Petter Reinholdtsen - Entries from May 2010

Parallellized boot seem to hold up well in Debian/testing

Thu, 27 May 2010 23:55:00 +0200

A few days ago, parallel booting was enabled in Debian/testing. +The feature seem to hold up pretty well, but three fairly serious +issues are known and should be solved: + +

The wicd package seen to +break NFS mounting and +network setup when +parallel booting is enabled. No idea why, but the wicd maintainer +seem to be on the case.
The nvidia X driver seem to +have a race condition +triggered more easily when parallel booting is in effect. The +maintainer is on the case.
The sysv-rc package fail to properly enable dependency based boot +sequencing (the shutdown is broken) when old file-rc users +try to switch back to +sysv-rc. One way to solve it would be for file-rc to create +/etc/init.d/.legacy-bootordering, and another is to try to make +sysv-rc more robust. Will investigate some more and probably upload a +workaround in sysv-rc to help those trying to move from file-rc to +sysv-rc get a working shutdown.

+ +

All in all not many surprising issues, and all of them seem +solvable before Squeeze is released. In addition to these there are +some packages with bugs in their dependencies and run level settings, +which I expect will be fixed in a reasonable time span.

+ +

If you report any problems with dependencies in init.d scripts to +the BTS, please usertag the report to get it to show up at +the +list of usertagged bugs related to this.

+ +

Update: Correct bug number to file-rc issue.

More flexible firmware handling in debian-installer

Sat, 22 May 2010 21:30:00 +0200

After a long break from debian-installer development, I finally +found time today to return to the project. Having to spend less time +working dependency based boot in debian, as it is almost complete now, +definitely helped freeing some time.

+ +

A while back, I ran into a problem while working on Debian Edu. We +include some firmware packages on the Debian Edu CDs, those needed to +get disk and network controllers working. Without having these +firmware packages available during installation, it is impossible to +install Debian Edu on the given machine, and because our target group +are non-technical people, asking them to provide firmware packages on +an external medium is a support pain. Initially, I expected it to be +enough to include the firmware packages on the CD to get +debian-installer to find and use them. This proved to be wrong. +Next, I hoped it was enough to symlink the relevant firmware packages +to some useful location on the CD (tried /cdrom/ and +/cdrom/firmware/). This also proved to not work, and at this point I +found time to look at the debian-installer code to figure out what was +going to work.

+ +

The firmware loading code is in the hw-detect package, and a closer +look revealed that it would only look for firmware packages outside +the installation media, so the CD was never checked for firmware +packages. It would only check USB sticks, floppies and other +"external" media devices. Today I changed it to also look in the +/cdrom/firmware/ directory on the mounted CD or DVD, which should +solve the problem I ran into with Debian edu. I also changed it to +look in /firmware/, to make sure the installer also find firmware +provided in the initrd when booting the installer via PXE, to allow us +to provide the same feature in the PXE setup included in Debian +Edu.

+ +

To make sure firmware deb packages with a license questions are not +activated without asking if the license is accepted, I extended +hw-detect to look for preinst scripts in the firmware packages, and +run these before activating the firmware during installation. The +license question is asked using debconf in the preinst, so this should +solve the issue for the firmware packages I have looked at so far.

+ +

If you want to discuss the details of these features, please +contact us on debian-boot@lists.debian.org.

Magnetstripeinnhold i billetter fra Flytoget og Hurtigruten

Fri, 21 May 2010 16:00:00 +0200

For en stund tilbake kjÃ¸pte jeg en magnetkortleser for Ã¥ kunne +titte pÃ¥ hva som er skrevet inn pÃ¥ magnetstripene til ulike kort. Har +ikke hatt tid til Ã¥ analysere mange kort sÃ¥ langt, men tenkte jeg +skulle dele innholdet pÃ¥ to kort med mine lesere.

+ +

For noen dager siden tok jeg flyet til Harstad og Hurtigruten til +Bergen. Flytoget fra Oslo S til flyplassen ga meg en billett med +magnetstripe. PÃ¥trykket finner jeg fÃ¸lgende informasjon:

+ +

+Flytoget Airport Express Train
+
+Fra - Til        : Oslo Sentralstasjon
+Kategori         : Voksen
+Pris             : Nok 170,00
+Herav mva. 8,00% : NOK 12,59
+Betaling         : Kontant
+Til - Fra        : Oslo Lufthavn
+Utstedt:         : 08.05.10
+Gyldig Fra-Til   : 08.05.10-07.11.10
+Billetttype      : Enkeltbillett
+
+102-1015-100508-48382-01-08
+

+ +

PÃ¥ selve magnetstripen er innholdet +;E?+900120011=23250996541068112619257138248441708433322932704083389389062603279671261502492655?. +Aner ikke hva innholdet representerer, og det er lite overlapp mellom +det jeg ser trykket pÃ¥ billetten og det jeg ser av tegn i +magnetstripen. HÃ¥per det betyr at de bruker kryptografiske metoder +for Ã¥ gjÃ¸re det vanskelig Ã¥ forfalske billetter.

