blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Pieces_of_the_roaming_laptop_puzzle_in_Debian.html">Pieces of the roaming laptop puzzle in Debian</a></div>
  24   <div class="date">2010-05-19 19:00</div>
  25   <div class="body">
  26 <p>Today, the last piece of the puzzle for roaming laptops in Debian
  27 Edu finally entered the Debian archive.  Today, the new
  28 <a href="http://packages.qa.debian.org/libp/libpam-mklocaluser.html">libpam-mklocaluser</a>
  29 package was accepted.  Two days ago, two other pieces was accepted
  30 into unstable.  The
  31 <a href="http://packages.qa.debian.org/p/pam-python.html">pam-python</a>
  32 package needed by libpam-mklocaluser, and the
  33 <a href="http://packages.qa.debian.org/s/sssd.html">sssd</a> package
  34 passed NEW on Monday.  In addition, the
  35 <a href="http://packages.qa.debian.org/libp/libpam-ccreds.html">libpam-ccreds</a>
  36 package we need is in experimental (version 10-4) since Saturday, and
  37 hopefully will be moved to unstable soon.</p>
  38
  39 <p>This collection of packages allow for two different setups for
  40 roaming laptops.  The traditional setup would be using libpam-ccreds,
  41 nscd and libpam-mklocaluser with LDAP or Kerberos authentication,
  42 which should work out of the box if the configuration changes proposed
  43 for nscd in <a href="http://bugs.debian.org/485282">BTS report
  44 #485282</a> is implemented.  The alternative setup is to use sssd with
  45 libpam-mklocaluser to connect to LDAP or Kerberos and let sssd take
  46 care of the caching of passwords and group information.</p>
  47
  48 <p>I have so far been unable to get sssd to work with the LDAP server
  49 at the University, but suspect the issue is some SSL/GnuTLS related
  50 problem with the server certificate.  I plan to update the Debian
  51 package to version 1.2, which is scheduled for next week, and hope to
  52 find time to make sure the next release will include both the
  53 Debian/Ubuntu specific patches.  Upstream is friendly and responsive,
  54 and I am sure we will find a good solution.</p>
  55
  56 <p>The idea is to set up the roaming laptops to authenticate using
  57 LDAP or Kerberos and create a local user with home directory in /home/
  58 when a usre in LDAP logs in via KDM or GDM for the first time, and
  59 cache the password for offline checking, as well as caching group
  60 memberhips and other relevant LDAP information.  The
  61 libpam-mklocaluser package was created to make sure the local home
  62 directory is in /home/, instead of /site/server/directory/ which would
  63 be the home directory if pam_mkhomedir was used.  To avoid confusion
  64 with support requests and configuration, we do not want local laptops
  65 to have users in a path that is used for the same users home directory
  66 on the home directory servers.</p>
  67
  68 <p>One annoying problem with gdm is that it do not show the PAM
  69 message passed to the user from libpam-mklocaluser when the local user
  70 is created.  Instead gdm simply reject the login with some generic
  71 message.  The message is shown in kdm, ssh and login, so I guess it is
  72 a bug in gdm.  Have not investigated if there is some other message
  73 type that can be used instead to get gdm to also show the message.</p>
  74
  75 <p>If you want to help out with implementing this for Debian Edu,
  76 please contact us on debian-edu@lists.debian.org.</p>
  77 </div>
  78   <div class="tags">
  79
  80
  81
  82    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
  83
  84   </div>
  85  </div>
  86  <div class="padding"></div>
  87
  88  <div class="entry">
  89   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html">Parallellized boot is now the default in Debian/unstable</a></div>
  90   <div class="date">2010-05-14 22:40</div>
  91   <div class="body">
  92 <p>Since this evening, parallel booting is the default in
  93 Debian/unstable for machines using dependency based boot sequencing.
  94 Apparently the testing of concurrent booting has been wider than
  95 expected, if I am to believe the
  96 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
  97 on debian-devel@</a>, and I concluded a few days ago to move forward
  98 with the feature this weekend, to give us some time to detect any
  99 remaining problems before Squeeze is frozen.  If serious problems are
 100 detected, it is simple to change the default back to sequential boot.
