blog/tags/ldap/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen: Entries Tagged ldap</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="ldap.rss" type="application/rss+xml">
   8  </head>
   9  <body>
  10
  11  <div class="title">
  12   <h1>
  13        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  14
  15   </h1>
  16
  17  </div>
  18
  19  <p>Entries tagged "ldap".</p>
  20
  21
  22
  23
  24 <div class="entry">
  25  <div class="title">
  26  <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">Time for new  LDAP schemas replacing RFC 2307?</a>
  27  </div>
  28  <div class="date">
  29   2009-03-29 20:30
  30  </div>
  31
  32  <div class="body">
  33
  34 <p>The state of standardized LDAP schemas on Linux is far from
  35 optimal.  There is RFC 2307 documenting one way to store NIS maps in
  36 LDAP, and a modified version of this normally called RFC 2307bis, with
  37 some modifications to be compatible with Active Directory.  The RFC
  38 specification handle the content of a lot of system databases, but do
  39 not handle DNS zones and DHCP configuration.</p>
  40
  41 <p>In <a href="http://www.skolelinux.org/">Debian Edu/Skolelinux</a>,
  42 we would like to store information about users, SMB clients/hosts,
  43 filegroups, netgroups (users and hosts), DHCP and DNS configuration,
  44 and LTSP configuration in LDAP.  These objects have a lot in common,
  45 but with the current LDAP schemas it is not possible to have one
  46 object per entity.  For example, one need to have at least three LDAP
  47 objects for a given computer, one with the SMB related stuff, one with
  48 DNS information and another with DHCP information.  The schemas
  49 provided for DNS and DHCP are impossible to combine into one LDAP
  50 object.  In addition, it is impossible to implement quick queries for
  51 netgroup membership, because of the way NIS triples are implemented.
  52 It just do not scale.  I believe it is time for a few RFC
  53 specifications to cleam up this mess.</p>
  54
  55 <p>I would like to have one LDAP object representing each computer in
  56 the network, and this object can then keep the SMB (ie host key), DHCP
  57 (mac address/name) and DNS (name/IP address) settings in one place.
  58 It need to be efficently stored to make sure it scale well.</p>
  59
  60 <p>I would also like to have a quick way to map from a user or
  61 computer and to the net group this user or computer is a member.</p>
  62
  63 <p>Active Directory have done a better job than unix heads like myself
  64 in this regard, and the unix side need to catch up.  Time to start a
  65 new IETF work group?</p>
  66
  67  </div>
  68  <div class="tags">
  69
  70
  71
  72   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
  73
  74  </div>
  75 </div>
  76 <div class="padding"></div>
  77
  78 <div class="entry">
  79  <div class="title">
  80  <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">Idea for a change to LDAP schemas allowing DNS and DHCP info to be combined into one object</a>
  81  </div>
  82  <div class="date">
  83   2010-06-24 00:35
  84  </div>
  85
  86  <div class="body">
  87
  88 <p>A while back, I
  89 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">complained
  90 about the fact</a> that it is not possible with the provided schemas
  91 for storing DNS and DHCP information in LDAP to combine the two sets
  92 of information into one LDAP object representing a computer.</p>
  93
  94 <p>In the mean time, I discovered that a simple fix would be to make
  95 the dhcpHost object class auxiliary, to allow it to be combined with
  96 the dNSDomain object class, and thus forming one object for one
  97 computer when storing both DHCP and DNS information in LDAP.</p>
  98
  99 <p>If I understand this correctly, it is not safe to do this change
 100 without also changing the assigned number for the object class, and I
 101 do not know enough about LDAP schema design to do that properly for
 102 Debian Edu.</p>
 103
