Generated.

[homepage.git] / blog / index.rss

<?xml version="1.0" encoding="utf-8"?>
<rss version='2.0' xmlns:lj='http://www.livejournal.org/rss/lj/1.0/' xmlns:atom="http://www.w3.org/2005/Atom">
        <channel>
                <title>Petter Reinholdtsen</title>
                <description></description>
                <link>http://people.skolelinux.org/pere/blog/</link>
                <atom:link href="http://people.skolelinux.org/pere/blog/index.rss" rel="self" type="application/rss+xml" />
        
        <item>
                <title>No hardcoded config on Debian Edu clients</title>
                <link>http://people.skolelinux.org/pere/blog/No_hardcoded_config_on_Debian_Edu_clients.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/No_hardcoded_config_on_Debian_Edu_clients.html</guid>
                <pubDate>Mon, 9 Aug 2010 20:15:00 +0200</pubDate>
                <description>
&lt;p&gt;As reported earlier, the last few days I have looked at how Debian
Edu clients are configured, and tried to get rid of all hardcoded
configuration settings on the clients.  I believe the work to be
mostly done, and the clients seem to work just fine with dynamically
generated configuration.&lt;/p&gt;

&lt;p&gt;What is the point, you might ask?  The point is to allow a Debian
Edu desktop to integrate into an existing network infrastructure
without any manual configuration.&lt;/p&gt;

&lt;p&gt;This is what happens when installing a Debian Edu client here at
the University of Oslo using PXE.  With the PXE installation, I am
asked for language (Norwegian Bokmål), locality (Norway) and keyboard
layout (no-latin1), Debian Edu profile (Roaming Workstation), if I
accept to reformat the hard drive (yes), if I want to submit info to
popcon.debian.org (no) and root password (secret).  After answering
these questions, the installer goes ahead and does its thing, and
after around 50 minutes it is done.  I press enter to finish the
installation, and the machine reboots into KDE.  When the machine is
ready and kdm asks for login information, I enter my university
username and password, am told by kdm that a local home directory has
been created and that I must log in again, and finally log in with the
same username and password to the KDE 4.4 desktop.  At no point during
this process did it ask for university specific settings, and all the
required configuration was dynamically detected using information
fetched via DHCP and DNS.  The roaming workstation is now ready for
use.&lt;/p&gt;

&lt;p&gt;How was this done, you might wonder?  First of all, here is the
list of things that need to be configured on the client to get it
working properly out of the box:&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;IP address/netmask and DNS server.&lt;/li&gt;
&lt;li&gt;Web proxy URL.&lt;/li&gt;
&lt;li&gt;LDAP server for NSS directory information (user, group, etc).&lt;/li&gt;
&lt;li&gt;Kerberos server for PAM password checking.&lt;/li&gt;
&lt;li&gt;SMB mount point to access the network home directory. (*)&lt;/li&gt;
&lt;li&gt;Central syslog server to send syslog messages to. (*)&lt;/li&gt;
&lt;li&gt;Sitesummary collector URL to submit info to central server. (*)&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;(Hm, did I forget anything?  Let me knew if I did.)&lt;/p&gt;

&lt;p&gt;The points marked (*) are not required to be able to use the
machine, but needed to provide central storage and allowing system
administrators to track their machines.  Since yesterday, everything
but the sitesummary collector URL is dynamically discovered at boot
and installation time in the svn version of Debian Edu.&lt;/p&gt;

&lt;p&gt;The IP and DNS setup is fetched during boot using DHCP as usual.
When a DHCP update arrives, the proxy setup is updated by looking for
http://wpat/wpad.dat and using the content of this WPAD file to
configure the http and ftp proxy in /etc/environment and
/etc/apt/apt.conf.  I decided to update the proxy setup using a DHCP
hook to ensure that the client stops using the Debian Edu proxy when
it is moved outside the Debian Edu network, and instead uses any local
proxy present on the new network when it moves around.&lt;/p&gt;

&lt;p&gt;The DNS names of the LDAP, Kerberos and syslog server and related
configuration are generated using DNS information at boot.  First the
installer looks for a host named ldap in the current DNS domain.  If
not found, it looks for _ldap._tcp SRV records in DNS instead.  If an
LDAP server is found, its root DSE entry is requested and the
attributes namingContexts and defaultNamingContext are used to
determine which LDAP base to use for NSS.  If there are several
namingContexts attibutes and the defaultNamingContext is present, that
LDAP subtree is used as the base.  If defaultNamingContext is missing,
the subtrees listed as namingContexts are searched in sequence for any
object with class posixAccount or posixGroup, and the first one with
such an object is used as the LDAP base.  For Kerberos, a similar
search is done by first looking for a host named kerberos, and then
for the _kerberos._tcp SRV record.  I&#39;ve been unable to find a way to
look up the Kerberos realm, so for this the upper case string of the
current DNS domain is used.&lt;/p&gt;

&lt;p&gt;For the syslog server, the hosts syslog and loghost are searched
for, and the _syslog._udp SRV record is consulted if no such host is
found.  This algorithm works for both Debian Edu and the University of
Oslo.  A similar strategy would work for locating the sitesummary
server, but have not been implemented yet.  I decided to fetch and
save these settings during installation, to make sure moving to a
different network does not change the set of users being allowed to
log in nor the passwords required to log in.  Usernames and passwords
will be cached by sssd when the user logs in on the Debian Edu
network, and will not change as the laptop move around.  For a
non-roaming machine, there is no caching, but given that it is
supposed to stay in place it should not matter much.  Perhaps we
should switch those to use sssd too?&lt;/p&gt;

