blog/archive/2010/05/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
   4   <head>
   5     <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
   6     <title>Petter Reinholdtsen: entries from May 2010</title>
   7     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css" />
   8     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/vim.css" />
   9     <link rel="alternate" title="RSS Feed" href="05.rss" type="application/rss+xml" />
  10   </head>
  11   <body>
  12     <!-- XML FEED -->
  13     <div class="title">
  14  <h1>
  15      <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  16
  17  </h1>
  18
  19 </div>
  20
  21
  22     <h3>Entries from May 2010.</h3>
  23
  24     <div class="entry">
  25       <div class="title">
  26         <a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_seem_to_hold_up_well_in_Debian_testing.html">Parallellized boot seem to hold up well in Debian/testing</a>
  27       </div>
  28       <div class="date">
  29         27th May 2010
  30       </div>
  31       <div class="body">
  32         <p>A few days ago, parallel booting was enabled in Debian/testing.
  33 The feature seem to hold up pretty well, but three fairly serious
  34 issues are known and should be solved:
  35
  36 <p><ul>
  37
  38 <li>The wicd package seen to
  39 <a href="http://bugs.debian.org/508289">break NFS mounting</a> and
  40 <a href="http://bugs.debian.org/581586">network setup</a> when
  41 parallel booting is enabled.  No idea why, but the wicd maintainer
  42 seem to be on the case.</li>
  43
  44 <li>The nvidia X driver seem to
  45 <a href="http://bugs.debian.org/583312">have a race condition</a>
  46 triggered more easily when parallel booting is in effect.  The
  47 maintainer is on the case.</li>
  48
  49 <li>The sysv-rc package fail to properly enable dependency based boot
  50 sequencing (the shutdown is broken) when old file-rc users
  51 <a href="http://bugs.debian.org/575080">try to switch back</a> to
  52 sysv-rc.  One way to solve it would be for file-rc to create
  53 /etc/init.d/.legacy-bootordering, and another is to try to make
  54 sysv-rc more robust.  Will investigate some more and probably upload a
  55 workaround in sysv-rc to help those trying to move from file-rc to
  56 sysv-rc get a working shutdown.</li>
  57
  58 </ul></p>
  59
  60 <p>All in all not many surprising issues, and all of them seem
  61 solvable before Squeeze is released.  In addition to these there are
  62 some packages with bugs in their dependencies and run level settings,
  63 which I expect will be fixed in a reasonable time span.</p>
  64
  65 <p>If you report any problems with dependencies in init.d scripts to
  66 the BTS, please usertag the report to get it to show up at
  67 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
  68 list of usertagged bugs related to this</a>.</p>
  69
  70 <p>Update: Correct bug number to file-rc issue.</p>
  71
  72       </div>
  73       <div class="tags">
  74
  75
  76         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
  77
  78
  79       </div>
  80     </div>
  81     <div class="padding"></div>
  82
  83     <div class="entry">
  84       <div class="title">
  85         <a href="http://people.skolelinux.org/pere/blog/More_flexible_firmware_handling_in_debian_installer.html">More flexible firmware handling in debian-installer</a>
  86       </div>
  87       <div class="date">
  88         22nd May 2010
  89       </div>
  90       <div class="body">
  91         <p>After a long break from debian-installer development, I finally
  92 found time today to return to the project.  Having to spend less time
  93 working dependency based boot in debian, as it is almost complete now,
  94 definitely helped freeing some time.</p>
  95
  96 <p>A while back, I ran into a problem while working on Debian Edu.  We
  97 include some firmware packages on the Debian Edu CDs, those needed to
  98 get disk and network controllers working.  Without having these
  99 firmware packages available during installation, it is impossible to
 100 install Debian Edu on the given machine, and because our target group
 101 are non-technical people, asking them to provide firmware packages on
 102 an external medium is a support pain.  Initially, I expected it to be
 103 enough to include the firmware packages on the CD to get
 104 debian-installer to find and use them.  This proved to be wrong.
