blog/tags/ldap/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
   4   <head>
   5     <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
   6     <title>Petter Reinholdtsen: Entries Tagged ldap</title>
   7     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css" />
   8     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/vim.css" />
   9     <link rel="alternate" title="RSS Feed" href="ldap.rss" type="application/rss+xml" />
  10   </head>
  11   <body>
  12     <div class="title">
  13  <h1>
  14      <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16  </h1>
  17
  18 </div>
  19
  20
  21     <h3>Entries tagged "ldap".</h3>
  22
  23     <div class="entry">
  24       <div class="title">
  25         <a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a>
  26       </div>
  27       <div class="date">
  28         17th July 2010
  29       </div>
  30       <div class="body">
  31         <p>This is a
  32 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
  33 on my
  34 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
  35 work</a> on
  36 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
  37 all</a> the computer related LDAP objects in Debian Edu.</p>
  38
  39 <p>As a step to try to see if it possible to merge the DNS and DHCP
  40 LDAP objects, I have had a look at how the packages pdns-backend-ldap
  41 and dhcp3-server-ldap in Debian use the LDAP server.  The two
  42 implementations are quite different in how they use LDAP.</p>
  43
  44 To get this information, I started slapd with debugging enabled and
  45 dumped the debug output to a file to get the LDAP searches performed
  46 on a Debian Edu main-server.  Here is a summary.
  47
  48 <p><strong>powerdns</strong></p>
  49
  50 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
  51 on how to</a> set up PowerDNS to use a LDAP backend is available on
  52 the web.
  53
  54 <p>PowerDNS have two modes of operation using LDAP as its backend.
  55 One "strict" mode where the forward and reverse DNS lookups are done
  56 using the same LDAP objects, and a "tree" mode where the forward and
  57 reverse entries are in two different subtrees in LDAP with a structure
  58 based on the DNS names, as in tjener.intern and
  59 2.2.0.10.in-addr.arpa.</p>
  60
  61 <p>In tree mode, the server is set up to use a LDAP subtree as its
  62 base, and uses a "base" scoped search for the DNS name by adding
  63 "dc=tjener,dc=intern," to the base with a filter for
  64 "(associateddomain=tjener.intern)" for the forward entry and
  65 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
  66 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
  67 forward entries, it is looking for attributes named dnsttl, arecord,
  68 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
  69 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
  70 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
  71 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
  72 spfrecord and modifytimestamp.  For reverse entries it is looking for
  73 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
  74 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
  75 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
  76 ldapsearch commands could look like this:</p>
  77
  78 <blockquote><pre>
  79 ldapsearch -h ldap \
  80   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
  81   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
  82   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
  83   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
  84   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
  85   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
  86
  87 ldapsearch -h ldap \
  88   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
  89   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
  90   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
  91   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
  92   srvrecord naptrrecord modifytimestamp
  93 </pre></blockquote>
  94
  95 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
  96 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
  97 example LDAP objects used there.  In addition to these objects, the
  98 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
  99 also exist.</p>
 100
 101 <blockquote><pre>
 102 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
 103 objectclass: top
 104 objectclass: dnsdomain
 105 objectclass: domainrelatedobject
 106 dc: tjener
 107 arecord: 10.0.2.2
 108 associateddomain: tjener.intern
 109
 110 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
 111 objectclass: top
 112 objectclass: dnsdomain2
 113 objectclass: domainrelatedobject
 114 dc: 2
 115 ptrrecord: tjener.intern
 116 associateddomain: 2.2.0.10.in-addr.arpa
 117 </pre></blockquote>
 118
 119 <p>In strict mode, the server behaves differently.  When looking for
 120 forward DNS entries, it is doing a "subtree" scoped search with the
 121 same base as in the tree mode for a object with filter
 122 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
 123 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
 124 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
 125 naptrrecord and modifytimestamp.  For reverse entires it also do a
 126 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
 127 and the requested attributes are associateddomain, dnsttl and
 128 modifytimestamp.  In short, in strict mode the objects with ptrrecord
 129 go away, and the arecord attribute in the forward object is used
 130 instead.</p>
 131
 132 <p>The forward and reverse searches can be simulated using ldapsearch
 133 like this:</p>
 134
 135 <blockquote><pre>
 136 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 137   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 138   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 139   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 140   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 141   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 142
 143 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 144   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
 145 </pre></blockquote>
 146
 147 <p>In addition to the forward and reverse searches , there is also a
 148 search for SOA records, which behave similar to the forward and
 149 reverse lookups.</p>
