blog/tags/english/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen: Entries Tagged english</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="english.rss" type="application/rss+xml">
   8  </head>
   9  <body>
  10
  11  <div class="title">
  12   <h1>
  13        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  14
  15   </h1>
  16
  17  </div>
  18
  19  <p>Entries tagged "english".</p>
  20
  21
  22
  23
  24 <div class="entry">
  25  <div class="title">
  26  <a href="http://people.skolelinux.org/pere/blog/The_sorry_state_of_multimedia_browser_plugins_in_Debian.html">The sorry state of multimedia browser plugins in Debian</a>
  27  </div>
  28  <div class="date">
  29   2008-11-25 00:10
  30  </div>
  31
  32  <div class="body">
  33
  34 <p>Recently I have spent some time evaluating the multimedia browser
  35 plugins available in Debian Lenny, to see which one we should use by
  36 default in Debian Edu.  We need an embedded video playing plugin with
  37 control buttons to pause or stop the video, and capable of streaming
  38 all the multimedia content available on the web.  The test results and
  39 notes are available on
  40 <a href="http://wiki.debian.org/DebianEdu/BrowserMultimedia">the
  41 Debian wiki</a>.  I was surprised how few of the plugins are able to
  42 fill this need.  My personal video player favorite, VLC, has a really
  43 bad plugin which fail on a lot of the test pages.  A lot of the MIME
  44 types I would expect to work with any free software player (like
  45 video/ogg), just do not work.  And simple formats like the
  46 audio/x-mplegurl format (m3u playlists), just isn't supported by the
  47 totem and vlc plugins.  I hope the situation will improve soon.  No
  48 wonder sites use the proprietary Adobe flash to play video.</p>
  49
  50 <p>For Lenny, we seem to end up with the mplayer plugin.  It seem to
  51 be the only one fitting our needs. :/</p>
  52
  53  </div>
  54  <div class="tags">
  55
  56
  57
  58   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
  59
  60  </div>
  61 </div>
  62 <div class="padding"></div>
  63
  64 <div class="entry">
  65  <div class="title">
  66  <a href="http://people.skolelinux.org/pere/blog/Devcamp_brought_us_closer_to_the_Lenny_based_Debian_Edu_release.html">Devcamp brought us closer to the Lenny based Debian Edu release</a>
  67  </div>
  68  <div class="date">
  69   2008-12-07 12:00
  70  </div>
  71
  72  <div class="body">
  73
  74 <p>This weekend we had a small developer gathering for Debian Edu in
  75 Oslo.  Most of Saturday was used for the general assemly for the
  76 member organization, but the rest of the weekend I used to tune the
  77 LTSP installation.  LTSP now work out of the box on the 10-network.
  78 Acer Aspire One proved to be a very nice thin client, with both
  79 screen, mouse and keybard in a small box.  Was working on getting the
  80 diskless workstation setup configured out of the box, but did not
  81 finish it before the weekend was up.</p>
  82
  83 <p>Did not find time to look at the 4 VGA cards in one box we got from
  84 the Brazilian group, so that will have to wait for the next
  85 development gathering.  Would love to have the Debian Edu installer
  86 automatically detect and configure a multiseat setup when it find one
  87 of these cards.</p>
  88
  89  </div>
  90  <div class="tags">
  91
  92
  93
  94   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp</a>.
  95
  96  </div>
  97 </div>
  98 <div class="padding"></div>
  99
 100 <div class="entry">
 101  <div class="title">
 102  <a href="http://people.skolelinux.org/pere/blog/Software_video_mixer_on_a_USB_stick.html">Software video mixer on a USB stick</a>
 103  </div>
 104  <div class="date">
 105   2008-12-28 15:40
 106  </div>
 107
 108  <div class="body">
 109
 110 <p>The <a href="http://www.nuug.no/">Norwegian Unix User Group</a> is
 111 recording our montly presentation on video, and recently we have
 112 worked on improving the quality of the recordings by mixing the slides
 113 directly with the video stream.  For this, we use the
 114 <a href="http://dvswitch.alioth.debian.org/">dvswitch</a> package from
 115 the Debian video team.  As this require quite one computer per video
 116 source, and NUUG do not have enough laptops available, we need to
 117 borrow laptops.  And to avoid having to install extra software on
 118 these borrwed laptops, I have wrapped up all the programs needed on a
 119 bootable USB stick.  The software required is dvswitch with assosiated
 120 source, sink and mixer applications and
 121 <a href="http://www.kinodv.org/">dvgrab</a>.  To allow this setup to
 122 work without any configuration, I've patched dvswitch to use
 123 <a href="http://www.avahi.org/">avahi</a> to connect the various parts
 124 together.  And to allow us to use laptops without firewire plugs, I
 125 upgraded dvgrab to the one from Debian/unstable to get one that work
 126 with USB sources.  We have not yet tested this setup in a production
 127 setup, but I hope it will work properly, and allow us to set up a
 128 video mixer in a very short time frame.  We will need it for
 129 <a href="http://www.goopen.no/">Go Open 2009</a>.</p>
 130
 131 <p><a href="http://www.nuug.no/pub/video/bin/usbstick-dvswitch.img.gz">The
 132 USB image</a> is for a 1 GB memory stick, but can be used on any
 133 larger stick as well.</p>
 134
 135  </div>
 136  <div class="tags">
 137
 138
 139
 140   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/video">video</a>.
 141
 142  </div>
 143 </div>
 144 <div class="padding"></div>
 145
 146 <div class="entry">
 147  <div class="title">
 148  <a href="http://people.skolelinux.org/pere/blog/When_web_browser_developers_make_a_video_player___.html">When web browser developers make a video player...</a>
 149  </div>
 150  <div class="date">
 151   2009-01-17 18:50
 152  </div>
 153
 154  <div class="body">
 155
 156 <p>As part of the work we do in <a href="http://www.nuug.no">NUUG</a>
 157 to publish video recordings of our monthly presentations, we provide a
 158 page with embedded video for easy access to the recording.  Putting a
 159 good set of HTML tags together to get working embedded video in all
 160 browsers and across all operating systems is not easy.  I hope this
 161 will become easier when the &lt;video&gt; tag is implemented in all
 162 browsers, but I am not sure.  We provide the recordings in several
 163 formats, MPEG1, Ogg Theora, H.264 and Quicktime, and want the
 164 browser/media plugin to pick one it support and use it to play the
 165 recording, using whatever embed mechanism the browser understand.
 166 There is at least four different tags to use for this, the new HTML5
 167 &lt;video&gt; tag, the &lt;object&gt; tag, the &lt;embed&gt; tag and
 168 the &lt;applet&gt; tag.  All of these take a lot of options, and
 169 finding the best options is a major challenge.</p>
 170
 171 <p>I just tested the experimental Opera browser available from <a
 172 href="http://labs.opera.com">labs.opera.com</a>, to see how it handled
 173 a &lt;video&gt; tag with a few video sources and no extra attributes.
 174 I was not very impressed.  The browser start by fetching a picture
 175 from the video stream.  Not sure if it is the first frame, but it is
 176 definitely very early in the recording.  So far, so good. Next,
 177 instead of streaming the 76 MiB video file, it start to download all
 178 of it, but do not start to play the video.  This mean I have to wait
 179 for several minutes for the downloading to finish.  When the download
 180 is done, the playing of the video do not start!  Waiting for the
 181 download, but I do not get to see the video?  Some testing later, I
 182 discover that I have to add the controls="true" attribute to be able
 183 to get a play button to pres to start the video.  Adding
 184 autoplay="true" did not help.  I sure hope this is a misfeature of the
 185 test version of Opera, and that future implementations of the
 186 &lt;video&gt; tag will stream recordings by default, or at least start
 187 playing when the download is done.</p>
 188
 189 <p>The test page I used (since changed to add more attributes) is
 190 <a href="http://www.nuug.no/aktiviteter/20090113-foredrag-om-foredrag/">available
 191 from the nuug site</a>.  Will have to test it with the new Firefox
 192 too.</p>
 193
 194 <p>In the test process, I discovered a missing feature.  I was unable
 195 to find a way to get the URL of the playing video out of Opera, so I
 196 am not quite sure it picked the Ogg Theora version of the video.  I
 197 sure hope it was using the announced Ogg Theora support. :)</p>
 198
 199  </div>
 200  <div class="tags">
 201
 202
 203
 204   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/video">video</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 205
 206  </div>
 207 </div>
 208 <div class="padding"></div>
 209
 210 <div class="entry">
 211  <div class="title">
 212  <a href="http://people.skolelinux.org/pere/blog/Using_bar_codes_at_a_computing_center.html">Using bar codes at a computing center</a>
 213  </div>
 214  <div class="date">
 215   2009-02-20 08:50
 216  </div>
 217
 218  <div class="body">
 219
 220 <p>At work with the University of Oslo, we have several hundred computers
 221 in our computing center.  This give us a challenge in tracking the
 222 location and cabling of the computers, when they are added, moved and
 223 removed.  Some times the location register is not updated when a
 224 computer is inserted or moved and we then have to search the room for
 225 the "missing" computer.</p>
 226
 227 <p>In the last issue of Linux Journal, I came across a project
 228 <a href="http://www.libdmtx.org/">libdmtx</a> to write and read bar
 229 code blocks as defined in the
 230 <a href="http://en.wikipedia.org/wiki/Data_Matrix">The Data Matrix
 231 Standard</a>.  This is bar codes that can be read with a normal
 232 digital camera, for example that on a cell phone, and several such bar
 233 codes can be read by libdmtx from one picture.  The bar code standard
 234 allow up to 2 KiB to be written in the tag.  There is another project
 235 with <a href="http://www.terryburton.co.uk/barcodewriter/">a bar code
 236 writer written in postscript</a> capable of creating such bar codes,
 237 but this was the first time I found a tool to read these bar
 238 codes.</p>
 239
 240 <p>It occurred to me that this could be used to tag and track the
 241 machines in our computing center.  If both racks and computers are
 242 tagged this way, we can use a picture of the rack and all its
 243 computers to detect the rack location of any computer in that rack.
 244 If we do this regularly for the entire room, we will find all
 245 locations, and can detect movements and removals.</p>
 246
 247 <p>I decided to test if this would work in practice, and picked a
 248 random rack and tagged all the machines with their names.  Next, I
 249 took pictures with my digital camera, and gave the dmtxread program
 250 these JPEG pictures to see how many tags it could read.  This worked
 251 fairly well.  If the pictures was well focused and not taken from the
 252 side, all tags in the image could be read.  Because of limited space
 253 between the racks, I was unable to get a good picture of the entire
 254 rack, but could without problem read all tags from a picture covering
 255 about half the rack.  I had to limit the search time used by dmtxread
 256 to 60000 ms to make sure it terminated in a reasonable time frame.</p>
 257
 258 <p>My conclusion is that this could work, and we should probably look
 259 at adjusting our computer tagging procedures to use bar codes for
 260 easier automatic tracking of computers.</p>
 261
 262  </div>
 263  <div class="tags">
 264
 265
 266
 267   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 268
 269  </div>
 270 </div>
 271 <div class="padding"></div>
 272
 273 <div class="entry">
 274  <div class="title">
 275  <a href="http://people.skolelinux.org/pere/blog/Checking_server_hardware_support_status_for_Dell__HP_and_IBM_servers.html">Checking server hardware support status for Dell, HP and IBM servers</a>
 276  </div>
 277  <div class="date">
 278   2009-02-28 23:50
 279  </div>
 280
 281  <div class="body">
 282
 283 <p>At work, we have a few hundred Linux servers, and with that amount
 284 of hardware it is important to keep track of when the hardware support
 285 contract expire for each server.  We have a machine (and service)
 286 register, which until recently did not contain much useful besides the
 287 machine room location and contact information for the system owner for
 288 each machine.  To make it easier for us to track support contract
 289 status, I've recently spent time on extending the machine register to
 290 include information about when the support contract expire, and to tag
 291 machines with expired contracts to make it easy to get a list of such
 292 machines.  I extended a perl script already being used to import
 293 information about machines into the register, to also do some screen
 294 scraping off the sites of Dell, HP and IBM (our majority of machines
 295 are from these vendors), and automatically check the support status
 296 for the relevant machines.  This make the support status information
 297 easily available and I hope it will make it easier for the computer
 298 owner to know when to get new hardware or renew the support contract.
 299 The result of this work documented that 27% of the machines in the
 300 registry is without a support contract, and made it very easy to find
 301 them.  27% might seem like a lot, but I see it more as the case of us
 302 using machines a bit longer than the 3 years a normal support contract
 303 last, to have test machines and a platform for less important
 304 services.  After all, the machines without a contract are working fine
 305 at the moment and the lack of contract is only a problem if any of
 306 them break down.  When that happen, we can either fix it using spare
 307 parts from other machines or move the service to another old
 308 machine.</p>
 309
 310 <p>I believe the code for screen scraping the Dell site was originally
 311 written by Trond Hasle Amundsen, and later adjusted by me and Morten
 312 Werner Forsbring.  The HP scraping was written by me after reading a
 313 nice article in ;login: about how to use WWW::Mechanize, and the IBM
 314 scraping was written by me based on the Dell code.  I know the HTML
 315 parsing could be done using nice libraries, but did not want to
 316 introduce more dependencies.  This is the current incarnation:</p>
 317
 318 <pre>
 319 use LWP::Simple;
 320 use POSIX;
 321 use WWW::Mechanize;
 322 use Date::Parse;
 323 [...]
 324 sub get_support_info {
 325     my ($machine, $model, $serial, $productnumber) = @_;
 326     my $str;
 327
 328     if ( $model =~ m/^Dell / ) {
 329         # fetch website from Dell support
 330         my $url = "http://support.euro.dell.com/support/topics/topic.aspx/emea/shared/support/my_systems_info/no/details?c=no&amp;cs=nodhs1&amp;l=no&amp;s=dhs&amp;ServiceTag=$serial";
 331         my $webpage = get($url);
 332         return undef unless ($webpage);
 333
 334         my $daysleft = -1;
 335         my @lines = split(/\n/, $webpage);
 336         foreach my $line (@lines) {
 337             next unless ($line =~ m/Beskrivelse/);
 338             $line =~ s/&lt;[^>]+?>/;/gm;
 339             $line =~ s/^.+?;(Beskrivelse;)/$1/;
 340
 341             my @f = split(/\;/, $line);
 342             @f = @f[13 .. $#f];
 343             my $lastend = "";
 344             while ($f[3] eq "DELL") {
 345                 my ($type, $startstr, $endstr, $days) = @f[0, 5, 7, 10];
 346
 347                 my $start = POSIX::strftime("%Y-%m-%d",
 348                                             localtime(str2time($startstr)));
 349                 my $end = POSIX::strftime("%Y-%m-%d",
 350                                           localtime(str2time($endstr)));
 351                 $str .= "$type $start -> $end ";
 352                 @f = @f[14 .. $#f];
 353                 $lastend = $end if ($end gt $lastend);
 354             }
 355             my $today = POSIX::strftime("%Y-%m-%d", localtime(time));
 356             tag_machine_unsupported($machine)
 357                 if ($lastend lt $today);
 358         }
 359     } elsif ( $model =~ m/^HP / ) {
 360         my $mech = WWW::Mechanize->new();
 361         my $url =
 362             'http://www1.itrc.hp.com/service/ewarranty/warrantyInput.do';
 363         $mech->get($url);
 364         my $fields = {
 365             'BODServiceID' => 'NA',
 366             'RegisteredPurchaseDate' => '',
 367             'country' => 'NO',
 368             'productNumber' => $productnumber,
 369             'serialNumber1' => $serial,
 370         };
 371         $mech->submit_form( form_number => 2,
 372                             fields      => $fields );
 373         # Next step is screen scraping
 374         my $content = $mech->content();
 375
 376         $content =~ s/&lt;[^>]+?>/;/gm;
 377         $content =~ s/\s+/ /gm;
 378         $content =~ s/;\s*;/;;/gm;
 379         $content =~ s/;[\s;]+/;/gm;
 380
 381         my $today = POSIX::strftime("%Y-%m-%d", localtime(time));
 382
 383         while ($content =~ m/;Warranty Type;/) {
 384             my ($type, $status, $startstr, $stopstr) = $content =~
 385                 m/;Warranty Type;([^;]+);.+?;Status;(\w+);Start Date;([^;]+);End Date;([^;]+);/;
 386             $content =~ s/^.+?;Warranty Type;//;
 387             my $start = POSIX::strftime("%Y-%m-%d",
 388                                         localtime(str2time($startstr)));
 389             my $end = POSIX::strftime("%Y-%m-%d",
 390                                       localtime(str2time($stopstr)));
 391
 392             $str .= "$type ($status) $start -> $end ";
 393
 394             tag_machine_unsupported($machine)
 395                 if ($end lt $today);
 396         }
 397     } elsif ( $model =~ m/^IBM / ) {
 398         # This code ignore extended support contracts.
 399         my ($producttype) = $model =~ m/.*-\[(.{4}).+\]-/;
 400         if ($producttype &amp;&amp; $serial) {
 401             my $content =
 402                 get("http://www-947.ibm.com/systems/support/supportsite.wss/warranty?action=warranty&amp;brandind=5000008&amp;Submit=Submit&amp;type=$producttype&amp;serial=$serial");
 403             if ($content) {
 404                 $content =~ s/&lt;[^>]+?>/;/gm;
 405                 $content =~ s/\s+/ /gm;
 406                 $content =~ s/;\s*;/;;/gm;
 407                 $content =~ s/;[\s;]+/;/gm;
 408
 409                 $content =~ s/^.+?;Warranty status;//;
 410                 my ($status, $end) = $content =~ m/;Warranty status;([^;]+)\s*;Expiration date;(\S+) ;/;
 411
 412                 $str .= "($status) -> $end ";
 413
 414                 my $today = POSIX::strftime("%Y-%m-%d", localtime(time));
 415                 tag_machine_unsupported($machine)
 416                     if ($end lt $today);
 417             }
 418         }
 419     }
 420     return $str;
 421 }
 422 </pre>
 423
 424 <p>Here are some examples on how to use the function, using fake
 425 serial numbers.  The information passed in as arguments are fetched
 426 from dmidecode.</p>
 427
 428 <pre>
 429 print get_support_info("hp.host", "HP ProLiant BL460c G1", "1234567890"
 430                        "447707-B21");
 431 print get_support_info("dell.host", "Dell Inc. PowerEdge 2950", "1234567");
 432 print get_support_info("ibm.host", "IBM eserver xSeries 345 -[867061X]-",
 433                        "1234567");
 434 </pre>
 435
 436 <p>I would recommend this approach for tracking support contracts for
 437 everyone with more than a few computers to administer. :)</p>
 438
 439 <p>Update 2009-03-06: The IBM page do not include extended support
 440 contracts, so it is useless in that case.  The original Dell code do
 441 not handle extended support contracts either, but has been updated to
 442 do so.</p>
 443
 444  </div>
 445  <div class="tags">
 446
 447
 448
 449   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 450
 451  </div>
 452 </div>
 453 <div class="padding"></div>
 454
 455 <div class="entry">
 456  <div class="title">
 457  <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">Time for new  LDAP schemas replacing RFC 2307?</a>
 458  </div>
 459  <div class="date">
 460   2009-03-29 20:30
 461  </div>
 462
 463  <div class="body">
 464
 465 <p>The state of standardized LDAP schemas on Linux is far from
 466 optimal.  There is RFC 2307 documenting one way to store NIS maps in
 467 LDAP, and a modified version of this normally called RFC 2307bis, with
 468 some modifications to be compatible with Active Directory.  The RFC
 469 specification handle the content of a lot of system databases, but do
 470 not handle DNS zones and DHCP configuration.</p>
 471
 472 <p>In <a href="http://www.skolelinux.org/">Debian Edu/Skolelinux</a>,
 473 we would like to store information about users, SMB clients/hosts,
 474 filegroups, netgroups (users and hosts), DHCP and DNS configuration,
 475 and LTSP configuration in LDAP.  These objects have a lot in common,
 476 but with the current LDAP schemas it is not possible to have one
 477 object per entity.  For example, one need to have at least three LDAP
 478 objects for a given computer, one with the SMB related stuff, one with
 479 DNS information and another with DHCP information.  The schemas
 480 provided for DNS and DHCP are impossible to combine into one LDAP
 481 object.  In addition, it is impossible to implement quick queries for
 482 netgroup membership, because of the way NIS triples are implemented.
 483 It just do not scale.  I believe it is time for a few RFC
 484 specifications to cleam up this mess.</p>
 485
 486 <p>I would like to have one LDAP object representing each computer in
 487 the network, and this object can then keep the SMB (ie host key), DHCP
 488 (mac address/name) and DNS (name/IP address) settings in one place.
