1 <?xml version=
"1.0" encoding=
"ISO-8859-1"?>
2 <rss version='
2.0' xmlns:lj='http://www.livejournal.org/rss/lj/
1.0/'
>
4 <title>Petter Reinholdtsen - Entries from July
2010</title>
5 <description>Entries from July
2010</description>
6 <link>http://people.skolelinux.org/pere/blog/
</link>
10 <title>Circular package dependencies harms apt recovery
</title>
11 <link>http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html
</link>
12 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html
</guid>
13 <pubDate>Tue,
27 Jul
2010 23:
50:
00 +
0200</pubDate>
14 <description><p
>I discovered this while doing
15 <a href=
"http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html
">automated
16 testing of upgrades from Debian Lenny to Squeeze
</a
>. A few packages
17 in Debian still got circular dependencies, and it is often claimed
18 that apt and aptitude should be able to handle this just fine, but
19 some times these dependency loops causes apt to fail.
</p
>
21 <p
>An example is from todays
22 <a href=
"http://people.skolelinux.org/~pere/debian-upgrade-testing//test-
20100727-lenny-squeeze-kde-aptitude.txt
">upgrade
23 of KDE using aptitude
</a
>. In it, a bug in kdebase-workspace-data
24 causes perl-modules to fail to upgrade. The cause is simple. If a
25 package fail to unpack, then only part of packages with the circular
26 dependency might end up being unpacked when unpacking aborts, and the
27 ones already unpacked will fail to configure in the recovery phase
28 because its dependencies are unavailable.
</p
>
30 <p
>In this log, the problem manifest itself with this error:
</p
>
32 <blockquote
><pre
>
33 dpkg: dependency problems prevent configuration of perl-modules:
34 perl-modules depends on perl (
>=
5.10.1-
1); however:
35 Version of perl on system is
5.10.0-
19lenny
2.
36 dpkg: error processing perl-modules (--configure):
37 dependency problems - leaving unconfigured
38 </pre
></blockquote
>
40 <p
>The perl/perl-modules circular dependency is already
41 <a href=
"http://bugs.debian.org/
527917">reported as a bug
</a
>, and will
42 hopefully be solved as soon as possible, but it is not the only one,
43 and each one of these loops in the dependency tree can cause similar
44 failures. Of course, they only occur when there are bugs in other
45 packages causing the unpacking to fail, but it is rather nasty when
46 the failure of one package causes the problem to become worse because
47 of dependency loops.
</p
>
50 <a href=
"http://lists.debian.org/debian-devel/
2010/
06/msg00116.html
">the
51 tireless effort by Bill Allombert
</a
>, the number of circular
53 <a href=
"http://debian.semistable.com/debgraph.out.html
">left in Debian
54 is dropping
</a
>, and perhaps it will reach zero one day. :)
</p
>
56 <p
>Todays testing also exposed a bug in
57 <a href=
"http://bugs.debian.org/
590605">update-notifier
</a
> and
58 <a href=
"http://bugs.debian.org/
590604">different behaviour
</a
> between
59 apt-get and aptitude, the latter possibly caused by some circular
60 dependency. Reported both to BTS to try to get someone to look at
66 <title>First Debian Edu test release (alpha0) based on Squeeze is released
</title>
67 <link>http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html
</link>
68 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html
</guid>
69 <pubDate>Tue,
27 Jul
2010 17:
45:
00 +
0200</pubDate>
70 <description><p
>I just posted this announcement culminating several months of work
71 with the next Debian Edu release. Not nearly done, but one major step
75 <p
>This is the first test release based on Squeeze. The focus of this
76 release is to test the user application selection. To have a look,
77 install the standalone profile and let the developers know if the set
78 of installed packages i.e. applications should be modified. If some
79 user application is missing, or if there are some applications that no
80 longer make sense to be included in Debian Edu, please let us know.
81 Also, if a useful application is missing the translation for your
82 language of choice, please let us know too.
</p
>
84 <p
>In addition, feedback and help to polish the desktop (menus,
85 artwork, starters, etc.) is appreciated. We would like to ship a nice
86 and handy KDE4 desktop targeted for schools out of the box.
</p
>
88 <p
>The other profiles should be installable, but there is a lot more
89 work left to be done before they are ready, so do not expect to
92 <p
>Changes compared to the lenny based version
</p
>
95 <li
>Everything from Debian Squeeze
97 <li
>Desktop environment KDE
4.4 =
> the new KDE desktop in
98 combination with some new artwork
99 <li
>Web browser Iceweasel
3.5
100 <li
>OpenOffice.org
3.2
101 <li
>Educational toolbox GCompris
9.3
102 <li
>Music creator Rosegarden
10.04.2
103 <li
>Image editor Gimp
2.6.10
104 <li
>Virtual universe Celestia
1.6.0
105 <li
>Virtual stargazer Stellarium
0.10.4
106 <li
>3D modeler Blender
2.49.2 (new application)
107 <li
>Video editor Kdenlive
0.7.7 (new application)
108 </ul
></li
>
109 <li
>Now using Kerberos for password checking (migration not finished).
115 <li
>SMTP (sender verification)
118 <li
>New experimental roaming workstation profile for laptops.
</li
>
119 <li
>Show welcome page to users when they first log in. The URL is
120 fetched from LDAP.
</li
>
121 <li
>New LXDE desktop option, in addition to KDE (default) and Gnome.
</li
>
122 <li
>General cleanup (not finished)
</li
>
124 <p
>The following features are not working as they should
</p
>
127 <li
>No web based administration tool for creating users and groups. The
128 scripts ldap-createuser-krb and ldap-add-user-to-group can be used
129 for testing.
</li
>
130 <li
>DVD installs are missing debian-installer images for the PXE boot,
131 and do not set up the PXE menu on eth0 because of this. LTSP
132 clients should still boot from eth1 on thin client servers.
</li
>
133 <li
>The restructured KDE menu is not implemented.
</li
>
134 <li
>The LDAP server setup need to be reviewed for security.