 105 Next, I hoped it was enough to symlink the relevant firmware packages
 106 to some useful location on the CD (tried /cdrom/ and
 107 /cdrom/firmware/).  This also proved to not work, and at this point I
 108 found time to look at the debian-installer code to figure out what was
 109 going to work.</p>
 110
 111 <p>The firmware loading code is in the hw-detect package, and a closer
 112 look revealed that it would only look for firmware packages outside
 113 the installation media, so the CD was never checked for firmware
 114 packages.  It would only check USB sticks, floppies and other
 115 "external" media devices.  Today I changed it to also look in the
 116 /cdrom/firmware/ directory on the mounted CD or DVD, which should
 117 solve the problem I ran into with Debian edu.  I also changed it to
 118 look in /firmware/, to make sure the installer also find firmware
 119 provided in the initrd when booting the installer via PXE, to allow us
 120 to provide the same feature in the PXE setup included in Debian
 121 Edu.</p>
 122
 123 <p>To make sure firmware deb packages with a license questions are not
 124 activated without asking if the license is accepted, I extended
 125 hw-detect to look for preinst scripts in the firmware packages, and
 126 run these before activating the firmware during installation.  The
 127 license question is asked using debconf in the preinst, so this should
 128 solve the issue for the firmware packages I have looked at so far.</p>
 129
 130 <p>If you want to discuss the details of these features, please
 131 contact us on debian-boot@lists.debian.org.</p>
 132
 133       </div>
 134       <div class="tags">
 135
 136
 137         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 138
 139
 140       </div>
 141     </div>
 142     <div class="padding"></div>
 143
 144     <div class="entry">
 145       <div class="title">
 146         <a href="http://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html">Magnetstripeinnhold i billetter fra Flytoget og Hurtigruten</a>
 147       </div>
 148       <div class="date">
 149         21st May 2010
 150       </div>
 151       <div class="body">
 152         <p>For en stund tilbake kjøpte jeg en magnetkortleser for å kunne
 153 titte på hva som er skrevet inn på magnetstripene til ulike kort.  Har
 154 ikke hatt tid til å analysere mange kort så langt, men tenkte jeg
 155 skulle dele innholdet på to kort med mine lesere.</p>
 156
 157 <p>For noen dager siden tok jeg flyet til Harstad og Hurtigruten til
 158 Bergen.  Flytoget fra Oslo S til flyplassen ga meg en billett med
 159 magnetstripe.  Påtrykket finner jeg følgende informasjon:</p>
 160
 161 <pre>
 162 Flytoget Airport Express Train
 163
 164 Fra - Til        : Oslo Sentralstasjon
 165 Kategori         : Voksen
 166 Pris             : Nok 170,00
 167 Herav mva. 8,00% : NOK 12,59
 168 Betaling         : Kontant
 169 Til - Fra        : Oslo Lufthavn
 170 Utstedt:         : 08.05.10
 171 Gyldig Fra-Til   : 08.05.10-07.11.10
 172 Billetttype      : Enkeltbillett
 173
 174 102-1015-100508-48382-01-08
 175 </pre>
 176
 177 <p>På selve magnetstripen er innholdet
 178 <tt>;E?+900120011=23250996541068112619257138248441708433322932704083389389062603279671261502492655?</tt>.
