blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Rob_Weir__How_to_Crush_Dissent.html">Rob Weir: How to Crush Dissent</a></div>
  24   <div class="date">2010-08-15 22:20</div>
  25   <div class="body">
  26 <p>I found the notes from Rob Weir on
  27 <a href="http://feedproxy.google.com/~r/robweir/antic-atom/~3/VGb23-kta8c/how-to-crush-dissent.html">how
  28 to crush dissent</a> matching my own thoughts on the matter quite
  29 well.  Highly recommended for those wondering which road our society
  30 should go down.  In my view we have been heading the wrong way for a
  31 long time.</p>
  32 </div>
  33   <div class="tags">
  34
  35
  36
  37    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
  38
  39   </div>
  40  </div>
  41  <div class="padding"></div>
  42
  43  <div class="entry">
  44   <div class="title"><a href="http://people.skolelinux.org/pere/blog/No_hardcoded_config_on_Debian_Edu_clients.html">No hardcoded config on Debian Edu clients</a></div>
  45   <div class="date">2010-08-09 20:15</div>
  46   <div class="body">
  47 <p>As reported earlier, the last few days I have looked at how Debian
  48 Edu clients are configured, and tried to get rid of all hardcoded
  49 configuration settings on the clients.  I believe the work to be
  50 mostly done, and the clients seem to work just fine with dynamically
  51 generated configuration.</p>
  52
  53 <p>What is the point, you might ask?  The point is to allow a Debian
  54 Edu desktop to integrate into an existing network infrastructure
  55 without any manual configuration.</p>
  56
  57 <p>This is what happens when installing a Debian Edu client here at
  58 the University of Oslo using PXE.  With the PXE installation, I am
  59 asked for language (Norwegian Bokmål), locality (Norway) and keyboard
  60 layout (no-latin1), Debian Edu profile (Roaming Workstation), if I
  61 accept to reformat the hard drive (yes), if I want to submit info to
  62 popcon.debian.org (no) and root password (secret).  After answering
  63 these questions, the installer goes ahead and does its thing, and
  64 after around 50 minutes it is done.  I press enter to finish the
  65 installation, and the machine reboots into KDE.  When the machine is
  66 ready and kdm asks for login information, I enter my university
  67 username and password, am told by kdm that a local home directory has
  68 been created and that I must log in again, and finally log in with the
  69 same username and password to the KDE 4.4 desktop.  At no point during
  70 this process did it ask for university specific settings, and all the
  71 required configuration was dynamically detected using information
  72 fetched via DHCP and DNS.  The roaming workstation is now ready for
  73 use.</p>
  74
  75 <p>How was this done, you might wonder?  First of all, here is the
  76 list of things that need to be configured on the client to get it
  77 working properly out of the box:</p>
  78
  79 <ul>
  80 <li>IP address/netmask and DNS server.</li>
  81 <li>Web proxy URL.</li>
  82 <li>LDAP server for NSS directory information (user, group, etc).</li>
  83 <li>Kerberos server for PAM password checking.</li>
  84 <li>SMB mount point to access the network home directory. (*)</li>
  85 <li>Central syslog server to send syslog messages to. (*)</li>
  86 <li>Sitesummary collector URL to submit info to central server. (*)</li>
  87 </ul>
  88
  89 <p>(Hm, did I forget anything?  Let me knew if I did.)</p>
  90
  91 <p>The points marked (*) are not required to be able to use the
  92 machine, but needed to provide central storage and allowing system
  93 administrators to track their machines.  Since yesterday, everything
  94 but the sitesummary collector URL is dynamically discovered at boot
  95 and installation time in the svn version of Debian Edu.</p>
  96
  97 <p>The IP and DNS setup is fetched during boot using DHCP as usual.
