blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Broken_hard_link_handling_with_sshfs.html">Broken hard link handling with sshfs</a></div>
  24   <div class="date">2010-08-30 19:30</div>
  25   <div class="body">
  26 <p>Just got an email from Tobias Gruetzmacher as a followup on my
  27 <a href="http://people.skolelinux.org/pere/blog/Broken_umask_handling_with_sshfs.html">previous
  28 post about sshfs</a>.  He reported another problem with sshfs.  It
  29 fail to handle hard links properly.  A simple way to spot this is to
  30 look at the . and .. entries in the directory tree.  These should have
  31 a link count >1, but on sshfs the count is 1.  I just tested to see
  32 what happen when trying to hardlink, and this fail as well:</p>
  33
  34 <pre>
  35 % ln foo bar
  36 ln: creating hard link `bar' => `foo': Function not implemented
  37 %
  38 </pre>
  39
  40 <p>I have not yet found time to implement a test for this in my file
  41 system test code, but believe having working hard links is useful to
  42 avoid surprised unix programs.  Not as useful as working file locking
  43 and symlinks, which are required to get a working desktop, but useful
  44 nevertheless. :)</p>
  45
  46 <p>The latest version of the file system test code is available via
  47 git from
  48 <a href="http://github.com/gebi/fs-test">http://github.com/gebi/fs-test</a></p>
  49 </div>
  50   <div class="tags">
  51
  52
  53
  54    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
  55
  56   </div>
  57  </div>
  58  <div class="padding"></div>
  59
  60  <div class="entry">
  61   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Sikkerhetsteateret_p___flyplassene_fortsetter.html">Sikkerhetsteateret på flyplassene fortsetter</a></div>
  62   <div class="date">2010-08-28 10:40</div>
  63   <div class="body">
  64 <p>Jeg skrev for et halvt år siden hvordan
  65 <a href="http://people.skolelinux.org/pere/blog/Sikkerhet__teater__og_hvordan_gj__re_verden_sikrere.html">samfunnet
  66 kaster bort ressurser på sikkerhetstiltak som ikke fungerer</a>.  Kom
  67 nettopp over en
  68 <a href="http://www.askthepilot.com/essays-and-stories/terrorism-tweezers-and-terminal-madness-an-essay-on-security/">historie
  69 fra en pilot fra USA</a> som kommenterer det samme.  Jeg mistenker det
  70 kun er uvitenhet og autoritetstro som gjør at så få protesterer.  Har
  71 veldig sans for piloten omtalt i <a
  72 href="http://www.aftenposten.no/nyheter/iriks/article2057501.ece">Aftenposten</a> 2007-10-23,
  73 og skulle ønske flere rettet oppmerksomhet mot problemet.  Det gir
  74 ikke meg trygghetsfølelse på flyplassene når jeg ser at
  75 flyplassadministrasjonen kaster bort folk, penger og tid på tull i
  76 stedet for ting som bidrar til reell økning av sikkerheten.  Det
  77 forteller meg jo at vurderingsevnen til de som burde bidra til økt
  78 sikkerhet er svært sviktende, noe som ikke taler godt for de andre
  79 tiltakene.</p>
  80
  81 <p>Mon tro hva som skjer hvis det fantes en enkel brosjyre å skrive ut
  82 fra Internet som forklarte hva som er galt med sikkerhetsopplegget på
  83 flyplassene, og folk skrev ut og la en bunke på flyplassene når de
  84 passerte.  Kanskje det ville fått flere til å få øynene opp for
  85 problemet.</p>
  86
  87 <p>Personlig synes jeg flyopplevelsen er blitt så avskyelig at jeg
  88 forsøker å klare meg med tog, bil og båt for å slippe ubehaget.  Det
  89 er dog noe vanskelig i det langstrakte Norge og for å kunne besøke de
  90 delene av verden jeg ønsker å nå.  Mistenker at flere har det slik, og
  91 at dette går ut over inntjeningen til flyselskapene.  Det er antagelig
  92 en god ting sett fra et miljøperspektiv, men det er en annen sak.</p>
  93 </div>
  94   <div class="tags">
  95
  96
  97
  98    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
  99
 100   </div>
 101  </div>
 102  <div class="padding"></div>
 103
 104  <div class="entry">
 105   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Skolelinux_i_Osloskolen.html">Skolelinux i Osloskolen</a></div>
 106   <div class="date">2010-08-26 22:25</div>
 107   <div class="body">
 108 <p>Denne høsten skal endelig alle Osloskolene få mulighet til å bruke
 109 <a href="http://www.skolelinux.org/">Skolelinux</a>.  Ny IT-løsning
 110 har vært rullet ut i noen måneder nå, og så vidt jeg fikk vite før
 111 sommeren skulle alle skoler ha nytt opplegg på plass før oppstart nå i
 112 høst.  På alle skolene skal en kunne velge ved installasjon om en skal
 113 ha Windows eller Skolelinux på maskinene, og en kan i tillegg
 114 PXE-boote maskinene over nett som tynne klienter eller diskløse
 115 arbeidsstasjoner. Jeg er spent på hvor mange skoler som velger å ta i
 116 bruk Skolelinux, og gleder meg til å se hvordan dette utvikler seg.
