed ikke helt sluttet å kjøpe filmer, men
-holder meg til DVD-filmer som kan spilles av på mine Linuxbokser.
-Kommer neppe til å ta i bruk Blueray, og ei heller de nye DRM-greiene
-«Ultraviolet» som be annonsert her om dagen.</p>
+<p>En stund tilbake ble jeg oppmerksom på at Datatilsynets verktøy for
+å holde rede på overvåkningskamera i Norge ikke var egnet til annet
+enn å lage statistikk, og ikke kunne brukes for å kontrollere om et
+overvåkningskamera i det offentlige rom er lovlig satt opp og
+registrert. For å teste hypotesen sendte jeg for noen dager siden
+følgende spørsmål til datatilsynet. Det omtalte kameraet står litt
+merkelig plassert i veigrøften ved gangstien langs Sandakerveien, og
+jeg lurer oppriktig på om det er lovlig plassert og registrert.</p>
+
+<p><blockquote>
+<p>Date: Tue, 2 Nov 2010 16:08:20 +0100
+<br>From: Petter Reinholdtsen &lt;pere (at) hungry.com&gt;
+<br>To: postkasse (at) datatilsynet.no
+<br>Subject: Er overvåkningskameraet korrekt registrert?</p>
+
+<p>Hei.</p>
+
+<p>I Nydalen i Oslo er det mange overvåkningskamera, og et av dem er
+spesielt merkelig plassert like over et kumlokk. Jeg lurer på om
+dette kameraet er korrekt registrert og i henhold til lovverket.</p>
+
+<p>Finner ingen eierinformasjon på kameraet, og dermed heller ingenting å
+søke på i &lt;URL:
+<a href="http://hetti.datatilsynet.no/melding/report_search.pl">http://hetti.datatilsynet.no/melding/report_search.pl</a> &gt;.
+Kartreferanse for kameraet er tilgjengelig fra
+&lt;URL:
+<a href="http://people.skolelinux.no/pere/surveillance-norway/?zoom=17&lat=59.94918&lon=10.76962&layers=B0T">http://people.skolelinux.no/pere/surveillance-norway/?zoom=17&lat=59.94918&lon=10.76962&layers=B0T</a> &gt;.
+
+<p>Kan dere fortelle meg om dette kameraet er registrert hos
+Datatilsynet som det skal være i henhold til lovverket?</p>
+
+<p>Det hadde forresten vært fint om rådata fra kameraregisteret var
+tilgjengelig på web og regelmessig oppdatert, for å kunne søke på
+andre ting enn organisasjonsnavn og -nummer ved å laste det ned og
+gjøre egne søk.</p>
+
+<p>Vennlig hilsen,
+<br>--
+<br>Petter Reinholdtsen
+</blockquote></p>
+
+<p>Her er svaret som kom dagen etter:</p>
+
+<p><blockquote>
+<p>Date: Wed, 3 Nov 2010 14:44:09 +0100
+<br>From: "juridisk" &lt;juridisk (at) Datatilsynet.no&gt;
+<br>To: Petter Reinholdtsen
+<br>Subject: VS: Er overvåkningskameraet korrekt registrert?
+
+<p>Viser til e-post av 2. november.
+
+<p>Datatilsynet er det forvaltningsorganet som skal kontrollere at
+personopplysningsloven blir fulgt. Formålet med loven er å verne
+enkeltpersoner mot krenking av personvernet gjennom behandling av
+personopplysninger.</p>
+
+<p>Juridisk veiledningstjeneste hos Datatilsynet gir råd og veiledning
+omkring personopplysningslovens regler på generelt grunnlag.</p>
+
+<p>Datatilsynet har dessverre ikke en fullstendig oversikt over alle
+kameraer, den oversikten som finner er i vår meldingsdatabase som du
+finner her:
+<a href="http://www.datatilsynet.no/templates/article____211.aspx">http://www.datatilsynet.no/templates/article____211.aspx</a></p>
+
+<p>Denne databasen gir en oversikt over virksomheter som har meldt inn
+kameraovervåkning. Dersom man ikek vet hvilken virksomhet som er
+ansvarlig, er det heller ikke mulig for Datatilsynet å søke dette
+opp.</p>
+
+<p>Webkameraer som har så dårlig oppløsning at man ikke kan gjenkjenne
+enkeltpersoner er ikke meldepliktige, da dette ikke anses som
+kameraovervåkning i personopplysningslovens forstand. Dersom kameraet
+du sikter til er et slikt webkamera, vil det kanskje ikke finnes i
+meldingsdatabasen på grunn av dette. Også dersom et kamera med god
+oppløsning ikke filmer mennesker, faller det utenfor loven.</p>
+
+<p>Datatilsynet har laget en veileder som gjennomgår når det er lov å
+overvåke med kamera, se lenke:
+<a href="http://www.datatilsynet.no/templates/article____401.aspx">http://www.datatilsynet.no/templates/article____401.aspx</a></p>
+
+<p>Dersom det ikke er klart hvem som er ansvarlig for kameraet, er det
+vanskelig for Datatilsynet å ta kontakt med den ansvarlige for å få
+avklart om kameraet er satt opp i tråd med tilsynets regelverk. Dersom
+du mener at kameraet ikke er lovlig ut fra informasjonen ovenfor, kan
+kameraet anmeldes til politiet.</p>
+
+<p>Med vennlig hilsen</p>
+
+<p>Maria Bakke
+<br>Juridisk veiledningstjeneste
+<br>Datatilsynet</p>
+</blockquote></p>
+
+<p>Personlig synes jeg det bør være krav om å registrere hvert eneste
+overvåkningskamera i det offentlige rom hos Datatilsynet, med
+kartreferanse og begrunnelse om hvorfor det er satt opp, slik at
+enhver borger enkelt kan hente ut kart over områder vi er interessert
+i og sjekke om det er overvåkningskamera der som er satt opp uten å
+være registert. Slike registreringer skal jo i dag fornyes
+regelmessing, noe jeg mistenker ikke blir gjort. Dermed kan kamera
+som en gang var korrekt registrert nå være ulovlig satt opp. Det
+burde også være bøter for å ha kamera som ikke er korrekt registrert,
+slik at en ikke kan ignorere registrering uten at det får
+konsekvenser.</p>
+
+<p>En ide fra England som jeg har sans (lite annet jeg har sans for
+når det gjelder overvåkningskamera i England) for er at enhver borger
+kan be om å få kopi av det som er tatt opp med et overvåkningskamera i
+det offentlige rom, noe som gjør at det kan komme løpende utgifter ved
+å sette overvåkningskamera. Jeg tror alt som gjør det mindre
+attraktivt å ha overvåkningskamera i det offentlige rom er en god
+ting, så et slikt lovverk i Norge tror jeg hadde vært nyttig.</p>
</description>
</item>
<item>
- <title>OpenStreetmap one step closer to having routing on its front page</title>
- <link>http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html</link>
- <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html</guid>
- <pubDate>Sun, 18 Jul 2010 16:45:00 +0200</pubDate>
+ <title>Making room on the Debian Edu/Sqeeze DVD</title>
+ <link>http://people.skolelinux.org/pere/blog/Making_room_on_the_Debian_Edu_Sqeeze_DVD.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Making_room_on_the_Debian_Edu_Sqeeze_DVD.html</guid>
+ <pubDate>Sun, 7 Nov 2010 11:45:00 +0100</pubDate>
<description>
-<p>Thanks to
-<a href="http://feedproxy.google.com/~r/Opengeodata/~3/wUTCzDZk3lc/project-of-the-week-which-way-home">todays
-opengeodata blog entry</a>, I just discovered that the
-OpenStreetmap.org site have gotten
-<a href="http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT">support
-for calculating routes</a>. The support is still experimental and
-only available from the development server, until more experience is
-gathered on the user interface and any scalability issues.</p>
-
-<p>Earlier, the routing I knew about using the OpenStreetmap.org data
-was provided by <a href="http://maps.cloudmade.com/">Cloudmade</a>,
-but having it on the main page is required to make everyone aware of
-the issue. I've had people reject Openstreetmap.org as a viable
-alternative for them because the front page lacked routing support,
-and I hope their needs will be catered for when routing show up on the
-www.openstreetmap.org front page.</p>
+<p>Prioritising packages for the Debian Edu /
+<a href="http://www.skolelinux.org/">Skolelinux</a> DVD, which is
+supposed provide a school with all the services and user applications
+needed on the pupils computer network has always been hard. Even
+schools without Internet connections should be able to get Debian Edu
+working using this DVD.</p>
+
+<p>The job became a lot harder when apt and aptitude started
+installing recommended packages by default. We want the same set of
+packages to be installed when using the DVD and the netinst CD, and
+that means all recommended packages need to be on the DVD. I created
+a patch for debian-cd in <a href="http://bugs.debian.org/601203">BTS
+report #601203</a> to do this, and since this change was applied to
+the Debian Edu DVD build, we have been seriously short on space.</p>
+
+<p>A few days ago we decided to drop blender, wxmaxima and kicad from
+the default installation to save space on the DVD, believing that
+those needing these applications are few and can get them from the
+Debian archive.</p>
+
+<p>Yesterday, I had a look what source packages to see which packages
+were using most space. A few large packages are well know;
+openoffice.org, openclipart and fluid-soundfont. But I also
+discovered that lilypond used 106 MiB and fglrx-driver used 53 MiB.
