blog/No_hardcoded_config_on_Debian_Edu_clients.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen: No hardcoded config on Debian Edu clients</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7  </head>
   8  <body>
   9
  10  <div class="title">
  11   <h1>
  12        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  13
  14   </h1>
  15
  16  </div>
  17
  18
  19  <div class="entry">
  20   <div class="title">No hardcoded config on Debian Edu clients</div>
  21   <div class="date">2010-08-09 20:15</div>
  22   <div class="body">
  23 <p>As reported earlier, the last few days I have looked at how Debian
  24 Edu clients are configured, and tried to get rid of all hardcoded
  25 configuration settings on the clients.  I believe the work to be
  26 mostly done, and the clients seem to work just fine with dynamically
  27 generated configuration.</p>
  28
  29 <p>What is the point, you might ask?  The point is to allow a Debian
  30 Edu desktop to integrate into an existing network infrastructure
  31 without any manual configuration.</p>
  32
  33 <p>This is what happens when installing a Debian Edu client here at
  34 the University of Oslo using PXE.  With the PXE installation, I am
  35 asked for language (Norwegian Bokmål), locality (Norway) and keyboard
  36 layout (no-latin1), Debian Edu profile (Roaming Workstation), if I
  37 accept to reformat the hard drive (yes), if I want to submit info to
  38 popcon.debian.org (no) and root password (secret).  After answering
  39 these questions, the installer goes ahead and does its thing, and
  40 after around 50 minutes it is done.  I press enter to finish the
  41 installation, and the machine reboots into KDE.  When the machine is
  42 ready and kdm asks for login information, I enter my university
  43 username and password, am told by kdm that a local home directory has
  44 been created and that I must log in again, and finally log in with the
  45 same username and password to the KDE 4.4 desktop.  At no point during
  46 this process did it ask for university specific settings, and all the
  47 required configuration was dynamically detected using information
  48 fetched via DHCP and DNS.  The roaming workstation is now ready for
  49 use.</p>
  50
  51 <p>How was this done, you might wonder?  First of all, here is the
  52 list of things that need to be configured on the client to get it
  53 working properly out of the box:</p>
  54
  55 <ul>
  56 <li>IP address/netmask and DNS server.</li>
  57 <li>Web proxy URL.</li>
  58 <li>LDAP server for NSS directory information (user, group, etc).</li>
  59 <li>Kerberos server for PAM password checking.</li>
  60 <li>SMB mount point to access the network home directory. (*)</li>
  61 <li>Central syslog server to send syslog messages to. (*)</li>
  62 <li>Sitesummary collector URL to submit info to central server. (*)</li>
  63 </ul>
  64
  65 <p>(Hm, did I forget anything?  Let me knew if I did.)</p>
  66
  67 <p>The points marked (*) are not required to be able to use the
  68 machine, but needed to provide central storage and allowing system
  69 administrators to track their machines.  Since yesterday, everything
  70 but the sitesummary collector URL is dynamically discovered at boot
  71 and installation time in the svn version of Debian Edu.</p>
  72
  73 <p>The IP and DNS setup is fetched during boot using DHCP as usual.
  74 When a DHCP update arrives, the proxy setup is updated by looking for
  75 http://wpat/wpad.dat and using the content of this WPAD file to
  76 configure the http and ftp proxy in /etc/environment and
  77 /etc/apt/apt.conf.  I decided to update the proxy setup using a DHCP
  78 hook to ensure that the client stops using the Debian Edu proxy when
  79 it is moved outside the Debian Edu network, and instead uses any local
  80 proxy present on the new network when it moves around.</p>
  81
  82 <p>The DNS names of the LDAP, Kerberos and syslog server and related
  83 configuration are generated using DNS information at boot.  First the
  84 installer looks for a host named ldap in the current DNS domain.  If
  85 not found, it looks for _ldap._tcp SRV records in DNS instead.  If an
  86 LDAP server is found, its root DSE entry is requested and the
  87 attributes namingContexts and defaultNamingContext are used to
  88 determine which LDAP base to use for NSS.  If there are several
  89 namingContexts attibutes and the defaultNamingContext is present, that
  90 LDAP subtree is used as the base.  If defaultNamingContext is missing,
  91 the subtrees listed as namingContexts are searched in sequence for any
  92 object with class posixAccount or posixGroup, and the first one with
  93 such an object is used as the LDAP base.  For Kerberos, a similar
  94 search is done by first looking for a host named kerberos, and then
  95 for the _kerberos._tcp SRV record.  I've been unable to find a way to
  96 look up the Kerberos realm, so for this the upper case string of the
  97 current DNS domain is used.</p>
  98
  99 <p>For the syslog server, the hosts syslog and loghost are searched
 100 for, and the _syslog._udp SRV record is consulted if no such host is
 101 found.  This algorithm works for both Debian Edu and the University of
 102 Oslo.  A similar strategy would work for locating the sitesummary
 103 server, but have not been implemented yet.  I decided to fetch and
 104 save these settings during installation, to make sure moving to a
 105 different network does not change the set of users being allowed to
 106 log in nor the passwords required to log in.  Usernames and passwords
 107 will be cached by sssd when the user logs in on the Debian Edu
 108 network, and will not change as the laptop move around.  For a
