<item>
- <title>Debian Edu roaming workstation - at the university of Oslo</title>
- <link>http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html</link>
- <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html</guid>
- <pubDate>Tue, 3 Aug 2010 23:30:00 +0200</pubDate>
- <description>
-<p>The new roaming workstation profile in Debian Edu/Squeeze is fairly
-similar to the laptop setup am I working on using Ubuntu for the
-University of Oslo, and just for the heck of it, I tested today how
-hard it would be to integrate that profile into the university
-infrastructure. In this case, it is the university LDAP server,
-Active Directory Kerberos server and SMB mounting from the Netapp file
-servers.</p>
+ <title>Forslag i stortinget om å stoppe elektronisk stemmegiving i Norge</title>
+ <link>http://people.skolelinux.org/pere/blog/Forslag_i_stortinget_om___stoppe_elektronisk_stemmegiving_i_Norge.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Forslag_i_stortinget_om___stoppe_elektronisk_stemmegiving_i_Norge.html</guid>
+ <pubDate>Tue, 31 Aug 2010 21:00:00 +0200</pubDate>
+ <description><p>Ble tipset i dag om at et forslag om å stoppe forsøkene med
+elektronisk stemmegiving utenfor valglokaler er
+<a href="http://www.stortinget.no/no/Saker-og-publikasjoner/Saker/Sak/?p=46616">til
+behandling</a> i Stortinget.
+<a href="http://www.stortinget.no/Global/pdf/Representantforslag/2009-2010/dok8-200910-128.pdf">Forslaget</a>
+er fremmet av Erna Solberg, Michael Tetzschner og Trond Helleland.</p>
+
+<p>Håper det får flertall.</p>
+</description>
+ </item>
+
+ <item>
+ <title>Broken hard link handling with sshfs</title>
+ <link>http://people.skolelinux.org/pere/blog/Broken_hard_link_handling_with_sshfs.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Broken_hard_link_handling_with_sshfs.html</guid>
+ <pubDate>Mon, 30 Aug 2010 19:30:00 +0200</pubDate>
+ <description><p>Just got an email from Tobias Gruetzmacher as a followup on my
+<a href="http://people.skolelinux.org/pere/blog/Broken_umask_handling_with_sshfs.html">previous
+post about sshfs</a>. He reported another problem with sshfs. It
+fail to handle hard links properly. A simple way to spot this is to
+look at the . and .. entries in the directory tree. These should have
+a link count >1, but on sshfs the count is 1. I just tested to see
+what happen when trying to hardlink, and this fail as well:</p>
-<p>I was pleasantly surprised that the only three files needed to be
-changed (/etc/sssd/sssd.conf, /etc/ldap.conf and
-/etc/mklocaluser.d/20-debian-edu-config) and one file had to be added
-(/usr/share/perl5/Debian/Edu_Local.pm), to get the client working.
-Most of the changes were to get the client to use the university LDAP
-for NSS and Kerberos server for PAM, but one was to change a hard
-coded DNS domain name in the mklocaluser hook from .intern to
-.uio.no.</p>
+<pre>
+% ln foo bar
+ln: creating hard link `bar' => `foo': Function not implemented
+%
+</pre>
-<p>This testing was so encouraging, that I went ahead and adjusted the
-Debian Edu scripts and setup in subversion to centralise the roaming
-workstation setup a bit more and avoid the hardcoded DNS domain name,
-so that when I test this tomorrow, I expect to get away with modifying
-only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the
-university servers.</p>
+<p>I have not yet found time to implement a test for this in my file
+system test code, but believe having working hard links is useful to
+avoid surprised unix programs. Not as useful as working file locking
+and symlinks, which are required to get a working desktop, but useful
+nevertheless. :)</p>
-<p>My goal is to get the clients to have no hardcoded settings and
-fetch all their initial setup during installation and first boot, to
-allow them to be inserted also into environments where the default
-setup in Debian Edu has been changed or as with the university, where
-the environment is different but provides the protocols Debian Edu
-uses.</p>
+<p>The latest version of the file system test code is available via
+git from
+<a href="http://github.com/gebi/fs-test">http://github.com/gebi/fs-test</a></p>
</description>
</item>
<item>
- <title>Autodetecting Client setup for roaming workstations in Debian Edu</title>
- <link>http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html</link>
- <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html</guid>
- <pubDate>Sat, 7 Aug 2010 14:45:00 +0200</pubDate>
- <description>
-<p>A few days ago, I
-<a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">tried
-to install</a> a Roaming workation profile from Debian Edu/Squeeze
-while on the university network here at the University of Oslo, and
-noticed how much had to change to get it operational using the
-university infrastructure. It was fairly easy, but it occured to me