 489 It need to be efficently stored to make sure it scale well.</p>
 490
 491 <p>I would also like to have a quick way to map from a user or
 492 computer and to the net group this user or computer is a member.</p>
 493
 494 <p>Active Directory have done a better job than unix heads like myself
 495 in this regard, and the unix side need to catch up.  Time to start a
 496 new IETF work group?</p>
 497
 498  </div>
 499  <div class="tags">
 500
 501
 502
 503   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 504
 505  </div>
 506 </div>
 507 <div class="padding"></div>
 508
 509 <div class="entry">
 510  <div class="title">
 511  <a href="http://people.skolelinux.org/pere/blog/Returning_from_Skolelinux_developer_gathering.html">Returning from Skolelinux developer gathering</a>
 512  </div>
 513  <div class="date">
 514   2009-03-29 21:00
 515  </div>
 516
 517  <div class="body">
 518
 519 <p>I'm sitting on the train going home from this weekends Debian
 520 Edu/Skolelinux development gathering.  I got a bit done tuning the
 521 desktop, and looked into the dynamic service location protocol
 522 implementation avahi.  It look like it could be useful for us.  Almost
 523 30 people participated, and I believe it was a great environment to
 524 get to know the Skolelinux system.  Walter Bender, involved in the
 525 development of the Sugar educational platform, presented his stuff and
 526 also helped me improve my OLPC installation.  He also showed me that
 527 his Turtle Art application can be used in standalone mode, and we
 528 agreed that I would help getting it packaged for Debian.  As a
 529 standalone application it would be great for Debian Edu.  We also
 530 tried to get the video conferencing working with two OLPCs, but that
 531 proved to be too hard for us.  The application seem to need more work
 532 before it is ready for me.  I look forward to getting home and relax
 533 now. :)</p>
 534
 535  </div>
 536  <div class="tags">
 537
 538
 539
 540   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 541
 542  </div>
 543 </div>
 544 <div class="padding"></div>
 545
 546 <div class="entry">
 547  <div class="title">
 548  <a href="http://people.skolelinux.org/pere/blog/Standardize_on_protocols_and_formats__not_vendors_and_applications.html">Standardize on protocols and formats, not vendors and applications</a>
 549  </div>
 550  <div class="date">
 551   2009-03-30 11:50
 552  </div>
 553
 554  <div class="body">
 555
 556 <p>Where I work at the University of Oslo, one decision stand out as a
 557 very good one to form a long lived computer infrastructure.  It is the
 558 simple one, lost by many in todays computer industry: Standardize on
 559 open network protocols and open exchange/storage formats, not applications.
 560 Applications come and go, while protocols and files tend to stay, and
 561 thus one want to make it easy to change application and vendor, while
 562 avoiding conversion costs and locking users to a specific platform or
 563 application.</p>
 564
 565 <p>This approach make it possible to replace the client applications
 566 independently of the server applications.  One can even allow users to
 567 use several different applications as long as they handle the selected
 568 protocol and format.  In the normal case, only one client application
 569 is recommended and users only get help if they choose to use this
 570 application, but those that want to deviate from the easy path are not
 571 blocked from doing so.</p>
 572
 573 <p>It also allow us to replace the server side without forcing the
 574 users to replace their applications, and thus allow us to select the
 575 best server implementation at any moment, when scale and resouce
 576 requirements change.</p>
 577
 578 <p>I strongly recommend standardizing - on open network protocols and
 579 open formats, but I would never recommend standardizing on a single
 580 application that do not use open network protocol or open formats.</p>
 581
 582  </div>
 583  <div class="tags">
 584
 585
 586
 587   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/standard">standard</a>.
 588
 589  </div>
 590 </div>
 591 <div class="padding"></div>
 592
 593 <div class="entry">
 594  <div class="title">
 595  <a href="http://people.skolelinux.org/pere/blog/Recording_video_from_cron_using_VLC.html">Recording video from cron using VLC</a>
 596  </div>
 597  <div class="date">
 598   2009-04-05 10:00
 599  </div>
 600
 601  <div class="body">
 602
 603 <p>One think I have wanted to figure out for a along time is how to
 604 run vlc from cron to do recording of video streams on the net.  The
 605 task is trivial with mplayer, but I do not really trust the security
 606 of mplayer (it crashes too often on strange input), and thus prefer
 607 vlc.  I finally found a way to do it today.  I spent an hour or so
 608 searching the web for recipes and reading the documentation.  The
 609 hardest part was to get rid of the GUI window, but after finding the
 610 dummy interface, the command line finally presented itself:</p>
 611
 612 <blockquote><pre>URL=http://www.ping.uio.no/video/rms-oslo_2009.ogg
 613 SAVEFILE=rms.ogg
 614 DISPLAY= vlc -q $URL \
 615   --sout="#duplicate{dst=std{access=file,url='$SAVEFILE'},dst=nodisplay}" \
 616   --intf=dummy</pre></blockquote>
 617
 618 <p>The command stream the URL and store it in the SAVEFILE by
 619 duplicating the output stream to "nodisplay" and the file, using the
 620 dummy interface.  The dummy interface and the nodisplay output make
 621 sure no X interface is needed.</p>
 622
 623 <p>The cron job then need to start this job with the appropriate URL
 624 and file name to save, sleep for the duration wanted, and then kill
 625 the vlc process with SIGTERM.  Here is a complete script
 626 <tt>vlc-record</tt> to use from <tt>at</tt> or <tt>cron</tt>:</p>
 627
 628 <blockquote><pre>#!/bin/sh
 629 set -e
 630 URL="$1"
 631 SAVEFILE="$2"
 632 DURATION="$3"
 633 DISPLAY= vlc -q "$URL" \
 634   --sout="#duplicate{dst=std{access=file,url='$SAVEFILE'},dst=nodisplay}" \
 635   --intf=dummy < /dev/null > /dev/null 2>&1 &
 636 pid=$!
 637 sleep $DURATION
 638 kill $pid
 639 wait $pid</pre></blockquote>
 640
 641  </div>
 642  <div class="tags">
 643
 644
 645
 646   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/video">video</a>.
 647
 648  </div>
 649 </div>
 650 <div class="padding"></div>
 651
 652 <div class="entry">
 653  <div class="title">
 654  <a href="http://people.skolelinux.org/pere/blog/No_patch_is_not_better_than_a_useless_patch.html">No patch is not better than a useless patch</a>
 655  </div>
 656  <div class="date">
 657   2009-04-28 09:30
 658  </div>
 659
 660  <div class="body">
 661
 662 <p>Julien Blache
 663 <a href="http://blog.technologeek.org/2009/04/12/214">claim that no
 664 patch is better than a useless patch</a>.  I completely disagree, as a
 665 patch allow one to discuss a concrete and proposed solution, and also
 666 prove that the issue at hand is important enough for someone to spent
 667 time on fixing it.  No patch do not provide any of these positive
 668 properties.</p>
 669
 670  </div>
 671  <div class="tags">
 672
 673
 674
 675   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 676
 677  </div>
 678 </div>
 679 <div class="padding"></div>
 680
 681 <div class="entry">
 682  <div class="title">
 683  <a href="http://people.skolelinux.org/pere/blog/Two_projects_that_have_improved_the_quality_of_free_software_a_lot.html">Two projects that have improved the quality of free software a lot</a>
 684  </div>
 685  <div class="date">
 686   2009-05-02 15:00
 687  </div>
 688
 689  <div class="body">
 690
 691 <p>There are two software projects that have had huge influence on the
 692 quality of free software, and I wanted to mention both in case someone
 693 do not yet know them.</p>
 694
 695 <p>The first one is <a href="http://valgrind.org/">valgrind</a>, a
 696 tool to detect and expose errors in the memory handling of programs.
 697 It is easy to use, all one need to do is to run 'valgrind program',
 698 and it will report any problems on stdout.  It is even better if the
 699 program include debug information.  With debug information, it is able
 700 to report the source file name and line number where the problem
 701 occurs.  It can report things like 'reading past memory block in file
 702 X line N, the memory block was allocated in file Y, line M', and
 703 'using uninitialised value in control logic'.  This tool has made it
 704 trivial to investigate reproducible crash bugs in programs, and have
 705 reduced the number of this kind of bugs in free software a lot.
 706
 707 <p>The second one is
 708 <a href="http://en.wikipedia.org/wiki/Coverity">Coverity</a> which is
 709 a source code checker.  It is able to process the source of a program
 710 and find problems in the logic without running the program.  It
 711 started out as the Stanford Checker and became well known when it was
 712 used to find bugs in the Linux kernel.  It is now a commercial tool
 713 and the company behind it is running
 714 <a href="http://www.scan.coverity.com/">a community service</a> for the
 715 free software community, where a lot of free software projects get
 716 their source checked for free.  Several thousand defects have been
 717 found and fixed so far.  It can find errors like 'lock L taken in file
 718 X line N is never released if exiting in line M', or 'the code in file
 719 Y lines O to P can never be executed'.  The projects included in the
 720 community service project have managed to get rid of a lot of
 721 reliability problems thanks to Coverity.</p>
 722
 723 <p>I believe tools like this, that are able to automatically find
 724 errors in the source, are vital to improve the quality of software and
 725 make sure we can get rid of the crashing and failing software we are
 726 surrounded by today.</p>
 727
 728  </div>
 729  <div class="tags">
 730
 731
 732
 733   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 734
 735  </div>
 736 </div>
 737 <div class="padding"></div>
 738
 739 <div class="entry">
 740  <div class="title">
 741  <a href="http://people.skolelinux.org/pere/blog/Debian_boots_quicker_and_quicker.html">Debian boots quicker and quicker</a>
 742  </div>
 743  <div class="date">
 744   2009-06-24 21:40
 745  </div>
 746
 747  <div class="body">
 748
 749 <p>I spent Monday and tuesday this week in London with a lot of the
 750 people involved in the boot system on Debian and Ubuntu, to see if we
 751 could find more ways to speed up the boot system.  This was an Ubuntu
 752 funded
 753 <a href="https://wiki.ubuntu.com/FoundationsTeam/BootPerformance/DebianUbuntuSprint">developer
 754 gathering</a>. It was quite productive.  We also discussed the future
 755 of boot systems, and ways to handle the increasing number of boot
 756 issues introduced by the Linux kernel becoming more and more
 757 asynchronous and event base.  The Ubuntu approach using udev and
 758 upstart might be a good way forward.  Time will show.</p>
 759
 760 <p>Anyway, there are a few ways at the moment to speed up the boot
 761 process in Debian.  All of these should be applied to get a quick
 762 boot:</p>
 763
 764 <ul>
 765
 766 <li>Use dash as /bin/sh.</li>
 767
 768 <li>Disable the init.d/hwclock*.sh scripts and make sure the hardware
 769    clock is in UTC.</li>
 770
 771 <li>Install and activate the insserv package to enable
 772    <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 773    based boot sequencing</a>, and enable concurrent booting.</li>
 774
 775 </ul>
 776
 777 These points are based on the Google summer of code work done by
 778 <a href="http://initscripts-ng.alioth.debian.org/soc2006-bootsystem/">Carlos
 779 Villegas</a>.
 780
 781 <p>Support for makefile-style concurrency during boot was uploaded to
 782 unstable yesterday.  When we tested it, we were able to cut 6 seconds
 783 from the boot sequence.  It depend on very correct dependency
 784 declaration in all init.d scripts, so I expect us to find edge cases
 785 where the dependences in some scripts are slightly wrong when we start
 786 using this.</p>
 787
 788 <p>On our IRC channel for this effort, #pkg-sysvinit, a new idea was
 789 introduced by Raphael Geissert today, one that could affect the
 790 startup speed as well.  Instead of starting some scripts concurrently
 791 from rcS.d/ and another set of scripts from rc2.d/, it would be
 792 possible to run a of them in the same process.  A quick way to test
 793 this would be to enable insserv and run 'mv /etc/rc2.d/S* /etc/rcS.d/;
 794 insserv'.  Will need to test if that work. :)</p>
 795
 796  </div>
 797  <div class="tags">
 798
 799
 800
 801   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 802
 803  </div>
 804 </div>
 805 <div class="padding"></div>
 806
 807 <div class="entry">
 808  <div class="title">
 809  <a href="http://people.skolelinux.org/pere/blog/Taking_over_sysvinit_development.html">Taking over sysvinit development</a>
 810  </div>
 811  <div class="date">
 812   2009-07-22 23:00
 813  </div>
 814
 815  <div class="body">
 816
 817 <p>After several years of frustration with the lack of activity from
 818 the existing sysvinit upstream developer, I decided a few weeks ago to
 819 take over the package and become the new upstream.  The number of
 820 patches to track for the Debian package was becoming a burden, and the
 821 lack of synchronization between the distribution made it hard to keep
 822 the package up to date.</p>
 823
 824 <p>On the new sysvinit team is the SuSe maintainer Dr. Werner Fink,
 825 and my Debian co-maintainer Kel Modderman.  About 10 days ago, I made
 826 a new upstream tarball with version number 2.87dsf (for Debian, SuSe
 827 and Fedora), based on the patches currently in use in these
 828 distributions.  We Debian maintainers plan to move to this tarball as
 829 the new upstream as soon as we find time to do the merge.  Since the
 830 new tarball was created, we agreed with Werner at SuSe to make a new
 831 upstream project at <a href="http://savannah.nongnu.org/">Savannah</a>, and continue
 832 development there.  The project is registered and currently waiting
 833 for approval by the Savannah administrators, and as soon as it is
 834 approved, we will import the old versions from svn and continue
 835 working on the future release.</p>
 836
 837 <p>It is a bit ironic that this is done now, when some of the involved
 838 distributions are moving to upstart as a syvinit replacement.</p>
 839
 840  </div>
 841  <div class="tags">
 842
 843
 844
 845   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 846
 847  </div>
 848 </div>
 849 <div class="padding"></div>
 850
 851 <div class="entry">
 852  <div class="title">
 853  <a href="http://people.skolelinux.org/pere/blog/Debian_has_switched_to_dependency_based_boot_sequencing.html">Debian has switched to dependency based boot sequencing</a>
 854  </div>
 855  <div class="date">
 856   2009-07-27 23:50
 857  </div>
 858
 859  <div class="body">
 860
 861 <p>Since this evening, with the upload of sysvinit version 2.87dsf-2,
 862 and the upload of insserv version 1.12.0-10 yesterday, Debian unstable
 863 have been migrated to using dependency based boot sequencing.  This
 864 conclude work me and others have been doing for the last three days.
 865 It feels great to see this finally part of the default Debian
 866 installation.  Now we just need to weed out the last few problems that
 867 are bound to show up, to get everything ready for Squeeze.</p>
 868
 869 <p>The next step is migrating /sbin/init from sysvinit to upstart, and
 870 fixing the more fundamental problem of handing the event based
 871 non-predictable kernel in the early boot.</p>
 872
 873  </div>
 874  <div class="tags">
 875
 876
 877
 878   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 879
 880  </div>
 881 </div>
 882 <div class="padding"></div>
 883
 884 <div class="entry">
 885  <div class="title">
 886  <a href="http://people.skolelinux.org/pere/blog/ISO_still_hope_to_fix_OOXML.html">ISO still hope to fix OOXML</a>
 887  </div>
 888  <div class="date">
 889   2009-08-08 14:00
 890  </div>
 891
 892  <div class="body">
 893
 894 <p>According to <a
 895 href="http://twerner.blogspot.com/2009/08/defects-of-office-open-xml.html">a
 896 blog post from Torsten Werner</a>, the current defect report for ISO
 897 29500 (ISO OOXML) is 809 pages.  His interesting point is that the
 898 defect report is 71 pages more than the full ODF 1.1 specification.
 899 Personally I find it more interesting that ISO still believe ISO OOXML
 900 can be fixed in ISO.  Personally, I believe it is broken beyon repair,
 901 and I completely lack any trust in ISO for being able to get anywhere
 902 close to solving the problems.  I was part of the Norwegian committee
 903 involved in the OOXML fast track process, and was not impressed with
 904 Standard Norway and ISO in how they handled it.</p>
 905
 906 <p>These days I focus on ODF instead, which seem like a specification
 907 with the future ahead of it.  We are working in NUUG to organise a ODF
 908 seminar this autumn.</p>
 909
 910  </div>
 911  <div class="tags">
 912
 913
 914
 915   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/standard">standard</a>.
 916
 917  </div>
 918 </div>
 919 <div class="padding"></div>
 920
 921 <div class="entry">
 922  <div class="title">
 923  <a href="http://people.skolelinux.org/pere/blog/Relative_popularity_of_document_formats__MS_Office_vs__ODF_.html">Relative popularity of document formats (MS Office vs. ODF)</a>
 924  </div>
 925  <div class="date">
 926   2009-08-12 15:50
 927  </div>
 928
 929  <div class="body">
 930
 931 <p>Just for fun, I did a search right now on Google for a few file ODF
 932 and MS Office based formats (not to be mistaken for ISO or ECMA
 933 OOXML), to get an idea of their relative usage.  I searched using
 934 'filetype:odt' and equvalent terms, and got these results:</P>
 935
 936 <table>
 937 <tr><th>Type</th><th>ODF</th><th>MS Office</th></tr>
 938 <tr><td>Tekst</td> <td>odt:282000</td> <td>docx:308000</td></tr>
 939 <tr><td>Presentasjon</td> <td>odp:75600</td> <td>pptx:183000</td></tr>
 940 <tr><td>Regneark</td> <td>ods:26500     </td> <td>xlsx:145000</td></tr>
 941 </table>
 942
 943 <p>Next, I added a 'site:no' limit to get the numbers for Norway, and
 944 got these numbers:</p>
 945
 946 <table>
 947 <tr><th>Type</th><th>ODF</th><th>MS Office</th></tr>
 948 <tr><td>Tekst</td> <td>odt:2480 </td> <td>docx:4460</td></tr>
 949 <tr><td>Presentasjon</td> <td>odp:299   </td> <td>pptx:741</td></tr>
 950 <tr><td>Regneark</td> <td>ods:187       </td> <td>xlsx:372</td></tr>
 951 </table>
 952
 953 <p>I wonder how these numbers change over time.</p>
 954
 955 <p>I am aware of Google returning different results and numbers based
 956 on where the search is done, so I guess these numbers will differ if
 957 they are conduced in another country.  Because of this, I did the same
 958 search from a machine in California, USA, a few minutes after the
 959 search done from a machine here in Norway.</p>
 960
 961
 962 <table>
 963 <tr><th>Type</th><th>ODF</th><th>MS Office</th></tr>
 964 <tr><td>Tekst</td> <td>odt:129000</td> <td>docx:308000</td></tr>
 965 <tr><td>Presentasjon</td> <td>odp:44200</td> <td>pptx:93900</td></tr>
 966 <tr><td>Regneark</td> <td>ods:26500     </td> <td>xlsx:82400</td></tr>
 967 </table>
 968
 969 <p>And with 'site:no':
 970
 971 <table>
 972 <tr><th>Type</th><th>ODF</th><th>MS Office</th></tr>
 973 <tr><td>Tekst</td> <td>odt:2480</td> <td>docx:3410</td></tr>
 974 <tr><td>Presentasjon</td> <td>odp:175</td> <td>pptx:604</td></tr>
 975 <tr><td>Regneark</td> <td>ods:186       </td> <td>xlsx:296</td></tr>
 976 </table>
 977
 978 <p>Interesting difference, not sure what to conclude from these
 979 numbers.</p>
 980
 981  </div>
 982  <div class="tags">
 983
 984
 985
 986   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/standard">standard</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 987
 988  </div>
 989 </div>
 990 <div class="padding"></div>
 991
 992 <div class="entry">
 993  <div class="title">
 994  <a href="http://people.skolelinux.org/pere/blog/Automatic_Munin_and_Nagios_configuration.html">Automatic Munin and Nagios configuration</a>
 995  </div>
 996  <div class="date">
 997   2010-01-27 15:15
 998  </div>
 999
1000  <div class="body">
1001
1002 <p>One of the new features in the next Debian/Lenny based release of
1003 Debian Edu/Skolelinux, which is scheduled for release in the next few
1004 days, is automatic configuration of the service monitoring system
1005 Nagios.  The previous release had automatic configuration of trend
1006 analysis using Munin, and this Lenny based release take that a step
1007 further.</p>
1008
1009 <p>When installing a Debian Edu Main-server, it is automatically
1010 configured as a Munin and Nagios server.  In addition, it is
1011 configured to be a server for the
1012 <a href="http://wiki.debian.org/DebianEdu/HowTo/SiteSummary">SiteSummary
1013 system</a> I have written for use in Debian Edu.  The SiteSummary
1014 system is inspired by a system used by the University of Oslo where I
1015 work.  In short, the system provide a centralised collector of
1016 information about the computers on the network, and a client on each
1017 computer submitting information to this collector.  This allow for
1018 automatic information on which packages are installed on each machine,
1019 which kernel the machines are using, what kind of configuration the
1020 packages got etc.  This also allow us to automatically generate Munin
1021 and Nagios configuration.</p>
1022
1023 <p>All computers reporting to the sitesummary collector with the
1024 munin-node package installed is automatically enabled as a Munin
1025 client and graphs from the statistics collected from that machine show
1026 up automatically on http://www/munin/ on the Main-server.</p>
1027
1028 <p>All non-laptop computers reporting to the sitesummary collector are
1029 automatically monitored for network presence (ping and any network
1030 services detected).  In addition, all computers (also laptops) with
1031 the nagios-nrpe-server package installed and configured the way
1032 sitesummary would configure it, are monitored for full disks, software
1033 raid status, swap free and other checks that need to run locally on
1034 the machine.</p>
1035
1036 <p>The result is that the administrator on a school using Debian Edu
1037 based on Lenny will be able to check the health of his installation
1038 with one look at the Nagios settings, without having to spend any time
1039 keeping the Nagios configuration up-to-date.</p>
1040
1041 <p>The only configuration one need to do to get Nagios up and running
1042 is to set the password used to get access via HTTP.  The system
1043 administrator need to run "<tt>htpasswd /etc/nagios3/htpasswd.users
1044 nagiosadmin</tt>" to create a nagiosadmin user and set a password for
1045 it to be able to log into the Nagios web pages.  After that,
1046 everything is taken care of.</p>
1047
1048  </div>
1049  <div class="tags">
1050
1051
1052
1053   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary</a>.
