blog/archive/2010/07/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen: entries from July 2010</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="07.rss" type="application/rss+xml">
   8  </head>
   9  <body>
  10 <!-- XML FEED -->
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20  <p>Entries from July 2010.</p>
  21
  22
  23 <div class="entry">
  24  <div class="title">
  25  <a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a>
  26  </div>
  27  <div class="date">
  28   2010-07-01 11:40
  29  </div>
  30
  31  <div class="body">
  32
  33 <p>For a laptop, centralized user directories and password checking is
  34 a bit troubling.  Laptops are typically used also when not connected
  35 to the network, and it is vital for a user to be able to log in or
  36 unlock the screen saver also when a central server is unavailable.
  37 This is possible by caching passwords and directory information (user
  38 and group attributes) locally, and the packages to do so are available
  39 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
  40 It is also possible to set up in Debian/Lenny, but require more manual
  41 setup there because pam-auth-update is missing in Lenny.</p>
  42
  43 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
  44
  45 This is the traditional method with a twist.  The password caching is
  46 provided by libpam-ccreds (version 10-4 or later is needed on
  47 Squeeze), and the directory caching is done by nscd.  The directory
  48 lookup and password checking is done using LDAP.  If one want to use
  49 Kerberos for password checking the libpam-ldapd package can be
  50 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
  51 local home directory with the path listed in LDAP, one can use the
  52 pam_mkhomedir module from pam-modules to make this happen instead of
  53 using libpam-mklocaluser.  A setup for pam-auth-update to enable
  54 pam_mkhomedir will have to be written until a fix for
  55 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
  56 archive.  Because I believe it is a bad idea to have local home
  57 directories using misleading paths like /site/server/partition/, I
  58 prefer to create a local user with the home directory in /home/.  This
  59 is done using the libpam-mklocaluser package.</p>
  60
  61 <p>These packages need to be installed and configured</p>
  62
  63 <blockquote><pre>
  64 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
  65 </pre></blockquote>
  66
  67 <p>The ldapd packages will ask for LDAP connection information, and
  68 one have to fill in the values that fits ones own site.  Make sure the
  69 PAM part uses encrypted connections, to make sure the password is not
  70 sent in clear text to the LDAP server.  I've been unable to get TLS
  71 certificate checking for a self signed certificate working, which make
  72 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
  73 is talking to the correct LDAP server), and very much welcome feedback
  74 on how to get this working.</p>
  75
  76 <p>Because nscd do not have a default configuration fit for offline
  77 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
  78 is fixed, this configuration should be used instead of the one
  79 currently in /etc/nscd.conf.  The changes are in the fields
  80 reload-count and positive-time-to-live, and is based on the
  81 instructions I found in the
  82 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
  83 instructions by Flyn Computing.</p>
  84
  85 <blockquote><pre>
  86         debug-level             0
  87         reload-count            unlimited
  88         paranoia                no
  89
  90         enable-cache            passwd          yes
  91         positive-time-to-live   passwd          2592000
  92         negative-time-to-live   passwd          20
  93         suggested-size          passwd          211
  94         check-files             passwd          yes
  95         persistent              passwd          yes
  96         shared                  passwd          yes
  97         max-db-size             passwd          33554432
  98         auto-propagate          passwd          yes
  99
 100         enable-cache            group           yes
 101         positive-time-to-live   group           2592000
 102         negative-time-to-live   group           20
 103         suggested-size          group           211
 104         check-files             group           yes
 105         persistent              group           yes
 106         shared                  group           yes
 107         max-db-size             group           33554432
 108         auto-propagate          group           yes
 109
 110         enable-cache            hosts           no
 111         positive-time-to-live   hosts           2592000
 112         negative-time-to-live   hosts           20
 113         suggested-size          hosts           211
 114         check-files             hosts           yes
 115         persistent              hosts           yes
 116         shared                  hosts           yes
 117         max-db-size             hosts           33554432
 118
 119         enable-cache            services        yes
 120         positive-time-to-live   services        2592000
 121         negative-time-to-live   services        20
 122         suggested-size          services        211
 123         check-files             services        yes
 124         persistent              services        yes
 125         shared                  services        yes
 126         max-db-size             services        33554432
 127 </pre></blockquote>
 128
 129 <p>While we wait for a mechanism to update /etc/nsswitch.conf
 130 automatically like the one provided in
 131 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
 132 content need to be manually replaced to ensure LDAP is used as the
 133 directory service on the machine.  /etc/nsswitch.conf should normally
 134 look like this:</p>
 135
 136 <blockquote><pre>
 137 passwd:         files ldap
 138 group:          files ldap
 139 shadow:         files ldap
 140 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 141 networks:       files
 142 protocols:      files
 143 services:       files
 144 ethers:         files
 145 rpc:            files
 146 netgroup:       files ldap
 147 </pre></blockquote>
 148
 149 <p>The important parts are that ldap is listed last for passwd, group,
 150 shadow and netgroup.</p>
 151
 152 <p>With these changes in place, any user in LDAP will be able to log
 153 in locally on the machine using for example kdm, get a local home
 154 directory created and have the password as well as user and group
 155 attributes cached.
 156
 157 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 158   libpam-mklocaluser/pam_mkhomedir</h2>
 159
 160 <p>Because nscd have had its share of problems, and seem to have
 161 problems doing proper caching, I've seen suggestions and recipes to
 162 use nss-updatedb to copy parts of the LDAP database locally when the
 163 LDAP database is available.  I have not tested such setup, because I
 164 discovered sssd.</p>
 165
 166 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
 167
 168 <p>A more flexible and robust setup than the nscd combination
 169 mentioned earlier that has shown up recently, is the
 170 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
 171 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
 172 to provide a Active Directory like directory service for Linux
 173 machines.  The sssd system combines the caching of passwords and user
 174 information into one package, and remove the need for nscd and
 175 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 176 1.2 do not support netgroups, but it is said that it will support this
 177 in version 1.5 expected to show up later in 2010.  Because the
 178 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
 179 was missing in Debian, I ended up co-maintaining it with Werner, and
 180 version 1.2 is now in testing.
 181
 182 <p>These packages need to be installed and configured to get the
 183 roaming setup I want</p>
 184
 185 <blockquote><pre>
 186 libpam-sss libnss-sss libpam-mklocaluser
 187 </pre></blockquote>
 188
 189 The complete setup of sssd is done by editing/creating
 190 <tt>/etc/sssd/sssd.conf</tt>.