 117 Løsningen leveres av
 118 <a href="http://www.logica.no/">Logica</a> med
 119 <a href="http://www.slxdrift.no/">Skolelinux Drift AS</a> som
 120 underleverandør, og jeg har vært involvert i utviklingen av løsningen
 121 via Skolelinux Drift AS siden prosjektet starter.  Jeg synes det er
 122 fantastisk at Skolelinux er kommet så langt siden vi startet i 2001 at
 123 alle elevene i Osloskolene nå skal få mulighet til å bruke
 124 løsningen.  Jeg håper de vil sette pris på alle de
 125 <a href="http://www.skolelinux.no/linux-signpost/">fantastiske
 126 brukerprogrammene</a> som er tilgjengelig i Skolelinux.</p>
 127 </div>
 128   <div class="tags">
 129
 130
 131
 132    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>.
 133
 134   </div>
 135  </div>
 136  <div class="padding"></div>
 137
 138  <div class="entry">
 139   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Broken_umask_handling_with_sshfs.html">Broken umask handling with sshfs</a></div>
 140   <div class="date">2010-08-26 13:30</div>
 141   <div class="body">
 142 <p>My file system sematics program
 143 <a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">presented
 144 a few days ago</a> is very useful to verify that a file system can
 145 work as a unix home directory,and today I had to extend it a bit.  I'm
 146 looking into alternatives for home directory access here at the
 147 University of Oslo, and one of the options is sshfs.  My friend
 148 Finn-Arne mentioned a while back that they had used sshfs with Debian
 149 Edu, but stopped because of problems.  I asked today what the problems
 150 where, and he mentioned that sshfs failed to handle umask properly.
 151 Trying to detect the problem I wrote this addition to my fs testing
 152 script:</p>
 153
 154 <pre>
 155 mode_t touch_get_mode(const char *name, mode_t mode) {
 156   mode_t retval = 0;
 157   int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, mode);
 158   if (-1 != fd) {
 159     unlink(name);
 160     struct stat statbuf;
 161     if (-1 != fstat(fd, &statbuf)) {
 162       retval = statbuf.st_mode & 0x1ff;
 163     }
 164     close(fd);
 165   }
 166   return retval;
 167 }
 168
 169 /* Try to detect problem discovered using sshfs */
 170 int test_umask(void) {
 171   printf("info: testing umask effect on file creation\n");
 172
 173   mode_t orig_umask = umask(000);
 174   mode_t newmode;
 175   if (0666 != (newmode = touch_get_mode("foobar", 0666))) {
 176     printf("  error: Wrong file mode %o when creating using mode 666 and umask 000\n",
 177            newmode);
 178   }
 179   umask(007);
 180   if (0660 != (newmode = touch_get_mode("foobar", 0666))) {
 181     printf("  error: Wrong file mode %o when creating using mode 666 and umask 007\n",
 182            newmode);
 183   }
 184
 185   umask (orig_umask);
 186   return 0;
 187 }
 188
 189 int main(int argc, char **argv) {
 190   [...]
