blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_seem_to_hold_up_well_in_Debian_testing.html">Parallellized boot seem to hold up well in Debian/testing</a></div>
  24   <div class="date">2010-05-27 23:55</div>
  25   <div class="body">
  26 <p>A few days ago, parallel booting was enabled in Debian/testing.
  27 The feature seem to hold up pretty well, but three fairly serious
  28 issues are known and should be solved:
  29
  30 <p><ul>
  31
  32 <li>The wicd package seen to
  33 <a href="http://bugs.debian.org/508289">break NFS mounting</a> and
  34 <a href="http://bugs.debian.org/581586">network setup</a> when
  35 parallel booting is enabled.  No idea why, but the wicd maintainer
  36 seem to be on the case.</li>
  37
  38 <li>The nvidia X driver seem to
  39 <a href="http://bugs.debian.org/583312">have a race condition</a>
  40 triggered more easily when parallel booting is in effect.  The
  41 maintainer is on the case.</li>
  42
  43 <li>The sysv-rc package fail to properly enable dependency based boot
  44 sequencing (the shutdown is broken) when old file-rc users
  45 <a href="http://bugs.debian.org/575080">try to switch back</a> to
  46 sysv-rc.  One way to solve it would be for file-rc to create
  47 /etc/init.d/.legacy-bootordering, and another is to try to make
  48 sysv-rc more robust.  Will investigate some more and probably upload a
  49 workaround in sysv-rc to help those trying to move from file-rc to
  50 sysv-rc get a working shutdown.</li>
  51
  52 </ul></p>
  53
  54 <p>All in all not many surprising issues, and all of them seem
  55 solvable before Squeeze is released.  In addition to these there are
  56 some packages with bugs in their dependencies and run level settings,
  57 which I expect will be fixed in a reasonable time span.</p>
  58
  59 <p>If you report any problems with dependencies in init.d scripts to
  60 the BTS, please usertag the report to get it to show up at
  61 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
  62 list of usertagged bugs related to this</a>.</p>
  63
  64 <p>Update: Correct bug number to file-rc issue.</p>
  65 </div>
  66   <div class="tags">
  67
  68
  69
  70    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
  71
  72   </div>
  73  </div>
  74  <div class="padding"></div>
  75
  76  <div class="entry">
  77   <div class="title"><a href="http://people.skolelinux.org/pere/blog/More_flexible_firmware_handling_in_debian_installer.html">More flexible firmware handling in debian-installer</a></div>
  78   <div class="date">2010-05-22 21:30</div>
  79   <div class="body">
  80 <p>After a long break from debian-installer development, I finally
  81 found time today to return to the project.  Having to spend less time
  82 working dependency based boot in debian, as it is almost complete now,
  83 definitely helped freeing some time.</p>
  84
  85 <p>A while back, I ran into a problem while working on Debian Edu.  We
  86 include some firmware packages on the Debian Edu CDs, those needed to
  87 get disk and network controllers working.  Without having these
  88 firmware packages available during installation, it is impossible to
  89 install Debian Edu on the given machine, and because our target group
  90 are non-technical people, asking them to provide firmware packages on
  91 an external medium is a support pain.  Initially, I expected it to be
  92 enough to include the firmware packages on the CD to get
  93 debian-installer to find and use them.  This proved to be wrong.