  98 When a DHCP update arrives, the proxy setup is updated by looking for
  99 http://wpat/wpad.dat and using the content of this WPAD file to
 100 configure the http and ftp proxy in /etc/environment and
 101 /etc/apt/apt.conf.  I decided to update the proxy setup using a DHCP
 102 hook to ensure that the client stops using the Debian Edu proxy when
 103 it is moved outside the Debian Edu network, and instead uses any local
 104 proxy present on the new network when it moves around.</p>
 105
 106 <p>The DNS names of the LDAP, Kerberos and syslog server and related
 107 configuration are generated using DNS information at boot.  First the
 108 installer looks for a host named ldap in the current DNS domain.  If
 109 not found, it looks for _ldap._tcp SRV records in DNS instead.  If an
 110 LDAP server is found, its root DSE entry is requested and the
 111 attributes namingContexts and defaultNamingContext are used to
 112 determine which LDAP base to use for NSS.  If there are several
 113 namingContexts attibutes and the defaultNamingContext is present, that
 114 LDAP subtree is used as the base.  If defaultNamingContext is missing,
 115 the subtrees listed as namingContexts are searched in sequence for any
 116 object with class posixAccount or posixGroup, and the first one with
 117 such an object is used as the LDAP base.  For Kerberos, a similar
 118 search is done by first looking for a host named kerberos, and then
 119 for the _kerberos._tcp SRV record.  I've been unable to find a way to
 120 look up the Kerberos realm, so for this the upper case string of the
 121 current DNS domain is used.</p>
 122
 123 <p>For the syslog server, the hosts syslog and loghost are searched
 124 for, and the _syslog._udp SRV record is consulted if no such host is
 125 found.  This algorithm works for both Debian Edu and the University of
 126 Oslo.  A similar strategy would work for locating the sitesummary
 127 server, but have not been implemented yet.  I decided to fetch and
 128 save these settings during installation, to make sure moving to a
 129 different network does not change the set of users being allowed to
 130 log in nor the passwords required to log in.  Usernames and passwords
 131 will be cached by sssd when the user logs in on the Debian Edu
 132 network, and will not change as the laptop move around.  For a
 133 non-roaming machine, there is no caching, but given that it is
 134 supposed to stay in place it should not matter much.  Perhaps we
 135 should switch those to use sssd too?</p>
 136
 137 <p>The user's SMB mount point for the network home directory is
 138 located when the user logs in for the first time.  The LDAP server is
 139 consulted to look for the user's LDAP object and the sambaHomePath
 140 attribute is used if found.  If it isn't found, the home directory
 141 path fetched from NSS is used instead.  Assuming the path is of the
 142 form /site/server/directory/username, the second part is looked up in
 143 DNS and used to generate a SMB URL of the form
 144 smb://server.domain/username.  This algorithm works for both Debian
 145 edu and the University of Oslo.  Perhaps there are better attributes
 146 to use or a better algorithm that works for more sites, but this will
 147 do for now. :)</p>
 148
 149 <p>This work should make it easier to integrate the Debian Edu clients
 150 into any LDAP/Kerberos infrastructure, and make the current setup even
 151 more flexible than before.  I suspect it will also work for thin
 152 client servers, allowing one to easily set up LTSP and hook it into a
 153 existing network infrastructure, but I have not had time to test this
 154 yet.</p>
 155
 156 <p>If you want to help out with implementing these things for Debian
 157 Edu, please contact us on debian-edu@lists.debian.org.</p>
 158
 159 <p>Update 2010-08-09: Simon Farnsworth gave me a heads-up on how to
 160 detect Kerberos realm from DNS, by looking for _kerberos TXT entries
 161 before falling back to the upper case DNS domain name.  Will have to
 162 implement it for Debian Edu. :)</p>
 163 </div>
 164   <div class="tags">
 165
 166
 167
 168    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 169
 170   </div>
 171  </div>
 172  <div class="padding"></div>
 173
 174  <div class="entry">
 175   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">Testing if a file system can be used for home directories...</a></div>
 176   <div class="date">2010-08-08 21:20</div>
 177   <div class="body">
 178 <p>A few years ago, I was involved in a project planning to use
 179 Windows file servers as home directory servers for Debian
 180 Edu/Skolelinux machines.  This was thought to be no problem, as the
 181 access would be through the SMB network file system protocol, and we
 182 knew other sites used SMB with unix and samba as the file server to
 183 mount home directories without any problems.  But, after months of
 184 struggling, we had to conclude that our goal was impossible.</p>
 185
 186 <p>The reason is simply that while SMB can be used for home
 187 directories when the file server is Samba running on Unix, this only
 188 work because of Samba have some extensions and the fact that the
 189 underlying file system is a unix file system.  When using a Windows
 190 file server, the underlying file system do not have POSIX semantics,
 191 and several programs will fail if the users home directory where they
 192 want to store their configuration lack POSIX semantics.</p>
 193
 194 <p>As part of this work, I wrote a small C program I want to share
 195 with you all, to replicate a few of the problematic applications (like
 196 OpenOffice.org and GCompris) and see if the file system was working as
 197 it should.  If you find yourself in spooky file system land, it might
 198 help you find your way out again.  This is the fs-test.c source:</p>
 199
 200 <pre>
 201 /*
 202  * Some tests to check the file system sematics.  Used to verify that
 203  * CIFS from a windows server do not work properly as a linux home
 204  * directory.