1054
1055  </div>
1056 </div>
1057 <div class="padding"></div>
1058
1059 <div class="entry">
1060  <div class="title">
1061  <a href="http://people.skolelinux.org/pere/blog/Debian_Edu___Skolelinux_based_on_Lenny_released__work_continues.html">Debian Edu / Skolelinux based on Lenny released, work continues</a>
1062  </div>
1063  <div class="date">
1064   2010-02-11 17:15
1065  </div>
1066
1067  <div class="body">
1068
1069 <p>On Tuesday, the Debian/Lenny based version of
1070 <a href="http://www.skolelinux.org/">Skolelinux</a> was finally
1071 shipped.  This was a major leap forward for the project, and I am very
1072 pleased that we finally got the release wrapped up.  Work on the first
1073 point release starts imediately, as we plan to get that one out a
1074 month after the major release, to include all fixes for bugs we found
1075 and fixed too late in the release process to include last Tuesday.</p>
1076
1077 <p>Perhaps it even is time for some partying?</p>
1078
1079 <p>After this first point release, my plan is to focus again on the
1080 next major release, based on Squeeze.  We will try to get as many of
1081 the fixes we need into the official Debian packages before the freeze,
1082 and have just a few weeks or months to make it happen.</p>
1083
1084  </div>
1085  <div class="tags">
1086
1087
1088
1089   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1090
1091  </div>
1092 </div>
1093 <div class="padding"></div>
1094
1095 <div class="entry">
1096  <div class="title">
1097  <a href="http://people.skolelinux.org/pere/blog/After_6_years_of_waiting__the_Xreset_d_feature_is_implemented.html">After 6 years of waiting, the Xreset.d feature is implemented</a>
1098  </div>
1099  <div class="date">
1100   2010-03-06 18:15
1101  </div>
1102
1103  <div class="body">
1104
1105 <p>6 years ago, as part of the Debian Edu development I am involved
1106 in, I asked for a hook in the kdm and gdm setup to run scripts as root
1107 when the user log out.  A bug was submitted against the xfree86-common
1108 package in 2004 (<a href="http://bugs.debian.org/230422">#230422</a>),
1109 and revisited every time Debian Edu was working on a new release.
1110 Today, this finally paid off.</p>
1111
1112 <p>The framework for this feature was today commited to the git
1113 repositry for the xorg package, and the git repository for xdm has
1114 been updated to use this framework.  Next on my agenda is to make sure
1115 kdm and gdm also add code to use this framework.</p>
1116
1117 <p>In Debian Edu, we want to ability to run commands as root when the
1118 user log out, to get rid of runaway processes and do general cleanup
1119 after a user.  With this framework in place, we finally can do that in
1120 a generic way that work with all display managers using this
1121 framework.  My goal is to get all display managers in Debian use it,
1122 similar to how they use the Xsession.d framework today.<p>
1123
1124  </div>
1125  <div class="tags">
1126
1127
1128
1129   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1130
1131  </div>
1132 </div>
1133 <div class="padding"></div>
1134
1135 <div class="entry">
1136  <div class="title">
1137  <a href="http://people.skolelinux.org/pere/blog/Kerberos_for_Debian_Edu_Squeeze_.html">Kerberos for Debian Edu/Squeeze?</a>
1138  </div>
1139  <div class="date">
1140   2010-04-14 17:20
1141  </div>
1142
1143  <div class="body">
1144
1145 <p><a href="http://www.nuug.no/aktiviteter/20100413-kerberos/">Yesterdays
1146 NUUG presentation</a> about Kerberos was inspiring, and reminded me
1147 about the need to start using Kerberos in Skolelinux.  Setting up a
1148 Kerberos server seem to be straight forward, and if we get this in
1149 place a long time before the Squeeze version of Debian freezes, we
1150 have a chance to migrate Skolelinux away from NFSv3 for the home
1151 directories, and over to an architecture where the infrastructure do
1152 not have to trust IP addresses and machines, and instead can trust
1153 users and cryptographic keys instead.</p>
1154
1155 <p>A challenge will be integration and administration.  Is there a
1156 Kerberos implementation for Debian where one can control the
1157 administration access in Kerberos using LDAP groups?  With it, the
1158 school administration will have to maintain access control using flat
1159 files on the main server, which give a huge potential for errors.</p>
1160
1161 <p>A related question I would like to know is how well Kerberos and
1162 pam-ccreds (offline password check) work together.  Anyone know?</p>
1163
1164 <p>Next step will be to use Kerberos for access control in Lwat and
1165 Nagios.  I have no idea how much work that will be to implement.  We
1166 would also need to document how to integrate with Windows AD, as such
1167 shared network will require two Kerberos realms that need to cooperate
1168 to work properly.</p>
1169
1170 <p>I believe a good start would be to start using Kerberos on the
1171 skolelinux.no machines, and this way get ourselves experience with
1172 configuration and integration.  A natural starting point would be
1173 setting up ldap.skolelinux.no as the Kerberos server, and migrate the
1174 rest of the machines from PAM via LDAP to PAM via Kerberos one at the
1175 time.</p>
1176
1177 <p>If you would like to contribute to get this working in Skolelinux,
1178 I recommend you to see the video recording from yesterdays NUUG
1179 presentation, and start using Kerberos at home.  The video show show
1180 up in a few days.</p>
1181
1182  </div>
1183  <div class="tags">
1184
1185
1186
1187   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1188
1189  </div>
1190 </div>
1191 <div class="padding"></div>
1192
1193 <div class="entry">
1194  <div class="title">
1195  <a href="http://people.skolelinux.org/pere/blog/Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html">Great book: "Content: Selected Essays on Technology, Creativity, Copyright, and the Future of the Future"</a>
1196  </div>
1197  <div class="date">
1198   2010-04-19 17:10
1199  </div>
1200
1201  <div class="body">
1202
1203 <p>The last few weeks i have had the pleasure of reading a
1204 thought-provoking collection of essays by Cory Doctorow, on topics
1205 touching copyright, virtual worlds, the future of man when the
1206 conscience mind can be duplicated into a computer and many more. The
1207 book titled "Content: Selected Essays on Technology, Creativity,
1208 Copyright, and the Future of the Future" is available with few
1209 restrictions on the web, for example from
1210 <a href="http://craphound.com/content/">his own site</a>. I read the
1211 epub-version from
1212 <a href="http://www.feedbooks.com/book/2883">feedbooks</a> using
1213 <a href="http://www.fbreader.org/">fbreader</a> and my N810. I
1214 strongly recommend this book.</p>
1215
1216  </div>
1217  <div class="tags">
1218
1219
1220
1221   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
1222
1223  </div>
1224 </div>
1225 <div class="padding"></div>
1226
1227 <div class="entry">
1228  <div class="title">
1229  <a href="http://people.skolelinux.org/pere/blog/Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html">Thoughts on roaming laptop setup for Debian Edu</a>
1230  </div>
1231  <div class="date">
1232   2010-04-28 20:40
1233  </div>
1234
1235  <div class="body">
1236
1237 <p>For some years now, I have wondered how we should handle laptops in
1238 Debian Edu.  The Debian Edu infrastructure is mostly designed to
1239 handle stationary computers, and less suited for computers that come
1240 and go.</p>
1241
1242 <p>Now I finally believe I have an sensible idea on how to adjust
1243 Debian Edu for laptops, by introducing a new profile for them, for
1244 example called Roaming Workstations.  Here are my thought on this.
1245 The setup would consist of the following:</p>
1246
1247 <ul>
1248
1249  <li>During installation, the user name of the owner / primary user of
1250    the laptop is requested and a local home directory is set up for
1251    the user, with uid and gid information fetched from the LDAP
1252    server.  This allow the user to work also when offline.  The
1253    central home directory can be available in a subdirectory on
1254    request, for example mounted via CIFS.  It could be mounted
1255    automatically when a user log in while on the Debian Edu network,
1256    and unmounted when the machine is taken away (network down,
1257    hibernate, etc), it can be set up to do automatic mounting on
1258    request (using autofs), or perhaps some GUI button on the desktop
1259    can be used to access it when needed.  Perhaps it is enough to use
1260    the fish protocol in KDE?</li>
1261
1262  <li>Password checking is set up to use LDAP or Kerberos
1263    authentication when the machine is on the Debian Edu network, and
1264    to cache the password for offline checking when the machine unable
1265    to reach the LDAP or Kerberos server.  This can be done using
1266    <a href="http://www.padl.com/OSS/pam_ccreds.html">libpam-ccreds</a>
1267    or the Fedora developed
1268    <a href="https://fedoraproject.org/wiki/Features/SSSD">System
1269    Security Services Daemon</a> packages.</li>
1270
1271  <li>File synchronisation with the central home directory is set up
1272    using a shared directory in both the local and the central home
1273    directory, using unison.</li>
1274
1275  <li>Printing should be set up to print to all printers broadcasting
1276    their existence on the local network, and should then work out of
1277    the box with CUPS.  For sites needing accurate printer quotas, some
1278    system with Kerberos authentication or printing via ssh could be
1279    implemented.</li>
1280
1281  <li>For users that should have local root access to their laptop,
1282    sudo should be used to allow this to the local user.</li>
1283
1284  <li>It would be nice if user and group information from LDAP is
1285    cached on the client, but given that there are entries for the
1286    local user and primary group in /etc/, it should not be needed.</li>
1287
1288 </ul>
1289
1290 <p>I believe all the pieces to implement this are in Debian/testing at
1291 the moment.  If we work quickly, we should be able to get this ready
1292 in time for the Squeeze release to freeze.  Some of the pieces need
1293 tweaking, like libpam-ccreds should get support for pam-auth-update
1294 (<a href="http://bugs.debian.org/566718">#566718</a>) and nslcd (or
1295 perhaps debian-edu-config) should get some integration code to stop
1296 its daemon when the LDAP server is unavailable to avoid long timeouts
1297 when disconnected from the net.  If we get Kerberos enabled, we need
1298 to make sure we avoid long timeouts there too.</p>
1299
1300 <p>If you want to help out with implementing this for Debian Edu,
1301 please contact us on debian-edu@lists.debian.org.</p>
1302
1303  </div>
1304  <div class="tags">
1305
1306
1307
1308   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1309
1310  </div>
1311 </div>
1312 <div class="padding"></div>
1313
1314 <div class="entry">
1315  <div class="title">
1316  <a href="http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html">Forcing new users to change their password on first login</a>
1317  </div>
1318  <div class="date">
1319   2010-05-02 13:47
1320  </div>
1321
1322  <div class="body">
1323
1324 <p>One interesting feature in Active Directory, is the ability to
1325 create a new user with an expired password, and thus force the user to
1326 change the password on the first login attempt.</p>
1327
1328 <p>I'm not quite sure how to do that with the LDAP setup in Debian
1329 Edu, but did some initial testing with a local account.  The account
1330 and password aging information is available in /etc/shadow, but
1331 unfortunately, it is not possible to specify an expiration time for
1332 passwords, only a maximum age for passwords.</p>
1333
1334 <p>A freshly created account (using adduser test) will have these
1335 settings in /etc/shadow:</p>
1336
1337 <blockquote><pre>
1338 root@tjener:~# chage -l test
1339 Last password change                                    : May 02, 2010
1340 Password expires                                        : never
1341 Password inactive                                       : never
1342 Account expires                                         : never
1343 Minimum number of days between password change          : 0
1344 Maximum number of days between password change          : 99999
1345 Number of days of warning before password expires       : 7
1346 root@tjener:~#
1347 </pre></blockquote>
1348
1349 <p>The only way I could come up with to create a user with an expired
1350 account, is to change the date of the last password change to the
1351 lowest value possible (January 1th 1970), and the maximum password age
1352 to the difference in days between that date and today.  To make it
1353 simple, I went for 30 years (30 * 365 = 10950) and January 2th (to
1354 avoid testing if 0 is a valid value).</p>
1355
1356 <p>After using these commands to set it up, it seem to work as
1357 intended:</p>
1358
1359 <blockquote><pre>
1360 root@tjener:~# chage -d 1 test; chage -M 10950 test
1361 root@tjener:~# chage -l test
1362 Last password change                                    : Jan 02, 1970
1363 Password expires                                        : never
1364 Password inactive                                       : never
1365 Account expires                                         : never
1366 Minimum number of days between password change          : 0
1367 Maximum number of days between password change          : 10950
1368 Number of days of warning before password expires       : 7
1369 root@tjener:~#
1370 </pre></blockquote>
1371
1372 <p>So far I have tested this with ssh and console, and kdm (in
1373 Squeeze) login, and all ask for a new password before login in the
1374 user (with ssh, I was thrown out and had to log in again).</p>
1375
1376 <p>Perhaps we should set up something similar for Debian Edu, to make
1377 sure only the user itself have the account password?</p>
1378
1379 <p>If you want to comment on or help out with implementing this for
1380 Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
1381
1382 <p>Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the
1383 shadow(8) page in Debian/testing now state that setting the date of
1384 last password change to zero (0) will force the password to be changed
1385 on the first login.  This was not mentioned in the manual in Lenny, so
1386 I did not notice this in my initial testing.  I have tested it on
1387 Squeeze, and '<tt>chage -d 0 username</tt>' do work there.  I have not
1388 tested it on Lenny yet.</p>
1389
1390 <p>Update 2010-05-02-19:05: Jim Paris tells me via email that an
1391 equivalent command to expire a password is '<tt>passwd -e
1392 username</tt>', which insert zero into the date of the last password
1393 change.</p>
1394
1395  </div>
1396  <div class="tags">
1397
1398
1399
1400   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
1401
1402  </div>
1403 </div>
1404 <div class="padding"></div>
1405
1406 <div class="entry">
1407  <div class="title">
1408  <a href="http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html">Parallellizing the boot in Debian Squeeze - ready for wider testing</a>
1409  </div>
1410  <div class="date">
1411   2010-05-06 23:25
1412  </div>
1413
1414  <div class="body">
1415
1416 <p>These days, the init.d script dependencies in Squeeze are quite
1417 complete, so complete that it is actually possible to run all the
1418 init.d scripts in parallell based on these dependencies.  If you want
1419 to test your Squeeze system, make sure
1420 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
1421 based boot sequencing</a> is enabled, and add this line to
1422 /etc/default/rcS:</p>
1423
1424 <blockquote><pre>
1425 CONCURRENCY=makefile
1426 </pre></blockquote>
1427
1428 <p>That is it.  It will cause sysv-rc to use the startpar tool to run
1429 scripts in parallel using the dependency information stored in
1430 /etc/init.d/.depend.boot, /etc/init.d/.depend.start and
1431 /etc/init.d/.depend.stop to order the scripts.  Startpar is configured
1432 to try to start the kdm and gdm scripts as early as possible, and will
1433 start the facilities required by kdm or gdm as early as possible to
1434 make this happen.</p>
1435
1436 <p>Give it a try, and see if you like the result.  If some services
1437 fail to start properly, it is most likely because they have incomplete
1438 init.d script dependencies in their startup script (or some of their
1439 dependent scripts have incomplete dependencies).  Report bugs and get
1440 the package maintainers to fix it. :)</p>
1441
1442 <p>Running scripts in parallel could be the default in Debian when we
1443 manage to get the init.d script dependencies complete and correct.  I
1444 expect we will get there in Squeeze+1, if we get manage to test and
1445 fix the remaining issues.</p>
1446
1447 <p>If you report any problems with dependencies in init.d scripts to
1448 the BTS, please usertag the report to get it to show up at
1449 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
1450 list of usertagged bugs related to this</a>.</p>
1451
1452  </div>
1453  <div class="tags">
1454
1455
1456
1457   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
1458
1459  </div>
1460 </div>
1461 <div class="padding"></div>
1462
1463 <div class="entry">
1464  <div class="title">
1465  <a href="http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html">systemd, an interesting alternative to upstart</a>
1466  </div>
1467  <div class="date">
1468   2010-05-13 22:20
1469  </div>
1470
1471  <div class="body">
1472
1473 <p>The last few days a new boot system called
1474 <a href="http://www.freedesktop.org/wiki/Software/systemd">systemd</a>
1475 has been
1476 <a href="http://0pointer.de/blog/projects/systemd.html">introduced</a>
1477
1478 to the free software world.  I have not yet had time to play around
1479 with it, but it seem to be a very interesting alternative to
1480 <a href="http://upstart.ubuntu.com/">upstart</a>, and might prove to be
1481 a good alternative for Debian when we are able to switch to an event
1482 based boot system.  Tollef is
1483 <a href="http://bugs.debian.org/580814">in the process</a> of getting
1484 systemd into Debian, and I look forward to seeing how well it work.  I
1485 like the fact that systemd handles init.d scripts with dependency
1486 information natively, allowing them to run in parallel where upstart
1487 at the moment do not.</p>
1488
1489 <p>Unfortunately do systemd have the same problem as upstart regarding
1490 platform support.  It only work on recent Linux kernels, and also need
1491 some new kernel features enabled to function properly.  This means
1492 kFreeBSD and Hurd ports of Debian will need a port or a different boot
1493 system.  Not sure how that will be handled if systemd proves to be the
1494 way forward.</p>
1495
1496 <p>In the mean time, based on the
1497 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
1498 on debian-devel@</a> regarding parallel booting in Debian, I have
1499 decided to enable full parallel booting as the default in Debian as
1500 soon as possible (probably this weekend or early next week), to see if
1501 there are any remaining serious bugs in the init.d dependencies.  A
1502 new version of the sysvinit package implementing this change is
1503 already in experimental.  If all go well, Squeeze will be released
1504 with parallel booting enabled by default.</p>
1505
1506  </div>
1507  <div class="tags">
1508
1509
1510
1511   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1512
1513  </div>
1514 </div>
1515 <div class="padding"></div>
1516
1517 <div class="entry">
1518  <div class="title">
1519  <a href="http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html">Sitesummary tip: Listing MAC address of all clients</a>
1520  </div>
1521  <div class="date">
1522   2010-05-14 21:10
1523  </div>
1524
1525  <div class="body">
1526
1527 <p>In the recent Debian Edu versions, the
1528 <a href="http://wiki.debian.org/DebianEdu/HowTo/SiteSummary">sitesummary
1529 system</a> is used to keep track of the machines in the school
1530 network.  Each machine will automatically report its status to the
1531 central server after boot and once per night.  The network setup is
1532 also reported, and using this information it is possible to get the
1533 MAC address of all network interfaces in the machines.  This is useful
1534 to update the DHCP configuration.</p>
1535
1536 <p>To give some idea how to use sitesummary, here is a one-liner to
1537 ist all MAC addresses of all machines reporting to sitesummary.  Run
1538 this on the collector host:</p>
1539
1540 <blockquote><pre>
1541 perl -MSiteSummary -e 'for_all_hosts(sub { print join(" ", get_macaddresses(shift)), "\n"; });'
1542 </pre></blockquote>
1543
1544 <p>This will list all MAC addresses assosiated with all machine, one
1545 line per machine and with space between the MAC addresses.</p>
1546
1547 <p>To allow system administrators easier job at adding static DHCP
1548 addresses for hosts, it would be possible to extend this to fetch
1549 machine information from sitesummary and update the DHCP and DNS
1550 tables in LDAP using this information.  Such tool is unfortunately not
1551 written yet.</p>
1552
1553  </div>
1554  <div class="tags">
1555
1556
1557
1558   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary</a>.
1559
1560  </div>
1561 </div>
1562 <div class="padding"></div>
1563
1564 <div class="entry">
1565  <div class="title">
1566  <a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html">Parallellized boot is now the default in Debian/unstable</a>
1567  </div>
1568  <div class="date">
1569   2010-05-14 22:40
1570  </div>
1571
1572  <div class="body">
1573
1574 <p>Since this evening, parallel booting is the default in
1575 Debian/unstable for machines using dependency based boot sequencing.
1576 Apparently the testing of concurrent booting has been wider than
1577 expected, if I am to believe the
1578 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
1579 on debian-devel@</a>, and I concluded a few days ago to move forward
1580 with the feature this weekend, to give us some time to detect any
1581 remaining problems before Squeeze is frozen.  If serious problems are
1582 detected, it is simple to change the default back to sequential boot.
