blog/tags/ldap/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
   4   <head>
   5     <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
   6     <title>Petter Reinholdtsen: Entries Tagged ldap</title>
   7     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css" />
   8     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/vim.css" />
   9     <link rel="alternate" title="RSS Feed" href="ldap.rss" type="application/rss+xml" />
  10   </head>
  11   <body>
  12     <div class="title">
  13  <h1>
  14      <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16  </h1>
  17
  18 </div>
  19
  20
  21     <h3>Entries tagged "ldap".</h3>
  22
  23     <div class="entry">
  24       <div class="title">
  25         <a href="http://people.skolelinux.org/pere/blog/How_to_add_extra_storage_servers_in_Debian_Edu___Skolelinux.html">How to add extra storage servers in Debian Edu / Skolelinux</a>
  26       </div>
  27       <div class="date">
  28         14th March 2014
  29       </div>
  30       <div class="body">
  31         <p>On larger sites, it is useful to use a dedicated storage server for
  32 storing user home directories and data.  The design for handling this
  33 in Debian Edu / Skolelinux, is to update the automount rules in LDAP
  34 and let the automount daemon on the clients take care of the rest.  I
  35 was reminded about the need to document this better when one of the
  36 customers of <a href="http://www.slxdrift.no/">Skolelinux Drift AS</a>,
  37 where I am on the board of directors, asked about how to do this.  The
  38 steps to get this working are the following:</p>
  39
  40 <p><ol>
  41
  42 <li>Add new storage server in DNS.  I use nas-server.intern as the
  43 example host here.</li>
  44
  45 <li>Add automoun LDAP information about this server in LDAP, to allow
  46 all clients to automatically mount it on reqeust.</li>
  47
  48 <li>Add the relevant entries in tjener.intern:/etc/fstab, because
  49 tjener.intern do not use automount to avoid mounting loops.</li>
  50
  51 </ol></p>
  52
  53 <p>DNS entries are added in GOsa², and not described here.  Follow the
  54 <a href="https://wiki.debian.org/DebianEdu/Documentation/Wheezy/GettingStarted">instructions
  55 in the manual</a> (Machine Management with GOsa² in section etting
  56 started).</p>
  57
  58 <p>Ensure that the NFS export points on the server are exported to the
  59 relevant subnets or machines:</p>
  60
  61 <p><blockquote><pre>
  62 root@tjener:~# showmount -e nas-server
  63 Export list for nas-server:
  64 /storage         10.0.0.0/8
  65 root@tjener:~#
  66 </pre></blockquote></p>
  67
  68 <p>Here everything on the backbone network is granted access to the
  69 /storage export.  With NFSv3 it is slightly better to limit it to
  70 netgroup membership or single IP addresses to have some limits on the
  71 NFS access.</p>
  72
  73 <p>The next step is to update LDAP.  This can not be done using GOsa²,
  74 because it lack a module for automount.  Instead, use ldapvi and add
  75 the required LDAP objects using an editor.</p>
  76
  77 <p><blockquote><pre>
  78 ldapvi --ldap-conf -ZD '(cn=admin)' -b ou=automount,dc=skole,dc=skolelinux,dc=no
  79 </pre></blockquote></p>
  80
  81 <p>When the editor show up, add the following LDAP objects at the
  82 bottom of the document.  The "/&" part in the last LDAP object is a
  83 wild card matching everything the nas-server exports, removing the
  84 need to list individual mount points in LDAP.</p>
  85
  86 <p><blockquote><pre>
  87 add cn=nas-server,ou=auto.skole,ou=automount,dc=skole,dc=skolelinux,dc=no
  88 objectClass: automount
  89 cn: nas-server
  90 automountInformation: -fstype=autofs --timeout=60 ldap:ou=auto.nas-server,ou=automount,dc=skole,dc=skolelinux,dc=no
  91
  92 add ou=auto.nas-server,ou=automount,dc=skole,dc=skolelinux,dc=no
  93 objectClass: top
  94 objectClass: automountMap
  95 ou: auto.nas-server
  96
  97 add cn=/,ou=auto.nas-server,ou=automount,dc=skole,dc=skolelinux,dc=no
  98 objectClass: automount
  99 cn: /
 100 automountInformation: -fstype=nfs,tcp,rsize=32768,wsize=32768,rw,intr,hard,nodev,nosuid,noatime nas-server.intern:/&
 101 </pre></blockquote></p>
 102
 103 <p>The last step to remember is to mount the relevant mount points in
 104 tjener.intern by adding them to /etc/fstab, creating the mount
 105 directories using mkdir and running "mount -a" to mount them.</p>
 106
 107 <p>When this is done, your users should be able to access the files on
 108 the storage server directly by just visiting the
 109 /tjener/nas-server/storage/ directory using any application on any
 110 workstation, LTSP client or LTSP server.</p>
 111
 112       </div>
 113       <div class="tags">
 114
 115
 116         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>.
 117
 118
 119       </div>
 120     </div>
 121     <div class="padding"></div>
 122
 123     <div class="entry">
 124       <div class="title">
 125         <a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a>
 126       </div>
 127       <div class="date">
 128         17th July 2010
 129       </div>
 130       <div class="body">
 131         <p>This is a
 132 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
 133 on my
 134 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
 135 work</a> on
 136 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
 137 all</a> the computer related LDAP objects in Debian Edu.</p>
 138
 139 <p>As a step to try to see if it possible to merge the DNS and DHCP
 140 LDAP objects, I have had a look at how the packages pdns-backend-ldap
 141 and dhcp3-server-ldap in Debian use the LDAP server.  The two
 142 implementations are quite different in how they use LDAP.</p>
 143
 144 To get this information, I started slapd with debugging enabled and
 145 dumped the debug output to a file to get the LDAP searches performed
 146 on a Debian Edu main-server.  Here is a summary.