  94 Next, I hoped it was enough to symlink the relevant firmware packages
  95 to some useful location on the CD (tried /cdrom/ and
  96 /cdrom/firmware/).  This also proved to not work, and at this point I
  97 found time to look at the debian-installer code to figure out what was
  98 going to work.</p>
  99
 100 <p>The firmware loading code is in the hw-detect package, and a closer
 101 look revealed that it would only look for firmware packages outside
 102 the installation media, so the CD was never checked for firmware
 103 packages.  It would only check USB sticks, floppies and other
 104 "external" media devices.  Today I changed it to also look in the
 105 /cdrom/firmware/ directory on the mounted CD or DVD, which should
 106 solve the problem I ran into with Debian edu.  I also changed it to
 107 look in /firmware/, to make sure the installer also find firmware
 108 provided in the initrd when booting the installer via PXE, to allow us
 109 to provide the same feature in the PXE setup included in Debian
 110 Edu.</p>
 111
 112 <p>To make sure firmware deb packages with a license questions are not
 113 activated without asking if the license is accepted, I extended
 114 hw-detect to look for preinst scripts in the firmware packages, and
 115 run these before activating the firmware during installation.  The
 116 license question is asked using debconf in the preinst, so this should
 117 solve the issue for the firmware packages I have looked at so far.</p>
 118
 119 <p>If you want to discuss the details of these features, please
 120 contact us on debian-boot@lists.debian.org.</p>
 121 </div>
 122   <div class="tags">
 123
 124
 125
 126    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 127
 128   </div>
 129  </div>
 130  <div class="padding"></div>
 131
 132  <div class="entry">
 133   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html">Magnetstripeinnhold i billetter fra Flytoget og Hurtigruten</a></div>
 134   <div class="date">2010-05-21 16:00</div>
 135   <div class="body">
 136 <p>For en stund tilbake kjøpte jeg en magnetkortleser for å kunne
 137 titte på hva som er skrevet inn på magnetstripene til ulike kort.  Har
 138 ikke hatt tid til å analysere mange kort så langt, men tenkte jeg
 139 skulle dele innholdet på to kort med mine lesere.</p>
 140
 141 <p>For noen dager siden tok jeg flyet til Harstad og Hurtigruten til
 142 Bergen.  Flytoget fra Oslo S til flyplassen ga meg en billett med
 143 magnetstripe.  Påtrykket finner jeg følgende informasjon:</p>
 144
 145 <pre>
 146 Flytoget Airport Express Train
 147
 148 Fra - Til        : Oslo Sentralstasjon
 149 Kategori         : Voksen
 150 Pris             : Nok 170,00
 151 Herav mva. 8,00% : NOK 12,59
 152 Betaling         : Kontant
 153 Til - Fra        : Oslo Lufthavn
 154 Utstedt:         : 08.05.10
 155 Gyldig Fra-Til   : 08.05.10-07.11.10
 156 Billetttype      : Enkeltbillett
 157
 158 102-1015-100508-48382-01-08
 159 </pre>
 160
 161 <p>På selve magnetstripen er innholdet
 162 <tt>;E?+900120011=23250996541068112619257138248441708433322932704083389389062603279671261502492655?</tt>.
 163 Aner ikke hva innholdet representerer, og det er lite overlapp mellom
 164 det jeg ser trykket på billetten og det jeg ser av tegn i
 165 magnetstripen.  Håper det betyr at de bruker kryptografiske metoder
 166 for å gjøre det vanskelig å forfalske billetter.</p>
 167
 168 <p>Den andre billetten er fra Hurtigruten, der jeg mistenker at
 169 strekkoden på fronten er mer brukt enn magnetstripen (det var i hvert
 170 fall den biten vi stakk inn i dørlåsen).</p>
 171
 172 <p>Påtrykket forsiden er følgende:</p>
 173
 174 <pre>
 175 Romnummer 727
 176 Hurtigruten
 177 Midnatsol
 178 Reinholdtsen
 179 Petter
 180 Bookingno: SAX69   0742193
 181 Harstad-Bergen
 182 Dep: 09.05.2010 Arr: 12.05.2010
 183 Lugar fra Risøyhamn
 184 Kost: FRO=4
 185 </pre>
 186
 187 <p>På selve magnetstripen er innholdet
 188 <tt>;1316010007421930=00000000000000000000?+E?</tt>.  Heller ikke her
 189 ser jeg mye korrespondanse mellom påtrykk og magnetstripe.</p>
 190 </div>
 191   <div class="tags">
 192
 193
 194
 195    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 196
 197   </div>
 198  </div>
 199  <div class="padding"></div>
 200
 201  <div class="entry">
 202   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Pieces_of_the_roaming_laptop_puzzle_in_Debian.html">Pieces of the roaming laptop puzzle in Debian</a></div>
