blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Broken_umask_handling_with_sshfs.html">Broken umask handling with sshfs</a></div>
  24   <div class="date">2010-08-26 13:30</div>
  25   <div class="body">
  26 <p>My file system sematics program
  27 <a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">presented
  28 a few days ago</a> is very useful to verify that a file system can
  29 work as a unix home directory,and today I had to extend it a bit.  I'm
  30 looking into alternatives for home directory access here at the
  31 University of Oslo, and one of the options is sshfs.  My friend
  32 Finn-Arne mentioned a while back that they had used sshfs with Debian
  33 Edu, but stopped because of problems.  I asked today what the problems
  34 where, and he mentioned that sshfs failed to handle umask properly.
  35 Trying to detect the problem I wrote this addition to my fs testing
  36 script:</p>
  37
  38 <pre>
  39 mode_t touch_get_mode(const char *name, mode_t mode) {
  40   mode_t retval = 0;
  41   int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, mode);
  42   if (-1 != fd) {
  43     unlink(name);
  44     struct stat statbuf;
  45     if (-1 != fstat(fd, &statbuf)) {
  46       retval = statbuf.st_mode & 0x1ff;
  47     }
  48     close(fd);
  49   }
  50   return retval;
  51 }
  52
  53 /* Try to detect problem discovered using sshfs */
  54 int test_umask(void) {
  55   printf("info: testing umask effect on file creation\n");
  56
  57   mode_t orig_umask = umask(000);
  58   mode_t newmode;
  59   if (0666 != (newmode = touch_get_mode("foobar", 0666))) {
  60     printf("  error: Wrong file mode %o when creating using mode 666 and umask 000\n",
  61            newmode);
  62   }
  63   umask(007);
  64   if (0660 != (newmode = touch_get_mode("foobar", 0666))) {
  65     printf("  error: Wrong file mode %o when creating using mode 666 and umask 007\n",
  66            newmode);
  67   }
  68
  69   umask (orig_umask);
  70   return 0;
  71 }
  72
  73 int main(int argc, char **argv) {
  74   [...]
  75   test_umask();
  76   return 0;
  77 }
  78 </pre>
  79
  80 <p>Sure enough.  On NFS to a netapp, I get this result:</p>
  81
  82 <pre>
  83 Testing POSIX/Unix sematics on file system
  84 info: testing symlink creation
  85 info: testing subdirectory creation
  86 info: testing fcntl locking
  87   Read-locking 1 byte from 1073741824
  88   Read-locking 510 byte from 1073741826
  89   Unlocking 1 byte from 1073741824
  90   Write-locking 1 byte from 1073741824
  91   Write-locking 510 byte from 1073741826
  92   Unlocking 2 byte from 1073741824
  93 info: testing umask effect on file creation
  94 </pre>
  95
  96 <p>When mounting the same directory using sshfs, I get this
  97 result:</p>
  98
  99 <pre>
 100 Testing POSIX/Unix sematics on file system
 101 info: testing symlink creation
 102 info: testing subdirectory creation
 103 info: testing fcntl locking
 104   Read-locking 1 byte from 1073741824
 105   Read-locking 510 byte from 1073741826
 106   Unlocking 1 byte from 1073741824
 107   Write-locking 1 byte from 1073741824
 108   Write-locking 510 byte from 1073741826
 109   Unlocking 2 byte from 1073741824
 110 info: testing umask effect on file creation
 111   error: Wrong file mode 644 when creating using mode 666 and umask 000
 112   error: Wrong file mode 640 when creating using mode 666 and umask 007
 113 </pre>
 114
 115 <p>So, I can conclude that sshfs is better than smb to a Netapp or a
 116 Windows server, but not good enough to be used as a home
 117 directory.</p>
 118 </div>
 119   <div class="tags">
 120
 121
 122
 123    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 124
 125   </div>
 126  </div>
 127  <div class="padding"></div>
 128
 129  <div class="entry">
 130   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Elektronisk_stemmegiving_er_ikke_til____stole_p_____heller_ikke_i_Norge.html">Elektronisk stemmegiving er ikke til å stole på - heller ikke i Norge</a></div>
 131   <div class="date">2010-08-23 19:30</div>
 132   <div class="body">
 133 <p>I Norge pågår en prosess for å
 134 <a href="http://www.e-valg.dep.no/">innføre elektronisk
 135 stemmegiving</a> ved kommune- og stortingsvalg.  Dette skal
 136 introduseres i 2011.  Det er all grunn til å tro at valg i Norge ikke
 137 vil være til å stole på hvis dette blir gjennomført.  Da det hele var
 138 oppe til høring i 2006 forfattet jeg
 139 <a href="http://www.nuug.no/dokumenter/valg-horing-2006-09.pdf">en
 140 høringsuttalelse fra NUUG</a> (og EFN som hengte seg på) som skisserte
 141 hvilke punkter som må oppfylles for at en skal kunne stole på et valg,
 142 og elektronisk stemmegiving mangler flere av disse.  Elektronisk
