1 <?xml version=
"1.0" encoding=
"utf-8"?>
2 <rss version='
2.0' xmlns:lj='http://www.livejournal.org/rss/lj/
1.0/' xmlns:
atom=
"http://www.w3.org/2005/Atom">
4 <title>Petter Reinholdtsen
</title>
5 <description></description>
6 <link>http://people.skolelinux.org/pere/blog/
</link>
7 <atom:link href=
"http://people.skolelinux.org/pere/blog/index.rss" rel=
"self" type=
"application/rss+xml" />
10 <title>Autodetecting Client setup for roaming workstations in Debian Edu
</title>
11 <link>http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html
</link>
12 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html
</guid>
13 <pubDate>Sat,
7 Aug
2010 14:
45:
00 +
0200</pubDate>
15 <p
>A few days ago, I
16 <a href=
"http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html
">tried
17 to install
</a
> a Roaming workation profile from Debian Edu/Squeeze
18 while on the university network here at the University of Oslo, and
19 noticed how much had to change to get it operational using the
20 university infrastructure. It was fairly easy, but it occured to me
21 that Debian Edu would improve a lot if I could get the client to
22 connect without any changes at all, and thus let the client configure
23 itself during installation and first boot to use the infrastructure
24 around it. Now I am a huge step further along that road.
</p
>
26 <p
>With our current squeeze-test packages, I can select the roaming
27 workstation profile and get a working laptop connecting to the
28 university LDAP server for user and group and our active directory
29 servers for Kerberos authentication. All this without any
30 configuration at all during installation. My users home directory got
31 a bookmark in the KDE menu to mount it via SMB, with the correct URL.
32 In short, openldap and sssd is correctly configured. In addition to
33 this, the client look for http://wpad/wpad.dat to configure a web
34 proxy, and when it fail to find it no proxy settings are stored in
35 /etc/environment and /etc/apt/apt.conf. Iceweasel and KDE is
36 configured to look for the same wpad configuration and also do not use
37 a proxy when at the university network. If the machine is moved to a
38 network with such wpad setup, it would automatically use it when DHCP
39 gave it a IP address.
</p
>
41 <p
>The LDAP server is located using DNS, by first looking for the DNS
42 entry ldap.$domain. If this do not exist, it look for the
43 _ldap._tcp.$domain SRV records and use the first one as the LDAP
44 server. Next, it connects to the LDAP server and search all
45 namingContexts entries for posixAccount or posixGroup objects, and
46 pick the first one as the LDAP base. For Kerberos, a similar
47 algorithm is used to locate the LDAP server, and the realm is the
48 uppercase version of $domain.
</p
>
50 <p
>So, what is not working, you might ask. SMB mounting my home
51 directory do not work. No idea why, but suspected the incorrect
52 Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
53 the cause. These are not properly configured during installation, and
54 had to be hand-edited to get the correct Kerberos realm and server,
55 but SMB mounting still do not work. :(
</p
>
57 <p
>With this automatic configuration in place, I expect a Debian Edu
58 roaming profile installation would be able to automatically detect and
59 connect to any site using LDAP and Kerberos for NSS directory and PAM
60 authentication. It should also work out of the box in a Active
61 Directory environment providing posixAccount and posixGroup objects
62 with UID and GID values.
</p
>
64 <p
>If you want to help out with implementing these things for Debian
65 Edu, please contact us on debian-edu@lists.debian.org.
</p
>
70 <title>Debian Edu roaming workstation - at the university of Oslo
</title>
71 <link>http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html
</link>
72 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html
</guid>
73 <pubDate>Tue,
3 Aug
2010 23:
30:
00 +
0200</pubDate>
75 <p
>The new roaming workstation profile in Debian Edu/Squeeze is fairly
76 similar to the laptop setup am I working on using Ubuntu for the
77 University of Oslo, and just for the heck of it, I tested today how
78 hard it would be to integrate that profile into the university
79 infrastructure. In this case, it is the university LDAP server,
80 Active Directory Kerberos server and SMB mounting from the Netapp file
83 <p
>I was pleasantly surprised that the only three files needed to be
84 changed (/etc/sssd/sssd.conf, /etc/ldap.conf and
85 /etc/mklocaluser.d/
20-debian-edu-config) and one file had to be added
86 (/usr/share/perl5/Debian/Edu_Local.pm), to get the client working.
