blog/tags/ldap/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
   4   <head>
   5     <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
   6     <title>Petter Reinholdtsen: Entries Tagged ldap</title>
   7     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css" />
   8     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/vim.css" />
   9     <link rel="alternate" title="RSS Feed" href="ldap.rss" type="application/rss+xml" />
  10   </head>
  11   <body>
  12     <div class="title">
  13  <h1>
  14      <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16  </h1>
  17
  18 </div>
  19
  20
  21     <h3>Entries tagged "ldap".</h3>
  22
  23     <div class="entry">
  24       <div class="title">
  25         <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">Time for new  LDAP schemas replacing RFC 2307?</a>
  26       </div>
  27       <div class="date">
  28         29th March 2009
  29       </div>
  30       <div class="body">
  31         <p>The state of standardized LDAP schemas on Linux is far from
  32 optimal.  There is RFC 2307 documenting one way to store NIS maps in
  33 LDAP, and a modified version of this normally called RFC 2307bis, with
  34 some modifications to be compatible with Active Directory.  The RFC
  35 specification handle the content of a lot of system databases, but do
  36 not handle DNS zones and DHCP configuration.</p>
  37
  38 <p>In <a href="http://www.skolelinux.org/">Debian Edu/Skolelinux</a>,
  39 we would like to store information about users, SMB clients/hosts,
  40 filegroups, netgroups (users and hosts), DHCP and DNS configuration,
  41 and LTSP configuration in LDAP.  These objects have a lot in common,
  42 but with the current LDAP schemas it is not possible to have one
  43 object per entity.  For example, one need to have at least three LDAP
  44 objects for a given computer, one with the SMB related stuff, one with
  45 DNS information and another with DHCP information.  The schemas
  46 provided for DNS and DHCP are impossible to combine into one LDAP
  47 object.  In addition, it is impossible to implement quick queries for
  48 netgroup membership, because of the way NIS triples are implemented.
  49 It just do not scale.  I believe it is time for a few RFC
  50 specifications to cleam up this mess.</p>
  51
  52 <p>I would like to have one LDAP object representing each computer in
  53 the network, and this object can then keep the SMB (ie host key), DHCP
  54 (mac address/name) and DNS (name/IP address) settings in one place.
  55 It need to be efficently stored to make sure it scale well.</p>
  56
  57 <p>I would also like to have a quick way to map from a user or
  58 computer and to the net group this user or computer is a member.</p>
  59
  60 <p>Active Directory have done a better job than unix heads like myself
  61 in this regard, and the unix side need to catch up.  Time to start a
  62 new IETF work group?</p>
  63
  64       </div>
  65       <div class="tags">
  66
  67
  68         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
  69
  70
  71       </div>
  72     </div>
  73     <div class="padding"></div>
  74
  75     <div class="entry">
  76       <div class="title">
  77         <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">Idea for a change to LDAP schemas allowing DNS and DHCP info to be combined into one object</a>
  78       </div>
  79       <div class="date">
  80         24th June 2010
  81       </div>
  82       <div class="body">
  83         <p>A while back, I
  84 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">complained
  85 about the fact</a> that it is not possible with the provided schemas
  86 for storing DNS and DHCP information in LDAP to combine the two sets
  87 of information into one LDAP object representing a computer.</p>
  88
  89 <p>In the mean time, I discovered that a simple fix would be to make
  90 the dhcpHost object class auxiliary, to allow it to be combined with
  91 the dNSDomain object class, and thus forming one object for one
  92 computer when storing both DHCP and DNS information in LDAP.</p>
  93
  94 <p>If I understand this correctly, it is not safe to do this change
  95 without also changing the assigned number for the object class, and I
  96 do not know enough about LDAP schema design to do that properly for
  97 Debian Edu.</p>
  98
  99 <p>Anyway, for future reference, this is how I believe we could change
 100 the
 101 <a href="http://tools.ietf.org/html/draft-ietf-dhc-ldap-schema-00">DHCP
 102 schema</a> to solve at least part of the problem with the LDAP schemas
 103 available today from IETF.</p>
 104
 105 <pre>
 106 --- dhcp.schema    (revision 65192)
 107 +++ dhcp.schema    (working copy)
 108 @@ -376,7 +376,7 @@
 109  objectclass ( 2.16.840.1.113719.1.203.6.6
 110         NAME 'dhcpHost'
 111         DESC 'This represents information about a particular client'
 112 -       SUP top
 113 +       SUP top AUXILIARY
 114         MUST cn
 115         MAY  (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
 116         X-NDS_CONTAINMENT ('dhcpService' 'dhcpSubnet' 'dhcpGroup') )
 117 </pre>
 118
 119 <p>I very much welcome clues on how to do this properly for Debian
 120 Edu/Squeeze.  We provide the DHCP schema in our debian-edu-config
 121 package, and should thus be free to rewrite it as we see fit.</p>