+The lilypond package is pulled in as a dependency for rosegarden, and
+when looking a bit closer I discovered that 99 MiB of the 106 MiB were
+the documentation package, which is recommended by the binary package.
+I decided to drop this documentation package from our DVD, as most of
+our users will use the GUI front-ends and do not need the lilypond
+documentation. Similarly, I dropped the non-free fglrx-driver package
+which might be installed by d-i when its hardware is detected, as the
+free X driver should work.</p>
+
+<p>With this change, we finally got space for the LXDE and Gnome
+desktop packages as well as the language specific packages making the
+DVD more useful again.</p>
</description>
</item>
<item>
- <title>What are they searching for - PowerDNS and ISC DHCP in LDAP</title>
- <link>http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html</link>
- <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html</guid>
- <pubDate>Sat, 17 Jul 2010 21:00:00 +0200</pubDate>
+ <title>Norgeskartet på mange vis - via OpenStreetmap.org</title>
+ <link>http://people.skolelinux.org/pere/blog/Norgeskartet_p___mange_vis___via_OpenStreetmap_org.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Norgeskartet_p___mange_vis___via_OpenStreetmap_org.html</guid>
+ <pubDate>Mon, 1 Nov 2010 11:15:00 +0100</pubDate>
<description>
-<p>This is a
-<a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
-on my
-<a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
-work</a> on
-<a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
-all</a> the computer related LDAP objects in Debian Edu.</p>
-
-<p>As a step to try to see if it possible to merge the DNS and DHCP
-LDAP objects, I have had a look at how the packages pdns-backend-ldap
-and dhcp3-server-ldap in Debian use the LDAP server. The two
-implementations are quite different in how they use LDAP.</p>
-
-To get this information, I started slapd with debugging enabled and
-dumped the debug output to a file to get the LDAP searches performed
-on a Debian Edu main-server. Here is a summary.
-
-<p><strong>powerdns</strong></p>
-
-<a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
-on how to</a> set up PowerDNS to use a LDAP backend is available on
-the web.
-
-<p>PowerDNS have two modes of operation using LDAP as its backend.
-One "strict" mode where the forward and reverse DNS lookups are done
-using the same LDAP objects, and a "tree" mode where the forward and
-reverse entries are in two different subtrees in LDAP with a structure
-based on the DNS names, as in tjener.intern and
-2.2.0.10.in-addr.arpa.</p>
-
-<p>In tree mode, the server is set up to use a LDAP subtree as its
-base, and uses a "base" scoped search for the DNS name by adding
-"dc=tjener,dc=intern," to the base with a filter for
-"(associateddomain=tjener.intern)" for the forward entry and
-"dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
-"(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry. For
-forward entries, it is looking for attributes named dnsttl, arecord,
-nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
-txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
-srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
-ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
-spfrecord and modifytimestamp. For reverse entries it is looking for
-the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
-ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
-locrecord, srvrecord, naptrrecord and modifytimestamp. The equivalent
-ldapsearch commands could look like this:</p>
-
-<blockquote><pre>
-ldapsearch -h ldap \
- -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
- -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
- cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
- rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
- nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
- rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
-
-ldapsearch -h ldap \
- -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
- -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
- dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
- hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
- srvrecord naptrrecord modifytimestamp
-</pre></blockquote>
-
-<p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
-ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
-example LDAP objects used there. In addition to these objects, the
-parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
-also exist.</p>
-
-<blockquote><pre>
-dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
-objectclass: top
-objectclass: dnsdomain
-objectclass: domainrelatedobject
-dc: tjener
-arecord: 10.0.2.2
-associateddomain: tjener.intern
-
-dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
-objectclass: top
-objectclass: dnsdomain2
-objectclass: domainrelatedobject
-dc: 2
-ptrrecord: tjener.intern
-associateddomain: 2.2.0.10.in-addr.arpa
-</pre></blockquote>
-
-<p>In strict mode, the server behaves differently. When looking for
-forward DNS entries, it is doing a "subtree" scoped search with the
-same base as in the tree mode for a object with filter
-"(associateddomain=tjener.intern)" and requests the attributes dnsttl,
-arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
-mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
-naptrrecord and modifytimestamp. For reverse entires it also do a
-subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
-and the requested attributes are associateddomain, dnsttl and
-modifytimestamp. In short, in strict mode the objects with ptrrecord
-go away, and the arecord attribute in the forward object is used
-instead.</p>
-
-<p>The forward and reverse searches can be simulated using ldapsearch
-like this:</p>
-
-<blockquote><pre>
-ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
- '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
- cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
- rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
- nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
- rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
-
-ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
- '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
-</pre></blockquote>
-
-<p>In addition to the forward and reverse searches , there is also a
-search for SOA records, which behave similar to the forward and
-reverse lookups.</p>
-
-<p>A thing to note with the PowerDNS behaviour is that it do not
-specify any objectclass names, and instead look for the attributes it
-need to generate a DNS reply. This make it able to work with any
-objectclass that provide the needed attributes.</p>
-
-<p>The attributes are normally provided in the cosine (RFC 1274) and
-dnsdomain2 schemas. The latter is used for reverse entries like
-ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
-
-<p>In Debian Edu, we have created DNS objects using the object classes
-dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
-attributes) and domainrelatedobject (for associatedDomain). The use
-of structural object classes make it impossible to combine these
-classes with the object classes used by DHCP.</p>
-
-<p>There are other schemas that could be used too, for example the
-dnszone structural object class used by Gosa and bind-sdb for the DNS
-attributes combined with the domainrelatedobject object class, but in
-this case some unused attributes would have to be included as well
-(zonename and relativedomainname).</p>
-
-<p>My proposal for Debian Edu would be to switch PowerDNS to strict
-mode and not use any of the existing objectclasses (dnsdomain,
-dnsdomain2 and dnszone) when one want to combine the DNS information
-with DHCP information, and instead create a auxiliary object class
-defined something like this (using the attributes defined for
-dnsdomain and dnsdomain2 or dnszone):</p>
-
-<blockquote><pre>
-objectclass ( some-oid NAME 'dnsDomainAux'
- SUP top
- AUXILIARY
- MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
- DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
- TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
- NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
- A6Record $ DNAMERecord
- ))
-</pre></blockquote>
-
-<p>This will allow any object to become a DNS entry when combined with
-the domainrelatedobject object class, and allow any entity to include
-all the attributes PowerDNS wants. I've sent an email to the PowerDNS
-developers asking for their view on this schema and if they are
-interested in providing such schema with PowerDNS, and I hope my
-message will be accepted into their mailing list soon.</p>
-
-<p><strong>ISC dhcp</strong></p>
-
-<p>The DHCP server searches for specific objectclass and requests all
-the object attributes, and then uses the attributes it want. This
-make it harder to figure out exactly what attributes are used, but
-thanks to the working example in Debian Edu I can at least get an idea
-what is needed without having to read the source code.</p>
-
-<p>In the DHCP server configuration, the LDAP base to use and the
-search filter to use to locate the correct dhcpServer entity is
-stored. These are the relevant entries from
-/etc/dhcp3/dhcpd.conf:</p>
-
-<blockquote><pre>
-ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
-ldap-dhcp-server-cn "dhcp";
-</pre></blockquote>
-
-<p>The DHCP server uses this information to nest all the DHCP
-configuration it need. The cn "dhcp" is located using the given LDAP
-base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))". The
-search result is this entry:</p>
-
-<blockquote><pre>
-dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
-cn: dhcp
-objectClass: top
-objectClass: dhcpServer
-dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
-</pre></blockquote>
-
-<p>The content of the dhcpServiceDN attribute is next used to locate the
-subtree with DHCP configuration. The DHCP configuration subtree base
-is located using a base scope search with base "cn=DHCP
-Config,dc=skole,dc=skolelinux,dc=no" and filter
-"(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
-The search result is this entry:</p>
-
-<blockquote><pre>
-dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
-cn: DHCP Config
-objectClass: top
-objectClass: dhcpService
-objectClass: dhcpOptions
-dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
-dhcpStatements: ddns-update-style none
-dhcpStatements: authoritative
-dhcpOption: smtp-server code 69 = array of ip-address
-dhcpOption: www-server code 72 = array of ip-address
-dhcpOption: wpad-url code 252 = text
-</pre></blockquote>
-
-<p>Next, the entire subtree is processed, one level at the time. When
-all the DHCP configuration is loaded, it is ready to receive requests.