</li
>
135 <li
>The LDAP directory structure need to be reworked.
</li
>
136 <li
>Different sets of packages are installed when using the DVD and the
137 netinst CD. More packages are installed using the netinst CD.
</li
>
138 <li
>The jackd package fail to install. This is believed to be caused by
139 some ongoing transition, and hopefully should be solved soon. The
140 jackd1 package can be installed manually for those that need it.
</li
>
141 <li
>Some packages lack translations. See
142 http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status,
143 and help out with translations.
</li
>
146 <p
>To download this multiarch netinstall release you can use
</p
>
149 <li
><a href=
"ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-CD.iso
">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-CD.iso
</a
></li
>
150 <li
><a href=
"http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-CD.iso
">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-CD.iso
</a
></li
>
151 <li
>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-CD.iso
</li
>
153 <p
>To download this multiarch dvd release you can use
</p
>
156 <li
><a href=
"ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-DVD.iso
">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-DVD.iso
</a
></li
>
157 <li
><a href=
"http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-DVD.iso
">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-DVD.iso
</a
></li
>
158 <li
>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-
6.0.0+edua0-DVD.iso
</li
>
161 <p
>There is no source DVD available yet. It will be prepared when we
162 get closer to the final release.
</p
>
164 <p
>The MD5SUM of these images are
</p
>
167 <li
>3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-
6.0.0+edua0-CD.iso
</li
>
168 <li
>22f2cbfce281d1c6e478be452638675d debian-edu-
6.0.0+edua0-DVD.iso
</li
>
171 <p
>The SHA1SUM of these images are
</p
>
173 <li
>c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-
6.0.0+edua0-CD.iso
</li
>
174 <li
>2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-
6.0.0+edua0-DVD.iso
</li
>
176 <p
>How to report bugs:
177 http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla
</p
>
179 <p
>Please direct replies to debian-edu@lists.debian.org
</p
>
185 <title>One step closer to single signon in Debian Edu
</title>
186 <link>http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html
</link>
187 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html
</guid>
188 <pubDate>Sun,
25 Jul
2010 10:
00:
00 +
0200</pubDate>
189 <description><p
>The last few months me and the other Debian Edu developers have
190 been working hard to get the Debian/Squeeze based version of Debian
191 Edu/Skolelinux into shape. This future version will use Kerberos for
192 authentication, and services are slowly migrated to single signon,
193 getting rid of password questions one at the time.
</p
>
195 <p
>It will also feature a roaming workstation profile with local home
196 directory, for laptops that are only some times on the Skolelinux
197 network, and for this profile a shortcut is created in Gnome and KDE
198 to gain access to the users home directory on the file server. This
199 shortcut uses SMB at the moment, and yesterday I had time to test if
200 SMB mounting had started working in KDE after we added the cifs-utils
201 package. I was pleasantly surprised how well it worked.
</p
>
203 <p
>Thanks to the recent changes to our samba configuration to get it
204 to use Kerberos for authentication, there were no question about user
205 password when mounting the SMB volume. A simple click on the shortcut
206 in the KDE menu, and a window with the home directory popped
209 <p
>One step closer to a single signon solution out of the box in
210 Debian Edu. We already had PAM, LDAP, IMAP and SMTP in place, and now
211 also Samba. Next step is Cups and hopefully also NFS.
</p
>
213 <p
>We had planned a alpha0 release of Debian Edu for today, but thanks
214 to the autobuilder administrators for some architectures being slow to
215 sign packages, we are still missing the fixed LTSP package we need for
216 the release. It was uploaded three days ago with urgency=high, and if
217 it had entered testing yesterday we would have been able to test it in
218 time for a alpha0 release today. As the binaries for ia64 and powerpc
219 still not uploaded to the Debian archive, we need to delay the alpha
220 release another day.
</p
>
222 <p
>If you want to help out with implementing Kerberos for Debian Edu,
223 please contact us on debian-edu@lists.debian.org.
</p
>
228 <title>Digitale restriksjonsmekanismer fikk meg til å slutte å kjøpe musikk
</title>
229 <link>http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til___slutte___kj_pe_musikk.html
</link>
230 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til___slutte___kj_pe_musikk.html
</guid>
231 <pubDate>Thu,
22 Jul
2010 23:
50:
00 +
0200</pubDate>
232 <description><p
>For mange år siden slutte jeg å kjøpe musikk-CDer. Årsaken var at
233 musikkbransjen var godt i gang med å selge platene sine med DRM som
234 gjorde at jeg ikke fikk spilt av musikken jeg kjøpte på utstyret jeg
235 hadde tilgjengelig, dvs. min datamaskin. Det var umulig å se på en
236 plate om den var ødelagt eller ikke, og jeg hadde jo allerede en
237 anseelig samling med plater, så jeg bestemme meg for å slutte å gi
238 penger til en bransje som åpenbart ikke respekterte meg.
</p
>
240 <p
>Jeg har mange titalls dager med musikk på CD i dag. Det meste er
241 lagt i et stort arkiv som kan spilles av fra husets datamaskiner (har
242 ikke rukket rippe alt). Jeg ser dermed ikke behovet for å skaffe mer
243 musikk. De fleste av mine favoritter er i hus, og jeg er dermed godt
246 <p
>Hvis musikkbransjen ønsker mine penger, så må de demonstrere at de
247 setter pris på meg som kunde, og ikke skremme meg bort med DRM og
248 antydninger om at kundene er kriminelle.
</p
>
250 <p
>Filmbransjen er like ille, men mens musikk gjerne varer lenge, er
251 filmer mer ferskvare. Har dermed ikke helt sluttet å kjøpe filmer, men
252 holder meg til DVD-filmer som kan spilles av på mine Linuxbokser.
253 Kommer neppe til å ta i bruk Blueray, og ei heller de nye DRM-greiene
254 «Ultraviolet» som be annonsert her om dagen.