 179 Aner ikke hva innholdet representerer, og det er lite overlapp mellom
 180 det jeg ser trykket på billetten og det jeg ser av tegn i
 181 magnetstripen.  Håper det betyr at de bruker kryptografiske metoder
 182 for å gjøre det vanskelig å forfalske billetter.</p>
 183
 184 <p>Den andre billetten er fra Hurtigruten, der jeg mistenker at
 185 strekkoden på fronten er mer brukt enn magnetstripen (det var i hvert
 186 fall den biten vi stakk inn i dørlåsen).</p>
 187
 188 <p>Påtrykket forsiden er følgende:</p>
 189
 190 <pre>
 191 Romnummer 727
 192 Hurtigruten
 193 Midnatsol
 194 Reinholdtsen
 195 Petter
 196 Bookingno: SAX69   0742193
 197 Harstad-Bergen
 198 Dep: 09.05.2010 Arr: 12.05.2010
 199 Lugar fra Risøyhamn
 200 Kost: FRO=4
 201 </pre>
 202
 203 <p>På selve magnetstripen er innholdet
 204 <tt>;1316010007421930=00000000000000000000?+E?</tt>.  Heller ikke her
 205 ser jeg mye korrespondanse mellom påtrykk og magnetstripe.</p>
 206
 207       </div>
 208       <div class="tags">
 209
 210
 211         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 212
 213
 214       </div>
 215     </div>
 216     <div class="padding"></div>
 217
 218     <div class="entry">
 219       <div class="title">
 220         <a href="http://people.skolelinux.org/pere/blog/Pieces_of_the_roaming_laptop_puzzle_in_Debian.html">Pieces of the roaming laptop puzzle in Debian</a>
 221       </div>
 222       <div class="date">
 223         19th May 2010
 224       </div>
 225       <div class="body">
 226         <p>Today, the last piece of the puzzle for roaming laptops in Debian
 227 Edu finally entered the Debian archive.  Today, the new
 228 <a href="http://packages.qa.debian.org/libp/libpam-mklocaluser.html">libpam-mklocaluser</a>
 229 package was accepted.  Two days ago, two other pieces was accepted
 230 into unstable.  The
 231 <a href="http://packages.qa.debian.org/p/pam-python.html">pam-python</a>
 232 package needed by libpam-mklocaluser, and the
 233 <a href="http://packages.qa.debian.org/s/sssd.html">sssd</a> package
 234 passed NEW on Monday.  In addition, the
 235 <a href="http://packages.qa.debian.org/libp/libpam-ccreds.html">libpam-ccreds</a>
 236 package we need is in experimental (version 10-4) since Saturday, and
 237 hopefully will be moved to unstable soon.</p>
 238
 239 <p>This collection of packages allow for two different setups for
 240 roaming laptops.  The traditional setup would be using libpam-ccreds,
 241 nscd and libpam-mklocaluser with LDAP or Kerberos authentication,
 242 which should work out of the box if the configuration changes proposed
 243 for nscd in <a href="http://bugs.debian.org/485282">BTS report
 244 #485282</a> is implemented.  The alternative setup is to use sssd with
 245 libpam-mklocaluser to connect to LDAP or Kerberos and let sssd take
 246 care of the caching of passwords and group information.</p>
 247
 248 <p>I have so far been unable to get sssd to work with the LDAP server
 249 at the University, but suspect the issue is some SSL/GnuTLS related
 250 problem with the server certificate.  I plan to update the Debian
 251 package to version 1.2, which is scheduled for next week, and hope to
 252 find time to make sure the next release will include both the
 253 Debian/Ubuntu specific patches.  Upstream is friendly and responsive,
 254 and I am sure we will find a good solution.</p>
 255
 256 <p>The idea is to set up the roaming laptops to authenticate using
 257 LDAP or Kerberos and create a local user with home directory in /home/
 258 when a usre in LDAP logs in via KDM or GDM for the first time, and
 259 cache the password for offline checking, as well as caching group
 260 memberhips and other relevant LDAP information.  The
 261 libpam-mklocaluser package was created to make sure the local home
 262 directory is in /home/, instead of /site/server/directory/ which would
 263 be the home directory if pam_mkhomedir was used.  To avoid confusion
 264 with support requests and configuration, we do not want local laptops
 265 to have users in a path that is used for the same users home directory
 266 on the home directory servers.</p>
 267
 268 <p>One annoying problem with gdm is that it do not show the PAM
 269 message passed to the user from libpam-mklocaluser when the local user
 270 is created.  Instead gdm simply reject the login with some generic
 271 message.  The message is shown in kdm, ssh and login, so I guess it is
 272 a bug in gdm.  Have not investigated if there is some other message
 273 type that can be used instead to get gdm to also show the message.</p>
 274
 275 <p>If you want to help out with implementing this for Debian Edu,
 276 please contact us on debian-edu@lists.debian.org.</p>
 277
 278       </div>
 279       <div class="tags">
 280
 281
 282         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 283
 284
 285       </div>
 286     </div>
 287     <div class="padding"></div>
 288
 289     <div class="entry">
 290       <div class="title">
 291         <a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html">Parallellized boot is now the default in Debian/unstable</a>
 292       </div>
 293       <div class="date">
 294         14th May 2010
 295       </div>
 296       <div class="body">
 297         <p>Since this evening, parallel booting is the default in
 298 Debian/unstable for machines using dependency based boot sequencing.
 299 Apparently the testing of concurrent booting has been wider than
 300 expected, if I am to believe the
 301 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 302 on debian-devel@</a>, and I concluded a few days ago to move forward
 303 with the feature this weekend, to give us some time to detect any
 304 remaining problems before Squeeze is frozen.  If serious problems are
 305 detected, it is simple to change the default back to sequential boot.
