]> pere.pagekite.me Git - homepage.git/blob - blog/tags/ldap/index.html
projects / homepage.git / blob
? search:


1c65481ac26ba7fe494c2b4a8f09f675f8bf1d06
[homepage.git] / blog / tags / ldap / index.html
1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
2 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
3 <html>
4 <head>
5 <title>Petter Reinholdtsen: Entries Tagged ldap</title>
6 <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
7 <link rel="alternate" title="RSS Feed" href="ldap.rss" type="application/rss+xml">
8 </head>
9 <body>
10
11 <div class="title">
12 <h1>
13 <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
14
15 </h1>
16
17 </div>
18
19 <p>Entries tagged "ldap".</p>
20
21
22
23
24 <div class="entry">
25 <div class="title">
26 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">Time for new LDAP schemas replacing RFC 2307?</a>
27 </div>
28 <div class="date">
29 2009-03-29 20:30
30 </div>
31
32 <div class="body">
33
34 <p>The state of standardized LDAP schemas on Linux is far from
35 optimal. There is RFC 2307 documenting one way to store NIS maps in
36 LDAP, and a modified version of this normally called RFC 2307bis, with
37 some modifications to be compatible with Active Directory. The RFC
38 specification handle the content of a lot of system databases, but do
39 not handle DNS zones and DHCP configuration.</p>
40
41 <p>In <a href="http://www.skolelinux.org/">Debian Edu/Skolelinux</a>,
42 we would like to store information about users, SMB clients/hosts,
43 filegroups, netgroups (users and hosts), DHCP and DNS configuration,
44 and LTSP configuration in LDAP. These objects have a lot in common,
45 but with the current LDAP schemas it is not possible to have one
46 object per entity. For example, one need to have at least three LDAP
47 objects for a given computer, one with the SMB related stuff, one with
48 DNS information and another with DHCP information. The schemas
49 provided for DNS and DHCP are impossible to combine into one LDAP
50 object. In addition, it is impossible to implement quick queries for
51 netgroup membership, because of the way NIS triples are implemented.
52 It just do not scale. I believe it is time for a few RFC
53 specifications to cleam up this mess.</p>
54
55 <p>I would like to have one LDAP object representing each computer in
56 the network, and this object can then keep the SMB (ie host key), DHCP
57 (mac address/name) and DNS (name/IP address) settings in one place.
58 It need to be efficently stored to make sure it scale well.</p>
59
60 <p>I would also like to have a quick way to map from a user or
61 computer and to the net group this user or computer is a member.</p>
62
63 <p>Active Directory have done a better job than unix heads like myself
64 in this regard, and the unix side need to catch up. Time to start a
65 new IETF work group?</p>
66
67 </div>
68 <div class="tags">
69
70
71
72 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
73
74 </div>
75 </div>
76 <div class="padding"></div>
77
78 <div class="entry">
79 <div class="title">
80 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">Idea for a change to LDAP schemas allowing DNS and DHCP info to be combined into one object</a>
81 </div>
82 <div class="date">
83 2010-06-24 00:35
84 </div>
85
86 <div class="body">
87
88 <p>A while back, I
89 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">complained
90 about the fact</a> that it is not possible with the provided schemas
91 for storing DNS and DHCP information in LDAP to combine the two sets
92 of information into one LDAP object representing a computer.</p>
93
94 <p>In the mean time, I discovered that a simple fix would be to make
95 the dhcpHost object class auxiliary, to allow it to be combined with
96 the dNSDomain object class, and thus forming one object for one
97 computer when storing both DHCP and DNS information in LDAP.</p>
98
99 <p>If I understand this correctly, it is not safe to do this change
100 without also changing the assigned number for the object class, and I
101 do not know enough about LDAP schema design to do that properly for