 205  * License: GPL v2 or later
 206  *
 207  * needs libsqlite3-dev and build-essential installed
 208  * compile with: gcc -Wall -lsqlite3 -DTEST_SQLITE fs-test.c -o fs-test
 209 */
 210
 211 #define _FILE_OFFSET_BITS 64
 212 #define _LARGEFILE_SOURCE 1
 213 #define _LARGEFILE64_SOURCE 1
 214
 215 #define _GNU_SOURCE /* for asprintf() */
 216
 217 #include &lt;errno.h>
 218 #include &lt;fcntl.h>
 219 #include &lt;stdio.h>
 220 #include &lt;string.h>
 221 #include &lt;stdlib.h>
 222 #include &lt;sys/file.h>
 223 #include &lt;sys/stat.h>
 224 #include &lt;sys/types.h>
 225 #include &lt;unistd.h>
 226
 227 #ifdef TEST_SQLITE
 228 /*
 229  * Test sqlite open, as done by gcompris require the libsqlite3-dev
 230  * package and linking with -lsqlite3.  A more low level test is
 231  * below.
 232  * See also &lt;URL: http://www.sqlite.org./faq.html#q5 >.
 233  */
 234 #include &lt;sqlite3.h>
 235 #define CREATE_TABLE_USERS                                              \
 236   "CREATE TABLE users (user_id INT UNIQUE, login TEXT, lastname TEXT, firstname TEXT, birthdate TEXT, class_id INT ); "
 237 int test_sqlite_open(void) {
 238   char *zErrMsg;
 239   char *name = "testsqlite.db";
 240   sqlite3 *db=NULL;
 241   unlink(name);
 242   int rc = sqlite3_open(name, &db);
 243   if( rc ){
 244     printf("error: sqlite open of %s failed: %s\n", name, sqlite3_errmsg(db));
 245     sqlite3_close(db);
 246     return -1;
 247   }
 248
 249   /* create tables */
 250   rc = sqlite3_exec(db,CREATE_TABLE_USERS, NULL,  0, &zErrMsg);
 251   if( rc != SQLITE_OK ){
 252     printf("error: sqlite table create failed: %s\n", zErrMsg);
 253     sqlite3_close(db);
 254     return -1;
 255   }
 256   printf("info: sqlite worked\n");
 257   sqlite3_close(db);
 258   return 0;
 259 }
 260 #endif /* TEST_SQLITE */
 261
 262 /*
 263  * Demonstrate locking issue found in gcompris using sqlite3.  This
 264  * work with ext3, but not with cifs server on Windows 2003.  This is
 265  * done in the sqlite3 library.
 266  * See also
 267  * &lt;URL:http://www.cygwin.com/ml/cygwin/2001-08/msg00854.html> and the
 268  * POSIX specification
 269  * &lt;URL:http://www.opengroup.org/onlinepubs/009695399/functions/fcntl.html>.
 270  */
 271 int test_gcompris_locking(void) {
 272   struct flock fl;
 273   char *name = "testsqlite.db";
 274   unlink(name);
 275   int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, 0644);
 276   printf("info: testing fcntl locking\n");
 277
 278   fl.l_whence = SEEK_SET;
 279   fl.l_pid    = getpid();
 280   printf("  Read-locking 1 byte from 1073741824");
 281   fl.l_start  = 1073741824;
 282   fl.l_len    = 1;
 283   fl.l_type   = F_RDLCK;
 284   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 285
 286   printf("  Read-locking 510 byte from 1073741826");
 287   fl.l_start  = 1073741826;
 288   fl.l_len    = 510;
 289   fl.l_type   = F_RDLCK;
 290   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 291
 292   printf("  Unlocking 1 byte from 1073741824");
 293   fl.l_start  = 1073741824;
 294   fl.l_len    = 1;
 295   fl.l_type   = F_UNLCK;
 296   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 297
 298   printf("  Write-locking 1 byte from 1073741824");
 299   fl.l_start  = 1073741824;
 300   fl.l_len    = 1;
 301   fl.l_type   = F_WRLCK;
 302   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 303
 304   printf("  Write-locking 510 byte from 1073741826");
 305   fl.l_start  = 1073741826;
 306   fl.l_len    = 510;
 307   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 308
 309   printf("  Unlocking 2 byte from 1073741824");
 310   fl.l_start  = 1073741824;
 311   fl.l_len    = 2;
 312   fl.l_type   = F_UNLCK;
 313   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 314
 315   close(fd);
 316   return 0;
 317 }
 318
 319 /*
 320  * Test if permissions of freshly created directories allow entries
 321  * below them.  This was a problem with OpenOffice.org and gcompris.
 322  * Mounting with option 'sync' seem to solve this problem while
 323  * slowing down file operations.