-that Debian Edu would improve a lot if I could get the client to
-connect without any changes at all, and thus let the client configure
-itself during installation and first boot to use the infrastructure
-around it. Now I am a huge step further along that road.</p>
+ <title>Sikkerhetsteateret på flyplassene fortsetter</title>
+ <link>http://people.skolelinux.org/pere/blog/Sikkerhetsteateret_p__flyplassene_fortsetter.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Sikkerhetsteateret_p__flyplassene_fortsetter.html</guid>
+ <pubDate>Sat, 28 Aug 2010 10:40:00 +0200</pubDate>
+ <description><p>Jeg skrev for et halvt år siden hvordan
+<a href="http://people.skolelinux.org/pere/blog/Sikkerhet__teater__og_hvordan_gj__re_verden_sikrere.html">samfunnet
+kaster bort ressurser på sikkerhetstiltak som ikke fungerer</a>. Kom
+nettopp over en
+<a href="http://www.askthepilot.com/essays-and-stories/terrorism-tweezers-and-terminal-madness-an-essay-on-security/">historie
+fra en pilot fra USA</a> som kommenterer det samme. Jeg mistenker det
+kun er uvitenhet og autoritetstro som gjør at så få protesterer. Har
+veldig sans for piloten omtalt i <a
+href="http://www.aftenposten.no/nyheter/iriks/article2057501.ece">Aftenposten</a> 2007-10-23,
+og skulle ønske flere rettet oppmerksomhet mot problemet. Det gir
+ikke meg trygghetsfølelse på flyplassene når jeg ser at
+flyplassadministrasjonen kaster bort folk, penger og tid på tull i
+stedet for ting som bidrar til reell økning av sikkerheten. Det
+forteller meg jo at vurderingsevnen til de som burde bidra til økt
+sikkerhet er svært sviktende, noe som ikke taler godt for de andre
+tiltakene.</p>
+
+<p>Mon tro hva som skjer hvis det fantes en enkel brosjyre å skrive ut
+fra Internet som forklarte hva som er galt med sikkerhetsopplegget på
+flyplassene, og folk skrev ut og la en bunke på flyplassene når de
+passerte. Kanskje det ville fått flere til å få øynene opp for
+problemet.</p>
+
+<p>Personlig synes jeg flyopplevelsen er blitt så avskyelig at jeg
+forsøker å klare meg med tog, bil og båt for å slippe ubehaget. Det
+er dog noe vanskelig i det langstrakte Norge og for å kunne besøke de
+delene av verden jeg ønsker å nå. Mistenker at flere har det slik, og
+at dette går ut over inntjeningen til flyselskapene. Det er antagelig
+en god ting sett fra et miljøperspektiv, men det er en annen sak.</p>
+</description>
+ </item>
+
+ <item>
+ <title>Skolelinux i Osloskolen</title>
+ <link>http://people.skolelinux.org/pere/blog/Skolelinux_i_Osloskolen.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Skolelinux_i_Osloskolen.html</guid>
+ <pubDate>Thu, 26 Aug 2010 22:25:00 +0200</pubDate>
+ <description><p>Denne høsten skal endelig alle Osloskolene få mulighet til å bruke
+<a href="http://www.skolelinux.org/">Skolelinux</a>. Ny IT-løsning
+har vært rullet ut i noen måneder nå, og så vidt jeg fikk vite før
+sommeren skulle alle skoler ha nytt opplegg på plass før oppstart nå i
+høst. På alle skolene skal en kunne velge ved installasjon om en skal
+ha Windows eller Skolelinux på maskinene, og en kan i tillegg
+PXE-boote maskinene over nett som tynne klienter eller diskløse
+arbeidsstasjoner. Jeg er spent på hvor mange skoler som velger å ta i
+bruk Skolelinux, og gleder meg til å se hvordan dette utvikler seg.
+Løsningen leveres av
+<a href="http://www.logica.no/">Logica</a> med
+<a href="http://www.slxdrift.no/">Skolelinux Drift AS</a> som
+underleverandør, og jeg har vært involvert i utviklingen av løsningen
+via Skolelinux Drift AS siden prosjektet starter. Jeg synes det er
+fantastisk at Skolelinux er kommet så langt siden vi startet i 2001 at
+alle elevene i Osloskolene nå skal få mulighet til å bruke
+løsningen. Jeg håper de vil sette pris på alle de
+<a href="http://www.skolelinux.no/linux-signpost/">fantastiske
+brukerprogrammene</a> som er tilgjengelig i Skolelinux.</p>
+</description>
+ </item>
+
+ <item>
+ <title>Broken umask handling with sshfs</title>
+ <link>http://people.skolelinux.org/pere/blog/Broken_umask_handling_with_sshfs.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Broken_umask_handling_with_sshfs.html</guid>
+ <pubDate>Thu, 26 Aug 2010 13:30:00 +0200</pubDate>
+ <description><p>My file system sematics program
+<a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">presented
+a few days ago</a> is very useful to verify that a file system can
+work as a unix home directory,and today I had to extend it a bit. I'm
+looking into alternatives for home directory access here at the
+University of Oslo, and one of the options is sshfs. My friend
+Finn-Arne mentioned a while back that they had used sshfs with Debian
+Edu, but stopped because of problems. I asked today what the problems
+where, and he mentioned that sshfs failed to handle umask properly.
