blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/No_hardcoded_config_on_Debian_Edu_clients.html">No hardcoded config on Debian Edu clients</a></div>
  24   <div class="date">2010-08-09 20:15</div>
  25   <div class="body">
  26 <p>As reported earlier, the last few days I have looked at how Debian
  27 Edu clients are configured, and tried to get rid of all hardcoded
  28 configuration settings on the clients.  I believe the work to be
  29 mostly done, and the clients seem to work just fine with dynamically
  30 generated configuration.</p>
  31
  32 <p>What is the point, you might ask?  The point is to allow a Debian
  33 Edu desktop to integrate into an existing network infrastructure
  34 without any manual configuration.</p>
  35
  36 <p>This is what happens when installing a Debian Edu client here at
  37 the University of Oslo using PXE.  With the PXE installation, I am
  38 asked for language (Norwegian Bokmål), locality (Norway) and keyboard
  39 layout (no-latin1), Debian Edu profile (Roaming Workstation), if I
  40 accept to reformat the hard drive (yes), if I want to submit info to
  41 popcon.debian.org (no) and root password (secret).  After answering
  42 these questions, the installer goes ahead and does its thing, and
  43 after around 50 minutes it is done.  I press enter to finish the
  44 installation, and the machine reboots into KDE.  When the machine is
  45 ready and kdm asks for login information, I enter my university
  46 username and password, am told by kdm that a local home directory has
  47 been created and that I must log in again, and finally log in with the
  48 same username and password to the KDE 4.4 desktop.  At no point during
  49 this process did it ask for university specific settings, and all the
  50 required configuration was dynamically detected using information
  51 fetched via DHCP and DNS.  The roaming workstation is now ready for
  52 use.</p>
  53
  54 <p>How was this done, you might wonder?  First of all, here is the
  55 list of things that need to be configured on the client to get it
  56 working properly out of the box:</p>
  57
  58 <ul>
  59 <li>IP address/netmask and DNS server.</li>
  60 <li>Web proxy URL.</li>
  61 <li>LDAP server for NSS directory information (user, group, etc).</li>
  62 <li>Kerberos server for PAM password checking.</li>
  63 <li>SMB mount point to access the network home directory. (*)</li>
  64 <li>Central syslog server to send syslog messages to. (*)</li>
  65 <li>Sitesummary collector URL to submit info to central server. (*)</li>
  66 </ul>
  67
  68 <p>(Hm, did I forget anything?  Let me knew if I did.)</p>
  69
  70 <p>The points marked (*) are not required to be able to use the
  71 machine, but needed to provide central storage and allowing system
  72 administrators to track their machines.  Since yesterday, everything
  73 but the sitesummary collector URL is dynamically discovered at boot
  74 and installation time in the svn version of Debian Edu.</p>
  75
  76 <p>The IP and DNS setup is fetched during boot using DHCP as usual.
  77 When a DHCP update arrives, the proxy setup is updated by looking for
  78 http://wpat/wpad.dat and using the content of this WPAD file to
  79 configure the http and ftp proxy in /etc/environment and
  80 /etc/apt/apt.conf.  I decided to update the proxy setup using a DHCP
  81 hook to ensure that the client stops using the Debian Edu proxy when
  82 it is moved outside the Debian Edu network, and instead uses any local
  83 proxy present on the new network when it moves around.</p>
  84
  85 <p>The DNS names of the LDAP, Kerberos and syslog server and related
  86 configuration are generated using DNS information at boot.  First the
  87 installer looks for a host named ldap in the current DNS domain.  If
  88 not found, it looks for _ldap._tcp SRV records in DNS instead.  If an
  89 LDAP server is found, its root DSE entry is requested and the
  90 attributes namingContexts and defaultNamingContext are used to
  91 determine which LDAP base to use for NSS.  If there are several
  92 namingContexts attibutes and the defaultNamingContext is present, that
  93 LDAP subtree is used as the base.  If defaultNamingContext is missing,
  94 the subtrees listed as namingContexts are searched in sequence for any
  95 object with class posixAccount or posixGroup, and the first one with
  96 such an object is used as the LDAP base.  For Kerberos, a similar
  97 search is done by first looking for a host named kerberos, and then
  98 for the _kerberos._tcp SRV record.  I've been unable to find a way to
  99 look up the Kerberos realm, so for this the upper case string of the
 100 current DNS domain is used.</p>
 101
 102 <p>For the syslog server, the hosts syslog and loghost are searched
 103 for, and the _syslog._udp SRV record is consulted if no such host is
 104 found.  This algorithm works for both Debian Edu and the University of
 105 Oslo.  A similar strategy would work for locating the sitesummary
 106 server, but have not been implemented yet.  I decided to fetch and
 107 save these settings during installation, to make sure moving to a
 108 different network does not change the set of users being allowed to
 109 log in nor the passwords required to log in.  Usernames and passwords
 110 will be cached by sssd when the user logs in on the Debian Edu
 111 network, and will not change as the laptop move around.  For a
 112 non-roaming machine, there is no caching, but given that it is
 113 supposed to stay in place it should not matter much.  Perhaps we
 114 should switch those to use sssd too?</p>
 115
 116 <p>The user's SMB mount point for the network home directory is
 117 located when the user logs in for the first time.  The LDAP server is
 118 consulted to look for the user's LDAP object and the sambaHomePath
 119 attribute is used if found.  If it isn't found, the home directory
 120 path fetched from NSS is used instead.  Assuming the path is of the
 121 form /site/server/directory/username, the second part is looked up in
 122 DNS and used to generate a SMB URL of the form
 123 smb://server.domain/username.  This algorithm works for both Debian
 124 edu and the University of Oslo.  Perhaps there are better attributes
 125 to use or a better algorithm that works for more sites, but this will
 126 do for now. :)</p>
 127
 128 <p>This work should make it easier to integrate the Debian Edu clients
 129 into any LDAP/Kerberos infrastructure, and make the current setup even