 143 stemmegiving er for alle praktiske formål å putte ens stemme i en sort
 144 boks under andres kontroll, og satse på at de som har kontroll med
 145 boksen er til å stole på - uten at en har mulighet til å verifisere
 146 dette selv.  Det er ikke slik en gjennomfører demokratiske valg.</p>
 147
 148 <p>Da problemet er fundamentalt med hvordan elektronisk stemmegiving
 149 må fungere for at også ikke-krypografer skal kunne delta, har det vært
 150 mange rapporter om hvordan elektronisk stemmegiving har sviktet i land
 151 etter land.  En
 152 <a href="http://wiki.nuug.no/uttalelser/2006-elektronisk-stemmegiving">liten
 153 samling referanser</a> finnes på NUUGs wiki.  Den siste er fra India,
 154 der valgkomisjonen har valgt
 155 <a href="http://www.freedom-to-tinker.com/blog/jhalderm/electronic-voting-researcher-arrested-over-anonymous-source">å
 156 pusse politiet på en forsker</a> som har dokumentert svakheter i
 157 valgsystemet.</p>
 158
 159 <p>Her i Norge har en valgt en annen tilnærming, der en forsøker seg
 160 med teknobabbel for å få befolkningen til å tro at dette skal bli
 161 sikkert.  Husk, elektronisk stemmegiving underminerer de demokratiske
 162 valgene i Norge, og bør ikke innføres.</p>
 163
 164 <p>Den offentlige diskusjonen blir litt vanskelig av at media har
 165 valgt å kalle dette "evalg", som kan sies å både gjelde elektronisk
 166 opptelling av valget som Norge har gjort siden 60-tallet og som er en
 167 svært god ide, og elektronisk opptelling som er en svært dårlig ide.
 168 Diskusjonen gir ikke mening hvis en skal diskutere om en er for eller
 169 mot "evalg", og jeg forsøker derfor å være klar på at jeg snakker om
 170 elektronisk stemmegiving og unngå begrepet "evalg".</p>
 171 </div>
 172   <div class="tags">
 173
 174
 175
 176    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 177
 178   </div>
 179  </div>
 180  <div class="padding"></div>
 181
 182  <div class="entry">
 183   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Robot__reis_deg___.html">Robot, reis deg...</a></div>
 184   <div class="date">2010-08-21 22:10</div>
 185   <div class="body">
 186 <p>I dag fikk jeg endelig tittet litt på mine nyinnkjøpte roboter, og
 187 har brukt noen timer til å google etter interessante referanser og
 188 aktuell kildekode for bruk på Linux.  Det mest lovende så langt er
 189 <a href="http://ispykee.toyz.org/">ispykee</a>, som har en
 190 BSD-lisensiert linux-daemon som står som mellomledd mellom roboter på
 191 lokalnettet og en sentral tjeneste der en iPhone kan koble seg opp for
 192 å fjernstyre roboten.  Linux-daemonen implementerer deler av
 193 protokollen som roboten forstår.  Etter å ha knotet litt med å oppnå
 194 kontakt med roboten (den oppretter et eget ad-hoc wifi-nett, så jeg
 195 måtte gå av mitt vanlige nett for å få kontakt), og kommet frem til at
 196 den lytter på IP-port 9000 og 9001, gikk jeg i gang med å finne ut
 197 hvordan jeg kunne snakke med roboten vha. disse portene.  Robotbiten
 198 av protokollen er publisert av produsenten med GPL-lisens, slik at det
 199 er mulig å se hvordan protokollen fungerer.  Det finnes en java-klient
 200 for Android som så ganske snasen ut, men fant ingen kildekode for
 201 denne.  Derimot hadde iphone-løsningen kildekode, så jeg tok
 202 utgangspunkt i den.</p>
 203
 204 <p>Daemonen ville i utgangspunktet forsøke å kontakte den sentrale
 205 tjenesten som iphone-programmet kobler seg til.  Jeg skrev dette om
 206 til i stedet å sette opp en nettverkstjeneste på min lokale maskin,
 207 som jeg kan koble meg opp til med telnet og gi kommandoer til roboten
 208 (act, forward, right, left, etc).  Det involverte i praksis å bytte ut
 209 socket()/connect() med socket()/bind()/listen()/accept() for å gjøre
 210 klienten om til en tjener.</p>
 211
 212 <p>Mens jeg har forsøkt å få roboten til å bevege seg har min samboer
 213 skrudd sammen resten av roboten for å få montert kamera og plastpynten
 214 (armer, plastfiber for lys).  Nå er det hele montert, og roboten er
 215 klar til bruk.  Må få flyttet den over til mitt vanlige trådløsnett
 216 før det blir praktisk, men de bitene av protokollen er ikke
 217 implementert i ispykee-daemonen, så der må jeg enten få tak i en mac
 218 eller en windows-maskin, eller implementere det selv.</p>
 219
 220 <p>Vi var tre som kjøpte slike roboter, og vi har blitt enige om å
 221 samle notater og referanser på <a
 222 href="http://wiki.nuug.no/grupper/robot/">NUUGs wiki</a>.  Ta en titt
 223 der hvis du er nysgjerrig.</p>
 224 </div>
 225   <div class="tags">
 226
 227
 228
 229    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/robot">robot</a>.