+ +

Den andre billetten er fra Hurtigruten, der jeg mistenker at +strekkoden pÃ¥ fronten er mer brukt enn magnetstripen (det var i hvert +fall den biten vi stakk inn i dÃ¸rlÃ¥sen).

+ +

PÃ¥trykket forsiden er fÃ¸lgende:

+ +

+Romnummer 727
+Hurtigruten
+Midnatsol
+Reinholdtsen
+Petter
+Bookingno: SAX69   0742193
+Harstad-Bergen
+Dep: 09.05.2010 Arr: 12.05.2010
+Lugar fra RisÃ¸yhamn
+Kost: FRO=4
+

+ +

PÃ¥ selve magnetstripen er innholdet +;1316010007421930=00000000000000000000?+E?. Heller ikke her +ser jeg mye korrespondanse mellom pÃ¥trykk og magnetstripe.

Pieces of the roaming laptop puzzle in Debian

Wed, 19 May 2010 19:00:00 +0200

Today, the last piece of the puzzle for roaming laptops in Debian +Edu finally entered the Debian archive. Today, the new +libpam-mklocaluser +package was accepted. Two days ago, two other pieces was accepted +into unstable. The +pam-python +package needed by libpam-mklocaluser, and the +sssd package +passed NEW on Monday. In addition, the +libpam-ccreds +package we need is in experimental (version 10-4) since Saturday, and +hopefully will be moved to unstable soon.

+ +

This collection of packages allow for two different setups for +roaming laptops. The traditional setup would be using libpam-ccreds, +nscd and libpam-mklocaluser with LDAP or Kerberos authentication, +which should work out of the box if the configuration changes proposed +for nscd in BTS report +#485282 is implemented. The alternative setup is to use sssd with +libpam-mklocaluser to connect to LDAP or Kerberos and let sssd take +care of the caching of passwords and group information.

+ +

I have so far been unable to get sssd to work with the LDAP server +at the University, but suspect the issue is some SSL/GnuTLS related +problem with the server certificate. I plan to update the Debian +package to version 1.2, which is scheduled for next week, and hope to +find time to make sure the next release will include both the +Debian/Ubuntu specific patches. Upstream is friendly and responsive, +and I am sure we will find a good solution.

+ +

The idea is to set up the roaming laptops to authenticate using +LDAP or Kerberos and create a local user with home directory in /home/ +when a usre in LDAP logs in via KDM or GDM for the first time, and +cache the password for offline checking, as well as caching group +memberhips and other relevant LDAP information. The +libpam-mklocaluser package was created to make sure the local home +directory is in /home/, instead of /site/server/directory/ which would +be the home directory if pam_mkhomedir was used. To avoid confusion +with support requests and configuration, we do not want local laptops +to have users in a path that is used for the same users home directory +on the home directory servers.

+ +

One annoying problem with gdm is that it do not show the PAM +message passed to the user from libpam-mklocaluser when the local user +is created. Instead gdm simply reject the login with some generic +message. The message is shown in kdm, ssh and login, so I guess it is +a bug in gdm. Have not investigated if there is some other message +type that can be used instead to get gdm to also show the message.

+ +

If you want to help out with implementing this for Debian Edu, +please contact us on debian-edu@lists.debian.org.

Parallellized boot is now the default in Debian/unstable

Fri, 14 May 2010 22:40:00 +0200

Since this evening, parallel booting is the default in +Debian/unstable for machines using dependency based boot sequencing. +Apparently the testing of concurrent booting has been wider than +expected, if I am to believe the +input +on debian-devel@, and I concluded a few days ago to move forward +with the feature this weekend, to give us some time to detect any +remaining problems before Squeeze is frozen. If serious problems are +detected, it is simple to change the default back to sequential boot. +The upload of the new sysvinit package also activate a new upstream +version.

+ +More information about +dependency +based boot sequencing is available from the Debian wiki. It is +currently possible to disable parallel booting when one run into +problems caused by it, by adding this line to /etc/default/rcS:

+ +

+CONCURRENCY=none
+

+ +

If you report any problems with dependencies in init.d scripts to +the BTS, please usertag the report to get it to show up at +the +list of usertagged bugs related to this.

