blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html">One step closer to single signon in Debian Edu</a></div>
  24   <div class="date">2010-07-25 10:00</div>
  25   <div class="body">
  26 <p>The last few months me and the other Debian Edu developers have
  27 been working hard to get the Debian/Squeeze based version of Debian
  28 Edu/Skolelinux into shape.  This future version will use Kerberos for
  29 authentication, and services are slowly migrated to single sign,
  30 getting rid of password questions one at the time.</p>
  31
  32 <p>It will also feature a roaming workstation profile with local home
  33 directory, for laptops that are only some times on the Skolelinux
  34 network, and for this profile a shortcut is created in Gnome and KDE
  35 to gain access to the users home directory on the file server.  This
  36 shortcut uses SMB at the moment, and yesterday I had time to test if
  37 SMB mounting had started working in KDE after we added the cifs-utils
  38 package.  I was pleasantly surprised how well it worked.</p>
  39
  40 <p>Thanks to the recent changes to our samba configuration to get it
  41 to use Kerberos for authentication, there were no question about user
  42 password when mounting the SMB volume.  A simple click on the shortcut
  43 in the KDE menu, and a window with the home directory popped
  44 up. :)</p>
  45
  46 <p>One step closer to a single signon solution out of the box in
  47 Debian Edu.  We already had PAM, LDAP, IMAP and SMTP in place, and now
  48 also Samba.  Next step is Cups and hopefully also NFS.</p>
  49
  50 <p>We had planned a alpha0 release of Debian Edu for today, but thanks
  51 to the autobuilder administrators for some architectures being slow to
  52 sign packages, we are still missing the fixed LTSP package we need for
  53 the release.  It was uploaded three days ago with urgency=high, and if
  54 it had entered testing yesterday we would have been able to test it in
  55 time for a alpha0 release today.  As the binaries for ia64 and powerpc
  56 still not uploaded to the Debian archive, we need to delay the alpha
  57 release another day.</p>
  58
  59 <p>If you want to help out with implementing Kerberos for Debian Edu,
  60 please contact us on debian-edu@lists.debian.org.</p>
  61 </div>
  62   <div class="tags">
  63
  64
  65
  66    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
  67
  68   </div>
  69  </div>
  70  <div class="padding"></div>
  71
  72  <div class="entry">
  73   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til____slutte____kj__pe_musikk.html">Digitale restriksjonsmekanismer fikk meg til å slutte å kjøpe musikk</a></div>
  74   <div class="date">2010-07-22 23:50</div>
  75   <div class="body">
  76 <p>For mange år siden slutte jeg å kjøpe musikk-CDer. Årsaken var at
  77 musikkbransjen var godt i gang med å selge platene sine med DRM som
  78 gjorde at jeg ikke fikk spilt av musikken jeg kjøpte på utstyret jeg
  79 hadde tilgjengelig, dvs. min datamaskin. Det var umulig å se på en
  80 plate om den var ødelagt eller ikke, og jeg hadde jo allerede en
  81 anseelig samling med plater, så jeg bestemme meg for å slutte å gi
  82 penger til en bransje som åpenbart ikke respekterte meg.</p>
  83
  84 <p>Jeg har mange titalls dager med musikk på CD i dag. Det meste er
  85 lagt i et stort arkiv som kan spilles av fra husets datamaskiner (har
  86 ikke rukket rippe alt). Jeg ser dermed ikke behovet for å skaffe mer
  87 musikk. De fleste av mine favoritter er i hus, og jeg er dermed godt
  88 fornøyd.</p>
  89
  90 <p>Hvis musikkbransjen ønsker mine penger, så må de demonstrere at de
  91 setter pris på meg som kunde, og ikke skremme meg bort med DRM og
  92 antydninger om at kundene er kriminelle.</p>
  93
  94 <p>Filmbransjen er like ille, men mens musikk gjerne varer lenge, er
  95 filmer mer ferskvare. Har dermed ikke helt sluttet å kjøpe filmer, men
  96 holder meg til DVD-filmer som kan spilles av på mine Linuxbokser.
  97 Kommer neppe til å ta i bruk Blueray, og ei heller de nye DRM-greiene
  98 «Ultraviolet» som be annonsert her om dagen.</p>
  99 </div>
 100   <div class="tags">
 101
 102
 103
 104    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>.