 191   test_umask();
 192   return 0;
 193 }
 194 </pre>
 195
 196 <p>Sure enough.  On NFS to a netapp, I get this result:</p>
 197
 198 <pre>
 199 Testing POSIX/Unix sematics on file system
 200 info: testing symlink creation
 201 info: testing subdirectory creation
 202 info: testing fcntl locking
 203   Read-locking 1 byte from 1073741824
 204   Read-locking 510 byte from 1073741826
 205   Unlocking 1 byte from 1073741824
 206   Write-locking 1 byte from 1073741824
 207   Write-locking 510 byte from 1073741826
 208   Unlocking 2 byte from 1073741824
 209 info: testing umask effect on file creation
 210 </pre>
 211
 212 <p>When mounting the same directory using sshfs, I get this
 213 result:</p>
 214
 215 <pre>
 216 Testing POSIX/Unix sematics on file system
 217 info: testing symlink creation
 218 info: testing subdirectory creation
 219 info: testing fcntl locking
 220   Read-locking 1 byte from 1073741824
 221   Read-locking 510 byte from 1073741826
 222   Unlocking 1 byte from 1073741824
 223   Write-locking 1 byte from 1073741824
 224   Write-locking 510 byte from 1073741826
 225   Unlocking 2 byte from 1073741824
 226 info: testing umask effect on file creation
 227   error: Wrong file mode 644 when creating using mode 666 and umask 000
 228   error: Wrong file mode 640 when creating using mode 666 and umask 007
 229 </pre>
 230
 231 <p>So, I can conclude that sshfs is better than smb to a Netapp or a
 232 Windows server, but not good enough to be used as a home
 233 directory.</p>
 234
 235 <p>Update 2010-08-26: Reported the issue in
 236 <a href="http://bugs.debian.org/594498">BTS report #594498</a></p>
 237
 238 <p>Update 2010-08-27: Michael Gebetsroither report that he found the
 239 script so useful that he created a GIT repository and stored it in
 240 <a href="http://github.com/gebi/fs-test">http://github.com/gebi/fs-test</a>.</p>
 241 </div>
 242   <div class="tags">
 243
 244
 245
 246    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 247
 248   </div>
 249  </div>
 250  <div class="padding"></div>
 251
 252  <div class="entry">
 253   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Elektronisk_stemmegiving_er_ikke_til____stole_p_____heller_ikke_i_Norge.html">Elektronisk stemmegiving er ikke til å stole på - heller ikke i Norge</a></div>
 254   <div class="date">2010-08-23 19:30</div>
 255   <div class="body">
 256 <p>I Norge pågår en prosess for å
 257 <a href="http://www.e-valg.dep.no/">innføre elektronisk
 258 stemmegiving</a> ved kommune- og stortingsvalg.  Dette skal
 259 introduseres i 2011.  Det er all grunn til å tro at valg i Norge ikke
 260 vil være til å stole på hvis dette blir gjennomført.  Da det hele var
 261 oppe til høring i 2006 forfattet jeg
 262 <a href="http://www.nuug.no/dokumenter/valg-horing-2006-09.pdf">en
 263 høringsuttalelse fra NUUG</a> (og EFN som hengte seg på) som skisserte
 264 hvilke punkter som må oppfylles for at en skal kunne stole på et valg,
 265 og elektronisk stemmegiving mangler flere av disse.  Elektronisk
 266 stemmegiving er for alle praktiske formål å putte ens stemme i en sort
 267 boks under andres kontroll, og satse på at de som har kontroll med
 268 boksen er til å stole på - uten at en har mulighet til å verifisere
 269 dette selv.  Det er ikke slik en gjennomfører demokratiske valg.</p>
 270
 271 <p>Da problemet er fundamentalt med hvordan elektronisk stemmegiving
 272 må fungere for at også ikke-krypografer skal kunne delta, har det vært
 273 mange rapporter om hvordan elektronisk stemmegiving har sviktet i land
 274 etter land.  En
 275 <a href="http://wiki.nuug.no/uttalelser/2006-elektronisk-stemmegiving">liten
 276 samling referanser</a> finnes på NUUGs wiki.  Den siste er fra India,
 277 der valgkomisjonen har valgt
 278 <a href="http://www.freedom-to-tinker.com/blog/jhalderm/electronic-voting-researcher-arrested-over-anonymous-source">å
 279 pusse politiet på en forsker</a> som har dokumentert svakheter i
 280 valgsystemet.</p>
 281
 282 <p>Her i Norge har en valgt en annen tilnærming, der en forsøker seg
 283 med teknobabbel for å få befolkningen til å tro at dette skal bli
 284 sikkert.  Husk, elektronisk stemmegiving underminerer de demokratiske
 285 valgene i Norge, og bør ikke innføres.</p>
 286
 287 <p>Den offentlige diskusjonen blir litt vanskelig av at media har
 288 valgt å kalle dette "evalg", som kan sies å både gjelde elektronisk
 289 opptelling av valget som Norge har gjort siden 60-tallet og som er en
 290 svært god ide, og elektronisk opptelling som er en svært dårlig ide.
