blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/KDM_fail_at_boot_with_NVidia_cards___and_no_one_try_to_fix_it_.html">KDM fail at boot with NVidia cards - and no one try to fix it?</a></div>
  24   <div class="date">2010-06-01 17:05</div>
  25   <div class="body">
  26 <p>It is strange to watch how a bug in Debian causing KDM to fail to
  27 start at boot when an NVidia video card is used.  The problem seem to
  28 be that the nvidia X.org driver uses a long time to initialize, and
  29 this duration is longer than kdm is configured to wait.</p>
  30
  31 <p>I came across two bugs related to this issue,
  32 <a href="http://bugs.debian.org/583312">#583312</a> initially filed
  33 against initscripts and passed on to nvidia-glx when it became obvious
  34 that the nvidia drivers were involved, and
  35 <a href="http://bugs.debian.org/524751">#524751</a> initially filed against
  36 kdm and passed on to src:nvidia-graphics-drivers for unknown reasons.</p>
  37
  38 <p>To me, it seem that no-one is interested in actually solving the
  39 problem nvidia video card owners experience and make sure the Debian
  40 distribution work out of the box for these users.  The nvidia driver
  41 maintainers expect kdm to be set up to wait longer, while kdm expect
  42 the nvidia driver maintainers to fix the driver start faster, and
  43 while they wait for each other I guess the users end up switching to a
  44 distribution that work for them.  I have no idea what the solution is,
  45 but I am pretty sure that waiting for each other is not it.</p>
  46
  47 <p>I wonder why we end up handling bugs this way.</p>
  48 </div>
  49   <div class="tags">
  50
  51
  52
  53    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
  54
  55   </div>
  56  </div>
  57  <div class="padding"></div>
  58
  59  <div class="entry">
  60   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_seem_to_hold_up_well_in_Debian_testing.html">Parallellized boot seem to hold up well in Debian/testing</a></div>
  61   <div class="date">2010-05-27 23:55</div>
  62   <div class="body">
  63 <p>A few days ago, parallel booting was enabled in Debian/testing.
  64 The feature seem to hold up pretty well, but three fairly serious
  65 issues are known and should be solved:
  66
  67 <p><ul>
  68
  69 <li>The wicd package seen to
  70 <a href="http://bugs.debian.org/508289">break NFS mounting</a> and
  71 <a href="http://bugs.debian.org/581586">network setup</a> when
  72 parallel booting is enabled.  No idea why, but the wicd maintainer
  73 seem to be on the case.</li>
  74
  75 <li>The nvidia X driver seem to
  76 <a href="http://bugs.debian.org/583312">have a race condition</a>
  77 triggered more easily when parallel booting is in effect.  The
  78 maintainer is on the case.</li>
  79
  80 <li>The sysv-rc package fail to properly enable dependency based boot
  81 sequencing (the shutdown is broken) when old file-rc users
  82 <a href="http://bugs.debian.org/575080">try to switch back</a> to
  83 sysv-rc.  One way to solve it would be for file-rc to create
  84 /etc/init.d/.legacy-bootordering, and another is to try to make
  85 sysv-rc more robust.  Will investigate some more and probably upload a
  86 workaround in sysv-rc to help those trying to move from file-rc to
  87 sysv-rc get a working shutdown.</li>
  88
  89 </ul></p>
  90
  91 <p>All in all not many surprising issues, and all of them seem
  92 solvable before Squeeze is released.  In addition to these there are
  93 some packages with bugs in their dependencies and run level settings,
  94 which I expect will be fixed in a reasonable time span.</p>
  95
  96 <p>If you report any problems with dependencies in init.d scripts to
  97 the BTS, please usertag the report to get it to show up at
  98 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
  99 list of usertagged bugs related to this</a>.</p>
 100
 101 <p>Update: Correct bug number to file-rc issue.</p>
 102 </div>
 103   <div class="tags">
 104
 105
 106
 107    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 108
 109   </div>
 110  </div>
 111  <div class="padding"></div>
 112
 113  <div class="entry">
 114   <div class="title"><a href="http://people.skolelinux.org/pere/blog/More_flexible_firmware_handling_in_debian_installer.html">More flexible firmware handling in debian-installer</a></div>
 115   <div class="date">2010-05-22 21:30</div>
 116   <div class="body">
 117 <p>After a long break from debian-installer development, I finally
 118 found time today to return to the project.  Having to spend less time
 119 working dependency based boot in debian, as it is almost complete now,
 120 definitely helped freeing some time.</p>
 121
 122 <p>A while back, I ran into a problem while working on Debian Edu.  We
 123 include some firmware packages on the Debian Edu CDs, those needed to
 124 get disk and network controllers working.  Without having these
 125 firmware packages available during installation, it is impossible to
 126 install Debian Edu on the given machine, and because our target group
 127 are non-technical people, asking them to provide firmware packages on
 128 an external medium is a support pain.  Initially, I expected it to be
 129 enough to include the firmware packages on the CD to get
 130 debian-installer to find and use them.  This proved to be wrong.