 191
 192 <blockquote><pre>
 193 [sssd]
 194 config_file_version = 2
 195 reconnection_retries = 3
 196 sbus_timeout = 30
 197 services = nss, pam
 198 domains = INTERN
 199
 200 [nss]
 201 filter_groups = root
 202 filter_users = root
 203 reconnection_retries = 3
 204
 205 [pam]
 206 reconnection_retries = 3
 207
 208 [domain/INTERN]
 209 enumerate = false
 210 cache_credentials = true
 211
 212 id_provider = ldap
 213 auth_provider = ldap
 214 chpass_provider = ldap
 215
 216 ldap_uri = ldap://ldap
 217 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 218 ldap_tls_reqcert = never
 219 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 220 </pre></blockquote>
 221
 222 <p>I got the same problem here with certificate checking.  Had to set
 223 "ldap_tls_reqcert = never" to get it working.</p>
 224
 225 <p>With the libnss-sss package in testing at the moment, the
 226 nsswitch.conf file is update automatically, so there is no need to
 227 modify it manually.</p>
 228
 229 <p>If you want to help out with implementing this for Debian Edu,
 230 please contact us on debian-edu@lists.debian.org.</p>
 231
 232  </div>
 233  <div class="tags">
 234
 235
 236
 237   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 238
 239  </div>
 240 </div>
 241  <div class="padding"></div>
 242
 243 <div class="entry">
 244  <div class="title">
 245  <a href="http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html">Lenny->Squeeze upgrades, apt vs aptitude with the Gnome desktop</a>
 246  </div>
 247  <div class="date">
 248   2010-07-03 23:55
 249  </div>
 250
 251  <div class="body">
 252
 253 <p>Here is a short update on my <a
 254 href="http://people.skolelinux.org/~pere/debian-upgrade-testing/">my
 255 Debian Lenny->Squeeze upgrade testing</a>.  Here is a summary of the
 256 difference for Gnome when it is upgraded by apt-get and aptitude.  I'm
 257 not reporting the status for KDE, because the upgrade crashes when
 258 aptitude try because of missing conflicts
 259 (<a href="http://bugs.debian.org/584861">#584861</a> and
 260 <a href="http://bugs.debian.org/585716">#585716</a>).</p>
 261
 262 <p>At the end of the upgrade test script, dpkg -l is executed to get a
 263 complete list of the installed packages.  Based on this I see these
 264 differences when I did a test run today.  As usual, I do not really
 265 know what the correct set of packages would be, but thought it best to
 266 publish the difference.</p>
 267
 268 <p>Installed using apt-get, missing with aptitude</p>
 269
 270 <blockquote><p>
 271   at-spi cpp-4.3 finger gnome-spell gstreamer0.10-gnomevfs
 272   libatspi1.0-0 libcupsys2 libeel2-data libgail-common libgdl-1-common
 273   libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin
 274   libgtksourceview-common libpt-1.10.10-plugins-alsa
 275   libpt-1.10.10-plugins-v4l libservlet2.4-java libxalan2-java
 276   libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip
 277   python-4suite-xml python-eggtrayicon python-gtkhtml2
 278   python-gtkmozembed svgalibg1 xserver-xephyr zip
 279 </p></blockquote>
 280
 281 <p>Installed using apt-get, removed with aptitude</p>
 282
 283 <blockquote><p>
 284   bluez-utils dhcdbd djvulibre-desktop epiphany-gecko
 285   gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager
 286   libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-50
 287   libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcurl3
 288   libdirectfb-1.0-0 libdvdread3 libedata-cal1.2-6 libedataserver1.2-9
 289   libeel2-2.20 libepc-1.0-1 libepc-ui-1.0-1 libexchange-storage1.2-3
 290   libfaad0 libgd2-noxpm libgda3-3 libgda3-common libggz2 libggzcore9
 291   libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnome-desktop-2
 292   libgnome-pilot2 libgnomecups1.0-1 libgnomeprint2.2-0
 293   libgnomeprintui2.2-0 libgpod3 libgraphviz4 libgtkhtml2-0
 294   libgtksourceview1.0-0 libgucharmap6 libhesiod0 libicu38 libisccc50
 295   libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++10
 296   libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4
 297   libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5
 298   libparted1.8-10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3
 299   libpt-1.10.10 libraw1394-8 libsensors3 libsmbios2 libsoup2.2-8
 300   libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1
 301   libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj
 302   libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3
 303   mysql-common swfdec-gnome totem-gstreamer wodim
 304 </p></blockquote>
 305
 306 <p>Installed using aptitude, missing with apt-get</p>
 307
 308 <blockquote><p>
 309   gnome gnome-desktop-environment hamster-applet python-gnomeapplet
 310   python-gnomekeyring python-wnck rhythmbox-plugins xorg
 311   xserver-xorg-input-all xserver-xorg-input-evdev
 312   xserver-xorg-input-kbd xserver-xorg-input-mouse
 313   xserver-xorg-input-synaptics xserver-xorg-video-all
 314   xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati
 315   xserver-xorg-video-chips xserver-xorg-video-cirrus
 316   xserver-xorg-video-dummy xserver-xorg-video-fbdev
 317   xserver-xorg-video-glint xserver-xorg-video-i128
 318   xserver-xorg-video-i740 xserver-xorg-video-mach64
 319   xserver-xorg-video-mga xserver-xorg-video-neomagic
 320   xserver-xorg-video-nouveau xserver-xorg-video-nv
 321   xserver-xorg-video-r128 xserver-xorg-video-radeon
 322   xserver-xorg-video-radeonhd xserver-xorg-video-rendition
 323   xserver-xorg-video-s3 xserver-xorg-video-s3virge
 324   xserver-xorg-video-savage xserver-xorg-video-siliconmotion
 325   xserver-xorg-video-sis xserver-xorg-video-sisusb
 326   xserver-xorg-video-tdfx xserver-xorg-video-tga
 327   xserver-xorg-video-trident xserver-xorg-video-tseng
 328   xserver-xorg-video-vesa xserver-xorg-video-vmware
 329   xserver-xorg-video-voodoo
 330 </p></blockquote>
 331
 332 <p>Installed using aptitude, removed with apt-get</p>
 333
 334 <blockquote><p>
 335   deskbar-applet xserver-xorg xserver-xorg-core
 336   xserver-xorg-input-wacom xserver-xorg-video-intel
 337   xserver-xorg-video-openchrome
 338 </p></blockquote>
 339
 340 <p>I was told on IRC that the xorg-xserver package was
 341 <a href="http://git.debian.org/?p=pkg-xorg/xserver/xorg-server.git;a=commit;h=9c8080d06c457932d3bfec021c69ac000aa60120">changed
 342 in git</a> today to try to get apt-get to not remove xorg completely.