 150
 151 <p>A thing to note with the PowerDNS behaviour is that it do not
 152 specify any objectclass names, and instead look for the attributes it
 153 need to generate a DNS reply.  This make it able to work with any
 154 objectclass that provide the needed attributes.</p>
 155
 156 <p>The attributes are normally provided in the cosine (RFC 1274) and
 157 dnsdomain2 schemas.  The latter is used for reverse entries like
 158 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
 159
 160 <p>In Debian Edu, we have created DNS objects using the object classes
 161 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
 162 attributes) and domainrelatedobject (for associatedDomain).  The use
 163 of structural object classes make it impossible to combine these
 164 classes with the object classes used by DHCP.</p>
 165
 166 <p>There are other schemas that could be used too, for example the
 167 dnszone structural object class used by Gosa and bind-sdb for the DNS
 168 attributes combined with the domainrelatedobject object class, but in
 169 this case some unused attributes would have to be included as well
 170 (zonename and relativedomainname).</p>
 171
 172 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
 173 mode and not use any of the existing objectclasses (dnsdomain,
 174 dnsdomain2 and dnszone) when one want to combine the DNS information
 175 with DHCP information, and instead create a auxiliary object class
 176 defined something like this (using the attributes defined for
 177 dnsdomain and dnsdomain2 or dnszone):</p>
 178
 179 <blockquote><pre>
 180 objectclass ( some-oid NAME 'dnsDomainAux'
 181     SUP top
 182     AUXILIARY
 183     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
 184           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
 185           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
 186           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
 187           A6Record $ DNAMERecord
 188     ))
 189 </pre></blockquote>
 190
 191 <p>This will allow any object to become a DNS entry when combined with
 192 the domainrelatedobject object class, and allow any entity to include
 193 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
 194 developers asking for their view on this schema and if they are
 195 interested in providing such schema with PowerDNS, and I hope my
 196 message will be accepted into their mailing list soon.</p>
 197
 198 <p><strong>ISC dhcp</strong></p>
 199
 200 <p>The DHCP server searches for specific objectclass and requests all
 201 the object attributes, and then uses the attributes it want.  This
 202 make it harder to figure out exactly what attributes are used, but
 203 thanks to the working example in Debian Edu I can at least get an idea
 204 what is needed without having to read the source code.</p>
 205
 206 <p>In the DHCP server configuration, the LDAP base to use and the
 207 search filter to use to locate the correct dhcpServer entity is
 208 stored.  These are the relevant entries from
 209 /etc/dhcp3/dhcpd.conf:</p>
 210
 211 <blockquote><pre>
 212 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
 213 ldap-dhcp-server-cn "dhcp";
 214 </pre></blockquote>
 215
 216 <p>The DHCP server uses this information to nest all the DHCP
 217 configuration it need.  The cn "dhcp" is located using the given LDAP
 218 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
 219 search result is this entry:</p>
 220
 221 <blockquote><pre>
 222 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
 223 cn: dhcp
 224 objectClass: top
 225 objectClass: dhcpServer
 226 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 227 </pre></blockquote>
 228
 229 <p>The content of the dhcpServiceDN attribute is next used to locate the
 230 subtree with DHCP configuration.  The DHCP configuration subtree base
 231 is located using a base scope search with base "cn=DHCP
 232 Config,dc=skole,dc=skolelinux,dc=no" and filter
 233 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
 234 The search result is this entry:</p>
 235
 236 <blockquote><pre>
 237 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 238 cn: DHCP Config
 239 objectClass: top
 240 objectClass: dhcpService
 241 objectClass: dhcpOptions
 242 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
 243 dhcpStatements: ddns-update-style none
 244 dhcpStatements: authoritative
 245 dhcpOption: smtp-server code 69 = array of ip-address
 246 dhcpOption: www-server code 72 = array of ip-address
 247 dhcpOption: wpad-url code 252 = text
 248 </pre></blockquote>
 249
 250 <p>Next, the entire subtree is processed, one level at the time.  When
 251 all the DHCP configuration is loaded, it is ready to receive requests.
 252 The subtree in Debian Edu contain objects with object classes
 253 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
 254 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
 255 and information about netmasks, dynamic range etc.  Leaving out the
 256 details here because it is not relevant for the focus of my
 257 investigation, which is to see if it is possible to merge dns and dhcp
 258 related computer objects.</p>
 259
 260 <p>When a DHCP request come in, LDAP is searched for the MAC address
 261 of the client (00:00:00:00:00:00 in this example), using a subtree
 262 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
 263 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
 264 00:00:00:00:00:00))" as the filter.  This is what a host object look
 265 like:</p>
 266
 267 <blockquote><pre>
 268 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 269 cn: hostname
 270 objectClass: top
 271 objectClass: dhcpHost
 272 dhcpHWAddress: ethernet 00:00:00:00:00:00
 273 dhcpStatements: fixed-address hostname
 274 </pre></blockquote>
 275
 276 <p>There is less flexiblity in the way LDAP searches are done here.
 277 The object classes need to have fixed names, and the configuration
 278 need to be stored in a fairly specific LDAP structure.  On the
 279 positive side, the invidiual dhcpHost entires can be anywhere without
 280 the DN pointed to by the dhcpServer entries.  The latter should make
 281 it possible to group all host entries in a subtree next to the
 282 configuration entries, and this subtree can also be shared with the
 283 DNS server if the schema proposed above is combined with the dhcpHost
 284 structural object class.