 147
 148 <p><strong>powerdns</strong></p>
 149
 150 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
 151 on how to</a> set up PowerDNS to use a LDAP backend is available on
 152 the web.
 153
 154 <p>PowerDNS have two modes of operation using LDAP as its backend.
 155 One "strict" mode where the forward and reverse DNS lookups are done
 156 using the same LDAP objects, and a "tree" mode where the forward and
 157 reverse entries are in two different subtrees in LDAP with a structure
 158 based on the DNS names, as in tjener.intern and
 159 2.2.0.10.in-addr.arpa.</p>
 160
 161 <p>In tree mode, the server is set up to use a LDAP subtree as its
 162 base, and uses a "base" scoped search for the DNS name by adding
 163 "dc=tjener,dc=intern," to the base with a filter for
 164 "(associateddomain=tjener.intern)" for the forward entry and
 165 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
 166 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
 167 forward entries, it is looking for attributes named dnsttl, arecord,
 168 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
 169 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
 170 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
 171 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
 172 spfrecord and modifytimestamp.  For reverse entries it is looking for
 173 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
 174 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
 175 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
 176 ldapsearch commands could look like this:</p>
 177
 178 <blockquote><pre>
 179 ldapsearch -h ldap \
 180   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 181   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 182   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 183   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 184   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 185   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 186
 187 ldapsearch -h ldap \
 188   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 189   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
 190   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
 191   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
 192   srvrecord naptrrecord modifytimestamp
 193 </pre></blockquote>
 194
 195 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
 196 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
 197 example LDAP objects used there.  In addition to these objects, the
 198 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
 199 also exist.</p>
 200
 201 <blockquote><pre>
 202 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
 203 objectclass: top
 204 objectclass: dnsdomain
 205 objectclass: domainrelatedobject
 206 dc: tjener
 207 arecord: 10.0.2.2
 208 associateddomain: tjener.intern
 209
 210 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
 211 objectclass: top
 212 objectclass: dnsdomain2
 213 objectclass: domainrelatedobject
 214 dc: 2
 215 ptrrecord: tjener.intern
 216 associateddomain: 2.2.0.10.in-addr.arpa
 217 </pre></blockquote>
 218
 219 <p>In strict mode, the server behaves differently.  When looking for
 220 forward DNS entries, it is doing a "subtree" scoped search with the
 221 same base as in the tree mode for a object with filter
 222 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
 223 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
 224 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
 225 naptrrecord and modifytimestamp.  For reverse entires it also do a
 226 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
 227 and the requested attributes are associateddomain, dnsttl and
 228 modifytimestamp.  In short, in strict mode the objects with ptrrecord
 229 go away, and the arecord attribute in the forward object is used
 230 instead.</p>
 231
 232 <p>The forward and reverse searches can be simulated using ldapsearch
 233 like this:</p>
 234
 235 <blockquote><pre>
 236 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 237   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 238   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 239   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 240   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 241   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 242
 243 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 244   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
 245 </pre></blockquote>
 246
 247 <p>In addition to the forward and reverse searches , there is also a
 248 search for SOA records, which behave similar to the forward and
 249 reverse lookups.</p>
 250
 251 <p>A thing to note with the PowerDNS behaviour is that it do not
 252 specify any objectclass names, and instead look for the attributes it
 253 need to generate a DNS reply.  This make it able to work with any
 254 objectclass that provide the needed attributes.</p>
 255
 256 <p>The attributes are normally provided in the cosine (RFC 1274) and
 257 dnsdomain2 schemas.  The latter is used for reverse entries like
 258 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
 259
 260 <p>In Debian Edu, we have created DNS objects using the object classes
 261 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
 262 attributes) and domainrelatedobject (for associatedDomain).  The use
 263 of structural object classes make it impossible to combine these
 264 classes with the object classes used by DHCP.</p>
 265
 266 <p>There are other schemas that could be used too, for example the
 267 dnszone structural object class used by Gosa and bind-sdb for the DNS
 268 attributes combined with the domainrelatedobject object class, but in
 269 this case some unused attributes would have to be included as well
 270 (zonename and relativedomainname).</p>
 271
 272 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
 273 mode and not use any of the existing objectclasses (dnsdomain,
 274 dnsdomain2 and dnszone) when one want to combine the DNS information
 275 with DHCP information, and instead create a auxiliary object class
 276 defined something like this (using the attributes defined for
 277 dnsdomain and dnsdomain2 or dnszone):</p>
 278
 279 <blockquote><pre>
 280 objectclass ( some-oid NAME 'dnsDomainAux'
 281     SUP top
 282     AUXILIARY
 283     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
 284           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
 285           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
 286           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
 287           A6Record $ DNAMERecord
 288     ))
 289 </pre></blockquote>
 290
 291 <p>This will allow any object to become a DNS entry when combined with
 292 the domainrelatedobject object class, and allow any entity to include
 293 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
 294 developers asking for their view on this schema and if they are
 295 interested in providing such schema with PowerDNS, and I hope my
 296 message will be accepted into their mailing list soon.</p>
 297
 298 <p><strong>ISC dhcp</strong></p>
 299
 300 <p>The DHCP server searches for specific objectclass and requests all
 301 the object attributes, and then uses the attributes it want.  This
 302 make it harder to figure out exactly what attributes are used, but
 303 thanks to the working example in Debian Edu I can at least get an idea
 304 what is needed without having to read the source code.</p>
 305
 306 <p>In the DHCP server configuration, the LDAP base to use and the
 307 search filter to use to locate the correct dhcpServer entity is
 308 stored.  These are the relevant entries from
 309 /etc/dhcp3/dhcpd.conf:</p>
 310
 311 <blockquote><pre>
 312 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
 313 ldap-dhcp-server-cn "dhcp";
 314 </pre></blockquote>
 315
 316 <p>The DHCP server uses this information to nest all the DHCP
 317 configuration it need.  The cn "dhcp" is located using the given LDAP
 318 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
 319 search result is this entry:</p>
 320
 321 <blockquote><pre>
 322 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
 323 cn: dhcp
 324 objectClass: top
 325 objectClass: dhcpServer
 326 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 327 </pre></blockquote>
 328
 329 <p>The content of the dhcpServiceDN attribute is next used to locate the
 330 subtree with DHCP configuration.  The DHCP configuration subtree base
 331 is located using a base scope search with base "cn=DHCP
 332 Config,dc=skole,dc=skolelinux,dc=no" and filter
 333 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
 334 The search result is this entry:</p>
 335
 336 <blockquote><pre>
 337 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 338 cn: DHCP Config
 339 objectClass: top
 340 objectClass: dhcpService
 341 objectClass: dhcpOptions
 342 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
 343 dhcpStatements: ddns-update-style none
 344 dhcpStatements: authoritative
 345 dhcpOption: smtp-server code 69 = array of ip-address
 346 dhcpOption: www-server code 72 = array of ip-address
 347 dhcpOption: wpad-url code 252 = text
 348 </pre></blockquote>
 349
 350 <p>Next, the entire subtree is processed, one level at the time.  When
 351 all the DHCP configuration is loaded, it is ready to receive requests.