 203   <div class="date">2010-05-19 19:00</div>
 204   <div class="body">
 205 <p>Today, the last piece of the puzzle for roaming laptops in Debian
 206 Edu finally entered the Debian archive.  Today, the new
 207 <a href="http://packages.qa.debian.org/libp/libpam-mklocaluser.html">libpam-mklocaluser</a>
 208 package was accepted.  Two days ago, two other pieces was accepted
 209 into unstable.  The
 210 <a href="http://packages.qa.debian.org/p/pam-python.html">pam-python</a>
 211 package needed by libpam-mklocaluser, and the
 212 <a href="http://packages.qa.debian.org/s/sssd.html">sssd</a> package
 213 passed NEW on Monday.  In addition, the
 214 <a href="http://packages.qa.debian.org/libp/libpam-ccreds.html">libpam-ccreds</a>
 215 package we need is in experimental (version 10-4) since Saturday, and
 216 hopefully will be moved to unstable soon.</p>
 217
 218 <p>This collection of packages allow for two different setups for
 219 roaming laptops.  The traditional setup would be using libpam-ccreds,
 220 nscd and libpam-mklocaluser with LDAP or Kerberos authentication,
 221 which should work out of the box if the configuration changes proposed
 222 for nscd in <a href="http://bugs.debian.org/485282">BTS report
 223 #485282</a> is implemented.  The alternative setup is to use sssd with
 224 libpam-mklocaluser to connect to LDAP or Kerberos and let sssd take
 225 care of the caching of passwords and group information.</p>
 226
 227 <p>I have so far been unable to get sssd to work with the LDAP server
 228 at the University, but suspect the issue is some SSL/GnuTLS related
 229 problem with the server certificate.  I plan to update the Debian
 230 package to version 1.2, which is scheduled for next week, and hope to
 231 find time to make sure the next release will include both the
 232 Debian/Ubuntu specific patches.  Upstream is friendly and responsive,
 233 and I am sure we will find a good solution.</p>
 234
 235 <p>The idea is to set up the roaming laptops to authenticate using
 236 LDAP or Kerberos and create a local user with home directory in /home/
 237 when a usre in LDAP logs in via KDM or GDM for the first time, and
 238 cache the password for offline checking, as well as caching group
 239 memberhips and other relevant LDAP information.  The
 240 libpam-mklocaluser package was created to make sure the local home
 241 directory is in /home/, instead of /site/server/directory/ which would
 242 be the home directory if pam_mkhomedir was used.  To avoid confusion
 243 with support requests and configuration, we do not want local laptops
 244 to have users in a path that is used for the same users home directory
 245 on the home directory servers.</p>
 246
 247 <p>One annoying problem with gdm is that it do not show the PAM
 248 message passed to the user from libpam-mklocaluser when the local user
 249 is created.  Instead gdm simply reject the login with some generic
 250 message.  The message is shown in kdm, ssh and login, so I guess it is
 251 a bug in gdm.  Have not investigated if there is some other message
 252 type that can be used instead to get gdm to also show the message.</p>
 253
 254 <p>If you want to help out with implementing this for Debian Edu,
 255 please contact us on debian-edu@lists.debian.org.</p>
 256 </div>
 257   <div class="tags">
 258
 259
 260
 261    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 262
 263   </div>
 264  </div>
 265  <div class="padding"></div>
 266
 267  <div class="entry">
 268   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html">Parallellized boot is now the default in Debian/unstable</a></div>
 269   <div class="date">2010-05-14 22:40</div>
 270   <div class="body">
 271 <p>Since this evening, parallel booting is the default in
 272 Debian/unstable for machines using dependency based boot sequencing.
 273 Apparently the testing of concurrent booting has been wider than
 274 expected, if I am to believe the
 275 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 276 on debian-devel@</a>, and I concluded a few days ago to move forward
 277 with the feature this weekend, to give us some time to detect any
 278 remaining problems before Squeeze is frozen.  If serious problems are
 279 detected, it is simple to change the default back to sequential boot.
