blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/More_flexible_firmware_handling_in_debian_installer.html">More flexible firmware handling in debian-installer</a></div>
  24   <div class="date">2010-05-22 21:30</div>
  25   <div class="body">
  26 <p>After a long break from debian-installer development, I finally
  27 found time today to return to the project.  Having to spend less time
  28 working dependency based boot in debian, as it is almost complete now,
  29 definitely helped freeing some time.</p>
  30
  31 <p>A while back, I ran into a problem while working on Debian Edu.  We
  32 include some firmware packages on the Debian Edu CDs, those needed to
  33 get disk and network controllers working.  Without having these
  34 firmware packages available during installation, it is impossible to
  35 install Debian Edu on the given machine, and because our target group
  36 are non-technical people, asking them to provide firmware packages on
  37 an external medium is a support pain.  Initially, I expected it to be
  38 enough to include the firmware packages on the CD to get
  39 debian-installer to find and use them.  This proved to be wrong.
  40 Next, I hoped it was enough to symlink the relevant firmware packages
  41 to some useful location on the CD (tried /cdrom/ and
  42 /cdrom/firmware/).  This also proved to not work, and at this point I
  43 found time to look at the debian-installer code to figure out what was
  44 going to work.</p>
  45
  46 <p>The firmware loading code is in the hw-detect package, and a closer
  47 look revealed that it would only look for firmware packages outside
  48 the installation media, so the CD was never checked for firmware
  49 packages.  It would only check USB sticks, floppies and other
  50 "external" media devices.  Today I changed it to also look in the
  51 /cdrom/firmware/ directory on the mounted CD or DVD, which should
  52 solve the problem I ran into with Debian edu.  I also changed it to
  53 look in /firmware/, to make sure the installer also find firmware
  54 provided in the initrd when booting the installer via PXE, to allow us
  55 to provide the same feature in the PXE setup included in Debian
  56 Edu.</p>
  57
  58 <p>To make sure firmware deb packages with a license questions are not
  59 activated without asking if the license is accepted, I extended
  60 hw-detect to look for preinst scripts in the firmware packages, and
  61 run these before activating the firmware during installation.  The
  62 license question is asked using debconf in the preinst, so this should
  63 solve the issue for the firmware packages I have looked at so far.</p>
  64
  65 <p>If you want to discuss the details of these features, please
  66 contact us on debian-boot@lists.debian.org.</p>
  67 </div>
  68   <div class="tags">
  69
  70
  71
  72    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
  73
  74   </div>
  75  </div>
  76  <div class="padding"></div>
  77
  78  <div class="entry">
  79   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html">Magnetstripeinnhold i billetter fra Flytoget og Hurtigruten</a></div>
  80   <div class="date">2010-05-21 16:00</div>
  81   <div class="body">
  82 <p>For en stund tilbake kjøpte jeg en magnetkortleser for å kunne
  83 titte på hva som er skrevet inn på magnetstripene til ulike kort.  Har
  84 ikke hatt tid til å analysere mange kort så langt, men tenkte jeg
  85 skulle dele innholdet på to kort med mine lesere.</p>
  86
  87 <p>For noen dager siden tok jeg flyet til Harstad og Hurtigruten til
  88 Bergen.  Flytoget fra Oslo S til flyplassen ga meg en billett med
  89 magnetstripe.  Påtrykket finner jeg følgende informasjon:</p>
  90
  91 <pre>
  92 Flytoget Airport Express Train
  93
  94 Fra - Til        : Oslo Sentralstasjon
  95 Kategori         : Voksen
  96 Pris             : Nok 170,00
  97 Herav mva. 8,00% : NOK 12,59
  98 Betaling         : Kontant
  99 Til - Fra        : Oslo Lufthavn
 100 Utstedt:         : 08.05.10
 101 Gyldig Fra-Til   : 08.05.10-07.11.10
 102 Billetttype      : Enkeltbillett
 103
 104 102-1015-100508-48382-01-08
 105 </pre>
 106
 107 <p>På selve magnetstripen er innholdet
 108 <tt>;E?+900120011=23250996541068112619257138248441708433322932704083389389062603279671261502492655?</tt>.