 104 <p>Anyway, for future reference, this is how I believe we could change
 105 the
 106 <a href="http://tools.ietf.org/html/draft-ietf-dhc-ldap-schema-00">DHCP
 107 schema</a> to solve at least part of the problem with the LDAP schemas
 108 available today from IETF.</p>
 109
 110 <pre>
 111 --- dhcp.schema    (revision 65192)
 112 +++ dhcp.schema    (working copy)
 113 @@ -376,7 +376,7 @@
 114  objectclass ( 2.16.840.1.113719.1.203.6.6
 115         NAME 'dhcpHost'
 116         DESC 'This represents information about a particular client'
 117 -       SUP top
 118 +       SUP top AUXILIARY
 119         MUST cn
 120         MAY  (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
 121         X-NDS_CONTAINMENT ('dhcpService' 'dhcpSubnet' 'dhcpGroup') )
 122 </pre>
 123
 124 <p>I very much welcome clues on how to do this properly for Debian
 125 Edu/Squeeze.  We provide the DHCP schema in our debian-edu-config
 126 package, and should thus be free to rewrite it as we see fit.</p>
 127
 128 <p>If you want to help out with implementing this for Debian Edu,
 129 please contact us on debian-edu@lists.debian.org.</p>
 130
 131  </div>
 132  <div class="tags">
 133
 134
 135
 136   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 137
 138  </div>
 139 </div>
 140 <div class="padding"></div>
 141
 142 <div class="entry">
 143  <div class="title">
 144  <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">LUMA, a very nice LDAP GUI</a>
 145  </div>
 146  <div class="date">
 147   2010-06-28 00:30
 148  </div>
 149
 150  <div class="body">
 151
 152 <p>The last few days I have been looking into the status of the LDAP
 153 directory in Debian Edu, and in the process I started to miss a GUI
 154 tool to browse the LDAP tree.  The only one I was able to find in
 155 Debian/Squeeze and Lenny is
 156 <a href="http://luma.sourceforge.net/">LUMA</a>, which has proved to
 157 be a great tool to get a overview of the current LDAP directory
 158 populated by default in Skolelinux.  Thanks to it, I have been able to
 159 find empty and obsolete subtrees, misplaced objects and duplicate
 160 objects.  It will be installed by default in Debian/Squeeze.  If you
 161 are working with LDAP, give it a go. :)</p>
 162
 163 <p>I did notice one problem with it I have not had time to report to
 164 the BTS yet.  There is no .desktop file in the package, so the tool do
 165 not show up in the Gnome and KDE menus, but only deep down in in the
 166 Debian submenu in KDE.  I hope that can be fixed before Squeeze is
 167 released.</p>
 168
 169 <p>I have not yet been able to get it to modify the tree yet.  I would
 170 like to move objects and remove subtrees directly in the GUI, but have
 171 not found a way to do that with LUMA yet.  So in the mean time, I use
 172 <a href="http://www.lichteblau.com/ldapvi/">ldapvi</a> for that.</p>
 173
 174 <p>If you have tips on other GUI tools for LDAP that might be useful
 175 in Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 176
 177 <p>Update 2010-06-29: Ross Reedstrom tipped us about the
 178 <a href="http://packages.qa.debian.org/g/gq.html">gq</a> package as a
 179 useful GUI alternative.  It seem like a good tool, but is unmaintained
 180 in Debian and got a RC bug keeping it out of Squeeze.  Unless that
 181 changes, it will not be an option for Debian Edu based on Squeeze.</p>
 182
 183  </div>
 184  <div class="tags">
 185
 186
 187
 188   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 189
 190  </div>
 191 </div>
 192 <div class="padding"></div>
 193
 194 <div class="entry">
 195  <div class="title">
 196  <a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a>
 197  </div>
 198  <div class="date">
 199   2010-07-01 11:40
 200  </div>
 201
 202  <div class="body">
 203
 204 <p>For a laptop, centralized user directories and password checking is
 205 a bit troubling.  Laptops are typically used also when not connected
 206 to the network, and it is vital for a user to be able to log in or
 207 unlock the screen saver also when a central server is unavailable.