-The subtree in Debian Edu contain objects with object classes
-top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
-top/dhcpSubnet, top/dhcpGroup and top/dhcpHost. These provide options
-and information about netmasks, dynamic range etc. Leaving out the
-details here because it is not relevant for the focus of my
-investigation, which is to see if it is possible to merge dns and dhcp
-related computer objects.</p>
-
-<p>When a DHCP request come in, LDAP is searched for the MAC address
-of the client (00:00:00:00:00:00 in this example), using a subtree
-scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
-the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
-00:00:00:00:00:00))" as the filter. This is what a host object look
-like:</p>
-
-<blockquote><pre>
-dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
-cn: hostname
-objectClass: top
-objectClass: dhcpHost
-dhcpHWAddress: ethernet 00:00:00:00:00:00
-dhcpStatements: fixed-address hostname
-</pre></blockquote>
-
-<p>There is less flexiblity in the way LDAP searches are done here.
-The object classes need to have fixed names, and the configuration
-need to be stored in a fairly specific LDAP structure. On the
-positive side, the invidiual dhcpHost entires can be anywhere without
-the DN pointed to by the dhcpServer entries. The latter should make
-it possible to group all host entries in a subtree next to the
-configuration entries, and this subtree can also be shared with the
-DNS server if the schema proposed above is combined with the dhcpHost
-structural object class.
-
-<p><strong>Conclusion</strong></p>
-
-<p>The PowerDNS implementation seem to be very flexible when it come
-to which LDAP schemas to use. While its "tree" mode is rigid when it
-come to the the LDAP structure, the "strict" mode is very flexible,
-allowing DNS objects to be stored anywhere under the base cn specified
-in the configuration.</p>
-
-<p>The DHCP implementation on the other hand is very inflexible, both
-regarding which LDAP schemas to use and which LDAP structure to use.
-I guess one could implement ones own schema, as long as the
-objectclasses and attributes have the names used, but this do not
-really help when the DHCP subtree need to have a fairly fixed
-structure.</p>
-
-<p>Based on the observed behaviour, I suspect a LDAP structure like
-this might work for Debian Edu:</p>
-
-<blockquote><pre>
-ou=services
- cn=machine-info (dhcpService) - dhcpServiceDN points here
- cn=dhcp (dhcpServer)
- cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
- cn=10.0.2.0 (dhcpSubnet)
- cn=group1 (dhcpGroup/dhcpOptions)
- cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
- cn=192.168.0.0 (dhcpSubnet)
- cn=group1 (dhcpGroup/dhcpOptions)
- ou=machines - PowerDNS base points here
- cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
-</pre></blockquote>
-
-<P>This is not tested yet. If the DHCP server require the dhcpHost
-entries to be in the dhcpGroup subtrees, the entries can be stored
-there instead of a common machines subtree, and the PowerDNS base
-would have to be moved one level up to the machine-info subtree.</p>
-
-<p>The combined object under the machines subtree would look something
-like this:</p>
-
-<blockquote><pre>
-dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
-dc: hostname
-objectClass: top
-objectClass: dhcpHost
-objectclass: domainrelatedobject
-objectclass: dnsDomainAux
-associateddomain: hostname.intern
-arecord: 10.11.12.13
-dhcpHWAddress: ethernet 00:00:00:00:00:00
-dhcpStatements: fixed-address hostname.intern
-</pre></blockquote>
-
-</p>One could even add the LTSP configuration associated with a given
-machine, as long as the required attributes are available in a
-auxiliary object class.</p>
+<p>Har oppdaget at mange ikke er klar over at OpenStreetmap.org er
+tilgjengelig i en rekke forskjellige formater. Her er en liste med
+eksporter jeg kjenner til for Norge, for de som trenger et
+fribrukskart til sine tjenester:</p>
+
+<p><ul>
+
+<li>Cloudmade tilbyr OSM XML, Garmin Map Files, Osmosis country
+bounding polygon, Shapefile, Navit maps, GPX POI, TomTom POI og OSM
+XML feature extracts via
+<a href="http://downloads.cloudmade.com/europe/norway">sine
+nedlastingssider</a>.</li>
+
+<li>Geofabric tilbyr
+<a href="http://download.geofabrik.de/osm/europe/norway.osm.bz2">OSM
+XML</a>,
+<a href="http://download.geofabrik.de/osm/europe/norway.osm.pbf">OSM
+protobuf binærformat</a> og
+<a href="http://download.geofabrik.de/osm/europe/norway.shp.zip">ESRI
+Shapefile (EPSG:4326)</a> fra sine nedlastingssider.</li>
+
+<li>Frikart.no tilbyr
+<a href="http://www.frikart.no/garmin/">Garmin-kart</a> i uike
+varianter for veibruk og turbruk sommer og vinter.</li>
+
+</ul></p>
+
+<p>Kartene oppdateres regelmessig, som oftest hver uke. Det skulle
+dermed være noe for enhver smak.</p>
</description>
</item>
<item>
- <title>Combining PowerDNS and ISC DHCP LDAP objects</title>
- <link>http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html</link>
- <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html</guid>
- <pubDate>Wed, 14 Jul 2010 23:45:00 +0200</pubDate>
+ <title>Best å ikke fortelle noen at streaming er nedlasting...</title>
+ <link>http://people.skolelinux.org/pere/blog/Best____ikke_fortelle_noen_at_streaming_er_nedlasting___.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Best____ikke_fortelle_noen_at_streaming_er_nedlasting___.html</guid>
+ <pubDate>Sat, 30 Oct 2010 11:20:00 +0200</pubDate>
<description>
-<p>For a while now, I have wanted to find a way to change the DNS and
-DHCP services in Debian Edu to use the same LDAP objects for a given
-computer, to avoid the possibility of having a inconsistent state for
-a computer in LDAP (as in DHCP but no DNS entry or the other way
-around) and make it easier to add computers to LDAP.</p>
-
-<p>I've looked at how powerdns and dhcpd is using LDAP, and using this
-information finally found a solution that seem to work.</p>
-
-<p>The old setup required three LDAP objects for a given computer.
-One forward DNS entry, one reverse DNS entry and one DHCP entry. If
-we switch powerdns to use its strict LDAP method (ldap-method=strict
-in pdns-debian-edu.conf), the forward and reverse DNS entries are
-merged into one while making it impossible to transfer the reverse map
-to a slave DNS server.</p>
-
-<p>If we also replace the object class used to get the DNS related
-attributes to one allowing these attributes to be combined with the
-dhcphost object class, we can merge the DNS and DHCP entries into one.
