blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html">Autodetecting Client setup for roaming workstations in Debian Edu</a></div>
  24   <div class="date">2010-08-07 14:45</div>
  25   <div class="body">
  26 <p>A few days ago, I
  27 <a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">tried
  28 to install</a> a Roaming workation profile from Debian Edu/Squeeze
  29 while on the university network here at the University of Oslo, and
  30 noticed how much had to change to get it operational using the
  31 university infrastructure.  It was fairly easy, but it occured to me
  32 that Debian Edu would improve a lot if I could get the client to
  33 connect without any changes at all, and thus let the client configure
  34 itself during installation and first boot to use the infrastructure
  35 around it.  Now I am a huge step further along that road.</p>
  36
  37 <p>With our current squeeze-test packages, I can select the roaming
  38 workstation profile and get a working laptop connecting to the
  39 university LDAP server for user and group and our active directory
  40 servers for Kerberos authentication.  All this without any
  41 configuration at all during installation.  My users home directory got
  42 a bookmark in the KDE menu to mount it via SMB, with the correct URL.
  43 In short, openldap and sssd is correctly configured.  In addition to
  44 this, the client look for http://wpad/wpad.dat to configure a web
  45 proxy, and when it fail to find it no proxy settings are stored in
  46 /etc/environment and /etc/apt/apt.conf.  Iceweasel and KDE is
  47 configured to look for the same wpad configuration and also do not use
  48 a proxy when at the university network.  If the machine is moved to a
  49 network with such wpad setup, it would automatically use it when DHCP
  50 gave it a IP address.</p>
  51
  52 <p>The LDAP server is located using DNS, by first looking for the DNS
  53 entry ldap.$domain.  If this do not exist, it look for the
  54 _ldap._tcp.$domain SRV records and use the first one as the LDAP
  55 server.  Next, it connects to the LDAP server and search all
  56 namingContexts entries for posixAccount or posixGroup objects, and
  57 pick the first one as the LDAP base.  For Kerberos, a similar
  58 algorithm is used to locate the LDAP server, and the realm is the
  59 uppercase version of $domain.</p>
  60
  61 <p>So, what is not working, you might ask.  SMB mounting my home
  62 directory do not work.  No idea why, but suspected the incorrect
  63 Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
  64 the cause.  These are not properly configured during installation, and
  65 had to be hand-edited to get the correct Kerberos realm and server,
  66 but SMB mounting still do not work. :(</p>
  67
  68 <p>With this automatic configuration in place, I expect a Debian Edu
  69 roaming profile installation would be able to automatically detect and
  70 connect to any site using LDAP and Kerberos for NSS directory and PAM
  71 authentication.  It should also work out of the box in a Active
  72 Directory environment providing posixAccount and posixGroup objects
  73 with UID and GID values.</p>
  74
  75 <p>If you want to help out with implementing these things for Debian
  76 Edu, please contact us on debian-edu@lists.debian.org.</p>
  77 </div>
  78   <div class="tags">
  79
  80
  81
  82    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
  83
  84   </div>
  85  </div>
  86  <div class="padding"></div>
  87
  88  <div class="entry">
  89   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">Debian Edu roaming workstation - at the university of Oslo</a></div>
  90   <div class="date">2010-08-03 23:30</div>
  91   <div class="body">
  92 <p>The new roaming workstation profile in Debian Edu/Squeeze is fairly
  93 similar to the laptop setup am I working on using Ubuntu for the
  94 University of Oslo, and just for the heck of it, I tested today how
  95 hard it would be to integrate that profile into the university
  96 infrastructure.  In this case, it is the university LDAP server,
  97 Active Directory Kerberos server and SMB mounting from the Netapp file
  98 servers.</p>
  99
 100 <p>I was pleasantly surprised that the only three files needed to be
 101 changed (/etc/sssd/sssd.conf, /etc/ldap.conf and
 102 /etc/mklocaluser.d/20-debian-edu-config) and one file had to be added
 103 (/usr/share/perl5/Debian/Edu_Local.pm), to get the client working.