 285
 286 <p><strong>Conclusion</strong></p>
 287
 288 <p>The PowerDNS implementation seem to be very flexible when it come
 289 to which LDAP schemas to use.  While its "tree" mode is rigid when it
 290 come to the the LDAP structure, the "strict" mode is very flexible,
 291 allowing DNS objects to be stored anywhere under the base cn specified
 292 in the configuration.</p>
 293
 294 <p>The DHCP implementation on the other hand is very inflexible, both
 295 regarding which LDAP schemas to use and which LDAP structure to use.
 296 I guess one could implement ones own schema, as long as the
 297 objectclasses and attributes have the names used, but this do not
 298 really help when the DHCP subtree need to have a fairly fixed
 299 structure.</p>
 300
 301 <p>Based on the observed behaviour, I suspect a LDAP structure like
 302 this might work for Debian Edu:</p>
 303
 304 <blockquote><pre>
 305 ou=services
 306   cn=machine-info (dhcpService) - dhcpServiceDN points here
 307     cn=dhcp (dhcpServer)
 308     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
 309       cn=10.0.2.0 (dhcpSubnet)
 310         cn=group1 (dhcpGroup/dhcpOptions)
 311     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
 312       cn=192.168.0.0 (dhcpSubnet)
 313         cn=group1 (dhcpGroup/dhcpOptions)
 314     ou=machines - PowerDNS base points here
 315       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
 316 </pre></blockquote>
 317
 318 <P>This is not tested yet.  If the DHCP server require the dhcpHost
 319 entries to be in the dhcpGroup subtrees, the entries can be stored
 320 there instead of a common machines subtree, and the PowerDNS base
 321 would have to be moved one level up to the machine-info subtree.</p>
 322
 323 <p>The combined object under the machines subtree would look something
 324 like this:</p>
 325
 326 <blockquote><pre>
 327 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
 328 dc: hostname
 329 objectClass: top
 330 objectClass: dhcpHost
 331 objectclass: domainrelatedobject
 332 objectclass: dnsDomainAux
 333 associateddomain: hostname.intern
 334 arecord: 10.11.12.13
 335 dhcpHWAddress: ethernet 00:00:00:00:00:00
 336 dhcpStatements: fixed-address hostname.intern
 337 </pre></blockquote>
 338
 339 </p>One could even add the LTSP configuration associated with a given
 340 machine, as long as the required attributes are available in a
 341 auxiliary object class.</p>
 342
 343       </div>
 344       <div class="tags">
 345
 346
 347         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 348
 349
 350       </div>
 351     </div>
 352     <div class="padding"></div>
 353
 354     <div class="entry">
 355       <div class="title">
 356         <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a>
 357       </div>
 358       <div class="date">
 359         14th July 2010
 360       </div>
 361       <div class="body">
 362         <p>For a while now, I have wanted to find a way to change the DNS and
 363 DHCP services in Debian Edu to use the same LDAP objects for a given
 364 computer, to avoid the possibility of having a inconsistent state for
 365 a computer in LDAP (as in DHCP but no DNS entry or the other way
 366 around) and make it easier to add computers to LDAP.</p>
 367
 368 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
 369 information finally found a solution that seem to work.</p>
 370
 371 <p>The old setup required three LDAP objects for a given computer.
 372 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
 373 we switch powerdns to use its strict LDAP method (ldap-method=strict
 374 in pdns-debian-edu.conf), the forward and reverse DNS entries are
 375 merged into one while making it impossible to transfer the reverse map
 376 to a slave DNS server.</p>
 377
 378 <p>If we also replace the object class used to get the DNS related
 379 attributes to one allowing these attributes to be combined with the
 380 dhcphost object class, we can merge the DNS and DHCP entries into one.