&lt;p&gt;The user&#39;s SMB mount point for the network home directory is
located when the user logs in for the first time.  The LDAP server is
consulted to look for the user&#39;s LDAP object and the sambaHomePath
attribute is used if found.  If it isn&#39;t found, the home directory
path fetched from NSS is used instead.  Assuming the path is of the
form /site/server/directory/username, the second part is looked up in
DNS and used to generate a SMB URL of the form
smb://server.domain/username.  This algorithm works for both Debian
edu and the University of Oslo.  Perhaps there are better attributes
to use or a better algorithm that works for more sites, but this will
do for now. :)&lt;/p&gt;

&lt;p&gt;This work should make it easier to integrate the Debian Edu clients
into any LDAP/Kerberos infrastructure, and make the current setup even
more flexible than before.  I suspect it will also work for thin
client servers, allowing one to easily set up LTSP and hook it into a
existing network infrastructure, but I have not had time to test this
yet.&lt;/p&gt;

&lt;p&gt;If you want to help out with implementing these things for Debian
Edu, please contact us on debian-edu@lists.debian.org.&lt;/p&gt;

&lt;p&gt;Update 2010-08-09: Simon Farnsworth gave me a heads-up on how to
detect Kerberos realm from DNS, by looking for _kerberos TXT entries
before falling back to the upper case DNS domain name.  Will have to
implement it for Debian Edu. :)&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Testing if a file system can be used for home directories...</title>
                <link>http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html</guid>
                <pubDate>Sun, 8 Aug 2010 21:20:00 +0200</pubDate>
                <description>
&lt;p&gt;A few years ago, I was involved in a project planning to use
Windows file servers as home directory servers for Debian
Edu/Skolelinux machines.  This was thought to be no problem, as the
access would be through the SMB network file system protocol, and we
knew other sites used SMB with unix and samba as the file server to
mount home directories without any problems.  But, after months of
struggling, we had to conclude that our goal was impossible.&lt;/p&gt;

&lt;p&gt;The reason is simply that while SMB can be used for home
directories when the file server is Samba running on Unix, this only
work because of Samba have some extensions and the fact that the
underlying file system is a unix file system.  When using a Windows
file server, the underlying file system do not have POSIX semantics,
and several programs will fail if the users home directory where they
want to store their configuration lack POSIX semantics.&lt;/p&gt;

&lt;p&gt;As part of this work, I wrote a small C program I want to share
with you all, to replicate a few of the problematic applications (like
OpenOffice.org and GCompris) and see if the file system was working as
it should.  If you find yourself in spooky file system land, it might
help you find your way out again.  This is the fs-test.c source:&lt;/p&gt;

&lt;pre&gt;
/*
 * Some tests to check the file system sematics.  Used to verify that
 * CIFS from a windows server do not work properly as a linux home
 * directory.
 * License: GPL v2 or later
 * 
 * needs libsqlite3-dev and build-essential installed
 * compile with: gcc -Wall -lsqlite3 -DTEST_SQLITE fs-test.c -o fs-test
*/

#define _FILE_OFFSET_BITS 64
#define _LARGEFILE_SOURCE 1
#define _LARGEFILE64_SOURCE 1

#define _GNU_SOURCE /* for asprintf() */

#include &amp;lt;errno.h&gt;
#include &amp;lt;fcntl.h&gt;
#include &amp;lt;stdio.h&gt;
#include &amp;lt;string.h&gt;
#include &amp;lt;stdlib.h&gt;
#include &amp;lt;sys/file.h&gt;
#include &amp;lt;sys/stat.h&gt;
#include &amp;lt;sys/types.h&gt;
#include &amp;lt;unistd.h&gt;

#ifdef TEST_SQLITE
/*
 * Test sqlite open, as done by gcompris require the libsqlite3-dev
 * package and linking with -lsqlite3.  A more low level test is
 * below.
 * See also &amp;lt;URL: http://www.sqlite.org./faq.html#q5 &gt;.
 */
#include &amp;lt;sqlite3.h&gt;
#define CREATE_TABLE_USERS                                              \
  &quot;CREATE TABLE users (user_id INT UNIQUE, login TEXT, lastname TEXT, firstname TEXT, birthdate TEXT, class_id INT ); &quot;
int test_sqlite_open(void) {
  char *zErrMsg;
  char *name = &quot;testsqlite.db&quot;;
  sqlite3 *db=NULL;
  unlink(name);
  int rc = sqlite3_open(name, &amp;db);
  if( rc ){
    printf(&quot;error: sqlite open of %s failed: %s\n&quot;, name, sqlite3_errmsg(db));
    sqlite3_close(db);
    return -1;
  }

  /* create tables */
  rc = sqlite3_exec(db,CREATE_TABLE_USERS, NULL,  0, &amp;zErrMsg);
  if( rc != SQLITE_OK ){
    printf(&quot;error: sqlite table create failed: %s\n&quot;, zErrMsg);
    sqlite3_close(db);
    return -1;
  }
  printf(&quot;info: sqlite worked\n&quot;);
  sqlite3_close(db);
  return 0;
}
#endif /* TEST_SQLITE */