 105
 106   </div>
 107  </div>
 108  <div class="padding"></div>
 109
 110  <div class="entry">
 111   <div class="title"><a href="http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html">OpenStreetmap one step closer to having routing on its front page</a></div>
 112   <div class="date">2010-07-18 16:45</div>
 113   <div class="body">
 114 <p>Thanks to
 115 <a href="http://feedproxy.google.com/~r/Opengeodata/~3/wUTCzDZk3lc/project-of-the-week-which-way-home">todays
 116 opengeodata blog entry</a>, I just discovered that the
 117 OpenStreetmap.org site have gotten
 118 <a href="http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT">support
 119 for calculating routes</a>.  The support is still experimental and
 120 only available from the development server, until more experience is
 121 gathered on the user interface and any scalability issues.</p>
 122
 123 <p>Earlier, the routing I knew about using the OpenStreetmap.org data
 124 was provided by <a href="http://maps.cloudmade.com/">Cloudmade</a>,
 125 but having it on the main page is required to make everyone aware of
 126 the issue.  I've had people reject Openstreetmap.org as a viable
 127 alternative for them because the front page lacked routing support,
 128 and I hope their needs will be catered for when routing show up on the
 129 www.openstreetmap.org front page.</p>
 130 </div>
 131   <div class="tags">
 132
 133
 134
 135    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/kart">kart</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 136
 137   </div>
 138  </div>
 139  <div class="padding"></div>
 140
 141  <div class="entry">
 142   <div class="title"><a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a></div>
 143   <div class="date">2010-07-17 21:00</div>
 144   <div class="body">
 145 <p>This is a
 146 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
 147 on my
 148 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
 149 work</a> on
 150 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
 151 all</a> the computer related LDAP objects in Debian Edu.</p>
 152
 153 <p>As a step to try to see if it possible to merge the DNS and DHCP
 154 LDAP objects, I have had a look at how the packages pdns-backend-ldap
 155 and dhcp3-server-ldap in Debian use the LDAP server.  The two
 156 implementations are quite different in how they use LDAP.</p>
 157
 158 To get this information, I started slapd with debugging enabled and
 159 dumped the debug output to a file to get the LDAP searches performed
 160 on a Debian Edu main-server.  Here is a summary.
 161
 162 <p><strong>powerdns</strong></p>
 163
 164 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
 165 on how to</a> set up PowerDNS to use a LDAP backend is available on
 166 the web.
 167
 168 <p>PowerDNS have two modes of operation using LDAP as its backend.
 169 One "strict" mode where the forward and reverse DNS lookups are done
 170 using the same LDAP objects, and a "tree" mode where the forward and
 171 reverse entries are in two different subtrees in LDAP with a structure
 172 based on the DNS names, as in tjener.intern and
 173 2.2.0.10.in-addr.arpa.</p>
 174
 175 <p>In tree mode, the server is set up to use a LDAP subtree as its
 176 base, and uses a "base" scoped search for the DNS name by adding
 177 "dc=tjener,dc=intern," to the base with a filter for
 178 "(associateddomain=tjener.intern)" for the forward entry and
 179 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
 180 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
 181 forward entries, it is looking for attributes named dnsttl, arecord,
 182 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
 183 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
 184 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
 185 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
 186 spfrecord and modifytimestamp.  For reverse entries it is looking for
 187 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
 188 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
 189 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
 190 ldapsearch commands could look like this:</p>
 191
 192 <blockquote><pre>
 193 ldapsearch -h ldap \
 194   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 195   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 196   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 197   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 198   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 199   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 200
 201 ldapsearch -h ldap \
 202   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 203   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
 204   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
 205   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
 206   srvrecord naptrrecord modifytimestamp
 207 </pre></blockquote>
 208
 209 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
 210 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
 211 example LDAP objects used there.  In addition to these objects, the
 212 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
 213 also exist.</p>
 214
 215 <blockquote><pre>
 216 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
 217 objectclass: top
 218 objectclass: dnsdomain
 219 objectclass: domainrelatedobject
 220 dc: tjener
 221 arecord: 10.0.2.2
 222 associateddomain: tjener.intern
 223
 224 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
 225 objectclass: top
 226 objectclass: dnsdomain2
 227 objectclass: domainrelatedobject
 228 dc: 2
 229 ptrrecord: tjener.intern
 230 associateddomain: 2.2.0.10.in-addr.arpa
 231 </pre></blockquote>
 232
 233 <p>In strict mode, the server behaves differently.  When looking for
 234 forward DNS entries, it is doing a "subtree" scoped search with the
 235 same base as in the tree mode for a object with filter
 236 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
 237 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
 238 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
 239 naptrrecord and modifytimestamp.  For reverse entires it also do a
 240 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
 241 and the requested attributes are associateddomain, dnsttl and
 242 modifytimestamp.  In short, in strict mode the objects with ptrrecord
 243 go away, and the arecord attribute in the forward object is used
 244 instead.</p>
 245
 246 <p>The forward and reverse searches can be simulated using ldapsearch
 247 like this:</p>
 248
 249 <blockquote><pre>
 250 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 251   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 252   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 253   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 254   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 255   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 256
 257 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 258   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
 259 </pre></blockquote>
 260
