blog/No_hardcoded_config_on_Debian_Edu_clients.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
   4   <head>
   5     <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
   6     <title>Petter Reinholdtsen: No hardcoded config on Debian Edu clients</title>
   7     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css" />
   8     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/vim.css" />
   9
  10
  11   </head>
  12   <body>
  13     <div class="title">
  14  <h1>
  15      <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  16
  17  </h1>
  18
  19 </div>
  20
  21
  22     <div class="entry">
  23       <div class="title">No hardcoded config on Debian Edu clients</div>
  24       <div class="date"> 9th August 2010</div>
  25       <div class="body"><p>As reported earlier, the last few days I have looked at how Debian
  26 Edu clients are configured, and tried to get rid of all hardcoded
  27 configuration settings on the clients.  I believe the work to be
  28 mostly done, and the clients seem to work just fine with dynamically
  29 generated configuration.</p>
  30
  31 <p>What is the point, you might ask?  The point is to allow a Debian
  32 Edu desktop to integrate into an existing network infrastructure
  33 without any manual configuration.</p>
  34
  35 <p>This is what happens when installing a Debian Edu client here at
  36 the University of Oslo using PXE.  With the PXE installation, I am
  37 asked for language (Norwegian Bokmål), locality (Norway) and keyboard
  38 layout (no-latin1), Debian Edu profile (Roaming Workstation), if I
  39 accept to reformat the hard drive (yes), if I want to submit info to
  40 popcon.debian.org (no) and root password (secret).  After answering
  41 these questions, the installer goes ahead and does its thing, and
  42 after around 50 minutes it is done.  I press enter to finish the
  43 installation, and the machine reboots into KDE.  When the machine is
  44 ready and kdm asks for login information, I enter my university
  45 username and password, am told by kdm that a local home directory has
  46 been created and that I must log in again, and finally log in with the
  47 same username and password to the KDE 4.4 desktop.  At no point during
  48 this process did it ask for university specific settings, and all the
  49 required configuration was dynamically detected using information
  50 fetched via DHCP and DNS.  The roaming workstation is now ready for
  51 use.</p>
  52
  53 <p>How was this done, you might wonder?  First of all, here is the
  54 list of things that need to be configured on the client to get it
  55 working properly out of the box:</p>
  56
  57 <ul>
  58 <li>IP address/netmask and DNS server.</li>
  59 <li>Web proxy URL.</li>
  60 <li>LDAP server for NSS directory information (user, group, etc).</li>
  61 <li>Kerberos server for PAM password checking.</li>
  62 <li>SMB mount point to access the network home directory. (*)</li>
  63 <li>Central syslog server to send syslog messages to. (*)</li>
  64 <li>Sitesummary collector URL to submit info to central server. (*)</li>
  65 </ul>
  66
  67 <p>(Hm, did I forget anything?  Let me knew if I did.)</p>
  68
  69 <p>The points marked (*) are not required to be able to use the
  70 machine, but needed to provide central storage and allowing system
  71 administrators to track their machines.  Since yesterday, everything
  72 but the sitesummary collector URL is dynamically discovered at boot
  73 and installation time in the svn version of Debian Edu.</p>
  74
  75 <p>The IP and DNS setup is fetched during boot using DHCP as usual.
