blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a></div>
  24   <div class="date">2010-07-14 23:45</div>
  25   <div class="body">
  26 <p>For a while now, I have wanted to find a way to change the DNS and
  27 DHCP services in Debian Edu to use the same LDAP objects for a given
  28 computer, to avoid the possibility of having a inconsistent state for
  29 a computer in LDAP (as in DHCP but no DNS entry or the other way
  30 around) and make it easier to add computers to LDAP.</p>
  31
  32 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
  33 information finally found a solution that seem to work.</p>
  34
  35 <p>The old setup required three LDAP objects for a given computer.
  36 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
  37 we switch powerdns to use its strict LDAP method (ldap-method=strict
  38 in pdns-debian-edu.conf), the forward and reverse DNS entries are
  39 merged into one while making it impossible to transfer the reverse map
  40 to a slave DNS server.</p>
  41
  42 <p>If we also replace the object class used to get the DNS related
  43 attributes to one allowing these attributes to be combined with the
  44 dhcphost object class, we can merge the DNS and DHCP entries into one.
  45 I've written such object class in the dnsdomainaux.schema file (need
  46 proper OIDs, but that is a minor issue), and tested the setup.  It
  47 seem to work.</p>
  48
  49 <p>With this test setup in place, we can get away with one LDAP object
  50 for both DNS and DHCP, and even the LTSP configuration I suggested in
  51 an earlier email.  The combined LDAP object will look something like
  52 this:</p>
  53
  54 <blockquote><pre>
  55   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
  56   cn: hostname
  57   objectClass: dhcphost
  58   objectclass: domainrelatedobject
  59   objectclass: dnsdomainaux
  60   associateddomain: hostname.intern
  61   arecord: 10.11.12.13
  62   dhcphwaddress: ethernet 00:00:00:00:00:00
  63   dhcpstatements: fixed-address hostname
  64   ldapconfigsound: Y
  65 </pre></blockquote>
  66
  67 <p>The DNS server uses the associateddomain and arecord entries, while
  68 the DHCP server uses the dhcphwaddress and dhcpstatements entries
  69 before asking DNS to resolve the fixed-adddress.  LTSP will use
  70 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
  71
  72 <p>I am not yet sure if I can get the DHCP server to look for its
  73 dhcphost in a different location, to allow us to put the objects
  74 outside the "DHCP Config" subtree, but hope to figure out a way to do
  75 that.  If I can't figure out a way to do that, we can still get rid of
  76 the hosts subtree and move all its content into the DHCP Config tree
  77 (which probably should be renamed to be more related to the new
  78 content.  I suspect cn=dnsdhcp,ou=services or something like that
  79 might be a good place to put it.</p>
  80
  81 <p>If you want to help out with implementing this for Debian Edu,
  82 please contact us on debian-edu@lists.debian.org.</p>
  83 </div>
  84   <div class="tags">
  85
  86
  87
  88    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
  89
  90   </div>
  91  </div>
  92  <div class="padding"></div>
  93
  94  <div class="entry">
  95   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a></div>
  96   <div class="date">2010-07-11 22:00</div>
  97   <div class="body">
  98 <p>Vagrant mentioned on IRC today that ltsp_config now support
  99 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
 100 clients, and that this can be used to fetch configuration from LDAP if
 101 Debian Edu choose to store configuration there.</p>
 102
 103 <p>Armed with this information, I got inspired and wrote a test module
 104 to get configuration from LDAP.  The idea is to look up the MAC
 105 address of the client in LDAP, and look for attributes on the form
 106 ltspconfigsetting=value, and use this to export SETTING=value to the
 107 LTSP clients.</p>
 108
 109 <p>The goal is to be able to store the LTSP configuration attributes
 110 in a "computer" LDAP object used by both DNS and DHCP, and thus
 111 allowing us to store all information about a computer in one place.</p>
 112
 113 <p>This is a untested draft implementation, and I welcome feedback on
 114 this approach.  A real LDAP schema for the ltspClientAux objectclass
 115 need to be written.  Comments, suggestions, etc?</p>
 116
 117 <blockquote><pre>
 118 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
 119 #
 120 # Fetch LTSP client settings from LDAP based on MAC address
 121 #
 122 # Uses ethernet address as stored in the dhcpHost objectclass using
 123 # the dhcpHWAddress attribute or ethernet address stored in the
 124 # ieee802Device objectclass with the macAddress attribute.
