1 <?xml version=
"1.0" encoding=
"utf-8"?>
2 <rss version='
2.0' xmlns:lj='http://www.livejournal.org/rss/lj/
1.0/' xmlns:
atom=
"http://www.w3.org/2005/Atom">
4 <title>Petter Reinholdtsen
</title>
5 <description></description>
6 <link>http://people.skolelinux.org/pere/blog/
</link>
7 <atom:link href=
"http://people.skolelinux.org/pere/blog/index.rss" rel=
"self" type=
"application/rss+xml" />
10 <title>More flexible firmware handling in debian-installer
</title>
11 <link>http://people.skolelinux.org/pere/blog/More_flexible_firmware_handling_in_debian_installer.html
</link>
12 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/More_flexible_firmware_handling_in_debian_installer.html
</guid>
13 <pubDate>Sat,
22 May
2010 21:
30:
00 +
0200</pubDate>
15 <p
>After a long break from debian-installer development, I finally
16 found time today to return to the project. Having to spend less time
17 working dependency based boot in debian, as it is almost complete now,
18 definitely helped freeing some time.
</p
>
20 <p
>A while back, I ran into a problem while working on Debian Edu. We
21 include some firmware packages on the Debian Edu CDs, those needed to
22 get disk and network controllers working. Without having these
23 firmware packages available during installation, it is impossible to
24 install Debian Edu on the given machine, and because our target group
25 are non-technical people, asking them to provide firmware packages on
26 an external medium is a support pain. Initially, I expected it to be
27 enough to include the firmware packages on the CD to get
28 debian-installer to find and use them. This proved to be wrong.
29 Next, I hoped it was enough to symlink the relevant firmware packages
30 to some useful location on the CD (tried /cdrom/ and
31 /cdrom/firmware/). This also proved to not work, and at this point I
32 found time to look at the debian-installer code to figure out what was
33 going to work.
</p
>
35 <p
>The firmware loading code is in the hw-detect package, and a closer
36 look revealed that it would only look for firmware packages outside
37 the installation media, so the CD was never checked for firmware
38 packages. It would only check USB sticks, floppies and other
39 "external
" media devices. Today I changed it to also look in the
40 /cdrom/firmware/ directory on the mounted CD or DVD, which should
41 solve the problem I ran into with Debian edu. I also changed it to
42 look in /firmware/, to make sure the installer also find firmware
43 provided in the initrd when booting the installer via PXE, to allow us
44 to provide the same feature in the PXE installer provided in Debian
47 <p
>To make sure firmware deb packages with a license questions are not
48 activated without asking if the license is accepted, I extended
49 hw-detect to look for preinst scripts in the firmware packages, and
50 run these before activating the firmware during installation. The
51 license question is asked using debconf in the preinst, so this should
52 solve the issue for the firmware packages I have looked at so far.
</p
>
54 <p
>If you want to discuss the details of these features, please
55 contact us on debian-boot@lists.debian.org.
</p
>
60 <title>Magnetstripeinnhold i billetter fra Flytoget og Hurtigruten
</title>
61 <link>http://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html
</link>
62 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html
</guid>
63 <pubDate>Fri,
21 May
2010 16:
00:
00 +
0200</pubDate>
65 <p
>For en stund tilbake kjøpte jeg en magnetkortleser for å kunne
66 titte på hva som er skrevet inn på magnetstripene til ulike kort. Har
67 ikke hatt tid til å analysere mange kort så langt, men tenkte jeg
68 skulle dele innholdet på to kort med mine lesere.
</p
>
70 <p
>For noen dager siden tok jeg flyet til Harstad og Hurtigruten til
71 Bergen. Flytoget fra Oslo S til flyplassen ga meg en billett med
72 magnetstripe. Påtrykket finner jeg følgende informasjon:
</p
>
75 Flytoget Airport Express Train
77 Fra - Til : Oslo Sentralstasjon
80 Herav mva.
8,
00% : NOK
12,
59
82 Til - Fra : Oslo Lufthavn
84 Gyldig Fra-Til :
08.05.10-
07.11.10
85 Billetttype : Enkeltbillett
87 102-
1015-
100508-
48382-
01-
08
90 <p
>På selve magnetstripen er innholdet
91 <tt
>;E?+
900120011=
23250996541068112619257138248441708433322932704083389389062603279671261502492655?
</tt
>.
92 Aner ikke hva innholdet representerer, og det er lite overlapp mellom
93 det jeg ser trykket på billetten og det jeg ser av tegn i
94 magnetstripen. Håper det betyr at de bruker kryptografiske metoder
95 for å gjøre det vanskelig å forfalske billetter.