/*
 * Demonstrate locking issue found in gcompris using sqlite3.  This
 * work with ext3, but not with cifs server on Windows 2003.  This is
 * done in the sqlite3 library.
 * See also
 * &amp;lt;URL:http://www.cygwin.com/ml/cygwin/2001-08/msg00854.html&gt; and the
 * POSIX specification
 * &amp;lt;URL:http://www.opengroup.org/onlinepubs/009695399/functions/fcntl.html&gt;.
 */
int test_gcompris_locking(void) {
  struct flock fl;
  char *name = &quot;testsqlite.db&quot;;
  unlink(name);
  int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, 0644);
  printf(&quot;info: testing fcntl locking\n&quot;);

  fl.l_whence = SEEK_SET;
  fl.l_pid    = getpid();
  printf(&quot;  Read-locking 1 byte from 1073741824&quot;);
  fl.l_start  = 1073741824;
  fl.l_len    = 1;
  fl.l_type   = F_RDLCK;
  if (0 != fcntl(fd, F_SETLK, &amp;fl) ) printf(&quot; - error!\n&quot;); else printf(&quot;\n&quot;);

  printf(&quot;  Read-locking 510 byte from 1073741826&quot;);
  fl.l_start  = 1073741826;
  fl.l_len    = 510;
  fl.l_type   = F_RDLCK;
  if (0 != fcntl(fd, F_SETLK, &amp;fl) ) printf(&quot; - error!\n&quot;); else printf(&quot;\n&quot;);

  printf(&quot;  Unlocking 1 byte from 1073741824&quot;);
  fl.l_start  = 1073741824;
  fl.l_len    = 1;
  fl.l_type   = F_UNLCK;
  if (0 != fcntl(fd, F_SETLK, &amp;fl) ) printf(&quot; - error!\n&quot;); else printf(&quot;\n&quot;);

  printf(&quot;  Write-locking 1 byte from 1073741824&quot;);
  fl.l_start  = 1073741824;
  fl.l_len    = 1;
  fl.l_type   = F_WRLCK;
  if (0 != fcntl(fd, F_SETLK, &amp;fl) ) printf(&quot; - error!\n&quot;); else printf(&quot;\n&quot;);

  printf(&quot;  Write-locking 510 byte from 1073741826&quot;);
  fl.l_start  = 1073741826;
  fl.l_len    = 510;
  if (0 != fcntl(fd, F_SETLK, &amp;fl) ) printf(&quot; - error!\n&quot;); else printf(&quot;\n&quot;);

  printf(&quot;  Unlocking 2 byte from 1073741824&quot;);
  fl.l_start  = 1073741824;
  fl.l_len    = 2;
  fl.l_type   = F_UNLCK;
  if (0 != fcntl(fd, F_SETLK, &amp;fl) ) printf(&quot; - error!\n&quot;); else printf(&quot;\n&quot;);

  close(fd);
  return 0;
}

/*
 * Test if permissions of freshly created directories allow entries
 * below them.  This was a problem with OpenOffice.org and gcompris.
 * Mounting with option &#39;sync&#39; seem to solve this problem while
 * slowing down file operations.
 */
int test_subdirectory_creation(void) {
#define LEVELS 5
  char *path = strdup(&quot;test&quot;);
  char *dirs[LEVELS];
  int level;
  printf(&quot;info: testing subdirectory creation\n&quot;);
  for (level = 0; level &amp;lt; LEVELS; level++) {
    char *newpath = NULL;
    if (-1 == mkdir(path, 0777)) {
      printf(&quot;  error: Unable to create directory &#39;%s&#39;: %s\n&quot;,
             path, strerror(errno));
      break;
    }
    asprintf(&amp;newpath, &quot;%s/%s&quot;, path, &quot;test&quot;);
    free(path);
    path = newpath;
  }
  return 0;
}

/*
 * Test if symlinks can be created.  This was a problem detected with
 * KDE.
 */
int test_symlinks(void) {
  printf(&quot;info: testing symlink creation\n&quot;);
  unlink(&quot;symlink&quot;);
  if (-1 == symlink(&quot;file&quot;, &quot;symlink&quot;))
    printf(&quot;  error: Unable to create symlink\n&quot;);
  return 0;
}

int main(int argc, char **argv) {
  printf(&quot;Testing POSIX/Unix sematics on file system\n&quot;);
  test_symlinks();
  test_subdirectory_creation();
#ifdef TEST_SQLITE
  test_sqlite_open();
#endif /* TEST_SQLITE */
  test_gcompris_locking();
  return 0;
}
&lt;/pre&gt;

&lt;p&gt;When everything is working, it should print something like
this:&lt;/p&gt;

&lt;pre&gt;
Testing POSIX/Unix sematics on file system
info: testing symlink creation
info: testing subdirectory creation
info: sqlite worked
info: testing fcntl locking
  Read-locking 1 byte from 1073741824
  Read-locking 510 byte from 1073741826
  Unlocking 1 byte from 1073741824
  Write-locking 1 byte from 1073741824
  Write-locking 510 byte from 1073741826
  Unlocking 2 byte from 1073741824
&lt;/pre&gt;

&lt;p&gt;I do not remember the exact details of the problems we saw, but one
of them was with locking, where if I remember correctly, POSIX allow a
read-only lock to be upgraded to a read-write lock without unlocking
the read-only lock (while Windows do not).  Another was a bug in the
CIFS/SMB client implementation in the Linux kernel where directory
meta information would be wrong for a fraction of a second, making
OpenOffice.org fail to create its deep directory tree because it was
not allowed to create files in its freshly created directory.&lt;/p&gt;

&lt;p&gt;Anyway, here is a nice tool for your tool box, might you never need
it. :)&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Autodetecting Client setup for roaming workstations in Debian Edu</title>
                <link>http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html</guid>
                <pubDate>Sat, 7 Aug 2010 14:45:00 +0200</pubDate>
                <description>
&lt;p&gt;A few days ago, I
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html&quot;&gt;tried
to install&lt;/a&gt; a Roaming workation profile from Debian Edu/Squeeze
while on the university network here at the University of Oslo, and
noticed how much had to change to get it operational using the
university infrastructure.  It was fairly easy, but it occured to me
that Debian Edu would improve a lot if I could get the client to
connect without any changes at all, and thus let the client configure
itself during installation and first boot to use the infrastructure
around it.  Now I am a huge step further along that road.&lt;/p&gt;

