blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/KDM_fail_at_boot_with_NVidia_cards___and_no_one_try_to_fix_it_.html">KDM fail at boot with NVidia cards - and no one try to fix it?</a></div>
  24   <div class="date">2010-06-01 17:05</div>
  25   <div class="body">
  26 <p>It is strange to watch how a bug in Debian causing KDM to fail to
  27 start at boot when an NVidia video card is used is handled.  The
  28 problem seem to be that the nvidia X.org driver uses a long time to
  29 initialize, and this duration is longer than kdm is configured to
  30 wait.</p>
  31
  32 <p>I came across two bugs related to this issue,
  33 <a href="http://bugs.debian.org/583312">#583312</a> initially filed
  34 against initscripts and passed on to nvidia-glx when it became obvious
  35 that the nvidia drivers were involved, and
  36 <a href="http://bugs.debian.org/524751">#524751</a> initially filed against
  37 kdm and passed on to src:nvidia-graphics-drivers for unknown reasons.</p>
  38
  39 <p>To me, it seem that no-one is interested in actually solving the
  40 problem nvidia video card owners experience and make sure the Debian
  41 distribution work out of the box for these users.  The nvidia driver
  42 maintainers expect kdm to be set up to wait longer, while kdm expect
  43 the nvidia driver maintainers to fix the driver to start faster, and
  44 while they wait for each other I guess the users end up switching to a
  45 distribution that work for them.  I have no idea what the solution is,
  46 but I am pretty sure that waiting for each other is not it.</p>
  47
  48 <p>I wonder why we end up handling bugs this way.</p>
  49 </div>
  50   <div class="tags">
  51
  52
  53
  54    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
  55
  56   </div>
  57  </div>
  58  <div class="padding"></div>
  59
  60  <div class="entry">
  61   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_seem_to_hold_up_well_in_Debian_testing.html">Parallellized boot seem to hold up well in Debian/testing</a></div>
  62   <div class="date">2010-05-27 23:55</div>
  63   <div class="body">
  64 <p>A few days ago, parallel booting was enabled in Debian/testing.
  65 The feature seem to hold up pretty well, but three fairly serious
  66 issues are known and should be solved:
  67
  68 <p><ul>
  69
  70 <li>The wicd package seen to
  71 <a href="http://bugs.debian.org/508289">break NFS mounting</a> and
  72 <a href="http://bugs.debian.org/581586">network setup</a> when
  73 parallel booting is enabled.  No idea why, but the wicd maintainer
  74 seem to be on the case.</li>
  75
  76 <li>The nvidia X driver seem to
  77 <a href="http://bugs.debian.org/583312">have a race condition</a>
  78 triggered more easily when parallel booting is in effect.  The
  79 maintainer is on the case.</li>
  80
  81 <li>The sysv-rc package fail to properly enable dependency based boot
  82 sequencing (the shutdown is broken) when old file-rc users
  83 <a href="http://bugs.debian.org/575080">try to switch back</a> to
  84 sysv-rc.  One way to solve it would be for file-rc to create
  85 /etc/init.d/.legacy-bootordering, and another is to try to make
  86 sysv-rc more robust.  Will investigate some more and probably upload a
  87 workaround in sysv-rc to help those trying to move from file-rc to
  88 sysv-rc get a working shutdown.</li>
  89
  90 </ul></p>
  91
  92 <p>All in all not many surprising issues, and all of them seem
  93 solvable before Squeeze is released.  In addition to these there are
  94 some packages with bugs in their dependencies and run level settings,
  95 which I expect will be fixed in a reasonable time span.</p>
  96
  97 <p>If you report any problems with dependencies in init.d scripts to
  98 the BTS, please usertag the report to get it to show up at
  99 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 100 list of usertagged bugs related to this</a>.</p>
 101
 102 <p>Update: Correct bug number to file-rc issue.</p>
 103 </div>
 104   <div class="tags">
 105
 106
 107
 108    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 109
 110   </div>
 111  </div>
 112  <div class="padding"></div>
 113
 114  <div class="entry">
 115   <div class="title"><a href="http://people.skolelinux.org/pere/blog/More_flexible_firmware_handling_in_debian_installer.html">More flexible firmware handling in debian-installer</a></div>
 116   <div class="date">2010-05-22 21:30</div>
 117   <div class="body">
 118 <p>After a long break from debian-installer development, I finally
 119 found time today to return to the project.  Having to spend less time
 120 working dependency based boot in debian, as it is almost complete now,
 121 definitely helped freeing some time.</p>
 122
 123 <p>A while back, I ran into a problem while working on Debian Edu.  We
 124 include some firmware packages on the Debian Edu CDs, those needed to
 125 get disk and network controllers working.  Without having these
 126 firmware packages available during installation, it is impossible to
 127 install Debian Edu on the given machine, and because our target group
 128 are non-technical people, asking them to provide firmware packages on
 129 an external medium is a support pain.  Initially, I expected it to be
 130 enough to include the firmware packages on the CD to get
 131 debian-installer to find and use them.  This proved to be wrong.