 280 The upload of the new sysvinit package also activate a new upstream
 281 version.</p>
 282
 283 More information about
 284 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 285 based boot sequencing</a> is available from the Debian wiki.  It is
 286 currently possible to disable parallel booting when one run into
 287 problems caused by it, by adding this line to /etc/default/rcS:</p>
 288
 289 <blockquote><pre>
 290 CONCURRENCY=none
 291 </pre></blockquote>
 292
 293 <p>If you report any problems with dependencies in init.d scripts to
 294 the BTS, please usertag the report to get it to show up at
 295 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 296 list of usertagged bugs related to this</a>.</p>
 297 </div>
 298   <div class="tags">
 299
 300
 301
 302    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 303
 304   </div>
 305  </div>
 306  <div class="padding"></div>
 307
 308  <div class="entry">
 309   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html">Sitesummary tip: Listing MAC address of all clients</a></div>
 310   <div class="date">2010-05-14 21:10</div>
 311   <div class="body">
 312 <p>In the recent Debian Edu versions, the
 313 <a href="http://wiki.debian.org/DebianEdu/HowTo/SiteSummary">sitesummary
 314 system</a> is used to keep track of the machines in the school
 315 network.  Each machine will automatically report its status to the
 316 central server after boot and once per night.  The network setup is
 317 also reported, and using this information it is possible to get the
 318 MAC address of all network interfaces in the machines.  This is useful
 319 to update the DHCP configuration.</p>
 320
 321 <p>To give some idea how to use sitesummary, here is a one-liner to
 322 ist all MAC addresses of all machines reporting to sitesummary.  Run
 323 this on the collector host:</p>
 324
 325 <blockquote><pre>
 326 perl -MSiteSummary -e 'for_all_hosts(sub { print join(" ", get_macaddresses(shift)), "\n"; });'
 327 </pre></blockquote>
 328
 329 <p>This will list all MAC addresses assosiated with all machine, one
 330 line per machine and with space between the MAC addresses.</p>
 331
 332 <p>To allow system administrators easier job at adding static DHCP
 333 addresses for hosts, it would be possible to extend this to fetch
 334 machine information from sitesummary and update the DHCP and DNS
 335 tables in LDAP using this information.  Such tool is unfortunately not
 336 written yet.</p>
 337 </div>
 338   <div class="tags">
 339
 340
 341
 342    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary</a>.