87 Most of the changes were to get the client to use the university LDAP
88 for NSS and Kerberos server for PAM, but one was to change a hard
89 coded DNS domain name in the mklocaluser hook from .intern to
92 <p
>This testing was so encouraging, that I went ahead and adjusted the
93 Debian Edu scripts and setup in subversion to centralise the roaming
94 workstation setup a bit more and avoid the hardcoded DNS domain name,
95 so that when I test this tomorrow, I expect to get away with modifying
96 only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the
97 university servers.
</p
>
99 <p
>My goal is to get the clients to have no hardcoded settings and
100 fetch all their initial setup during installation and first boot, to
101 allow them to be inserted also into environments where the default
102 setup in Debian Edu has been changed or as with the university, where
103 the environment is different but provides the protocols Debian Edu
109 <title>Circular package dependencies harms apt recovery
</title>
110 <link>http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html
</link>
111 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html
</guid>
112 <pubDate>Tue,
27 Jul
2010 23:
50:
00 +
0200</pubDate>
114 <p
>I discovered this while doing
115 <a href=
"http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html
">automated
116 testing of upgrades from Debian Lenny to Squeeze
</a
>. A few packages
117 in Debian still got circular dependencies, and it is often claimed
118 that apt and aptitude should be able to handle this just fine, but
119 some times these dependency loops causes apt to fail.
</p
>
121 <p
>An example is from todays
122 <a href=
"http://people.skolelinux.org/~pere/debian-upgrade-testing//test-
20100727-lenny-squeeze-kde-aptitude.txt
">upgrade
123 of KDE using aptitude
</a
>. In it, a bug in kdebase-workspace-data
124 causes perl-modules to fail to upgrade. The cause is simple. If a
125 package fail to unpack, then only part of packages with the circular
126 dependency might end up being unpacked when unpacking aborts, and the
127 ones already unpacked will fail to configure in the recovery phase
128 because its dependencies are unavailable.
</p
>
130 <p
>In this log, the problem manifest itself with this error:
</p
>
132 <blockquote
><pre
>
133 dpkg: dependency problems prevent configuration of perl-modules:
134 perl-modules depends on perl (
>=
5.10.1-
1); however:
135 Version of perl on system is
5.10.0-
19lenny
2.
136 dpkg: error processing perl-modules (--configure):
137 dependency problems - leaving unconfigured
138 </pre
></blockquote
>
140 <p
>The perl/perl-modules circular dependency is already
141 <a href=
"http://bugs.debian.org/
527917">reported as a bug
</a
>, and will
142 hopefully be solved as soon as possible, but it is not the only one,
143 and each one of these loops in the dependency tree can cause similar
144 failures. Of course, they only occur when there are bugs in other
145 packages causing the unpacking to fail, but it is rather nasty when
146 the failure of one package causes the problem to become worse because
147 of dependency loops.
</p
>
150 <a href=
"http://lists.debian.org/debian-devel/
2010/
06/msg00116.html
">the
151 tireless effort by Bill Allombert
</a
>, the number of circular
153 <a href=
"http://debian.semistable.com/debgraph.out.html
">left in Debian
154 is dropping
</a
>, and perhaps it will reach zero one day. :)
</p
>
156 <p
>Todays testing also exposed a bug in
157 <a href=
"http://bugs.debian.org/
590605">update-notifier
</a
> and
158 <a href=
"http://bugs.debian.org/
590604">different behaviour
</a
> between
159 apt-get and aptitude, the latter possibly caused by some circular
160 dependency. Reported both to BTS to try to get someone to look at
166 <title>First Debian Edu test release (alpha0) based on Squeeze is released
</title>
167 <link>http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html
</link>
168 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html
</guid>
169 <pubDate>Tue,
27 Jul
2010 17:
45:
00 +
0200</pubDate>
171 <p
>I just posted this announcement culminating several months of work
172 with the next Debian Edu release. Not nearly done, but one major step
176 <p
>This is the first test release based on Squeeze. The focus of this
177 release is to test the user application selection. To have a look,
178 install the standalone profile and let the developers know if the set
179 of installed packages i.e. applications should be modified. If some
180 user application is missing, or if there are some applications that no
181 longer make sense to be included in Debian Edu, please let us know.
182 Also, if a useful application is missing the translation for your
183 language of choice, please let us know too.
</p
>
185 <p
>In addition, feedback and help to polish the desktop (menus,
186 artwork, starters, etc.) is appreciated. We would like to ship a nice
187 and handy KDE4 desktop targeted for schools out of the box.