&lt;p&gt;With our current squeeze-test packages, I can select the roaming
workstation profile and get a working laptop connecting to the
university LDAP server for user and group and our active directory
servers for Kerberos authentication.  All this without any
configuration at all during installation.  My users home directory got
a bookmark in the KDE menu to mount it via SMB, with the correct URL.
In short, openldap and sssd is correctly configured.  In addition to
this, the client look for http://wpad/wpad.dat to configure a web
proxy, and when it fail to find it no proxy settings are stored in
/etc/environment and /etc/apt/apt.conf.  Iceweasel and KDE is
configured to look for the same wpad configuration and also do not use
a proxy when at the university network.  If the machine is moved to a
network with such wpad setup, it would automatically use it when DHCP
gave it a IP address.&lt;/p&gt;

&lt;p&gt;The LDAP server is located using DNS, by first looking for the DNS
entry ldap.$domain.  If this do not exist, it look for the
_ldap._tcp.$domain SRV records and use the first one as the LDAP
server.  Next, it connects to the LDAP server and search all
namingContexts entries for posixAccount or posixGroup objects, and
pick the first one as the LDAP base.  For Kerberos, a similar
algorithm is used to locate the LDAP server, and the realm is the
uppercase version of $domain.&lt;/p&gt;

&lt;p&gt;So, what is not working, you might ask.  SMB mounting my home
directory do not work.  No idea why, but suspected the incorrect
Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
the cause.  These are not properly configured during installation, and
had to be hand-edited to get the correct Kerberos realm and server,
but SMB mounting still do not work. :(&lt;/p&gt;

&lt;p&gt;With this automatic configuration in place, I expect a Debian Edu
roaming profile installation would be able to automatically detect and
connect to any site using LDAP and Kerberos for NSS directory and PAM
authentication.  It should also work out of the box in a Active
Directory environment providing posixAccount and posixGroup objects
with UID and GID values.&lt;/p&gt;

&lt;p&gt;If you want to help out with implementing these things for Debian
Edu, please contact us on debian-edu@lists.debian.org.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Debian Edu roaming workstation - at the university of Oslo</title>
                <link>http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html</guid>
                <pubDate>Tue, 3 Aug 2010 23:30:00 +0200</pubDate>
                <description>
&lt;p&gt;The new roaming workstation profile in Debian Edu/Squeeze is fairly
similar to the laptop setup am I working on using Ubuntu for the
University of Oslo, and just for the heck of it, I tested today how
hard it would be to integrate that profile into the university
infrastructure.  In this case, it is the university LDAP server,
Active Directory Kerberos server and SMB mounting from the Netapp file
servers.&lt;/p&gt;

&lt;p&gt;I was pleasantly surprised that the only three files needed to be
changed (/etc/sssd/sssd.conf, /etc/ldap.conf and
/etc/mklocaluser.d/20-debian-edu-config) and one file had to be added
(/usr/share/perl5/Debian/Edu_Local.pm), to get the client working.
Most of the changes were to get the client to use the university LDAP
for NSS and Kerberos server for PAM, but one was to change a hard
coded DNS domain name in the mklocaluser hook from .intern to
.uio.no.&lt;/p&gt;

&lt;p&gt;This testing was so encouraging, that I went ahead and adjusted the
Debian Edu scripts and setup in subversion to centralise the roaming
workstation setup a bit more and avoid the hardcoded DNS domain name,
so that when I test this tomorrow, I expect to get away with modifying
only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the
university servers.&lt;/p&gt;

&lt;p&gt;My goal is to get the clients to have no hardcoded settings and
fetch all their initial setup during installation and first boot, to
allow them to be inserted also into environments where the default
setup in Debian Edu has been changed or as with the university, where
the environment is different but provides the protocols Debian Edu
uses.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Circular package dependencies harms apt recovery</title>
                <link>http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html</guid>
                <pubDate>Tue, 27 Jul 2010 23:50:00 +0200</pubDate>
                <description>
&lt;p&gt;I discovered this while doing
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html&quot;&gt;automated
testing of upgrades from Debian Lenny to Squeeze&lt;/a&gt;.  A few packages
in Debian still got circular dependencies, and it is often claimed
that apt and aptitude should be able to handle this just fine, but
some times these dependency loops causes apt to fail.&lt;/p&gt;

&lt;p&gt;An example is from todays
&lt;a href=&quot;http://people.skolelinux.org/~pere/debian-upgrade-testing//test-20100727-lenny-squeeze-kde-aptitude.txt&quot;&gt;upgrade
of KDE using aptitude&lt;/a&gt;.  In it, a bug in kdebase-workspace-data
causes perl-modules to fail to upgrade.  The cause is simple.  If a
package fail to unpack, then only part of packages with the circular
dependency might end up being unpacked when unpacking aborts, and the
ones already unpacked will fail to configure in the recovery phase
because its dependencies are unavailable.&lt;/p&gt;

&lt;p&gt;In this log, the problem manifest itself with this error:&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
dpkg: dependency problems prevent configuration of perl-modules:
 perl-modules depends on perl (&gt;= 5.10.1-1); however:
  Version of perl on system is 5.10.0-19lenny2.
dpkg: error processing perl-modules (--configure):
 dependency problems - leaving unconfigured
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;p&gt;The perl/perl-modules circular dependency is already
&lt;a href=&quot;http://bugs.debian.org/527917&quot;&gt;reported as a bug&lt;/a&gt;, and will
hopefully be solved as soon as possible, but it is not the only one,
and each one of these loops in the dependency tree can cause similar
failures.  Of course, they only occur when there are bugs in other
packages causing the unpacking to fail, but it is rather nasty when
the failure of one package causes the problem to become worse because
of dependency loops.&lt;/p&gt;

