blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/No_hardcoded_config_on_Debian_Edu_clients.html">No hardcoded config on Debian Edu clients</a></div>
  24   <div class="date">2010-08-09 20:15</div>
  25   <div class="body">
  26 <p>As reported earlier, the last few days I have looked at how Debian
  27 Edu clients are configured, and tried to get rid of all hardcoded
  28 configuration settings on the clients.  I believe the work to be
  29 mostly done, and the clients seem to work just fine with dynamically
  30 generated configuration.</p>
  31
  32 <p>What is the point, you might ask?  The point is to allow a Debian
  33 Edu desktop to integrate into an existing network infrastructure
  34 without any manual configuration.</p>
  35
  36 <p>This is what happens when installing a Debian Edu client here at
  37 the University of Oslo using PXE.  With the PXE installation, I am
  38 asked for language (Norwegian Bokmål), locality (Norway) and keyboard
  39 layout (no-latin1), Debian Edu profile (Roaming Workstation), if I
  40 accept to reformat the hard drive (yes), if I want to submit info to
  41 popcon.debian.org (no) and root password (secret).  After answering
  42 these questions, the installer goes ahead and does its thing, and
  43 after around 50 minutes it is done.  I press enter to finish the
  44 installation, and the machine reboots into KDE.  When the machine is
  45 ready and kdm asks for login information, I enter my university
  46 username and password, am told by kdm that a local home directory has
  47 been created and that I must log in again, and finally log in with the
  48 same username and password to the KDE 4.4 desktop.  At no point during
  49 this process did it ask for university specific settings, and all the
  50 required configuration was dynamically detected using information
  51 fetched via DHCP and DNS.  The roaming workstation is now ready for
  52 use.</p>
  53
  54 <p>How was this done, you might wonder?  First of all, here is the
  55 list of things that need to be configured on the client to get it
  56 working properly out of the box:</p>
  57
  58 <ul>
  59 <li>IP address/netmask and DNS server.</li>
  60 <li>Web proxy URL.</li>
  61 <li>LDAP server for NSS directory information (user, group, etc).</li>
  62 <li>Kerberos server for PAM password checking.</li>
  63 <li>SMB mount point to access the network home directory. (*)</li>
  64 <li>Central syslog server to send syslog messages to. (*)</li>
  65 <li>Sitesummary collector URL to submit info to central server. (*)</li>
  66 </ul>
  67
  68 <p>(Hm, did I forget anything?  Let me knew if I did.)</p>
  69
  70 <p>The points marked (*) are not required to be able to use the
  71 machine, but needed to provide central storage and allowing system
  72 administrators to track their machines.  Since yesterday, everything
  73 but the sitesummary collector URL is dynamically discovered at boot
  74 and installation time in the svn version of Debian Edu.</p>
  75
  76 <p>The IP and DNS setup is fetched during boot using DHCP as usual.
  77 When a DHCP update arrives, the proxy setup is updated by looking for
  78 http://wpat/wpad.dat and using the content of this WPAD file to
  79 configure the http and ftp proxy in /etc/environment and
  80 /etc/apt/apt.conf.  I decided to update the proxy setup using a DHCP
  81 hook to ensure that the client stops using the Debian Edu proxy when
  82 it is moved outside the Debian Edu network, and instead uses any local
  83 proxy present on the new network when it moves around.</p>
  84
  85 <p>The DNS names of the LDAP, Kerberos and syslog server and related
  86 configuration are generated using DNS information at boot.  First the
  87 installer looks for a host named ldap in the current DNS domain.  If
  88 not found, it looks for _ldap._tcp SRV records in DNS instead.  If an
  89 LDAP server is found, its root DSE entry is requested and the
  90 attributes namingContexts and defaultNamingContext are used to
  91 determine which LDAP base to use for NSS.  If there are several
  92 namingContexts attibutes and the defaultNamingContext is present, that
  93 LDAP subtree is used as the base.  If defaultNamingContext is missing,
  94 the subtrees listed as namingContexts are searched in sequence for any
  95 object with class posixAccount or posixGroup, and the first one with
  96 such an object is used as the LDAP base.  For Kerberos, a similar
  97 search is done by first looking for a host named kerberos, and then
  98 for the _kerberos._tcp SRV record.  I've been unable to find a way to
  99 look up the Kerberos realm, so for this the upper case string of the
 100 current DNS domain is used.</p>
 101
 102 <p>For the syslog server, the hosts syslog and loghost are searched
 103 for, and the _syslog._udp SRV record is consulted if no such host is
 104 found.  This algorithm works for both Debian Edu and the University of
 105 Oslo.  A similar strategy would work for locating the sitesummary
 106 server, but have not been implemented yet.  I decided to fetch and
 107 save these settings during installation, to make sure moving to a
 108 different network does not change the set of users being allowed to
 109 log in nor the passwords required to log in.  Usernames and passwords
 110 will be cached by sssd when the user logs in on the Debian Edu
 111 network, and will not change as the laptop move around.  For a
 112 non-roaming machine, there is no caching, but given that it is
 113 supposed to stay in place it should not matter much.  Perhaps we
 114 should switch those to use sssd too?</p>
 115
 116 <p>The user's SMB mount point for the network home directory is
 117 located when the user logs in for the first time.  The LDAP server is
 118 consulted to look for the user's LDAP object and the sambaHomePath
 119 attribute is used if found.  If it isn't found, the home directory
 120 path fetched from NSS is used instead.  Assuming the path is of the
 121 form /site/server/directory/username, the second part is looked up in
 122 DNS and used to generate a SMB URL of the form
 123 smb://server.domain/username.  This algorithm works for both Debian
 124 edu and the University of Oslo.  Perhaps there are better attributes
 125 to use or a better algorithm that works for more sites, but this will
 126 do for now. :)</p>
 127
 128 <p>This work should make it easier to integrate the Debian Edu clients