102 Debian Edu.</p>
103
104 <p>Anyway, for future reference, this is how I believe we could change
105 the
106 <a href="http://tools.ietf.org/html/draft-ietf-dhc-ldap-schema-00">DHCP
107 schema</a> to solve at least part of the problem with the LDAP schemas
108 available today from IETF.</p>
109
110 <pre>
111 --- dhcp.schema (revision 65192)
112 +++ dhcp.schema (working copy)
113 @@ -376,7 +376,7 @@
114 objectclass ( 2.16.840.1.113719.1.203.6.6
115 NAME 'dhcpHost'
116 DESC 'This represents information about a particular client'
117 - SUP top
118 + SUP top AUXILIARY
119 MUST cn
120 MAY (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
121 X-NDS_CONTAINMENT ('dhcpService' 'dhcpSubnet' 'dhcpGroup') )
122 </pre>
123
124 <p>I very much welcome clues on how to do this properly for Debian
125 Edu/Squeeze. We provide the DHCP schema in our debian-edu-config
126 package, and should thus be free to rewrite it as we see fit.</p>
127
128 <p>If you want to help out with implementing this for Debian Edu,
129 please contact us on debian-edu@lists.debian.org.</p>
130
131 </div>
132 <div class="tags">
133
134
135
136 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
137
138 </div>
139 </div>
140 <div class="padding"></div>
141
142 <div class="entry">
143 <div class="title">
144 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">LUMA, a very nice LDAP GUI</a>
145 </div>
146 <div class="date">
147 2010-06-28 00:30
148 </div>
149
150 <div class="body">
151
152 <p>The last few days I have been looking into the status of the LDAP
153 directory in Debian Edu, and in the process I started to miss a GUI
154 tool to browse the LDAP tree. The only one I was able to find in
155 Debian/Squeeze and Lenny is
156 <a href="http://luma.sourceforge.net/">LUMA</a>, which has proved to
157 be a great tool to get a overview of the current LDAP directory
158 populated by default in Skolelinux. Thanks to it, I have been able to
159 find empty and obsolete subtrees, misplaced objects and duplicate
160 objects. It will be installed by default in Debian/Squeeze. If you
161 are working with LDAP, give it a go. :)</p>
162
163 <p>I did notice one problem with it I have not had time to report to
164 the BTS yet. There is no .desktop file in the package, so the tool do
165 not show up in the Gnome and KDE menus, but only deep down in in the
166 Debian submenu in KDE. I hope that can be fixed before Squeeze is
167 released.</p>
168
169 <p>I have not yet been able to get it to modify the tree yet. I would
170 like to move objects and remove subtrees directly in the GUI, but have
171 not found a way to do that with LUMA yet. So in the mean time, I use
172 <a href="http://www.lichteblau.com/ldapvi/">ldapvi</a> for that.</p>
173
174 <p>If you have tips on other GUI tools for LDAP that might be useful
175 in Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
176
177 <p>Update 2010-06-29: Ross Reedstrom tipped us about the
178 <a href="http://packages.qa.debian.org/g/gq.html">gq</a> package as a
179 useful GUI alternative. It seem like a good tool, but is unmaintained
180 in Debian and got a RC bug keeping it out of Squeeze. Unless that
181 changes, it will not be an option for Debian Edu based on Squeeze.</p>
182
183 </div>
184 <div class="tags">
185
186
187
188 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
189
190 </div>
191 </div>
192 <div class="padding"></div>
193
194 <div class="entry">
195 <div class="title">
196 <a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a>
197 </div>
198 <div class="date">
199 2010-07-01 11:40
200 </div>
201
202 <div class="body">
203
204 <p>For a laptop, centralized user directories and password checking is
205 a bit troubling. Laptops are typically used also when not connected
206 to the network, and it is vital for a user to be able to log in or
207 unlock the screen saver also when a central server is unavailable.
208 This is possible by caching passwords and directory information (user
209 and group attributes) locally, and the packages to do so are available
210 in Debian. Here follow two recipes to set this up in Debian/Squeeze.