 104 Most of the changes were to get the client to use the university LDAP
 105 for NSS and Kerberos server for PAM, but one was to change a hard
 106 coded DNS domain name in the mklocaluser hook from .intern to
 107 .uio.no.</p>
 108
 109 <p>This testing was so encouraging, that I went ahead and adjusted the
 110 Debian Edu scripts and setup in subversion to centralise the roaming
 111 workstation setup a bit more and avoid the hardcoded DNS domain name,
 112 so that when I test this tomorrow, I expect to get away with modifying
 113 only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the
 114 university servers.</p>
 115
 116 <p>My goal is to get the clients to have no hardcoded settings and
 117 fetch all their initial setup during installation and first boot, to
 118 allow them to be inserted also into environments where the default
 119 setup in Debian Edu has been changed or as with the university, where
 120 the environment is different but provides the protocols Debian Edu
 121 uses.</p>
 122 </div>
 123   <div class="tags">
 124
 125
 126
 127    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 128
 129   </div>
 130  </div>
 131  <div class="padding"></div>
 132
 133  <div class="entry">
 134   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html">Circular package dependencies harms apt recovery</a></div>
 135   <div class="date">2010-07-27 23:50</div>
 136   <div class="body">
 137 <p>I discovered this while doing
 138 <a href="http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html">automated
 139 testing of upgrades from Debian Lenny to Squeeze</a>.  A few packages
 140 in Debian still got circular dependencies, and it is often claimed
 141 that apt and aptitude should be able to handle this just fine, but
 142 some times these dependency loops causes apt to fail.</p>
 143
 144 <p>An example is from todays
 145 <a href="http://people.skolelinux.org/~pere/debian-upgrade-testing//test-20100727-lenny-squeeze-kde-aptitude.txt">upgrade
 146 of KDE using aptitude</a>.  In it, a bug in kdebase-workspace-data
 147 causes perl-modules to fail to upgrade.  The cause is simple.  If a
 148 package fail to unpack, then only part of packages with the circular
 149 dependency might end up being unpacked when unpacking aborts, and the
 150 ones already unpacked will fail to configure in the recovery phase
 151 because its dependencies are unavailable.</p>
 152
 153 <p>In this log, the problem manifest itself with this error:</p>
 154
 155 <blockquote><pre>
 156 dpkg: dependency problems prevent configuration of perl-modules:
 157  perl-modules depends on perl (>= 5.10.1-1); however:
 158   Version of perl on system is 5.10.0-19lenny2.
 159 dpkg: error processing perl-modules (--configure):
 160  dependency problems - leaving unconfigured
 161 </pre></blockquote>
 162
 163 <p>The perl/perl-modules circular dependency is already
 164 <a href="http://bugs.debian.org/527917">reported as a bug</a>, and will
 165 hopefully be solved as soon as possible, but it is not the only one,
 166 and each one of these loops in the dependency tree can cause similar
 167 failures.  Of course, they only occur when there are bugs in other
 168 packages causing the unpacking to fail, but it is rather nasty when
 169 the failure of one package causes the problem to become worse because
 170 of dependency loops.</p>
 171
 172 <p>Thanks to
 173 <a href="http://lists.debian.org/debian-devel/2010/06/msg00116.html">the
 174 tireless effort by Bill Allombert</a>, the number of circular
 175 dependencies
 176 <a href="http://debian.semistable.com/debgraph.out.html">left in Debian
 177 is dropping</a>, and perhaps it will reach zero one day. :)</p>
 178
 179 <p>Todays testing also exposed a bug in
 180 <a href="http://bugs.debian.org/590605">update-notifier</a> and
 181 <a href="http://bugs.debian.org/590604">different behaviour</a> between
 182 apt-get and aptitude, the latter possibly caused by some circular
 183 dependency.  Reported both to BTS to try to get someone to look at
 184 it.</p>
 185 </div>
 186   <div class="tags">
 187
 188
 189
 190    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 191
 192   </div>
 193  </div>
 194  <div class="padding"></div>
 195
 196  <div class="entry">
 197   <div class="title"><a href="http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html">First Debian Edu test release (alpha0) based on Squeeze is released</a></div>
 198   <div class="date">2010-07-27 17:45</div>
 199   <div class="body">
 200 <p>I just posted this announcement culminating several months of work
 201 with the next Debian Edu release.  Not nearly done, but one major step
 202 completed.</p>
 203
 204 <blockquote>
 205 <p>This is the first test release based on Squeeze. The focus of this
 206 release is to test the user application selection. To have a look,
 207 install the standalone profile and let the developers know if the set
 208 of installed packages i.e. applications should be modified. If some
 209 user application is missing, or if there are some applications that no
 210 longer make sense to be included in Debian Edu, please let us know.
 211 Also, if a useful application is missing the translation for your
 212 language of choice, please let us know too.</p>
 213
 214 <p>In addition, feedback and help to polish the desktop (menus,
 215 artwork, starters, etc.) is appreciated. We would like to ship a nice
 216 and handy KDE4 desktop targeted for schools out of the box.</p>
 217
 218 <p>The other profiles should be installable, but there is a lot more
 219 work left to be done before they are ready, so do not expect to
 220 much.</p>
 221
 222 <p>Changes compared to the lenny based version</p>
 223
 224 <ul>
 225 <li>Everything from Debian Squeeze
 226 <ul>
 227   <li>Desktop environment KDE 4.4 => the new KDE desktop in
 228          combination with some new artwork
 229   <li>Web browser Iceweasel 3.5
 230   <li>OpenOffice.org 3.2
 231   <li>Educational toolbox GCompris 9.3
 232   <li>Music creator Rosegarden 10.04.2
 233   <li>Image editor Gimp 2.6.10
 234   <li>Virtual universe Celestia 1.6.0
 235   <li>Virtual stargazer Stellarium 0.10.4
 236   <li>3D modeler Blender 2.49.2 (new application)
 237   <li>Video editor Kdenlive 0.7.7 (new application)
 238 </ul></li>
 239 <li>Now using Kerberos for password checking (migration not finished).