 122
 123 <p>If you want to help out with implementing this for Debian Edu,
 124 please contact us on debian-edu@lists.debian.org.</p>
 125
 126       </div>
 127       <div class="tags">
 128
 129
 130         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 131
 132
 133       </div>
 134     </div>
 135     <div class="padding"></div>
 136
 137     <div class="entry">
 138       <div class="title">
 139         <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">LUMA, a very nice LDAP GUI</a>
 140       </div>
 141       <div class="date">
 142         28th June 2010
 143       </div>
 144       <div class="body">
 145         <p>The last few days I have been looking into the status of the LDAP
 146 directory in Debian Edu, and in the process I started to miss a GUI
 147 tool to browse the LDAP tree.  The only one I was able to find in
 148 Debian/Squeeze and Lenny is
 149 <a href="http://luma.sourceforge.net/">LUMA</a>, which has proved to
 150 be a great tool to get a overview of the current LDAP directory
 151 populated by default in Skolelinux.  Thanks to it, I have been able to
 152 find empty and obsolete subtrees, misplaced objects and duplicate
 153 objects.  It will be installed by default in Debian/Squeeze.  If you
 154 are working with LDAP, give it a go. :)</p>
 155
 156 <p>I did notice one problem with it I have not had time to report to
 157 the BTS yet.  There is no .desktop file in the package, so the tool do
 158 not show up in the Gnome and KDE menus, but only deep down in in the
 159 Debian submenu in KDE.  I hope that can be fixed before Squeeze is
 160 released.</p>
 161
 162 <p>I have not yet been able to get it to modify the tree yet.  I would
 163 like to move objects and remove subtrees directly in the GUI, but have
 164 not found a way to do that with LUMA yet.  So in the mean time, I use
 165 <a href="http://www.lichteblau.com/ldapvi/">ldapvi</a> for that.</p>
 166
 167 <p>If you have tips on other GUI tools for LDAP that might be useful
 168 in Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 169
 170 <p>Update 2010-06-29: Ross Reedstrom tipped us about the
 171 <a href="http://packages.qa.debian.org/g/gq.html">gq</a> package as a
 172 useful GUI alternative.  It seem like a good tool, but is unmaintained
 173 in Debian and got a RC bug keeping it out of Squeeze.  Unless that
 174 changes, it will not be an option for Debian Edu based on Squeeze.</p>
 175
 176       </div>
 177       <div class="tags">
 178
 179
 180         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 181
 182
 183       </div>
 184     </div>
 185     <div class="padding"></div>
 186
 187     <div class="entry">
 188       <div class="title">
 189         <a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a>
 190       </div>
 191       <div class="date">
 192          1st July 2010
 193       </div>
 194       <div class="body">
 195         <p>For a laptop, centralized user directories and password checking is
 196 a bit troubling.  Laptops are typically used also when not connected
 197 to the network, and it is vital for a user to be able to log in or
 198 unlock the screen saver also when a central server is unavailable.
 199 This is possible by caching passwords and directory information (user
 200 and group attributes) locally, and the packages to do so are available
 201 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
 202 It is also possible to set up in Debian/Lenny, but require more manual
 203 setup there because pam-auth-update is missing in Lenny.</p>
 204
 205 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
 206
 207 This is the traditional method with a twist.  The password caching is
 208 provided by libpam-ccreds (version 10-4 or later is needed on
 209 Squeeze), and the directory caching is done by nscd.  The directory
 210 lookup and password checking is done using LDAP.  If one want to use
 211 Kerberos for password checking the libpam-ldapd package can be
 212 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
 213 local home directory with the path listed in LDAP, one can use the
 214 pam_mkhomedir module from pam-modules to make this happen instead of
 215 using libpam-mklocaluser.  A setup for pam-auth-update to enable
 216 pam_mkhomedir will have to be written until a fix for
 217 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
 218 archive.  Because I believe it is a bad idea to have local home
 219 directories using misleading paths like /site/server/partition/, I
 220 prefer to create a local user with the home directory in /home/.  This
 221 is done using the libpam-mklocaluser package.</p>
 222
 223 <p>These packages need to be installed and configured</p>
 224
 225 <blockquote><pre>
 226 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
 227 </pre></blockquote>
 228
 229 <p>The ldapd packages will ask for LDAP connection information, and
 230 one have to fill in the values that fits ones own site.  Make sure the
 231 PAM part uses encrypted connections, to make sure the password is not
 232 sent in clear text to the LDAP server.  I've been unable to get TLS
 233 certificate checking for a self signed certificate working, which make
 234 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
 235 is talking to the correct LDAP server), and very much welcome feedback