 125 #
 126 # This module is written to be schema agnostic, and only depend on the
 127 # existence of attribute names.
 128 #
 129 # The LTSP configuration variables are saved directly using a
 130 # ltspConfig prefix and uppercasing the rest of the attribute name.
 131 # To set the SERVER variable, set the ltspConfigServer attribute.
 132 #
 133 # Some LDAP schema should be created with all the relevant
 134 # configuration settings.  Something like this should work:
 135 #
 136 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
 137 #     SUP top
 138 #     AUXILIARY
 139 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
 140
 141 LDAPSERVER=$(debian-edu-ldapserver)
 142 if [ "$LDAPSERVER" ] ; then
 143     LDAPBASE=$(debian-edu-ldapserver -b)
 144     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
 145         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
 146         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
 147             grep '^ltspConfig' | while read attr value ; do
 148             # Remove prefix and convert to upper case
 149             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
 150             # bass value on to clients
 151             eval "$attr=$value; export $attr"
 152         done
 153     done
 154 fi
 155 </pre></blockquote>
 156
 157 <p>I'm not sure this shell construction will work, because I suspect
 158 the while block might end up in a subshell causing the variables set
 159 there to not show up in ltsp-config, but if that is the case I am sure
 160 the code can be restructured to make sure the variables are passed on.
 161 I expect that can be solved with some testing. :)</p>
 162
 163 <p>If you want to help out with implementing this for Debian Edu,
 164 please contact us on debian-edu@lists.debian.org.</p>
 165 </div>
 166   <div class="tags">
 167
 168
 169
 170    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 171
 172   </div>
 173  </div>
 174  <div class="padding"></div>
 175
 176  <div class="entry">
 177   <div class="title"><a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a></div>
 178   <div class="date">2010-07-09 12:55</div>
 179   <div class="body">
 180 <p>Since
 181 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
 182 last post</a> about available LDAP tools in Debian, I was told about a
 183 LDAP GUI that is even better than luma.  The java application
 184 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
 185 moving LDAP objects and subtrees using drag-and-drop, and can
 186 authenticate using Kerberos.  I have only tested the Kerberos
 187 authentication, but do not have a LDAP setup allowing me to rewrite
 188 LDAP with my test user yet.  It is
 189 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
 190 Debian</a> testing and unstable at the moment.  The only problem I
 191 have with it is how it handle errors.  If something go wrong, its
 192 non-intuitive behaviour require me to go through some query work list
 193 and remove the failing query.  Nothing big, but very annoying.</p>
 194 </div>
 195   <div class="tags">
 196
 197
 198
 199    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 200
 201   </div>
 202  </div>
 203  <div class="padding"></div>
 204
 205  <div class="entry">
 206   <div class="title"><a href="http://people.skolelinux.org/pere/blog/MS_Word_kr__ller_det_til_for_politiet_.html">MS Word krøller det til for politiet?</a></div>
 207   <div class="date">2010-07-08 14:00</div>
 208   <div class="body">
 209 <p>De siste dagene har Aftenposten
 210 <a href="http://www.aftenposten.no/nyheter/iriks/article3718597.ece">fortalt</a>
 211 <a href="http://www.aftenposten.no/nyheter/iriks/article3724249.ece">hvordan</a>
 212 politet har brukt skriveverktøy som ikke håndterer arabisk tekst og
 213 tekst som skal skrives fra høyre mot venstre når de har laget
 214 løpeseddel for å be om informasjon fra publikum.  Resultatet har vært
 215 en uleselig arabisk-bit på løpeseddelen.  Feilen har oppstått når
 216 teksten har blitt "kopiert inn i programvare som ikke har støtte for
 217 språk som skrives fra høyre mot venstre", og jeg er ganske sikker på
 218 at det er snakk om Microsoft Office i dette tilfellet.  Er det slik at
 219 MS Office i norsk språkdrakt ikke har støtte for tekst som skal
 220 skrives fra høyre mot venstre?  Jeg tror alle utgaver av
 221 OpenOffice.org har slik støtte, og det er jo ikke veldig vanskelig å
 222 la slik støtte finnes i alle utgaver av et program hvis støtten først
 223 er utviklet.  Aftenpostens melding får meg til å undre om problemet
 224 ville vært unngått hvis politiet brukte OpenOffice.org i stedet for MS
 225 Office.</p>
 226
 227 <p>Mon tro om det er flere eksempler på at MS Office har ødelagt for
 228 offentlig myndighet?</p>
 229 </div>
 230   <div class="tags">
 231
 232
 233
 234    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>.