 381 I've written such object class in the dnsdomainaux.schema file (need
 382 proper OIDs, but that is a minor issue), and tested the setup.  It
 383 seem to work.</p>
 384
 385 <p>With this test setup in place, we can get away with one LDAP object
 386 for both DNS and DHCP, and even the LTSP configuration I suggested in
 387 an earlier email.  The combined LDAP object will look something like
 388 this:</p>
 389
 390 <blockquote><pre>
 391   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 392   cn: hostname
 393   objectClass: dhcphost
 394   objectclass: domainrelatedobject
 395   objectclass: dnsdomainaux
 396   associateddomain: hostname.intern
 397   arecord: 10.11.12.13
 398   dhcphwaddress: ethernet 00:00:00:00:00:00
 399   dhcpstatements: fixed-address hostname
 400   ldapconfigsound: Y
 401 </pre></blockquote>
 402
 403 <p>The DNS server uses the associateddomain and arecord entries, while
 404 the DHCP server uses the dhcphwaddress and dhcpstatements entries
 405 before asking DNS to resolve the fixed-adddress.  LTSP will use
 406 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
 407
 408 <p>I am not yet sure if I can get the DHCP server to look for its
 409 dhcphost in a different location, to allow us to put the objects
 410 outside the "DHCP Config" subtree, but hope to figure out a way to do
 411 that.  If I can't figure out a way to do that, we can still get rid of
 412 the hosts subtree and move all its content into the DHCP Config tree
 413 (which probably should be renamed to be more related to the new
 414 content.  I suspect cn=dnsdhcp,ou=services or something like that
 415 might be a good place to put it.</p>
 416
 417 <p>If you want to help out with implementing this for Debian Edu,
 418 please contact us on debian-edu@lists.debian.org.</p>
 419
 420       </div>
 421       <div class="tags">
 422
 423
 424         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 425
 426
 427       </div>
 428     </div>
 429     <div class="padding"></div>
 430
 431     <div class="entry">
 432       <div class="title">
 433         <a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a>
 434       </div>
 435       <div class="date">
 436         11th July 2010
 437       </div>
 438       <div class="body">
 439         <p>Vagrant mentioned on IRC today that ltsp_config now support
 440 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
 441 clients, and that this can be used to fetch configuration from LDAP if
 442 Debian Edu choose to store configuration there.</p>
 443
 444 <p>Armed with this information, I got inspired and wrote a test module
 445 to get configuration from LDAP.  The idea is to look up the MAC
 446 address of the client in LDAP, and look for attributes on the form
 447 ltspconfigsetting=value, and use this to export SETTING=value to the
 448 LTSP clients.</p>
 449
 450 <p>The goal is to be able to store the LTSP configuration attributes
 451 in a "computer" LDAP object used by both DNS and DHCP, and thus
 452 allowing us to store all information about a computer in one place.</p>
 453
 454 <p>This is a untested draft implementation, and I welcome feedback on
 455 this approach.  A real LDAP schema for the ltspClientAux objectclass
 456 need to be written.  Comments, suggestions, etc?</p>
 457
 458 <blockquote><pre>
 459 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
 460 #
 461 # Fetch LTSP client settings from LDAP based on MAC address
 462 #
 463 # Uses ethernet address as stored in the dhcpHost objectclass using
 464 # the dhcpHWAddress attribute or ethernet address stored in the
 465 # ieee802Device objectclass with the macAddress attribute.
 466 #
 467 # This module is written to be schema agnostic, and only depend on the
 468 # existence of attribute names.
 469 #
 470 # The LTSP configuration variables are saved directly using a
 471 # ltspConfig prefix and uppercasing the rest of the attribute name.
 472 # To set the SERVER variable, set the ltspConfigServer attribute.
 473 #
 474 # Some LDAP schema should be created with all the relevant
 475 # configuration settings.  Something like this should work:
 476 #
 477 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
 478 #     SUP top
 479 #     AUXILIARY
 480 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
 481
 482 LDAPSERVER=$(debian-edu-ldapserver)
 483 if [ "$LDAPSERVER" ] ; then
 484     LDAPBASE=$(debian-edu-ldapserver -b)
 485     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
 486         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
 487         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
 488             grep '^ltspConfig' | while read attr value ; do
 489             # Remove prefix and convert to upper case
 490             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
 491             # bass value on to clients
 492             eval "$attr=$value; export $attr"
 493         done
 494     done
 495 fi
 496 </pre></blockquote>
 497
 498 <p>I'm not sure this shell construction will work, because I suspect
 499 the while block might end up in a subshell causing the variables set
 500 there to not show up in ltsp-config, but if that is the case I am sure
 501 the code can be restructured to make sure the variables are passed on.
 502 I expect that can be solved with some testing. :)</p>
 503
 504 <p>If you want to help out with implementing this for Debian Edu,
 505 please contact us on debian-edu@lists.debian.org.</p>
 506
 507 <p>Update 2010-07-17: I am aware of another effort to store LTSP
 508 configuration in LDAP that was created around year 2000 by
 509 <a href="http://www.pcxperience.com/thinclient/documentation/ldap.html">PC
 510 Xperience, Inc., 2000</a>.  I found its
 511 <a href="http://people.redhat.com/alikins/ltsp/ldap/">files</a> on a
 512 personal home page over at redhat.com.</p>
 513
 514       </div>
 515       <div class="tags">
 516
 517
 518         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 519
 520
 521       </div>
 522     </div>
 523     <div class="padding"></div>
 524
 525     <div class="entry">
 526       <div class="title">
 527         <a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a>
 528       </div>
 529       <div class="date">
 530          9th July 2010
 531       </div>
 532       <div class="body">
 533         <p>Since
 534 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
 535 last post</a> about available LDAP tools in Debian, I was told about a
 536 LDAP GUI that is even better than luma.  The java application
 537 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
 538 moving LDAP objects and subtrees using drag-and-drop, and can
 539 authenticate using Kerberos.  I have only tested the Kerberos
 540 authentication, but do not have a LDAP setup allowing me to rewrite
 541 LDAP with my test user yet.  It is
 542 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
 543 Debian</a> testing and unstable at the moment.  The only problem I
 544 have with it is how it handle errors.  If something go wrong, its
 545 non-intuitive behaviour require me to go through some query work list
 546 and remove the failing query.  Nothing big, but very annoying.</p>
 547
 548       </div>
 549       <div class="tags">
 550
 551
 552         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 553
 554
 555       </div>
 556     </div>
 557     <div class="padding"></div>
 558
 559     <div class="entry">
 560       <div class="title">
 561         <a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a>
 562       </div>
 563       <div class="date">
 564          1st July 2010
 565       </div>
 566       <div class="body">
 567         <p>For a laptop, centralized user directories and password checking is
 568 a bit troubling.  Laptops are typically used also when not connected
 569 to the network, and it is vital for a user to be able to log in or
 570 unlock the screen saver also when a central server is unavailable.
