1 <!DOCTYPE html PUBLIC
"-//W3C//DTD XHTML 1.0 Strict//EN"
2 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
5 <title>Petter Reinholdtsen
</title>
6 <link rel=
"stylesheet" type=
"text/css" media=
"screen" href=
"style.css">
7 <link rel=
"alternate" title=
"RSS Feed" href=
"index.rss" type=
"application/rss+xml">
14 <a href=
"">Petter Reinholdtsen
</a>
23 <div class=
"title"><a href=
"Forcing_new_users_to_change_their_password_on_first_login.html">Forcing new users to change their password on first login
</a></div>
24 <div class=
"date">2010-
05-
02 13:
47</div>
26 <p>One interesting feature in Active Directory, is the ability to
27 create a new user with an expired password, and thus force the user to
28 change the password on the first login attempt.
</p>
30 <p>I'm not quite sure how to do that with the LDAP setup in Debian
31 Edu, but did some initial testing with a local account. The account
32 and password aging information is available in /etc/shadow, but
33 unfortunately, it is not possible to specify an expiration time for
34 passwords, only a maximum age for passwords.
</p>
36 <p>A freshly created account (using adduser test) will have these
37 settings in /etc/shadow:
</p>
40 root@tjener:~# chage -l test
41 Last password change : May
02,
2010
42 Password expires : never
43 Password inactive : never
44 Account expires : never
45 Minimum number of days between password change :
0
46 Maximum number of days between password change :
99999
47 Number of days of warning before password expires :
7
51 <p>The only way I could come up with to create a user with an expired
52 account, is to change the date of the last password change to the
53 lowest value possible (January
1th
1970), and the maximum password age
54 to the difference in days between that date and today. To make it
55 simple, I went for
30 years (
30 *
365 =
10950) and January
2th (to
56 avoid testing if
0 is a valid value).
</p>
58 <p>After using these commands to set it up, it seem to work as
62 root@tjener:~# chage -d
1 test; chage -M
10950 test
63 root@tjener:~# chage -l test
64 Last password change : Jan
02,
1970
65 Password expires : never
66 Password inactive : never
67 Account expires : never
68 Minimum number of days between password change :
0
69 Maximum number of days between password change :
10950
70 Number of days of warning before password expires :
7
74 <p>So far I have tested this with ssh and console, and kdm (in
75 Squeeze) login, and all ask for a new password before login in the
76 user (with ssh, I was thrown out and had to log in again).
</p>
78 <p>Perhaps we should set up something similar for Debian Edu, to make
79 sure only the user itself have the account password?
</p>
81 <p>If you want to comment on or help out with implementing this for
82 Debian Edu, please contact us on debian-edu@lists.debian.org.
</p>
88 Tags:
<a href=
"tags/debian edu">debian edu
</a>,
<a href=
"tags/english">english
</a>,
<a href=
"tags/nuug">nuug
</a>,
<a href=
"tags/sikkerhet">sikkerhet
</a>.
92 <div class=
"padding"></div>
95 <div class=
"title"><a href=
"Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html">Thoughts on roaming laptop setup for Debian Edu
</a></div>
96 <div class=
"date">2010-
04-
28 20:
40</div>
98 <p>For some years now, I have wondered how we should handle laptops in
99 Debian Edu. The Debian Edu infrastructure is mostly designed to
100 handle stationary computers, and less suited for computers that come
103 <p>Now I finally believe I have an sensible idea on how to adjust
104 Debian Edu for laptops, by introducing a new profile for them, for
105 example called Roaming Workstations. Here are my thought on this.
106 The setup would consist of the following:
</p>
110 <li>During installation, the user name of the owner / primary user of
111 the laptop is requested and a local home directory is set up for
112 the user, with uid and gid information fetched from the LDAP
113 server. This allow the user to work also when offline. The
114 central home directory can be available in a subdirectory on
115 request, for example mounted via CIFS. It could be mounted
116 automatically when a user log in while on the Debian Edu network,
117 and unmounted when the machine is taken away (network down,
118 hibernate, etc), it can be set up to do automatic mounting on
119 request (using autofs), or perhaps some GUI button on the desktop
120 can be used to access it when needed. Perhaps it is enough to use
121 the fish protocol in KDE?
