Generated.

[homepage.git] / blog / index.rss

<?xml version="1.0" encoding="utf-8"?>
<rss version='2.0' xmlns:lj='http://www.livejournal.org/rss/lj/1.0/' xmlns:atom="http://www.w3.org/2005/Atom">
        <channel>
                <title>Petter Reinholdtsen</title>
                <description></description>
                <link>http://people.skolelinux.org/pere/blog/</link>
                <atom:link href="http://people.skolelinux.org/pere/blog/index.rss" rel="self" type="application/rss+xml" />
        
        <item>
                <title>Robot, reis deg...</title>
                <link>http://people.skolelinux.org/pere/blog/Robot__reis_deg___.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Robot__reis_deg___.html</guid>
                <pubDate>Sat, 21 Aug 2010 22:10:00 +0200</pubDate>
                <description>
&lt;p&gt;I dag fikk jeg endelig tittet litt på mine nyinnkjøpte roboter, og
har brukt noen timer til å google etter interessante referanser og
aktuell kildekode for bruk på Linux.  Det mest lovende så langt er
&lt;a href=&quot;http://ispykee.toyz.org/&quot;&gt;ispykee&lt;/a&gt;, som har en
BSD-lisensiert linux-daemon som står som mellomledd mellom roboter på
lokalnettet og en sentral tjeneste der en iPhone kan koble seg opp for
å fjernstyre roboten.  Linux-daemonen implementerer deler av
protokollen som roboten forstår.  Etter å ha knotet litt med å oppnå
kontakt med roboten (den oppretter et eget ad-hoc wifi-nett, så jeg
måtte gå av mitt vanlige nett for å få kontakt), og kommet frem til at
den lytter på IP-port 9000 og 9001, gikk jeg i gang med å finne ut
hvordan jeg kunne snakke med roboten vha. disse portene.  Robotbiten
av protokollen er publisert av produsenten med GPL-lisens, slik at det
er mulig å se hvordan protokollen fungerer.  Det finnes en java-klient
for Android som så ganske snasen ut, men fant ingen kildekode for
denne.  Derimot hadde iphone-løsningen kildekode, så jeg tok
utgangspunkt i den.&lt;/p&gt;

&lt;p&gt;Daemonen ville i utgangspunktet forsøke å kontakte den sentrale
tjenesten som iphone-programmet kobler seg til.  Jeg skrev dette om
til i stedet å sette opp en nettverkstjeneste på min lokale maskin,
som jeg kan koble meg opp til med telnet og gi kommandoer til roboten
(act, forward, right, left, etc).  Det involverte i praksis å bytte ut
socket()/connect() med socket()/bind()/listen()/accept() for å gjøre
klienten om til en tjener.&lt;/p&gt;

&lt;p&gt;Mens jeg har forsøkt å få roboten til å bevege seg har min samboer
skrudd sammen resten av roboten for å få montert kamera og plastpynten
(armer, plastfiber for lys).  Nå er det hele montert, og roboten er
klar til bruk.  Må få flyttet den over til mitt vanlige trådløsnett
før det blir praktisk, men de bitene av protokollen er ikke
implementert i ispykee-daemonen, så der må jeg enten få tak i en mac
eller en windows-maskin, eller implementere det selv.&lt;/p&gt;

&lt;p&gt;Vi var tre som kjøpte slike roboter, og vi har blitt enige om å
samle notater og referanser på &lt;a
href=&quot;http://wiki.nuug.no/grupper/robot/&quot;&gt;NUUGs wiki&lt;/a&gt;.  Ta en titt
der hvis du er nysgjerrig.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>2 Spykee-roboter i hus, nå skal det lekes</title>
                <link>http://people.skolelinux.org/pere/blog/2_Spykee_roboter_i_hus__n___skal_det_lekes.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/2_Spykee_roboter_i_hus__n___skal_det_lekes.html</guid>
                <pubDate>Wed, 18 Aug 2010 13:30:00 +0200</pubDate>
                <description>
&lt;p&gt;Jeg kjøpte nettopp to
&lt;a href=&quot;http://www.spykee-robot.com/&quot;&gt;Spykee&lt;/a&gt;-roboter, for test og
leking.  Kjøpte to da det var så billige, og gir meg mulighet til å
eksperimentere uten å være veldig redd for å ødelegge alt ved å bytte
ut firmware og slikt.  Oppdaget at lekebutikken på Bryn senter hadde
en liten stabel på lager som de ikke hadde klart å selge ut etter
fjorårets juleinnkjøp, og var villig til å selge for en femtedel av
vanlig pris.  Jeg, Ronny og Jarle har skaffet oss restbeholdningen, og
det blir morsomt å se hva vi får ut av dette.&lt;/p&gt;