 571 This is possible by caching passwords and directory information (user
 572 and group attributes) locally, and the packages to do so are available
 573 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
 574 It is also possible to set up in Debian/Lenny, but require more manual
 575 setup there because pam-auth-update is missing in Lenny.</p>
 576
 577 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
 578
 579 This is the traditional method with a twist.  The password caching is
 580 provided by libpam-ccreds (version 10-4 or later is needed on
 581 Squeeze), and the directory caching is done by nscd.  The directory
 582 lookup and password checking is done using LDAP.  If one want to use
 583 Kerberos for password checking the libpam-ldapd package can be
 584 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
 585 local home directory with the path listed in LDAP, one can use the
 586 pam_mkhomedir module from pam-modules to make this happen instead of
 587 using libpam-mklocaluser.  A setup for pam-auth-update to enable
 588 pam_mkhomedir will have to be written until a fix for
 589 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
 590 archive.  Because I believe it is a bad idea to have local home
 591 directories using misleading paths like /site/server/partition/, I
 592 prefer to create a local user with the home directory in /home/.  This
 593 is done using the libpam-mklocaluser package.</p>
 594
 595 <p>These packages need to be installed and configured</p>
 596
 597 <blockquote><pre>
 598 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
 599 </pre></blockquote>
 600
 601 <p>The ldapd packages will ask for LDAP connection information, and
 602 one have to fill in the values that fits ones own site.  Make sure the
 603 PAM part uses encrypted connections, to make sure the password is not
 604 sent in clear text to the LDAP server.  I've been unable to get TLS
 605 certificate checking for a self signed certificate working, which make
 606 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
 607 is talking to the correct LDAP server), and very much welcome feedback
 608 on how to get this working.</p>
 609
 610 <p>Because nscd do not have a default configuration fit for offline
 611 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
 612 is fixed, this configuration should be used instead of the one
 613 currently in /etc/nscd.conf.  The changes are in the fields
 614 reload-count and positive-time-to-live, and is based on the
 615 instructions I found in the
 616 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
 617 instructions by Flyn Computing.</p>
 618
 619 <blockquote><pre>
 620         debug-level             0
 621         reload-count            unlimited
 622         paranoia                no
 623
 624         enable-cache            passwd          yes
 625         positive-time-to-live   passwd          2592000
 626         negative-time-to-live   passwd          20
 627         suggested-size          passwd          211
 628         check-files             passwd          yes
 629         persistent              passwd          yes
 630         shared                  passwd          yes
 631         max-db-size             passwd          33554432
 632         auto-propagate          passwd          yes
 633
 634         enable-cache            group           yes
 635         positive-time-to-live   group           2592000
 636         negative-time-to-live   group           20
 637         suggested-size          group           211
 638         check-files             group           yes
 639         persistent              group           yes
 640         shared                  group           yes
 641         max-db-size             group           33554432
 642         auto-propagate          group           yes
 643
 644         enable-cache            hosts           no
 645         positive-time-to-live   hosts           2592000
 646         negative-time-to-live   hosts           20
 647         suggested-size          hosts           211
 648         check-files             hosts           yes
 649         persistent              hosts           yes
 650         shared                  hosts           yes
 651         max-db-size             hosts           33554432
 652
 653         enable-cache            services        yes
 654         positive-time-to-live   services        2592000
 655         negative-time-to-live   services        20
 656         suggested-size          services        211
 657         check-files             services        yes
 658         persistent              services        yes
 659         shared                  services        yes
 660         max-db-size             services        33554432
 661 </pre></blockquote>
 662
 663 <p>While we wait for a mechanism to update /etc/nsswitch.conf
 664 automatically like the one provided in
 665 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
 666 content need to be manually replaced to ensure LDAP is used as the
 667 directory service on the machine.  /etc/nsswitch.conf should normally
 668 look like this:</p>
 669
 670 <blockquote><pre>
 671 passwd:         files ldap
 672 group:          files ldap
 673 shadow:         files ldap
 674 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 675 networks:       files
 676 protocols:      files
 677 services:       files
 678 ethers:         files
 679 rpc:            files
 680 netgroup:       files ldap
 681 </pre></blockquote>
 682
 683 <p>The important parts are that ldap is listed last for passwd, group,
 684 shadow and netgroup.</p>
 685
 686 <p>With these changes in place, any user in LDAP will be able to log
 687 in locally on the machine using for example kdm, get a local home
 688 directory created and have the password as well as user and group
 689 attributes cached.