</p
>
259 <title>OpenStreetmap one step closer to having routing on its front page
</title>
260 <link>http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html
</link>
261 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html
</guid>
262 <pubDate>Sun,
18 Jul
2010 16:
45:
00 +
0200</pubDate>
263 <description><p
>Thanks to
264 <a href=
"http://feedproxy.google.com/~r/Opengeodata/~
3/wUTCzDZk3lc/project-of-the-week-which-way-home
">todays
265 opengeodata blog entry
</a
>, I just discovered that the
266 OpenStreetmap.org site have gotten
267 <a href=
"http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT
">support
268 for calculating routes
</a
>. The support is still experimental and
269 only available from the development server, until more experience is
270 gathered on the user interface and any scalability issues.
</p
>
272 <p
>Earlier, the routing I knew about using the OpenStreetmap.org data
273 was provided by
<a href=
"http://maps.cloudmade.com/
">Cloudmade
</a
>,
274 but having it on the main page is required to make everyone aware of
275 the issue. I
've had people reject Openstreetmap.org as a viable
276 alternative for them because the front page lacked routing support,
277 and I hope their needs will be catered for when routing show up on the
278 www.openstreetmap.org front page.
</p
>
283 <title>What are they searching for - PowerDNS and ISC DHCP in LDAP
</title>
284 <link>http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html
</link>
285 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html
</guid>
286 <pubDate>Sat,
17 Jul
2010 21:
00:
00 +
0200</pubDate>
287 <description><p
>This is a
288 <a href=
"http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html
">followup
</a
>
290 <a href=
"http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html
">previous
292 <a href=
"http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html
">merging
293 all
</a
> the computer related LDAP objects in Debian Edu.
</p
>
295 <p
>As a step to try to see if it possible to merge the DNS and DHCP
296 LDAP objects, I have had a look at how the packages pdns-backend-ldap
297 and dhcp3-server-ldap in Debian use the LDAP server. The two
298 implementations are quite different in how they use LDAP.
</p
>
300 To get this information, I started slapd with debugging enabled and
301 dumped the debug output to a file to get the LDAP searches performed
302 on a Debian Edu main-server. Here is a summary.
304 <p
><strong
>powerdns
</strong
></p
>
306 <a href=
"http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend
">Clues
307 on how to
</a
> set up PowerDNS to use a LDAP backend is available on
310 <p
>PowerDNS have two modes of operation using LDAP as its backend.
311 One
"strict
" mode where the forward and reverse DNS lookups are done
312 using the same LDAP objects, and a
"tree
" mode where the forward and
313 reverse entries are in two different subtrees in LDAP with a structure
314 based on the DNS names, as in tjener.intern and
315 2.2.0.10.in-addr.arpa.
</p
>
317 <p
>In tree mode, the server is set up to use a LDAP subtree as its
318 base, and uses a
"base
" scoped search for the DNS name by adding
319 "dc=tjener,dc=intern,
" to the base with a filter for
320 "(associateddomain=tjener.intern)
" for the forward entry and
321 "dc=
2,dc=
2,dc=
0,dc=
10,dc=in-addr,dc=arpa,
" with a filter for
322 "(associateddomain=
2.2.0.10.in-addr.arpa)
" for the reverse entry. For
323 forward entries, it is looking for attributes named dnsttl, arecord,
324 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
325 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
326 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
327 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
328 spfrecord and modifytimestamp. For reverse entries it is looking for
329 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
330 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
331 locrecord, srvrecord, naptrrecord and modifytimestamp. The equivalent
332 ldapsearch commands could look like this:
</p
>
334 <blockquote
><pre
>
336 -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
337 -s base -x
'(associateddomain=tjener.intern)
' dNSTTL aRecord nSRecord \
338 cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
339 rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
340 nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
341 rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
344 -b dc=
2,dc=
2,dc=
0,dc=
10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
345 -s base -x
'(associateddomain=
2.2.0.10.in-addr.arpa)
'
346 dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
347 hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
348 srvrecord naptrrecord modifytimestamp
349 </pre
></blockquote
>
351 <p
>In Debian Edu/Lenny, the PowerDNS tree mode is used with
352 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
353 example LDAP objects used there. In addition to these objects, the
354 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
355 also exist.
</p
>
357 <blockquote
><pre
>
358 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
360 objectclass: dnsdomain
361 objectclass: domainrelatedobject
364 associateddomain: tjener.intern
366 dn: dc=
2,dc=
2,dc=
0,dc=
10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
368 objectclass: dnsdomain2
369 objectclass: domainrelatedobject
371 ptrrecord: tjener.intern
372 associateddomain:
2.2.0.10.in-addr.arpa
373 </pre
></blockquote
>
375 <p
>In strict mode, the server behaves differently. When looking for
376 forward DNS entries, it is doing a
"subtree
" scoped search with the
377 same base as in the tree mode for a object with filter
378 "(associateddomain=tjener.intern)
" and requests the attributes dnsttl,
379 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
380 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
381 naptrrecord and modifytimestamp. For reverse entires it also do a
382 subtree scoped search but this time the filter is
"(arecord=
10.0.2.2)
"
383 and the requested attributes are associateddomain, dnsttl and
384 modifytimestamp. In short, in strict mode the objects with ptrrecord
385 go away, and the arecord attribute in the forward object is used
388 <p
>The forward and reverse searches can be simulated using ldapsearch
391 <blockquote
><pre
>
392 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
393 '(associateddomain=tjener.intern)
' dNSTTL aRecord nSRecord \
394 cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
395 rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
396 nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
397 rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
399 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
400 '(arecord=
10.0.2.2)
' associateddomain dnsttl modifytimestamp
401 </pre
></blockquote
>
403 <p
>In addition to the forward and reverse searches , there is also a
404 search for SOA records, which behave similar to the forward and
405 reverse lookups.
</p
>
407 <p
>A thing to note with the PowerDNS behaviour is that it do not
408 specify any objectclass names, and instead look for the attributes it
409 need to generate a DNS reply. This make it able to work with any
410 objectclass that provide the needed attributes.
