blog/No_hardcoded_config_on_Debian_Edu_clients.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
   4   <head>
   5     <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
   6     <title>Petter Reinholdtsen: No hardcoded config on Debian Edu clients</title>
   7     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css" />
   8     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/vim.css" />
   9   </head>
  10   <body>
  11     <div class="title">
  12  <h1>
  13      <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  14
  15  </h1>
  16
  17 </div>
  18
  19
  20     <div class="entry">
  21       <div class="title">No hardcoded config on Debian Edu clients</div>
  22       <div class="date"> 9th August 2010</div>
  23       <div class="body"><p>As reported earlier, the last few days I have looked at how Debian
  24 Edu clients are configured, and tried to get rid of all hardcoded
  25 configuration settings on the clients.  I believe the work to be
  26 mostly done, and the clients seem to work just fine with dynamically
  27 generated configuration.</p>
  28
  29 <p>What is the point, you might ask?  The point is to allow a Debian
  30 Edu desktop to integrate into an existing network infrastructure
  31 without any manual configuration.</p>
  32
  33 <p>This is what happens when installing a Debian Edu client here at
  34 the University of Oslo using PXE.  With the PXE installation, I am
  35 asked for language (Norwegian Bokmål), locality (Norway) and keyboard
  36 layout (no-latin1), Debian Edu profile (Roaming Workstation), if I
  37 accept to reformat the hard drive (yes), if I want to submit info to
  38 popcon.debian.org (no) and root password (secret).  After answering
  39 these questions, the installer goes ahead and does its thing, and
  40 after around 50 minutes it is done.  I press enter to finish the
  41 installation, and the machine reboots into KDE.  When the machine is
  42 ready and kdm asks for login information, I enter my university
  43 username and password, am told by kdm that a local home directory has
  44 been created and that I must log in again, and finally log in with the
  45 same username and password to the KDE 4.4 desktop.  At no point during
  46 this process did it ask for university specific settings, and all the
  47 required configuration was dynamically detected using information
  48 fetched via DHCP and DNS.  The roaming workstation is now ready for
  49 use.</p>
  50
  51 <p>How was this done, you might wonder?  First of all, here is the
  52 list of things that need to be configured on the client to get it
  53 working properly out of the box:</p>
  54
  55 <ul>
  56 <li>IP address/netmask and DNS server.</li>
  57 <li>Web proxy URL.</li>
  58 <li>LDAP server for NSS directory information (user, group, etc).</li>
  59 <li>Kerberos server for PAM password checking.</li>
  60 <li>SMB mount point to access the network home directory. (*)</li>
  61 <li>Central syslog server to send syslog messages to. (*)</li>
  62 <li>Sitesummary collector URL to submit info to central server. (*)</li>
  63 </ul>
  64
  65 <p>(Hm, did I forget anything?  Let me knew if I did.)</p>
  66
  67 <p>The points marked (*) are not required to be able to use the
  68 machine, but needed to provide central storage and allowing system
  69 administrators to track their machines.  Since yesterday, everything
  70 but the sitesummary collector URL is dynamically discovered at boot
  71 and installation time in the svn version of Debian Edu.</p>
  72
  73 <p>The IP and DNS setup is fetched during boot using DHCP as usual.
  74 When a DHCP update arrives, the proxy setup is updated by looking for
  75 http://wpat/wpad.dat and using the content of this WPAD file to
  76 configure the http and ftp proxy in /etc/environment and
  77 /etc/apt/apt.conf.  I decided to update the proxy setup using a DHCP
  78 hook to ensure that the client stops using the Debian Edu proxy when
  79 it is moved outside the Debian Edu network, and instead uses any local
  80 proxy present on the new network when it moves around.</p>
  81
  82 <p>The DNS names of the LDAP, Kerberos and syslog server and related
  83 configuration are generated using DNS information at boot.  First the
  84 installer looks for a host named ldap in the current DNS domain.  If
  85 not found, it looks for _ldap._tcp SRV records in DNS instead.  If an
  86 LDAP server is found, its root DSE entry is requested and the
  87 attributes namingContexts and defaultNamingContext are used to
  88 determine which LDAP base to use for NSS.  If there are several
  89 namingContexts attibutes and the defaultNamingContext is present, that
  90 LDAP subtree is used as the base.  If defaultNamingContext is missing,
  91 the subtrees listed as namingContexts are searched in sequence for any
  92 object with class posixAccount or posixGroup, and the first one with
  93 such an object is used as the LDAP base.  For Kerberos, a similar
  94 search is done by first looking for a host named kerberos, and then
  95 for the _kerberos._tcp SRV record.  I've been unable to find a way to
  96 look up the Kerberos realm, so for this the upper case string of the
  97 current DNS domain is used.</p>
  98
  99 <p>For the syslog server, the hosts syslog and loghost are searched
 100 for, and the _syslog._udp SRV record is consulted if no such host is
 101 found.  This algorithm works for both Debian Edu and the University of
 102 Oslo.  A similar strategy would work for locating the sitesummary
 103 server, but have not been implemented yet.  I decided to fetch and
 104 save these settings during installation, to make sure moving to a
 105 different network does not change the set of users being allowed to
 106 log in nor the passwords required to log in.  Usernames and passwords
 107 will be cached by sssd when the user logs in on the Debian Edu
 108 network, and will not change as the laptop move around.  For a
 109 non-roaming machine, there is no caching, but given that it is
 110 supposed to stay in place it should not matter much.  Perhaps we
 111 should switch those to use sssd too?</p>
 112
 113 <p>The user's SMB mount point for the network home directory is
 114 located when the user logs in for the first time.  The LDAP server is
 115 consulted to look for the user's LDAP object and the sambaHomePath
 116 attribute is used if found.  If it isn't found, the home directory
 117 path fetched from NSS is used instead.  Assuming the path is of the
 118 form /site/server/directory/username, the second part is looked up in
 119 DNS and used to generate a SMB URL of the form
 120 smb://server.domain/username.  This algorithm works for both Debian
 121 edu and the University of Oslo.  Perhaps there are better attributes
 122 to use or a better algorithm that works for more sites, but this will
 123 do for now. :)</p>
 124
 125 <p>This work should make it easier to integrate the Debian Edu clients
 126 into any LDAP/Kerberos infrastructure, and make the current setup even
 127 more flexible than before.  I suspect it will also work for thin
 128 client servers, allowing one to easily set up LTSP and hook it into a
 129 existing network infrastructure, but I have not had time to test this
 130 yet.</p>
 131
 132 <p>If you want to help out with implementing these things for Debian
 133 Edu, please contact us on debian-edu@lists.debian.org.</p>
 134
 135 <p>Update 2010-08-09: Simon Farnsworth gave me a heads-up on how to
 136 detect Kerberos realm from DNS, by looking for _kerberos TXT entries
 137 before falling back to the upper case DNS domain name.  Will have to