-I've written such object class in the dnsdomainaux.schema file (need
-proper OIDs, but that is a minor issue), and tested the setup. It
-seem to work.</p>
-
-<p>With this test setup in place, we can get away with one LDAP object
-for both DNS and DHCP, and even the LTSP configuration I suggested in
-an earlier email. The combined LDAP object will look something like
-this:</p>
-
-<blockquote><pre>
- dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
- cn: hostname
- objectClass: dhcphost
- objectclass: domainrelatedobject
- objectclass: dnsdomainaux
- associateddomain: hostname.intern
- arecord: 10.11.12.13
- dhcphwaddress: ethernet 00:00:00:00:00:00
- dhcpstatements: fixed-address hostname
- ldapconfigsound: Y
-</pre></blockquote>
-
-<p>The DNS server uses the associateddomain and arecord entries, while
-the DHCP server uses the dhcphwaddress and dhcpstatements entries
-before asking DNS to resolve the fixed-adddress. LTSP will use
-dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
-
-<p>I am not yet sure if I can get the DHCP server to look for its
-dhcphost in a different location, to allow us to put the objects
-outside the "DHCP Config" subtree, but hope to figure out a way to do
-that. If I can't figure out a way to do that, we can still get rid of
-the hosts subtree and move all its content into the DHCP Config tree
-(which probably should be renamed to be more related to the new
-content. I suspect cn=dnsdhcp,ou=services or something like that
-might be a good place to put it.</p>
-
-<p>If you want to help out with implementing this for Debian Edu,
-please contact us on debian-edu@lists.debian.org.</p>
+<p>I dag la jeg inn en kommentar på en sak hos NRKBeta
+<a href="http://nrkbeta.no/2010/10/27/bakom-blindpassasjer-del-1/">om
+hvordan TV-serien Blindpassasjer ble laget</a> i forbindelse med at
+filmene NRK la ut ikke var tilgjengelig i et
+<a href="http://www.digistan.org/open-standard:definition">fritt og
+åpent format</a>. Dette var det jeg skrev publiserte der 07:39.</p>
+
+<p><blockquote>
+<p>"Vi fikk en kommentar rundt måten streamet innhold er beskyttet fra
+nedlasting. Mange av oss som kan mer enn gjennomsnittet om systemer
+som dette, vet at det stort sett er mulig å lure ut ting med den
+nødvendige forkunnskapen."</p>
+
+<p>Haha. Å streame innhold er det samme som å laste ned innhold, så å
+beskytte en stream mot nedlasting er ikke mulig. Å skrive noe slikt
+er å forlede leseren.</p>
+
+<p>Med den bakgrunn blir forklaringen om at noen rettighetshavere kun
+vil tillate streaming men ikke nedlasting meningsløs.</p>
+
+<p>Anbefaler forresten å lese
+<a href="http://blogs.computerworlduk.com/simon-says/2010/10/drm-is-toxic-to-culture/index.htm">http://blogs.computerworlduk.com/simon-says/2010/10/drm-is-toxic-to-culture/index.htm</a>
+om hva som ville være konsekvensen hvis digitale avspillingssperrer
+(DRM) fungerte. Det gjør de naturligvis ikke teknisk - det er jo
+derfor de må ha totalitære juridiske beskyttelsesmekanismer på plass,
+men det er skremmende hva samfunnet tillater og NRK er med på å bygge
+opp under.</p>
+</blockquote></p>
+
+<p>Ca. 20 minutter senere får jeg følgende epost fra Anders Hofseth i
+NRKBeta:</p>
+
+<p><blockquote>
+<p>From: Anders Hofseth &lt;XXX@gmail.com>
+<br>To: "pere@hungry.com" &lt;pere@hungry.com>
+<br>Cc: Eirik Solheim &lt;XXX@gmail.com>, Jon Ståle Carlsen &lt;XXX@gmail.com>, Henrik Lied &lt;XXX@gmail.com>
+<br>Subject: Re: [NRKbeta] Kommentar: "Bakom Blindpassasjer: del 1"
+<br>Date: Sat, 30 Oct 2010 07:58:44 +0200</p>
+
+<p>Hei Petter.
+<br>Det du forsøker dra igang er egentlig en interessant diskusjon,
+men om vi skal kjøre den i kommentarfeltet her, vil vi kunne bli bedt
+om å fjerne blindpassasjer fra nett- tv og det vil heller ikke bli
+særlig lett å klarere ut noe annet arkivmateriale på lang tid.</p>
+
+<p>Dette er en situasjon NRKbeta ikke ønsker, så kommentaren er
+fjernet og den delen av diskusjonen er avsluttet på nrkbeta, vi antar
+konsekvensene vi beskriver ikke er noe du ønsker heller...</p>
+
+<p>Med hilsen,
+<br>-anders</p>
+
+<p>Ring meg om noe er uklart: 95XXXXXXX</p>
+</blockquote></p>
+
+<p>Ble så fascinert over denne holdningen, at jeg forfattet og sendte
+over følgende svar. I og med at debatten er fjernet fra NRK Betas
+kommentarfelt, så velger jeg å publisere her på bloggen min i stedet.
+Har fjernet epostadresser og telefonnummer til de involverte, for å
+unngå at de tiltrekker seg uønskede direkte kontaktforsøk.</p>
+
+<p><blockquote>
+<p>From: Petter Reinholdtsen &lt;pere@hungry.com>
+<br>To: Anders Hofseth &lt;XXX@gmail.com>
+<br>Cc: Eirik Solheim &lt;XXX@gmail.com>,
+<br> Jon Ståle Carlsen &lt;XXX@gmail.com>,
+<br> Henrik Lied &lt;XXX@gmail.com>
+<br>Subject: Re: [NRKbeta] Kommentar: "Bakom Blindpassasjer: del 1"
+<br>Date: Sat, 30 Oct 2010 08:24:34 +0200</p>
+
+<p>[Anders Hofseth]
+<br>> Hei Petter.</p>
+
+<p>Hei.</p>
+
+<p>> Det du forsøker dra igang er egentlig en interessant diskusjon, men
+<br>> om vi skal kjøre den i kommentarfeltet her, vil vi kunne bli bedt om
+<br>> å fjerne blindpassasjer fra nett- tv og det vil heller ikke bli
+<br>> særlig lett å klarere ut noe annet arkivmateriale på lang tid.</p>
+
+<p>Godt å se at du er enig i at dette er en interessant diskusjon. Den
+vil nok fortsette en stund til. :)</p>
+
+<p>Må innrømme at jeg synes det er merkelig å lese at dere i NRK med
+vitende og vilje ønsker å forlede rettighetshaverne for å kunne
+fortsette å legge ut arkivmateriale.</p>
+
+<p>Kommentarer og diskusjoner i bloggene til NRK Beta påvirker jo ikke
+faktum, som er at streaming er det samme som nedlasting, og at innhold
+som er lagt ut på nett kan lagres lokalt for avspilling når en ønsker
+det.</p>
+
+<p>Det du sier er jo at klarering av arkivmateriale for publisering på
+web krever at en holder faktum skjult fra debattfeltet på NRKBeta.
+Det er ikke et argument som holder vann. :)</p>
+
+<p>> Dette er en situasjon NRKbeta ikke ønsker, så kommentaren er fjernet
+<br>> og den delen av diskusjonen er avsluttet på nrkbeta, vi antar
+<br>> konsekvensene vi beskriver ikke er noe du ønsker heller...</p>
+
+<p>Personlig ønsker jeg at NRK skal slutte å stikke hodet i sanden og
+heller være åpne på hvordan virkeligheten fungerer, samt ta opp kampen
+mot de som vil låse kulturen inne. Jeg synes det er en skam at NRK
+godtar å forlede publikum. Ville heller at NRK krever at innhold som
+skal sendes skal være uten bruksbegresninger og kan publiseres i
+formater som heller ikke har bruksbegresninger (bruksbegresningene til
+H.264 burde få varselbjellene i NRK til å ringe).</p>
+
+<p>At NRK er med på DRM-tåkeleggingen og at det kommer feilaktive
+påstander om at "streaming beskytter mot nedlasting" som bare er egnet
+til å bygge opp om en myte som er skadelig for samfunnet som helhet.</p>
+
+<p>Anbefaler &lt;URL:<a href="http://webmink.com/2010/09/03/h-264-and-foss/">http://webmink.com/2010/09/03/h-264-and-foss/</a>> og en
+titt på
+&lt;URL: <a href="http://people.skolelinux.org/pere/blog/Terms_of_use_for_video_produced_by_a_Canon_IXUS_130_digital_camera.html">http://people.skolelinux.org/pere/blog/Terms_of_use_for_video_produced_by_a_Canon_IXUS_130_digital_camera.html</a> >.
+for å se hva slags bruksbegresninger H.264 innebærer.</p>
+
+<p>Hvis dette innebærer at NRK må være åpne med at arkivmaterialet ikke
+kan brukes før rettighetshaverene også innser at de er med på å skade
+samfunnets kultur og kollektive hukommelse, så får en i hvert fall
+synliggjort konsekvensene og antagelig mer flammer på en debatt som er
+langt på overtid.</p>
+
+<p>> Ring meg om noe er uklart: XXX</p>
+
+<p>Intet uklart, men ikke imponert over måten dere håndterer debatten på.
+Hadde du i stedet kommet med et tilsvar i kommentarfeltet der en
+gjorde det klart at blindpassasjer-blogpostingen ikke var riktig sted
+for videre diskusjon hadde dere i mine øyne kommet fra det med
+ryggraden på plass.</p>
+
+<p>PS: Interessant å se at NRK-ansatte ikke bruker NRK-epostadresser.</p>
+
+<p>Som en liten avslutning, her er noen litt morsomme innslag om temaet.