1583 The upload of the new sysvinit package also activate a new upstream
1584 version.</p>
1585
1586 More information about
1587 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
1588 based boot sequencing</a> is available from the Debian wiki.  It is
1589 currently possible to disable parallel booting when one run into
1590 problems caused by it, by adding this line to /etc/default/rcS:</p>
1591
1592 <blockquote><pre>
1593 CONCURRENCY=none
1594 </pre></blockquote>
1595
1596 <p>If you report any problems with dependencies in init.d scripts to
1597 the BTS, please usertag the report to get it to show up at
1598 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
1599 list of usertagged bugs related to this</a>.</p>
1600
1601  </div>
1602  <div class="tags">
1603
1604
1605
1606   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
1607
1608  </div>
1609 </div>
1610 <div class="padding"></div>
1611
1612 <div class="entry">
1613  <div class="title">
1614  <a href="http://people.skolelinux.org/pere/blog/Pieces_of_the_roaming_laptop_puzzle_in_Debian.html">Pieces of the roaming laptop puzzle in Debian</a>
1615  </div>
1616  <div class="date">
1617   2010-05-19 19:00
1618  </div>
1619
1620  <div class="body">
1621
1622 <p>Today, the last piece of the puzzle for roaming laptops in Debian
1623 Edu finally entered the Debian archive.  Today, the new
1624 <a href="http://packages.qa.debian.org/libp/libpam-mklocaluser.html">libpam-mklocaluser</a>
1625 package was accepted.  Two days ago, two other pieces was accepted
1626 into unstable.  The
1627 <a href="http://packages.qa.debian.org/p/pam-python.html">pam-python</a>
1628 package needed by libpam-mklocaluser, and the
1629 <a href="http://packages.qa.debian.org/s/sssd.html">sssd</a> package
1630 passed NEW on Monday.  In addition, the
1631 <a href="http://packages.qa.debian.org/libp/libpam-ccreds.html">libpam-ccreds</a>
1632 package we need is in experimental (version 10-4) since Saturday, and
1633 hopefully will be moved to unstable soon.</p>
1634
1635 <p>This collection of packages allow for two different setups for
1636 roaming laptops.  The traditional setup would be using libpam-ccreds,
1637 nscd and libpam-mklocaluser with LDAP or Kerberos authentication,
1638 which should work out of the box if the configuration changes proposed
1639 for nscd in <a href="http://bugs.debian.org/485282">BTS report
1640 #485282</a> is implemented.  The alternative setup is to use sssd with
1641 libpam-mklocaluser to connect to LDAP or Kerberos and let sssd take
1642 care of the caching of passwords and group information.</p>
1643
1644 <p>I have so far been unable to get sssd to work with the LDAP server
1645 at the University, but suspect the issue is some SSL/GnuTLS related
1646 problem with the server certificate.  I plan to update the Debian
1647 package to version 1.2, which is scheduled for next week, and hope to
1648 find time to make sure the next release will include both the
1649 Debian/Ubuntu specific patches.  Upstream is friendly and responsive,
1650 and I am sure we will find a good solution.</p>
1651
1652 <p>The idea is to set up the roaming laptops to authenticate using
1653 LDAP or Kerberos and create a local user with home directory in /home/
1654 when a usre in LDAP logs in via KDM or GDM for the first time, and
1655 cache the password for offline checking, as well as caching group
1656 memberhips and other relevant LDAP information.  The
1657 libpam-mklocaluser package was created to make sure the local home
1658 directory is in /home/, instead of /site/server/directory/ which would
1659 be the home directory if pam_mkhomedir was used.  To avoid confusion
1660 with support requests and configuration, we do not want local laptops
1661 to have users in a path that is used for the same users home directory
1662 on the home directory servers.</p>
1663
1664 <p>One annoying problem with gdm is that it do not show the PAM
1665 message passed to the user from libpam-mklocaluser when the local user
1666 is created.  Instead gdm simply reject the login with some generic
1667 message.  The message is shown in kdm, ssh and login, so I guess it is
1668 a bug in gdm.  Have not investigated if there is some other message
1669 type that can be used instead to get gdm to also show the message.</p>
1670
1671 <p>If you want to help out with implementing this for Debian Edu,
1672 please contact us on debian-edu@lists.debian.org.</p>
1673
1674  </div>
1675  <div class="tags">
1676
1677
1678
1679   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1680
1681  </div>
1682 </div>
1683 <div class="padding"></div>
1684
1685 <div class="entry">
1686  <div class="title">
1687  <a href="http://people.skolelinux.org/pere/blog/More_flexible_firmware_handling_in_debian_installer.html">More flexible firmware handling in debian-installer</a>
1688  </div>
1689  <div class="date">
1690   2010-05-22 21:30
1691  </div>
1692
1693  <div class="body">
1694
1695 <p>After a long break from debian-installer development, I finally
1696 found time today to return to the project.  Having to spend less time
1697 working dependency based boot in debian, as it is almost complete now,
1698 definitely helped freeing some time.</p>
1699
1700 <p>A while back, I ran into a problem while working on Debian Edu.  We
1701 include some firmware packages on the Debian Edu CDs, those needed to
1702 get disk and network controllers working.  Without having these
1703 firmware packages available during installation, it is impossible to
1704 install Debian Edu on the given machine, and because our target group
1705 are non-technical people, asking them to provide firmware packages on
1706 an external medium is a support pain.  Initially, I expected it to be
1707 enough to include the firmware packages on the CD to get
1708 debian-installer to find and use them.  This proved to be wrong.
1709 Next, I hoped it was enough to symlink the relevant firmware packages
1710 to some useful location on the CD (tried /cdrom/ and
1711 /cdrom/firmware/).  This also proved to not work, and at this point I
1712 found time to look at the debian-installer code to figure out what was
1713 going to work.</p>
1714
1715 <p>The firmware loading code is in the hw-detect package, and a closer
1716 look revealed that it would only look for firmware packages outside
1717 the installation media, so the CD was never checked for firmware
1718 packages.  It would only check USB sticks, floppies and other
1719 "external" media devices.  Today I changed it to also look in the
1720 /cdrom/firmware/ directory on the mounted CD or DVD, which should
1721 solve the problem I ran into with Debian edu.  I also changed it to
1722 look in /firmware/, to make sure the installer also find firmware
1723 provided in the initrd when booting the installer via PXE, to allow us
1724 to provide the same feature in the PXE setup included in Debian
1725 Edu.</p>
1726
1727 <p>To make sure firmware deb packages with a license questions are not
1728 activated without asking if the license is accepted, I extended
1729 hw-detect to look for preinst scripts in the firmware packages, and
1730 run these before activating the firmware during installation.  The
1731 license question is asked using debconf in the preinst, so this should
1732 solve the issue for the firmware packages I have looked at so far.</p>
1733
1734 <p>If you want to discuss the details of these features, please
1735 contact us on debian-boot@lists.debian.org.</p>
1736
1737  </div>
1738  <div class="tags">
1739
1740
1741
1742   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
1743
1744  </div>
1745 </div>
1746 <div class="padding"></div>
1747
1748 <div class="entry">
1749  <div class="title">
1750  <a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_seem_to_hold_up_well_in_Debian_testing.html">Parallellized boot seem to hold up well in Debian/testing</a>
1751  </div>
1752  <div class="date">
1753   2010-05-27 23:55
1754  </div>
1755
1756  <div class="body">
1757
1758 <p>A few days ago, parallel booting was enabled in Debian/testing.
1759 The feature seem to hold up pretty well, but three fairly serious
1760 issues are known and should be solved:
1761
1762 <p><ul>
1763
1764 <li>The wicd package seen to
1765 <a href="http://bugs.debian.org/508289">break NFS mounting</a> and
1766 <a href="http://bugs.debian.org/581586">network setup</a> when
1767 parallel booting is enabled.  No idea why, but the wicd maintainer
1768 seem to be on the case.</li>
1769
1770 <li>The nvidia X driver seem to
1771 <a href="http://bugs.debian.org/583312">have a race condition</a>
1772 triggered more easily when parallel booting is in effect.  The
1773 maintainer is on the case.</li>
1774
1775 <li>The sysv-rc package fail to properly enable dependency based boot
1776 sequencing (the shutdown is broken) when old file-rc users
1777 <a href="http://bugs.debian.org/575080">try to switch back</a> to
1778 sysv-rc.  One way to solve it would be for file-rc to create
1779 /etc/init.d/.legacy-bootordering, and another is to try to make
1780 sysv-rc more robust.  Will investigate some more and probably upload a
1781 workaround in sysv-rc to help those trying to move from file-rc to
1782 sysv-rc get a working shutdown.</li>
1783
1784 </ul></p>
1785
1786 <p>All in all not many surprising issues, and all of them seem
1787 solvable before Squeeze is released.  In addition to these there are
1788 some packages with bugs in their dependencies and run level settings,
1789 which I expect will be fixed in a reasonable time span.</p>
1790
1791 <p>If you report any problems with dependencies in init.d scripts to
1792 the BTS, please usertag the report to get it to show up at
1793 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
1794 list of usertagged bugs related to this</a>.</p>
1795
1796 <p>Update: Correct bug number to file-rc issue.</p>
1797
1798  </div>
1799  <div class="tags">
1800
1801
1802
1803   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
1804
1805  </div>
1806 </div>
1807 <div class="padding"></div>
1808
1809 <div class="entry">
1810  <div class="title">
1811  <a href="http://people.skolelinux.org/pere/blog/KDM_fail_at_boot_with_NVidia_cards___and_no_one_try_to_fix_it_.html">KDM fail at boot with NVidia cards - and no one try to fix it?</a>
1812  </div>
1813  <div class="date">
1814   2010-06-01 17:05
1815  </div>
1816
1817  <div class="body">
1818
1819 <p>It is strange to watch how a bug in Debian causing KDM to fail to
1820 start at boot when an NVidia video card is used is handled.  The
1821 problem seem to be that the nvidia X.org driver uses a long time to
1822 initialize, and this duration is longer than kdm is configured to
1823 wait.</p>
1824
1825 <p>I came across two bugs related to this issue,
1826 <a href="http://bugs.debian.org/583312">#583312</a> initially filed
1827 against initscripts and passed on to nvidia-glx when it became obvious
1828 that the nvidia drivers were involved, and
1829 <a href="http://bugs.debian.org/524751">#524751</a> initially filed against
1830 kdm and passed on to src:nvidia-graphics-drivers for unknown reasons.</p>
1831
1832 <p>To me, it seem that no-one is interested in actually solving the
1833 problem nvidia video card owners experience and make sure the Debian
1834 distribution work out of the box for these users.  The nvidia driver
1835 maintainers expect kdm to be set up to wait longer, while kdm expect
1836 the nvidia driver maintainers to fix the driver to start faster, and
1837 while they wait for each other I guess the users end up switching to a
1838 distribution that work for them.  I have no idea what the solution is,
1839 but I am pretty sure that waiting for each other is not it.</p>
1840
1841 <p>I wonder why we end up handling bugs this way.</p>
1842
1843  </div>
1844  <div class="tags">
1845
1846
1847
1848   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
1849
1850  </div>
1851 </div>
1852 <div class="padding"></div>
1853
1854 <div class="entry">
1855  <div class="title">
1856  <a href="http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_computer_hardware_models_used_at_site.html">Sitesummary tip: Listing computer hardware models used at site</a>
1857  </div>
1858  <div class="date">
1859   2010-06-03 12:05
1860  </div>
1861
1862  <div class="body">
1863
1864 <p>When using sitesummary at a site to track machines, it is possible
1865 to get a list of the machine types in use thanks to the DMI
1866 information extracted from each machine.  The script to do so is
1867 included in the sitesummary package, and here is example output from
1868 the Skolelinux build servers:</p>
1869
1870 <blockquote><pre>
1871 maintainer:~# /usr/lib/sitesummary/hardware-model-summary
1872   vendor                    count
1873   Dell Computer Corporation     1
1874     PowerEdge 1750              1
1875   IBM                           1
1876     eserver xSeries 345 -[8670M1X]-     1
1877   Intel                         2
1878   [no-dmi-info]                 3
1879 maintainer:~#
1880 </pre></blockquote>
1881
1882 <p>The quality of the report depend on the quality of the DMI tables
1883 provided in each machine.  Here there are Intel machines without model
1884 information listed with Intel as vendor and mo model, and virtual Xen
1885 machines listed as [no-dmi-info].  One can add -l as a command line
1886 option to list the individual machines.</p>
1887
1888 <p>A larger list is
1889 <a href="http://narvikskolen.no/sitesummary/">available from the the
1890 city of Narvik</a>, which uses Skolelinux on all their shools and also
1891 provide the basic sitesummary report publicly.  In their report there
1892 are ~1400 machines. I know they use both Ubuntu and Skolelinux on
1893 their machines, and as sitesummary is available in both distributions,
1894 it is trivial to get all of them to report to the same central
1895 collector.</p>
1896
1897  </div>
1898  <div class="tags">
1899
1900
1901
1902   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary</a>.
1903
1904  </div>
1905 </div>
1906 <div class="padding"></div>
1907
1908 <div class="entry">
1909  <div class="title">
1910  <a href="http://people.skolelinux.org/pere/blog/A_manual_for_standards_wars___.html">A manual for standards wars...</a>
1911  </div>
1912  <div class="date">
1913   2010-06-06 14:15
1914  </div>
1915
1916  <div class="body">
1917
1918 <p>Via the
1919 <a href="http://feedproxy.google.com/~r/robweir/antic-atom/~3/QzU4RgoAGMg/weekly-links-10.html">blog
1920 of Rob Weir</a> I came across the very interesting essay named
1921 <a href="http://faculty.haas.berkeley.edu/shapiro/wars.pdf">The Art of
1922 Standards Wars</a> (PDF 25 pages).  I recommend it for everyone
1923 following the standards wars of today.</p>
1924
1925  </div>
1926  <div class="tags">
1927
1928
1929
1930   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/standard">standard</a>.
1931
1932  </div>
1933 </div>
1934 <div class="padding"></div>
1935
1936 <div class="entry">
1937  <div class="title">
1938  <a href="http://people.skolelinux.org/pere/blog/Upstart_or_sysvinit___as_init_d_scripts_see_it.html">Upstart or sysvinit - as init.d scripts see it</a>
1939  </div>
1940  <div class="date">
1941   2010-06-06 23:55
1942  </div>
1943
1944  <div class="body">
1945
1946 <p>If Debian is to migrate to upstart on Linux, I expect some init.d
1947 scripts to migrate (some of) their operations to upstart job while
1948 keeping the init.d for hurd and kfreebsd.  The packages with such
1949 needs will need a way to get their init.d scripts to behave
1950 differently when used with sysvinit and with upstart.  Because of
1951 this, I had a look at the environment variables set when a init.d
1952 script is running under upstart, and when it is not.</p>
1953
1954 <p>With upstart, I notice these environment variables are set when a
1955 script is started from rcS.d/ (ignoring some irrelevant ones like
1956 COLUMNS):</p>
1957
1958 <blockquote><pre>
1959 DEFAULT_RUNLEVEL=2
1960 previous=N
1961 PREVLEVEL=
1962 RUNLEVEL=
1963 runlevel=S
1964 UPSTART_EVENTS=startup
1965 UPSTART_INSTANCE=
1966 UPSTART_JOB=rc-sysinit
1967 </pre></blockquote>
1968
1969 <p>With sysvinit, these environment variables are set for the same
1970 script.</p>
1971
1972 <blockquote><pre>
1973 INIT_VERSION=sysvinit-2.88
1974 previous=N
1975 PREVLEVEL=N
1976 RUNLEVEL=S
1977 runlevel=S
1978 </pre></blockquote>
1979
1980 <p>The RUNLEVEL and PREVLEVEL environment variables passed on from
1981 sysvinit are not set by upstart.  Not sure if it is intentional or not
1982 to not be compatible with sysvinit in this regard.</p>
1983
1984 <p>For scripts needing to behave differently when upstart is used,
1985 looking for the UPSTART_JOB environment variable seem to be a good
1986 choice.</p>
1987
1988  </div>
1989  <div class="tags">
1990
1991
1992
1993   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
1994
1995  </div>
1996 </div>
1997 <div class="padding"></div>
1998
1999 <div class="entry">
2000  <div class="title">
2001  <a href="http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html">Automatic upgrade testing from Lenny to Squeeze</a>
2002  </div>
2003  <div class="date">
2004   2010-06-11 22:50
2005  </div>
2006
2007  <div class="body">
2008
2009 <p>The last few days I have done some upgrade testing in Debian, to
2010 see if the upgrade from Lenny to Squeeze will go smoothly.  A few bugs
2011 have been discovered and reported in the process
2012 (<a href="http://bugs.debian.org/585410">#585410</a> in nagios3-cgi,
2013 <a href="http://bugs.debian.org/584879">#584879</a> already fixed in
2014 enscript and <a href="http://bugs.debian.org/584861">#584861</a> in
2015 kdebase-workspace-data), and to get a more regular testing going on, I
2016 am working on a script to automate the test.</p>
2017
2018 <p>The idea is to create a Lenny chroot and use tasksel to install a
2019 Gnome or KDE desktop installation inside the chroot before upgrading
2020 it.  To ensure no services are started in the chroot, a policy-rc.d
2021 script is inserted.  To make sure tasksel believe it is to install a
2022 desktop on a laptop, the tasksel tests are replaced in the chroot
2023 (only acceptable because this is a throw-away chroot).</p>
2024
2025 <p>A naive upgrade from Lenny to Squeeze using aptitude dist-upgrade
2026 currently always fail because udev refuses to upgrade with the kernel
2027 in Lenny, so to avoid that problem the file /etc/udev/kernel-upgrade
2028 is created.  The bug report
2029 <a href="http://bugs.debian.org/566000">#566000</a> make me suspect
2030 this problem do not trigger in a chroot, but I touch the file anyway
2031 to make sure the upgrade go well.  Testing on virtual and real
2032 hardware have failed me because of udev so far, and creating this file
2033 do the trick in such settings anyway.  This is a
2034 <a href="http://www.linuxquestions.org/questions/debian-26/failed-dist-upgrade-due-to-udev-config_sysfs_deprecated-nonsense-804130/">known
2035 issue</a> and the current udev behaviour is intended by the udev
2036 maintainer because he lack the resources to rewrite udev to keep
2037 working with old kernels or something like that.  I really wish the
2038 udev upstream would keep udev backwards compatible, to avoid such
2039 upgrade problem, but given that they fail to do so, I guess
2040 documenting the way out of this mess is the best option we got for
2041 Debian Squeeze.</p>
2042
2043 <p>Anyway, back to the task at hand, testing upgrades.  This test
2044 script, which I call <tt>upgrade-test</tt> for now, is doing the
2045 trick:</p>
2046
2047 <blockquote><pre>
2048 #!/bin/sh
2049 set -ex
2050
2051 if [ "$1" ] ; then
2052     desktop=$1
2053 else
2054     desktop=gnome
2055 fi
2056
2057 from=lenny
2058 to=squeeze
2059
2060 exec &lt; /dev/null
2061 unset LANG
2062 mirror=http://ftp.skolelinux.org/debian
2063 tmpdir=chroot-$from-upgrade-$to-$desktop
2064 fuser -mv .
2065 debootstrap $from $tmpdir $mirror
2066 chroot $tmpdir aptitude update
2067 cat > $tmpdir/usr/sbin/policy-rc.d &lt;&lt;EOF
2068 #!/bin/sh
2069 exit 101
2070 EOF
2071 chmod a+rx $tmpdir/usr/sbin/policy-rc.d
2072 exit_cleanup() {
2073     umount $tmpdir/proc
2074 }
2075 mount -t proc proc $tmpdir/proc
2076 # Make sure proc is unmounted also on failure
2077 trap exit_cleanup EXIT INT
2078
2079 chroot $tmpdir aptitude -y install debconf-utils
2080
2081 # Make sure tasksel autoselection trigger.  It need the test scripts
2082 # to return the correct answers.
2083 echo tasksel tasksel/desktop multiselect $desktop | \
2084     chroot $tmpdir debconf-set-selections
2085
2086 # Include the desktop and laptop task
2087 for test in desktop laptop ; do
2088     echo > $tmpdir/usr/lib/tasksel/tests/$test &lt;&lt;EOF
2089 #!/bin/sh
2090 exit 2
2091 EOF
2092     chmod a+rx $tmpdir/usr/lib/tasksel/tests/$test
2093 done
2094
2095 DEBIAN_FRONTEND=noninteractive
2096 DEBIAN_PRIORITY=critical
2097 export DEBIAN_FRONTEND DEBIAN_PRIORITY
2098 chroot $tmpdir tasksel --new-install
2099
2100 echo deb $mirror $to main > $tmpdir/etc/apt/sources.list
2101 chroot $tmpdir aptitude update
2102 touch $tmpdir/etc/udev/kernel-upgrade
2103 chroot $tmpdir aptitude -y dist-upgrade
2104 fuser -mv
2105 </pre></blockquote>
2106
2107 <p>I suspect it would be useful to test upgrades with both apt-get and
2108 with aptitude, but I have not had time to look at how they behave
2109 differently so far.  I hope to get a cron job running to do the test
2110 regularly and post the result on the web.  The Gnome upgrade currently
2111 work, while the KDE upgrade fail because of the bug in
2112 kdebase-workspace-data</p>
2113
2114 <p>I am not quite sure what kind of extract from the huge upgrade logs
2115 (KDE 167 KiB, Gnome 516 KiB) it make sense to include in this blog
2116 post, so I will refrain from trying.  I can report that for Gnome,
2117 aptitude report 760 packages upgraded, 448 newly installed, 129 to
2118 remove and 1 not upgraded and 1024MB need to be downloaded while for
2119 KDE the same numbers are 702 packages upgraded, 507 newly installed,
2120 193 to remove and 0 not upgraded and 1117MB need to be downloaded</p>
2121
2122 <p>I am very happy to notice that the Gnome desktop + laptop upgrade
2123 is able to migrate to dependency based boot sequencing and parallel
2124 booting without a hitch.  Was unsure if there were still bugs with
2125 packages failing to clean up their obsolete init.d script during
2126 upgrades, and no such problem seem to affect the Gnome desktop+laptop
2127 packages.</p>
2128
2129  </div>
2130  <div class="tags">
2131
2132
2133
2134   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
2135
2136  </div>
2137 </div>
2138 <div class="padding"></div>
2139
2140 <div class="entry">
2141  <div class="title">
2142  <a href="http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__removals_by_apt_and_aptitude.html">Lenny->Squeeze upgrades, removals by apt and aptitude</a>
2143  </div>
2144  <div class="date">
2145   2010-06-13 09:05
2146  </div>
2147
2148  <div class="body">
2149
2150 <p>My
2151 <a href="http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html">testing
2152 of Debian upgrades</a> from Lenny to Squeeze continues, and I've
2153 finally made the upgrade logs available from
2154 <a href="http://people.skolelinux.org/pere/debian-upgrade-testing/">http://people.skolelinux.org/pere/debian-upgrade-testing/</a>.