&lt;p&gt;Roboten har belter styrt av to motorer, kamera, høytaler, mikrofon
og wifi-tilkobling.  Det hele styrt av en GPL-lisensiert databoks som
jeg mistenker kjører linux.  Firmware-kildekoden ble visst publisert i
mai.  Eneste utfordringen er at kontroller-programvaren kun finnes til
Windows, men det må en kunne jobbe seg rundt når vi har kildekoden til
firmwaren. :)&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Spykee&quot;&gt;Wikipedia-oppføring&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=http://www.spykeeworld.com/spykee/US/freeSoftware.html&quot;&gt;Nedlasting av firmware-kilden&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;http://wiki.nuug.no/grupper/robot&quot;&gt;prosjektwiki hos NUUG&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
</description>
        </item>
        
        <item>
                <title>Rob Weir: How to Crush Dissent</title>
                <link>http://people.skolelinux.org/pere/blog/Rob_Weir__How_to_Crush_Dissent.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Rob_Weir__How_to_Crush_Dissent.html</guid>
                <pubDate>Sun, 15 Aug 2010 22:20:00 +0200</pubDate>
                <description>
&lt;p&gt;I found the notes from Rob Weir on
&lt;a href=&quot;http://feedproxy.google.com/~r/robweir/antic-atom/~3/VGb23-kta8c/how-to-crush-dissent.html&quot;&gt;how
to crush dissent&lt;/a&gt; matching my own thoughts on the matter quite
well.  Highly recommended for those wondering which road our society
should go down.  In my view we have been heading the wrong way for a
long time.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>No hardcoded config on Debian Edu clients</title>
                <link>http://people.skolelinux.org/pere/blog/No_hardcoded_config_on_Debian_Edu_clients.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/No_hardcoded_config_on_Debian_Edu_clients.html</guid>
                <pubDate>Mon, 9 Aug 2010 20:15:00 +0200</pubDate>
                <description>
&lt;p&gt;As reported earlier, the last few days I have looked at how Debian
Edu clients are configured, and tried to get rid of all hardcoded
configuration settings on the clients.  I believe the work to be
mostly done, and the clients seem to work just fine with dynamically
generated configuration.&lt;/p&gt;

&lt;p&gt;What is the point, you might ask?  The point is to allow a Debian
Edu desktop to integrate into an existing network infrastructure
without any manual configuration.&lt;/p&gt;

&lt;p&gt;This is what happens when installing a Debian Edu client here at
the University of Oslo using PXE.  With the PXE installation, I am
asked for language (Norwegian Bokmål), locality (Norway) and keyboard
layout (no-latin1), Debian Edu profile (Roaming Workstation), if I
accept to reformat the hard drive (yes), if I want to submit info to
popcon.debian.org (no) and root password (secret).  After answering
these questions, the installer goes ahead and does its thing, and
after around 50 minutes it is done.  I press enter to finish the
installation, and the machine reboots into KDE.  When the machine is
ready and kdm asks for login information, I enter my university
username and password, am told by kdm that a local home directory has
been created and that I must log in again, and finally log in with the
same username and password to the KDE 4.4 desktop.  At no point during
this process did it ask for university specific settings, and all the
required configuration was dynamically detected using information
fetched via DHCP and DNS.  The roaming workstation is now ready for
use.&lt;/p&gt;

&lt;p&gt;How was this done, you might wonder?  First of all, here is the
list of things that need to be configured on the client to get it
working properly out of the box:&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;IP address/netmask and DNS server.&lt;/li&gt;
&lt;li&gt;Web proxy URL.&lt;/li&gt;
&lt;li&gt;LDAP server for NSS directory information (user, group, etc).&lt;/li&gt;
&lt;li&gt;Kerberos server for PAM password checking.&lt;/li&gt;
&lt;li&gt;SMB mount point to access the network home directory. (*)&lt;/li&gt;
&lt;li&gt;Central syslog server to send syslog messages to. (*)&lt;/li&gt;
&lt;li&gt;Sitesummary collector URL to submit info to central server. (*)&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;(Hm, did I forget anything?  Let me knew if I did.)&lt;/p&gt;

&lt;p&gt;The points marked (*) are not required to be able to use the
machine, but needed to provide central storage and allowing system
administrators to track their machines.  Since yesterday, everything
but the sitesummary collector URL is dynamically discovered at boot
and installation time in the svn version of Debian Edu.&lt;/p&gt;