 306 The upload of the new sysvinit package also activate a new upstream
 307 version.</p>
 308
 309 More information about
 310 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 311 based boot sequencing</a> is available from the Debian wiki.  It is
 312 currently possible to disable parallel booting when one run into
 313 problems caused by it, by adding this line to /etc/default/rcS:</p>
 314
 315 <blockquote><pre>
 316 CONCURRENCY=none
 317 </pre></blockquote>
 318
 319 <p>If you report any problems with dependencies in init.d scripts to
 320 the BTS, please usertag the report to get it to show up at
 321 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 322 list of usertagged bugs related to this</a>.</p>
 323
 324       </div>
 325       <div class="tags">
 326
 327
 328         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 329
 330
 331       </div>
 332     </div>
 333     <div class="padding"></div>
 334
 335     <div class="entry">
 336       <div class="title">
 337         <a href="http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html">Sitesummary tip: Listing MAC address of all clients</a>
 338       </div>
 339       <div class="date">
 340         14th May 2010
 341       </div>
 342       <div class="body">
 343         <p>In the recent Debian Edu versions, the
 344 <a href="http://wiki.debian.org/DebianEdu/HowTo/SiteSummary">sitesummary
 345 system</a> is used to keep track of the machines in the school
 346 network.  Each machine will automatically report its status to the
 347 central server after boot and once per night.  The network setup is
 348 also reported, and using this information it is possible to get the
 349 MAC address of all network interfaces in the machines.  This is useful
 350 to update the DHCP configuration.</p>
 351
 352 <p>To give some idea how to use sitesummary, here is a one-liner to
 353 ist all MAC addresses of all machines reporting to sitesummary.  Run
 354 this on the collector host:</p>
 355
 356 <blockquote><pre>
 357 perl -MSiteSummary -e 'for_all_hosts(sub { print join(" ", get_macaddresses(shift)), "\n"; });'
 358 </pre></blockquote>
 359
 360 <p>This will list all MAC addresses assosiated with all machine, one
 361 line per machine and with space between the MAC addresses.</p>
 362
 363 <p>To allow system administrators easier job at adding static DHCP
 364 addresses for hosts, it would be possible to extend this to fetch
 365 machine information from sitesummary and update the DHCP and DNS
 366 tables in LDAP using this information.  Such tool is unfortunately not
 367 written yet.</p>
 368
 369       </div>
 370       <div class="tags">
 371
 372
 373         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary</a>.
 374
 375
 376       </div>
 377     </div>
 378     <div class="padding"></div>
 379
 380     <div class="entry">
 381       <div class="title">
 382         <a href="http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html">systemd, an interesting alternative to upstart</a>
 383       </div>
 384       <div class="date">
 385         13th May 2010
 386       </div>
 387       <div class="body">
 388         <p>The last few days a new boot system called
 389 <a href="http://www.freedesktop.org/wiki/Software/systemd">systemd</a>
 390 has been
 391 <a href="http://0pointer.de/blog/projects/systemd.html">introduced</a>
 392
 393 to the free software world.  I have not yet had time to play around
 394 with it, but it seem to be a very interesting alternative to
 395 <a href="http://upstart.ubuntu.com/">upstart</a>, and might prove to be
 396 a good alternative for Debian when we are able to switch to an event
 397 based boot system.  Tollef is
 398 <a href="http://bugs.debian.org/580814">in the process</a> of getting
 399 systemd into Debian, and I look forward to seeing how well it work.  I
 400 like the fact that systemd handles init.d scripts with dependency
 401 information natively, allowing them to run in parallel where upstart
 402 at the moment do not.</p>
 403
 404 <p>Unfortunately do systemd have the same problem as upstart regarding
 405 platform support.  It only work on recent Linux kernels, and also need
 406 some new kernel features enabled to function properly.  This means
 407 kFreeBSD and Hurd ports of Debian will need a port or a different boot
 408 system.  Not sure how that will be handled if systemd proves to be the
 409 way forward.</p>
 410
 411 <p>In the mean time, based on the
 412 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 413 on debian-devel@</a> regarding parallel booting in Debian, I have
 414 decided to enable full parallel booting as the default in Debian as
 415 soon as possible (probably this weekend or early next week), to see if
 416 there are any remaining serious bugs in the init.d dependencies.  A
 417 new version of the sysvinit package implementing this change is
 418 already in experimental.  If all go well, Squeeze will be released
 419 with parallel booting enabled by default.</p>
 420
 421       </div>
 422       <div class="tags">
 423
 424
 425         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 426
 427
 428       </div>
 429     </div>
 430     <div class="padding"></div>
 431
 432     <div class="entry">
 433       <div class="title">
 434         <a href="http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html">Parallellizing the boot in Debian Squeeze - ready for wider testing</a>