2155 I am now testing dist-upgrade of Gnome and KDE in a chroot using both
2156 apt and aptitude, and found their differences interesting.  This time
2157 I will only focus on their removal plans.</p>
2158
2159 <p>After installing a Gnome desktop and the laptop task, apt-get wants
2160 to remove 72 packages when dist-upgrading from Lenny to Squeeze.  The
2161 surprising part is that it want to remove xorg and all
2162 xserver-xorg-video* drivers.  Clearly not a good choice, but I am not
2163 sure why.  When asking aptitude to do the same, it want to remove 129
2164 packages, but most of them are library packages I suspect are no
2165 longer needed.  Both of them want to remove bluetooth packages, which
2166 I do not know.  Perhaps these bluetooth packages are obsolete?</p>
2167
2168 <p>For KDE, apt-get want to remove 82 packages, among them kdebase
2169 which seem like a bad idea and xorg the same way as with Gnome. Asking
2170 aptitude for the same, it wants to remove 192 packages, none which are
2171 too surprising.</p>
2172
2173 <p>I guess the removal of xorg during upgrades should be investigated
2174 and avoided, and perhaps others as well.  Here are the complete list
2175 of planned removals.  The complete logs is available from the URL
2176 above.  Note if you want to repeat these tests, that the upgrade test
2177 for kde+apt-get hung in the tasksel setup because of dpkg asking
2178 conffile questions.  No idea why.  I worked around it by using
2179 '<tt>echo >> /proc/<em>pidofdpkg</em>/fd/0</tt>' to tell dpkg to
2180 continue.</p>
2181
2182 <p><b>apt-get gnome 72</b>
2183 <br>bluez-gnome cupsddk-drivers deskbar-applet gnome
2184   gnome-desktop-environment gnome-network-admin gtkhtml3.14
2185   iceweasel-gnome-support libavcodec51 libdatrie0 libgdl-1-0
2186   libgnomekbd2 libgnomekbdui2 libmetacity0 libslab0 libxcb-xlib0
2187   nautilus-cd-burner python-gnome2-desktop python-gnome2-extras
2188   serpentine swfdec-mozilla update-manager xorg xserver-xorg
2189   xserver-xorg-core xserver-xorg-input-all xserver-xorg-input-evdev
2190   xserver-xorg-input-kbd xserver-xorg-input-mouse
2191   xserver-xorg-input-synaptics xserver-xorg-input-wacom
2192   xserver-xorg-video-all xserver-xorg-video-apm xserver-xorg-video-ark
2193   xserver-xorg-video-ati xserver-xorg-video-chips
2194   xserver-xorg-video-cirrus xserver-xorg-video-cyrix
2195   xserver-xorg-video-dummy xserver-xorg-video-fbdev
2196   xserver-xorg-video-glint xserver-xorg-video-i128
2197   xserver-xorg-video-i740 xserver-xorg-video-imstt
2198   xserver-xorg-video-intel xserver-xorg-video-mach64
2199   xserver-xorg-video-mga xserver-xorg-video-neomagic
2200   xserver-xorg-video-nsc xserver-xorg-video-nv
2201   xserver-xorg-video-openchrome xserver-xorg-video-r128
2202   xserver-xorg-video-radeon xserver-xorg-video-radeonhd
2203   xserver-xorg-video-rendition xserver-xorg-video-s3
2204   xserver-xorg-video-s3virge xserver-xorg-video-savage
2205   xserver-xorg-video-siliconmotion xserver-xorg-video-sis
2206   xserver-xorg-video-sisusb xserver-xorg-video-tdfx
2207   xserver-xorg-video-tga xserver-xorg-video-trident
2208   xserver-xorg-video-tseng xserver-xorg-video-v4l
2209   xserver-xorg-video-vesa xserver-xorg-video-vga
2210   xserver-xorg-video-vmware xserver-xorg-video-voodoo xulrunner-1.9
2211   xulrunner-1.9-gnome-support</p>
2212
2213 <p><b>aptitude gnome 129</b>
2214
2215 <br>bluez-gnome bluez-utils cpp-4.3 cupsddk-drivers dhcdbd
2216   djvulibre-desktop finger gnome-app-install gnome-mount
2217   gnome-network-admin gnome-spell gnome-vfs-obexftp
2218   gnome-volume-manager gstreamer0.10-gnomevfs gtkhtml3.14 libao2
2219   libavahi-compat-libdnssd1 libavahi-core5 libavcodec51 libbluetooth2
2220   libcamel1.2-11 libcdio7 libcucul0 libcupsys2 libcurl3 libdatrie0
2221   libdirectfb-1.0-0 libdvdread3 libedataserver1.2-9 libeel2-2.20
2222   libeel2-data libepc-1.0-1 libepc-ui-1.0-1 libfaad0 libgail-common
2223   libgd2-noxpm libgda3-3 libgda3-common libgdl-1-0 libgdl-1-common
2224   libggz2 libggzcore9 libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0
2225   libgnomecups1.0-1 libgnomekbd2 libgnomekbdui2 libgnomeprint2.2-0
2226   libgnomeprint2.2-data libgnomeprintui2.2-0 libgnomeprintui2.2-common
2227   libgnomevfs2-bin libgpod3 libgraphviz4 libgtkhtml2-0
2228   libgtksourceview-common libgtksourceview1.0-0 libgucharmap6
2229   libhesiod0 libicu38 libiw29 libkpathsea4 libltdl3 libmagick++10
2230   libmagick10 libmalaga7 libmetacity0 libmtp7 libmysqlclient15off
2231   libnautilus-burn4 libneon27 libnm-glib0 libnm-util0 libopal-2.2
2232   libosp5 libparted1.8-10 libpoppler-glib3 libpoppler3 libpt-1.10.10
2233   libpt-1.10.10-plugins-alsa libpt-1.10.10-plugins-v4l libraw1394-8
2234   libsensors3 libslab0 libsmbios2 libsoup2.2-8 libssh2-1
2235   libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1 libtotem-plparser10
2236   libtrackerclient0 libxalan2-java libxalan2-java-gcj libxcb-xlib0
2237   libxerces2-java libxerces2-java-gcj libxklavier12 libxtrap6
2238   libxxf86misc1 libzephyr3 mysql-common nautilus-cd-burner
2239   openoffice.org-writer2latex openssl-blacklist p7zip
2240   python-4suite-xml python-eggtrayicon python-gnome2-desktop
2241   python-gnome2-extras python-gtkhtml2 python-gtkmozembed
2242   python-numeric python-sexy serpentine svgalibg1 swfdec-gnome
2243   swfdec-mozilla totem-gstreamer update-manager wodim
2244   xserver-xorg-video-cyrix xserver-xorg-video-imstt
2245   xserver-xorg-video-nsc xserver-xorg-video-v4l xserver-xorg-video-vga
2246   zip</p>
2247
2248 <p><b>apt-get kde 82</b>
2249
2250 <br>cupsddk-drivers karm kaudiocreator kcoloredit kcontrol kde kde-core
2251   kdeaddons kdeartwork kdebase kdebase-bin kdebase-bin-kde3
2252   kdebase-kio-plugins kdesktop kdeutils khelpcenter kicker
2253   kicker-applets knewsticker kolourpaint konq-plugins konqueror korn
2254   kpersonalizer kscreensaver ksplash libavcodec51 libdatrie0 libkiten1
2255   libxcb-xlib0 quanta superkaramba texlive-base-bin xorg xserver-xorg
2256   xserver-xorg-core xserver-xorg-input-all xserver-xorg-input-evdev
2257   xserver-xorg-input-kbd xserver-xorg-input-mouse
2258   xserver-xorg-input-synaptics xserver-xorg-input-wacom
2259   xserver-xorg-video-all xserver-xorg-video-apm xserver-xorg-video-ark
2260   xserver-xorg-video-ati xserver-xorg-video-chips
2261   xserver-xorg-video-cirrus xserver-xorg-video-cyrix
2262   xserver-xorg-video-dummy xserver-xorg-video-fbdev
2263   xserver-xorg-video-glint xserver-xorg-video-i128
2264   xserver-xorg-video-i740 xserver-xorg-video-imstt
2265   xserver-xorg-video-intel xserver-xorg-video-mach64
2266   xserver-xorg-video-mga xserver-xorg-video-neomagic
2267   xserver-xorg-video-nsc xserver-xorg-video-nv
2268   xserver-xorg-video-openchrome xserver-xorg-video-r128
2269   xserver-xorg-video-radeon xserver-xorg-video-radeonhd
2270   xserver-xorg-video-rendition xserver-xorg-video-s3
2271   xserver-xorg-video-s3virge xserver-xorg-video-savage
2272   xserver-xorg-video-siliconmotion xserver-xorg-video-sis
2273   xserver-xorg-video-sisusb xserver-xorg-video-tdfx
2274   xserver-xorg-video-tga xserver-xorg-video-trident
2275   xserver-xorg-video-tseng xserver-xorg-video-v4l
2276   xserver-xorg-video-vesa xserver-xorg-video-vga
2277   xserver-xorg-video-vmware xserver-xorg-video-voodoo xulrunner-1.9</p>
2278
2279 <p><b>aptitude kde 192</b>
2280 <br>bluez-utils cpp-4.3 cupsddk-drivers cvs dcoprss dhcdbd
2281   djvulibre-desktop dosfstools eyesapplet fifteenapplet finger gettext
2282   ghostscript-x imlib-base imlib11 indi kandy karm kasteroids
2283   kaudiocreator kbackgammon kbstate kcoloredit kcontrol kcron kdat
2284   kdeadmin-kfile-plugins kdeartwork-misc kdeartwork-theme-window
2285   kdebase-bin-kde3 kdebase-kio-plugins kdeedu-data
2286   kdegraphics-kfile-plugins kdelirc kdemultimedia-kappfinder-data
2287   kdemultimedia-kfile-plugins kdenetwork-kfile-plugins
2288   kdepim-kfile-plugins kdepim-kio-plugins kdeprint kdesktop kdessh
2289   kdict kdnssd kdvi kedit keduca kenolaba kfax kfaxview kfouleggs
2290   kghostview khelpcenter khexedit kiconedit kitchensync klatin
2291   klickety kmailcvt kmenuedit kmid kmilo kmoon kmrml kodo kolourpaint
2292   kooka korn kpager kpdf kpercentage kpf kpilot kpoker kpovmodeler
2293   krec kregexpeditor ksayit ksim ksirc ksirtet ksmiletris ksmserver
2294   ksnake ksokoban ksplash ksvg ksysv ktip ktnef kuickshow kverbos
2295   kview kviewshell kvoctrain kwifimanager kwin kwin4 kworldclock
2296   kxsldbg libakode2 libao2 libarts1-akode libarts1-audiofile
2297   libarts1-mpeglib libarts1-xine libavahi-compat-libdnssd1
2298   libavahi-core5 libavc1394-0 libavcodec51 libbluetooth2
2299   libboost-python1.34.1 libcucul0 libcurl3 libcvsservice0 libdatrie0
2300   libdirectfb-1.0-0 libdjvulibre21 libdvdread3 libfaad0 libfreebob0
2301   libgail-common libgd2-noxpm libgraphviz4 libgsmme1c2a libgtkhtml2-0
2302   libicu38 libiec61883-0 libindex0 libiw29 libk3b3 libkcal2b libkcddb1
2303   libkdeedu3 libkdepim1a libkgantt0 libkiten1 libkleopatra1 libkmime2
2304   libkpathsea4 libkpimexchange1 libkpimidentities1 libkscan1
2305   libksieve0 libktnef1 liblockdev1 libltdl3 libmagick10 libmimelib1c2a
2306   libmozjs1d libmpcdec3 libneon27 libnm-util0 libopensync0 libpisock9
2307   libpoppler-glib3 libpoppler-qt2 libpoppler3 libraw1394-8 libsmbios2
2308   libssh2-1 libsuitesparse-3.1.0 libtalloc1 libtiff-tools
2309   libxalan2-java libxalan2-java-gcj libxcb-xlib0 libxerces2-java
2310   libxerces2-java-gcj libxtrap6 mpeglib networkstatus
2311   openoffice.org-writer2latex pmount poster psutils quanta quanta-data
2312   superkaramba svgalibg1 tex-common texlive-base texlive-base-bin
2313   texlive-common texlive-doc-base texlive-fonts-recommended
2314   xserver-xorg-video-cyrix xserver-xorg-video-imstt
2315   xserver-xorg-video-nsc xserver-xorg-video-v4l xserver-xorg-video-vga
2316   xulrunner-1.9</p>
2317
2318
2319  </div>
2320  <div class="tags">
2321
2322
2323
2324   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
2325
2326  </div>
2327 </div>
2328 <div class="padding"></div>
2329
2330 <div class="entry">
2331  <div class="title">
2332  <a href="http://people.skolelinux.org/pere/blog/Officeshots_taking_shape.html">Officeshots taking shape</a>
2333  </div>
2334  <div class="date">
2335   2010-06-13 11:40
2336  </div>
2337
2338  <div class="body">
2339
2340 <p>For those of us caring about document exchange and
2341 interoperability, <a href="http://www.officeshots.org/">OfficeShots</a>
2342 is a great service.  It is to ODF documents what
2343 <a href="http://browsershots.org/">BrowserShots</a> is for web
2344 pages.</p>
2345
2346 <p>A while back, I was contacted by Knut Yrvin at the part of Nokia
2347 that used to be Trolltech, who wanted to help the OfficeShots project
2348 and wondered if the University of Oslo where I work would be
2349 interested in supporting the project.  I helped him to navigate his
2350 request to the right people at work, and his request was answered with
2351 a spot in the machine room with power and network connected, and Knut
2352 arranged funding for a machine to fill the spot.  The machine is
2353 administrated by the OfficeShots people, so I do not have daily
2354 contact with its progress, and thus from time to time check back to
2355 see how the project is doing.</p>
2356
2357 <p>Today I had a look, and was happy to see that the Dell box in our
2358 machine room now is the host for several virtual machines running as
2359 OfficeShots factories, and the project is able to render ODF documents
2360 in 17 different document processing implementation on Linux and
2361 Windows.  This is great.</p>
2362
2363  </div>
2364  <div class="tags">
2365
2366
2367
2368   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/standard">standard</a>.
2369
2370  </div>
2371 </div>
2372 <div class="padding"></div>
2373
2374 <div class="entry">
2375  <div class="title">
2376  <a href="http://people.skolelinux.org/pere/blog/Calling_tasksel_like_the_installer__while_still_getting_useful_output.html">Calling tasksel like the installer, while still getting useful output</a>
2377  </div>
2378  <div class="date">
2379   2010-06-16 14:55
2380  </div>
2381
2382  <div class="body">
2383
2384 <p>A few times I have had the need to simulate the way tasksel
2385 installs packages during the normal debian-installer run.  Until now,
2386 I have ended up letting tasksel do the work, with the annoying problem
2387 of not getting any feedback at all when something fails (like a
2388 conffile question from dpkg or a download that fails), using code like
2389 this:
2390
2391 <blockquote><pre>
2392 export DEBIAN_FRONTEND=noninteractive
2393 tasksel --new-install
2394 </pre></blockquote>
2395
2396 This would invoke tasksel, let its automatic task selection pick the
2397 tasks to install, and continue to install the requested tasks without
2398 any output what so ever.
2399
2400 Recently I revisited this problem while working on the automatic
2401 package upgrade testing, because tasksel would some times hang without
2402 any useful feedback, and I want to see what is going on when it
2403 happen.  Then it occured to me, I can parse the output from tasksel
2404 when asked to run in test mode, and use that aptitude command line
2405 printed by tasksel then to simulate the tasksel run.  I ended up using
2406 code like this:
2407
2408 <blockquote><pre>
2409 export DEBIAN_FRONTEND=noninteractive
2410 cmd="$(in_target tasksel -t --new-install | sed 's/debconf-apt-progress -- //')"
2411 $cmd
2412 </pre></blockquote>
2413
2414 <p>The content of $cmd is typically something like "<tt>aptitude -q
2415 --without-recommends -o APT::Install-Recommends=no -y install
2416 ~t^desktop$ ~t^gnome-desktop$ ~t^laptop$ ~pstandard ~prequired
2417 ~pimportant</tt>", which will install the gnome desktop task, the
2418 laptop task and all packages with priority standard , required and
2419 important, just like tasksel would have done it during
2420 installation.</p>
2421
2422 <p>A better approach is probably to extend tasksel to be able to
2423 install packages without using debconf-apt-progress, for use cases
2424 like this.</p>
2425
2426  </div>
2427  <div class="tags">
2428
2429
2430
2431   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
2432
2433  </div>
2434 </div>
2435 <div class="padding"></div>
2436
2437 <div class="entry">
2438  <div class="title">
2439  <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">Idea for a change to LDAP schemas allowing DNS and DHCP info to be combined into one object</a>
2440  </div>
2441  <div class="date">
2442   2010-06-24 00:35
2443  </div>
2444
2445  <div class="body">
2446
2447 <p>A while back, I
2448 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">complained
2449 about the fact</a> that it is not possible with the provided schemas
2450 for storing DNS and DHCP information in LDAP to combine the two sets
2451 of information into one LDAP object representing a computer.</p>
2452
2453 <p>In the mean time, I discovered that a simple fix would be to make
2454 the dhcpHost object class auxiliary, to allow it to be combined with
2455 the dNSDomain object class, and thus forming one object for one
2456 computer when storing both DHCP and DNS information in LDAP.</p>
2457
2458 <p>If I understand this correctly, it is not safe to do this change
2459 without also changing the assigned number for the object class, and I
2460 do not know enough about LDAP schema design to do that properly for
2461 Debian Edu.</p>
2462
2463 <p>Anyway, for future reference, this is how I believe we could change
2464 the
2465 <a href="http://tools.ietf.org/html/draft-ietf-dhc-ldap-schema-00">DHCP
2466 schema</a> to solve at least part of the problem with the LDAP schemas
2467 available today from IETF.</p>
2468
2469 <pre>
2470 --- dhcp.schema    (revision 65192)
2471 +++ dhcp.schema    (working copy)
2472 @@ -376,7 +376,7 @@
2473  objectclass ( 2.16.840.1.113719.1.203.6.6
2474         NAME 'dhcpHost'
2475         DESC 'This represents information about a particular client'
2476 -       SUP top
2477 +       SUP top AUXILIARY
2478         MUST cn
2479         MAY  (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
2480         X-NDS_CONTAINMENT ('dhcpService' 'dhcpSubnet' 'dhcpGroup') )
2481 </pre>
2482
2483 <p>I very much welcome clues on how to do this properly for Debian
2484 Edu/Squeeze.  We provide the DHCP schema in our debian-edu-config
2485 package, and should thus be free to rewrite it as we see fit.</p>
2486
2487 <p>If you want to help out with implementing this for Debian Edu,
2488 please contact us on debian-edu@lists.debian.org.</p>
2489
2490  </div>
2491  <div class="tags">
2492
2493
2494
2495   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
2496
2497  </div>
2498 </div>
2499 <div class="padding"></div>
2500
2501 <div class="entry">
2502  <div class="title">
2503  <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">LUMA, a very nice LDAP GUI</a>
2504  </div>
2505  <div class="date">
2506   2010-06-28 00:30
2507  </div>
2508
2509  <div class="body">
2510
2511 <p>The last few days I have been looking into the status of the LDAP
2512 directory in Debian Edu, and in the process I started to miss a GUI
2513 tool to browse the LDAP tree.  The only one I was able to find in
2514 Debian/Squeeze and Lenny is
2515 <a href="http://luma.sourceforge.net/">LUMA</a>, which has proved to
2516 be a great tool to get a overview of the current LDAP directory
2517 populated by default in Skolelinux.  Thanks to it, I have been able to
2518 find empty and obsolete subtrees, misplaced objects and duplicate
2519 objects.  It will be installed by default in Debian/Squeeze.  If you
2520 are working with LDAP, give it a go. :)</p>
2521
2522 <p>I did notice one problem with it I have not had time to report to
2523 the BTS yet.  There is no .desktop file in the package, so the tool do
2524 not show up in the Gnome and KDE menus, but only deep down in in the
2525 Debian submenu in KDE.  I hope that can be fixed before Squeeze is
2526 released.</p>
2527
2528 <p>I have not yet been able to get it to modify the tree yet.  I would
2529 like to move objects and remove subtrees directly in the GUI, but have
2530 not found a way to do that with LUMA yet.  So in the mean time, I use
2531 <a href="http://www.lichteblau.com/ldapvi/">ldapvi</a> for that.</p>
2532
2533 <p>If you have tips on other GUI tools for LDAP that might be useful
2534 in Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
2535
2536 <p>Update 2010-06-29: Ross Reedstrom tipped us about the
2537 <a href="http://packages.qa.debian.org/g/gq.html">gq</a> package as a
2538 useful GUI alternative.  It seem like a good tool, but is unmaintained
2539 in Debian and got a RC bug keeping it out of Squeeze.  Unless that
2540 changes, it will not be an option for Debian Edu based on Squeeze.</p>
2541
2542  </div>
2543  <div class="tags">
2544
2545
2546
2547   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
2548
2549  </div>
2550 </div>
2551 <div class="padding"></div>
2552
2553 <div class="entry">
2554  <div class="title">
2555  <a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a>
2556  </div>
2557  <div class="date">
2558   2010-07-01 11:40
2559  </div>
2560
2561  <div class="body">
2562
2563 <p>For a laptop, centralized user directories and password checking is
2564 a bit troubling.  Laptops are typically used also when not connected
2565 to the network, and it is vital for a user to be able to log in or
2566 unlock the screen saver also when a central server is unavailable.