</li>
123 <li>Password checking is set up to use LDAP or Kerberos
124 authentication when the machine is on the Debian Edu network, and
125 to cache the password for offline checking when the machine unable
126 to reach the LDAP or Kerberos server. This can be done using
127 <a href=
"http://www.padl.com/OSS/pam_ccreds.html">libpam-ccreds
</a>
128 or the Fedora developed
129 <a href=
"https://fedoraproject.org/wiki/Features/SSSD">System
130 Security Services Daemon
</a> packages.
</li>
132 <li>File synchronisation with the central home directory is set up
133 using a shared directory in both the local and the central home
134 directory, using unison.
</li>
136 <li>Printing should be set up to print to all printers broadcasting
137 their existence on the local network, and should then work out of
138 the box with CUPS. For sites needing accurate printer quotas, some
139 system with Kerberos authentication or printing via ssh could be
142 <li>For users that should have local root access to their laptop,
143 sudo should be used to allow this to the local user.
</li>
145 <li>It would be nice if user and group information from LDAP is
146 cached on the client, but given that there are entries for the
147 local user and primary group in /etc/, it should not be needed.
</li>
151 <p>I believe all the pieces to implement this are in Debian/testing at
152 the moment. If we work quickly, we should be able to get this ready
153 in time for the Squeeze release to freeze. Some of the pieces need
154 tweaking, like libpam-ccreds should get support for pam-auth-update
155 (
<a href=
"http://bugs.debian.org/566718">#
566718</a>) and nslcd (or
156 perhaps debian-edu-config) should get some integration code to stop
157 its daemon when the LDAP server is unavailable to avoid long timeouts
158 when disconnected from the net. If we get Kerberos enabled, we need
159 to make sure we avoid long timeouts there too.
</p>
161 <p>If you want to help out with implementing this for Debian Edu,
162 please contact us on debian-edu@lists.debian.org.
</p>
168 Tags:
<a href=
"tags/debian edu">debian edu
</a>,
<a href=
"tags/english">english
</a>,
<a href=
"tags/nuug">nuug
</a>.
172 <div class=
"padding"></div>
175 <div class=
"title"><a href=
"Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html">Great book: "Content: Selected Essays on Technology, Creativity, Copyright, and the Future of the Future"
</a></div>
176 <div class=
"date">2010-
04-
19 17:
10</div>
178 <p>The last few weeks i have had the pleasure of reading a
179 thought-provoking collection of essays by Cory Doctorow, on topics
180 touching copyright, virtual worlds, the future of man when the
181 conscience mind can be duplicated into a computer and many more. The
182 book titled "Content: Selected Essays on Technology, Creativity,
183 Copyright, and the Future of the Future" is available with few
184 restrictions on the web, for example from
185 <a href=
"http://craphound.com/content/">his own site
</a>. I read the
187 <a href=
"http://www.feedbooks.com/book/2883">feedbooks
</a> using
188 <a href=
"http://www.fbreader.org/">fbreader
</a> and my N810. I
189 strongly recommend this book.
</p>
195 Tags:
<a href=
"tags/english">english
</a>,
<a href=
"tags/fildeling">fildeling
</a>,
<a href=
"tags/nuug">nuug
</a>,
<a href=
"tags/opphavsrett">opphavsrett
</a>,
<a href=
"tags/personvern">personvern
</a>,
<a href=
"tags/sikkerhet">sikkerhet
</a>,
<a href=
"tags/web">web
</a>.
199 <div class=
"padding"></div>
202 <div class=
"title"><a href=
"Kerberos_for_Debian_Edu_Squeeze_.html">Kerberos for Debian Edu/Squeeze?
