blog/data/2010-08-07-edu-autoconf.txt

   1 Title: Autodetecting Client setup for roaming workstations in Debian Edu
   2 Tags: english, nuug, debian edu
   3 Date: 2010-08-07 14:45
   4
   5 <p>A few days ago, I
   6 <a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">tried
   7 to install</a> a Roaming workation profile from Debian Edu/Squeeze
   8 while on the university network here at the University of Oslo, and
   9 noticed how much had to change to get it operational using the
  10 university infrastructure.  It was fairly easy, but it occured to me
  11 that Debian Edu would improve a lot if I could get the client to
  12 connect without any changes at all, and thus let the client configure
  13 itself during installation and first boot to use the infrastructure
  14 around it.  Now I am a huge step further along that road.</p>
  15
  16 <p>With our current squeeze-test packages, I can select the roaming
  17 workstation profile and get a working laptop connecting to the
  18 university LDAP server for user and group and our active directory
  19 servers for Kerberos authentication.  All this without any
  20 configuration at all during installation.  My users home directory got
  21 a bookmark in the KDE menu to mount it via SMB, with the correct URL.
  22 In short, openldap and sssd is correctly configured.  In addition to
  23 this, the client look for http://wpad/wpad.dat to configure a web
  24 proxy, and when it fail to find it no proxy settings are stored in
  25 /etc/environment and /etc/apt/apt.conf.  Iceweasel and KDE is
  26 configured to look for the same wpad configuration and also do not use
  27 a proxy when at the university network.  If the machine is moved to a
  28 network with such wpad setup, it would automatically use it when DHCP
  29 gave it a IP address.</p>
  30
  31 <p>The LDAP server is located using DNS, by first looking for the DNS
  32 entry ldap.$domain.  If this do not exist, it look for the
  33 _ldap._tcp.$domain SRV records and use the first one as the LDAP
  34 server.  Next, it connects to the LDAP server and search all
  35 namingContexts entries for posixAccount or posixGroup objects, and
  36 pick the first one as the LDAP base.  For Kerberos, a similar
  37 algorithm is used to locate the LDAP server, and the realm is the
  38 uppercase version of $domain.</p>
  39
  40 <p>So, what is not working, you might ask.  SMB mounting my home
  41 directory do not work.  No idea why, but suspected the incorrect
  42 Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
  43 the cause.  These are not properly configured during installation, and
  44 had to be hand-edited to get the correct Kerberos realm and server,
  45 but SMB mounting still do not work. :(</p>
  46
  47 <p>With this automatic configuration in place, I expect a Debian Edu
  48 roaming profile installation would be able to automatically detect and
  49 connect to any site using LDAP and Kerberos for NSS directory and PAM
  50 authentication.  It should also work out of the box in a Active
  51 Directory environment providing posixAccount and posixGroup objects
  52 with UID and GID values.</p>
  53
  54 <p>If you want to help out with implementing these things for Debian
  55 Edu, please contact us on debian-edu@lists.debian.org.</p>