 240     Enabled for:
 241 <ul>
 242   <li>PAM
 243   <li>LDAP
 244   <li>IMAP
 245   <li>SMTP (sender verification)
 246 </ul>
 247 </li>
 248 <li>New experimental roaming workstation profile for laptops.</li>
 249 <li>Show welcome page to users when they first log in. The URL is
 250     fetched from LDAP.</li>
 251 <li>New LXDE desktop option, in addition to KDE (default) and Gnome.</li>
 252 <li>General cleanup (not finished)</li>
 253 </ul>
 254 <p>The following features are not working as they should</p>
 255
 256 <ul>
 257 <li>No web based administration tool for creating users and groups. The
 258     scripts ldap-createuser-krb and ldap-add-user-to-group can be used
 259     for testing.</li>
 260 <li>DVD installs are missing debian-installer images for the PXE boot,
 261     and do not set up the PXE menu on eth0 because of this. LTSP
 262     clients should still boot from eth1 on thin client servers.</li>
 263 <li>The restructured KDE menu is not implemented.</li>
 264 <li>The LDAP server setup need to be reviewed for security.</li>
 265 <li>The LDAP directory structure need to be reworked.</li>
 266 <li>Different sets of packages are installed when using the DVD and the
 267     netinst CD. More packages are installed using the netinst CD.</li>
 268 <li>The jackd package fail to install. This is believed to be caused by
 269     some ongoing transition, and hopefully should be solved soon. The
 270     jackd1 package can be installed manually for those that need it.</li>
 271 <li>Some packages lack translations. See
 272     http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status,
 273     and help out with translations.</li>
 274 </ul>
 275
 276 <p>To download this multiarch netinstall release you can use</p>
 277
 278 <ul>
 279 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
 280 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
 281 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</li>
 282 </ul>
 283 <p>To download this multiarch dvd release you can use</p>
 284
 285 <ul>
 286 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
 287 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
 288 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</li>
 289 </ul>
 290
 291 <p>There is no source DVD available yet. It will be prepared when we
 292 get closer to the final release.</p>
 293
 294 <p>The MD5SUM of these images are</p>
 295
 296 <ul>
 297 <li>3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-6.0.0+edua0-CD.iso</li>
 298 <li>22f2cbfce281d1c6e478be452638675d debian-edu-6.0.0+edua0-DVD.iso</li>
 299 </ul>
 300
 301 <p>The SHA1SUM of these images are</p>
 302 <ul>
 303 <li>c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-6.0.0+edua0-CD.iso</li>
 304 <li>2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-6.0.0+edua0-DVD.iso</li>
 305 </ul>
 306 <p>How to report bugs:
 307 http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla</p>
 308
 309 <p>Please direct replies to debian-edu@lists.debian.org</p>
 310 </blockquote>
 311 </div>
 312   <div class="tags">
 313
 314
 315
 316    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 317
 318   </div>
 319  </div>
 320  <div class="padding"></div>
 321
 322  <div class="entry">
 323   <div class="title"><a href="http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html">One step closer to single signon in Debian Edu</a></div>
 324   <div class="date">2010-07-25 10:00</div>
 325   <div class="body">
 326 <p>The last few months me and the other Debian Edu developers have
 327 been working hard to get the Debian/Squeeze based version of Debian
 328 Edu/Skolelinux into shape.  This future version will use Kerberos for
 329 authentication, and services are slowly migrated to single signon,
 330 getting rid of password questions one at the time.</p>
 331
 332 <p>It will also feature a roaming workstation profile with local home
 333 directory, for laptops that are only some times on the Skolelinux
 334 network, and for this profile a shortcut is created in Gnome and KDE
 335 to gain access to the users home directory on the file server.  This
 336 shortcut uses SMB at the moment, and yesterday I had time to test if
 337 SMB mounting had started working in KDE after we added the cifs-utils
 338 package.  I was pleasantly surprised how well it worked.</p>
 339
 340 <p>Thanks to the recent changes to our samba configuration to get it
 341 to use Kerberos for authentication, there were no question about user
 342 password when mounting the SMB volume.  A simple click on the shortcut
 343 in the KDE menu, and a window with the home directory popped
 344 up. :)</p>
 345
 346 <p>One step closer to a single signon solution out of the box in
 347 Debian Edu.  We already had PAM, LDAP, IMAP and SMTP in place, and now
 348 also Samba.  Next step is Cups and hopefully also NFS.</p>
 349
 350 <p>We had planned a alpha0 release of Debian Edu for today, but thanks
 351 to the autobuilder administrators for some architectures being slow to