 235
 236   </div>
 237  </div>
 238  <div class="padding"></div>
 239
 240  <div class="entry">
 241   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html">Lenny->Squeeze upgrades, apt vs aptitude with the Gnome desktop</a></div>
 242   <div class="date">2010-07-03 23:55</div>
 243   <div class="body">
 244 <p>Here is a short update on my <a
 245 href="http://people.skolelinux.org/~pere/debian-upgrade-testing/">my
 246 Debian Lenny->Squeeze upgrade testing</a>.  Here is a summary of the
 247 difference for Gnome when it is upgraded by apt-get and aptitude.  I'm
 248 not reporting the status for KDE, because the upgrade crashes when
 249 aptitude try because of missing conflicts
 250 (<a href="http://bugs.debian.org/584861">#584861</a> and
 251 <a href="http://bugs.debian.org/585716">#585716</a>).</p>
 252
 253 <p>At the end of the upgrade test script, dpkg -l is executed to get a
 254 complete list of the installed packages.  Based on this I see these
 255 differences when I did a test run today.  As usual, I do not really
 256 know what the correct set of packages would be, but thought it best to
 257 publish the difference.</p>
 258
 259 <p>Installed using apt-get, missing with aptitude</p>
 260
 261 <blockquote><p>
 262   at-spi cpp-4.3 finger gnome-spell gstreamer0.10-gnomevfs
 263   libatspi1.0-0 libcupsys2 libeel2-data libgail-common libgdl-1-common
 264   libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin
 265   libgtksourceview-common libpt-1.10.10-plugins-alsa
 266   libpt-1.10.10-plugins-v4l libservlet2.4-java libxalan2-java
 267   libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip
 268   python-4suite-xml python-eggtrayicon python-gtkhtml2
 269   python-gtkmozembed svgalibg1 xserver-xephyr zip
 270 </p></blockquote>
 271
 272 <p>Installed using apt-get, removed with aptitude</p>
 273
 274 <blockquote><p>
 275   bluez-utils dhcdbd djvulibre-desktop epiphany-gecko
 276   gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager
 277   libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-50
 278   libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcurl3
 279   libdirectfb-1.0-0 libdvdread3 libedata-cal1.2-6 libedataserver1.2-9
 280   libeel2-2.20 libepc-1.0-1 libepc-ui-1.0-1 libexchange-storage1.2-3
 281   libfaad0 libgd2-noxpm libgda3-3 libgda3-common libggz2 libggzcore9
 282   libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnome-desktop-2
 283   libgnome-pilot2 libgnomecups1.0-1 libgnomeprint2.2-0
 284   libgnomeprintui2.2-0 libgpod3 libgraphviz4 libgtkhtml2-0
 285   libgtksourceview1.0-0 libgucharmap6 libhesiod0 libicu38 libisccc50
 286   libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++10
 287   libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4
 288   libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5
 289   libparted1.8-10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3
 290   libpt-1.10.10 libraw1394-8 libsensors3 libsmbios2 libsoup2.2-8
 291   libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1
 292   libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj
 293   libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3
 294   mysql-common swfdec-gnome totem-gstreamer wodim
 295 </p></blockquote>
 296
 297 <p>Installed using aptitude, missing with apt-get</p>
 298
 299 <blockquote><p>
 300   gnome gnome-desktop-environment hamster-applet python-gnomeapplet
 301   python-gnomekeyring python-wnck rhythmbox-plugins xorg
 302   xserver-xorg-input-all xserver-xorg-input-evdev
 303   xserver-xorg-input-kbd xserver-xorg-input-mouse
 304   xserver-xorg-input-synaptics xserver-xorg-video-all
 305   xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati
 306   xserver-xorg-video-chips xserver-xorg-video-cirrus
 307   xserver-xorg-video-dummy xserver-xorg-video-fbdev
 308   xserver-xorg-video-glint xserver-xorg-video-i128
 309   xserver-xorg-video-i740 xserver-xorg-video-mach64
 310   xserver-xorg-video-mga xserver-xorg-video-neomagic
 311   xserver-xorg-video-nouveau xserver-xorg-video-nv
 312   xserver-xorg-video-r128 xserver-xorg-video-radeon
 313   xserver-xorg-video-radeonhd xserver-xorg-video-rendition
 314   xserver-xorg-video-s3 xserver-xorg-video-s3virge
 315   xserver-xorg-video-savage xserver-xorg-video-siliconmotion
 316   xserver-xorg-video-sis xserver-xorg-video-sisusb
 317   xserver-xorg-video-tdfx xserver-xorg-video-tga
 318   xserver-xorg-video-trident xserver-xorg-video-tseng