 129 into any LDAP/Kerberos infrastructure, and make the current setup even
 130 more flexible than before.  I suspect it will also work for thin
 131 client servers, allowing one to easily set up LTSP and hook it into a
 132 existing network infrastructure, but I have not had time to test this
 133 yet.</p>
 134
 135 <p>If you want to help out with implementing these things for Debian
 136 Edu, please contact us on debian-edu@lists.debian.org.</p>
 137 </div>
 138   <div class="tags">
 139
 140
 141
 142    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 143
 144   </div>
 145  </div>
 146  <div class="padding"></div>
 147
 148  <div class="entry">
 149   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">Testing if a file system can be used for home directories...</a></div>
 150   <div class="date">2010-08-08 21:20</div>
 151   <div class="body">
 152 <p>A few years ago, I was involved in a project planning to use
 153 Windows file servers as home directory servers for Debian
 154 Edu/Skolelinux machines.  This was thought to be no problem, as the
 155 access would be through the SMB network file system protocol, and we
 156 knew other sites used SMB with unix and samba as the file server to
 157 mount home directories without any problems.  But, after months of
 158 struggling, we had to conclude that our goal was impossible.</p>
 159
 160 <p>The reason is simply that while SMB can be used for home
 161 directories when the file server is Samba running on Unix, this only
 162 work because of Samba have some extensions and the fact that the
 163 underlying file system is a unix file system.  When using a Windows
 164 file server, the underlying file system do not have POSIX semantics,
 165 and several programs will fail if the users home directory where they
 166 want to store their configuration lack POSIX semantics.</p>
 167
 168 <p>As part of this work, I wrote a small C program I want to share
 169 with you all, to replicate a few of the problematic applications (like
 170 OpenOffice.org and GCompris) and see if the file system was working as
 171 it should.  If you find yourself in spooky file system land, it might
 172 help you find your way out again.  This is the fs-test.c source:</p>
 173
 174 <pre>
 175 /*
 176  * Some tests to check the file system sematics.  Used to verify that
 177  * CIFS from a windows server do not work properly as a linux home
 178  * directory.
 179  * License: GPL v2 or later
 180  *
 181  * needs libsqlite3-dev and build-essential installed
 182  * compile with: gcc -Wall -lsqlite3 -DTEST_SQLITE fs-test.c -o fs-test
 183 */
 184
 185 #define _FILE_OFFSET_BITS 64
 186 #define _LARGEFILE_SOURCE 1
 187 #define _LARGEFILE64_SOURCE 1
 188
 189 #define _GNU_SOURCE /* for asprintf() */
 190
 191 #include &lt;errno.h>
 192 #include &lt;fcntl.h>
 193 #include &lt;stdio.h>
 194 #include &lt;string.h>
 195 #include &lt;stdlib.h>
 196 #include &lt;sys/file.h>
 197 #include &lt;sys/stat.h>
 198 #include &lt;sys/types.h>
 199 #include &lt;unistd.h>
 200
 201 #ifdef TEST_SQLITE
 202 /*
 203  * Test sqlite open, as done by gcompris require the libsqlite3-dev
 204  * package and linking with -lsqlite3.  A more low level test is
 205  * below.
 206  * See also &lt;URL: http://www.sqlite.org./faq.html#q5 >.
 207  */
 208 #include &lt;sqlite3.h>
 209 #define CREATE_TABLE_USERS                                              \
 210   "CREATE TABLE users (user_id INT UNIQUE, login TEXT, lastname TEXT, firstname TEXT, birthdate TEXT, class_id INT ); "
 211 int test_sqlite_open(void) {
 212   char *zErrMsg;
 213   char *name = "testsqlite.db";
 214   sqlite3 *db=NULL;
 215   unlink(name);
 216   int rc = sqlite3_open(name, &db);
 217   if( rc ){
 218     printf("error: sqlite open of %s failed: %s\n", name, sqlite3_errmsg(db));
 219     sqlite3_close(db);
 220     return -1;
 221   }
 222
 223   /* create tables */
 224   rc = sqlite3_exec(db,CREATE_TABLE_USERS, NULL,  0, &zErrMsg);
 225   if( rc != SQLITE_OK ){
 226     printf("error: sqlite table create failed: %s\n", zErrMsg);
 227     sqlite3_close(db);
 228     return -1;
 229   }
 230   printf("info: sqlite worked\n");
 231   sqlite3_close(db);
 232   return 0;
 233 }
 234 #endif /* TEST_SQLITE */
 235
 236 /*
 237  * Demonstrate locking issue found in gcompris using sqlite3.  This
 238  * work with ext3, but not with cifs server on Windows 2003.  This is
 239  * done in the sqlite3 library.
 240  * See also
 241  * &lt;URL:http://www.cygwin.com/ml/cygwin/2001-08/msg00854.html> and the
 242  * POSIX specification
 243  * &lt;URL:http://www.opengroup.org/onlinepubs/009695399/functions/fcntl.html>.
 244  */
 245 int test_gcompris_locking(void) {
 246   struct flock fl;
 247   char *name = "testsqlite.db";
 248   unlink(name);
 249   int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, 0644);
 250   printf("info: testing fcntl locking\n");
 251
 252   fl.l_whence = SEEK_SET;
 253   fl.l_pid    = getpid();
 254   printf("  Read-locking 1 byte from 1073741824");
 255   fl.l_start  = 1073741824;
 256   fl.l_len    = 1;
 257   fl.l_type   = F_RDLCK;
 258   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 259
 260   printf("  Read-locking 510 byte from 1073741826");
 261   fl.l_start  = 1073741826;
 262   fl.l_len    = 510;
 263   fl.l_type   = F_RDLCK;
 264   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 265
 266   printf("  Unlocking 1 byte from 1073741824");
 267   fl.l_start  = 1073741824;
 268   fl.l_len    = 1;
 269   fl.l_type   = F_UNLCK;
 270   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 271
 272   printf("  Write-locking 1 byte from 1073741824");
 273   fl.l_start  = 1073741824;
 274   fl.l_len    = 1;
 275   fl.l_type   = F_WRLCK;
 276   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 277
 278   printf("  Write-locking 510 byte from 1073741826");
 279   fl.l_start  = 1073741826;
 280   fl.l_len    = 510;
 281   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 282
 283   printf("  Unlocking 2 byte from 1073741824");
 284   fl.l_start  = 1073741824;
 285   fl.l_len    = 2;
 286   fl.l_type   = F_UNLCK;
 287   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 288
 289   close(fd);
 290   return 0;
 291 }
 292
 293 /*
 294  * Test if permissions of freshly created directories allow entries
 295  * below them.  This was a problem with OpenOffice.org and gcompris.