</p
>
412 <p
>The attributes are normally provided in the cosine (RFC
1274) and
413 dnsdomain2 schemas. The latter is used for reverse entries like
414 ptrrecord and recent DNS additions like aaaarecord and srvrecord.
</p
>
416 <p
>In Debian Edu, we have created DNS objects using the object classes
417 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
418 attributes) and domainrelatedobject (for associatedDomain). The use
419 of structural object classes make it impossible to combine these
420 classes with the object classes used by DHCP.
</p
>
422 <p
>There are other schemas that could be used too, for example the
423 dnszone structural object class used by Gosa and bind-sdb for the DNS
424 attributes combined with the domainrelatedobject object class, but in
425 this case some unused attributes would have to be included as well
426 (zonename and relativedomainname).
</p
>
428 <p
>My proposal for Debian Edu would be to switch PowerDNS to strict
429 mode and not use any of the existing objectclasses (dnsdomain,
430 dnsdomain2 and dnszone) when one want to combine the DNS information
431 with DHCP information, and instead create a auxiliary object class
432 defined something like this (using the attributes defined for
433 dnsdomain and dnsdomain2 or dnszone):
</p
>
435 <blockquote
><pre
>
436 objectclass ( some-oid NAME
'dnsDomainAux
'
439 MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
440 DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
441 TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
442 NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
443 A6Record $ DNAMERecord
445 </pre
></blockquote
>
447 <p
>This will allow any object to become a DNS entry when combined with
448 the domainrelatedobject object class, and allow any entity to include
449 all the attributes PowerDNS wants. I
've sent an email to the PowerDNS
450 developers asking for their view on this schema and if they are
451 interested in providing such schema with PowerDNS, and I hope my
452 message will be accepted into their mailing list soon.
</p
>
454 <p
><strong
>ISC dhcp
</strong
></p
>
456 <p
>The DHCP server searches for specific objectclass and requests all
457 the object attributes, and then uses the attributes it want. This
458 make it harder to figure out exactly what attributes are used, but
459 thanks to the working example in Debian Edu I can at least get an idea
460 what is needed without having to read the source code.
</p
>
462 <p
>In the DHCP server configuration, the LDAP base to use and the
463 search filter to use to locate the correct dhcpServer entity is
464 stored. These are the relevant entries from
465 /etc/dhcp3/dhcpd.conf:
</p
>
467 <blockquote
><pre
>
468 ldap-base-dn
"dc=skole,dc=skolelinux,dc=no
";
469 ldap-dhcp-server-cn
"dhcp
";
470 </pre
></blockquote
>
472 <p
>The DHCP server uses this information to nest all the DHCP
473 configuration it need. The cn
"dhcp
" is located using the given LDAP
474 base and the filter
"(
&(objectClass=dhcpServer)(cn=dhcp))
". The
475 search result is this entry:
</p
>
477 <blockquote
><pre
>
478 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
481 objectClass: dhcpServer
482 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
483 </pre
></blockquote
>
485 <p
>The content of the dhcpServiceDN attribute is next used to locate the
486 subtree with DHCP configuration. The DHCP configuration subtree base
487 is located using a base scope search with base
"cn=DHCP
488 Config,dc=skole,dc=skolelinux,dc=no
" and filter
489 "(
&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))
".
490 The search result is this entry:
</p
>
492 <blockquote
><pre
>
493 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
496 objectClass: dhcpService
497 objectClass: dhcpOptions
498 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
499 dhcpStatements: ddns-update-style none
500 dhcpStatements: authoritative
501 dhcpOption: smtp-server code
69 = array of ip-address
502 dhcpOption: www-server code
72 = array of ip-address
503 dhcpOption: wpad-url code
252 = text
504 </pre
></blockquote
>
506 <p
>Next, the entire subtree is processed, one level at the time. When
507 all the DHCP configuration is loaded, it is ready to receive requests.
508 The subtree in Debian Edu contain objects with object classes
509 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
510 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost. These provide options
511 and information about netmasks, dynamic range etc. Leaving out the
512 details here because it is not relevant for the focus of my
513 investigation, which is to see if it is possible to merge dns and dhcp
514 related computer objects.
</p
>
516 <p
>When a DHCP request come in, LDAP is searched for the MAC address
517 of the client (
00:
00:
00:
00:
00:
00 in this example), using a subtree
518 scoped search with
"cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
" as
519 the base and
"(
&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
520 00:
00:
00:
00:
00:
00))
" as the filter. This is what a host object look
523 <blockquote
><pre
>
524 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
527 objectClass: dhcpHost
528 dhcpHWAddress: ethernet
00:
00:
00:
00:
00:
00
529 dhcpStatements: fixed-address hostname
530 </pre
></blockquote
>
532 <p
>There is less flexiblity in the way LDAP searches are done here.
533 The object classes need to have fixed names, and the configuration
534 need to be stored in a fairly specific LDAP structure. On the
535 positive side, the invidiual dhcpHost entires can be anywhere without
536 the DN pointed to by the dhcpServer entries. The latter should make
537 it possible to group all host entries in a subtree next to the
538 configuration entries, and this subtree can also be shared with the
539 DNS server if the schema proposed above is combined with the dhcpHost
540 structural object class.
542 <p
><strong
>Conclusion
</strong
></p
>
544 <p
>The PowerDNS implementation seem to be very flexible when it come
545 to which LDAP schemas to use. While its
"tree
" mode is rigid when it
546 come to the the LDAP structure, the
"strict
" mode is very flexible,
547 allowing DNS objects to be stored anywhere under the base cn specified
548 in the configuration.
</p
>
550 <p
>The DHCP implementation on the other hand is very inflexible, both
551 regarding which LDAP schemas to use and which LDAP structure to use.
