]> pere.pagekite.me Git - homepage.git/blob - blog/tags/ldap/index.html
projects / homepage.git / blob
? search:


1ad594d808af9e29fc22de8c1726d2c208c08cf7
[homepage.git] / blog / tags / ldap / index.html
1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
2 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
3 <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
4 <head>
5 <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
6 <title>Petter Reinholdtsen: Entries Tagged ldap</title>
7 <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css" />
8 <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/vim.css" />
9 <link rel="alternate" title="RSS Feed" href="ldap.rss" type="application/rss+xml" />
10 </head>
11 <body>
12 <div class="title">
13 <h1>
14 <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
15
16 </h1>
17
18 </div>
19
20
21 <h3>Entries tagged "ldap".</h3>
22
23 <div class="entry">
24 <div class="title">
25 <a href="http://people.skolelinux.org/pere/blog/How_to_add_extra_storage_servers_in_Debian_Edu___Skolelinux.html">How to add extra storage servers in Debian Edu / Skolelinux</a>
26 </div>
27 <div class="date">
28 12th March 2014
29 </div>
30 <div class="body">
31 <p>On larger sites, it is useful to use a dedicated storage server for
32 storing user home directories and data. The design for handling this
33 in <a href="http://www.skolelinux.org/">Debian Edu / Skolelinux</a>, is
34 to update the automount rules in LDAP and let the automount daemon on
35 the clients take care of the rest. I was reminded about the need to
36 document this better when one of the customers of
37 <a href="http://www.slxdrift.no/">Skolelinux Drift AS</a>, where I am
38 on the board of directors, asked about how to do this. The steps to
39 get this working are the following:</p>
40
41 <p><ol>
42
43 <li>Add new storage server in DNS. I use nas-server.intern as the
44 example host here.</li>
45
46 <li>Add automoun LDAP information about this server in LDAP, to allow
47 all clients to automatically mount it on reqeust.</li>
48
49 <li>Add the relevant entries in tjener.intern:/etc/fstab, because
50 tjener.intern do not use automount to avoid mounting loops.</li>
51
52 </ol></p>
53
54 <p>DNS entries are added in GOsa², and not described here. Follow the
55 <a href="https://wiki.debian.org/DebianEdu/Documentation/Wheezy/GettingStarted">instructions
56 in the manual</a> (Machine Management with GOsa² in section Getting
57 started).</p>
58
59 <p>Ensure that the NFS export points on the server are exported to the
60 relevant subnets or machines:</p>
61
62 <p><blockquote><pre>
63 root@tjener:~# showmount -e nas-server
64 Export list for nas-server:
65 /storage 10.0.0.0/8
66 root@tjener:~#
67 </pre></blockquote></p>
68
69 <p>Here everything on the backbone network is granted access to the
70 /storage export. With NFSv3 it is slightly better to limit it to
71 netgroup membership or single IP addresses to have some limits on the
72 NFS access.</p>
73
74 <p>The next step is to update LDAP. This can not be done using GOsa²,
75 because it lack a module for automount. Instead, use ldapvi and add
76 the required LDAP objects using an editor.</p>
77
78 <p><blockquote><pre>
79 ldapvi --ldap-conf -ZD '(cn=admin)' -b ou=automount,dc=skole,dc=skolelinux,dc=no
80 </pre></blockquote></p>
81
82 <p>When the editor show up, add the following LDAP objects at the
83 bottom of the document. The "/&" part in the last LDAP object is a
84 wild card matching everything the nas-server exports, removing the
85 need to list individual mount points in LDAP.</p>
86
87 <p><blockquote><pre>
88 add cn=nas-server,ou=auto.skole,ou=automount,dc=skole,dc=skolelinux,dc=no
89 objectClass: automount
90 cn: nas-server
91 automountInformation: -fstype=autofs --timeout=60 ldap:ou=auto.nas-server,ou=automount,dc=skole,dc=skolelinux,dc=no
92
93 add ou=auto.nas-server,ou=automount,dc=skole,dc=skolelinux,dc=no
94 objectClass: top
95 objectClass: automountMap
96 ou: auto.nas-server
97
98 add cn=/,ou=auto.nas-server,ou=automount,dc=skole,dc=skolelinux,dc=no
99 objectClass: automount
100 cn: /
101 automountInformation: -fstype=nfs,tcp,rsize=32768,wsize=32768,rw,intr,hard,nodev,nosuid,noatime nas-server.intern:/&
102 </pre></blockquote></p>
103
104 <p>The last step to remember is to mount the relevant mount points in
105 tjener.intern by adding them to /etc/fstab, creating the mount
106 directories using mkdir and running "mount -a" to mount them.</p>
107
108 <p>When this is done, your users should be able to access the files on
109 the storage server directly by just visiting the
110 /tjener/nas-server/storage/ directory using any application on any
111 workstation, LTSP client or LTSP server.</p>
112
113 </div>
114 <div class="tags">
115
116
117 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>.
118
119
120 </div>
121 </div>
122 <div class="padding"></div>
123
124 <div class="entry">
125 <div class="title">
126 <a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a>
127 </div>
128 <div class="date">
129 17th July 2010
130 </div>
131 <div class="body">
132 <p>This is a
133 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
134 on my
135 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
136 work</a> on
137 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
138 all</a> the computer related LDAP objects in Debian Edu.</p>
139
140 <p>As a step to try to see if it possible to merge the DNS and DHCP
141 LDAP objects, I have had a look at how the packages pdns-backend-ldap
142 and dhcp3-server-ldap in Debian use the LDAP server. The two
143 implementations are quite different in how they use LDAP.</p>
144
145 To get this information, I started slapd with debugging enabled and
146 dumped the debug output to a file to get the LDAP searches performed
147 on a Debian Edu main-server. Here is a summary.
148
149 <p><strong>powerdns</strong></p>
150
151 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
152 on how to</a> set up PowerDNS to use a LDAP backend is available on
153 the web.
154
155 <p>PowerDNS have two modes of operation using LDAP as its backend.