 101 The upload of the new sysvinit package also activate a new upstream
 102 version.</p>
 103
 104 More information about
 105 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 106 based boot sequencing</a> is available from the Debian wiki.  It is
 107 currently possible to disable parallel booting when one run into
 108 problems caused by it, by adding this line to /etc/default/rcS:</p>
 109
 110 <blockquote><pre>
 111 CONCURRENCY=none
 112 </pre></blockquote>
 113
 114 <p>If you report any problems with dependencies in init.d scripts to
 115 the BTS, please usertag the report to get it to show up at
 116 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 117 list of usertagged bugs related to this</a>.</p>
 118 </div>
 119   <div class="tags">
 120
 121
 122
 123    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 124
 125   </div>
 126  </div>
 127  <div class="padding"></div>
 128
 129  <div class="entry">
 130   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html">Sitesummary tip: Listing MAC address of all clients</a></div>
 131   <div class="date">2010-05-14 21:10</div>
 132   <div class="body">
 133 <p>In the recent Debian Edu versions, the
 134 <a href="http://wiki.debian.org/DebianEdu/HowTo/SiteSummary">sitesummary
 135 system</a> is used to keep track of the machines in the school
 136 network.  Each machine will automatically report its status to the
 137 central server after boot and once per night.  The network setup is
 138 also reported, and using this information it is possible to get the
 139 MAC address of all network interfaces in the machines.  This is useful
 140 to update the DHCP configuration.</p>
 141
 142 <p>To give some idea how to use sitesummary, here is a one-liner to
 143 ist all MAC addresses of all machines reporting to sitesummary.  Run
 144 this on the collector host:</p>
 145
 146 <blockquote><pre>
 147 perl -MSiteSummary -e 'for_all_hosts(sub { print join(" ", get_macaddresses(shift)), "\n"; });'
 148 </pre></blockquote>
 149
 150 <p>This will list all MAC addresses assosiated with all machine, one
 151 line per machine and with space between the MAC addresses.</p>
 152
 153 <p>To allow system administrators easier job at adding static DHCP
 154 addresses for hosts, it would be possible to extend this to fetch
 155 machine information from sitesummary and update the DHCP and DNS
 156 tables in LDAP using this information.  Such tool is unfortunately not
 157 written yet.</p>
 158 </div>
 159   <div class="tags">
 160
 161
 162
 163    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary</a>.
 164
 165   </div>
 166  </div>
 167  <div class="padding"></div>
 168
 169  <div class="entry">
 170   <div class="title"><a href="http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html">systemd, an interesting alternative to upstart</a></div>
 171   <div class="date">2010-05-13 22:20</div>
 172   <div class="body">
 173 <p>The last few days a new boot system called
 174 <a href="http://www.freedesktop.org/wiki/Software/systemd">systemd</a>
 175 has been
 176 <a href="http://0pointer.de/blog/projects/systemd.html">introduced</a>
 177
 178 to the free software world.  I have not yet had time to play around
 179 with it, but it seem to be a very interesting alternative to
 180 <a href="http://upstart.ubuntu.com/">upstart</a>, and might prove to be
 181 a good alternative for Debian when we are able to switch to an event
 182 based boot system.  Tollef is
 183 <a href="http://bugs.debian.org/580814">in the process</a> of getting
 184 systemd into Debian, and I look forward to seeing how well it work.  I
 185 like the fact that systemd handles init.d scripts with dependency
 186 information natively, allowing them to run in parallel where upstart
 187 at the moment do not.</p>
 188
 189 <p>Unfortunately do systemd have the same problem as upstart regarding
 190 platform support.  It only work on recent Linux kernels, and also need
 191 some new kernel features enabled to function properly.  This means
 192 kFreeBSD and Hurd ports of Debian will need a port or a different boot
 193 system.  Not sure how that will be handled if systemd proves to be the
 194 way forward.</p>
 195
 196 <p>In the mean time, based on the
 197 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 198 on debian-devel@</a> regarding parallel booting in Debian, I have
 199 decided to enable full parallel booting as the default in Debian as
 200 soon as possible (probably this weekend or early next week), to see if
 201 there are any remaining serious bugs in the init.d dependencies.  A
 202 new version of the sysvinit package implementing this change is
 203 already in experimental.  If all go well, Squeeze will be released
