blog/archive/2010/07/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
   4   <head>
   5     <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
   6     <title>Petter Reinholdtsen: entries from July 2010</title>
   7     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css" />
   8     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/vim.css" />
   9     <link rel="alternate" title="RSS Feed" href="07.rss" type="application/rss+xml" />
  10   </head>
  11   <body>
  12     <!-- XML FEED -->
  13     <div class="title">
  14  <h1>
  15      <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  16
  17  </h1>
  18
  19 </div>
  20
  21
  22     <h3>Entries from July 2010.</h3>
  23
  24     <div class="entry">
  25       <div class="title">
  26         <a href="http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html">Circular package dependencies harms apt recovery</a>
  27       </div>
  28       <div class="date">
  29         27th July 2010
  30       </div>
  31       <div class="body">
  32         <p>I discovered this while doing
  33 <a href="http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html">automated
  34 testing of upgrades from Debian Lenny to Squeeze</a>.  A few packages
  35 in Debian still got circular dependencies, and it is often claimed
  36 that apt and aptitude should be able to handle this just fine, but
  37 some times these dependency loops causes apt to fail.</p>
  38
  39 <p>An example is from todays
  40 <a href="http://people.skolelinux.org/~pere/debian-upgrade-testing//test-20100727-lenny-squeeze-kde-aptitude.txt">upgrade
  41 of KDE using aptitude</a>.  In it, a bug in kdebase-workspace-data
  42 causes perl-modules to fail to upgrade.  The cause is simple.  If a
  43 package fail to unpack, then only part of packages with the circular
  44 dependency might end up being unpacked when unpacking aborts, and the
  45 ones already unpacked will fail to configure in the recovery phase
  46 because its dependencies are unavailable.</p>
  47
  48 <p>In this log, the problem manifest itself with this error:</p>
  49
  50 <blockquote><pre>
  51 dpkg: dependency problems prevent configuration of perl-modules:
  52  perl-modules depends on perl (>= 5.10.1-1); however:
  53   Version of perl on system is 5.10.0-19lenny2.
  54 dpkg: error processing perl-modules (--configure):
  55  dependency problems - leaving unconfigured
  56 </pre></blockquote>
  57
  58 <p>The perl/perl-modules circular dependency is already
  59 <a href="http://bugs.debian.org/527917">reported as a bug</a>, and will
  60 hopefully be solved as soon as possible, but it is not the only one,
  61 and each one of these loops in the dependency tree can cause similar
  62 failures.  Of course, they only occur when there are bugs in other
  63 packages causing the unpacking to fail, but it is rather nasty when
  64 the failure of one package causes the problem to become worse because
  65 of dependency loops.</p>
  66
  67 <p>Thanks to
  68 <a href="http://lists.debian.org/debian-devel/2010/06/msg00116.html">the
  69 tireless effort by Bill Allombert</a>, the number of circular
  70 dependencies
  71 <a href="http://debian.semistable.com/debgraph.out.html">left in Debian
  72 is dropping</a>, and perhaps it will reach zero one day. :)</p>
  73
  74 <p>Todays testing also exposed a bug in
  75 <a href="http://bugs.debian.org/590605">update-notifier</a> and
  76 <a href="http://bugs.debian.org/590604">different behaviour</a> between
  77 apt-get and aptitude, the latter possibly caused by some circular
  78 dependency.  Reported both to BTS to try to get someone to look at
  79 it.</p>
  80
  81       </div>
  82       <div class="tags">
  83
  84
  85         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
  86
  87
  88       </div>
  89     </div>
  90     <div class="padding"></div>
  91
  92     <div class="entry">
  93       <div class="title">
  94         <a href="http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html">First Debian Edu test release (alpha0) based on Squeeze is released</a>
  95       </div>
  96       <div class="date">
  97         27th July 2010
  98       </div>
  99       <div class="body">
 100         <p>I just posted this announcement culminating several months of work
 101 with the next Debian Edu release.  Not nearly done, but one major step
 102 completed.</p>
 103
 104 <blockquote>
 105 <p>This is the first test release based on Squeeze. The focus of this
 106 release is to test the user application selection. To have a look,
 107 install the standalone profile and let the developers know if the set
 108 of installed packages i.e. applications should be modified. If some
 109 user application is missing, or if there are some applications that no
 110 longer make sense to be included in Debian Edu, please let us know.
 111 Also, if a useful application is missing the translation for your
 112 language of choice, please let us know too.</p>
 113
 114 <p>In addition, feedback and help to polish the desktop (menus,
 115 artwork, starters, etc.) is appreciated. We would like to ship a nice
 116 and handy KDE4 desktop targeted for schools out of the box.</p>
 117
 118 <p>The other profiles should be installable, but there is a lot more
 119 work left to be done before they are ready, so do not expect to
 120 much.</p>
 121
 122 <p>Changes compared to the lenny based version</p>
 123
 124 <ul>
 125 <li>Everything from Debian Squeeze
 126 <ul>
 127   <li>Desktop environment KDE 4.4 => the new KDE desktop in
 128          combination with some new artwork
 129   <li>Web browser Iceweasel 3.5
 130   <li>OpenOffice.org 3.2
 131   <li>Educational toolbox GCompris 9.3
 132   <li>Music creator Rosegarden 10.04.2
 133   <li>Image editor Gimp 2.6.10
 134   <li>Virtual universe Celestia 1.6.0
 135   <li>Virtual stargazer Stellarium 0.10.4
 136   <li>3D modeler Blender 2.49.2 (new application)
 137   <li>Video editor Kdenlive 0.7.7 (new application)
 138 </ul></li>
 139 <li>Now using Kerberos for password checking (migration not finished).