156 One "strict" mode where the forward and reverse DNS lookups are done
157 using the same LDAP objects, and a "tree" mode where the forward and
158 reverse entries are in two different subtrees in LDAP with a structure
159 based on the DNS names, as in tjener.intern and
160 2.2.0.10.in-addr.arpa.</p>
161
162 <p>In tree mode, the server is set up to use a LDAP subtree as its
163 base, and uses a "base" scoped search for the DNS name by adding
164 "dc=tjener,dc=intern," to the base with a filter for
165 "(associateddomain=tjener.intern)" for the forward entry and
166 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
167 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry. For
168 forward entries, it is looking for attributes named dnsttl, arecord,
169 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
170 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
171 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
172 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
173 spfrecord and modifytimestamp. For reverse entries it is looking for
174 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
175 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
176 locrecord, srvrecord, naptrrecord and modifytimestamp. The equivalent
177 ldapsearch commands could look like this:</p>
178
179 <blockquote><pre>
180 ldapsearch -h ldap \
181 -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
182 -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
183 cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
184 rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
185 nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
186 rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
187
188 ldapsearch -h ldap \
189 -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
190 -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
191 dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
192 hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
193 srvrecord naptrrecord modifytimestamp
194 </pre></blockquote>
195
196 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
197 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
198 example LDAP objects used there. In addition to these objects, the
199 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
200 also exist.</p>
201
202 <blockquote><pre>
203 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
204 objectclass: top
205 objectclass: dnsdomain
206 objectclass: domainrelatedobject
207 dc: tjener
208 arecord: 10.0.2.2
209 associateddomain: tjener.intern
210
211 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
212 objectclass: top
213 objectclass: dnsdomain2
214 objectclass: domainrelatedobject
215 dc: 2
216 ptrrecord: tjener.intern
217 associateddomain: 2.2.0.10.in-addr.arpa
218 </pre></blockquote>
219
220 <p>In strict mode, the server behaves differently. When looking for
221 forward DNS entries, it is doing a "subtree" scoped search with the
222 same base as in the tree mode for a object with filter
223 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
224 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
225 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
226 naptrrecord and modifytimestamp. For reverse entires it also do a
227 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
228 and the requested attributes are associateddomain, dnsttl and
229 modifytimestamp. In short, in strict mode the objects with ptrrecord
230 go away, and the arecord attribute in the forward object is used
231 instead.</p>
232
233 <p>The forward and reverse searches can be simulated using ldapsearch
234 like this:</p>
235
236 <blockquote><pre>
237 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
238 '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
239 cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
240 rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
241 nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
242 rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
243
244 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
245 '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
246 </pre></blockquote>
247
248 <p>In addition to the forward and reverse searches , there is also a
249 search for SOA records, which behave similar to the forward and
250 reverse lookups.</p>
251
252 <p>A thing to note with the PowerDNS behaviour is that it do not
253 specify any objectclass names, and instead look for the attributes it
254 need to generate a DNS reply. This make it able to work with any
255 objectclass that provide the needed attributes.</p>
256
257 <p>The attributes are normally provided in the cosine (RFC 1274) and
258 dnsdomain2 schemas. The latter is used for reverse entries like
259 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
260
261 <p>In Debian Edu, we have created DNS objects using the object classes
262 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
263 attributes) and domainrelatedobject (for associatedDomain). The use
264 of structural object classes make it impossible to combine these
265 classes with the object classes used by DHCP.</p>
266
267 <p>There are other schemas that could be used too, for example the
268 dnszone structural object class used by Gosa and bind-sdb for the DNS
269 attributes combined with the domainrelatedobject object class, but in
270 this case some unused attributes would have to be included as well
271 (zonename and relativedomainname).</p>
272
273 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
274 mode and not use any of the existing objectclasses (dnsdomain,
275 dnsdomain2 and dnszone) when one want to combine the DNS information
276 with DHCP information, and instead create a auxiliary object class
277 defined something like this (using the attributes defined for
278 dnsdomain and dnsdomain2 or dnszone):</p>
279
280 <blockquote><pre>
281 objectclass ( some-oid NAME 'dnsDomainAux'
282 SUP top
283 AUXILIARY
284 MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
285 DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
286 TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
287 NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
288 A6Record $ DNAMERecord
289 ))
290 </pre></blockquote>
291
292 <p>This will allow any object to become a DNS entry when combined with
293 the domainrelatedobject object class, and allow any entity to include
294 all the attributes PowerDNS wants. I've sent an email to the PowerDNS
295 developers asking for their view on this schema and if they are
296 interested in providing such schema with PowerDNS, and I hope my
297 message will be accepted into their mailing list soon.</p>
298
299 <p><strong>ISC dhcp</strong></p>
300
301 <p>The DHCP server searches for specific objectclass and requests all
302 the object attributes, and then uses the attributes it want. This
303 make it harder to figure out exactly what attributes are used, but
304 thanks to the working example in Debian Edu I can at least get an idea
305 what is needed without having to read the source code.</p>
306
307 <p>In the DHCP server configuration, the LDAP base to use and the
308 search filter to use to locate the correct dhcpServer entity is
309 stored. These are the relevant entries from
310 /etc/dhcp3/dhcpd.conf:</p>
311
312 <blockquote><pre>
313 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
314 ldap-dhcp-server-cn "dhcp";
315 </pre></blockquote>
316
317 <p>The DHCP server uses this information to nest all the DHCP
318 configuration it need. The cn "dhcp" is located using the given LDAP
319 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))". The
320 search result is this entry:</p>
321
322 <blockquote><pre>
323 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
324 cn: dhcp
325 objectClass: top
326 objectClass: dhcpServer
327 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
328 </pre></blockquote>
329
330 <p>The content of the dhcpServiceDN attribute is next used to locate the
331 subtree with DHCP configuration. The DHCP configuration subtree base
332 is located using a base scope search with base "cn=DHCP
333 Config,dc=skole,dc=skolelinux,dc=no" and filter
334 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
335 The search result is this entry:</p>
336
337 <blockquote><pre>
338 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
339 cn: DHCP Config
340 objectClass: top
341 objectClass: dhcpService
342 objectClass: dhcpOptions
343 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
344 dhcpStatements: ddns-update-style none
345 dhcpStatements: authoritative
346 dhcpOption: smtp-server code 69 = array of ip-address
347 dhcpOption: www-server code 72 = array of ip-address
348 dhcpOption: wpad-url code 252 = text
349 </pre></blockquote>
350
351 <p>Next, the entire subtree is processed, one level at the time. When
352 all the DHCP configuration is loaded, it is ready to receive requests.