 343 No idea when it hits Squeeze, but when it does I hope it will reduce
 344 the difference somewhat.
 345
 346  </div>
 347  <div class="tags">
 348
 349
 350
 351   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 352
 353  </div>
 354 </div>
 355  <div class="padding"></div>
 356
 357 <div class="entry">
 358  <div class="title">
 359  <a href="http://people.skolelinux.org/pere/blog/MS_Word_kr__ller_det_til_for_politiet_.html">MS Word krøller det til for politiet?</a>
 360  </div>
 361  <div class="date">
 362   2010-07-08 14:00
 363  </div>
 364
 365  <div class="body">
 366
 367 <p>De siste dagene har Aftenposten
 368 <a href="http://www.aftenposten.no/nyheter/iriks/article3718597.ece">fortalt</a>
 369 <a href="http://www.aftenposten.no/nyheter/iriks/article3724249.ece">hvordan</a>
 370 politet har brukt skriveverktøy som ikke håndterer arabisk tekst og
 371 tekst som skal skrives fra høyre mot venstre når de har laget
 372 løpeseddel for å be om informasjon fra publikum.  Resultatet har vært
 373 en uleselig arabisk-bit på løpeseddelen.  Feilen har oppstått når
 374 teksten har blitt "kopiert inn i programvare som ikke har støtte for
 375 språk som skrives fra høyre mot venstre", og jeg er ganske sikker på
 376 at det er snakk om Microsoft Office i dette tilfellet.  Er det slik at
 377 MS Office i norsk språkdrakt ikke har støtte for tekst som skal
 378 skrives fra høyre mot venstre?  Jeg tror alle utgaver av
 379 OpenOffice.org har slik støtte, og det er jo ikke veldig vanskelig å
 380 la slik støtte finnes i alle utgaver av et program hvis støtten først
 381 er utviklet.  Aftenpostens melding får meg til å undre om problemet
 382 ville vært unngått hvis politiet brukte OpenOffice.org i stedet for MS
 383 Office.</p>
 384
 385 <p>Mon tro om det er flere eksempler på at MS Office har ødelagt for
 386 offentlig myndighet?</p>
 387
 388  </div>
 389  <div class="tags">
 390
 391
 392
 393   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>.
 394
 395  </div>
 396 </div>
 397  <div class="padding"></div>
 398
 399 <div class="entry">
 400  <div class="title">
 401  <a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a>
 402  </div>
 403  <div class="date">
 404   2010-07-09 12:55
 405  </div>
 406
 407  <div class="body">
 408
 409 <p>Since
 410 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
 411 last post</a> about available LDAP tools in Debian, I was told about a
 412 LDAP GUI that is even better than luma.  The java application
 413 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
 414 moving LDAP objects and subtrees using drag-and-drop, and can
 415 authenticate using Kerberos.  I have only tested the Kerberos
 416 authentication, but do not have a LDAP setup allowing me to rewrite
 417 LDAP with my test user yet.  It is
 418 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
 419 Debian</a> testing and unstable at the moment.  The only problem I
 420 have with it is how it handle errors.  If something go wrong, its
 421 non-intuitive behaviour require me to go through some query work list
 422 and remove the failing query.  Nothing big, but very annoying.</p>
 423
 424  </div>
 425  <div class="tags">
 426
 427
 428
 429   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 430
 431  </div>
 432 </div>
 433  <div class="padding"></div>
 434
 435 <div class="entry">
 436  <div class="title">
 437  <a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a>
 438  </div>
 439  <div class="date">
 440   2010-07-11 22:00
 441  </div>
 442
 443  <div class="body">
 444
 445 <p>Vagrant mentioned on IRC today that ltsp_config now support
 446 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
 447 clients, and that this can be used to fetch configuration from LDAP if
 448 Debian Edu choose to store configuration there.</p>
 449
 450 <p>Armed with this information, I got inspired and wrote a test module
 451 to get configuration from LDAP.  The idea is to look up the MAC
 452 address of the client in LDAP, and look for attributes on the form
 453 ltspconfigsetting=value, and use this to export SETTING=value to the
 454 LTSP clients.</p>
 455
 456 <p>The goal is to be able to store the LTSP configuration attributes
 457 in a "computer" LDAP object used by both DNS and DHCP, and thus
 458 allowing us to store all information about a computer in one place.</p>
 459
 460 <p>This is a untested draft implementation, and I welcome feedback on
 461 this approach.  A real LDAP schema for the ltspClientAux objectclass
 462 need to be written.  Comments, suggestions, etc?</p>
 463
 464 <blockquote><pre>
 465 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
 466 #
 467 # Fetch LTSP client settings from LDAP based on MAC address
 468 #
 469 # Uses ethernet address as stored in the dhcpHost objectclass using
 470 # the dhcpHWAddress attribute or ethernet address stored in the
 471 # ieee802Device objectclass with the macAddress attribute.
 472 #
 473 # This module is written to be schema agnostic, and only depend on the
 474 # existence of attribute names.
 475 #
 476 # The LTSP configuration variables are saved directly using a
 477 # ltspConfig prefix and uppercasing the rest of the attribute name.
 478 # To set the SERVER variable, set the ltspConfigServer attribute.
 479 #
 480 # Some LDAP schema should be created with all the relevant
 481 # configuration settings.  Something like this should work:
 482 #
 483 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
 484 #     SUP top
 485 #     AUXILIARY
 486 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
 487
 488 LDAPSERVER=$(debian-edu-ldapserver)
 489 if [ "$LDAPSERVER" ] ; then
 490     LDAPBASE=$(debian-edu-ldapserver -b)
 491     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
 492         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
 493         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
 494             grep '^ltspConfig' | while read attr value ; do
 495             # Remove prefix and convert to upper case
 496             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
 497             # bass value on to clients
 498             eval "$attr=$value; export $attr"
 499         done
 500     done
 501 fi
 502 </pre></blockquote>
 503
 504 <p>I'm not sure this shell construction will work, because I suspect
 505 the while block might end up in a subshell causing the variables set
 506 there to not show up in ltsp-config, but if that is the case I am sure
 507 the code can be restructured to make sure the variables are passed on.