552 I guess one could implement ones own schema, as long as the
553 objectclasses and attributes have the names used, but this do not
554 really help when the DHCP subtree need to have a fairly fixed
557 <p
>Based on the observed behaviour, I suspect a LDAP structure like
558 this might work for Debian Edu:
</p
>
560 <blockquote
><pre
>
562 cn=machine-info (dhcpService) - dhcpServiceDN points here
564 cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
565 cn=
10.0.2.0 (dhcpSubnet)
566 cn=group1 (dhcpGroup/dhcpOptions)
567 cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
568 cn=
192.168.0.0 (dhcpSubnet)
569 cn=group1 (dhcpGroup/dhcpOptions)
570 ou=machines - PowerDNS base points here
571 cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
572 </pre
></blockquote
>
574 <P
>This is not tested yet. If the DHCP server require the dhcpHost
575 entries to be in the dhcpGroup subtrees, the entries can be stored
576 there instead of a common machines subtree, and the PowerDNS base
577 would have to be moved one level up to the machine-info subtree.
</p
>
579 <p
>The combined object under the machines subtree would look something
582 <blockquote
><pre
>
583 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
586 objectClass: dhcpHost
587 objectclass: domainrelatedobject
588 objectclass: dnsDomainAux
589 associateddomain: hostname.intern
591 dhcpHWAddress: ethernet
00:
00:
00:
00:
00:
00
592 dhcpStatements: fixed-address hostname.intern
593 </pre
></blockquote
>
595 </p
>One could even add the LTSP configuration associated with a given
596 machine, as long as the required attributes are available in a
597 auxiliary object class.
</p
>
602 <title>Combining PowerDNS and ISC DHCP LDAP objects
</title>
603 <link>http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html
</link>
604 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html
</guid>
605 <pubDate>Wed,
14 Jul
2010 23:
45:
00 +
0200</pubDate>
606 <description><p
>For a while now, I have wanted to find a way to change the DNS and
607 DHCP services in Debian Edu to use the same LDAP objects for a given
608 computer, to avoid the possibility of having a inconsistent state for
609 a computer in LDAP (as in DHCP but no DNS entry or the other way
610 around) and make it easier to add computers to LDAP.
</p
>
612 <p
>I
've looked at how powerdns and dhcpd is using LDAP, and using this
613 information finally found a solution that seem to work.
</p
>
615 <p
>The old setup required three LDAP objects for a given computer.
616 One forward DNS entry, one reverse DNS entry and one DHCP entry. If
617 we switch powerdns to use its strict LDAP method (ldap-method=strict
618 in pdns-debian-edu.conf), the forward and reverse DNS entries are
619 merged into one while making it impossible to transfer the reverse map
620 to a slave DNS server.
</p
>
622 <p
>If we also replace the object class used to get the DNS related
623 attributes to one allowing these attributes to be combined with the
624 dhcphost object class, we can merge the DNS and DHCP entries into one.
625 I
've written such object class in the dnsdomainaux.schema file (need
626 proper OIDs, but that is a minor issue), and tested the setup. It
627 seem to work.
</p
>
629 <p
>With this test setup in place, we can get away with one LDAP object
630 for both DNS and DHCP, and even the LTSP configuration I suggested in
631 an earlier email. The combined LDAP object will look something like
634 <blockquote
><pre
>
635 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
637 objectClass: dhcphost
638 objectclass: domainrelatedobject
639 objectclass: dnsdomainaux
640 associateddomain: hostname.intern
642 dhcphwaddress: ethernet
00:
00:
00:
00:
00:
00
643 dhcpstatements: fixed-address hostname
645 </pre
></blockquote
>
647 <p
>The DNS server uses the associateddomain and arecord entries, while
648 the DHCP server uses the dhcphwaddress and dhcpstatements entries
649 before asking DNS to resolve the fixed-adddress. LTSP will use
650 dhcphwaddress or associateddomain and the ldapconfig* attributes.
</p
>
652 <p
>I am not yet sure if I can get the DHCP server to look for its
653 dhcphost in a different location, to allow us to put the objects
654 outside the
"DHCP Config
" subtree, but hope to figure out a way to do
655 that. If I can
't figure out a way to do that, we can still get rid of
656 the hosts subtree and move all its content into the DHCP Config tree
657 (which probably should be renamed to be more related to the new
658 content. I suspect cn=dnsdhcp,ou=services or something like that
659 might be a good place to put it.
</p
>
661 <p
>If you want to help out with implementing this for Debian Edu,
662 please contact us on debian-edu@lists.debian.org.
</p
>
667 <title>Idea for storing LTSP configuration in LDAP
</title>
668 <link>http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html
</link>
669 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html
</guid>
670 <pubDate>Sun,
11 Jul
2010 22:
00:
00 +
0200</pubDate>
671 <description><p
>Vagrant mentioned on IRC today that ltsp_config now support
672 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
673 clients, and that this can be used to fetch configuration from LDAP if
674 Debian Edu choose to store configuration there.
</p
>
676 <p
>Armed with this information, I got inspired and wrote a test module
677 to get configuration from LDAP. The idea is to look up the MAC
678 address of the client in LDAP, and look for attributes on the form
679 ltspconfigsetting=value, and use this to export SETTING=value to the
680 LTSP clients.
</p
>
682 <p
>The goal is to be able to store the LTSP configuration attributes
683 in a
"computer
" LDAP object used by both DNS and DHCP, and thus
684 allowing us to store all information about a computer in one place.
</p
>
686 <p
>This is a untested draft implementation, and I welcome feedback on
687 this approach. A real LDAP schema for the ltspClientAux objectclass
688 need to be written. Comments, suggestions, etc?
</p
>
690 <blockquote
><pre
>
691 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
693 # Fetch LTSP client settings from LDAP based on MAC address
695 # Uses ethernet address as stored in the dhcpHost objectclass using
696 # the dhcpHWAddress attribute or ethernet address stored in the
697 # ieee802Device objectclass with the macAddress attribute.
699 # This module is written to be schema agnostic, and only depend on the
700 # existence of attribute names.
702 # The LTSP configuration variables are saved directly using a
703 # ltspConfig prefix and uppercasing the rest of the attribute name.
704 # To set the SERVER variable, set the ltspConfigServer attribute.