 296  * Mounting with option 'sync' seem to solve this problem while
 297  * slowing down file operations.
 298  */
 299 int test_subdirectory_creation(void) {
 300 #define LEVELS 5
 301   char *path = strdup("test");
 302   char *dirs[LEVELS];
 303   int level;
 304   printf("info: testing subdirectory creation\n");
 305   for (level = 0; level &lt; LEVELS; level++) {
 306     char *newpath = NULL;
 307     if (-1 == mkdir(path, 0777)) {
 308       printf("  error: Unable to create directory '%s': %s\n",
 309              path, strerror(errno));
 310       break;
 311     }
 312     asprintf(&newpath, "%s/%s", path, "test");
 313     free(path);
 314     path = newpath;
 315   }
 316   return 0;
 317 }
 318
 319 /*
 320  * Test if symlinks can be created.  This was a problem detected with
 321  * KDE.
 322  */
 323 int test_symlinks(void) {
 324   printf("info: testing symlink creation\n");
 325   unlink("symlink");
 326   if (-1 == symlink("file", "symlink"))
 327     printf("  error: Unable to create symlink\n");
 328   return 0;
 329 }
 330
 331 int main(int argc, char **argv) {
 332   printf("Testing POSIX/Unix sematics on file system\n");
 333   test_symlinks();
 334   test_subdirectory_creation();
 335 #ifdef TEST_SQLITE
 336   test_sqlite_open();
 337 #endif /* TEST_SQLITE */
 338   test_gcompris_locking();
 339   return 0;
 340 }
 341 </pre>
 342
 343 <p>When everything is working, it should print something like
 344 this:</p>
 345
 346 <pre>
 347 Testing POSIX/Unix sematics on file system
 348 info: testing symlink creation
 349 info: testing subdirectory creation
 350 info: sqlite worked
 351 info: testing fcntl locking
 352   Read-locking 1 byte from 1073741824
 353   Read-locking 510 byte from 1073741826
 354   Unlocking 1 byte from 1073741824
 355   Write-locking 1 byte from 1073741824
 356   Write-locking 510 byte from 1073741826
 357   Unlocking 2 byte from 1073741824
 358 </pre>
 359
 360 <p>I do not remember the exact details of the problems we saw, but one
 361 of them was with locking, where if I remember correctly, POSIX allow a
 362 read-only lock to be upgraded to a read-write lock without unlocking
 363 the read-only lock (while Windows do not).  Another was a bug in the
 364 CIFS/SMB client implementation in the Linux kernel where directory
 365 meta information would be wrong for a fraction of a second, making
 366 OpenOffice.org fail to create its deep directory tree because it was
 367 not allowed to create files in its freshly created directory.</p>
 368
 369 <p>Anyway, here is a nice tool for your tool box, might you never need
 370 it. :)</p>
 371 </div>
 372   <div class="tags">
 373
 374
 375
 376    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 377
 378   </div>
 379  </div>
 380  <div class="padding"></div>
 381
 382  <div class="entry">
 383   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html">Autodetecting Client setup for roaming workstations in Debian Edu</a></div>
 384   <div class="date">2010-08-07 14:45</div>
 385   <div class="body">
 386 <p>A few days ago, I
 387 <a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">tried
 388 to install</a> a Roaming workation profile from Debian Edu/Squeeze
 389 while on the university network here at the University of Oslo, and
 390 noticed how much had to change to get it operational using the
 391 university infrastructure.  It was fairly easy, but it occured to me
 392 that Debian Edu would improve a lot if I could get the client to
 393 connect without any changes at all, and thus let the client configure
 394 itself during installation and first boot to use the infrastructure
 395 around it.  Now I am a huge step further along that road.</p>
 396
 397 <p>With our current squeeze-test packages, I can select the roaming
 398 workstation profile and get a working laptop connecting to the
 399 university LDAP server for user and group and our active directory
 400 servers for Kerberos authentication.  All this without any
 401 configuration at all during installation.  My users home directory got
 402 a bookmark in the KDE menu to mount it via SMB, with the correct URL.