&lt;p&gt;The IP and DNS setup is fetched during boot using DHCP as usual.
When a DHCP update arrives, the proxy setup is updated by looking for
http://wpat/wpad.dat and using the content of this WPAD file to
configure the http and ftp proxy in /etc/environment and
/etc/apt/apt.conf.  I decided to update the proxy setup using a DHCP
hook to ensure that the client stops using the Debian Edu proxy when
it is moved outside the Debian Edu network, and instead uses any local
proxy present on the new network when it moves around.&lt;/p&gt;

&lt;p&gt;The DNS names of the LDAP, Kerberos and syslog server and related
configuration are generated using DNS information at boot.  First the
installer looks for a host named ldap in the current DNS domain.  If
not found, it looks for _ldap._tcp SRV records in DNS instead.  If an
LDAP server is found, its root DSE entry is requested and the
attributes namingContexts and defaultNamingContext are used to
determine which LDAP base to use for NSS.  If there are several
namingContexts attibutes and the defaultNamingContext is present, that
LDAP subtree is used as the base.  If defaultNamingContext is missing,
the subtrees listed as namingContexts are searched in sequence for any
object with class posixAccount or posixGroup, and the first one with
such an object is used as the LDAP base.  For Kerberos, a similar
search is done by first looking for a host named kerberos, and then
for the _kerberos._tcp SRV record.  I&#39;ve been unable to find a way to
look up the Kerberos realm, so for this the upper case string of the
current DNS domain is used.&lt;/p&gt;

&lt;p&gt;For the syslog server, the hosts syslog and loghost are searched
for, and the _syslog._udp SRV record is consulted if no such host is
found.  This algorithm works for both Debian Edu and the University of
Oslo.  A similar strategy would work for locating the sitesummary
server, but have not been implemented yet.  I decided to fetch and
save these settings during installation, to make sure moving to a
different network does not change the set of users being allowed to
log in nor the passwords required to log in.  Usernames and passwords
will be cached by sssd when the user logs in on the Debian Edu
network, and will not change as the laptop move around.  For a
non-roaming machine, there is no caching, but given that it is
supposed to stay in place it should not matter much.  Perhaps we
should switch those to use sssd too?&lt;/p&gt;

&lt;p&gt;The user&#39;s SMB mount point for the network home directory is
located when the user logs in for the first time.  The LDAP server is
consulted to look for the user&#39;s LDAP object and the sambaHomePath
attribute is used if found.  If it isn&#39;t found, the home directory
path fetched from NSS is used instead.  Assuming the path is of the
form /site/server/directory/username, the second part is looked up in
DNS and used to generate a SMB URL of the form
smb://server.domain/username.  This algorithm works for both Debian
edu and the University of Oslo.  Perhaps there are better attributes
to use or a better algorithm that works for more sites, but this will
do for now. :)&lt;/p&gt;

&lt;p&gt;This work should make it easier to integrate the Debian Edu clients
into any LDAP/Kerberos infrastructure, and make the current setup even
more flexible than before.  I suspect it will also work for thin
client servers, allowing one to easily set up LTSP and hook it into a
existing network infrastructure, but I have not had time to test this
yet.&lt;/p&gt;

&lt;p&gt;If you want to help out with implementing these things for Debian
Edu, please contact us on debian-edu@lists.debian.org.&lt;/p&gt;

&lt;p&gt;Update 2010-08-09: Simon Farnsworth gave me a heads-up on how to
detect Kerberos realm from DNS, by looking for _kerberos TXT entries
before falling back to the upper case DNS domain name.  Will have to
implement it for Debian Edu. :)&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Testing if a file system can be used for home directories...</title>
                <link>http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html</guid>
                <pubDate>Sun, 8 Aug 2010 21:20:00 +0200</pubDate>
                <description>
&lt;p&gt;A few years ago, I was involved in a project planning to use
Windows file servers as home directory servers for Debian
Edu/Skolelinux machines.  This was thought to be no problem, as the
access would be through the SMB network file system protocol, and we
knew other sites used SMB with unix and samba as the file server to
mount home directories without any problems.  But, after months of
struggling, we had to conclude that our goal was impossible.&lt;/p&gt;

&lt;p&gt;The reason is simply that while SMB can be used for home
directories when the file server is Samba running on Unix, this only
work because of Samba have some extensions and the fact that the
underlying file system is a unix file system.  When using a Windows
file server, the underlying file system do not have POSIX semantics,
and several programs will fail if the users home directory where they
want to store their configuration lack POSIX semantics.&lt;/p&gt;