 319   xserver-xorg-video-vesa xserver-xorg-video-vmware
 320   xserver-xorg-video-voodoo
 321 </p></blockquote>
 322
 323 <p>Installed using aptitude, removed with apt-get</p>
 324
 325 <blockquote><p>
 326   deskbar-applet xserver-xorg xserver-xorg-core
 327   xserver-xorg-input-wacom xserver-xorg-video-intel
 328   xserver-xorg-video-openchrome
 329 </p></blockquote>
 330
 331 <p>I was told on IRC that the xorg-xserver package was
 332 <a href="http://git.debian.org/?p=pkg-xorg/xserver/xorg-server.git;a=commit;h=9c8080d06c457932d3bfec021c69ac000aa60120">changed
 333 in git</a> today to try to get apt-get to not remove xorg completely.
 334 No idea when it hits Squeeze, but when it does I hope it will reduce
 335 the difference somewhat.
 336 </div>
 337   <div class="tags">
 338
 339
 340
 341    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 342
 343   </div>
 344  </div>
 345  <div class="padding"></div>
 346
 347  <div class="entry">
 348   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a></div>
 349   <div class="date">2010-07-01 11:40</div>
 350   <div class="body">
 351 <p>For a laptop, centralized user directories and password checking is
 352 a bit troubling.  Laptops are typically used also when not connected
 353 to the network, and it is vital for a user to be able to log in or
 354 unlock the screen saver also when a central server is unavailable.
 355 This is possible by caching passwords and directory information (user
 356 and group attributes) locally, and the packages to do so are available
 357 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
 358 It is also possible to set up in Debian/Lenny, but require more manual
 359 setup there because pam-auth-update is missing in Lenny.</p>
 360
 361 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
 362
 363 This is the traditional method with a twist.  The password caching is
 364 provided by libpam-ccreds (version 10-4 or later is needed on
 365 Squeeze), and the directory caching is done by nscd.  The directory
 366 lookup and password checking is done using LDAP.  If one want to use
 367 Kerberos for password checking the libpam-ldapd package can be
 368 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
 369 local home directory with the path listed in LDAP, one can use the
 370 pam_mkhomedir module from pam-modules to make this happen instead of
 371 using libpam-mklocaluser.  A setup for pam-auth-update to enable
 372 pam_mkhomedir will have to be written until a fix for
 373 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
 374 archive.  Because I believe it is a bad idea to have local home
 375 directories using misleading paths like /site/server/partition/, I
 376 prefer to create a local user with the home directory in /home/.  This
 377 is done using the libpam-mklocaluser package.</p>
 378
 379 <p>These packages need to be installed and configured</p>
 380
 381 <blockquote><pre>
 382 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
 383 </pre></blockquote>
 384
 385 <p>The ldapd packages will ask for LDAP connection information, and
 386 one have to fill in the values that fits ones own site.  Make sure the
 387 PAM part uses encrypted connections, to make sure the password is not
 388 sent in clear text to the LDAP server.  I've been unable to get TLS
 389 certificate checking for a self signed certificate working, which make
 390 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
 391 is talking to the correct LDAP server), and very much welcome feedback
 392 on how to get this working.</p>
 393
 394 <p>Because nscd do not have a default configuration fit for offline
 395 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
 396 is fixed, this configuration should be used instead of the one
 397 currently in /etc/nscd.conf.  The changes are in the fields
 398 reload-count and positive-time-to-live, and is based on the
 399 instructions I found in the
 400 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
 401 instructions by Flyn Computing.</p>
 402
 403 <blockquote><pre>
 404         debug-level             0
 405         reload-count            unlimited
 406         paranoia                no
 407
 408         enable-cache            passwd          yes
 409         positive-time-to-live   passwd          2592000
 410         negative-time-to-live   passwd          20
 411         suggested-size          passwd          211