</p
>
97 <p
>Den andre billetten er fra Hurtigruten, der jeg mistenker at
98 strekkoden på fronten er mer brukt enn magnetstripen (det var i hvert
99 fall den biten vi stakk inn i dørlåsen).
</p
>
101 <p
>Påtrykket forsiden er følgende:
</p
>
109 Bookingno: SAX69
0742193
111 Dep:
09.05.2010 Arr:
12.05.2010
116 <p
>På selve magnetstripen er innholdet
117 <tt
>;
1316010007421930=
00000000000000000000?+E?
</tt
>. Heller ikke her
118 ser jeg mye korrespondanse mellom påtrykk og magnetstripe.
</p
>
123 <title>Pieces of the roaming laptop puzzle in Debian
</title>
124 <link>http://people.skolelinux.org/pere/blog/Pieces_of_the_roaming_laptop_puzzle_in_Debian.html
</link>
125 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Pieces_of_the_roaming_laptop_puzzle_in_Debian.html
</guid>
126 <pubDate>Wed,
19 May
2010 19:
00:
00 +
0200</pubDate>
128 <p
>Today, the last piece of the puzzle for roaming laptops in Debian
129 Edu finally entered the Debian archive. Today, the new
130 <a href=
"http://packages.qa.debian.org/libp/libpam-mklocaluser.html
">libpam-mklocaluser
</a
>
131 package was accepted. Two days ago, two other pieces was accepted
133 <a href=
"http://packages.qa.debian.org/p/pam-python.html
">pam-python
</a
>
134 package needed by libpam-mklocaluser, and the
135 <a href=
"http://packages.qa.debian.org/s/sssd.html
">sssd
</a
> package
136 passed NEW on Monday. In addition, the
137 <a href=
"http://packages.qa.debian.org/libp/libpam-ccreds.html
">libpam-ccreds
</a
>
138 package we need is in experimental (version
10-
4) since Saturday, and
139 hopefully will be moved to unstable soon.
</p
>
141 <p
>This collection of packages allow for two different setups for
142 roaming laptops. The traditional setup would be using libpam-ccreds,
143 nscd and libpam-mklocaluser with LDAP or Kerberos authentication,
144 which should work out of the box if the configuration changes proposed
145 for nscd in
<a href=
"http://bugs.debian.org/
485282">BTS report
146 #
485282</a
> is implemented. The alternative setup is to use sssd with
147 libpam-mklocaluser to connect to LDAP or Kerberos and let sssd take
148 care of the caching of passwords and group information.
</p
>
150 <p
>I have so far been unable to get sssd to work with the LDAP server
151 at the University, but suspect the issue is some SSL/GnuTLS related
152 problem with the server certificate. I plan to update the Debian
153 package to version
1.2, which is scheduled for next week, and hope to
154 find time to make sure the next release will include both the
155 Debian/Ubuntu specific patches. Upstream is friendly and responsive,
156 and I am sure we will find a good solution.
</p
>
158 <p
>The idea is to set up the roaming laptops to authenticate using
159 LDAP or Kerberos and create a local user with home directory in /home/
160 when a usre in LDAP logs in via KDM or GDM for the first time, and
161 cache the password for offline checking, as well as caching group
162 memberhips and other relevant LDAP information. The
163 libpam-mklocaluser package was created to make sure the local home
164 directory is in /home/, instead of /site/server/directory/ which would
165 be the home directory if pam_mkhomedir was used. To avoid confusion
166 with support requests and configuration, we do not want local laptops
167 to have users in a path that is used for the same users home directory
168 on the home directory servers.
</p
>
170 <p
>One annoying problem with gdm is that it do not show the PAM
171 message passed to the user from libpam-mklocaluser when the local user
172 is created. Instead gdm simply reject the login with some generic
173 message. The message is shown in kdm, ssh and login, so I guess it is
174 a bug in gdm. Have not investigated if there is some other message
175 type that can be used instead to get gdm to also show the message.
</p
>
177 <p
>If you want to help out with implementing this for Debian Edu,
178 please contact us on debian-edu@lists.debian.org.
</p
>
183 <title>Parallellized boot is now the default in Debian/unstable
</title>
184 <link>http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html
</link>
185 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html
</guid>
186 <pubDate>Fri,
14 May
2010 22:
40:
00 +
0200</pubDate>
188 <p
>Since this evening, parallel booting is the default in
189 Debian/unstable for machines using dependency based boot sequencing.
190 Apparently the testing of concurrent booting has been wider than
191 expected, if I am to believe the
192 <a href=
"http://lists.debian.org/debian-devel/
2010/
05/msg00122.html
">input
193 on debian-devel@
</a
>, and I concluded a few days ago to move forward
194 with the feature this weekend, to give us some time to detect any
195 remaining problems before Squeeze is frozen. If serious problems are
196 detected, it is simple to change the default back to sequential boot.