 208 This is possible by caching passwords and directory information (user
 209 and group attributes) locally, and the packages to do so are available
 210 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
 211 It is also possible to set up in Debian/Lenny, but require more manual
 212 setup there because pam-auth-update is missing in Lenny.</p>
 213
 214 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
 215
 216 This is the traditional method with a twist.  The password caching is
 217 provided by libpam-ccreds (version 10-4 or later is needed on
 218 Squeeze), and the directory caching is done by nscd.  The directory
 219 lookup and password checking is done using LDAP.  If one want to use
 220 Kerberos for password checking the libpam-ldapd package can be
 221 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
 222 local home directory with the path listed in LDAP, one can use the
 223 pam_mkhomedir module from pam-modules to make this happen instead of
 224 using libpam-mklocaluser.  A setup for pam-auth-update to enable
 225 pam_mkhomedir will have to be written until a fix for
 226 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
 227 archive.  Because I believe it is a bad idea to have local home
 228 directories using misleading paths like /site/server/partition/, I
 229 prefer to create a local user with the home directory in /home/.  This
 230 is done using the libpam-mklocaluser package.</p>
 231
 232 <p>These packages need to be installed and configured</p>
 233
 234 <blockquote><pre>
 235 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
 236 </pre></blockquote>
 237
 238 <p>The ldapd packages will ask for LDAP connection information, and
 239 one have to fill in the values that fits ones own site.  Make sure the
 240 PAM part uses encrypted connections, to make sure the password is not
 241 sent in clear text to the LDAP server.  I've been unable to get TLS
 242 certificate checking for a self signed certificate working, which make
 243 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
 244 is talking to the correct LDAP server), and very much welcome feedback
 245 on how to get this working.</p>
 246
 247 <p>Because nscd do not have a default configuration fit for offline
 248 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
 249 is fixed, this configuration should be used instead of the one
 250 currently in /etc/nscd.conf.  The changes are in the fields
 251 reload-count and positive-time-to-live, and is based on the
 252 instructions I found in the
 253 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
 254 instructions by Flyn Computing.</p>
 255
 256 <blockquote><pre>
 257         debug-level             0
 258         reload-count            unlimited
 259         paranoia                no
 260
 261         enable-cache            passwd          yes
 262         positive-time-to-live   passwd          2592000
 263         negative-time-to-live   passwd          20
 264         suggested-size          passwd          211
 265         check-files             passwd          yes
 266         persistent              passwd          yes
 267         shared                  passwd          yes
 268         max-db-size             passwd          33554432
 269         auto-propagate          passwd          yes
 270
 271         enable-cache            group           yes
 272         positive-time-to-live   group           2592000
 273         negative-time-to-live   group           20
 274         suggested-size          group           211
 275         check-files             group           yes
 276         persistent              group           yes
 277         shared                  group           yes
 278         max-db-size             group           33554432
 279         auto-propagate          group           yes
 280
 281         enable-cache            hosts           no
 282         positive-time-to-live   hosts           2592000
 283         negative-time-to-live   hosts           20
 284         suggested-size          hosts           211
 285         check-files             hosts           yes
 286         persistent              hosts           yes
 287         shared                  hosts           yes
 288         max-db-size             hosts           33554432
 289
 290         enable-cache            services        yes
 291         positive-time-to-live   services        2592000
 292         negative-time-to-live   services        20
 293         suggested-size          services        211
 294         check-files             services        yes
 295         persistent              services        yes
 296         shared                  services        yes
 297         max-db-size             services        33554432
 298 </pre></blockquote>
 299
 300 <p>While we wait for a mechanism to update /etc/nsswitch.conf
 301 automatically like the one provided in
 302 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
 303 content need to be manually replaced to ensure LDAP is used as the
 304 directory service on the machine.  /etc/nsswitch.conf should normally
 305 look like this:</p>
 306
 307 <blockquote><pre>
 308 passwd:         files ldap
 309 group:          files ldap
 310 shadow:         files ldap
 311 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 312 networks:       files
 313 protocols:      files
 314 services:       files
 315 ethers:         files
 316 rpc:            files
 317 netgroup:       files ldap
 318 </pre></blockquote>
 319
 320 <p>The important parts are that ldap is listed last for passwd, group,
 321 shadow and netgroup.</p>
 322
 323 <p>With these changes in place, any user in LDAP will be able to log
 324 in locally on the machine using for example kdm, get a local home
 325 directory created and have the password as well as user and group
 326 attributes cached.
 327
 328 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 329   libpam-mklocaluser/pam_mkhomedir</h2>
 330
 331 <p>Because nscd have had its share of problems, and seem to have
 332 problems doing proper caching, I've seen suggestions and recipes to
 333 use nss-updatedb to copy parts of the LDAP database locally when the
 334 LDAP database is available.  I have not tested such setup, because I
 335 discovered sssd.</p>
 336
 337 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
 338
 339 <p>A more flexible and robust setup than the nscd combination
 340 mentioned earlier that has shown up recently, is the
 341 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
 342 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
 343 to provide a Active Directory like directory service for Linux
 344 machines.  The sssd system combines the caching of passwords and user
 345 information into one package, and remove the need for nscd and
 346 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 347 1.2 do not support netgroups, but it is said that it will support this
 348 in version 1.5 expected to show up later in 2010.  Because the
 349 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
 350 was missing in Debian, I ended up co-maintaining it with Werner, and
 351 version 1.2 is now in testing.
 352
 353 <p>These packages need to be installed and configured to get the
 354 roaming setup I want</p>
 355
 356 <blockquote><pre>
 357 libpam-sss libnss-sss libpam-mklocaluser
 358 </pre></blockquote>
 359
 360 The complete setup of sssd is done by editing/creating
 361 <tt>/etc/sssd/sssd.conf</tt>.