 140     Enabled for:
 141 <ul>
 142   <li>PAM
 143   <li>LDAP
 144   <li>IMAP
 145   <li>SMTP (sender verification)
 146 </ul>
 147 </li>
 148 <li>New experimental roaming workstation profile for laptops.</li>
 149 <li>Show welcome page to users when they first log in. The URL is
 150     fetched from LDAP.</li>
 151 <li>New LXDE desktop option, in addition to KDE (default) and Gnome.</li>
 152 <li>General cleanup (not finished)</li>
 153 </ul>
 154 <p>The following features are not working as they should</p>
 155
 156 <ul>
 157 <li>No web based administration tool for creating users and groups. The
 158     scripts ldap-createuser-krb and ldap-add-user-to-group can be used
 159     for testing.</li>
 160 <li>DVD installs are missing debian-installer images for the PXE boot,
 161     and do not set up the PXE menu on eth0 because of this. LTSP
 162     clients should still boot from eth1 on thin client servers.</li>
 163 <li>The restructured KDE menu is not implemented.</li>
 164 <li>The LDAP server setup need to be reviewed for security.</li>
 165 <li>The LDAP directory structure need to be reworked.</li>
 166 <li>Different sets of packages are installed when using the DVD and the
 167     netinst CD. More packages are installed using the netinst CD.</li>
 168 <li>The jackd package fail to install. This is believed to be caused by
 169     some ongoing transition, and hopefully should be solved soon. The
 170     jackd1 package can be installed manually for those that need it.</li>
 171 <li>Some packages lack translations. See
 172     http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status,
 173     and help out with translations.</li>
 174 </ul>
 175
 176 <p>To download this multiarch netinstall release you can use</p>
 177
 178 <ul>
 179 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
 180 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
 181 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</li>
 182 </ul>
 183 <p>To download this multiarch dvd release you can use</p>
 184
 185 <ul>
 186 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
 187 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
 188 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</li>
 189 </ul>
 190
 191 <p>There is no source DVD available yet. It will be prepared when we
 192 get closer to the final release.</p>
 193
 194 <p>The MD5SUM of these images are</p>
 195
 196 <ul>
 197 <li>3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-6.0.0+edua0-CD.iso</li>
 198 <li>22f2cbfce281d1c6e478be452638675d debian-edu-6.0.0+edua0-DVD.iso</li>
 199 </ul>
 200
 201 <p>The SHA1SUM of these images are</p>
 202 <ul>
 203 <li>c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-6.0.0+edua0-CD.iso</li>
 204 <li>2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-6.0.0+edua0-DVD.iso</li>
 205 </ul>
 206 <p>How to report bugs:
 207 http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla</p>
 208
 209 <p>Please direct replies to debian-edu@lists.debian.org</p>
 210 </blockquote>
 211
 212       </div>
 213       <div class="tags">
 214
 215
 216         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 217
 218
 219       </div>
 220     </div>
 221     <div class="padding"></div>
 222
 223     <div class="entry">
 224       <div class="title">
 225         <a href="http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html">One step closer to single signon in Debian Edu</a>
 226       </div>
 227       <div class="date">
 228         25th July 2010
 229       </div>
 230       <div class="body">
 231         <p>The last few months me and the other Debian Edu developers have
 232 been working hard to get the Debian/Squeeze based version of Debian
 233 Edu/Skolelinux into shape.  This future version will use Kerberos for
 234 authentication, and services are slowly migrated to single signon,
 235 getting rid of password questions one at the time.</p>
 236
 237 <p>It will also feature a roaming workstation profile with local home
 238 directory, for laptops that are only some times on the Skolelinux
 239 network, and for this profile a shortcut is created in Gnome and KDE
 240 to gain access to the users home directory on the file server.  This
 241 shortcut uses SMB at the moment, and yesterday I had time to test if
 242 SMB mounting had started working in KDE after we added the cifs-utils
 243 package.  I was pleasantly surprised how well it worked.</p>
 244
 245 <p>Thanks to the recent changes to our samba configuration to get it
 246 to use Kerberos for authentication, there were no question about user
 247 password when mounting the SMB volume.  A simple click on the shortcut
 248 in the KDE menu, and a window with the home directory popped
 249 up. :)</p>
 250
 251 <p>One step closer to a single signon solution out of the box in
 252 Debian Edu.  We already had PAM, LDAP, IMAP and SMTP in place, and now
 253 also Samba.  Next step is Cups and hopefully also NFS.</p>
 254
 255 <p>We had planned a alpha0 release of Debian Edu for today, but thanks
 256 to the autobuilder administrators for some architectures being slow to
 257 sign packages, we are still missing the fixed LTSP package we need for
 258 the release.  It was uploaded three days ago with urgency=high, and if
 259 it had entered testing yesterday we would have been able to test it in
 260 time for a alpha0 release today.  As the binaries for ia64 and powerpc
 261 still not uploaded to the Debian archive, we need to delay the alpha
 262 release another day.</p>
 263
 264 <p>If you want to help out with implementing Kerberos for Debian Edu,
 265 please contact us on debian-edu@lists.debian.org.</p>
 266
 267       </div>
 268       <div class="tags">
 269
 270
 271         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 272
 273
 274       </div>
 275     </div>
 276     <div class="padding"></div>
 277
 278     <div class="entry">
 279       <div class="title">
 280         <a href="http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til___slutte___kj_pe_musikk.html">Digitale restriksjonsmekanismer fikk meg til å slutte å kjøpe musikk</a>
 281       </div>
 282       <div class="date">
 283         22nd July 2010
 284       </div>
 285       <div class="body">
 286         <p>For mange år siden slutte jeg å kjøpe musikk-CDer. Årsaken var at
 287 musikkbransjen var godt i gang med å selge platene sine med DRM som
 288 gjorde at jeg ikke fikk spilt av musikken jeg kjøpte på utstyret jeg
 289 hadde tilgjengelig, dvs. min datamaskin. Det var umulig å se på en
 290 plate om den var ødelagt eller ikke, og jeg hadde jo allerede en
 291 anseelig samling med plater, så jeg bestemme meg for å slutte å gi
 292 penger til en bransje som åpenbart ikke respekterte meg.</p>
 293
 294 <p>Jeg har mange titalls dager med musikk på CD i dag. Det meste er
 295 lagt i et stort arkiv som kan spilles av fra husets datamaskiner (har
 296 ikke rukket rippe alt). Jeg ser dermed ikke behovet for å skaffe mer
 297 musikk. De fleste av mine favoritter er i hus, og jeg er dermed godt
 298 fornøyd.</p>
 299
 300 <p>Hvis musikkbransjen ønsker mine penger, så må de demonstrere at de
 301 setter pris på meg som kunde, og ikke skremme meg bort med DRM og
 302 antydninger om at kundene er kriminelle.</p>
 303
 304 <p>Filmbransjen er like ille, men mens musikk gjerne varer lenge, er
 305 filmer mer ferskvare. Har dermed ikke helt sluttet å kjøpe filmer, men
 306 holder meg til DVD-filmer som kan spilles av på mine Linuxbokser.
 307 Kommer neppe til å ta i bruk Blueray, og ei heller de nye DRM-greiene
 308 «Ultraviolet» som be annonsert her om dagen.</p>
 309
 310       </div>
 311       <div class="tags">
 312
 313
 314         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>.
 315
 316
 317       </div>
 318     </div>
 319     <div class="padding"></div>
 320
 321     <div class="entry">
 322       <div class="title">
 323         <a href="http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html">OpenStreetmap one step closer to having routing on its front page</a>
 324       </div>
 325       <div class="date">
 326         18th July 2010
 327       </div>
 328       <div class="body">
 329         <p>Thanks to
 330 <a href="http://feedproxy.google.com/~r/Opengeodata/~3/wUTCzDZk3lc/project-of-the-week-which-way-home">todays
 331 opengeodata blog entry</a>, I just discovered that the
 332 OpenStreetmap.org site have gotten
 333 <a href="http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT">support
 334 for calculating routes</a>.  The support is still experimental and
 335 only available from the development server, until more experience is
 336 gathered on the user interface and any scalability issues.</p>
 337
 338 <p>Earlier, the routing I knew about using the OpenStreetmap.org data
 339 was provided by <a href="http://maps.cloudmade.com/">Cloudmade</a>,
 340 but having it on the main page is required to make everyone aware of
 341 the issue.  I've had people reject Openstreetmap.org as a viable
 342 alternative for them because the front page lacked routing support,
 343 and I hope their needs will be catered for when routing show up on the
 344 www.openstreetmap.org front page.</p>
 345
 346       </div>
 347       <div class="tags">
 348
 349
 350         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/kart">kart</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 351
 352
 353       </div>
 354     </div>
 355     <div class="padding"></div>
 356
 357     <div class="entry">
 358       <div class="title">
 359         <a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a>
 360       </div>
 361       <div class="date">
 362         17th July 2010
 363       </div>
 364       <div class="body">
 365         <p>This is a
 366 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
 367 on my
 368 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
 369 work</a> on
 370 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
 371 all</a> the computer related LDAP objects in Debian Edu.</p>
 372
 373 <p>As a step to try to see if it possible to merge the DNS and DHCP
 374 LDAP objects, I have had a look at how the packages pdns-backend-ldap
 375 and dhcp3-server-ldap in Debian use the LDAP server.  The two
 376 implementations are quite different in how they use LDAP.</p>
 377
 378 To get this information, I started slapd with debugging enabled and
 379 dumped the debug output to a file to get the LDAP searches performed
 380 on a Debian Edu main-server.  Here is a summary.