 352 The subtree in Debian Edu contain objects with object classes
 353 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
 354 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
 355 and information about netmasks, dynamic range etc.  Leaving out the
 356 details here because it is not relevant for the focus of my
 357 investigation, which is to see if it is possible to merge dns and dhcp
 358 related computer objects.</p>
 359
 360 <p>When a DHCP request come in, LDAP is searched for the MAC address
 361 of the client (00:00:00:00:00:00 in this example), using a subtree
 362 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
 363 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
 364 00:00:00:00:00:00))" as the filter.  This is what a host object look
 365 like:</p>
 366
 367 <blockquote><pre>
 368 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 369 cn: hostname
 370 objectClass: top
 371 objectClass: dhcpHost
 372 dhcpHWAddress: ethernet 00:00:00:00:00:00
 373 dhcpStatements: fixed-address hostname
 374 </pre></blockquote>
 375
 376 <p>There is less flexiblity in the way LDAP searches are done here.
 377 The object classes need to have fixed names, and the configuration
 378 need to be stored in a fairly specific LDAP structure.  On the
 379 positive side, the invidiual dhcpHost entires can be anywhere without
 380 the DN pointed to by the dhcpServer entries.  The latter should make
 381 it possible to group all host entries in a subtree next to the
 382 configuration entries, and this subtree can also be shared with the
 383 DNS server if the schema proposed above is combined with the dhcpHost
 384 structural object class.
 385
 386 <p><strong>Conclusion</strong></p>
 387
 388 <p>The PowerDNS implementation seem to be very flexible when it come
 389 to which LDAP schemas to use.  While its "tree" mode is rigid when it
 390 come to the the LDAP structure, the "strict" mode is very flexible,
 391 allowing DNS objects to be stored anywhere under the base cn specified
 392 in the configuration.</p>
 393
 394 <p>The DHCP implementation on the other hand is very inflexible, both
 395 regarding which LDAP schemas to use and which LDAP structure to use.
 396 I guess one could implement ones own schema, as long as the
 397 objectclasses and attributes have the names used, but this do not
 398 really help when the DHCP subtree need to have a fairly fixed
 399 structure.</p>
 400
 401 <p>Based on the observed behaviour, I suspect a LDAP structure like
 402 this might work for Debian Edu:</p>
 403
 404 <blockquote><pre>
 405 ou=services
 406   cn=machine-info (dhcpService) - dhcpServiceDN points here
 407     cn=dhcp (dhcpServer)
 408     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
 409       cn=10.0.2.0 (dhcpSubnet)
 410         cn=group1 (dhcpGroup/dhcpOptions)
 411     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
 412       cn=192.168.0.0 (dhcpSubnet)
 413         cn=group1 (dhcpGroup/dhcpOptions)
 414     ou=machines - PowerDNS base points here
 415       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
 416 </pre></blockquote>
 417
 418 <P>This is not tested yet.  If the DHCP server require the dhcpHost
 419 entries to be in the dhcpGroup subtrees, the entries can be stored
 420 there instead of a common machines subtree, and the PowerDNS base
 421 would have to be moved one level up to the machine-info subtree.</p>
 422
 423 <p>The combined object under the machines subtree would look something
 424 like this:</p>
 425
 426 <blockquote><pre>
 427 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
 428 dc: hostname
 429 objectClass: top
 430 objectClass: dhcpHost
 431 objectclass: domainrelatedobject
 432 objectclass: dnsDomainAux
 433 associateddomain: hostname.intern
 434 arecord: 10.11.12.13
 435 dhcpHWAddress: ethernet 00:00:00:00:00:00
 436 dhcpStatements: fixed-address hostname.intern
 437 </pre></blockquote>
 438
 439 </p>One could even add the LTSP configuration associated with a given
 440 machine, as long as the required attributes are available in a
 441 auxiliary object class.</p>
 442
 443       </div>
 444       <div class="tags">
 445
 446
 447         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 448
 449
 450       </div>
 451     </div>
 452     <div class="padding"></div>
 453
 454     <div class="entry">
 455       <div class="title">
 456         <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a>
 457       </div>
 458       <div class="date">
 459         14th July 2010
 460       </div>
 461       <div class="body">
 462         <p>For a while now, I have wanted to find a way to change the DNS and
 463 DHCP services in Debian Edu to use the same LDAP objects for a given
 464 computer, to avoid the possibility of having a inconsistent state for
 465 a computer in LDAP (as in DHCP but no DNS entry or the other way
 466 around) and make it easier to add computers to LDAP.</p>
 467
 468 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
 469 information finally found a solution that seem to work.</p>
 470
 471 <p>The old setup required three LDAP objects for a given computer.