 236 on how to get this working.</p>
 237
 238 <p>Because nscd do not have a default configuration fit for offline
 239 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
 240 is fixed, this configuration should be used instead of the one
 241 currently in /etc/nscd.conf.  The changes are in the fields
 242 reload-count and positive-time-to-live, and is based on the
 243 instructions I found in the
 244 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
 245 instructions by Flyn Computing.</p>
 246
 247 <blockquote><pre>
 248         debug-level             0
 249         reload-count            unlimited
 250         paranoia                no
 251
 252         enable-cache            passwd          yes
 253         positive-time-to-live   passwd          2592000
 254         negative-time-to-live   passwd          20
 255         suggested-size          passwd          211
 256         check-files             passwd          yes
 257         persistent              passwd          yes
 258         shared                  passwd          yes
 259         max-db-size             passwd          33554432
 260         auto-propagate          passwd          yes
 261
 262         enable-cache            group           yes
 263         positive-time-to-live   group           2592000
 264         negative-time-to-live   group           20
 265         suggested-size          group           211
 266         check-files             group           yes
 267         persistent              group           yes
 268         shared                  group           yes
 269         max-db-size             group           33554432
 270         auto-propagate          group           yes
 271
 272         enable-cache            hosts           no
 273         positive-time-to-live   hosts           2592000
 274         negative-time-to-live   hosts           20
 275         suggested-size          hosts           211
 276         check-files             hosts           yes
 277         persistent              hosts           yes
 278         shared                  hosts           yes
 279         max-db-size             hosts           33554432
 280
 281         enable-cache            services        yes
 282         positive-time-to-live   services        2592000
 283         negative-time-to-live   services        20
 284         suggested-size          services        211
 285         check-files             services        yes
 286         persistent              services        yes
 287         shared                  services        yes
 288         max-db-size             services        33554432
 289 </pre></blockquote>
 290
 291 <p>While we wait for a mechanism to update /etc/nsswitch.conf
 292 automatically like the one provided in
 293 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
 294 content need to be manually replaced to ensure LDAP is used as the
 295 directory service on the machine.  /etc/nsswitch.conf should normally
 296 look like this:</p>
 297
 298 <blockquote><pre>
 299 passwd:         files ldap
 300 group:          files ldap
 301 shadow:         files ldap
 302 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 303 networks:       files
 304 protocols:      files
 305 services:       files
 306 ethers:         files
 307 rpc:            files
 308 netgroup:       files ldap
 309 </pre></blockquote>
 310
 311 <p>The important parts are that ldap is listed last for passwd, group,
 312 shadow and netgroup.</p>
 313
 314 <p>With these changes in place, any user in LDAP will be able to log
 315 in locally on the machine using for example kdm, get a local home
 316 directory created and have the password as well as user and group
 317 attributes cached.
 318
 319 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 320   libpam-mklocaluser/pam_mkhomedir</h2>
 321
 322 <p>Because nscd have had its share of problems, and seem to have
 323 problems doing proper caching, I've seen suggestions and recipes to
 324 use nss-updatedb to copy parts of the LDAP database locally when the
 325 LDAP database is available.  I have not tested such setup, because I
 326 discovered sssd.</p>
 327
 328 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
 329
 330 <p>A more flexible and robust setup than the nscd combination
 331 mentioned earlier that has shown up recently, is the
 332 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
 333 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
 334 to provide a Active Directory like directory service for Linux
 335 machines.  The sssd system combines the caching of passwords and user
 336 information into one package, and remove the need for nscd and
 337 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 338 1.2 do not support netgroups, but it is said that it will support this
 339 in version 1.5 expected to show up later in 2010.  Because the
 340 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
 341 was missing in Debian, I ended up co-maintaining it with Werner, and
 342 version 1.2 is now in testing.
 343
 344 <p>These packages need to be installed and configured to get the
 345 roaming setup I want</p>
 346
 347 <blockquote><pre>
 348 libpam-sss libnss-sss libpam-mklocaluser
 349 </pre></blockquote>
 350
 351 The complete setup of sssd is done by editing/creating
 352 <tt>/etc/sssd/sssd.conf</tt>.