 435       </div>
 436       <div class="date">
 437          6th May 2010
 438       </div>
 439       <div class="body">
 440         <p>These days, the init.d script dependencies in Squeeze are quite
 441 complete, so complete that it is actually possible to run all the
 442 init.d scripts in parallell based on these dependencies.  If you want
 443 to test your Squeeze system, make sure
 444 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 445 based boot sequencing</a> is enabled, and add this line to
 446 /etc/default/rcS:</p>
 447
 448 <blockquote><pre>
 449 CONCURRENCY=makefile
 450 </pre></blockquote>
 451
 452 <p>That is it.  It will cause sysv-rc to use the startpar tool to run
 453 scripts in parallel using the dependency information stored in
 454 /etc/init.d/.depend.boot, /etc/init.d/.depend.start and
 455 /etc/init.d/.depend.stop to order the scripts.  Startpar is configured
 456 to try to start the kdm and gdm scripts as early as possible, and will
 457 start the facilities required by kdm or gdm as early as possible to
 458 make this happen.</p>
 459
 460 <p>Give it a try, and see if you like the result.  If some services
 461 fail to start properly, it is most likely because they have incomplete
 462 init.d script dependencies in their startup script (or some of their
 463 dependent scripts have incomplete dependencies).  Report bugs and get
 464 the package maintainers to fix it. :)</p>
 465
 466 <p>Running scripts in parallel could be the default in Debian when we
 467 manage to get the init.d script dependencies complete and correct.  I
 468 expect we will get there in Squeeze+1, if we get manage to test and
 469 fix the remaining issues.</p>
 470
 471 <p>If you report any problems with dependencies in init.d scripts to
 472 the BTS, please usertag the report to get it to show up at
 473 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 474 list of usertagged bugs related to this</a>.</p>
 475
 476       </div>
 477       <div class="tags">
 478
 479
 480         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 481
 482
 483       </div>
 484     </div>
 485     <div class="padding"></div>
 486
 487     <div class="entry">
 488       <div class="title">
 489         <a href="http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html">Forcing new users to change their password on first login</a>
 490       </div>
 491       <div class="date">
 492          2nd May 2010
 493       </div>
 494       <div class="body">
 495         <p>One interesting feature in Active Directory, is the ability to
 496 create a new user with an expired password, and thus force the user to
 497 change the password on the first login attempt.</p>
 498
 499 <p>I'm not quite sure how to do that with the LDAP setup in Debian
 500 Edu, but did some initial testing with a local account.  The account
 501 and password aging information is available in /etc/shadow, but
 502 unfortunately, it is not possible to specify an expiration time for
 503 passwords, only a maximum age for passwords.</p>
 504
 505 <p>A freshly created account (using adduser test) will have these
 506 settings in /etc/shadow:</p>
 507
 508 <blockquote><pre>
 509 root@tjener:~# chage -l test
 510 Last password change                                    : May 02, 2010
 511 Password expires                                        : never
 512 Password inactive                                       : never
 513 Account expires                                         : never
 514 Minimum number of days between password change          : 0
 515 Maximum number of days between password change          : 99999
 516 Number of days of warning before password expires       : 7
 517 root@tjener:~#
 518 </pre></blockquote>
 519
 520 <p>The only way I could come up with to create a user with an expired
 521 account, is to change the date of the last password change to the
 522 lowest value possible (January 1th 1970), and the maximum password age
 523 to the difference in days between that date and today.  To make it
 524 simple, I went for 30 years (30 * 365 = 10950) and January 2th (to
 525 avoid testing if 0 is a valid value).</p>
 526
 527 <p>After using these commands to set it up, it seem to work as
 528 intended:</p>
 529
 530 <blockquote><pre>
 531 root@tjener:~# chage -d 1 test; chage -M 10950 test
 532 root@tjener:~# chage -l test
 533 Last password change                                    : Jan 02, 1970
 534 Password expires                                        : never
 535 Password inactive                                       : never
 536 Account expires                                         : never
 537 Minimum number of days between password change          : 0
 538 Maximum number of days between password change          : 10950
 539 Number of days of warning before password expires       : 7
 540 root@tjener:~#
 541 </pre></blockquote>
 542
 543 <p>So far I have tested this with ssh and console, and kdm (in
 544 Squeeze) login, and all ask for a new password before login in the
 545 user (with ssh, I was thrown out and had to log in again).</p>
 546
 547 <p>Perhaps we should set up something similar for Debian Edu, to make
 548 sure only the user itself have the account password?</p>
 549
 550 <p>If you want to comment on or help out with implementing this for
 551 Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 552
 553 <p>Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the