 109 Aner ikke hva innholdet representerer, og det er lite overlapp mellom
 110 det jeg ser trykket på billetten og det jeg ser av tegn i
 111 magnetstripen.  Håper det betyr at de bruker kryptografiske metoder
 112 for å gjøre det vanskelig å forfalske billetter.</p>
 113
 114 <p>Den andre billetten er fra Hurtigruten, der jeg mistenker at
 115 strekkoden på fronten er mer brukt enn magnetstripen (det var i hvert
 116 fall den biten vi stakk inn i dørlåsen).</p>
 117
 118 <p>Påtrykket forsiden er følgende:</p>
 119
 120 <pre>
 121 Romnummer 727
 122 Hurtigruten
 123 Midnatsol
 124 Reinholdtsen
 125 Petter
 126 Bookingno: SAX69   0742193
 127 Harstad-Bergen
 128 Dep: 09.05.2010 Arr: 12.05.2010
 129 Lugar fra Risøyhamn
 130 Kost: FRO=4
 131 </pre>
 132
 133 <p>På selve magnetstripen er innholdet
 134 <tt>;1316010007421930=00000000000000000000?+E?</tt>.  Heller ikke her
 135 ser jeg mye korrespondanse mellom påtrykk og magnetstripe.</p>
 136 </div>
 137   <div class="tags">
 138
 139
 140
 141    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 142
 143   </div>
 144  </div>
 145  <div class="padding"></div>
 146
 147  <div class="entry">
 148   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Pieces_of_the_roaming_laptop_puzzle_in_Debian.html">Pieces of the roaming laptop puzzle in Debian</a></div>
 149   <div class="date">2010-05-19 19:00</div>
 150   <div class="body">
 151 <p>Today, the last piece of the puzzle for roaming laptops in Debian
 152 Edu finally entered the Debian archive.  Today, the new
 153 <a href="http://packages.qa.debian.org/libp/libpam-mklocaluser.html">libpam-mklocaluser</a>
 154 package was accepted.  Two days ago, two other pieces was accepted
 155 into unstable.  The
 156 <a href="http://packages.qa.debian.org/p/pam-python.html">pam-python</a>
 157 package needed by libpam-mklocaluser, and the
 158 <a href="http://packages.qa.debian.org/s/sssd.html">sssd</a> package
 159 passed NEW on Monday.  In addition, the
 160 <a href="http://packages.qa.debian.org/libp/libpam-ccreds.html">libpam-ccreds</a>
 161 package we need is in experimental (version 10-4) since Saturday, and
 162 hopefully will be moved to unstable soon.</p>
 163
 164 <p>This collection of packages allow for two different setups for
 165 roaming laptops.  The traditional setup would be using libpam-ccreds,
 166 nscd and libpam-mklocaluser with LDAP or Kerberos authentication,
 167 which should work out of the box if the configuration changes proposed
 168 for nscd in <a href="http://bugs.debian.org/485282">BTS report
 169 #485282</a> is implemented.  The alternative setup is to use sssd with
 170 libpam-mklocaluser to connect to LDAP or Kerberos and let sssd take
 171 care of the caching of passwords and group information.</p>
 172
 173 <p>I have so far been unable to get sssd to work with the LDAP server
 174 at the University, but suspect the issue is some SSL/GnuTLS related
 175 problem with the server certificate.  I plan to update the Debian
 176 package to version 1.2, which is scheduled for next week, and hope to
 177 find time to make sure the next release will include both the
 178 Debian/Ubuntu specific patches.  Upstream is friendly and responsive,
 179 and I am sure we will find a good solution.</p>
 180
 181 <p>The idea is to set up the roaming laptops to authenticate using
 182 LDAP or Kerberos and create a local user with home directory in /home/
 183 when a usre in LDAP logs in via KDM or GDM for the first time, and
 184 cache the password for offline checking, as well as caching group
 185 memberhips and other relevant LDAP information.  The
 186 libpam-mklocaluser package was created to make sure the local home
 187 directory is in /home/, instead of /site/server/directory/ which would
 188 be the home directory if pam_mkhomedir was used.  To avoid confusion
 189 with support requests and configuration, we do not want local laptops
 190 to have users in a path that is used for the same users home directory
 191 on the home directory servers.</p>
 192
 193 <p>One annoying problem with gdm is that it do not show the PAM
 194 message passed to the user from libpam-mklocaluser when the local user
 195 is created.  Instead gdm simply reject the login with some generic
 196 message.  The message is shown in kdm, ssh and login, so I guess it is
 197 a bug in gdm.  Have not investigated if there is some other message
 198 type that can be used instead to get gdm to also show the message.</p>
 199
 200 <p>If you want to help out with implementing this for Debian Edu,
 201 please contact us on debian-edu@lists.debian.org.</p>
 202 </div>
 203   <div class="tags">
 204
 205
 206
 207    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 208
 209   </div>
 210  </div>
 211  <div class="padding"></div>
 212
 213  <div class="entry">
 214   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html">Parallellized boot is now the default in Debian/unstable</a></div>