 403 In short, openldap and sssd is correctly configured.  In addition to
 404 this, the client look for http://wpad/wpad.dat to configure a web
 405 proxy, and when it fail to find it no proxy settings are stored in
 406 /etc/environment and /etc/apt/apt.conf.  Iceweasel and KDE is
 407 configured to look for the same wpad configuration and also do not use
 408 a proxy when at the university network.  If the machine is moved to a
 409 network with such wpad setup, it would automatically use it when DHCP
 410 gave it a IP address.</p>
 411
 412 <p>The LDAP server is located using DNS, by first looking for the DNS
 413 entry ldap.$domain.  If this do not exist, it look for the
 414 _ldap._tcp.$domain SRV records and use the first one as the LDAP
 415 server.  Next, it connects to the LDAP server and search all
 416 namingContexts entries for posixAccount or posixGroup objects, and
 417 pick the first one as the LDAP base.  For Kerberos, a similar
 418 algorithm is used to locate the LDAP server, and the realm is the
 419 uppercase version of $domain.</p>
 420
 421 <p>So, what is not working, you might ask.  SMB mounting my home
 422 directory do not work.  No idea why, but suspected the incorrect
 423 Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
 424 the cause.  These are not properly configured during installation, and
 425 had to be hand-edited to get the correct Kerberos realm and server,
 426 but SMB mounting still do not work. :(</p>
 427
 428 <p>With this automatic configuration in place, I expect a Debian Edu
 429 roaming profile installation would be able to automatically detect and
 430 connect to any site using LDAP and Kerberos for NSS directory and PAM
 431 authentication.  It should also work out of the box in a Active
 432 Directory environment providing posixAccount and posixGroup objects
 433 with UID and GID values.</p>
 434
 435 <p>If you want to help out with implementing these things for Debian
 436 Edu, please contact us on debian-edu@lists.debian.org.</p>
 437 </div>
 438   <div class="tags">
 439
 440
 441
 442    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 443
 444   </div>
 445  </div>
 446  <div class="padding"></div>
 447
 448  <div class="entry">
 449   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">Debian Edu roaming workstation - at the university of Oslo</a></div>
 450   <div class="date">2010-08-03 23:30</div>
 451   <div class="body">
 452 <p>The new roaming workstation profile in Debian Edu/Squeeze is fairly
 453 similar to the laptop setup am I working on using Ubuntu for the
 454 University of Oslo, and just for the heck of it, I tested today how
 455 hard it would be to integrate that profile into the university
 456 infrastructure.  In this case, it is the university LDAP server,
 457 Active Directory Kerberos server and SMB mounting from the Netapp file
 458 servers.</p>
 459
 460 <p>I was pleasantly surprised that the only three files needed to be
 461 changed (/etc/sssd/sssd.conf, /etc/ldap.conf and
 462 /etc/mklocaluser.d/20-debian-edu-config) and one file had to be added
 463 (/usr/share/perl5/Debian/Edu_Local.pm), to get the client working.
 464 Most of the changes were to get the client to use the university LDAP
 465 for NSS and Kerberos server for PAM, but one was to change a hard
 466 coded DNS domain name in the mklocaluser hook from .intern to
 467 .uio.no.</p>
 468
 469 <p>This testing was so encouraging, that I went ahead and adjusted the
 470 Debian Edu scripts and setup in subversion to centralise the roaming
 471 workstation setup a bit more and avoid the hardcoded DNS domain name,
 472 so that when I test this tomorrow, I expect to get away with modifying
 473 only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the
 474 university servers.</p>
 475
 476 <p>My goal is to get the clients to have no hardcoded settings and
 477 fetch all their initial setup during installation and first boot, to
 478 allow them to be inserted also into environments where the default
 479 setup in Debian Edu has been changed or as with the university, where
 480 the environment is different but provides the protocols Debian Edu
 481 uses.</p>
 482 </div>
 483   <div class="tags">
 484
 485
 486
 487    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 488
 489   </div>
 490  </div>
 491  <div class="padding"></div>
 492
 493  <div class="entry">
 494   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html">Circular package dependencies harms apt recovery</a></div>
 495   <div class="date">2010-07-27 23:50</div>
 496   <div class="body">
 497 <p>I discovered this while doing
 498 <a href="http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html">automated
 499 testing of upgrades from Debian Lenny to Squeeze</a>.  A few packages
 500 in Debian still got circular dependencies, and it is often claimed
 501 that apt and aptitude should be able to handle this just fine, but
 502 some times these dependency loops causes apt to fail.</p>
 503
 504 <p>An example is from todays
 505 <a href="http://people.skolelinux.org/~pere/debian-upgrade-testing//test-20100727-lenny-squeeze-kde-aptitude.txt">upgrade
 506 of KDE using aptitude</a>.  In it, a bug in kdebase-workspace-data
 507 causes perl-modules to fail to upgrade.  The cause is simple.  If a
 508 package fail to unpack, then only part of packages with the circular
 509 dependency might end up being unpacked when unpacking aborts, and the
 510 ones already unpacked will fail to configure in the recovery phase
 511 because its dependencies are unavailable.</p>
 512
 513 <p>In this log, the problem manifest itself with this error:</p>
 514
 515 <blockquote><pre>
 516 dpkg: dependency problems prevent configuration of perl-modules:
 517  perl-modules depends on perl (>= 5.10.1-1); however:
 518   Version of perl on system is 5.10.0-19lenny2.
 519 dpkg: error processing perl-modules (--configure):
 520  dependency problems - leaving unconfigured
 521 </pre></blockquote>
 522
 523 <p>The perl/perl-modules circular dependency is already
 524 <a href="http://bugs.debian.org/527917">reported as a bug</a>, and will
 525 hopefully be solved as soon as possible, but it is not the only one,
 526 and each one of these loops in the dependency tree can cause similar
 527 failures.  Of course, they only occur when there are bugs in other
 528 packages causing the unpacking to fail, but it is rather nasty when
 529 the failure of one package causes the problem to become worse because
 530 of dependency loops.</p>
 531
 532 <p>Thanks to
 533 <a href="http://lists.debian.org/debian-devel/2010/06/msg00116.html">the
 534 tireless effort by Bill Allombert</a>, the number of circular
 535 dependencies
 536 <a href="http://debian.semistable.com/debgraph.out.html">left in Debian
 537 is dropping</a>, and perhaps it will reach zero one day. :)</p>
 538
 539 <p>Todays testing also exposed a bug in
 540 <a href="http://bugs.debian.org/590605">update-notifier</a> and
 541 <a href="http://bugs.debian.org/590604">different behaviour</a> between
 542 apt-get and aptitude, the latter possibly caused by some circular
 543 dependency.  Reported both to BTS to try to get someone to look at
 544 it.</p>
 545 </div>
 546   <div class="tags">
 547
 548
 549
 550    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 551
 552   </div>
 553  </div>
 554  <div class="padding"></div>
 555
 556  <div class="entry">
 557   <div class="title"><a href="http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html">First Debian Edu test release (alpha0) based on Squeeze is released</a></div>
 558   <div class="date">2010-07-27 17:45</div>
 559   <div class="body">
 560 <p>I just posted this announcement culminating several months of work
 561 with the next Debian Edu release.  Not nearly done, but one major step
 562 completed.</p>
 563
 564 <blockquote>
 565 <p>This is the first test release based on Squeeze. The focus of this
 566 release is to test the user application selection. To have a look,
 567 install the standalone profile and let the developers know if the set
 568 of installed packages i.e. applications should be modified. If some
 569 user application is missing, or if there are some applications that no
 570 longer make sense to be included in Debian Edu, please let us know.