 343
 344   </div>
 345  </div>
 346  <div class="padding"></div>
 347
 348  <div class="entry">
 349   <div class="title"><a href="http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html">systemd, an interesting alternative to upstart</a></div>
 350   <div class="date">2010-05-13 22:20</div>
 351   <div class="body">
 352 <p>The last few days a new boot system called
 353 <a href="http://www.freedesktop.org/wiki/Software/systemd">systemd</a>
 354 has been
 355 <a href="http://0pointer.de/blog/projects/systemd.html">introduced</a>
 356
 357 to the free software world.  I have not yet had time to play around
 358 with it, but it seem to be a very interesting alternative to
 359 <a href="http://upstart.ubuntu.com/">upstart</a>, and might prove to be
 360 a good alternative for Debian when we are able to switch to an event
 361 based boot system.  Tollef is
 362 <a href="http://bugs.debian.org/580814">in the process</a> of getting
 363 systemd into Debian, and I look forward to seeing how well it work.  I
 364 like the fact that systemd handles init.d scripts with dependency
 365 information natively, allowing them to run in parallel where upstart
 366 at the moment do not.</p>
 367
 368 <p>Unfortunately do systemd have the same problem as upstart regarding
 369 platform support.  It only work on recent Linux kernels, and also need
 370 some new kernel features enabled to function properly.  This means
 371 kFreeBSD and Hurd ports of Debian will need a port or a different boot
 372 system.  Not sure how that will be handled if systemd proves to be the
 373 way forward.</p>
 374
 375 <p>In the mean time, based on the
 376 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 377 on debian-devel@</a> regarding parallel booting in Debian, I have
 378 decided to enable full parallel booting as the default in Debian as
 379 soon as possible (probably this weekend or early next week), to see if
 380 there are any remaining serious bugs in the init.d dependencies.  A
 381 new version of the sysvinit package implementing this change is
 382 already in experimental.  If all go well, Squeeze will be released
 383 with parallel booting enabled by default.</p>
 384 </div>
 385   <div class="tags">
 386
 387
 388
 389    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 390
 391   </div>
 392  </div>
 393  <div class="padding"></div>
 394
 395  <div class="entry">
 396   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html">Parallellizing the boot in Debian Squeeze - ready for wider testing</a></div>
 397   <div class="date">2010-05-06 23:25</div>
 398   <div class="body">
 399 <p>These days, the init.d script dependencies in Squeeze are quite
 400 complete, so complete that it is actually possible to run all the
 401 init.d scripts in parallell based on these dependencies.  If you want
 402 to test your Squeeze system, make sure
 403 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 404 based boot sequencing</a> is enabled, and add this line to
 405 /etc/default/rcS:</p>
 406
 407 <blockquote><pre>
 408 CONCURRENCY=makefile
 409 </pre></blockquote>
 410
 411 <p>That is it.  It will cause sysv-rc to use the startpar tool to run
 412 scripts in parallel using the dependency information stored in
 413 /etc/init.d/.depend.boot, /etc/init.d/.depend.start and
 414 /etc/init.d/.depend.stop to order the scripts.  Startpar is configured
 415 to try to start the kdm and gdm scripts as early as possible, and will
 416 start the facilities required by kdm or gdm as early as possible to
 417 make this happen.</p>
 418
 419 <p>Give it a try, and see if you like the result.  If some services
 420 fail to start properly, it is most likely because they have incomplete
 421 init.d script dependencies in their startup script (or some of their
 422 dependent scripts have incomplete dependencies).  Report bugs and get
 423 the package maintainers to fix it. :)</p>
 424
 425 <p>Running scripts in parallel could be the default in Debian when we
 426 manage to get the init.d script dependencies complete and correct.  I
 427 expect we will get there in Squeeze+1, if we get manage to test and
 428 fix the remaining issues.</p>
 429
 430 <p>If you report any problems with dependencies in init.d scripts to
 431 the BTS, please usertag the report to get it to show up at
 432 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 433 list of usertagged bugs related to this</a>.</p>
 434 </div>
 435   <div class="tags">
 436
 437
 438
 439    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 440
 441   </div>
 442  </div>
 443  <div class="padding"></div>
 444
 445  <div class="entry">
