blog/archive/2010/07/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
   4   <head>
   5     <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
   6     <title>Petter Reinholdtsen: entries from July 2010</title>
   7     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css" />
   8     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/vim.css" />
   9     <link rel="alternate" title="RSS Feed" href="07.rss" type="application/rss+xml" />
  10   </head>
  11   <body>
  12     <!-- XML FEED -->
  13     <div class="title">
  14  <h1>
  15      <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  16
  17  </h1>
  18
  19 </div>
  20
  21
  22     <h3>Entries from July 2010.</h3>
  23
  24     <div class="entry">
  25       <div class="title">
  26         <a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a>
  27       </div>
  28       <div class="date">
  29          1st July 2010
  30       </div>
  31       <div class="body">
  32         <p>For a laptop, centralized user directories and password checking is
  33 a bit troubling.  Laptops are typically used also when not connected
  34 to the network, and it is vital for a user to be able to log in or
  35 unlock the screen saver also when a central server is unavailable.
  36 This is possible by caching passwords and directory information (user
  37 and group attributes) locally, and the packages to do so are available
  38 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
  39 It is also possible to set up in Debian/Lenny, but require more manual
  40 setup there because pam-auth-update is missing in Lenny.</p>
  41
  42 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
  43
  44 This is the traditional method with a twist.  The password caching is
  45 provided by libpam-ccreds (version 10-4 or later is needed on
  46 Squeeze), and the directory caching is done by nscd.  The directory
  47 lookup and password checking is done using LDAP.  If one want to use
  48 Kerberos for password checking the libpam-ldapd package can be
  49 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
  50 local home directory with the path listed in LDAP, one can use the
  51 pam_mkhomedir module from pam-modules to make this happen instead of
  52 using libpam-mklocaluser.  A setup for pam-auth-update to enable
  53 pam_mkhomedir will have to be written until a fix for
  54 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
  55 archive.  Because I believe it is a bad idea to have local home
  56 directories using misleading paths like /site/server/partition/, I
  57 prefer to create a local user with the home directory in /home/.  This
  58 is done using the libpam-mklocaluser package.</p>
  59
  60 <p>These packages need to be installed and configured</p>
  61
  62 <blockquote><pre>
  63 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
  64 </pre></blockquote>
  65
  66 <p>The ldapd packages will ask for LDAP connection information, and
  67 one have to fill in the values that fits ones own site.  Make sure the
  68 PAM part uses encrypted connections, to make sure the password is not
  69 sent in clear text to the LDAP server.  I've been unable to get TLS
  70 certificate checking for a self signed certificate working, which make
  71 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
  72 is talking to the correct LDAP server), and very much welcome feedback
  73 on how to get this working.</p>
  74
  75 <p>Because nscd do not have a default configuration fit for offline
  76 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
  77 is fixed, this configuration should be used instead of the one
  78 currently in /etc/nscd.conf.  The changes are in the fields
  79 reload-count and positive-time-to-live, and is based on the
  80 instructions I found in the
  81 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
  82 instructions by Flyn Computing.</p>
  83
  84 <blockquote><pre>
  85         debug-level             0
  86         reload-count            unlimited
  87         paranoia                no
  88
  89         enable-cache            passwd          yes
  90         positive-time-to-live   passwd          2592000
  91         negative-time-to-live   passwd          20
  92         suggested-size          passwd          211
  93         check-files             passwd          yes
  94         persistent              passwd          yes
  95         shared                  passwd          yes
  96         max-db-size             passwd          33554432
  97         auto-propagate          passwd          yes
  98
  99         enable-cache            group           yes
 100         positive-time-to-live   group           2592000
 101         negative-time-to-live   group           20
 102         suggested-size          group           211
 103         check-files             group           yes
 104         persistent              group           yes
 105         shared                  group           yes
 106         max-db-size             group           33554432
 107         auto-propagate          group           yes
 108
 109         enable-cache            hosts           no
 110         positive-time-to-live   hosts           2592000
 111         negative-time-to-live   hosts           20
 112         suggested-size          hosts           211
 113         check-files             hosts           yes
 114         persistent              hosts           yes
 115         shared                  hosts           yes
 116         max-db-size             hosts           33554432
 117
 118         enable-cache            services        yes
 119         positive-time-to-live   services        2592000
 120         negative-time-to-live   services        20
 121         suggested-size          services        211
 122         check-files             services        yes
 123         persistent              services        yes
 124         shared                  services        yes
 125         max-db-size             services        33554432
 126 </pre></blockquote>
 127
 128 <p>While we wait for a mechanism to update /etc/nsswitch.conf
 129 automatically like the one provided in
 130 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
 131 content need to be manually replaced to ensure LDAP is used as the
 132 directory service on the machine.  /etc/nsswitch.conf should normally
 133 look like this:</p>
 134
 135 <blockquote><pre>
 136 passwd:         files ldap
 137 group:          files ldap
 138 shadow:         files ldap
 139 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 140 networks:       files
 141 protocols:      files
 142 services:       files
 143 ethers:         files
 144 rpc:            files
 145 netgroup:       files ldap
 146 </pre></blockquote>
 147
 148 <p>The important parts are that ldap is listed last for passwd, group,
 149 shadow and netgroup.</p>
 150
 151 <p>With these changes in place, any user in LDAP will be able to log
 152 in locally on the machine using for example kdm, get a local home
 153 directory created and have the password as well as user and group
 154 attributes cached.
 155
 156 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 157   libpam-mklocaluser/pam_mkhomedir</h2>
 158
 159 <p>Because nscd have had its share of problems, and seem to have
 160 problems doing proper caching, I've seen suggestions and recipes to
 161 use nss-updatedb to copy parts of the LDAP database locally when the
 162 LDAP database is available.  I have not tested such setup, because I
 163 discovered sssd.</p>
 164
 165 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
 166
 167 <p>A more flexible and robust setup than the nscd combination
 168 mentioned earlier that has shown up recently, is the
 169 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
 170 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
 171 to provide a Active Directory like directory service for Linux
 172 machines.  The sssd system combines the caching of passwords and user
 173 information into one package, and remove the need for nscd and
 174 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 175 1.2 do not support netgroups, but it is said that it will support this
 176 in version 1.5 expected to show up later in 2010.  Because the
 177 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
 178 was missing in Debian, I ended up co-maintaining it with Werner, and
 179 version 1.2 is now in testing.
 180
 181 <p>These packages need to be installed and configured to get the
 182 roaming setup I want</p>
 183
 184 <blockquote><pre>
 185 libpam-sss libnss-sss libpam-mklocaluser
 186 </pre></blockquote>
 187
 188 The complete setup of sssd is done by editing/creating
 189 <tt>/etc/sssd/sssd.conf</tt>.