+Trying to detect the problem I wrote this addition to my fs testing
+script:</p>
-<p>With our current squeeze-test packages, I can select the roaming
-workstation profile and get a working laptop connecting to the
-university LDAP server for user and group and our active directory
-servers for Kerberos authentication. All this without any
-configuration at all during installation. My users home directory got
-a bookmark in the KDE menu to mount it via SMB, with the correct URL.
-In short, openldap and sssd is correctly configured. In addition to
-this, the client look for http://wpad/wpad.dat to configure a web
-proxy, and when it fail to find it no proxy settings are stored in
-/etc/environment and /etc/apt/apt.conf. Iceweasel and KDE is
-configured to look for the same wpad configuration and also do not use
-a proxy when at the university network. If the machine is moved to a
-network with such wpad setup, it would automatically use it when DHCP
-gave it a IP address.</p>
+<pre>
+mode_t touch_get_mode(const char *name, mode_t mode) {
+ mode_t retval = 0;
+ int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, mode);
+ if (-1 != fd) {
+ unlink(name);
+ struct stat statbuf;
+ if (-1 != fstat(fd, &statbuf)) {
+ retval = statbuf.st_mode & 0x1ff;
+ }
+ close(fd);
+ }
+ return retval;
+}
-<p>The LDAP server is located using DNS, by first looking for the DNS
-entry ldap.$domain. If this do not exist, it look for the
-_ldap._tcp.$domain SRV records and use the first one as the LDAP
-server. Next, it connects to the LDAP server and search all
-namingContexts entries for posixAccount or posixGroup objects, and
-pick the first one as the LDAP base. For Kerberos, a similar
-algorithm is used to locate the LDAP server, and the realm is the
-uppercase version of $domain.</p>
+/* Try to detect problem discovered using sshfs */
+int test_umask(void) {
+ printf("info: testing umask effect on file creation\n");
-<p>So, what is not working, you might ask. SMB mounting my home
-directory do not work. No idea why, but suspected the incorrect
-Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
-the cause. These are not properly configured during installation, and
-had to be hand-edited to get the correct Kerberos realm and server,
-but SMB mounting still do not work. :(</p>
+ mode_t orig_umask = umask(000);
+ mode_t newmode;
+ if (0666 != (newmode = touch_get_mode("foobar", 0666))) {
+ printf(" error: Wrong file mode %o when creating using mode 666 and umask 000\n",
+ newmode);
+ }
+ umask(007);
+ if (0660 != (newmode = touch_get_mode("foobar", 0666))) {
+ printf(" error: Wrong file mode %o when creating using mode 666 and umask 007\n",
+ newmode);
+ }
-<p>With this automatic configuration in place, I expect a Debian Edu
-roaming profile installation would be able to automatically detect and
-connect to any site using LDAP and Kerberos for NSS directory and PAM
-authentication. It should also work out of the box in a Active
-Directory environment providing posixAccount and posixGroup objects
-with UID and GID values.</p>
+ umask (orig_umask);
+ return 0;
+}
+
+int main(int argc, char **argv) {
+ [...]