 230
 231   </div>
 232  </div>
 233  <div class="padding"></div>
 234
 235  <div class="entry">
 236   <div class="title"><a href="http://people.skolelinux.org/pere/blog/2_Spykee_roboter_i_hus__n___skal_det_lekes.html">2 Spykee-roboter i hus, nå skal det lekes</a></div>
 237   <div class="date">2010-08-18 13:30</div>
 238   <div class="body">
 239 <p>Jeg kjøpte nettopp to
 240 <a href="http://www.spykee-robot.com/">Spykee</a>-roboter, for test og
 241 leking.  Kjøpte to da det var så billige, og gir meg mulighet til å
 242 eksperimentere uten å være veldig redd for å ødelegge alt ved å bytte
 243 ut firmware og slikt.  Oppdaget at lekebutikken på Bryn senter hadde
 244 en liten stabel på lager som de ikke hadde klart å selge ut etter
 245 fjorårets juleinnkjøp, og var villig til å selge for en femtedel av
 246 vanlig pris.  Jeg, Ronny og Jarle har skaffet oss restbeholdningen, og
 247 det blir morsomt å se hva vi får ut av dette.</p>
 248
 249 <p>Roboten har belter styrt av to motorer, kamera, høytaler, mikrofon
 250 og wifi-tilkobling.  Det hele styrt av en GPL-lisensiert databoks som
 251 jeg mistenker kjører linux.  Firmware-kildekoden ble visst publisert i
 252 mai.  Eneste utfordringen er at kontroller-programvaren kun finnes til
 253 Windows, men det må en kunne jobbe seg rundt når vi har kildekoden til
 254 firmwaren. :)</p>
 255
 256 <ul>
 257 <li><a href="http://en.wikipedia.org/wiki/Spykee">Wikipedia-oppføring</a></li>
 258 <li><a href=http://www.spykeeworld.com/spykee/US/freeSoftware.html">Nedlasting av firmware-kilden</a></li>
 259 <li><a href="http://wiki.nuug.no/grupper/robot">prosjektwiki hos NUUG</a></li>
 260 </ul>
 261 </div>
 262   <div class="tags">
 263
 264
 265
 266    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/robot">robot</a>.
 267
 268   </div>
 269  </div>
 270  <div class="padding"></div>
 271
 272  <div class="entry">
 273   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Rob_Weir__How_to_Crush_Dissent.html">Rob Weir: How to Crush Dissent</a></div>
 274   <div class="date">2010-08-15 22:20</div>
 275   <div class="body">
 276 <p>I found the notes from Rob Weir on
 277 <a href="http://feedproxy.google.com/~r/robweir/antic-atom/~3/VGb23-kta8c/how-to-crush-dissent.html">how
 278 to crush dissent</a> matching my own thoughts on the matter quite
 279 well.  Highly recommended for those wondering which road our society
 280 should go down.  In my view we have been heading the wrong way for a
 281 long time.</p>
 282 </div>
 283   <div class="tags">
 284
 285
 286
 287    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 288
 289   </div>
 290  </div>
 291  <div class="padding"></div>
 292
 293  <div class="entry">
 294   <div class="title"><a href="http://people.skolelinux.org/pere/blog/No_hardcoded_config_on_Debian_Edu_clients.html">No hardcoded config on Debian Edu clients</a></div>
 295   <div class="date">2010-08-09 20:15</div>
 296   <div class="body">
 297 <p>As reported earlier, the last few days I have looked at how Debian
 298 Edu clients are configured, and tried to get rid of all hardcoded
 299 configuration settings on the clients.  I believe the work to be
 300 mostly done, and the clients seem to work just fine with dynamically
 301 generated configuration.</p>
 302
 303 <p>What is the point, you might ask?  The point is to allow a Debian
 304 Edu desktop to integrate into an existing network infrastructure
 305 without any manual configuration.</p>
 306
 307 <p>This is what happens when installing a Debian Edu client here at
 308 the University of Oslo using PXE.  With the PXE installation, I am
 309 asked for language (Norwegian Bokmål), locality (Norway) and keyboard
 310 layout (no-latin1), Debian Edu profile (Roaming Workstation), if I
 311 accept to reformat the hard drive (yes), if I want to submit info to
 312 popcon.debian.org (no) and root password (secret).  After answering
 313 these questions, the installer goes ahead and does its thing, and
 314 after around 50 minutes it is done.  I press enter to finish the
 315 installation, and the machine reboots into KDE.  When the machine is
 316 ready and kdm asks for login information, I enter my university
 317 username and password, am told by kdm that a local home directory has
 318 been created and that I must log in again, and finally log in with the
 319 same username and password to the KDE 4.4 desktop.  At no point during
 320 this process did it ask for university specific settings, and all the
 321 required configuration was dynamically detected using information
 322 fetched via DHCP and DNS.  The roaming workstation is now ready for
 323 use.</p>
 324
 325 <p>How was this done, you might wonder?  First of all, here is the