197 The upload of the new sysvinit package also activate a new upstream
200 More information about
201 <a href=
"http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot
">dependency
202 based boot sequencing
</a
> is available from the Debian wiki. It is
203 currently possible to disable parallel booting when one run into
204 problems caused by it, by adding this line to /etc/default/rcS:
</p
>
206 <blockquote
><pre
>
208 </pre
></blockquote
>
210 <p
>If you report any problems with dependencies in init.d scripts to
211 the BTS, please usertag the report to get it to show up at
212 <a href=
"http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org
">the
213 list of usertagged bugs related to this
</a
>.
</p
>
218 <title>Sitesummary tip: Listing MAC address of all clients
</title>
219 <link>http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html
</link>
220 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html
</guid>
221 <pubDate>Fri,
14 May
2010 21:
10:
00 +
0200</pubDate>
223 <p
>In the recent Debian Edu versions, the
224 <a href=
"http://wiki.debian.org/DebianEdu/HowTo/SiteSummary
">sitesummary
225 system
</a
> is used to keep track of the machines in the school
226 network. Each machine will automatically report its status to the
227 central server after boot and once per night. The network setup is
228 also reported, and using this information it is possible to get the
229 MAC address of all network interfaces in the machines. This is useful
230 to update the DHCP configuration.
</p
>
232 <p
>To give some idea how to use sitesummary, here is a one-liner to
233 ist all MAC addresses of all machines reporting to sitesummary. Run
234 this on the collector host:
</p
>
236 <blockquote
><pre
>
237 perl -MSiteSummary -e
'for_all_hosts(sub { print join(
" ", get_macaddresses(shift)),
"\n
"; });
'
238 </pre
></blockquote
>
240 <p
>This will list all MAC addresses assosiated with all machine, one
241 line per machine and with space between the MAC addresses.
</p
>
243 <p
>To allow system administrators easier job at adding static DHCP
244 addresses for hosts, it would be possible to extend this to fetch
245 machine information from sitesummary and update the DHCP and DNS
246 tables in LDAP using this information. Such tool is unfortunately not
247 written yet.
</p
>
252 <title>systemd, an interesting alternative to upstart
</title>
253 <link>http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html
</link>
254 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html
</guid>
255 <pubDate>Thu,
13 May
2010 22:
20:
00 +
0200</pubDate>
257 <p
>The last few days a new boot system called
258 <a href=
"http://www.freedesktop.org/wiki/Software/systemd
">systemd
</a
>
260 <a href=
"http://
0pointer.de/blog/projects/systemd.html
">introduced
</a
>
262 to the free software world. I have not yet had time to play around
263 with it, but it seem to be a very interesting alternative to
264 <a href=
"http://upstart.ubuntu.com/
">upstart
</a
>, and might prove to be
265 a good alternative for Debian when we are able to switch to an event
266 based boot system. Tollef is
267 <a href=
"http://bugs.debian.org/
580814">in the process
</a
> of getting
268 systemd into Debian, and I look forward to seeing how well it work. I
269 like the fact that systemd handles init.d scripts with dependency
270 information natively, allowing them to run in parallel where upstart
271 at the moment do not.
</p
>
273 <p
>Unfortunately do systemd have the same problem as upstart regarding
274 platform support. It only work on recent Linux kernels, and also need
275 some new kernel features enabled to function properly. This means
276 kFreeBSD and Hurd ports of Debian will need a port or a different boot
277 system. Not sure how that will be handled if systemd proves to be the
278 way forward.
</p
>
280 <p
>In the mean time, based on the
281 <a href=
"http://lists.debian.org/debian-devel/
2010/
05/msg00122.html
">input
282 on debian-devel@
</a
> regarding parallel booting in Debian, I have
283 decided to enable full parallel booting as the default in Debian as
284 soon as possible (probably this weekend or early next week), to see if
285 there are any remaining serious bugs in the init.d dependencies. A
286 new version of the sysvinit package implementing this change is
287 already in experimental. If all go well, Squeeze will be released
288 with parallel booting enabled by default.