353 The subtree in Debian Edu contain objects with object classes
354 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
355 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost. These provide options
356 and information about netmasks, dynamic range etc. Leaving out the
357 details here because it is not relevant for the focus of my
358 investigation, which is to see if it is possible to merge dns and dhcp
359 related computer objects.</p>
360
361 <p>When a DHCP request come in, LDAP is searched for the MAC address
362 of the client (00:00:00:00:00:00 in this example), using a subtree
363 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
364 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
365 00:00:00:00:00:00))" as the filter. This is what a host object look
366 like:</p>
367
368 <blockquote><pre>
369 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
370 cn: hostname
371 objectClass: top
372 objectClass: dhcpHost
373 dhcpHWAddress: ethernet 00:00:00:00:00:00
374 dhcpStatements: fixed-address hostname
375 </pre></blockquote>
376
377 <p>There is less flexiblity in the way LDAP searches are done here.
378 The object classes need to have fixed names, and the configuration
379 need to be stored in a fairly specific LDAP structure. On the
380 positive side, the invidiual dhcpHost entires can be anywhere without
381 the DN pointed to by the dhcpServer entries. The latter should make
382 it possible to group all host entries in a subtree next to the
383 configuration entries, and this subtree can also be shared with the
384 DNS server if the schema proposed above is combined with the dhcpHost
385 structural object class.
386
387 <p><strong>Conclusion</strong></p>
388
389 <p>The PowerDNS implementation seem to be very flexible when it come
390 to which LDAP schemas to use. While its "tree" mode is rigid when it
391 come to the the LDAP structure, the "strict" mode is very flexible,
392 allowing DNS objects to be stored anywhere under the base cn specified
393 in the configuration.</p>
394
395 <p>The DHCP implementation on the other hand is very inflexible, both
396 regarding which LDAP schemas to use and which LDAP structure to use.
397 I guess one could implement ones own schema, as long as the
398 objectclasses and attributes have the names used, but this do not
399 really help when the DHCP subtree need to have a fairly fixed
400 structure.</p>
401
402 <p>Based on the observed behaviour, I suspect a LDAP structure like
403 this might work for Debian Edu:</p>
404
405 <blockquote><pre>
406 ou=services
407 cn=machine-info (dhcpService) - dhcpServiceDN points here
408 cn=dhcp (dhcpServer)
409 cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
410 cn=10.0.2.0 (dhcpSubnet)
411 cn=group1 (dhcpGroup/dhcpOptions)
412 cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
413 cn=192.168.0.0 (dhcpSubnet)
414 cn=group1 (dhcpGroup/dhcpOptions)
415 ou=machines - PowerDNS base points here
416 cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
417 </pre></blockquote>
418
419 <P>This is not tested yet. If the DHCP server require the dhcpHost
420 entries to be in the dhcpGroup subtrees, the entries can be stored
421 there instead of a common machines subtree, and the PowerDNS base
422 would have to be moved one level up to the machine-info subtree.</p>
423
424 <p>The combined object under the machines subtree would look something
425 like this:</p>
426
427 <blockquote><pre>
428 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
429 dc: hostname
430 objectClass: top
431 objectClass: dhcpHost
432 objectclass: domainrelatedobject
433 objectclass: dnsDomainAux
434 associateddomain: hostname.intern
435 arecord: 10.11.12.13
436 dhcpHWAddress: ethernet 00:00:00:00:00:00
437 dhcpStatements: fixed-address hostname.intern
438 </pre></blockquote>
439
440 </p>One could even add the LTSP configuration associated with a given
441 machine, as long as the required attributes are available in a
442 auxiliary object class.</p>
443
444 </div>
445 <div class="tags">
446
447
448 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
449
450
451 </div>
452 </div>
453 <div class="padding"></div>
454
455 <div class="entry">
456 <div class="title">
457 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a>
458 </div>
459 <div class="date">
460 14th July 2010
461 </div>
462 <div class="body">
463 <p>For a while now, I have wanted to find a way to change the DNS and
464 DHCP services in Debian Edu to use the same LDAP objects for a given
465 computer, to avoid the possibility of having a inconsistent state for
466 a computer in LDAP (as in DHCP but no DNS entry or the other way
467 around) and make it easier to add computers to LDAP.</p>
468
469 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
470 information finally found a solution that seem to work.</p>
471
472 <p>The old setup required three LDAP objects for a given computer.
473 One forward DNS entry, one reverse DNS entry and one DHCP entry. If
474 we switch powerdns to use its strict LDAP method (ldap-method=strict
475 in pdns-debian-edu.conf), the forward and reverse DNS entries are
476 merged into one while making it impossible to transfer the reverse map
477 to a slave DNS server.</p>
478
479 <p>If we also replace the object class used to get the DNS related
480 attributes to one allowing these attributes to be combined with the
481 dhcphost object class, we can merge the DNS and DHCP entries into one.