+ test_umask();
+ return 0;
+}
+</pre>
+
+<p>Sure enough. On NFS to a netapp, I get this result:</p>
+
+<pre>
+Testing POSIX/Unix sematics on file system
+info: testing symlink creation
+info: testing subdirectory creation
+info: testing fcntl locking
+ Read-locking 1 byte from 1073741824
+ Read-locking 510 byte from 1073741826
+ Unlocking 1 byte from 1073741824
+ Write-locking 1 byte from 1073741824
+ Write-locking 510 byte from 1073741826
+ Unlocking 2 byte from 1073741824
+info: testing umask effect on file creation
+</pre>
+
+<p>When mounting the same directory using sshfs, I get this
+result:</p>
+
+<pre>
+Testing POSIX/Unix sematics on file system
+info: testing symlink creation
+info: testing subdirectory creation
+info: testing fcntl locking
+ Read-locking 1 byte from 1073741824
+ Read-locking 510 byte from 1073741826
+ Unlocking 1 byte from 1073741824
+ Write-locking 1 byte from 1073741824
+ Write-locking 510 byte from 1073741826
+ Unlocking 2 byte from 1073741824
+info: testing umask effect on file creation
+ error: Wrong file mode 644 when creating using mode 666 and umask 000
+ error: Wrong file mode 640 when creating using mode 666 and umask 007
+</pre>
+
+<p>So, I can conclude that sshfs is better than smb to a Netapp or a
+Windows server, but not good enough to be used as a home
+directory.</p>
+
+<p>Update 2010-08-26: Reported the issue in
+<a href="http://bugs.debian.org/594498">BTS report #594498</a></p>
+
+<p>Update 2010-08-27: Michael Gebetsroither report that he found the
+script so useful that he created a GIT repository and stored it in
+<a href="http://github.com/gebi/fs-test">http://github.com/gebi/fs-test</a>.</p>
+</description>
+ </item>
+
+ <item>
+ <title>Elektronisk stemmegiving er ikke til å stole på - heller ikke i Norge</title>
+ <link>http://people.skolelinux.org/pere/blog/Elektronisk_stemmegiving_er_ikke_til___stole_p____heller_ikke_i_Norge.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Elektronisk_stemmegiving_er_ikke_til___stole_p____heller_ikke_i_Norge.html</guid>
+ <pubDate>Mon, 23 Aug 2010 19:30:00 +0200</pubDate>
+ <description><p>I Norge pågår en prosess for å
+<a href="http://www.e-valg.dep.no/">innføre elektronisk
+stemmegiving</a> ved kommune- og stortingsvalg. Dette skal
+introduseres i 2011. Det er all grunn til å tro at valg i Norge ikke
+vil være til å stole på hvis dette blir gjennomført. Da det hele var
+oppe til høring i 2006 forfattet jeg
+<a href="http://www.nuug.no/dokumenter/valg-horing-2006-09.pdf">en
+høringsuttalelse fra NUUG</a> (og EFN som hengte seg på) som skisserte
+hvilke punkter som må oppfylles for at en skal kunne stole på et valg,
+og elektronisk stemmegiving mangler flere av disse. Elektronisk
+stemmegiving er for alle praktiske formål å putte ens stemme i en sort
+boks under andres kontroll, og satse på at de som har kontroll med
+boksen er til å stole på - uten at en har mulighet til å verifisere
+dette selv. Det er ikke slik en gjennomfører demokratiske valg.</p>
+
+<p>Da problemet er fundamentalt med hvordan elektronisk stemmegiving
+må fungere for at også ikke-krypografer skal kunne delta, har det vært
+mange rapporter om hvordan elektronisk stemmegiving har sviktet i land
+etter land. En
+<a href="http://wiki.nuug.no/uttalelser/2006-elektronisk-stemmegiving">liten
+samling referanser</a> finnes på NUUGs wiki. Den siste er fra India,
+der valgkomisjonen har valgt
+<a href="http://www.freedom-to-tinker.com/blog/jhalderm/electronic-voting-researcher-arrested-over-anonymous-source">å
+pusse politiet på en forsker</a> som har dokumentert svakheter i
+valgsystemet.</p>
+
+<p>Her i Norge har en valgt en annen tilnærming, der en forsøker seg
+med teknobabbel for å få befolkningen til å tro at dette skal bli
+sikkert. Husk, elektronisk stemmegiving underminerer de demokratiske
+valgene i Norge, og bør ikke innføres.</p>
+
+<p>Den offentlige diskusjonen blir litt vanskelig av at media har
+valgt å kalle dette "evalg", som kan sies å både gjelde elektronisk
+opptelling av valget som Norge har gjort siden 60-tallet og som er en
+svært god ide, og elektronisk opptelling som er en svært dårlig ide.