 324  */
 325 int test_subdirectory_creation(void) {
 326 #define LEVELS 5
 327   char *path = strdup("test");
 328   char *dirs[LEVELS];
 329   int level;
 330   printf("info: testing subdirectory creation\n");
 331   for (level = 0; level &lt; LEVELS; level++) {
 332     char *newpath = NULL;
 333     if (-1 == mkdir(path, 0777)) {
 334       printf("  error: Unable to create directory '%s': %s\n",
 335              path, strerror(errno));
 336       break;
 337     }
 338     asprintf(&newpath, "%s/%s", path, "test");
 339     free(path);
 340     path = newpath;
 341   }
 342   return 0;
 343 }
 344
 345 /*
 346  * Test if symlinks can be created.  This was a problem detected with
 347  * KDE.
 348  */
 349 int test_symlinks(void) {
 350   printf("info: testing symlink creation\n");
 351   unlink("symlink");
 352   if (-1 == symlink("file", "symlink"))
 353     printf("  error: Unable to create symlink\n");
 354   return 0;
 355 }
 356
 357 int main(int argc, char **argv) {
 358   printf("Testing POSIX/Unix sematics on file system\n");
 359   test_symlinks();
 360   test_subdirectory_creation();
 361 #ifdef TEST_SQLITE
 362   test_sqlite_open();
 363 #endif /* TEST_SQLITE */
 364   test_gcompris_locking();
 365   return 0;
 366 }
 367 </pre>
 368
 369 <p>When everything is working, it should print something like
 370 this:</p>
 371
 372 <pre>
 373 Testing POSIX/Unix sematics on file system
 374 info: testing symlink creation
 375 info: testing subdirectory creation
 376 info: sqlite worked
 377 info: testing fcntl locking
 378   Read-locking 1 byte from 1073741824
 379   Read-locking 510 byte from 1073741826
 380   Unlocking 1 byte from 1073741824
 381   Write-locking 1 byte from 1073741824
 382   Write-locking 510 byte from 1073741826
 383   Unlocking 2 byte from 1073741824
 384 </pre>
 385
 386 <p>I do not remember the exact details of the problems we saw, but one
 387 of them was with locking, where if I remember correctly, POSIX allow a
 388 read-only lock to be upgraded to a read-write lock without unlocking
 389 the read-only lock (while Windows do not).  Another was a bug in the
 390 CIFS/SMB client implementation in the Linux kernel where directory
 391 meta information would be wrong for a fraction of a second, making
 392 OpenOffice.org fail to create its deep directory tree because it was
 393 not allowed to create files in its freshly created directory.</p>
 394
 395 <p>Anyway, here is a nice tool for your tool box, might you never need
 396 it. :)</p>
 397 </div>
 398   <div class="tags">
 399
 400
 401
 402    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 403
 404   </div>
 405  </div>
 406  <div class="padding"></div>
 407
 408  <div class="entry">
 409   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html">Autodetecting Client setup for roaming workstations in Debian Edu</a></div>
 410   <div class="date">2010-08-07 14:45</div>
 411   <div class="body">
 412 <p>A few days ago, I
 413 <a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">tried
 414 to install</a> a Roaming workation profile from Debian Edu/Squeeze
 415 while on the university network here at the University of Oslo, and
 416 noticed how much had to change to get it operational using the
 417 university infrastructure.  It was fairly easy, but it occured to me
 418 that Debian Edu would improve a lot if I could get the client to
 419 connect without any changes at all, and thus let the client configure
 420 itself during installation and first boot to use the infrastructure
 421 around it.  Now I am a huge step further along that road.</p>
 422
 423 <p>With our current squeeze-test packages, I can select the roaming
 424 workstation profile and get a working laptop connecting to the
 425 university LDAP server for user and group and our active directory
 426 servers for Kerberos authentication.  All this without any
 427 configuration at all during installation.  My users home directory got
 428 a bookmark in the KDE menu to mount it via SMB, with the correct URL.