 130 more flexible than before.  I suspect it will also work for thin
 131 client servers, allowing one to easily set up LTSP and hook it into a
 132 existing network infrastructure, but I have not had time to test this
 133 yet.</p>
 134
 135 <p>If you want to help out with implementing these things for Debian
 136 Edu, please contact us on debian-edu@lists.debian.org.</p>
 137
 138 <p>Update 2010-08-09: Simon Farnsworth gave me a heads-up on how to
 139 detect Kerberos realm from DNS, by looking for _kerberos TXT entries
 140 before falling back to the upper case DNS domain name.  Will have to
 141 implement it for Debian Edu. :)</p>
 142 </div>
 143   <div class="tags">
 144
 145
 146
 147    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 148
 149   </div>
 150  </div>
 151  <div class="padding"></div>
 152
 153  <div class="entry">
 154   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">Testing if a file system can be used for home directories...</a></div>
 155   <div class="date">2010-08-08 21:20</div>
 156   <div class="body">
 157 <p>A few years ago, I was involved in a project planning to use
 158 Windows file servers as home directory servers for Debian
 159 Edu/Skolelinux machines.  This was thought to be no problem, as the
 160 access would be through the SMB network file system protocol, and we
 161 knew other sites used SMB with unix and samba as the file server to
 162 mount home directories without any problems.  But, after months of
 163 struggling, we had to conclude that our goal was impossible.</p>
 164
 165 <p>The reason is simply that while SMB can be used for home
 166 directories when the file server is Samba running on Unix, this only
 167 work because of Samba have some extensions and the fact that the
 168 underlying file system is a unix file system.  When using a Windows
 169 file server, the underlying file system do not have POSIX semantics,
 170 and several programs will fail if the users home directory where they
 171 want to store their configuration lack POSIX semantics.</p>
 172
 173 <p>As part of this work, I wrote a small C program I want to share
 174 with you all, to replicate a few of the problematic applications (like
 175 OpenOffice.org and GCompris) and see if the file system was working as
 176 it should.  If you find yourself in spooky file system land, it might
 177 help you find your way out again.  This is the fs-test.c source:</p>
 178
 179 <pre>
 180 /*
 181  * Some tests to check the file system sematics.  Used to verify that
 182  * CIFS from a windows server do not work properly as a linux home
 183  * directory.
 184  * License: GPL v2 or later
 185  *
 186  * needs libsqlite3-dev and build-essential installed
 187  * compile with: gcc -Wall -lsqlite3 -DTEST_SQLITE fs-test.c -o fs-test
 188 */
 189
 190 #define _FILE_OFFSET_BITS 64
 191 #define _LARGEFILE_SOURCE 1
 192 #define _LARGEFILE64_SOURCE 1
 193
 194 #define _GNU_SOURCE /* for asprintf() */
 195
 196 #include &lt;errno.h>
 197 #include &lt;fcntl.h>
 198 #include &lt;stdio.h>
 199 #include &lt;string.h>
 200 #include &lt;stdlib.h>
 201 #include &lt;sys/file.h>
 202 #include &lt;sys/stat.h>
 203 #include &lt;sys/types.h>
 204 #include &lt;unistd.h>
 205
 206 #ifdef TEST_SQLITE
 207 /*
 208  * Test sqlite open, as done by gcompris require the libsqlite3-dev
 209  * package and linking with -lsqlite3.  A more low level test is
 210  * below.
 211  * See also &lt;URL: http://www.sqlite.org./faq.html#q5 >.
 212  */
 213 #include &lt;sqlite3.h>
 214 #define CREATE_TABLE_USERS                                              \
 215   "CREATE TABLE users (user_id INT UNIQUE, login TEXT, lastname TEXT, firstname TEXT, birthdate TEXT, class_id INT ); "
 216 int test_sqlite_open(void) {
 217   char *zErrMsg;
 218   char *name = "testsqlite.db";
 219   sqlite3 *db=NULL;
 220   unlink(name);
 221   int rc = sqlite3_open(name, &db);
 222   if( rc ){
 223     printf("error: sqlite open of %s failed: %s\n", name, sqlite3_errmsg(db));
 224     sqlite3_close(db);
 225     return -1;
 226   }
 227
 228   /* create tables */
 229   rc = sqlite3_exec(db,CREATE_TABLE_USERS, NULL,  0, &zErrMsg);
 230   if( rc != SQLITE_OK ){
 231     printf("error: sqlite table create failed: %s\n", zErrMsg);
 232     sqlite3_close(db);
 233     return -1;
 234   }
 235   printf("info: sqlite worked\n");
 236   sqlite3_close(db);
 237   return 0;
 238 }
 239 #endif /* TEST_SQLITE */
 240
 241 /*
 242  * Demonstrate locking issue found in gcompris using sqlite3.  This
 243  * work with ext3, but not with cifs server on Windows 2003.  This is
 244  * done in the sqlite3 library.
 245  * See also
 246  * &lt;URL:http://www.cygwin.com/ml/cygwin/2001-08/msg00854.html> and the
 247  * POSIX specification
 248  * &lt;URL:http://www.opengroup.org/onlinepubs/009695399/functions/fcntl.html>.
 249  */
 250 int test_gcompris_locking(void) {
 251   struct flock fl;
 252   char *name = "testsqlite.db";
 253   unlink(name);
 254   int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, 0644);
 255   printf("info: testing fcntl locking\n");
 256
 257   fl.l_whence = SEEK_SET;
 258   fl.l_pid    = getpid();
 259   printf("  Read-locking 1 byte from 1073741824");
 260   fl.l_start  = 1073741824;
 261   fl.l_len    = 1;
 262   fl.l_type   = F_RDLCK;
 263   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 264
 265   printf("  Read-locking 510 byte from 1073741826");
 266   fl.l_start  = 1073741826;
 267   fl.l_len    = 510;
 268   fl.l_type   = F_RDLCK;
 269   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 270
 271   printf("  Unlocking 1 byte from 1073741824");
 272   fl.l_start  = 1073741824;
 273   fl.l_len    = 1;
 274   fl.l_type   = F_UNLCK;
 275   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 276
 277   printf("  Write-locking 1 byte from 1073741824");
 278   fl.l_start  = 1073741824;
 279   fl.l_len    = 1;
 280   fl.l_type   = F_WRLCK;
 281   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 282
 283   printf("  Write-locking 510 byte from 1073741826");
 284   fl.l_start  = 1073741826;
 285   fl.l_len    = 510;
 286   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 287
 288   printf("  Unlocking 2 byte from 1073741824");
 289   fl.l_start  = 1073741824;
 290   fl.l_len    = 2;
 291   fl.l_type   = F_UNLCK;
 292   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 293
 294   close(fd);
 295   return 0;
 296 }
 297
 298 /*
 299  * Test if permissions of freshly created directories allow entries
 300  * below them.  This was a problem with OpenOffice.org and gcompris.