 215   <div class="date">2010-05-14 22:40</div>
 216   <div class="body">
 217 <p>Since this evening, parallel booting is the default in
 218 Debian/unstable for machines using dependency based boot sequencing.
 219 Apparently the testing of concurrent booting has been wider than
 220 expected, if I am to believe the
 221 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 222 on debian-devel@</a>, and I concluded a few days ago to move forward
 223 with the feature this weekend, to give us some time to detect any
 224 remaining problems before Squeeze is frozen.  If serious problems are
 225 detected, it is simple to change the default back to sequential boot.
 226 The upload of the new sysvinit package also activate a new upstream
 227 version.</p>
 228
 229 More information about
 230 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 231 based boot sequencing</a> is available from the Debian wiki.  It is
 232 currently possible to disable parallel booting when one run into
 233 problems caused by it, by adding this line to /etc/default/rcS:</p>
 234
 235 <blockquote><pre>
 236 CONCURRENCY=none
 237 </pre></blockquote>
 238
 239 <p>If you report any problems with dependencies in init.d scripts to
 240 the BTS, please usertag the report to get it to show up at
 241 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 242 list of usertagged bugs related to this</a>.</p>
 243 </div>
 244   <div class="tags">
 245
 246
 247
 248    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 249
 250   </div>
 251  </div>
 252  <div class="padding"></div>
 253
 254  <div class="entry">
 255   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html">Sitesummary tip: Listing MAC address of all clients</a></div>
 256   <div class="date">2010-05-14 21:10</div>
 257   <div class="body">
 258 <p>In the recent Debian Edu versions, the
 259 <a href="http://wiki.debian.org/DebianEdu/HowTo/SiteSummary">sitesummary
 260 system</a> is used to keep track of the machines in the school
 261 network.  Each machine will automatically report its status to the
 262 central server after boot and once per night.  The network setup is
 263 also reported, and using this information it is possible to get the
 264 MAC address of all network interfaces in the machines.  This is useful
 265 to update the DHCP configuration.</p>
 266
 267 <p>To give some idea how to use sitesummary, here is a one-liner to
 268 ist all MAC addresses of all machines reporting to sitesummary.  Run
 269 this on the collector host:</p>
 270
 271 <blockquote><pre>
 272 perl -MSiteSummary -e 'for_all_hosts(sub { print join(" ", get_macaddresses(shift)), "\n"; });'
 273 </pre></blockquote>
 274
 275 <p>This will list all MAC addresses assosiated with all machine, one
 276 line per machine and with space between the MAC addresses.</p>
 277
 278 <p>To allow system administrators easier job at adding static DHCP
 279 addresses for hosts, it would be possible to extend this to fetch
 280 machine information from sitesummary and update the DHCP and DNS
 281 tables in LDAP using this information.  Such tool is unfortunately not
 282 written yet.</p>
 283 </div>
 284   <div class="tags">
 285
 286
 287
 288    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary</a>.