 690
 691 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 692   libpam-mklocaluser/pam_mkhomedir</h2>
 693
 694 <p>Because nscd have had its share of problems, and seem to have
 695 problems doing proper caching, I've seen suggestions and recipes to
 696 use nss-updatedb to copy parts of the LDAP database locally when the
 697 LDAP database is available.  I have not tested such setup, because I
 698 discovered sssd.</p>
 699
 700 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
 701
 702 <p>A more flexible and robust setup than the nscd combination
 703 mentioned earlier that has shown up recently, is the
 704 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
 705 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
 706 to provide a Active Directory like directory service for Linux
 707 machines.  The sssd system combines the caching of passwords and user
 708 information into one package, and remove the need for nscd and
 709 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 710 1.2 do not support netgroups, but it is said that it will support this
 711 in version 1.5 expected to show up later in 2010.  Because the
 712 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
 713 was missing in Debian, I ended up co-maintaining it with Werner, and
 714 version 1.2 is now in testing.
 715
 716 <p>These packages need to be installed and configured to get the
 717 roaming setup I want</p>
 718
 719 <blockquote><pre>
 720 libpam-sss libnss-sss libpam-mklocaluser
 721 </pre></blockquote>
 722
 723 The complete setup of sssd is done by editing/creating
 724 <tt>/etc/sssd/sssd.conf</tt>.
 725
 726 <blockquote><pre>
 727 [sssd]
 728 config_file_version = 2
 729 reconnection_retries = 3
 730 sbus_timeout = 30
 731 services = nss, pam
 732 domains = INTERN
 733
 734 [nss]
 735 filter_groups = root
 736 filter_users = root
 737 reconnection_retries = 3
 738
 739 [pam]
 740 reconnection_retries = 3
 741
 742 [domain/INTERN]
 743 enumerate = false
 744 cache_credentials = true
 745
 746 id_provider = ldap
 747 auth_provider = ldap
 748 chpass_provider = ldap
 749
 750 ldap_uri = ldap://ldap
 751 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 752 ldap_tls_reqcert = never
 753 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 754 </pre></blockquote>
 755
 756 <p>I got the same problem here with certificate checking.  Had to set
 757 "ldap_tls_reqcert = never" to get it working.</p>
 758
 759 <p>With the libnss-sss package in testing at the moment, the
 760 nsswitch.conf file is update automatically, so there is no need to
 761 modify it manually.</p>
 762
 763 <p>If you want to help out with implementing this for Debian Edu,
 764 please contact us on debian-edu@lists.debian.org.</p>
 765
 766       </div>
 767       <div class="tags">
 768
 769
 770         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 771
 772
 773       </div>
 774     </div>
 775     <div class="padding"></div>
 776
 777     <div class="entry">
 778       <div class="title">
 779         <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">LUMA, a very nice LDAP GUI</a>
 780       </div>
 781       <div class="date">
 782         28th June 2010
 783       </div>
 784       <div class="body">
 785         <p>The last few days I have been looking into the status of the LDAP
 786 directory in Debian Edu, and in the process I started to miss a GUI
 787 tool to browse the LDAP tree.  The only one I was able to find in
 788 Debian/Squeeze and Lenny is
 789 <a href="http://luma.sourceforge.net/">LUMA</a>, which has proved to
 790 be a great tool to get a overview of the current LDAP directory
 791 populated by default in Skolelinux.  Thanks to it, I have been able to
 792 find empty and obsolete subtrees, misplaced objects and duplicate
 793 objects.  It will be installed by default in Debian/Squeeze.  If you
 794 are working with LDAP, give it a go. :)</p>
 795
 796 <p>I did notice one problem with it I have not had time to report to
 797 the BTS yet.  There is no .desktop file in the package, so the tool do
 798 not show up in the Gnome and KDE menus, but only deep down in in the
 799 Debian submenu in KDE.  I hope that can be fixed before Squeeze is
 800 released.</p>
 801
 802 <p>I have not yet been able to get it to modify the tree yet.  I would
 803 like to move objects and remove subtrees directly in the GUI, but have
 804 not found a way to do that with LUMA yet.  So in the mean time, I use
 805 <a href="http://www.lichteblau.com/ldapvi/">ldapvi</a> for that.</p>
 806
 807 <p>If you have tips on other GUI tools for LDAP that might be useful
 808 in Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 809
 810 <p>Update 2010-06-29: Ross Reedstrom tipped us about the
 811 <a href="http://packages.qa.debian.org/g/gq.html">gq</a> package as a
