blog/archive/2010/04/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen: entries from April 2010</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="04.rss" type="application/rss+xml">
   8  </head>
   9  <body>
  10 <!-- XML FEED -->
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20  <p>Entries from April 2010.</p>
  21
  22
  23 <div class="entry">
  24  <div class="title">
  25  <a href="http://people.skolelinux.org/pere/blog/Kerberos_for_Debian_Edu_Squeeze_.html">Kerberos for Debian Edu/Squeeze?</a>
  26  </div>
  27  <div class="date">
  28   2010-04-14 17:20
  29  </div>
  30
  31  <div class="body">
  32
  33 <p><a href="http://www.nuug.no/aktiviteter/20100413-kerberos/">Yesterdays
  34 NUUG presentation</a> about Kerberos was inspiring, and reminded me
  35 about the need to start using Kerberos in Skolelinux.  Setting up a
  36 Kerberos server seem to be straight forward, and if we get this in
  37 place a long time before the Squeeze version of Debian freezes, we
  38 have a chance to migrate Skolelinux away from NFSv3 for the home
  39 directories, and over to an architecture where the infrastructure do
  40 not have to trust IP addresses and machines, and instead can trust
  41 users and cryptographic keys instead.</p>
  42
  43 <p>A challenge will be integration and administration.  Is there a
  44 Kerberos implementation for Debian where one can control the
  45 administration access in Kerberos using LDAP groups?  With it, the
  46 school administration will have to maintain access control using flat
  47 files on the main server, which give a huge potential for errors.</p>
  48
  49 <p>A related question I would like to know is how well Kerberos and
  50 pam-ccreds (offline password check) work together.  Anyone know?</p>
  51
  52 <p>Next step will be to use Kerberos for access control in Lwat and
  53 Nagios.  I have no idea how much work that will be to implement.  We
  54 would also need to document how to integrate with Windows AD, as such
  55 shared network will require two Kerberos realms that need to cooperate
  56 to work properly.</p>
  57
  58 <p>I believe a good start would be to start using Kerberos on the
  59 skolelinux.no machines, and this way get ourselves experience with
  60 configuration and integration.  A natural starting point would be
  61 setting up ldap.skolelinux.no as the Kerberos server, and migrate the
  62 rest of the machines from PAM via LDAP to PAM via Kerberos one at the
  63 time.</p>
  64
  65 <p>If you would like to contribute to get this working in Skolelinux,
  66 I recommend you to see the video recording from yesterdays NUUG
  67 presentation, and start using Kerberos at home.  The video show show
  68 up in a few days.</p>
  69
  70  </div>
  71  <div class="tags">
  72
  73
  74
  75   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
  76
  77  </div>
  78 </div>
  79  <div class="padding"></div>
  80
  81 <div class="entry">
  82  <div class="title">
  83  <a href="http://people.skolelinux.org/pere/blog/Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html">Great book: "Content: Selected Essays on Technology, Creativity, Copyright, and the Future of the Future"</a>
  84  </div>
  85  <div class="date">
  86   2010-04-19 17:10
  87  </div>
  88
  89  <div class="body">
  90
  91 <p>The last few weeks i have had the pleasure of reading a
  92 thought-provoking collection of essays by Cory Doctorow, on topics
  93 touching copyright, virtual worlds, the future of man when the
  94 conscience mind can be duplicated into a computer and many more. The
  95 book titled "Content: Selected Essays on Technology, Creativity,
  96 Copyright, and the Future of the Future" is available with few
  97 restrictions on the web, for example from
  98 <a href="http://craphound.com/content/">his own site</a>. I read the
  99 epub-version from
 100 <a href="http://www.feedbooks.com/book/2883">feedbooks</a> using
 101 <a href="http://www.fbreader.org/">fbreader</a> and my N810. I
 102 strongly recommend this book.</p>
 103
 104  </div>
 105  <div class="tags">
 106
 107
 108
 109   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 110
 111  </div>
 112 </div>
 113  <div class="padding"></div>
 114
 115 <div class="entry">
 116  <div class="title">
 117  <a href="http://people.skolelinux.org/pere/blog/Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html">Thoughts on roaming laptop setup for Debian Edu</a>
 118  </div>
 119  <div class="date">
 120   2010-04-28 20:40
 121  </div>
 122
 123  <div class="body">
 124
 125 <p>For some years now, I have wondered how we should handle laptops in
 126 Debian Edu.  The Debian Edu infrastructure is mostly designed to
 127 handle stationary computers, and less suited for computers that come
 128 and go.</p>
 129
 130 <p>Now I finally believe I have an sensible idea on how to adjust
 131 Debian Edu for laptops, by introducing a new profile for them, for
 132 example called Roaming Workstations.  Here are my thought on this.