 190
 191 <blockquote><pre>
 192 [sssd]
 193 config_file_version = 2
 194 reconnection_retries = 3
 195 sbus_timeout = 30
 196 services = nss, pam
 197 domains = INTERN
 198
 199 [nss]
 200 filter_groups = root
 201 filter_users = root
 202 reconnection_retries = 3
 203
 204 [pam]
 205 reconnection_retries = 3
 206
 207 [domain/INTERN]
 208 enumerate = false
 209 cache_credentials = true
 210
 211 id_provider = ldap
 212 auth_provider = ldap
 213 chpass_provider = ldap
 214
 215 ldap_uri = ldap://ldap
 216 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 217 ldap_tls_reqcert = never
 218 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 219 </pre></blockquote>
 220
 221 <p>I got the same problem here with certificate checking.  Had to set
 222 "ldap_tls_reqcert = never" to get it working.</p>
 223
 224 <p>With the libnss-sss package in testing at the moment, the
 225 nsswitch.conf file is update automatically, so there is no need to
 226 modify it manually.</p>
 227
 228 <p>If you want to help out with implementing this for Debian Edu,
 229 please contact us on debian-edu@lists.debian.org.</p>
 230
 231       </div>
 232       <div class="tags">
 233
 234
 235         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 236
 237
 238       </div>
 239     </div>
 240     <div class="padding"></div>
 241
 242     <div class="entry">
 243       <div class="title">
 244         <a href="http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html">Lenny->Squeeze upgrades, apt vs aptitude with the Gnome desktop</a>
 245       </div>
 246       <div class="date">
 247          3rd July 2010
 248       </div>
 249       <div class="body">
 250         <p>Here is a short update on my <a
 251 href="http://people.skolelinux.org/~pere/debian-upgrade-testing/">my
 252 Debian Lenny->Squeeze upgrade testing</a>.  Here is a summary of the
 253 difference for Gnome when it is upgraded by apt-get and aptitude.  I'm
 254 not reporting the status for KDE, because the upgrade crashes when
 255 aptitude try because of missing conflicts
 256 (<a href="http://bugs.debian.org/584861">#584861</a> and
 257 <a href="http://bugs.debian.org/585716">#585716</a>).</p>
 258
 259 <p>At the end of the upgrade test script, dpkg -l is executed to get a
 260 complete list of the installed packages.  Based on this I see these
 261 differences when I did a test run today.  As usual, I do not really
 262 know what the correct set of packages would be, but thought it best to
 263 publish the difference.</p>
 264
 265 <p>Installed using apt-get, missing with aptitude</p>
 266
 267 <blockquote><p>
 268   at-spi cpp-4.3 finger gnome-spell gstreamer0.10-gnomevfs
 269   libatspi1.0-0 libcupsys2 libeel2-data libgail-common libgdl-1-common
 270   libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin
 271   libgtksourceview-common libpt-1.10.10-plugins-alsa
 272   libpt-1.10.10-plugins-v4l libservlet2.4-java libxalan2-java
 273   libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip
 274   python-4suite-xml python-eggtrayicon python-gtkhtml2
 275   python-gtkmozembed svgalibg1 xserver-xephyr zip
 276 </p></blockquote>
 277
 278 <p>Installed using apt-get, removed with aptitude</p>
 279
 280 <blockquote><p>
 281   bluez-utils dhcdbd djvulibre-desktop epiphany-gecko
 282   gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager
 283   libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-50
 284   libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcurl3
 285   libdirectfb-1.0-0 libdvdread3 libedata-cal1.2-6 libedataserver1.2-9
 286   libeel2-2.20 libepc-1.0-1 libepc-ui-1.0-1 libexchange-storage1.2-3
 287   libfaad0 libgd2-noxpm libgda3-3 libgda3-common libggz2 libggzcore9
 288   libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnome-desktop-2
 289   libgnome-pilot2 libgnomecups1.0-1 libgnomeprint2.2-0
 290   libgnomeprintui2.2-0 libgpod3 libgraphviz4 libgtkhtml2-0
 291   libgtksourceview1.0-0 libgucharmap6 libhesiod0 libicu38 libisccc50
 292   libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++10
 293   libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4
 294   libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5
 295   libparted1.8-10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3
 296   libpt-1.10.10 libraw1394-8 libsensors3 libsmbios2 libsoup2.2-8
 297   libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1
 298   libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj
 299   libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3
 300   mysql-common swfdec-gnome totem-gstreamer wodim
 301 </p></blockquote>
 302
 303 <p>Installed using aptitude, missing with apt-get</p>
 304
 305 <blockquote><p>
 306   gnome gnome-desktop-environment hamster-applet python-gnomeapplet
 307   python-gnomekeyring python-wnck rhythmbox-plugins xorg
 308   xserver-xorg-input-all xserver-xorg-input-evdev
 309   xserver-xorg-input-kbd xserver-xorg-input-mouse
 310   xserver-xorg-input-synaptics xserver-xorg-video-all
 311   xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati
 312   xserver-xorg-video-chips xserver-xorg-video-cirrus
 313   xserver-xorg-video-dummy xserver-xorg-video-fbdev
 314   xserver-xorg-video-glint xserver-xorg-video-i128
 315   xserver-xorg-video-i740 xserver-xorg-video-mach64
 316   xserver-xorg-video-mga xserver-xorg-video-neomagic
 317   xserver-xorg-video-nouveau xserver-xorg-video-nv
 318   xserver-xorg-video-r128 xserver-xorg-video-radeon
 319   xserver-xorg-video-radeonhd xserver-xorg-video-rendition
 320   xserver-xorg-video-s3 xserver-xorg-video-s3virge
 321   xserver-xorg-video-savage xserver-xorg-video-siliconmotion
 322   xserver-xorg-video-sis xserver-xorg-video-sisusb
 323   xserver-xorg-video-tdfx xserver-xorg-video-tga
 324   xserver-xorg-video-trident xserver-xorg-video-tseng
 325   xserver-xorg-video-vesa xserver-xorg-video-vmware
 326   xserver-xorg-video-voodoo
 327 </p></blockquote>
 328
 329 <p>Installed using aptitude, removed with apt-get</p>
 330
 331 <blockquote><p>
 332   deskbar-applet xserver-xorg xserver-xorg-core
 333   xserver-xorg-input-wacom xserver-xorg-video-intel
 334   xserver-xorg-video-openchrome
 335 </p></blockquote>
 336
 337 <p>I was told on IRC that the xorg-xserver package was
 338 <a href="http://git.debian.org/?p=pkg-xorg/xserver/xorg-server.git;a=commit;h=9c8080d06c457932d3bfec021c69ac000aa60120">changed
 339 in git</a> today to try to get apt-get to not remove xorg completely.