 301  * Mounting with option 'sync' seem to solve this problem while
 302  * slowing down file operations.
 303  */
 304 int test_subdirectory_creation(void) {
 305 #define LEVELS 5
 306   char *path = strdup("test");
 307   char *dirs[LEVELS];
 308   int level;
 309   printf("info: testing subdirectory creation\n");
 310   for (level = 0; level &lt; LEVELS; level++) {
 311     char *newpath = NULL;
 312     if (-1 == mkdir(path, 0777)) {
 313       printf("  error: Unable to create directory '%s': %s\n",
 314              path, strerror(errno));
 315       break;
 316     }
 317     asprintf(&newpath, "%s/%s", path, "test");
 318     free(path);
 319     path = newpath;
 320   }
 321   return 0;
 322 }
 323
 324 /*
 325  * Test if symlinks can be created.  This was a problem detected with
 326  * KDE.
 327  */
 328 int test_symlinks(void) {
 329   printf("info: testing symlink creation\n");
 330   unlink("symlink");
 331   if (-1 == symlink("file", "symlink"))
 332     printf("  error: Unable to create symlink\n");
 333   return 0;
 334 }
 335
 336 int main(int argc, char **argv) {
 337   printf("Testing POSIX/Unix sematics on file system\n");
 338   test_symlinks();
 339   test_subdirectory_creation();
 340 #ifdef TEST_SQLITE
 341   test_sqlite_open();
 342 #endif /* TEST_SQLITE */
 343   test_gcompris_locking();
 344   return 0;
 345 }
 346 </pre>
 347
 348 <p>When everything is working, it should print something like
 349 this:</p>
 350
 351 <pre>
 352 Testing POSIX/Unix sematics on file system
 353 info: testing symlink creation
 354 info: testing subdirectory creation
 355 info: sqlite worked
 356 info: testing fcntl locking
 357   Read-locking 1 byte from 1073741824
 358   Read-locking 510 byte from 1073741826
 359   Unlocking 1 byte from 1073741824
 360   Write-locking 1 byte from 1073741824
 361   Write-locking 510 byte from 1073741826
 362   Unlocking 2 byte from 1073741824
 363 </pre>
 364
 365 <p>I do not remember the exact details of the problems we saw, but one
 366 of them was with locking, where if I remember correctly, POSIX allow a
 367 read-only lock to be upgraded to a read-write lock without unlocking
 368 the read-only lock (while Windows do not).  Another was a bug in the
 369 CIFS/SMB client implementation in the Linux kernel where directory
 370 meta information would be wrong for a fraction of a second, making
 371 OpenOffice.org fail to create its deep directory tree because it was
 372 not allowed to create files in its freshly created directory.</p>
 373
 374 <p>Anyway, here is a nice tool for your tool box, might you never need
 375 it. :)</p>
 376 </div>
 377   <div class="tags">
 378
 379
 380
 381    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 382
 383   </div>
 384  </div>
 385  <div class="padding"></div>
 386
 387  <div class="entry">
 388   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html">Autodetecting Client setup for roaming workstations in Debian Edu</a></div>
 389   <div class="date">2010-08-07 14:45</div>
 390   <div class="body">
 391 <p>A few days ago, I
 392 <a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">tried
 393 to install</a> a Roaming workation profile from Debian Edu/Squeeze
 394 while on the university network here at the University of Oslo, and
 395 noticed how much had to change to get it operational using the
 396 university infrastructure.  It was fairly easy, but it occured to me
 397 that Debian Edu would improve a lot if I could get the client to
 398 connect without any changes at all, and thus let the client configure
 399 itself during installation and first boot to use the infrastructure
 400 around it.  Now I am a huge step further along that road.</p>
 401
 402 <p>With our current squeeze-test packages, I can select the roaming
 403 workstation profile and get a working laptop connecting to the
 404 university LDAP server for user and group and our active directory
 405 servers for Kerberos authentication.  All this without any
 406 configuration at all during installation.  My users home directory got
 407 a bookmark in the KDE menu to mount it via SMB, with the correct URL.