+&lt;URL: <a href="http://www.archive.org/details/CopyingIsNotTheft">http://www.archive.org/details/CopyingIsNotTheft</a> > og
+&lt;URL: <a href="http://patentabsurdity.com/">http://patentabsurdity.com/</a> > hadde vært noe å kringkaste på
+NRK1. :)</p>
+
+<p>Vennlig hilsen,
+<br>--
+<br>Petter Reinholdtsen</p>
</description>
</item>
<item>
- <title>Idea for storing LTSP configuration in LDAP</title>
- <link>http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html</link>
- <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html</guid>
- <pubDate>Sun, 11 Jul 2010 22:00:00 +0200</pubDate>
+ <title>Software updates 2010-10-24</title>
+ <link>http://people.skolelinux.org/pere/blog/Software_updates_2010_10_24.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Software_updates_2010_10_24.html</guid>
+ <pubDate>Sun, 24 Oct 2010 22:45:00 +0200</pubDate>
<description>
-<p>Vagrant mentioned on IRC today that ltsp_config now support
-sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
-clients, and that this can be used to fetch configuration from LDAP if
-Debian Edu choose to store configuration there.</p>
-
-<p>Armed with this information, I got inspired and wrote a test module
-to get configuration from LDAP. The idea is to look up the MAC
-address of the client in LDAP, and look for attributes on the form
-ltspconfigsetting=value, and use this to export SETTING=value to the
-LTSP clients.</p>
-
-<p>The goal is to be able to store the LTSP configuration attributes
-in a "computer" LDAP object used by both DNS and DHCP, and thus
-allowing us to store all information about a computer in one place.</p>
-
-<p>This is a untested draft implementation, and I welcome feedback on
-this approach. A real LDAP schema for the ltspClientAux objectclass
-need to be written. Comments, suggestions, etc?</p>
-
-<blockquote><pre>
-# Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
-#
-# Fetch LTSP client settings from LDAP based on MAC address
-#
-# Uses ethernet address as stored in the dhcpHost objectclass using
-# the dhcpHWAddress attribute or ethernet address stored in the
-# ieee802Device objectclass with the macAddress attribute.
-#
-# This module is written to be schema agnostic, and only depend on the
-# existence of attribute names.
-#
-# The LTSP configuration variables are saved directly using a
-# ltspConfig prefix and uppercasing the rest of the attribute name.
-# To set the SERVER variable, set the ltspConfigServer attribute.
-#
-# Some LDAP schema should be created with all the relevant
-# configuration settings. Something like this should work:
-#
-# objectclass ( 1.1.2.2 NAME 'ltspClientAux'
-# SUP top
-# AUXILIARY
-# MAY ( ltspConfigServer $ ltsConfigSound $ ... )
-
-LDAPSERVER=$(debian-edu-ldapserver)
-if [ "$LDAPSERVER" ] ; then
- LDAPBASE=$(debian-edu-ldapserver -b)
- for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
- filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
- ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
- grep '^ltspConfig' | while read attr value ; do
- # Remove prefix and convert to upper case
- attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
- # bass value on to clients
- eval "$attr=$value; export $attr"
- done
- done
-fi
-</pre></blockquote>
-
-<p>I'm not sure this shell construction will work, because I suspect
-the while block might end up in a subshell causing the variables set
-there to not show up in ltsp-config, but if that is the case I am sure
-the code can be restructured to make sure the variables are passed on.
-I expect that can be solved with some testing. :)</p>
-
-<p>If you want to help out with implementing this for Debian Edu,
-please contact us on debian-edu@lists.debian.org.</p>
-
-<p>Update 2010-07-17: I am aware of another effort to store LTSP
-configuration in LDAP that was created around year 2000 by
-<a href="http://www.pcxperience.com/thinclient/documentation/ldap.html">PC
-Xperience, Inc., 2000</a>. I found its
-<a href="http://people.redhat.com/alikins/ltsp/ldap/">files</a> on a
-personal home page over at redhat.com.</p>
+<p>Some updates.</p>
+
+<p>My <a href="http://pledgebank.com/gnash-avm2">gnash pledge</a> to
+raise money for the project is going well. The lower limit of 10
+signers was reached in 24 hours, and so far 13 people have signed it.
+More signers and more funding is most welcome, and I am really curious
+how far we can get before the time limit of December 24 is reached.
+:)</p>
+
+<p>On the #gnash IRC channel on irc.freenode.net, I was just tipped
+about what appear to be a great code coverage tool capable of
+generating code coverage stats without any changes to the source code.
+It is called
+<a href="http://simonkagstrom.github.com/kcov/index.html">kcov</a>,
+and can be used using <tt>kcov &lt;directory&gt; &lt;binary&gt;</tt>.
+It is missing in Debian, but the git source built just fine in Squeeze
+after I installed libelf-dev, libdwarf-dev, pkg-config and
+libglib2.0-dev. Failed to build in Lenny, but suspect that is
+solvable. I hope kcov make it into Debian soon.</p>
+
+<p>Finally found time to wrap up the release notes for <a
+href="http://lists.debian.org/debian-edu-announce/2010/10/msg00002.html">a
+new alpha release of Debian Edu</a>, and just published the second
+alpha test release of the Squeeze based Debian Edu /
+<a href="http://www.skolelinux.org/">Skolelinux</a>
+release. Give it a try if you need a complete linux solution for your
+school, including central infrastructure server, workstations, thin
+client servers and diskless workstations. A nice touch added
+yesterday is RDP support on the thin client servers, for windows
+clients to get a Linux desktop on request.</p>
</description>
</item>
<item>
- <title>jXplorer, a very nice LDAP GUI</title>
- <link>http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html</link>
- <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html</guid>
- <pubDate>Fri, 9 Jul 2010 12:55:00 +0200</pubDate>
+ <title>Pledge for funding to the Gnash project to get AVM2 support</title>
+ <link>http://people.skolelinux.org/pere/blog/Pledge_for_funding_to_the_Gnash_project_to_get_AVM2_support.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Pledge_for_funding_to_the_Gnash_project_to_get_AVM2_support.html</guid>
+ <pubDate>Tue, 19 Oct 2010 14:45:00 +0200</pubDate>
<description>
-<p>Since
-<a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
-last post</a> about available LDAP tools in Debian, I was told about a
-LDAP GUI that is even better than luma. The java application
-<a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
-moving LDAP objects and subtrees using drag-and-drop, and can
-authenticate using Kerberos. I have only tested the Kerberos
-authentication, but do not have a LDAP setup allowing me to rewrite
-LDAP with my test user yet. It is
-<a href="http://packages.qa.debian.org/j/jxplorer.html">available in
-Debian</a> testing and unstable at the moment. The only problem I
-have with it is how it handle errors. If something go wrong, its
-non-intuitive behaviour require me to go through some query work list
-and remove the failing query. Nothing big, but very annoying.</p>
+<p><a href="http://www.getgnash.org/">The Gnash project</a> is the
+most promising solution for a Free Software Flash implementation. It
+has done great so far, but there is still far to go, and recently its
+funding has dried up. I believe AVM2 support in Gnash is vital to the
+continued progress of the project, as more and more sites show up with
+AVM2 flash files.</p>
+
+<p>To try to get funding for developing such support, I have started
+<a href="http://www.pledgebank.com/gnash-avm2">a pledge</a> with the
+following text:</P>
+
+<p><blockquote>
+
+ <p>"I will pay 100$ to the Gnash project to develop AVM2 support but
+ only if 10 other people will do the same."</p>
+
+ <p>- Petter Reinholdtsen, free software developer</p>
+
+ <p>Deadline to sign up by: 24th December 2010</p>
+
+ <p>The Gnash project need to get support for the new Flash file
+ format AVM2 to work with a lot of sites using Flash on the
+ web. Gnash already work with a lot of Flash sites using the old AVM1
+ format, but more and more sites are using the AVM2 format these
+ days. The project web page is available from
+ http://www.getgnash.org/ . Gnash is a free software implementation
+ of Adobe Flash, allowing those of us that do not accept the terms of
+ the Adobe Flash license to get access to Flash sites.</p>
+
+ <p>The project need funding to get developers to put aside enough
+ time to develop the AVM2 support, and this pledge is my way to try
+ to get this to happen.</p>
+
+ <p>The project accept donations via the OpenMediaNow foundation,
+ <a href="http://www.openmedianow.org/?q=node/32">http://www.openmedianow.org/?q=node/32</a> .</p>
+
+</blockquote></p>
+
+<p>I hope you will support this effort too. I hope more than 10
+people will participate to make this happen. The more money the
+project gets, the more features it can develop using these funds.