 261 <p>In addition to the forward and reverse searches , there is also a
 262 search for SOA records, which behave similar to the forward and
 263 reverse lookups.</p>
 264
 265 <p>A thing to note with the PowerDNS behaviour is that it do not
 266 specify any objectclass names, and instead look for the attributes it
 267 need to generate a DNS reply.  This make it able to work with any
 268 objectclass that provide the needed attributes.</p>
 269
 270 <p>The attributes are normally provided in the cosine (RFC 1274) and
 271 dnsdomain2 schemas.  The latter is used for reverse entries like
 272 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
 273
 274 <p>In Debian Edu, we have created DNS objects using the object classes
 275 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
 276 attributes) and domainrelatedobject (for associatedDomain).  The use
 277 of structural object classes make it impossible to combine these
 278 classes with the object classes used by DHCP.</p>
 279
 280 <p>There are other schemas that could be used too, for example the
 281 dnszone structural object class used by Gosa and bind-sdb for the DNS
 282 attributes combined with the domainrelatedobject object class, but in
 283 this case some unused attributes would have to be included as well
 284 (zonename and relativedomainname).</p>
 285
 286 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
 287 mode and not use any of the existing objectclasses (dnsdomain,
 288 dnsdomain2 and dnszone) when one want to combine the DNS information
 289 with DHCP information, and instead create a auxiliary object class
 290 defined something like this (using the attributes defined for
 291 dnsdomain and dnsdomain2 or dnszone):</p>
 292
 293 <blockquote><pre>
 294 objectclass ( some-oid NAME 'dnsDomainAux'
 295     SUP top
 296     AUXILIARY
 297     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
 298           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
 299           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
 300           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
 301           A6Record $ DNAMERecord
 302     ))
 303 </pre></blockquote>
 304
 305 <p>This will allow any object to become a DNS entry when combined with
 306 the domainrelatedobject object class, and allow any entity to include
 307 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
 308 developers asking for their view on this schema and if they are
 309 interested in providing such schema with PowerDNS, and I hope my
 310 message will be accepted into their mailing list soon.</p>
 311
 312 <p><strong>ISC dhcp</strong></p>
 313
 314 <p>The DHCP server searches for specific objectclass and requests all
 315 the object attributes, and then uses the attributes it want.  This
 316 make it harder to figure out exactly what attributes are used, but
 317 thanks to the working example in Debian Edu I can at least get an idea
 318 what is needed without having to read the source code.</p>
 319
 320 <p>In the DHCP server configuration, the LDAP base to use and the
 321 search filter to use to locate the correct dhcpServer entity is
 322 stored.  These are the relevant entries from
 323 /etc/dhcp3/dhcpd.conf:</p>
 324
 325 <blockquote><pre>
 326 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
 327 ldap-dhcp-server-cn "dhcp";
 328 </pre></blockquote>
 329
 330 <p>The DHCP server uses this information to nest all the DHCP
 331 configuration it need.  The cn "dhcp" is located using the given LDAP
 332 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
 333 search result is this entry:</p>
 334
 335 <blockquote><pre>
 336 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
 337 cn: dhcp
 338 objectClass: top
 339 objectClass: dhcpServer
 340 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 341 </pre></blockquote>
 342
 343 <p>The content of the dhcpServiceDN attribute is next used to locate the
 344 subtree with DHCP configuration.  The DHCP configuration subtree base
 345 is located using a base scope search with base "cn=DHCP
 346 Config,dc=skole,dc=skolelinux,dc=no" and filter
 347 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
 348 The search result is this entry:</p>
 349
 350 <blockquote><pre>
 351 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 352 cn: DHCP Config
 353 objectClass: top
 354 objectClass: dhcpService
 355 objectClass: dhcpOptions
 356 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
 357 dhcpStatements: ddns-update-style none
 358 dhcpStatements: authoritative
 359 dhcpOption: smtp-server code 69 = array of ip-address
 360 dhcpOption: www-server code 72 = array of ip-address
 361 dhcpOption: wpad-url code 252 = text
 362 </pre></blockquote>
 363
 364 <p>Next, the entire subtree is processed, one level at the time.  When
 365 all the DHCP configuration is loaded, it is ready to receive requests.
 366 The subtree in Debian Edu contain objects with object classes
 367 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
 368 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
 369 and information about netmasks, dynamic range etc.  Leaving out the
 370 details here because it is not relevant for the focus of my
 371 investigation, which is to see if it is possible to merge dns and dhcp
 372 related computer objects.</p>
 373
 374 <p>When a DHCP request come in, LDAP is searched for the MAC address
 375 of the client (00:00:00:00:00:00 in this example), using a subtree
 376 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
 377 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
 378 00:00:00:00:00:00))" as the filter.  This is what a host object look
 379 like:</p>
 380
 381 <blockquote><pre>
 382 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 383 cn: hostname
 384 objectClass: top
 385 objectClass: dhcpHost
 386 dhcpHWAddress: ethernet 00:00:00:00:00:00
 387 dhcpStatements: fixed-address hostname
 388 </pre></blockquote>
 389
 390 <p>There is less flexiblity in the way LDAP searches are done here.
 391 The object classes need to have fixed names, and the configuration
 392 need to be stored in a fairly specific LDAP structure.  On the
 393 positive side, the invidiual dhcpHost entires can be anywhere without
 394 the DN pointed to by the dhcpServer entries.  The latter should make
 395 it possible to group all host entries in a subtree next to the
 396 configuration entries, and this subtree can also be shared with the
 397 DNS server if the schema proposed above is combined with the dhcpHost
 398 structural object class.
 399
 400 <p><strong>Conclusion</strong></p>
 401
 402 <p>The PowerDNS implementation seem to be very flexible when it come
 403 to which LDAP schemas to use.  While its "tree" mode is rigid when it
 404 come to the the LDAP structure, the "strict" mode is very flexible,
 405 allowing DNS objects to be stored anywhere under the base cn specified
 406 in the configuration.</p>
 407
 408 <p>The DHCP implementation on the other hand is very inflexible, both
 409 regarding which LDAP schemas to use and which LDAP structure to use.