 381
 382 <p><strong>powerdns</strong></p>
 383
 384 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
 385 on how to</a> set up PowerDNS to use a LDAP backend is available on
 386 the web.
 387
 388 <p>PowerDNS have two modes of operation using LDAP as its backend.
 389 One "strict" mode where the forward and reverse DNS lookups are done
 390 using the same LDAP objects, and a "tree" mode where the forward and
 391 reverse entries are in two different subtrees in LDAP with a structure
 392 based on the DNS names, as in tjener.intern and
 393 2.2.0.10.in-addr.arpa.</p>
 394
 395 <p>In tree mode, the server is set up to use a LDAP subtree as its
 396 base, and uses a "base" scoped search for the DNS name by adding
 397 "dc=tjener,dc=intern," to the base with a filter for
 398 "(associateddomain=tjener.intern)" for the forward entry and
 399 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
 400 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
 401 forward entries, it is looking for attributes named dnsttl, arecord,
 402 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
 403 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
 404 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
 405 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
 406 spfrecord and modifytimestamp.  For reverse entries it is looking for
 407 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
 408 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
 409 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
 410 ldapsearch commands could look like this:</p>
 411
 412 <blockquote><pre>
 413 ldapsearch -h ldap \
 414   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 415   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 416   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 417   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 418   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 419   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 420
 421 ldapsearch -h ldap \
 422   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 423   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
 424   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
 425   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
 426   srvrecord naptrrecord modifytimestamp
 427 </pre></blockquote>
 428
 429 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
 430 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
 431 example LDAP objects used there.  In addition to these objects, the
 432 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
 433 also exist.</p>
 434
 435 <blockquote><pre>
 436 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
 437 objectclass: top
 438 objectclass: dnsdomain
 439 objectclass: domainrelatedobject
 440 dc: tjener
 441 arecord: 10.0.2.2
 442 associateddomain: tjener.intern
 443
 444 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
 445 objectclass: top
 446 objectclass: dnsdomain2
 447 objectclass: domainrelatedobject
 448 dc: 2
 449 ptrrecord: tjener.intern
 450 associateddomain: 2.2.0.10.in-addr.arpa
 451 </pre></blockquote>
 452
 453 <p>In strict mode, the server behaves differently.  When looking for
 454 forward DNS entries, it is doing a "subtree" scoped search with the
 455 same base as in the tree mode for a object with filter
 456 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
 457 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
 458 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
 459 naptrrecord and modifytimestamp.  For reverse entires it also do a
 460 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
 461 and the requested attributes are associateddomain, dnsttl and
 462 modifytimestamp.  In short, in strict mode the objects with ptrrecord
 463 go away, and the arecord attribute in the forward object is used
 464 instead.</p>
 465
 466 <p>The forward and reverse searches can be simulated using ldapsearch
 467 like this:</p>
 468
 469 <blockquote><pre>
 470 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 471   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 472   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 473   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 474   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 475   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 476
 477 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 478   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
 479 </pre></blockquote>
 480
 481 <p>In addition to the forward and reverse searches , there is also a
 482 search for SOA records, which behave similar to the forward and
 483 reverse lookups.</p>
 484
 485 <p>A thing to note with the PowerDNS behaviour is that it do not
 486 specify any objectclass names, and instead look for the attributes it
 487 need to generate a DNS reply.  This make it able to work with any
 488 objectclass that provide the needed attributes.</p>
 489
 490 <p>The attributes are normally provided in the cosine (RFC 1274) and
 491 dnsdomain2 schemas.  The latter is used for reverse entries like
 492 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
 493
 494 <p>In Debian Edu, we have created DNS objects using the object classes
 495 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
 496 attributes) and domainrelatedobject (for associatedDomain).  The use
 497 of structural object classes make it impossible to combine these
 498 classes with the object classes used by DHCP.</p>
 499
 500 <p>There are other schemas that could be used too, for example the
 501 dnszone structural object class used by Gosa and bind-sdb for the DNS
 502 attributes combined with the domainrelatedobject object class, but in
 503 this case some unused attributes would have to be included as well
 504 (zonename and relativedomainname).</p>
 505
 506 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
 507 mode and not use any of the existing objectclasses (dnsdomain,
 508 dnsdomain2 and dnszone) when one want to combine the DNS information
 509 with DHCP information, and instead create a auxiliary object class
 510 defined something like this (using the attributes defined for
 511 dnsdomain and dnsdomain2 or dnszone):</p>
 512
 513 <blockquote><pre>
 514 objectclass ( some-oid NAME 'dnsDomainAux'
 515     SUP top
 516     AUXILIARY
 517     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
 518           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
 519           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
 520           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
 521           A6Record $ DNAMERecord
 522     ))
 523 </pre></blockquote>
 524
 525 <p>This will allow any object to become a DNS entry when combined with
 526 the domainrelatedobject object class, and allow any entity to include
 527 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
 528 developers asking for their view on this schema and if they are
 529 interested in providing such schema with PowerDNS, and I hope my
 530 message will be accepted into their mailing list soon.</p>
 531
 532 <p><strong>ISC dhcp</strong></p>
 533
 534 <p>The DHCP server searches for specific objectclass and requests all
 535 the object attributes, and then uses the attributes it want.  This
 536 make it harder to figure out exactly what attributes are used, but
 537 thanks to the working example in Debian Edu I can at least get an idea
 538 what is needed without having to read the source code.</p>
 539
 540 <p>In the DHCP server configuration, the LDAP base to use and the
 541 search filter to use to locate the correct dhcpServer entity is
 542 stored.  These are the relevant entries from
 543 /etc/dhcp3/dhcpd.conf:</p>
 544
 545 <blockquote><pre>
 546 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
 547 ldap-dhcp-server-cn "dhcp";
 548 </pre></blockquote>
 549
 550 <p>The DHCP server uses this information to nest all the DHCP
 551 configuration it need.  The cn "dhcp" is located using the given LDAP
 552 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
 553 search result is this entry:</p>
 554
 555 <blockquote><pre>
 556 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
 557 cn: dhcp
 558 objectClass: top
 559 objectClass: dhcpServer
 560 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 561 </pre></blockquote>
 562
 563 <p>The content of the dhcpServiceDN attribute is next used to locate the
 564 subtree with DHCP configuration.  The DHCP configuration subtree base
 565 is located using a base scope search with base "cn=DHCP
 566 Config,dc=skole,dc=skolelinux,dc=no" and filter
 567 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
 568 The search result is this entry:</p>
 569
 570 <blockquote><pre>
 571 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 572 cn: DHCP Config
 573 objectClass: top
 574 objectClass: dhcpService
 575 objectClass: dhcpOptions
 576 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
 577 dhcpStatements: ddns-update-style none
 578 dhcpStatements: authoritative
 579 dhcpOption: smtp-server code 69 = array of ip-address
 580 dhcpOption: www-server code 72 = array of ip-address
 581 dhcpOption: wpad-url code 252 = text
 582 </pre></blockquote>
 583
 584 <p>Next, the entire subtree is processed, one level at the time.  When
 585 all the DHCP configuration is loaded, it is ready to receive requests.
 586 The subtree in Debian Edu contain objects with object classes
 587 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
 588 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
 589 and information about netmasks, dynamic range etc.  Leaving out the
 590 details here because it is not relevant for the focus of my
 591 investigation, which is to see if it is possible to merge dns and dhcp
 592 related computer objects.</p>
 593
 594 <p>When a DHCP request come in, LDAP is searched for the MAC address
 595 of the client (00:00:00:00:00:00 in this example), using a subtree
 596 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
 597 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
 598 00:00:00:00:00:00))" as the filter.  This is what a host object look
 599 like:</p>
 600
 601 <blockquote><pre>
 602 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 603 cn: hostname
 604 objectClass: top
 605 objectClass: dhcpHost
 606 dhcpHWAddress: ethernet 00:00:00:00:00:00
 607 dhcpStatements: fixed-address hostname
 608 </pre></blockquote>
 609
 610 <p>There is less flexiblity in the way LDAP searches are done here.