 446   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html">Forcing new users to change their password on first login</a></div>
 447   <div class="date">2010-05-02 13:47</div>
 448   <div class="body">
 449 <p>One interesting feature in Active Directory, is the ability to
 450 create a new user with an expired password, and thus force the user to
 451 change the password on the first login attempt.</p>
 452
 453 <p>I'm not quite sure how to do that with the LDAP setup in Debian
 454 Edu, but did some initial testing with a local account.  The account
 455 and password aging information is available in /etc/shadow, but
 456 unfortunately, it is not possible to specify an expiration time for
 457 passwords, only a maximum age for passwords.</p>
 458
 459 <p>A freshly created account (using adduser test) will have these
 460 settings in /etc/shadow:</p>
 461
 462 <blockquote><pre>
 463 root@tjener:~# chage -l test
 464 Last password change                                    : May 02, 2010
 465 Password expires                                        : never
 466 Password inactive                                       : never
 467 Account expires                                         : never
 468 Minimum number of days between password change          : 0
 469 Maximum number of days between password change          : 99999
 470 Number of days of warning before password expires       : 7
 471 root@tjener:~#
 472 </pre></blockquote>
 473
 474 <p>The only way I could come up with to create a user with an expired
 475 account, is to change the date of the last password change to the
 476 lowest value possible (January 1th 1970), and the maximum password age
 477 to the difference in days between that date and today.  To make it
 478 simple, I went for 30 years (30 * 365 = 10950) and January 2th (to
 479 avoid testing if 0 is a valid value).</p>
 480
 481 <p>After using these commands to set it up, it seem to work as
 482 intended:</p>
 483
 484 <blockquote><pre>
 485 root@tjener:~# chage -d 1 test; chage -M 10950 test
 486 root@tjener:~# chage -l test
 487 Last password change                                    : Jan 02, 1970
 488 Password expires                                        : never
 489 Password inactive                                       : never
 490 Account expires                                         : never
 491 Minimum number of days between password change          : 0
 492 Maximum number of days between password change          : 10950
 493 Number of days of warning before password expires       : 7
 494 root@tjener:~#
 495 </pre></blockquote>
 496
 497 <p>So far I have tested this with ssh and console, and kdm (in
 498 Squeeze) login, and all ask for a new password before login in the
 499 user (with ssh, I was thrown out and had to log in again).</p>
 500
 501 <p>Perhaps we should set up something similar for Debian Edu, to make
 502 sure only the user itself have the account password?</p>
 503
 504 <p>If you want to comment on or help out with implementing this for
 505 Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 506
 507 <p>Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the
 508 shadow(8) page in Debian/testing now state that setting the date of
 509 last password change to zero (0) will force the password to be changed
 510 on the first login.  This was not mentioned in the manual in Lenny, so
 511 I did not notice this in my initial testing.  I have tested it on
 512 Squeeze, and '<tt>chage -d 0 username</tt>' do work there.  I have not
 513 tested it on Lenny yet.</p>
 514
 515 <p>Update 2010-05-02-19:05: Jim Paris tells me via email that an
 516 equivalent command to expire a password is '<tt>passwd -e
 517 username</tt>', which insert zero into the date of the last password
 518 change.</p>
 519 </div>
 520   <div class="tags">
 521
 522
 523
 524    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 525
 526   </div>
 527  </div>
 528  <div class="padding"></div>
 529
 530  <div class="entry">
 531   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html">Thoughts on roaming laptop setup for Debian Edu</a></div>
 532   <div class="date">2010-04-28 20:40</div>
 533   <div class="body">
 534 <p>For some years now, I have wondered how we should handle laptops in
 535 Debian Edu.  The Debian Edu infrastructure is mostly designed to
 536 handle stationary computers, and less suited for computers that come
 537 and go.</p>
 538
 539 <p>Now I finally believe I have an sensible idea on how to adjust
 540 Debian Edu for laptops, by introducing a new profile for them, for
 541 example called Roaming Workstations.  Here are my thought on this.