 571 Also, if a useful application is missing the translation for your
 572 language of choice, please let us know too.</p>
 573
 574 <p>In addition, feedback and help to polish the desktop (menus,
 575 artwork, starters, etc.) is appreciated. We would like to ship a nice
 576 and handy KDE4 desktop targeted for schools out of the box.</p>
 577
 578 <p>The other profiles should be installable, but there is a lot more
 579 work left to be done before they are ready, so do not expect to
 580 much.</p>
 581
 582 <p>Changes compared to the lenny based version</p>
 583
 584 <ul>
 585 <li>Everything from Debian Squeeze
 586 <ul>
 587   <li>Desktop environment KDE 4.4 => the new KDE desktop in
 588          combination with some new artwork
 589   <li>Web browser Iceweasel 3.5
 590   <li>OpenOffice.org 3.2
 591   <li>Educational toolbox GCompris 9.3
 592   <li>Music creator Rosegarden 10.04.2
 593   <li>Image editor Gimp 2.6.10
 594   <li>Virtual universe Celestia 1.6.0
 595   <li>Virtual stargazer Stellarium 0.10.4
 596   <li>3D modeler Blender 2.49.2 (new application)
 597   <li>Video editor Kdenlive 0.7.7 (new application)
 598 </ul></li>
 599 <li>Now using Kerberos for password checking (migration not finished).
 600     Enabled for:
 601 <ul>
 602   <li>PAM
 603   <li>LDAP
 604   <li>IMAP
 605   <li>SMTP (sender verification)
 606 </ul>
 607 </li>
 608 <li>New experimental roaming workstation profile for laptops.</li>
 609 <li>Show welcome page to users when they first log in. The URL is
 610     fetched from LDAP.</li>
 611 <li>New LXDE desktop option, in addition to KDE (default) and Gnome.</li>
 612 <li>General cleanup (not finished)</li>
 613 </ul>
 614 <p>The following features are not working as they should</p>
 615
 616 <ul>
 617 <li>No web based administration tool for creating users and groups. The
 618     scripts ldap-createuser-krb and ldap-add-user-to-group can be used
 619     for testing.</li>
 620 <li>DVD installs are missing debian-installer images for the PXE boot,
 621     and do not set up the PXE menu on eth0 because of this. LTSP
 622     clients should still boot from eth1 on thin client servers.</li>
 623 <li>The restructured KDE menu is not implemented.</li>
 624 <li>The LDAP server setup need to be reviewed for security.</li>
 625 <li>The LDAP directory structure need to be reworked.</li>
 626 <li>Different sets of packages are installed when using the DVD and the
 627     netinst CD. More packages are installed using the netinst CD.</li>
 628 <li>The jackd package fail to install. This is believed to be caused by
 629     some ongoing transition, and hopefully should be solved soon. The
 630     jackd1 package can be installed manually for those that need it.</li>
 631 <li>Some packages lack translations. See
 632     http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status,
 633     and help out with translations.</li>
 634 </ul>
 635
 636 <p>To download this multiarch netinstall release you can use</p>
 637
 638 <ul>
 639 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
 640 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
 641 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</li>
 642 </ul>
 643 <p>To download this multiarch dvd release you can use</p>
 644
 645 <ul>
 646 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
 647 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
 648 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</li>
 649 </ul>
 650
 651 <p>There is no source DVD available yet. It will be prepared when we
 652 get closer to the final release.</p>
 653
 654 <p>The MD5SUM of these images are</p>
 655
 656 <ul>
 657 <li>3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-6.0.0+edua0-CD.iso</li>
 658 <li>22f2cbfce281d1c6e478be452638675d debian-edu-6.0.0+edua0-DVD.iso</li>
 659 </ul>
 660
 661 <p>The SHA1SUM of these images are</p>
 662 <ul>
 663 <li>c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-6.0.0+edua0-CD.iso</li>
 664 <li>2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-6.0.0+edua0-DVD.iso</li>
 665 </ul>
 666 <p>How to report bugs:
 667 http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla</p>
 668
 669 <p>Please direct replies to debian-edu@lists.debian.org</p>
 670 </blockquote>
 671 </div>
 672   <div class="tags">
 673
 674
 675
 676    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 677
 678   </div>
 679  </div>
 680  <div class="padding"></div>
 681
 682  <div class="entry">
 683   <div class="title"><a href="http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html">One step closer to single signon in Debian Edu</a></div>
 684   <div class="date">2010-07-25 10:00</div>
 685   <div class="body">
 686 <p>The last few months me and the other Debian Edu developers have
 687 been working hard to get the Debian/Squeeze based version of Debian
 688 Edu/Skolelinux into shape.  This future version will use Kerberos for
 689 authentication, and services are slowly migrated to single signon,
 690 getting rid of password questions one at the time.</p>
 691
 692 <p>It will also feature a roaming workstation profile with local home
 693 directory, for laptops that are only some times on the Skolelinux
 694 network, and for this profile a shortcut is created in Gnome and KDE
 695 to gain access to the users home directory on the file server.  This
 696 shortcut uses SMB at the moment, and yesterday I had time to test if
 697 SMB mounting had started working in KDE after we added the cifs-utils
 698 package.  I was pleasantly surprised how well it worked.</p>
 699
 700 <p>Thanks to the recent changes to our samba configuration to get it
 701 to use Kerberos for authentication, there were no question about user
 702 password when mounting the SMB volume.  A simple click on the shortcut