 204 with parallel booting enabled by default.</p>
 205 </div>
 206   <div class="tags">
 207
 208
 209
 210    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 211
 212   </div>
 213  </div>
 214  <div class="padding"></div>
 215
 216  <div class="entry">
 217   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html">Parallellizing the boot in Debian Squeeze - ready for wider testing</a></div>
 218   <div class="date">2010-05-06 23:25</div>
 219   <div class="body">
 220 <p>These days, the init.d script dependencies in Squeeze are quite
 221 complete, so complete that it is actually possible to run all the
 222 init.d scripts in parallell based on these dependencies.  If you want
 223 to test your Squeeze system, make sure
 224 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 225 based boot sequencing</a> is enabled, and add this line to
 226 /etc/default/rcS:</p>
 227
 228 <blockquote><pre>
 229 CONCURRENCY=makefile
 230 </pre></blockquote>
 231
 232 <p>That is it.  It will cause sysv-rc to use the startpar tool to run
 233 scripts in parallel using the dependency information stored in
 234 /etc/init.d/.depend.boot, /etc/init.d/.depend.start and
 235 /etc/init.d/.depend.stop to order the scripts.  Startpar is configured
 236 to try to start the kdm and gdm scripts as early as possible, and will
 237 start the facilities required by kdm or gdm as early as possible to
 238 make this happen.</p>
 239
 240 <p>Give it a try, and see if you like the result.  If some services
 241 fail to start properly, it is most likely because they have incomplete
 242 init.d script dependencies in their startup script (or some of their
 243 dependent scripts have incomplete dependencies).  Report bugs and get
 244 the package maintainers to fix it. :)</p>
 245
 246 <p>Running scripts in parallel could be the default in Debian when we
 247 manage to get the init.d script dependencies complete and correct.  I
 248 expect we will get there in Squeeze+1, if we get manage to test and
 249 fix the remaining issues.</p>
 250
 251 <p>If you report any problems with dependencies in init.d scripts to
 252 the BTS, please usertag the report to get it to show up at
 253 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 254 list of usertagged bugs related to this</a>.</p>
 255 </div>
 256   <div class="tags">
 257
 258
 259
 260    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 261
 262   </div>
 263  </div>
 264  <div class="padding"></div>
 265
 266  <div class="entry">
 267   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html">Forcing new users to change their password on first login</a></div>
 268   <div class="date">2010-05-02 13:47</div>
 269   <div class="body">
 270 <p>One interesting feature in Active Directory, is the ability to
 271 create a new user with an expired password, and thus force the user to
 272 change the password on the first login attempt.</p>
 273
 274 <p>I'm not quite sure how to do that with the LDAP setup in Debian
 275 Edu, but did some initial testing with a local account.  The account
 276 and password aging information is available in /etc/shadow, but
 277 unfortunately, it is not possible to specify an expiration time for
 278 passwords, only a maximum age for passwords.</p>
 279
 280 <p>A freshly created account (using adduser test) will have these
 281 settings in /etc/shadow:</p>
 282
 283 <blockquote><pre>
 284 root@tjener:~# chage -l test
 285 Last password change                                    : May 02, 2010
 286 Password expires                                        : never
 287 Password inactive                                       : never
 288 Account expires                                         : never
 289 Minimum number of days between password change          : 0
 290 Maximum number of days between password change          : 99999
 291 Number of days of warning before password expires       : 7
 292 root@tjener:~#
 293 </pre></blockquote>
 294
 295 <p>The only way I could come up with to create a user with an expired
 296 account, is to change the date of the last password change to the
 297 lowest value possible (January 1th 1970), and the maximum password age
 298 to the difference in days between that date and today.  To make it
 299 simple, I went for 30 years (30 * 365 = 10950) and January 2th (to
 300 avoid testing if 0 is a valid value).</p>
 301
 302 <p>After using these commands to set it up, it seem to work as
 303 intended:</p>
 304
 305 <blockquote><pre>
 306 root@tjener:~# chage -d 1 test; chage -M 10950 test
 307 root@tjener:~# chage -l test
 308 Last password change                                    : Jan 02, 1970