 133 The setup would consist of the following:</p>
 134
 135 <ul>
 136
 137  <li>During installation, the user name of the owner / primary user of
 138    the laptop is requested and a local home directory is set up for
 139    the user, with uid and gid information fetched from the LDAP
 140    server.  This allow the user to work also when offline.  The
 141    central home directory can be available in a subdirectory on
 142    request, for example mounted via CIFS.  It could be mounted
 143    automatically when a user log in while on the Debian Edu network,
 144    and unmounted when the machine is taken away (network down,
 145    hibernate, etc), it can be set up to do automatic mounting on
 146    request (using autofs), or perhaps some GUI button on the desktop
 147    can be used to access it when needed.  Perhaps it is enough to use
 148    the fish protocol in KDE?</li>
 149
 150  <li>Password checking is set up to use LDAP or Kerberos
 151    authentication when the machine is on the Debian Edu network, and
 152    to cache the password for offline checking when the machine unable
 153    to reach the LDAP or Kerberos server.  This can be done using
 154    <a href="http://www.padl.com/OSS/pam_ccreds.html">libpam-ccreds</a>
 155    or the Fedora developed
 156    <a href="https://fedoraproject.org/wiki/Features/SSSD">System
 157    Security Services Daemon</a> packages.</li>
 158
 159  <li>File synchronisation with the central home directory is set up
 160    using a shared directory in both the local and the central home
 161    directory, using unison.</li>
 162
 163  <li>Printing should be set up to print to all printers broadcasting
 164    their existence on the local network, and should then work out of
 165    the box with CUPS.  For sites needing accurate printer quotas, some
 166    system with Kerberos authentication or printing via ssh could be
 167    implemented.</li>
 168
 169  <li>For users that should have local root access to their laptop,
 170    sudo should be used to allow this to the local user.</li>
 171
 172  <li>It would be nice if user and group information from LDAP is
 173    cached on the client, but given that there are entries for the
 174    local user and primary group in /etc/, it should not be needed.</li>
 175
 176 </ul>
 177
 178 <p>I believe all the pieces to implement this are in Debian/testing at
 179 the moment.  If we work quickly, we should be able to get this ready
 180 in time for the Squeeze release to freeze.  Some of the pieces need
 181 tweaking, like libpam-ccreds should get support for pam-auth-update
 182 (<a href="http://bugs.debian.org/566718">#566718</a>) and nslcd (or
 183 perhaps debian-edu-config) should get some integration code to stop
 184 its daemon when the LDAP server is unavailable to avoid long timeouts
 185 when disconnected from the net.  If we get Kerberos enabled, we need
 186 to make sure we avoid long timeouts there too.</p>
 187
 188 <p>If you want to help out with implementing this for Debian Edu,
 189 please contact us on debian-edu@lists.debian.org.</p>
 190
 191  </div>
 192  <div class="tags">
 193
 194
 195
 196   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 197
 198  </div>
 199 </div>
 200  <div class="padding"></div>
 201
 202  <p style="text-align: right;"><a href="04.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14"></a></p>
 203
 204
 205
 206 <div id="sidebar">
 207
 208 <h2>Archive</h2>
 209 <ul>
 210
 211 <li>2011
 212 <ul>
 213
 214 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
 215
 216 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
 217
 218 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
 219
 220 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
 221
 222 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
 223
 224 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
 225
 226 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (6)</a></li>
 227
 228 </ul></li>
 229
 230 <li>2010
 231 <ul>
 232
 233 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 234
 235 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 236
 237 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 238
 239 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 240
 241 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 242
 243 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 244
 245 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
 246
 247 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
 248
 249 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
 250
 251 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
 252
 253 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
 254
 255 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
 256
 257 </ul></li>
 258
 259 <li>2009
 260 <ul>
 261
 262 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 263
 264 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 265
 266 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 267
 268 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 269
 270 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 271
 272 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 273
 274 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 275
 276 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 277
 278 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 279
 280 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 281
 282 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 283
 284 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 285
 286 </ul></li>
 287
 288 <li>2008
 289 <ul>
 290
 291 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 292
 293 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 294
 295 </ul></li>
 296
 297 </ul>
 298
 299
 300
 301 <h2>Tags</h2>
 302 <ul>
 303
 304  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (13)</a></li>
 305
 306  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 307
 308  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 309
 310  <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (2)</a></li>
 311
 312  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
 313
 314  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (51)</a></li>
 315
 316  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (64)</a></li>
 317
 318  <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (7)</a></li>
 319
 320  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (93)</a></li>
 321
 322  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (12)</a></li>
 323
 324  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (11)</a></li>
 325
 326  <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (10)</a></li>
 327
 328  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (15)</a></li>
 329
 330  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
 331
 332  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (4)</a></li>
 333
 334  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 335
 336  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (13)</a></li>
 337
 338  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (129)</a></li>
 339
 340  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (118)</a></li>
 341
 342  <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
 343
 344  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (21)</a></li>
 345
 346  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (40)</a></li>
 347
 348  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
 349
 350  <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (2)</a></li>
 351
 352  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (4)</a></li>
 353
 354  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 355
 356  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (23)</a></li>
 357
 358  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
 359
 360  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (24)</a></li>
 361
 362  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 363
 364  <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (2)</a></li>
 365
 366  <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (9)</a></li>
 367
 368  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (20)</a></li>
 369
 370  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 371
 372  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (16)</a></li>
 373
 374 </ul>
 375
 376 </div>
 377 </body>
 378 </html>