 410 I guess one could implement ones own schema, as long as the
 411 objectclasses and attributes have the names used, but this do not
 412 really help when the DHCP subtree need to have a fairly fixed
 413 structure.</p>
 414
 415 <p>Based on the observed behaviour, I suspect a LDAP structure like
 416 this might work for Debian Edu:</p>
 417
 418 <blockquote><pre>
 419 ou=services
 420   cn=machine-info (dhcpService) - dhcpServiceDN points here
 421     cn=dhcp (dhcpServer)
 422     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
 423       cn=10.0.2.0 (dhcpSubnet)
 424         cn=group1 (dhcpGroup/dhcpOptions)
 425     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
 426       cn=192.168.0.0 (dhcpSubnet)
 427         cn=group1 (dhcpGroup/dhcpOptions)
 428     ou=machines - PowerDNS base points here
 429       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
 430 </pre></blockquote>
 431
 432 <P>This is not tested yet.  If the DHCP server require the dhcpHost
 433 entries to be in the dhcpGroup subtrees, the entries can be stored
 434 there instead of a common machines subtree, and the PowerDNS base
 435 would have to be moved one level up to the machine-info subtree.</p>
 436
 437 <p>The combined object under the machines subtree would look something
 438 like this:</p>
 439
 440 <blockquote><pre>
 441 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
 442 dc: hostname
 443 objectClass: top
 444 objectClass: dhcpHost
 445 objectclass: domainrelatedobject
 446 objectclass: dnsDomainAux
 447 associateddomain: hostname.intern
 448 arecord: 10.11.12.13
 449 dhcpHWAddress: ethernet 00:00:00:00:00:00
 450 dhcpStatements: fixed-address hostname.intern
 451 </pre></blockquote>
 452
 453 </p>One could even add the LTSP configuration associated with a given
 454 machine, as long as the required attributes are available in a
 455 auxiliary object class.</p>
 456 </div>
 457   <div class="tags">
 458
 459
 460
 461    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 462
 463   </div>
 464  </div>
 465  <div class="padding"></div>
 466
 467  <div class="entry">
 468   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a></div>
 469   <div class="date">2010-07-14 23:45</div>
 470   <div class="body">
 471 <p>For a while now, I have wanted to find a way to change the DNS and
 472 DHCP services in Debian Edu to use the same LDAP objects for a given
 473 computer, to avoid the possibility of having a inconsistent state for
 474 a computer in LDAP (as in DHCP but no DNS entry or the other way
 475 around) and make it easier to add computers to LDAP.</p>
 476
 477 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
 478 information finally found a solution that seem to work.</p>
 479
 480 <p>The old setup required three LDAP objects for a given computer.
 481 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
 482 we switch powerdns to use its strict LDAP method (ldap-method=strict
 483 in pdns-debian-edu.conf), the forward and reverse DNS entries are
 484 merged into one while making it impossible to transfer the reverse map
 485 to a slave DNS server.</p>
 486
 487 <p>If we also replace the object class used to get the DNS related
 488 attributes to one allowing these attributes to be combined with the
 489 dhcphost object class, we can merge the DNS and DHCP entries into one.
 490 I've written such object class in the dnsdomainaux.schema file (need
 491 proper OIDs, but that is a minor issue), and tested the setup.  It
 492 seem to work.</p>
 493
 494 <p>With this test setup in place, we can get away with one LDAP object
 495 for both DNS and DHCP, and even the LTSP configuration I suggested in
 496 an earlier email.  The combined LDAP object will look something like
 497 this:</p>
 498
 499 <blockquote><pre>
 500   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 501   cn: hostname
 502   objectClass: dhcphost
 503   objectclass: domainrelatedobject
 504   objectclass: dnsdomainaux
 505   associateddomain: hostname.intern
 506   arecord: 10.11.12.13
 507   dhcphwaddress: ethernet 00:00:00:00:00:00
 508   dhcpstatements: fixed-address hostname
 509   ldapconfigsound: Y
 510 </pre></blockquote>
 511
 512 <p>The DNS server uses the associateddomain and arecord entries, while
 513 the DHCP server uses the dhcphwaddress and dhcpstatements entries
 514 before asking DNS to resolve the fixed-adddress.  LTSP will use
 515 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
 516
 517 <p>I am not yet sure if I can get the DHCP server to look for its
 518 dhcphost in a different location, to allow us to put the objects
 519 outside the "DHCP Config" subtree, but hope to figure out a way to do
 520 that.  If I can't figure out a way to do that, we can still get rid of
 521 the hosts subtree and move all its content into the DHCP Config tree
 522 (which probably should be renamed to be more related to the new
 523 content.  I suspect cn=dnsdhcp,ou=services or something like that
 524 might be a good place to put it.</p>
 525
 526 <p>If you want to help out with implementing this for Debian Edu,
 527 please contact us on debian-edu@lists.debian.org.</p>
 528 </div>
 529   <div class="tags">
 530
 531
 532
 533    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 534
 535   </div>
 536  </div>
 537  <div class="padding"></div>
 538
 539  <div class="entry">
 540   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a></div>
 541   <div class="date">2010-07-11 22:00</div>
 542   <div class="body">
 543 <p>Vagrant mentioned on IRC today that ltsp_config now support
 544 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
 545 clients, and that this can be used to fetch configuration from LDAP if
 546 Debian Edu choose to store configuration there.</p>
 547
 548 <p>Armed with this information, I got inspired and wrote a test module
 549 to get configuration from LDAP.  The idea is to look up the MAC
 550 address of the client in LDAP, and look for attributes on the form
 551 ltspconfigsetting=value, and use this to export SETTING=value to the
 552 LTSP clients.</p>
 553
 554 <p>The goal is to be able to store the LTSP configuration attributes
 555 in a "computer" LDAP object used by both DNS and DHCP, and thus
 556 allowing us to store all information about a computer in one place.</p>
 557
 558 <p>This is a untested draft implementation, and I welcome feedback on
 559 this approach.  A real LDAP schema for the ltspClientAux objectclass
 560 need to be written.  Comments, suggestions, etc?</p>
 561
 562 <blockquote><pre>
 563 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
 564 #
 565 # Fetch LTSP client settings from LDAP based on MAC address
 566 #
 567 # Uses ethernet address as stored in the dhcpHost objectclass using
 568 # the dhcpHWAddress attribute or ethernet address stored in the
 569 # ieee802Device objectclass with the macAddress attribute.