+Diskusjonen gir ikke mening hvis en skal diskutere om en er for eller
+mot "evalg", og jeg forsøker derfor å være klar på at jeg snakker om
+elektronisk stemmegiving og unngå begrepet "evalg".</p>
+</description>
+ </item>
+
+ <item>
+ <title>Robot, reis deg...</title>
+ <link>http://people.skolelinux.org/pere/blog/Robot__reis_deg___.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Robot__reis_deg___.html</guid>
+ <pubDate>Sat, 21 Aug 2010 22:10:00 +0200</pubDate>
+ <description><p>I dag fikk jeg endelig tittet litt på mine nyinnkjøpte roboter, og
+har brukt noen timer til å google etter interessante referanser og
+aktuell kildekode for bruk på Linux. Det mest lovende så langt er
+<a href="http://ispykee.toyz.org/">ispykee</a>, som har en
+BSD-lisensiert linux-daemon som står som mellomledd mellom roboter på
+lokalnettet og en sentral tjeneste der en iPhone kan koble seg opp for
+å fjernstyre roboten. Linux-daemonen implementerer deler av
+protokollen som roboten forstår. Etter å ha knotet litt med å oppnå
+kontakt med roboten (den oppretter et eget ad-hoc wifi-nett, så jeg
+måtte gå av mitt vanlige nett for å få kontakt), og kommet frem til at
+den lytter på IP-port 9000 og 9001, gikk jeg i gang med å finne ut
+hvordan jeg kunne snakke med roboten vha. disse portene. Robotbiten
+av protokollen er publisert av produsenten med GPL-lisens, slik at det
+er mulig å se hvordan protokollen fungerer. Det finnes en java-klient
+for Android som så ganske snasen ut, men fant ingen kildekode for
+denne. Derimot hadde iphone-løsningen kildekode, så jeg tok
+utgangspunkt i den.</p>
+
+<p>Daemonen ville i utgangspunktet forsøke å kontakte den sentrale
+tjenesten som iphone-programmet kobler seg til. Jeg skrev dette om
+til i stedet å sette opp en nettverkstjeneste på min lokale maskin,
+som jeg kan koble meg opp til med telnet og gi kommandoer til roboten
+(act, forward, right, left, etc). Det involverte i praksis å bytte ut
+socket()/connect() med socket()/bind()/listen()/accept() for å gjøre
+klienten om til en tjener.</p>
+
+<p>Mens jeg har forsøkt å få roboten til å bevege seg har min samboer
+skrudd sammen resten av roboten for å få montert kamera og plastpynten
+(armer, plastfiber for lys). Nå er det hele montert, og roboten er
+klar til bruk. Må få flyttet den over til mitt vanlige trådløsnett
+før det blir praktisk, men de bitene av protokollen er ikke
+implementert i ispykee-daemonen, så der må jeg enten få tak i en mac
+eller en windows-maskin, eller implementere det selv.</p>
+
+<p>Vi var tre som kjøpte slike roboter, og vi har blitt enige om å
+samle notater og referanser på <a
+href="http://wiki.nuug.no/grupper/robot/">NUUGs wiki</a>. Ta en titt
+der hvis du er nysgjerrig.</p>
+</description>
+ </item>
+
+ <item>
+ <title>2 Spykee-roboter i hus, nå skal det lekes</title>
+ <link>http://people.skolelinux.org/pere/blog/2_Spykee_roboter_i_hus__n__skal_det_lekes.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/2_Spykee_roboter_i_hus__n__skal_det_lekes.html</guid>
+ <pubDate>Wed, 18 Aug 2010 13:30:00 +0200</pubDate>
+ <description><p>Jeg kjøpte nettopp to
+<a href="http://www.spykee-robot.com/">Spykee</a>-roboter, for test og
+leking. Kjøpte to da det var så billige, og gir meg mulighet til å
+eksperimentere uten å være veldig redd for å ødelegge alt ved å bytte
+ut firmware og slikt. Oppdaget at lekebutikken på Bryn senter hadde
+en liten stabel på lager som de ikke hadde klart å selge ut etter
+fjorårets juleinnkjøp, og var villig til å selge for en femtedel av
+vanlig pris. Jeg, Ronny og Jarle har skaffet oss restbeholdningen, og
+det blir morsomt å se hva vi får ut av dette.</p>
+
+<p>Roboten har belter styrt av to motorer, kamera, høytaler, mikrofon
+og wifi-tilkobling. Det hele styrt av en GPL-lisensiert databoks som
+jeg mistenker kjører linux. Firmware-kildekoden ble visst publisert i
+mai. Eneste utfordringen er at kontroller-programvaren kun finnes til
+Windows, men det må en kunne jobbe seg rundt når vi har kildekoden til
+firmwaren. :)</p>
+
+<ul>
+<li><a href="http://en.wikipedia.org/wiki/Spykee">Wikipedia-oppføring</a></li>
+<li><a href="http://www.spykeeworld.com/spykee/US/freeSoftware.html">Nedlasting av firmware-kilden</a></li>
+<li><a href="http://wiki.nuug.no/grupper/robot">prosjektwiki hos NUUG</a></li>
+</ul>
+</description>
+ </item>
+
+ <item>
+ <title>Rob Weir: How to Crush Dissent</title>
+ <link>http://people.skolelinux.org/pere/blog/Rob_Weir__How_to_Crush_Dissent.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Rob_Weir__How_to_Crush_Dissent.html</guid>