 812 useful GUI alternative.  It seem like a good tool, but is unmaintained
 813 in Debian and got a RC bug keeping it out of Squeeze.  Unless that
 814 changes, it will not be an option for Debian Edu based on Squeeze.</p>
 815
 816       </div>
 817       <div class="tags">
 818
 819
 820         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 821
 822
 823       </div>
 824     </div>
 825     <div class="padding"></div>
 826
 827     <div class="entry">
 828       <div class="title">
 829         <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">Idea for a change to LDAP schemas allowing DNS and DHCP info to be combined into one object</a>
 830       </div>
 831       <div class="date">
 832         24th June 2010
 833       </div>
 834       <div class="body">
 835         <p>A while back, I
 836 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">complained
 837 about the fact</a> that it is not possible with the provided schemas
 838 for storing DNS and DHCP information in LDAP to combine the two sets
 839 of information into one LDAP object representing a computer.</p>
 840
 841 <p>In the mean time, I discovered that a simple fix would be to make
 842 the dhcpHost object class auxiliary, to allow it to be combined with
 843 the dNSDomain object class, and thus forming one object for one
 844 computer when storing both DHCP and DNS information in LDAP.</p>
 845
 846 <p>If I understand this correctly, it is not safe to do this change
 847 without also changing the assigned number for the object class, and I
 848 do not know enough about LDAP schema design to do that properly for
 849 Debian Edu.</p>
 850
 851 <p>Anyway, for future reference, this is how I believe we could change
 852 the
 853 <a href="http://tools.ietf.org/html/draft-ietf-dhc-ldap-schema-00">DHCP
 854 schema</a> to solve at least part of the problem with the LDAP schemas
 855 available today from IETF.</p>
 856
 857 <pre>
 858 --- dhcp.schema    (revision 65192)
 859 +++ dhcp.schema    (working copy)
 860 @@ -376,7 +376,7 @@
 861  objectclass ( 2.16.840.1.113719.1.203.6.6
 862         NAME 'dhcpHost'
 863         DESC 'This represents information about a particular client'
 864 -       SUP top
 865 +       SUP top AUXILIARY
 866         MUST cn
 867         MAY  (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
 868         X-NDS_CONTAINMENT ('dhcpService' 'dhcpSubnet' 'dhcpGroup') )
 869 </pre>
 870
 871 <p>I very much welcome clues on how to do this properly for Debian
 872 Edu/Squeeze.  We provide the DHCP schema in our debian-edu-config
 873 package, and should thus be free to rewrite it as we see fit.</p>
 874
 875 <p>If you want to help out with implementing this for Debian Edu,
 876 please contact us on debian-edu@lists.debian.org.</p>
 877
 878       </div>
 879       <div class="tags">
 880
 881
 882         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 883
 884
 885       </div>
 886     </div>
 887     <div class="padding"></div>
 888
 889     <div class="entry">
 890       <div class="title">
 891         <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">Time for new  LDAP schemas replacing RFC 2307?</a>
 892       </div>
 893       <div class="date">
 894         29th March 2009
 895       </div>
 896       <div class="body">
 897         <p>The state of standardized LDAP schemas on Linux is far from
 898 optimal.  There is RFC 2307 documenting one way to store NIS maps in
 899 LDAP, and a modified version of this normally called RFC 2307bis, with
 900 some modifications to be compatible with Active Directory.  The RFC
 901 specification handle the content of a lot of system databases, but do
 902 not handle DNS zones and DHCP configuration.</p>
 903
 904 <p>In <a href="http://www.skolelinux.org/">Debian Edu/Skolelinux</a>,
 905 we would like to store information about users, SMB clients/hosts,
 906 filegroups, netgroups (users and hosts), DHCP and DNS configuration,
 907 and LTSP configuration in LDAP.  These objects have a lot in common,
 908 but with the current LDAP schemas it is not possible to have one
 909 object per entity.  For example, one need to have at least three LDAP
 910 objects for a given computer, one with the SMB related stuff, one with
 911 DNS information and another with DHCP information.  The schemas
 912 provided for DNS and DHCP are impossible to combine into one LDAP
 913 object.  In addition, it is impossible to implement quick queries for
 914 netgroup membership, because of the way NIS triples are implemented.
 915 It just do not scale.  I believe it is time for a few RFC
 916 specifications to cleam up this mess.</p>
 917
 918 <p>I would like to have one LDAP object representing each computer in
 919 the network, and this object can then keep the SMB (ie host key), DHCP
 920 (mac address/name) and DNS (name/IP address) settings in one place.