 309 Password expires                                        : never
 310 Password inactive                                       : never
 311 Account expires                                         : never
 312 Minimum number of days between password change          : 0
 313 Maximum number of days between password change          : 10950
 314 Number of days of warning before password expires       : 7
 315 root@tjener:~#
 316 </pre></blockquote>
 317
 318 <p>So far I have tested this with ssh and console, and kdm (in
 319 Squeeze) login, and all ask for a new password before login in the
 320 user (with ssh, I was thrown out and had to log in again).</p>
 321
 322 <p>Perhaps we should set up something similar for Debian Edu, to make
 323 sure only the user itself have the account password?</p>
 324
 325 <p>If you want to comment on or help out with implementing this for
 326 Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 327
 328 <p>Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the
 329 shadow(8) page in Debian/testing now state that setting the date of
 330 last password change to zero (0) will force the password to be changed
 331 on the first login.  This was not mentioned in the manual in Lenny, so
 332 I did not notice this in my initial testing.  I have tested it on
 333 Squeeze, and '<tt>chage -d 0 username</tt>' do work there.  I have not
 334 tested it on Lenny yet.</p>
 335
 336 <p>Update 2010-05-02-19:05: Jim Paris tells me via email that an
 337 equivalent command to expire a password is '<tt>passwd -e
 338 username</tt>', which insert zero into the date of the last password
 339 change.</p>
 340 </div>
 341   <div class="tags">
 342
 343
 344
 345    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 346
 347   </div>
 348  </div>
 349  <div class="padding"></div>
 350
 351  <div class="entry">
 352   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html">Thoughts on roaming laptop setup for Debian Edu</a></div>
 353   <div class="date">2010-04-28 20:40</div>
 354   <div class="body">
 355 <p>For some years now, I have wondered how we should handle laptops in
 356 Debian Edu.  The Debian Edu infrastructure is mostly designed to
 357 handle stationary computers, and less suited for computers that come
 358 and go.</p>
 359
 360 <p>Now I finally believe I have an sensible idea on how to adjust
 361 Debian Edu for laptops, by introducing a new profile for them, for
 362 example called Roaming Workstations.  Here are my thought on this.
 363 The setup would consist of the following:</p>
 364
 365 <ul>
 366
 367  <li>During installation, the user name of the owner / primary user of
 368    the laptop is requested and a local home directory is set up for
 369    the user, with uid and gid information fetched from the LDAP
 370    server.  This allow the user to work also when offline.  The
 371    central home directory can be available in a subdirectory on
 372    request, for example mounted via CIFS.  It could be mounted
 373    automatically when a user log in while on the Debian Edu network,
 374    and unmounted when the machine is taken away (network down,
 375    hibernate, etc), it can be set up to do automatic mounting on
 376    request (using autofs), or perhaps some GUI button on the desktop
 377    can be used to access it when needed.  Perhaps it is enough to use
 378    the fish protocol in KDE?</li>
 379
 380  <li>Password checking is set up to use LDAP or Kerberos
 381    authentication when the machine is on the Debian Edu network, and
 382    to cache the password for offline checking when the machine unable
 383    to reach the LDAP or Kerberos server.  This can be done using
 384    <a href="http://www.padl.com/OSS/pam_ccreds.html">libpam-ccreds</a>
 385    or the Fedora developed
 386    <a href="https://fedoraproject.org/wiki/Features/SSSD">System
 387    Security Services Daemon</a> packages.</li>
 388
 389  <li>File synchronisation with the central home directory is set up
 390    using a shared directory in both the local and the central home
 391    directory, using unison.</li>
 392
 393  <li>Printing should be set up to print to all printers broadcasting
 394    their existence on the local network, and should then work out of
 395    the box with CUPS.  For sites needing accurate printer quotas, some
 396    system with Kerberos authentication or printing via ssh could be
 397    implemented.</li>
 398
 399  <li>For users that should have local root access to their laptop,
 400    sudo should be used to allow this to the local user.</li>
 401
 402  <li>It would be nice if user and group information from LDAP is
 403    cached on the client, but given that there are entries for the