 138 implement it for Debian Edu. :)</p>
 139 </div>
 140
 141       <div class="tags">Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.</div>
 142
 143
 144     </div>
 145
 146
 147
 148
 149     <div id="sidebar">
 150
 151
 152
 153 <h2>Archive</h2>
 154 <ul>
 155
 156 <li>2012
 157 <ul>
 158
 159 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/01/">January (7)</a></li>
 160
 161 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/02/">February (10)</a></li>
 162
 163 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/03/">March (17)</a></li>
 164
 165 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/04/">April (12)</a></li>
 166
 167 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/05/">May (12)</a></li>
 168
 169 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/06/">June (20)</a></li>
 170
 171 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/07/">July (17)</a></li>
 172
 173 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/08/">August (6)</a></li>
 174
 175 </ul></li>
 176
 177 <li>2011
 178 <ul>
 179
 180 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
 181
 182 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
 183
 184 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
 185
 186 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
 187
 188 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
 189
 190 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
 191
 192 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (7)</a></li>
 193
 194 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/08/">August (6)</a></li>
 195
 196 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/09/">September (4)</a></li>
 197
 198 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/10/">October (2)</a></li>
 199
 200 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/11/">November (3)</a></li>
 201
 202 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/12/">December (1)</a></li>
 203
 204 </ul></li>
 205
 206 <li>2010
 207 <ul>
 208
 209 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 210
 211 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 212
 213 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 214
 215 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 216
 217 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 218
 219 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 220
 221 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
 222
 223 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
 224
 225 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
 226
 227 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
 228
 229 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
 230
 231 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
 232
 233 </ul></li>
 234
 235 <li>2009
 236 <ul>
 237
 238 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 239
 240 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 241
 242 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 243
 244 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 245
 246 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 247
 248 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 249
 250 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 251
 252 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 253
 254 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 255
 256 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 257
 258 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 259
 260 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 261
 262 </ul></li>
 263
 264 <li>2008
 265 <ul>
 266
 267 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 268
 269 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 270
 271 </ul></li>
 272
 273 </ul>
 274
 275
 276
 277 <h2>Tags</h2>
 278 <ul>
 279
 280  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (13)</a></li>
 281
 282  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 283
 284  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 285
 286  <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (2)</a></li>
 287
 288  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (12)</a></li>
 289
 290  <li><a href="http://people.skolelinux.org/pere/blog/tags/bsa">bsa (2)</a></li>
 291
 292  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (56)</a></li>
 293
 294  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (111)</a></li>
 295
 296  <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (9)</a></li>
 297
 298  <li><a href="http://people.skolelinux.org/pere/blog/tags/docbook">docbook (6)</a></li>
 299
 300  <li><a href="http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (4)</a></li>
 301
 302  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (147)</a></li>
 303
 304  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (17)</a></li>
 305
 306  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (12)</a></li>
 307
 308  <li><a href="http://people.skolelinux.org/pere/blog/tags/freeculture">freeculture (7)</a></li>
 309
 310  <li><a href="http://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (6)</a></li>
 311
 312  <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (30)</a></li>
 313
 314  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (16)</a></li>
 315
 316  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
 317
 318  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (4)</a></li>
 319
 320  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 321
 322  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (22)</a></li>
 323
 324  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (193)</a></li>
 325
 326  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (142)</a></li>
 327
 328  <li><a href="http://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (4)</a></li>
 329
 330  <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
 331
 332  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (35)</a></li>
 333
 334  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (48)</a></li>
 335
 336  <li><a href="http://people.skolelinux.org/pere/blog/tags/raid">raid (1)</a></li>
 337
 338  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
 339
 340  <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (2)</a></li>
 341
 342  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (4)</a></li>
 343
 344  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 345
 346  <li><a href="http://people.skolelinux.org/pere/blog/tags/ruter">ruter (4)</a></li>
 347
 348  <li><a href="http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (2)</a></li>
 349
 350  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (23)</a></li>
 351
 352  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (4)</a></li>
 353
 354  <li><a href="http://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (1)</a></li>
 355
 356  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (37)</a></li>
 357
 358  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 359
 360  <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (4)</a></li>
 361
 362  <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (10)</a></li>
 363
 364  <li><a href="http://people.skolelinux.org/pere/blog/tags/valg">valg (6)</a></li>
 365
 366  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (32)</a></li>
 367
 368  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 369
 370  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (25)</a></li>
 371
 372 </ul>
 373
 374
 375     </div>
 376     <p style="text-align: right">
 377  Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v4.4</a>
 378 </p>
 379
 380   </body>
 381 </html>