 132 Next, I hoped it was enough to symlink the relevant firmware packages
 133 to some useful location on the CD (tried /cdrom/ and
 134 /cdrom/firmware/).  This also proved to not work, and at this point I
 135 found time to look at the debian-installer code to figure out what was
 136 going to work.</p>
 137
 138 <p>The firmware loading code is in the hw-detect package, and a closer
 139 look revealed that it would only look for firmware packages outside
 140 the installation media, so the CD was never checked for firmware
 141 packages.  It would only check USB sticks, floppies and other
 142 "external" media devices.  Today I changed it to also look in the
 143 /cdrom/firmware/ directory on the mounted CD or DVD, which should
 144 solve the problem I ran into with Debian edu.  I also changed it to
 145 look in /firmware/, to make sure the installer also find firmware
 146 provided in the initrd when booting the installer via PXE, to allow us
 147 to provide the same feature in the PXE setup included in Debian
 148 Edu.</p>
 149
 150 <p>To make sure firmware deb packages with a license questions are not
 151 activated without asking if the license is accepted, I extended
 152 hw-detect to look for preinst scripts in the firmware packages, and
 153 run these before activating the firmware during installation.  The
 154 license question is asked using debconf in the preinst, so this should
 155 solve the issue for the firmware packages I have looked at so far.</p>
 156
 157 <p>If you want to discuss the details of these features, please
 158 contact us on debian-boot@lists.debian.org.</p>
 159 </div>
 160   <div class="tags">
 161
 162
 163
 164    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 165
 166   </div>
 167  </div>
 168  <div class="padding"></div>
 169
 170  <div class="entry">
 171   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html">Magnetstripeinnhold i billetter fra Flytoget og Hurtigruten</a></div>
 172   <div class="date">2010-05-21 16:00</div>
 173   <div class="body">
 174 <p>For en stund tilbake kjøpte jeg en magnetkortleser for å kunne
 175 titte på hva som er skrevet inn på magnetstripene til ulike kort.  Har
 176 ikke hatt tid til å analysere mange kort så langt, men tenkte jeg
 177 skulle dele innholdet på to kort med mine lesere.</p>
 178
 179 <p>For noen dager siden tok jeg flyet til Harstad og Hurtigruten til
 180 Bergen.  Flytoget fra Oslo S til flyplassen ga meg en billett med
 181 magnetstripe.  Påtrykket finner jeg følgende informasjon:</p>
 182
 183 <pre>
 184 Flytoget Airport Express Train
 185
 186 Fra - Til        : Oslo Sentralstasjon
 187 Kategori         : Voksen
 188 Pris             : Nok 170,00
 189 Herav mva. 8,00% : NOK 12,59
 190 Betaling         : Kontant
 191 Til - Fra        : Oslo Lufthavn
 192 Utstedt:         : 08.05.10
 193 Gyldig Fra-Til   : 08.05.10-07.11.10
 194 Billetttype      : Enkeltbillett
 195
 196 102-1015-100508-48382-01-08
 197 </pre>
 198
 199 <p>På selve magnetstripen er innholdet
 200 <tt>;E?+900120011=23250996541068112619257138248441708433322932704083389389062603279671261502492655?</tt>.