</p
>
189 <p
>The other profiles should be installable, but there is a lot more
190 work left to be done before they are ready, so do not expect to
193 <p
>Changes compared to the lenny based version
</p
>
196 <li
>Everything from Debian Squeeze
198 <li
>Desktop environment KDE
4.4 =
> the new KDE desktop in
199 combination with some new artwork
200 <li
>Web browser Iceweasel
3.5
201 <li
>OpenOffice.org
3.2
202 <li
>Educational toolbox GCompris
9.3
203 <li
>Music creator Rosegarden
10.04.2
204 <li
>Image editor Gimp
2.6.10
205 <li
>Virtual universe Celestia
1.6.0
206 <li
>Virtual stargazer Stellarium
0.10.4
207 <li
>3D modeler Blender
2.49.2 (new application)
208 <li
>Video editor Kdenlive
0.7.7 (new application)
209 </ul
></li
>
210 <li
>Now using Kerberos for password checking (migration not finished).
216 <li
>SMTP (sender verification)
219 <li
>New experimental roaming workstation profile for laptops.
</li
>
220 <li
>Show welcome page to users when they first log in. The URL is
221 fetched from LDAP.
</li
>
222 <li
>New LXDE desktop option, in addition to KDE (default) and Gnome.
</li
>
223 <li
>General cleanup (not finished)
</li
>
225 <p
>The following features are not working as they should
</p
>
228 <li
>No web based administration tool for creating users and groups. The
229 scripts ldap-createuser-krb and ldap-add-user-to-group can be used
230 for testing.
</li
>
231 <li
>DVD installs are missing debian-installer images for the PXE boot,
232 and do not set up the PXE menu on eth0 because of this. LTSP
233 clients should still boot from eth1 on thin client servers.
</li
>
234 <li
>The restructured KDE menu is not implemented.
</li
>
235 <li
>The LDAP server setup need to be reviewed for security.
</li
>
236 <li
>The LDAP directory structure need to be reworked.
</li
>
237 <li
>Different sets of packages are installed when using the DVD and the
238 netinst CD. More packages are installed using the netinst CD.
</li
>
239 <li
>The jackd package fail to install. This is believed to be caused by
240 some ongoing transition, and hopefully should be solved soon. The
241 jackd1 package can be installed manually for those that need it.
</li
>
242 <li
>Some packages lack translations. See
243 http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status,
244 and help out with translations.
</li
>
247 <p
>To download this multiarch netinstall release you can use
</p
>
250 <li
><a href=
"ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-CD.iso
">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-CD.iso
</a
></li
>
251 <li
><a href=
"http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-CD.iso
">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-CD.iso
</a
></li
>
252 <li
>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-CD.iso
</li
>
254 <p
>To download this multiarch dvd release you can use
</p
>
257 <li
><a href=
"ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-DVD.iso
">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-DVD.iso
</a
></li
>
258 <li
><a href=
"http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-DVD.iso
">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-DVD.iso
</a
></li
>
259 <li
>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-DVD.iso
</li
>
262 <p
>There is no source DVD available yet. It will be prepared when we
263 get closer to the final release.
</p
>
265 <p
>The MD5SUM of these images are
</p
>
268 <li
>3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-
6.0.0+edua0-CD.iso
</li
>
269 <li
>22f2cbfce281d1c6e478be452638675d debian-edu-
6.0.0+edua0-DVD.iso
</li
>
272 <p
>The SHA1SUM of these images are
</p
>
274 <li
>c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-
6.0.0+edua0-CD.iso
</li
>
275 <li
>2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-
6.0.0+edua0-DVD.iso
</li
>
277 <p
>How to report bugs:
278 http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla
</p
>
280 <p
>Please direct replies to debian-edu@lists.debian.org
</p
>
286 <title>One step closer to single signon in Debian Edu
</title>
287 <link>http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html
</link>
288 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html
</guid>
289 <pubDate>Sun,
25 Jul
2010 10:
00:
00 +
0200</pubDate>
291 <p
>The last few months me and the other Debian Edu developers have
292 been working hard to get the Debian/Squeeze based version of Debian
293 Edu/Skolelinux into shape. This future version will use Kerberos for
294 authentication, and services are slowly migrated to single signon,
295 getting rid of password questions one at the time.
</p
>
297 <p
>It will also feature a roaming workstation profile with local home
298 directory, for laptops that are only some times on the Skolelinux
299 network, and for this profile a shortcut is created in Gnome and KDE
300 to gain access to the users home directory on the file server. This
301 shortcut uses SMB at the moment, and yesterday I had time to test if
302 SMB mounting had started working in KDE after we added the cifs-utils
303 package. I was pleasantly surprised how well it worked.