 289
 290   </div>
 291  </div>
 292  <div class="padding"></div>
 293
 294  <div class="entry">
 295   <div class="title"><a href="http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html">systemd, an interesting alternative to upstart</a></div>
 296   <div class="date">2010-05-13 22:20</div>
 297   <div class="body">
 298 <p>The last few days a new boot system called
 299 <a href="http://www.freedesktop.org/wiki/Software/systemd">systemd</a>
 300 has been
 301 <a href="http://0pointer.de/blog/projects/systemd.html">introduced</a>
 302
 303 to the free software world.  I have not yet had time to play around
 304 with it, but it seem to be a very interesting alternative to
 305 <a href="http://upstart.ubuntu.com/">upstart</a>, and might prove to be
 306 a good alternative for Debian when we are able to switch to an event
 307 based boot system.  Tollef is
 308 <a href="http://bugs.debian.org/580814">in the process</a> of getting
 309 systemd into Debian, and I look forward to seeing how well it work.  I
 310 like the fact that systemd handles init.d scripts with dependency
 311 information natively, allowing them to run in parallel where upstart
 312 at the moment do not.</p>
 313
 314 <p>Unfortunately do systemd have the same problem as upstart regarding
 315 platform support.  It only work on recent Linux kernels, and also need
 316 some new kernel features enabled to function properly.  This means
 317 kFreeBSD and Hurd ports of Debian will need a port or a different boot
 318 system.  Not sure how that will be handled if systemd proves to be the
 319 way forward.</p>
 320
 321 <p>In the mean time, based on the
 322 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 323 on debian-devel@</a> regarding parallel booting in Debian, I have
 324 decided to enable full parallel booting as the default in Debian as
 325 soon as possible (probably this weekend or early next week), to see if
 326 there are any remaining serious bugs in the init.d dependencies.  A
 327 new version of the sysvinit package implementing this change is
 328 already in experimental.  If all go well, Squeeze will be released
 329 with parallel booting enabled by default.</p>
 330 </div>
 331   <div class="tags">
 332
 333
 334
 335    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 336
 337   </div>
 338  </div>
 339  <div class="padding"></div>
 340
 341  <div class="entry">
 342   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html">Parallellizing the boot in Debian Squeeze - ready for wider testing</a></div>
 343   <div class="date">2010-05-06 23:25</div>
 344   <div class="body">
 345 <p>These days, the init.d script dependencies in Squeeze are quite
 346 complete, so complete that it is actually possible to run all the
 347 init.d scripts in parallell based on these dependencies.  If you want
 348 to test your Squeeze system, make sure
 349 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 350 based boot sequencing</a> is enabled, and add this line to
 351 /etc/default/rcS:</p>
 352
 353 <blockquote><pre>
 354 CONCURRENCY=makefile
 355 </pre></blockquote>
 356
 357 <p>That is it.  It will cause sysv-rc to use the startpar tool to run
 358 scripts in parallel using the dependency information stored in
 359 /etc/init.d/.depend.boot, /etc/init.d/.depend.start and
 360 /etc/init.d/.depend.stop to order the scripts.  Startpar is configured
 361 to try to start the kdm and gdm scripts as early as possible, and will
 362 start the facilities required by kdm or gdm as early as possible to
 363 make this happen.</p>
 364
 365 <p>Give it a try, and see if you like the result.  If some services
 366 fail to start properly, it is most likely because they have incomplete
 367 init.d script dependencies in their startup script (or some of their
 368 dependent scripts have incomplete dependencies).  Report bugs and get
 369 the package maintainers to fix it. :)</p>
 370
 371 <p>Running scripts in parallel could be the default in Debian when we
 372 manage to get the init.d script dependencies complete and correct.  I
 373 expect we will get there in Squeeze+1, if we get manage to test and
 374 fix the remaining issues.</p>
 375
 376 <p>If you report any problems with dependencies in init.d scripts to
 377 the BTS, please usertag the report to get it to show up at
 378 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 379 list of usertagged bugs related to this</a>.</p>
 380 </div>
 381   <div class="tags">
 382
 383
 384
 385    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 386
 387   </div>
 388  </div>
 389  <div class="padding"></div>
 390
 391  <div class="entry">
 392   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html">Forcing new users to change their password on first login</a></div>
 393   <div class="date">2010-05-02 13:47</div>
 394   <div class="body">
 395 <p>One interesting feature in Active Directory, is the ability to
 396 create a new user with an expired password, and thus force the user to
 397 change the password on the first login attempt.</p>
 398
 399 <p>I'm not quite sure how to do that with the LDAP setup in Debian
 400 Edu, but did some initial testing with a local account.  The account
 401 and password aging information is available in /etc/shadow, but
 402 unfortunately, it is not possible to specify an expiration time for
 403 passwords, only a maximum age for passwords.</p>
 404
 405 <p>A freshly created account (using adduser test) will have these
 406 settings in /etc/shadow:</p>
 407
 408 <blockquote><pre>
 409 root@tjener:~# chage -l test
 410 Last password change                                    : May 02, 2010
 411 Password expires                                        : never
 412 Password inactive                                       : never