 508 I expect that can be solved with some testing. :)</p>
 509
 510 <p>If you want to help out with implementing this for Debian Edu,
 511 please contact us on debian-edu@lists.debian.org.</p>
 512
 513 <p>Update 2010-07-17: I am aware of another effort to store LTSP
 514 configuration in LDAP that was created around year 2000 by
 515 <a href="http://www.pcxperience.com/thinclient/documentation/ldap.html">PC
 516 Xperience, Inc., 2000</a>.  I found its
 517 <a href="http://people.redhat.com/alikins/ltsp/ldap/">files</a> on a
 518 personal home page over at redhat.com.</p>
 519
 520  </div>
 521  <div class="tags">
 522
 523
 524
 525   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 526
 527  </div>
 528 </div>
 529  <div class="padding"></div>
 530
 531 <div class="entry">
 532  <div class="title">
 533  <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a>
 534  </div>
 535  <div class="date">
 536   2010-07-14 23:45
 537  </div>
 538
 539  <div class="body">
 540
 541 <p>For a while now, I have wanted to find a way to change the DNS and
 542 DHCP services in Debian Edu to use the same LDAP objects for a given
 543 computer, to avoid the possibility of having a inconsistent state for
 544 a computer in LDAP (as in DHCP but no DNS entry or the other way
 545 around) and make it easier to add computers to LDAP.</p>
 546
 547 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
 548 information finally found a solution that seem to work.</p>
 549
 550 <p>The old setup required three LDAP objects for a given computer.
 551 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
 552 we switch powerdns to use its strict LDAP method (ldap-method=strict
 553 in pdns-debian-edu.conf), the forward and reverse DNS entries are
 554 merged into one while making it impossible to transfer the reverse map
 555 to a slave DNS server.</p>
 556
 557 <p>If we also replace the object class used to get the DNS related
 558 attributes to one allowing these attributes to be combined with the
 559 dhcphost object class, we can merge the DNS and DHCP entries into one.
 560 I've written such object class in the dnsdomainaux.schema file (need
 561 proper OIDs, but that is a minor issue), and tested the setup.  It
 562 seem to work.</p>
 563
 564 <p>With this test setup in place, we can get away with one LDAP object
 565 for both DNS and DHCP, and even the LTSP configuration I suggested in
 566 an earlier email.  The combined LDAP object will look something like
 567 this:</p>
 568
 569 <blockquote><pre>
 570   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 571   cn: hostname
 572   objectClass: dhcphost
 573   objectclass: domainrelatedobject
 574   objectclass: dnsdomainaux
 575   associateddomain: hostname.intern
 576   arecord: 10.11.12.13
 577   dhcphwaddress: ethernet 00:00:00:00:00:00
 578   dhcpstatements: fixed-address hostname
 579   ldapconfigsound: Y
 580 </pre></blockquote>
 581
 582 <p>The DNS server uses the associateddomain and arecord entries, while
 583 the DHCP server uses the dhcphwaddress and dhcpstatements entries
 584 before asking DNS to resolve the fixed-adddress.  LTSP will use
 585 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
 586
 587 <p>I am not yet sure if I can get the DHCP server to look for its
 588 dhcphost in a different location, to allow us to put the objects
 589 outside the "DHCP Config" subtree, but hope to figure out a way to do
 590 that.  If I can't figure out a way to do that, we can still get rid of
 591 the hosts subtree and move all its content into the DHCP Config tree
 592 (which probably should be renamed to be more related to the new
 593 content.  I suspect cn=dnsdhcp,ou=services or something like that
 594 might be a good place to put it.</p>
 595
 596 <p>If you want to help out with implementing this for Debian Edu,
 597 please contact us on debian-edu@lists.debian.org.</p>
 598
 599  </div>
 600  <div class="tags">
 601
 602
 603
 604   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 605
 606  </div>
 607 </div>
 608  <div class="padding"></div>
 609
 610 <div class="entry">
 611  <div class="title">
 612  <a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a>
 613  </div>
 614  <div class="date">
 615   2010-07-17 21:00
 616  </div>
 617
 618  <div class="body">
 619
 620 <p>This is a
 621 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
 622 on my
 623 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
 624 work</a> on
 625 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
 626 all</a> the computer related LDAP objects in Debian Edu.</p>
 627
 628 <p>As a step to try to see if it possible to merge the DNS and DHCP
 629 LDAP objects, I have had a look at how the packages pdns-backend-ldap
 630 and dhcp3-server-ldap in Debian use the LDAP server.  The two
 631 implementations are quite different in how they use LDAP.</p>
 632
 633 To get this information, I started slapd with debugging enabled and
 634 dumped the debug output to a file to get the LDAP searches performed
 635 on a Debian Edu main-server.  Here is a summary.
 636
 637 <p><strong>powerdns</strong></p>
 638
 639 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
 640 on how to</a> set up PowerDNS to use a LDAP backend is available on
 641 the web.
 642
 643 <p>PowerDNS have two modes of operation using LDAP as its backend.