 131 Next, I hoped it was enough to symlink the relevant firmware packages
 132 to some useful location on the CD (tried /cdrom/ and
 133 /cdrom/firmware/).  This also proved to not work, and at this point I
 134 found time to look at the debian-installer code to figure out what was
 135 going to work.</p>
 136
 137 <p>The firmware loading code is in the hw-detect package, and a closer
 138 look revealed that it would only look for firmware packages outside
 139 the installation media, so the CD was never checked for firmware
 140 packages.  It would only check USB sticks, floppies and other
 141 "external" media devices.  Today I changed it to also look in the
 142 /cdrom/firmware/ directory on the mounted CD or DVD, which should
 143 solve the problem I ran into with Debian edu.  I also changed it to
 144 look in /firmware/, to make sure the installer also find firmware
 145 provided in the initrd when booting the installer via PXE, to allow us
 146 to provide the same feature in the PXE setup included in Debian
 147 Edu.</p>
 148
 149 <p>To make sure firmware deb packages with a license questions are not
 150 activated without asking if the license is accepted, I extended
 151 hw-detect to look for preinst scripts in the firmware packages, and
 152 run these before activating the firmware during installation.  The
 153 license question is asked using debconf in the preinst, so this should
 154 solve the issue for the firmware packages I have looked at so far.</p>
 155
 156 <p>If you want to discuss the details of these features, please
 157 contact us on debian-boot@lists.debian.org.</p>
 158 </div>
 159   <div class="tags">
 160
 161
 162
 163    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 164
 165   </div>
 166  </div>
 167  <div class="padding"></div>
 168
 169  <div class="entry">
 170   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html">Magnetstripeinnhold i billetter fra Flytoget og Hurtigruten</a></div>
 171   <div class="date">2010-05-21 16:00</div>
 172   <div class="body">
 173 <p>For en stund tilbake kjøpte jeg en magnetkortleser for å kunne
 174 titte på hva som er skrevet inn på magnetstripene til ulike kort.  Har
 175 ikke hatt tid til å analysere mange kort så langt, men tenkte jeg
 176 skulle dele innholdet på to kort med mine lesere.</p>
 177
 178 <p>For noen dager siden tok jeg flyet til Harstad og Hurtigruten til
 179 Bergen.  Flytoget fra Oslo S til flyplassen ga meg en billett med
 180 magnetstripe.  Påtrykket finner jeg følgende informasjon:</p>
 181
 182 <pre>
 183 Flytoget Airport Express Train
 184
 185 Fra - Til        : Oslo Sentralstasjon
 186 Kategori         : Voksen
 187 Pris             : Nok 170,00
 188 Herav mva. 8,00% : NOK 12,59
 189 Betaling         : Kontant
 190 Til - Fra        : Oslo Lufthavn
 191 Utstedt:         : 08.05.10
 192 Gyldig Fra-Til   : 08.05.10-07.11.10
 193 Billetttype      : Enkeltbillett
 194
 195 102-1015-100508-48382-01-08
 196 </pre>
 197
 198 <p>På selve magnetstripen er innholdet
 199 <tt>;E?+900120011=23250996541068112619257138248441708433322932704083389389062603279671261502492655?</tt>.