 353
 354 <blockquote><pre>
 355 [sssd]
 356 config_file_version = 2
 357 reconnection_retries = 3
 358 sbus_timeout = 30
 359 services = nss, pam
 360 domains = INTERN
 361
 362 [nss]
 363 filter_groups = root
 364 filter_users = root
 365 reconnection_retries = 3
 366
 367 [pam]
 368 reconnection_retries = 3
 369
 370 [domain/INTERN]
 371 enumerate = false
 372 cache_credentials = true
 373
 374 id_provider = ldap
 375 auth_provider = ldap
 376 chpass_provider = ldap
 377
 378 ldap_uri = ldap://ldap
 379 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 380 ldap_tls_reqcert = never
 381 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 382 </pre></blockquote>
 383
 384 <p>I got the same problem here with certificate checking.  Had to set
 385 "ldap_tls_reqcert = never" to get it working.</p>
 386
 387 <p>With the libnss-sss package in testing at the moment, the
 388 nsswitch.conf file is update automatically, so there is no need to
 389 modify it manually.</p>
 390
 391 <p>If you want to help out with implementing this for Debian Edu,
 392 please contact us on debian-edu@lists.debian.org.</p>
 393
 394       </div>
 395       <div class="tags">
 396
 397
 398         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 399
 400
 401       </div>
 402     </div>
 403     <div class="padding"></div>
 404
 405     <div class="entry">
 406       <div class="title">
 407         <a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a>
 408       </div>
 409       <div class="date">
 410          9th July 2010
 411       </div>
 412       <div class="body">
 413         <p>Since
 414 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
 415 last post</a> about available LDAP tools in Debian, I was told about a
 416 LDAP GUI that is even better than luma.  The java application
 417 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
 418 moving LDAP objects and subtrees using drag-and-drop, and can
 419 authenticate using Kerberos.  I have only tested the Kerberos
 420 authentication, but do not have a LDAP setup allowing me to rewrite
 421 LDAP with my test user yet.  It is
 422 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
 423 Debian</a> testing and unstable at the moment.  The only problem I
 424 have with it is how it handle errors.  If something go wrong, its
 425 non-intuitive behaviour require me to go through some query work list
 426 and remove the failing query.  Nothing big, but very annoying.</p>
 427
 428       </div>
 429       <div class="tags">
 430
 431
 432         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 433
 434
 435       </div>
 436     </div>
 437     <div class="padding"></div>
 438
 439     <div class="entry">
 440       <div class="title">
 441         <a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a>
 442       </div>
 443       <div class="date">
 444         11th July 2010
 445       </div>
 446       <div class="body">
 447         <p>Vagrant mentioned on IRC today that ltsp_config now support
 448 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
 449 clients, and that this can be used to fetch configuration from LDAP if
 450 Debian Edu choose to store configuration there.</p>
 451
 452 <p>Armed with this information, I got inspired and wrote a test module
 453 to get configuration from LDAP.  The idea is to look up the MAC
 454 address of the client in LDAP, and look for attributes on the form
 455 ltspconfigsetting=value, and use this to export SETTING=value to the
 456 LTSP clients.</p>
 457
 458 <p>The goal is to be able to store the LTSP configuration attributes
 459 in a "computer" LDAP object used by both DNS and DHCP, and thus
 460 allowing us to store all information about a computer in one place.</p>
 461
 462 <p>This is a untested draft implementation, and I welcome feedback on
 463 this approach.  A real LDAP schema for the ltspClientAux objectclass
 464 need to be written.  Comments, suggestions, etc?</p>
 465
 466 <blockquote><pre>
 467 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
 468 #
 469 # Fetch LTSP client settings from LDAP based on MAC address
 470 #
 471 # Uses ethernet address as stored in the dhcpHost objectclass using
 472 # the dhcpHWAddress attribute or ethernet address stored in the
 473 # ieee802Device objectclass with the macAddress attribute.
 474 #
 475 # This module is written to be schema agnostic, and only depend on the
 476 # existence of attribute names.
 477 #
 478 # The LTSP configuration variables are saved directly using a
 479 # ltspConfig prefix and uppercasing the rest of the attribute name.
 480 # To set the SERVER variable, set the ltspConfigServer attribute.
 481 #
 482 # Some LDAP schema should be created with all the relevant
 483 # configuration settings.  Something like this should work:
 484 #
 485 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
 486 #     SUP top
 487 #     AUXILIARY
 488 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
 489
 490 LDAPSERVER=$(debian-edu-ldapserver)
 491 if [ "$LDAPSERVER" ] ; then
 492     LDAPBASE=$(debian-edu-ldapserver -b)
 493     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
 494         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
 495         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
 496             grep '^ltspConfig' | while read attr value ; do
 497             # Remove prefix and convert to upper case
 498             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
 499             # bass value on to clients
 500             eval "$attr=$value; export $attr"
 501         done
 502     done
 503 fi
 504 </pre></blockquote>
 505
 506 <p>I'm not sure this shell construction will work, because I suspect
 507 the while block might end up in a subshell causing the variables set
 508 there to not show up in ltsp-config, but if that is the case I am sure
 509 the code can be restructured to make sure the variables are passed on.