 362
 363 <blockquote><pre>
 364 [sssd]
 365 config_file_version = 2
 366 reconnection_retries = 3
 367 sbus_timeout = 30
 368 services = nss, pam
 369 domains = INTERN
 370
 371 [nss]
 372 filter_groups = root
 373 filter_users = root
 374 reconnection_retries = 3
 375
 376 [pam]
 377 reconnection_retries = 3
 378
 379 [domain/INTERN]
 380 enumerate = false
 381 cache_credentials = true
 382
 383 id_provider = ldap
 384 auth_provider = ldap
 385 chpass_provider = ldap
 386
 387 ldap_uri = ldap://ldap
 388 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 389 ldap_tls_reqcert = never
 390 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 391 </pre></blockquote>
 392
 393 <p>I got the same problem here with certificate checking.  Had to set
 394 "ldap_tls_reqcert = never" to get it working.</p>
 395
 396 <p>With the libnss-sss package in testing at the moment, the
 397 nsswitch.conf file is update automatically, so there is no need to
 398 modify it manually.</p>
 399
 400 <p>If you want to help out with implementing this for Debian Edu,
 401 please contact us on debian-edu@lists.debian.org.</p>
 402
 403  </div>
 404  <div class="tags">
 405
 406
 407
 408   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 409
 410  </div>
 411 </div>
 412 <div class="padding"></div>
 413
 414 <div class="entry">
 415  <div class="title">
 416  <a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a>
 417  </div>
 418  <div class="date">
 419   2010-07-09 12:55
 420  </div>
 421
 422  <div class="body">
 423
 424 <p>Since
 425 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
 426 last post</a> about available LDAP tools in Debian, I was told about a
 427 LDAP GUI that is even better than luma.  The java application
 428 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
 429 moving LDAP objects and subtrees using drag-and-drop, and can
 430 authenticate using Kerberos.  I have only tested the Kerberos
 431 authentication, but do not have a LDAP setup allowing me to rewrite
 432 LDAP with my test user yet.  It is
 433 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
 434 Debian</a> testing and unstable at the moment.  The only problem I
 435 have with it is how it handle errors.  If something go wrong, its
 436 non-intuitive behaviour require me to go through some query work list
 437 and remove the failing query.  Nothing big, but very annoying.</p>
 438
 439  </div>
 440  <div class="tags">
 441
 442
 443
 444   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 445
 446  </div>
 447 </div>
 448 <div class="padding"></div>
 449
 450 <div class="entry">
 451  <div class="title">
 452  <a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a>
 453  </div>
 454  <div class="date">
 455   2010-07-11 22:00
 456  </div>
 457
 458  <div class="body">
 459
 460 <p>Vagrant mentioned on IRC today that ltsp_config now support
 461 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
 462 clients, and that this can be used to fetch configuration from LDAP if
 463 Debian Edu choose to store configuration there.</p>
 464
 465 <p>Armed with this information, I got inspired and wrote a test module
 466 to get configuration from LDAP.  The idea is to look up the MAC
 467 address of the client in LDAP, and look for attributes on the form
 468 ltspconfigsetting=value, and use this to export SETTING=value to the
 469 LTSP clients.</p>
 470
 471 <p>The goal is to be able to store the LTSP configuration attributes
 472 in a "computer" LDAP object used by both DNS and DHCP, and thus
 473 allowing us to store all information about a computer in one place.</p>
 474
 475 <p>This is a untested draft implementation, and I welcome feedback on
 476 this approach.  A real LDAP schema for the ltspClientAux objectclass
 477 need to be written.  Comments, suggestions, etc?</p>
 478
 479 <blockquote><pre>
 480 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
 481 #
 482 # Fetch LTSP client settings from LDAP based on MAC address
 483 #
 484 # Uses ethernet address as stored in the dhcpHost objectclass using
 485 # the dhcpHWAddress attribute or ethernet address stored in the
 486 # ieee802Device objectclass with the macAddress attribute.
 487 #
 488 # This module is written to be schema agnostic, and only depend on the
 489 # existence of attribute names.
 490 #
 491 # The LTSP configuration variables are saved directly using a
 492 # ltspConfig prefix and uppercasing the rest of the attribute name.
 493 # To set the SERVER variable, set the ltspConfigServer attribute.