</p
>
305 <p
>Thanks to the recent changes to our samba configuration to get it
306 to use Kerberos for authentication, there were no question about user
307 password when mounting the SMB volume. A simple click on the shortcut
308 in the KDE menu, and a window with the home directory popped
311 <p
>One step closer to a single signon solution out of the box in
312 Debian Edu. We already had PAM, LDAP, IMAP and SMTP in place, and now
313 also Samba. Next step is Cups and hopefully also NFS.
</p
>
315 <p
>We had planned a alpha0 release of Debian Edu for today, but thanks
316 to the autobuilder administrators for some architectures being slow to
317 sign packages, we are still missing the fixed LTSP package we need for
318 the release. It was uploaded three days ago with urgency=high, and if
319 it had entered testing yesterday we would have been able to test it in
320 time for a alpha0 release today. As the binaries for ia64 and powerpc
321 still not uploaded to the Debian archive, we need to delay the alpha
322 release another day.
</p
>
324 <p
>If you want to help out with implementing Kerberos for Debian Edu,
325 please contact us on debian-edu@lists.debian.org.
</p
>
330 <title>Digitale restriksjonsmekanismer fikk meg til å slutte å kjøpe musikk
</title>
331 <link>http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til____slutte____kj__pe_musikk.html
</link>
332 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til____slutte____kj__pe_musikk.html
</guid>
333 <pubDate>Thu,
22 Jul
2010 23:
50:
00 +
0200</pubDate>
335 <p
>For mange år siden slutte jeg å kjøpe musikk-CDer. Årsaken var at
336 musikkbransjen var godt i gang med å selge platene sine med DRM som
337 gjorde at jeg ikke fikk spilt av musikken jeg kjøpte på utstyret jeg
338 hadde tilgjengelig, dvs. min datamaskin. Det var umulig å se på en
339 plate om den var ødelagt eller ikke, og jeg hadde jo allerede en
340 anseelig samling med plater, så jeg bestemme meg for å slutte å gi
341 penger til en bransje som åpenbart ikke respekterte meg.
</p
>
343 <p
>Jeg har mange titalls dager med musikk på CD i dag. Det meste er
344 lagt i et stort arkiv som kan spilles av fra husets datamaskiner (har
345 ikke rukket rippe alt). Jeg ser dermed ikke behovet for å skaffe mer
346 musikk. De fleste av mine favoritter er i hus, og jeg er dermed godt
349 <p
>Hvis musikkbransjen ønsker mine penger, så må de demonstrere at de
350 setter pris på meg som kunde, og ikke skremme meg bort med DRM og
351 antydninger om at kundene er kriminelle.
</p
>
353 <p
>Filmbransjen er like ille, men mens musikk gjerne varer lenge, er
354 filmer mer ferskvare. Har dermed ikke helt sluttet å kjøpe filmer, men
355 holder meg til DVD-filmer som kan spilles av på mine Linuxbokser.
356 Kommer neppe til å ta i bruk Blueray, og ei heller de nye DRM-greiene
357 «Ultraviolet» som be annonsert her om dagen.
</p
>
362 <title>OpenStreetmap one step closer to having routing on its front page
</title>
363 <link>http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html
</link>
364 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html
</guid>
365 <pubDate>Sun,
18 Jul
2010 16:
45:
00 +
0200</pubDate>
368 <a href=
"http://feedproxy.google.com/~r/Opengeodata/~
3/wUTCzDZk3lc/project-of-the-week-which-way-home
">todays
369 opengeodata blog entry
</a
>, I just discovered that the
370 OpenStreetmap.org site have gotten
371 <a href=
"http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT
">support
372 for calculating routes
</a
>. The support is still experimental and
373 only available from the development server, until more experience is
374 gathered on the user interface and any scalability issues.
</p
>
376 <p
>Earlier, the routing I knew about using the OpenStreetmap.org data
377 was provided by
<a href=
"http://maps.cloudmade.com/
">Cloudmade
</a
>,
378 but having it on the main page is required to make everyone aware of
379 the issue. I
've had people reject Openstreetmap.org as a viable
380 alternative for them because the front page lacked routing support,
381 and I hope their needs will be catered for when routing show up on the
382 www.openstreetmap.org front page.
</p
>
387 <title>What are they searching for - PowerDNS and ISC DHCP in LDAP
</title>
388 <link>http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html
</link>
389 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html
</guid>
390 <pubDate>Sat,
17 Jul
2010 21:
00:
00 +
0200</pubDate>
393 <a href=
"http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html
">followup
</a
>
395 <a href=
"http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html
">previous
397 <a href=
"http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html
">merging
398 all
</a
> the computer related LDAP objects in Debian Edu.