 611 The object classes need to have fixed names, and the configuration
 612 need to be stored in a fairly specific LDAP structure.  On the
 613 positive side, the invidiual dhcpHost entires can be anywhere without
 614 the DN pointed to by the dhcpServer entries.  The latter should make
 615 it possible to group all host entries in a subtree next to the
 616 configuration entries, and this subtree can also be shared with the
 617 DNS server if the schema proposed above is combined with the dhcpHost
 618 structural object class.
 619
 620 <p><strong>Conclusion</strong></p>
 621
 622 <p>The PowerDNS implementation seem to be very flexible when it come
 623 to which LDAP schemas to use.  While its "tree" mode is rigid when it
 624 come to the the LDAP structure, the "strict" mode is very flexible,
 625 allowing DNS objects to be stored anywhere under the base cn specified
 626 in the configuration.</p>
 627
 628 <p>The DHCP implementation on the other hand is very inflexible, both
 629 regarding which LDAP schemas to use and which LDAP structure to use.
 630 I guess one could implement ones own schema, as long as the
 631 objectclasses and attributes have the names used, but this do not
 632 really help when the DHCP subtree need to have a fairly fixed
 633 structure.</p>
 634
 635 <p>Based on the observed behaviour, I suspect a LDAP structure like
 636 this might work for Debian Edu:</p>
 637
 638 <blockquote><pre>
 639 ou=services
 640   cn=machine-info (dhcpService) - dhcpServiceDN points here
 641     cn=dhcp (dhcpServer)
 642     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
 643       cn=10.0.2.0 (dhcpSubnet)
 644         cn=group1 (dhcpGroup/dhcpOptions)
 645     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
 646       cn=192.168.0.0 (dhcpSubnet)
 647         cn=group1 (dhcpGroup/dhcpOptions)
 648     ou=machines - PowerDNS base points here
 649       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
 650 </pre></blockquote>
 651
 652 <P>This is not tested yet.  If the DHCP server require the dhcpHost
 653 entries to be in the dhcpGroup subtrees, the entries can be stored
 654 there instead of a common machines subtree, and the PowerDNS base
 655 would have to be moved one level up to the machine-info subtree.</p>
 656
 657 <p>The combined object under the machines subtree would look something
 658 like this:</p>
 659
 660 <blockquote><pre>
 661 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
 662 dc: hostname
 663 objectClass: top
 664 objectClass: dhcpHost
 665 objectclass: domainrelatedobject
 666 objectclass: dnsDomainAux
 667 associateddomain: hostname.intern
 668 arecord: 10.11.12.13
 669 dhcpHWAddress: ethernet 00:00:00:00:00:00
 670 dhcpStatements: fixed-address hostname.intern
 671 </pre></blockquote>
 672
 673 </p>One could even add the LTSP configuration associated with a given
 674 machine, as long as the required attributes are available in a
 675 auxiliary object class.</p>
 676
 677       </div>
 678       <div class="tags">
 679
 680
 681         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 682
 683
 684       </div>
 685     </div>
 686     <div class="padding"></div>
 687
 688     <div class="entry">
 689       <div class="title">
 690         <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a>
 691       </div>
 692       <div class="date">
 693         14th July 2010
 694       </div>
 695       <div class="body">
 696         <p>For a while now, I have wanted to find a way to change the DNS and
 697 DHCP services in Debian Edu to use the same LDAP objects for a given
 698 computer, to avoid the possibility of having a inconsistent state for
 699 a computer in LDAP (as in DHCP but no DNS entry or the other way
 700 around) and make it easier to add computers to LDAP.</p>
 701
 702 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
 703 information finally found a solution that seem to work.</p>
 704
 705 <p>The old setup required three LDAP objects for a given computer.
 706 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
 707 we switch powerdns to use its strict LDAP method (ldap-method=strict
 708 in pdns-debian-edu.conf), the forward and reverse DNS entries are
 709 merged into one while making it impossible to transfer the reverse map
 710 to a slave DNS server.</p>
 711
 712 <p>If we also replace the object class used to get the DNS related
 713 attributes to one allowing these attributes to be combined with the
 714 dhcphost object class, we can merge the DNS and DHCP entries into one.
 715 I've written such object class in the dnsdomainaux.schema file (need
 716 proper OIDs, but that is a minor issue), and tested the setup.  It
 717 seem to work.</p>
 718
 719 <p>With this test setup in place, we can get away with one LDAP object
 720 for both DNS and DHCP, and even the LTSP configuration I suggested in
 721 an earlier email.  The combined LDAP object will look something like
 722 this:</p>
 723
 724 <blockquote><pre>
 725   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 726   cn: hostname
 727   objectClass: dhcphost
 728   objectclass: domainrelatedobject
 729   objectclass: dnsdomainaux
 730   associateddomain: hostname.intern
 731   arecord: 10.11.12.13
 732   dhcphwaddress: ethernet 00:00:00:00:00:00
 733   dhcpstatements: fixed-address hostname
 734   ldapconfigsound: Y
 735 </pre></blockquote>
 736
 737 <p>The DNS server uses the associateddomain and arecord entries, while
 738 the DHCP server uses the dhcphwaddress and dhcpstatements entries
 739 before asking DNS to resolve the fixed-adddress.  LTSP will use
 740 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
 741
 742 <p>I am not yet sure if I can get the DHCP server to look for its
 743 dhcphost in a different location, to allow us to put the objects
 744 outside the "DHCP Config" subtree, but hope to figure out a way to do
 745 that.  If I can't figure out a way to do that, we can still get rid of
 746 the hosts subtree and move all its content into the DHCP Config tree
 747 (which probably should be renamed to be more related to the new
 748 content.  I suspect cn=dnsdhcp,ou=services or something like that
 749 might be a good place to put it.</p>
 750
 751 <p>If you want to help out with implementing this for Debian Edu,
 752 please contact us on debian-edu@lists.debian.org.</p>
 753
 754       </div>
 755       <div class="tags">
 756
 757
 758         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 759
 760
 761       </div>
 762     </div>
 763     <div class="padding"></div>
 764
 765     <div class="entry">
 766       <div class="title">
 767         <a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a>
 768       </div>
 769       <div class="date">
 770         11th July 2010
 771       </div>
 772       <div class="body">
 773         <p>Vagrant mentioned on IRC today that ltsp_config now support
 774 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
 775 clients, and that this can be used to fetch configuration from LDAP if
 776 Debian Edu choose to store configuration there.</p>
 777
 778 <p>Armed with this information, I got inspired and wrote a test module
 779 to get configuration from LDAP.  The idea is to look up the MAC
 780 address of the client in LDAP, and look for attributes on the form
 781 ltspconfigsetting=value, and use this to export SETTING=value to the
 782 LTSP clients.</p>
 783
 784 <p>The goal is to be able to store the LTSP configuration attributes
 785 in a "computer" LDAP object used by both DNS and DHCP, and thus
 786 allowing us to store all information about a computer in one place.</p>
 787
 788 <p>This is a untested draft implementation, and I welcome feedback on
 789 this approach.  A real LDAP schema for the ltspClientAux objectclass
 790 need to be written.  Comments, suggestions, etc?</p>
 791
 792 <blockquote><pre>
 793 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
 794 #
 795 # Fetch LTSP client settings from LDAP based on MAC address
 796 #
 797 # Uses ethernet address as stored in the dhcpHost objectclass using
 798 # the dhcpHWAddress attribute or ethernet address stored in the
 799 # ieee802Device objectclass with the macAddress attribute.