 326 list of things that need to be configured on the client to get it
 327 working properly out of the box:</p>
 328
 329 <ul>
 330 <li>IP address/netmask and DNS server.</li>
 331 <li>Web proxy URL.</li>
 332 <li>LDAP server for NSS directory information (user, group, etc).</li>
 333 <li>Kerberos server for PAM password checking.</li>
 334 <li>SMB mount point to access the network home directory. (*)</li>
 335 <li>Central syslog server to send syslog messages to. (*)</li>
 336 <li>Sitesummary collector URL to submit info to central server. (*)</li>
 337 </ul>
 338
 339 <p>(Hm, did I forget anything?  Let me knew if I did.)</p>
 340
 341 <p>The points marked (*) are not required to be able to use the
 342 machine, but needed to provide central storage and allowing system
 343 administrators to track their machines.  Since yesterday, everything
 344 but the sitesummary collector URL is dynamically discovered at boot
 345 and installation time in the svn version of Debian Edu.</p>
 346
 347 <p>The IP and DNS setup is fetched during boot using DHCP as usual.
 348 When a DHCP update arrives, the proxy setup is updated by looking for
 349 http://wpat/wpad.dat and using the content of this WPAD file to
 350 configure the http and ftp proxy in /etc/environment and
 351 /etc/apt/apt.conf.  I decided to update the proxy setup using a DHCP
 352 hook to ensure that the client stops using the Debian Edu proxy when
 353 it is moved outside the Debian Edu network, and instead uses any local
 354 proxy present on the new network when it moves around.</p>
 355
 356 <p>The DNS names of the LDAP, Kerberos and syslog server and related
 357 configuration are generated using DNS information at boot.  First the
 358 installer looks for a host named ldap in the current DNS domain.  If
 359 not found, it looks for _ldap._tcp SRV records in DNS instead.  If an
 360 LDAP server is found, its root DSE entry is requested and the
 361 attributes namingContexts and defaultNamingContext are used to
 362 determine which LDAP base to use for NSS.  If there are several
 363 namingContexts attibutes and the defaultNamingContext is present, that
 364 LDAP subtree is used as the base.  If defaultNamingContext is missing,
 365 the subtrees listed as namingContexts are searched in sequence for any
 366 object with class posixAccount or posixGroup, and the first one with
 367 such an object is used as the LDAP base.  For Kerberos, a similar
 368 search is done by first looking for a host named kerberos, and then
 369 for the _kerberos._tcp SRV record.  I've been unable to find a way to
 370 look up the Kerberos realm, so for this the upper case string of the
 371 current DNS domain is used.</p>
 372
 373 <p>For the syslog server, the hosts syslog and loghost are searched
 374 for, and the _syslog._udp SRV record is consulted if no such host is
 375 found.  This algorithm works for both Debian Edu and the University of
 376 Oslo.  A similar strategy would work for locating the sitesummary
 377 server, but have not been implemented yet.  I decided to fetch and
 378 save these settings during installation, to make sure moving to a
 379 different network does not change the set of users being allowed to
 380 log in nor the passwords required to log in.  Usernames and passwords
 381 will be cached by sssd when the user logs in on the Debian Edu
 382 network, and will not change as the laptop move around.  For a
 383 non-roaming machine, there is no caching, but given that it is
 384 supposed to stay in place it should not matter much.  Perhaps we
 385 should switch those to use sssd too?</p>
 386
 387 <p>The user's SMB mount point for the network home directory is
 388 located when the user logs in for the first time.  The LDAP server is
 389 consulted to look for the user's LDAP object and the sambaHomePath
 390 attribute is used if found.  If it isn't found, the home directory
 391 path fetched from NSS is used instead.  Assuming the path is of the
 392 form /site/server/directory/username, the second part is looked up in
 393 DNS and used to generate a SMB URL of the form
 394 smb://server.domain/username.  This algorithm works for both Debian
 395 edu and the University of Oslo.  Perhaps there are better attributes
 396 to use or a better algorithm that works for more sites, but this will
 397 do for now. :)</p>
 398
 399 <p>This work should make it easier to integrate the Debian Edu clients
 400 into any LDAP/Kerberos infrastructure, and make the current setup even
 401 more flexible than before.  I suspect it will also work for thin
 402 client servers, allowing one to easily set up LTSP and hook it into a