 703 in the KDE menu, and a window with the home directory popped
 704 up. :)</p>
 705
 706 <p>One step closer to a single signon solution out of the box in
 707 Debian Edu.  We already had PAM, LDAP, IMAP and SMTP in place, and now
 708 also Samba.  Next step is Cups and hopefully also NFS.</p>
 709
 710 <p>We had planned a alpha0 release of Debian Edu for today, but thanks
 711 to the autobuilder administrators for some architectures being slow to
 712 sign packages, we are still missing the fixed LTSP package we need for
 713 the release.  It was uploaded three days ago with urgency=high, and if
 714 it had entered testing yesterday we would have been able to test it in
 715 time for a alpha0 release today.  As the binaries for ia64 and powerpc
 716 still not uploaded to the Debian archive, we need to delay the alpha
 717 release another day.</p>
 718
 719 <p>If you want to help out with implementing Kerberos for Debian Edu,
 720 please contact us on debian-edu@lists.debian.org.</p>
 721 </div>
 722   <div class="tags">
 723
 724
 725
 726    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 727
 728   </div>
 729  </div>
 730  <div class="padding"></div>
 731
 732  <div class="entry">
 733   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til____slutte____kj__pe_musikk.html">Digitale restriksjonsmekanismer fikk meg til å slutte å kjøpe musikk</a></div>
 734   <div class="date">2010-07-22 23:50</div>
 735   <div class="body">
 736 <p>For mange år siden slutte jeg å kjøpe musikk-CDer. Årsaken var at
 737 musikkbransjen var godt i gang med å selge platene sine med DRM som
 738 gjorde at jeg ikke fikk spilt av musikken jeg kjøpte på utstyret jeg
 739 hadde tilgjengelig, dvs. min datamaskin. Det var umulig å se på en
 740 plate om den var ødelagt eller ikke, og jeg hadde jo allerede en
 741 anseelig samling med plater, så jeg bestemme meg for å slutte å gi
 742 penger til en bransje som åpenbart ikke respekterte meg.</p>
 743
 744 <p>Jeg har mange titalls dager med musikk på CD i dag. Det meste er
 745 lagt i et stort arkiv som kan spilles av fra husets datamaskiner (har
 746 ikke rukket rippe alt). Jeg ser dermed ikke behovet for å skaffe mer
 747 musikk. De fleste av mine favoritter er i hus, og jeg er dermed godt
 748 fornøyd.</p>
 749
 750 <p>Hvis musikkbransjen ønsker mine penger, så må de demonstrere at de
 751 setter pris på meg som kunde, og ikke skremme meg bort med DRM og
 752 antydninger om at kundene er kriminelle.</p>
 753
 754 <p>Filmbransjen er like ille, men mens musikk gjerne varer lenge, er
 755 filmer mer ferskvare. Har dermed ikke helt sluttet å kjøpe filmer, men
 756 holder meg til DVD-filmer som kan spilles av på mine Linuxbokser.
 757 Kommer neppe til å ta i bruk Blueray, og ei heller de nye DRM-greiene
 758 «Ultraviolet» som be annonsert her om dagen.</p>
 759 </div>
 760   <div class="tags">
 761
 762
 763
 764    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>.
 765
 766   </div>
 767  </div>
 768  <div class="padding"></div>
 769
 770  <div class="entry">
 771   <div class="title"><a href="http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html">OpenStreetmap one step closer to having routing on its front page</a></div>
 772   <div class="date">2010-07-18 16:45</div>
 773   <div class="body">
 774 <p>Thanks to
 775 <a href="http://feedproxy.google.com/~r/Opengeodata/~3/wUTCzDZk3lc/project-of-the-week-which-way-home">todays
 776 opengeodata blog entry</a>, I just discovered that the
 777 OpenStreetmap.org site have gotten
 778 <a href="http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT">support
 779 for calculating routes</a>.  The support is still experimental and
 780 only available from the development server, until more experience is
 781 gathered on the user interface and any scalability issues.</p>
 782
 783 <p>Earlier, the routing I knew about using the OpenStreetmap.org data
 784 was provided by <a href="http://maps.cloudmade.com/">Cloudmade</a>,
 785 but having it on the main page is required to make everyone aware of
 786 the issue.  I've had people reject Openstreetmap.org as a viable
 787 alternative for them because the front page lacked routing support,
 788 and I hope their needs will be catered for when routing show up on the
 789 www.openstreetmap.org front page.</p>
 790 </div>
 791   <div class="tags">
 792
 793
 794
 795    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/kart">kart</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 796
 797   </div>
 798  </div>
 799  <div class="padding"></div>
 800
 801  <div class="entry">
 802   <div class="title"><a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a></div>
 803   <div class="date">2010-07-17 21:00</div>
 804   <div class="body">
 805 <p>This is a
 806 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
 807 on my
 808 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
 809 work</a> on
 810 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
 811 all</a> the computer related LDAP objects in Debian Edu.</p>
 812
 813 <p>As a step to try to see if it possible to merge the DNS and DHCP
 814 LDAP objects, I have had a look at how the packages pdns-backend-ldap
 815 and dhcp3-server-ldap in Debian use the LDAP server.  The two
 816 implementations are quite different in how they use LDAP.</p>
 817
 818 To get this information, I started slapd with debugging enabled and
 819 dumped the debug output to a file to get the LDAP searches performed
 820 on a Debian Edu main-server.  Here is a summary.
 821
 822 <p><strong>powerdns</strong></p>
 823
 824 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
 825 on how to</a> set up PowerDNS to use a LDAP backend is available on
 826 the web.
 827
 828 <p>PowerDNS have two modes of operation using LDAP as its backend.