+:)</p>
</description>
</item>
<item>
- <title>MS Word krøller det til for politiet?</title>
- <link>http://people.skolelinux.org/pere/blog/MS_Word_kr__ller_det_til_for_politiet_.html</link>
- <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/MS_Word_kr__ller_det_til_for_politiet_.html</guid>
- <pubDate>Thu, 8 Jul 2010 14:00:00 +0200</pubDate>
+ <title>Standardkrav inn i anbudstekster?</title>
+ <link>http://people.skolelinux.org/pere/blog/Standardkrav_inn_i_anbudstekster_.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Standardkrav_inn_i_anbudstekster_.html</guid>
+ <pubDate>Sun, 17 Oct 2010 19:30:00 +0200</pubDate>
<description>
-<p>De siste dagene har Aftenposten
-<a href="http://www.aftenposten.no/nyheter/iriks/article3718597.ece">fortalt</a>
-<a href="http://www.aftenposten.no/nyheter/iriks/article3724249.ece">hvordan</a>
-politet har brukt skriveverktøy som ikke håndterer arabisk tekst og
-tekst som skal skrives fra høyre mot venstre når de har laget
-løpeseddel for å be om informasjon fra publikum. Resultatet har vært
-en uleselig arabisk-bit på løpeseddelen. Feilen har oppstått når
-teksten har blitt "kopiert inn i programvare som ikke har støtte for
-språk som skrives fra høyre mot venstre", og jeg er ganske sikker på
-at det er snakk om Microsoft Office i dette tilfellet. Er det slik at
-MS Office i norsk språkdrakt ikke har støtte for tekst som skal
-skrives fra høyre mot venstre? Jeg tror alle utgaver av
-OpenOffice.org har slik støtte, og det er jo ikke veldig vanskelig å
-la slik støtte finnes i alle utgaver av et program hvis støtten først
-er utviklet. Aftenpostens melding får meg til å undre om problemet
-ville vært unngått hvis politiet brukte OpenOffice.org i stedet for MS
-Office.</p>
-
-<p>Mon tro om det er flere eksempler på at MS Office har ødelagt for
-offentlig myndighet?</p>
+<p>Hvis det å følge standarder skal ha noen effekt overfor
+leverandører, så må slike krav og ønsker komme inn i anbudstekster når
+systemer kjøpes inn. Har ikke sett noen slike formuleringer i anbud
+så langt, men har tenkt litt på hva som bør inn. Her er noen ideer og
+forslag. Min drøm er at en kan sette krav til slik støtte i
+anbudstekster, men så langt er det nok mer sannsynlig at en må nøye
+seg med å skrive at det er en fordel om slik støtte er tilstede i
+leveranser.</p>
+
+<p>Som systemadministrator på Universitetet er det typisk to områder
+som er problematiske for meg. Det ene er admin-grensesnittene på
+tjenermaskiner, som vi ønsker å bruke via ssh. Det andre er nettsider
+som vi ønsker å bruke via en nettleser. For begge deler er det viktig
+at protokollene og formatene som brukes følger standarder våre verktøy
+støtter.</p>
+
+<p>De fleste har nå støtte for SSH som overføringsprotkoll for
+admin-grensesnittet, men det er ikke tilstrekkelig for å kunne stille
+inn f.eks BIOS og RAID-kontroller via ssh-forbindelsen. Det er flere
+aktuelle protokoller for fremvisning av BIOS-oppsett og
+oppstartmeldinger, og min anbefaling ville være å kreve
+VT100-kompatibel protokoll, for å sikre at flest mulig
+terminalemulatorer kan forstå hva som kommer fra admin-grensesnittet
+via ssh. Andre aktuelle alternativer er ANSI-terminalemulering og
+VT220. Kanskje en formulering ala dette i anbudsutlysninger vil
+fungere:</p>
+
+<p><blockquote>
+BIOS og oppstartmeldinger i administrasjonsgrensesnittet til maskinen
+bør/skal være tilgjengelig via SSH-protokollen som definert av IETF
+(RFC 4251 mfl.) og følge terminalfremvisningprotokollen VT100 (ref?)
+når en kobler seg til oppstart via ssh.
+</blockquote></p>
+
+<p>Har ikke lykkes med å finne en god referanse for
+VT100-spesifikasjonen.</p>
+
+<p>Når det gjelder nettsider, så er det det HTML, CSS og
+JavaScript-spesifikasjonen til W3C som gjelder.</p>
+
+<p><blockquote>
+Alle systemets nettider bør/skal være i henhold til statens
+standardkatalogs krav om nettsider og følge HTML-standarden som
+definert av W3C, og validere uten feil hos W3Cs HTML-validator
+(http://validator.w3.org). Hvis det brukes CSS så bør/skal denne
+validere uten feil hos W3Cs CSS-validator
+(http://jigsaw.w3.org/css-validator/). Eventuelle JavaScript skal
+være i henhold til EcmaScript-standarden. I tillegg til å følge de
+overnevnte standardene skal websidene fungere i nettleserne (fyll inn
+relevant liste for organisasjonen) Firefox 3.5, Internet Explorer 8,
+Opera 9, etc.
+</blockquote></p>
+
+<p>Vil et slikt avsnitt være konkret nok til å få leverandørene til å
+lage nettsider som følger standardene og fungerer i flere
+nettlesere?</p>
+
+<p>Tar svært gjerne imot innspill på dette temaet til aktive (at)
+nuug.no, og er spesielt interessert i hva andre skriver i sine anbud
+for å oppmuntre leverandører til å følge standardene. Kanskje NUUG
+burde lage et dokument med forslag til standardformuleringer å ta med
+i anbudsutlysninger?</p>
</description>
</item>
<item>
- <title>Lenny->Squeeze upgrades, apt vs aptitude with the Gnome desktop</title>
- <link>http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html</link>
- <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html</guid>
- <pubDate>Sat, 3 Jul 2010 23:55:00 +0200</pubDate>
+ <title>Datatilsynet svarer om Bilkollektivets ønske om GPS-sporing</title>
+ <link>http://people.skolelinux.org/pere/blog/Datatilsynet_svarer_om_Bilkollektivets___nske_om_GPS_sporing.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Datatilsynet_svarer_om_Bilkollektivets___nske_om_GPS_sporing.html</guid>
+ <pubDate>Thu, 14 Oct 2010 15:00:00 +0200</pubDate>
<description>
-<p>Here is a short update on my <a
-href="http://people.skolelinux.org/~pere/debian-upgrade-testing/">my
-Debian Lenny->Squeeze upgrade testing</a>. Here is a summary of the
-difference for Gnome when it is upgraded by apt-get and aptitude. I'm
-not reporting the status for KDE, because the upgrade crashes when
-aptitude try because of missing conflicts
-(<a href="http://bugs.debian.org/584861">#584861</a> and
-<a href="http://bugs.debian.org/585716">#585716</a>).</p>
-
-<p>At the end of the upgrade test script, dpkg -l is executed to get a
-complete list of the installed packages. Based on this I see these
-differences when I did a test run today. As usual, I do not really
-know what the correct set of packages would be, but thought it best to
-publish the difference.</p>
-
-<p>Installed using apt-get, missing with aptitude</p>
-
-<blockquote><p>
- at-spi cpp-4.3 finger gnome-spell gstreamer0.10-gnomevfs
- libatspi1.0-0 libcupsys2 libeel2-data libgail-common libgdl-1-common
- libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin
- libgtksourceview-common libpt-1.10.10-plugins-alsa
- libpt-1.10.10-plugins-v4l libservlet2.4-java libxalan2-java
- libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip
- python-4suite-xml python-eggtrayicon python-gtkhtml2
- python-gtkmozembed svgalibg1 xserver-xephyr zip
-</p></blockquote>
-
-<p>Installed using apt-get, removed with aptitude</p>
-
-<blockquote><p>
- bluez-utils dhcdbd djvulibre-desktop epiphany-gecko
- gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager
- libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-50
- libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcurl3
- libdirectfb-1.0-0 libdvdread3 libedata-cal1.2-6 libedataserver1.2-9
- libeel2-2.20 libepc-1.0-1 libepc-ui-1.0-1 libexchange-storage1.2-3
- libfaad0 libgd2-noxpm libgda3-3 libgda3-common libggz2 libggzcore9
- libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnome-desktop-2
- libgnome-pilot2 libgnomecups1.0-1 libgnomeprint2.2-0
- libgnomeprintui2.2-0 libgpod3 libgraphviz4 libgtkhtml2-0
- libgtksourceview1.0-0 libgucharmap6 libhesiod0 libicu38 libisccc50
- libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++10
- libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4
- libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5
- libparted1.8-10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3
- libpt-1.10.10 libraw1394-8 libsensors3 libsmbios2 libsoup2.2-8
- libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1
- libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj
- libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3
- mysql-common swfdec-gnome totem-gstreamer wodim
-</p></blockquote>
-
-<p>Installed using aptitude, missing with apt-get</p>
-
-<blockquote><p>
- gnome gnome-desktop-environment hamster-applet python-gnomeapplet
- python-gnomekeyring python-wnck rhythmbox-plugins xorg
- xserver-xorg-input-all xserver-xorg-input-evdev
- xserver-xorg-input-kbd xserver-xorg-input-mouse
- xserver-xorg-input-synaptics xserver-xorg-video-all
- xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati
- xserver-xorg-video-chips xserver-xorg-video-cirrus
- xserver-xorg-video-dummy xserver-xorg-video-fbdev
- xserver-xorg-video-glint xserver-xorg-video-i128
- xserver-xorg-video-i740 xserver-xorg-video-mach64
- xserver-xorg-video-mga xserver-xorg-video-neomagic
- xserver-xorg-video-nouveau xserver-xorg-video-nv
- xserver-xorg-video-r128 xserver-xorg-video-radeon
- xserver-xorg-video-radeonhd xserver-xorg-video-rendition
- xserver-xorg-video-s3 xserver-xorg-video-s3virge
- xserver-xorg-video-savage xserver-xorg-video-siliconmotion
- xserver-xorg-video-sis xserver-xorg-video-sisusb
- xserver-xorg-video-tdfx xserver-xorg-video-tga
- xserver-xorg-video-trident xserver-xorg-video-tseng
- xserver-xorg-video-vesa xserver-xorg-video-vmware
- xserver-xorg-video-voodoo
-</p></blockquote>
-
-<p>Installed using aptitude, removed with apt-get</p>
-
-<blockquote><p>
- deskbar-applet xserver-xorg xserver-xorg-core
- xserver-xorg-input-wacom xserver-xorg-video-intel
- xserver-xorg-video-openchrome
-</p></blockquote>
-
-<p>I was told on IRC that the xorg-xserver package was
-<a href="http://git.debian.org/?p=pkg-xorg/xserver/xorg-server.git;a=commit;h=9c8080d06c457932d3bfec021c69ac000aa60120">changed
-in git</a> today to try to get apt-get to not remove xorg completely.