 291 Diskusjonen gir ikke mening hvis en skal diskutere om en er for eller
 292 mot "evalg", og jeg forsøker derfor å være klar på at jeg snakker om
 293 elektronisk stemmegiving og unngå begrepet "evalg".</p>
 294 </div>
 295   <div class="tags">
 296
 297
 298
 299    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 300
 301   </div>
 302  </div>
 303  <div class="padding"></div>
 304
 305  <div class="entry">
 306   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Robot__reis_deg___.html">Robot, reis deg...</a></div>
 307   <div class="date">2010-08-21 22:10</div>
 308   <div class="body">
 309 <p>I dag fikk jeg endelig tittet litt på mine nyinnkjøpte roboter, og
 310 har brukt noen timer til å google etter interessante referanser og
 311 aktuell kildekode for bruk på Linux.  Det mest lovende så langt er
 312 <a href="http://ispykee.toyz.org/">ispykee</a>, som har en
 313 BSD-lisensiert linux-daemon som står som mellomledd mellom roboter på
 314 lokalnettet og en sentral tjeneste der en iPhone kan koble seg opp for
 315 å fjernstyre roboten.  Linux-daemonen implementerer deler av
 316 protokollen som roboten forstår.  Etter å ha knotet litt med å oppnå
 317 kontakt med roboten (den oppretter et eget ad-hoc wifi-nett, så jeg
 318 måtte gå av mitt vanlige nett for å få kontakt), og kommet frem til at
 319 den lytter på IP-port 9000 og 9001, gikk jeg i gang med å finne ut
 320 hvordan jeg kunne snakke med roboten vha. disse portene.  Robotbiten
 321 av protokollen er publisert av produsenten med GPL-lisens, slik at det
 322 er mulig å se hvordan protokollen fungerer.  Det finnes en java-klient
 323 for Android som så ganske snasen ut, men fant ingen kildekode for
 324 denne.  Derimot hadde iphone-løsningen kildekode, så jeg tok
 325 utgangspunkt i den.</p>
 326
 327 <p>Daemonen ville i utgangspunktet forsøke å kontakte den sentrale
 328 tjenesten som iphone-programmet kobler seg til.  Jeg skrev dette om
 329 til i stedet å sette opp en nettverkstjeneste på min lokale maskin,
 330 som jeg kan koble meg opp til med telnet og gi kommandoer til roboten
 331 (act, forward, right, left, etc).  Det involverte i praksis å bytte ut
 332 socket()/connect() med socket()/bind()/listen()/accept() for å gjøre
 333 klienten om til en tjener.</p>
 334
 335 <p>Mens jeg har forsøkt å få roboten til å bevege seg har min samboer
 336 skrudd sammen resten av roboten for å få montert kamera og plastpynten
 337 (armer, plastfiber for lys).  Nå er det hele montert, og roboten er
 338 klar til bruk.  Må få flyttet den over til mitt vanlige trådløsnett
 339 før det blir praktisk, men de bitene av protokollen er ikke
 340 implementert i ispykee-daemonen, så der må jeg enten få tak i en mac
 341 eller en windows-maskin, eller implementere det selv.</p>
 342
 343 <p>Vi var tre som kjøpte slike roboter, og vi har blitt enige om å
 344 samle notater og referanser på <a
 345 href="http://wiki.nuug.no/grupper/robot/">NUUGs wiki</a>.  Ta en titt
 346 der hvis du er nysgjerrig.</p>
 347 </div>
 348   <div class="tags">
 349
 350
 351
 352    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/robot">robot</a>.
 353
 354   </div>
 355  </div>
 356  <div class="padding"></div>
 357
 358  <div class="entry">
 359   <div class="title"><a href="http://people.skolelinux.org/pere/blog/2_Spykee_roboter_i_hus__n___skal_det_lekes.html">2 Spykee-roboter i hus, nå skal det lekes</a></div>
 360   <div class="date">2010-08-18 13:30</div>
 361   <div class="body">
 362 <p>Jeg kjøpte nettopp to
 363 <a href="http://www.spykee-robot.com/">Spykee</a>-roboter, for test og
 364 leking.  Kjøpte to da det var så billige, og gir meg mulighet til å
 365 eksperimentere uten å være veldig redd for å ødelegge alt ved å bytte
 366 ut firmware og slikt.  Oppdaget at lekebutikken på Bryn senter hadde
 367 en liten stabel på lager som de ikke hadde klart å selge ut etter
 368 fjorårets juleinnkjøp, og var villig til å selge for en femtedel av
 369 vanlig pris.  Jeg, Ronny og Jarle har skaffet oss restbeholdningen, og
 370 det blir morsomt å se hva vi får ut av dette.</p>
 371
 372 <p>Roboten har belter styrt av to motorer, kamera, høytaler, mikrofon
 373 og wifi-tilkobling.  Det hele styrt av en GPL-lisensiert databoks som
 374 jeg mistenker kjører linux.  Firmware-kildekoden ble visst publisert i
 375 mai.  Eneste utfordringen er at kontroller-programvaren kun finnes til
 376 Windows, men det må en kunne jobbe seg rundt når vi har kildekoden til
 377 firmwaren. :)</p>
 378
 379 <ul>
 380 <li><a href="http://en.wikipedia.org/wiki/Spykee">Wikipedia-oppføring</a></li>
 381 <li><a href=http://www.spykeeworld.com/spykee/US/freeSoftware.html">Nedlasting av firmware-kilden</a></li>
 382 <li><a href="http://wiki.nuug.no/grupper/robot">prosjektwiki hos NUUG</a></li>
 383 </ul>
 384 </div>
 385   <div class="tags">
 386
 387
 388
 389    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/robot">robot</a>.