482 I've written such object class in the dnsdomainaux.schema file (need
483 proper OIDs, but that is a minor issue), and tested the setup. It
484 seem to work.</p>
485
486 <p>With this test setup in place, we can get away with one LDAP object
487 for both DNS and DHCP, and even the LTSP configuration I suggested in
488 an earlier email. The combined LDAP object will look something like
489 this:</p>
490
491 <blockquote><pre>
492 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
493 cn: hostname
494 objectClass: dhcphost
495 objectclass: domainrelatedobject
496 objectclass: dnsdomainaux
497 associateddomain: hostname.intern
498 arecord: 10.11.12.13
499 dhcphwaddress: ethernet 00:00:00:00:00:00
500 dhcpstatements: fixed-address hostname
501 ldapconfigsound: Y
502 </pre></blockquote>
503
504 <p>The DNS server uses the associateddomain and arecord entries, while
505 the DHCP server uses the dhcphwaddress and dhcpstatements entries
506 before asking DNS to resolve the fixed-adddress. LTSP will use
507 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
508
509 <p>I am not yet sure if I can get the DHCP server to look for its
510 dhcphost in a different location, to allow us to put the objects
511 outside the "DHCP Config" subtree, but hope to figure out a way to do
512 that. If I can't figure out a way to do that, we can still get rid of
513 the hosts subtree and move all its content into the DHCP Config tree
514 (which probably should be renamed to be more related to the new
515 content. I suspect cn=dnsdhcp,ou=services or something like that
516 might be a good place to put it.</p>
517
518 <p>If you want to help out with implementing this for Debian Edu,
519 please contact us on debian-edu@lists.debian.org.</p>
520
521 </div>
522 <div class="tags">
523
524
525 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
526
527
528 </div>
529 </div>
530 <div class="padding"></div>
531
532 <div class="entry">
533 <div class="title">
534 <a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a>
535 </div>
536 <div class="date">
537 11th July 2010
538 </div>
539 <div class="body">
540 <p>Vagrant mentioned on IRC today that ltsp_config now support
541 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
542 clients, and that this can be used to fetch configuration from LDAP if
543 Debian Edu choose to store configuration there.</p>
544
545 <p>Armed with this information, I got inspired and wrote a test module
546 to get configuration from LDAP. The idea is to look up the MAC
547 address of the client in LDAP, and look for attributes on the form
548 ltspconfigsetting=value, and use this to export SETTING=value to the
549 LTSP clients.</p>
550
551 <p>The goal is to be able to store the LTSP configuration attributes
552 in a "computer" LDAP object used by both DNS and DHCP, and thus
553 allowing us to store all information about a computer in one place.</p>
554
555 <p>This is a untested draft implementation, and I welcome feedback on
556 this approach. A real LDAP schema for the ltspClientAux objectclass
557 need to be written. Comments, suggestions, etc?</p>
558
559 <blockquote><pre>
560 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
561 #
562 # Fetch LTSP client settings from LDAP based on MAC address
563 #
564 # Uses ethernet address as stored in the dhcpHost objectclass using
565 # the dhcpHWAddress attribute or ethernet address stored in the
566 # ieee802Device objectclass with the macAddress attribute.
567 #
568 # This module is written to be schema agnostic, and only depend on the
569 # existence of attribute names.
570 #
571 # The LTSP configuration variables are saved directly using a
572 # ltspConfig prefix and uppercasing the rest of the attribute name.
573 # To set the SERVER variable, set the ltspConfigServer attribute.
574 #
575 # Some LDAP schema should be created with all the relevant
576 # configuration settings. Something like this should work:
577 #
578 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
579 # SUP top
580 # AUXILIARY
581 # MAY ( ltspConfigServer $ ltsConfigSound $ ... )
582
583 LDAPSERVER=$(debian-edu-ldapserver)
584 if [ "$LDAPSERVER" ] ; then
585 LDAPBASE=$(debian-edu-ldapserver -b)
586 for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
587 filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
588 ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
589 grep '^ltspConfig' | while read attr value ; do
590 # Remove prefix and convert to upper case
591 attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
592 # bass value on to clients
593 eval "$attr=$value; export $attr"
594 done
595 done
596 fi
597 </pre></blockquote>
598
599 <p>I'm not sure this shell construction will work, because I suspect
600 the while block might end up in a subshell causing the variables set
601 there to not show up in ltsp-config, but if that is the case I am sure
602 the code can be restructured to make sure the variables are passed on.
603 I expect that can be solved with some testing. :)</p>
604
605 <p>If you want to help out with implementing this for Debian Edu,
606 please contact us on debian-edu@lists.debian.org.</p>
607
608 <p>Update 2010-07-17: I am aware of another effort to store LTSP
609 configuration in LDAP that was created around year 2000 by
610 <a href="http://www.pcxperience.com/thinclient/documentation/ldap.html">PC
611 Xperience, Inc., 2000</a>. I found its
612 <a href="http://people.redhat.com/alikins/ltsp/ldap/">files</a> on a
613 personal home page over at redhat.com.</p>
614
615 </div>
616 <div class="tags">
617
618
619 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
620
621
622 </div>
623 </div>
624 <div class="padding"></div>
625
626 <div class="entry">
627 <div class="title">
628 <a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a>
629 </div>
630 <div class="date">
631 9th July 2010
632 </div>
633 <div class="body">
634 <p>Since
635 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
636 last post</a> about available LDAP tools in Debian, I was told about a
637 LDAP GUI that is even better than luma. The java application
638 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
639 moving LDAP objects and subtrees using drag-and-drop, and can
640 authenticate using Kerberos. I have only tested the Kerberos
641 authentication, but do not have a LDAP setup allowing me to rewrite
642 LDAP with my test user yet. It is
643 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
644 Debian</a> testing and unstable at the moment. The only problem I
645 have with it is how it handle errors. If something go wrong, its
646 non-intuitive behaviour require me to go through some query work list
647 and remove the failing query. Nothing big, but very annoying.</p>
648
649 </div>
650 <div class="tags">
651
652
653 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
654
655
656 </div>
657 </div>
658 <div class="padding"></div>
659
660 <div class="entry">
661 <div class="title">
662 <a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a>
663 </div>
664 <div class="date">
665 1st July 2010
666 </div>
667 <div class="body">
668 <p>For a laptop, centralized user directories and password checking is
669 a bit troubling. Laptops are typically used also when not connected
670 to the network, and it is vital for a user to be able to log in or
671 unlock the screen saver also when a central server is unavailable.
672 This is possible by caching passwords and directory information (user
673 and group attributes) locally, and the packages to do so are available
674 in Debian. Here follow two recipes to set this up in Debian/Squeeze.
