blog/archive/2010/04/04.rss

   1 <?xml version="1.0" encoding="ISO-8859-1"?>
   2 <rss version='2.0' xmlns:lj='http://www.livejournal.org/rss/lj/1.0/'>
   3         <channel>
   4                 <title>Petter Reinholdtsen - Entries from April 2010</title>
   5                 <description>Entries from April 2010</description>
   6                 <link>http://people.skolelinux.org/pere/blog/</link>
   7
   8
   9         <item>
  10                 <title>Kerberos for Debian Edu/Squeeze?</title>
  11                 <link>http://people.skolelinux.org/pere/blog/Kerberos_for_Debian_Edu_Squeeze_.html</link>
  12                 <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Kerberos_for_Debian_Edu_Squeeze_.html</guid>
  13                 <pubDate>Wed, 14 Apr 2010 17:20:00 +0200</pubDate>
  14                 <description>&lt;p&gt;&lt;a href=&quot;http://www.nuug.no/aktiviteter/20100413-kerberos/&quot;&gt;Yesterdays
  15 NUUG presentation&lt;/a&gt; about Kerberos was inspiring, and reminded me
  16 about the need to start using Kerberos in Skolelinux.  Setting up a
  17 Kerberos server seem to be straight forward, and if we get this in
  18 place a long time before the Squeeze version of Debian freezes, we
  19 have a chance to migrate Skolelinux away from NFSv3 for the home
  20 directories, and over to an architecture where the infrastructure do
  21 not have to trust IP addresses and machines, and instead can trust
  22 users and cryptographic keys instead.&lt;/p&gt;
  23
  24 &lt;p&gt;A challenge will be integration and administration.  Is there a
  25 Kerberos implementation for Debian where one can control the
  26 administration access in Kerberos using LDAP groups?  With it, the
  27 school administration will have to maintain access control using flat
  28 files on the main server, which give a huge potential for errors.&lt;/p&gt;
  29
  30 &lt;p&gt;A related question I would like to know is how well Kerberos and
  31 pam-ccreds (offline password check) work together.  Anyone know?&lt;/p&gt;
  32
  33 &lt;p&gt;Next step will be to use Kerberos for access control in Lwat and
  34 Nagios.  I have no idea how much work that will be to implement.  We
  35 would also need to document how to integrate with Windows AD, as such
  36 shared network will require two Kerberos realms that need to cooperate
  37 to work properly.&lt;/p&gt;
  38
  39 &lt;p&gt;I believe a good start would be to start using Kerberos on the
  40 skolelinux.no machines, and this way get ourselves experience with
  41 configuration and integration.  A natural starting point would be
  42 setting up ldap.skolelinux.no as the Kerberos server, and migrate the
  43 rest of the machines from PAM via LDAP to PAM via Kerberos one at the
  44 time.&lt;/p&gt;
  45
  46 &lt;p&gt;If you would like to contribute to get this working in Skolelinux,
  47 I recommend you to see the video recording from yesterdays NUUG
  48 presentation, and start using Kerberos at home.  The video show show
  49 up in a few days.&lt;/p&gt;
  50 </description>
  51         </item>
  52
  53         <item>
  54                 <title>Great book: &quot;Content: Selected Essays on Technology, Creativity, Copyright, and the Future of the Future&quot;</title>
  55                 <link>http://people.skolelinux.org/pere/blog/Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html</link>
  56                 <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html</guid>
  57                 <pubDate>Mon, 19 Apr 2010 17:10:00 +0200</pubDate>
  58                 <description>&lt;p&gt;The last few weeks i have had the pleasure of reading a
  59 thought-provoking collection of essays by Cory Doctorow, on topics
  60 touching copyright, virtual worlds, the future of man when the
  61 conscience mind can be duplicated into a computer and many more. The
  62 book titled &quot;Content: Selected Essays on Technology, Creativity,
  63 Copyright, and the Future of the Future&quot; is available with few
  64 restrictions on the web, for example from
  65 &lt;a href=&quot;http://craphound.com/content/&quot;&gt;his own site&lt;/a&gt;. I read the
  66 epub-version from
  67 &lt;a href=&quot;http://www.feedbooks.com/book/2883&quot;&gt;feedbooks&lt;/a&gt; using
  68 &lt;a href=&quot;http://www.fbreader.org/&quot;&gt;fbreader&lt;/a&gt; and my N810. I
  69 strongly recommend this book.&lt;/p&gt;
  70 </description>
  71         </item>
  72
  73         <item>
  74                 <title>Thoughts on roaming laptop setup for Debian Edu</title>
  75                 <link>http://people.skolelinux.org/pere/blog/Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html</link>
  76                 <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html</guid>
  77                 <pubDate>Wed, 28 Apr 2010 20:40:00 +0200</pubDate>
  78                 <description>&lt;p&gt;For some years now, I have wondered how we should handle laptops in
  79 Debian Edu.  The Debian Edu infrastructure is mostly designed to
  80 handle stationary computers, and less suited for computers that come
  81 and go.&lt;/p&gt;
  82
  83 &lt;p&gt;Now I finally believe I have an sensible idea on how to adjust
  84 Debian Edu for laptops, by introducing a new profile for them, for
  85 example called Roaming Workstations.  Here are my thought on this.