 542 The setup would consist of the following:</p>
 543
 544 <ul>
 545
 546  <li>During installation, the user name of the owner / primary user of
 547    the laptop is requested and a local home directory is set up for
 548    the user, with uid and gid information fetched from the LDAP
 549    server.  This allow the user to work also when offline.  The
 550    central home directory can be available in a subdirectory on
 551    request, for example mounted via CIFS.  It could be mounted
 552    automatically when a user log in while on the Debian Edu network,
 553    and unmounted when the machine is taken away (network down,
 554    hibernate, etc), it can be set up to do automatic mounting on
 555    request (using autofs), or perhaps some GUI button on the desktop
 556    can be used to access it when needed.  Perhaps it is enough to use
 557    the fish protocol in KDE?</li>
 558
 559  <li>Password checking is set up to use LDAP or Kerberos
 560    authentication when the machine is on the Debian Edu network, and
 561    to cache the password for offline checking when the machine unable
 562    to reach the LDAP or Kerberos server.  This can be done using
 563    <a href="http://www.padl.com/OSS/pam_ccreds.html">libpam-ccreds</a>
 564    or the Fedora developed
 565    <a href="https://fedoraproject.org/wiki/Features/SSSD">System
 566    Security Services Daemon</a> packages.</li>
 567
 568  <li>File synchronisation with the central home directory is set up
 569    using a shared directory in both the local and the central home
 570    directory, using unison.</li>
 571
 572  <li>Printing should be set up to print to all printers broadcasting
 573    their existence on the local network, and should then work out of
 574    the box with CUPS.  For sites needing accurate printer quotas, some
 575    system with Kerberos authentication or printing via ssh could be
 576    implemented.</li>
 577
 578  <li>For users that should have local root access to their laptop,
 579    sudo should be used to allow this to the local user.</li>
 580
 581  <li>It would be nice if user and group information from LDAP is
 582    cached on the client, but given that there are entries for the
 583    local user and primary group in /etc/, it should not be needed.</li>
 584
 585 </ul>
 586
 587 <p>I believe all the pieces to implement this are in Debian/testing at
 588 the moment.  If we work quickly, we should be able to get this ready
 589 in time for the Squeeze release to freeze.  Some of the pieces need
 590 tweaking, like libpam-ccreds should get support for pam-auth-update
 591 (<a href="http://bugs.debian.org/566718">#566718</a>) and nslcd (or
 592 perhaps debian-edu-config) should get some integration code to stop
 593 its daemon when the LDAP server is unavailable to avoid long timeouts
 594 when disconnected from the net.  If we get Kerberos enabled, we need
 595 to make sure we avoid long timeouts there too.</p>
 596
 597 <p>If you want to help out with implementing this for Debian Edu,
 598 please contact us on debian-edu@lists.debian.org.</p>
 599 </div>
 600   <div class="tags">
 601
 602
 603
 604    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 605
 606   </div>
 607  </div>
 608  <div class="padding"></div>
 609
 610  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
 611
 612 <div id="sidebar">
 613
 614
 615
 616
 617
 618 <h2>Archive</h2>
 619 <ul>
 620
 621 <li>2010
 622 <ul>
 623
 624 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 625
 626 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 627
 628 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 629
 630 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 631
 632 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 633
 634 </ul></li>
 635
 636 <li>2009
 637 <ul>
 638
 639 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 640
 641 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 642
 643 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 644
 645 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 646
 647 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 648
 649 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 650
 651 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 652
 653 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 654
 655 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 656
 657 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 658
 659 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 660
 661 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 662
 663 </ul></li>
 664
 665 <li>2008
 666 <ul>
 667
 668 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 669
 670 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 671
 672 </ul></li>
 673
 674 </ul>
 675
 676
 677
 678 <h2>Tags</h2>
 679 <ul>
 680
 681  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 682
 683  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 684
 685  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 686
 687  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (20)</a></li>
 688
 689  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (20)</a></li>
 690
 691  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (31)</a></li>
 692
 693  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 694
 695  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (6)</a></li>
 696
 697  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
 698
 699  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
 700
 701  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 702
 703  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 704
 705  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (65)</a></li>
 706
 707  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (74)</a></li>
 708
 709  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (12)</a></li>
 710
 711  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (11)</a></li>
 712
 713  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 714
 715  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 716
 717  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (8)</a></li>
 718
 719  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (1)</a></li>
 720
 721  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (11)</a></li>
 722
 723  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 724
 725  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 726
 727  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 728
 729  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
 730
 731 </ul>
 732
 733 </div>
 734
 735 <p style="text-align: right">
 736 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
 737 </p>
 738 </body>
 739 </html>