 408 In short, openldap and sssd is correctly configured.  In addition to
 409 this, the client look for http://wpad/wpad.dat to configure a web
 410 proxy, and when it fail to find it no proxy settings are stored in
 411 /etc/environment and /etc/apt/apt.conf.  Iceweasel and KDE is
 412 configured to look for the same wpad configuration and also do not use
 413 a proxy when at the university network.  If the machine is moved to a
 414 network with such wpad setup, it would automatically use it when DHCP
 415 gave it a IP address.</p>
 416
 417 <p>The LDAP server is located using DNS, by first looking for the DNS
 418 entry ldap.$domain.  If this do not exist, it look for the
 419 _ldap._tcp.$domain SRV records and use the first one as the LDAP
 420 server.  Next, it connects to the LDAP server and search all
 421 namingContexts entries for posixAccount or posixGroup objects, and
 422 pick the first one as the LDAP base.  For Kerberos, a similar
 423 algorithm is used to locate the LDAP server, and the realm is the
 424 uppercase version of $domain.</p>
 425
 426 <p>So, what is not working, you might ask.  SMB mounting my home
 427 directory do not work.  No idea why, but suspected the incorrect
 428 Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
 429 the cause.  These are not properly configured during installation, and
 430 had to be hand-edited to get the correct Kerberos realm and server,
 431 but SMB mounting still do not work. :(</p>
 432
 433 <p>With this automatic configuration in place, I expect a Debian Edu
 434 roaming profile installation would be able to automatically detect and
 435 connect to any site using LDAP and Kerberos for NSS directory and PAM
 436 authentication.  It should also work out of the box in a Active
 437 Directory environment providing posixAccount and posixGroup objects
 438 with UID and GID values.</p>
 439
 440 <p>If you want to help out with implementing these things for Debian
 441 Edu, please contact us on debian-edu@lists.debian.org.</p>
 442 </div>
 443   <div class="tags">
 444
 445
 446
 447    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 448
 449   </div>
 450  </div>
 451  <div class="padding"></div>
 452
 453  <div class="entry">
 454   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">Debian Edu roaming workstation - at the university of Oslo</a></div>
 455   <div class="date">2010-08-03 23:30</div>
 456   <div class="body">
 457 <p>The new roaming workstation profile in Debian Edu/Squeeze is fairly
 458 similar to the laptop setup am I working on using Ubuntu for the
 459 University of Oslo, and just for the heck of it, I tested today how
 460 hard it would be to integrate that profile into the university
 461 infrastructure.  In this case, it is the university LDAP server,
 462 Active Directory Kerberos server and SMB mounting from the Netapp file
 463 servers.</p>
 464
 465 <p>I was pleasantly surprised that the only three files needed to be
 466 changed (/etc/sssd/sssd.conf, /etc/ldap.conf and
 467 /etc/mklocaluser.d/20-debian-edu-config) and one file had to be added
 468 (/usr/share/perl5/Debian/Edu_Local.pm), to get the client working.
 469 Most of the changes were to get the client to use the university LDAP
 470 for NSS and Kerberos server for PAM, but one was to change a hard
 471 coded DNS domain name in the mklocaluser hook from .intern to
 472 .uio.no.</p>
 473
 474 <p>This testing was so encouraging, that I went ahead and adjusted the
 475 Debian Edu scripts and setup in subversion to centralise the roaming
 476 workstation setup a bit more and avoid the hardcoded DNS domain name,
 477 so that when I test this tomorrow, I expect to get away with modifying
 478 only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the
 479 university servers.</p>
 480
 481 <p>My goal is to get the clients to have no hardcoded settings and
 482 fetch all their initial setup during installation and first boot, to
 483 allow them to be inserted also into environments where the default
 484 setup in Debian Edu has been changed or as with the university, where
 485 the environment is different but provides the protocols Debian Edu
 486 uses.</p>
 487 </div>
 488   <div class="tags">
 489
 490
 491
 492    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 493
 494   </div>
 495  </div>
 496  <div class="padding"></div>
 497
 498  <div class="entry">
 499   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html">Circular package dependencies harms apt recovery</a></div>
 500   <div class="date">2010-07-27 23:50</div>
 501   <div class="body">
 502 <p>I discovered this while doing
 503 <a href="http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html">automated
 504 testing of upgrades from Debian Lenny to Squeeze</a>.  A few packages
 505 in Debian still got circular dependencies, and it is often claimed
 506 that apt and aptitude should be able to handle this just fine, but
 507 some times these dependency loops causes apt to fail.</p>
 508
 509 <p>An example is from todays
 510 <a href="http://people.skolelinux.org/~pere/debian-upgrade-testing//test-20100727-lenny-squeeze-kde-aptitude.txt">upgrade
 511 of KDE using aptitude</a>.  In it, a bug in kdebase-workspace-data
 512 causes perl-modules to fail to upgrade.  The cause is simple.  If a
 513 package fail to unpack, then only part of packages with the circular
 514 dependency might end up being unpacked when unpacking aborts, and the
 515 ones already unpacked will fail to configure in the recovery phase
 516 because its dependencies are unavailable.</p>
 517
 518 <p>In this log, the problem manifest itself with this error:</p>
 519
 520 <blockquote><pre>
 521 dpkg: dependency problems prevent configuration of perl-modules:
 522  perl-modules depends on perl (>= 5.10.1-1); however:
 523   Version of perl on system is 5.10.0-19lenny2.
 524 dpkg: error processing perl-modules (--configure):
 525  dependency problems - leaving unconfigured
 526 </pre></blockquote>
 527
 528 <p>The perl/perl-modules circular dependency is already
 529 <a href="http://bugs.debian.org/527917">reported as a bug</a>, and will
 530 hopefully be solved as soon as possible, but it is not the only one,
 531 and each one of these loops in the dependency tree can cause similar
 532 failures.  Of course, they only occur when there are bugs in other
 533 packages causing the unpacking to fail, but it is rather nasty when
 534 the failure of one package causes the problem to become worse because
 535 of dependency loops.</p>
 536
 537 <p>Thanks to
 538 <a href="http://lists.debian.org/debian-devel/2010/06/msg00116.html">the
 539 tireless effort by Bill Allombert</a>, the number of circular
 540 dependencies
 541 <a href="http://debian.semistable.com/debgraph.out.html">left in Debian
 542 is dropping</a>, and perhaps it will reach zero one day. :)</p>
 543
 544 <p>Todays testing also exposed a bug in
 545 <a href="http://bugs.debian.org/590605">update-notifier</a> and
 546 <a href="http://bugs.debian.org/590604">different behaviour</a> between
 547 apt-get and aptitude, the latter possibly caused by some circular
 548 dependency.  Reported both to BTS to try to get someone to look at
 549 it.</p>
 550 </div>
 551   <div class="tags">
 552
 553
 554
 555    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 556
 557   </div>
 558  </div>
 559  <div class="padding"></div>
 560
 561  <div class="entry">
 562   <div class="title"><a href="http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html">First Debian Edu test release (alpha0) based on Squeeze is released</a></div>
 563   <div class="date">2010-07-27 17:45</div>
 564   <div class="body">
 565 <p>I just posted this announcement culminating several months of work
 566 with the next Debian Edu release.  Not nearly done, but one major step
 567 completed.</p>
 568
 569 <blockquote>
 570 <p>This is the first test release based on Squeeze. The focus of this
 571 release is to test the user application selection. To have a look,
 572 install the standalone profile and let the developers know if the set
 573 of installed packages i.e. applications should be modified. If some
 574 user application is missing, or if there are some applications that no
 575 longer make sense to be included in Debian Edu, please let us know.