</p
>
293 <title>Parallellizing the boot in Debian Squeeze - ready for wider testing
</title>
294 <link>http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html
</link>
295 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html
</guid>
296 <pubDate>Thu,
6 May
2010 23:
25:
00 +
0200</pubDate>
298 <p
>These days, the init.d script dependencies in Squeeze are quite
299 complete, so complete that it is actually possible to run all the
300 init.d scripts in parallell based on these dependencies. If you want
301 to test your Squeeze system, make sure
302 <a href=
"http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot
">dependency
303 based boot sequencing
</a
> is enabled, and add this line to
304 /etc/default/rcS:
</p
>
306 <blockquote
><pre
>
308 </pre
></blockquote
>
310 <p
>That is it. It will cause sysv-rc to use the startpar tool to run
311 scripts in parallel using the dependency information stored in
312 /etc/init.d/.depend.boot, /etc/init.d/.depend.start and
313 /etc/init.d/.depend.stop to order the scripts. Startpar is configured
314 to try to start the kdm and gdm scripts as early as possible, and will
315 start the facilities required by kdm or gdm as early as possible to
316 make this happen.
</p
>
318 <p
>Give it a try, and see if you like the result. If some services
319 fail to start properly, it is most likely because they have incomplete
320 init.d script dependencies in their startup script (or some of their
321 dependent scripts have incomplete dependencies). Report bugs and get
322 the package maintainers to fix it. :)
</p
>
324 <p
>Running scripts in parallel could be the default in Debian when we
325 manage to get the init.d script dependencies complete and correct. I
326 expect we will get there in Squeeze+
1, if we get manage to test and
327 fix the remaining issues.
</p
>
329 <p
>If you report any problems with dependencies in init.d scripts to
330 the BTS, please usertag the report to get it to show up at
331 <a href=
"http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org
">the
332 list of usertagged bugs related to this
</a
>.
</p
>
337 <title>Forcing new users to change their password on first login
</title>
338 <link>http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html
</link>
339 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html
</guid>
340 <pubDate>Sun,
2 May
2010 13:
47:
00 +
0200</pubDate>
342 <p
>One interesting feature in Active Directory, is the ability to
343 create a new user with an expired password, and thus force the user to
344 change the password on the first login attempt.
</p
>
346 <p
>I
'm not quite sure how to do that with the LDAP setup in Debian
347 Edu, but did some initial testing with a local account. The account
348 and password aging information is available in /etc/shadow, but
349 unfortunately, it is not possible to specify an expiration time for
350 passwords, only a maximum age for passwords.
</p
>
352 <p
>A freshly created account (using adduser test) will have these
353 settings in /etc/shadow:
</p
>
355 <blockquote
><pre
>
356 root@tjener:~# chage -l test
357 Last password change : May
02,
2010
358 Password expires : never
359 Password inactive : never
360 Account expires : never
361 Minimum number of days between password change :
0
362 Maximum number of days between password change :
99999
363 Number of days of warning before password expires :
7
365 </pre
></blockquote
>
367 <p
>The only way I could come up with to create a user with an expired
368 account, is to change the date of the last password change to the
369 lowest value possible (January
1th
1970), and the maximum password age
370 to the difference in days between that date and today. To make it
371 simple, I went for
30 years (
30 *
365 =
10950) and January
2th (to
372 avoid testing if
0 is a valid value).
</p
>
374 <p
>After using these commands to set it up, it seem to work as
377 <blockquote
><pre
>
378 root@tjener:~# chage -d
1 test; chage -M
10950 test
379 root@tjener:~# chage -l test
380 Last password change : Jan
02,
1970
381 Password expires : never
382 Password inactive : never
383 Account expires : never
384 Minimum number of days between password change :
0
385 Maximum number of days between password change :
10950
386 Number of days of warning before password expires :
7
388 </pre
></blockquote
>
390 <p
>So far I have tested this with ssh and console, and kdm (in
391 Squeeze) login, and all ask for a new password before login in the
392 user (with ssh, I was thrown out and had to log in again).
</p
>
394 <p
>Perhaps we should set up something similar for Debian Edu, to make
395 sure only the user itself have the account password?
</p
>
397 <p
>If you want to comment on or help out with implementing this for
398 Debian Edu, please contact us on debian-edu@lists.debian.org.
</p
>
400 <p
>Update
2010-
05-
02 17:
20: Paul Tötterman tells me on IRC that the
401 shadow(
8) page in Debian/testing now state that setting the date of
402 last password change to zero (
0) will force the password to be changed
403 on the first login. This was not mentioned in the manual in Lenny, so
404 I did not notice this in my initial testing. I have tested it on
405 Squeeze, and
'<tt
>chage -d
0 username
</tt
>' do work there. I have not
406 tested it on Lenny yet.