 494 #
 495 # Some LDAP schema should be created with all the relevant
 496 # configuration settings.  Something like this should work:
 497 #
 498 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
 499 #     SUP top
 500 #     AUXILIARY
 501 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
 502
 503 LDAPSERVER=$(debian-edu-ldapserver)
 504 if [ "$LDAPSERVER" ] ; then
 505     LDAPBASE=$(debian-edu-ldapserver -b)
 506     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
 507         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
 508         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
 509             grep '^ltspConfig' | while read attr value ; do
 510             # Remove prefix and convert to upper case
 511             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
 512             # bass value on to clients
 513             eval "$attr=$value; export $attr"
 514         done
 515     done
 516 fi
 517 </pre></blockquote>
 518
 519 <p>I'm not sure this shell construction will work, because I suspect
 520 the while block might end up in a subshell causing the variables set
 521 there to not show up in ltsp-config, but if that is the case I am sure
 522 the code can be restructured to make sure the variables are passed on.
 523 I expect that can be solved with some testing. :)</p>
 524
 525 <p>If you want to help out with implementing this for Debian Edu,
 526 please contact us on debian-edu@lists.debian.org.</p>
 527
 528  </div>
 529  <div class="tags">
 530
 531
 532
 533   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 534
 535  </div>
 536 </div>
 537 <div class="padding"></div>
 538
 539 <div class="entry">
 540  <div class="title">
 541  <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a>
 542  </div>
 543  <div class="date">
 544   2010-07-14 23:45
 545  </div>
 546
 547  <div class="body">
 548
 549 <p>For a while now, I have wanted to find a way to change the DNS and
 550 DHCP services in Debian Edu to use the same LDAP objects for a given
 551 computer, to avoid the possibility of having a inconsistent state for
 552 a computer in LDAP (as in DHCP but no DNS entry or the other way
 553 around) and make it easier to add computers to LDAP.</p>
 554
 555 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
 556 information finally found a solution that seem to work.</p>
 557
 558 <p>The old setup required three LDAP objects for a given computer.
 559 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
 560 we switch powerdns to use its strict LDAP method (ldap-method=strict
 561 in pdns-debian-edu.conf), the forward and reverse DNS entries are
 562 merged into one while making it impossible to transfer the reverse map
 563 to a slave DNS server.</p>
 564
 565 <p>If we also replace the object class used to get the DNS related
 566 attributes to one allowing these attributes to be combined with the
 567 dhcphost object class, we can merge the DNS and DHCP entries into one.
 568 I've written such object class in the dnsdomainaux.schema file (need
 569 proper OIDs, but that is a minor issue), and tested the setup.  It
 570 seem to work.</p>
 571
 572 <p>With this test setup in place, we can get away with one LDAP object
 573 for both DNS and DHCP, and even the LTSP configuration I suggested in
 574 an earlier email.  The combined LDAP object will look something like
 575 this:</p>
 576
 577 <blockquote><pre>
 578   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 579   cn: hostname
 580   objectClass: dhcphost
 581   objectclass: domainrelatedobject
 582   objectclass: dnsdomainaux
 583   associateddomain: hostname.intern
 584   arecord: 10.11.12.13
 585   dhcphwaddress: ethernet 00:00:00:00:00:00
 586   dhcpstatements: fixed-address hostname
 587   ldapconfigsound: Y
 588 </pre></blockquote>
 589
 590 <p>The DNS server uses the associateddomain and arecord entries, while
 591 the DHCP server uses the dhcphwaddress and dhcpstatements entries
 592 before asking DNS to resolve the fixed-adddress.  LTSP will use
 593 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
 594
 595 <p>I am not yet sure if I can get the DHCP server to look for its
 596 dhcphost in a different location, to allow us to put the objects
 597 outside the "DHCP Config" subtree, but hope to figure out a way to do
 598 that.  If I can't figure out a way to do that, we can still get rid of
 599 the hosts subtree and move all its content into the DHCP Config tree
 600 (which probably should be renamed to be more related to the new
 601 content.  I suspect cn=dnsdhcp,ou=services or something like that
 602 might be a good place to put it.</p>
 603
 604 <p>If you want to help out with implementing this for Debian Edu,
 605 please contact us on debian-edu@lists.debian.org.</p>
 606
 607  </div>
 608  <div class="tags">
 609
 610
 611
 612   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 613
 614  </div>
 615 </div>
 616 <div class="padding"></div>
 617
 618 <div class="entry">
 619  <div class="title">
 620  <a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a>
 621  </div>
 622  <div class="date">
 623   2010-07-17 21:00
 624  </div>
 625
 626  <div class="body">
 627
 628 <p>This is a
 629 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
 630 on my
 631 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
 632 work</a> on
 633 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
 634 all</a> the computer related LDAP objects in Debian Edu.</p>
 635
 636 <p>As a step to try to see if it possible to merge the DNS and DHCP
 637 LDAP objects, I have had a look at how the packages pdns-backend-ldap
 638 and dhcp3-server-ldap in Debian use the LDAP server.  The two
 639 implementations are quite different in how they use LDAP.</p>
 640
 641 To get this information, I started slapd with debugging enabled and
 642 dumped the debug output to a file to get the LDAP searches performed
 643 on a Debian Edu main-server.  Here is a summary.