 472 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
 473 we switch powerdns to use its strict LDAP method (ldap-method=strict
 474 in pdns-debian-edu.conf), the forward and reverse DNS entries are
 475 merged into one while making it impossible to transfer the reverse map
 476 to a slave DNS server.</p>
 477
 478 <p>If we also replace the object class used to get the DNS related
 479 attributes to one allowing these attributes to be combined with the
 480 dhcphost object class, we can merge the DNS and DHCP entries into one.
 481 I've written such object class in the dnsdomainaux.schema file (need
 482 proper OIDs, but that is a minor issue), and tested the setup.  It
 483 seem to work.</p>
 484
 485 <p>With this test setup in place, we can get away with one LDAP object
 486 for both DNS and DHCP, and even the LTSP configuration I suggested in
 487 an earlier email.  The combined LDAP object will look something like
 488 this:</p>
 489
 490 <blockquote><pre>
 491   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 492   cn: hostname
 493   objectClass: dhcphost
 494   objectclass: domainrelatedobject
 495   objectclass: dnsdomainaux
 496   associateddomain: hostname.intern
 497   arecord: 10.11.12.13
 498   dhcphwaddress: ethernet 00:00:00:00:00:00
 499   dhcpstatements: fixed-address hostname
 500   ldapconfigsound: Y
 501 </pre></blockquote>
 502
 503 <p>The DNS server uses the associateddomain and arecord entries, while
 504 the DHCP server uses the dhcphwaddress and dhcpstatements entries
 505 before asking DNS to resolve the fixed-adddress.  LTSP will use
 506 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
 507
 508 <p>I am not yet sure if I can get the DHCP server to look for its
 509 dhcphost in a different location, to allow us to put the objects
 510 outside the "DHCP Config" subtree, but hope to figure out a way to do
 511 that.  If I can't figure out a way to do that, we can still get rid of
 512 the hosts subtree and move all its content into the DHCP Config tree
 513 (which probably should be renamed to be more related to the new
 514 content.  I suspect cn=dnsdhcp,ou=services or something like that
 515 might be a good place to put it.</p>
 516
 517 <p>If you want to help out with implementing this for Debian Edu,
 518 please contact us on debian-edu@lists.debian.org.</p>
 519
 520       </div>
 521       <div class="tags">
 522
 523
 524         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 525
 526
 527       </div>
 528     </div>
 529     <div class="padding"></div>
 530
 531     <div class="entry">
 532       <div class="title">
 533         <a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a>
 534       </div>
 535       <div class="date">
 536         11th July 2010
 537       </div>
 538       <div class="body">
 539         <p>Vagrant mentioned on IRC today that ltsp_config now support
 540 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
 541 clients, and that this can be used to fetch configuration from LDAP if
 542 Debian Edu choose to store configuration there.</p>
 543
 544 <p>Armed with this information, I got inspired and wrote a test module
 545 to get configuration from LDAP.  The idea is to look up the MAC
 546 address of the client in LDAP, and look for attributes on the form
 547 ltspconfigsetting=value, and use this to export SETTING=value to the
 548 LTSP clients.</p>
 549
 550 <p>The goal is to be able to store the LTSP configuration attributes
 551 in a "computer" LDAP object used by both DNS and DHCP, and thus
 552 allowing us to store all information about a computer in one place.</p>
 553
 554 <p>This is a untested draft implementation, and I welcome feedback on
 555 this approach.  A real LDAP schema for the ltspClientAux objectclass
 556 need to be written.  Comments, suggestions, etc?</p>
 557
 558 <blockquote><pre>
 559 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
 560 #
 561 # Fetch LTSP client settings from LDAP based on MAC address
 562 #
 563 # Uses ethernet address as stored in the dhcpHost objectclass using
 564 # the dhcpHWAddress attribute or ethernet address stored in the
 565 # ieee802Device objectclass with the macAddress attribute.
 566 #
 567 # This module is written to be schema agnostic, and only depend on the
 568 # existence of attribute names.
 569 #
 570 # The LTSP configuration variables are saved directly using a
 571 # ltspConfig prefix and uppercasing the rest of the attribute name.
 572 # To set the SERVER variable, set the ltspConfigServer attribute.
 573 #
 574 # Some LDAP schema should be created with all the relevant
 575 # configuration settings.  Something like this should work:
 576 #
 577 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
 578 #     SUP top
 579 #     AUXILIARY
 580 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
 581
 582 LDAPSERVER=$(debian-edu-ldapserver)
 583 if [ "$LDAPSERVER" ] ; then
 584     LDAPBASE=$(debian-edu-ldapserver -b)
 585     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
 586         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
 587         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
 588             grep '^ltspConfig' | while read attr value ; do
 589             # Remove prefix and convert to upper case
 590             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
 591             # bass value on to clients
 592             eval "$attr=$value; export $attr"
 593         done
 594     done
 595 fi
 596 </pre></blockquote>
 597
 598 <p>I'm not sure this shell construction will work, because I suspect
 599 the while block might end up in a subshell causing the variables set
 600 there to not show up in ltsp-config, but if that is the case I am sure
 601 the code can be restructured to make sure the variables are passed on.