 554 shadow(8) page in Debian/testing now state that setting the date of
 555 last password change to zero (0) will force the password to be changed
 556 on the first login.  This was not mentioned in the manual in Lenny, so
 557 I did not notice this in my initial testing.  I have tested it on
 558 Squeeze, and '<tt>chage -d 0 username</tt>' do work there.  I have not
 559 tested it on Lenny yet.</p>
 560
 561 <p>Update 2010-05-02-19:05: Jim Paris tells me via email that an
 562 equivalent command to expire a password is '<tt>passwd -e
 563 username</tt>', which insert zero into the date of the last password
 564 change.</p>
 565
 566       </div>
 567       <div class="tags">
 568
 569
 570         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 571
 572
 573       </div>
 574     </div>
 575     <div class="padding"></div>
 576
 577     <p style="text-align: right;"><a href="05.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14" /></a></p>
 578     <div id="sidebar">
 579
 580
 581
 582 <h2>Archive</h2>
 583 <ul>
 584
 585 <li>2018
 586 <ul>
 587
 588 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/01/">January (1)</a></li>
 589
 590 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/02/">February (5)</a></li>
 591
 592 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/03/">March (5)</a></li>
 593
 594 <li><a href="http://people.skolelinux.org/pere/blog/archive/2018/04/">April (1)</a></li>
 595
 596 </ul></li>
 597
 598 <li>2017
 599 <ul>
 600
 601 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/01/">January (4)</a></li>
 602
 603 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/02/">February (3)</a></li>
 604
 605 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/03/">March (5)</a></li>
 606
 607 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/04/">April (2)</a></li>
 608
 609 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/06/">June (5)</a></li>
 610
 611 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/07/">July (1)</a></li>
 612
 613 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/08/">August (1)</a></li>
 614
 615 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/09/">September (3)</a></li>
 616
 617 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/10/">October (5)</a></li>
 618
 619 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/11/">November (3)</a></li>
 620
 621 <li><a href="http://people.skolelinux.org/pere/blog/archive/2017/12/">December (4)</a></li>
 622
 623 </ul></li>
 624
 625 <li>2016
 626 <ul>
 627
 628 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/01/">January (3)</a></li>
 629
 630 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/02/">February (2)</a></li>
 631
 632 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/03/">March (3)</a></li>
 633
 634 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/04/">April (8)</a></li>
 635
 636 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/05/">May (8)</a></li>
 637
 638 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/06/">June (2)</a></li>
 639
 640 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/07/">July (2)</a></li>
 641
 642 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/08/">August (5)</a></li>
 643
 644 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/09/">September (2)</a></li>
 645
 646 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/10/">October (3)</a></li>
 647
 648 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/11/">November (8)</a></li>
 649
 650 <li><a href="http://people.skolelinux.org/pere/blog/archive/2016/12/">December (5)</a></li>
 651
 652 </ul></li>
 653
 654 <li>2015
 655 <ul>
 656
 657 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/01/">January (7)</a></li>
 658
 659 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/02/">February (6)</a></li>
 660
 661 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/03/">March (1)</a></li>
 662
 663 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/04/">April (4)</a></li>
 664
 665 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/05/">May (3)</a></li>
 666
 667 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/06/">June (4)</a></li>
 668
 669 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/07/">July (6)</a></li>
 670
 671 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/08/">August (2)</a></li>
 672
 673 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/09/">September (2)</a></li>
 674
 675 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/10/">October (9)</a></li>
 676
 677 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/11/">November (6)</a></li>
 678
 679 <li><a href="http://people.skolelinux.org/pere/blog/archive/2015/12/">December (3)</a></li>
 680
 681 </ul></li>
 682
 683 <li>2014
 684 <ul>
 685
 686 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/01/">January (2)</a></li>
 687
 688 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/02/">February (3)</a></li>
 689
 690 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/03/">March (8)</a></li>
 691
 692 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/04/">April (7)</a></li>
 693
 694 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/05/">May (1)</a></li>
 695
 696 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/06/">June (2)</a></li>
 697
 698 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/07/">July (2)</a></li>
 699