</a></div>
203 <div class=
"date">2010-
04-
14 17:
20</div>
205 <p><a href=
"http://www.nuug.no/aktiviteter/20100413-kerberos/">Yesterdays
206 NUUG presentation
</a> about Kerberos was inspiring, and reminded me
207 about the need to start using Kerberos in Skolelinux. Setting up a
208 Kerberos server seem to be straight forward, and if we get this in
209 place a long time before the Squeeze version of Debian freezes, we
210 have a chance to migrate Skolelinux away from NFSv3 for the home
211 directories, and over to an architecture where the infrastructure do
212 not have to trust IP addresses and machines, and instead can trust
213 users and cryptographic keys instead.
</p>
215 <p>A challenge will be integration and administration. Is there a
216 Kerberos implementation for Debian where one can control the
217 administration access in Kerberos using LDAP groups? With it, the
218 school administration will have to maintain access control using flat
219 files on the main server, which give a huge potential for errors.
</p>
221 <p>A related question I would like to know is how well Kerberos and
222 pam-ccreds (offline password check) work together. Anyone know?
</p>
224 <p>Next step will be to use Kerberos for access control in Lwat and
225 Nagios. I have no idea how much work that will be to implement. We
226 would also need to document how to integrate with Windows AD, as such
227 shared network will require two Kerberos realms that need to cooperate
228 to work properly.
</p>
230 <p>I believe a good start would be to start using Kerberos on the
231 skolelinux.no machines, and this way get ourselves experience with
232 configuration and integration. A natural starting point would be
233 setting up ldap.skolelinux.no as the Kerberos server, and migrate the
234 rest of the machines from PAM via LDAP to PAM via Kerberos one at the
237 <p>If you would like to contribute to get this working in Skolelinux,
238 I recommend you to see the video recording from yesterdays NUUG
239 presentation, and start using Kerberos at home. The video show show
240 up in a few days.
</p>
246 Tags:
<a href=
"tags/debian edu">debian edu
</a>,
<a href=
"tags/english">english
</a>,
<a href=
"tags/nuug">nuug
</a>.
250 <div class=
"padding"></div>
253 <div class=
"title"><a href=
"P___vegne_av_vanvitting_mange__Aftenposten_.html">På vegne av vanvitting mange, Aftenposten!
</a></div>
254 <div class=
"date">2010-
03-
06 21:
15</div>
256 <p><a href=
"http://fotball.aftenposten.no/incoming/article163000.ece">Aftenposten
257 melder
</a> på forsiden av webavisen sin at de tror Erling Fossen
258 provoserer nordlendinger med sine uttalelser på
259 fotballtinget. Jeg er utflyttet nordlending, og må innrømme at jeg
260 ikke kjennet så mye som et snev av provokasjon fra denne litt morsomme
261 uttalelsen til Hr. Fossen. Lurer på om Aftenposten har noen kilder
262 utenom redaksjonen for sin påstand om at nordledinger er provosert av
263 Hr. Fossen. Må innrømme at jeg tviler på det.
</p>
265 <p>Det hele bringer tankene tilbake til Sture Hansen i Hallo i Uken.
</p>
271 Tags:
<a href=
"tags/norsk">norsk
</a>.
275 <div class=
"padding"></div>
278 <div class=
"title"><a href=
"After_6_years_of_waiting__the_Xreset_d_feature_is_implemented.html">After
6 years of waiting, the Xreset.d feature is implemented
</a></div>
279 <div class=
"date">2010-
03-
06 18:
15</div>
281 <p>6 years ago, as part of the Debian Edu development I am involved
282 in, I asked for a hook in the kdm and gdm setup to run scripts as root
283 when the user log out. A bug was submitted against the xfree86-common
284 package in
2004 (
<a href=
"http://bugs.debian.org/230422">#
230422</a>),
285 and revisited every time Debian Edu was working on a new release.
286 Today, this finally paid off.
</p>
288 <p>The framework for this feature was today commited to the git
289 repositry for the xorg package, and the git repository for xdm has
290 been updated to use this framework. Next on my agenda is to make sure
291 kdm and gdm also add code to use this framework.