 644
 645 <p><strong>powerdns</strong></p>
 646
 647 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
 648 on how to</a> set up PowerDNS to use a LDAP backend is available on
 649 the web.
 650
 651 <p>PowerDNS have two modes of operation using LDAP as its backend.
 652 One "strict" mode where the forward and reverse DNS lookups are done
 653 using the same LDAP objects, and a "tree" mode where the forward and
 654 reverse entries are in two different subtrees in LDAP with a structure
 655 based on the DNS names, as in tjener.intern and
 656 2.2.0.10.in-addr.arpa.</p>
 657
 658 <p>In tree mode, the server is set up to use a LDAP subtree as its
 659 base, and uses a "base" scoped search for the DNS name by adding
 660 "dc=tjener,dc=intern," to the base with a filter for
 661 "(associateddomain=tjener.intern)" for the forward entry and
 662 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
 663 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
 664 forward entries, it is looking for attributes named dnsttl, arecord,
 665 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
 666 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
 667 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
 668 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
 669 spfrecord and modifytimestamp.  For reverse entries it is looking for
 670 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
 671 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
 672 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
 673 ldapsearch commands could look like this:</p>
 674
 675 <blockquote><pre>
 676 ldapsearch -h ldap \
 677   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 678   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 679   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 680   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 681   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 682   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 683
 684 ldapsearch -h ldap \
 685   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 686   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
 687   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
 688   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
 689   srvrecord naptrrecord modifytimestamp
 690 </pre></blockquote>
 691
 692 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
 693 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
 694 example LDAP objects used there.  In addition to these objects, the
 695 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
 696 also exist.</p>
 697
 698 <blockquote><pre>
 699 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
 700 objectclass: top
 701 objectclass: dnsdomain
 702 objectclass: domainrelatedobject
 703 dc: tjener
 704 arecord: 10.0.2.2
 705 associateddomain: tjener.intern
 706
 707 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
 708 objectclass: top
 709 objectclass: dnsdomain2
 710 objectclass: domainrelatedobject
 711 dc: 2
 712 ptrrecord: tjener.intern
 713 associateddomain: 2.2.0.10.in-addr.arpa
 714 </pre></blockquote>
 715
 716 <p>In strict mode, the server behaves differently.  When looking for
 717 forward DNS entries, it is doing a "subtree" scoped search with the
 718 same base as in the tree mode for a object with filter
 719 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
 720 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
 721 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
 722 naptrrecord and modifytimestamp.  For reverse entires it also do a
 723 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
 724 and the requested attributes are associateddomain, dnsttl and
 725 modifytimestamp.  In short, in strict mode the objects with ptrrecord
 726 go away, and the arecord attribute in the forward object is used
 727 instead.</p>
 728
 729 <p>The forward and reverse searches can be simulated using ldapsearch
 730 like this:</p>
 731
 732 <blockquote><pre>
 733 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 734   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 735   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 736   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 737   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 738   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 739
 740 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 741   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
 742 </pre></blockquote>
 743
 744 <p>In addition to the forward and reverse searches , there is also a
 745 search for SOA records, which behave similar to the forward and
 746 reverse lookups.</p>
 747
 748 <p>A thing to note with the PowerDNS behaviour is that it do not
 749 specify any objectclass names, and instead look for the attributes it
 750 need to generate a DNS reply.  This make it able to work with any
 751 objectclass that provide the needed attributes.</p>
 752
 753 <p>The attributes are normally provided in the cosine (RFC 1274) and
 754 dnsdomain2 schemas.  The latter is used for reverse entries like
 755 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
 756
 757 <p>In Debian Edu, we have created DNS objects using the object classes
 758 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
 759 attributes) and domainrelatedobject (for associatedDomain).  The use
 760 of structural object classes make it impossible to combine these
 761 classes with the object classes used by DHCP.</p>
 762