 352 sign packages, we are still missing the fixed LTSP package we need for
 353 the release.  It was uploaded three days ago with urgency=high, and if
 354 it had entered testing yesterday we would have been able to test it in
 355 time for a alpha0 release today.  As the binaries for ia64 and powerpc
 356 still not uploaded to the Debian archive, we need to delay the alpha
 357 release another day.</p>
 358
 359 <p>If you want to help out with implementing Kerberos for Debian Edu,
 360 please contact us on debian-edu@lists.debian.org.</p>
 361 </div>
 362   <div class="tags">
 363
 364
 365
 366    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 367
 368   </div>
 369  </div>
 370  <div class="padding"></div>
 371
 372  <div class="entry">
 373   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til____slutte____kj__pe_musikk.html">Digitale restriksjonsmekanismer fikk meg til å slutte å kjøpe musikk</a></div>
 374   <div class="date">2010-07-22 23:50</div>
 375   <div class="body">
 376 <p>For mange år siden slutte jeg å kjøpe musikk-CDer. Årsaken var at
 377 musikkbransjen var godt i gang med å selge platene sine med DRM som
 378 gjorde at jeg ikke fikk spilt av musikken jeg kjøpte på utstyret jeg
 379 hadde tilgjengelig, dvs. min datamaskin. Det var umulig å se på en
 380 plate om den var ødelagt eller ikke, og jeg hadde jo allerede en
 381 anseelig samling med plater, så jeg bestemme meg for å slutte å gi
 382 penger til en bransje som åpenbart ikke respekterte meg.</p>
 383
 384 <p>Jeg har mange titalls dager med musikk på CD i dag. Det meste er
 385 lagt i et stort arkiv som kan spilles av fra husets datamaskiner (har
 386 ikke rukket rippe alt). Jeg ser dermed ikke behovet for å skaffe mer
 387 musikk. De fleste av mine favoritter er i hus, og jeg er dermed godt
 388 fornøyd.</p>
 389
 390 <p>Hvis musikkbransjen ønsker mine penger, så må de demonstrere at de
 391 setter pris på meg som kunde, og ikke skremme meg bort med DRM og
 392 antydninger om at kundene er kriminelle.</p>
 393
 394 <p>Filmbransjen er like ille, men mens musikk gjerne varer lenge, er
 395 filmer mer ferskvare. Har dermed ikke helt sluttet å kjøpe filmer, men
 396 holder meg til DVD-filmer som kan spilles av på mine Linuxbokser.
 397 Kommer neppe til å ta i bruk Blueray, og ei heller de nye DRM-greiene
 398 «Ultraviolet» som be annonsert her om dagen.</p>
 399 </div>
 400   <div class="tags">
 401
 402
 403
 404    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>.
 405
 406   </div>
 407  </div>
 408  <div class="padding"></div>
 409
 410  <div class="entry">
 411   <div class="title"><a href="http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html">OpenStreetmap one step closer to having routing on its front page</a></div>
 412   <div class="date">2010-07-18 16:45</div>
 413   <div class="body">
 414 <p>Thanks to
 415 <a href="http://feedproxy.google.com/~r/Opengeodata/~3/wUTCzDZk3lc/project-of-the-week-which-way-home">todays
 416 opengeodata blog entry</a>, I just discovered that the
 417 OpenStreetmap.org site have gotten
 418 <a href="http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT">support
 419 for calculating routes</a>.  The support is still experimental and
 420 only available from the development server, until more experience is
 421 gathered on the user interface and any scalability issues.</p>
 422
 423 <p>Earlier, the routing I knew about using the OpenStreetmap.org data
 424 was provided by <a href="http://maps.cloudmade.com/">Cloudmade</a>,
 425 but having it on the main page is required to make everyone aware of
 426 the issue.  I've had people reject Openstreetmap.org as a viable
 427 alternative for them because the front page lacked routing support,
 428 and I hope their needs will be catered for when routing show up on the
 429 www.openstreetmap.org front page.</p>
 430 </div>
 431   <div class="tags">
 432
 433
 434
 435    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/kart">kart</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 436
 437   </div>
 438  </div>
 439  <div class="padding"></div>
 440
 441  <div class="entry">
 442   <div class="title"><a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a></div>
 443   <div class="date">2010-07-17 21:00</div>
 444   <div class="body">
 445 <p>This is a
 446 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
 447 on my
 448 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
 449 work</a> on
 450 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
 451 all</a> the computer related LDAP objects in Debian Edu.</p>
 452
 453 <p>As a step to try to see if it possible to merge the DNS and DHCP
 454 LDAP objects, I have had a look at how the packages pdns-backend-ldap
 455 and dhcp3-server-ldap in Debian use the LDAP server.  The two
 456 implementations are quite different in how they use LDAP.</p>
 457
 458 To get this information, I started slapd with debugging enabled and
 459 dumped the debug output to a file to get the LDAP searches performed
 460 on a Debian Edu main-server.  Here is a summary.