 403 existing network infrastructure, but I have not had time to test this
 404 yet.</p>
 405
 406 <p>If you want to help out with implementing these things for Debian
 407 Edu, please contact us on debian-edu@lists.debian.org.</p>
 408
 409 <p>Update 2010-08-09: Simon Farnsworth gave me a heads-up on how to
 410 detect Kerberos realm from DNS, by looking for _kerberos TXT entries
 411 before falling back to the upper case DNS domain name.  Will have to
 412 implement it for Debian Edu. :)</p>
 413 </div>
 414   <div class="tags">
 415
 416
 417
 418    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 419
 420   </div>
 421  </div>
 422  <div class="padding"></div>
 423
 424  <div class="entry">
 425   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">Testing if a file system can be used for home directories...</a></div>
 426   <div class="date">2010-08-08 21:20</div>
 427   <div class="body">
 428 <p>A few years ago, I was involved in a project planning to use
 429 Windows file servers as home directory servers for Debian
 430 Edu/Skolelinux machines.  This was thought to be no problem, as the
 431 access would be through the SMB network file system protocol, and we
 432 knew other sites used SMB with unix and samba as the file server to
 433 mount home directories without any problems.  But, after months of
 434 struggling, we had to conclude that our goal was impossible.</p>
 435
 436 <p>The reason is simply that while SMB can be used for home
 437 directories when the file server is Samba running on Unix, this only
 438 work because of Samba have some extensions and the fact that the
 439 underlying file system is a unix file system.  When using a Windows
 440 file server, the underlying file system do not have POSIX semantics,
 441 and several programs will fail if the users home directory where they
 442 want to store their configuration lack POSIX semantics.</p>
 443
 444 <p>As part of this work, I wrote a small C program I want to share
 445 with you all, to replicate a few of the problematic applications (like
 446 OpenOffice.org and GCompris) and see if the file system was working as
 447 it should.  If you find yourself in spooky file system land, it might
 448 help you find your way out again.  This is the fs-test.c source:</p>
 449
 450 <pre>
 451 /*
 452  * Some tests to check the file system sematics.  Used to verify that
 453  * CIFS from a windows server do not work properly as a linux home
 454  * directory.
 455  * License: GPL v2 or later
 456  *
 457  * needs libsqlite3-dev and build-essential installed
 458  * compile with: gcc -Wall -lsqlite3 -DTEST_SQLITE fs-test.c -o fs-test
 459 */
 460
 461 #define _FILE_OFFSET_BITS 64
 462 #define _LARGEFILE_SOURCE 1
 463 #define _LARGEFILE64_SOURCE 1
 464
 465 #define _GNU_SOURCE /* for asprintf() */
 466
 467 #include &lt;errno.h>
 468 #include &lt;fcntl.h>
 469 #include &lt;stdio.h>
 470 #include &lt;string.h>
 471 #include &lt;stdlib.h>
 472 #include &lt;sys/file.h>
 473 #include &lt;sys/stat.h>
 474 #include &lt;sys/types.h>
 475 #include &lt;unistd.h>
 476
 477 #ifdef TEST_SQLITE
 478 /*
 479  * Test sqlite open, as done by gcompris require the libsqlite3-dev
 480  * package and linking with -lsqlite3.  A more low level test is
 481  * below.
 482  * See also &lt;URL: http://www.sqlite.org./faq.html#q5 >.
 483  */
 484 #include &lt;sqlite3.h>
 485 #define CREATE_TABLE_USERS                                              \
 486   "CREATE TABLE users (user_id INT UNIQUE, login TEXT, lastname TEXT, firstname TEXT, birthdate TEXT, class_id INT ); "
 487 int test_sqlite_open(void) {
 488   char *zErrMsg;
 489   char *name = "testsqlite.db";
 490   sqlite3 *db=NULL;
 491   unlink(name);
 492   int rc = sqlite3_open(name, &db);
 493   if( rc ){
 494     printf("error: sqlite open of %s failed: %s\n", name, sqlite3_errmsg(db));
 495     sqlite3_close(db);
 496     return -1;
 497   }
 498
 499   /* create tables */
 500   rc = sqlite3_exec(db,CREATE_TABLE_USERS, NULL,  0, &zErrMsg);
 501   if( rc != SQLITE_OK ){
 502     printf("error: sqlite table create failed: %s\n", zErrMsg);
 503     sqlite3_close(db);
 504     return -1;
 505   }
 506   printf("info: sqlite worked\n");
 507   sqlite3_close(db);
 508   return 0;
 509 }
 510 #endif /* TEST_SQLITE */
 511
 512 /*
 513  * Demonstrate locking issue found in gcompris using sqlite3.  This
 514  * work with ext3, but not with cifs server on Windows 2003.  This is
 515  * done in the sqlite3 library.
 516  * See also
 517  * &lt;URL:http://www.cygwin.com/ml/cygwin/2001-08/msg00854.html> and the
 518  * POSIX specification
 519  * &lt;URL:http://www.opengroup.org/onlinepubs/009695399/functions/fcntl.html>.