 510 I expect that can be solved with some testing. :)</p>
 511
 512 <p>If you want to help out with implementing this for Debian Edu,
 513 please contact us on debian-edu@lists.debian.org.</p>
 514
 515 <p>Update 2010-07-17: I am aware of another effort to store LTSP
 516 configuration in LDAP that was created around year 2000 by
 517 <a href="http://www.pcxperience.com/thinclient/documentation/ldap.html">PC
 518 Xperience, Inc., 2000</a>.  I found its
 519 <a href="http://people.redhat.com/alikins/ltsp/ldap/">files</a> on a
 520 personal home page over at redhat.com.</p>
 521
 522       </div>
 523       <div class="tags">
 524
 525
 526         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 527
 528
 529       </div>
 530     </div>
 531     <div class="padding"></div>
 532
 533     <div class="entry">
 534       <div class="title">
 535         <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a>
 536       </div>
 537       <div class="date">
 538         14th July 2010
 539       </div>
 540       <div class="body">
 541         <p>For a while now, I have wanted to find a way to change the DNS and
 542 DHCP services in Debian Edu to use the same LDAP objects for a given
 543 computer, to avoid the possibility of having a inconsistent state for
 544 a computer in LDAP (as in DHCP but no DNS entry or the other way
 545 around) and make it easier to add computers to LDAP.</p>
 546
 547 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
 548 information finally found a solution that seem to work.</p>
 549
 550 <p>The old setup required three LDAP objects for a given computer.
 551 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
 552 we switch powerdns to use its strict LDAP method (ldap-method=strict
 553 in pdns-debian-edu.conf), the forward and reverse DNS entries are
 554 merged into one while making it impossible to transfer the reverse map
 555 to a slave DNS server.</p>
 556
 557 <p>If we also replace the object class used to get the DNS related
 558 attributes to one allowing these attributes to be combined with the
 559 dhcphost object class, we can merge the DNS and DHCP entries into one.
 560 I've written such object class in the dnsdomainaux.schema file (need
 561 proper OIDs, but that is a minor issue), and tested the setup.  It
 562 seem to work.</p>
 563
 564 <p>With this test setup in place, we can get away with one LDAP object
 565 for both DNS and DHCP, and even the LTSP configuration I suggested in
 566 an earlier email.  The combined LDAP object will look something like
 567 this:</p>
 568
 569 <blockquote><pre>
 570   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 571   cn: hostname
 572   objectClass: dhcphost
 573   objectclass: domainrelatedobject
 574   objectclass: dnsdomainaux
 575   associateddomain: hostname.intern
 576   arecord: 10.11.12.13
 577   dhcphwaddress: ethernet 00:00:00:00:00:00
 578   dhcpstatements: fixed-address hostname
 579   ldapconfigsound: Y
 580 </pre></blockquote>
 581
 582 <p>The DNS server uses the associateddomain and arecord entries, while
 583 the DHCP server uses the dhcphwaddress and dhcpstatements entries
 584 before asking DNS to resolve the fixed-adddress.  LTSP will use
 585 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
 586
 587 <p>I am not yet sure if I can get the DHCP server to look for its
 588 dhcphost in a different location, to allow us to put the objects
 589 outside the "DHCP Config" subtree, but hope to figure out a way to do
 590 that.  If I can't figure out a way to do that, we can still get rid of
 591 the hosts subtree and move all its content into the DHCP Config tree
 592 (which probably should be renamed to be more related to the new
 593 content.  I suspect cn=dnsdhcp,ou=services or something like that
 594 might be a good place to put it.</p>
 595
 596 <p>If you want to help out with implementing this for Debian Edu,
 597 please contact us on debian-edu@lists.debian.org.</p>
 598
 599       </div>
 600       <div class="tags">
 601
 602
 603         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 604
 605
 606       </div>
 607     </div>
 608     <div class="padding"></div>
 609
 610     <div class="entry">
 611       <div class="title">
 612         <a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a>
 613       </div>
 614       <div class="date">
 615         17th July 2010
 616       </div>
 617       <div class="body">
 618         <p>This is a
 619 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
 620 on my
 621 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
 622 work</a> on
 623 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
 624 all</a> the computer related LDAP objects in Debian Edu.</p>
 625
 626 <p>As a step to try to see if it possible to merge the DNS and DHCP
 627 LDAP objects, I have had a look at how the packages pdns-backend-ldap
 628 and dhcp3-server-ldap in Debian use the LDAP server.  The two
 629 implementations are quite different in how they use LDAP.</p>
 630
 631 To get this information, I started slapd with debugging enabled and
 632 dumped the debug output to a file to get the LDAP searches performed
 633 on a Debian Edu main-server.  Here is a summary.
 634
 635 <p><strong>powerdns</strong></p>
 636
 637 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
 638 on how to</a> set up PowerDNS to use a LDAP backend is available on
 639 the web.
 640
 641 <p>PowerDNS have two modes of operation using LDAP as its backend.