&lt;p&gt;As part of this work, I wrote a small C program I want to share
with you all, to replicate a few of the problematic applications (like
OpenOffice.org and GCompris) and see if the file system was working as
it should.  If you find yourself in spooky file system land, it might
help you find your way out again.  This is the fs-test.c source:&lt;/p&gt;

&lt;pre&gt;
/*
 * Some tests to check the file system sematics.  Used to verify that
 * CIFS from a windows server do not work properly as a linux home
 * directory.
 * License: GPL v2 or later
 * 
 * needs libsqlite3-dev and build-essential installed
 * compile with: gcc -Wall -lsqlite3 -DTEST_SQLITE fs-test.c -o fs-test
*/

#define _FILE_OFFSET_BITS 64
#define _LARGEFILE_SOURCE 1
#define _LARGEFILE64_SOURCE 1

#define _GNU_SOURCE /* for asprintf() */

#include &amp;lt;errno.h&gt;
#include &amp;lt;fcntl.h&gt;
#include &amp;lt;stdio.h&gt;
#include &amp;lt;string.h&gt;
#include &amp;lt;stdlib.h&gt;
#include &amp;lt;sys/file.h&gt;
#include &amp;lt;sys/stat.h&gt;
#include &amp;lt;sys/types.h&gt;
#include &amp;lt;unistd.h&gt;

#ifdef TEST_SQLITE
/*
 * Test sqlite open, as done by gcompris require the libsqlite3-dev
 * package and linking with -lsqlite3.  A more low level test is
 * below.
 * See also &amp;lt;URL: http://www.sqlite.org./faq.html#q5 &gt;.
 */
#include &amp;lt;sqlite3.h&gt;
#define CREATE_TABLE_USERS                                              \
  &quot;CREATE TABLE users (user_id INT UNIQUE, login TEXT, lastname TEXT, firstname TEXT, birthdate TEXT, class_id INT ); &quot;
int test_sqlite_open(void) {
  char *zErrMsg;
  char *name = &quot;testsqlite.db&quot;;
  sqlite3 *db=NULL;
  unlink(name);
  int rc = sqlite3_open(name, &amp;db);
  if( rc ){
    printf(&quot;error: sqlite open of %s failed: %s\n&quot;, name, sqlite3_errmsg(db));
    sqlite3_close(db);
    return -1;
  }

  /* create tables */
  rc = sqlite3_exec(db,CREATE_TABLE_USERS, NULL,  0, &amp;zErrMsg);
  if( rc != SQLITE_OK ){
    printf(&quot;error: sqlite table create failed: %s\n&quot;, zErrMsg);
    sqlite3_close(db);
    return -1;
  }
  printf(&quot;info: sqlite worked\n&quot;);
  sqlite3_close(db);
  return 0;
}
#endif /* TEST_SQLITE */

/*
 * Demonstrate locking issue found in gcompris using sqlite3.  This
 * work with ext3, but not with cifs server on Windows 2003.  This is
 * done in the sqlite3 library.
 * See also
 * &amp;lt;URL:http://www.cygwin.com/ml/cygwin/2001-08/msg00854.html&gt; and the
 * POSIX specification
 * &amp;lt;URL:http://www.opengroup.org/onlinepubs/009695399/functions/fcntl.html&gt;.
 */
int test_gcompris_locking(void) {
  struct flock fl;
  char *name = &quot;testsqlite.db&quot;;
  unlink(name);
  int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, 0644);
  printf(&quot;info: testing fcntl locking\n&quot;);

  fl.l_whence = SEEK_SET;
  fl.l_pid    = getpid();
  printf(&quot;  Read-locking 1 byte from 1073741824&quot;);
  fl.l_start  = 1073741824;
  fl.l_len    = 1;
  fl.l_type   = F_RDLCK;
  if (0 != fcntl(fd, F_SETLK, &amp;fl) ) printf(&quot; - error!\n&quot;); else printf(&quot;\n&quot;);

  printf(&quot;  Read-locking 510 byte from 1073741826&quot;);
  fl.l_start  = 1073741826;
  fl.l_len    = 510;
  fl.l_type   = F_RDLCK;
  if (0 != fcntl(fd, F_SETLK, &amp;fl) ) printf(&quot; - error!\n&quot;); else printf(&quot;\n&quot;);

  printf(&quot;  Unlocking 1 byte from 1073741824&quot;);
  fl.l_start  = 1073741824;
  fl.l_len    = 1;
  fl.l_type   = F_UNLCK;
  if (0 != fcntl(fd, F_SETLK, &amp;fl) ) printf(&quot; - error!\n&quot;); else printf(&quot;\n&quot;);