 340 No idea when it hits Squeeze, but when it does I hope it will reduce
 341 the difference somewhat.
 342
 343       </div>
 344       <div class="tags">
 345
 346
 347         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 348
 349
 350       </div>
 351     </div>
 352     <div class="padding"></div>
 353
 354     <div class="entry">
 355       <div class="title">
 356         <a href="http://people.skolelinux.org/pere/blog/MS_Word_kr_ller_det_til_for_politiet_.html">MS Word krøller det til for politiet?</a>
 357       </div>
 358       <div class="date">
 359          8th July 2010
 360       </div>
 361       <div class="body">
 362         <p>De siste dagene har Aftenposten
 363 <a href="http://www.aftenposten.no/nyheter/iriks/article3718597.ece">fortalt</a>
 364 <a href="http://www.aftenposten.no/nyheter/iriks/article3724249.ece">hvordan</a>
 365 politet har brukt skriveverktøy som ikke håndterer arabisk tekst og
 366 tekst som skal skrives fra høyre mot venstre når de har laget
 367 løpeseddel for å be om informasjon fra publikum.  Resultatet har vært
 368 en uleselig arabisk-bit på løpeseddelen.  Feilen har oppstått når
 369 teksten har blitt "kopiert inn i programvare som ikke har støtte for
 370 språk som skrives fra høyre mot venstre", og jeg er ganske sikker på
 371 at det er snakk om Microsoft Office i dette tilfellet.  Er det slik at
 372 MS Office i norsk språkdrakt ikke har støtte for tekst som skal
 373 skrives fra høyre mot venstre?  Jeg tror alle utgaver av
 374 OpenOffice.org har slik støtte, og det er jo ikke veldig vanskelig å
 375 la slik støtte finnes i alle utgaver av et program hvis støtten først
 376 er utviklet.  Aftenpostens melding får meg til å undre om problemet
 377 ville vært unngått hvis politiet brukte OpenOffice.org i stedet for MS
 378 Office.</p>
 379
 380 <p>Mon tro om det er flere eksempler på at MS Office har ødelagt for
 381 offentlig myndighet?</p>
 382
 383       </div>
 384       <div class="tags">
 385
 386
 387         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>.
 388
 389
 390       </div>
 391     </div>
 392     <div class="padding"></div>
 393
 394     <div class="entry">
 395       <div class="title">
 396         <a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a>
 397       </div>
 398       <div class="date">
 399          9th July 2010
 400       </div>
 401       <div class="body">
 402         <p>Since
 403 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
 404 last post</a> about available LDAP tools in Debian, I was told about a
 405 LDAP GUI that is even better than luma.  The java application
 406 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
 407 moving LDAP objects and subtrees using drag-and-drop, and can
 408 authenticate using Kerberos.  I have only tested the Kerberos
 409 authentication, but do not have a LDAP setup allowing me to rewrite
 410 LDAP with my test user yet.  It is
 411 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
 412 Debian</a> testing and unstable at the moment.  The only problem I
 413 have with it is how it handle errors.  If something go wrong, its
 414 non-intuitive behaviour require me to go through some query work list
 415 and remove the failing query.  Nothing big, but very annoying.</p>
 416
 417       </div>
 418       <div class="tags">
 419
 420
 421         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 422
 423
 424       </div>
 425     </div>
 426     <div class="padding"></div>
 427
 428     <div class="entry">
 429       <div class="title">
 430         <a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a>
 431       </div>
 432       <div class="date">
 433         11th July 2010
 434       </div>
 435       <div class="body">
 436         <p>Vagrant mentioned on IRC today that ltsp_config now support
 437 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
 438 clients, and that this can be used to fetch configuration from LDAP if
 439 Debian Edu choose to store configuration there.</p>
 440
 441 <p>Armed with this information, I got inspired and wrote a test module
 442 to get configuration from LDAP.  The idea is to look up the MAC
 443 address of the client in LDAP, and look for attributes on the form
 444 ltspconfigsetting=value, and use this to export SETTING=value to the
 445 LTSP clients.</p>
 446
 447 <p>The goal is to be able to store the LTSP configuration attributes
 448 in a "computer" LDAP object used by both DNS and DHCP, and thus
 449 allowing us to store all information about a computer in one place.</p>
 450
 451 <p>This is a untested draft implementation, and I welcome feedback on
 452 this approach.  A real LDAP schema for the ltspClientAux objectclass
 453 need to be written.  Comments, suggestions, etc?</p>
 454
 455 <blockquote><pre>
 456 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
 457 #
 458 # Fetch LTSP client settings from LDAP based on MAC address
 459 #
 460 # Uses ethernet address as stored in the dhcpHost objectclass using
 461 # the dhcpHWAddress attribute or ethernet address stored in the
 462 # ieee802Device objectclass with the macAddress attribute.
 463 #
 464 # This module is written to be schema agnostic, and only depend on the
 465 # existence of attribute names.
 466 #
 467 # The LTSP configuration variables are saved directly using a
 468 # ltspConfig prefix and uppercasing the rest of the attribute name.
 469 # To set the SERVER variable, set the ltspConfigServer attribute.
 470 #
 471 # Some LDAP schema should be created with all the relevant
 472 # configuration settings.  Something like this should work:
 473 #
 474 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
 475 #     SUP top
 476 #     AUXILIARY
 477 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
 478
 479 LDAPSERVER=$(debian-edu-ldapserver)
 480 if [ "$LDAPSERVER" ] ; then
 481     LDAPBASE=$(debian-edu-ldapserver -b)
 482     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
 483         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
 484         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
 485             grep '^ltspConfig' | while read attr value ; do
 486             # Remove prefix and convert to upper case
 487             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
 488             # bass value on to clients
 489             eval "$attr=$value; export $attr"
 490         done
 491     done
 492 fi
 493 </pre></blockquote>
 494
 495 <p>I'm not sure this shell construction will work, because I suspect
 496 the while block might end up in a subshell causing the variables set
 497 there to not show up in ltsp-config, but if that is the case I am sure
 498 the code can be restructured to make sure the variables are passed on.