 412         check-files             passwd          yes
 413         persistent              passwd          yes
 414         shared                  passwd          yes
 415         max-db-size             passwd          33554432
 416         auto-propagate          passwd          yes
 417
 418         enable-cache            group           yes
 419         positive-time-to-live   group           2592000
 420         negative-time-to-live   group           20
 421         suggested-size          group           211
 422         check-files             group           yes
 423         persistent              group           yes
 424         shared                  group           yes
 425         max-db-size             group           33554432
 426         auto-propagate          group           yes
 427
 428         enable-cache            hosts           no
 429         positive-time-to-live   hosts           2592000
 430         negative-time-to-live   hosts           20
 431         suggested-size          hosts           211
 432         check-files             hosts           yes
 433         persistent              hosts           yes
 434         shared                  hosts           yes
 435         max-db-size             hosts           33554432
 436
 437         enable-cache            services        yes
 438         positive-time-to-live   services        2592000
 439         negative-time-to-live   services        20
 440         suggested-size          services        211
 441         check-files             services        yes
 442         persistent              services        yes
 443         shared                  services        yes
 444         max-db-size             services        33554432
 445 </pre></blockquote>
 446
 447 <p>While we wait for a mechanism to update /etc/nsswitch.conf
 448 automatically like the one provided in
 449 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
 450 content need to be manually replaced to ensure LDAP is used as the
 451 directory service on the machine.  /etc/nsswitch.conf should normally
 452 look like this:</p>
 453
 454 <blockquote><pre>
 455 passwd:         files ldap
 456 group:          files ldap
 457 shadow:         files ldap
 458 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 459 networks:       files
 460 protocols:      files
 461 services:       files
 462 ethers:         files
 463 rpc:            files
 464 netgroup:       files ldap
 465 </pre></blockquote>
 466
 467 <p>The important parts are that ldap is listed last for passwd, group,
 468 shadow and netgroup.</p>
 469
 470 <p>With these changes in place, any user in LDAP will be able to log
 471 in locally on the machine using for example kdm, get a local home
 472 directory created and have the password as well as user and group
 473 attributes cached.
 474
 475 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 476   libpam-mklocaluser/pam_mkhomedir</h2>
 477
 478 <p>Because nscd have had its share of problems, and seem to have
 479 problems doing proper caching, I've seen suggestions and recipes to
 480 use nss-updatedb to copy parts of the LDAP database locally when the
 481 LDAP database is available.  I have not tested such setup, because I
 482 discovered sssd.</p>
 483
 484 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
 485
 486 <p>A more flexible and robust setup than the nscd combination
 487 mentioned earlier that has shown up recently, is the
 488 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
 489 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
 490 to provide a Active Directory like directory service for Linux
 491 machines.  The sssd system combines the caching of passwords and user
 492 information into one package, and remove the need for nscd and
 493 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 494 1.2 do not support netgroups, but it is said that it will support this
 495 in version 1.5 expected to show up later in 2010.  Because the
 496 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
 497 was missing in Debian, I ended up co-maintaining it with Werner, and
 498 version 1.2 is now in testing.
 499
 500 <p>These packages need to be installed and configured to get the
 501 roaming setup I want</p>
 502
 503 <blockquote><pre>
 504 libpam-sss libnss-sss libpam-mklocaluser
 505 </pre></blockquote>
 506
 507 The complete setup of sssd is done by editing/creating
 508 <tt>/etc/sssd/sssd.conf</tt>.