 642 One "strict" mode where the forward and reverse DNS lookups are done
 643 using the same LDAP objects, and a "tree" mode where the forward and
 644 reverse entries are in two different subtrees in LDAP with a structure
 645 based on the DNS names, as in tjener.intern and
 646 2.2.0.10.in-addr.arpa.</p>
 647
 648 <p>In tree mode, the server is set up to use a LDAP subtree as its
 649 base, and uses a "base" scoped search for the DNS name by adding
 650 "dc=tjener,dc=intern," to the base with a filter for
 651 "(associateddomain=tjener.intern)" for the forward entry and
 652 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
 653 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
 654 forward entries, it is looking for attributes named dnsttl, arecord,
 655 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
 656 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
 657 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
 658 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
 659 spfrecord and modifytimestamp.  For reverse entries it is looking for
 660 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
 661 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
 662 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
 663 ldapsearch commands could look like this:</p>
 664
 665 <blockquote><pre>
 666 ldapsearch -h ldap \
 667   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 668   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 669   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 670   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 671   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 672   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 673
 674 ldapsearch -h ldap \
 675   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 676   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
 677   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
 678   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
 679   srvrecord naptrrecord modifytimestamp
 680 </pre></blockquote>
 681
 682 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
 683 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
 684 example LDAP objects used there.  In addition to these objects, the
 685 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
 686 also exist.</p>
 687
 688 <blockquote><pre>
 689 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
 690 objectclass: top
 691 objectclass: dnsdomain
 692 objectclass: domainrelatedobject
 693 dc: tjener
 694 arecord: 10.0.2.2
 695 associateddomain: tjener.intern
 696
 697 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
 698 objectclass: top
 699 objectclass: dnsdomain2
 700 objectclass: domainrelatedobject
 701 dc: 2
 702 ptrrecord: tjener.intern
 703 associateddomain: 2.2.0.10.in-addr.arpa
 704 </pre></blockquote>
 705
 706 <p>In strict mode, the server behaves differently.  When looking for
 707 forward DNS entries, it is doing a "subtree" scoped search with the
 708 same base as in the tree mode for a object with filter
 709 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
 710 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
 711 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
 712 naptrrecord and modifytimestamp.  For reverse entires it also do a
 713 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
 714 and the requested attributes are associateddomain, dnsttl and
 715 modifytimestamp.  In short, in strict mode the objects with ptrrecord
 716 go away, and the arecord attribute in the forward object is used
 717 instead.</p>
 718
 719 <p>The forward and reverse searches can be simulated using ldapsearch
 720 like this:</p>
 721
 722 <blockquote><pre>
 723 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 724   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 725   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 726   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 727   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 728   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 729
 730 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 731   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
 732 </pre></blockquote>
 733
 734 <p>In addition to the forward and reverse searches , there is also a
 735 search for SOA records, which behave similar to the forward and
 736 reverse lookups.</p>
 737
 738 <p>A thing to note with the PowerDNS behaviour is that it do not
 739 specify any objectclass names, and instead look for the attributes it
 740 need to generate a DNS reply.  This make it able to work with any
 741 objectclass that provide the needed attributes.</p>
 742
 743 <p>The attributes are normally provided in the cosine (RFC 1274) and
 744 dnsdomain2 schemas.  The latter is used for reverse entries like
 745 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
 746
 747 <p>In Debian Edu, we have created DNS objects using the object classes
 748 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
 749 attributes) and domainrelatedobject (for associatedDomain).  The use
 750 of structural object classes make it impossible to combine these
 751 classes with the object classes used by DHCP.</p>
 752
 753 <p>There are other schemas that could be used too, for example the
 754 dnszone structural object class used by Gosa and bind-sdb for the DNS
 755 attributes combined with the domainrelatedobject object class, but in
 756 this case some unused attributes would have to be included as well
 757 (zonename and relativedomainname).</p>
 758
 759 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