+ <pubDate>Sun, 15 Aug 2010 22:20:00 +0200</pubDate>
+ <description><p>I found the notes from Rob Weir on
+<a href="http://feedproxy.google.com/~r/robweir/antic-atom/~3/VGb23-kta8c/how-to-crush-dissent.html">how
+to crush dissent</a> matching my own thoughts on the matter quite
+well. Highly recommended for those wondering which road our society
+should go down. In my view we have been heading the wrong way for a
+long time.</p>
+</description>
+ </item>
+
+ <item>
+ <title>No hardcoded config on Debian Edu clients</title>
+ <link>http://people.skolelinux.org/pere/blog/No_hardcoded_config_on_Debian_Edu_clients.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/No_hardcoded_config_on_Debian_Edu_clients.html</guid>
+ <pubDate>Mon, 9 Aug 2010 20:15:00 +0200</pubDate>
+ <description><p>As reported earlier, the last few days I have looked at how Debian
+Edu clients are configured, and tried to get rid of all hardcoded
+configuration settings on the clients. I believe the work to be
+mostly done, and the clients seem to work just fine with dynamically
+generated configuration.</p>
+
+<p>What is the point, you might ask? The point is to allow a Debian
+Edu desktop to integrate into an existing network infrastructure
+without any manual configuration.</p>
+
+<p>This is what happens when installing a Debian Edu client here at
+the University of Oslo using PXE. With the PXE installation, I am
+asked for language (Norwegian Bokmål), locality (Norway) and keyboard
+layout (no-latin1), Debian Edu profile (Roaming Workstation), if I
+accept to reformat the hard drive (yes), if I want to submit info to
+popcon.debian.org (no) and root password (secret). After answering
+these questions, the installer goes ahead and does its thing, and
+after around 50 minutes it is done. I press enter to finish the
+installation, and the machine reboots into KDE. When the machine is
+ready and kdm asks for login information, I enter my university
+username and password, am told by kdm that a local home directory has
+been created and that I must log in again, and finally log in with the
+same username and password to the KDE 4.4 desktop. At no point during
+this process did it ask for university specific settings, and all the
+required configuration was dynamically detected using information
+fetched via DHCP and DNS. The roaming workstation is now ready for
+use.</p>
+
+<p>How was this done, you might wonder? First of all, here is the
+list of things that need to be configured on the client to get it
+working properly out of the box:</p>
+
+<ul>
+<li>IP address/netmask and DNS server.</li>
+<li>Web proxy URL.</li>
+<li>LDAP server for NSS directory information (user, group, etc).</li>
+<li>Kerberos server for PAM password checking.</li>
+<li>SMB mount point to access the network home directory. (*)</li>
+<li>Central syslog server to send syslog messages to. (*)</li>
+<li>Sitesummary collector URL to submit info to central server. (*)</li>
+</ul>
+
+<p>(Hm, did I forget anything? Let me knew if I did.)</p>
+
+<p>The points marked (*) are not required to be able to use the
+machine, but needed to provide central storage and allowing system
+administrators to track their machines. Since yesterday, everything
+but the sitesummary collector URL is dynamically discovered at boot
+and installation time in the svn version of Debian Edu.</p>
+
+<p>The IP and DNS setup is fetched during boot using DHCP as usual.
+When a DHCP update arrives, the proxy setup is updated by looking for
+http://wpat/wpad.dat and using the content of this WPAD file to
+configure the http and ftp proxy in /etc/environment and
+/etc/apt/apt.conf. I decided to update the proxy setup using a DHCP
+hook to ensure that the client stops using the Debian Edu proxy when
+it is moved outside the Debian Edu network, and instead uses any local
+proxy present on the new network when it moves around.</p>
+
+<p>The DNS names of the LDAP, Kerberos and syslog server and related
+configuration are generated using DNS information at boot. First the
+installer looks for a host named ldap in the current DNS domain. If
+not found, it looks for _ldap._tcp SRV records in DNS instead. If an
+LDAP server is found, its root DSE entry is requested and the
+attributes namingContexts and defaultNamingContext are used to
+determine which LDAP base to use for NSS. If there are several
+namingContexts attibutes and the defaultNamingContext is present, that
+LDAP subtree is used as the base. If defaultNamingContext is missing,
+the subtrees listed as namingContexts are searched in sequence for any