 763 <p>There are other schemas that could be used too, for example the
 764 dnszone structural object class used by Gosa and bind-sdb for the DNS
 765 attributes combined with the domainrelatedobject object class, but in
 766 this case some unused attributes would have to be included as well
 767 (zonename and relativedomainname).</p>
 768
 769 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
 770 mode and not use any of the existing objectclasses (dnsdomain,
 771 dnsdomain2 and dnszone) when one want to combine the DNS information
 772 with DHCP information, and instead create a auxiliary object class
 773 defined something like this (using the attributes defined for
 774 dnsdomain and dnsdomain2 or dnszone):</p>
 775
 776 <blockquote><pre>
 777 objectclass ( some-oid NAME 'dnsDomainAux'
 778     SUP top
 779     AUXILIARY
 780     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
 781           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
 782           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
 783           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
 784           A6Record $ DNAMERecord
 785     ))
 786 </pre></blockquote>
 787
 788 <p>This will allow any object to become a DNS entry when combined with
 789 the domainrelatedobject object class, and allow any entity to include
 790 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
 791 developers asking for their view on this schema and if they are
 792 interested in providing such schema with PowerDNS, and I hope my
 793 message will be accepted into their mailing list soon.</p>
 794
 795 <p><strong>ISC dhcp</strong></p>
 796
 797 <p>The DHCP server searches for specific objectclass and requests all
 798 the object attributes, and then uses the attributes it want.  This
 799 make it harder to figure out exactly what attributes are used, but
 800 thanks to the working example in Debian Edu I can at least get an idea
 801 what is needed without having to read the source code.</p>
 802
 803 <p>In the DHCP server configuration, the LDAP base to use and the
 804 search filter to use to locate the correct dhcpServer entity is
 805 stored.  These are the relevant entries from
 806 /etc/dhcp3/dhcpd.conf:</p>
 807
 808 <blockquote><pre>
 809 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
 810 ldap-dhcp-server-cn "dhcp";
 811 </pre></blockquote>
 812
 813 <p>The DHCP server uses this information to nest all the DHCP
 814 configuration it need.  The cn "dhcp" is located using the given LDAP
 815 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
 816 search result is this entry:</p>
 817
 818 <blockquote><pre>
 819 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
 820 cn: dhcp
 821 objectClass: top
 822 objectClass: dhcpServer
 823 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 824 </pre></blockquote>
 825
 826 <p>The content of the dhcpServiceDN attribute is next used to locate the
 827 subtree with DHCP configuration.  The DHCP configuration subtree base
 828 is located using a base scope search with base "cn=DHCP
 829 Config,dc=skole,dc=skolelinux,dc=no" and filter
 830 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
 831 The search result is this entry:</p>
 832
 833 <blockquote><pre>
 834 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 835 cn: DHCP Config
 836 objectClass: top
 837 objectClass: dhcpService
 838 objectClass: dhcpOptions
 839 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
 840 dhcpStatements: ddns-update-style none
 841 dhcpStatements: authoritative
 842 dhcpOption: smtp-server code 69 = array of ip-address
 843 dhcpOption: www-server code 72 = array of ip-address
 844 dhcpOption: wpad-url code 252 = text
 845 </pre></blockquote>
 846
 847 <p>Next, the entire subtree is processed, one level at the time.  When
 848 all the DHCP configuration is loaded, it is ready to receive requests.
 849 The subtree in Debian Edu contain objects with object classes
 850 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
 851 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
 852 and information about netmasks, dynamic range etc.  Leaving out the
 853 details here because it is not relevant for the focus of my
 854 investigation, which is to see if it is possible to merge dns and dhcp
 855 related computer objects.</p>
 856
 857 <p>When a DHCP request come in, LDAP is searched for the MAC address
 858 of the client (00:00:00:00:00:00 in this example), using a subtree
 859 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
 860 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
 861 00:00:00:00:00:00))" as the filter.  This is what a host object look
 862 like:</p>
 863
 864 <blockquote><pre>
 865 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 866 cn: hostname
 867 objectClass: top
 868 objectClass: dhcpHost
 869 dhcpHWAddress: ethernet 00:00:00:00:00:00
 870 dhcpStatements: fixed-address hostname
 871 </pre></blockquote>
 872
 873 <p>There is less flexiblity in the way LDAP searches are done here.
 874 The object classes need to have fixed names, and the configuration
 875 need to be stored in a fairly specific LDAP structure.  On the
 876 positive side, the invidiual dhcpHost entires can be anywhere without
 877 the DN pointed to by the dhcpServer entries.  The latter should make
 878 it possible to group all host entries in a subtree next to the
 879 configuration entries, and this subtree can also be shared with the
 880 DNS server if the schema proposed above is combined with the dhcpHost
 881 structural object class.