 201 Aner ikke hva innholdet representerer, og det er lite overlapp mellom
 202 det jeg ser trykket på billetten og det jeg ser av tegn i
 203 magnetstripen.  Håper det betyr at de bruker kryptografiske metoder
 204 for å gjøre det vanskelig å forfalske billetter.</p>
 205
 206 <p>Den andre billetten er fra Hurtigruten, der jeg mistenker at
 207 strekkoden på fronten er mer brukt enn magnetstripen (det var i hvert
 208 fall den biten vi stakk inn i dørlåsen).</p>
 209
 210 <p>Påtrykket forsiden er følgende:</p>
 211
 212 <pre>
 213 Romnummer 727
 214 Hurtigruten
 215 Midnatsol
 216 Reinholdtsen
 217 Petter
 218 Bookingno: SAX69   0742193
 219 Harstad-Bergen
 220 Dep: 09.05.2010 Arr: 12.05.2010
 221 Lugar fra Risøyhamn
 222 Kost: FRO=4
 223 </pre>
 224
 225 <p>På selve magnetstripen er innholdet
 226 <tt>;1316010007421930=00000000000000000000?+E?</tt>.  Heller ikke her
 227 ser jeg mye korrespondanse mellom påtrykk og magnetstripe.</p>
 228 </div>
 229   <div class="tags">
 230
 231
 232
 233    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 234
 235   </div>
 236  </div>
 237  <div class="padding"></div>
 238
 239  <div class="entry">
 240   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Pieces_of_the_roaming_laptop_puzzle_in_Debian.html">Pieces of the roaming laptop puzzle in Debian</a></div>
 241   <div class="date">2010-05-19 19:00</div>
 242   <div class="body">
 243 <p>Today, the last piece of the puzzle for roaming laptops in Debian
 244 Edu finally entered the Debian archive.  Today, the new
 245 <a href="http://packages.qa.debian.org/libp/libpam-mklocaluser.html">libpam-mklocaluser</a>
 246 package was accepted.  Two days ago, two other pieces was accepted
 247 into unstable.  The
 248 <a href="http://packages.qa.debian.org/p/pam-python.html">pam-python</a>
 249 package needed by libpam-mklocaluser, and the
 250 <a href="http://packages.qa.debian.org/s/sssd.html">sssd</a> package
 251 passed NEW on Monday.  In addition, the
 252 <a href="http://packages.qa.debian.org/libp/libpam-ccreds.html">libpam-ccreds</a>
 253 package we need is in experimental (version 10-4) since Saturday, and
 254 hopefully will be moved to unstable soon.</p>
 255
 256 <p>This collection of packages allow for two different setups for
 257 roaming laptops.  The traditional setup would be using libpam-ccreds,
 258 nscd and libpam-mklocaluser with LDAP or Kerberos authentication,
 259 which should work out of the box if the configuration changes proposed
 260 for nscd in <a href="http://bugs.debian.org/485282">BTS report
 261 #485282</a> is implemented.  The alternative setup is to use sssd with
 262 libpam-mklocaluser to connect to LDAP or Kerberos and let sssd take
 263 care of the caching of passwords and group information.</p>
 264
 265 <p>I have so far been unable to get sssd to work with the LDAP server
 266 at the University, but suspect the issue is some SSL/GnuTLS related
 267 problem with the server certificate.  I plan to update the Debian
 268 package to version 1.2, which is scheduled for next week, and hope to
 269 find time to make sure the next release will include both the
 270 Debian/Ubuntu specific patches.  Upstream is friendly and responsive,
 271 and I am sure we will find a good solution.</p>
 272
 273 <p>The idea is to set up the roaming laptops to authenticate using
 274 LDAP or Kerberos and create a local user with home directory in /home/
 275 when a usre in LDAP logs in via KDM or GDM for the first time, and
 276 cache the password for offline checking, as well as caching group
 277 memberhips and other relevant LDAP information.  The
 278 libpam-mklocaluser package was created to make sure the local home
 279 directory is in /home/, instead of /site/server/directory/ which would
 280 be the home directory if pam_mkhomedir was used.  To avoid confusion
 281 with support requests and configuration, we do not want local laptops
 282 to have users in a path that is used for the same users home directory
 283 on the home directory servers.</p>
 284
 285 <p>One annoying problem with gdm is that it do not show the PAM
 286 message passed to the user from libpam-mklocaluser when the local user
 287 is created.  Instead gdm simply reject the login with some generic
 288 message.  The message is shown in kdm, ssh and login, so I guess it is
 289 a bug in gdm.  Have not investigated if there is some other message
 290 type that can be used instead to get gdm to also show the message.</p>
 291
 292 <p>If you want to help out with implementing this for Debian Edu,
 293 please contact us on debian-edu@lists.debian.org.</p>
 294 </div>
 295   <div class="tags">
 296
 297
 298
 299    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 300
 301   </div>
 302  </div>
 303  <div class="padding"></div>
 304
 305  <div class="entry">
 306   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html">Parallellized boot is now the default in Debian/unstable</a></div>