  86 The setup would consist of the following:&lt;/p&gt;
  87
  88 &lt;ul&gt;
  89
  90  &lt;li&gt;During installation, the user name of the owner / primary user of
  91    the laptop is requested and a local home directory is set up for
  92    the user, with uid and gid information fetched from the LDAP
  93    server.  This allow the user to work also when offline.  The
  94    central home directory can be available in a subdirectory on
  95    request, for example mounted via CIFS.  It could be mounted
  96    automatically when a user log in while on the Debian Edu network,
  97    and unmounted when the machine is taken away (network down,
  98    hibernate, etc), it can be set up to do automatic mounting on
  99    request (using autofs), or perhaps some GUI button on the desktop
 100    can be used to access it when needed.  Perhaps it is enough to use
 101    the fish protocol in KDE?&lt;/li&gt;
 102
 103  &lt;li&gt;Password checking is set up to use LDAP or Kerberos
 104    authentication when the machine is on the Debian Edu network, and
 105    to cache the password for offline checking when the machine unable
 106    to reach the LDAP or Kerberos server.  This can be done using
 107    &lt;a href=&quot;http://www.padl.com/OSS/pam_ccreds.html&quot;&gt;libpam-ccreds&lt;/a&gt;
 108    or the Fedora developed
 109    &lt;a href=&quot;https://fedoraproject.org/wiki/Features/SSSD&quot;&gt;System
 110    Security Services Daemon&lt;/a&gt; packages.&lt;/li&gt;
 111
 112  &lt;li&gt;File synchronisation with the central home directory is set up
 113    using a shared directory in both the local and the central home
 114    directory, using unison.&lt;/li&gt;
 115
 116  &lt;li&gt;Printing should be set up to print to all printers broadcasting
 117    their existence on the local network, and should then work out of
 118    the box with CUPS.  For sites needing accurate printer quotas, some
 119    system with Kerberos authentication or printing via ssh could be
 120    implemented.&lt;/li&gt;
 121
 122  &lt;li&gt;For users that should have local root access to their laptop,
 123    sudo should be used to allow this to the local user.&lt;/li&gt;
 124
 125  &lt;li&gt;It would be nice if user and group information from LDAP is
 126    cached on the client, but given that there are entries for the
 127    local user and primary group in /etc/, it should not be needed.&lt;/li&gt;
 128
 129 &lt;/ul&gt;
 130
 131 &lt;p&gt;I believe all the pieces to implement this are in Debian/testing at
 132 the moment.  If we work quickly, we should be able to get this ready
 133 in time for the Squeeze release to freeze.  Some of the pieces need
 134 tweaking, like libpam-ccreds should get support for pam-auth-update
 135 (&lt;a href=&quot;http://bugs.debian.org/566718&quot;&gt;#566718&lt;/a&gt;) and nslcd (or
 136 perhaps debian-edu-config) should get some integration code to stop
 137 its daemon when the LDAP server is unavailable to avoid long timeouts
 138 when disconnected from the net.  If we get Kerberos enabled, we need
 139 to make sure we avoid long timeouts there too.&lt;/p&gt;
 140
 141 &lt;p&gt;If you want to help out with implementing this for Debian Edu,
 142 please contact us on debian-edu@lists.debian.org.&lt;/p&gt;
 143 </description>
 144         </item>
 145
 146         </channel>
 147 </rss>