&lt;p&gt;Thanks to
&lt;a href=&quot;http://lists.debian.org/debian-devel/2010/06/msg00116.html&quot;&gt;the
tireless effort by Bill Allombert&lt;/a&gt;, the number of circular
dependencies
&lt;a href=&quot;http://debian.semistable.com/debgraph.out.html&quot;&gt;left in Debian
is dropping&lt;/a&gt;, and perhaps it will reach zero one day. :)&lt;/p&gt;

&lt;p&gt;Todays testing also exposed a bug in
&lt;a href=&quot;http://bugs.debian.org/590605&quot;&gt;update-notifier&lt;/a&gt; and
&lt;a href=&quot;http://bugs.debian.org/590604&quot;&gt;different behaviour&lt;/a&gt; between
apt-get and aptitude, the latter possibly caused by some circular
dependency.  Reported both to BTS to try to get someone to look at
it.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>First Debian Edu test release (alpha0) based on Squeeze is released</title>
                <link>http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html</guid>
                <pubDate>Tue, 27 Jul 2010 17:45:00 +0200</pubDate>
                <description>
&lt;p&gt;I just posted this announcement culminating several months of work
with the next Debian Edu release.  Not nearly done, but one major step
completed.&lt;/p&gt;

&lt;blockquote&gt;
&lt;p&gt;This is the first test release based on Squeeze. The focus of this
release is to test the user application selection. To have a look,
install the standalone profile and let the developers know if the set
of installed packages i.e. applications should be modified. If some
user application is missing, or if there are some applications that no
longer make sense to be included in Debian Edu, please let us know.
Also, if a useful application is missing the translation for your
language of choice, please let us know too.&lt;/p&gt;

&lt;p&gt;In addition, feedback and help to polish the desktop (menus,
artwork, starters, etc.) is appreciated. We would like to ship a nice
and handy KDE4 desktop targeted for schools out of the box.&lt;/p&gt;

&lt;p&gt;The other profiles should be installable, but there is a lot more
work left to be done before they are ready, so do not expect to
much.&lt;/p&gt;

&lt;p&gt;Changes compared to the lenny based version&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Everything from Debian Squeeze
&lt;ul&gt;
  &lt;li&gt;Desktop environment KDE 4.4 =&gt; the new KDE desktop in
         combination with some new artwork
  &lt;li&gt;Web browser Iceweasel 3.5
  &lt;li&gt;OpenOffice.org 3.2
  &lt;li&gt;Educational toolbox GCompris 9.3
  &lt;li&gt;Music creator Rosegarden 10.04.2
  &lt;li&gt;Image editor Gimp 2.6.10
  &lt;li&gt;Virtual universe Celestia 1.6.0
  &lt;li&gt;Virtual stargazer Stellarium 0.10.4
  &lt;li&gt;3D modeler Blender 2.49.2 (new application)
  &lt;li&gt;Video editor Kdenlive 0.7.7 (new application)
&lt;/ul&gt;&lt;/li&gt;
&lt;li&gt;Now using Kerberos for password checking (migration not finished).
    Enabled for:
&lt;ul&gt;
  &lt;li&gt;PAM
  &lt;li&gt;LDAP
  &lt;li&gt;IMAP
  &lt;li&gt;SMTP (sender verification)
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;New experimental roaming workstation profile for laptops.&lt;/li&gt;
&lt;li&gt;Show welcome page to users when they first log in. The URL is
    fetched from LDAP.&lt;/li&gt;
&lt;li&gt;New LXDE desktop option, in addition to KDE (default) and Gnome.&lt;/li&gt;
&lt;li&gt;General cleanup (not finished)&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;The following features are not working as they should&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;No web based administration tool for creating users and groups. The
    scripts ldap-createuser-krb and ldap-add-user-to-group can be used
    for testing.&lt;/li&gt;
&lt;li&gt;DVD installs are missing debian-installer images for the PXE boot,
    and do not set up the PXE menu on eth0 because of this. LTSP
    clients should still boot from eth1 on thin client servers.&lt;/li&gt;
&lt;li&gt;The restructured KDE menu is not implemented.&lt;/li&gt;
&lt;li&gt;The LDAP server setup need to be reviewed for security.&lt;/li&gt;
&lt;li&gt;The LDAP directory structure need to be reworked.&lt;/li&gt;
&lt;li&gt;Different sets of packages are installed when using the DVD and the
    netinst CD. More packages are installed using the netinst CD.&lt;/li&gt;
&lt;li&gt;The jackd package fail to install. This is believed to be caused by
    some ongoing transition, and hopefully should be solved soon. The
    jackd1 package can be installed manually for those that need it.&lt;/li&gt;
&lt;li&gt;Some packages lack translations. See
    http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status,
    and help out with translations.&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;To download this multiarch netinstall release you can use&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href=&quot;ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso&quot;&gt;ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso&quot;&gt;http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;To download this multiarch dvd release you can use&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href=&quot;ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso&quot;&gt;ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso&quot;&gt;http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;There is no source DVD available yet. It will be prepared when we
get closer to the final release.&lt;/p&gt;

&lt;p&gt;The MD5SUM of these images are&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-6.0.0+edua0-CD.iso&lt;/li&gt;
&lt;li&gt;22f2cbfce281d1c6e478be452638675d debian-edu-6.0.0+edua0-DVD.iso&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;The SHA1SUM of these images are&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-6.0.0+edua0-CD.iso&lt;/li&gt;
&lt;li&gt;2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-6.0.0+edua0-DVD.iso&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;How to report bugs:
http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla&lt;/p&gt;