 404    local user and primary group in /etc/, it should not be needed.</li>
 405
 406 </ul>
 407
 408 <p>I believe all the pieces to implement this are in Debian/testing at
 409 the moment.  If we work quickly, we should be able to get this ready
 410 in time for the Squeeze release to freeze.  Some of the pieces need
 411 tweaking, like libpam-ccreds should get support for pam-auth-update
 412 (<a href="http://bugs.debian.org/566718">#566718</a>) and nslcd (or
 413 perhaps debian-edu-config) should get some integration code to stop
 414 its daemon when the LDAP server is unavailable to avoid long timeouts
 415 when disconnected from the net.  If we get Kerberos enabled, we need
 416 to make sure we avoid long timeouts there too.</p>
 417
 418 <p>If you want to help out with implementing this for Debian Edu,
 419 please contact us on debian-edu@lists.debian.org.</p>
 420 </div>
 421   <div class="tags">
 422
 423
 424
 425    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 426
 427   </div>
 428  </div>
 429  <div class="padding"></div>
 430
 431  <div class="entry">
 432   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html">Great book: "Content: Selected Essays on Technology, Creativity, Copyright, and the Future of the Future"</a></div>
 433   <div class="date">2010-04-19 17:10</div>
 434   <div class="body">
 435 <p>The last few weeks i have had the pleasure of reading a
 436 thought-provoking collection of essays by Cory Doctorow, on topics
 437 touching copyright, virtual worlds, the future of man when the
 438 conscience mind can be duplicated into a computer and many more. The
 439 book titled "Content: Selected Essays on Technology, Creativity,
 440 Copyright, and the Future of the Future" is available with few
 441 restrictions on the web, for example from
 442 <a href="http://craphound.com/content/">his own site</a>. I read the
 443 epub-version from
 444 <a href="http://www.feedbooks.com/book/2883">feedbooks</a> using
 445 <a href="http://www.fbreader.org/">fbreader</a> and my N810. I
 446 strongly recommend this book.</p>
 447 </div>
 448   <div class="tags">
 449
 450
 451
 452    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 453
 454   </div>
 455  </div>
 456  <div class="padding"></div>
 457
 458  <div class="entry">
 459   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Kerberos_for_Debian_Edu_Squeeze_.html">Kerberos for Debian Edu/Squeeze?</a></div>
 460   <div class="date">2010-04-14 17:20</div>
 461   <div class="body">
 462 <p><a href="http://www.nuug.no/aktiviteter/20100413-kerberos/">Yesterdays
 463 NUUG presentation</a> about Kerberos was inspiring, and reminded me
 464 about the need to start using Kerberos in Skolelinux.  Setting up a
 465 Kerberos server seem to be straight forward, and if we get this in
 466 place a long time before the Squeeze version of Debian freezes, we
 467 have a chance to migrate Skolelinux away from NFSv3 for the home
 468 directories, and over to an architecture where the infrastructure do
 469 not have to trust IP addresses and machines, and instead can trust
 470 users and cryptographic keys instead.</p>
 471
 472 <p>A challenge will be integration and administration.  Is there a
 473 Kerberos implementation for Debian where one can control the
 474 administration access in Kerberos using LDAP groups?  With it, the
 475 school administration will have to maintain access control using flat
 476 files on the main server, which give a huge potential for errors.</p>
 477
 478 <p>A related question I would like to know is how well Kerberos and
 479 pam-ccreds (offline password check) work together.  Anyone know?</p>
 480
 481 <p>Next step will be to use Kerberos for access control in Lwat and
 482 Nagios.  I have no idea how much work that will be to implement.  We
 483 would also need to document how to integrate with Windows AD, as such
 484 shared network will require two Kerberos realms that need to cooperate
 485 to work properly.</p>
 486
 487 <p>I believe a good start would be to start using Kerberos on the
 488 skolelinux.no machines, and this way get ourselves experience with
 489 configuration and integration.  A natural starting point would be
 490 setting up ldap.skolelinux.no as the Kerberos server, and migrate the
 491 rest of the machines from PAM via LDAP to PAM via Kerberos one at the
 492 time.</p>
 493
 494 <p>If you would like to contribute to get this working in Skolelinux,
 495 I recommend you to see the video recording from yesterdays NUUG
 496 presentation, and start using Kerberos at home.  The video show show
 497 up in a few days.</p>
 498 </div>
 499   <div class="tags">
 500
 501
 502