 413 Account expires                                         : never
 414 Minimum number of days between password change          : 0
 415 Maximum number of days between password change          : 99999
 416 Number of days of warning before password expires       : 7
 417 root@tjener:~#
 418 </pre></blockquote>
 419
 420 <p>The only way I could come up with to create a user with an expired
 421 account, is to change the date of the last password change to the
 422 lowest value possible (January 1th 1970), and the maximum password age
 423 to the difference in days between that date and today.  To make it
 424 simple, I went for 30 years (30 * 365 = 10950) and January 2th (to
 425 avoid testing if 0 is a valid value).</p>
 426
 427 <p>After using these commands to set it up, it seem to work as
 428 intended:</p>
 429
 430 <blockquote><pre>
 431 root@tjener:~# chage -d 1 test; chage -M 10950 test
 432 root@tjener:~# chage -l test
 433 Last password change                                    : Jan 02, 1970
 434 Password expires                                        : never
 435 Password inactive                                       : never
 436 Account expires                                         : never
 437 Minimum number of days between password change          : 0
 438 Maximum number of days between password change          : 10950
 439 Number of days of warning before password expires       : 7
 440 root@tjener:~#
 441 </pre></blockquote>
 442
 443 <p>So far I have tested this with ssh and console, and kdm (in
 444 Squeeze) login, and all ask for a new password before login in the
 445 user (with ssh, I was thrown out and had to log in again).</p>
 446
 447 <p>Perhaps we should set up something similar for Debian Edu, to make
 448 sure only the user itself have the account password?</p>
 449
 450 <p>If you want to comment on or help out with implementing this for
 451 Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 452
 453 <p>Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the
 454 shadow(8) page in Debian/testing now state that setting the date of
 455 last password change to zero (0) will force the password to be changed
 456 on the first login.  This was not mentioned in the manual in Lenny, so
 457 I did not notice this in my initial testing.  I have tested it on
 458 Squeeze, and '<tt>chage -d 0 username</tt>' do work there.  I have not
 459 tested it on Lenny yet.</p>
 460
 461 <p>Update 2010-05-02-19:05: Jim Paris tells me via email that an
 462 equivalent command to expire a password is '<tt>passwd -e
 463 username</tt>', which insert zero into the date of the last password
 464 change.</p>
 465 </div>
 466   <div class="tags">
 467
 468
 469
 470    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 471
 472   </div>
 473  </div>
 474  <div class="padding"></div>
 475
 476  <div class="entry">
 477   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html">Thoughts on roaming laptop setup for Debian Edu</a></div>
 478   <div class="date">2010-04-28 20:40</div>
 479   <div class="body">
 480 <p>For some years now, I have wondered how we should handle laptops in
 481 Debian Edu.  The Debian Edu infrastructure is mostly designed to
 482 handle stationary computers, and less suited for computers that come
 483 and go.</p>
 484
 485 <p>Now I finally believe I have an sensible idea on how to adjust
 486 Debian Edu for laptops, by introducing a new profile for them, for
 487 example called Roaming Workstations.  Here are my thought on this.
 488 The setup would consist of the following:</p>
 489
 490 <ul>
 491
 492  <li>During installation, the user name of the owner / primary user of
 493    the laptop is requested and a local home directory is set up for
 494    the user, with uid and gid information fetched from the LDAP
 495    server.  This allow the user to work also when offline.  The
 496    central home directory can be available in a subdirectory on
 497    request, for example mounted via CIFS.  It could be mounted
 498    automatically when a user log in while on the Debian Edu network,
 499    and unmounted when the machine is taken away (network down,
 500    hibernate, etc), it can be set up to do automatic mounting on
 501    request (using autofs), or perhaps some GUI button on the desktop
 502    can be used to access it when needed.  Perhaps it is enough to use
 503    the fish protocol in KDE?</li>
 504
 505  <li>Password checking is set up to use LDAP or Kerberos
 506    authentication when the machine is on the Debian Edu network, and
 507    to cache the password for offline checking when the machine unable
 508    to reach the LDAP or Kerberos server.  This can be done using
 509    <a href="http://www.padl.com/OSS/pam_ccreds.html">libpam-ccreds</a>
 510    or the Fedora developed
 511    <a href="https://fedoraproject.org/wiki/Features/SSSD">System
 512    Security Services Daemon</a> packages.</li>
 513
 514  <li>File synchronisation with the central home directory is set up
 515    using a shared directory in both the local and the central home
 516    directory, using unison.</li>
 517
 518  <li>Printing should be set up to print to all printers broadcasting
 519    their existence on the local network, and should then work out of
 520    the box with CUPS.  For sites needing accurate printer quotas, some
 521    system with Kerberos authentication or printing via ssh could be
 522    implemented.</li>
 523
 524  <li>For users that should have local root access to their laptop,
 525    sudo should be used to allow this to the local user.</li>
 526
 527  <li>It would be nice if user and group information from LDAP is
 528    cached on the client, but given that there are entries for the