</p>
293 <p>In Debian Edu, we want to ability to run commands as root when the
294 user log out, to get rid of runaway processes and do general cleanup
295 after a user. With this framework in place, we finally can do that in
296 a generic way that work with all display managers using this
297 framework. My goal is to get all display managers in Debian use it,
298 similar to how they use the Xsession.d framework today.
<p>
304 Tags:
<a href=
"tags/debian edu">debian edu
</a>,
<a href=
"tags/english">english
</a>,
<a href=
"tags/nuug">nuug
</a>.
308 <div class=
"padding"></div>
311 <div class=
"title"><a href=
"Digitale_b__ker_uten_digitale_restriksjonsmekanismer__DRM__b__r_f___mva_fritak.html">Digitale bøker uten digitale restriksjonsmekanismer (DRM) bør få mva-fritak
</a></div>
312 <div class=
"date">2010-
03-
03 19:
00</div>
314 <p>Den norske bokbransjen har
315 <a href=
"http://www.digi.no/823912/nei-til-moms-paa-e-boker">bedt om at
316 digitale bøker må få mva-fritak
</a> slik papirbøker har det, og
317 <a href=
"http://www.digi.no/836875/moms-paa-alt-digitalt-innhold">finansdepartementet
318 har sagt nei
</a>. Det er et interessant spørsmål om digitale bøker
319 bør ha mva-fritak eller ikke, og svaret er ikke så enkelt som et ja
321 <a href=
"http://www.digi.no/836925/norske-e-boker-truet-av-moms">Enkelte
322 medlemmer
</a> av bokbransjen truer med å droppe den planlagte
323 lanseringen av norske digitale bøker med digitale restriksjonsmekanismer
324 (DRM) som de har snakket om å gjennomføre nå i vår, og det må de
325 gjerne gjøre for min del.
</p>
327 <p>Papirbøker har mva-fritak pga. at de fremmer kultur- og
328 kunnskapsspredning. Digitale bøker uten digitale
329 restriksjonsmekanismer (DRM) fremmer kultur- og kunnskapsspredning,
330 mens digitale bøker med DRM hindrer kultur og kunnskapsspredning.
331 Digitale bøker uten DRM bør få mva-fritak da det er salg av bøker på
332 lik linje med salg av papirbøker, mens digitale bøker med DRM ikke bør
333 få det da det er utleie av bøker og ikke salg.
</p>
335 <p>Jeg foretrekker å kjøpe bøker, og velger dermed å la være å bruke
336 DRM-belastede digitale bøker. Vet ikke helt hva jeg ville være villig
337 til å betale for å leie en bok, men tror ikke det er mange kronene.
338 Heldigvis er det mye bøker tilgjengelig uten slike restriksjoner, og
339 de som vil ha tak i engelske bøker kan laste ned bøker som er
340 tilgjengelig uten bruksbegresninger fra
<a href=
"http://www.archive.org/">The
341 Internet Archive
</a>. Der er det pr. i dag
1 889 313 bøker
342 tilgjengelig. De er tilgjengelig i flere formater. Besøk
343 <a href=
"http://www.archive.org/details/texts">oversikten over tekster
344 der
</a> for å se hva de har.
350 Tags:
<a href=
"tags/norsk">norsk
</a>,
<a href=
"tags/nuug">nuug
</a>,
<a href=
"tags/opphavsrett">opphavsrett
</a>.
354 <div class=
"padding"></div>
357 <div class=
"title"><a href=
"Debian_Edu___Skolelinux_based_on_Lenny_released__work_continues.html">Debian Edu / Skolelinux based on Lenny released, work continues
</a></div>
358 <div class=
"date">2010-
02-
11 17:
15</div>
360 <p>On Tuesday, the Debian/Lenny based version of
361 <a href=
"http://www.skolelinux.org/">Skolelinux
</a> was finally
362 shipped. This was a major leap forward for the project, and I am very
363 pleased that we finally got the release wrapped up. Work on the first
364 point release starts imediately, as we plan to get that one out a
365 month after the major release, to include all fixes for bugs we found
366 and fixed too late in the release process to include last Tuesday.