 520  */
 521 int test_gcompris_locking(void) {
 522   struct flock fl;
 523   char *name = "testsqlite.db";
 524   unlink(name);
 525   int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, 0644);
 526   printf("info: testing fcntl locking\n");
 527
 528   fl.l_whence = SEEK_SET;
 529   fl.l_pid    = getpid();
 530   printf("  Read-locking 1 byte from 1073741824");
 531   fl.l_start  = 1073741824;
 532   fl.l_len    = 1;
 533   fl.l_type   = F_RDLCK;
 534   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 535
 536   printf("  Read-locking 510 byte from 1073741826");
 537   fl.l_start  = 1073741826;
 538   fl.l_len    = 510;
 539   fl.l_type   = F_RDLCK;
 540   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 541
 542   printf("  Unlocking 1 byte from 1073741824");
 543   fl.l_start  = 1073741824;
 544   fl.l_len    = 1;
 545   fl.l_type   = F_UNLCK;
 546   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 547
 548   printf("  Write-locking 1 byte from 1073741824");
 549   fl.l_start  = 1073741824;
 550   fl.l_len    = 1;
 551   fl.l_type   = F_WRLCK;
 552   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 553
 554   printf("  Write-locking 510 byte from 1073741826");
 555   fl.l_start  = 1073741826;
 556   fl.l_len    = 510;
 557   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 558
 559   printf("  Unlocking 2 byte from 1073741824");
 560   fl.l_start  = 1073741824;
 561   fl.l_len    = 2;
 562   fl.l_type   = F_UNLCK;
 563   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 564
 565   close(fd);
 566   return 0;
 567 }
 568
 569 /*
 570  * Test if permissions of freshly created directories allow entries
 571  * below them.  This was a problem with OpenOffice.org and gcompris.
 572  * Mounting with option 'sync' seem to solve this problem while
 573  * slowing down file operations.
 574  */
 575 int test_subdirectory_creation(void) {
 576 #define LEVELS 5
 577   char *path = strdup("test");
 578   char *dirs[LEVELS];
 579   int level;
 580   printf("info: testing subdirectory creation\n");
 581   for (level = 0; level &lt; LEVELS; level++) {
 582     char *newpath = NULL;
 583     if (-1 == mkdir(path, 0777)) {
 584       printf("  error: Unable to create directory '%s': %s\n",
 585              path, strerror(errno));
 586       break;
 587     }
 588     asprintf(&newpath, "%s/%s", path, "test");
 589     free(path);
 590     path = newpath;
 591   }
 592   return 0;
 593 }
 594
 595 /*
 596  * Test if symlinks can be created.  This was a problem detected with
 597  * KDE.
 598  */
 599 int test_symlinks(void) {
 600   printf("info: testing symlink creation\n");
 601   unlink("symlink");
 602   if (-1 == symlink("file", "symlink"))
 603     printf("  error: Unable to create symlink\n");
 604   return 0;
 605 }
 606
 607 int main(int argc, char **argv) {
 608   printf("Testing POSIX/Unix sematics on file system\n");
 609   test_symlinks();
 610   test_subdirectory_creation();
 611 #ifdef TEST_SQLITE
 612   test_sqlite_open();
 613 #endif /* TEST_SQLITE */
 614   test_gcompris_locking();
 615   return 0;
 616 }
 617 </pre>
 618
 619 <p>When everything is working, it should print something like
 620 this:</p>
 621
 622 <pre>
 623 Testing POSIX/Unix sematics on file system
 624 info: testing symlink creation
 625 info: testing subdirectory creation
 626 info: sqlite worked
 627 info: testing fcntl locking
 628   Read-locking 1 byte from 1073741824
 629   Read-locking 510 byte from 1073741826
 630   Unlocking 1 byte from 1073741824
 631   Write-locking 1 byte from 1073741824
 632   Write-locking 510 byte from 1073741826
 633   Unlocking 2 byte from 1073741824
 634 </pre>
 635
 636 <p>I do not remember the exact details of the problems we saw, but one
 637 of them was with locking, where if I remember correctly, POSIX allow a
 638 read-only lock to be upgraded to a read-write lock without unlocking
 639 the read-only lock (while Windows do not).  Another was a bug in the
 640 CIFS/SMB client implementation in the Linux kernel where directory
 641 meta information would be wrong for a fraction of a second, making
 642 OpenOffice.org fail to create its deep directory tree because it was
 643 not allowed to create files in its freshly created directory.</p>
 644
 645 <p>Anyway, here is a nice tool for your tool box, might you never need
 646 it. :)</p>
 647 </div>
 648   <div class="tags">
 649
 650
 651
 652    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 653
 654   </div>
 655  </div>
 656  <div class="padding"></div>
 657
 658  <div class="entry">
 659   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html">Autodetecting Client setup for roaming workstations in Debian Edu</a></div>
 660   <div class="date">2010-08-07 14:45</div>
 661   <div class="body">
 662 <p>A few days ago, I
 663 <a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">tried
 664 to install</a> a Roaming workation profile from Debian Edu/Squeeze
 665 while on the university network here at the University of Oslo, and
 666 noticed how much had to change to get it operational using the
 667 university infrastructure.  It was fairly easy, but it occured to me
 668 that Debian Edu would improve a lot if I could get the client to
 669 connect without any changes at all, and thus let the client configure
 670 itself during installation and first boot to use the infrastructure
 671 around it.  Now I am a huge step further along that road.</p>
 672
 673 <p>With our current squeeze-test packages, I can select the roaming
 674 workstation profile and get a working laptop connecting to the
 675 university LDAP server for user and group and our active directory
 676 servers for Kerberos authentication.  All this without any
 677 configuration at all during installation.  My users home directory got
 678 a bookmark in the KDE menu to mount it via SMB, with the correct URL.