 390
 391   </div>
 392  </div>
 393  <div class="padding"></div>
 394
 395  <div class="entry">
 396   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Rob_Weir__How_to_Crush_Dissent.html">Rob Weir: How to Crush Dissent</a></div>
 397   <div class="date">2010-08-15 22:20</div>
 398   <div class="body">
 399 <p>I found the notes from Rob Weir on
 400 <a href="http://feedproxy.google.com/~r/robweir/antic-atom/~3/VGb23-kta8c/how-to-crush-dissent.html">how
 401 to crush dissent</a> matching my own thoughts on the matter quite
 402 well.  Highly recommended for those wondering which road our society
 403 should go down.  In my view we have been heading the wrong way for a
 404 long time.</p>
 405 </div>
 406   <div class="tags">
 407
 408
 409
 410    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 411
 412   </div>
 413  </div>
 414  <div class="padding"></div>
 415
 416  <div class="entry">
 417   <div class="title"><a href="http://people.skolelinux.org/pere/blog/No_hardcoded_config_on_Debian_Edu_clients.html">No hardcoded config on Debian Edu clients</a></div>
 418   <div class="date">2010-08-09 20:15</div>
 419   <div class="body">
 420 <p>As reported earlier, the last few days I have looked at how Debian
 421 Edu clients are configured, and tried to get rid of all hardcoded
 422 configuration settings on the clients.  I believe the work to be
 423 mostly done, and the clients seem to work just fine with dynamically
 424 generated configuration.</p>
 425
 426 <p>What is the point, you might ask?  The point is to allow a Debian
 427 Edu desktop to integrate into an existing network infrastructure
 428 without any manual configuration.</p>
 429
 430 <p>This is what happens when installing a Debian Edu client here at
 431 the University of Oslo using PXE.  With the PXE installation, I am
 432 asked for language (Norwegian Bokmål), locality (Norway) and keyboard
 433 layout (no-latin1), Debian Edu profile (Roaming Workstation), if I
 434 accept to reformat the hard drive (yes), if I want to submit info to
 435 popcon.debian.org (no) and root password (secret).  After answering
 436 these questions, the installer goes ahead and does its thing, and
 437 after around 50 minutes it is done.  I press enter to finish the
 438 installation, and the machine reboots into KDE.  When the machine is
 439 ready and kdm asks for login information, I enter my university
 440 username and password, am told by kdm that a local home directory has
 441 been created and that I must log in again, and finally log in with the
 442 same username and password to the KDE 4.4 desktop.  At no point during
 443 this process did it ask for university specific settings, and all the
 444 required configuration was dynamically detected using information
 445 fetched via DHCP and DNS.  The roaming workstation is now ready for
 446 use.</p>
 447
 448 <p>How was this done, you might wonder?  First of all, here is the
 449 list of things that need to be configured on the client to get it
 450 working properly out of the box:</p>
 451
 452 <ul>
 453 <li>IP address/netmask and DNS server.</li>
 454 <li>Web proxy URL.</li>
 455 <li>LDAP server for NSS directory information (user, group, etc).</li>
 456 <li>Kerberos server for PAM password checking.</li>
 457 <li>SMB mount point to access the network home directory. (*)</li>
 458 <li>Central syslog server to send syslog messages to. (*)</li>
 459 <li>Sitesummary collector URL to submit info to central server. (*)</li>
 460 </ul>
 461
 462 <p>(Hm, did I forget anything?  Let me knew if I did.)</p>
 463
 464 <p>The points marked (*) are not required to be able to use the
 465 machine, but needed to provide central storage and allowing system
 466 administrators to track their machines.  Since yesterday, everything
 467 but the sitesummary collector URL is dynamically discovered at boot
 468 and installation time in the svn version of Debian Edu.</p>
 469
 470 <p>The IP and DNS setup is fetched during boot using DHCP as usual.