 829 One "strict" mode where the forward and reverse DNS lookups are done
 830 using the same LDAP objects, and a "tree" mode where the forward and
 831 reverse entries are in two different subtrees in LDAP with a structure
 832 based on the DNS names, as in tjener.intern and
 833 2.2.0.10.in-addr.arpa.</p>
 834
 835 <p>In tree mode, the server is set up to use a LDAP subtree as its
 836 base, and uses a "base" scoped search for the DNS name by adding
 837 "dc=tjener,dc=intern," to the base with a filter for
 838 "(associateddomain=tjener.intern)" for the forward entry and
 839 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
 840 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
 841 forward entries, it is looking for attributes named dnsttl, arecord,
 842 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
 843 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
 844 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
 845 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
 846 spfrecord and modifytimestamp.  For reverse entries it is looking for
 847 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
 848 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
 849 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
 850 ldapsearch commands could look like this:</p>
 851
 852 <blockquote><pre>
 853 ldapsearch -h ldap \
 854   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 855   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 856   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 857   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 858   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 859   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 860
 861 ldapsearch -h ldap \
 862   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 863   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
 864   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
 865   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
 866   srvrecord naptrrecord modifytimestamp
 867 </pre></blockquote>
 868
 869 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
 870 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
 871 example LDAP objects used there.  In addition to these objects, the
 872 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
 873 also exist.</p>
 874
 875 <blockquote><pre>
 876 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
 877 objectclass: top
 878 objectclass: dnsdomain
 879 objectclass: domainrelatedobject
 880 dc: tjener
 881 arecord: 10.0.2.2
 882 associateddomain: tjener.intern
 883
 884 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
 885 objectclass: top
 886 objectclass: dnsdomain2
 887 objectclass: domainrelatedobject
 888 dc: 2
 889 ptrrecord: tjener.intern
 890 associateddomain: 2.2.0.10.in-addr.arpa
 891 </pre></blockquote>
 892
 893 <p>In strict mode, the server behaves differently.  When looking for
 894 forward DNS entries, it is doing a "subtree" scoped search with the
 895 same base as in the tree mode for a object with filter
 896 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
 897 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
 898 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
 899 naptrrecord and modifytimestamp.  For reverse entires it also do a
 900 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
 901 and the requested attributes are associateddomain, dnsttl and
 902 modifytimestamp.  In short, in strict mode the objects with ptrrecord
 903 go away, and the arecord attribute in the forward object is used
 904 instead.</p>
 905
 906 <p>The forward and reverse searches can be simulated using ldapsearch
 907 like this:</p>
 908
 909 <blockquote><pre>
 910 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 911   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 912   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 913   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 914   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 915   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 916
 917 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 918   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
 919 </pre></blockquote>
 920
 921 <p>In addition to the forward and reverse searches , there is also a
 922 search for SOA records, which behave similar to the forward and
 923 reverse lookups.</p>
 924
 925 <p>A thing to note with the PowerDNS behaviour is that it do not
 926 specify any objectclass names, and instead look for the attributes it
 927 need to generate a DNS reply.  This make it able to work with any
 928 objectclass that provide the needed attributes.</p>
 929
 930 <p>The attributes are normally provided in the cosine (RFC 1274) and
 931 dnsdomain2 schemas.  The latter is used for reverse entries like
 932 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
 933
 934 <p>In Debian Edu, we have created DNS objects using the object classes
 935 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
 936 attributes) and domainrelatedobject (for associatedDomain).  The use
 937 of structural object classes make it impossible to combine these
 938 classes with the object classes used by DHCP.</p>
 939
 940 <p>There are other schemas that could be used too, for example the
 941 dnszone structural object class used by Gosa and bind-sdb for the DNS
 942 attributes combined with the domainrelatedobject object class, but in
 943 this case some unused attributes would have to be included as well
 944 (zonename and relativedomainname).</p>
 945
 946 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
 947 mode and not use any of the existing objectclasses (dnsdomain,
 948 dnsdomain2 and dnszone) when one want to combine the DNS information
 949 with DHCP information, and instead create a auxiliary object class
 950 defined something like this (using the attributes defined for
 951 dnsdomain and dnsdomain2 or dnszone):</p>
 952
 953 <blockquote><pre>
 954 objectclass ( some-oid NAME 'dnsDomainAux'
 955     SUP top
 956     AUXILIARY
 957     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
 958           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
 959           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
 960           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
 961           A6Record $ DNAMERecord
 962     ))
 963 </pre></blockquote>
 964
 965 <p>This will allow any object to become a DNS entry when combined with
 966 the domainrelatedobject object class, and allow any entity to include
 967 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
 968 developers asking for their view on this schema and if they are
 969 interested in providing such schema with PowerDNS, and I hope my
 970 message will be accepted into their mailing list soon.</p>
 971
 972 <p><strong>ISC dhcp</strong></p>
 973
 974 <p>The DHCP server searches for specific objectclass and requests all
 975 the object attributes, and then uses the attributes it want.  This
 976 make it harder to figure out exactly what attributes are used, but
 977 thanks to the working example in Debian Edu I can at least get an idea
 978 what is needed without having to read the source code.</p>
 979
 980 <p>In the DHCP server configuration, the LDAP base to use and the
 981 search filter to use to locate the correct dhcpServer entity is
 982 stored.  These are the relevant entries from
 983 /etc/dhcp3/dhcpd.conf:</p>
 984
 985 <blockquote><pre>
 986 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
 987 ldap-dhcp-server-cn "dhcp";
 988 </pre></blockquote>
 989
 990 <p>The DHCP server uses this information to nest all the DHCP
 991 configuration it need.  The cn "dhcp" is located using the given LDAP
 992 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
 993 search result is this entry:</p>
 994
 995 <blockquote><pre>
 996 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
 997 cn: dhcp
 998 objectClass: top
 999 objectClass: dhcpServer
1000 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
1001 </pre></blockquote>
1002
1003 <p>The content of the dhcpServiceDN attribute is next used to locate the
1004 subtree with DHCP configuration.  The DHCP configuration subtree base
1005 is located using a base scope search with base "cn=DHCP
1006 Config,dc=skole,dc=skolelinux,dc=no" and filter
1007 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
1008 The search result is this entry:</p>
1009
1010 <blockquote><pre>
1011 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
1012 cn: DHCP Config
1013 objectClass: top
1014 objectClass: dhcpService
1015 objectClass: dhcpOptions
1016 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
1017 dhcpStatements: ddns-update-style none
1018 dhcpStatements: authoritative
1019 dhcpOption: smtp-server code 69 = array of ip-address
1020 dhcpOption: www-server code 72 = array of ip-address
1021 dhcpOption: wpad-url code 252 = text
1022 </pre></blockquote>
1023
1024 <p>Next, the entire subtree is processed, one level at the time.  When
1025 all the DHCP configuration is loaded, it is ready to receive requests.