675 It is also possible to set up in Debian/Lenny, but require more manual
676 setup there because pam-auth-update is missing in Lenny.</p>
677
678 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
679
680 This is the traditional method with a twist. The password caching is
681 provided by libpam-ccreds (version 10-4 or later is needed on
682 Squeeze), and the directory caching is done by nscd. The directory
683 lookup and password checking is done using LDAP. If one want to use
684 Kerberos for password checking the libpam-ldapd package can be
685 replaced with libpam-krb5 or libpam-heimdal. If one is happy having a
686 local home directory with the path listed in LDAP, one can use the
687 pam_mkhomedir module from pam-modules to make this happen instead of
688 using libpam-mklocaluser. A setup for pam-auth-update to enable
689 pam_mkhomedir will have to be written until a fix for
690 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
691 archive. Because I believe it is a bad idea to have local home
692 directories using misleading paths like /site/server/partition/, I
693 prefer to create a local user with the home directory in /home/. This
694 is done using the libpam-mklocaluser package.</p>
695
696 <p>These packages need to be installed and configured</p>
697
698 <blockquote><pre>
699 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
700 </pre></blockquote>
701
702 <p>The ldapd packages will ask for LDAP connection information, and
703 one have to fill in the values that fits ones own site. Make sure the
704 PAM part uses encrypted connections, to make sure the password is not
705 sent in clear text to the LDAP server. I've been unable to get TLS
706 certificate checking for a self signed certificate working, which make
707 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
708 is talking to the correct LDAP server), and very much welcome feedback
709 on how to get this working.</p>
710
711 <p>Because nscd do not have a default configuration fit for offline
712 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
713 is fixed, this configuration should be used instead of the one
714 currently in /etc/nscd.conf. The changes are in the fields
715 reload-count and positive-time-to-live, and is based on the
716 instructions I found in the
717 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
718 instructions by Flyn Computing.</p>
719
720 <blockquote><pre>
721 debug-level 0
722 reload-count unlimited
723 paranoia no
724
725 enable-cache passwd yes
726 positive-time-to-live passwd 2592000
727 negative-time-to-live passwd 20
728 suggested-size passwd 211
729 check-files passwd yes
730 persistent passwd yes
731 shared passwd yes
732 max-db-size passwd 33554432
733 auto-propagate passwd yes
734
735 enable-cache group yes
736 positive-time-to-live group 2592000
737 negative-time-to-live group 20
738 suggested-size group 211
739 check-files group yes
740 persistent group yes
741 shared group yes
742 max-db-size group 33554432
743 auto-propagate group yes
744
745 enable-cache hosts no
746 positive-time-to-live hosts 2592000
747 negative-time-to-live hosts 20
748 suggested-size hosts 211
749 check-files hosts yes
750 persistent hosts yes
751 shared hosts yes
752 max-db-size hosts 33554432
753
754 enable-cache services yes
755 positive-time-to-live services 2592000
756 negative-time-to-live services 20
757 suggested-size services 211
758 check-files services yes
759 persistent services yes
760 shared services yes
761 max-db-size services 33554432
762 </pre></blockquote>
763
764 <p>While we wait for a mechanism to update /etc/nsswitch.conf
765 automatically like the one provided in
766 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
767 content need to be manually replaced to ensure LDAP is used as the
768 directory service on the machine. /etc/nsswitch.conf should normally
769 look like this:</p>
770
771 <blockquote><pre>
772 passwd: files ldap
773 group: files ldap
774 shadow: files ldap
775 hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
776 networks: files
777 protocols: files
778 services: files
779 ethers: files
780 rpc: files
781 netgroup: files ldap
782 </pre></blockquote>
783
784 <p>The important parts are that ldap is listed last for passwd, group,
785 shadow and netgroup.</p>
786
787 <p>With these changes in place, any user in LDAP will be able to log
788 in locally on the machine using for example kdm, get a local home
789 directory created and have the password as well as user and group
790 attributes cached.
791
792 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
793 libpam-mklocaluser/pam_mkhomedir</h2>
794
795 <p>Because nscd have had its share of problems, and seem to have
796 problems doing proper caching, I've seen suggestions and recipes to
797 use nss-updatedb to copy parts of the LDAP database locally when the
798 LDAP database is available. I have not tested such setup, because I
799 discovered sssd.</p>
800
801 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
802
803 <p>A more flexible and robust setup than the nscd combination
804 mentioned earlier that has shown up recently, is the
805 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
806 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
807 to provide a Active Directory like directory service for Linux
808 machines. The sssd system combines the caching of passwords and user
809 information into one package, and remove the need for nscd and
810 libpam-ccreds. It support LDAP and Kerberos, but not NIS. Version
811 1.2 do not support netgroups, but it is said that it will support this
812 in version 1.5 expected to show up later in 2010. Because the
813 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
814 was missing in Debian, I ended up co-maintaining it with Werner, and
815 version 1.2 is now in testing.
816
817 <p>These packages need to be installed and configured to get the
818 roaming setup I want</p>
819
820 <blockquote><pre>
821 libpam-sss libnss-sss libpam-mklocaluser
822 </pre></blockquote>
823
824 The complete setup of sssd is done by editing/creating
825 <tt>/etc/sssd/sssd.conf</tt>.