</p
>
408 <p
>Update
2010-
05-
02-
19:
05: Jim Paris tells me via email that an
409 equivalent command to expire a password is
'<tt
>passwd -e
410 username
</tt
>', which insert zero into the date of the last password
416 <title>Thoughts on roaming laptop setup for Debian Edu
</title>
417 <link>http://people.skolelinux.org/pere/blog/Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html
</link>
418 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html
</guid>
419 <pubDate>Wed,
28 Apr
2010 20:
40:
00 +
0200</pubDate>
421 <p
>For some years now, I have wondered how we should handle laptops in
422 Debian Edu. The Debian Edu infrastructure is mostly designed to
423 handle stationary computers, and less suited for computers that come
426 <p
>Now I finally believe I have an sensible idea on how to adjust
427 Debian Edu for laptops, by introducing a new profile for them, for
428 example called Roaming Workstations. Here are my thought on this.
429 The setup would consist of the following:
</p
>
433 <li
>During installation, the user name of the owner / primary user of
434 the laptop is requested and a local home directory is set up for
435 the user, with uid and gid information fetched from the LDAP
436 server. This allow the user to work also when offline. The
437 central home directory can be available in a subdirectory on
438 request, for example mounted via CIFS. It could be mounted
439 automatically when a user log in while on the Debian Edu network,
440 and unmounted when the machine is taken away (network down,
441 hibernate, etc), it can be set up to do automatic mounting on
442 request (using autofs), or perhaps some GUI button on the desktop
443 can be used to access it when needed. Perhaps it is enough to use
444 the fish protocol in KDE?
</li
>
446 <li
>Password checking is set up to use LDAP or Kerberos
447 authentication when the machine is on the Debian Edu network, and
448 to cache the password for offline checking when the machine unable
449 to reach the LDAP or Kerberos server. This can be done using
450 <a href=
"http://www.padl.com/OSS/pam_ccreds.html
">libpam-ccreds
</a
>
451 or the Fedora developed
452 <a href=
"https://fedoraproject.org/wiki/Features/SSSD
">System
453 Security Services Daemon
</a
> packages.
</li
>
455 <li
>File synchronisation with the central home directory is set up
456 using a shared directory in both the local and the central home
457 directory, using unison.
</li
>
459 <li
>Printing should be set up to print to all printers broadcasting
460 their existence on the local network, and should then work out of
461 the box with CUPS. For sites needing accurate printer quotas, some
462 system with Kerberos authentication or printing via ssh could be
463 implemented.
</li
>
465 <li
>For users that should have local root access to their laptop,
466 sudo should be used to allow this to the local user.
</li
>
468 <li
>It would be nice if user and group information from LDAP is
469 cached on the client, but given that there are entries for the
470 local user and primary group in /etc/, it should not be needed.
</li
>
474 <p
>I believe all the pieces to implement this are in Debian/testing at
475 the moment. If we work quickly, we should be able to get this ready
476 in time for the Squeeze release to freeze. Some of the pieces need
477 tweaking, like libpam-ccreds should get support for pam-auth-update
478 (
<a href=
"http://bugs.debian.org/
566718">#
566718</a
>) and nslcd (or
479 perhaps debian-edu-config) should get some integration code to stop
480 its daemon when the LDAP server is unavailable to avoid long timeouts
481 when disconnected from the net. If we get Kerberos enabled, we need
482 to make sure we avoid long timeouts there too.
</p
>
484 <p
>If you want to help out with implementing this for Debian Edu,
485 please contact us on debian-edu@lists.debian.org.
</p
>
490 <title>Great book:
"Content: Selected Essays on Technology, Creativity, Copyright, and the Future of the Future
"</title>
491 <link>http://people.skolelinux.org/pere/blog/Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html
</link>
492 <guid isPermaLink=
"true">http://people.skolelinux.org/pere/blog/Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html
</guid>
493 <pubDate>Mon,
19 Apr
2010 17:
10:
00 +
0200</pubDate>
495 <p
>The last few weeks i have had the pleasure of reading a
496 thought-provoking collection of essays by Cory Doctorow, on topics
497 touching copyright, virtual worlds, the future of man when the
498 conscience mind can be duplicated into a computer and many more. The
499 book titled
"Content: Selected Essays on Technology, Creativity,
500 Copyright, and the Future of the Future
" is available with few
501 restrictions on the web, for example from
502 <a href=
"http://craphound.com/content/
">his own site
</a
>. I read the
504 <a href=
"http://www.feedbooks.com/book/
2883">feedbooks
</a
> using
505 <a href=
"http://www.fbreader.org/
">fbreader
</a
> and my N810. I
506 strongly recommend this book.
</p
>
projects / homepage.git / blob