211 It is also possible to set up in Debian/Lenny, but require more manual
212 setup there because pam-auth-update is missing in Lenny.</p>
213
214 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
215
216 This is the traditional method with a twist. The password caching is
217 provided by libpam-ccreds (version 10-4 or later is needed on
218 Squeeze), and the directory caching is done by nscd. The directory
219 lookup and password checking is done using LDAP. If one want to use
220 Kerberos for password checking the libpam-ldapd package can be
221 replaced with libpam-krb5 or libpam-heimdal. If one is happy having a
222 local home directory with the path listed in LDAP, one can use the
223 pam_mkhomedir module from pam-modules to make this happen instead of
224 using libpam-mklocaluser. A setup for pam-auth-update to enable
225 pam_mkhomedir will have to be written until a fix for
226 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
227 archive. Because I believe it is a bad idea to have local home
228 directories using misleading paths like /site/server/partition/, I
229 prefer to create a local user with the home directory in /home/. This
230 is done using the libpam-mklocaluser package.</p>
231
232 <p>These packages need to be installed and configured</p>
233
234 <blockquote><pre>
235 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
236 </pre></blockquote>
237
238 <p>The ldapd packages will ask for LDAP connection information, and
239 one have to fill in the values that fits ones own site. Make sure the
240 PAM part uses encrypted connections, to make sure the password is not
241 sent in clear text to the LDAP server. I've been unable to get TLS
242 certificate checking for a self signed certificate working, which make
243 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
244 is talking to the correct LDAP server), and very much welcome feedback
245 on how to get this working.</p>
246
247 <p>Because nscd do not have a default configuration fit for offline
248 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
249 is fixed, this configuration should be used instead of the one
250 currently in /etc/nscd.conf. The changes are in the fields
251 reload-count and positive-time-to-live, and is based on the
252 instructions I found in the
253 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
254 instructions by Flyn Computing.</p>
255
256 <blockquote><pre>
257 debug-level 0
258 reload-count unlimited
259 paranoia no
260
261 enable-cache passwd yes
262 positive-time-to-live passwd 2592000
263 negative-time-to-live passwd 20
264 suggested-size passwd 211
265 check-files passwd yes
266 persistent passwd yes
267 shared passwd yes
268 max-db-size passwd 33554432
269 auto-propagate passwd yes
270
271 enable-cache group yes
272 positive-time-to-live group 2592000
273 negative-time-to-live group 20
274 suggested-size group 211
275 check-files group yes
276 persistent group yes
277 shared group yes
278 max-db-size group 33554432
279 auto-propagate group yes
280
281 enable-cache hosts no
282 positive-time-to-live hosts 2592000
283 negative-time-to-live hosts 20
284 suggested-size hosts 211
285 check-files hosts yes
286 persistent hosts yes
287 shared hosts yes
288 max-db-size hosts 33554432
289
290 enable-cache services yes
291 positive-time-to-live services 2592000
292 negative-time-to-live services 20
293 suggested-size services 211
294 check-files services yes
295 persistent services yes
296 shared services yes
297 max-db-size services 33554432
298 </pre></blockquote>
299
300 <p>While we wait for a mechanism to update /etc/nsswitch.conf
301 automatically like the one provided in
302 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
303 content need to be manually replaced to ensure LDAP is used as the
304 directory service on the machine. /etc/nsswitch.conf should normally
305 look like this:</p>
306
307 <blockquote><pre>
308 passwd: files ldap
309 group: files ldap
310 shadow: files ldap
311 hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
312 networks: files
313 protocols: files
314 services: files
315 ethers: files
316 rpc: files
317 netgroup: files ldap
318 </pre></blockquote>
319
320 <p>The important parts are that ldap is listed last for passwd, group,
321 shadow and netgroup.</p>
322
323 <p>With these changes in place, any user in LDAP will be able to log
324 in locally on the machine using for example kdm, get a local home
325 directory created and have the password as well as user and group
326 attributes cached.
327
328 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
329 libpam-mklocaluser/pam_mkhomedir</h2>
330
331 <p>Because nscd have had its share of problems, and seem to have
332 problems doing proper caching, I've seen suggestions and recipes to
333 use nss-updatedb to copy parts of the LDAP database locally when the
334 LDAP database is available. I have not tested such setup, because I
335 discovered sssd.</p>
336
337 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
338
339 <p>A more flexible and robust setup than the nscd combination
340 mentioned earlier that has shown up recently, is the
341 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
342 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
343 to provide a Active Directory like directory service for Linux
344 machines. The sssd system combines the caching of passwords and user
345 information into one package, and remove the need for nscd and
346 libpam-ccreds. It support LDAP and Kerberos, but not NIS. Version
347 1.2 do not support netgroups, but it is said that it will support this
348 in version 1.5 expected to show up later in 2010. Because the
349 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
350 was missing in Debian, I ended up co-maintaining it with Werner, and
351 version 1.2 is now in testing.
352
353 <p>These packages need to be installed and configured to get the
354 roaming setup I want</p>
355
356 <blockquote><pre>
357 libpam-sss libnss-sss libpam-mklocaluser
358 </pre></blockquote>
359
360 The complete setup of sssd is done by editing/creating
361 <tt>/etc/sssd/sssd.conf</tt>.