 429 In short, openldap and sssd is correctly configured.  In addition to
 430 this, the client look for http://wpad/wpad.dat to configure a web
 431 proxy, and when it fail to find it no proxy settings are stored in
 432 /etc/environment and /etc/apt/apt.conf.  Iceweasel and KDE is
 433 configured to look for the same wpad configuration and also do not use
 434 a proxy when at the university network.  If the machine is moved to a
 435 network with such wpad setup, it would automatically use it when DHCP
 436 gave it a IP address.</p>
 437
 438 <p>The LDAP server is located using DNS, by first looking for the DNS
 439 entry ldap.$domain.  If this do not exist, it look for the
 440 _ldap._tcp.$domain SRV records and use the first one as the LDAP
 441 server.  Next, it connects to the LDAP server and search all
 442 namingContexts entries for posixAccount or posixGroup objects, and
 443 pick the first one as the LDAP base.  For Kerberos, a similar
 444 algorithm is used to locate the LDAP server, and the realm is the
 445 uppercase version of $domain.</p>
 446
 447 <p>So, what is not working, you might ask.  SMB mounting my home
 448 directory do not work.  No idea why, but suspected the incorrect
 449 Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
 450 the cause.  These are not properly configured during installation, and
 451 had to be hand-edited to get the correct Kerberos realm and server,
 452 but SMB mounting still do not work. :(</p>
 453
 454 <p>With this automatic configuration in place, I expect a Debian Edu
 455 roaming profile installation would be able to automatically detect and
 456 connect to any site using LDAP and Kerberos for NSS directory and PAM
 457 authentication.  It should also work out of the box in a Active
 458 Directory environment providing posixAccount and posixGroup objects
 459 with UID and GID values.</p>
 460
 461 <p>If you want to help out with implementing these things for Debian
 462 Edu, please contact us on debian-edu@lists.debian.org.</p>
 463 </div>
 464   <div class="tags">
 465
 466
 467
 468    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 469
 470   </div>
 471  </div>
 472  <div class="padding"></div>
 473
 474  <div class="entry">
 475   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">Debian Edu roaming workstation - at the university of Oslo</a></div>
 476   <div class="date">2010-08-03 23:30</div>
 477   <div class="body">
 478 <p>The new roaming workstation profile in Debian Edu/Squeeze is fairly
 479 similar to the laptop setup am I working on using Ubuntu for the
 480 University of Oslo, and just for the heck of it, I tested today how
 481 hard it would be to integrate that profile into the university
 482 infrastructure.  In this case, it is the university LDAP server,
 483 Active Directory Kerberos server and SMB mounting from the Netapp file
 484 servers.</p>
 485
 486 <p>I was pleasantly surprised that the only three files needed to be
 487 changed (/etc/sssd/sssd.conf, /etc/ldap.conf and
 488 /etc/mklocaluser.d/20-debian-edu-config) and one file had to be added
 489 (/usr/share/perl5/Debian/Edu_Local.pm), to get the client working.
 490 Most of the changes were to get the client to use the university LDAP
 491 for NSS and Kerberos server for PAM, but one was to change a hard
 492 coded DNS domain name in the mklocaluser hook from .intern to
 493 .uio.no.</p>
 494
 495 <p>This testing was so encouraging, that I went ahead and adjusted the
 496 Debian Edu scripts and setup in subversion to centralise the roaming
 497 workstation setup a bit more and avoid the hardcoded DNS domain name,
 498 so that when I test this tomorrow, I expect to get away with modifying
 499 only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the
 500 university servers.</p>
 501
 502 <p>My goal is to get the clients to have no hardcoded settings and
 503 fetch all their initial setup during installation and first boot, to
 504 allow them to be inserted also into environments where the default
 505 setup in Debian Edu has been changed or as with the university, where
 506 the environment is different but provides the protocols Debian Edu
 507 uses.</p>
 508 </div>
 509   <div class="tags">
 510
 511
 512
 513    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 514
 515   </div>
 516  </div>
 517  <div class="padding"></div>
 518
 519  <div class="entry">
 520   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html">Circular package dependencies harms apt recovery</a></div>
 521   <div class="date">2010-07-27 23:50</div>
 522   <div class="body">
 523 <p>I discovered this while doing
 524 <a href="http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html">automated
 525 testing of upgrades from Debian Lenny to Squeeze</a>.  A few packages
 526 in Debian still got circular dependencies, and it is often claimed
 527 that apt and aptitude should be able to handle this just fine, but
 528 some times these dependency loops causes apt to fail.</p>
 529
 530 <p>An example is from todays
 531 <a href="http://people.skolelinux.org/~pere/debian-upgrade-testing//test-20100727-lenny-squeeze-kde-aptitude.txt">upgrade
 532 of KDE using aptitude</a>.  In it, a bug in kdebase-workspace-data
 533 causes perl-modules to fail to upgrade.  The cause is simple.  If a
 534 package fail to unpack, then only part of packages with the circular
 535 dependency might end up being unpacked when unpacking aborts, and the
 536 ones already unpacked will fail to configure in the recovery phase
 537 because its dependencies are unavailable.</p>
 538
 539 <p>In this log, the problem manifest itself with this error:</p>
 540
 541 <blockquote><pre>
 542 dpkg: dependency problems prevent configuration of perl-modules:
 543  perl-modules depends on perl (>= 5.10.1-1); however:
 544   Version of perl on system is 5.10.0-19lenny2.
 545 dpkg: error processing perl-modules (--configure):
 546  dependency problems - leaving unconfigured
 547 </pre></blockquote>
 548
 549 <p>The perl/perl-modules circular dependency is already
 550 <a href="http://bugs.debian.org/527917">reported as a bug</a>, and will
 551 hopefully be solved as soon as possible, but it is not the only one,
 552 and each one of these loops in the dependency tree can cause similar
 553 failures.  Of course, they only occur when there are bugs in other
 554 packages causing the unpacking to fail, but it is rather nasty when
 555 the failure of one package causes the problem to become worse because
 556 of dependency loops.</p>
 557
 558 <p>Thanks to
 559 <a href="http://lists.debian.org/debian-devel/2010/06/msg00116.html">the
 560 tireless effort by Bill Allombert</a>, the number of circular
 561 dependencies
 562 <a href="http://debian.semistable.com/debgraph.out.html">left in Debian
 563 is dropping</a>, and perhaps it will reach zero one day. :)</p>
 564
 565 <p>Todays testing also exposed a bug in
 566 <a href="http://bugs.debian.org/590605">update-notifier</a> and
 567 <a href="http://bugs.debian.org/590604">different behaviour</a> between
 568 apt-get and aptitude, the latter possibly caused by some circular
 569 dependency.  Reported both to BTS to try to get someone to look at
 570 it.</p>
 571 </div>
 572   <div class="tags">
 573
 574
 575
 576    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 577
 578   </div>
 579  </div>
 580  <div class="padding"></div>
 581
 582  <div class="entry">
 583   <div class="title"><a href="http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html">First Debian Edu test release (alpha0) based on Squeeze is released</a></div>
 584   <div class="date">2010-07-27 17:45</div>
 585   <div class="body">
 586 <p>I just posted this announcement culminating several months of work
 587 with the next Debian Edu release.  Not nearly done, but one major step
 588 completed.</p>
 589
 590 <blockquote>
 591 <p>This is the first test release based on Squeeze. The focus of this
 592 release is to test the user application selection. To have a look,
 593 install the standalone profile and let the developers know if the set
 594 of installed packages i.e. applications should be modified. If some
 595 user application is missing, or if there are some applications that no
 596 longer make sense to be included in Debian Edu, please let us know.
 597 Also, if a useful application is missing the translation for your
 598 language of choice, please let us know too.</p>
 599
 600 <p>In addition, feedback and help to polish the desktop (menus,
 601 artwork, starters, etc.) is appreciated. We would like to ship a nice
 602 and handy KDE4 desktop targeted for schools out of the box.</p>
 603
 604 <p>The other profiles should be installable, but there is a lot more
 605 work left to be done before they are ready, so do not expect to
 606 much.</p>
 607
 608 <p>Changes compared to the lenny based version</p>
 609
 610 <ul>
 611 <li>Everything from Debian Squeeze
 612 <ul>
 613   <li>Desktop environment KDE 4.4 => the new KDE desktop in
 614          combination with some new artwork
 615   <li>Web browser Iceweasel 3.5
 616   <li>OpenOffice.org 3.2
 617   <li>Educational toolbox GCompris 9.3
 618   <li>Music creator Rosegarden 10.04.2
 619   <li>Image editor Gimp 2.6.10
 620   <li>Virtual universe Celestia 1.6.0
 621   <li>Virtual stargazer Stellarium 0.10.4
 622   <li>3D modeler Blender 2.49.2 (new application)
 623   <li>Video editor Kdenlive 0.7.7 (new application)
 624 </ul></li>
 625 <li>Now using Kerberos for password checking (migration not finished).