  printf(&quot;  Write-locking 1 byte from 1073741824&quot;);
  fl.l_start  = 1073741824;
  fl.l_len    = 1;
  fl.l_type   = F_WRLCK;
  if (0 != fcntl(fd, F_SETLK, &amp;fl) ) printf(&quot; - error!\n&quot;); else printf(&quot;\n&quot;);

  printf(&quot;  Write-locking 510 byte from 1073741826&quot;);
  fl.l_start  = 1073741826;
  fl.l_len    = 510;
  if (0 != fcntl(fd, F_SETLK, &amp;fl) ) printf(&quot; - error!\n&quot;); else printf(&quot;\n&quot;);

  printf(&quot;  Unlocking 2 byte from 1073741824&quot;);
  fl.l_start  = 1073741824;
  fl.l_len    = 2;
  fl.l_type   = F_UNLCK;
  if (0 != fcntl(fd, F_SETLK, &amp;fl) ) printf(&quot; - error!\n&quot;); else printf(&quot;\n&quot;);

  close(fd);
  return 0;
}

/*
 * Test if permissions of freshly created directories allow entries
 * below them.  This was a problem with OpenOffice.org and gcompris.
 * Mounting with option &#39;sync&#39; seem to solve this problem while
 * slowing down file operations.
 */
int test_subdirectory_creation(void) {
#define LEVELS 5
  char *path = strdup(&quot;test&quot;);
  char *dirs[LEVELS];
  int level;
  printf(&quot;info: testing subdirectory creation\n&quot;);
  for (level = 0; level &amp;lt; LEVELS; level++) {
    char *newpath = NULL;
    if (-1 == mkdir(path, 0777)) {
      printf(&quot;  error: Unable to create directory &#39;%s&#39;: %s\n&quot;,
             path, strerror(errno));
      break;
    }
    asprintf(&amp;newpath, &quot;%s/%s&quot;, path, &quot;test&quot;);
    free(path);
    path = newpath;
  }
  return 0;
}

/*
 * Test if symlinks can be created.  This was a problem detected with
 * KDE.
 */
int test_symlinks(void) {
  printf(&quot;info: testing symlink creation\n&quot;);
  unlink(&quot;symlink&quot;);
  if (-1 == symlink(&quot;file&quot;, &quot;symlink&quot;))
    printf(&quot;  error: Unable to create symlink\n&quot;);
  return 0;
}

int main(int argc, char **argv) {
  printf(&quot;Testing POSIX/Unix sematics on file system\n&quot;);
  test_symlinks();
  test_subdirectory_creation();
#ifdef TEST_SQLITE
  test_sqlite_open();
#endif /* TEST_SQLITE */
  test_gcompris_locking();
  return 0;
}
&lt;/pre&gt;

&lt;p&gt;When everything is working, it should print something like
this:&lt;/p&gt;

&lt;pre&gt;
Testing POSIX/Unix sematics on file system
info: testing symlink creation
info: testing subdirectory creation
info: sqlite worked
info: testing fcntl locking
  Read-locking 1 byte from 1073741824
  Read-locking 510 byte from 1073741826
  Unlocking 1 byte from 1073741824
  Write-locking 1 byte from 1073741824
  Write-locking 510 byte from 1073741826
  Unlocking 2 byte from 1073741824
&lt;/pre&gt;

&lt;p&gt;I do not remember the exact details of the problems we saw, but one
of them was with locking, where if I remember correctly, POSIX allow a
read-only lock to be upgraded to a read-write lock without unlocking
the read-only lock (while Windows do not).  Another was a bug in the
CIFS/SMB client implementation in the Linux kernel where directory
meta information would be wrong for a fraction of a second, making
OpenOffice.org fail to create its deep directory tree because it was
not allowed to create files in its freshly created directory.&lt;/p&gt;

&lt;p&gt;Anyway, here is a nice tool for your tool box, might you never need
it. :)&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Autodetecting Client setup for roaming workstations in Debian Edu</title>
                <link>http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html</guid>
                <pubDate>Sat, 7 Aug 2010 14:45:00 +0200</pubDate>
                <description>
&lt;p&gt;A few days ago, I
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html&quot;&gt;tried
to install&lt;/a&gt; a Roaming workation profile from Debian Edu/Squeeze
while on the university network here at the University of Oslo, and
noticed how much had to change to get it operational using the
university infrastructure.  It was fairly easy, but it occured to me
that Debian Edu would improve a lot if I could get the client to
connect without any changes at all, and thus let the client configure
itself during installation and first boot to use the infrastructure
around it.  Now I am a huge step further along that road.&lt;/p&gt;