 307   <div class="date">2010-05-14 22:40</div>
 308   <div class="body">
 309 <p>Since this evening, parallel booting is the default in
 310 Debian/unstable for machines using dependency based boot sequencing.
 311 Apparently the testing of concurrent booting has been wider than
 312 expected, if I am to believe the
 313 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 314 on debian-devel@</a>, and I concluded a few days ago to move forward
 315 with the feature this weekend, to give us some time to detect any
 316 remaining problems before Squeeze is frozen.  If serious problems are
 317 detected, it is simple to change the default back to sequential boot.
 318 The upload of the new sysvinit package also activate a new upstream
 319 version.</p>
 320
 321 More information about
 322 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 323 based boot sequencing</a> is available from the Debian wiki.  It is
 324 currently possible to disable parallel booting when one run into
 325 problems caused by it, by adding this line to /etc/default/rcS:</p>
 326
 327 <blockquote><pre>
 328 CONCURRENCY=none
 329 </pre></blockquote>
 330
 331 <p>If you report any problems with dependencies in init.d scripts to
 332 the BTS, please usertag the report to get it to show up at
 333 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 334 list of usertagged bugs related to this</a>.</p>
 335 </div>
 336   <div class="tags">
 337
 338
 339
 340    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 341
 342   </div>
 343  </div>
 344  <div class="padding"></div>
 345
 346  <div class="entry">
 347   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html">Sitesummary tip: Listing MAC address of all clients</a></div>
 348   <div class="date">2010-05-14 21:10</div>
 349   <div class="body">
 350 <p>In the recent Debian Edu versions, the
 351 <a href="http://wiki.debian.org/DebianEdu/HowTo/SiteSummary">sitesummary
 352 system</a> is used to keep track of the machines in the school
 353 network.  Each machine will automatically report its status to the
 354 central server after boot and once per night.  The network setup is
 355 also reported, and using this information it is possible to get the
 356 MAC address of all network interfaces in the machines.  This is useful
 357 to update the DHCP configuration.</p>
 358
 359 <p>To give some idea how to use sitesummary, here is a one-liner to
 360 ist all MAC addresses of all machines reporting to sitesummary.  Run
 361 this on the collector host:</p>
 362
 363 <blockquote><pre>
 364 perl -MSiteSummary -e 'for_all_hosts(sub { print join(" ", get_macaddresses(shift)), "\n"; });'
 365 </pre></blockquote>
 366
 367 <p>This will list all MAC addresses assosiated with all machine, one
 368 line per machine and with space between the MAC addresses.</p>
 369
 370 <p>To allow system administrators easier job at adding static DHCP
 371 addresses for hosts, it would be possible to extend this to fetch
 372 machine information from sitesummary and update the DHCP and DNS
 373 tables in LDAP using this information.  Such tool is unfortunately not
 374 written yet.</p>
 375 </div>
 376   <div class="tags">
 377
 378
 379
 380    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary</a>.