 602 I expect that can be solved with some testing. :)</p>
 603
 604 <p>If you want to help out with implementing this for Debian Edu,
 605 please contact us on debian-edu@lists.debian.org.</p>
 606
 607 <p>Update 2010-07-17: I am aware of another effort to store LTSP
 608 configuration in LDAP that was created around year 2000 by
 609 <a href="http://www.pcxperience.com/thinclient/documentation/ldap.html">PC
 610 Xperience, Inc., 2000</a>.  I found its
 611 <a href="http://people.redhat.com/alikins/ltsp/ldap/">files</a> on a
 612 personal home page over at redhat.com.</p>
 613
 614       </div>
 615       <div class="tags">
 616
 617
 618         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 619
 620
 621       </div>
 622     </div>
 623     <div class="padding"></div>
 624
 625     <div class="entry">
 626       <div class="title">
 627         <a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a>
 628       </div>
 629       <div class="date">
 630          9th July 2010
 631       </div>
 632       <div class="body">
 633         <p>Since
 634 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
 635 last post</a> about available LDAP tools in Debian, I was told about a
 636 LDAP GUI that is even better than luma.  The java application
 637 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
 638 moving LDAP objects and subtrees using drag-and-drop, and can
 639 authenticate using Kerberos.  I have only tested the Kerberos
 640 authentication, but do not have a LDAP setup allowing me to rewrite
 641 LDAP with my test user yet.  It is
 642 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
 643 Debian</a> testing and unstable at the moment.  The only problem I
 644 have with it is how it handle errors.  If something go wrong, its
 645 non-intuitive behaviour require me to go through some query work list
 646 and remove the failing query.  Nothing big, but very annoying.</p>
 647
 648       </div>
 649       <div class="tags">
 650
 651
 652         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 653
 654
 655       </div>
 656     </div>
 657     <div class="padding"></div>
 658
 659     <div class="entry">
 660       <div class="title">
 661         <a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a>
 662       </div>
 663       <div class="date">
 664          1st July 2010
 665       </div>
 666       <div class="body">
 667         <p>For a laptop, centralized user directories and password checking is
 668 a bit troubling.  Laptops are typically used also when not connected
 669 to the network, and it is vital for a user to be able to log in or
 670 unlock the screen saver also when a central server is unavailable.
 671 This is possible by caching passwords and directory information (user
 672 and group attributes) locally, and the packages to do so are available
 673 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
 674 It is also possible to set up in Debian/Lenny, but require more manual
 675 setup there because pam-auth-update is missing in Lenny.</p>
 676
 677 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
 678
 679 This is the traditional method with a twist.  The password caching is
 680 provided by libpam-ccreds (version 10-4 or later is needed on
 681 Squeeze), and the directory caching is done by nscd.  The directory
 682 lookup and password checking is done using LDAP.  If one want to use
 683 Kerberos for password checking the libpam-ldapd package can be
 684 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
 685 local home directory with the path listed in LDAP, one can use the
 686 pam_mkhomedir module from pam-modules to make this happen instead of
 687 using libpam-mklocaluser.  A setup for pam-auth-update to enable
 688 pam_mkhomedir will have to be written until a fix for
 689 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
 690 archive.  Because I believe it is a bad idea to have local home
 691 directories using misleading paths like /site/server/partition/, I
 692 prefer to create a local user with the home directory in /home/.  This
 693 is done using the libpam-mklocaluser package.</p>
 694
 695 <p>These packages need to be installed and configured</p>
 696
 697 <blockquote><pre>
 698 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
 699 </pre></blockquote>
 700
 701 <p>The ldapd packages will ask for LDAP connection information, and
 702 one have to fill in the values that fits ones own site.  Make sure the
 703 PAM part uses encrypted connections, to make sure the password is not
 704 sent in clear text to the LDAP server.  I've been unable to get TLS
 705 certificate checking for a self signed certificate working, which make
 706 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
 707 is talking to the correct LDAP server), and very much welcome feedback
 708 on how to get this working.</p>
 709
 710 <p>Because nscd do not have a default configuration fit for offline
 711 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
 712 is fixed, this configuration should be used instead of the one
 713 currently in /etc/nscd.conf.  The changes are in the fields
 714 reload-count and positive-time-to-live, and is based on the
 715 instructions I found in the
 716 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
 717 instructions by Flyn Computing.</p>
 718
 719 <blockquote><pre>
 720         debug-level             0
 721         reload-count            unlimited
 722         paranoia                no
 723
 724         enable-cache            passwd          yes
 725         positive-time-to-live   passwd          2592000
 726         negative-time-to-live   passwd          20
 727         suggested-size          passwd          211
 728         check-files             passwd          yes
 729         persistent              passwd          yes
 730         shared                  passwd          yes
 731         max-db-size             passwd          33554432
 732         auto-propagate          passwd          yes
 733
 734         enable-cache            group           yes
 735         positive-time-to-live   group           2592000
 736         negative-time-to-live   group           20
 737         suggested-size          group           211
 738         check-files             group           yes
 739         persistent              group           yes
 740         shared                  group           yes
 741         max-db-size             group           33554432
 742         auto-propagate          group           yes
 743
 744         enable-cache            hosts           no
 745         positive-time-to-live   hosts           2592000
 746         negative-time-to-live   hosts           20
 747         suggested-size          hosts           211
 748         check-files             hosts           yes
 749         persistent              hosts           yes
 750         shared                  hosts           yes
 751         max-db-size             hosts           33554432
 752
 753         enable-cache            services        yes
 754         positive-time-to-live   services        2592000
 755         negative-time-to-live   services        20
 756         suggested-size          services        211
 757         check-files             services        yes
 758         persistent              services        yes
 759         shared                  services        yes
 760         max-db-size             services        33554432
 761 </pre></blockquote>
 762
 763 <p>While we wait for a mechanism to update /etc/nsswitch.conf
 764 automatically like the one provided in
 765 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
 766 content need to be manually replaced to ensure LDAP is used as the
 767 directory service on the machine.  /etc/nsswitch.conf should normally
 768 look like this:</p>
 769
 770 <blockquote><pre>
 771 passwd:         files ldap
 772 group:          files ldap
 773 shadow:         files ldap
 774 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 775 networks:       files
 776 protocols:      files
 777 services:       files
 778 ethers:         files
 779 rpc:            files
 780 netgroup:       files ldap
 781 </pre></blockquote>
 782
 783 <p>The important parts are that ldap is listed last for passwd, group,
 784 shadow and netgroup.</p>
 785
 786 <p>With these changes in place, any user in LDAP will be able to log
 787 in locally on the machine using for example kdm, get a local home
 788 directory created and have the password as well as user and group
 789 attributes cached.