 570 #
 571 # This module is written to be schema agnostic, and only depend on the
 572 # existence of attribute names.
 573 #
 574 # The LTSP configuration variables are saved directly using a
 575 # ltspConfig prefix and uppercasing the rest of the attribute name.
 576 # To set the SERVER variable, set the ltspConfigServer attribute.
 577 #
 578 # Some LDAP schema should be created with all the relevant
 579 # configuration settings.  Something like this should work:
 580 #
 581 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
 582 #     SUP top
 583 #     AUXILIARY
 584 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
 585
 586 LDAPSERVER=$(debian-edu-ldapserver)
 587 if [ "$LDAPSERVER" ] ; then
 588     LDAPBASE=$(debian-edu-ldapserver -b)
 589     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
 590         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
 591         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
 592             grep '^ltspConfig' | while read attr value ; do
 593             # Remove prefix and convert to upper case
 594             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
 595             # bass value on to clients
 596             eval "$attr=$value; export $attr"
 597         done
 598     done
 599 fi
 600 </pre></blockquote>
 601
 602 <p>I'm not sure this shell construction will work, because I suspect
 603 the while block might end up in a subshell causing the variables set
 604 there to not show up in ltsp-config, but if that is the case I am sure
 605 the code can be restructured to make sure the variables are passed on.
 606 I expect that can be solved with some testing. :)</p>
 607
 608 <p>If you want to help out with implementing this for Debian Edu,
 609 please contact us on debian-edu@lists.debian.org.</p>
 610
 611 <p>Update 2010-07-17: I am aware of another effort to store LTSP
 612 configuration in LDAP that was created around year 2000 by
 613 <a href="http://www.pcxperience.com/thinclient/documentation/ldap.html">PC
 614 Xperience, Inc., 2000</a>.  I found its
 615 <a href="http://people.redhat.com/alikins/ltsp/ldap/">files</a> on a
 616 personal home page over at redhat.com.</p>
 617 </div>
 618   <div class="tags">
 619
 620
 621
 622    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 623
 624   </div>
 625  </div>
 626  <div class="padding"></div>
 627
 628  <div class="entry">
 629   <div class="title"><a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a></div>
 630   <div class="date">2010-07-09 12:55</div>
 631   <div class="body">
 632 <p>Since
 633 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
 634 last post</a> about available LDAP tools in Debian, I was told about a
 635 LDAP GUI that is even better than luma.  The java application
 636 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
 637 moving LDAP objects and subtrees using drag-and-drop, and can
 638 authenticate using Kerberos.  I have only tested the Kerberos
 639 authentication, but do not have a LDAP setup allowing me to rewrite
 640 LDAP with my test user yet.  It is
 641 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
 642 Debian</a> testing and unstable at the moment.  The only problem I
 643 have with it is how it handle errors.  If something go wrong, its
 644 non-intuitive behaviour require me to go through some query work list
 645 and remove the failing query.  Nothing big, but very annoying.</p>
 646 </div>
 647   <div class="tags">
 648
 649
 650
 651    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 652
 653   </div>
 654  </div>
 655  <div class="padding"></div>
 656
 657  <div class="entry">
 658   <div class="title"><a href="http://people.skolelinux.org/pere/blog/MS_Word_kr__ller_det_til_for_politiet_.html">MS Word krøller det til for politiet?</a></div>
 659   <div class="date">2010-07-08 14:00</div>
 660   <div class="body">
 661 <p>De siste dagene har Aftenposten
 662 <a href="http://www.aftenposten.no/nyheter/iriks/article3718597.ece">fortalt</a>
 663 <a href="http://www.aftenposten.no/nyheter/iriks/article3724249.ece">hvordan</a>
 664 politet har brukt skriveverktøy som ikke håndterer arabisk tekst og
 665 tekst som skal skrives fra høyre mot venstre når de har laget
 666 løpeseddel for å be om informasjon fra publikum.  Resultatet har vært
 667 en uleselig arabisk-bit på løpeseddelen.  Feilen har oppstått når
 668 teksten har blitt "kopiert inn i programvare som ikke har støtte for
 669 språk som skrives fra høyre mot venstre", og jeg er ganske sikker på
 670 at det er snakk om Microsoft Office i dette tilfellet.  Er det slik at
 671 MS Office i norsk språkdrakt ikke har støtte for tekst som skal
 672 skrives fra høyre mot venstre?  Jeg tror alle utgaver av
 673 OpenOffice.org har slik støtte, og det er jo ikke veldig vanskelig å
 674 la slik støtte finnes i alle utgaver av et program hvis støtten først
 675 er utviklet.  Aftenpostens melding får meg til å undre om problemet
 676 ville vært unngått hvis politiet brukte OpenOffice.org i stedet for MS
 677 Office.</p>
 678
 679 <p>Mon tro om det er flere eksempler på at MS Office har ødelagt for
 680 offentlig myndighet?</p>
 681 </div>
 682   <div class="tags">
 683
 684
 685
 686    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>.