 509
 510 <blockquote><pre>
 511 [sssd]
 512 config_file_version = 2
 513 reconnection_retries = 3
 514 sbus_timeout = 30
 515 services = nss, pam
 516 domains = INTERN
 517
 518 [nss]
 519 filter_groups = root
 520 filter_users = root
 521 reconnection_retries = 3
 522
 523 [pam]
 524 reconnection_retries = 3
 525
 526 [domain/INTERN]
 527 enumerate = false
 528 cache_credentials = true
 529
 530 id_provider = ldap
 531 auth_provider = ldap
 532 chpass_provider = ldap
 533
 534 ldap_uri = ldap://ldap
 535 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 536 ldap_tls_reqcert = never
 537 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 538 </pre></blockquote>
 539
 540 <p>I got the same problem here with certificate checking.  Had to set
 541 "ldap_tls_reqcert = never" to get it working.</p>
 542
 543 <p>With the libnss-sss package in testing at the moment, the
 544 nsswitch.conf file is update automatically, so there is no need to
 545 modify it manually.</p>
 546
 547 <p>If you want to help out with implementing this for Debian Edu,
 548 please contact us on debian-edu@lists.debian.org.</p>
 549 </div>
 550   <div class="tags">
 551
 552
 553
 554    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 555
 556   </div>
 557  </div>
 558  <div class="padding"></div>
 559
 560  <div class="entry">
 561   <div class="title"><a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">LUMA, a very nice LDAP GUI</a></div>
 562   <div class="date">2010-06-28 00:30</div>
 563   <div class="body">
 564 <p>The last few days I have been looking into the status of the LDAP
 565 directory in Debian Edu, and in the process I started to miss a GUI
 566 tool to browse the LDAP tree.  The only one I was able to find in
 567 Debian/Squeeze and Lenny is
 568 <a href="http://luma.sourceforge.net/">LUMA</a>, which has proved to
 569 be a great tool to get a overview of the current LDAP directory
 570 populated by default in Skolelinux.  Thanks to it, I have been able to
 571 find empty and obsolete subtrees, misplaced objects and duplicate
 572 objects.  It will be installed by default in Debian/Squeeze.  If you
 573 are working with LDAP, give it a go. :)</p>
 574
 575 <p>I did notice one problem with it I have not had time to report to
 576 the BTS yet.  There is no .desktop file in the package, so the tool do
 577 not show up in the Gnome and KDE menus, but only deep down in in the
 578 Debian submenu in KDE.  I hope that can be fixed before Squeeze is
 579 released.</p>
 580
 581 <p>I have not yet been able to get it to modify the tree yet.  I would
 582 like to move objects and remove subtrees directly in the GUI, but have
 583 not found a way to do that with LUMA yet.  So in the mean time, I use
 584 <a href="http://www.lichteblau.com/ldapvi/">ldapvi</a> for that.</p>
 585
 586 <p>If you have tips on other GUI tools for LDAP that might be useful
 587 in Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 588
 589 <p>Update 2010-06-29: Ross Reedstrom tipped us about the
 590 <a href="http://packages.qa.debian.org/g/gq.html">gq</a> package as a
 591 useful GUI alternative.  It seem like a good tool, but is unmaintained
 592 in Debian and got a RC bug keeping it out of Squeeze.  Unless that
 593 changes, it will not be an option for Debian Edu based on Squeeze.</p>
 594 </div>
 595   <div class="tags">
 596
 597
 598
 599    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 600
 601   </div>
 602  </div>
 603  <div class="padding"></div>
 604
 605  <div class="entry">
 606   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">Idea for a change to LDAP schemas allowing DNS and DHCP info to be combined into one object</a></div>
 607   <div class="date">2010-06-24 00:35</div>
 608   <div class="body">
 609 <p>A while back, I
 610 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">complained
 611 about the fact</a> that it is not possible with the provided schemas
 612 for storing DNS and DHCP information in LDAP to combine the two sets
 613 of information into one LDAP object representing a computer.</p>
 614
 615 <p>In the mean time, I discovered that a simple fix would be to make
 616 the dhcpHost object class auxiliary, to allow it to be combined with
 617 the dNSDomain object class, and thus forming one object for one
 618 computer when storing both DHCP and DNS information in LDAP.</p>
 619
 620 <p>If I understand this correctly, it is not safe to do this change
 621 without also changing the assigned number for the object class, and I