-No idea when it hits Squeeze, but when it does I hope it will reduce
-the difference somewhat.
+<p>I forbindelse med Bilkollektivets plan om å skaffe seg mulighet til
+å GPS-spore sine medlemmers bevegelser
+(<a href="http://people.skolelinux.org/pere/blog/Bilkollektivet_vil_ha_retten_til____se_hvor_jeg_kj__rer___.html">omtalt
+tidligere</a>), sendte jeg avgårde et spørsmål til <a
+href="http://www.datatilsynet.no/">Datatilsynet</a> for å gjøre dem
+oppmerksom på saken og høre hva de hadde å si. Her er korrespondansen
+så langt.</p>
+
+<p><blockquote>
+Date: Thu, 23 Sep 2010 13:38:55 +0200
+<br>From: Petter Reinholdtsen
+<br>To: postkasse@datatilsynet.no
+<br>Subject: GPS-sporing av privatpersoners bruk av bil?
+
+<p>Hei. Jeg er med i Bilkollektivet[1] her i Oslo, og ble i dag
+orientert om at de har tenkt å innføre GPS-sporing av bilene og krever
+at en for fremtidig bruk skal godkjenne følgende klausul i
+bruksvilkårene[2]:</p>
+
+<p><blockquote>
+ Andelseier er med dette gjort kjent med at bilene er utstyrt med
+ sporingsutstyr, som kan benyttes av Bilkollektivet til å spore biler
+ som brukes utenfor gyldig reservasjon.
+</blockquote></p>
+
+<p>Er slik sporing meldepliktig til datatilsynet? Har Bilkollektivet
+meldt dette til Datatilsynet? Forsøkte å søke på orgnr. 874 538 892
+på søkesiden for meldinger[3], men fant intet der.</p>
+
+<p>Hva er datatilsynets syn på slik sporing av privatpersoners bruk av
+bil?</p>
+
+<p>Jeg må innrømme at jeg forventer å kunne ferdes anonymt og uten
+radiomerking i Norge, og synes GPS-sporing av bilen jeg ønsker å bruke
+i så måte er et overgrep mot privatlivets fred. For meg er det et
+prinsipielt spørsmål og det er underordnet hvem og med hvilket formål
+som i første omgang sies å skulle ha tilgang til
+sporingsinformasjonen. Jeg vil ikke ha mulighet til å sjekke eller
+kontrollere når bruksområdene utvides, og erfaring viser jo at
+bruksområder utvides når informasjon først er samlet inn.<p>
+
+<p>1 &lt;URL: http://www.bilkollektivet.no/ >
+<br>2 &lt;URL: http://www.bilkollektivet.no/bilbruksregler.26256.no.html >
+<br>3 &lt;URL: http://hetti.datatilsynet.no/melding/report_search.pl >
+
+<p>Vennlig hilsen,
+<br>--
+<br>Petter Reinholdtsen
+</blockquote></p>
+
+<p>Svaret fra Datatilsynet kom dagen etter:</p>
+
+<p><blockquote>
+Date: Fri, 24 Sep 2010 11:24:17 +0200
+<br>From: Henok Tesfazghi
+<br>To: Petter Reinholdtsen
+<br>Subject: VS: GPS-sporing av privatpersoners bruk av bil?
+
+<p>Viser til e-post av 23. september 2010.</p>
+
+<p>Datatilsynet er det forvaltningsorganet som skal kontrollere at
+personopplysningsloven blir fulgt. Formålet med loven er å verne
+enkeltpersoner mot krenking av personvernet gjennom behandling av
+personopplysninger. Vi gjør oppmerksom på at vår e-post svartjeneste
+er ment å være en kortfattet rådgivningstjeneste, slik at vi av den
+grunn ikke kan konkludere i din sak, men gi deg innledende råd og
+veiledning. Vårt syn er basert på din fremstilling av saksforholdet,
+andre opplysninger vi eventuelt ikke kjenner til og som kan være
+relevante, vil kunne medføre et annet resultat.</p>
+
+<p>Det er uklart for Datatilsynet hva slags GPS-sporing Bilkollektivet
+her legger opp til. Dette skyldes blant annet manglende informasjon i
+forhold til hvilket formål GPS-sporingen har, hvordan det er ment å
+fungere, hvilket behandlingsgrunnlag som ligger til grunn, samt om
+opplysningene skal lagres eller ikke.</p>
+
+<p>Behandlingen vil i utgangspunket være meldepliktig etter
+personopplysningslovens § 31. Det finnes en rekke unntak fra
+meldeplikten som er hjemlet i personopplysningsforskriftens kapittel
+7. Da dette er et andelslag, og andelseiere i en utstrekning også kan
+karakteriseres som kunder, vil unntak etter
+personopplysningsforskriftens § 7-7 kunne komme til anvendelse, se
+lenke: <a href="http://lovdata.no/for/sf/fa/ta-20001215-1265-009.html#7-7">http://lovdata.no/for/sf/fa/ta-20001215-1265-009.html#7-7</a></p>
+
+<p>Datatilsynet har til orientering en rekke artikler som omhandler
+henholdsvis sporing og lokalisering, samt trafikanter og passasjerer,
+se lenke:
+<br><a href="http://www.datatilsynet.no/templates/article____1730.aspx">http://www.datatilsynet.no/templates/article____1730.aspx</a> og
+<br><a href="http://www.datatilsynet.no/templates/article____1098.aspx">http://www.datatilsynet.no/templates/article____1098.aspx</a></p>
+
+
+<p>Vennlig hilsen
+<br>Henok Tesfazghi
+<br>Rådgiver, Datatilsynet
+</blockquote></p>
+
+<p>Vet ennå ikke om jeg har overskudd til å ta opp kampen i
+Bilkollektivet, mellom barnepass og alt det andre som spiser opp
+dagene, eller om jeg bare finner et annet alternativ.</p>
</description>
</item>
<item>
- <title>Caching password, user and group on a roaming Debian laptop</title>
- <link>http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html</link>
- <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html</guid>
- <pubDate>Thu, 1 Jul 2010 11:40:00 +0200</pubDate>
+ <title>Links for 2010-10-14</title>
+ <link>http://people.skolelinux.org/pere/blog/Links_for_2010_10_14.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Links_for_2010_10_14.html</guid>
+ <pubDate>Thu, 14 Oct 2010 14:45:00 +0200</pubDate>
<description>
-<p>For a laptop, centralized user directories and password checking is
-a bit troubling. Laptops are typically used also when not connected
-to the network, and it is vital for a user to be able to log in or
-unlock the screen saver also when a central server is unavailable.