 687
 688   </div>
 689  </div>
 690  <div class="padding"></div>
 691
 692  <div class="entry">
 693   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html">Lenny->Squeeze upgrades, apt vs aptitude with the Gnome desktop</a></div>
 694   <div class="date">2010-07-03 23:55</div>
 695   <div class="body">
 696 <p>Here is a short update on my <a
 697 href="http://people.skolelinux.org/~pere/debian-upgrade-testing/">my
 698 Debian Lenny->Squeeze upgrade testing</a>.  Here is a summary of the
 699 difference for Gnome when it is upgraded by apt-get and aptitude.  I'm
 700 not reporting the status for KDE, because the upgrade crashes when
 701 aptitude try because of missing conflicts
 702 (<a href="http://bugs.debian.org/584861">#584861</a> and
 703 <a href="http://bugs.debian.org/585716">#585716</a>).</p>
 704
 705 <p>At the end of the upgrade test script, dpkg -l is executed to get a
 706 complete list of the installed packages.  Based on this I see these
 707 differences when I did a test run today.  As usual, I do not really
 708 know what the correct set of packages would be, but thought it best to
 709 publish the difference.</p>
 710
 711 <p>Installed using apt-get, missing with aptitude</p>
 712
 713 <blockquote><p>
 714   at-spi cpp-4.3 finger gnome-spell gstreamer0.10-gnomevfs
 715   libatspi1.0-0 libcupsys2 libeel2-data libgail-common libgdl-1-common
 716   libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin
 717   libgtksourceview-common libpt-1.10.10-plugins-alsa
 718   libpt-1.10.10-plugins-v4l libservlet2.4-java libxalan2-java
 719   libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip
 720   python-4suite-xml python-eggtrayicon python-gtkhtml2
 721   python-gtkmozembed svgalibg1 xserver-xephyr zip
 722 </p></blockquote>
 723
 724 <p>Installed using apt-get, removed with aptitude</p>
 725
 726 <blockquote><p>
 727   bluez-utils dhcdbd djvulibre-desktop epiphany-gecko
 728   gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager
 729   libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-50
 730   libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcurl3
 731   libdirectfb-1.0-0 libdvdread3 libedata-cal1.2-6 libedataserver1.2-9
 732   libeel2-2.20 libepc-1.0-1 libepc-ui-1.0-1 libexchange-storage1.2-3
 733   libfaad0 libgd2-noxpm libgda3-3 libgda3-common libggz2 libggzcore9
 734   libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnome-desktop-2
 735   libgnome-pilot2 libgnomecups1.0-1 libgnomeprint2.2-0
 736   libgnomeprintui2.2-0 libgpod3 libgraphviz4 libgtkhtml2-0
 737   libgtksourceview1.0-0 libgucharmap6 libhesiod0 libicu38 libisccc50
 738   libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++10
 739   libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4
 740   libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5
 741   libparted1.8-10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3
 742   libpt-1.10.10 libraw1394-8 libsensors3 libsmbios2 libsoup2.2-8
 743   libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1
 744   libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj
 745   libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3
 746   mysql-common swfdec-gnome totem-gstreamer wodim
 747 </p></blockquote>
 748
 749 <p>Installed using aptitude, missing with apt-get</p>
 750
 751 <blockquote><p>
 752   gnome gnome-desktop-environment hamster-applet python-gnomeapplet
 753   python-gnomekeyring python-wnck rhythmbox-plugins xorg
 754   xserver-xorg-input-all xserver-xorg-input-evdev
 755   xserver-xorg-input-kbd xserver-xorg-input-mouse
 756   xserver-xorg-input-synaptics xserver-xorg-video-all
 757   xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati
 758   xserver-xorg-video-chips xserver-xorg-video-cirrus
 759   xserver-xorg-video-dummy xserver-xorg-video-fbdev
 760   xserver-xorg-video-glint xserver-xorg-video-i128
 761   xserver-xorg-video-i740 xserver-xorg-video-mach64
 762   xserver-xorg-video-mga xserver-xorg-video-neomagic
 763   xserver-xorg-video-nouveau xserver-xorg-video-nv
 764   xserver-xorg-video-r128 xserver-xorg-video-radeon
 765   xserver-xorg-video-radeonhd xserver-xorg-video-rendition
 766   xserver-xorg-video-s3 xserver-xorg-video-s3virge
 767   xserver-xorg-video-savage xserver-xorg-video-siliconmotion
 768   xserver-xorg-video-sis xserver-xorg-video-sisusb
 769   xserver-xorg-video-tdfx xserver-xorg-video-tga
 770   xserver-xorg-video-trident xserver-xorg-video-tseng
 771   xserver-xorg-video-vesa xserver-xorg-video-vmware
 772   xserver-xorg-video-voodoo
 773 </p></blockquote>
 774
 775 <p>Installed using aptitude, removed with apt-get</p>
 776
 777 <blockquote><p>
 778   deskbar-applet xserver-xorg xserver-xorg-core
 779   xserver-xorg-input-wacom xserver-xorg-video-intel
 780   xserver-xorg-video-openchrome
 781 </p></blockquote>
 782
 783 <p>I was told on IRC that the xorg-xserver package was
 784 <a href="http://git.debian.org/?p=pkg-xorg/xserver/xorg-server.git;a=commit;h=9c8080d06c457932d3bfec021c69ac000aa60120">changed
 785 in git</a> today to try to get apt-get to not remove xorg completely.