&lt;p&gt;With our current squeeze-test packages, I can select the roaming
workstation profile and get a working laptop connecting to the
university LDAP server for user and group and our active directory
servers for Kerberos authentication.  All this without any
configuration at all during installation.  My users home directory got
a bookmark in the KDE menu to mount it via SMB, with the correct URL.
In short, openldap and sssd is correctly configured.  In addition to
this, the client look for http://wpad/wpad.dat to configure a web
proxy, and when it fail to find it no proxy settings are stored in
/etc/environment and /etc/apt/apt.conf.  Iceweasel and KDE is
configured to look for the same wpad configuration and also do not use
a proxy when at the university network.  If the machine is moved to a
network with such wpad setup, it would automatically use it when DHCP
gave it a IP address.&lt;/p&gt;

&lt;p&gt;The LDAP server is located using DNS, by first looking for the DNS
entry ldap.$domain.  If this do not exist, it look for the
_ldap._tcp.$domain SRV records and use the first one as the LDAP
server.  Next, it connects to the LDAP server and search all
namingContexts entries for posixAccount or posixGroup objects, and
pick the first one as the LDAP base.  For Kerberos, a similar
algorithm is used to locate the LDAP server, and the realm is the
uppercase version of $domain.&lt;/p&gt;

&lt;p&gt;So, what is not working, you might ask.  SMB mounting my home
directory do not work.  No idea why, but suspected the incorrect
Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
the cause.  These are not properly configured during installation, and
had to be hand-edited to get the correct Kerberos realm and server,
but SMB mounting still do not work. :(&lt;/p&gt;

&lt;p&gt;With this automatic configuration in place, I expect a Debian Edu
roaming profile installation would be able to automatically detect and
connect to any site using LDAP and Kerberos for NSS directory and PAM
authentication.  It should also work out of the box in a Active
Directory environment providing posixAccount and posixGroup objects
with UID and GID values.&lt;/p&gt;

&lt;p&gt;If you want to help out with implementing these things for Debian
Edu, please contact us on debian-edu@lists.debian.org.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Debian Edu roaming workstation - at the university of Oslo</title>
                <link>http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html</guid>
                <pubDate>Tue, 3 Aug 2010 23:30:00 +0200</pubDate>
                <description>
&lt;p&gt;The new roaming workstation profile in Debian Edu/Squeeze is fairly
similar to the laptop setup am I working on using Ubuntu for the
University of Oslo, and just for the heck of it, I tested today how
hard it would be to integrate that profile into the university
infrastructure.  In this case, it is the university LDAP server,
Active Directory Kerberos server and SMB mounting from the Netapp file
servers.&lt;/p&gt;

&lt;p&gt;I was pleasantly surprised that the only three files needed to be
changed (/etc/sssd/sssd.conf, /etc/ldap.conf and
/etc/mklocaluser.d/20-debian-edu-config) and one file had to be added
(/usr/share/perl5/Debian/Edu_Local.pm), to get the client working.
Most of the changes were to get the client to use the university LDAP
for NSS and Kerberos server for PAM, but one was to change a hard
coded DNS domain name in the mklocaluser hook from .intern to
.uio.no.&lt;/p&gt;

&lt;p&gt;This testing was so encouraging, that I went ahead and adjusted the
Debian Edu scripts and setup in subversion to centralise the roaming
workstation setup a bit more and avoid the hardcoded DNS domain name,
so that when I test this tomorrow, I expect to get away with modifying
only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the
university servers.&lt;/p&gt;

&lt;p&gt;My goal is to get the clients to have no hardcoded settings and
fetch all their initial setup during installation and first boot, to
allow them to be inserted also into environments where the default
setup in Debian Edu has been changed or as with the university, where
the environment is different but provides the protocols Debian Edu
uses.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Circular package dependencies harms apt recovery</title>
                <link>http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html</guid>
                <pubDate>Tue, 27 Jul 2010 23:50:00 +0200</pubDate>
                <description>
&lt;p&gt;I discovered this while doing
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html&quot;&gt;automated
testing of upgrades from Debian Lenny to Squeeze&lt;/a&gt;.  A few packages
in Debian still got circular dependencies, and it is often claimed
that apt and aptitude should be able to handle this just fine, but
some times these dependency loops causes apt to fail.&lt;/p&gt;

&lt;p&gt;An example is from todays
&lt;a href=&quot;http://people.skolelinux.org/~pere/debian-upgrade-testing//test-20100727-lenny-squeeze-kde-aptitude.txt&quot;&gt;upgrade
of KDE using aptitude&lt;/a&gt;.  In it, a bug in kdebase-workspace-data
causes perl-modules to fail to upgrade.  The cause is simple.  If a
package fail to unpack, then only part of packages with the circular
dependency might end up being unpacked when unpacking aborts, and the
ones already unpacked will fail to configure in the recovery phase
because its dependencies are unavailable.&lt;/p&gt;