-This is possible by caching passwords and directory information (user
-and group attributes) locally, and the packages to do so are available
-in Debian. Here follow two recipes to set this up in Debian/Squeeze.
-It is also possible to set up in Debian/Lenny, but require more manual
-setup there because pam-auth-update is missing in Lenny.</p>
-
-<h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
-
-This is the traditional method with a twist. The password caching is
-provided by libpam-ccreds (version 10-4 or later is needed on
-Squeeze), and the directory caching is done by nscd. The directory
-lookup and password checking is done using LDAP. If one want to use
-Kerberos for password checking the libpam-ldapd package can be
-replaced with libpam-krb5 or libpam-heimdal. If one is happy having a
-local home directory with the path listed in LDAP, one can use the
-pam_mkhomedir module from pam-modules to make this happen instead of
-using libpam-mklocaluser. A setup for pam-auth-update to enable
-pam_mkhomedir will have to be written until a fix for
-<a href="http://bugs.debian.org/568577">bug #568577</a> is in the
-archive. Because I believe it is a bad idea to have local home
-directories using misleading paths like /site/server/partition/, I
-prefer to create a local user with the home directory in /home/. This
-is done using the libpam-mklocaluser package.</p>
-
-<p>These packages need to be installed and configured</p>
-
-<blockquote><pre>
-libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
-</pre></blockquote>
-
-<p>The ldapd packages will ask for LDAP connection information, and
-one have to fill in the values that fits ones own site. Make sure the
-PAM part uses encrypted connections, to make sure the password is not
-sent in clear text to the LDAP server. I've been unable to get TLS
-certificate checking for a self signed certificate working, which make
-LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
-is talking to the correct LDAP server), and very much welcome feedback
-on how to get this working.</p>
-
-<p>Because nscd do not have a default configuration fit for offline
-caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
-is fixed, this configuration should be used instead of the one
-currently in /etc/nscd.conf. The changes are in the fields
-reload-count and positive-time-to-live, and is based on the
-instructions I found in the
-<a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
-instructions by Flyn Computing.</p>
-
-<blockquote><pre>
- debug-level 0
- reload-count unlimited
- paranoia no
-
- enable-cache passwd yes
- positive-time-to-live passwd 2592000
- negative-time-to-live passwd 20
- suggested-size passwd 211
- check-files passwd yes
- persistent passwd yes
- shared passwd yes
- max-db-size passwd 33554432
- auto-propagate passwd yes
-
- enable-cache group yes
- positive-time-to-live group 2592000
- negative-time-to-live group 20
- suggested-size group 211
- check-files group yes
- persistent group yes
- shared group yes
- max-db-size group 33554432
- auto-propagate group yes
-
- enable-cache hosts no
- positive-time-to-live hosts 2592000
- negative-time-to-live hosts 20
- suggested-size hosts 211
- check-files hosts yes
- persistent hosts yes
- shared hosts yes
- max-db-size hosts 33554432
-
- enable-cache services yes
- positive-time-to-live services 2592000
- negative-time-to-live services 20
- suggested-size services 211
- check-files services yes
- persistent services yes
- shared services yes
- max-db-size services 33554432
-</pre></blockquote>
-
-<p>While we wait for a mechanism to update /etc/nsswitch.conf
-automatically like the one provided in
-<a href="http://bugs.debian.org/496915">bug #496915</a>, the file
-content need to be manually replaced to ensure LDAP is used as the
-directory service on the machine. /etc/nsswitch.conf should normally
-look like this:</p>
-
-<blockquote><pre>
-passwd: files ldap
-group: files ldap
-shadow: files ldap
-hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
-networks: files
-protocols: files
-services: files
-ethers: files
-rpc: files
-netgroup: files ldap
-</pre></blockquote>
-
-<p>The important parts are that ldap is listed last for passwd, group,
-shadow and netgroup.</p>
-
-<p>With these changes in place, any user in LDAP will be able to log
-in locally on the machine using for example kdm, get a local home
-directory created and have the password as well as user and group
-attributes cached.
-
-<h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
- libpam-mklocaluser/pam_mkhomedir</h2>
-
-<p>Because nscd have had its share of problems, and seem to have
-problems doing proper caching, I've seen suggestions and recipes to
-use nss-updatedb to copy parts of the LDAP database locally when the
-LDAP database is available. I have not tested such setup, because I
-discovered sssd.</p>
-
-<h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
-
-<p>A more flexible and robust setup than the nscd combination
-mentioned earlier that has shown up recently, is the
-<a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
-It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
-to provide a Active Directory like directory service for Linux
-machines. The sssd system combines the caching of passwords and user
-information into one package, and remove the need for nscd and
-libpam-ccreds. It support LDAP and Kerberos, but not NIS. Version
-1.2 do not support netgroups, but it is said that it will support this
-in version 1.5 expected to show up later in 2010. Because the
-<a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
-was missing in Debian, I ended up co-maintaining it with Werner, and
-version 1.2 is now in testing.
-
-<p>These packages need to be installed and configured to get the
-roaming setup I want</p>
-
-<blockquote><pre>
-libpam-sss libnss-sss libpam-mklocaluser
-</pre></blockquote>
-
-The complete setup of sssd is done by editing/creating
-<tt>/etc/sssd/sssd.conf</tt>.
-
-<blockquote><pre>
-[sssd]
-config_file_version = 2
-reconnection_retries = 3
-sbus_timeout = 30
-services = nss, pam
-domains = INTERN
-
-[nss]
-filter_groups = root
-filter_users = root
-reconnection_retries = 3
-
-[pam]
-reconnection_retries = 3
-
-[domain/INTERN]
-enumerate = false
-cache_credentials = true
-
-id_provider = ldap
-auth_provider = ldap
-chpass_provider = ldap
-
-ldap_uri = ldap://ldap
-ldap_search_base = dc=skole,dc=skolelinux,dc=no
-ldap_tls_reqcert = never
-ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
-</pre></blockquote>
-
-<p>I got the same problem here with certificate checking. Had to set
-"ldap_tls_reqcert = never" to get it working.</p>
-
-<p>With the libnss-sss package in testing at the moment, the
-nsswitch.conf file is update automatically, so there is no need to
-modify it manually.</p>
-
-<p>If you want to help out with implementing this for Debian Edu,
-please contact us on debian-edu@lists.debian.org.</p>
+<p>Personvernet et under kontinuerlig og kraftig angrep. Her er noen
+stemmer i debatten.</p>
+
+<p><ul>
+
+<li><a href="http://efn.no/hemmelig-retthaversk.txt">Hemmelig
+ "Retthaversk" notat vil amputere person- og rettsvernet</a> -
+ pressemelding fra EFN etter at de ble kjent med hårreisende
+ lovforslag fra "Dele, ikke stjele"-kampanjen.
+
+<li><a href="http://borud2.borud.no/2010/10/verdidebatt.html">Verdidebatt</a>
+ av Bjørn Borud. Klargjørende omramming av debatten med bakgrunn i
+ oppdagelsen fra EFN.</li>
+
+<li><a href="http://www.dagbladet.no/2010/10/14/kultur/data_og_teknologi/tekno/personvern/opphavsrett/13804298/">Må
+ personvernet vike for opphavsretten?</a> av Jan Omdahl i
+ Dagbladet</li>
+
+<li><a href="http://www.archive.org/details/CopyingIsNotTheft">Copying
+ Is Not Theft</a> - fin jingle om opphavsrett vs. eiendom</li>
+
+<li><a href="http://cleanternet.org/">Cleanternet</a> - satire om
+forslag for et rent og sikkert Internet.</li>
+
+<li><a href="http://www.dubistterrorist.de/en/">You are a
+ terrorist!</a> - innspill om den massive overvåkningen som er
+ gjennomført i Tysland og resten av den vestlige verden de siste
+ årene.</li>
+
+<li><a href="http://www.dagbladet.no/2010/10/12/kultur/debatt/debattinnlegg/13787554/">Farlig
+ hemmelighold</a> - debattinnlegg i Dagbladet fra Thomas Gramstad og
+ Bjørn Remseth i EFN</li>
+
+</ul></p>
</description>
</item>
projects / homepage.git / blobdiff