 461
 462 <p><strong>powerdns</strong></p>
 463
 464 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
 465 on how to</a> set up PowerDNS to use a LDAP backend is available on
 466 the web.
 467
 468 <p>PowerDNS have two modes of operation using LDAP as its backend.
 469 One "strict" mode where the forward and reverse DNS lookups are done
 470 using the same LDAP objects, and a "tree" mode where the forward and
 471 reverse entries are in two different subtrees in LDAP with a structure
 472 based on the DNS names, as in tjener.intern and
 473 2.2.0.10.in-addr.arpa.</p>
 474
 475 <p>In tree mode, the server is set up to use a LDAP subtree as its
 476 base, and uses a "base" scoped search for the DNS name by adding
 477 "dc=tjener,dc=intern," to the base with a filter for
 478 "(associateddomain=tjener.intern)" for the forward entry and
 479 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
 480 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
 481 forward entries, it is looking for attributes named dnsttl, arecord,
 482 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
 483 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
 484 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
 485 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
 486 spfrecord and modifytimestamp.  For reverse entries it is looking for
 487 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
 488 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
 489 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
 490 ldapsearch commands could look like this:</p>
 491
 492 <blockquote><pre>
 493 ldapsearch -h ldap \
 494   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 495   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 496   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 497   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 498   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 499   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 500
 501 ldapsearch -h ldap \
 502   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 503   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
 504   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
 505   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
 506   srvrecord naptrrecord modifytimestamp
 507 </pre></blockquote>
 508
 509 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
 510 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
 511 example LDAP objects used there.  In addition to these objects, the
 512 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
 513 also exist.</p>
 514
 515 <blockquote><pre>
 516 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
 517 objectclass: top
 518 objectclass: dnsdomain
 519 objectclass: domainrelatedobject
 520 dc: tjener
 521 arecord: 10.0.2.2
 522 associateddomain: tjener.intern
 523
 524 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
 525 objectclass: top
 526 objectclass: dnsdomain2
 527 objectclass: domainrelatedobject
 528 dc: 2
 529 ptrrecord: tjener.intern
 530 associateddomain: 2.2.0.10.in-addr.arpa
 531 </pre></blockquote>
 532
 533 <p>In strict mode, the server behaves differently.  When looking for
 534 forward DNS entries, it is doing a "subtree" scoped search with the
 535 same base as in the tree mode for a object with filter
 536 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
 537 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
 538 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
 539 naptrrecord and modifytimestamp.  For reverse entires it also do a
 540 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
 541 and the requested attributes are associateddomain, dnsttl and
 542 modifytimestamp.  In short, in strict mode the objects with ptrrecord
 543 go away, and the arecord attribute in the forward object is used
 544 instead.</p>
 545
 546 <p>The forward and reverse searches can be simulated using ldapsearch
 547 like this:</p>
 548
 549 <blockquote><pre>
 550 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 551   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 552   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 553   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 554   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 555   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 556
 557 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 558   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
 559 </pre></blockquote>
 560
 561 <p>In addition to the forward and reverse searches , there is also a
 562 search for SOA records, which behave similar to the forward and
 563 reverse lookups.</p>
 564
 565 <p>A thing to note with the PowerDNS behaviour is that it do not
 566 specify any objectclass names, and instead look for the attributes it
 567 need to generate a DNS reply.  This make it able to work with any
 568 objectclass that provide the needed attributes.</p>
 569
 570 <p>The attributes are normally provided in the cosine (RFC 1274) and
 571 dnsdomain2 schemas.  The latter is used for reverse entries like
 572 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
 573
 574 <p>In Debian Edu, we have created DNS objects using the object classes
 575 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
 576 attributes) and domainrelatedobject (for associatedDomain).  The use
 577 of structural object classes make it impossible to combine these
 578 classes with the object classes used by DHCP.</p>
 579
 580 <p>There are other schemas that could be used too, for example the
 581 dnszone structural object class used by Gosa and bind-sdb for the DNS
 582 attributes combined with the domainrelatedobject object class, but in
 583 this case some unused attributes would have to be included as well