&lt;p&gt;Please direct replies to debian-edu@lists.debian.org&lt;/p&gt;
&lt;/blockquote&gt;
</description>
        </item>
        
        <item>
                <title>One step closer to single signon in Debian Edu</title>
                <link>http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html</guid>
                <pubDate>Sun, 25 Jul 2010 10:00:00 +0200</pubDate>
                <description>
&lt;p&gt;The last few months me and the other Debian Edu developers have
been working hard to get the Debian/Squeeze based version of Debian
Edu/Skolelinux into shape.  This future version will use Kerberos for
authentication, and services are slowly migrated to single signon,
getting rid of password questions one at the time.&lt;/p&gt;

&lt;p&gt;It will also feature a roaming workstation profile with local home
directory, for laptops that are only some times on the Skolelinux
network, and for this profile a shortcut is created in Gnome and KDE
to gain access to the users home directory on the file server.  This
shortcut uses SMB at the moment, and yesterday I had time to test if
SMB mounting had started working in KDE after we added the cifs-utils
package.  I was pleasantly surprised how well it worked.&lt;/p&gt;

&lt;p&gt;Thanks to the recent changes to our samba configuration to get it
to use Kerberos for authentication, there were no question about user
password when mounting the SMB volume.  A simple click on the shortcut
in the KDE menu, and a window with the home directory popped
up. :)&lt;/p&gt;

&lt;p&gt;One step closer to a single signon solution out of the box in
Debian Edu.  We already had PAM, LDAP, IMAP and SMTP in place, and now
also Samba.  Next step is Cups and hopefully also NFS.&lt;/p&gt;

&lt;p&gt;We had planned a alpha0 release of Debian Edu for today, but thanks
to the autobuilder administrators for some architectures being slow to
sign packages, we are still missing the fixed LTSP package we need for
the release.  It was uploaded three days ago with urgency=high, and if
it had entered testing yesterday we would have been able to test it in
time for a alpha0 release today.  As the binaries for ia64 and powerpc
still not uploaded to the Debian archive, we need to delay the alpha
release another day.&lt;/p&gt;

&lt;p&gt;If you want to help out with implementing Kerberos for Debian Edu,
please contact us on debian-edu@lists.debian.org.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Digitale restriksjonsmekanismer fikk meg til å slutte å kjøpe musikk</title>
                <link>http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til____slutte____kj__pe_musikk.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til____slutte____kj__pe_musikk.html</guid>
                <pubDate>Thu, 22 Jul 2010 23:50:00 +0200</pubDate>
                <description>
&lt;p&gt;For mange år siden slutte jeg å kjøpe musikk-CDer. Årsaken var at
musikkbransjen var godt i gang med å selge platene sine med DRM som
gjorde at jeg ikke fikk spilt av musikken jeg kjøpte på utstyret jeg
hadde tilgjengelig, dvs. min datamaskin. Det var umulig å se på en
plate om den var ødelagt eller ikke, og jeg hadde jo allerede en
anseelig samling med plater, så jeg bestemme meg for å slutte å gi
penger til en bransje som åpenbart ikke respekterte meg.&lt;/p&gt;

&lt;p&gt;Jeg har mange titalls dager med musikk på CD i dag. Det meste er
lagt i et stort arkiv som kan spilles av fra husets datamaskiner (har
ikke rukket rippe alt). Jeg ser dermed ikke behovet for å skaffe mer
musikk. De fleste av mine favoritter er i hus, og jeg er dermed godt
fornøyd.&lt;/p&gt;

&lt;p&gt;Hvis musikkbransjen ønsker mine penger, så må de demonstrere at de
setter pris på meg som kunde, og ikke skremme meg bort med DRM og
antydninger om at kundene er kriminelle.&lt;/p&gt;

&lt;p&gt;Filmbransjen er like ille, men mens musikk gjerne varer lenge, er
filmer mer ferskvare. Har dermed ikke helt sluttet å kjøpe filmer, men
holder meg til DVD-filmer som kan spilles av på mine Linuxbokser.
Kommer neppe til å ta i bruk Blueray, og ei heller de nye DRM-greiene
«Ultraviolet» som be annonsert her om dagen.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>OpenStreetmap one step closer to having routing on its front page</title>
                <link>http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html</guid>
                <pubDate>Sun, 18 Jul 2010 16:45:00 +0200</pubDate>
                <description>
&lt;p&gt;Thanks to
&lt;a href=&quot;http://feedproxy.google.com/~r/Opengeodata/~3/wUTCzDZk3lc/project-of-the-week-which-way-home&quot;&gt;todays
opengeodata blog entry&lt;/a&gt;, I just discovered that the
OpenStreetmap.org site have gotten
&lt;a href=&quot;http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT&quot;&gt;support
for calculating routes&lt;/a&gt;.  The support is still experimental and
only available from the development server, until more experience is
gathered on the user interface and any scalability issues.&lt;/p&gt;

&lt;p&gt;Earlier, the routing I knew about using the OpenStreetmap.org data
was provided by &lt;a href=&quot;http://maps.cloudmade.com/&quot;&gt;Cloudmade&lt;/a&gt;,
but having it on the main page is required to make everyone aware of
the issue.  I&#39;ve had people reject Openstreetmap.org as a viable
alternative for them because the front page lacked routing support,
and I hope their needs will be catered for when routing show up on the
www.openstreetmap.org front page.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>What are they searching for - PowerDNS and ISC DHCP in LDAP</title>
                <link>http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html</guid>
                <pubDate>Sat, 17 Jul 2010 21:00:00 +0200</pubDate>
                <description>
&lt;p&gt;This is a
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html&quot;&gt;followup&lt;/a&gt;
on my
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html&quot;&gt;previous
work&lt;/a&gt; on
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html&quot;&gt;merging
all&lt;/a&gt; the computer related LDAP objects in Debian Edu.&lt;/p&gt;

&lt;p&gt;As a step to try to see if it possible to merge the DNS and DHCP
LDAP objects, I have had a look at how the packages pdns-backend-ldap
and dhcp3-server-ldap in Debian use the LDAP server.  The two
implementations are quite different in how they use LDAP.&lt;/p&gt;

To get this information, I started slapd with debugging enabled and
dumped the debug output to a file to get the LDAP searches performed
on a Debian Edu main-server.  Here is a summary.