  76 When a DHCP update arrives, the proxy setup is updated by looking for
  77 http://wpat/wpad.dat and using the content of this WPAD file to
  78 configure the http and ftp proxy in /etc/environment and
  79 /etc/apt/apt.conf.  I decided to update the proxy setup using a DHCP
  80 hook to ensure that the client stops using the Debian Edu proxy when
  81 it is moved outside the Debian Edu network, and instead uses any local
  82 proxy present on the new network when it moves around.</p>
  83
  84 <p>The DNS names of the LDAP, Kerberos and syslog server and related
  85 configuration are generated using DNS information at boot.  First the
  86 installer looks for a host named ldap in the current DNS domain.  If
  87 not found, it looks for _ldap._tcp SRV records in DNS instead.  If an
  88 LDAP server is found, its root DSE entry is requested and the
  89 attributes namingContexts and defaultNamingContext are used to
  90 determine which LDAP base to use for NSS.  If there are several
  91 namingContexts attibutes and the defaultNamingContext is present, that
  92 LDAP subtree is used as the base.  If defaultNamingContext is missing,
  93 the subtrees listed as namingContexts are searched in sequence for any
  94 object with class posixAccount or posixGroup, and the first one with
  95 such an object is used as the LDAP base.  For Kerberos, a similar
  96 search is done by first looking for a host named kerberos, and then
  97 for the _kerberos._tcp SRV record.  I've been unable to find a way to
  98 look up the Kerberos realm, so for this the upper case string of the
  99 current DNS domain is used.</p>
 100
 101 <p>For the syslog server, the hosts syslog and loghost are searched
 102 for, and the _syslog._udp SRV record is consulted if no such host is
 103 found.  This algorithm works for both Debian Edu and the University of
 104 Oslo.  A similar strategy would work for locating the sitesummary
 105 server, but have not been implemented yet.  I decided to fetch and
 106 save these settings during installation, to make sure moving to a
 107 different network does not change the set of users being allowed to
 108 log in nor the passwords required to log in.  Usernames and passwords
 109 will be cached by sssd when the user logs in on the Debian Edu
 110 network, and will not change as the laptop move around.  For a
 111 non-roaming machine, there is no caching, but given that it is
 112 supposed to stay in place it should not matter much.  Perhaps we
 113 should switch those to use sssd too?</p>
 114
 115 <p>The user's SMB mount point for the network home directory is
 116 located when the user logs in for the first time.  The LDAP server is
 117 consulted to look for the user's LDAP object and the sambaHomePath
 118 attribute is used if found.  If it isn't found, the home directory
 119 path fetched from NSS is used instead.  Assuming the path is of the
 120 form /site/server/directory/username, the second part is looked up in
 121 DNS and used to generate a SMB URL of the form
 122 smb://server.domain/username.  This algorithm works for both Debian
 123 edu and the University of Oslo.  Perhaps there are better attributes
 124 to use or a better algorithm that works for more sites, but this will
 125 do for now. :)</p>
 126
 127 <p>This work should make it easier to integrate the Debian Edu clients
 128 into any LDAP/Kerberos infrastructure, and make the current setup even
 129 more flexible than before.  I suspect it will also work for thin
 130 client servers, allowing one to easily set up LTSP and hook it into a
 131 existing network infrastructure, but I have not had time to test this
 132 yet.</p>
 133
 134 <p>If you want to help out with implementing these things for Debian
 135 Edu, please contact us on debian-edu@lists.debian.org.</p>
 136
 137 <p>Update 2010-08-09: Simon Farnsworth gave me a heads-up on how to
 138 detect Kerberos realm from DNS, by looking for _kerberos TXT entries
 139 before falling back to the upper case DNS domain name.  Will have to
 140 implement it for Debian Edu. :)</p>
 141 </div>
 142
 143       <div class="tags">Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.</div>
 144
 145
 146     </div>
 147
 148
 149
 150
 151     <div id="sidebar">
 152
 153
 154
 155 <h2>Archive</h2>
 156 <ul>
 157
 158 <li>2013
 159 <ul>
 160
 161 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/01/">January (11)</a></li>
 162
 163 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/02/">February (9)</a></li>
 164
 165 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/03/">March (9)</a></li>
 166
 167 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/04/">April (6)</a></li>
 168
 169 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/05/">May (9)</a></li>
 170
 171 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/06/">June (10)</a></li>
 172
 173 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/07/">July (7)</a></li>
 174
 175 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/08/">August (3)</a></li>
 176
 177 <li><a href="http://people.skolelinux.org/pere/blog/archive/2013/09/">September (2)</a></li>
 178
 179 </ul></li>
 180
 181 <li>2012
 182 <ul>
 183
 184 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/01/">January (7)</a></li>
 185
 186 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/02/">February (10)</a></li>
 187
 188 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/03/">March (17)</a></li>
 189
 190 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/04/">April (12)</a></li>
 191
 192 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/05/">May (12)</a></li>
 193
 194 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/06/">June (20)</a></li>
 195
 196 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/07/">July (17)</a></li>
 197
 198 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/08/">August (6)</a></li>
 199
 200 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/09/">September (9)</a></li>
 201
 202 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/10/">October (17)</a></li>
 203
 204 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/11/">November (10)</a></li>
 205
 206 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/12/">December (7)</a></li>
 207
 208 </ul></li>
 209
 210 <li>2011
 211 <ul>
 212
 213 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
 214
 215 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
 216
 217 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
 218
 219 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
 220
 221 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
 222
 223 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