 786 No idea when it hits Squeeze, but when it does I hope it will reduce
 787 the difference somewhat.
 788 </div>
 789   <div class="tags">
 790
 791
 792
 793    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 794
 795   </div>
 796  </div>
 797  <div class="padding"></div>
 798
 799  <div class="entry">
 800   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a></div>
 801   <div class="date">2010-07-01 11:40</div>
 802   <div class="body">
 803 <p>For a laptop, centralized user directories and password checking is
 804 a bit troubling.  Laptops are typically used also when not connected
 805 to the network, and it is vital for a user to be able to log in or
 806 unlock the screen saver also when a central server is unavailable.
 807 This is possible by caching passwords and directory information (user
 808 and group attributes) locally, and the packages to do so are available
 809 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
 810 It is also possible to set up in Debian/Lenny, but require more manual
 811 setup there because pam-auth-update is missing in Lenny.</p>
 812
 813 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
 814
 815 This is the traditional method with a twist.  The password caching is
 816 provided by libpam-ccreds (version 10-4 or later is needed on
 817 Squeeze), and the directory caching is done by nscd.  The directory
 818 lookup and password checking is done using LDAP.  If one want to use
 819 Kerberos for password checking the libpam-ldapd package can be
 820 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
 821 local home directory with the path listed in LDAP, one can use the
 822 pam_mkhomedir module from pam-modules to make this happen instead of
 823 using libpam-mklocaluser.  A setup for pam-auth-update to enable
 824 pam_mkhomedir will have to be written until a fix for
 825 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
 826 archive.  Because I believe it is a bad idea to have local home
 827 directories using misleading paths like /site/server/partition/, I
 828 prefer to create a local user with the home directory in /home/.  This
 829 is done using the libpam-mklocaluser package.</p>
 830
 831 <p>These packages need to be installed and configured</p>
 832
 833 <blockquote><pre>
 834 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
 835 </pre></blockquote>
 836
 837 <p>The ldapd packages will ask for LDAP connection information, and
 838 one have to fill in the values that fits ones own site.  Make sure the
 839 PAM part uses encrypted connections, to make sure the password is not
 840 sent in clear text to the LDAP server.  I've been unable to get TLS
 841 certificate checking for a self signed certificate working, which make
 842 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
 843 is talking to the correct LDAP server), and very much welcome feedback
 844 on how to get this working.</p>
 845
 846 <p>Because nscd do not have a default configuration fit for offline
 847 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
 848 is fixed, this configuration should be used instead of the one
 849 currently in /etc/nscd.conf.  The changes are in the fields
 850 reload-count and positive-time-to-live, and is based on the
 851 instructions I found in the
 852 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
 853 instructions by Flyn Computing.</p>
 854
 855 <blockquote><pre>
 856         debug-level             0
 857         reload-count            unlimited
 858         paranoia                no
 859
 860         enable-cache            passwd          yes
 861         positive-time-to-live   passwd          2592000
 862         negative-time-to-live   passwd          20
 863         suggested-size          passwd          211
 864         check-files             passwd          yes
 865         persistent              passwd          yes
 866         shared                  passwd          yes
 867         max-db-size             passwd          33554432
 868         auto-propagate          passwd          yes
 869
 870         enable-cache            group           yes
 871         positive-time-to-live   group           2592000
 872         negative-time-to-live   group           20
 873         suggested-size          group           211
 874         check-files             group           yes
 875         persistent              group           yes
 876         shared                  group           yes
 877         max-db-size             group           33554432
 878         auto-propagate          group           yes
 879
 880         enable-cache            hosts           no
 881         positive-time-to-live   hosts           2592000
 882         negative-time-to-live   hosts           20
 883         suggested-size          hosts           211
 884         check-files             hosts           yes
 885         persistent              hosts           yes
 886         shared                  hosts           yes
 887         max-db-size             hosts           33554432
 888
 889         enable-cache            services        yes
 890         positive-time-to-live   services        2592000
 891         negative-time-to-live   services        20
 892         suggested-size          services        211
 893         check-files             services        yes
 894         persistent              services        yes
 895         shared                  services        yes
 896         max-db-size             services        33554432
 897 </pre></blockquote>
 898
 899 <p>While we wait for a mechanism to update /etc/nsswitch.conf
 900 automatically like the one provided in
 901 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
 902 content need to be manually replaced to ensure LDAP is used as the
 903 directory service on the machine.  /etc/nsswitch.conf should normally
 904 look like this:</p>
 905
 906 <blockquote><pre>
 907 passwd:         files ldap
 908 group:          files ldap
 909 shadow:         files ldap
 910 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 911 networks:       files
 912 protocols:      files
 913 services:       files
 914 ethers:         files
 915 rpc:            files
 916 netgroup:       files ldap
 917 </pre></blockquote>
 918
 919 <p>The important parts are that ldap is listed last for passwd, group,
 920 shadow and netgroup.</p>
 921
 922 <p>With these changes in place, any user in LDAP will be able to log
 923 in locally on the machine using for example kdm, get a local home
 924 directory created and have the password as well as user and group
 925 attributes cached.