 622 do not know enough about LDAP schema design to do that properly for
 623 Debian Edu.</p>
 624
 625 <p>Anyway, for future reference, this is how I believe we could change
 626 the
 627 <a href="http://tools.ietf.org/html/draft-ietf-dhc-ldap-schema-00">DHCP
 628 schema</a> to solve at least part of the problem with the LDAP schemas
 629 available today from IETF.</p>
 630
 631 <pre>
 632 --- dhcp.schema    (revision 65192)
 633 +++ dhcp.schema    (working copy)
 634 @@ -376,7 +376,7 @@
 635  objectclass ( 2.16.840.1.113719.1.203.6.6
 636         NAME 'dhcpHost'
 637         DESC 'This represents information about a particular client'
 638 -       SUP top
 639 +       SUP top AUXILIARY
 640         MUST cn
 641         MAY  (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
 642         X-NDS_CONTAINMENT ('dhcpService' 'dhcpSubnet' 'dhcpGroup') )
 643 </pre>
 644
 645 <p>I very much welcome clues on how to do this properly for Debian
 646 Edu/Squeeze.  We provide the DHCP schema in our debian-edu-config
 647 package, and should thus be free to rewrite it as we see fit.</p>
 648
 649 <p>If you want to help out with implementing this for Debian Edu,
 650 please contact us on debian-edu@lists.debian.org.</p>
 651 </div>
 652   <div class="tags">
 653
 654
 655
 656    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 657
 658   </div>
 659  </div>
 660  <div class="padding"></div>
 661
 662  <div class="entry">
 663   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Calling_tasksel_like_the_installer__while_still_getting_useful_output.html">Calling tasksel like the installer, while still getting useful output</a></div>
 664   <div class="date">2010-06-16 14:55</div>
 665   <div class="body">
 666 <p>A few times I have had the need to simulate the way tasksel
 667 installs packages during the normal debian-installer run.  Until now,
 668 I have ended up letting tasksel do the work, with the annoying problem
 669 of not getting any feedback at all when something fails (like a
 670 conffile question from dpkg or a download that fails), using code like
 671 this:
 672
 673 <blockquote><pre>
 674 export DEBIAN_FRONTEND=noninteractive
 675 tasksel --new-install
 676 </pre></blockquote>
 677
 678 This would invoke tasksel, let its automatic task selection pick the
 679 tasks to install, and continue to install the requested tasks without
 680 any output what so ever.
 681
 682 Recently I revisited this problem while working on the automatic
 683 package upgrade testing, because tasksel would some times hang without
 684 any useful feedback, and I want to see what is going on when it
 685 happen.  Then it occured to me, I can parse the output from tasksel
 686 when asked to run in test mode, and use that aptitude command line
 687 printed by tasksel then to simulate the tasksel run.  I ended up using
 688 code like this:
 689
 690 <blockquote><pre>
 691 export DEBIAN_FRONTEND=noninteractive
 692 cmd="$(in_target tasksel -t --new-install | sed 's/debconf-apt-progress -- //')"
 693 $cmd
 694 </pre></blockquote>
 695
 696 <p>The content of $cmd is typically something like "<tt>aptitude -q
 697 --without-recommends -o APT::Install-Recommends=no -y install
 698 ~t^desktop$ ~t^gnome-desktop$ ~t^laptop$ ~pstandard ~prequired
 699 ~pimportant</tt>", which will install the gnome desktop task, the
 700 laptop task and all packages with priority standard , required and
 701 important, just like tasksel would have done it during
 702 installation.</p>
 703
 704 <p>A better approach is probably to extend tasksel to be able to
 705 install packages without using debconf-apt-progress, for use cases
 706 like this.</p>
 707 </div>
 708   <div class="tags">
 709
 710
 711
 712    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 713
 714   </div>
 715  </div>
 716  <div class="padding"></div>
 717
 718  <div class="entry">
 719   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Vinmonopolet_bryter_loven___penlyst___og_flere_planlegger____gj__re_det_samme.html">Vinmonopolet bryter loven åpenlyst - og flere planlegger å gjøre det samme</a></div>
 720   <div class="date">2010-06-16 11:00</div>
 721   <div class="body">
 722 <p><a href="http://www.dagbladet.no/2010/06/16/nyheter/innenriks/streik/arbeidsliv/12157858/">Dagbladet
 723 melder</a> at Vinmonopolet med bakgrunn i vekterstreiken som pågår i
 724 Norge for tiden, har bestemt seg for med vitende og vilje å bryte
 725 sentralbanklovens paragraf 14 ved å nekte folk å betale med
 726 kontanter, og at flere butikker planlegger å følge deres eksempel.