362
363 <blockquote><pre>
364 [sssd]
365 config_file_version = 2
366 reconnection_retries = 3
367 sbus_timeout = 30
368 services = nss, pam
369 domains = INTERN
370
371 [nss]
372 filter_groups = root
373 filter_users = root
374 reconnection_retries = 3
375
376 [pam]
377 reconnection_retries = 3
378
379 [domain/INTERN]
380 enumerate = false
381 cache_credentials = true
382
383 id_provider = ldap
384 auth_provider = ldap
385 chpass_provider = ldap
386
387 ldap_uri = ldap://ldap
388 ldap_search_base = dc=skole,dc=skolelinux,dc=no
389 ldap_tls_reqcert = never
390 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
391 </pre></blockquote>
392
393 <p>I got the same problem here with certificate checking. Had to set
394 "ldap_tls_reqcert = never" to get it working.</p>
395
396 <p>With the libnss-sss package in testing at the moment, the
397 nsswitch.conf file is update automatically, so there is no need to
398 modify it manually.</p>
399
400 <p>If you want to help out with implementing this for Debian Edu,
401 please contact us on debian-edu@lists.debian.org.</p>
402
403 </div>
404 <div class="tags">
405
406
407
408 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
409
410 </div>
411 </div>
412 <div class="padding"></div>
413
414 <div class="entry">
415 <div class="title">
416 <a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a>
417 </div>
418 <div class="date">
419 2010-07-09 12:55
420 </div>
421
422 <div class="body">
423
424 <p>Since
425 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
426 last post</a> about available LDAP tools in Debian, I was told about a
427 LDAP GUI that is even better than luma. The java application
428 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
429 moving LDAP objects and subtrees using drag-and-drop, and can
430 authenticate using Kerberos. I have only tested the Kerberos
431 authentication, but do not have a LDAP setup allowing me to rewrite
432 LDAP with my test user yet. It is
433 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
434 Debian</a> testing and unstable at the moment. The only problem I
435 have with it is how it handle errors. If something go wrong, its
436 non-intuitive behaviour require me to go through some query work list
437 and remove the failing query. Nothing big, but very annoying.</p>
438
439 </div>
440 <div class="tags">
441
442
443
444 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
445
446 </div>
447 </div>
448 <div class="padding"></div>
449
450 <div class="entry">
451 <div class="title">
452 <a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a>
453 </div>
454 <div class="date">
455 2010-07-11 22:00
456 </div>
457
458 <div class="body">
459
460 <p>Vagrant mentioned on IRC today that ltsp_config now support
461 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
462 clients, and that this can be used to fetch configuration from LDAP if
463 Debian Edu choose to store configuration there.</p>
464
465 <p>Armed with this information, I got inspired and wrote a test module
466 to get configuration from LDAP. The idea is to look up the MAC
467 address of the client in LDAP, and look for attributes on the form
468 ltspconfigsetting=value, and use this to export SETTING=value to the
469 LTSP clients.</p>
470
471 <p>The goal is to be able to store the LTSP configuration attributes
472 in a "computer" LDAP object used by both DNS and DHCP, and thus
473 allowing us to store all information about a computer in one place.</p>
474
475 <p>This is a untested draft implementation, and I welcome feedback on
476 this approach. A real LDAP schema for the ltspClientAux objectclass
477 need to be written. Comments, suggestions, etc?</p>
478
479 <blockquote><pre>
480 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
481 #
482 # Fetch LTSP client settings from LDAP based on MAC address
483 #
484 # Uses ethernet address as stored in the dhcpHost objectclass using
485 # the dhcpHWAddress attribute or ethernet address stored in the
486 # ieee802Device objectclass with the macAddress attribute.
487 #
488 # This module is written to be schema agnostic, and only depend on the
489 # existence of attribute names.
490 #
491 # The LTSP configuration variables are saved directly using a
492 # ltspConfig prefix and uppercasing the rest of the attribute name.
493 # To set the SERVER variable, set the ltspConfigServer attribute.
494 #
495 # Some LDAP schema should be created with all the relevant
496 # configuration settings. Something like this should work:
497 #
498 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
499 # SUP top
500 # AUXILIARY
501 # MAY ( ltspConfigServer $ ltsConfigSound $ ... )
502
503 LDAPSERVER=$(debian-edu-ldapserver)
504 if [ "$LDAPSERVER" ] ; then
505 LDAPBASE=$(debian-edu-ldapserver -b)
506 for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
507 filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
508 ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
509 grep '^ltspConfig' | while read attr value ; do
510 # Remove prefix and convert to upper case
511 attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
512 # bass value on to clients
513 eval "$attr=$value; export $attr"
514 done
515 done
516 fi
517 </pre></blockquote>
518
519 <p>I'm not sure this shell construction will work, because I suspect
520 the while block might end up in a subshell causing the variables set
521 there to not show up in ltsp-config, but if that is the case I am sure
522 the code can be restructured to make sure the variables are passed on.