 503    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 504
 505   </div>
 506  </div>
 507  <div class="padding"></div>
 508
 509  <div class="entry">
 510   <div class="title"><a href="http://people.skolelinux.org/pere/blog/P___vegne_av_vanvitting_mange__Aftenposten_.html">På vegne av vanvitting mange, Aftenposten!</a></div>
 511   <div class="date">2010-03-06 21:15</div>
 512   <div class="body">
 513 <p><a href="http://fotball.aftenposten.no/incoming/article163000.ece">Aftenposten
 514 melder</a> på forsiden av webavisen sin at de tror Erling Fossen
 515 provoserer nordlendinger med sine uttalelser på
 516 fotballtinget.  Jeg er utflyttet nordlending, og må innrømme at jeg
 517 ikke kjennet så mye som et snev av provokasjon fra denne litt morsomme
 518 uttalelsen til Hr. Fossen.  Lurer på om Aftenposten har noen kilder
 519 utenom redaksjonen for sin påstand om at nordledinger er provosert av
 520 Hr. Fossen.  Må innrømme at jeg tviler på det.</p>
 521
 522 <p>Det hele bringer tankene tilbake til Sture Hansen i Hallo i Uken.</p>
 523 </div>
 524   <div class="tags">
 525
 526
 527
 528    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>.
 529
 530   </div>
 531  </div>
 532  <div class="padding"></div>
 533
 534  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
 535
 536 <div id="sidebar">
 537
 538
 539
 540
 541
 542 <h2>Archive</h2>
 543 <ul>
 544
 545 <li>2010
 546 <ul>
 547
 548 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 549
 550 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 551
 552 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 553
 554 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 555
 556 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (6)</a></li>
 557
 558 </ul></li>
 559
 560 <li>2009
 561 <ul>
 562
 563 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 564
 565 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 566
 567 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 568
 569 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 570
 571 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 572
 573 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 574
 575 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 576
 577 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 578
 579 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 580
 581 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 582
 583 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 584
 585 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 586
 587 </ul></li>
 588
 589 <li>2008
 590 <ul>
 591
 592 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 593
 594 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 595
 596 </ul></li>
 597
 598 </ul>
 599
 600
 601
 602 <h2>Tags</h2>
 603 <ul>
 604
 605  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 606
 607  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 608
 609  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 610
 611  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (18)</a></li>
 612
 613  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (18)</a></li>
 614
 615  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (29)</a></li>
 616
 617  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 618
 619  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (6)</a></li>
 620
 621  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
 622
 623  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
 624
 625  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 626
 627  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 628
 629  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (64)</a></li>
 630
 631  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (73)</a></li>
 632
 633  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (12)</a></li>
 634
 635  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (11)</a></li>
 636
 637  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 638
 639  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 640
 641  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (7)</a></li>
 642
 643  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (1)</a></li>
 644
 645  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (11)</a></li>
 646
 647  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 648
 649  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 650
 651  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 652
 653  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
 654
 655 </ul>
 656
 657 </div>
 658
 659 <p style="text-align: right">
 660 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
 661 </p>
 662 </body>
 663 </html>