 200 Aner ikke hva innholdet representerer, og det er lite overlapp mellom
 201 det jeg ser trykket på billetten og det jeg ser av tegn i
 202 magnetstripen.  Håper det betyr at de bruker kryptografiske metoder
 203 for å gjøre det vanskelig å forfalske billetter.</p>
 204
 205 <p>Den andre billetten er fra Hurtigruten, der jeg mistenker at
 206 strekkoden på fronten er mer brukt enn magnetstripen (det var i hvert
 207 fall den biten vi stakk inn i dørlåsen).</p>
 208
 209 <p>Påtrykket forsiden er følgende:</p>
 210
 211 <pre>
 212 Romnummer 727
 213 Hurtigruten
 214 Midnatsol
 215 Reinholdtsen
 216 Petter
 217 Bookingno: SAX69   0742193
 218 Harstad-Bergen
 219 Dep: 09.05.2010 Arr: 12.05.2010
 220 Lugar fra Risøyhamn
 221 Kost: FRO=4
 222 </pre>
 223
 224 <p>På selve magnetstripen er innholdet
 225 <tt>;1316010007421930=00000000000000000000?+E?</tt>.  Heller ikke her
 226 ser jeg mye korrespondanse mellom påtrykk og magnetstripe.</p>
 227 </div>
 228   <div class="tags">
 229
 230
 231
 232    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 233
 234   </div>
 235  </div>
 236  <div class="padding"></div>
 237
 238  <div class="entry">
 239   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Pieces_of_the_roaming_laptop_puzzle_in_Debian.html">Pieces of the roaming laptop puzzle in Debian</a></div>
 240   <div class="date">2010-05-19 19:00</div>
 241   <div class="body">
 242 <p>Today, the last piece of the puzzle for roaming laptops in Debian
 243 Edu finally entered the Debian archive.  Today, the new
 244 <a href="http://packages.qa.debian.org/libp/libpam-mklocaluser.html">libpam-mklocaluser</a>
 245 package was accepted.  Two days ago, two other pieces was accepted
 246 into unstable.  The
 247 <a href="http://packages.qa.debian.org/p/pam-python.html">pam-python</a>
 248 package needed by libpam-mklocaluser, and the
 249 <a href="http://packages.qa.debian.org/s/sssd.html">sssd</a> package
 250 passed NEW on Monday.  In addition, the
 251 <a href="http://packages.qa.debian.org/libp/libpam-ccreds.html">libpam-ccreds</a>
 252 package we need is in experimental (version 10-4) since Saturday, and
 253 hopefully will be moved to unstable soon.</p>
 254
 255 <p>This collection of packages allow for two different setups for
 256 roaming laptops.  The traditional setup would be using libpam-ccreds,
 257 nscd and libpam-mklocaluser with LDAP or Kerberos authentication,
 258 which should work out of the box if the configuration changes proposed
 259 for nscd in <a href="http://bugs.debian.org/485282">BTS report
 260 #485282</a> is implemented.  The alternative setup is to use sssd with
 261 libpam-mklocaluser to connect to LDAP or Kerberos and let sssd take
 262 care of the caching of passwords and group information.</p>
 263
 264 <p>I have so far been unable to get sssd to work with the LDAP server
 265 at the University, but suspect the issue is some SSL/GnuTLS related
 266 problem with the server certificate.  I plan to update the Debian
 267 package to version 1.2, which is scheduled for next week, and hope to
 268 find time to make sure the next release will include both the
 269 Debian/Ubuntu specific patches.  Upstream is friendly and responsive,
 270 and I am sure we will find a good solution.</p>
 271
 272 <p>The idea is to set up the roaming laptops to authenticate using
 273 LDAP or Kerberos and create a local user with home directory in /home/
 274 when a usre in LDAP logs in via KDM or GDM for the first time, and
 275 cache the password for offline checking, as well as caching group
 276 memberhips and other relevant LDAP information.  The
 277 libpam-mklocaluser package was created to make sure the local home
 278 directory is in /home/, instead of /site/server/directory/ which would
 279 be the home directory if pam_mkhomedir was used.  To avoid confusion
 280 with support requests and configuration, we do not want local laptops
 281 to have users in a path that is used for the same users home directory
 282 on the home directory servers.</p>
 283
 284 <p>One annoying problem with gdm is that it do not show the PAM
 285 message passed to the user from libpam-mklocaluser when the local user
 286 is created.  Instead gdm simply reject the login with some generic
 287 message.  The message is shown in kdm, ssh and login, so I guess it is
 288 a bug in gdm.  Have not investigated if there is some other message
 289 type that can be used instead to get gdm to also show the message.</p>
 290
 291 <p>If you want to help out with implementing this for Debian Edu,
 292 please contact us on debian-edu@lists.debian.org.</p>
 293 </div>
 294   <div class="tags">
 295
 296
 297
 298    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 299
 300   </div>
 301  </div>
 302  <div class="padding"></div>
 303
 304  <div class="entry">
 305   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html">Parallellized boot is now the default in Debian/unstable</a></div>