</p
>
400 <p
>As a step to try to see if it possible to merge the DNS and DHCP
401 LDAP objects, I have had a look at how the packages pdns-backend-ldap
402 and dhcp3-server-ldap in Debian use the LDAP server. The two
403 implementations are quite different in how they use LDAP.
</p
>
405 To get this information, I started slapd with debugging enabled and
406 dumped the debug output to a file to get the LDAP searches performed
407 on a Debian Edu main-server. Here is a summary.
409 <p
><strong
>powerdns
</strong
></p
>
411 <a href=
"http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend
">Clues
412 on how to
</a
> set up PowerDNS to use a LDAP backend is available on
415 <p
>PowerDNS have two modes of operation using LDAP as its backend.
416 One
"strict
" mode where the forward and reverse DNS lookups are done
417 using the same LDAP objects, and a
"tree
" mode where the forward and
418 reverse entries are in two different subtrees in LDAP with a structure
419 based on the DNS names, as in tjener.intern and
420 2.2.0.10.in-addr.arpa.
</p
>
422 <p
>In tree mode, the server is set up to use a LDAP subtree as its
423 base, and uses a
"base
" scoped search for the DNS name by adding
424 "dc=tjener,dc=intern,
" to the base with a filter for
425 "(associateddomain=tjener.intern)
" for the forward entry and
426 "dc=
2,dc=
2,dc=
0,dc=
10,dc=in-addr,dc=arpa,
" with a filter for
427 "(associateddomain=
2.2.0.10.in-addr.arpa)
" for the reverse entry. For
428 forward entries, it is looking for attributes named dnsttl, arecord,
429 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
430 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
431 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
432 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
433 spfrecord and modifytimestamp. For reverse entries it is looking for
434 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
435 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
436 locrecord, srvrecord, naptrrecord and modifytimestamp. The equivalent
437 ldapsearch commands could look like this:
</p
>
439 <blockquote
><pre
>
441 -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
442 -s base -x
'(associateddomain=tjener.intern)
' dNSTTL aRecord nSRecord \
443 cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
444 rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
445 nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
446 rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
449 -b dc=
2,dc=
2,dc=
0,dc=
10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
450 -s base -x
'(associateddomain=
2.2.0.10.in-addr.arpa)
'
451 dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
452 hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
453 srvrecord naptrrecord modifytimestamp
454 </pre
></blockquote
>
456 <p
>In Debian Edu/Lenny, the PowerDNS tree mode is used with
457 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
458 example LDAP objects used there. In addition to these objects, the
459 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
460 also exist.
</p
>
462 <blockquote
><pre
>
463 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
465 objectclass: dnsdomain
466 objectclass: domainrelatedobject
469 associateddomain: tjener.intern
471 dn: dc=
2,dc=
2,dc=
0,dc=
10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
473 objectclass: dnsdomain2
474 objectclass: domainrelatedobject
476 ptrrecord: tjener.intern
477 associateddomain:
2.2.0.10.in-addr.arpa
478 </pre
></blockquote
>
480 <p
>In strict mode, the server behaves differently. When looking for
481 forward DNS entries, it is doing a
"subtree
" scoped search with the
482 same base as in the tree mode for a object with filter
483 "(associateddomain=tjener.intern)
" and requests the attributes dnsttl,
484 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
485 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
486 naptrrecord and modifytimestamp. For reverse entires it also do a
487 subtree scoped search but this time the filter is
"(arecord=
10.0.2.2)
"
488 and the requested attributes are associateddomain, dnsttl and
489 modifytimestamp. In short, in strict mode the objects with ptrrecord
490 go away, and the arecord attribute in the forward object is used
493 <p
>The forward and reverse searches can be simulated using ldapsearch
496 <blockquote
><pre
>
497 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
498 '(associateddomain=tjener.intern)
' dNSTTL aRecord nSRecord \
499 cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
500 rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
501 nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
502 rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
504 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
505 '(arecord=
10.0.2.2)
' associateddomain dnsttl modifytimestamp
506 </pre
></blockquote
>
508 <p
>In addition to the forward and reverse searches , there is also a
509 search for SOA records, which behave similar to the forward and
510 reverse lookups.
</p
>
512 <p
>A thing to note with the PowerDNS behaviour is that it do not
513 specify any objectclass names, and instead look for the attributes it
514 need to generate a DNS reply. This make it able to work with any
515 objectclass that provide the needed attributes.
</p
>
517 <p
>The attributes are normally provided in the cosine (RFC
1274) and
518 dnsdomain2 schemas. The latter is used for reverse entries like
519 ptrrecord and recent DNS additions like aaaarecord and srvrecord.