</p>
368 <p>Perhaps it even is time for some partying?
</p>
370 <p>After this first point release, my plan is to focus again on the
371 next major release, based on Squeeze. We will try to get as many of
372 the fixes we need into the official Debian packages before the freeze,
373 and have just a few weeks or months to make it happen.
</p>
379 Tags:
<a href=
"tags/debian edu">debian edu
</a>,
<a href=
"tags/english">english
</a>,
<a href=
"tags/nuug">nuug
</a>.
383 <div class=
"padding"></div>
386 <div class=
"title"><a href=
"Danmark_g__r_for_ODF_.html">Danmark går for ODF?
</a></div>
387 <div class=
"date">2010-
01-
29 12:
00</div>
389 <p>Ble nettopp gjort oppmerksom på en
390 <a href=
"http://www.version2.dk/artikel/13690-breaking-odf-vinder-dokumentformat-krigen ">nyhet fra Version2
</a>
391 fra Danmark, der det hevdes at Folketinget har vedtatt at ODF skal
392 brukes som dokumentutvekslingsformat i Staten.
</p>
394 <p>Hyggelig lesning, spesielt hvis det viser seg at de av vedtatt
395 kravlisten for hva som skal aksepteres som referert i kommentarfeltet
397 <a href=
"http://www.version2.dk/artikel/13693-er-ooxml-doemt-ude-her-er-kravene-til-en-offentlig-dokumentstandard">en
398 annen artikkel
</a> i samme nett-avis. Liker spesielt godt denne:
</p>
400 <p><blockquote> Det skal demonstreres, at standarden i sin helhed kan
401 implementeres af alle direkte i sin helhed på flere
402 platforme.
</blockquote></p>
404 <p>Noe slikt burde være et krav også i Norge.
</p>
410 Tags:
<a href=
"tags/norsk">norsk
</a>,
<a href=
"tags/nuug">nuug
</a>,
<a href=
"tags/standard">standard
</a>.
414 <div class=
"padding"></div>
417 <div class=
"title"><a href=
"Automatic_Munin_and_Nagios_configuration.html">Automatic Munin and Nagios configuration
</a></div>
418 <div class=
"date">2010-
01-
27 15:
15</div>
420 <p>One of the new features in the next Debian/Lenny based release of
421 Debian Edu/Skolelinux, which is scheduled for release in the next few
422 days, is automatic configuration of the service monitoring system
423 Nagios. The previous release had automatic configuration of trend
424 analysis using Munin, and this Lenny based release take that a step
427 <p>When installing a Debian Edu Main-server, it is automatically
428 configured as a Munin and Nagios server. In addition, it is
429 configured to be a server for the
430 <a href=
"http://wiki.debian.org/DebianEdu/HowTo/SiteSummary">SiteSummary
431 system
</a> I have written for use in Debian Edu. The SiteSummary
432 system is inspired by a system used by the University of Oslo where I
433 work. In short, the system provide a centralised collector of
434 information about the computers on the network, and a client on each
435 computer submitting information to this collector. This allow for
436 automatic information on which packages are installed on each machine,
437 which kernel the machines are using, what kind of configuration the
438 packages got etc. This also allow us to automatically generate Munin
439 and Nagios configuration.
</p>
441 <p>All computers reporting to the sitesummary collector with the
442 munin-node package installed is automatically enabled as a Munin
443 client and graphs from the statistics collected from that machine show
444 up automatically on http://www/munin/ on the Main-server.
</p>
446 <p>All non-laptop computers reporting to the sitesummary collector are
447 automatically monitored for network presence (ping and any network
448 services detected). In addition, all computers (also laptops) with
449 the nagios-nrpe-server package installed and configured the way
450 sitesummary would configure it, are monitored for full disks, software
451 raid status, swap free and other checks that need to run locally on
454 <p>The result is that the administrator on a school using Debian Edu
455 based on Lenny will be able to check the health of his installation
456 with one look at the Nagios settings, without having to spend any time
457 keeping the Nagios configuration up-to-date.