 576 Also, if a useful application is missing the translation for your
 577 language of choice, please let us know too.</p>
 578
 579 <p>In addition, feedback and help to polish the desktop (menus,
 580 artwork, starters, etc.) is appreciated. We would like to ship a nice
 581 and handy KDE4 desktop targeted for schools out of the box.</p>
 582
 583 <p>The other profiles should be installable, but there is a lot more
 584 work left to be done before they are ready, so do not expect to
 585 much.</p>
 586
 587 <p>Changes compared to the lenny based version</p>
 588
 589 <ul>
 590 <li>Everything from Debian Squeeze
 591 <ul>
 592   <li>Desktop environment KDE 4.4 => the new KDE desktop in
 593          combination with some new artwork
 594   <li>Web browser Iceweasel 3.5
 595   <li>OpenOffice.org 3.2
 596   <li>Educational toolbox GCompris 9.3
 597   <li>Music creator Rosegarden 10.04.2
 598   <li>Image editor Gimp 2.6.10
 599   <li>Virtual universe Celestia 1.6.0
 600   <li>Virtual stargazer Stellarium 0.10.4
 601   <li>3D modeler Blender 2.49.2 (new application)
 602   <li>Video editor Kdenlive 0.7.7 (new application)
 603 </ul></li>
 604 <li>Now using Kerberos for password checking (migration not finished).
 605     Enabled for:
 606 <ul>
 607   <li>PAM
 608   <li>LDAP
 609   <li>IMAP
 610   <li>SMTP (sender verification)
 611 </ul>
 612 </li>
 613 <li>New experimental roaming workstation profile for laptops.</li>
 614 <li>Show welcome page to users when they first log in. The URL is
 615     fetched from LDAP.</li>
 616 <li>New LXDE desktop option, in addition to KDE (default) and Gnome.</li>
 617 <li>General cleanup (not finished)</li>
 618 </ul>
 619 <p>The following features are not working as they should</p>
 620
 621 <ul>
 622 <li>No web based administration tool for creating users and groups. The
 623     scripts ldap-createuser-krb and ldap-add-user-to-group can be used
 624     for testing.</li>
 625 <li>DVD installs are missing debian-installer images for the PXE boot,
 626     and do not set up the PXE menu on eth0 because of this. LTSP
 627     clients should still boot from eth1 on thin client servers.</li>
 628 <li>The restructured KDE menu is not implemented.</li>
 629 <li>The LDAP server setup need to be reviewed for security.</li>
 630 <li>The LDAP directory structure need to be reworked.</li>
 631 <li>Different sets of packages are installed when using the DVD and the
 632     netinst CD. More packages are installed using the netinst CD.</li>
 633 <li>The jackd package fail to install. This is believed to be caused by
 634     some ongoing transition, and hopefully should be solved soon. The
 635     jackd1 package can be installed manually for those that need it.</li>
 636 <li>Some packages lack translations. See
 637     http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status,
 638     and help out with translations.</li>
 639 </ul>
 640
 641 <p>To download this multiarch netinstall release you can use</p>
 642
 643 <ul>
 644 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
 645 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
 646 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</li>
 647 </ul>
 648 <p>To download this multiarch dvd release you can use</p>
 649
 650 <ul>
 651 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
 652 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
 653 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</li>
 654 </ul>
 655
 656 <p>There is no source DVD available yet. It will be prepared when we
 657 get closer to the final release.</p>
 658
 659 <p>The MD5SUM of these images are</p>
 660
 661 <ul>
 662 <li>3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-6.0.0+edua0-CD.iso</li>
 663 <li>22f2cbfce281d1c6e478be452638675d debian-edu-6.0.0+edua0-DVD.iso</li>
 664 </ul>
 665
 666 <p>The SHA1SUM of these images are</p>
 667 <ul>
 668 <li>c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-6.0.0+edua0-CD.iso</li>
 669 <li>2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-6.0.0+edua0-DVD.iso</li>
 670 </ul>
 671 <p>How to report bugs:
 672 http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla</p>
 673
 674 <p>Please direct replies to debian-edu@lists.debian.org</p>
 675 </blockquote>
 676 </div>
 677   <div class="tags">
 678
 679
 680
 681    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 682
 683   </div>
 684  </div>
 685  <div class="padding"></div>
 686
 687  <div class="entry">
 688   <div class="title"><a href="http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html">One step closer to single signon in Debian Edu</a></div>
 689   <div class="date">2010-07-25 10:00</div>
 690   <div class="body">
 691 <p>The last few months me and the other Debian Edu developers have
 692 been working hard to get the Debian/Squeeze based version of Debian
 693 Edu/Skolelinux into shape.  This future version will use Kerberos for
 694 authentication, and services are slowly migrated to single signon,
 695 getting rid of password questions one at the time.</p>
 696
 697 <p>It will also feature a roaming workstation profile with local home
 698 directory, for laptops that are only some times on the Skolelinux
 699 network, and for this profile a shortcut is created in Gnome and KDE
 700 to gain access to the users home directory on the file server.  This
 701 shortcut uses SMB at the moment, and yesterday I had time to test if
 702 SMB mounting had started working in KDE after we added the cifs-utils
 703 package.  I was pleasantly surprised how well it worked.</p>
 704
 705 <p>Thanks to the recent changes to our samba configuration to get it
 706 to use Kerberos for authentication, there were no question about user
 707 password when mounting the SMB volume.  A simple click on the shortcut
