-
One interesting feature in Active Directory, is the ability to
-create a new user with an expired password, and thus force the user to
-change the password on the first login attempt.
-
-
I'm not quite sure how to do that with the LDAP setup in Debian
-Edu, but did some initial testing with a local account. The account
-and password aging information is available in /etc/shadow, but
-unfortunately, it is not possible to specify an expiration time for
-passwords, only a maximum age for passwords.
-
-
A freshly created account (using adduser test) will have these
-settings in /etc/shadow:
-
-
-root@tjener:~# chage -l test
-Last password change : May 02, 2010
-Password expires : never
-Password inactive : never
-Account expires : never
-Minimum number of days between password change : 0
-Maximum number of days between password change : 99999
-Number of days of warning before password expires : 7
-root@tjener:~#
-
-
-
The only way I could come up with to create a user with an expired
-account, is to change the date of the last password change to the
-lowest value possible (January 1th 1970), and the maximum password age
-to the difference in days between that date and today. To make it
-simple, I went for 30 years (30 * 365 = 10950) and January 2th (to
-avoid testing if 0 is a valid value).
-
-
After using these commands to set it up, it seem to work as
-intended:
-
-
-root@tjener:~# chage -d 1 test; chage -M 10950 test
-root@tjener:~# chage -l test
-Last password change : Jan 02, 1970
-Password expires : never
-Password inactive : never
-Account expires : never
-Minimum number of days between password change : 0
-Maximum number of days between password change : 10950
-Number of days of warning before password expires : 7
-root@tjener:~#
-
-
-
So far I have tested this with ssh and console, and kdm (in
-Squeeze) login, and all ask for a new password before login in the
-user (with ssh, I was thrown out and had to log in again).
-
-
Perhaps we should set up something similar for Debian Edu, to make
-sure only the user itself have the account password?
-
-
If you want to comment on or help out with implementing this for
-Debian Edu, please contact us on debian-edu@lists.debian.org.
-
-
Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the
-shadow(8) page in Debian/testing now state that setting the date of
-last password change to zero (0) will force the password to be changed
-on the first login. This was not mentioned in the manual in Lenny, so
-I did not notice this in my initial testing. I have tested it on
-Squeeze, and 'chage -d 0 username' do work there. I have not
-tested it on Lenny yet.
-
-
Update 2010-05-02-19:05: Jim Paris tells me via email that an
-equivalent command to expire a password is 'passwd -e
-username', which insert zero into the date of the last password
-change.
+
A few days ago I had the mixed pleasure of bying a new digital
+camera, a Canon IXUS 130. It was instructive and very disturbing to
+be able to verify that also this camera producer have the nerve to
+specify how I can or can not use the videos produced with the camera.
+Even thought I was aware of the issue, the options with new cameras
+are limited and I ended up bying the camera anyway. What is the
+problem, you might ask? It is software patents, MPEG-4, H.264 and the
+MPEG-LA that is the problem, and our right to record our experiences
+without asking for permissions that is at risk.
+
+
On page 27 of the Danish instruction manual, this section is
+written:
+
+
+This product is licensed under AT&T patents for the MPEG-4 standard
+and may be used for encoding MPEG-4 compliant video and/or decoding
+MPEG-4 compliant video that was encoded only (1) for a personal and
+non-commercial purpose or (2) by a video provider licensed under the
+AT&T patents to provide MPEG-4 compliant video.
+
+No license is granted or implied for any other use for MPEG-4
+standard.
+
+
+
In short, the camera producer have chosen to use technology
+(MPEG-4/H.264) that is only provided if I used it for personal and
+non-commercial purposes, or ask for permission from the organisations
+holding the knowledge monopoly (patent) for technology used.
+
+
This issue has been brewing for a while, and I recommend you to
+read
+"Why
+Our Civilization's Video Art and Culture is Threatened by the
+MPEG-LA" by Eugenia Loli-Queru and
+"H.264 Is Not
+The Sort Of Free That Matters" by Simon Phipps to learn more about
+the issue. The solution is to support the
+free and
+open standards for video, like Ogg
+Theora, and avoid MPEG-4 and H.264 if you can.