 471 When a DHCP update arrives, the proxy setup is updated by looking for
 472 http://wpat/wpad.dat and using the content of this WPAD file to
 473 configure the http and ftp proxy in /etc/environment and
 474 /etc/apt/apt.conf.  I decided to update the proxy setup using a DHCP
 475 hook to ensure that the client stops using the Debian Edu proxy when
 476 it is moved outside the Debian Edu network, and instead uses any local
 477 proxy present on the new network when it moves around.</p>
 478
 479 <p>The DNS names of the LDAP, Kerberos and syslog server and related
 480 configuration are generated using DNS information at boot.  First the
 481 installer looks for a host named ldap in the current DNS domain.  If
 482 not found, it looks for _ldap._tcp SRV records in DNS instead.  If an
 483 LDAP server is found, its root DSE entry is requested and the
 484 attributes namingContexts and defaultNamingContext are used to
 485 determine which LDAP base to use for NSS.  If there are several
 486 namingContexts attibutes and the defaultNamingContext is present, that
 487 LDAP subtree is used as the base.  If defaultNamingContext is missing,
 488 the subtrees listed as namingContexts are searched in sequence for any
 489 object with class posixAccount or posixGroup, and the first one with
 490 such an object is used as the LDAP base.  For Kerberos, a similar
 491 search is done by first looking for a host named kerberos, and then
 492 for the _kerberos._tcp SRV record.  I've been unable to find a way to
 493 look up the Kerberos realm, so for this the upper case string of the
 494 current DNS domain is used.</p>
 495
 496 <p>For the syslog server, the hosts syslog and loghost are searched
 497 for, and the _syslog._udp SRV record is consulted if no such host is
 498 found.  This algorithm works for both Debian Edu and the University of
 499 Oslo.  A similar strategy would work for locating the sitesummary
 500 server, but have not been implemented yet.  I decided to fetch and
 501 save these settings during installation, to make sure moving to a
 502 different network does not change the set of users being allowed to
 503 log in nor the passwords required to log in.  Usernames and passwords
 504 will be cached by sssd when the user logs in on the Debian Edu
 505 network, and will not change as the laptop move around.  For a
 506 non-roaming machine, there is no caching, but given that it is
 507 supposed to stay in place it should not matter much.  Perhaps we
 508 should switch those to use sssd too?</p>
 509
 510 <p>The user's SMB mount point for the network home directory is
 511 located when the user logs in for the first time.  The LDAP server is
 512 consulted to look for the user's LDAP object and the sambaHomePath
 513 attribute is used if found.  If it isn't found, the home directory
 514 path fetched from NSS is used instead.  Assuming the path is of the
 515 form /site/server/directory/username, the second part is looked up in
 516 DNS and used to generate a SMB URL of the form
 517 smb://server.domain/username.  This algorithm works for both Debian
 518 edu and the University of Oslo.  Perhaps there are better attributes
 519 to use or a better algorithm that works for more sites, but this will
 520 do for now. :)</p>
 521
 522 <p>This work should make it easier to integrate the Debian Edu clients
 523 into any LDAP/Kerberos infrastructure, and make the current setup even
 524 more flexible than before.  I suspect it will also work for thin
 525 client servers, allowing one to easily set up LTSP and hook it into a
 526 existing network infrastructure, but I have not had time to test this
 527 yet.</p>
 528
 529 <p>If you want to help out with implementing these things for Debian
 530 Edu, please contact us on debian-edu@lists.debian.org.</p>
 531
 532 <p>Update 2010-08-09: Simon Farnsworth gave me a heads-up on how to
 533 detect Kerberos realm from DNS, by looking for _kerberos TXT entries
 534 before falling back to the upper case DNS domain name.  Will have to
 535 implement it for Debian Edu. :)</p>
 536 </div>
 537   <div class="tags">
 538
 539
 540
 541    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 542
 543   </div>
 544  </div>
 545  <div class="padding"></div>
 546
 547  <div class="entry">
 548   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">Testing if a file system can be used for home directories...</a></div>
 549   <div class="date">2010-08-08 21:20</div>
 550   <div class="body">
 551 <p>A few years ago, I was involved in a project planning to use
 552 Windows file servers as home directory servers for Debian
 553 Edu/Skolelinux machines.  This was thought to be no problem, as the
 554 access would be through the SMB network file system protocol, and we
 555 knew other sites used SMB with unix and samba as the file server to
 556 mount home directories without any problems.  But, after months of
 557 struggling, we had to conclude that our goal was impossible.</p>
 558
 559 <p>The reason is simply that while SMB can be used for home
 560 directories when the file server is Samba running on Unix, this only
 561 work because of Samba have some extensions and the fact that the
 562 underlying file system is a unix file system.  When using a Windows
 563 file server, the underlying file system do not have POSIX semantics,
 564 and several programs will fail if the users home directory where they
 565 want to store their configuration lack POSIX semantics.</p>
 566
 567 <p>As part of this work, I wrote a small C program I want to share
 568 with you all, to replicate a few of the problematic applications (like
 569 OpenOffice.org and GCompris) and see if the file system was working as
 570 it should.  If you find yourself in spooky file system land, it might
 571 help you find your way out again.  This is the fs-test.c source:</p>
 572
 573 <pre>
 574 /*
 575  * Some tests to check the file system sematics.  Used to verify that
 576  * CIFS from a windows server do not work properly as a linux home
 577  * directory.