 800 #
 801 # This module is written to be schema agnostic, and only depend on the
 802 # existence of attribute names.
 803 #
 804 # The LTSP configuration variables are saved directly using a
 805 # ltspConfig prefix and uppercasing the rest of the attribute name.
 806 # To set the SERVER variable, set the ltspConfigServer attribute.
 807 #
 808 # Some LDAP schema should be created with all the relevant
 809 # configuration settings.  Something like this should work:
 810 #
 811 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
 812 #     SUP top
 813 #     AUXILIARY
 814 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
 815
 816 LDAPSERVER=$(debian-edu-ldapserver)
 817 if [ "$LDAPSERVER" ] ; then
 818     LDAPBASE=$(debian-edu-ldapserver -b)
 819     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
 820         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
 821         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
 822             grep '^ltspConfig' | while read attr value ; do
 823             # Remove prefix and convert to upper case
 824             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
 825             # bass value on to clients
 826             eval "$attr=$value; export $attr"
 827         done
 828     done
 829 fi
 830 </pre></blockquote>
 831
 832 <p>I'm not sure this shell construction will work, because I suspect
 833 the while block might end up in a subshell causing the variables set
 834 there to not show up in ltsp-config, but if that is the case I am sure
 835 the code can be restructured to make sure the variables are passed on.
 836 I expect that can be solved with some testing. :)</p>
 837
 838 <p>If you want to help out with implementing this for Debian Edu,
 839 please contact us on debian-edu@lists.debian.org.</p>
 840
 841 <p>Update 2010-07-17: I am aware of another effort to store LTSP
 842 configuration in LDAP that was created around year 2000 by
 843 <a href="http://www.pcxperience.com/thinclient/documentation/ldap.html">PC
 844 Xperience, Inc., 2000</a>.  I found its
 845 <a href="http://people.redhat.com/alikins/ltsp/ldap/">files</a> on a
 846 personal home page over at redhat.com.</p>
 847
 848       </div>
 849       <div class="tags">
 850
 851
 852         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 853
 854
 855       </div>
 856     </div>
 857     <div class="padding"></div>
 858
 859     <div class="entry">
 860       <div class="title">
 861         <a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a>
 862       </div>
 863       <div class="date">
 864          9th July 2010
 865       </div>
 866       <div class="body">
 867         <p>Since
 868 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
 869 last post</a> about available LDAP tools in Debian, I was told about a
 870 LDAP GUI that is even better than luma.  The java application
 871 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
 872 moving LDAP objects and subtrees using drag-and-drop, and can
 873 authenticate using Kerberos.  I have only tested the Kerberos
 874 authentication, but do not have a LDAP setup allowing me to rewrite
 875 LDAP with my test user yet.  It is
 876 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
 877 Debian</a> testing and unstable at the moment.  The only problem I
 878 have with it is how it handle errors.  If something go wrong, its
 879 non-intuitive behaviour require me to go through some query work list
 880 and remove the failing query.  Nothing big, but very annoying.</p>
 881
 882       </div>
 883       <div class="tags">
 884
 885
 886         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 887
 888
 889       </div>
 890     </div>
 891     <div class="padding"></div>
 892
 893     <div class="entry">
 894       <div class="title">
 895         <a href="http://people.skolelinux.org/pere/blog/MS_Word_kr_ller_det_til_for_politiet_.html">MS Word krøller det til for politiet?</a>
 896       </div>
 897       <div class="date">
 898          8th July 2010
 899       </div>
 900       <div class="body">
 901         <p>De siste dagene har Aftenposten
 902 <a href="http://www.aftenposten.no/nyheter/iriks/article3718597.ece">fortalt</a>
 903 <a href="http://www.aftenposten.no/nyheter/iriks/article3724249.ece">hvordan</a>
 904 politet har brukt skriveverktøy som ikke håndterer arabisk tekst og
 905 tekst som skal skrives fra høyre mot venstre når de har laget
 906 løpeseddel for å be om informasjon fra publikum.  Resultatet har vært
 907 en uleselig arabisk-bit på løpeseddelen.  Feilen har oppstått når
 908 teksten har blitt "kopiert inn i programvare som ikke har støtte for
 909 språk som skrives fra høyre mot venstre", og jeg er ganske sikker på
 910 at det er snakk om Microsoft Office i dette tilfellet.  Er det slik at
 911 MS Office i norsk språkdrakt ikke har støtte for tekst som skal
 912 skrives fra høyre mot venstre?  Jeg tror alle utgaver av
 913 OpenOffice.org har slik støtte, og det er jo ikke veldig vanskelig å
 914 la slik støtte finnes i alle utgaver av et program hvis støtten først
 915 er utviklet.  Aftenpostens melding får meg til å undre om problemet
 916 ville vært unngått hvis politiet brukte OpenOffice.org i stedet for MS
 917 Office.</p>
 918
 919 <p>Mon tro om det er flere eksempler på at MS Office har ødelagt for
 920 offentlig myndighet?</p>
 921
 922       </div>
 923       <div class="tags">
 924
 925
 926         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>.
 927
 928
 929       </div>
 930     </div>
 931     <div class="padding"></div>
 932
 933     <div class="entry">
 934       <div class="title">
 935         <a href="http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html">Lenny->Squeeze upgrades, apt vs aptitude with the Gnome desktop</a>
 936       </div>
 937       <div class="date">
 938          3rd July 2010
 939       </div>
 940       <div class="body">
 941         <p>Here is a short update on my <a
 942 href="http://people.skolelinux.org/~pere/debian-upgrade-testing/">my
 943 Debian Lenny->Squeeze upgrade testing</a>.  Here is a summary of the
 944 difference for Gnome when it is upgraded by apt-get and aptitude.  I'm
 945 not reporting the status for KDE, because the upgrade crashes when
 946 aptitude try because of missing conflicts
 947 (<a href="http://bugs.debian.org/584861">#584861</a> and
 948 <a href="http://bugs.debian.org/585716">#585716</a>).</p>
 949
 950 <p>At the end of the upgrade test script, dpkg -l is executed to get a
 951 complete list of the installed packages.  Based on this I see these
 952 differences when I did a test run today.  As usual, I do not really
 953 know what the correct set of packages would be, but thought it best to
 954 publish the difference.</p>
 955
 956 <p>Installed using apt-get, missing with aptitude</p>
 957
 958 <blockquote><p>
 959   at-spi cpp-4.3 finger gnome-spell gstreamer0.10-gnomevfs
 960   libatspi1.0-0 libcupsys2 libeel2-data libgail-common libgdl-1-common
 961   libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin
 962   libgtksourceview-common libpt-1.10.10-plugins-alsa
 963   libpt-1.10.10-plugins-v4l libservlet2.4-java libxalan2-java
 964   libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip
 965   python-4suite-xml python-eggtrayicon python-gtkhtml2
 966   python-gtkmozembed svgalibg1 xserver-xephyr zip
 967 </p></blockquote>
 968
 969 <p>Installed using apt-get, removed with aptitude</p>
 970
 971 <blockquote><p>
 972   bluez-utils dhcdbd djvulibre-desktop epiphany-gecko
 973   gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager
 974   libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-50
 975   libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcurl3
 976   libdirectfb-1.0-0 libdvdread3 libedata-cal1.2-6 libedataserver1.2-9
 977   libeel2-2.20 libepc-1.0-1 libepc-ui-1.0-1 libexchange-storage1.2-3
 978   libfaad0 libgd2-noxpm libgda3-3 libgda3-common libggz2 libggzcore9
 979   libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnome-desktop-2
 980   libgnome-pilot2 libgnomecups1.0-1 libgnomeprint2.2-0
 981   libgnomeprintui2.2-0 libgpod3 libgraphviz4 libgtkhtml2-0
 982   libgtksourceview1.0-0 libgucharmap6 libhesiod0 libicu38 libisccc50
 983   libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++10
 984   libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4
 985   libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5
 986   libparted1.8-10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3
 987   libpt-1.10.10 libraw1394-8 libsensors3 libsmbios2 libsoup2.2-8
 988   libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1
 989   libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj
 990   libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3
 991   mysql-common swfdec-gnome totem-gstreamer wodim
 992 </p></blockquote>
 993
 994 <p>Installed using aptitude, missing with apt-get</p>
 995
 996 <blockquote><p>
 997   gnome gnome-desktop-environment hamster-applet python-gnomeapplet
 998   python-gnomekeyring python-wnck rhythmbox-plugins xorg
 999   xserver-xorg-input-all xserver-xorg-input-evdev
1000   xserver-xorg-input-kbd xserver-xorg-input-mouse
1001   xserver-xorg-input-synaptics xserver-xorg-video-all
1002   xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati
1003   xserver-xorg-video-chips xserver-xorg-video-cirrus
1004   xserver-xorg-video-dummy xserver-xorg-video-fbdev
1005   xserver-xorg-video-glint xserver-xorg-video-i128
1006   xserver-xorg-video-i740 xserver-xorg-video-mach64
1007   xserver-xorg-video-mga xserver-xorg-video-neomagic
1008   xserver-xorg-video-nouveau xserver-xorg-video-nv
1009   xserver-xorg-video-r128 xserver-xorg-video-radeon
1010   xserver-xorg-video-radeonhd xserver-xorg-video-rendition
1011   xserver-xorg-video-s3 xserver-xorg-video-s3virge
1012   xserver-xorg-video-savage xserver-xorg-video-siliconmotion
1013   xserver-xorg-video-sis xserver-xorg-video-sisusb
1014   xserver-xorg-video-tdfx xserver-xorg-video-tga
1015   xserver-xorg-video-trident xserver-xorg-video-tseng
1016   xserver-xorg-video-vesa xserver-xorg-video-vmware
1017   xserver-xorg-video-voodoo
1018 </p></blockquote>
1019
1020 <p>Installed using aptitude, removed with apt-get</p>
1021
1022 <blockquote><p>
1023   deskbar-applet xserver-xorg xserver-xorg-core
1024   xserver-xorg-input-wacom xserver-xorg-video-intel
1025   xserver-xorg-video-openchrome
1026 </p></blockquote>
1027
1028 <p>I was told on IRC that the xorg-xserver package was
1029 <a href="http://git.debian.org/?p=pkg-xorg/xserver/xorg-server.git;a=commit;h=9c8080d06c457932d3bfec021c69ac000aa60120">changed
1030 in git</a> today to try to get apt-get to not remove xorg completely.
1031 No idea when it hits Squeeze, but when it does I hope it will reduce
1032 the difference somewhat.
1033
1034       </div>
1035       <div class="tags">
1036
1037
1038         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
1039
1040
1041       </div>
1042     </div>
1043     <div class="padding"></div>
1044
1045     <div class="entry">
1046       <div class="title">
1047         <a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a>
1048       </div>
1049       <div class="date">
1050          1st July 2010
1051       </div>
1052       <div class="body">
1053         <p>For a laptop, centralized user directories and password checking is
1054 a bit troubling.  Laptops are typically used also when not connected
1055 to the network, and it is vital for a user to be able to log in or
1056 unlock the screen saver also when a central server is unavailable.
1057 This is possible by caching passwords and directory information (user
1058 and group attributes) locally, and the packages to do so are available
1059 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
1060 It is also possible to set up in Debian/Lenny, but require more manual
1061 setup there because pam-auth-update is missing in Lenny.</p>
1062
1063 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
1064
1065 This is the traditional method with a twist.  The password caching is
1066 provided by libpam-ccreds (version 10-4 or later is needed on
1067 Squeeze), and the directory caching is done by nscd.  The directory
1068 lookup and password checking is done using LDAP.  If one want to use
1069 Kerberos for password checking the libpam-ldapd package can be
1070 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
1071 local home directory with the path listed in LDAP, one can use the
1072 pam_mkhomedir module from pam-modules to make this happen instead of
1073 using libpam-mklocaluser.  A setup for pam-auth-update to enable
1074 pam_mkhomedir will have to be written until a fix for
1075 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
1076 archive.  Because I believe it is a bad idea to have local home
1077 directories using misleading paths like /site/server/partition/, I
1078 prefer to create a local user with the home directory in /home/.  This
1079 is done using the libpam-mklocaluser package.</p>
1080
1081 <p>These packages need to be installed and configured</p>
1082
1083 <blockquote><pre>
1084 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
1085 </pre></blockquote>
1086
1087 <p>The ldapd packages will ask for LDAP connection information, and
1088 one have to fill in the values that fits ones own site.  Make sure the
1089 PAM part uses encrypted connections, to make sure the password is not
1090 sent in clear text to the LDAP server.  I've been unable to get TLS
1091 certificate checking for a self signed certificate working, which make
1092 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
1093 is talking to the correct LDAP server), and very much welcome feedback
1094 on how to get this working.</p>
1095
1096 <p>Because nscd do not have a default configuration fit for offline
1097 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
1098 is fixed, this configuration should be used instead of the one
1099 currently in /etc/nscd.conf.  The changes are in the fields
1100 reload-count and positive-time-to-live, and is based on the
1101 instructions I found in the
1102 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
1103 instructions by Flyn Computing.</p>
1104
1105 <blockquote><pre>
1106         debug-level             0
1107         reload-count            unlimited
1108         paranoia                no
1109
1110         enable-cache            passwd          yes
1111         positive-time-to-live   passwd          2592000
1112         negative-time-to-live   passwd          20
1113         suggested-size          passwd          211
1114         check-files             passwd          yes
1115         persistent              passwd          yes
1116         shared                  passwd          yes
1117         max-db-size             passwd          33554432
1118         auto-propagate          passwd          yes
1119
1120         enable-cache            group           yes
1121         positive-time-to-live   group           2592000
1122         negative-time-to-live   group           20
1123         suggested-size          group           211
1124         check-files             group           yes
1125         persistent              group           yes
1126         shared                  group           yes
1127         max-db-size             group           33554432
1128         auto-propagate          group           yes
1129
1130         enable-cache            hosts           no
1131         positive-time-to-live   hosts           2592000
1132         negative-time-to-live   hosts           20
1133         suggested-size          hosts           211
1134         check-files             hosts           yes
1135         persistent              hosts           yes
1136         shared                  hosts           yes
1137         max-db-size             hosts           33554432
1138
1139         enable-cache            services        yes
1140         positive-time-to-live   services        2592000
1141         negative-time-to-live   services        20
1142         suggested-size          services        211
1143         check-files             services        yes
1144         persistent              services        yes
1145         shared                  services        yes
1146         max-db-size             services        33554432
1147 </pre></blockquote>
1148
1149 <p>While we wait for a mechanism to update /etc/nsswitch.conf
1150 automatically like the one provided in
1151 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
1152 content need to be manually replaced to ensure LDAP is used as the
1153 directory service on the machine.  /etc/nsswitch.conf should normally
1154 look like this:</p>
1155
1156 <blockquote><pre>
1157 passwd:         files ldap
1158 group:          files ldap
1159 shadow:         files ldap
1160 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
1161 networks:       files
1162 protocols:      files
1163 services:       files
1164 ethers:         files
1165 rpc:            files
1166 netgroup:       files ldap
1167 </pre></blockquote>
1168
1169 <p>The important parts are that ldap is listed last for passwd, group,
1170 shadow and netgroup.</p>
1171
1172 <p>With these changes in place, any user in LDAP will be able to log
1173 in locally on the machine using for example kdm, get a local home
1174 directory created and have the password as well as user and group
1175 attributes cached.