&lt;p&gt;In this log, the problem manifest itself with this error:&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
dpkg: dependency problems prevent configuration of perl-modules:
 perl-modules depends on perl (&gt;= 5.10.1-1); however:
  Version of perl on system is 5.10.0-19lenny2.
dpkg: error processing perl-modules (--configure):
 dependency problems - leaving unconfigured
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;p&gt;The perl/perl-modules circular dependency is already
&lt;a href=&quot;http://bugs.debian.org/527917&quot;&gt;reported as a bug&lt;/a&gt;, and will
hopefully be solved as soon as possible, but it is not the only one,
and each one of these loops in the dependency tree can cause similar
failures.  Of course, they only occur when there are bugs in other
packages causing the unpacking to fail, but it is rather nasty when
the failure of one package causes the problem to become worse because
of dependency loops.&lt;/p&gt;

&lt;p&gt;Thanks to
&lt;a href=&quot;http://lists.debian.org/debian-devel/2010/06/msg00116.html&quot;&gt;the
tireless effort by Bill Allombert&lt;/a&gt;, the number of circular
dependencies
&lt;a href=&quot;http://debian.semistable.com/debgraph.out.html&quot;&gt;left in Debian
is dropping&lt;/a&gt;, and perhaps it will reach zero one day. :)&lt;/p&gt;

&lt;p&gt;Todays testing also exposed a bug in
&lt;a href=&quot;http://bugs.debian.org/590605&quot;&gt;update-notifier&lt;/a&gt; and
&lt;a href=&quot;http://bugs.debian.org/590604&quot;&gt;different behaviour&lt;/a&gt; between
apt-get and aptitude, the latter possibly caused by some circular
dependency.  Reported both to BTS to try to get someone to look at
it.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>First Debian Edu test release (alpha0) based on Squeeze is released</title>
                <link>http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html</guid>
                <pubDate>Tue, 27 Jul 2010 17:45:00 +0200</pubDate>
                <description>
&lt;p&gt;I just posted this announcement culminating several months of work
with the next Debian Edu release.  Not nearly done, but one major step
completed.&lt;/p&gt;

&lt;blockquote&gt;
&lt;p&gt;This is the first test release based on Squeeze. The focus of this
release is to test the user application selection. To have a look,
install the standalone profile and let the developers know if the set
of installed packages i.e. applications should be modified. If some
user application is missing, or if there are some applications that no
longer make sense to be included in Debian Edu, please let us know.
Also, if a useful application is missing the translation for your
language of choice, please let us know too.&lt;/p&gt;

&lt;p&gt;In addition, feedback and help to polish the desktop (menus,
artwork, starters, etc.) is appreciated. We would like to ship a nice
and handy KDE4 desktop targeted for schools out of the box.&lt;/p&gt;

&lt;p&gt;The other profiles should be installable, but there is a lot more
work left to be done before they are ready, so do not expect to
much.&lt;/p&gt;