 790
 791 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 792   libpam-mklocaluser/pam_mkhomedir</h2>
 793
 794 <p>Because nscd have had its share of problems, and seem to have
 795 problems doing proper caching, I've seen suggestions and recipes to
 796 use nss-updatedb to copy parts of the LDAP database locally when the
 797 LDAP database is available.  I have not tested such setup, because I
 798 discovered sssd.</p>
 799
 800 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
 801
 802 <p>A more flexible and robust setup than the nscd combination
 803 mentioned earlier that has shown up recently, is the
 804 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
 805 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
 806 to provide a Active Directory like directory service for Linux
 807 machines.  The sssd system combines the caching of passwords and user
 808 information into one package, and remove the need for nscd and
 809 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 810 1.2 do not support netgroups, but it is said that it will support this
 811 in version 1.5 expected to show up later in 2010.  Because the
 812 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
 813 was missing in Debian, I ended up co-maintaining it with Werner, and
 814 version 1.2 is now in testing.
 815
 816 <p>These packages need to be installed and configured to get the
 817 roaming setup I want</p>
 818
 819 <blockquote><pre>
 820 libpam-sss libnss-sss libpam-mklocaluser
 821 </pre></blockquote>
 822
 823 The complete setup of sssd is done by editing/creating
 824 <tt>/etc/sssd/sssd.conf</tt>.
 825
 826 <blockquote><pre>
 827 [sssd]
 828 config_file_version = 2
 829 reconnection_retries = 3
 830 sbus_timeout = 30
 831 services = nss, pam
 832 domains = INTERN
 833
 834 [nss]
 835 filter_groups = root
 836 filter_users = root
 837 reconnection_retries = 3
 838
 839 [pam]
 840 reconnection_retries = 3
 841
 842 [domain/INTERN]
 843 enumerate = false
 844 cache_credentials = true
 845
 846 id_provider = ldap
 847 auth_provider = ldap
 848 chpass_provider = ldap
 849
 850 ldap_uri = ldap://ldap
 851 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 852 ldap_tls_reqcert = never
 853 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 854 </pre></blockquote>
 855
 856 <p>I got the same problem here with certificate checking.  Had to set
 857 "ldap_tls_reqcert = never" to get it working.</p>
 858
 859 <p>With the libnss-sss package in testing at the moment, the
 860 nsswitch.conf file is update automatically, so there is no need to
 861 modify it manually.</p>
 862
 863 <p>If you want to help out with implementing this for Debian Edu,
 864 please contact us on debian-edu@lists.debian.org.</p>
 865
 866       </div>
 867       <div class="tags">
 868
 869
 870         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 871
 872
 873       </div>
 874     </div>
 875     <div class="padding"></div>
 876
 877     <div class="entry">
 878       <div class="title">
 879         <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">LUMA, a very nice LDAP GUI</a>
 880       </div>
 881       <div class="date">
 882         28th June 2010
 883       </div>
 884       <div class="body">
 885         <p>The last few days I have been looking into the status of the LDAP
 886 directory in Debian Edu, and in the process I started to miss a GUI
 887 tool to browse the LDAP tree.  The only one I was able to find in
 888 Debian/Squeeze and Lenny is
 889 <a href="http://luma.sourceforge.net/">LUMA</a>, which has proved to
 890 be a great tool to get a overview of the current LDAP directory
 891 populated by default in Skolelinux.  Thanks to it, I have been able to
 892 find empty and obsolete subtrees, misplaced objects and duplicate
 893 objects.  It will be installed by default in Debian/Squeeze.  If you
 894 are working with LDAP, give it a go. :)</p>
 895
 896 <p>I did notice one problem with it I have not had time to report to
 897 the BTS yet.  There is no .desktop file in the package, so the tool do
 898 not show up in the Gnome and KDE menus, but only deep down in in the
 899 Debian submenu in KDE.  I hope that can be fixed before Squeeze is
 900 released.</p>
 901
 902 <p>I have not yet been able to get it to modify the tree yet.  I would
 903 like to move objects and remove subtrees directly in the GUI, but have
 904 not found a way to do that with LUMA yet.  So in the mean time, I use
 905 <a href="http://www.lichteblau.com/ldapvi/">ldapvi</a> for that.</p>
 906
 907 <p>If you have tips on other GUI tools for LDAP that might be useful
 908 in Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 909
 910 <p>Update 2010-06-29: Ross Reedstrom tipped us about the
 911 <a href="http://packages.qa.debian.org/g/gq.html">gq</a> package as a