 644 One "strict" mode where the forward and reverse DNS lookups are done
 645 using the same LDAP objects, and a "tree" mode where the forward and
 646 reverse entries are in two different subtrees in LDAP with a structure
 647 based on the DNS names, as in tjener.intern and
 648 2.2.0.10.in-addr.arpa.</p>
 649
 650 <p>In tree mode, the server is set up to use a LDAP subtree as its
 651 base, and uses a "base" scoped search for the DNS name by adding
 652 "dc=tjener,dc=intern," to the base with a filter for
 653 "(associateddomain=tjener.intern)" for the forward entry and
 654 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
 655 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
 656 forward entries, it is looking for attributes named dnsttl, arecord,
 657 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
 658 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
 659 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
 660 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
 661 spfrecord and modifytimestamp.  For reverse entries it is looking for
 662 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
 663 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
 664 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
 665 ldapsearch commands could look like this:</p>
 666
 667 <blockquote><pre>
 668 ldapsearch -h ldap \
 669   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 670   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 671   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 672   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 673   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 674   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 675
 676 ldapsearch -h ldap \
 677   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 678   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
 679   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
 680   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
 681   srvrecord naptrrecord modifytimestamp
 682 </pre></blockquote>
 683
 684 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
 685 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
 686 example LDAP objects used there.  In addition to these objects, the
 687 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
 688 also exist.</p>
 689
 690 <blockquote><pre>
 691 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
 692 objectclass: top
 693 objectclass: dnsdomain
 694 objectclass: domainrelatedobject
 695 dc: tjener
 696 arecord: 10.0.2.2
 697 associateddomain: tjener.intern
 698
 699 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
 700 objectclass: top
 701 objectclass: dnsdomain2
 702 objectclass: domainrelatedobject
 703 dc: 2
 704 ptrrecord: tjener.intern
 705 associateddomain: 2.2.0.10.in-addr.arpa
 706 </pre></blockquote>
 707
 708 <p>In strict mode, the server behaves differently.  When looking for
 709 forward DNS entries, it is doing a "subtree" scoped search with the
 710 same base as in the tree mode for a object with filter
 711 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
 712 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
 713 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
 714 naptrrecord and modifytimestamp.  For reverse entires it also do a
 715 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
 716 and the requested attributes are associateddomain, dnsttl and
 717 modifytimestamp.  In short, in strict mode the objects with ptrrecord
 718 go away, and the arecord attribute in the forward object is used
 719 instead.</p>
 720
 721 <p>The forward and reverse searches can be simulated using ldapsearch
 722 like this:</p>
 723
 724 <blockquote><pre>
 725 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 726   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 727   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 728   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 729   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 730   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 731
 732 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 733   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
 734 </pre></blockquote>
 735
 736 <p>In addition to the forward and reverse searches , there is also a
 737 search for SOA records, which behave similar to the forward and
 738 reverse lookups.</p>
 739
 740 <p>A thing to note with the PowerDNS behaviour is that it do not
 741 specify any objectclass names, and instead look for the attributes it
 742 need to generate a DNS reply.  This make it able to work with any
 743 objectclass that provide the needed attributes.</p>
 744
 745 <p>The attributes are normally provided in the cosine (RFC 1274) and
 746 dnsdomain2 schemas.  The latter is used for reverse entries like
 747 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
 748
 749 <p>In Debian Edu, we have created DNS objects using the object classes
 750 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
 751 attributes) and domainrelatedobject (for associatedDomain).  The use
 752 of structural object classes make it impossible to combine these
 753 classes with the object classes used by DHCP.</p>
 754
 755 <p>There are other schemas that could be used too, for example the
 756 dnszone structural object class used by Gosa and bind-sdb for the DNS
 757 attributes combined with the domainrelatedobject object class, but in
 758 this case some unused attributes would have to be included as well
 759 (zonename and relativedomainname).</p>
 760
 761 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
 762 mode and not use any of the existing objectclasses (dnsdomain,
 763 dnsdomain2 and dnszone) when one want to combine the DNS information
 764 with DHCP information, and instead create a auxiliary object class
 765 defined something like this (using the attributes defined for
 766 dnsdomain and dnsdomain2 or dnszone):</p>
 767
 768 <blockquote><pre>
 769 objectclass ( some-oid NAME 'dnsDomainAux'
 770     SUP top
 771     AUXILIARY
 772     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
 773           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
 774           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
 775           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
 776           A6Record $ DNAMERecord
 777     ))
 778 </pre></blockquote>
 779
 780 <p>This will allow any object to become a DNS entry when combined with
 781 the domainrelatedobject object class, and allow any entity to include
 782 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
 783 developers asking for their view on this schema and if they are
 784 interested in providing such schema with PowerDNS, and I hope my
 785 message will be accepted into their mailing list soon.</p>
 786
 787 <p><strong>ISC dhcp</strong></p>
 788
 789 <p>The DHCP server searches for specific objectclass and requests all
 790 the object attributes, and then uses the attributes it want.  This
 791 make it harder to figure out exactly what attributes are used, but
 792 thanks to the working example in Debian Edu I can at least get an idea
 793 what is needed without having to read the source code.</p>
 794
 795 <p>In the DHCP server configuration, the LDAP base to use and the
 796 search filter to use to locate the correct dhcpServer entity is
 797 stored.  These are the relevant entries from
 798 /etc/dhcp3/dhcpd.conf:</p>
 799
 800 <blockquote><pre>
 801 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
 802 ldap-dhcp-server-cn "dhcp";
 803 </pre></blockquote>
 804
 805 <p>The DHCP server uses this information to nest all the DHCP
 806 configuration it need.  The cn "dhcp" is located using the given LDAP
 807 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
 808 search result is this entry:</p>
 809
 810 <blockquote><pre>
 811 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
 812 cn: dhcp
 813 objectClass: top
 814 objectClass: dhcpServer
 815 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 816 </pre></blockquote>
 817
 818 <p>The content of the dhcpServiceDN attribute is next used to locate the
 819 subtree with DHCP configuration.  The DHCP configuration subtree base
 820 is located using a base scope search with base "cn=DHCP
 821 Config,dc=skole,dc=skolelinux,dc=no" and filter
 822 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
 823 The search result is this entry:</p>
 824
 825 <blockquote><pre>
 826 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 827 cn: DHCP Config
 828 objectClass: top
 829 objectClass: dhcpService
 830 objectClass: dhcpOptions
 831 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
 832 dhcpStatements: ddns-update-style none
 833 dhcpStatements: authoritative
 834 dhcpOption: smtp-server code 69 = array of ip-address
 835 dhcpOption: www-server code 72 = array of ip-address
 836 dhcpOption: wpad-url code 252 = text
 837 </pre></blockquote>
 838
 839 <p>Next, the entire subtree is processed, one level at the time.  When
 840 all the DHCP configuration is loaded, it is ready to receive requests.
 841 The subtree in Debian Edu contain objects with object classes
 842 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
 843 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
 844 and information about netmasks, dynamic range etc.  Leaving out the
 845 details here because it is not relevant for the focus of my
 846 investigation, which is to see if it is possible to merge dns and dhcp
 847 related computer objects.</p>
 848
 849 <p>When a DHCP request come in, LDAP is searched for the MAC address
 850 of the client (00:00:00:00:00:00 in this example), using a subtree
 851 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
 852 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
 853 00:00:00:00:00:00))" as the filter.  This is what a host object look
 854 like:</p>
 855
 856 <blockquote><pre>
 857 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 858 cn: hostname
 859 objectClass: top
 860 objectClass: dhcpHost
 861 dhcpHWAddress: ethernet 00:00:00:00:00:00
 862 dhcpStatements: fixed-address hostname
 863 </pre></blockquote>
 864
 865 <p>There is less flexiblity in the way LDAP searches are done here.