2567 This is possible by caching passwords and directory information (user
2568 and group attributes) locally, and the packages to do so are available
2569 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
2570 It is also possible to set up in Debian/Lenny, but require more manual
2571 setup there because pam-auth-update is missing in Lenny.</p>
2572
2573 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
2574
2575 This is the traditional method with a twist.  The password caching is
2576 provided by libpam-ccreds (version 10-4 or later is needed on
2577 Squeeze), and the directory caching is done by nscd.  The directory
2578 lookup and password checking is done using LDAP.  If one want to use
2579 Kerberos for password checking the libpam-ldapd package can be
2580 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
2581 local home directory with the path listed in LDAP, one can use the
2582 pam_mkhomedir module from pam-modules to make this happen instead of
2583 using libpam-mklocaluser.  A setup for pam-auth-update to enable
2584 pam_mkhomedir will have to be written until a fix for
2585 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
2586 archive.  Because I believe it is a bad idea to have local home
2587 directories using misleading paths like /site/server/partition/, I
2588 prefer to create a local user with the home directory in /home/.  This
2589 is done using the libpam-mklocaluser package.</p>
2590
2591 <p>These packages need to be installed and configured</p>
2592
2593 <blockquote><pre>
2594 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
2595 </pre></blockquote>
2596
2597 <p>The ldapd packages will ask for LDAP connection information, and
2598 one have to fill in the values that fits ones own site.  Make sure the
2599 PAM part uses encrypted connections, to make sure the password is not
2600 sent in clear text to the LDAP server.  I've been unable to get TLS
2601 certificate checking for a self signed certificate working, which make
2602 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
2603 is talking to the correct LDAP server), and very much welcome feedback
2604 on how to get this working.</p>
2605
2606 <p>Because nscd do not have a default configuration fit for offline
2607 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
2608 is fixed, this configuration should be used instead of the one
2609 currently in /etc/nscd.conf.  The changes are in the fields
2610 reload-count and positive-time-to-live, and is based on the
2611 instructions I found in the
2612 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
2613 instructions by Flyn Computing.</p>
2614
2615 <blockquote><pre>
2616         debug-level             0
2617         reload-count            unlimited
2618         paranoia                no
2619
2620         enable-cache            passwd          yes
2621         positive-time-to-live   passwd          2592000
2622         negative-time-to-live   passwd          20
2623         suggested-size          passwd          211
2624         check-files             passwd          yes
2625         persistent              passwd          yes
2626         shared                  passwd          yes
2627         max-db-size             passwd          33554432
2628         auto-propagate          passwd          yes
2629
2630         enable-cache            group           yes
2631         positive-time-to-live   group           2592000
2632         negative-time-to-live   group           20
2633         suggested-size          group           211
2634         check-files             group           yes
2635         persistent              group           yes
2636         shared                  group           yes
2637         max-db-size             group           33554432
2638         auto-propagate          group           yes
2639
2640         enable-cache            hosts           no
2641         positive-time-to-live   hosts           2592000
2642         negative-time-to-live   hosts           20
2643         suggested-size          hosts           211
2644         check-files             hosts           yes
2645         persistent              hosts           yes
2646         shared                  hosts           yes
2647         max-db-size             hosts           33554432
2648
2649         enable-cache            services        yes
2650         positive-time-to-live   services        2592000
2651         negative-time-to-live   services        20
2652         suggested-size          services        211
2653         check-files             services        yes
2654         persistent              services        yes
2655         shared                  services        yes
2656         max-db-size             services        33554432
2657 </pre></blockquote>
2658
2659 <p>While we wait for a mechanism to update /etc/nsswitch.conf
2660 automatically like the one provided in
2661 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
2662 content need to be manually replaced to ensure LDAP is used as the
2663 directory service on the machine.  /etc/nsswitch.conf should normally
2664 look like this:</p>
2665
2666 <blockquote><pre>
2667 passwd:         files ldap
2668 group:          files ldap
2669 shadow:         files ldap
2670 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
2671 networks:       files
2672 protocols:      files
2673 services:       files
2674 ethers:         files
2675 rpc:            files
2676 netgroup:       files ldap
2677 </pre></blockquote>
2678
2679 <p>The important parts are that ldap is listed last for passwd, group,
2680 shadow and netgroup.</p>
2681
2682 <p>With these changes in place, any user in LDAP will be able to log
2683 in locally on the machine using for example kdm, get a local home
2684 directory created and have the password as well as user and group
2685 attributes cached.
2686
2687 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
2688   libpam-mklocaluser/pam_mkhomedir</h2>
2689
2690 <p>Because nscd have had its share of problems, and seem to have
2691 problems doing proper caching, I've seen suggestions and recipes to
2692 use nss-updatedb to copy parts of the LDAP database locally when the
2693 LDAP database is available.  I have not tested such setup, because I
2694 discovered sssd.</p>
2695
2696 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
2697
2698 <p>A more flexible and robust setup than the nscd combination
2699 mentioned earlier that has shown up recently, is the
2700 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
2701 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
2702 to provide a Active Directory like directory service for Linux
2703 machines.  The sssd system combines the caching of passwords and user
2704 information into one package, and remove the need for nscd and
2705 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
2706 1.2 do not support netgroups, but it is said that it will support this
2707 in version 1.5 expected to show up later in 2010.  Because the
2708 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
2709 was missing in Debian, I ended up co-maintaining it with Werner, and
2710 version 1.2 is now in testing.
2711
2712 <p>These packages need to be installed and configured to get the
2713 roaming setup I want</p>
2714
2715 <blockquote><pre>
2716 libpam-sss libnss-sss libpam-mklocaluser
2717 </pre></blockquote>
2718
2719 The complete setup of sssd is done by editing/creating
2720 <tt>/etc/sssd/sssd.conf</tt>.
2721
2722 <blockquote><pre>
2723 [sssd]
2724 config_file_version = 2
2725 reconnection_retries = 3
2726 sbus_timeout = 30
2727 services = nss, pam
2728 domains = INTERN
2729
2730 [nss]
2731 filter_groups = root
2732 filter_users = root
2733 reconnection_retries = 3
2734
2735 [pam]
2736 reconnection_retries = 3
2737
2738 [domain/INTERN]
2739 enumerate = false
2740 cache_credentials = true
2741
2742 id_provider = ldap
2743 auth_provider = ldap
2744 chpass_provider = ldap
2745
2746 ldap_uri = ldap://ldap
2747 ldap_search_base = dc=skole,dc=skolelinux,dc=no
2748 ldap_tls_reqcert = never
2749 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
2750 </pre></blockquote>
2751
2752 <p>I got the same problem here with certificate checking.  Had to set
2753 "ldap_tls_reqcert = never" to get it working.</p>
2754
2755 <p>With the libnss-sss package in testing at the moment, the
2756 nsswitch.conf file is update automatically, so there is no need to
2757 modify it manually.</p>
2758
2759 <p>If you want to help out with implementing this for Debian Edu,
2760 please contact us on debian-edu@lists.debian.org.</p>
2761
2762  </div>
2763  <div class="tags">
2764
2765
2766
2767   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
2768
2769  </div>
2770 </div>
2771 <div class="padding"></div>
2772
2773 <div class="entry">
2774  <div class="title">
2775  <a href="http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html">Lenny->Squeeze upgrades, apt vs aptitude with the Gnome desktop</a>
2776  </div>
2777  <div class="date">
2778   2010-07-03 23:55
2779  </div>
2780
2781  <div class="body">
2782
2783 <p>Here is a short update on my <a
2784 href="http://people.skolelinux.org/~pere/debian-upgrade-testing/">my
2785 Debian Lenny->Squeeze upgrade testing</a>.  Here is a summary of the
2786 difference for Gnome when it is upgraded by apt-get and aptitude.  I'm
2787 not reporting the status for KDE, because the upgrade crashes when
2788 aptitude try because of missing conflicts
2789 (<a href="http://bugs.debian.org/584861">#584861</a> and
2790 <a href="http://bugs.debian.org/585716">#585716</a>).</p>
2791
2792 <p>At the end of the upgrade test script, dpkg -l is executed to get a
2793 complete list of the installed packages.  Based on this I see these
2794 differences when I did a test run today.  As usual, I do not really
2795 know what the correct set of packages would be, but thought it best to
2796 publish the difference.</p>
2797
2798 <p>Installed using apt-get, missing with aptitude</p>
2799
2800 <blockquote><p>
2801   at-spi cpp-4.3 finger gnome-spell gstreamer0.10-gnomevfs
2802   libatspi1.0-0 libcupsys2 libeel2-data libgail-common libgdl-1-common
2803   libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin
2804   libgtksourceview-common libpt-1.10.10-plugins-alsa
2805   libpt-1.10.10-plugins-v4l libservlet2.4-java libxalan2-java
2806   libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip
2807   python-4suite-xml python-eggtrayicon python-gtkhtml2
2808   python-gtkmozembed svgalibg1 xserver-xephyr zip
2809 </p></blockquote>
2810
2811 <p>Installed using apt-get, removed with aptitude</p>
2812
2813 <blockquote><p>
2814   bluez-utils dhcdbd djvulibre-desktop epiphany-gecko
2815   gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager
2816   libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-50
2817   libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcurl3
2818   libdirectfb-1.0-0 libdvdread3 libedata-cal1.2-6 libedataserver1.2-9
2819   libeel2-2.20 libepc-1.0-1 libepc-ui-1.0-1 libexchange-storage1.2-3
2820   libfaad0 libgd2-noxpm libgda3-3 libgda3-common libggz2 libggzcore9
2821   libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnome-desktop-2
2822   libgnome-pilot2 libgnomecups1.0-1 libgnomeprint2.2-0
2823   libgnomeprintui2.2-0 libgpod3 libgraphviz4 libgtkhtml2-0
2824   libgtksourceview1.0-0 libgucharmap6 libhesiod0 libicu38 libisccc50
2825   libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++10
2826   libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4
2827   libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5
2828   libparted1.8-10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3
2829   libpt-1.10.10 libraw1394-8 libsensors3 libsmbios2 libsoup2.2-8
2830   libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1
2831   libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj
2832   libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3
2833   mysql-common swfdec-gnome totem-gstreamer wodim
2834 </p></blockquote>
2835
2836 <p>Installed using aptitude, missing with apt-get</p>
2837
2838 <blockquote><p>
2839   gnome gnome-desktop-environment hamster-applet python-gnomeapplet
2840   python-gnomekeyring python-wnck rhythmbox-plugins xorg
2841   xserver-xorg-input-all xserver-xorg-input-evdev
2842   xserver-xorg-input-kbd xserver-xorg-input-mouse
2843   xserver-xorg-input-synaptics xserver-xorg-video-all
2844   xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati
2845   xserver-xorg-video-chips xserver-xorg-video-cirrus
2846   xserver-xorg-video-dummy xserver-xorg-video-fbdev
2847   xserver-xorg-video-glint xserver-xorg-video-i128
2848   xserver-xorg-video-i740 xserver-xorg-video-mach64
2849   xserver-xorg-video-mga xserver-xorg-video-neomagic
2850   xserver-xorg-video-nouveau xserver-xorg-video-nv
2851   xserver-xorg-video-r128 xserver-xorg-video-radeon
2852   xserver-xorg-video-radeonhd xserver-xorg-video-rendition
2853   xserver-xorg-video-s3 xserver-xorg-video-s3virge
2854   xserver-xorg-video-savage xserver-xorg-video-siliconmotion
2855   xserver-xorg-video-sis xserver-xorg-video-sisusb
2856   xserver-xorg-video-tdfx xserver-xorg-video-tga
2857   xserver-xorg-video-trident xserver-xorg-video-tseng
2858   xserver-xorg-video-vesa xserver-xorg-video-vmware
2859   xserver-xorg-video-voodoo
2860 </p></blockquote>
2861
2862 <p>Installed using aptitude, removed with apt-get</p>
2863
2864 <blockquote><p>
2865   deskbar-applet xserver-xorg xserver-xorg-core
2866   xserver-xorg-input-wacom xserver-xorg-video-intel
2867   xserver-xorg-video-openchrome
2868 </p></blockquote>
2869
2870 <p>I was told on IRC that the xorg-xserver package was
2871 <a href="http://git.debian.org/?p=pkg-xorg/xserver/xorg-server.git;a=commit;h=9c8080d06c457932d3bfec021c69ac000aa60120">changed
2872 in git</a> today to try to get apt-get to not remove xorg completely.
2873 No idea when it hits Squeeze, but when it does I hope it will reduce
2874 the difference somewhat.
2875
2876  </div>
2877  <div class="tags">
2878
2879
2880
2881   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
2882
2883  </div>
2884 </div>
2885 <div class="padding"></div>
2886
2887 <div class="entry">
2888  <div class="title">
2889  <a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a>
2890  </div>
2891  <div class="date">
2892   2010-07-09 12:55
2893  </div>
2894
2895  <div class="body">
2896
2897 <p>Since
2898 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
2899 last post</a> about available LDAP tools in Debian, I was told about a
2900 LDAP GUI that is even better than luma.  The java application
2901 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
2902 moving LDAP objects and subtrees using drag-and-drop, and can
2903 authenticate using Kerberos.  I have only tested the Kerberos
2904 authentication, but do not have a LDAP setup allowing me to rewrite
2905 LDAP with my test user yet.  It is
2906 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
2907 Debian</a> testing and unstable at the moment.  The only problem I
2908 have with it is how it handle errors.  If something go wrong, its
2909 non-intuitive behaviour require me to go through some query work list
2910 and remove the failing query.  Nothing big, but very annoying.</p>
2911
2912  </div>
2913  <div class="tags">
2914
2915
2916
2917   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
2918
2919  </div>
2920 </div>
2921 <div class="padding"></div>
2922
2923 <div class="entry">
2924  <div class="title">
2925  <a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a>
2926  </div>
2927  <div class="date">
2928   2010-07-11 22:00
2929  </div>
2930
2931  <div class="body">
2932
2933 <p>Vagrant mentioned on IRC today that ltsp_config now support
2934 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
2935 clients, and that this can be used to fetch configuration from LDAP if
2936 Debian Edu choose to store configuration there.</p>
2937
2938 <p>Armed with this information, I got inspired and wrote a test module
2939 to get configuration from LDAP.  The idea is to look up the MAC
2940 address of the client in LDAP, and look for attributes on the form
2941 ltspconfigsetting=value, and use this to export SETTING=value to the
2942 LTSP clients.</p>
2943
2944 <p>The goal is to be able to store the LTSP configuration attributes
2945 in a "computer" LDAP object used by both DNS and DHCP, and thus
2946 allowing us to store all information about a computer in one place.</p>
2947
2948 <p>This is a untested draft implementation, and I welcome feedback on
2949 this approach.  A real LDAP schema for the ltspClientAux objectclass
2950 need to be written.  Comments, suggestions, etc?</p>
2951
2952 <blockquote><pre>
2953 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
2954 #
2955 # Fetch LTSP client settings from LDAP based on MAC address
2956 #
2957 # Uses ethernet address as stored in the dhcpHost objectclass using
2958 # the dhcpHWAddress attribute or ethernet address stored in the
2959 # ieee802Device objectclass with the macAddress attribute.
2960 #
2961 # This module is written to be schema agnostic, and only depend on the
2962 # existence of attribute names.
2963 #
2964 # The LTSP configuration variables are saved directly using a
2965 # ltspConfig prefix and uppercasing the rest of the attribute name.
2966 # To set the SERVER variable, set the ltspConfigServer attribute.
2967 #
2968 # Some LDAP schema should be created with all the relevant
2969 # configuration settings.  Something like this should work:
2970 #
2971 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
2972 #     SUP top
2973 #     AUXILIARY
2974 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
2975
2976 LDAPSERVER=$(debian-edu-ldapserver)
2977 if [ "$LDAPSERVER" ] ; then
2978     LDAPBASE=$(debian-edu-ldapserver -b)
2979     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
2980         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
2981         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
2982             grep '^ltspConfig' | while read attr value ; do
2983             # Remove prefix and convert to upper case
2984             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
2985             # bass value on to clients
2986             eval "$attr=$value; export $attr"
2987         done
2988     done
2989 fi
2990 </pre></blockquote>
2991
2992 <p>I'm not sure this shell construction will work, because I suspect
2993 the while block might end up in a subshell causing the variables set
2994 there to not show up in ltsp-config, but if that is the case I am sure
2995 the code can be restructured to make sure the variables are passed on.
2996 I expect that can be solved with some testing. :)</p>
2997
2998 <p>If you want to help out with implementing this for Debian Edu,
2999 please contact us on debian-edu@lists.debian.org.</p>
3000
3001 <p>Update 2010-07-17: I am aware of another effort to store LTSP
3002 configuration in LDAP that was created around year 2000 by
3003 <a href="http://www.pcxperience.com/thinclient/documentation/ldap.html">PC
3004 Xperience, Inc., 2000</a>.  I found its
3005 <a href="http://people.redhat.com/alikins/ltsp/ldap/">files</a> on a
3006 personal home page over at redhat.com.</p>
3007
3008  </div>
3009  <div class="tags">
3010
3011
3012
3013   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
3014
3015  </div>
3016 </div>
3017 <div class="padding"></div>
3018
3019 <div class="entry">
3020  <div class="title">
3021  <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a>
3022  </div>
3023  <div class="date">
3024   2010-07-14 23:45
3025  </div>
3026
3027  <div class="body">
3028
3029 <p>For a while now, I have wanted to find a way to change the DNS and
3030 DHCP services in Debian Edu to use the same LDAP objects for a given
3031 computer, to avoid the possibility of having a inconsistent state for
3032 a computer in LDAP (as in DHCP but no DNS entry or the other way
3033 around) and make it easier to add computers to LDAP.</p>
3034
3035 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
3036 information finally found a solution that seem to work.</p>
3037
3038 <p>The old setup required three LDAP objects for a given computer.
3039 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
3040 we switch powerdns to use its strict LDAP method (ldap-method=strict
3041 in pdns-debian-edu.conf), the forward and reverse DNS entries are
3042 merged into one while making it impossible to transfer the reverse map
3043 to a slave DNS server.</p>
3044
3045 <p>If we also replace the object class used to get the DNS related
3046 attributes to one allowing these attributes to be combined with the
3047 dhcphost object class, we can merge the DNS and DHCP entries into one.
3048 I've written such object class in the dnsdomainaux.schema file (need
3049 proper OIDs, but that is a minor issue), and tested the setup.  It
3050 seem to work.</p>
3051
3052 <p>With this test setup in place, we can get away with one LDAP object
3053 for both DNS and DHCP, and even the LTSP configuration I suggested in
3054 an earlier email.  The combined LDAP object will look something like
3055 this:</p>
3056
3057 <blockquote><pre>
3058   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
3059   cn: hostname
3060   objectClass: dhcphost
3061   objectclass: domainrelatedobject
3062   objectclass: dnsdomainaux
3063   associateddomain: hostname.intern
3064   arecord: 10.11.12.13
3065   dhcphwaddress: ethernet 00:00:00:00:00:00
3066   dhcpstatements: fixed-address hostname
3067   ldapconfigsound: Y
3068 </pre></blockquote>
3069
3070 <p>The DNS server uses the associateddomain and arecord entries, while
3071 the DHCP server uses the dhcphwaddress and dhcpstatements entries
3072 before asking DNS to resolve the fixed-adddress.  LTSP will use
3073 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
3074
3075 <p>I am not yet sure if I can get the DHCP server to look for its
3076 dhcphost in a different location, to allow us to put the objects
3077 outside the "DHCP Config" subtree, but hope to figure out a way to do
3078 that.  If I can't figure out a way to do that, we can still get rid of
3079 the hosts subtree and move all its content into the DHCP Config tree
3080 (which probably should be renamed to be more related to the new
3081 content.  I suspect cn=dnsdhcp,ou=services or something like that
3082 might be a good place to put it.</p>
3083
3084 <p>If you want to help out with implementing this for Debian Edu,
3085 please contact us on debian-edu@lists.debian.org.</p>
3086
3087  </div>
3088  <div class="tags">
3089
3090
3091
3092   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
3093
3094  </div>
3095 </div>
3096 <div class="padding"></div>
3097
3098 <div class="entry">
3099  <div class="title">
3100  <a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a>
3101  </div>
3102  <div class="date">
3103   2010-07-17 21:00
3104  </div>
3105
3106  <div class="body">
3107
3108 <p>This is a
3109 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
3110 on my
3111 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
3112 work</a> on
3113 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
3114 all</a> the computer related LDAP objects in Debian Edu.</p>
3115
3116 <p>As a step to try to see if it possible to merge the DNS and DHCP
3117 LDAP objects, I have had a look at how the packages pdns-backend-ldap
3118 and dhcp3-server-ldap in Debian use the LDAP server.  The two
3119 implementations are quite different in how they use LDAP.</p>
3120
3121 To get this information, I started slapd with debugging enabled and
3122 dumped the debug output to a file to get the LDAP searches performed
3123 on a Debian Edu main-server.  Here is a summary.
3124
3125 <p><strong>powerdns</strong></p>
3126
3127 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
3128 on how to</a> set up PowerDNS to use a LDAP backend is available on
3129 the web.
3130
3131 <p>PowerDNS have two modes of operation using LDAP as its backend.