 381
 382   </div>
 383  </div>
 384  <div class="padding"></div>
 385
 386  <div class="entry">
 387   <div class="title"><a href="http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html">systemd, an interesting alternative to upstart</a></div>
 388   <div class="date">2010-05-13 22:20</div>
 389   <div class="body">
 390 <p>The last few days a new boot system called
 391 <a href="http://www.freedesktop.org/wiki/Software/systemd">systemd</a>
 392 has been
 393 <a href="http://0pointer.de/blog/projects/systemd.html">introduced</a>
 394
 395 to the free software world.  I have not yet had time to play around
 396 with it, but it seem to be a very interesting alternative to
 397 <a href="http://upstart.ubuntu.com/">upstart</a>, and might prove to be
 398 a good alternative for Debian when we are able to switch to an event
 399 based boot system.  Tollef is
 400 <a href="http://bugs.debian.org/580814">in the process</a> of getting
 401 systemd into Debian, and I look forward to seeing how well it work.  I
 402 like the fact that systemd handles init.d scripts with dependency
 403 information natively, allowing them to run in parallel where upstart
 404 at the moment do not.</p>
 405
 406 <p>Unfortunately do systemd have the same problem as upstart regarding
 407 platform support.  It only work on recent Linux kernels, and also need
 408 some new kernel features enabled to function properly.  This means
 409 kFreeBSD and Hurd ports of Debian will need a port or a different boot
 410 system.  Not sure how that will be handled if systemd proves to be the
 411 way forward.</p>
 412
 413 <p>In the mean time, based on the
 414 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 415 on debian-devel@</a> regarding parallel booting in Debian, I have
 416 decided to enable full parallel booting as the default in Debian as
 417 soon as possible (probably this weekend or early next week), to see if
 418 there are any remaining serious bugs in the init.d dependencies.  A
 419 new version of the sysvinit package implementing this change is
 420 already in experimental.  If all go well, Squeeze will be released
 421 with parallel booting enabled by default.</p>
 422 </div>
 423   <div class="tags">
 424
 425
 426
 427    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 428
 429   </div>
 430  </div>
 431  <div class="padding"></div>
 432
 433  <div class="entry">
 434   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html">Parallellizing the boot in Debian Squeeze - ready for wider testing</a></div>
 435   <div class="date">2010-05-06 23:25</div>
 436   <div class="body">
 437 <p>These days, the init.d script dependencies in Squeeze are quite
 438 complete, so complete that it is actually possible to run all the
 439 init.d scripts in parallell based on these dependencies.  If you want
 440 to test your Squeeze system, make sure
 441 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 442 based boot sequencing</a> is enabled, and add this line to
 443 /etc/default/rcS:</p>
 444
 445 <blockquote><pre>
 446 CONCURRENCY=makefile
 447 </pre></blockquote>
 448
 449 <p>That is it.  It will cause sysv-rc to use the startpar tool to run
 450 scripts in parallel using the dependency information stored in
 451 /etc/init.d/.depend.boot, /etc/init.d/.depend.start and
 452 /etc/init.d/.depend.stop to order the scripts.  Startpar is configured
 453 to try to start the kdm and gdm scripts as early as possible, and will
 454 start the facilities required by kdm or gdm as early as possible to
 455 make this happen.</p>
 456
 457 <p>Give it a try, and see if you like the result.  If some services
 458 fail to start properly, it is most likely because they have incomplete
 459 init.d script dependencies in their startup script (or some of their
 460 dependent scripts have incomplete dependencies).  Report bugs and get
 461 the package maintainers to fix it. :)</p>
 462
 463 <p>Running scripts in parallel could be the default in Debian when we
 464 manage to get the init.d script dependencies complete and correct.  I
 465 expect we will get there in Squeeze+1, if we get manage to test and
 466 fix the remaining issues.</p>
 467
 468 <p>If you report any problems with dependencies in init.d scripts to
 469 the BTS, please usertag the report to get it to show up at
 470 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 471 list of usertagged bugs related to this</a>.</p>
 472 </div>
 473   <div class="tags">
 474
 475
 476
 477    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 478
 479   </div>
 480  </div>
 481  <div class="padding"></div>
 482
 483  <div class="entry">
 484   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html">Forcing new users to change their password on first login</a></div>
 485   <div class="date">2010-05-02 13:47</div>
 486   <div class="body">
 487 <p>One interesting feature in Active Directory, is the ability to
 488 create a new user with an expired password, and thus force the user to
 489 change the password on the first login attempt.</p>
 490
 491 <p>I'm not quite sure how to do that with the LDAP setup in Debian
 492 Edu, but did some initial testing with a local account.  The account
 493 and password aging information is available in /etc/shadow, but
 494 unfortunately, it is not possible to specify an expiration time for
 495 passwords, only a maximum age for passwords.</p>
 496
 497 <p>A freshly created account (using adduser test) will have these
 498 settings in /etc/shadow:</p>
 499
 500 <blockquote><pre>
 501 root@tjener:~# chage -l test
 502 Last password change                                    : May 02, 2010
 503 Password expires                                        : never
 504 Password inactive                                       : never
 505 Account expires                                         : never
 506 Minimum number of days between password change          : 0
 507 Maximum number of days between password change          : 99999
 508 Number of days of warning before password expires       : 7
 509 root@tjener:~#
 510 </pre></blockquote>