 306   <div class="date">2010-05-14 22:40</div>
 307   <div class="body">
 308 <p>Since this evening, parallel booting is the default in
 309 Debian/unstable for machines using dependency based boot sequencing.
 310 Apparently the testing of concurrent booting has been wider than
 311 expected, if I am to believe the
 312 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 313 on debian-devel@</a>, and I concluded a few days ago to move forward
 314 with the feature this weekend, to give us some time to detect any
 315 remaining problems before Squeeze is frozen.  If serious problems are
 316 detected, it is simple to change the default back to sequential boot.
 317 The upload of the new sysvinit package also activate a new upstream
 318 version.</p>
 319
 320 More information about
 321 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 322 based boot sequencing</a> is available from the Debian wiki.  It is
 323 currently possible to disable parallel booting when one run into
 324 problems caused by it, by adding this line to /etc/default/rcS:</p>
 325
 326 <blockquote><pre>
 327 CONCURRENCY=none
 328 </pre></blockquote>
 329
 330 <p>If you report any problems with dependencies in init.d scripts to
 331 the BTS, please usertag the report to get it to show up at
 332 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 333 list of usertagged bugs related to this</a>.</p>
 334 </div>
 335   <div class="tags">
 336
 337
 338
 339    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 340
 341   </div>
 342  </div>
 343  <div class="padding"></div>
 344
 345  <div class="entry">
 346   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html">Sitesummary tip: Listing MAC address of all clients</a></div>
 347   <div class="date">2010-05-14 21:10</div>
 348   <div class="body">
 349 <p>In the recent Debian Edu versions, the
 350 <a href="http://wiki.debian.org/DebianEdu/HowTo/SiteSummary">sitesummary
 351 system</a> is used to keep track of the machines in the school
 352 network.  Each machine will automatically report its status to the
 353 central server after boot and once per night.  The network setup is
 354 also reported, and using this information it is possible to get the
 355 MAC address of all network interfaces in the machines.  This is useful
 356 to update the DHCP configuration.</p>
 357
 358 <p>To give some idea how to use sitesummary, here is a one-liner to
 359 ist all MAC addresses of all machines reporting to sitesummary.  Run
 360 this on the collector host:</p>
 361
 362 <blockquote><pre>
 363 perl -MSiteSummary -e 'for_all_hosts(sub { print join(" ", get_macaddresses(shift)), "\n"; });'
 364 </pre></blockquote>
 365
 366 <p>This will list all MAC addresses assosiated with all machine, one
 367 line per machine and with space between the MAC addresses.</p>
 368
 369 <p>To allow system administrators easier job at adding static DHCP
 370 addresses for hosts, it would be possible to extend this to fetch
 371 machine information from sitesummary and update the DHCP and DNS
 372 tables in LDAP using this information.  Such tool is unfortunately not
 373 written yet.</p>
 374 </div>
 375   <div class="tags">
 376
 377
 378
 379    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary</a>.