1026 The subtree in Debian Edu contain objects with object classes
1027 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
1028 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
1029 and information about netmasks, dynamic range etc.  Leaving out the
1030 details here because it is not relevant for the focus of my
1031 investigation, which is to see if it is possible to merge dns and dhcp
1032 related computer objects.</p>
1033
1034 <p>When a DHCP request come in, LDAP is searched for the MAC address
1035 of the client (00:00:00:00:00:00 in this example), using a subtree
1036 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
1037 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
1038 00:00:00:00:00:00))" as the filter.  This is what a host object look
1039 like:</p>
1040
1041 <blockquote><pre>
1042 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
1043 cn: hostname
1044 objectClass: top
1045 objectClass: dhcpHost
1046 dhcpHWAddress: ethernet 00:00:00:00:00:00
1047 dhcpStatements: fixed-address hostname
1048 </pre></blockquote>
1049
1050 <p>There is less flexiblity in the way LDAP searches are done here.
1051 The object classes need to have fixed names, and the configuration
1052 need to be stored in a fairly specific LDAP structure.  On the
1053 positive side, the invidiual dhcpHost entires can be anywhere without
1054 the DN pointed to by the dhcpServer entries.  The latter should make
1055 it possible to group all host entries in a subtree next to the
1056 configuration entries, and this subtree can also be shared with the
1057 DNS server if the schema proposed above is combined with the dhcpHost
1058 structural object class.
1059
1060 <p><strong>Conclusion</strong></p>
1061
1062 <p>The PowerDNS implementation seem to be very flexible when it come
1063 to which LDAP schemas to use.  While its "tree" mode is rigid when it
1064 come to the the LDAP structure, the "strict" mode is very flexible,
1065 allowing DNS objects to be stored anywhere under the base cn specified
1066 in the configuration.</p>
1067
1068 <p>The DHCP implementation on the other hand is very inflexible, both
1069 regarding which LDAP schemas to use and which LDAP structure to use.
1070 I guess one could implement ones own schema, as long as the
1071 objectclasses and attributes have the names used, but this do not
1072 really help when the DHCP subtree need to have a fairly fixed
1073 structure.</p>
1074
1075 <p>Based on the observed behaviour, I suspect a LDAP structure like
1076 this might work for Debian Edu:</p>
1077
1078 <blockquote><pre>
1079 ou=services
1080   cn=machine-info (dhcpService) - dhcpServiceDN points here
1081     cn=dhcp (dhcpServer)
1082     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
1083       cn=10.0.2.0 (dhcpSubnet)
1084         cn=group1 (dhcpGroup/dhcpOptions)
1085     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
1086       cn=192.168.0.0 (dhcpSubnet)
1087         cn=group1 (dhcpGroup/dhcpOptions)
1088     ou=machines - PowerDNS base points here
1089       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
1090 </pre></blockquote>
1091
1092 <P>This is not tested yet.  If the DHCP server require the dhcpHost
1093 entries to be in the dhcpGroup subtrees, the entries can be stored
1094 there instead of a common machines subtree, and the PowerDNS base
1095 would have to be moved one level up to the machine-info subtree.</p>
1096
1097 <p>The combined object under the machines subtree would look something
1098 like this:</p>
1099
1100 <blockquote><pre>
1101 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
1102 dc: hostname
1103 objectClass: top
1104 objectClass: dhcpHost
1105 objectclass: domainrelatedobject
1106 objectclass: dnsDomainAux
1107 associateddomain: hostname.intern
1108 arecord: 10.11.12.13
1109 dhcpHWAddress: ethernet 00:00:00:00:00:00
1110 dhcpStatements: fixed-address hostname.intern
1111 </pre></blockquote>
1112
1113 </p>One could even add the LTSP configuration associated with a given
1114 machine, as long as the required attributes are available in a
1115 auxiliary object class.</p>
1116 </div>
1117   <div class="tags">
1118
1119
1120
1121    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1122
1123   </div>
1124  </div>
1125  <div class="padding"></div>
1126
1127  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
1128
1129 <div id="sidebar">
1130
1131
1132
1133
1134
1135 <h2>Archive</h2>
1136 <ul>
1137
1138 <li>2010
1139 <ul>
1140
1141 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
1142
1143 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
1144
1145 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1146
1147 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1148
1149 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1150
1151 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1152
1153 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
1154
1155 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (4)</a></li>
1156
1157 </ul></li>
1158
1159 <li>2009
1160 <ul>
1161
1162 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1163
1164 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1165
1166 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1167
1168 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1169
1170 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1171
1172 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1173
1174 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1175
1176 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1177
1178 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1179
1180 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1181
1182 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1183
1184 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1185
1186 </ul></li>
1187
1188 <li>2008
1189 <ul>
1190
1191 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1192
1193 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1194
1195 </ul></li>
1196
1197 </ul>
1198
1199
1200
1201 <h2>Tags</h2>
1202 <ul>
1203
1204  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
1205
1206  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1207
1208  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1209
1210  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
1211
1212  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (35)</a></li>
1213
1214  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (40)</a></li>
1215
1216  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (55)</a></li>
1217
1218  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
1219
1220  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (8)</a></li>
1221
1222  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (3)</a></li>
1223
1224  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
1225
1226  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
1227
1228  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1229
1230  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
1231
1232  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (71)</a></li>
1233
1234  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (92)</a></li>
1235
1236  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (14)</a></li>
1237
1238  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (14)</a></li>
1239
1240  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
1241
1242  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1243
1244  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (10)</a></li>
1245
1246  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
1247
1248  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
1249
1250  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
1251
1252  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
1253
1254  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
1255
1256  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (7)</a></li>
1257
1258 </ul>
1259
1260 </div>
1261
1262 <p style="text-align: right">
1263 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
1264 </p>
1265 </body>
1266 </html>