 866 The object classes need to have fixed names, and the configuration
 867 need to be stored in a fairly specific LDAP structure.  On the
 868 positive side, the invidiual dhcpHost entires can be anywhere without
 869 the DN pointed to by the dhcpServer entries.  The latter should make
 870 it possible to group all host entries in a subtree next to the
 871 configuration entries, and this subtree can also be shared with the
 872 DNS server if the schema proposed above is combined with the dhcpHost
 873 structural object class.
 874
 875 <p><strong>Conclusion</strong></p>
 876
 877 <p>The PowerDNS implementation seem to be very flexible when it come
 878 to which LDAP schemas to use.  While its "tree" mode is rigid when it
 879 come to the the LDAP structure, the "strict" mode is very flexible,
 880 allowing DNS objects to be stored anywhere under the base cn specified
 881 in the configuration.</p>
 882
 883 <p>The DHCP implementation on the other hand is very inflexible, both
 884 regarding which LDAP schemas to use and which LDAP structure to use.
 885 I guess one could implement ones own schema, as long as the
 886 objectclasses and attributes have the names used, but this do not
 887 really help when the DHCP subtree need to have a fairly fixed
 888 structure.</p>
 889
 890 <p>Based on the observed behaviour, I suspect a LDAP structure like
 891 this might work for Debian Edu:</p>
 892
 893 <blockquote><pre>
 894 ou=services
 895   cn=machine-info (dhcpService) - dhcpServiceDN points here
 896     cn=dhcp (dhcpServer)
 897     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
 898       cn=10.0.2.0 (dhcpSubnet)
 899         cn=group1 (dhcpGroup/dhcpOptions)
 900     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
 901       cn=192.168.0.0 (dhcpSubnet)
 902         cn=group1 (dhcpGroup/dhcpOptions)
 903     ou=machines - PowerDNS base points here
 904       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
 905 </pre></blockquote>
 906
 907 <P>This is not tested yet.  If the DHCP server require the dhcpHost
 908 entries to be in the dhcpGroup subtrees, the entries can be stored
 909 there instead of a common machines subtree, and the PowerDNS base
 910 would have to be moved one level up to the machine-info subtree.</p>
 911
 912 <p>The combined object under the machines subtree would look something
 913 like this:</p>
 914
 915 <blockquote><pre>
 916 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
 917 dc: hostname
 918 objectClass: top
 919 objectClass: dhcpHost
 920 objectclass: domainrelatedobject
 921 objectclass: dnsDomainAux
 922 associateddomain: hostname.intern
 923 arecord: 10.11.12.13
 924 dhcpHWAddress: ethernet 00:00:00:00:00:00
 925 dhcpStatements: fixed-address hostname.intern
 926 </pre></blockquote>
 927
 928 </p>One could even add the LTSP configuration associated with a given
 929 machine, as long as the required attributes are available in a
 930 auxiliary object class.</p>
 931
 932  </div>
 933  <div class="tags">
 934
 935
 936
 937   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 938
 939  </div>
 940 </div>
 941  <div class="padding"></div>
 942
 943 <div class="entry">
 944  <div class="title">
 945  <a href="http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html">OpenStreetmap one step closer to having routing on its front page</a>
 946  </div>
 947  <div class="date">
 948   2010-07-18 16:45
 949  </div>
 950
 951  <div class="body">
 952
 953 <p>Thanks to
 954 <a href="http://feedproxy.google.com/~r/Opengeodata/~3/wUTCzDZk3lc/project-of-the-week-which-way-home">todays
 955 opengeodata blog entry</a>, I just discovered that the
 956 OpenStreetmap.org site have gotten
 957 <a href="http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT">support
 958 for calculating routes</a>.  The support is still experimental and
 959 only available from the development server, until more experience is
 960 gathered on the user interface and any scalability issues.</p>
 961
 962 <p>Earlier, the routing I knew about using the OpenStreetmap.org data
 963 was provided by <a href="http://maps.cloudmade.com/">Cloudmade</a>,
 964 but having it on the main page is required to make everyone aware of
 965 the issue.  I've had people reject Openstreetmap.org as a viable
 966 alternative for them because the front page lacked routing support,
 967 and I hope their needs will be catered for when routing show up on the
 968 www.openstreetmap.org front page.</p>
 969
 970  </div>
 971  <div class="tags">
 972
 973
 974
 975   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/kart">kart</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 976
 977  </div>
 978 </div>
 979  <div class="padding"></div>
 980
 981 <div class="entry">
 982  <div class="title">
 983  <a href="http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til____slutte____kj__pe_musikk.html">Digitale restriksjonsmekanismer fikk meg til å slutte å kjøpe musikk</a>
 984  </div>
 985  <div class="date">
 986   2010-07-22 23:50
 987  </div>
 988
 989  <div class="body">
 990
 991 <p>For mange år siden slutte jeg å kjøpe musikk-CDer. Årsaken var at
 992 musikkbransjen var godt i gang med å selge platene sine med DRM som
 993 gjorde at jeg ikke fikk spilt av musikken jeg kjøpte på utstyret jeg
 994 hadde tilgjengelig, dvs. min datamaskin. Det var umulig å se på en
 995 plate om den var ødelagt eller ikke, og jeg hadde jo allerede en
 996 anseelig samling med plater, så jeg bestemme meg for å slutte å gi
 997 penger til en bransje som åpenbart ikke respekterte meg.</p>
 998
 999 <p>Jeg har mange titalls dager med musikk på CD i dag. Det meste er
1000 lagt i et stort arkiv som kan spilles av fra husets datamaskiner (har
1001 ikke rukket rippe alt). Jeg ser dermed ikke behovet for å skaffe mer
1002 musikk. De fleste av mine favoritter er i hus, og jeg er dermed godt
1003 fornøyd.</p>
1004
1005 <p>Hvis musikkbransjen ønsker mine penger, så må de demonstrere at de
1006 setter pris på meg som kunde, og ikke skremme meg bort med DRM og
1007 antydninger om at kundene er kriminelle.</p>
1008
1009 <p>Filmbransjen er like ille, men mens musikk gjerne varer lenge, er
1010 filmer mer ferskvare. Har dermed ikke helt sluttet å kjøpe filmer, men
1011 holder meg til DVD-filmer som kan spilles av på mine Linuxbokser.
1012 Kommer neppe til å ta i bruk Blueray, og ei heller de nye DRM-greiene
1013 «Ultraviolet» som be annonsert her om dagen.</p>
1014
1015  </div>
1016  <div class="tags">
1017
1018
1019
1020   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>.