 626     Enabled for:
 627 <ul>
 628   <li>PAM
 629   <li>LDAP
 630   <li>IMAP
 631   <li>SMTP (sender verification)
 632 </ul>
 633 </li>
 634 <li>New experimental roaming workstation profile for laptops.</li>
 635 <li>Show welcome page to users when they first log in. The URL is
 636     fetched from LDAP.</li>
 637 <li>New LXDE desktop option, in addition to KDE (default) and Gnome.</li>
 638 <li>General cleanup (not finished)</li>
 639 </ul>
 640 <p>The following features are not working as they should</p>
 641
 642 <ul>
 643 <li>No web based administration tool for creating users and groups. The
 644     scripts ldap-createuser-krb and ldap-add-user-to-group can be used
 645     for testing.</li>
 646 <li>DVD installs are missing debian-installer images for the PXE boot,
 647     and do not set up the PXE menu on eth0 because of this. LTSP
 648     clients should still boot from eth1 on thin client servers.</li>
 649 <li>The restructured KDE menu is not implemented.</li>
 650 <li>The LDAP server setup need to be reviewed for security.</li>
 651 <li>The LDAP directory structure need to be reworked.</li>
 652 <li>Different sets of packages are installed when using the DVD and the
 653     netinst CD. More packages are installed using the netinst CD.</li>
 654 <li>The jackd package fail to install. This is believed to be caused by
 655     some ongoing transition, and hopefully should be solved soon. The
 656     jackd1 package can be installed manually for those that need it.</li>
 657 <li>Some packages lack translations. See
 658     http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status,
 659     and help out with translations.</li>
 660 </ul>
 661
 662 <p>To download this multiarch netinstall release you can use</p>
 663
 664 <ul>
 665 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
 666 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
 667 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</li>
 668 </ul>
 669 <p>To download this multiarch dvd release you can use</p>
 670
 671 <ul>
 672 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
 673 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
 674 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</li>
 675 </ul>
 676
 677 <p>There is no source DVD available yet. It will be prepared when we
 678 get closer to the final release.</p>
 679
 680 <p>The MD5SUM of these images are</p>
 681
 682 <ul>
 683 <li>3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-6.0.0+edua0-CD.iso</li>
 684 <li>22f2cbfce281d1c6e478be452638675d debian-edu-6.0.0+edua0-DVD.iso</li>
 685 </ul>
 686
 687 <p>The SHA1SUM of these images are</p>
 688 <ul>
 689 <li>c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-6.0.0+edua0-CD.iso</li>
 690 <li>2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-6.0.0+edua0-DVD.iso</li>
 691 </ul>
 692 <p>How to report bugs:
 693 http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla</p>
 694
 695 <p>Please direct replies to debian-edu@lists.debian.org</p>
 696 </blockquote>
 697 </div>
 698   <div class="tags">
 699
 700
 701
 702    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 703
 704   </div>
 705  </div>
 706  <div class="padding"></div>
 707
 708  <div class="entry">
 709   <div class="title"><a href="http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html">One step closer to single signon in Debian Edu</a></div>
 710   <div class="date">2010-07-25 10:00</div>
 711   <div class="body">
 712 <p>The last few months me and the other Debian Edu developers have
 713 been working hard to get the Debian/Squeeze based version of Debian
 714 Edu/Skolelinux into shape.  This future version will use Kerberos for
 715 authentication, and services are slowly migrated to single signon,
 716 getting rid of password questions one at the time.</p>
 717
 718 <p>It will also feature a roaming workstation profile with local home
 719 directory, for laptops that are only some times on the Skolelinux
 720 network, and for this profile a shortcut is created in Gnome and KDE
 721 to gain access to the users home directory on the file server.  This
 722 shortcut uses SMB at the moment, and yesterday I had time to test if
 723 SMB mounting had started working in KDE after we added the cifs-utils
 724 package.  I was pleasantly surprised how well it worked.</p>
 725
 726 <p>Thanks to the recent changes to our samba configuration to get it
 727 to use Kerberos for authentication, there were no question about user
 728 password when mounting the SMB volume.  A simple click on the shortcut
 729 in the KDE menu, and a window with the home directory popped
 730 up. :)</p>
 731
 732 <p>One step closer to a single signon solution out of the box in
 733 Debian Edu.  We already had PAM, LDAP, IMAP and SMTP in place, and now
 734 also Samba.  Next step is Cups and hopefully also NFS.</p>
 735
 736 <p>We had planned a alpha0 release of Debian Edu for today, but thanks
 737 to the autobuilder administrators for some architectures being slow to
 738 sign packages, we are still missing the fixed LTSP package we need for
 739 the release.  It was uploaded three days ago with urgency=high, and if
 740 it had entered testing yesterday we would have been able to test it in
 741 time for a alpha0 release today.  As the binaries for ia64 and powerpc
 742 still not uploaded to the Debian archive, we need to delay the alpha
 743 release another day.</p>
 744
 745 <p>If you want to help out with implementing Kerberos for Debian Edu,
 746 please contact us on debian-edu@lists.debian.org.</p>
 747 </div>
 748   <div class="tags">
 749
 750
 751
 752    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 753
 754   </div>
 755  </div>
 756  <div class="padding"></div>
 757
 758  <div class="entry">
 759   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til____slutte____kj__pe_musikk.html">Digitale restriksjonsmekanismer fikk meg til å slutte å kjøpe musikk</a></div>
 760   <div class="date">2010-07-22 23:50</div>
 761   <div class="body">
 762 <p>For mange år siden slutte jeg å kjøpe musikk-CDer. Årsaken var at
 763 musikkbransjen var godt i gang med å selge platene sine med DRM som
 764 gjorde at jeg ikke fikk spilt av musikken jeg kjøpte på utstyret jeg
 765 hadde tilgjengelig, dvs. min datamaskin. Det var umulig å se på en
 766 plate om den var ødelagt eller ikke, og jeg hadde jo allerede en
 767 anseelig samling med plater, så jeg bestemme meg for å slutte å gi
 768 penger til en bransje som åpenbart ikke respekterte meg.</p>
 769
 770 <p>Jeg har mange titalls dager med musikk på CD i dag. Det meste er
 771 lagt i et stort arkiv som kan spilles av fra husets datamaskiner (har
 772 ikke rukket rippe alt). Jeg ser dermed ikke behovet for å skaffe mer
 773 musikk. De fleste av mine favoritter er i hus, og jeg er dermed godt
 774 fornøyd.</p>
 775
 776 <p>Hvis musikkbransjen ønsker mine penger, så må de demonstrere at de
 777 setter pris på meg som kunde, og ikke skremme meg bort med DRM og
 778 antydninger om at kundene er kriminelle.</p>
 779
 780 <p>Filmbransjen er like ille, men mens musikk gjerne varer lenge, er
 781 filmer mer ferskvare. Har dermed ikke helt sluttet å kjøpe filmer, men
 782 holder meg til DVD-filmer som kan spilles av på mine Linuxbokser.