3132 One "strict" mode where the forward and reverse DNS lookups are done
3133 using the same LDAP objects, and a "tree" mode where the forward and
3134 reverse entries are in two different subtrees in LDAP with a structure
3135 based on the DNS names, as in tjener.intern and
3136 2.2.0.10.in-addr.arpa.</p>
3137
3138 <p>In tree mode, the server is set up to use a LDAP subtree as its
3139 base, and uses a "base" scoped search for the DNS name by adding
3140 "dc=tjener,dc=intern," to the base with a filter for
3141 "(associateddomain=tjener.intern)" for the forward entry and
3142 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
3143 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
3144 forward entries, it is looking for attributes named dnsttl, arecord,
3145 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
3146 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
3147 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
3148 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
3149 spfrecord and modifytimestamp.  For reverse entries it is looking for
3150 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
3151 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
3152 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
3153 ldapsearch commands could look like this:</p>
3154
3155 <blockquote><pre>
3156 ldapsearch -h ldap \
3157   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
3158   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
3159   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
3160   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
3161   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
3162   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
3163
3164 ldapsearch -h ldap \
3165   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
3166   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
3167   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
3168   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
3169   srvrecord naptrrecord modifytimestamp
3170 </pre></blockquote>
3171
3172 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
3173 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
3174 example LDAP objects used there.  In addition to these objects, the
3175 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
3176 also exist.</p>
3177
3178 <blockquote><pre>
3179 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
3180 objectclass: top
3181 objectclass: dnsdomain
3182 objectclass: domainrelatedobject
3183 dc: tjener
3184 arecord: 10.0.2.2
3185 associateddomain: tjener.intern
3186
3187 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
3188 objectclass: top
3189 objectclass: dnsdomain2
3190 objectclass: domainrelatedobject
3191 dc: 2
3192 ptrrecord: tjener.intern
3193 associateddomain: 2.2.0.10.in-addr.arpa
3194 </pre></blockquote>
3195
3196 <p>In strict mode, the server behaves differently.  When looking for
3197 forward DNS entries, it is doing a "subtree" scoped search with the
3198 same base as in the tree mode for a object with filter
3199 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
3200 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
3201 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
3202 naptrrecord and modifytimestamp.  For reverse entires it also do a
3203 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
3204 and the requested attributes are associateddomain, dnsttl and
3205 modifytimestamp.  In short, in strict mode the objects with ptrrecord
3206 go away, and the arecord attribute in the forward object is used
3207 instead.</p>
3208
3209 <p>The forward and reverse searches can be simulated using ldapsearch
3210 like this:</p>
3211
3212 <blockquote><pre>
3213 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
3214   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
3215   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
3216   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
3217   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
3218   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
3219
3220 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
3221   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
3222 </pre></blockquote>
3223
3224 <p>In addition to the forward and reverse searches , there is also a
3225 search for SOA records, which behave similar to the forward and
3226 reverse lookups.</p>
3227
3228 <p>A thing to note with the PowerDNS behaviour is that it do not
3229 specify any objectclass names, and instead look for the attributes it
3230 need to generate a DNS reply.  This make it able to work with any
3231 objectclass that provide the needed attributes.</p>
3232
3233 <p>The attributes are normally provided in the cosine (RFC 1274) and
3234 dnsdomain2 schemas.  The latter is used for reverse entries like
3235 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
3236
3237 <p>In Debian Edu, we have created DNS objects using the object classes
3238 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
3239 attributes) and domainrelatedobject (for associatedDomain).  The use
3240 of structural object classes make it impossible to combine these
3241 classes with the object classes used by DHCP.</p>
3242
3243 <p>There are other schemas that could be used too, for example the
3244 dnszone structural object class used by Gosa and bind-sdb for the DNS
3245 attributes combined with the domainrelatedobject object class, but in
3246 this case some unused attributes would have to be included as well
3247 (zonename and relativedomainname).</p>
3248
3249 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
3250 mode and not use any of the existing objectclasses (dnsdomain,
3251 dnsdomain2 and dnszone) when one want to combine the DNS information
3252 with DHCP information, and instead create a auxiliary object class
3253 defined something like this (using the attributes defined for
3254 dnsdomain and dnsdomain2 or dnszone):</p>
3255
3256 <blockquote><pre>
3257 objectclass ( some-oid NAME 'dnsDomainAux'
3258     SUP top
3259     AUXILIARY
3260     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
3261           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
3262           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
3263           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
3264           A6Record $ DNAMERecord
3265     ))
3266 </pre></blockquote>
3267
3268 <p>This will allow any object to become a DNS entry when combined with
3269 the domainrelatedobject object class, and allow any entity to include
3270 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
3271 developers asking for their view on this schema and if they are
3272 interested in providing such schema with PowerDNS, and I hope my
3273 message will be accepted into their mailing list soon.</p>
3274
3275 <p><strong>ISC dhcp</strong></p>
3276
3277 <p>The DHCP server searches for specific objectclass and requests all
3278 the object attributes, and then uses the attributes it want.  This
3279 make it harder to figure out exactly what attributes are used, but
3280 thanks to the working example in Debian Edu I can at least get an idea
3281 what is needed without having to read the source code.</p>
3282
3283 <p>In the DHCP server configuration, the LDAP base to use and the
3284 search filter to use to locate the correct dhcpServer entity is
3285 stored.  These are the relevant entries from
3286 /etc/dhcp3/dhcpd.conf:</p>
3287
3288 <blockquote><pre>
3289 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
3290 ldap-dhcp-server-cn "dhcp";
3291 </pre></blockquote>
3292
3293 <p>The DHCP server uses this information to nest all the DHCP
3294 configuration it need.  The cn "dhcp" is located using the given LDAP
3295 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
3296 search result is this entry:</p>
3297
3298 <blockquote><pre>
3299 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
3300 cn: dhcp
3301 objectClass: top
3302 objectClass: dhcpServer
3303 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
3304 </pre></blockquote>
3305
3306 <p>The content of the dhcpServiceDN attribute is next used to locate the
3307 subtree with DHCP configuration.  The DHCP configuration subtree base
3308 is located using a base scope search with base "cn=DHCP
3309 Config,dc=skole,dc=skolelinux,dc=no" and filter
3310 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
3311 The search result is this entry:</p>
3312
3313 <blockquote><pre>
3314 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
3315 cn: DHCP Config
3316 objectClass: top
3317 objectClass: dhcpService
3318 objectClass: dhcpOptions
3319 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
3320 dhcpStatements: ddns-update-style none
3321 dhcpStatements: authoritative
3322 dhcpOption: smtp-server code 69 = array of ip-address
3323 dhcpOption: www-server code 72 = array of ip-address
3324 dhcpOption: wpad-url code 252 = text
3325 </pre></blockquote>
3326
3327 <p>Next, the entire subtree is processed, one level at the time.  When
3328 all the DHCP configuration is loaded, it is ready to receive requests.
3329 The subtree in Debian Edu contain objects with object classes
3330 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
3331 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
3332 and information about netmasks, dynamic range etc.  Leaving out the
3333 details here because it is not relevant for the focus of my
3334 investigation, which is to see if it is possible to merge dns and dhcp
3335 related computer objects.</p>
3336
3337 <p>When a DHCP request come in, LDAP is searched for the MAC address
3338 of the client (00:00:00:00:00:00 in this example), using a subtree
3339 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
3340 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
3341 00:00:00:00:00:00))" as the filter.  This is what a host object look
3342 like:</p>
3343
3344 <blockquote><pre>
3345 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
3346 cn: hostname
3347 objectClass: top
3348 objectClass: dhcpHost
3349 dhcpHWAddress: ethernet 00:00:00:00:00:00
3350 dhcpStatements: fixed-address hostname
3351 </pre></blockquote>
3352
3353 <p>There is less flexiblity in the way LDAP searches are done here.
3354 The object classes need to have fixed names, and the configuration
3355 need to be stored in a fairly specific LDAP structure.  On the
3356 positive side, the invidiual dhcpHost entires can be anywhere without
3357 the DN pointed to by the dhcpServer entries.  The latter should make
3358 it possible to group all host entries in a subtree next to the
3359 configuration entries, and this subtree can also be shared with the
3360 DNS server if the schema proposed above is combined with the dhcpHost
3361 structural object class.
3362
3363 <p><strong>Conclusion</strong></p>
3364
3365 <p>The PowerDNS implementation seem to be very flexible when it come
3366 to which LDAP schemas to use.  While its "tree" mode is rigid when it
3367 come to the the LDAP structure, the "strict" mode is very flexible,
3368 allowing DNS objects to be stored anywhere under the base cn specified
3369 in the configuration.</p>
3370
3371 <p>The DHCP implementation on the other hand is very inflexible, both
3372 regarding which LDAP schemas to use and which LDAP structure to use.
3373 I guess one could implement ones own schema, as long as the
3374 objectclasses and attributes have the names used, but this do not
3375 really help when the DHCP subtree need to have a fairly fixed
3376 structure.</p>
3377
3378 <p>Based on the observed behaviour, I suspect a LDAP structure like
3379 this might work for Debian Edu:</p>
3380
3381 <blockquote><pre>
3382 ou=services
3383   cn=machine-info (dhcpService) - dhcpServiceDN points here
3384     cn=dhcp (dhcpServer)
3385     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
3386       cn=10.0.2.0 (dhcpSubnet)
3387         cn=group1 (dhcpGroup/dhcpOptions)
3388     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
3389       cn=192.168.0.0 (dhcpSubnet)
3390         cn=group1 (dhcpGroup/dhcpOptions)
3391     ou=machines - PowerDNS base points here
3392       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
3393 </pre></blockquote>
3394
3395 <P>This is not tested yet.  If the DHCP server require the dhcpHost
3396 entries to be in the dhcpGroup subtrees, the entries can be stored
3397 there instead of a common machines subtree, and the PowerDNS base
3398 would have to be moved one level up to the machine-info subtree.</p>
3399
3400 <p>The combined object under the machines subtree would look something
3401 like this:</p>
3402
3403 <blockquote><pre>
3404 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
3405 dc: hostname
3406 objectClass: top
3407 objectClass: dhcpHost
3408 objectclass: domainrelatedobject
3409 objectclass: dnsDomainAux
3410 associateddomain: hostname.intern
3411 arecord: 10.11.12.13
3412 dhcpHWAddress: ethernet 00:00:00:00:00:00
3413 dhcpStatements: fixed-address hostname.intern
3414 </pre></blockquote>
3415
3416 </p>One could even add the LTSP configuration associated with a given
3417 machine, as long as the required attributes are available in a
3418 auxiliary object class.</p>
3419
3420  </div>
3421  <div class="tags">
3422
3423
3424
3425   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
3426
3427  </div>
3428 </div>
3429 <div class="padding"></div>
3430
3431 <div class="entry">
3432  <div class="title">
3433  <a href="http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html">OpenStreetmap one step closer to having routing on its front page</a>
3434  </div>
3435  <div class="date">
3436   2010-07-18 16:45
3437  </div>
3438
3439  <div class="body">
3440
3441 <p>Thanks to
3442 <a href="http://feedproxy.google.com/~r/Opengeodata/~3/wUTCzDZk3lc/project-of-the-week-which-way-home">todays
3443 opengeodata blog entry</a>, I just discovered that the
3444 OpenStreetmap.org site have gotten
3445 <a href="http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT">support
3446 for calculating routes</a>.  The support is still experimental and
3447 only available from the development server, until more experience is
3448 gathered on the user interface and any scalability issues.</p>
3449
3450 <p>Earlier, the routing I knew about using the OpenStreetmap.org data
3451 was provided by <a href="http://maps.cloudmade.com/">Cloudmade</a>,
3452 but having it on the main page is required to make everyone aware of
3453 the issue.  I've had people reject Openstreetmap.org as a viable
3454 alternative for them because the front page lacked routing support,
3455 and I hope their needs will be catered for when routing show up on the
3456 www.openstreetmap.org front page.</p>
3457
3458  </div>
3459  <div class="tags">
3460
3461
3462
3463   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/kart">kart</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
3464
3465  </div>
3466 </div>
3467 <div class="padding"></div>
3468
3469 <div class="entry">
3470  <div class="title">
3471  <a href="http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html">One step closer to single signon in Debian Edu</a>
3472  </div>
3473  <div class="date">
3474   2010-07-25 10:00
3475  </div>
3476
3477  <div class="body">
3478
3479 <p>The last few months me and the other Debian Edu developers have
3480 been working hard to get the Debian/Squeeze based version of Debian
3481 Edu/Skolelinux into shape.  This future version will use Kerberos for
3482 authentication, and services are slowly migrated to single signon,
3483 getting rid of password questions one at the time.</p>
3484
3485 <p>It will also feature a roaming workstation profile with local home
3486 directory, for laptops that are only some times on the Skolelinux
3487 network, and for this profile a shortcut is created in Gnome and KDE
3488 to gain access to the users home directory on the file server.  This
3489 shortcut uses SMB at the moment, and yesterday I had time to test if
3490 SMB mounting had started working in KDE after we added the cifs-utils
3491 package.  I was pleasantly surprised how well it worked.</p>
3492
3493 <p>Thanks to the recent changes to our samba configuration to get it
3494 to use Kerberos for authentication, there were no question about user
3495 password when mounting the SMB volume.  A simple click on the shortcut
3496 in the KDE menu, and a window with the home directory popped
3497 up. :)</p>
3498
3499 <p>One step closer to a single signon solution out of the box in
3500 Debian Edu.  We already had PAM, LDAP, IMAP and SMTP in place, and now
3501 also Samba.  Next step is Cups and hopefully also NFS.</p>
3502
3503 <p>We had planned a alpha0 release of Debian Edu for today, but thanks
3504 to the autobuilder administrators for some architectures being slow to
3505 sign packages, we are still missing the fixed LTSP package we need for
3506 the release.  It was uploaded three days ago with urgency=high, and if
3507 it had entered testing yesterday we would have been able to test it in
3508 time for a alpha0 release today.  As the binaries for ia64 and powerpc
3509 still not uploaded to the Debian archive, we need to delay the alpha
3510 release another day.</p>
3511
3512 <p>If you want to help out with implementing Kerberos for Debian Edu,
3513 please contact us on debian-edu@lists.debian.org.</p>
3514
3515  </div>
3516  <div class="tags">
3517
3518
3519
3520   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
3521
3522  </div>
3523 </div>
3524 <div class="padding"></div>
3525
3526 <div class="entry">
3527  <div class="title">
3528  <a href="http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html">First Debian Edu test release (alpha0) based on Squeeze is released</a>
3529  </div>
3530  <div class="date">
3531   2010-07-27 17:45
3532  </div>
3533
3534  <div class="body">
3535
3536 <p>I just posted this announcement culminating several months of work
3537 with the next Debian Edu release.  Not nearly done, but one major step
3538 completed.</p>
3539
3540 <blockquote>
3541 <p>This is the first test release based on Squeeze. The focus of this
3542 release is to test the user application selection. To have a look,
3543 install the standalone profile and let the developers know if the set
3544 of installed packages i.e. applications should be modified. If some
3545 user application is missing, or if there are some applications that no
3546 longer make sense to be included in Debian Edu, please let us know.
3547 Also, if a useful application is missing the translation for your
3548 language of choice, please let us know too.</p>
3549
3550 <p>In addition, feedback and help to polish the desktop (menus,
3551 artwork, starters, etc.) is appreciated. We would like to ship a nice
3552 and handy KDE4 desktop targeted for schools out of the box.</p>
3553
3554 <p>The other profiles should be installable, but there is a lot more
3555 work left to be done before they are ready, so do not expect to
3556 much.</p>
3557
3558 <p>Changes compared to the lenny based version</p>
3559
3560 <ul>
3561 <li>Everything from Debian Squeeze
3562 <ul>
3563   <li>Desktop environment KDE 4.4 => the new KDE desktop in
3564          combination with some new artwork
3565   <li>Web browser Iceweasel 3.5
3566   <li>OpenOffice.org 3.2
3567   <li>Educational toolbox GCompris 9.3
3568   <li>Music creator Rosegarden 10.04.2
3569   <li>Image editor Gimp 2.6.10
3570   <li>Virtual universe Celestia 1.6.0
3571   <li>Virtual stargazer Stellarium 0.10.4
3572   <li>3D modeler Blender 2.49.2 (new application)
3573   <li>Video editor Kdenlive 0.7.7 (new application)
3574 </ul></li>
3575 <li>Now using Kerberos for password checking (migration not finished).
3576     Enabled for:
3577 <ul>
3578   <li>PAM
3579   <li>LDAP
3580   <li>IMAP
3581   <li>SMTP (sender verification)
3582 </ul>
3583 </li>
3584 <li>New experimental roaming workstation profile for laptops.</li>
3585 <li>Show welcome page to users when they first log in. The URL is
3586     fetched from LDAP.</li>
3587 <li>New LXDE desktop option, in addition to KDE (default) and Gnome.</li>
3588 <li>General cleanup (not finished)</li>
3589 </ul>
3590 <p>The following features are not working as they should</p>
3591
3592 <ul>
3593 <li>No web based administration tool for creating users and groups. The
3594     scripts ldap-createuser-krb and ldap-add-user-to-group can be used
3595     for testing.</li>
3596 <li>DVD installs are missing debian-installer images for the PXE boot,
3597     and do not set up the PXE menu on eth0 because of this. LTSP
3598     clients should still boot from eth1 on thin client servers.</li>
3599 <li>The restructured KDE menu is not implemented.</li>
3600 <li>The LDAP server setup need to be reviewed for security.</li>
3601 <li>The LDAP directory structure need to be reworked.</li>
3602 <li>Different sets of packages are installed when using the DVD and the
3603     netinst CD. More packages are installed using the netinst CD.</li>
3604 <li>The jackd package fail to install. This is believed to be caused by
3605     some ongoing transition, and hopefully should be solved soon. The
3606     jackd1 package can be installed manually for those that need it.</li>
3607 <li>Some packages lack translations. See
3608     http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status,
3609     and help out with translations.</li>
3610 </ul>
3611
3612 <p>To download this multiarch netinstall release you can use</p>
3613
3614 <ul>
3615 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
3616 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
3617 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</li>
3618 </ul>
3619 <p>To download this multiarch dvd release you can use</p>
3620
3621 <ul>
3622 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
3623 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
3624 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</li>
3625 </ul>
3626
3627 <p>There is no source DVD available yet. It will be prepared when we
3628 get closer to the final release.</p>
3629
3630 <p>The MD5SUM of these images are</p>
3631
3632 <ul>
3633 <li>3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-6.0.0+edua0-CD.iso</li>
3634 <li>22f2cbfce281d1c6e478be452638675d debian-edu-6.0.0+edua0-DVD.iso</li>
3635 </ul>
3636
3637 <p>The SHA1SUM of these images are</p>
3638 <ul>
3639 <li>c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-6.0.0+edua0-CD.iso</li>
3640 <li>2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-6.0.0+edua0-DVD.iso</li>
3641 </ul>
3642 <p>How to report bugs:
3643 http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla</p>
3644
3645 <p>Please direct replies to debian-edu@lists.debian.org</p>
3646 </blockquote>
3647
3648  </div>
3649  <div class="tags">
3650
3651
3652
3653   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
3654
3655  </div>
3656 </div>
3657 <div class="padding"></div>
3658
3659 <div class="entry">
3660  <div class="title">
3661  <a href="http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html">Circular package dependencies harms apt recovery</a>
3662  </div>
3663  <div class="date">
3664   2010-07-27 23:50
3665  </div>
3666
3667  <div class="body">
3668
3669 <p>I discovered this while doing
3670 <a href="http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html">automated
3671 testing of upgrades from Debian Lenny to Squeeze</a>.  A few packages
3672 in Debian still got circular dependencies, and it is often claimed
3673 that apt and aptitude should be able to handle this just fine, but
3674 some times these dependency loops causes apt to fail.</p>
3675
3676 <p>An example is from todays
3677 <a href="http://people.skolelinux.org/~pere/debian-upgrade-testing//test-20100727-lenny-squeeze-kde-aptitude.txt">upgrade
3678 of KDE using aptitude</a>.  In it, a bug in kdebase-workspace-data
3679 causes perl-modules to fail to upgrade.  The cause is simple.  If a
3680 package fail to unpack, then only part of packages with the circular
3681 dependency might end up being unpacked when unpacking aborts, and the
3682 ones already unpacked will fail to configure in the recovery phase
3683 because its dependencies are unavailable.</p>
3684
3685 <p>In this log, the problem manifest itself with this error:</p>
3686
3687 <blockquote><pre>
3688 dpkg: dependency problems prevent configuration of perl-modules:
3689  perl-modules depends on perl (>= 5.10.1-1); however:
3690   Version of perl on system is 5.10.0-19lenny2.
3691 dpkg: error processing perl-modules (--configure):
3692  dependency problems - leaving unconfigured
3693 </pre></blockquote>
3694
3695 <p>The perl/perl-modules circular dependency is already
3696 <a href="http://bugs.debian.org/527917">reported as a bug</a>, and will
3697 hopefully be solved as soon as possible, but it is not the only one,
3698 and each one of these loops in the dependency tree can cause similar
3699 failures.  Of course, they only occur when there are bugs in other
3700 packages causing the unpacking to fail, but it is rather nasty when
3701 the failure of one package causes the problem to become worse because
3702 of dependency loops.</p>
3703
3704 <p>Thanks to
3705 <a href="http://lists.debian.org/debian-devel/2010/06/msg00116.html">the
3706 tireless effort by Bill Allombert</a>, the number of circular
3707 dependencies
3708 <a href="http://debian.semistable.com/debgraph.out.html">left in Debian
3709 is dropping</a>, and perhaps it will reach zero one day. :)</p>
3710
3711 <p>Todays testing also exposed a bug in
3712 <a href="http://bugs.debian.org/590605">update-notifier</a> and
3713 <a href="http://bugs.debian.org/590604">different behaviour</a> between
3714 apt-get and aptitude, the latter possibly caused by some circular
3715 dependency.  Reported both to BTS to try to get someone to look at
3716 it.</p>
3717
3718  </div>
3719  <div class="tags">
3720
3721
3722
3723   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
3724
3725  </div>
3726 </div>
3727 <div class="padding"></div>
3728
3729 <div class="entry">
3730  <div class="title">
3731  <a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">Debian Edu roaming workstation - at the university of Oslo</a>
3732  </div>
3733  <div class="date">
3734   2010-08-03 23:30
3735  </div>
3736
3737  <div class="body">
3738
3739 <p>The new roaming workstation profile in Debian Edu/Squeeze is fairly
3740 similar to the laptop setup am I working on using Ubuntu for the
3741 University of Oslo, and just for the heck of it, I tested today how
3742 hard it would be to integrate that profile into the university
3743 infrastructure.  In this case, it is the university LDAP server,
3744 Active Directory Kerberos server and SMB mounting from the Netapp file
3745 servers.</p>
3746
3747 <p>I was pleasantly surprised that the only three files needed to be
3748 changed (/etc/sssd/sssd.conf, /etc/ldap.conf and
3749 /etc/mklocaluser.d/20-debian-edu-config) and one file had to be added
3750 (/usr/share/perl5/Debian/Edu_Local.pm), to get the client working.