 727 Jeg synes det er hårreisende hvis de slipper unna med et slikt
 728 soleklart lovbrudd, og lurer på hva slags muligheter jeg vil ha hvis
 729 jeg blir nektet å handle med kontanter.  Jeg handler i hovedsak med
 730 kontanter selv, da jeg anser det som en borgerrett å kunne handle
 731 anonymt uten at det blir registrert.  For meg er det et angrep på mitt
 732 personvern å nekte å ta imot kontant betaling.</p>
 733
 734 <p><a href="http://www.lovdata.no/all/tl-19850524-028-003.html#14">Paragrafen
 735 i sentralbankloven</a> lyder:</p>
 736
 737 <blockquote>
 738 <p>§ 14. Tvungent betalingsmiddel</p>
 739
 740 <p>Bankens sedler og mynter er tvungent betalingsmiddel i Norge. Ingen
 741 er pliktig til i én betaling å ta imot mer enn femogtyve mynter av
 742 hver enhet.</p>
 743
 744 <p>Sterkt skadde sedler og mynter er ikke tvungent
 745 betalingsmiddel. Banken gir nærmere forskrifter om erstatning for
 746 bortkomne, brente eller skadde sedler og mynter.</p>
 747
 748 <p>Selv om en avtale inneholder klausul om betaling av en
 749 pengeforpliktelse i gullverdi, kan skyldneren frigjøre seg med tvungne
 750 betalingsmidler uten hensyn til denne klausul.</p>
 751 </blockquote>
 752
 753 <p>Det er med bakgrunn i denne lovet ikke tillatt å nekte å ta imot
 754 kontakt betaling.  Det er en lov jeg har sans for, og som jeg mener må
 755 håndheves strengt.</p>
 756 </div>
 757   <div class="tags">
 758
 759
 760
 761    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>.
 762
 763   </div>
 764  </div>
 765  <div class="padding"></div>
 766
 767  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
 768
 769 <div id="sidebar">
 770
 771
 772
 773
 774
 775 <h2>Archive</h2>
 776 <ul>
 777
 778 <li>2010
 779 <ul>
 780
 781 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 782
 783 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 784
 785 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 786
 787 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 788
 789 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 790
 791 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 792
 793 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (6)</a></li>
 794
 795 </ul></li>
 796
 797 <li>2009
 798 <ul>
 799
 800 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 801
 802 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 803
 804 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 805
 806 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 807
 808 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 809
 810 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 811
 812 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 813
 814 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 815
 816 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 817
 818 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 819
 820 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 821
 822 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 823
 824 </ul></li>
 825
 826 <li>2008
 827 <ul>
 828
 829 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 830
 831 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 832
 833 </ul></li>
 834
 835 </ul>
 836
 837
 838
 839 <h2>Tags</h2>
 840 <ul>
 841
 842  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 843
 844  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 845
 846  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 847
 848  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
 849
 850  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (33)</a></li>
 851
 852  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (33)</a></li>
 853
 854  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (46)</a></li>
 855
 856  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 857
 858  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (7)</a></li>
 859
 860  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
 861
 862  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (7)</a></li>
 863
 864  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
 865
 866  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 867
 868  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 869
 870  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (70)</a></li>
 871
 872  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (83)</a></li>
 873
 874  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (13)</a></li>
 875
 876  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (13)</a></li>
 877
 878  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 879
 880  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 881
 882  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (9)</a></li>
 883
 884  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
 885
 886  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
 887
 888  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 889
 890  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 891
 892  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 893
 894  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
 895
 896 </ul>
 897
 898 </div>
 899
 900 <p style="text-align: right">
 901 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
 902 </p>
 903 </body>
 904 </html>