 700 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/08/">August (2)</a></li>
 701
 702 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/09/">September (5)</a></li>
 703
 704 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/10/">October (6)</a></li>
 705
 706 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/11/">November (3)</a></li>
 707
 708 <li><a href="http://people.skolelinux.org/pere/blog/archive/2014/12/">December (5)</a></li>
 709
 710 </ul></li>
 711
 712 <li>2013
 713 <ul>
 714
 715 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/01/">January (11)</a></li>
 716
 717 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/02/">February (9)</a></li>
 718
 719 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/03/">March (9)</a></li>
 720
 721 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/04/">April (6)</a></li>
 722
 723 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/05/">May (9)</a></li>
 724
 725 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/06/">June (10)</a></li>
 726
 727 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/07/">July (7)</a></li>
 728
 729 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/08/">August (3)</a></li>
 730
 731 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/09/">September (5)</a></li>
 732
 733 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/10/">October (7)</a></li>
 734
 735 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/11/">November (9)</a></li>
 736
 737 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/12/">December (3)</a></li>
 738
 739 </ul></li>
 740
 741 <li>2012
 742 <ul>
 743
 744 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/01/">January (7)</a></li>
 745
 746 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/02/">February (10)</a></li>
 747
 748 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/03/">March (17)</a></li>
 749
 750 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/04/">April (12)</a></li>
 751
 752 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/05/">May (12)</a></li>
 753
 754 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/06/">June (20)</a></li>
 755
 756 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/07/">July (17)</a></li>
 757
 758 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/08/">August (6)</a></li>
 759
 760 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/09/">September (9)</a></li>
 761
 762 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/10/">October (17)</a></li>
 763
 764 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/11/">November (10)</a></li>
 765
 766 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/12/">December (7)</a></li>
 767
 768 </ul></li>
 769
 770 <li>2011
 771 <ul>
 772
 773 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
 774
 775 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
 776
 777 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
 778
 779 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
 780
 781 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
 782
 783 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
 784
 785 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (7)</a></li>
 786
 787 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/08/">August (6)</a></li>
 788
 789 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/09/">September (4)</a></li>
 790
 791 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/10/">October (2)</a></li>
 792
 793 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/11/">November (3)</a></li>
 794
 795 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/12/">December (1)</a></li>
 796
 797 </ul></li>
 798
 799 <li>2010
 800 <ul>
 801
 802 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 803
 804 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 805
 806 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 807
 808 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 809
 810 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 811
 812 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 813
 814 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
 815
 816 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
 817
 818 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
 819
 820 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
 821
 822 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
 823
 824 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
 825
 826 </ul></li>
 827
 828 <li>2009
 829 <ul>
 830
 831 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 832
 833 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 834
 835 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 836
 837 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 838
 839 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 840
 841 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 842
 843 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 844
 845 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 846
 847 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 848
 849 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 850
 851 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 852
 853 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 854
 855 </ul></li>
 856
 857 <li>2008
 858 <ul>
 859
 860 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 861
 862 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 863
 864 </ul></li>
 865