 380
 381   </div>
 382  </div>
 383  <div class="padding"></div>
 384
 385  <div class="entry">
 386   <div class="title"><a href="http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html">systemd, an interesting alternative to upstart</a></div>
 387   <div class="date">2010-05-13 22:20</div>
 388   <div class="body">
 389 <p>The last few days a new boot system called
 390 <a href="http://www.freedesktop.org/wiki/Software/systemd">systemd</a>
 391 has been
 392 <a href="http://0pointer.de/blog/projects/systemd.html">introduced</a>
 393
 394 to the free software world.  I have not yet had time to play around
 395 with it, but it seem to be a very interesting alternative to
 396 <a href="http://upstart.ubuntu.com/">upstart</a>, and might prove to be
 397 a good alternative for Debian when we are able to switch to an event
 398 based boot system.  Tollef is
 399 <a href="http://bugs.debian.org/580814">in the process</a> of getting
 400 systemd into Debian, and I look forward to seeing how well it work.  I
 401 like the fact that systemd handles init.d scripts with dependency
 402 information natively, allowing them to run in parallel where upstart
 403 at the moment do not.</p>
 404
 405 <p>Unfortunately do systemd have the same problem as upstart regarding
 406 platform support.  It only work on recent Linux kernels, and also need
 407 some new kernel features enabled to function properly.  This means
 408 kFreeBSD and Hurd ports of Debian will need a port or a different boot
 409 system.  Not sure how that will be handled if systemd proves to be the
 410 way forward.</p>
 411
 412 <p>In the mean time, based on the
 413 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 414 on debian-devel@</a> regarding parallel booting in Debian, I have
 415 decided to enable full parallel booting as the default in Debian as
 416 soon as possible (probably this weekend or early next week), to see if
 417 there are any remaining serious bugs in the init.d dependencies.  A
 418 new version of the sysvinit package implementing this change is
 419 already in experimental.  If all go well, Squeeze will be released
 420 with parallel booting enabled by default.</p>
 421 </div>
 422   <div class="tags">
 423
 424
 425
 426    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 427
 428   </div>
 429  </div>
 430  <div class="padding"></div>
 431
 432  <div class="entry">
 433   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html">Parallellizing the boot in Debian Squeeze - ready for wider testing</a></div>
 434   <div class="date">2010-05-06 23:25</div>
 435   <div class="body">
 436 <p>These days, the init.d script dependencies in Squeeze are quite
 437 complete, so complete that it is actually possible to run all the
 438 init.d scripts in parallell based on these dependencies.  If you want
 439 to test your Squeeze system, make sure
 440 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 441 based boot sequencing</a> is enabled, and add this line to
 442 /etc/default/rcS:</p>
 443
 444 <blockquote><pre>
 445 CONCURRENCY=makefile
 446 </pre></blockquote>
 447
 448 <p>That is it.  It will cause sysv-rc to use the startpar tool to run
 449 scripts in parallel using the dependency information stored in
 450 /etc/init.d/.depend.boot, /etc/init.d/.depend.start and
 451 /etc/init.d/.depend.stop to order the scripts.  Startpar is configured
 452 to try to start the kdm and gdm scripts as early as possible, and will
 453 start the facilities required by kdm or gdm as early as possible to
 454 make this happen.</p>
 455
 456 <p>Give it a try, and see if you like the result.  If some services
 457 fail to start properly, it is most likely because they have incomplete
 458 init.d script dependencies in their startup script (or some of their
 459 dependent scripts have incomplete dependencies).  Report bugs and get
 460 the package maintainers to fix it. :)</p>
 461
 462 <p>Running scripts in parallel could be the default in Debian when we
 463 manage to get the init.d script dependencies complete and correct.  I
 464 expect we will get there in Squeeze+1, if we get manage to test and
 465 fix the remaining issues.</p>
 466
 467 <p>If you report any problems with dependencies in init.d scripts to
 468 the BTS, please usertag the report to get it to show up at
 469 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 470 list of usertagged bugs related to this</a>.</p>
 471 </div>
 472   <div class="tags">
 473
 474
 475
 476    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 477
 478   </div>
 479  </div>
 480  <div class="padding"></div>
 481
 482  <div class="entry">
 483   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html">Forcing new users to change their password on first login</a></div>
 484   <div class="date">2010-05-02 13:47</div>
 485   <div class="body">
 486 <p>One interesting feature in Active Directory, is the ability to
 487 create a new user with an expired password, and thus force the user to
 488 change the password on the first login attempt.</p>
 489
 490 <p>I'm not quite sure how to do that with the LDAP setup in Debian
 491 Edu, but did some initial testing with a local account.  The account
 492 and password aging information is available in /etc/shadow, but
 493 unfortunately, it is not possible to specify an expiration time for
 494 passwords, only a maximum age for passwords.</p>
 495
 496 <p>A freshly created account (using adduser test) will have these
 497 settings in /etc/shadow:</p>
 498
 499 <blockquote><pre>
 500 root@tjener:~# chage -l test
 501 Last password change                                    : May 02, 2010
 502 Password expires                                        : never
 503 Password inactive                                       : never
 504 Account expires                                         : never
 505 Minimum number of days between password change          : 0
 506 Maximum number of days between password change          : 99999
 507 Number of days of warning before password expires       : 7
 508 root@tjener:~#
 509 </pre></blockquote>