 499 I expect that can be solved with some testing. :)</p>
 500
 501 <p>If you want to help out with implementing this for Debian Edu,
 502 please contact us on debian-edu@lists.debian.org.</p>
 503
 504 <p>Update 2010-07-17: I am aware of another effort to store LTSP
 505 configuration in LDAP that was created around year 2000 by
 506 <a href="http://www.pcxperience.com/thinclient/documentation/ldap.html">PC
 507 Xperience, Inc., 2000</a>.  I found its
 508 <a href="http://people.redhat.com/alikins/ltsp/ldap/">files</a> on a
 509 personal home page over at redhat.com.</p>
 510
 511       </div>
 512       <div class="tags">
 513
 514
 515         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 516
 517
 518       </div>
 519     </div>
 520     <div class="padding"></div>
 521
 522     <div class="entry">
 523       <div class="title">
 524         <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a>
 525       </div>
 526       <div class="date">
 527         14th July 2010
 528       </div>
 529       <div class="body">
 530         <p>For a while now, I have wanted to find a way to change the DNS and
 531 DHCP services in Debian Edu to use the same LDAP objects for a given
 532 computer, to avoid the possibility of having a inconsistent state for
 533 a computer in LDAP (as in DHCP but no DNS entry or the other way
 534 around) and make it easier to add computers to LDAP.</p>
 535
 536 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
 537 information finally found a solution that seem to work.</p>
 538
 539 <p>The old setup required three LDAP objects for a given computer.
 540 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
 541 we switch powerdns to use its strict LDAP method (ldap-method=strict
 542 in pdns-debian-edu.conf), the forward and reverse DNS entries are
 543 merged into one while making it impossible to transfer the reverse map
 544 to a slave DNS server.</p>
 545
 546 <p>If we also replace the object class used to get the DNS related
 547 attributes to one allowing these attributes to be combined with the
 548 dhcphost object class, we can merge the DNS and DHCP entries into one.
 549 I've written such object class in the dnsdomainaux.schema file (need
 550 proper OIDs, but that is a minor issue), and tested the setup.  It
 551 seem to work.</p>
 552
 553 <p>With this test setup in place, we can get away with one LDAP object
 554 for both DNS and DHCP, and even the LTSP configuration I suggested in
 555 an earlier email.  The combined LDAP object will look something like
 556 this:</p>
 557
 558 <blockquote><pre>
 559   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 560   cn: hostname
 561   objectClass: dhcphost
 562   objectclass: domainrelatedobject
 563   objectclass: dnsdomainaux
 564   associateddomain: hostname.intern
 565   arecord: 10.11.12.13
 566   dhcphwaddress: ethernet 00:00:00:00:00:00
 567   dhcpstatements: fixed-address hostname
 568   ldapconfigsound: Y
 569 </pre></blockquote>
 570
 571 <p>The DNS server uses the associateddomain and arecord entries, while
 572 the DHCP server uses the dhcphwaddress and dhcpstatements entries
 573 before asking DNS to resolve the fixed-adddress.  LTSP will use
 574 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
 575
 576 <p>I am not yet sure if I can get the DHCP server to look for its
 577 dhcphost in a different location, to allow us to put the objects
 578 outside the "DHCP Config" subtree, but hope to figure out a way to do
 579 that.  If I can't figure out a way to do that, we can still get rid of
 580 the hosts subtree and move all its content into the DHCP Config tree
 581 (which probably should be renamed to be more related to the new
 582 content.  I suspect cn=dnsdhcp,ou=services or something like that
 583 might be a good place to put it.</p>
 584
 585 <p>If you want to help out with implementing this for Debian Edu,
 586 please contact us on debian-edu@lists.debian.org.</p>
 587
 588       </div>
 589       <div class="tags">
 590
 591
 592         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 593
 594
 595       </div>
 596     </div>
 597     <div class="padding"></div>
 598
 599     <div class="entry">
 600       <div class="title">
 601         <a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a>
 602       </div>
 603       <div class="date">
 604         17th July 2010
 605       </div>
 606       <div class="body">
 607         <p>This is a
 608 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
 609 on my
 610 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
 611 work</a> on
 612 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
 613 all</a> the computer related LDAP objects in Debian Edu.</p>
 614
 615 <p>As a step to try to see if it possible to merge the DNS and DHCP
 616 LDAP objects, I have had a look at how the packages pdns-backend-ldap
 617 and dhcp3-server-ldap in Debian use the LDAP server.  The two
 618 implementations are quite different in how they use LDAP.</p>
 619
 620 To get this information, I started slapd with debugging enabled and
 621 dumped the debug output to a file to get the LDAP searches performed
 622 on a Debian Edu main-server.  Here is a summary.
 623
 624 <p><strong>powerdns</strong></p>
 625
 626 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
 627 on how to</a> set up PowerDNS to use a LDAP backend is available on
 628 the web.
 629
 630 <p>PowerDNS have two modes of operation using LDAP as its backend.
 631 One "strict" mode where the forward and reverse DNS lookups are done
 632 using the same LDAP objects, and a "tree" mode where the forward and
 633 reverse entries are in two different subtrees in LDAP with a structure
 634 based on the DNS names, as in tjener.intern and
 635 2.2.0.10.in-addr.arpa.</p>
 636
 637 <p>In tree mode, the server is set up to use a LDAP subtree as its
 638 base, and uses a "base" scoped search for the DNS name by adding
 639 "dc=tjener,dc=intern," to the base with a filter for
 640 "(associateddomain=tjener.intern)" for the forward entry and
 641 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
 642 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
 643 forward entries, it is looking for attributes named dnsttl, arecord,
 644 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
 645 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
 646 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
 647 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
 648 spfrecord and modifytimestamp.  For reverse entries it is looking for
 649 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
 650 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
 651 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
 652 ldapsearch commands could look like this:</p>
 653
 654 <blockquote><pre>
 655 ldapsearch -h ldap \
 656   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 657   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 658   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 659   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 660   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 661   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 662
 663 ldapsearch -h ldap \
 664   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 665   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
 666   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
 667   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
 668   srvrecord naptrrecord modifytimestamp
 669 </pre></blockquote>
 670
 671 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
 672 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
 673 example LDAP objects used there.  In addition to these objects, the
 674 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
 675 also exist.</p>
 676
 677 <blockquote><pre>
 678 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
 679 objectclass: top
 680 objectclass: dnsdomain
 681 objectclass: domainrelatedobject
 682 dc: tjener
 683 arecord: 10.0.2.2
 684 associateddomain: tjener.intern
 685
 686 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
 687 objectclass: top
 688 objectclass: dnsdomain2
 689 objectclass: domainrelatedobject
 690 dc: 2
 691 ptrrecord: tjener.intern
 692 associateddomain: 2.2.0.10.in-addr.arpa
 693 </pre></blockquote>
 694
 695 <p>In strict mode, the server behaves differently.  When looking for