1021
1022  </div>
1023 </div>
1024  <div class="padding"></div>
1025
1026 <div class="entry">
1027  <div class="title">
1028  <a href="http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html">One step closer to single signon in Debian Edu</a>
1029  </div>
1030  <div class="date">
1031   2010-07-25 10:00
1032  </div>
1033
1034  <div class="body">
1035
1036 <p>The last few months me and the other Debian Edu developers have
1037 been working hard to get the Debian/Squeeze based version of Debian
1038 Edu/Skolelinux into shape.  This future version will use Kerberos for
1039 authentication, and services are slowly migrated to single signon,
1040 getting rid of password questions one at the time.</p>
1041
1042 <p>It will also feature a roaming workstation profile with local home
1043 directory, for laptops that are only some times on the Skolelinux
1044 network, and for this profile a shortcut is created in Gnome and KDE
1045 to gain access to the users home directory on the file server.  This
1046 shortcut uses SMB at the moment, and yesterday I had time to test if
1047 SMB mounting had started working in KDE after we added the cifs-utils
1048 package.  I was pleasantly surprised how well it worked.</p>
1049
1050 <p>Thanks to the recent changes to our samba configuration to get it
1051 to use Kerberos for authentication, there were no question about user
1052 password when mounting the SMB volume.  A simple click on the shortcut
1053 in the KDE menu, and a window with the home directory popped
1054 up. :)</p>
1055
1056 <p>One step closer to a single signon solution out of the box in
1057 Debian Edu.  We already had PAM, LDAP, IMAP and SMTP in place, and now
1058 also Samba.  Next step is Cups and hopefully also NFS.</p>
1059
1060 <p>We had planned a alpha0 release of Debian Edu for today, but thanks
1061 to the autobuilder administrators for some architectures being slow to
1062 sign packages, we are still missing the fixed LTSP package we need for
1063 the release.  It was uploaded three days ago with urgency=high, and if
1064 it had entered testing yesterday we would have been able to test it in
1065 time for a alpha0 release today.  As the binaries for ia64 and powerpc
1066 still not uploaded to the Debian archive, we need to delay the alpha
1067 release another day.</p>
1068
1069 <p>If you want to help out with implementing Kerberos for Debian Edu,
1070 please contact us on debian-edu@lists.debian.org.</p>
1071
1072  </div>
1073  <div class="tags">
1074
1075
1076
1077   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
1078
1079  </div>
1080 </div>
1081  <div class="padding"></div>
1082
1083 <div class="entry">
1084  <div class="title">
1085  <a href="http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html">First Debian Edu test release (alpha0) based on Squeeze is released</a>
1086  </div>
1087  <div class="date">
1088   2010-07-27 17:45
1089  </div>
1090
1091  <div class="body">
1092
1093 <p>I just posted this announcement culminating several months of work
1094 with the next Debian Edu release.  Not nearly done, but one major step
1095 completed.</p>
1096
1097 <blockquote>
1098 <p>This is the first test release based on Squeeze. The focus of this
1099 release is to test the user application selection. To have a look,
1100 install the standalone profile and let the developers know if the set
1101 of installed packages i.e. applications should be modified. If some
1102 user application is missing, or if there are some applications that no
1103 longer make sense to be included in Debian Edu, please let us know.
1104 Also, if a useful application is missing the translation for your
1105 language of choice, please let us know too.</p>
1106
1107 <p>In addition, feedback and help to polish the desktop (menus,
1108 artwork, starters, etc.) is appreciated. We would like to ship a nice
1109 and handy KDE4 desktop targeted for schools out of the box.</p>
1110
1111 <p>The other profiles should be installable, but there is a lot more
1112 work left to be done before they are ready, so do not expect to
1113 much.</p>
1114
1115 <p>Changes compared to the lenny based version</p>
1116
1117 <ul>
1118 <li>Everything from Debian Squeeze
1119 <ul>
1120   <li>Desktop environment KDE 4.4 => the new KDE desktop in
1121          combination with some new artwork
1122   <li>Web browser Iceweasel 3.5
1123   <li>OpenOffice.org 3.2
1124   <li>Educational toolbox GCompris 9.3
1125   <li>Music creator Rosegarden 10.04.2
1126   <li>Image editor Gimp 2.6.10
1127   <li>Virtual universe Celestia 1.6.0
1128   <li>Virtual stargazer Stellarium 0.10.4
1129   <li>3D modeler Blender 2.49.2 (new application)
1130   <li>Video editor Kdenlive 0.7.7 (new application)
1131 </ul></li>
1132 <li>Now using Kerberos for password checking (migration not finished).
1133     Enabled for:
1134 <ul>
1135   <li>PAM
1136   <li>LDAP
1137   <li>IMAP
1138   <li>SMTP (sender verification)
1139 </ul>
1140 </li>
1141 <li>New experimental roaming workstation profile for laptops.</li>
1142 <li>Show welcome page to users when they first log in. The URL is
1143     fetched from LDAP.</li>
1144 <li>New LXDE desktop option, in addition to KDE (default) and Gnome.</li>
1145 <li>General cleanup (not finished)</li>
1146 </ul>
1147 <p>The following features are not working as they should</p>
1148
1149 <ul>
1150 <li>No web based administration tool for creating users and groups. The
1151     scripts ldap-createuser-krb and ldap-add-user-to-group can be used
1152     for testing.</li>
1153 <li>DVD installs are missing debian-installer images for the PXE boot,
1154     and do not set up the PXE menu on eth0 because of this. LTSP
1155     clients should still boot from eth1 on thin client servers.</li>
1156 <li>The restructured KDE menu is not implemented.</li>
1157 <li>The LDAP server setup need to be reviewed for security.</li>
1158 <li>The LDAP directory structure need to be reworked.</li>
1159 <li>Different sets of packages are installed when using the DVD and the
1160     netinst CD. More packages are installed using the netinst CD.</li>
1161 <li>The jackd package fail to install. This is believed to be caused by
1162     some ongoing transition, and hopefully should be solved soon. The
1163     jackd1 package can be installed manually for those that need it.</li>
1164 <li>Some packages lack translations. See
1165     http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status,
1166     and help out with translations.</li>
1167 </ul>
1168
1169 <p>To download this multiarch netinstall release you can use</p>
1170
1171 <ul>
1172 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
1173 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
1174 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</li>
1175 </ul>
1176 <p>To download this multiarch dvd release you can use</p>
1177
1178 <ul>
1179 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
1180 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
1181 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</li>
1182 </ul>
1183
1184 <p>There is no source DVD available yet. It will be prepared when we
1185 get closer to the final release.</p>
1186
1187 <p>The MD5SUM of these images are</p>
1188
1189 <ul>
1190 <li>3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-6.0.0+edua0-CD.iso</li>
1191 <li>22f2cbfce281d1c6e478be452638675d debian-edu-6.0.0+edua0-DVD.iso</li>
1192 </ul>
1193
1194 <p>The SHA1SUM of these images are</p>
1195 <ul>
1196 <li>c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-6.0.0+edua0-CD.iso</li>
1197 <li>2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-6.0.0+edua0-DVD.iso</li>
1198 </ul>
1199 <p>How to report bugs:
1200 http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla</p>
1201
1202 <p>Please direct replies to debian-edu@lists.debian.org</p>
1203 </blockquote>
1204
1205  </div>
1206  <div class="tags">
1207
1208
1209
1210   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1211
1212  </div>
1213 </div>
1214  <div class="padding"></div>
1215
1216 <div class="entry">
1217  <div class="title">
1218  <a href="http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html">Circular package dependencies harms apt recovery</a>