 783 Kommer neppe til å ta i bruk Blueray, og ei heller de nye DRM-greiene
 784 «Ultraviolet» som be annonsert her om dagen.</p>
 785 </div>
 786   <div class="tags">
 787
 788
 789
 790    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>.
 791
 792   </div>
 793  </div>
 794  <div class="padding"></div>
 795
 796  <div class="entry">
 797   <div class="title"><a href="http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html">OpenStreetmap one step closer to having routing on its front page</a></div>
 798   <div class="date">2010-07-18 16:45</div>
 799   <div class="body">
 800 <p>Thanks to
 801 <a href="http://feedproxy.google.com/~r/Opengeodata/~3/wUTCzDZk3lc/project-of-the-week-which-way-home">todays
 802 opengeodata blog entry</a>, I just discovered that the
 803 OpenStreetmap.org site have gotten
 804 <a href="http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT">support
 805 for calculating routes</a>.  The support is still experimental and
 806 only available from the development server, until more experience is
 807 gathered on the user interface and any scalability issues.</p>
 808
 809 <p>Earlier, the routing I knew about using the OpenStreetmap.org data
 810 was provided by <a href="http://maps.cloudmade.com/">Cloudmade</a>,
 811 but having it on the main page is required to make everyone aware of
 812 the issue.  I've had people reject Openstreetmap.org as a viable
 813 alternative for them because the front page lacked routing support,
 814 and I hope their needs will be catered for when routing show up on the
 815 www.openstreetmap.org front page.</p>
 816 </div>
 817   <div class="tags">
 818
 819
 820
 821    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/kart">kart</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 822
 823   </div>
 824  </div>
 825  <div class="padding"></div>
 826
 827  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
 828
 829 <div id="sidebar">
 830
 831
 832
 833
 834
 835 <h2>Archive</h2>
 836 <ul>
 837
 838 <li>2010
 839 <ul>
 840
 841 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 842
 843 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 844
 845 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 846
 847 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 848
 849 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 850
 851 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 852
 853 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
 854
 855 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (5)</a></li>
 856
 857 </ul></li>
 858
 859 <li>2009
 860 <ul>
 861
 862 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 863
 864 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 865
 866 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 867
 868 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 869
 870 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 871
 872 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 873
 874 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 875
 876 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 877
 878 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 879
 880 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 881
 882 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 883
 884 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 885
 886 </ul></li>
 887
 888 <li>2008
 889 <ul>
 890
 891 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 892
 893 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 894
 895 </ul></li>
 896
 897 </ul>
 898
 899
 900
 901 <h2>Tags</h2>
 902 <ul>
 903
 904  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 905
 906  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 907
 908  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 909
 910  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
 911
 912  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (35)</a></li>
 913
 914  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (40)</a></li>
 915
 916  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (56)</a></li>
 917
 918  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 919
 920  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (8)</a></li>
 921
 922  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (3)</a></li>
 923
 924  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
 925
 926  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (2)</a></li>
 927
 928  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 929
 930  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 931
 932  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (71)</a></li>
 933
 934  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (93)</a></li>
 935
 936  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (14)</a></li>
 937
 938  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (15)</a></li>
 939
 940  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 941
 942  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 943
 944  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (11)</a></li>
 945
 946  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
 947
 948  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
 949
 950  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 951
 952  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 953
 954  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 955
 956  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (7)</a></li>
 957
 958 </ul>
 959
 960 </div>
 961
 962 <p style="text-align: right">
 963 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
 964 </p>
 965 </body>
 966 </html>