</p
>
521 <p
>In Debian Edu, we have created DNS objects using the object classes
522 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
523 attributes) and domainrelatedobject (for associatedDomain). The use
524 of structural object classes make it impossible to combine these
525 classes with the object classes used by DHCP.
</p
>
527 <p
>There are other schemas that could be used too, for example the
528 dnszone structural object class used by Gosa and bind-sdb for the DNS
529 attributes combined with the domainrelatedobject object class, but in
530 this case some unused attributes would have to be included as well
531 (zonename and relativedomainname).
</p
>
533 <p
>My proposal for Debian Edu would be to switch PowerDNS to strict
534 mode and not use any of the existing objectclasses (dnsdomain,
535 dnsdomain2 and dnszone) when one want to combine the DNS information
536 with DHCP information, and instead create a auxiliary object class
537 defined something like this (using the attributes defined for
538 dnsdomain and dnsdomain2 or dnszone):
</p
>
540 <blockquote
><pre
>
541 objectclass ( some-oid NAME
'dnsDomainAux
'
544 MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
545 DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
546 TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
547 NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
548 A6Record $ DNAMERecord
550 </pre
></blockquote
>
552 <p
>This will allow any object to become a DNS entry when combined with
553 the domainrelatedobject object class, and allow any entity to include
554 all the attributes PowerDNS wants. I
've sent an email to the PowerDNS
555 developers asking for their view on this schema and if they are
556 interested in providing such schema with PowerDNS, and I hope my
557 message will be accepted into their mailing list soon.
</p
>
559 <p
><strong
>ISC dhcp
</strong
></p
>
561 <p
>The DHCP server searches for specific objectclass and requests all
562 the object attributes, and then uses the attributes it want. This
563 make it harder to figure out exactly what attributes are used, but
564 thanks to the working example in Debian Edu I can at least get an idea
565 what is needed without having to read the source code.
</p
>
567 <p
>In the DHCP server configuration, the LDAP base to use and the
568 search filter to use to locate the correct dhcpServer entity is
569 stored. These are the relevant entries from
570 /etc/dhcp3/dhcpd.conf:
</p
>
572 <blockquote
><pre
>
573 ldap-base-dn
"dc=skole,dc=skolelinux,dc=no
";
574 ldap-dhcp-server-cn
"dhcp
";
575 </pre
></blockquote
>
577 <p
>The DHCP server uses this information to nest all the DHCP
578 configuration it need. The cn
"dhcp
" is located using the given LDAP
579 base and the filter
"(
&(objectClass=dhcpServer)(cn=dhcp))
". The
580 search result is this entry:
</p
>
582 <blockquote
><pre
>
583 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
586 objectClass: dhcpServer
587 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
588 </pre
></blockquote
>
590 <p
>The content of the dhcpServiceDN attribute is next used to locate the
591 subtree with DHCP configuration. The DHCP configuration subtree base
592 is located using a base scope search with base
"cn=DHCP
593 Config,dc=skole,dc=skolelinux,dc=no
" and filter
594 "(
&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))
".
595 The search result is this entry:
</p
>
597 <blockquote
><pre
>
598 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
601 objectClass: dhcpService
602 objectClass: dhcpOptions
603 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
604 dhcpStatements: ddns-update-style none
605 dhcpStatements: authoritative
606 dhcpOption: smtp-server code
69 = array of ip-address
607 dhcpOption: www-server code
72 = array of ip-address
608 dhcpOption: wpad-url code
252 = text
609 </pre
></blockquote
>
611 <p
>Next, the entire subtree is processed, one level at the time. When
612 all the DHCP configuration is loaded, it is ready to receive requests.
613 The subtree in Debian Edu contain objects with object classes
614 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
615 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost. These provide options
616 and information about netmasks, dynamic range etc. Leaving out the
617 details here because it is not relevant for the focus of my
618 investigation, which is to see if it is possible to merge dns and dhcp
619 related computer objects.
</p
>
621 <p
>When a DHCP request come in, LDAP is searched for the MAC address
622 of the client (
00:
00:
00:
00:
00:
00 in this example), using a subtree
623 scoped search with
"cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
" as
624 the base and
"(
&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
625 00:
00:
00:
00:
00:
00))
" as the filter. This is what a host object look
628 <blockquote
><pre
>
629 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
632 objectClass: dhcpHost
633 dhcpHWAddress: ethernet
00:
00:
00:
00:
00:
00
634 dhcpStatements: fixed-address hostname
635 </pre
></blockquote
>
637 <p
>There is less flexiblity in the way LDAP searches are done here.