Sitesummary tip: Listing MAC address of all clients

Fri, 14 May 2010 21:10:00 +0200

In the recent Debian Edu versions, the +sitesummary +system is used to keep track of the machines in the school +network. Each machine will automatically report its status to the +central server after boot and once per night. The network setup is +also reported, and using this information it is possible to get the +MAC address of all network interfaces in the machines. This is useful +to update the DHCP configuration.

+ +

To give some idea how to use sitesummary, here is a one-liner to +ist all MAC addresses of all machines reporting to sitesummary. Run +this on the collector host:

+ +

+perl -MSiteSummary -e 'for_all_hosts(sub { print join(" ", get_macaddresses(shift)), "\n"; });'
+

+ +

This will list all MAC addresses assosiated with all machine, one +line per machine and with space between the MAC addresses.

+ +

To allow system administrators easier job at adding static DHCP +addresses for hosts, it would be possible to extend this to fetch +machine information from sitesummary and update the DHCP and DNS +tables in LDAP using this information. Such tool is unfortunately not +written yet.

systemd, an interesting alternative to upstart

Thu, 13 May 2010 22:20:00 +0200

The last few days a new boot system called +systemd +has been +introduced + +to the free software world. I have not yet had time to play around +with it, but it seem to be a very interesting alternative to +upstart, and might prove to be +a good alternative for Debian when we are able to switch to an event +based boot system. Tollef is +in the process of getting +systemd into Debian, and I look forward to seeing how well it work. I +like the fact that systemd handles init.d scripts with dependency +information natively, allowing them to run in parallel where upstart +at the moment do not.

+ +

Unfortunately do systemd have the same problem as upstart regarding +platform support. It only work on recent Linux kernels, and also need +some new kernel features enabled to function properly. This means +kFreeBSD and Hurd ports of Debian will need a port or a different boot +system. Not sure how that will be handled if systemd proves to be the +way forward.

+ +

In the mean time, based on the +input +on debian-devel@ regarding parallel booting in Debian, I have +decided to enable full parallel booting as the default in Debian as +soon as possible (probably this weekend or early next week), to see if +there are any remaining serious bugs in the init.d dependencies. A +new version of the sysvinit package implementing this change is +already in experimental. If all go well, Squeeze will be released +with parallel booting enabled by default.

Parallellizing the boot in Debian Squeeze - ready for wider testing

Thu, 6 May 2010 23:25:00 +0200

These days, the init.d script dependencies in Squeeze are quite +complete, so complete that it is actually possible to run all the +init.d scripts in parallell based on these dependencies. If you want +to test your Squeeze system, make sure +dependency +based boot sequencing is enabled, and add this line to +/etc/default/rcS:

+ +

+CONCURRENCY=makefile
+

+ +

That is it. It will cause sysv-rc to use the startpar tool to run +scripts in parallel using the dependency information stored in +/etc/init.d/.depend.boot, /etc/init.d/.depend.start and +/etc/init.d/.depend.stop to order the scripts. Startpar is configured +to try to start the kdm and gdm scripts as early as possible, and will +start the facilities required by kdm or gdm as early as possible to +make this happen.

+ +

Give it a try, and see if you like the result. If some services +fail to start properly, it is most likely because they have incomplete +init.d script dependencies in their startup script (or some of their +dependent scripts have incomplete dependencies). Report bugs and get +the package maintainers to fix it. :)

+ +

Running scripts in parallel could be the default in Debian when we +manage to get the init.d script dependencies complete and correct. I +expect we will get there in Squeeze+1, if we get manage to test and +fix the remaining issues.

+ +

If you report any problems with dependencies in init.d scripts to +the BTS, please usertag the report to get it to show up at +the +list of usertagged bugs related to this.

Forcing new users to change their password on first login

Sun, 2 May 2010 13:40:00 +0200

One interesting feature in Active Directory, is the ability to + http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html + http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html + Sun, 2 May 2010 13:47:00 +0200 +

One interesting feature in Active Directory, is the ability to create a new user with an expired password, and thus force the user to change the password on the first login attempt.

@@ -69,6 +435,19 @@ sure only the user itself have the account password?

If you want to comment on or help out with implementing this for Debian Edu, please contact us on debian-edu@lists.debian.org.

+ +

Update 2010-05-02 17:20: Paul TÃ¶tterman tells me on IRC that the +shadow(8) page in Debian/testing now state that setting the date of +last password change to zero (0) will force the password to be changed +on the first login. This was not mentioned in the manual in Lenny, so +I did not notice this in my initial testing. I have tested it on +Squeeze, and 'chage -d 0 username' do work there. I have not +tested it on Lenny yet.

+ +

Update 2010-05-02-19:05: Jim Paris tells me via email that an +equivalent command to expire a password is 'passwd -e +username', which insert zero into the date of the last password +change.