523 I expect that can be solved with some testing. :)</p>
524
525 <p>If you want to help out with implementing this for Debian Edu,
526 please contact us on debian-edu@lists.debian.org.</p>
527
528 <p>Update 2010-07-17: I am aware of another effort to store LTSP
529 configuration in LDAP that was created around year 2000 by
530 <a href="http://www.pcxperience.com/thinclient/documentation/ldap.html">PC
531 Xperience, Inc., 2000</a>. I found its
532 <a href="http://people.redhat.com/alikins/ltsp/ldap/">files</a> on a
533 personal home page over at redhat.com.</p>
534
535 </div>
536 <div class="tags">
537
538
539
540 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
541
542 </div>
543 </div>
544 <div class="padding"></div>
545
546 <div class="entry">
547 <div class="title">
548 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a>
549 </div>
550 <div class="date">
551 2010-07-14 23:45
552 </div>
553
554 <div class="body">
555
556 <p>For a while now, I have wanted to find a way to change the DNS and
557 DHCP services in Debian Edu to use the same LDAP objects for a given
558 computer, to avoid the possibility of having a inconsistent state for
559 a computer in LDAP (as in DHCP but no DNS entry or the other way
560 around) and make it easier to add computers to LDAP.</p>
561
562 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
563 information finally found a solution that seem to work.</p>
564
565 <p>The old setup required three LDAP objects for a given computer.
566 One forward DNS entry, one reverse DNS entry and one DHCP entry. If
567 we switch powerdns to use its strict LDAP method (ldap-method=strict
568 in pdns-debian-edu.conf), the forward and reverse DNS entries are
569 merged into one while making it impossible to transfer the reverse map
570 to a slave DNS server.</p>
571
572 <p>If we also replace the object class used to get the DNS related
573 attributes to one allowing these attributes to be combined with the
574 dhcphost object class, we can merge the DNS and DHCP entries into one.
575 I've written such object class in the dnsdomainaux.schema file (need
576 proper OIDs, but that is a minor issue), and tested the setup. It
577 seem to work.</p>
578
579 <p>With this test setup in place, we can get away with one LDAP object
580 for both DNS and DHCP, and even the LTSP configuration I suggested in
581 an earlier email. The combined LDAP object will look something like
582 this:</p>
583
584 <blockquote><pre>
585 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
586 cn: hostname
587 objectClass: dhcphost
588 objectclass: domainrelatedobject
589 objectclass: dnsdomainaux
590 associateddomain: hostname.intern
591 arecord: 10.11.12.13
592 dhcphwaddress: ethernet 00:00:00:00:00:00
593 dhcpstatements: fixed-address hostname
594 ldapconfigsound: Y
595 </pre></blockquote>
596
597 <p>The DNS server uses the associateddomain and arecord entries, while
598 the DHCP server uses the dhcphwaddress and dhcpstatements entries
599 before asking DNS to resolve the fixed-adddress. LTSP will use
600 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
601
602 <p>I am not yet sure if I can get the DHCP server to look for its
603 dhcphost in a different location, to allow us to put the objects
604 outside the "DHCP Config" subtree, but hope to figure out a way to do
605 that. If I can't figure out a way to do that, we can still get rid of
606 the hosts subtree and move all its content into the DHCP Config tree
607 (which probably should be renamed to be more related to the new
608 content. I suspect cn=dnsdhcp,ou=services or something like that
609 might be a good place to put it.</p>
610
611 <p>If you want to help out with implementing this for Debian Edu,
612 please contact us on debian-edu@lists.debian.org.</p>
613
614 </div>
615 <div class="tags">
616
617
618
619 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
620
621 </div>
622 </div>
623 <div class="padding"></div>
624
625 <div class="entry">
626 <div class="title">
627 <a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a>
628 </div>
629 <div class="date">
630 2010-07-17 21:00
631 </div>
632
633 <div class="body">
634
635 <p>This is a
636 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
637 on my
638 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
639 work</a> on
640 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
641 all</a> the computer related LDAP objects in Debian Edu.</p>
642
643 <p>As a step to try to see if it possible to merge the DNS and DHCP
644 LDAP objects, I have had a look at how the packages pdns-backend-ldap
645 and dhcp3-server-ldap in Debian use the LDAP server. The two
646 implementations are quite different in how they use LDAP.</p>
647
648 To get this information, I started slapd with debugging enabled and
649 dumped the debug output to a file to get the LDAP searches performed
650 on a Debian Edu main-server. Here is a summary.