 696 forward DNS entries, it is doing a "subtree" scoped search with the
 697 same base as in the tree mode for a object with filter
 698 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
 699 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
 700 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
 701 naptrrecord and modifytimestamp.  For reverse entires it also do a
 702 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
 703 and the requested attributes are associateddomain, dnsttl and
 704 modifytimestamp.  In short, in strict mode the objects with ptrrecord
 705 go away, and the arecord attribute in the forward object is used
 706 instead.</p>
 707
 708 <p>The forward and reverse searches can be simulated using ldapsearch
 709 like this:</p>
 710
 711 <blockquote><pre>
 712 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 713   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 714   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 715   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 716   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 717   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 718
 719 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 720   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
 721 </pre></blockquote>
 722
 723 <p>In addition to the forward and reverse searches , there is also a
 724 search for SOA records, which behave similar to the forward and
 725 reverse lookups.</p>
 726
 727 <p>A thing to note with the PowerDNS behaviour is that it do not
 728 specify any objectclass names, and instead look for the attributes it
 729 need to generate a DNS reply.  This make it able to work with any
 730 objectclass that provide the needed attributes.</p>
 731
 732 <p>The attributes are normally provided in the cosine (RFC 1274) and
 733 dnsdomain2 schemas.  The latter is used for reverse entries like
 734 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
 735
 736 <p>In Debian Edu, we have created DNS objects using the object classes
 737 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
 738 attributes) and domainrelatedobject (for associatedDomain).  The use
 739 of structural object classes make it impossible to combine these
 740 classes with the object classes used by DHCP.</p>
 741
 742 <p>There are other schemas that could be used too, for example the
 743 dnszone structural object class used by Gosa and bind-sdb for the DNS
 744 attributes combined with the domainrelatedobject object class, but in
 745 this case some unused attributes would have to be included as well
 746 (zonename and relativedomainname).</p>
 747
 748 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
 749 mode and not use any of the existing objectclasses (dnsdomain,
 750 dnsdomain2 and dnszone) when one want to combine the DNS information
 751 with DHCP information, and instead create a auxiliary object class
 752 defined something like this (using the attributes defined for
 753 dnsdomain and dnsdomain2 or dnszone):</p>
 754
 755 <blockquote><pre>
 756 objectclass ( some-oid NAME 'dnsDomainAux'
 757     SUP top
 758     AUXILIARY
 759     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
 760           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
 761           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
 762           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
 763           A6Record $ DNAMERecord
 764     ))
 765 </pre></blockquote>
 766
 767 <p>This will allow any object to become a DNS entry when combined with
 768 the domainrelatedobject object class, and allow any entity to include
 769 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
 770 developers asking for their view on this schema and if they are
 771 interested in providing such schema with PowerDNS, and I hope my
 772 message will be accepted into their mailing list soon.</p>
 773
 774 <p><strong>ISC dhcp</strong></p>
 775
 776 <p>The DHCP server searches for specific objectclass and requests all
 777 the object attributes, and then uses the attributes it want.  This
 778 make it harder to figure out exactly what attributes are used, but
 779 thanks to the working example in Debian Edu I can at least get an idea
 780 what is needed without having to read the source code.</p>
 781
 782 <p>In the DHCP server configuration, the LDAP base to use and the
 783 search filter to use to locate the correct dhcpServer entity is
 784 stored.  These are the relevant entries from
 785 /etc/dhcp3/dhcpd.conf:</p>
 786
 787 <blockquote><pre>
 788 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
 789 ldap-dhcp-server-cn "dhcp";
 790 </pre></blockquote>
 791
 792 <p>The DHCP server uses this information to nest all the DHCP
 793 configuration it need.  The cn "dhcp" is located using the given LDAP
 794 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
 795 search result is this entry:</p>
 796
 797 <blockquote><pre>
 798 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
 799 cn: dhcp
 800 objectClass: top
 801 objectClass: dhcpServer
 802 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 803 </pre></blockquote>
 804
 805 <p>The content of the dhcpServiceDN attribute is next used to locate the
 806 subtree with DHCP configuration.  The DHCP configuration subtree base
 807 is located using a base scope search with base "cn=DHCP
 808 Config,dc=skole,dc=skolelinux,dc=no" and filter
 809 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
 810 The search result is this entry:</p>
 811
 812 <blockquote><pre>
 813 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 814 cn: DHCP Config
 815 objectClass: top
 816 objectClass: dhcpService
 817 objectClass: dhcpOptions
 818 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
 819 dhcpStatements: ddns-update-style none
 820 dhcpStatements: authoritative
 821 dhcpOption: smtp-server code 69 = array of ip-address
 822 dhcpOption: www-server code 72 = array of ip-address
 823 dhcpOption: wpad-url code 252 = text
 824 </pre></blockquote>
 825
 826 <p>Next, the entire subtree is processed, one level at the time.  When
 827 all the DHCP configuration is loaded, it is ready to receive requests.
 828 The subtree in Debian Edu contain objects with object classes
 829 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
 830 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
 831 and information about netmasks, dynamic range etc.  Leaving out the
 832 details here because it is not relevant for the focus of my
 833 investigation, which is to see if it is possible to merge dns and dhcp
 834 related computer objects.</p>
 835
 836 <p>When a DHCP request come in, LDAP is searched for the MAC address
 837 of the client (00:00:00:00:00:00 in this example), using a subtree
 838 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
 839 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
 840 00:00:00:00:00:00))" as the filter.  This is what a host object look
 841 like:</p>
 842
 843 <blockquote><pre>
 844 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 845 cn: hostname
 846 objectClass: top
 847 objectClass: dhcpHost
 848 dhcpHWAddress: ethernet 00:00:00:00:00:00
 849 dhcpStatements: fixed-address hostname
 850 </pre></blockquote>
 851
 852 <p>There is less flexiblity in the way LDAP searches are done here.
 853 The object classes need to have fixed names, and the configuration
 854 need to be stored in a fairly specific LDAP structure.  On the
 855 positive side, the invidiual dhcpHost entires can be anywhere without
 856 the DN pointed to by the dhcpServer entries.  The latter should make
 857 it possible to group all host entries in a subtree next to the
 858 configuration entries, and this subtree can also be shared with the
 859 DNS server if the schema proposed above is combined with the dhcpHost
 860 structural object class.
 861
 862 <p><strong>Conclusion</strong></p>
 863
 864 <p>The PowerDNS implementation seem to be very flexible when it come
 865 to which LDAP schemas to use.  While its "tree" mode is rigid when it
 866 come to the the LDAP structure, the "strict" mode is very flexible,
 867 allowing DNS objects to be stored anywhere under the base cn specified
 868 in the configuration.</p>
 869
 870 <p>The DHCP implementation on the other hand is very inflexible, both
 871 regarding which LDAP schemas to use and which LDAP structure to use.