 926
 927 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 928   libpam-mklocaluser/pam_mkhomedir</h2>
 929
 930 <p>Because nscd have had its share of problems, and seem to have
 931 problems doing proper caching, I've seen suggestions and recipes to
 932 use nss-updatedb to copy parts of the LDAP database locally when the
 933 LDAP database is available.  I have not tested such setup, because I
 934 discovered sssd.</p>
 935
 936 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
 937
 938 <p>A more flexible and robust setup than the nscd combination
 939 mentioned earlier that has shown up recently, is the
 940 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
 941 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
 942 to provide a Active Directory like directory service for Linux
 943 machines.  The sssd system combines the caching of passwords and user
 944 information into one package, and remove the need for nscd and
 945 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 946 1.2 do not support netgroups, but it is said that it will support this
 947 in version 1.5 expected to show up later in 2010.  Because the
 948 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
 949 was missing in Debian, I ended up co-maintaining it with Werner, and
 950 version 1.2 is now in testing.
 951
 952 <p>These packages need to be installed and configured to get the
 953 roaming setup I want</p>
 954
 955 <blockquote><pre>
 956 libpam-sss libnss-sss libpam-mklocaluser
 957 </pre></blockquote>
 958
 959 The complete setup of sssd is done by editing/creating
 960 <tt>/etc/sssd/sssd.conf</tt>.
 961
 962 <blockquote><pre>
 963 [sssd]
 964 config_file_version = 2
 965 reconnection_retries = 3
 966 sbus_timeout = 30
 967 services = nss, pam
 968 domains = INTERN
 969
 970 [nss]
 971 filter_groups = root
 972 filter_users = root
 973 reconnection_retries = 3
 974
 975 [pam]
 976 reconnection_retries = 3
 977
 978 [domain/INTERN]
 979 enumerate = false
 980 cache_credentials = true
 981
 982 id_provider = ldap
 983 auth_provider = ldap
 984 chpass_provider = ldap
 985
 986 ldap_uri = ldap://ldap
 987 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 988 ldap_tls_reqcert = never
 989 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 990 </pre></blockquote>
 991
 992 <p>I got the same problem here with certificate checking.  Had to set
 993 "ldap_tls_reqcert = never" to get it working.</p>
 994
 995 <p>With the libnss-sss package in testing at the moment, the
 996 nsswitch.conf file is update automatically, so there is no need to
 997 modify it manually.</p>
 998
 999 <p>If you want to help out with implementing this for Debian Edu,
1000 please contact us on debian-edu@lists.debian.org.</p>
1001 </div>
1002   <div class="tags">
1003
1004
1005
1006    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1007
1008   </div>
1009  </div>
1010  <div class="padding"></div>
1011
1012  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
1013
1014 <div id="sidebar">
1015
1016
1017
1018
1019
1020 <h2>Archive</h2>
1021 <ul>
1022
1023 <li>2010
1024 <ul>
1025
1026 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
1027
1028 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
1029
1030 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1031
1032 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1033
1034 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1035
1036 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1037
1038 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (10)</a></li>
1039
1040 </ul></li>
1041
1042 <li>2009
1043 <ul>
1044
1045 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1046
1047 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1048
1049 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1050
1051 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1052
1053 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1054
1055 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1056
1057 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1058
1059 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1060
1061 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1062
1063 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1064
1065 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1066
1067 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1068
1069 </ul></li>
1070
1071 <li>2008
1072 <ul>
1073
1074 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1075
1076 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1077
1078 </ul></li>
1079
1080 </ul>
1081
1082
1083
1084 <h2>Tags</h2>
1085 <ul>
1086
1087  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
1088
1089  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1090
1091  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1092
1093  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
1094
1095  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (34)</a></li>
1096
1097  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (35)</a></li>
1098
1099  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (49)</a></li>
1100
1101  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
1102
1103  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (8)</a></li>
1104
1105  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (3)</a></li>
1106
1107  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
1108
1109  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
1110
1111  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1112
1113  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
1114
1115  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (71)</a></li>
1116
1117  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (86)</a></li>
1118
1119  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (14)</a></li>
1120
1121  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (14)</a></li>
1122
1123  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
1124
1125  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1126
1127  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (10)</a></li>
1128
1129  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
1130
1131  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
1132
1133  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
1134
1135  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
1136
1137  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
1138
1139  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (7)</a></li>
1140
1141 </ul>
1142
1143 </div>
1144
1145 <p style="text-align: right">
1146 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
1147 </p>
1148 </body>
1149 </html>