651
652 <p><strong>powerdns</strong></p>
653
654 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
655 on how to</a> set up PowerDNS to use a LDAP backend is available on
656 the web.
657
658 <p>PowerDNS have two modes of operation using LDAP as its backend.
659 One "strict" mode where the forward and reverse DNS lookups are done
660 using the same LDAP objects, and a "tree" mode where the forward and
661 reverse entries are in two different subtrees in LDAP with a structure
662 based on the DNS names, as in tjener.intern and
663 2.2.0.10.in-addr.arpa.</p>
664
665 <p>In tree mode, the server is set up to use a LDAP subtree as its
666 base, and uses a "base" scoped search for the DNS name by adding
667 "dc=tjener,dc=intern," to the base with a filter for
668 "(associateddomain=tjener.intern)" for the forward entry and
669 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
670 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry. For
671 forward entries, it is looking for attributes named dnsttl, arecord,
672 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
673 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
674 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
675 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
676 spfrecord and modifytimestamp. For reverse entries it is looking for
677 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
678 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
679 locrecord, srvrecord, naptrrecord and modifytimestamp. The equivalent
680 ldapsearch commands could look like this:</p>
681
682 <blockquote><pre>
683 ldapsearch -h ldap \
684 -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
685 -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
686 cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
687 rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
688 nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
689 rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
690
691 ldapsearch -h ldap \
692 -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
693 -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
694 dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
695 hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
696 srvrecord naptrrecord modifytimestamp
697 </pre></blockquote>
698
699 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
700 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
701 example LDAP objects used there. In addition to these objects, the
702 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
703 also exist.</p>
704
705 <blockquote><pre>
706 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
707 objectclass: top
708 objectclass: dnsdomain
709 objectclass: domainrelatedobject
710 dc: tjener
711 arecord: 10.0.2.2
712 associateddomain: tjener.intern
713
714 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
715 objectclass: top
716 objectclass: dnsdomain2
717 objectclass: domainrelatedobject
718 dc: 2
719 ptrrecord: tjener.intern
720 associateddomain: 2.2.0.10.in-addr.arpa
721 </pre></blockquote>
722
723 <p>In strict mode, the server behaves differently. When looking for
724 forward DNS entries, it is doing a "subtree" scoped search with the
725 same base as in the tree mode for a object with filter
726 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
727 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
728 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
729 naptrrecord and modifytimestamp. For reverse entires it also do a
730 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
731 and the requested attributes are associateddomain, dnsttl and
732 modifytimestamp. In short, in strict mode the objects with ptrrecord
733 go away, and the arecord attribute in the forward object is used
734 instead.</p>
735
736 <p>The forward and reverse searches can be simulated using ldapsearch
737 like this:</p>
738
739 <blockquote><pre>
740 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
741 '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
742 cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
743 rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
744 nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
745 rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
746
747 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
748 '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
749 </pre></blockquote>
750
751 <p>In addition to the forward and reverse searches , there is also a
752 search for SOA records, which behave similar to the forward and
753 reverse lookups.</p>
754
755 <p>A thing to note with the PowerDNS behaviour is that it do not
756 specify any objectclass names, and instead look for the attributes it
757 need to generate a DNS reply. This make it able to work with any
758 objectclass that provide the needed attributes.</p>
759
760 <p>The attributes are normally provided in the cosine (RFC 1274) and
761 dnsdomain2 schemas. The latter is used for reverse entries like
762 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
763
764 <p>In Debian Edu, we have created DNS objects using the object classes
765 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
766 attributes) and domainrelatedobject (for associatedDomain). The use
767 of structural object classes make it impossible to combine these
768 classes with the object classes used by DHCP.</p>
769