 578  * License: GPL v2 or later
 579  *
 580  * needs libsqlite3-dev and build-essential installed
 581  * compile with: gcc -Wall -lsqlite3 -DTEST_SQLITE fs-test.c -o fs-test
 582 */
 583
 584 #define _FILE_OFFSET_BITS 64
 585 #define _LARGEFILE_SOURCE 1
 586 #define _LARGEFILE64_SOURCE 1
 587
 588 #define _GNU_SOURCE /* for asprintf() */
 589
 590 #include &lt;errno.h>
 591 #include &lt;fcntl.h>
 592 #include &lt;stdio.h>
 593 #include &lt;string.h>
 594 #include &lt;stdlib.h>
 595 #include &lt;sys/file.h>
 596 #include &lt;sys/stat.h>
 597 #include &lt;sys/types.h>
 598 #include &lt;unistd.h>
 599
 600 #ifdef TEST_SQLITE
 601 /*
 602  * Test sqlite open, as done by gcompris require the libsqlite3-dev
 603  * package and linking with -lsqlite3.  A more low level test is
 604  * below.
 605  * See also &lt;URL: http://www.sqlite.org./faq.html#q5 >.
 606  */
 607 #include &lt;sqlite3.h>
 608 #define CREATE_TABLE_USERS                                              \
 609   "CREATE TABLE users (user_id INT UNIQUE, login TEXT, lastname TEXT, firstname TEXT, birthdate TEXT, class_id INT ); "
 610 int test_sqlite_open(void) {
 611   char *zErrMsg;
 612   char *name = "testsqlite.db";
 613   sqlite3 *db=NULL;
 614   unlink(name);
 615   int rc = sqlite3_open(name, &db);
 616   if( rc ){
 617     printf("error: sqlite open of %s failed: %s\n", name, sqlite3_errmsg(db));
 618     sqlite3_close(db);
 619     return -1;
 620   }
 621
 622   /* create tables */
 623   rc = sqlite3_exec(db,CREATE_TABLE_USERS, NULL,  0, &zErrMsg);
 624   if( rc != SQLITE_OK ){
 625     printf("error: sqlite table create failed: %s\n", zErrMsg);
 626     sqlite3_close(db);
 627     return -1;
 628   }
 629   printf("info: sqlite worked\n");
 630   sqlite3_close(db);
 631   return 0;
 632 }
 633 #endif /* TEST_SQLITE */
 634
 635 /*
 636  * Demonstrate locking issue found in gcompris using sqlite3.  This
 637  * work with ext3, but not with cifs server on Windows 2003.  This is
 638  * done in the sqlite3 library.
 639  * See also
 640  * &lt;URL:http://www.cygwin.com/ml/cygwin/2001-08/msg00854.html> and the
 641  * POSIX specification
 642  * &lt;URL:http://www.opengroup.org/onlinepubs/009695399/functions/fcntl.html>.
 643  */
 644 int test_gcompris_locking(void) {
 645   struct flock fl;
 646   char *name = "testsqlite.db";
 647   unlink(name);
 648   int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, 0644);
 649   printf("info: testing fcntl locking\n");
 650
 651   fl.l_whence = SEEK_SET;
 652   fl.l_pid    = getpid();
 653   printf("  Read-locking 1 byte from 1073741824");
 654   fl.l_start  = 1073741824;
 655   fl.l_len    = 1;
 656   fl.l_type   = F_RDLCK;
 657   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 658
 659   printf("  Read-locking 510 byte from 1073741826");
 660   fl.l_start  = 1073741826;
 661   fl.l_len    = 510;
 662   fl.l_type   = F_RDLCK;
 663   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 664
 665   printf("  Unlocking 1 byte from 1073741824");
 666   fl.l_start  = 1073741824;
 667   fl.l_len    = 1;
 668   fl.l_type   = F_UNLCK;
 669   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 670
 671   printf("  Write-locking 1 byte from 1073741824");
 672   fl.l_start  = 1073741824;
 673   fl.l_len    = 1;
 674   fl.l_type   = F_WRLCK;
 675   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 676
 677   printf("  Write-locking 510 byte from 1073741826");
 678   fl.l_start  = 1073741826;
 679   fl.l_len    = 510;
 680   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 681
 682   printf("  Unlocking 2 byte from 1073741824");
 683   fl.l_start  = 1073741824;
 684   fl.l_len    = 2;
 685   fl.l_type   = F_UNLCK;
 686   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 687
 688   close(fd);
 689   return 0;
 690 }
 691
 692 /*
 693  * Test if permissions of freshly created directories allow entries
 694  * below them.  This was a problem with OpenOffice.org and gcompris.
 695  * Mounting with option 'sync' seem to solve this problem while
 696  * slowing down file operations.