 708 in the KDE menu, and a window with the home directory popped
 709 up. :)</p>
 710
 711 <p>One step closer to a single signon solution out of the box in
 712 Debian Edu.  We already had PAM, LDAP, IMAP and SMTP in place, and now
 713 also Samba.  Next step is Cups and hopefully also NFS.</p>
 714
 715 <p>We had planned a alpha0 release of Debian Edu for today, but thanks
 716 to the autobuilder administrators for some architectures being slow to
 717 sign packages, we are still missing the fixed LTSP package we need for
 718 the release.  It was uploaded three days ago with urgency=high, and if
 719 it had entered testing yesterday we would have been able to test it in
 720 time for a alpha0 release today.  As the binaries for ia64 and powerpc
 721 still not uploaded to the Debian archive, we need to delay the alpha
 722 release another day.</p>
 723
 724 <p>If you want to help out with implementing Kerberos for Debian Edu,
 725 please contact us on debian-edu@lists.debian.org.</p>
 726 </div>
 727   <div class="tags">
 728
 729
 730
 731    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 732
 733   </div>
 734  </div>
 735  <div class="padding"></div>
 736
 737  <div class="entry">
 738   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til____slutte____kj__pe_musikk.html">Digitale restriksjonsmekanismer fikk meg til å slutte å kjøpe musikk</a></div>
 739   <div class="date">2010-07-22 23:50</div>
 740   <div class="body">
 741 <p>For mange år siden slutte jeg å kjøpe musikk-CDer. Årsaken var at
 742 musikkbransjen var godt i gang med å selge platene sine med DRM som
 743 gjorde at jeg ikke fikk spilt av musikken jeg kjøpte på utstyret jeg
 744 hadde tilgjengelig, dvs. min datamaskin. Det var umulig å se på en
 745 plate om den var ødelagt eller ikke, og jeg hadde jo allerede en
 746 anseelig samling med plater, så jeg bestemme meg for å slutte å gi
 747 penger til en bransje som åpenbart ikke respekterte meg.</p>
 748
 749 <p>Jeg har mange titalls dager med musikk på CD i dag. Det meste er
 750 lagt i et stort arkiv som kan spilles av fra husets datamaskiner (har
 751 ikke rukket rippe alt). Jeg ser dermed ikke behovet for å skaffe mer
 752 musikk. De fleste av mine favoritter er i hus, og jeg er dermed godt
 753 fornøyd.</p>
 754
 755 <p>Hvis musikkbransjen ønsker mine penger, så må de demonstrere at de
 756 setter pris på meg som kunde, og ikke skremme meg bort med DRM og
 757 antydninger om at kundene er kriminelle.</p>
 758
 759 <p>Filmbransjen er like ille, men mens musikk gjerne varer lenge, er
 760 filmer mer ferskvare. Har dermed ikke helt sluttet å kjøpe filmer, men
 761 holder meg til DVD-filmer som kan spilles av på mine Linuxbokser.
 762 Kommer neppe til å ta i bruk Blueray, og ei heller de nye DRM-greiene
 763 «Ultraviolet» som be annonsert her om dagen.</p>
 764 </div>
 765   <div class="tags">
 766
 767
 768
 769    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>.
 770
 771   </div>
 772  </div>
 773  <div class="padding"></div>
 774
 775  <div class="entry">
 776   <div class="title"><a href="http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html">OpenStreetmap one step closer to having routing on its front page</a></div>
 777   <div class="date">2010-07-18 16:45</div>
 778   <div class="body">
 779 <p>Thanks to
 780 <a href="http://feedproxy.google.com/~r/Opengeodata/~3/wUTCzDZk3lc/project-of-the-week-which-way-home">todays
 781 opengeodata blog entry</a>, I just discovered that the
 782 OpenStreetmap.org site have gotten
 783 <a href="http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT">support
 784 for calculating routes</a>.  The support is still experimental and
 785 only available from the development server, until more experience is
 786 gathered on the user interface and any scalability issues.</p>
 787
 788 <p>Earlier, the routing I knew about using the OpenStreetmap.org data
 789 was provided by <a href="http://maps.cloudmade.com/">Cloudmade</a>,
 790 but having it on the main page is required to make everyone aware of
 791 the issue.  I've had people reject Openstreetmap.org as a viable
 792 alternative for them because the front page lacked routing support,
 793 and I hope their needs will be catered for when routing show up on the
 794 www.openstreetmap.org front page.</p>
 795 </div>
 796   <div class="tags">
 797
 798
 799
 800    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/kart">kart</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 801
 802   </div>
 803  </div>
 804  <div class="padding"></div>
 805
 806  <div class="entry">
 807   <div class="title"><a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a></div>
 808   <div class="date">2010-07-17 21:00</div>
 809   <div class="body">
 810 <p>This is a
 811 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
 812 on my
 813 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
 814 work</a> on
 815 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
 816 all</a> the computer related LDAP objects in Debian Edu.</p>
 817
 818 <p>As a step to try to see if it possible to merge the DNS and DHCP
 819 LDAP objects, I have had a look at how the packages pdns-backend-ldap
 820 and dhcp3-server-ldap in Debian use the LDAP server.  The two
 821 implementations are quite different in how they use LDAP.</p>
 822
 823 To get this information, I started slapd with debugging enabled and
 824 dumped the debug output to a file to get the LDAP searches performed
 825 on a Debian Edu main-server.  Here is a summary.
 826
 827 <p><strong>powerdns</strong></p>
 828
 829 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
 830 on how to</a> set up PowerDNS to use a LDAP backend is available on
 831 the web.
 832
 833 <p>PowerDNS have two modes of operation using LDAP as its backend.