 921 It need to be efficently stored to make sure it scale well.</p>
 922
 923 <p>I would also like to have a quick way to map from a user or
 924 computer and to the net group this user or computer is a member.</p>
 925
 926 <p>Active Directory have done a better job than unix heads like myself
 927 in this regard, and the unix side need to catch up.  Time to start a
 928 new IETF work group?</p>
 929
 930       </div>
 931       <div class="tags">
 932
 933
 934         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 935
 936
 937       </div>
 938     </div>
 939     <div class="padding"></div>
 940
 941     <p style="text-align: right;"><a href="ldap.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14" /></a></p>
 942     <div id="sidebar">
 943
 944
 945
 946 <h2>Archive</h2>
 947 <ul>
 948
 949 <li>2013
 950 <ul>
 951
 952 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/01/">January (11)</a></li>
 953
 954 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/02/">February (3)</a></li>
 955
 956 </ul></li>
 957
 958 <li>2012
 959 <ul>
 960
 961 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/01/">January (7)</a></li>
 962
 963 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/02/">February (10)</a></li>
 964
 965 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/03/">March (17)</a></li>
 966
 967 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/04/">April (12)</a></li>
 968
 969 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/05/">May (12)</a></li>
 970
 971 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/06/">June (20)</a></li>
 972
 973 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/07/">July (17)</a></li>
 974
 975 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/08/">August (6)</a></li>
 976
 977 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/09/">September (9)</a></li>
 978
 979 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/10/">October (17)</a></li>
 980
 981 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/11/">November (10)</a></li>
 982
 983 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/12/">December (7)</a></li>
 984
 985 </ul></li>
 986
 987 <li>2011
 988 <ul>
 989
 990 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
 991
 992 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
 993
 994 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
 995
 996 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
 997
 998 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
 999
1000 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
1001
1002 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (7)</a></li>
1003
1004 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/08/">August (6)</a></li>
1005
1006 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/09/">September (4)</a></li>
1007
1008 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/10/">October (2)</a></li>
1009
1010 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/11/">November (3)</a></li>
1011
1012 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/12/">December (1)</a></li>
1013
1014 </ul></li>
1015
1016 <li>2010
1017 <ul>
1018
1019 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
1020
1021 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
1022
1023 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1024
1025 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1026
1027 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1028
1029 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1030
1031 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
1032
1033 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
1034
1035 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
1036
1037 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
1038
1039 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
1040
1041 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
1042
1043 </ul></li>
1044
1045 <li>2009
1046 <ul>
1047
1048 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1049
1050 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1051
1052 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1053
1054 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1055
1056 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1057
1058 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1059
1060 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1061
1062 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1063
1064 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1065
1066 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1067
1068 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1069
1070 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1071
1072 </ul></li>
1073
1074 <li>2008
1075 <ul>
1076
1077 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1078
1079 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1080
1081 </ul></li>
1082
1083 </ul>
1084
1085
1086
1087 <h2>Tags</h2>
1088 <ul>
1089
1090  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (13)</a></li>
1091
1092  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1093
1094  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1095
1096  <li><a href="http://people.skolelinux.org/pere/blog/tags/bankid">bankid (4)</a></li>
1097
1098  <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (6)</a></li>
1099
1100  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (12)</a></li>
1101
1102  <li><a href="http://people.skolelinux.org/pere/blog/tags/bsa">bsa (2)</a></li>
1103
1104  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (70)</a></li>
1105
1106  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (118)</a></li>
1107
1108  <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (9)</a></li>
1109
1110  <li><a href="http://people.skolelinux.org/pere/blog/tags/docbook">docbook (7)</a></li>
1111
1112  <li><a href="http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (4)</a></li>
1113
1114  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (176)</a></li>
1115
1116  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (21)</a></li>
1117
1118  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (12)</a></li>
1119
1120  <li><a href="http://people.skolelinux.org/pere/blog/tags/freeculture">freeculture (10)</a></li>
1121
1122  <li><a href="http://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (9)</a></li>
1123
1124  <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (32)</a></li>
1125
1126  <li><a href="http://people.skolelinux.org/pere/blog/tags/isenkram">isenkram (5)</a></li>
1127
1128  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (17)</a></li>
1129
1130  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
1131
1132  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (6)</a></li>
1133
1134  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1135
1136  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (25)</a></li>
1137
1138  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (221)</a></li>
1139
1140  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (148)</a></li>
1141
1142  <li><a href="http://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (6)</a></li>
1143
1144  <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
1145
1146  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (41)</a></li>
1147
1148  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (63)</a></li>
1149
1150  <li><a href="http://people.skolelinux.org/pere/blog/tags/raid">raid (1)</a></li>
1151
1152  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
1153
1154  <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (2)</a></li>
1155
1156  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (6)</a></li>
1157
1158  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1159
1160  <li><a href="http://people.skolelinux.org/pere/blog/tags/ruter">ruter (4)</a></li>
1161
1162  <li><a href="http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (2)</a></li>
1163
1164  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (28)</a></li>
1165
1166  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (4)</a></li>
1167
1168  <li><a href="http://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (4)</a></li>
1169
1170  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (39)</a></li>
1171
1172  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (3)</a></li>
1173
1174  <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (6)</a></li>
1175
1176  <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (14)</a></li>
1177
1178  <li><a href="http://people.skolelinux.org/pere/blog/tags/sysadmin">sysadmin (1)</a></li>
1179
1180  <li><a href="http://people.skolelinux.org/pere/blog/tags/valg">valg (7)</a></li>
1181
1182  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (35)</a></li>
1183
1184  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (4)</a></li>
1185
1186  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (26)</a></li>
1187
1188 </ul>
1189
1190
1191     </div>
1192     <p style="text-align: right">
1193  Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v4.6</a>
1194 </p>
1195
1196   </body>
1197 </html>