638 The object classes need to have fixed names, and the configuration
639 need to be stored in a fairly specific LDAP structure. On the
640 positive side, the invidiual dhcpHost entires can be anywhere without
641 the DN pointed to by the dhcpServer entries. The latter should make
642 it possible to group all host entries in a subtree next to the
643 configuration entries, and this subtree can also be shared with the
644 DNS server if the schema proposed above is combined with the dhcpHost
645 structural object class.
647 <p
><strong
>Conclusion
</strong
></p
>
649 <p
>The PowerDNS implementation seem to be very flexible when it come
650 to which LDAP schemas to use. While its
"tree
" mode is rigid when it
651 come to the the LDAP structure, the
"strict
" mode is very flexible,
652 allowing DNS objects to be stored anywhere under the base cn specified
653 in the configuration.
</p
>
655 <p
>The DHCP implementation on the other hand is very inflexible, both
656 regarding which LDAP schemas to use and which LDAP structure to use.
657 I guess one could implement ones own schema, as long as the
658 objectclasses and attributes have the names used, but this do not
659 really help when the DHCP subtree need to have a fairly fixed
662 <p
>Based on the observed behaviour, I suspect a LDAP structure like
663 this might work for Debian Edu:
</p
>
665 <blockquote
><pre
>
667 cn=machine-info (dhcpService) - dhcpServiceDN points here
669 cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
670 cn=
10.0.2.0 (dhcpSubnet)
671 cn=group1 (dhcpGroup/dhcpOptions)
672 cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
673 cn=
192.168.0.0 (dhcpSubnet)
674 cn=group1 (dhcpGroup/dhcpOptions)
675 ou=machines - PowerDNS base points here
676 cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
677 </pre
></blockquote
>
679 <P
>This is not tested yet. If the DHCP server require the dhcpHost
680 entries to be in the dhcpGroup subtrees, the entries can be stored
681 there instead of a common machines subtree, and the PowerDNS base
682 would have to be moved one level up to the machine-info subtree.
</p
>
684 <p
>The combined object under the machines subtree would look something
687 <blockquote
><pre
>
688 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
691 objectClass: dhcpHost
692 objectclass: domainrelatedobject
693 objectclass: dnsDomainAux
694 associateddomain: hostname.intern
696 dhcpHWAddress: ethernet
00:
00:
00:
00:
00:
00
697 dhcpStatements: fixed-address hostname.intern
698 </pre
></blockquote
>
700 </p
>One could even add the LTSP configuration associated with a given
701 machine, as long as the required attributes are available in a
702 auxiliary object class.
</p
>
707 <title>Combining PowerDNS and ISC DHCP LDAP objects
</title>
708 <link>http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html
</link>
709 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html
</guid>
710 <pubDate>Wed,
14 Jul
2010 23:
45:
00 +
0200</pubDate>
712 <p
>For a while now, I have wanted to find a way to change the DNS and
713 DHCP services in Debian Edu to use the same LDAP objects for a given
714 computer, to avoid the possibility of having a inconsistent state for
715 a computer in LDAP (as in DHCP but no DNS entry or the other way
716 around) and make it easier to add computers to LDAP.
</p
>
718 <p
>I
've looked at how powerdns and dhcpd is using LDAP, and using this
719 information finally found a solution that seem to work.
</p
>
721 <p
>The old setup required three LDAP objects for a given computer.
722 One forward DNS entry, one reverse DNS entry and one DHCP entry. If
723 we switch powerdns to use its strict LDAP method (ldap-method=strict
724 in pdns-debian-edu.conf), the forward and reverse DNS entries are
725 merged into one while making it impossible to transfer the reverse map
726 to a slave DNS server.
</p
>
728 <p
>If we also replace the object class used to get the DNS related
729 attributes to one allowing these attributes to be combined with the
730 dhcphost object class, we can merge the DNS and DHCP entries into one.
731 I
've written such object class in the dnsdomainaux.schema file (need
732 proper OIDs, but that is a minor issue), and tested the setup. It
733 seem to work.
</p
>
735 <p
>With this test setup in place, we can get away with one LDAP object
736 for both DNS and DHCP, and even the LTSP configuration I suggested in
737 an earlier email. The combined LDAP object will look something like
740 <blockquote
><pre
>
741 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
743 objectClass: dhcphost
744 objectclass: domainrelatedobject
745 objectclass: dnsdomainaux
746 associateddomain: hostname.intern
748 dhcphwaddress: ethernet
00:
00:
00:
00:
00:
00
749 dhcpstatements: fixed-address hostname
751 </pre
></blockquote
>
753 <p
>The DNS server uses the associateddomain and arecord entries, while
754 the DHCP server uses the dhcphwaddress and dhcpstatements entries
755 before asking DNS to resolve the fixed-adddress. LTSP will use
756 dhcphwaddress or associateddomain and the ldapconfig* attributes.