&lt;p&gt;Changes compared to the lenny based version&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;Everything from Debian Squeeze
&lt;ul&gt;
  &lt;li&gt;Desktop environment KDE 4.4 =&gt; the new KDE desktop in
         combination with some new artwork
  &lt;li&gt;Web browser Iceweasel 3.5
  &lt;li&gt;OpenOffice.org 3.2
  &lt;li&gt;Educational toolbox GCompris 9.3
  &lt;li&gt;Music creator Rosegarden 10.04.2
  &lt;li&gt;Image editor Gimp 2.6.10
  &lt;li&gt;Virtual universe Celestia 1.6.0
  &lt;li&gt;Virtual stargazer Stellarium 0.10.4
  &lt;li&gt;3D modeler Blender 2.49.2 (new application)
  &lt;li&gt;Video editor Kdenlive 0.7.7 (new application)
&lt;/ul&gt;&lt;/li&gt;
&lt;li&gt;Now using Kerberos for password checking (migration not finished).
    Enabled for:
&lt;ul&gt;
  &lt;li&gt;PAM
  &lt;li&gt;LDAP
  &lt;li&gt;IMAP
  &lt;li&gt;SMTP (sender verification)
&lt;/ul&gt;
&lt;/li&gt;
&lt;li&gt;New experimental roaming workstation profile for laptops.&lt;/li&gt;
&lt;li&gt;Show welcome page to users when they first log in. The URL is
    fetched from LDAP.&lt;/li&gt;
&lt;li&gt;New LXDE desktop option, in addition to KDE (default) and Gnome.&lt;/li&gt;
&lt;li&gt;General cleanup (not finished)&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;The following features are not working as they should&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;No web based administration tool for creating users and groups. The
    scripts ldap-createuser-krb and ldap-add-user-to-group can be used
    for testing.&lt;/li&gt;
&lt;li&gt;DVD installs are missing debian-installer images for the PXE boot,
    and do not set up the PXE menu on eth0 because of this. LTSP
    clients should still boot from eth1 on thin client servers.&lt;/li&gt;
&lt;li&gt;The restructured KDE menu is not implemented.&lt;/li&gt;
&lt;li&gt;The LDAP server setup need to be reviewed for security.&lt;/li&gt;
&lt;li&gt;The LDAP directory structure need to be reworked.&lt;/li&gt;
&lt;li&gt;Different sets of packages are installed when using the DVD and the
    netinst CD. More packages are installed using the netinst CD.&lt;/li&gt;
&lt;li&gt;The jackd package fail to install. This is believed to be caused by
    some ongoing transition, and hopefully should be solved soon. The
    jackd1 package can be installed manually for those that need it.&lt;/li&gt;
&lt;li&gt;Some packages lack translations. See
    http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status,
    and help out with translations.&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;To download this multiarch netinstall release you can use&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href=&quot;ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso&quot;&gt;ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso&quot;&gt;http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;To download this multiarch dvd release you can use&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href=&quot;ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso&quot;&gt;ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso&quot;&gt;http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;There is no source DVD available yet. It will be prepared when we
get closer to the final release.&lt;/p&gt;

&lt;p&gt;The MD5SUM of these images are&lt;/p&gt;

&lt;ul&gt;
&lt;li&gt;3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-6.0.0+edua0-CD.iso&lt;/li&gt;
&lt;li&gt;22f2cbfce281d1c6e478be452638675d debian-edu-6.0.0+edua0-DVD.iso&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;The SHA1SUM of these images are&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-6.0.0+edua0-CD.iso&lt;/li&gt;
&lt;li&gt;2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-6.0.0+edua0-DVD.iso&lt;/li&gt;
&lt;/ul&gt;
&lt;p&gt;How to report bugs:
http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla&lt;/p&gt;

&lt;p&gt;Please direct replies to debian-edu@lists.debian.org&lt;/p&gt;
&lt;/blockquote&gt;
</description>
        </item>
        
        <item>
                <title>One step closer to single signon in Debian Edu</title>
                <link>http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html</link>
                <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html</guid>
                <pubDate>Sun, 25 Jul 2010 10:00:00 +0200</pubDate>
                <description>
&lt;p&gt;The last few months me and the other Debian Edu developers have
been working hard to get the Debian/Squeeze based version of Debian
Edu/Skolelinux into shape.  This future version will use Kerberos for
authentication, and services are slowly migrated to single signon,
getting rid of password questions one at the time.&lt;/p&gt;

&lt;p&gt;It will also feature a roaming workstation profile with local home
directory, for laptops that are only some times on the Skolelinux
network, and for this profile a shortcut is created in Gnome and KDE
to gain access to the users home directory on the file server.  This
shortcut uses SMB at the moment, and yesterday I had time to test if
SMB mounting had started working in KDE after we added the cifs-utils
package.  I was pleasantly surprised how well it worked.&lt;/p&gt;

&lt;p&gt;Thanks to the recent changes to our samba configuration to get it
to use Kerberos for authentication, there were no question about user
password when mounting the SMB volume.  A simple click on the shortcut
in the KDE menu, and a window with the home directory popped
up. :)&lt;/p&gt;

&lt;p&gt;One step closer to a single signon solution out of the box in
Debian Edu.  We already had PAM, LDAP, IMAP and SMTP in place, and now
also Samba.  Next step is Cups and hopefully also NFS.&lt;/p&gt;

&lt;p&gt;We had planned a alpha0 release of Debian Edu for today, but thanks
to the autobuilder administrators for some architectures being slow to
sign packages, we are still missing the fixed LTSP package we need for
the release.  It was uploaded three days ago with urgency=high, and if
it had entered testing yesterday we would have been able to test it in
time for a alpha0 release today.  As the binaries for ia64 and powerpc
still not uploaded to the Debian archive, we need to delay the alpha
release another day.&lt;/p&gt;

&lt;p&gt;If you want to help out with implementing Kerberos for Debian Edu,
please contact us on debian-edu@lists.debian.org.&lt;/p&gt;
</description>
        </item>
        
        </channel>
</rss>