 679 In short, openldap and sssd is correctly configured.  In addition to
 680 this, the client look for http://wpad/wpad.dat to configure a web
 681 proxy, and when it fail to find it no proxy settings are stored in
 682 /etc/environment and /etc/apt/apt.conf.  Iceweasel and KDE is
 683 configured to look for the same wpad configuration and also do not use
 684 a proxy when at the university network.  If the machine is moved to a
 685 network with such wpad setup, it would automatically use it when DHCP
 686 gave it a IP address.</p>
 687
 688 <p>The LDAP server is located using DNS, by first looking for the DNS
 689 entry ldap.$domain.  If this do not exist, it look for the
 690 _ldap._tcp.$domain SRV records and use the first one as the LDAP
 691 server.  Next, it connects to the LDAP server and search all
 692 namingContexts entries for posixAccount or posixGroup objects, and
 693 pick the first one as the LDAP base.  For Kerberos, a similar
 694 algorithm is used to locate the LDAP server, and the realm is the
 695 uppercase version of $domain.</p>
 696
 697 <p>So, what is not working, you might ask.  SMB mounting my home
 698 directory do not work.  No idea why, but suspected the incorrect
 699 Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
 700 the cause.  These are not properly configured during installation, and
 701 had to be hand-edited to get the correct Kerberos realm and server,
 702 but SMB mounting still do not work. :(</p>
 703
 704 <p>With this automatic configuration in place, I expect a Debian Edu
 705 roaming profile installation would be able to automatically detect and
 706 connect to any site using LDAP and Kerberos for NSS directory and PAM
 707 authentication.  It should also work out of the box in a Active
 708 Directory environment providing posixAccount and posixGroup objects
 709 with UID and GID values.</p>
 710
 711 <p>If you want to help out with implementing these things for Debian
 712 Edu, please contact us on debian-edu@lists.debian.org.</p>
 713 </div>
 714   <div class="tags">
 715
 716
 717
 718    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 719
 720   </div>
 721  </div>
 722  <div class="padding"></div>
 723
 724  <div class="entry">
 725   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">Debian Edu roaming workstation - at the university of Oslo</a></div>
 726   <div class="date">2010-08-03 23:30</div>
 727   <div class="body">
 728 <p>The new roaming workstation profile in Debian Edu/Squeeze is fairly
 729 similar to the laptop setup am I working on using Ubuntu for the
 730 University of Oslo, and just for the heck of it, I tested today how
 731 hard it would be to integrate that profile into the university
 732 infrastructure.  In this case, it is the university LDAP server,
 733 Active Directory Kerberos server and SMB mounting from the Netapp file
 734 servers.</p>
 735
 736 <p>I was pleasantly surprised that the only three files needed to be
 737 changed (/etc/sssd/sssd.conf, /etc/ldap.conf and
 738 /etc/mklocaluser.d/20-debian-edu-config) and one file had to be added
 739 (/usr/share/perl5/Debian/Edu_Local.pm), to get the client working.