+object with class posixAccount or posixGroup, and the first one with
+such an object is used as the LDAP base. For Kerberos, a similar
+search is done by first looking for a host named kerberos, and then
+for the _kerberos._tcp SRV record. I've been unable to find a way to
+look up the Kerberos realm, so for this the upper case string of the
+current DNS domain is used.</p>
+
+<p>For the syslog server, the hosts syslog and loghost are searched
+for, and the _syslog._udp SRV record is consulted if no such host is
+found. This algorithm works for both Debian Edu and the University of
+Oslo. A similar strategy would work for locating the sitesummary
+server, but have not been implemented yet. I decided to fetch and
+save these settings during installation, to make sure moving to a
+different network does not change the set of users being allowed to
+log in nor the passwords required to log in. Usernames and passwords
+will be cached by sssd when the user logs in on the Debian Edu
+network, and will not change as the laptop move around. For a
+non-roaming machine, there is no caching, but given that it is
+supposed to stay in place it should not matter much. Perhaps we
+should switch those to use sssd too?</p>
+
+<p>The user's SMB mount point for the network home directory is
+located when the user logs in for the first time. The LDAP server is
+consulted to look for the user's LDAP object and the sambaHomePath
+attribute is used if found. If it isn't found, the home directory
+path fetched from NSS is used instead. Assuming the path is of the
+form /site/server/directory/username, the second part is looked up in
+DNS and used to generate a SMB URL of the form
+smb://server.domain/username. This algorithm works for both Debian
+edu and the University of Oslo. Perhaps there are better attributes
+to use or a better algorithm that works for more sites, but this will
+do for now. :)</p>
+
+<p>This work should make it easier to integrate the Debian Edu clients
+into any LDAP/Kerberos infrastructure, and make the current setup even
+more flexible than before. I suspect it will also work for thin
+client servers, allowing one to easily set up LTSP and hook it into a
+existing network infrastructure, but I have not had time to test this
+yet.</p>
<p>If you want to help out with implementing these things for Debian
Edu, please contact us on debian-edu@lists.debian.org.</p>
+
+<p>Update 2010-08-09: Simon Farnsworth gave me a heads-up on how to
+detect Kerberos realm from DNS, by looking for _kerberos TXT entries
+before falling back to the upper case DNS domain name. Will have to
+implement it for Debian Edu. :)</p>
</description>
</item>
<link>http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html</link>
<guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html</guid>
<pubDate>Sun, 8 Aug 2010 21:20:00 +0200</pubDate>
- <description>
-<p>A few years ago, I was involved in a project planning to use
+ <description><p>A few years ago, I was involved in a project planning to use
Windows file servers as home directory servers for Debian
Edu/Skolelinux machines. This was thought to be no problem, as the
access would be through the SMB network file system protocol, and we
#define _GNU_SOURCE /* for asprintf() */
-#include <errno.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <string.h>
-#include <stdlib.h>
-#include <sys/file.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <unistd.h>
+#include &lt;errno.h>
+#include &lt;fcntl.h>
+#include &lt;stdio.h>
+#include &lt;string.h>
+#include &lt;stdlib.h>
+#include &lt;sys/file.h>
+#include &lt;sys/stat.h>
+#include &lt;sys/types.h>
+#include &lt;unistd.h>
#ifdef TEST_SQLITE
/*
* Test sqlite open, as done by gcompris require the libsqlite3-dev
* package and linking with -lsqlite3. A more low level test is
* below.
- * See also <URL: http://www.sqlite.org./faq.html#q5 >.
+ * See also &lt;URL: http://www.sqlite.org./faq.html#q5 >.
*/
-#include <sqlite3.h>
+#include &lt;sqlite3.h>
#define CREATE_TABLE_USERS \
"CREATE TABLE users (user_id INT UNIQUE, login TEXT, lastname TEXT, firstname TEXT, birthdate TEXT, class_id INT ); "
int test_sqlite_open(void) {
* work with ext3, but not with cifs server on Windows 2003. This is
* done in the sqlite3 library.
* See also
- * <URL:http://www.cygwin.com/ml/cygwin/2001-08/msg00854.html> and the
+ * &lt;URL:http://www.cygwin.com/ml/cygwin/2001-08/msg00854.html> and the
* POSIX specification
- * <URL:http://www.opengroup.org/onlinepubs/009695399/functions/fcntl.html>.
+ * &lt;URL:http://www.opengroup.org/onlinepubs/009695399/functions/fcntl.html>.