706 # Some LDAP schema should be created with all the relevant
707 # configuration settings. Something like this should work:
709 # objectclass (
1.1.2.2 NAME
'ltspClientAux
'
712 # MAY ( ltspConfigServer $ ltsConfigSound $ ... )
714 LDAPSERVER=$(debian-edu-ldapserver)
715 if [
"$LDAPSERVER
" ] ; then
716 LDAPBASE=$(debian-edu-ldapserver -b)
717 for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk
'{print $
5}
'|sort -u) ; do
718 filter=
"(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))
"
719 ldapsearch -h
"$LDAPSERVER
" -b
"$LDAPBASE
" -v -x
"$filter
" | \
720 grep
'^ltspConfig
' | while read attr value ; do
721 # Remove prefix and convert to upper case
722 attr=$(echo $attr | sed
's/^ltspConfig//i
' | tr a-z A-Z)
723 # bass value on to clients
724 eval
"$attr=$value; export $attr
"
728 </pre
></blockquote
>
730 <p
>I
'm not sure this shell construction will work, because I suspect
731 the while block might end up in a subshell causing the variables set
732 there to not show up in ltsp-config, but if that is the case I am sure
733 the code can be restructured to make sure the variables are passed on.
734 I expect that can be solved with some testing. :)
</p
>
736 <p
>If you want to help out with implementing this for Debian Edu,
737 please contact us on debian-edu@lists.debian.org.
</p
>
739 <p
>Update
2010-
07-
17: I am aware of another effort to store LTSP
740 configuration in LDAP that was created around year
2000 by
741 <a href=
"http://www.pcxperience.com/thinclient/documentation/ldap.html
">PC
742 Xperience, Inc.,
2000</a
>. I found its
743 <a href=
"http://people.redhat.com/alikins/ltsp/ldap/
">files
</a
> on a
744 personal home page over at redhat.com.
</p
>
749 <title>jXplorer, a very nice LDAP GUI
</title>
750 <link>http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html
</link>
751 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html
</guid>
752 <pubDate>Fri,
9 Jul
2010 12:
55:
00 +
0200</pubDate>
753 <description><p
>Since
754 <a href=
"http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html
">my
755 last post
</a
> about available LDAP tools in Debian, I was told about a
756 LDAP GUI that is even better than luma. The java application
757 <a href=
"http://jxplorer.org/
">jXplorer
</a
> is claimed to be capable of
758 moving LDAP objects and subtrees using drag-and-drop, and can
759 authenticate using Kerberos. I have only tested the Kerberos
760 authentication, but do not have a LDAP setup allowing me to rewrite
761 LDAP with my test user yet. It is
762 <a href=
"http://packages.qa.debian.org/j/jxplorer.html
">available in
763 Debian
</a
> testing and unstable at the moment. The only problem I
764 have with it is how it handle errors. If something go wrong, its
765 non-intuitive behaviour require me to go through some query work list
766 and remove the failing query. Nothing big, but very annoying.
</p
>
771 <title>MS Word krøller det til for politiet?
</title>
772 <link>http://people.skolelinux.org/pere/blog/MS_Word_kr_ller_det_til_for_politiet_.html
</link>
773 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/MS_Word_kr_ller_det_til_for_politiet_.html
</guid>
774 <pubDate>Thu,
8 Jul
2010 14:
00:
00 +
0200</pubDate>
775 <description><p
>De siste dagene har Aftenposten
776 <a href=
"http://www.aftenposten.no/nyheter/iriks/article3718597.ece
">fortalt
</a
>
777 <a href=
"http://www.aftenposten.no/nyheter/iriks/article3724249.ece
">hvordan
</a
>
778 politet har brukt skriveverktøy som ikke håndterer arabisk tekst og
779 tekst som skal skrives fra høyre mot venstre når de har laget
780 løpeseddel for å be om informasjon fra publikum. Resultatet har vært
781 en uleselig arabisk-bit på løpeseddelen. Feilen har oppstått når
782 teksten har blitt
"kopiert inn i programvare som ikke har støtte for
783 språk som skrives fra høyre mot venstre
", og jeg er ganske sikker på
784 at det er snakk om Microsoft Office i dette tilfellet. Er det slik at
785 MS Office i norsk språkdrakt ikke har støtte for tekst som skal
786 skrives fra høyre mot venstre? Jeg tror alle utgaver av
787 OpenOffice.org har slik støtte, og det er jo ikke veldig vanskelig å
788 la slik støtte finnes i alle utgaver av et program hvis støtten først
789 er utviklet. Aftenpostens melding får meg til å undre om problemet
790 ville vært unngått hvis politiet brukte OpenOffice.org i stedet for MS
793 <p
>Mon tro om det er flere eksempler på at MS Office har ødelagt for
794 offentlig myndighet?
</p
>
799 <title>Lenny-
>Squeeze upgrades, apt vs aptitude with the Gnome desktop
</title>
800 <link>http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html
</link>
801 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html
</guid>
802 <pubDate>Sat,
3 Jul
2010 23:
55:
00 +
0200</pubDate>
803 <description><p
>Here is a short update on my
<a
804 href=
"http://people.skolelinux.org/~pere/debian-upgrade-testing/
">my
805 Debian Lenny-
>Squeeze upgrade testing
</a
>. Here is a summary of the
806 difference for Gnome when it is upgraded by apt-get and aptitude. I
'm
807 not reporting the status for KDE, because the upgrade crashes when
808 aptitude try because of missing conflicts
809 (
<a href=
"http://bugs.debian.org/
584861">#
584861</a
> and
810 <a href=
"http://bugs.debian.org/
585716">#
585716</a
>).
</p
>
812 <p
>At the end of the upgrade test script, dpkg -l is executed to get a
813 complete list of the installed packages. Based on this I see these
814 differences when I did a test run today. As usual, I do not really
815 know what the correct set of packages would be, but thought it best to
816 publish the difference.