 511
 512 <p>The only way I could come up with to create a user with an expired
 513 account, is to change the date of the last password change to the
 514 lowest value possible (January 1th 1970), and the maximum password age
 515 to the difference in days between that date and today.  To make it
 516 simple, I went for 30 years (30 * 365 = 10950) and January 2th (to
 517 avoid testing if 0 is a valid value).</p>
 518
 519 <p>After using these commands to set it up, it seem to work as
 520 intended:</p>
 521
 522 <blockquote><pre>
 523 root@tjener:~# chage -d 1 test; chage -M 10950 test
 524 root@tjener:~# chage -l test
 525 Last password change                                    : Jan 02, 1970
 526 Password expires                                        : never
 527 Password inactive                                       : never
 528 Account expires                                         : never
 529 Minimum number of days between password change          : 0
 530 Maximum number of days between password change          : 10950
 531 Number of days of warning before password expires       : 7
 532 root@tjener:~#
 533 </pre></blockquote>
 534
 535 <p>So far I have tested this with ssh and console, and kdm (in
 536 Squeeze) login, and all ask for a new password before login in the
 537 user (with ssh, I was thrown out and had to log in again).</p>
 538
 539 <p>Perhaps we should set up something similar for Debian Edu, to make
 540 sure only the user itself have the account password?</p>
 541
 542 <p>If you want to comment on or help out with implementing this for
 543 Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 544
 545 <p>Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the
 546 shadow(8) page in Debian/testing now state that setting the date of
 547 last password change to zero (0) will force the password to be changed
 548 on the first login.  This was not mentioned in the manual in Lenny, so
 549 I did not notice this in my initial testing.  I have tested it on
 550 Squeeze, and '<tt>chage -d 0 username</tt>' do work there.  I have not
 551 tested it on Lenny yet.</p>
 552
 553 <p>Update 2010-05-02-19:05: Jim Paris tells me via email that an
 554 equivalent command to expire a password is '<tt>passwd -e
 555 username</tt>', which insert zero into the date of the last password
 556 change.</p>
 557 </div>
 558   <div class="tags">
 559
 560
 561
 562    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 563
 564   </div>
 565  </div>
 566  <div class="padding"></div>
 567
 568  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
 569
 570 <div id="sidebar">
 571
 572
 573
 574
 575
 576 <h2>Archive</h2>
 577 <ul>
 578
 579 <li>2010
 580 <ul>
 581
 582 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 583
 584 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 585
 586 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 587
 588 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 589
 590 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 591
 592 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (1)</a></li>
 593
 594 </ul></li>
 595
 596 <li>2009
 597 <ul>
 598
 599 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 600
 601 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 602
 603 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 604
 605 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 606
 607 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 608
 609 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 610
 611 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 612
 613 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 614
 615 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 616
 617 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 618
 619 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 620
 621 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 622
 623 </ul></li>
 624
 625 <li>2008
 626 <ul>
 627
 628 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 629
 630 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 631
 632 </ul></li>
 633
 634 </ul>
 635
 636
 637
 638 <h2>Tags</h2>
 639 <ul>
 640
 641  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 642
 643  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 644
 645  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 646
 647  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (21)</a></li>
 648
 649  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (21)</a></li>
 650
 651  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (32)</a></li>
 652
 653  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 654
 655  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (6)</a></li>
 656
 657  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
 658
 659  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
 660
 661  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 662
 663  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 664
 665  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (65)</a></li>
 666
 667  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (74)</a></li>
 668
 669  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (12)</a></li>
 670
 671  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (11)</a></li>
 672
 673  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 674
 675  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 676
 677  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (8)</a></li>
 678
 679  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (1)</a></li>
 680
 681  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (11)</a></li>
 682
 683  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 684
 685  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 686
 687  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 688
 689  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
 690
 691 </ul>
 692
 693 </div>
 694
 695 <p style="text-align: right">
 696 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
 697 </p>
 698 </body>
 699 </html>