1219  </div>
1220  <div class="date">
1221   2010-07-27 23:50
1222  </div>
1223
1224  <div class="body">
1225
1226 <p>I discovered this while doing
1227 <a href="http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html">automated
1228 testing of upgrades from Debian Lenny to Squeeze</a>.  A few packages
1229 in Debian still got circular dependencies, and it is often claimed
1230 that apt and aptitude should be able to handle this just fine, but
1231 some times these dependency loops causes apt to fail.</p>
1232
1233 <p>An example is from todays
1234 <a href="http://people.skolelinux.org/~pere/debian-upgrade-testing//test-20100727-lenny-squeeze-kde-aptitude.txt">upgrade
1235 of KDE using aptitude</a>.  In it, a bug in kdebase-workspace-data
1236 causes perl-modules to fail to upgrade.  The cause is simple.  If a
1237 package fail to unpack, then only part of packages with the circular
1238 dependency might end up being unpacked when unpacking aborts, and the
1239 ones already unpacked will fail to configure in the recovery phase
1240 because its dependencies are unavailable.</p>
1241
1242 <p>In this log, the problem manifest itself with this error:</p>
1243
1244 <blockquote><pre>
1245 dpkg: dependency problems prevent configuration of perl-modules:
1246  perl-modules depends on perl (>= 5.10.1-1); however:
1247   Version of perl on system is 5.10.0-19lenny2.
1248 dpkg: error processing perl-modules (--configure):
1249  dependency problems - leaving unconfigured
1250 </pre></blockquote>
1251
1252 <p>The perl/perl-modules circular dependency is already
1253 <a href="http://bugs.debian.org/527917">reported as a bug</a>, and will
1254 hopefully be solved as soon as possible, but it is not the only one,
1255 and each one of these loops in the dependency tree can cause similar
1256 failures.  Of course, they only occur when there are bugs in other
1257 packages causing the unpacking to fail, but it is rather nasty when
1258 the failure of one package causes the problem to become worse because
1259 of dependency loops.</p>
1260
1261 <p>Thanks to
1262 <a href="http://lists.debian.org/debian-devel/2010/06/msg00116.html">the
1263 tireless effort by Bill Allombert</a>, the number of circular
1264 dependencies
1265 <a href="http://debian.semistable.com/debgraph.out.html">left in Debian
1266 is dropping</a>, and perhaps it will reach zero one day. :)</p>
1267
1268 <p>Todays testing also exposed a bug in
1269 <a href="http://bugs.debian.org/590605">update-notifier</a> and
1270 <a href="http://bugs.debian.org/590604">different behaviour</a> between
1271 apt-get and aptitude, the latter possibly caused by some circular
1272 dependency.  Reported both to BTS to try to get someone to look at
1273 it.</p>
1274
1275  </div>
1276  <div class="tags">
1277
1278
1279
1280   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1281
1282  </div>
1283 </div>
1284  <div class="padding"></div>
1285
1286  <p style="text-align: right;"><a href="07.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14"></a></p>
1287
1288
1289
1290 <div id="sidebar">
1291
1292 <h2>Archive</h2>
1293 <ul>
1294
1295 <li>2011
1296 <ul>
1297
1298 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
1299
1300 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
1301
1302 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
1303
1304 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
1305
1306 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
1307
1308 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
1309
1310 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (6)</a></li>
1311
1312 </ul></li>
1313
1314 <li>2010
1315 <ul>
1316
1317 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
1318
1319 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
1320
1321 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1322
1323 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1324
1325 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1326
1327 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1328
1329 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
1330
1331 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
1332
1333 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
1334
1335 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
1336
1337 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
1338
1339 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
1340
1341 </ul></li>
1342
1343 <li>2009
1344 <ul>
1345
1346 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1347
1348 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1349
1350 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1351
1352 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1353
1354 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1355
1356 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1357
1358 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1359
1360 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1361
1362 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1363
1364 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1365
1366 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1367
1368 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1369
1370 </ul></li>
1371
1372 <li>2008
1373 <ul>
1374
1375 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1376
1377 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1378
1379 </ul></li>
1380
1381 </ul>
1382
1383
1384
1385 <h2>Tags</h2>
1386 <ul>
1387
1388  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (13)</a></li>
1389
1390  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1391
1392  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1393
1394  <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (2)</a></li>
1395
1396  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
1397
1398  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (51)</a></li>
1399
1400  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (64)</a></li>
1401
1402  <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (7)</a></li>
1403
1404  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (93)</a></li>
1405
1406  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (12)</a></li>
1407
1408  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (11)</a></li>
1409
1410  <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (10)</a></li>
1411
1412  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (15)</a></li>
1413
1414  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
1415
1416  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (4)</a></li>
1417
1418  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1419
1420  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (13)</a></li>
1421
1422  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (129)</a></li>
1423
1424  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (118)</a></li>
1425
1426  <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
1427
1428  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (21)</a></li>
1429
1430  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (40)</a></li>
1431
1432  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
1433
1434  <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (2)</a></li>
1435
1436  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (4)</a></li>
1437
1438  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1439
1440  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (23)</a></li>
1441
1442  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
1443
1444  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (24)</a></li>
1445
1446  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
1447
1448  <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (2)</a></li>
1449
1450  <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (9)</a></li>
1451
1452  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (20)</a></li>
1453
1454  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
1455
1456  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (16)</a></li>
1457
1458 </ul>
1459
1460 </div>
1461 </body>
1462 </html>