 510
 511 <p>The only way I could come up with to create a user with an expired
 512 account, is to change the date of the last password change to the
 513 lowest value possible (January 1th 1970), and the maximum password age
 514 to the difference in days between that date and today.  To make it
 515 simple, I went for 30 years (30 * 365 = 10950) and January 2th (to
 516 avoid testing if 0 is a valid value).</p>
 517
 518 <p>After using these commands to set it up, it seem to work as
 519 intended:</p>
 520
 521 <blockquote><pre>
 522 root@tjener:~# chage -d 1 test; chage -M 10950 test
 523 root@tjener:~# chage -l test
 524 Last password change                                    : Jan 02, 1970
 525 Password expires                                        : never
 526 Password inactive                                       : never
 527 Account expires                                         : never
 528 Minimum number of days between password change          : 0
 529 Maximum number of days between password change          : 10950
 530 Number of days of warning before password expires       : 7
 531 root@tjener:~#
 532 </pre></blockquote>
 533
 534 <p>So far I have tested this with ssh and console, and kdm (in
 535 Squeeze) login, and all ask for a new password before login in the
 536 user (with ssh, I was thrown out and had to log in again).</p>
 537
 538 <p>Perhaps we should set up something similar for Debian Edu, to make
 539 sure only the user itself have the account password?</p>
 540
 541 <p>If you want to comment on or help out with implementing this for
 542 Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 543
 544 <p>Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the
 545 shadow(8) page in Debian/testing now state that setting the date of
 546 last password change to zero (0) will force the password to be changed
 547 on the first login.  This was not mentioned in the manual in Lenny, so
 548 I did not notice this in my initial testing.  I have tested it on
 549 Squeeze, and '<tt>chage -d 0 username</tt>' do work there.  I have not
 550 tested it on Lenny yet.</p>
 551
 552 <p>Update 2010-05-02-19:05: Jim Paris tells me via email that an
 553 equivalent command to expire a password is '<tt>passwd -e
 554 username</tt>', which insert zero into the date of the last password
 555 change.</p>
 556 </div>
 557   <div class="tags">
 558
 559
 560
 561    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 562
 563   </div>
 564  </div>
 565  <div class="padding"></div>
 566
 567  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
 568
 569 <div id="sidebar">
 570
 571
 572
 573
 574
 575 <h2>Archive</h2>
 576 <ul>
 577
 578 <li>2010
 579 <ul>
 580
 581 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 582
 583 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 584
 585 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 586
 587 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 588
 589 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 590
 591 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (1)</a></li>
 592
 593 </ul></li>
 594
 595 <li>2009
 596 <ul>
 597
 598 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 599
 600 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 601
 602 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 603
 604 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 605
 606 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 607
 608 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 609
 610 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 611
 612 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 613
 614 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 615
 616 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 617
 618 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 619
 620 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 621
 622 </ul></li>
 623
 624 <li>2008
 625 <ul>
 626
 627 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 628
 629 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 630
 631 </ul></li>
 632
 633 </ul>
 634
 635
 636
 637 <h2>Tags</h2>
 638 <ul>
 639
 640  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 641
 642  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 643
 644  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 645
 646  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (21)</a></li>
 647
 648  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (21)</a></li>
 649
 650  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (32)</a></li>
 651
 652  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 653
 654  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (6)</a></li>
 655
 656  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
 657
 658  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
 659
 660  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 661
 662  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 663
 664  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (65)</a></li>
 665
 666  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (74)</a></li>
 667
 668  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (12)</a></li>
 669
 670  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (11)</a></li>
 671
 672  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 673
 674  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 675
 676  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (8)</a></li>
 677
 678  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (1)</a></li>
 679
 680  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (11)</a></li>
 681
 682  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 683
 684  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 685
 686  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 687
 688  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
 689
 690 </ul>
 691
 692 </div>
 693
 694 <p style="text-align: right">
 695 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
 696 </p>
 697 </body>
 698 </html>