 834 One "strict" mode where the forward and reverse DNS lookups are done
 835 using the same LDAP objects, and a "tree" mode where the forward and
 836 reverse entries are in two different subtrees in LDAP with a structure
 837 based on the DNS names, as in tjener.intern and
 838 2.2.0.10.in-addr.arpa.</p>
 839
 840 <p>In tree mode, the server is set up to use a LDAP subtree as its
 841 base, and uses a "base" scoped search for the DNS name by adding
 842 "dc=tjener,dc=intern," to the base with a filter for
 843 "(associateddomain=tjener.intern)" for the forward entry and
 844 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
 845 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
 846 forward entries, it is looking for attributes named dnsttl, arecord,
 847 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
 848 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
 849 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
 850 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
 851 spfrecord and modifytimestamp.  For reverse entries it is looking for
 852 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
 853 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
 854 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
 855 ldapsearch commands could look like this:</p>
 856
 857 <blockquote><pre>
 858 ldapsearch -h ldap \
 859   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 860   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 861   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 862   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 863   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 864   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 865
 866 ldapsearch -h ldap \
 867   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 868   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
 869   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
 870   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
 871   srvrecord naptrrecord modifytimestamp
 872 </pre></blockquote>
 873
 874 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
 875 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
 876 example LDAP objects used there.  In addition to these objects, the
 877 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
 878 also exist.</p>
 879
 880 <blockquote><pre>
 881 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
 882 objectclass: top
 883 objectclass: dnsdomain
 884 objectclass: domainrelatedobject
 885 dc: tjener
 886 arecord: 10.0.2.2
 887 associateddomain: tjener.intern
 888
 889 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
 890 objectclass: top
 891 objectclass: dnsdomain2
 892 objectclass: domainrelatedobject
 893 dc: 2
 894 ptrrecord: tjener.intern
 895 associateddomain: 2.2.0.10.in-addr.arpa
 896 </pre></blockquote>
 897
 898 <p>In strict mode, the server behaves differently.  When looking for
 899 forward DNS entries, it is doing a "subtree" scoped search with the
 900 same base as in the tree mode for a object with filter
 901 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
 902 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
 903 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
 904 naptrrecord and modifytimestamp.  For reverse entires it also do a
 905 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
 906 and the requested attributes are associateddomain, dnsttl and
 907 modifytimestamp.  In short, in strict mode the objects with ptrrecord
 908 go away, and the arecord attribute in the forward object is used
 909 instead.</p>
 910
 911 <p>The forward and reverse searches can be simulated using ldapsearch
 912 like this:</p>
 913
 914 <blockquote><pre>
 915 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 916   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 917   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 918   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 919   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 920   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 921
 922 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 923   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
 924 </pre></blockquote>
 925
 926 <p>In addition to the forward and reverse searches , there is also a
 927 search for SOA records, which behave similar to the forward and
 928 reverse lookups.</p>
 929
 930 <p>A thing to note with the PowerDNS behaviour is that it do not
 931 specify any objectclass names, and instead look for the attributes it
 932 need to generate a DNS reply.  This make it able to work with any
 933 objectclass that provide the needed attributes.</p>
 934
 935 <p>The attributes are normally provided in the cosine (RFC 1274) and
 936 dnsdomain2 schemas.  The latter is used for reverse entries like
 937 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
 938
 939 <p>In Debian Edu, we have created DNS objects using the object classes
 940 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
 941 attributes) and domainrelatedobject (for associatedDomain).  The use
 942 of structural object classes make it impossible to combine these
 943 classes with the object classes used by DHCP.</p>
 944
 945 <p>There are other schemas that could be used too, for example the
 946 dnszone structural object class used by Gosa and bind-sdb for the DNS
 947 attributes combined with the domainrelatedobject object class, but in
 948 this case some unused attributes would have to be included as well
 949 (zonename and relativedomainname).</p>
 950
 951 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
 952 mode and not use any of the existing objectclasses (dnsdomain,
 953 dnsdomain2 and dnszone) when one want to combine the DNS information
 954 with DHCP information, and instead create a auxiliary object class
 955 defined something like this (using the attributes defined for
 956 dnsdomain and dnsdomain2 or dnszone):</p>
 957
 958 <blockquote><pre>
 959 objectclass ( some-oid NAME 'dnsDomainAux'
 960     SUP top
 961     AUXILIARY
 962     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
 963           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
 964           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
 965           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
 966           A6Record $ DNAMERecord
 967     ))
 968 </pre></blockquote>
 969
 970 <p>This will allow any object to become a DNS entry when combined with
 971 the domainrelatedobject object class, and allow any entity to include
 972 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
 973 developers asking for their view on this schema and if they are
 974 interested in providing such schema with PowerDNS, and I hope my
 975 message will be accepted into their mailing list soon.</p>
 976
 977 <p><strong>ISC dhcp</strong></p>
 978
 979 <p>The DHCP server searches for specific objectclass and requests all
 980 the object attributes, and then uses the attributes it want.  This
 981 make it harder to figure out exactly what attributes are used, but
 982 thanks to the working example in Debian Edu I can at least get an idea
 983 what is needed without having to read the source code.</p>
 984
 985 <p>In the DHCP server configuration, the LDAP base to use and the
 986 search filter to use to locate the correct dhcpServer entity is
 987 stored.  These are the relevant entries from
 988 /etc/dhcp3/dhcpd.conf:</p>
 989
 990 <blockquote><pre>
 991 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
 992 ldap-dhcp-server-cn "dhcp";
 993 </pre></blockquote>
 994
 995 <p>The DHCP server uses this information to nest all the DHCP
 996 configuration it need.  The cn "dhcp" is located using the given LDAP
 997 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
 998 search result is this entry:</p>
 999
1000 <blockquote><pre>
1001 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
1002 cn: dhcp
1003 objectClass: top
1004 objectClass: dhcpServer
1005 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
1006 </pre></blockquote>
1007
1008 <p>The content of the dhcpServiceDN attribute is next used to locate the
1009 subtree with DHCP configuration.  The DHCP configuration subtree base
1010 is located using a base scope search with base "cn=DHCP
1011 Config,dc=skole,dc=skolelinux,dc=no" and filter
1012 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
1013 The search result is this entry:</p>
1014
1015 <blockquote><pre>
1016 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
1017 cn: DHCP Config
1018 objectClass: top
1019 objectClass: dhcpService
1020 objectClass: dhcpOptions
1021 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
1022 dhcpStatements: ddns-update-style none
1023 dhcpStatements: authoritative
1024 dhcpOption: smtp-server code 69 = array of ip-address
1025 dhcpOption: www-server code 72 = array of ip-address
1026 dhcpOption: wpad-url code 252 = text
1027 </pre></blockquote>
1028
1029 <p>Next, the entire subtree is processed, one level at the time.  When
1030 all the DHCP configuration is loaded, it is ready to receive requests.