&lt;p&gt;&lt;strong&gt;powerdns&lt;/strong&gt;&lt;/p&gt;

&lt;a href=&quot;http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend&quot;&gt;Clues
on how to&lt;/a&gt; set up PowerDNS to use a LDAP backend is available on
the web.

&lt;p&gt;PowerDNS have two modes of operation using LDAP as its backend.
One &quot;strict&quot; mode where the forward and reverse DNS lookups are done
using the same LDAP objects, and a &quot;tree&quot; mode where the forward and
reverse entries are in two different subtrees in LDAP with a structure
based on the DNS names, as in tjener.intern and
2.2.0.10.in-addr.arpa.&lt;/p&gt;

&lt;p&gt;In tree mode, the server is set up to use a LDAP subtree as its
base, and uses a &quot;base&quot; scoped search for the DNS name by adding
&quot;dc=tjener,dc=intern,&quot; to the base with a filter for
&quot;(associateddomain=tjener.intern)&quot; for the forward entry and
&quot;dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,&quot; with a filter for
&quot;(associateddomain=2.2.0.10.in-addr.arpa)&quot; for the reverse entry.  For
forward entries, it is looking for attributes named dnsttl, arecord,
nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
spfrecord and modifytimestamp.  For reverse entries it is looking for
the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
ldapsearch commands could look like this:&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
ldapsearch -h ldap \
  -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
  -s base -x &#39;(associateddomain=tjener.intern)&#39; dNSTTL aRecord nSRecord \
  cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
  rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
  nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
  rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp

ldapsearch -h ldap \
  -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
  -s base -x &#39;(associateddomain=2.2.0.10.in-addr.arpa)&#39;
  dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
  hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
  srvrecord naptrrecord modifytimestamp
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;p&gt;In Debian Edu/Lenny, the PowerDNS tree mode is used with
ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
example LDAP objects used there.  In addition to these objects, the
parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
also exist.&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
objectclass: top
objectclass: dnsdomain
objectclass: domainrelatedobject
dc: tjener
arecord: 10.0.2.2
associateddomain: tjener.intern

dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
objectclass: top
objectclass: dnsdomain2
objectclass: domainrelatedobject
dc: 2
ptrrecord: tjener.intern
associateddomain: 2.2.0.10.in-addr.arpa
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;p&gt;In strict mode, the server behaves differently.  When looking for
forward DNS entries, it is doing a &quot;subtree&quot; scoped search with the
same base as in the tree mode for a object with filter
&quot;(associateddomain=tjener.intern)&quot; and requests the attributes dnsttl,
arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
naptrrecord and modifytimestamp.  For reverse entires it also do a
subtree scoped search but this time the filter is &quot;(arecord=10.0.2.2)&quot;
and the requested attributes are associateddomain, dnsttl and
modifytimestamp.  In short, in strict mode the objects with ptrrecord
go away, and the arecord attribute in the forward object is used
instead.&lt;/p&gt;

&lt;p&gt;The forward and reverse searches can be simulated using ldapsearch
like this:&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
  &#39;(associateddomain=tjener.intern)&#39; dNSTTL aRecord nSRecord \
  cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
  rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
  nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
  rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp

ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
  &#39;(arecord=10.0.2.2)&#39; associateddomain dnsttl modifytimestamp
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;p&gt;In addition to the forward and reverse searches , there is also a
search for SOA records, which behave similar to the forward and
reverse lookups.&lt;/p&gt;

&lt;p&gt;A thing to note with the PowerDNS behaviour is that it do not
specify any objectclass names, and instead look for the attributes it
need to generate a DNS reply.  This make it able to work with any
objectclass that provide the needed attributes.&lt;/p&gt;

&lt;p&gt;The attributes are normally provided in the cosine (RFC 1274) and
dnsdomain2 schemas.  The latter is used for reverse entries like
ptrrecord and recent DNS additions like aaaarecord and srvrecord.&lt;/p&gt;

&lt;p&gt;In Debian Edu, we have created DNS objects using the object classes
dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
attributes) and domainrelatedobject (for associatedDomain).  The use
of structural object classes make it impossible to combine these
classes with the object classes used by DHCP.&lt;/p&gt;

&lt;p&gt;There are other schemas that could be used too, for example the
dnszone structural object class used by Gosa and bind-sdb for the DNS
attributes combined with the domainrelatedobject object class, but in
this case some unused attributes would have to be included as well
(zonename and relativedomainname).&lt;/p&gt;

&lt;p&gt;My proposal for Debian Edu would be to switch PowerDNS to strict
mode and not use any of the existing objectclasses (dnsdomain,
dnsdomain2 and dnszone) when one want to combine the DNS information
with DHCP information, and instead create a auxiliary object class
defined something like this (using the attributes defined for
dnsdomain and dnsdomain2 or dnszone):&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
objectclass ( some-oid NAME &#39;dnsDomainAux&#39;
    SUP top
    AUXILIARY
    MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
          DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
          TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
          NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
          A6Record $ DNAMERecord
    ))
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;p&gt;This will allow any object to become a DNS entry when combined with
the domainrelatedobject object class, and allow any entity to include
all the attributes PowerDNS wants.  I&#39;ve sent an email to the PowerDNS
developers asking for their view on this schema and if they are
interested in providing such schema with PowerDNS, and I hope my
message will be accepted into their mailing list soon.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;ISC dhcp&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;The DHCP server searches for specific objectclass and requests all
the object attributes, and then uses the attributes it want.  This
make it harder to figure out exactly what attributes are used, but
thanks to the working example in Debian Edu I can at least get an idea
what is needed without having to read the source code.&lt;/p&gt;