826
827 <blockquote><pre>
828 [sssd]
829 config_file_version = 2
830 reconnection_retries = 3
831 sbus_timeout = 30
832 services = nss, pam
833 domains = INTERN
834
835 [nss]
836 filter_groups = root
837 filter_users = root
838 reconnection_retries = 3
839
840 [pam]
841 reconnection_retries = 3
842
843 [domain/INTERN]
844 enumerate = false
845 cache_credentials = true
846
847 id_provider = ldap
848 auth_provider = ldap
849 chpass_provider = ldap
850
851 ldap_uri = ldap://ldap
852 ldap_search_base = dc=skole,dc=skolelinux,dc=no
853 ldap_tls_reqcert = never
854 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
855 </pre></blockquote>
856
857 <p>I got the same problem here with certificate checking. Had to set
858 "ldap_tls_reqcert = never" to get it working.</p>
859
860 <p>With the libnss-sss package in testing at the moment, the
861 nsswitch.conf file is update automatically, so there is no need to
862 modify it manually.</p>
863
864 <p>If you want to help out with implementing this for Debian Edu,
865 please contact us on debian-edu@lists.debian.org.</p>
866
867 </div>
868 <div class="tags">
869
870
871 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
872
873
874 </div>
875 </div>
876 <div class="padding"></div>
877
878 <div class="entry">
879 <div class="title">
880 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">LUMA, a very nice LDAP GUI</a>
881 </div>
882 <div class="date">
883 28th June 2010
884 </div>
885 <div class="body">
886 <p>The last few days I have been looking into the status of the LDAP
887 directory in Debian Edu, and in the process I started to miss a GUI
888 tool to browse the LDAP tree. The only one I was able to find in
889 Debian/Squeeze and Lenny is
890 <a href="http://luma.sourceforge.net/">LUMA</a>, which has proved to
891 be a great tool to get a overview of the current LDAP directory
892 populated by default in Skolelinux. Thanks to it, I have been able to
893 find empty and obsolete subtrees, misplaced objects and duplicate
894 objects. It will be installed by default in Debian/Squeeze. If you
895 are working with LDAP, give it a go. :)</p>
896
897 <p>I did notice one problem with it I have not had time to report to
898 the BTS yet. There is no .desktop file in the package, so the tool do
899 not show up in the Gnome and KDE menus, but only deep down in in the
900 Debian submenu in KDE. I hope that can be fixed before Squeeze is
901 released.</p>
902
903 <p>I have not yet been able to get it to modify the tree yet. I would
904 like to move objects and remove subtrees directly in the GUI, but have
905 not found a way to do that with LUMA yet. So in the mean time, I use
906 <a href="http://www.lichteblau.com/ldapvi/">ldapvi</a> for that.</p>
907
908 <p>If you have tips on other GUI tools for LDAP that might be useful
909 in Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
910
911 <p>Update 2010-06-29: Ross Reedstrom tipped us about the
912 <a href="http://packages.qa.debian.org/g/gq.html">gq</a> package as a
913 useful GUI alternative. It seem like a good tool, but is unmaintained
914 in Debian and got a RC bug keeping it out of Squeeze. Unless that
915 changes, it will not be an option for Debian Edu based on Squeeze.</p>
916
917 </div>
918 <div class="tags">
919
920
921 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
922
923
924 </div>
925 </div>
926 <div class="padding"></div>
927
928 <div class="entry">
929 <div class="title">
930 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">Idea for a change to LDAP schemas allowing DNS and DHCP info to be combined into one object</a>
931 </div>
932 <div class="date">
933 24th June 2010
934 </div>
935 <div class="body">
936 <p>A while back, I
937 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">complained
938 about the fact</a> that it is not possible with the provided schemas
939 for storing DNS and DHCP information in LDAP to combine the two sets
940 of information into one LDAP object representing a computer.</p>
941
942 <p>In the mean time, I discovered that a simple fix would be to make
943 the dhcpHost object class auxiliary, to allow it to be combined with
944 the dNSDomain object class, and thus forming one object for one
945 computer when storing both DHCP and DNS information in LDAP.</p>
946
947 <p>If I understand this correctly, it is not safe to do this change
948 without also changing the assigned number for the object class, and I
949 do not know enough about LDAP schema design to do that properly for
950 Debian Edu.</p>
951
952 <p>Anyway, for future reference, this is how I believe we could change
953 the
954 <a href="http://tools.ietf.org/html/draft-ietf-dhc-ldap-schema-00">DHCP
955 schema</a> to solve at least part of the problem with the LDAP schemas
956 available today from IETF.</p>
957
958 <pre>
959 --- dhcp.schema (revision 65192)
960 +++ dhcp.schema (working copy)
961 @@ -376,7 +376,7 @@
962 objectclass ( 2.16.840.1.113719.1.203.6.6
963 NAME 'dhcpHost'
964 DESC 'This represents information about a particular client'
965 - SUP top
966 + SUP top AUXILIARY
967 MUST cn
968 MAY (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
969 X-NDS_CONTAINMENT ('dhcpService' 'dhcpSubnet' 'dhcpGroup') )
970 </pre>
971
972 <p>I very much welcome clues on how to do this properly for Debian
973 Edu/Squeeze. We provide the DHCP schema in our debian-edu-config
974 package, and should thus be free to rewrite it as we see fit.</p>
975
976 <p>If you want to help out with implementing this for Debian Edu,
977 please contact us on debian-edu@lists.debian.org.</p>
978
979 </div>
980 <div class="tags">
981
982
983 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
984
985
986 </div>
987 </div>
988 <div class="padding"></div>
989
990 <div class="entry">
991 <div class="title">
992 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">Time for new LDAP schemas replacing RFC 2307?</a>
993 </div>
994 <div class="date">
995 29th March 2009
996 </div>
997 <div class="body">
998 <p>The state of standardized LDAP schemas on Linux is far from
999 optimal. There is RFC 2307 documenting one way to store NIS maps in
1000 LDAP, and a modified version of this normally called RFC 2307bis, with
1001 some modifications to be compatible with Active Directory. The RFC
1002 specification handle the content of a lot of system databases, but do
1003 not handle DNS zones and DHCP configuration.</p>
1004
1005 <p>In <a href="http://www.skolelinux.org/">Debian Edu/Skolelinux</a>,
1006 we would like to store information about users, SMB clients/hosts,
1007 filegroups, netgroups (users and hosts), DHCP and DNS configuration,
1008 and LTSP configuration in LDAP. These objects have a lot in common,
1009 but with the current LDAP schemas it is not possible to have one
1010 object per entity. For example, one need to have at least three LDAP
1011 objects for a given computer, one with the SMB related stuff, one with
1012 DNS information and another with DHCP information. The schemas
1013 provided for DNS and DHCP are impossible to combine into one LDAP
1014 object. In addition, it is impossible to implement quick queries for
1015 netgroup membership, because of the way NIS triples are implemented.
1016 It just do not scale. I believe it is time for a few RFC
1017 specifications to cleam up this mess.</p>
1018
1019 <p>I would like to have one LDAP object representing each computer in
1020 the network, and this object can then keep the SMB (ie host key), DHCP
1021 (mac address/name) and DNS (name/IP address) settings in one place.