770 <p>There are other schemas that could be used too, for example the
771 dnszone structural object class used by Gosa and bind-sdb for the DNS
772 attributes combined with the domainrelatedobject object class, but in
773 this case some unused attributes would have to be included as well
774 (zonename and relativedomainname).</p>
775
776 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
777 mode and not use any of the existing objectclasses (dnsdomain,
778 dnsdomain2 and dnszone) when one want to combine the DNS information
779 with DHCP information, and instead create a auxiliary object class
780 defined something like this (using the attributes defined for
781 dnsdomain and dnsdomain2 or dnszone):</p>
782
783 <blockquote><pre>
784 objectclass ( some-oid NAME 'dnsDomainAux'
785 SUP top
786 AUXILIARY
787 MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
788 DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
789 TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
790 NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
791 A6Record $ DNAMERecord
792 ))
793 </pre></blockquote>
794
795 <p>This will allow any object to become a DNS entry when combined with
796 the domainrelatedobject object class, and allow any entity to include
797 all the attributes PowerDNS wants. I've sent an email to the PowerDNS
798 developers asking for their view on this schema and if they are
799 interested in providing such schema with PowerDNS, and I hope my
800 message will be accepted into their mailing list soon.</p>
801
802 <p><strong>ISC dhcp</strong></p>
803
804 <p>The DHCP server searches for specific objectclass and requests all
805 the object attributes, and then uses the attributes it want. This
806 make it harder to figure out exactly what attributes are used, but
807 thanks to the working example in Debian Edu I can at least get an idea
808 what is needed without having to read the source code.</p>
809
810 <p>In the DHCP server configuration, the LDAP base to use and the
811 search filter to use to locate the correct dhcpServer entity is
812 stored. These are the relevant entries from
813 /etc/dhcp3/dhcpd.conf:</p>
814
815 <blockquote><pre>
816 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
817 ldap-dhcp-server-cn "dhcp";
818 </pre></blockquote>
819
820 <p>The DHCP server uses this information to nest all the DHCP
821 configuration it need. The cn "dhcp" is located using the given LDAP
822 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))". The
823 search result is this entry:</p>
824
825 <blockquote><pre>
826 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
827 cn: dhcp
828 objectClass: top
829 objectClass: dhcpServer
830 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
831 </pre></blockquote>
832
833 <p>The content of the dhcpServiceDN attribute is next used to locate the
834 subtree with DHCP configuration. The DHCP configuration subtree base
835 is located using a base scope search with base "cn=DHCP
836 Config,dc=skole,dc=skolelinux,dc=no" and filter
837 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
838 The search result is this entry:</p>
839
840 <blockquote><pre>
841 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
842 cn: DHCP Config
843 objectClass: top
844 objectClass: dhcpService
845 objectClass: dhcpOptions
846 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
847 dhcpStatements: ddns-update-style none
848 dhcpStatements: authoritative
849 dhcpOption: smtp-server code 69 = array of ip-address
850 dhcpOption: www-server code 72 = array of ip-address
851 dhcpOption: wpad-url code 252 = text
852 </pre></blockquote>
853
854 <p>Next, the entire subtree is processed, one level at the time. When
855 all the DHCP configuration is loaded, it is ready to receive requests.
856 The subtree in Debian Edu contain objects with object classes
857 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
858 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost. These provide options
859 and information about netmasks, dynamic range etc. Leaving out the
860 details here because it is not relevant for the focus of my
861 investigation, which is to see if it is possible to merge dns and dhcp
862 related computer objects.</p>
863
864 <p>When a DHCP request come in, LDAP is searched for the MAC address
865 of the client (00:00:00:00:00:00 in this example), using a subtree
866 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
867 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
868 00:00:00:00:00:00))" as the filter. This is what a host object look
869 like:</p>
870
871 <blockquote><pre>
872 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
873 cn: hostname
874 objectClass: top
875 objectClass: dhcpHost
876 dhcpHWAddress: ethernet 00:00:00:00:00:00
877 dhcpStatements: fixed-address hostname
878 </pre></blockquote>
879
880 <p>There is less flexiblity in the way LDAP searches are done here.
881 The object classes need to have fixed names, and the configuration
882 need to be stored in a fairly specific LDAP structure. On the
883 positive side, the invidiual dhcpHost entires can be anywhere without
884 the DN pointed to by the dhcpServer entries. The latter should make
885 it possible to group all host entries in a subtree next to the
886 configuration entries, and this subtree can also be shared with the
887 DNS server if the schema proposed above is combined with the dhcpHost
888 structural object class.