 740 Most of the changes were to get the client to use the university LDAP
 741 for NSS and Kerberos server for PAM, but one was to change a hard
 742 coded DNS domain name in the mklocaluser hook from .intern to
 743 .uio.no.</p>
 744
 745 <p>This testing was so encouraging, that I went ahead and adjusted the
 746 Debian Edu scripts and setup in subversion to centralise the roaming
 747 workstation setup a bit more and avoid the hardcoded DNS domain name,
 748 so that when I test this tomorrow, I expect to get away with modifying
 749 only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the
 750 university servers.</p>
 751
 752 <p>My goal is to get the clients to have no hardcoded settings and
 753 fetch all their initial setup during installation and first boot, to
 754 allow them to be inserted also into environments where the default
 755 setup in Debian Edu has been changed or as with the university, where
 756 the environment is different but provides the protocols Debian Edu
 757 uses.</p>
 758 </div>
 759   <div class="tags">
 760
 761
 762
 763    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 764
 765   </div>
 766  </div>
 767  <div class="padding"></div>
 768
 769  <div class="entry">
 770   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html">Circular package dependencies harms apt recovery</a></div>
 771   <div class="date">2010-07-27 23:50</div>
 772   <div class="body">
 773 <p>I discovered this while doing
 774 <a href="http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html">automated
 775 testing of upgrades from Debian Lenny to Squeeze</a>.  A few packages
 776 in Debian still got circular dependencies, and it is often claimed
 777 that apt and aptitude should be able to handle this just fine, but
 778 some times these dependency loops causes apt to fail.</p>
 779
 780 <p>An example is from todays
 781 <a href="http://people.skolelinux.org/~pere/debian-upgrade-testing//test-20100727-lenny-squeeze-kde-aptitude.txt">upgrade
 782 of KDE using aptitude</a>.  In it, a bug in kdebase-workspace-data
 783 causes perl-modules to fail to upgrade.  The cause is simple.  If a
 784 package fail to unpack, then only part of packages with the circular
 785 dependency might end up being unpacked when unpacking aborts, and the
 786 ones already unpacked will fail to configure in the recovery phase
 787 because its dependencies are unavailable.</p>
 788
 789 <p>In this log, the problem manifest itself with this error:</p>
 790
 791 <blockquote><pre>
 792 dpkg: dependency problems prevent configuration of perl-modules:
 793  perl-modules depends on perl (>= 5.10.1-1); however:
 794   Version of perl on system is 5.10.0-19lenny2.
 795 dpkg: error processing perl-modules (--configure):
 796  dependency problems - leaving unconfigured
 797 </pre></blockquote>
 798
 799 <p>The perl/perl-modules circular dependency is already
 800 <a href="http://bugs.debian.org/527917">reported as a bug</a>, and will
 801 hopefully be solved as soon as possible, but it is not the only one,
 802 and each one of these loops in the dependency tree can cause similar
 803 failures.  Of course, they only occur when there are bugs in other
 804 packages causing the unpacking to fail, but it is rather nasty when
 805 the failure of one package causes the problem to become worse because
 806 of dependency loops.</p>
 807
 808 <p>Thanks to
 809 <a href="http://lists.debian.org/debian-devel/2010/06/msg00116.html">the
 810 tireless effort by Bill Allombert</a>, the number of circular
 811 dependencies
 812 <a href="http://debian.semistable.com/debgraph.out.html">left in Debian
 813 is dropping</a>, and perhaps it will reach zero one day. :)</p>
 814
 815 <p>Todays testing also exposed a bug in
 816 <a href="http://bugs.debian.org/590605">update-notifier</a> and
 817 <a href="http://bugs.debian.org/590604">different behaviour</a> between
 818 apt-get and aptitude, the latter possibly caused by some circular
 819 dependency.  Reported both to BTS to try to get someone to look at
 820 it.</p>
 821 </div>
 822   <div class="tags">
 823
 824
 825
 826    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 827
 828   </div>
 829  </div>
 830  <div class="padding"></div>
 831
 832  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
 833
 834 <div id="sidebar">
 835
 836
 837
 838
 839
 840 <h2>Archive</h2>
 841 <ul>
 842
 843 <li>2010
 844 <ul>
 845
 846 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 847
 848 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 849
 850 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 851
 852 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 853
 854 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 855
 856 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 857
 858 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
 859
 860 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (9)</a></li>
 861
 862 </ul></li>
 863
 864 <li>2009
 865 <ul>
 866
 867 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 868
 869 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 870
 871 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 872
 873 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 874
 875 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 876
 877 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 878
 879 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 880
 881 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 882
 883 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 884
 885 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 886
 887 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 888
 889 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 890
 891 </ul></li>
 892
 893 <li>2008
 894 <ul>
 895
 896 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 897
 898 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 899
 900 </ul></li>
 901
 902 </ul>
 903
 904
 905
 906 <h2>Tags</h2>
 907 <ul>
 908
 909  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 910
 911  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 912
 913  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 914
 915  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
 916
 917  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (35)</a></li>
 918
 919  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (41)</a></li>
 920
 921  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (57)</a></li>
 922
 923  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 924
 925  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (8)</a></li>
 926
 927  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (3)</a></li>
 928
 929  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
 930
 931  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (2)</a></li>
 932
 933  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 934
 935  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 936
 937  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (74)</a></li>
 938
 939  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (97)</a></li>
 940
 941  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (14)</a></li>
 942
 943  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (15)</a></li>
 944
 945  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 946
 947  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (2)</a></li>
 948
 949  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 950
 951  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (12)</a></li>
 952
 953  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
 954
 955  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
 956
 957  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 958
 959  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 960
 961  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 962
 963  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (7)</a></li>
 964
 965 </ul>
 966
 967 </div>
 968
 969 <p style="text-align: right">
 970 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.2</a>
 971 </p>
 972 </body>
 973 </html>