 912 useful GUI alternative.  It seem like a good tool, but is unmaintained
 913 in Debian and got a RC bug keeping it out of Squeeze.  Unless that
 914 changes, it will not be an option for Debian Edu based on Squeeze.</p>
 915
 916       </div>
 917       <div class="tags">
 918
 919
 920         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 921
 922
 923       </div>
 924     </div>
 925     <div class="padding"></div>
 926
 927     <div class="entry">
 928       <div class="title">
 929         <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">Idea for a change to LDAP schemas allowing DNS and DHCP info to be combined into one object</a>
 930       </div>
 931       <div class="date">
 932         24th June 2010
 933       </div>
 934       <div class="body">
 935         <p>A while back, I
 936 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">complained
 937 about the fact</a> that it is not possible with the provided schemas
 938 for storing DNS and DHCP information in LDAP to combine the two sets
 939 of information into one LDAP object representing a computer.</p>
 940
 941 <p>In the mean time, I discovered that a simple fix would be to make
 942 the dhcpHost object class auxiliary, to allow it to be combined with
 943 the dNSDomain object class, and thus forming one object for one
 944 computer when storing both DHCP and DNS information in LDAP.</p>
 945
 946 <p>If I understand this correctly, it is not safe to do this change
 947 without also changing the assigned number for the object class, and I
 948 do not know enough about LDAP schema design to do that properly for
 949 Debian Edu.</p>
 950
 951 <p>Anyway, for future reference, this is how I believe we could change
 952 the
 953 <a href="http://tools.ietf.org/html/draft-ietf-dhc-ldap-schema-00">DHCP
 954 schema</a> to solve at least part of the problem with the LDAP schemas
 955 available today from IETF.</p>
 956
 957 <pre>
 958 --- dhcp.schema    (revision 65192)
 959 +++ dhcp.schema    (working copy)
 960 @@ -376,7 +376,7 @@
 961  objectclass ( 2.16.840.1.113719.1.203.6.6
 962         NAME 'dhcpHost'
 963         DESC 'This represents information about a particular client'
 964 -       SUP top
 965 +       SUP top AUXILIARY
 966         MUST cn
 967         MAY  (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
 968         X-NDS_CONTAINMENT ('dhcpService' 'dhcpSubnet' 'dhcpGroup') )
 969 </pre>
 970
 971 <p>I very much welcome clues on how to do this properly for Debian
 972 Edu/Squeeze.  We provide the DHCP schema in our debian-edu-config
 973 package, and should thus be free to rewrite it as we see fit.</p>
 974
 975 <p>If you want to help out with implementing this for Debian Edu,
 976 please contact us on debian-edu@lists.debian.org.</p>
 977
 978       </div>
 979       <div class="tags">
 980
 981
 982         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 983
 984
 985       </div>
 986     </div>
 987     <div class="padding"></div>
 988
 989     <div class="entry">
 990       <div class="title">
 991         <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">Time for new  LDAP schemas replacing RFC 2307?</a>
 992       </div>
 993       <div class="date">
 994         29th March 2009
 995       </div>
 996       <div class="body">
 997         <p>The state of standardized LDAP schemas on Linux is far from
 998 optimal.  There is RFC 2307 documenting one way to store NIS maps in
 999 LDAP, and a modified version of this normally called RFC 2307bis, with
1000 some modifications to be compatible with Active Directory.  The RFC
1001 specification handle the content of a lot of system databases, but do
1002 not handle DNS zones and DHCP configuration.</p>
1003
1004 <p>In <a href="http://www.skolelinux.org/">Debian Edu/Skolelinux</a>,
1005 we would like to store information about users, SMB clients/hosts,
1006 filegroups, netgroups (users and hosts), DHCP and DNS configuration,
1007 and LTSP configuration in LDAP.  These objects have a lot in common,
1008 but with the current LDAP schemas it is not possible to have one
1009 object per entity.  For example, one need to have at least three LDAP
1010 objects for a given computer, one with the SMB related stuff, one with
1011 DNS information and another with DHCP information.  The schemas
1012 provided for DNS and DHCP are impossible to combine into one LDAP
1013 object.  In addition, it is impossible to implement quick queries for
1014 netgroup membership, because of the way NIS triples are implemented.
1015 It just do not scale.  I believe it is time for a few RFC
1016 specifications to cleam up this mess.</p>
1017
1018 <p>I would like to have one LDAP object representing each computer in
1019 the network, and this object can then keep the SMB (ie host key), DHCP
1020 (mac address/name) and DNS (name/IP address) settings in one place.