 872 I guess one could implement ones own schema, as long as the
 873 objectclasses and attributes have the names used, but this do not
 874 really help when the DHCP subtree need to have a fairly fixed
 875 structure.</p>
 876
 877 <p>Based on the observed behaviour, I suspect a LDAP structure like
 878 this might work for Debian Edu:</p>
 879
 880 <blockquote><pre>
 881 ou=services
 882   cn=machine-info (dhcpService) - dhcpServiceDN points here
 883     cn=dhcp (dhcpServer)
 884     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
 885       cn=10.0.2.0 (dhcpSubnet)
 886         cn=group1 (dhcpGroup/dhcpOptions)
 887     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
 888       cn=192.168.0.0 (dhcpSubnet)
 889         cn=group1 (dhcpGroup/dhcpOptions)
 890     ou=machines - PowerDNS base points here
 891       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
 892 </pre></blockquote>
 893
 894 <P>This is not tested yet.  If the DHCP server require the dhcpHost
 895 entries to be in the dhcpGroup subtrees, the entries can be stored
 896 there instead of a common machines subtree, and the PowerDNS base
 897 would have to be moved one level up to the machine-info subtree.</p>
 898
 899 <p>The combined object under the machines subtree would look something
 900 like this:</p>
 901
 902 <blockquote><pre>
 903 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
 904 dc: hostname
 905 objectClass: top
 906 objectClass: dhcpHost
 907 objectclass: domainrelatedobject
 908 objectclass: dnsDomainAux
 909 associateddomain: hostname.intern
 910 arecord: 10.11.12.13
 911 dhcpHWAddress: ethernet 00:00:00:00:00:00
 912 dhcpStatements: fixed-address hostname.intern
 913 </pre></blockquote>
 914
 915 </p>One could even add the LTSP configuration associated with a given
 916 machine, as long as the required attributes are available in a
 917 auxiliary object class.</p>
 918
 919       </div>
 920       <div class="tags">
 921
 922
 923         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 924
 925
 926       </div>
 927     </div>
 928     <div class="padding"></div>
 929
 930     <div class="entry">
 931       <div class="title">
 932         <a href="http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html">OpenStreetmap one step closer to having routing on its front page</a>
 933       </div>
 934       <div class="date">
 935         18th July 2010
 936       </div>
 937       <div class="body">
 938         <p>Thanks to
 939 <a href="http://feedproxy.google.com/~r/Opengeodata/~3/wUTCzDZk3lc/project-of-the-week-which-way-home">todays
 940 opengeodata blog entry</a>, I just discovered that the
 941 OpenStreetmap.org site have gotten
 942 <a href="http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT">support
 943 for calculating routes</a>.  The support is still experimental and
 944 only available from the development server, until more experience is
 945 gathered on the user interface and any scalability issues.</p>
 946
 947 <p>Earlier, the routing I knew about using the OpenStreetmap.org data
 948 was provided by <a href="http://maps.cloudmade.com/">Cloudmade</a>,
 949 but having it on the main page is required to make everyone aware of
 950 the issue.  I've had people reject Openstreetmap.org as a viable
 951 alternative for them because the front page lacked routing support,
 952 and I hope their needs will be catered for when routing show up on the
 953 www.openstreetmap.org front page.</p>
 954
 955       </div>
 956       <div class="tags">
 957
 958
 959         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/kart">kart</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 960
 961
 962       </div>
 963     </div>
 964     <div class="padding"></div>
 965
 966     <div class="entry">
 967       <div class="title">
 968         <a href="http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til___slutte___kj_pe_musikk.html">Digitale restriksjonsmekanismer fikk meg til å slutte å kjøpe musikk</a>
 969       </div>
 970       <div class="date">
 971         22nd July 2010
 972       </div>
 973       <div class="body">
 974         <p>For mange år siden slutte jeg å kjøpe musikk-CDer. Årsaken var at
 975 musikkbransjen var godt i gang med å selge platene sine med DRM som
 976 gjorde at jeg ikke fikk spilt av musikken jeg kjøpte på utstyret jeg
 977 hadde tilgjengelig, dvs. min datamaskin. Det var umulig å se på en
 978 plate om den var ødelagt eller ikke, og jeg hadde jo allerede en
 979 anseelig samling med plater, så jeg bestemme meg for å slutte å gi
 980 penger til en bransje som åpenbart ikke respekterte meg.</p>
 981
 982 <p>Jeg har mange titalls dager med musikk på CD i dag. Det meste er
 983 lagt i et stort arkiv som kan spilles av fra husets datamaskiner (har
 984 ikke rukket rippe alt). Jeg ser dermed ikke behovet for å skaffe mer
 985 musikk. De fleste av mine favoritter er i hus, og jeg er dermed godt
 986 fornøyd.</p>
 987
 988 <p>Hvis musikkbransjen ønsker mine penger, så må de demonstrere at de
 989 setter pris på meg som kunde, og ikke skremme meg bort med DRM og
 990 antydninger om at kundene er kriminelle.</p>
 991
 992 <p>Filmbransjen er like ille, men mens musikk gjerne varer lenge, er
 993 filmer mer ferskvare. Har dermed ikke helt sluttet å kjøpe filmer, men
 994 holder meg til DVD-filmer som kan spilles av på mine Linuxbokser.
 995 Kommer neppe til å ta i bruk Blueray, og ei heller de nye DRM-greiene
 996 «Ultraviolet» som be annonsert her om dagen.</p>
 997
 998       </div>
 999       <div class="tags">
1000
1001
1002         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>.