</p>
459 <p>The only configuration one need to do to get Nagios up and running
460 is to set the password used to get access via HTTP. The system
461 administrator need to run "
<tt>htpasswd /etc/nagios3/htpasswd.users
462 nagiosadmin
</tt>" to create a nagiosadmin user and set a password for
463 it to be able to log into the Nagios web pages. After that,
464 everything is taken care of.</p>
470 Tags: <a href="tags/debian edu
">debian edu</a>, <a href="tags/english
">english</a>, <a href="tags/nuug
">nuug</a>.
474 <div class="padding
"></div>
476 <p style="text-align: right;
"><a href="index.rss
"><img src="xml.gif
" alt="RSS feed
" width="36" height="14"></a></p>
490 <li><a href="archive/
2010/
01/
">January (2)</a></li>
492 <li><a href="archive/
2010/
02/
">February (1)</a></li>
494 <li><a href="archive/
2010/
03/
">March (3)</a></li>
496 <li><a href="archive/
2010/
04/
">April (3)</a></li>
498 <li><a href="archive/
2010/
05/
">May (1)</a></li>
505 <li><a href="archive/
2009/
01/
">January (8)</a></li>
507 <li><a href="archive/
2009/
02/
">February (8)</a></li>
509 <li><a href="archive/
2009/
03/
">March (12)</a></li>
511 <li><a href="archive/
2009/
04/
">April (10)</a></li>
513 <li><a href="archive/
2009/
05/
">May (9)</a></li>
515 <li><a href="archive/
2009/
06/
">June (3)</a></li>
517 <li><a href="archive/
2009/
07/
">July (4)</a></li>
519 <li><a href="archive/
2009/
08/
">August (3)</a></li>
521 <li><a href="archive/
2009/
09/
">September (1)</a></li>
523 <li><a href="archive/
2009/
10/
">October (2)</a></li>
525 <li><a href="archive/
2009/
11/
">November (3)</a></li>
527 <li><a href="archive/
2009/
12/
">December (3)</a></li>
534 <li><a href="archive/
2008/
11/
">November (5)</a></li>
536 <li><a href="archive/
2008/
12/
">December (7)</a></li>
547 <li><a href="tags/
3d-printer
">3d-printer (11)</a></li>
549 <li><a href="tags/amiga
">amiga (1)</a></li>
551 <li><a href="tags/aros
">aros (1)</a></li>
553 <li><a href="tags/debian
">debian (14)</a></li>
555 <li><a href="tags/debian edu
">debian edu (15)</a></li>
557 <li><a href="tags/english
">english (24)</a></li>
559 <li><a href="tags/fiksgatami
">fiksgatami (1)</a></li>
561 <li><a href="tags/fildeling
">fildeling (6)</a></li>
563 <li><a href="tags/kart
">kart (2)</a></li>
565 <li><a href="tags/lenker
">lenker (1)</a></li>
567 <li><a href="tags/ltsp
">ltsp (1)</a></li>
569 <li><a href="tags/multimedia
">multimedia (5)</a></li>
571 <li><a href="tags/norsk
">norsk (64)</a></li>
573 <li><a href="tags/nuug
">nuug (71)</a></li>
575 <li><a href="tags/opphavsrett
">opphavsrett (12)</a></li>
577 <li><a href="tags/personvern
">personvern (11)</a></li>
579 <li><a href="tags/reprap
">reprap (10)</a></li>
581 <li><a href="tags/rss
">rss (1)</a></li>
583 <li><a href="tags/sikkerhet
">sikkerhet (7)</a></li>
585 <li><a href="tags/standard
">standard (11)</a></li>
587 <li><a href="tags/stavekontroll
">stavekontroll (1)</a></li>
589 <li><a href="tags/video
">video (10)</a></li>
591 <li><a href="tags/vitenskap
">vitenskap (1)</a></li>
593 <li><a href="tags/web
">web (6)</a></li>
599 <p style="text-align: right
">
600 Created by <a href="http://steve.org.uk/Software/chronicle
">Chronicle v3.7</a>