</p
>
758 <p
>I am not yet sure if I can get the DHCP server to look for its
759 dhcphost in a different location, to allow us to put the objects
760 outside the
"DHCP Config
" subtree, but hope to figure out a way to do
761 that. If I can
't figure out a way to do that, we can still get rid of
762 the hosts subtree and move all its content into the DHCP Config tree
763 (which probably should be renamed to be more related to the new
764 content. I suspect cn=dnsdhcp,ou=services or something like that
765 might be a good place to put it.
</p
>
767 <p
>If you want to help out with implementing this for Debian Edu,
768 please contact us on debian-edu@lists.debian.org.
</p
>
773 <title>Idea for storing LTSP configuration in LDAP
</title>
774 <link>http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html
</link>
775 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html
</guid>
776 <pubDate>Sun,
11 Jul
2010 22:
00:
00 +
0200</pubDate>
778 <p
>Vagrant mentioned on IRC today that ltsp_config now support
779 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
780 clients, and that this can be used to fetch configuration from LDAP if
781 Debian Edu choose to store configuration there.
</p
>
783 <p
>Armed with this information, I got inspired and wrote a test module
784 to get configuration from LDAP. The idea is to look up the MAC
785 address of the client in LDAP, and look for attributes on the form
786 ltspconfigsetting=value, and use this to export SETTING=value to the
787 LTSP clients.
</p
>
789 <p
>The goal is to be able to store the LTSP configuration attributes
790 in a
"computer
" LDAP object used by both DNS and DHCP, and thus
791 allowing us to store all information about a computer in one place.
</p
>
793 <p
>This is a untested draft implementation, and I welcome feedback on
794 this approach. A real LDAP schema for the ltspClientAux objectclass
795 need to be written. Comments, suggestions, etc?
</p
>
797 <blockquote
><pre
>
798 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
800 # Fetch LTSP client settings from LDAP based on MAC address
802 # Uses ethernet address as stored in the dhcpHost objectclass using
803 # the dhcpHWAddress attribute or ethernet address stored in the
804 # ieee802Device objectclass with the macAddress attribute.
806 # This module is written to be schema agnostic, and only depend on the
807 # existence of attribute names.
809 # The LTSP configuration variables are saved directly using a
810 # ltspConfig prefix and uppercasing the rest of the attribute name.
811 # To set the SERVER variable, set the ltspConfigServer attribute.
813 # Some LDAP schema should be created with all the relevant
814 # configuration settings. Something like this should work:
816 # objectclass (
1.1.2.2 NAME
'ltspClientAux
'
819 # MAY ( ltspConfigServer $ ltsConfigSound $ ... )
821 LDAPSERVER=$(debian-edu-ldapserver)
822 if [
"$LDAPSERVER
" ] ; then
823 LDAPBASE=$(debian-edu-ldapserver -b)
824 for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk
'{print $
5}
'|sort -u) ; do
825 filter=
"(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))
"
826 ldapsearch -h
"$LDAPSERVER
" -b
"$LDAPBASE
" -v -x
"$filter
" | \
827 grep
'^ltspConfig
' | while read attr value ; do
828 # Remove prefix and convert to upper case
829 attr=$(echo $attr | sed
's/^ltspConfig//i
' | tr a-z A-Z)
830 # bass value on to clients
831 eval
"$attr=$value; export $attr
"
835 </pre
></blockquote
>
837 <p
>I
'm not sure this shell construction will work, because I suspect
838 the while block might end up in a subshell causing the variables set
839 there to not show up in ltsp-config, but if that is the case I am sure
840 the code can be restructured to make sure the variables are passed on.
841 I expect that can be solved with some testing. :)
</p
>
843 <p
>If you want to help out with implementing this for Debian Edu,
844 please contact us on debian-edu@lists.debian.org.
</p
>
846 <p
>Update
2010-
07-
17: I am aware of another effort to store LTSP
847 configuration in LDAP that was created around year
2000 by
848 <a href=
"http://www.pcxperience.com/thinclient/documentation/ldap.html
">PC
849 Xperience, Inc.,
2000</a
>. I found its
850 <a href=
"http://people.redhat.com/alikins/ltsp/ldap/
">files
</a
> on a
851 personal home page over at redhat.com.
</p
>
projects / homepage.git / blob