3751 Most of the changes were to get the client to use the university LDAP
3752 for NSS and Kerberos server for PAM, but one was to change a hard
3753 coded DNS domain name in the mklocaluser hook from .intern to
3754 .uio.no.</p>
3755
3756 <p>This testing was so encouraging, that I went ahead and adjusted the
3757 Debian Edu scripts and setup in subversion to centralise the roaming
3758 workstation setup a bit more and avoid the hardcoded DNS domain name,
3759 so that when I test this tomorrow, I expect to get away with modifying
3760 only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the
3761 university servers.</p>
3762
3763 <p>My goal is to get the clients to have no hardcoded settings and
3764 fetch all their initial setup during installation and first boot, to
3765 allow them to be inserted also into environments where the default
3766 setup in Debian Edu has been changed or as with the university, where
3767 the environment is different but provides the protocols Debian Edu
3768 uses.</p>
3769
3770  </div>
3771  <div class="tags">
3772
3773
3774
3775   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
3776
3777  </div>
3778 </div>
3779 <div class="padding"></div>
3780
3781 <div class="entry">
3782  <div class="title">
3783  <a href="http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html">Autodetecting Client setup for roaming workstations in Debian Edu</a>
3784  </div>
3785  <div class="date">
3786   2010-08-07 14:45
3787  </div>
3788
3789  <div class="body">
3790
3791 <p>A few days ago, I
3792 <a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">tried
3793 to install</a> a Roaming workation profile from Debian Edu/Squeeze
3794 while on the university network here at the University of Oslo, and
3795 noticed how much had to change to get it operational using the
3796 university infrastructure.  It was fairly easy, but it occured to me
3797 that Debian Edu would improve a lot if I could get the client to
3798 connect without any changes at all, and thus let the client configure
3799 itself during installation and first boot to use the infrastructure
3800 around it.  Now I am a huge step further along that road.</p>
3801
3802 <p>With our current squeeze-test packages, I can select the roaming
3803 workstation profile and get a working laptop connecting to the
3804 university LDAP server for user and group and our active directory
3805 servers for Kerberos authentication.  All this without any
3806 configuration at all during installation.  My users home directory got
3807 a bookmark in the KDE menu to mount it via SMB, with the correct URL.
3808 In short, openldap and sssd is correctly configured.  In addition to
3809 this, the client look for http://wpad/wpad.dat to configure a web
3810 proxy, and when it fail to find it no proxy settings are stored in
3811 /etc/environment and /etc/apt/apt.conf.  Iceweasel and KDE is
3812 configured to look for the same wpad configuration and also do not use
3813 a proxy when at the university network.  If the machine is moved to a
3814 network with such wpad setup, it would automatically use it when DHCP
3815 gave it a IP address.</p>
3816
3817 <p>The LDAP server is located using DNS, by first looking for the DNS
3818 entry ldap.$domain.  If this do not exist, it look for the
3819 _ldap._tcp.$domain SRV records and use the first one as the LDAP
3820 server.  Next, it connects to the LDAP server and search all
3821 namingContexts entries for posixAccount or posixGroup objects, and
3822 pick the first one as the LDAP base.  For Kerberos, a similar
3823 algorithm is used to locate the LDAP server, and the realm is the
3824 uppercase version of $domain.</p>
3825
3826 <p>So, what is not working, you might ask.  SMB mounting my home
3827 directory do not work.  No idea why, but suspected the incorrect
3828 Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
3829 the cause.  These are not properly configured during installation, and
3830 had to be hand-edited to get the correct Kerberos realm and server,
3831 but SMB mounting still do not work. :(</p>
3832
3833 <p>With this automatic configuration in place, I expect a Debian Edu
3834 roaming profile installation would be able to automatically detect and
3835 connect to any site using LDAP and Kerberos for NSS directory and PAM
3836 authentication.  It should also work out of the box in a Active
3837 Directory environment providing posixAccount and posixGroup objects
3838 with UID and GID values.</p>
3839
3840 <p>If you want to help out with implementing these things for Debian
3841 Edu, please contact us on debian-edu@lists.debian.org.</p>
3842
3843  </div>
3844  <div class="tags">
3845
3846
3847
3848   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
3849
3850  </div>
3851 </div>
3852 <div class="padding"></div>
3853
3854 <div class="entry">
3855  <div class="title">
3856  <a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">Testing if a file system can be used for home directories...</a>
3857  </div>
3858  <div class="date">
3859   2010-08-08 21:20
3860  </div>
3861
3862  <div class="body">
3863
3864 <p>A few years ago, I was involved in a project planning to use
3865 Windows file servers as home directory servers for Debian
3866 Edu/Skolelinux machines.  This was thought to be no problem, as the
3867 access would be through the SMB network file system protocol, and we
3868 knew other sites used SMB with unix and samba as the file server to
3869 mount home directories without any problems.  But, after months of
3870 struggling, we had to conclude that our goal was impossible.</p>
3871
3872 <p>The reason is simply that while SMB can be used for home
3873 directories when the file server is Samba running on Unix, this only
3874 work because of Samba have some extensions and the fact that the
3875 underlying file system is a unix file system.  When using a Windows
3876 file server, the underlying file system do not have POSIX semantics,
3877 and several programs will fail if the users home directory where they
3878 want to store their configuration lack POSIX semantics.</p>
3879
3880 <p>As part of this work, I wrote a small C program I want to share
3881 with you all, to replicate a few of the problematic applications (like
3882 OpenOffice.org and GCompris) and see if the file system was working as
3883 it should.  If you find yourself in spooky file system land, it might
3884 help you find your way out again.  This is the fs-test.c source:</p>
3885
3886 <pre>
3887 /*
3888  * Some tests to check the file system sematics.  Used to verify that
3889  * CIFS from a windows server do not work properly as a linux home
3890  * directory.
3891  * License: GPL v2 or later
3892  *
3893  * needs libsqlite3-dev and build-essential installed
3894  * compile with: gcc -Wall -lsqlite3 -DTEST_SQLITE fs-test.c -o fs-test
3895 */
3896
3897 #define _FILE_OFFSET_BITS 64
3898 #define _LARGEFILE_SOURCE 1
3899 #define _LARGEFILE64_SOURCE 1
3900
3901 #define _GNU_SOURCE /* for asprintf() */
3902
3903 #include &lt;errno.h>
3904 #include &lt;fcntl.h>
3905 #include &lt;stdio.h>
3906 #include &lt;string.h>
3907 #include &lt;stdlib.h>
3908 #include &lt;sys/file.h>
3909 #include &lt;sys/stat.h>
3910 #include &lt;sys/types.h>
3911 #include &lt;unistd.h>
3912
3913 #ifdef TEST_SQLITE
3914 /*
3915  * Test sqlite open, as done by gcompris require the libsqlite3-dev
3916  * package and linking with -lsqlite3.  A more low level test is
3917  * below.
3918  * See also &lt;URL: http://www.sqlite.org./faq.html#q5 >.
3919  */
3920 #include &lt;sqlite3.h>
3921 #define CREATE_TABLE_USERS                                              \
3922   "CREATE TABLE users (user_id INT UNIQUE, login TEXT, lastname TEXT, firstname TEXT, birthdate TEXT, class_id INT ); "
3923 int test_sqlite_open(void) {
3924   char *zErrMsg;
3925   char *name = "testsqlite.db";
3926   sqlite3 *db=NULL;
3927   unlink(name);
3928   int rc = sqlite3_open(name, &db);
3929   if( rc ){
3930     printf("error: sqlite open of %s failed: %s\n", name, sqlite3_errmsg(db));
3931     sqlite3_close(db);
3932     return -1;
3933   }
3934
3935   /* create tables */
3936   rc = sqlite3_exec(db,CREATE_TABLE_USERS, NULL,  0, &zErrMsg);
3937   if( rc != SQLITE_OK ){
3938     printf("error: sqlite table create failed: %s\n", zErrMsg);
3939     sqlite3_close(db);
3940     return -1;
3941   }
3942   printf("info: sqlite worked\n");
3943   sqlite3_close(db);
3944   return 0;
3945 }
3946 #endif /* TEST_SQLITE */
3947
3948 /*
3949  * Demonstrate locking issue found in gcompris using sqlite3.  This
3950  * work with ext3, but not with cifs server on Windows 2003.  This is
3951  * done in the sqlite3 library.
3952  * See also
3953  * &lt;URL:http://www.cygwin.com/ml/cygwin/2001-08/msg00854.html> and the
3954  * POSIX specification
3955  * &lt;URL:http://www.opengroup.org/onlinepubs/009695399/functions/fcntl.html>.
3956  */
3957 int test_gcompris_locking(void) {
3958   struct flock fl;
3959   char *name = "testsqlite.db";
3960   unlink(name);
3961   int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, 0644);
3962   printf("info: testing fcntl locking\n");
3963
3964   fl.l_whence = SEEK_SET;
3965   fl.l_pid    = getpid();
3966   printf("  Read-locking 1 byte from 1073741824");
3967   fl.l_start  = 1073741824;
3968   fl.l_len    = 1;
3969   fl.l_type   = F_RDLCK;
3970   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
3971
3972   printf("  Read-locking 510 byte from 1073741826");
3973   fl.l_start  = 1073741826;
3974   fl.l_len    = 510;
3975   fl.l_type   = F_RDLCK;
3976   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
3977
3978   printf("  Unlocking 1 byte from 1073741824");
3979   fl.l_start  = 1073741824;
3980   fl.l_len    = 1;
3981   fl.l_type   = F_UNLCK;
3982   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
3983
3984   printf("  Write-locking 1 byte from 1073741824");
3985   fl.l_start  = 1073741824;
3986   fl.l_len    = 1;
3987   fl.l_type   = F_WRLCK;
3988   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
3989
3990   printf("  Write-locking 510 byte from 1073741826");
3991   fl.l_start  = 1073741826;
3992   fl.l_len    = 510;
3993   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
3994
3995   printf("  Unlocking 2 byte from 1073741824");
3996   fl.l_start  = 1073741824;
3997   fl.l_len    = 2;
3998   fl.l_type   = F_UNLCK;
3999   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
4000
4001   close(fd);
4002   return 0;
4003 }
4004
4005 /*
4006  * Test if permissions of freshly created directories allow entries
4007  * below them.  This was a problem with OpenOffice.org and gcompris.
4008  * Mounting with option 'sync' seem to solve this problem while
4009  * slowing down file operations.
4010  */
4011 int test_subdirectory_creation(void) {
4012 #define LEVELS 5
4013   char *path = strdup("test");
4014   char *dirs[LEVELS];
4015   int level;
4016   printf("info: testing subdirectory creation\n");
4017   for (level = 0; level &lt; LEVELS; level++) {
4018     char *newpath = NULL;
4019     if (-1 == mkdir(path, 0777)) {
4020       printf("  error: Unable to create directory '%s': %s\n",
4021              path, strerror(errno));
4022       break;
4023     }
4024     asprintf(&newpath, "%s/%s", path, "test");
4025     free(path);
4026     path = newpath;
4027   }
4028   return 0;
4029 }
4030
4031 /*
4032  * Test if symlinks can be created.  This was a problem detected with
4033  * KDE.
4034  */
4035 int test_symlinks(void) {
4036   printf("info: testing symlink creation\n");
4037   unlink("symlink");
4038   if (-1 == symlink("file", "symlink"))
4039     printf("  error: Unable to create symlink\n");
4040   return 0;
4041 }
4042
4043 int main(int argc, char **argv) {
4044   printf("Testing POSIX/Unix sematics on file system\n");
4045   test_symlinks();
4046   test_subdirectory_creation();
4047 #ifdef TEST_SQLITE
4048   test_sqlite_open();
4049 #endif /* TEST_SQLITE */
4050   test_gcompris_locking();
4051   return 0;
4052 }
4053 </pre>
4054
4055 <p>When everything is working, it should print something like
4056 this:</p>
4057
4058 <pre>
4059 Testing POSIX/Unix sematics on file system
4060 info: testing symlink creation
4061 info: testing subdirectory creation
4062 info: sqlite worked
4063 info: testing fcntl locking
4064   Read-locking 1 byte from 1073741824
4065   Read-locking 510 byte from 1073741826
4066   Unlocking 1 byte from 1073741824
4067   Write-locking 1 byte from 1073741824
4068   Write-locking 510 byte from 1073741826
4069   Unlocking 2 byte from 1073741824
4070 </pre>
4071
4072 <p>I do not remember the exact details of the problems we saw, but one
4073 of them was with locking, where if I remember correctly, POSIX allow a
4074 read-only lock to be upgraded to a read-write lock without unlocking
4075 the read-only lock (while Windows do not).  Another was a bug in the
4076 CIFS/SMB client implementation in the Linux kernel where directory
4077 meta information would be wrong for a fraction of a second, making
4078 OpenOffice.org fail to create its deep directory tree because it was
4079 not allowed to create files in its freshly created directory.</p>
4080
4081 <p>Anyway, here is a nice tool for your tool box, might you never need
4082 it. :)</p>
4083
4084  </div>
4085  <div class="tags">
4086
4087
4088
4089   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
4090
4091  </div>
4092 </div>
4093 <div class="padding"></div>
4094
4095 <div class="entry">
4096  <div class="title">
4097  <a href="http://people.skolelinux.org/pere/blog/No_hardcoded_config_on_Debian_Edu_clients.html">No hardcoded config on Debian Edu clients</a>
4098  </div>
4099  <div class="date">
4100   2010-08-09 20:15
4101  </div>
4102
4103  <div class="body">
4104
4105 <p>As reported earlier, the last few days I have looked at how Debian
4106 Edu clients are configured, and tried to get rid of all hardcoded
4107 configuration settings on the clients.  I believe the work to be
4108 mostly done, and the clients seem to work just fine with dynamically
4109 generated configuration.</p>
4110
4111 <p>What is the point, you might ask?  The point is to allow a Debian
4112 Edu desktop to integrate into an existing network infrastructure
4113 without any manual configuration.</p>
4114
4115 <p>This is what happens when installing a Debian Edu client here at
4116 the University of Oslo using PXE.  With the PXE installation, I am
4117 asked for language (Norwegian Bokmål), locality (Norway) and keyboard
4118 layout (no-latin1), Debian Edu profile (Roaming Workstation), if I
4119 accept to reformat the hard drive (yes), if I want to submit info to
4120 popcon.debian.org (no) and root password (secret).  After answering
4121 these questions, the installer goes ahead and does its thing, and
4122 after around 50 minutes it is done.  I press enter to finish the
4123 installation, and the machine reboots into KDE.  When the machine is
4124 ready and kdm asks for login information, I enter my university
4125 username and password, am told by kdm that a local home directory has
4126 been created and that I must log in again, and finally log in with the
4127 same username and password to the KDE 4.4 desktop.  At no point during
4128 this process did it ask for university specific settings, and all the
4129 required configuration was dynamically detected using information
4130 fetched via DHCP and DNS.  The roaming workstation is now ready for
4131 use.</p>
4132
4133 <p>How was this done, you might wonder?  First of all, here is the
4134 list of things that need to be configured on the client to get it
4135 working properly out of the box:</p>
4136
4137 <ul>
4138 <li>IP address/netmask and DNS server.</li>
4139 <li>Web proxy URL.</li>
4140 <li>LDAP server for NSS directory information (user, group, etc).</li>
4141 <li>Kerberos server for PAM password checking.</li>
4142 <li>SMB mount point to access the network home directory. (*)</li>
4143 <li>Central syslog server to send syslog messages to. (*)</li>
4144 <li>Sitesummary collector URL to submit info to central server. (*)</li>
4145 </ul>
4146
4147 <p>(Hm, did I forget anything?  Let me knew if I did.)</p>
4148
4149 <p>The points marked (*) are not required to be able to use the
4150 machine, but needed to provide central storage and allowing system
4151 administrators to track their machines.  Since yesterday, everything
4152 but the sitesummary collector URL is dynamically discovered at boot
4153 and installation time in the svn version of Debian Edu.</p>
4154
4155 <p>The IP and DNS setup is fetched during boot using DHCP as usual.
4156 When a DHCP update arrives, the proxy setup is updated by looking for
4157 http://wpat/wpad.dat and using the content of this WPAD file to
4158 configure the http and ftp proxy in /etc/environment and
4159 /etc/apt/apt.conf.  I decided to update the proxy setup using a DHCP
4160 hook to ensure that the client stops using the Debian Edu proxy when
4161 it is moved outside the Debian Edu network, and instead uses any local
4162 proxy present on the new network when it moves around.</p>
4163
4164 <p>The DNS names of the LDAP, Kerberos and syslog server and related
4165 configuration are generated using DNS information at boot.  First the
4166 installer looks for a host named ldap in the current DNS domain.  If
4167 not found, it looks for _ldap._tcp SRV records in DNS instead.  If an
4168 LDAP server is found, its root DSE entry is requested and the
4169 attributes namingContexts and defaultNamingContext are used to
4170 determine which LDAP base to use for NSS.  If there are several
4171 namingContexts attibutes and the defaultNamingContext is present, that
4172 LDAP subtree is used as the base.  If defaultNamingContext is missing,
4173 the subtrees listed as namingContexts are searched in sequence for any
4174 object with class posixAccount or posixGroup, and the first one with
4175 such an object is used as the LDAP base.  For Kerberos, a similar
4176 search is done by first looking for a host named kerberos, and then
4177 for the _kerberos._tcp SRV record.  I've been unable to find a way to
4178 look up the Kerberos realm, so for this the upper case string of the
4179 current DNS domain is used.</p>
4180
4181 <p>For the syslog server, the hosts syslog and loghost are searched
4182 for, and the _syslog._udp SRV record is consulted if no such host is
4183 found.  This algorithm works for both Debian Edu and the University of
4184 Oslo.  A similar strategy would work for locating the sitesummary
4185 server, but have not been implemented yet.  I decided to fetch and
4186 save these settings during installation, to make sure moving to a
4187 different network does not change the set of users being allowed to
4188 log in nor the passwords required to log in.  Usernames and passwords
4189 will be cached by sssd when the user logs in on the Debian Edu
4190 network, and will not change as the laptop move around.  For a
4191 non-roaming machine, there is no caching, but given that it is
4192 supposed to stay in place it should not matter much.  Perhaps we
4193 should switch those to use sssd too?</p>
4194
4195 <p>The user's SMB mount point for the network home directory is
4196 located when the user logs in for the first time.  The LDAP server is
4197 consulted to look for the user's LDAP object and the sambaHomePath
4198 attribute is used if found.  If it isn't found, the home directory
4199 path fetched from NSS is used instead.  Assuming the path is of the
4200 form /site/server/directory/username, the second part is looked up in
4201 DNS and used to generate a SMB URL of the form
4202 smb://server.domain/username.  This algorithm works for both Debian
4203 edu and the University of Oslo.  Perhaps there are better attributes
4204 to use or a better algorithm that works for more sites, but this will
4205 do for now. :)</p>
4206
4207 <p>This work should make it easier to integrate the Debian Edu clients
4208 into any LDAP/Kerberos infrastructure, and make the current setup even
4209 more flexible than before.  I suspect it will also work for thin
4210 client servers, allowing one to easily set up LTSP and hook it into a
4211 existing network infrastructure, but I have not had time to test this
4212 yet.</p>
4213
4214 <p>If you want to help out with implementing these things for Debian
4215 Edu, please contact us on debian-edu@lists.debian.org.</p>
4216
4217  </div>
4218  <div class="tags">
4219
4220
4221
4222   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
4223
4224  </div>
4225 </div>
4226 <div class="padding"></div>
4227
4228  <p style="text-align: right;"><a href="english.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14"></a></p>
4229
4230
4231
4232
4233 <div id="sidebar">
4234
4235 <h2>Archive</h2>
4236 <ul>
4237
4238 <li>2010
4239 <ul>
4240
4241 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
4242
4243 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
4244
4245 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
4246
4247 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
4248
4249 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
4250
4251 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
4252
4253 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
4254
4255 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (4)</a></li>
4256
4257 </ul></li>
4258
4259 <li>2009
4260 <ul>
4261
4262 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
4263
4264 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
4265
4266 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
4267
4268 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
4269
4270 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
4271
4272 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
4273
4274 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
4275
4276 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
4277
4278 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
4279
4280 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
4281
4282 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
4283
4284 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
4285
4286 </ul></li>
4287
4288 <li>2008
4289 <ul>
4290
4291 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
4292
4293 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
4294
4295 </ul></li>
4296
4297 </ul>
4298
4299
4300
4301 <h2>Tags</h2>
4302 <ul>
4303
4304  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
4305
4306  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
4307
4308  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
4309
4310  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
4311
4312  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (35)</a></li>
4313
4314  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (40)</a></li>
4315
4316  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (55)</a></li>
4317
4318  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
4319
4320  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (8)</a></li>
4321
4322  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (3)</a></li>
4323
4324  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
4325
4326  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
4327
4328  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
4329
4330  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
4331
4332  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (71)</a></li>
4333
4334  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (92)</a></li>
4335
4336  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (14)</a></li>
4337
4338  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (14)</a></li>
4339
4340  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
4341
4342  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
4343
4344  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (10)</a></li>
4345
4346  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
4347
4348  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
4349
4350  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
4351
4352  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
4353
4354  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
4355
4356  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (7)</a></li>
4357
4358 </ul>
4359
4360 </div>
4361 </body>
4362 </html>