 584 (zonename and relativedomainname).</p>
 585
 586 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
 587 mode and not use any of the existing objectclasses (dnsdomain,
 588 dnsdomain2 and dnszone) when one want to combine the DNS information
 589 with DHCP information, and instead create a auxiliary object class
 590 defined something like this (using the attributes defined for
 591 dnsdomain and dnsdomain2 or dnszone):</p>
 592
 593 <blockquote><pre>
 594 objectclass ( some-oid NAME 'dnsDomainAux'
 595     SUP top
 596     AUXILIARY
 597     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
 598           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
 599           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
 600           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
 601           A6Record $ DNAMERecord
 602     ))
 603 </pre></blockquote>
 604
 605 <p>This will allow any object to become a DNS entry when combined with
 606 the domainrelatedobject object class, and allow any entity to include
 607 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
 608 developers asking for their view on this schema and if they are
 609 interested in providing such schema with PowerDNS, and I hope my
 610 message will be accepted into their mailing list soon.</p>
 611
 612 <p><strong>ISC dhcp</strong></p>
 613
 614 <p>The DHCP server searches for specific objectclass and requests all
 615 the object attributes, and then uses the attributes it want.  This
 616 make it harder to figure out exactly what attributes are used, but
 617 thanks to the working example in Debian Edu I can at least get an idea
 618 what is needed without having to read the source code.</p>
 619
 620 <p>In the DHCP server configuration, the LDAP base to use and the
 621 search filter to use to locate the correct dhcpServer entity is
 622 stored.  These are the relevant entries from
 623 /etc/dhcp3/dhcpd.conf:</p>
 624
 625 <blockquote><pre>
 626 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
 627 ldap-dhcp-server-cn "dhcp";
 628 </pre></blockquote>
 629
 630 <p>The DHCP server uses this information to nest all the DHCP
 631 configuration it need.  The cn "dhcp" is located using the given LDAP
 632 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
 633 search result is this entry:</p>
 634
 635 <blockquote><pre>
 636 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
 637 cn: dhcp
 638 objectClass: top
 639 objectClass: dhcpServer
 640 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 641 </pre></blockquote>
 642
 643 <p>The content of the dhcpServiceDN attribute is next used to locate the
 644 subtree with DHCP configuration.  The DHCP configuration subtree base
 645 is located using a base scope search with base "cn=DHCP
 646 Config,dc=skole,dc=skolelinux,dc=no" and filter
 647 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
 648 The search result is this entry:</p>
 649
 650 <blockquote><pre>
 651 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 652 cn: DHCP Config
 653 objectClass: top
 654 objectClass: dhcpService
 655 objectClass: dhcpOptions
 656 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
 657 dhcpStatements: ddns-update-style none
 658 dhcpStatements: authoritative
 659 dhcpOption: smtp-server code 69 = array of ip-address
 660 dhcpOption: www-server code 72 = array of ip-address
 661 dhcpOption: wpad-url code 252 = text
 662 </pre></blockquote>
 663
 664 <p>Next, the entire subtree is processed, one level at the time.  When
 665 all the DHCP configuration is loaded, it is ready to receive requests.
 666 The subtree in Debian Edu contain objects with object classes
 667 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
 668 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
 669 and information about netmasks, dynamic range etc.  Leaving out the
 670 details here because it is not relevant for the focus of my
 671 investigation, which is to see if it is possible to merge dns and dhcp
 672 related computer objects.</p>
 673
 674 <p>When a DHCP request come in, LDAP is searched for the MAC address
 675 of the client (00:00:00:00:00:00 in this example), using a subtree
 676 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
 677 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
 678 00:00:00:00:00:00))" as the filter.  This is what a host object look
 679 like:</p>
 680
 681 <blockquote><pre>
 682 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 683 cn: hostname
 684 objectClass: top
 685 objectClass: dhcpHost
 686 dhcpHWAddress: ethernet 00:00:00:00:00:00
 687 dhcpStatements: fixed-address hostname
 688 </pre></blockquote>
 689
 690 <p>There is less flexiblity in the way LDAP searches are done here.
 691 The object classes need to have fixed names, and the configuration
 692 need to be stored in a fairly specific LDAP structure.  On the
 693 positive side, the invidiual dhcpHost entires can be anywhere without
 694 the DN pointed to by the dhcpServer entries.  The latter should make
 695 it possible to group all host entries in a subtree next to the
 696 configuration entries, and this subtree can also be shared with the
 697 DNS server if the schema proposed above is combined with the dhcpHost
 698 structural object class.
 699
 700 <p><strong>Conclusion</strong></p>
 701
 702 <p>The PowerDNS implementation seem to be very flexible when it come
 703 to which LDAP schemas to use.  While its "tree" mode is rigid when it
 704 come to the the LDAP structure, the "strict" mode is very flexible,
 705 allowing DNS objects to be stored anywhere under the base cn specified
 706 in the configuration.</p>
 707
 708 <p>The DHCP implementation on the other hand is very inflexible, both
 709 regarding which LDAP schemas to use and which LDAP structure to use.