 529    local user and primary group in /etc/, it should not be needed.</li>
 530
 531 </ul>
 532
 533 <p>I believe all the pieces to implement this are in Debian/testing at
 534 the moment.  If we work quickly, we should be able to get this ready
 535 in time for the Squeeze release to freeze.  Some of the pieces need
 536 tweaking, like libpam-ccreds should get support for pam-auth-update
 537 (<a href="http://bugs.debian.org/566718">#566718</a>) and nslcd (or
 538 perhaps debian-edu-config) should get some integration code to stop
 539 its daemon when the LDAP server is unavailable to avoid long timeouts
 540 when disconnected from the net.  If we get Kerberos enabled, we need
 541 to make sure we avoid long timeouts there too.</p>
 542
 543 <p>If you want to help out with implementing this for Debian Edu,
 544 please contact us on debian-edu@lists.debian.org.</p>
 545 </div>
 546   <div class="tags">
 547
 548
 549
 550    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 551
 552   </div>
 553  </div>
 554  <div class="padding"></div>
 555
 556  <div class="entry">
 557   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html">Great book: "Content: Selected Essays on Technology, Creativity, Copyright, and the Future of the Future"</a></div>
 558   <div class="date">2010-04-19 17:10</div>
 559   <div class="body">
 560 <p>The last few weeks i have had the pleasure of reading a
 561 thought-provoking collection of essays by Cory Doctorow, on topics
 562 touching copyright, virtual worlds, the future of man when the
 563 conscience mind can be duplicated into a computer and many more. The
 564 book titled "Content: Selected Essays on Technology, Creativity,
 565 Copyright, and the Future of the Future" is available with few
 566 restrictions on the web, for example from
 567 <a href="http://craphound.com/content/">his own site</a>. I read the
 568 epub-version from
 569 <a href="http://www.feedbooks.com/book/2883">feedbooks</a> using
 570 <a href="http://www.fbreader.org/">fbreader</a> and my N810. I
 571 strongly recommend this book.</p>
 572 </div>
 573   <div class="tags">
 574
 575
 576
 577    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 578
 579   </div>
 580  </div>
 581  <div class="padding"></div>
 582
 583  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
 584
 585 <div id="sidebar">
 586
 587
 588
 589
 590
 591 <h2>Archive</h2>
 592 <ul>
 593
 594 <li>2010
 595 <ul>
 596
 597 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 598
 599 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 600
 601 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 602
 603 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 604
 605 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (8)</a></li>
 606
 607 </ul></li>
 608
 609 <li>2009
 610 <ul>
 611
 612 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 613
 614 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 615
 616 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 617
 618 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 619
 620 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 621
 622 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 623
 624 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 625
 626 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 627
 628 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 629
 630 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 631
 632 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 633
 634 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 635
 636 </ul></li>
 637
 638 <li>2008
 639 <ul>
 640
 641 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 642
 643 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 644
 645 </ul></li>
 646
 647 </ul>
 648
 649
 650
 651 <h2>Tags</h2>
 652 <ul>
 653
 654  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 655
 656  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 657
 658  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 659
 660  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (19)</a></li>
 661
 662  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (19)</a></li>
 663
 664  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (30)</a></li>
 665
 666  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 667
 668  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (6)</a></li>
 669
 670  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
 671
 672  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
 673
 674  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 675
 676  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 677
 678  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (65)</a></li>
 679
 680  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (74)</a></li>
 681
 682  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (12)</a></li>
 683
 684  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (11)</a></li>
 685
 686  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 687
 688  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 689
 690  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (8)</a></li>
 691
 692  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (1)</a></li>
 693
 694  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (11)</a></li>
 695
 696  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 697
 698  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 699
 700  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 701
 702  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
 703
 704 </ul>
 705
 706 </div>
 707
 708 <p style="text-align: right">
 709 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
 710 </p>
 711 </body>
 712 </html>