&lt;p&gt;In the DHCP server configuration, the LDAP base to use and the
search filter to use to locate the correct dhcpServer entity is
stored.  These are the relevant entries from
/etc/dhcp3/dhcpd.conf:&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
ldap-base-dn &quot;dc=skole,dc=skolelinux,dc=no&quot;;
ldap-dhcp-server-cn &quot;dhcp&quot;;
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;p&gt;The DHCP server uses this information to nest all the DHCP
configuration it need.  The cn &quot;dhcp&quot; is located using the given LDAP
base and the filter &quot;(&amp;(objectClass=dhcpServer)(cn=dhcp))&quot;.  The
search result is this entry:&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
cn: dhcp
objectClass: top
objectClass: dhcpServer
dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;p&gt;The content of the dhcpServiceDN attribute is next used to locate the
subtree with DHCP configuration.  The DHCP configuration subtree base
is located using a base scope search with base &quot;cn=DHCP
Config,dc=skole,dc=skolelinux,dc=no&quot; and filter
&quot;(&amp;(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))&quot;.
The search result is this entry:&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
cn: DHCP Config
objectClass: top
objectClass: dhcpService
objectClass: dhcpOptions
dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
dhcpStatements: ddns-update-style none
dhcpStatements: authoritative
dhcpOption: smtp-server code 69 = array of ip-address
dhcpOption: www-server code 72 = array of ip-address
dhcpOption: wpad-url code 252 = text
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;p&gt;Next, the entire subtree is processed, one level at the time.  When
all the DHCP configuration is loaded, it is ready to receive requests.
The subtree in Debian Edu contain objects with object classes
top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
and information about netmasks, dynamic range etc.  Leaving out the
details here because it is not relevant for the focus of my
investigation, which is to see if it is possible to merge dns and dhcp
related computer objects.&lt;/p&gt;

&lt;p&gt;When a DHCP request come in, LDAP is searched for the MAC address
of the client (00:00:00:00:00:00 in this example), using a subtree
scoped search with &quot;cn=DHCP Config,dc=skole,dc=skolelinux,dc=no&quot; as
the base and &quot;(&amp;(objectClass=dhcpHost)(dhcpHWAddress=ethernet
00:00:00:00:00:00))&quot; as the filter.  This is what a host object look
like:&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
cn: hostname
objectClass: top
objectClass: dhcpHost
dhcpHWAddress: ethernet 00:00:00:00:00:00
dhcpStatements: fixed-address hostname
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;p&gt;There is less flexiblity in the way LDAP searches are done here.
The object classes need to have fixed names, and the configuration
need to be stored in a fairly specific LDAP structure.  On the
positive side, the invidiual dhcpHost entires can be anywhere without
the DN pointed to by the dhcpServer entries.  The latter should make
it possible to group all host entries in a subtree next to the
configuration entries, and this subtree can also be shared with the
DNS server if the schema proposed above is combined with the dhcpHost
structural object class.

&lt;p&gt;&lt;strong&gt;Conclusion&lt;/strong&gt;&lt;/p&gt;

&lt;p&gt;The PowerDNS implementation seem to be very flexible when it come
to which LDAP schemas to use.  While its &quot;tree&quot; mode is rigid when it
come to the the LDAP structure, the &quot;strict&quot; mode is very flexible,
allowing DNS objects to be stored anywhere under the base cn specified
in the configuration.&lt;/p&gt;

&lt;p&gt;The DHCP implementation on the other hand is very inflexible, both
regarding which LDAP schemas to use and which LDAP structure to use.
I guess one could implement ones own schema, as long as the
objectclasses and attributes have the names used, but this do not
really help when the DHCP subtree need to have a fairly fixed
structure.&lt;/p&gt;

&lt;p&gt;Based on the observed behaviour, I suspect a LDAP structure like
this might work for Debian Edu:&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
ou=services
  cn=machine-info (dhcpService) - dhcpServiceDN points here
    cn=dhcp (dhcpServer)
    cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
      cn=10.0.2.0 (dhcpSubnet)
        cn=group1 (dhcpGroup/dhcpOptions)
    cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
      cn=192.168.0.0 (dhcpSubnet)
        cn=group1 (dhcpGroup/dhcpOptions)
    ou=machines - PowerDNS base points here
      cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;P&gt;This is not tested yet.  If the DHCP server require the dhcpHost
entries to be in the dhcpGroup subtrees, the entries can be stored
there instead of a common machines subtree, and the PowerDNS base
would have to be moved one level up to the machine-info subtree.&lt;/p&gt;

&lt;p&gt;The combined object under the machines subtree would look something
like this:&lt;/p&gt;
    
&lt;blockquote&gt;&lt;pre&gt;
dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
dc: hostname
objectClass: top
objectClass: dhcpHost
objectclass: domainrelatedobject
objectclass: dnsDomainAux
associateddomain: hostname.intern
arecord: 10.11.12.13
dhcpHWAddress: ethernet 00:00:00:00:00:00
dhcpStatements: fixed-address hostname.intern
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;/p&gt;One could even add the LTSP configuration associated with a given
machine, as long as the required attributes are available in a
auxiliary object class.&lt;/p&gt;
</description>
        </item>
        
        </channel>
</rss>