 882
 883 <p><strong>Conclusion</strong></p>
 884
 885 <p>The PowerDNS implementation seem to be very flexible when it come
 886 to which LDAP schemas to use.  While its "tree" mode is rigid when it
 887 come to the the LDAP structure, the "strict" mode is very flexible,
 888 allowing DNS objects to be stored anywhere under the base cn specified
 889 in the configuration.</p>
 890
 891 <p>The DHCP implementation on the other hand is very inflexible, both
 892 regarding which LDAP schemas to use and which LDAP structure to use.
 893 I guess one could implement ones own schema, as long as the
 894 objectclasses and attributes have the names used, but this do not
 895 really help when the DHCP subtree need to have a fairly fixed
 896 structure.</p>
 897
 898 <p>Based on the observed behaviour, I suspect a LDAP structure like
 899 this might work for Debian Edu:</p>
 900
 901 <blockquote><pre>
 902 ou=services
 903   cn=machine-info (dhcpService) - dhcpServiceDN points here
 904     cn=dhcp (dhcpServer)
 905     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
 906       cn=10.0.2.0 (dhcpSubnet)
 907         cn=group1 (dhcpGroup/dhcpOptions)
 908     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
 909       cn=192.168.0.0 (dhcpSubnet)
 910         cn=group1 (dhcpGroup/dhcpOptions)
 911     ou=machines - PowerDNS base points here
 912       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
 913 </pre></blockquote>
 914
 915 <P>This is not tested yet.  If the DHCP server require the dhcpHost
 916 entries to be in the dhcpGroup subtrees, the entries can be stored
 917 there instead of a common machines subtree, and the PowerDNS base
 918 would have to be moved one level up to the machine-info subtree.</p>
 919
 920 <p>The combined object under the machines subtree would look something
 921 like this:</p>
 922
 923 <blockquote><pre>
 924 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
 925 dc: hostname
 926 objectClass: top
 927 objectClass: dhcpHost
 928 objectclass: domainrelatedobject
 929 objectclass: dnsDomainAux
 930 associateddomain: hostname.intern
 931 arecord: 10.11.12.13
 932 dhcpHWAddress: ethernet 00:00:00:00:00:00
 933 dhcpStatements: fixed-address hostname.intern
 934 </pre></blockquote>
 935
 936 </p>One could even add the LTSP configuration associated with a given
 937 machine, as long as the required attributes are available in a
 938 auxiliary object class.</p>
 939
 940  </div>
 941  <div class="tags">
 942
 943
 944
 945   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 946
 947  </div>
 948 </div>
 949 <div class="padding"></div>
 950
 951  <p style="text-align: right;"><a href="ldap.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14"></a></p>
 952
 953
 954
 955
 956 <div id="sidebar">
 957
 958 <h2>Archive</h2>
 959 <ul>
 960
 961 <li>2010
 962 <ul>
 963
 964 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 965
 966 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 967
 968 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 969
 970 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 971
 972 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 973
 974 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 975
 976 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (7)</a></li>
 977
 978 </ul></li>
 979
 980 <li>2009
 981 <ul>
 982
 983 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 984
 985 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 986
 987 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 988
 989 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 990
 991 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 992
 993 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 994
 995 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 996
 997 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 998
 999 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1000
1001 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1002
1003 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1004
1005 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1006
1007 </ul></li>
1008
1009 <li>2008
1010 <ul>
1011
1012 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1013
1014 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1015
1016 </ul></li>
1017
1018 </ul>
1019
1020
1021
1022 <h2>Tags</h2>
1023 <ul>
1024
1025  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
1026
1027  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1028
1029  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1030
1031  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
1032
1033  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (34)</a></li>
1034
1035  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (34)</a></li>
1036
1037  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (47)</a></li>
1038
1039  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
1040
1041  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (7)</a></li>
1042
1043  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
1044
1045  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
1046
1047  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
1048
1049  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1050
1051  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
1052
1053  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (70)</a></li>
1054
1055  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (84)</a></li>
1056
1057  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (13)</a></li>
1058
1059  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (13)</a></li>
1060
1061  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
1062
1063  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1064
1065  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (9)</a></li>
1066
1067  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
1068
1069  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
1070
1071  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
1072
1073  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
1074
1075  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
1076
1077  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
1078
1079 </ul>
1080
1081 </div>
1082 </body>
1083 </html>