889
890 <p><strong>Conclusion</strong></p>
891
892 <p>The PowerDNS implementation seem to be very flexible when it come
893 to which LDAP schemas to use. While its "tree" mode is rigid when it
894 come to the the LDAP structure, the "strict" mode is very flexible,
895 allowing DNS objects to be stored anywhere under the base cn specified
896 in the configuration.</p>
897
898 <p>The DHCP implementation on the other hand is very inflexible, both
899 regarding which LDAP schemas to use and which LDAP structure to use.
900 I guess one could implement ones own schema, as long as the
901 objectclasses and attributes have the names used, but this do not
902 really help when the DHCP subtree need to have a fairly fixed
903 structure.</p>
904
905 <p>Based on the observed behaviour, I suspect a LDAP structure like
906 this might work for Debian Edu:</p>
907
908 <blockquote><pre>
909 ou=services
910 cn=machine-info (dhcpService) - dhcpServiceDN points here
911 cn=dhcp (dhcpServer)
912 cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
913 cn=10.0.2.0 (dhcpSubnet)
914 cn=group1 (dhcpGroup/dhcpOptions)
915 cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
916 cn=192.168.0.0 (dhcpSubnet)
917 cn=group1 (dhcpGroup/dhcpOptions)
918 ou=machines - PowerDNS base points here
919 cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
920 </pre></blockquote>
921
922 <P>This is not tested yet. If the DHCP server require the dhcpHost
923 entries to be in the dhcpGroup subtrees, the entries can be stored
924 there instead of a common machines subtree, and the PowerDNS base
925 would have to be moved one level up to the machine-info subtree.</p>
926
927 <p>The combined object under the machines subtree would look something
928 like this:</p>
929
930 <blockquote><pre>
931 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
932 dc: hostname
933 objectClass: top
934 objectClass: dhcpHost
935 objectclass: domainrelatedobject
936 objectclass: dnsDomainAux
937 associateddomain: hostname.intern
938 arecord: 10.11.12.13
939 dhcpHWAddress: ethernet 00:00:00:00:00:00
940 dhcpStatements: fixed-address hostname.intern
941 </pre></blockquote>
942
943 </p>One could even add the LTSP configuration associated with a given
944 machine, as long as the required attributes are available in a
945 auxiliary object class.</p>
946
947 </div>
948 <div class="tags">
949
950
951
952 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
953
954 </div>
955 </div>
956 <div class="padding"></div>
957
958 <p style="text-align: right;"><a href="ldap.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14"></a></p>
959
960
961
962
963 <div id="sidebar">
964
965 <h2>Archive</h2>
966 <ul>
967
968 <li>2010
969 <ul>
970
971 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
972
973 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
974
975 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
976
977 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
978
979 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
980
981 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
982
983 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
984
985 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
986
987 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
988
989 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
990
991 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
992
993 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (5)</a></li>
994
995 </ul></li>
996
997 <li>2009
998 <ul>
999
1000 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1001
1002 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1003
1004 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1005
1006 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1007
1008 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1009
1010 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1011
1012 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1013
1014 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1015
1016 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1017
1018 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1019
1020 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1021
1022 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1023
1024 </ul></li>
1025
1026 <li>2008
1027 <ul>
1028
1029 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1030
1031 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1032
1033 </ul></li>
1034
1035 </ul>
1036
1037
1038
1039 <h2>Tags</h2>
1040 <ul>
1041
1042 <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (13)</a></li>
1043
1044 <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1045
1046 <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1047
1048 <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (1)</a></li>
1049
1050 <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
1051
1052 <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (45)</a></li>
1053
1054 <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (53)</a></li>
1055
1056 <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (76)</a></li>
1057
1058 <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
1059
1060 <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (11)</a></li>
1061
1062 <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (5)</a></li>
1063
1064 <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
1065
1066 <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (4)</a></li>
1067
1068 <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1069
1070 <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (11)</a></li>
1071
1072 <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (93)</a></li>
1073
1074 <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (114)</a></li>
1075
1076 <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (18)</a></li>
1077
1078 <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (29)</a></li>
1079
1080 <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
1081
1082 <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (4)</a></li>
1083
1084 <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1085
1086 <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (21)</a></li>
1087
1088 <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
1089
1090 <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (16)</a></li>
1091
1092 <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
1093
1094 <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (16)</a></li>
1095
1096 <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
1097
1098 <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (14)</a></li>
1099
1100 </ul>
1101
1102 </div>
1103 </body>
1104 </html>
Nettsider og blogg.