 760 mode and not use any of the existing objectclasses (dnsdomain,
 761 dnsdomain2 and dnszone) when one want to combine the DNS information
 762 with DHCP information, and instead create a auxiliary object class
 763 defined something like this (using the attributes defined for
 764 dnsdomain and dnsdomain2 or dnszone):</p>
 765
 766 <blockquote><pre>
 767 objectclass ( some-oid NAME 'dnsDomainAux'
 768     SUP top
 769     AUXILIARY
 770     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
 771           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
 772           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
 773           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
 774           A6Record $ DNAMERecord
 775     ))
 776 </pre></blockquote>
 777
 778 <p>This will allow any object to become a DNS entry when combined with
 779 the domainrelatedobject object class, and allow any entity to include
 780 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
 781 developers asking for their view on this schema and if they are
 782 interested in providing such schema with PowerDNS, and I hope my
 783 message will be accepted into their mailing list soon.</p>
 784
 785 <p><strong>ISC dhcp</strong></p>
 786
 787 <p>The DHCP server searches for specific objectclass and requests all
 788 the object attributes, and then uses the attributes it want.  This
 789 make it harder to figure out exactly what attributes are used, but
 790 thanks to the working example in Debian Edu I can at least get an idea
 791 what is needed without having to read the source code.</p>
 792
 793 <p>In the DHCP server configuration, the LDAP base to use and the
 794 search filter to use to locate the correct dhcpServer entity is
 795 stored.  These are the relevant entries from
 796 /etc/dhcp3/dhcpd.conf:</p>
 797
 798 <blockquote><pre>
 799 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
 800 ldap-dhcp-server-cn "dhcp";
 801 </pre></blockquote>
 802
 803 <p>The DHCP server uses this information to nest all the DHCP
 804 configuration it need.  The cn "dhcp" is located using the given LDAP
 805 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
 806 search result is this entry:</p>
 807
 808 <blockquote><pre>
 809 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
 810 cn: dhcp
 811 objectClass: top
 812 objectClass: dhcpServer
 813 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 814 </pre></blockquote>
 815
 816 <p>The content of the dhcpServiceDN attribute is next used to locate the
 817 subtree with DHCP configuration.  The DHCP configuration subtree base
 818 is located using a base scope search with base "cn=DHCP
 819 Config,dc=skole,dc=skolelinux,dc=no" and filter
 820 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
 821 The search result is this entry:</p>
 822
 823 <blockquote><pre>
 824 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 825 cn: DHCP Config
 826 objectClass: top
 827 objectClass: dhcpService
 828 objectClass: dhcpOptions
 829 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
 830 dhcpStatements: ddns-update-style none
 831 dhcpStatements: authoritative
 832 dhcpOption: smtp-server code 69 = array of ip-address
 833 dhcpOption: www-server code 72 = array of ip-address
 834 dhcpOption: wpad-url code 252 = text
 835 </pre></blockquote>
 836
 837 <p>Next, the entire subtree is processed, one level at the time.  When
 838 all the DHCP configuration is loaded, it is ready to receive requests.
 839 The subtree in Debian Edu contain objects with object classes
 840 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
 841 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
 842 and information about netmasks, dynamic range etc.  Leaving out the
 843 details here because it is not relevant for the focus of my
 844 investigation, which is to see if it is possible to merge dns and dhcp
 845 related computer objects.</p>
 846
 847 <p>When a DHCP request come in, LDAP is searched for the MAC address
 848 of the client (00:00:00:00:00:00 in this example), using a subtree
 849 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
 850 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
 851 00:00:00:00:00:00))" as the filter.  This is what a host object look
 852 like:</p>
 853
 854 <blockquote><pre>
 855 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 856 cn: hostname
 857 objectClass: top
 858 objectClass: dhcpHost
 859 dhcpHWAddress: ethernet 00:00:00:00:00:00
 860 dhcpStatements: fixed-address hostname
 861 </pre></blockquote>
 862
 863 <p>There is less flexiblity in the way LDAP searches are done here.
 864 The object classes need to have fixed names, and the configuration
 865 need to be stored in a fairly specific LDAP structure.  On the
 866 positive side, the invidiual dhcpHost entires can be anywhere without
 867 the DN pointed to by the dhcpServer entries.  The latter should make
 868 it possible to group all host entries in a subtree next to the
 869 configuration entries, and this subtree can also be shared with the
 870 DNS server if the schema proposed above is combined with the dhcpHost
 871 structural object class.
 872
 873 <p><strong>Conclusion</strong></p>
 874
 875 <p>The PowerDNS implementation seem to be very flexible when it come
 876 to which LDAP schemas to use.  While its "tree" mode is rigid when it
 877 come to the the LDAP structure, the "strict" mode is very flexible,
 878 allowing DNS objects to be stored anywhere under the base cn specified
 879 in the configuration.</p>
 880
 881 <p>The DHCP implementation on the other hand is very inflexible, both
 882 regarding which LDAP schemas to use and which LDAP structure to use.