1176
1177 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
1178   libpam-mklocaluser/pam_mkhomedir</h2>
1179
1180 <p>Because nscd have had its share of problems, and seem to have
1181 problems doing proper caching, I've seen suggestions and recipes to
1182 use nss-updatedb to copy parts of the LDAP database locally when the
1183 LDAP database is available.  I have not tested such setup, because I
1184 discovered sssd.</p>
1185
1186 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
1187
1188 <p>A more flexible and robust setup than the nscd combination
1189 mentioned earlier that has shown up recently, is the
1190 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
1191 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
1192 to provide a Active Directory like directory service for Linux
1193 machines.  The sssd system combines the caching of passwords and user
1194 information into one package, and remove the need for nscd and
1195 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
1196 1.2 do not support netgroups, but it is said that it will support this
1197 in version 1.5 expected to show up later in 2010.  Because the
1198 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
1199 was missing in Debian, I ended up co-maintaining it with Werner, and
1200 version 1.2 is now in testing.
1201
1202 <p>These packages need to be installed and configured to get the
1203 roaming setup I want</p>
1204
1205 <blockquote><pre>
1206 libpam-sss libnss-sss libpam-mklocaluser
1207 </pre></blockquote>
1208
1209 The complete setup of sssd is done by editing/creating
1210 <tt>/etc/sssd/sssd.conf</tt>.
1211
1212 <blockquote><pre>
1213 [sssd]
1214 config_file_version = 2
1215 reconnection_retries = 3
1216 sbus_timeout = 30
1217 services = nss, pam
1218 domains = INTERN
1219
1220 [nss]
1221 filter_groups = root
1222 filter_users = root
1223 reconnection_retries = 3
1224
1225 [pam]
1226 reconnection_retries = 3
1227
1228 [domain/INTERN]
1229 enumerate = false
1230 cache_credentials = true
1231
1232 id_provider = ldap
1233 auth_provider = ldap
1234 chpass_provider = ldap
1235
1236 ldap_uri = ldap://ldap
1237 ldap_search_base = dc=skole,dc=skolelinux,dc=no
1238 ldap_tls_reqcert = never
1239 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
1240 </pre></blockquote>
1241
1242 <p>I got the same problem here with certificate checking.  Had to set
1243 "ldap_tls_reqcert = never" to get it working.</p>
1244
1245 <p>With the libnss-sss package in testing at the moment, the
1246 nsswitch.conf file is update automatically, so there is no need to
1247 modify it manually.</p>
1248
1249 <p>If you want to help out with implementing this for Debian Edu,
1250 please contact us on debian-edu@lists.debian.org.</p>
1251
1252       </div>
1253       <div class="tags">
1254
1255
1256         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1257
1258
1259       </div>
1260     </div>
1261     <div class="padding"></div>
1262
1263     <p style="text-align: right;"><a href="07.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14" /></a></p>
1264     <div id="sidebar">
1265
1266
1267
1268 <h2>Archive</h2>
1269 <ul>
1270
1271 <li>2019
1272 <ul>
1273
1274 <li><a href="http://people.skolelinux.org/pere/blog/archive/2019/01/">January (4)</a></li>
1275
1276 <li><a href="http://people.skolelinux.org/pere/blog/archive/2019/02/">February (3)</a></li>
1277
1278 <li><a href="http://people.skolelinux.org/pere/blog/archive/2019/03/">March (3)</a></li>
1279
1280 <li><a href="http://people.skolelinux.org/pere/blog/archive/2019/05/">May (2)</a></li>
1281
1282 <li><a href="http://people.skolelinux.org/pere/blog/archive/2019/06/">June (5)</a></li>
1283
1284 <li><a href="http://people.skolelinux.org/pere/blog/archive/2019/07/">July (2)</a></li>
1285
1286 </ul></li>
1287
1288 <li>2018
1289 <ul>
1290
1291 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/01/">January (1)</a></li>
1292
1293 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/02/">February (5)</a></li>
1294
1295 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/03/">March (5)</a></li>
1296
1297 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/04/">April (3)</a></li>
1298
1299 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/06/">June (2)</a></li>
1300
1301 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/07/">July (5)</a></li>
1302
1303 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/08/">August (3)</a></li>
1304
1305 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/09/">September (3)</a></li>
1306
1307 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/10/">October (5)</a></li>
1308
1309 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/11/">November (2)</a></li>
1310
1311 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/12/">December (4)</a></li>
1312
1313 </ul></li>
1314
1315 <li>2017
1316 <ul>
1317
1318 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/01/">January (4)</a></li>
1319
1320 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/02/">February (3)</a></li>
1321
1322 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/03/">March (5)</a></li>
1323
1324 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/04/">April (2)</a></li>
1325
1326 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/06/">June (5)</a></li>
1327
1328 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/07/">July (1)</a></li>
1329
1330 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/08/">August (1)</a></li>
1331
1332 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/09/">September (3)</a></li>
1333
1334 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/10/">October (5)</a></li>
1335
1336 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/11/">November (3)</a></li>
1337
1338 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/12/">December (4)</a></li>
1339
1340 </ul></li>
1341
1342 <li>2016
1343 <ul>
1344
1345 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/01/">January (3)</a></li>
1346
1347 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/02/">February (2)</a></li>
1348
1349 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/03/">March (3)</a></li>
1350
1351 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/04/">April (8)</a></li>
1352
1353 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/05/">May (8)</a></li>
1354
1355 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/06/">June (2)</a></li>
1356
1357 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/07/">July (2)</a></li>
1358
1359 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/08/">August (5)</a></li>
1360
1361 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/09/">September (2)</a></li>
1362
1363 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/10/">October (3)</a></li>
1364
1365 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/11/">November (8)</a></li>
1366
1367 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/12/">December (5)</a></li>
1368
1369 </ul></li>
1370
1371 <li>2015
1372 <ul>
1373
1374 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/01/">January (7)</a></li>
1375
1376 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/02/">February (6)</a></li>
1377
1378 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/03/">March (1)</a></li>
1379
1380 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/04/">April (4)</a></li>
1381
1382 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/05/">May (3)</a></li>
1383
1384 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/06/">June (4)</a></li>
1385
1386 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/07/">July (6)</a></li>
1387
1388 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/08/">August (2)</a></li>
1389
1390 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/09/">September (2)</a></li>
1391
1392 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/10/">October (9)</a></li>
1393
1394 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/11/">November (6)</a></li>
1395
1396 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/12/">December (3)</a></li>
1397
1398 </ul></li>
1399
1400 <li>2014
1401 <ul>
1402
1403 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/01/">January (2)</a></li>
1404
1405 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/02/">February (3)</a></li>
1406
1407 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/03/">March (8)</a></li>
1408
1409 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/04/">April (7)</a></li>
1410
1411 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/05/">May (1)</a></li>
1412
1413 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/06/">June (2)</a></li>
1414
1415 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/07/">July (2)</a></li>
1416
1417 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/08/">August (2)</a></li>
1418
1419 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/09/">September (5)</a></li>
1420
1421 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/10/">October (6)</a></li>
1422
1423 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/11/">November (3)</a></li>
1424
1425 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/12/">December (5)</a></li>
1426
1427 </ul></li>
1428
1429 <li>2013
1430 <ul>
1431
1432 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/01/">January (11)</a></li>
1433
1434 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/02/">February (9)</a></li>
1435
1436 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/03/">March (9)</a></li>
1437
1438 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/04/">April (6)</a></li>
1439
1440 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/05/">May (9)</a></li>
1441
1442 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/06/">June (10)</a></li>
1443
1444 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/07/">July (7)</a></li>
1445
1446 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/08/">August (3)</a></li>
1447