1022 It need to be efficently stored to make sure it scale well.</p>
1023
1024 <p>I would also like to have a quick way to map from a user or
1025 computer and to the net group this user or computer is a member.</p>
1026
1027 <p>Active Directory have done a better job than unix heads like myself
1028 in this regard, and the unix side need to catch up. Time to start a
1029 new IETF work group?</p>
1030
1031 </div>
1032 <div class="tags">
1033
1034
1035 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1036
1037
1038 </div>
1039 </div>
1040 <div class="padding"></div>
1041
1042 <p style="text-align: right;"><a href="ldap.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14" /></a></p>
1043 <div id="sidebar">
1044
1045
1046
1047 <h2>Archive</h2>
1048 <ul>
1049
1050 <li>2019
1051 <ul>
1052
1053 <li><a href="http://people.skolelinux.org/pere/blog/archive/2019/01/">January (4)</a></li>
1054
1055 <li><a href="http://people.skolelinux.org/pere/blog/archive/2019/02/">February (3)</a></li>
1056
1057 <li><a href="http://people.skolelinux.org/pere/blog/archive/2019/03/">March (3)</a></li>
1058
1059 <li><a href="http://people.skolelinux.org/pere/blog/archive/2019/05/">May (2)</a></li>
1060
1061 <li><a href="http://people.skolelinux.org/pere/blog/archive/2019/06/">June (5)</a></li>
1062
1063 <li><a href="http://people.skolelinux.org/pere/blog/archive/2019/07/">July (2)</a></li>
1064
1065 <li><a href="http://people.skolelinux.org/pere/blog/archive/2019/08/">August (1)</a></li>
1066
1067 <li><a href="http://people.skolelinux.org/pere/blog/archive/2019/09/">September (1)</a></li>
1068
1069 </ul></li>
1070
1071 <li>2018
1072 <ul>
1073
1074 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/01/">January (1)</a></li>
1075
1076 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/02/">February (5)</a></li>
1077
1078 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/03/">March (5)</a></li>
1079
1080 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/04/">April (3)</a></li>
1081
1082 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/06/">June (2)</a></li>
1083
1084 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/07/">July (5)</a></li>
1085
1086 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/08/">August (3)</a></li>
1087
1088 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/09/">September (3)</a></li>
1089
1090 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/10/">October (5)</a></li>
1091
1092 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/11/">November (2)</a></li>
1093
1094 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/12/">December (4)</a></li>
1095
1096 </ul></li>
1097
1098 <li>2017
1099 <ul>
1100
1101 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/01/">January (4)</a></li>
1102
1103 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/02/">February (3)</a></li>
1104
1105 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/03/">March (5)</a></li>
1106
1107 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/04/">April (2)</a></li>
1108
1109 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/06/">June (5)</a></li>
1110
1111 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/07/">July (1)</a></li>
1112
1113 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/08/">August (1)</a></li>
1114
1115 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/09/">September (3)</a></li>
1116
1117 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/10/">October (5)</a></li>
1118
1119 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/11/">November (3)</a></li>
1120
1121 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/12/">December (4)</a></li>
1122
1123 </ul></li>
1124
1125 <li>2016
1126 <ul>
1127
1128 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/01/">January (3)</a></li>
1129
1130 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/02/">February (2)</a></li>
1131
1132 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/03/">March (3)</a></li>
1133
1134 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/04/">April (8)</a></li>
1135
1136 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/05/">May (8)</a></li>
1137
1138 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/06/">June (2)</a></li>
1139
1140 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/07/">July (2)</a></li>
1141
1142 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/08/">August (5)</a></li>
1143
1144 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/09/">September (2)</a></li>
1145
1146 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/10/">October (3)</a></li>
1147
1148 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/11/">November (8)</a></li>
1149
1150 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/12/">December (5)</a></li>
1151
1152 </ul></li>
1153
1154 <li>2015
1155 <ul>
1156
1157 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/01/">January (7)</a></li>
1158
1159 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/02/">February (6)</a></li>
1160
1161 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/03/">March (1)</a></li>
1162
1163 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/04/">April (4)</a></li>
1164
1165 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/05/">May (3)</a></li>
1166
1167 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/06/">June (4)</a></li>
1168
1169 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/07/">July (6)</a></li>
1170
1171 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/08/">August (2)</a></li>
1172
1173 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/09/">September (2)</a></li>
1174
1175 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/10/">October (9)</a></li>
1176
1177 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/11/">November (6)</a></li>
1178
1179 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/12/">December (3)</a></li>
1180
1181 </ul></li>
1182
1183 <li>2014
1184 <ul>
1185
1186 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/01/">January (2)</a></li>
1187
1188 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/02/">February (3)</a></li>
1189
1190 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/03/">March (8)</a></li>
1191
1192 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/04/">April (7)</a></li>
1193
1194 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/05/">May (1)</a></li>
1195
1196 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/06/">June (2)</a></li>
1197
1198 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/07/">July (2)</a></li>
1199
1200 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/08/">August (2)</a></li>
1201
1202 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/09/">September (5)</a></li>
1203
1204 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/10/">October (6)</a></li>
1205
1206 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/11/">November (3)</a></li>
1207
1208 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/12/">December (5)</a></li>
1209
1210 </ul></li>
1211
1212 <li>2013
1213 <ul>
1214
1215 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/01/">January (11)</a></li>
1216
1217 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/02/">February (9)</a></li>
1218
1219 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/03/">March (9)</a></li>
1220
1221 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/04/">April (6)</a></li>
1222
1223 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/05/">May (9)</a></li>
1224
1225 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/06/">June (10)</a></li>
1226
1227 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/07/">July (7)</a></li>
1228
1229 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/08/">August (3)</a></li>
1230
1231 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/09/">September (5)</a></li>
1232
1233 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/10/">October (7)</a></li>
1234
1235 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/11/">November (9)</a></li>
1236
1237 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/12/">December (3)</a></li>
1238
1239 </ul></li>
1240
1241 <li>2012
1242 <ul>
1243
1244 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/01/">January (7)</a></li>
1245
1246 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/02/">February (10)</a></li>
1247
1248 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/03/">March (17)</a></li>
1249
1250 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/04/">April (12)</a></li>
1251
1252 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/05/">May (12)</a></li>
1253
1254 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/06/">June (20)</a></li>
1255
1256 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/07/">July (17)</a></li>
1257
1258 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/08/">August (6)</a></li>