 883 I guess one could implement ones own schema, as long as the
 884 objectclasses and attributes have the names used, but this do not
 885 really help when the DHCP subtree need to have a fairly fixed
 886 structure.</p>
 887
 888 <p>Based on the observed behaviour, I suspect a LDAP structure like
 889 this might work for Debian Edu:</p>
 890
 891 <blockquote><pre>
 892 ou=services
 893   cn=machine-info (dhcpService) - dhcpServiceDN points here
 894     cn=dhcp (dhcpServer)
 895     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
 896       cn=10.0.2.0 (dhcpSubnet)
 897         cn=group1 (dhcpGroup/dhcpOptions)
 898     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
 899       cn=192.168.0.0 (dhcpSubnet)
 900         cn=group1 (dhcpGroup/dhcpOptions)
 901     ou=machines - PowerDNS base points here
 902       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
 903 </pre></blockquote>
 904
 905 <P>This is not tested yet.  If the DHCP server require the dhcpHost
 906 entries to be in the dhcpGroup subtrees, the entries can be stored
 907 there instead of a common machines subtree, and the PowerDNS base
 908 would have to be moved one level up to the machine-info subtree.</p>
 909
 910 <p>The combined object under the machines subtree would look something
 911 like this:</p>
 912
 913 <blockquote><pre>
 914 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
 915 dc: hostname
 916 objectClass: top
 917 objectClass: dhcpHost
 918 objectclass: domainrelatedobject
 919 objectclass: dnsDomainAux
 920 associateddomain: hostname.intern
 921 arecord: 10.11.12.13
 922 dhcpHWAddress: ethernet 00:00:00:00:00:00
 923 dhcpStatements: fixed-address hostname.intern
 924 </pre></blockquote>
 925
 926 </p>One could even add the LTSP configuration associated with a given
 927 machine, as long as the required attributes are available in a
 928 auxiliary object class.</p>
 929
 930       </div>
 931       <div class="tags">
 932
 933
 934         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 935
 936
 937       </div>
 938     </div>
 939     <div class="padding"></div>
 940
 941     <p style="text-align: right;"><a href="ldap.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14" /></a></p>
 942     <div id="sidebar">
 943
 944
 945
 946 <h2>Archive</h2>
 947 <ul>
 948
 949 <li>2012
 950 <ul>
 951
 952 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/01/">January (7)</a></li>
 953
 954 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/02/">February (10)</a></li>
 955
 956 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/03/">March (17)</a></li>
 957
 958 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/04/">April (12)</a></li>
 959
 960 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/05/">May (11)</a></li>
 961
 962 </ul></li>
 963
 964 <li>2011
 965 <ul>
 966
 967 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
 968
 969 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
 970
 971 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
 972
 973 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
 974
 975 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
 976
 977 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
 978
 979 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (7)</a></li>
 980
 981 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/08/">August (6)</a></li>
 982
 983 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/09/">September (4)</a></li>
 984
 985 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/10/">October (2)</a></li>
 986
 987 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/11/">November (3)</a></li>
 988
 989 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/12/">December (1)</a></li>
 990
 991 </ul></li>
 992
 993 <li>2010
 994 <ul>
 995
 996 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 997
 998 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 999
1000 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1001
1002 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1003
1004 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1005
1006 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1007
1008 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
1009
1010 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
1011
1012 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
1013
1014 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
1015
1016 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
1017
1018 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
1019
1020 </ul></li>
1021
1022 <li>2009
1023 <ul>
1024
1025 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1026
1027 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1028
1029 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1030
1031 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1032
1033 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1034
1035 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1036
1037 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1038
1039 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1040
1041 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1042
1043 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1044
1045 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1046
1047 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1048
1049 </ul></li>
1050
1051 <li>2008
1052 <ul>
1053
1054 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1055
1056 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1057
1058 </ul></li>
1059
1060 </ul>
1061
1062
1063
1064 <h2>Tags</h2>
1065 <ul>
1066
1067  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (13)</a></li>
1068
1069  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1070
1071  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1072
1073  <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (2)</a></li>
1074
1075  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (12)</a></li>
1076
1077  <li><a href="http://people.skolelinux.org/pere/blog/tags/bsa">bsa (2)</a></li>
1078
1079  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (54)</a></li>
1080
1081  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (102)</a></li>
1082
1083  <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (8)</a></li>
1084
1085  <li><a href="http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (3)</a></li>
1086
1087  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (129)</a></li>
1088
1089  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (15)</a></li>
1090
1091  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (12)</a></li>
1092
1093  <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (26)</a></li>
1094
1095  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (16)</a></li>
1096
1097  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
1098
1099  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (4)</a></li>
1100
1101  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1102
1103  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (16)</a></li>
1104
1105  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (167)</a></li>
1106
1107  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (127)</a></li>
1108
1109  <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
1110
1111  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (24)</a></li>
1112
1113  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (47)</a></li>
1114
1115  <li><a href="http://people.skolelinux.org/pere/blog/tags/raid">raid (1)</a></li>
1116
1117  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
1118
1119  <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (2)</a></li>
1120
1121  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (4)</a></li>
1122
1123  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1124
1125  <li><a href="http://people.skolelinux.org/pere/blog/tags/ruter">ruter (4)</a></li>
1126
1127  <li><a href="http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (1)</a></li>
1128
1129  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (23)</a></li>
1130
1131  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (4)</a></li>
1132
1133  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (29)</a></li>
1134
1135  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
1136
1137  <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (4)</a></li>
1138
1139  <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (9)</a></li>
1140
1141  <li><a href="http://people.skolelinux.org/pere/blog/tags/valg">valg (6)</a></li>
1142
1143  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (25)</a></li>
1144
1145  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
1146
1147  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (19)</a></li>
1148
1149 </ul>
1150
1151
1152     </div>
1153     <p style="text-align: right">
1154  Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v4.4</a>
1155 </p>
1156
1157   </body>
1158 </html>