*/
int test_gcompris_locking(void) {
struct flock fl;
char *dirs[LEVELS];
int level;
printf("info: testing subdirectory creation\n");
- for (level = 0; level < LEVELS; level++) {
+ for (level = 0; level &lt; LEVELS; level++) {
char *newpath = NULL;
if (-1 == mkdir(path, 0777)) {
printf(" error: Unable to create directory '%s': %s\n",
<p>Anyway, here is a nice tool for your tool box, might you never need
it. :)</p>
+
+<p>Update 2010-08-27: Michael Gebetsroither report that he found the
+script so useful that he created a GIT repository and stored it in
+<a href="http://github.com/gebi/fs-test">http://github.com/gebi/fs-test</a>.</p>
+</description>
+ </item>
+
+ <item>
+ <title>Autodetecting Client setup for roaming workstations in Debian Edu</title>
+ <link>http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html</guid>
+ <pubDate>Sat, 7 Aug 2010 14:45:00 +0200</pubDate>
+ <description><p>A few days ago, I
+<a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">tried
+to install</a> a Roaming workation profile from Debian Edu/Squeeze
+while on the university network here at the University of Oslo, and
+noticed how much had to change to get it operational using the
+university infrastructure. It was fairly easy, but it occured to me
+that Debian Edu would improve a lot if I could get the client to
+connect without any changes at all, and thus let the client configure
+itself during installation and first boot to use the infrastructure
+around it. Now I am a huge step further along that road.</p>
+
+<p>With our current squeeze-test packages, I can select the roaming
+workstation profile and get a working laptop connecting to the
+university LDAP server for user and group and our active directory
+servers for Kerberos authentication. All this without any
+configuration at all during installation. My users home directory got
+a bookmark in the KDE menu to mount it via SMB, with the correct URL.
+In short, openldap and sssd is correctly configured. In addition to
+this, the client look for http://wpad/wpad.dat to configure a web
+proxy, and when it fail to find it no proxy settings are stored in
+/etc/environment and /etc/apt/apt.conf. Iceweasel and KDE is
+configured to look for the same wpad configuration and also do not use
+a proxy when at the university network. If the machine is moved to a
+network with such wpad setup, it would automatically use it when DHCP
+gave it a IP address.</p>
+
+<p>The LDAP server is located using DNS, by first looking for the DNS
+entry ldap.$domain. If this do not exist, it look for the
+_ldap._tcp.$domain SRV records and use the first one as the LDAP
+server. Next, it connects to the LDAP server and search all
+namingContexts entries for posixAccount or posixGroup objects, and
+pick the first one as the LDAP base. For Kerberos, a similar
+algorithm is used to locate the LDAP server, and the realm is the
+uppercase version of $domain.</p>
+
+<p>So, what is not working, you might ask. SMB mounting my home
+directory do not work. No idea why, but suspected the incorrect
+Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
+the cause. These are not properly configured during installation, and
+had to be hand-edited to get the correct Kerberos realm and server,
+but SMB mounting still do not work. :(</p>
+
+<p>With this automatic configuration in place, I expect a Debian Edu
+roaming profile installation would be able to automatically detect and
+connect to any site using LDAP and Kerberos for NSS directory and PAM
+authentication. It should also work out of the box in a Active
+Directory environment providing posixAccount and posixGroup objects
+with UID and GID values.</p>
+
+<p>If you want to help out with implementing these things for Debian
+Edu, please contact us on debian-edu@lists.debian.org.</p>
+</description>
+ </item>
+
+ <item>
+ <title>Debian Edu roaming workstation - at the university of Oslo</title>
+ <link>http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html</link>
+ <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html</guid>
+ <pubDate>Tue, 3 Aug 2010 23:30:00 +0200</pubDate>
+ <description><p>The new roaming workstation profile in Debian Edu/Squeeze is fairly
+similar to the laptop setup am I working on using Ubuntu for the
+University of Oslo, and just for the heck of it, I tested today how
+hard it would be to integrate that profile into the university
+infrastructure. In this case, it is the university LDAP server,
+Active Directory Kerberos server and SMB mounting from the Netapp file
+servers.</p>
+
+<p>I was pleasantly surprised that the only three files needed to be
+changed (/etc/sssd/sssd.conf, /etc/ldap.conf and
+/etc/mklocaluser.d/20-debian-edu-config) and one file had to be added
+(/usr/share/perl5/Debian/Edu_Local.pm), to get the client working.
+Most of the changes were to get the client to use the university LDAP
+for NSS and Kerberos server for PAM, but one was to change a hard
+coded DNS domain name in the mklocaluser hook from .intern to
+.uio.no.</p>
+
+<p>This testing was so encouraging, that I went ahead and adjusted the
+Debian Edu scripts and setup in subversion to centralise the roaming
+workstation setup a bit more and avoid the hardcoded DNS domain name,
+so that when I test this tomorrow, I expect to get away with modifying
+only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the
+university servers.</p>
+
+<p>My goal is to get the clients to have no hardcoded settings and
+fetch all their initial setup during installation and first boot, to
+allow them to be inserted also into environments where the default
+setup in Debian Edu has been changed or as with the university, where
+the environment is different but provides the protocols Debian Edu
+uses.</p>
</description>
</item>
projects / homepage.git / blobdiff