1259
1260 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/09/">September (9)</a></li>
1261
1262 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/10/">October (17)</a></li>
1263
1264 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/11/">November (10)</a></li>
1265
1266 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/12/">December (7)</a></li>
1267
1268 </ul></li>
1269
1270 <li>2011
1271 <ul>
1272
1273 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
1274
1275 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
1276
1277 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
1278
1279 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
1280
1281 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
1282
1283 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
1284
1285 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (7)</a></li>
1286
1287 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/08/">August (6)</a></li>
1288
1289 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/09/">September (4)</a></li>
1290
1291 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/10/">October (2)</a></li>
1292
1293 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/11/">November (3)</a></li>
1294
1295 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/12/">December (1)</a></li>
1296
1297 </ul></li>
1298
1299 <li>2010
1300 <ul>
1301
1302 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
1303
1304 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
1305
1306 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1307
1308 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1309
1310 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1311
1312 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1313
1314 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
1315
1316 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
1317
1318 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
1319
1320 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
1321
1322 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
1323
1324 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
1325
1326 </ul></li>
1327
1328 <li>2009
1329 <ul>
1330
1331 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1332
1333 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1334
1335 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1336
1337 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1338
1339 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1340
1341 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1342
1343 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1344
1345 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1346
1347 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1348
1349 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1350
1351 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1352
1353 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1354
1355 </ul></li>
1356
1357 <li>2008
1358 <ul>
1359
1360 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1361
1362 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1363
1364 </ul></li>
1365
1366 </ul>
1367
1368
1369
1370 <h2>Tags</h2>
1371 <ul>
1372
1373 <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (16)</a></li>
1374
1375 <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1376
1377 <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1378
1379 <li><a href="http://people.skolelinux.org/pere/blog/tags/bankid">bankid (4)</a></li>
1380
1381 <li><a href="http://people.skolelinux.org/pere/blog/tags/betalkontant">betalkontant (8)</a></li>
1382
1383 <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (11)</a></li>
1384
1385 <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (17)</a></li>
1386
1387 <li><a href="http://people.skolelinux.org/pere/blog/tags/bsa">bsa (2)</a></li>
1388
1389 <li><a href="http://people.skolelinux.org/pere/blog/tags/chrpath">chrpath (2)</a></li>
1390
1391 <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (168)</a></li>
1392
1393 <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (158)</a></li>
1394
1395 <li><a href="http://people.skolelinux.org/pere/blog/tags/debian-handbook">debian-handbook (4)</a></li>
1396
1397 <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (11)</a></li>
1398
1399 <li><a href="http://people.skolelinux.org/pere/blog/tags/dld">dld (17)</a></li>
1400
1401 <li><a href="http://people.skolelinux.org/pere/blog/tags/docbook">docbook (26)</a></li>
1402
1403 <li><a href="http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (4)</a></li>
1404
1405 <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (409)</a></li>
1406
1407 <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (23)</a></li>
1408
1409 <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (14)</a></li>
1410
1411 <li><a href="http://people.skolelinux.org/pere/blog/tags/freeculture">freeculture (34)</a></li>
1412
1413 <li><a href="http://people.skolelinux.org/pere/blog/tags/freedombox">freedombox (9)</a></li>
1414
1415 <li><a href="http://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (20)</a></li>
1416
1417 <li><a href="http://people.skolelinux.org/pere/blog/tags/h264">h264 (20)</a></li>
1418
1419 <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (42)</a></li>
1420
1421 <li><a href="http://people.skolelinux.org/pere/blog/tags/isenkram">isenkram (16)</a></li>
1422
1423 <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (22)</a></li>
1424
1425 <li><a href="http://people.skolelinux.org/pere/blog/tags/kodi">kodi (4)</a></li>
1426
1427 <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (9)</a></li>
1428
1429 <li><a href="http://people.skolelinux.org/pere/blog/tags/lego">lego (4)</a></li>
1430
1431 <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (8)</a></li>
1432
1433 <li><a href="http://people.skolelinux.org/pere/blog/tags/lsdvd">lsdvd (2)</a></li>
1434
1435 <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1436
1437 <li><a href="http://people.skolelinux.org/pere/blog/tags/mesh network">mesh network (8)</a></li>
1438
1439 <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (42)</a></li>
1440
1441 <li><a href="http://people.skolelinux.org/pere/blog/tags/nice free software">nice free software (12)</a></li>
1442
1443 <li><a href="http://people.skolelinux.org/pere/blog/tags/noark5">noark5 (17)</a></li>
1444
1445 <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (307)</a></li>
1446
1447 <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (196)</a></li>
1448
1449 <li><a href="http://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (37)</a></li>
1450
1451 <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
1452
1453 <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (75)</a></li>
1454
1455 <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (109)</a></li>
1456
1457 <li><a href="http://people.skolelinux.org/pere/blog/tags/raid">raid (2)</a></li>
1458
1459 <li><a href="http://people.skolelinux.org/pere/blog/tags/reactos">reactos (1)</a></li>
1460
1461 <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
1462
1463 <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (3)</a></li>
1464
1465 <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (12)</a></li>
1466
1467 <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1468
1469 <li><a href="http://people.skolelinux.org/pere/blog/tags/ruter">ruter (7)</a></li>
1470
1471 <li><a href="http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (2)</a></li>
1472
1473 <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (56)</a></li>
1474
1475 <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (4)</a></li>
1476
1477 <li><a href="http://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (5)</a></li>
1478
1479 <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (66)</a></li>
1480
1481 <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (6)</a></li>
1482
1483 <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (12)</a></li>
1484
1485 <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (56)</a></li>
1486
1487 <li><a href="http://people.skolelinux.org/pere/blog/tags/sysadmin">sysadmin (4)</a></li>
1488
1489 <li><a href="http://people.skolelinux.org/pere/blog/tags/usenix">usenix (2)</a></li>
1490
1491 <li><a href="http://people.skolelinux.org/pere/blog/tags/valg">valg (9)</a></li>
1492
1493 <li><a href="http://people.skolelinux.org/pere/blog/tags/verkidetfri">verkidetfri (17)</a></li>
1494
1495 <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (73)</a></li>
1496
1497 <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (4)</a></li>
1498
1499 <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (42)</a></li>
1500
1501 </ul>
1502
1503
1504 </div>
1505 <p style="text-align: right">
1506 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v4.6</a>
1507 </p>
1508
1509 </body>
1510 </html>
Nettsider og blogg.