</p
>
818 <p
>Installed using apt-get, missing with aptitude
</p
>
820 <blockquote
><p
>
821 at-spi cpp-
4.3 finger gnome-spell gstreamer0.10-gnomevfs
822 libatspi1.0-
0 libcupsys2 libeel2-data libgail-common libgdl-
1-common
823 libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin
824 libgtksourceview-common libpt-
1.10.10-plugins-alsa
825 libpt-
1.10.10-plugins-v4l libservlet2.4-java libxalan2-java
826 libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip
827 python-
4suite-xml python-eggtrayicon python-gtkhtml2
828 python-gtkmozembed svgalibg1 xserver-xephyr zip
829 </p
></blockquote
>
831 <p
>Installed using apt-get, removed with aptitude
</p
>
833 <blockquote
><p
>
834 bluez-utils dhcdbd djvulibre-desktop epiphany-gecko
835 gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager
836 libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-
50
837 libbluetooth2 libcamel1.2-
11 libcdio7 libcucul0 libcurl3
838 libdirectfb-
1.0-
0 libdvdread3 libedata-cal1.2-
6 libedataserver1.2-
9
839 libeel2-
2.20 libepc-
1.0-
1 libepc-ui-
1.0-
1 libexchange-storage1.2-
3
840 libfaad0 libgd2-noxpm libgda3-
3 libgda3-common libggz2 libggzcore9
841 libggzmod4 libgksu1.2-
0 libgksuui1.0-
1 libgmyth0 libgnome-desktop-
2
842 libgnome-pilot2 libgnomecups1.0-
1 libgnomeprint2.2-
0
843 libgnomeprintui2.2-
0 libgpod3 libgraphviz4 libgtkhtml2-
0
844 libgtksourceview1.0-
0 libgucharmap6 libhesiod0 libicu38 libisccc50
845 libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++
10
846 libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4
847 libneon27 libnm-glib0 libnm-util0 libopal-
2.2 libosp5
848 libparted1.8-
10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3
849 libpt-
1.10.10 libraw1394-
8 libsensors3 libsmbios2 libsoup2.2-
8
850 libssh2-
1 libsuitesparse-
3.1.0 libswfdec-
0.6-
90 libtalloc1
851 libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj
852 libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3
853 mysql-common swfdec-gnome totem-gstreamer wodim
854 </p
></blockquote
>
856 <p
>Installed using aptitude, missing with apt-get
</p
>
858 <blockquote
><p
>
859 gnome gnome-desktop-environment hamster-applet python-gnomeapplet
860 python-gnomekeyring python-wnck rhythmbox-plugins xorg
861 xserver-xorg-input-all xserver-xorg-input-evdev
862 xserver-xorg-input-kbd xserver-xorg-input-mouse
863 xserver-xorg-input-synaptics xserver-xorg-video-all
864 xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati
865 xserver-xorg-video-chips xserver-xorg-video-cirrus
866 xserver-xorg-video-dummy xserver-xorg-video-fbdev
867 xserver-xorg-video-glint xserver-xorg-video-i128
868 xserver-xorg-video-i740 xserver-xorg-video-mach64
869 xserver-xorg-video-mga xserver-xorg-video-neomagic
870 xserver-xorg-video-nouveau xserver-xorg-video-nv
871 xserver-xorg-video-r128 xserver-xorg-video-radeon
872 xserver-xorg-video-radeonhd xserver-xorg-video-rendition
873 xserver-xorg-video-s3 xserver-xorg-video-s3virge
874 xserver-xorg-video-savage xserver-xorg-video-siliconmotion
875 xserver-xorg-video-sis xserver-xorg-video-sisusb
876 xserver-xorg-video-tdfx xserver-xorg-video-tga
877 xserver-xorg-video-trident xserver-xorg-video-tseng
878 xserver-xorg-video-vesa xserver-xorg-video-vmware
879 xserver-xorg-video-voodoo
880 </p
></blockquote
>
882 <p
>Installed using aptitude, removed with apt-get
</p
>
884 <blockquote
><p
>
885 deskbar-applet xserver-xorg xserver-xorg-core
886 xserver-xorg-input-wacom xserver-xorg-video-intel
887 xserver-xorg-video-openchrome
888 </p
></blockquote
>
890 <p
>I was told on IRC that the xorg-xserver package was
891 <a href=
"http://git.debian.org/?p=pkg-xorg/xserver/xorg-server.git;a=commit;h=
9c8080d06c457932d3bfec021c69ac000aa60120
">changed
892 in git
</a
> today to try to get apt-get to not remove xorg completely.
893 No idea when it hits Squeeze, but when it does I hope it will reduce
894 the difference somewhat.
899 <title>Caching password, user and group on a roaming Debian laptop
</title>
900 <link>http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html
</link>
901 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html
</guid>
902 <pubDate>Thu,
1 Jul
2010 11:
40:
00 +
0200</pubDate>
903 <description><p
>For a laptop, centralized user directories and password checking is
904 a bit troubling. Laptops are typically used also when not connected
905 to the network, and it is vital for a user to be able to log in or
906 unlock the screen saver also when a central server is unavailable.
907 This is possible by caching passwords and directory information (user
908 and group attributes) locally, and the packages to do so are available
909 in Debian. Here follow two recipes to set this up in Debian/Squeeze.
910 It is also possible to set up in Debian/Lenny, but require more manual
911 setup there because pam-auth-update is missing in Lenny.
</p
>
913 <h2
>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir
</h2
>
915 This is the traditional method with a twist. The password caching is
916 provided by libpam-ccreds (version
10-
4 or later is needed on
917 Squeeze), and the directory caching is done by nscd. The directory
918 lookup and password checking is done using LDAP. If one want to use
919 Kerberos for password checking the libpam-ldapd package can be
920 replaced with libpam-krb5 or libpam-heimdal. If one is happy having a
921 local home directory with the path listed in LDAP, one can use the
922 pam_mkhomedir module from pam-modules to make this happen instead of
923 using libpam-mklocaluser. A setup for pam-auth-update to enable
924 pam_mkhomedir will have to be written until a fix for
925 <a href=
"http://bugs.debian.org/
568577">bug #
568577</a
> is in the
926 archive. Because I believe it is a bad idea to have local home
927 directories using misleading paths like /site/server/partition/, I
928 prefer to create a local user with the home directory in /home/. This
929 is done using the libpam-mklocaluser package.