1448 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/09/">September (5)</a></li>
1449
1450 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/10/">October (7)</a></li>
1451
1452 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/11/">November (9)</a></li>
1453
1454 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/12/">December (3)</a></li>
1455
1456 </ul></li>
1457
1458 <li>2012
1459 <ul>
1460
1461 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/01/">January (7)</a></li>
1462
1463 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/02/">February (10)</a></li>
1464
1465 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/03/">March (17)</a></li>
1466
1467 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/04/">April (12)</a></li>
1468
1469 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/05/">May (12)</a></li>
1470
1471 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/06/">June (20)</a></li>
1472
1473 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/07/">July (17)</a></li>
1474
1475 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/08/">August (6)</a></li>
1476
1477 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/09/">September (9)</a></li>
1478
1479 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/10/">October (17)</a></li>
1480
1481 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/11/">November (10)</a></li>
1482
1483 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/12/">December (7)</a></li>
1484
1485 </ul></li>
1486
1487 <li>2011
1488 <ul>
1489
1490 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
1491
1492 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
1493
1494 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
1495
1496 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
1497
1498 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
1499
1500 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
1501
1502 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (7)</a></li>
1503
1504 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/08/">August (6)</a></li>
1505
1506 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/09/">September (4)</a></li>
1507
1508 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/10/">October (2)</a></li>
1509
1510 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/11/">November (3)</a></li>
1511
1512 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/12/">December (1)</a></li>
1513
1514 </ul></li>
1515
1516 <li>2010
1517 <ul>
1518
1519 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
1520
1521 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
1522
1523 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1524
1525 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1526
1527 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1528
1529 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1530
1531 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
1532
1533 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
1534
1535 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
1536
1537 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
1538
1539 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
1540
1541 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
1542
1543 </ul></li>
1544
1545 <li>2009
1546 <ul>
1547
1548 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1549
1550 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1551
1552 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1553
1554 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1555
1556 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1557
1558 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1559
1560 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1561
1562 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1563
1564 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1565
1566 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1567
1568 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1569
1570 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1571
1572 </ul></li>
1573
1574 <li>2008
1575 <ul>
1576
1577 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1578
1579 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1580
1581 </ul></li>
1582
1583 </ul>
1584
1585
1586
1587 <h2>Tags</h2>
1588 <ul>
1589
1590  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (16)</a></li>
1591
1592  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1593
1594  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1595
1596  <li><a href="http://people.skolelinux.org/pere/blog/tags/bankid">bankid (4)</a></li>
1597
1598  <li><a href="http://people.skolelinux.org/pere/blog/tags/betalkontant">betalkontant (8)</a></li>
1599
1600  <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (11)</a></li>
1601
1602  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (17)</a></li>
1603
1604  <li><a href="http://people.skolelinux.org/pere/blog/tags/bsa">bsa (2)</a></li>
1605
1606  <li><a href="http://people.skolelinux.org/pere/blog/tags/chrpath">chrpath (2)</a></li>
1607
1608  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (168)</a></li>
1609
1610  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (158)</a></li>
1611
1612  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian-handbook">debian-handbook (4)</a></li>
1613
1614  <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (11)</a></li>
1615
1616  <li><a href="http://people.skolelinux.org/pere/blog/tags/dld">dld (17)</a></li>
1617
1618  <li><a href="http://people.skolelinux.org/pere/blog/tags/docbook">docbook (26)</a></li>
1619
1620  <li><a href="http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (4)</a></li>
1621
1622  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (407)</a></li>
1623
1624  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (23)</a></li>
1625
1626  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (14)</a></li>
1627
1628  <li><a href="http://people.skolelinux.org/pere/blog/tags/freeculture">freeculture (34)</a></li>
1629
1630  <li><a href="http://people.skolelinux.org/pere/blog/tags/freedombox">freedombox (9)</a></li>
1631
1632  <li><a href="http://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (20)</a></li>
1633
1634  <li><a href="http://people.skolelinux.org/pere/blog/tags/h264">h264 (20)</a></li>
1635
1636  <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (42)</a></li>
1637
1638  <li><a href="http://people.skolelinux.org/pere/blog/tags/isenkram">isenkram (16)</a></li>
1639
1640  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (22)</a></li>
1641
1642  <li><a href="http://people.skolelinux.org/pere/blog/tags/kodi">kodi (4)</a></li>
1643
1644  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (9)</a></li>
1645
1646  <li><a href="http://people.skolelinux.org/pere/blog/tags/lego">lego (4)</a></li>
1647
1648  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (8)</a></li>
1649
1650  <li><a href="http://people.skolelinux.org/pere/blog/tags/lsdvd">lsdvd (2)</a></li>
1651
1652  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1653
1654  <li><a href="http://people.skolelinux.org/pere/blog/tags/mesh network">mesh network (8)</a></li>
1655
1656  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (42)</a></li>
1657
1658  <li><a href="http://people.skolelinux.org/pere/blog/tags/nice free software">nice free software (12)</a></li>
1659
1660  <li><a href="http://people.skolelinux.org/pere/blog/tags/noark5">noark5 (17)</a></li>
1661
1662  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (307)</a></li>
1663
1664  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (196)</a></li>
1665
1666  <li><a href="http://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (37)</a></li>
1667
1668  <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
1669
1670  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (73)</a></li>
1671
1672  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (109)</a></li>
1673
1674  <li><a href="http://people.skolelinux.org/pere/blog/tags/raid">raid (2)</a></li>
1675
1676  <li><a href="http://people.skolelinux.org/pere/blog/tags/reactos">reactos (1)</a></li>
1677
1678  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
1679
1680  <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (3)</a></li>
1681
1682  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (12)</a></li>
1683
1684  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1685
1686  <li><a href="http://people.skolelinux.org/pere/blog/tags/ruter">ruter (7)</a></li>
1687
1688  <li><a href="http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (2)</a></li>
1689
1690  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (56)</a></li>
1691
1692  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (4)</a></li>
1693
1694  <li><a href="http://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (5)</a></li>
1695
1696  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (66)</a></li>
1697
1698  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (6)</a></li>
1699
1700  <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (12)</a></li>
1701
1702  <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (56)</a></li>
1703
1704  <li><a href="http://people.skolelinux.org/pere/blog/tags/sysadmin">sysadmin (4)</a></li>
1705
1706  <li><a href="http://people.skolelinux.org/pere/blog/tags/usenix">usenix (2)</a></li>
1707
1708  <li><a href="http://people.skolelinux.org/pere/blog/tags/valg">valg (9)</a></li>
1709
1710  <li><a href="http://people.skolelinux.org/pere/blog/tags/verkidetfri">verkidetfri (15)</a></li>
1711
1712  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (73)</a></li>
1713
1714  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (4)</a></li>
1715
1716  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (42)</a></li>
1717
1718 </ul>
1719
1720
1721     </div>
1722     <p style="text-align: right">
1723  Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v4.6</a>
1724 </p>
1725
1726   </body>
1727 </html>