1021 It need to be efficently stored to make sure it scale well.</p>
1022
1023 <p>I would also like to have a quick way to map from a user or
1024 computer and to the net group this user or computer is a member.</p>
1025
1026 <p>Active Directory have done a better job than unix heads like myself
1027 in this regard, and the unix side need to catch up.  Time to start a
1028 new IETF work group?</p>
1029
1030       </div>
1031       <div class="tags">
1032
1033
1034         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1035
1036
1037       </div>
1038     </div>
1039     <div class="padding"></div>
1040
1041     <p style="text-align: right;"><a href="ldap.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14" /></a></p>
1042     <div id="sidebar">
1043
1044
1045
1046 <h2>Archive</h2>
1047 <ul>
1048
1049 <li>2014
1050 <ul>
1051
1052 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/01/">January (2)</a></li>
1053
1054 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/02/">February (3)</a></li>
1055
1056 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/03/">March (2)</a></li>
1057
1058 </ul></li>
1059
1060 <li>2013
1061 <ul>
1062
1063 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/01/">January (11)</a></li>
1064
1065 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/02/">February (9)</a></li>
1066
1067 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/03/">March (9)</a></li>
1068
1069 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/04/">April (6)</a></li>
1070
1071 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/05/">May (9)</a></li>
1072
1073 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/06/">June (10)</a></li>
1074
1075 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/07/">July (7)</a></li>
1076
1077 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/08/">August (3)</a></li>
1078
1079 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/09/">September (5)</a></li>
1080
1081 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/10/">October (7)</a></li>
1082
1083 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/11/">November (9)</a></li>
1084
1085 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/12/">December (3)</a></li>
1086
1087 </ul></li>
1088
1089 <li>2012
1090 <ul>
1091
1092 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/01/">January (7)</a></li>
1093
1094 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/02/">February (10)</a></li>
1095
1096 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/03/">March (17)</a></li>
1097
1098 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/04/">April (12)</a></li>
1099
1100 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/05/">May (12)</a></li>
1101
1102 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/06/">June (20)</a></li>
1103
1104 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/07/">July (17)</a></li>
1105
1106 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/08/">August (6)</a></li>
1107
1108 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/09/">September (9)</a></li>
1109
1110 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/10/">October (17)</a></li>
1111
1112 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/11/">November (10)</a></li>
1113
1114 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/12/">December (7)</a></li>
1115
1116 </ul></li>
1117
1118 <li>2011
1119 <ul>
1120
1121 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
1122
1123 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
1124
1125 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
1126
1127 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
1128
1129 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
1130
1131 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
1132
1133 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (7)</a></li>
1134
1135 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/08/">August (6)</a></li>
1136
1137 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/09/">September (4)</a></li>
1138
1139 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/10/">October (2)</a></li>
1140
1141 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/11/">November (3)</a></li>
1142
1143 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/12/">December (1)</a></li>
1144
1145 </ul></li>
1146
1147 <li>2010
1148 <ul>
1149
1150 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
1151
1152 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
1153
1154 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1155
1156 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1157
1158 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1159
1160 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1161
1162 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
1163
1164 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
1165
1166 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
1167
1168 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
1169
1170 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
1171
1172 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
1173
1174 </ul></li>
1175
1176 <li>2009
1177 <ul>
1178
1179 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1180
1181 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1182
1183 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1184
1185 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1186
1187 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1188
1189 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1190
1191 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1192
1193 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1194
1195 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1196
1197 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1198
1199 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1200
1201 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1202
1203 </ul></li>
1204
1205 <li>2008
1206 <ul>
1207
1208 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1209
1210 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1211
1212 </ul></li>
1213
1214 </ul>
1215
1216
1217
1218 <h2>Tags</h2>
1219 <ul>
1220
1221  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (13)</a></li>
1222
1223  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1224
1225  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1226
1227  <li><a href="http://people.skolelinux.org/pere/blog/tags/bankid">bankid (4)</a></li>
1228
1229  <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (8)</a></li>
1230
1231  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (14)</a></li>
1232
1233  <li><a href="http://people.skolelinux.org/pere/blog/tags/bsa">bsa (2)</a></li>
1234
1235  <li><a href="http://people.skolelinux.org/pere/blog/tags/chrpath">chrpath (2)</a></li>
1236
1237  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (94)</a></li>
1238
1239  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (145)</a></li>
1240
1241  <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (10)</a></li>
1242
1243  <li><a href="http://people.skolelinux.org/pere/blog/tags/docbook">docbook (10)</a></li>
1244
1245  <li><a href="http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (4)</a></li>
1246
1247  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (237)</a></li>
1248
1249  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (21)</a></li>
1250
1251  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (12)</a></li>
1252
1253  <li><a href="http://people.skolelinux.org/pere/blog/tags/freeculture">freeculture (12)</a></li>
1254
1255  <li><a href="http://people.skolelinux.org/pere/blog/tags/freedombox">freedombox (5)</a></li>
1256
1257  <li><a href="http://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (11)</a></li>
1258
1259  <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (39)</a></li>
1260
1261  <li><a href="http://people.skolelinux.org/pere/blog/tags/isenkram">isenkram (7)</a></li>
1262
1263  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (18)</a></li>
1264
1265  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (9)</a></li>
1266
1267  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (7)</a></li>
1268
1269  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1270
1271  <li><a href="http://people.skolelinux.org/pere/blog/tags/mesh network">mesh network (7)</a></li>
1272
1273  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (25)</a></li>
1274
1275  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (241)</a></li>
1276
1277  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (161)</a></li>
1278
1279  <li><a href="http://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (10)</a></li>
1280
1281  <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
1282
1283  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (45)</a></li>
1284
1285  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (69)</a></li>
1286
1287  <li><a href="http://people.skolelinux.org/pere/blog/tags/raid">raid (1)</a></li>
1288
1289  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
1290
1291  <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (2)</a></li>
1292
1293  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (9)</a></li>
1294
1295  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1296
1297  <li><a href="http://people.skolelinux.org/pere/blog/tags/ruter">ruter (4)</a></li>
1298
1299  <li><a href="http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (2)</a></li>
1300
1301  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (34)</a></li>
1302
1303  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (4)</a></li>
1304
1305  <li><a href="http://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (4)</a></li>
1306
1307  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (44)</a></li>
1308
1309  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (3)</a></li>
1310
1311  <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (9)</a></li>
1312
1313  <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (21)</a></li>
1314
1315  <li><a href="http://people.skolelinux.org/pere/blog/tags/sysadmin">sysadmin (1)</a></li>
1316
1317  <li><a href="http://people.skolelinux.org/pere/blog/tags/valg">valg (8)</a></li>
1318
1319  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (39)</a></li>
1320
1321  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (4)</a></li>
1322
1323  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (28)</a></li>
1324
1325 </ul>
1326
1327
1328     </div>
1329     <p style="text-align: right">
1330  Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v4.6</a>
1331 </p>
1332
1333   </body>
1334 </html>