 710 I guess one could implement ones own schema, as long as the
 711 objectclasses and attributes have the names used, but this do not
 712 really help when the DHCP subtree need to have a fairly fixed
 713 structure.</p>
 714
 715 <p>Based on the observed behaviour, I suspect a LDAP structure like
 716 this might work for Debian Edu:</p>
 717
 718 <blockquote><pre>
 719 ou=services
 720   cn=machine-info (dhcpService) - dhcpServiceDN points here
 721     cn=dhcp (dhcpServer)
 722     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
 723       cn=10.0.2.0 (dhcpSubnet)
 724         cn=group1 (dhcpGroup/dhcpOptions)
 725     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
 726       cn=192.168.0.0 (dhcpSubnet)
 727         cn=group1 (dhcpGroup/dhcpOptions)
 728     ou=machines - PowerDNS base points here
 729       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
 730 </pre></blockquote>
 731
 732 <P>This is not tested yet.  If the DHCP server require the dhcpHost
 733 entries to be in the dhcpGroup subtrees, the entries can be stored
 734 there instead of a common machines subtree, and the PowerDNS base
 735 would have to be moved one level up to the machine-info subtree.</p>
 736
 737 <p>The combined object under the machines subtree would look something
 738 like this:</p>
 739
 740 <blockquote><pre>
 741 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
 742 dc: hostname
 743 objectClass: top
 744 objectClass: dhcpHost
 745 objectclass: domainrelatedobject
 746 objectclass: dnsDomainAux
 747 associateddomain: hostname.intern
 748 arecord: 10.11.12.13
 749 dhcpHWAddress: ethernet 00:00:00:00:00:00
 750 dhcpStatements: fixed-address hostname.intern
 751 </pre></blockquote>
 752
 753 </p>One could even add the LTSP configuration associated with a given
 754 machine, as long as the required attributes are available in a
 755 auxiliary object class.</p>
 756 </div>
 757   <div class="tags">
 758
 759
 760
 761    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 762
 763   </div>
 764  </div>
 765  <div class="padding"></div>
 766
 767  <div class="entry">
 768   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a></div>
 769   <div class="date">2010-07-14 23:45</div>
 770   <div class="body">
 771 <p>For a while now, I have wanted to find a way to change the DNS and
 772 DHCP services in Debian Edu to use the same LDAP objects for a given
 773 computer, to avoid the possibility of having a inconsistent state for
 774 a computer in LDAP (as in DHCP but no DNS entry or the other way
 775 around) and make it easier to add computers to LDAP.</p>
 776
 777 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
 778 information finally found a solution that seem to work.</p>
 779
 780 <p>The old setup required three LDAP objects for a given computer.
 781 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
 782 we switch powerdns to use its strict LDAP method (ldap-method=strict
 783 in pdns-debian-edu.conf), the forward and reverse DNS entries are
 784 merged into one while making it impossible to transfer the reverse map
 785 to a slave DNS server.</p>
 786
 787 <p>If we also replace the object class used to get the DNS related
 788 attributes to one allowing these attributes to be combined with the
 789 dhcphost object class, we can merge the DNS and DHCP entries into one.
 790 I've written such object class in the dnsdomainaux.schema file (need
 791 proper OIDs, but that is a minor issue), and tested the setup.  It
 792 seem to work.</p>
 793
 794 <p>With this test setup in place, we can get away with one LDAP object
 795 for both DNS and DHCP, and even the LTSP configuration I suggested in
 796 an earlier email.  The combined LDAP object will look something like
 797 this:</p>
 798
 799 <blockquote><pre>
 800   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 801   cn: hostname
 802   objectClass: dhcphost
 803   objectclass: domainrelatedobject
 804   objectclass: dnsdomainaux
 805   associateddomain: hostname.intern
 806   arecord: 10.11.12.13
 807   dhcphwaddress: ethernet 00:00:00:00:00:00
 808   dhcpstatements: fixed-address hostname
 809   ldapconfigsound: Y
 810 </pre></blockquote>
 811
 812 <p>The DNS server uses the associateddomain and arecord entries, while
 813 the DHCP server uses the dhcphwaddress and dhcpstatements entries
 814 before asking DNS to resolve the fixed-adddress.  LTSP will use
 815 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
 816
 817 <p>I am not yet sure if I can get the DHCP server to look for its
 818 dhcphost in a different location, to allow us to put the objects
 819 outside the "DHCP Config" subtree, but hope to figure out a way to do
 820 that.  If I can't figure out a way to do that, we can still get rid of
 821 the hosts subtree and move all its content into the DHCP Config tree
 822 (which probably should be renamed to be more related to the new
 823 content.  I suspect cn=dnsdhcp,ou=services or something like that
 824 might be a good place to put it.</p>
 825
 826 <p>If you want to help out with implementing this for Debian Edu,
 827 please contact us on debian-edu@lists.debian.org.</p>
 828 </div>
 829   <div class="tags">
 830
 831
 832
 833    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 834
 835   </div>
 836  </div>
 837  <div class="padding"></div>
 838
 839  <div class="entry">
 840   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a></div>
 841   <div class="date">2010-07-11 22:00</div>
 842   <div class="body">
 843 <p>Vagrant mentioned on IRC today that ltsp_config now support
 844 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
 845 clients, and that this can be used to fetch configuration from LDAP if
 846 Debian Edu choose to store configuration there.</p>
 847
 848 <p>Armed with this information, I got inspired and wrote a test module
 849 to get configuration from LDAP.  The idea is to look up the MAC
 850 address of the client in LDAP, and look for attributes on the form
 851 ltspconfigsetting=value, and use this to export SETTING=value to the
 852 LTSP clients.</p>
 853
 854 <p>The goal is to be able to store the LTSP configuration attributes
 855 in a "computer" LDAP object used by both DNS and DHCP, and thus
 856 allowing us to store all information about a computer in one place.</p>
 857
 858 <p>This is a untested draft implementation, and I welcome feedback on
 859 this approach.  A real LDAP schema for the ltspClientAux objectclass
 860 need to be written.  Comments, suggestions, etc?</p>
 861
 862 <blockquote><pre>
 863 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
 864 #
 865 # Fetch LTSP client settings from LDAP based on MAC address
 866 #
 867 # Uses ethernet address as stored in the dhcpHost objectclass using
 868 # the dhcpHWAddress attribute or ethernet address stored in the
 869 # ieee802Device objectclass with the macAddress attribute.