 109 non-roaming machine, there is no caching, but given that it is
 110 supposed to stay in place it should not matter much.  Perhaps we
 111 should switch those to use sssd too?</p>
 112
 113 <p>The user's SMB mount point for the network home directory is
 114 located when the user logs in for the first time.  The LDAP server is
 115 consulted to look for the user's LDAP object and the sambaHomePath
 116 attribute is used if found.  If it isn't found, the home directory
 117 path fetched from NSS is used instead.  Assuming the path is of the
 118 form /site/server/directory/username, the second part is looked up in
 119 DNS and used to generate a SMB URL of the form
 120 smb://server.domain/username.  This algorithm works for both Debian
 121 edu and the University of Oslo.  Perhaps there are better attributes
 122 to use or a better algorithm that works for more sites, but this will
 123 do for now. :)</p>
 124
 125 <p>This work should make it easier to integrate the Debian Edu clients
 126 into any LDAP/Kerberos infrastructure, and make the current setup even
 127 more flexible than before.  I suspect it will also work for thin
 128 client servers, allowing one to easily set up LTSP and hook it into a
 129 existing network infrastructure, but I have not had time to test this
 130 yet.</p>
 131
 132 <p>If you want to help out with implementing these things for Debian
 133 Edu, please contact us on debian-edu@lists.debian.org.</p>
 134
 135 <p>Update 2010-08-09: Simon Farnsworth gave me a heads-up on how to
 136 detect Kerberos realm from DNS, by looking for _kerberos TXT entries
 137 before falling back to the upper case DNS domain name.  Will have to
 138 implement it for Debian Edu. :)</p>
 139 </div>
 140
 141   <div class="tags">Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.</div>
 142
 143   </div>
 144
 145
 146
 147
 148
 149
 150 <div id="sidebar">
 151
 152 <h2>Archive</h2>
 153 <ul>
 154
 155 <li>2010
 156 <ul>
 157
 158 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 159
 160 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 161
 162 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 163
 164 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 165
 166 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 167
 168 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 169
 170 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
 171
 172 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
 173
 174 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
 175
 176 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
 177
 178 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (10)</a></li>
 179
 180 </ul></li>
 181
 182 <li>2009
 183 <ul>
 184
 185 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 186
 187 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 188
 189 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 190
 191 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 192
 193 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 194
 195 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 196
 197 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 198
 199 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 200
 201 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 202
 203 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 204
 205 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 206
 207 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 208
 209 </ul></li>
 210
 211 <li>2008
 212 <ul>
 213
 214 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 215
 216 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 217
 218 </ul></li>
 219
 220 </ul>
 221
 222
 223
 224 <h2>Tags</h2>
 225 <ul>
 226
 227  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (12)</a></li>
 228
 229  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 230
 231  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 232
 233  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
 234
 235  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (42)</a></li>
 236
 237  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (50)</a></li>
 238
 239  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (71)</a></li>
 240
 241  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 242
 243  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (11)</a></li>
 244
 245  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (5)</a></li>
 246
 247  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
 248
 249  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (4)</a></li>
 250
 251  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 252
 253  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (10)</a></li>
 254
 255  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (90)</a></li>
 256
 257  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (113)</a></li>
 258
 259  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (18)</a></li>
 260
 261  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (25)</a></li>
 262
 263  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 264
 265  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (4)</a></li>
 266
 267  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 268
 269  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (18)</a></li>
 270
 271  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
 272
 273  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (16)</a></li>
 274
 275  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 276
 277  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (15)</a></li>
 278
 279  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 280
 281  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (13)</a></li>
 282
 283 </ul>
 284
 285 </div>
 286  </body>
 287 </html>