 866 </ul>
 867
 868
 869
 870 <h2>Tags</h2>
 871 <ul>
 872
 873  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (16)</a></li>
 874
 875  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 876
 877  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 878
 879  <li><a href="http://people.skolelinux.org/pere/blog/tags/bankid">bankid (4)</a></li>
 880
 881  <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (9)</a></li>
 882
 883  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (17)</a></li>
 884
 885  <li><a href="http://people.skolelinux.org/pere/blog/tags/bsa">bsa (2)</a></li>
 886
 887  <li><a href="http://people.skolelinux.org/pere/blog/tags/chrpath">chrpath (2)</a></li>
 888
 889  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (156)</a></li>
 890
 891  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (158)</a></li>
 892
 893  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian-handbook">debian-handbook (4)</a></li>
 894
 895  <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (10)</a></li>
 896
 897  <li><a href="http://people.skolelinux.org/pere/blog/tags/dld">dld (17)</a></li>
 898
 899  <li><a href="http://people.skolelinux.org/pere/blog/tags/docbook">docbook (25)</a></li>
 900
 901  <li><a href="http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (4)</a></li>
 902
 903  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (372)</a></li>
 904
 905  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (23)</a></li>
 906
 907  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (13)</a></li>
 908
 909  <li><a href="http://people.skolelinux.org/pere/blog/tags/freeculture">freeculture (32)</a></li>
 910
 911  <li><a href="http://people.skolelinux.org/pere/blog/tags/freedombox">freedombox (9)</a></li>
 912
 913  <li><a href="http://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (18)</a></li>
 914
 915  <li><a href="http://people.skolelinux.org/pere/blog/tags/h264">h264 (20)</a></li>
 916
 917  <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (42)</a></li>
 918
 919  <li><a href="http://people.skolelinux.org/pere/blog/tags/isenkram">isenkram (15)</a></li>
 920
 921  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (20)</a></li>
 922
 923  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (9)</a></li>
 924
 925  <li><a href="http://people.skolelinux.org/pere/blog/tags/lego">lego (4)</a></li>
 926
 927  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (8)</a></li>
 928
 929  <li><a href="http://people.skolelinux.org/pere/blog/tags/lsdvd">lsdvd (2)</a></li>
 930
 931  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 932
 933  <li><a href="http://people.skolelinux.org/pere/blog/tags/mesh network">mesh network (8)</a></li>
 934
 935  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (39)</a></li>
 936
 937  <li><a href="http://people.skolelinux.org/pere/blog/tags/nice free software">nice free software (9)</a></li>
 938
 939  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (297)</a></li>
 940
 941  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (190)</a></li>
 942
 943  <li><a href="http://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (33)</a></li>
 944
 945  <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
 946
 947  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (71)</a></li>
 948
 949  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (107)</a></li>
 950
 951  <li><a href="http://people.skolelinux.org/pere/blog/tags/raid">raid (2)</a></li>
 952
 953  <li><a href="http://people.skolelinux.org/pere/blog/tags/reactos">reactos (1)</a></li>
 954
 955  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
 956
 957  <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (3)</a></li>
 958
 959  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (10)</a></li>
 960
 961  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 962
 963  <li><a href="http://people.skolelinux.org/pere/blog/tags/ruter">ruter (6)</a></li>
 964
 965  <li><a href="http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (2)</a></li>
 966
 967  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (53)</a></li>
 968
 969  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (4)</a></li>
 970
 971  <li><a href="http://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (5)</a></li>
 972
 973  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (55)</a></li>
 974
 975  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (6)</a></li>
 976
 977  <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (12)</a></li>
 978
 979  <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (55)</a></li>
 980
 981  <li><a href="http://people.skolelinux.org/pere/blog/tags/sysadmin">sysadmin (4)</a></li>
 982
 983  <li><a href="http://people.skolelinux.org/pere/blog/tags/usenix">usenix (2)</a></li>
 984
 985  <li><a href="http://people.skolelinux.org/pere/blog/tags/valg">valg (9)</a></li>
 986
 987  <li><a href="http://people.skolelinux.org/pere/blog/tags/verkidetfri">verkidetfri (11)</a></li>
 988
 989  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (62)</a></li>
 990
 991  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (4)</a></li>
 992
 993  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (40)</a></li>
 994
 995 </ul>
 996
 997
 998     </div>
 999     <p style="text-align: right">
1000  Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v4.6</a>
1001 </p>
1002
1003   </body>
1004 </html>