1031 The subtree in Debian Edu contain objects with object classes
1032 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
1033 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
1034 and information about netmasks, dynamic range etc.  Leaving out the
1035 details here because it is not relevant for the focus of my
1036 investigation, which is to see if it is possible to merge dns and dhcp
1037 related computer objects.</p>
1038
1039 <p>When a DHCP request come in, LDAP is searched for the MAC address
1040 of the client (00:00:00:00:00:00 in this example), using a subtree
1041 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
1042 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
1043 00:00:00:00:00:00))" as the filter.  This is what a host object look
1044 like:</p>
1045
1046 <blockquote><pre>
1047 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
1048 cn: hostname
1049 objectClass: top
1050 objectClass: dhcpHost
1051 dhcpHWAddress: ethernet 00:00:00:00:00:00
1052 dhcpStatements: fixed-address hostname
1053 </pre></blockquote>
1054
1055 <p>There is less flexiblity in the way LDAP searches are done here.
1056 The object classes need to have fixed names, and the configuration
1057 need to be stored in a fairly specific LDAP structure.  On the
1058 positive side, the invidiual dhcpHost entires can be anywhere without
1059 the DN pointed to by the dhcpServer entries.  The latter should make
1060 it possible to group all host entries in a subtree next to the
1061 configuration entries, and this subtree can also be shared with the
1062 DNS server if the schema proposed above is combined with the dhcpHost
1063 structural object class.
1064
1065 <p><strong>Conclusion</strong></p>
1066
1067 <p>The PowerDNS implementation seem to be very flexible when it come
1068 to which LDAP schemas to use.  While its "tree" mode is rigid when it
1069 come to the the LDAP structure, the "strict" mode is very flexible,
1070 allowing DNS objects to be stored anywhere under the base cn specified
1071 in the configuration.</p>
1072
1073 <p>The DHCP implementation on the other hand is very inflexible, both
1074 regarding which LDAP schemas to use and which LDAP structure to use.
1075 I guess one could implement ones own schema, as long as the
1076 objectclasses and attributes have the names used, but this do not
1077 really help when the DHCP subtree need to have a fairly fixed
1078 structure.</p>
1079
1080 <p>Based on the observed behaviour, I suspect a LDAP structure like
1081 this might work for Debian Edu:</p>
1082
1083 <blockquote><pre>
1084 ou=services
1085   cn=machine-info (dhcpService) - dhcpServiceDN points here
1086     cn=dhcp (dhcpServer)
1087     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
1088       cn=10.0.2.0 (dhcpSubnet)
1089         cn=group1 (dhcpGroup/dhcpOptions)
1090     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
1091       cn=192.168.0.0 (dhcpSubnet)
1092         cn=group1 (dhcpGroup/dhcpOptions)
1093     ou=machines - PowerDNS base points here
1094       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
1095 </pre></blockquote>
1096
1097 <P>This is not tested yet.  If the DHCP server require the dhcpHost
1098 entries to be in the dhcpGroup subtrees, the entries can be stored
1099 there instead of a common machines subtree, and the PowerDNS base
1100 would have to be moved one level up to the machine-info subtree.</p>
1101
1102 <p>The combined object under the machines subtree would look something
1103 like this:</p>
1104
1105 <blockquote><pre>
1106 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
1107 dc: hostname
1108 objectClass: top
1109 objectClass: dhcpHost
1110 objectclass: domainrelatedobject
1111 objectclass: dnsDomainAux
1112 associateddomain: hostname.intern
1113 arecord: 10.11.12.13
1114 dhcpHWAddress: ethernet 00:00:00:00:00:00
1115 dhcpStatements: fixed-address hostname.intern
1116 </pre></blockquote>
1117
1118 </p>One could even add the LTSP configuration associated with a given
1119 machine, as long as the required attributes are available in a
1120 auxiliary object class.</p>
1121 </div>
1122   <div class="tags">
1123
1124
1125
1126    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1127
1128   </div>
1129  </div>
1130  <div class="padding"></div>
1131
1132  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
1133
1134 <div id="sidebar">
1135
1136
1137
1138
1139
1140 <h2>Archive</h2>
1141 <ul>
1142
1143 <li>2010
1144 <ul>
1145
1146 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
1147
1148 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
1149
1150 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1151
1152 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1153
1154 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1155
1156 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1157
1158 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
1159
1160 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (4)</a></li>
1161
1162 </ul></li>
1163
1164 <li>2009
1165 <ul>
1166
1167 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1168
1169 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1170
1171 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1172
1173 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1174
1175 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1176
1177 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1178
1179 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1180
1181 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1182
1183 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1184
1185 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1186
1187 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1188
1189 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1190
1191 </ul></li>
1192
1193 <li>2008
1194 <ul>
1195
1196 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1197
1198 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1199
1200 </ul></li>
1201
1202 </ul>
1203
1204
1205
1206 <h2>Tags</h2>
1207 <ul>
1208
1209  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
1210
1211  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1212
1213  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1214
1215  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
1216
1217  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (35)</a></li>
1218
1219  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (40)</a></li>
1220
1221  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (55)</a></li>
1222
1223  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
1224
1225  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (8)</a></li>
1226
1227  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (3)</a></li>
1228
1229  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
1230
1231  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
1232
1233  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1234
1235  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
1236
1237  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (71)</a></li>
1238
1239  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (92)</a></li>
1240
1241  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (14)</a></li>
1242
1243  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (14)</a></li>
1244
1245  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
1246
1247  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1248
1249  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (10)</a></li>
1250
1251  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
1252
1253  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
1254
1255  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
1256
1257  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
1258
1259  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
1260
1261  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (7)</a></li>
1262
1263 </ul>
1264
1265 </div>
1266
1267 <p style="text-align: right">
1268 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
1269 </p>
1270 </body>
1271 </html>