 870 #
 871 # This module is written to be schema agnostic, and only depend on the
 872 # existence of attribute names.
 873 #
 874 # The LTSP configuration variables are saved directly using a
 875 # ltspConfig prefix and uppercasing the rest of the attribute name.
 876 # To set the SERVER variable, set the ltspConfigServer attribute.
 877 #
 878 # Some LDAP schema should be created with all the relevant
 879 # configuration settings.  Something like this should work:
 880 #
 881 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
 882 #     SUP top
 883 #     AUXILIARY
 884 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
 885
 886 LDAPSERVER=$(debian-edu-ldapserver)
 887 if [ "$LDAPSERVER" ] ; then
 888     LDAPBASE=$(debian-edu-ldapserver -b)
 889     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
 890         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
 891         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
 892             grep '^ltspConfig' | while read attr value ; do
 893             # Remove prefix and convert to upper case
 894             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
 895             # bass value on to clients
 896             eval "$attr=$value; export $attr"
 897         done
 898     done
 899 fi
 900 </pre></blockquote>
 901
 902 <p>I'm not sure this shell construction will work, because I suspect
 903 the while block might end up in a subshell causing the variables set
 904 there to not show up in ltsp-config, but if that is the case I am sure
 905 the code can be restructured to make sure the variables are passed on.
 906 I expect that can be solved with some testing. :)</p>
 907
 908 <p>If you want to help out with implementing this for Debian Edu,
 909 please contact us on debian-edu@lists.debian.org.</p>
 910
 911 <p>Update 2010-07-17: I am aware of another effort to store LTSP
 912 configuration in LDAP that was created around year 2000 by
 913 <a href="http://www.pcxperience.com/thinclient/documentation/ldap.html">PC
 914 Xperience, Inc., 2000</a>.  I found its
 915 <a href="http://people.redhat.com/alikins/ltsp/ldap/">files</a> on a
 916 personal home page over at redhat.com.</p>
 917 </div>
 918   <div class="tags">
 919
 920
 921
 922    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 923
 924   </div>
 925  </div>
 926  <div class="padding"></div>
 927
 928  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
 929
 930 <div id="sidebar">
 931
 932
 933
 934
 935
 936 <h2>Archive</h2>
 937 <ul>
 938
 939 <li>2010
 940 <ul>
 941
 942 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 943
 944 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 945
 946 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 947
 948 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 949
 950 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 951
 952 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 953
 954 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
 955
 956 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (2)</a></li>
 957
 958 </ul></li>
 959
 960 <li>2009
 961 <ul>
 962
 963 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 964
 965 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 966
 967 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 968
 969 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 970
 971 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 972
 973 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 974
 975 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 976
 977 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 978
 979 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 980
 981 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 982
 983 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 984
 985 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 986
 987 </ul></li>
 988
 989 <li>2008
 990 <ul>
 991
 992 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 993
 994 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 995
 996 </ul></li>
 997
 998 </ul>
 999
1000
1001
1002 <h2>Tags</h2>
1003 <ul>
1004
1005  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
1006
1007  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1008
1009  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1010
1011  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
1012
1013  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (35)</a></li>
1014
1015  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (38)</a></li>
1016
1017  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (53)</a></li>
1018
1019  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
1020
1021  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (8)</a></li>
1022
1023  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (3)</a></li>
1024
1025  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
1026
1027  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
1028
1029  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1030
1031  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
1032
1033  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (71)</a></li>
1034
1035  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (90)</a></li>
1036
1037  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (14)</a></li>
1038
1039  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (14)</a></li>
1040
1041  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
1042
1043  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1044
1045  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (10)</a></li>
1046
1047  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
1048
1049  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
1050
1051  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
1052
1053  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
1054
1055  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
1056
1057  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (7)</a></li>
1058
1059 </ul>
1060
1061 </div>
1062
1063 <p style="text-align: right">
1064 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.2</a>
1065 </p>
1066 </body>
1067 </html>