 224
 225 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (7)</a></li>
 226
 227 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/08/">August (6)</a></li>
 228
 229 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/09/">September (4)</a></li>
 230
 231 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/10/">October (2)</a></li>
 232
 233 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/11/">November (3)</a></li>
 234
 235 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/12/">December (1)</a></li>
 236
 237 </ul></li>
 238
 239 <li>2010
 240 <ul>
 241
 242 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 243
 244 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 245
 246 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 247
 248 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 249
 250 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 251
 252 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 253
 254 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
 255
 256 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
 257
 258 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
 259
 260 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
 261
 262 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
 263
 264 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
 265
 266 </ul></li>
 267
 268 <li>2009
 269 <ul>
 270
 271 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 272
 273 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 274
 275 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 276
 277 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 278
 279 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 280
 281 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 282
 283 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 284
 285 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 286
 287 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 288
 289 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 290
 291 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 292
 293 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 294
 295 </ul></li>
 296
 297 <li>2008
 298 <ul>
 299
 300 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 301
 302 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 303
 304 </ul></li>
 305
 306 </ul>
 307
 308
 309
 310 <h2>Tags</h2>
 311 <ul>
 312
 313  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (13)</a></li>
 314
 315  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 316
 317  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 318
 319  <li><a href="http://people.skolelinux.org/pere/blog/tags/bankid">bankid (4)</a></li>
 320
 321  <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (7)</a></li>
 322
 323  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (12)</a></li>
 324
 325  <li><a href="http://people.skolelinux.org/pere/blog/tags/bsa">bsa (2)</a></li>
 326
 327  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (85)</a></li>
 328
 329  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (139)</a></li>
 330
 331  <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (10)</a></li>
 332
 333  <li><a href="http://people.skolelinux.org/pere/blog/tags/docbook">docbook (10)</a></li>
 334
 335  <li><a href="http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (4)</a></li>
 336
 337  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (214)</a></li>
 338
 339  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (21)</a></li>
 340
 341  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (12)</a></li>
 342
 343  <li><a href="http://people.skolelinux.org/pere/blog/tags/freeculture">freeculture (12)</a></li>
 344
 345  <li><a href="http://people.skolelinux.org/pere/blog/tags/freedombox">freedombox (1)</a></li>
 346
 347  <li><a href="http://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (11)</a></li>
 348
 349  <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (37)</a></li>
 350
 351  <li><a href="http://people.skolelinux.org/pere/blog/tags/isenkram">isenkram (7)</a></li>
 352
 353  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (18)</a></li>
 354
 355  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
 356
 357  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (6)</a></li>
 358
 359  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 360
 361  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (25)</a></li>
 362
 363  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (235)</a></li>
 364
 365  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (153)</a></li>
 366
 367  <li><a href="http://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (8)</a></li>
 368
 369  <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
 370
 371  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (44)</a></li>
 372
 373  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (66)</a></li>
 374
 375  <li><a href="http://people.skolelinux.org/pere/blog/tags/raid">raid (1)</a></li>
 376
 377  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
 378
 379  <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (2)</a></li>
 380
 381  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (7)</a></li>
 382
 383  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 384
 385  <li><a href="http://people.skolelinux.org/pere/blog/tags/ruter">ruter (4)</a></li>
 386
 387  <li><a href="http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (2)</a></li>
 388
 389  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (30)</a></li>
 390
 391  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (4)</a></li>
 392
 393  <li><a href="http://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (4)</a></li>
 394
 395  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (43)</a></li>
 396
 397  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (3)</a></li>
 398
 399  <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (8)</a></li>
 400
 401  <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (17)</a></li>
 402
 403  <li><a href="http://people.skolelinux.org/pere/blog/tags/sysadmin">sysadmin (1)</a></li>
 404
 405  <li><a href="http://people.skolelinux.org/pere/blog/tags/valg">valg (8)</a></li>
 406
 407  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (38)</a></li>
 408
 409  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (4)</a></li>
 410
 411  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (27)</a></li>
 412
 413 </ul>
 414
 415
 416     </div>
 417     <p style="text-align: right">
 418  Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v4.6</a>
 419 </p>
 420
 421   </body>
 422 </html>