</p
>
931 <p
>These packages need to be installed and configured
</p
>
933 <blockquote
><pre
>
934 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
935 </pre
></blockquote
>
937 <p
>The ldapd packages will ask for LDAP connection information, and
938 one have to fill in the values that fits ones own site. Make sure the
939 PAM part uses encrypted connections, to make sure the password is not
940 sent in clear text to the LDAP server. I
've been unable to get TLS
941 certificate checking for a self signed certificate working, which make
942 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
943 is talking to the correct LDAP server), and very much welcome feedback
944 on how to get this working.
</p
>
946 <p
>Because nscd do not have a default configuration fit for offline
947 caching until
<a href=
"http://bugs.debian.org/
485282">bug #
485282</a
>
948 is fixed, this configuration should be used instead of the one
949 currently in /etc/nscd.conf. The changes are in the fields
950 reload-count and positive-time-to-live, and is based on the
951 instructions I found in the
952 <a href=
"http://www.flyn.org/laptopldap/
">LDAP for Mobile Laptops
</a
>
953 instructions by Flyn Computing.
</p
>
955 <blockquote
><pre
>
957 reload-count unlimited
960 enable-cache passwd yes
961 positive-time-to-live passwd
2592000
962 negative-time-to-live passwd
20
963 suggested-size passwd
211
964 check-files passwd yes
965 persistent passwd yes
967 max-db-size passwd
33554432
968 auto-propagate passwd yes
970 enable-cache group yes
971 positive-time-to-live group
2592000
972 negative-time-to-live group
20
973 suggested-size group
211
974 check-files group yes
977 max-db-size group
33554432
978 auto-propagate group yes
980 enable-cache hosts no
981 positive-time-to-live hosts
2592000
982 negative-time-to-live hosts
20
983 suggested-size hosts
211
984 check-files hosts yes
987 max-db-size hosts
33554432
989 enable-cache services yes
990 positive-time-to-live services
2592000
991 negative-time-to-live services
20
992 suggested-size services
211
993 check-files services yes
994 persistent services yes
996 max-db-size services
33554432
997 </pre
></blockquote
>
999 <p
>While we wait for a mechanism to update /etc/nsswitch.conf
1000 automatically like the one provided in
1001 <a href=
"http://bugs.debian.org/
496915">bug #
496915</a
>, the file
1002 content need to be manually replaced to ensure LDAP is used as the
1003 directory service on the machine. /etc/nsswitch.conf should normally
1004 look like this:
</p
>
1006 <blockquote
><pre
>
1010 hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
1016 netgroup: files ldap
1017 </pre
></blockquote
>
1019 <p
>The important parts are that ldap is listed last for passwd, group,
1020 shadow and netgroup.
</p
>
1022 <p
>With these changes in place, any user in LDAP will be able to log
1023 in locally on the machine using for example kdm, get a local home
1024 directory created and have the password as well as user and group
1027 <h2
>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
1028 libpam-mklocaluser/pam_mkhomedir
</h2
>
1030 <p
>Because nscd have had its share of problems, and seem to have
1031 problems doing proper caching, I
've seen suggestions and recipes to
1032 use nss-updatedb to copy parts of the LDAP database locally when the
1033 LDAP database is available. I have not tested such setup, because I
1034 discovered sssd.
</p
>
1036 <h2
>LDAP/Kerberos + sssd + libpam-mklocaluser
</h2
>
1038 <p
>A more flexible and robust setup than the nscd combination
1039 mentioned earlier that has shown up recently, is the
1040 <a href=
"https://fedorahosted.org/sssd/
">sssd
</a
> package from Redhat.
1041 It is part of the
<a href=
"http://www.freeipa.org/
">FreeIPA
</A
> project
1042 to provide a Active Directory like directory service for Linux
1043 machines. The sssd system combines the caching of passwords and user
1044 information into one package, and remove the need for nscd and
1045 libpam-ccreds. It support LDAP and Kerberos, but not NIS. Version
1046 1.2 do not support netgroups, but it is said that it will support this
1047 in version
1.5 expected to show up later in
2010. Because the
1048 <a href=
"http://packages.qa.debian.org/s/sssd.html
">sssd package
</a
>
1049 was missing in Debian, I ended up co-maintaining it with Werner, and
1050 version
1.2 is now in testing.
1052 <p
>These packages need to be installed and configured to get the
1053 roaming setup I want
</p
>
1055 <blockquote
><pre
>
1056 libpam-sss libnss-sss libpam-mklocaluser
1057 </pre
></blockquote
>
1059 The complete setup of sssd is done by editing/creating
1060 <tt
>/etc/sssd/sssd.conf
</tt
>.
1062 <blockquote
><pre
>
1064 config_file_version =
2
1065 reconnection_retries =
3
1071 filter_groups = root
1073 reconnection_retries =
3
1076 reconnection_retries =
3
1080 cache_credentials = true
1083 auth_provider = ldap
1084 chpass_provider = ldap
1086 ldap_uri = ldap://ldap
1087 ldap_search_base = dc=skole,dc=skolelinux,dc=no
1088 ldap_tls_reqcert = never
1089 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
1090 </pre
></blockquote
>
1092 <p
>I got the same problem here with certificate checking. Had to set
1093 "ldap_tls_reqcert = never
" to get it working.
</p
>
1095 <p
>With the libnss-sss package in testing at the moment, the
1096 nsswitch.conf file is update automatically, so there is no need to
1097 modify it manually.
</p
>
1099 <p
>If you want to help out with implementing this for Debian Edu,
1100 please contact us on debian-edu@lists.debian.org.
</p
>
projects / homepage.git / blob