 697  */
 698 int test_subdirectory_creation(void) {
 699 #define LEVELS 5
 700   char *path = strdup("test");
 701   char *dirs[LEVELS];
 702   int level;
 703   printf("info: testing subdirectory creation\n");
 704   for (level = 0; level &lt; LEVELS; level++) {
 705     char *newpath = NULL;
 706     if (-1 == mkdir(path, 0777)) {
 707       printf("  error: Unable to create directory '%s': %s\n",
 708              path, strerror(errno));
 709       break;
 710     }
 711     asprintf(&newpath, "%s/%s", path, "test");
 712     free(path);
 713     path = newpath;
 714   }
 715   return 0;
 716 }
 717
 718 /*
 719  * Test if symlinks can be created.  This was a problem detected with
 720  * KDE.
 721  */
 722 int test_symlinks(void) {
 723   printf("info: testing symlink creation\n");
 724   unlink("symlink");
 725   if (-1 == symlink("file", "symlink"))
 726     printf("  error: Unable to create symlink\n");
 727   return 0;
 728 }
 729
 730 int main(int argc, char **argv) {
 731   printf("Testing POSIX/Unix sematics on file system\n");
 732   test_symlinks();
 733   test_subdirectory_creation();
 734 #ifdef TEST_SQLITE
 735   test_sqlite_open();
 736 #endif /* TEST_SQLITE */
 737   test_gcompris_locking();
 738   return 0;
 739 }
 740 </pre>
 741
 742 <p>When everything is working, it should print something like
 743 this:</p>
 744
 745 <pre>
 746 Testing POSIX/Unix sematics on file system
 747 info: testing symlink creation
 748 info: testing subdirectory creation
 749 info: sqlite worked
 750 info: testing fcntl locking
 751   Read-locking 1 byte from 1073741824
 752   Read-locking 510 byte from 1073741826
 753   Unlocking 1 byte from 1073741824
 754   Write-locking 1 byte from 1073741824
 755   Write-locking 510 byte from 1073741826
 756   Unlocking 2 byte from 1073741824
 757 </pre>
 758
 759 <p>I do not remember the exact details of the problems we saw, but one
 760 of them was with locking, where if I remember correctly, POSIX allow a
 761 read-only lock to be upgraded to a read-write lock without unlocking
 762 the read-only lock (while Windows do not).  Another was a bug in the
 763 CIFS/SMB client implementation in the Linux kernel where directory
 764 meta information would be wrong for a fraction of a second, making
 765 OpenOffice.org fail to create its deep directory tree because it was
 766 not allowed to create files in its freshly created directory.</p>
 767
 768 <p>Anyway, here is a nice tool for your tool box, might you never need
 769 it. :)</p>
 770
 771 <p>Update 2010-08-27: Michael Gebetsroither report that he found the
 772 script so useful that he created a GIT repository and stored it in
 773 <a href="http://github.com/gebi/fs-test">http://github.com/gebi/fs-test</a>.</p>
 774 </div>
 775   <div class="tags">
 776
 777
 778
 779    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 780
 781   </div>
 782  </div>
 783  <div class="padding"></div>
 784
 785  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
 786
 787 <div id="sidebar">
 788
 789
 790
 791
 792
 793 <h2>Archive</h2>
 794 <ul>
 795
 796 <li>2010
 797 <ul>
 798
 799 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 800
 801 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 802
 803 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 804
 805 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 806
 807 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 808
 809 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 810
 811 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
 812
 813 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (12)</a></li>
 814
 815 </ul></li>
 816
 817 <li>2009
 818 <ul>
 819
 820 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 821
 822 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 823
 824 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 825
 826 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 827
 828 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 829
 830 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 831
 832 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 833
 834 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 835
 836 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 837
 838 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 839
 840 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 841
 842 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 843
 844 </ul></li>
 845
 846 <li>2008
 847 <ul>
 848
 849 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 850
 851 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 852
 853 </ul></li>
 854
 855 </ul>
 856
 857
 858
 859 <h2>Tags</h2>
 860 <ul>
 861
 862  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 863
 864  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 865
 866  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 867
 868  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
 869
 870  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (35)</a></li>
 871
 872  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (43)</a></li>
 873
 874  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (58)</a></li>
 875
 876  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 877
 878  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (8)</a></li>
 879
 880  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (3)</a></li>
 881
 882  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
 883
 884  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (2)</a></li>
 885
 886  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 887
 888  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 889
 890  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (76)</a></li>
 891
 892  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (99)</a></li>
 893
 894  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (14)</a></li>
 895
 896  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (16)</a></li>
 897
 898  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 899
 900  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (2)</a></li>
 901
 902  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 903
 904  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (13)</a></li>
 905
 906  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
 907
 908  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
 909
 910  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 911
 912  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 913
 914  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 915
 916  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (7)</a></li>
 917
 918 </ul>
 919
 920 </div>
 921
 922 <p style="text-align: right">
 923 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
 924 </p>
 925 </body>
 926 </html>