1003
1004
1005       </div>
1006     </div>
1007     <div class="padding"></div>
1008
1009     <div class="entry">
1010       <div class="title">
1011         <a href="http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html">One step closer to single signon in Debian Edu</a>
1012       </div>
1013       <div class="date">
1014         25th July 2010
1015       </div>
1016       <div class="body">
1017         <p>The last few months me and the other Debian Edu developers have
1018 been working hard to get the Debian/Squeeze based version of Debian
1019 Edu/Skolelinux into shape.  This future version will use Kerberos for
1020 authentication, and services are slowly migrated to single signon,
1021 getting rid of password questions one at the time.</p>
1022
1023 <p>It will also feature a roaming workstation profile with local home
1024 directory, for laptops that are only some times on the Skolelinux
1025 network, and for this profile a shortcut is created in Gnome and KDE
1026 to gain access to the users home directory on the file server.  This
1027 shortcut uses SMB at the moment, and yesterday I had time to test if
1028 SMB mounting had started working in KDE after we added the cifs-utils
1029 package.  I was pleasantly surprised how well it worked.</p>
1030
1031 <p>Thanks to the recent changes to our samba configuration to get it
1032 to use Kerberos for authentication, there were no question about user
1033 password when mounting the SMB volume.  A simple click on the shortcut
1034 in the KDE menu, and a window with the home directory popped
1035 up. :)</p>
1036
1037 <p>One step closer to a single signon solution out of the box in
1038 Debian Edu.  We already had PAM, LDAP, IMAP and SMTP in place, and now
1039 also Samba.  Next step is Cups and hopefully also NFS.</p>
1040
1041 <p>We had planned a alpha0 release of Debian Edu for today, but thanks
1042 to the autobuilder administrators for some architectures being slow to
1043 sign packages, we are still missing the fixed LTSP package we need for
1044 the release.  It was uploaded three days ago with urgency=high, and if
1045 it had entered testing yesterday we would have been able to test it in
1046 time for a alpha0 release today.  As the binaries for ia64 and powerpc
1047 still not uploaded to the Debian archive, we need to delay the alpha
1048 release another day.</p>
1049
1050 <p>If you want to help out with implementing Kerberos for Debian Edu,
1051 please contact us on debian-edu@lists.debian.org.</p>
1052
1053       </div>
1054       <div class="tags">
1055
1056
1057         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
1058
1059
1060       </div>
1061     </div>
1062     <div class="padding"></div>
1063
1064     <div class="entry">
1065       <div class="title">
1066         <a href="http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html">First Debian Edu test release (alpha0) based on Squeeze is released</a>
1067       </div>
1068       <div class="date">
1069         27th July 2010
1070       </div>
1071       <div class="body">
1072         <p>I just posted this announcement culminating several months of work
1073 with the next Debian Edu release.  Not nearly done, but one major step
1074 completed.</p>
1075
1076 <blockquote>
1077 <p>This is the first test release based on Squeeze. The focus of this
1078 release is to test the user application selection. To have a look,
1079 install the standalone profile and let the developers know if the set
1080 of installed packages i.e. applications should be modified. If some
1081 user application is missing, or if there are some applications that no
1082 longer make sense to be included in Debian Edu, please let us know.
1083 Also, if a useful application is missing the translation for your
1084 language of choice, please let us know too.</p>
1085
1086 <p>In addition, feedback and help to polish the desktop (menus,
1087 artwork, starters, etc.) is appreciated. We would like to ship a nice
1088 and handy KDE4 desktop targeted for schools out of the box.</p>
1089
1090 <p>The other profiles should be installable, but there is a lot more
1091 work left to be done before they are ready, so do not expect to
1092 much.</p>
1093
1094 <p>Changes compared to the lenny based version</p>
1095
1096 <ul>
1097 <li>Everything from Debian Squeeze
1098 <ul>
1099   <li>Desktop environment KDE 4.4 => the new KDE desktop in
1100          combination with some new artwork
1101   <li>Web browser Iceweasel 3.5
1102   <li>OpenOffice.org 3.2
1103   <li>Educational toolbox GCompris 9.3
1104   <li>Music creator Rosegarden 10.04.2
1105   <li>Image editor Gimp 2.6.10
1106   <li>Virtual universe Celestia 1.6.0
1107   <li>Virtual stargazer Stellarium 0.10.4
1108   <li>3D modeler Blender 2.49.2 (new application)
1109   <li>Video editor Kdenlive 0.7.7 (new application)
1110 </ul></li>
1111 <li>Now using Kerberos for password checking (migration not finished).
1112     Enabled for:
1113 <ul>
1114   <li>PAM
1115   <li>LDAP
1116   <li>IMAP
1117   <li>SMTP (sender verification)
1118 </ul>
1119 </li>
1120 <li>New experimental roaming workstation profile for laptops.</li>
1121 <li>Show welcome page to users when they first log in. The URL is
1122     fetched from LDAP.</li>
1123 <li>New LXDE desktop option, in addition to KDE (default) and Gnome.</li>
1124 <li>General cleanup (not finished)</li>
1125 </ul>
1126 <p>The following features are not working as they should</p>
1127
1128 <ul>
1129 <li>No web based administration tool for creating users and groups. The
1130     scripts ldap-createuser-krb and ldap-add-user-to-group can be used
1131     for testing.</li>
1132 <li>DVD installs are missing debian-installer images for the PXE boot,
1133     and do not set up the PXE menu on eth0 because of this. LTSP
1134     clients should still boot from eth1 on thin client servers.</li>
1135 <li>The restructured KDE menu is not implemented.</li>
1136 <li>The LDAP server setup need to be reviewed for security.</li>
1137 <li>The LDAP directory structure need to be reworked.</li>
1138 <li>Different sets of packages are installed when using the DVD and the
1139     netinst CD. More packages are installed using the netinst CD.</li>
1140 <li>The jackd package fail to install. This is believed to be caused by
1141     some ongoing transition, and hopefully should be solved soon. The
1142     jackd1 package can be installed manually for those that need it.</li>
1143 <li>Some packages lack translations. See
1144     http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status,
1145     and help out with translations.</li>
1146 </ul>
1147
1148 <p>To download this multiarch netinstall release you can use</p>
1149
1150 <ul>
1151 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
1152 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
1153 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</li>
1154 </ul>
1155 <p>To download this multiarch dvd release you can use</p>
1156
1157 <ul>
1158 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
1159 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
1160 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</li>
1161 </ul>
1162
1163 <p>There is no source DVD available yet. It will be prepared when we
1164 get closer to the final release.</p>
1165
1166 <p>The MD5SUM of these images are</p>
1167
1168 <ul>
1169 <li>3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-6.0.0+edua0-CD.iso</li>
1170 <li>22f2cbfce281d1c6e478be452638675d debian-edu-6.0.0+edua0-DVD.iso</li>
1171 </ul>
1172
1173 <p>The SHA1SUM of these images are</p>
1174 <ul>
1175 <li>c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-6.0.0+edua0-CD.iso</li>
1176 <li>2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-6.0.0+edua0-DVD.iso</li>
1177 </ul>
1178 <p>How to report bugs:
1179 http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla</p>
1180
1181 <p>Please direct replies to debian-edu@lists.debian.org</p>
1182 </blockquote>
1183
1184       </div>
1185       <div class="tags">
1186
1187
1188         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1189
1190
1191       </div>
1192     </div>
1193     <div class="padding"></div>
1194
1195     <div class="entry">
1196       <div class="title">
1197         <a href="http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html">Circular package dependencies harms apt recovery</a>
1198       </div>
1199       <div class="date">
1200         27th July 2010
1201       </div>
1202       <div class="body">
1203         <p>I discovered this while doing
1204 <a href="http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html">automated
1205 testing of upgrades from Debian Lenny to Squeeze</a>.  A few packages
1206 in Debian still got circular dependencies, and it is often claimed
1207 that apt and aptitude should be able to handle this just fine, but
1208 some times these dependency loops causes apt to fail.</p>
1209
1210 <p>An example is from todays
1211 <a href="http://people.skolelinux.org/~pere/debian-upgrade-testing//test-20100727-lenny-squeeze-kde-aptitude.txt">upgrade
1212 of KDE using aptitude</a>.  In it, a bug in kdebase-workspace-data
1213 causes perl-modules to fail to upgrade.  The cause is simple.  If a
1214 package fail to unpack, then only part of packages with the circular
1215 dependency might end up being unpacked when unpacking aborts, and the
1216 ones already unpacked will fail to configure in the recovery phase
1217 because its dependencies are unavailable.</p>
1218
1219 <p>In this log, the problem manifest itself with this error:</p>
1220
1221 <blockquote><pre>
1222 dpkg: dependency problems prevent configuration of perl-modules:
1223  perl-modules depends on perl (>= 5.10.1-1); however:
1224   Version of perl on system is 5.10.0-19lenny2.
1225 dpkg: error processing perl-modules (--configure):
1226  dependency problems - leaving unconfigured
1227 </pre></blockquote>
1228
1229 <p>The perl/perl-modules circular dependency is already
1230 <a href="http://bugs.debian.org/527917">reported as a bug</a>, and will
1231 hopefully be solved as soon as possible, but it is not the only one,
1232 and each one of these loops in the dependency tree can cause similar
1233 failures.  Of course, they only occur when there are bugs in other
1234 packages causing the unpacking to fail, but it is rather nasty when
1235 the failure of one package causes the problem to become worse because
1236 of dependency loops.</p>
1237
1238 <p>Thanks to
1239 <a href="http://lists.debian.org/debian-devel/2010/06/msg00116.html">the
1240 tireless effort by Bill Allombert</a>, the number of circular
1241 dependencies
1242 <a href="http://debian.semistable.com/debgraph.out.html">left in Debian
1243 is dropping</a>, and perhaps it will reach zero one day. :)</p>
1244
1245 <p>Todays testing also exposed a bug in
1246 <a href="http://bugs.debian.org/590605">update-notifier</a> and
1247 <a href="http://bugs.debian.org/590604">different behaviour</a> between
1248 apt-get and aptitude, the latter possibly caused by some circular
1249 dependency.  Reported both to BTS to try to get someone to look at
1250 it.</p>
1251
1252       </div>
1253       <div class="tags">
1254
1255
1256         Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1257
1258
1259       </div>
1260     </div>
1261     <div class="padding"></div>
1262
1263     <p style="text-align: right;"><a href="07.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14" /></a></p>
1264     <div id="sidebar">
1265
1266
1267
1268 <h2>Archive</h2>
1269 <ul>
1270
1271 <li>2012
1272 <ul>
1273
1274 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/01/">January (7)</a></li>
1275
1276 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/02/">February (10)</a></li>
1277
1278 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/03/">March (17)</a></li>
1279
1280 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/04/">April (12)</a></li>
1281
1282 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/05/">May (12)</a></li>
1283
1284 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/06/">June (20)</a></li>
1285
1286 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/07/">July (8)</a></li>
1287
1288 </ul></li>
1289
1290 <li>2011
1291 <ul>
1292
1293 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
1294
1295 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
1296
1297 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
1298
1299 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
1300
1301 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
1302
1303 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
1304
1305 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (7)</a></li>
1306
1307 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/08/">August (6)</a></li>
1308
1309 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/09/">September (4)</a></li>
1310
1311 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/10/">October (2)</a></li>
1312
1313 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/11/">November (3)</a></li>
1314
1315 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/12/">December (1)</a></li>
1316
1317 </ul></li>
1318
1319 <li>2010
1320 <ul>
1321
1322 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
1323
1324 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
1325
1326 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1327
1328 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1329
1330 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1331
1332 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1333
1334 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
1335
1336 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
1337
1338 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
1339
1340 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
1341
1342 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
1343
1344 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
1345
1346 </ul></li>
1347
1348 <li>2009
1349 <ul>
1350
1351 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1352
1353 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1354
1355 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1356
1357 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1358
1359 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1360
1361 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1362
1363 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1364
1365 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1366
1367 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1368
1369 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1370
1371 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1372
1373 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1374
1375 </ul></li>
1376
1377 <li>2008
1378 <ul>
1379
1380 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1381
1382 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1383
1384 </ul></li>
1385
1386 </ul>
1387
1388
1389
1390 <h2>Tags</h2>
1391 <ul>
1392
1393  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (13)</a></li>
1394
1395  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1396
1397  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1398
1399  <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (2)</a></li>
1400
1401  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (12)</a></li>
1402
1403  <li><a href="http://people.skolelinux.org/pere/blog/tags/bsa">bsa (2)</a></li>
1404
1405  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (55)</a></li>
1406
1407  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (107)</a></li>
1408
1409  <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (9)</a></li>
1410
1411  <li><a href="http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (4)</a></li>
1412
1413  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (139)</a></li>
1414
1415  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (17)</a></li>
1416
1417  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (12)</a></li>
1418
1419  <li><a href="http://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (6)</a></li>
1420
1421  <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (29)</a></li>
1422
1423  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (16)</a></li>
1424
1425  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
1426
1427  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (4)</a></li>
1428
1429  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1430
1431  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (22)</a></li>
1432
1433  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (186)</a></li>
1434
1435  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (137)</a></li>
1436
1437  <li><a href="http://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (4)</a></li>
1438
1439  <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
1440
1441  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (31)</a></li>
1442
1443  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (48)</a></li>
1444
1445  <li><a href="http://people.skolelinux.org/pere/blog/tags/raid">raid (1)</a></li>
1446
1447  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
1448
1449  <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (2)</a></li>
1450
1451  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (4)</a></li>
1452
1453  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1454
1455  <li><a href="http://people.skolelinux.org/pere/blog/tags/ruter">ruter (4)</a></li>
1456
1457  <li><a href="http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (2)</a></li>
1458
1459  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (23)</a></li>
1460
1461  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (4)</a></li>
1462
1463  <li><a href="http://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (1)</a></li>
1464
1465  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (35)</a></li>
1466
1467  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
1468
1469  <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (4)</a></li>
1470
1471  <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (10)</a></li>
1472
1473  <li><a href="http://people.skolelinux.org/pere/blog/tags/valg">valg (6)</a></li>
1474
1475  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (32)</a></li>
1476
1477  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
1478
1479  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (25)</a></li>
1480
1481 </ul>
1482
1483
1484     </div>
1485     <p style="text-align: right">
1486  Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v4.4</a>
1487 </p>
1488
1489   </body>
1490 </html>