blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Skolelinux_i_Osloskolen.html">Skolelinux i Osloskolen</a></div>
  24   <div class="date">2010-08-26 22:25</div>
  25   <div class="body">
  26 <p>Denne høsten skal endelig alle Osloskolene få mulighet til å bruke
  27 <a href="http://www.skolelinux.org/">Skolelinux</a>.  Ny IT-løsning
  28 har vært rullet ut i noen måneder nå, og så vidt jeg fikk vite før
  29 sommeren skulle alle skoler ha nytt opplegg på plass før oppstart nå i
  30 høst.  På alle skolene skal en kunne velge ved installasjon om en skal
  31 ha Windows eller Skolelinux på maskinene, og en kan i tillegg
  32 PXE-boote maskinene over nett som tynne klienter eller diskløse
  33 arbeidsstasjoner. Jeg er spent på hvor mange skoler som velger å ta i
  34 bruk Skolelinux, og gleder meg til å se hvordan dette utvikler seg.
  35 Løsningen leveres av
  36 <a href="http://www.logica.no/">Logica</a> med
  37 <a href="http://www.slxdrift.no/">Skolelinux Drift AS</a> som
  38 underleverandør, og jeg har vært involvert i utviklingen av løsningen
  39 via Skolelinux Drift AS siden prosjektet starter.  Jeg synes det er
  40 fantastisk at Skolelinux er kommet så langt siden vi startet i 2001 at
  41 alle elevene i Osloskolene nå skal få mulighet til å bruke
  42 løsningen.  Jeg håper de vil sette pris på alle de
  43 <a href="http://www.skolelinux.no/linux-signpost/">fantastiske
  44 brukerprogrammene</a> som er tilgjengelig i Skolelinux.</p>
  45 </div>
  46   <div class="tags">
  47
  48
  49
  50    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>.
  51
  52   </div>
  53  </div>
  54  <div class="padding"></div>
  55
  56  <div class="entry">
  57   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Broken_umask_handling_with_sshfs.html">Broken umask handling with sshfs</a></div>
  58   <div class="date">2010-08-26 13:30</div>
  59   <div class="body">
  60 <p>My file system sematics program
  61 <a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">presented
  62 a few days ago</a> is very useful to verify that a file system can
  63 work as a unix home directory,and today I had to extend it a bit.  I'm
  64 looking into alternatives for home directory access here at the
  65 University of Oslo, and one of the options is sshfs.  My friend
  66 Finn-Arne mentioned a while back that they had used sshfs with Debian
  67 Edu, but stopped because of problems.  I asked today what the problems
  68 where, and he mentioned that sshfs failed to handle umask properly.
  69 Trying to detect the problem I wrote this addition to my fs testing
  70 script:</p>
  71
  72 <pre>
  73 mode_t touch_get_mode(const char *name, mode_t mode) {
  74   mode_t retval = 0;
  75   int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, mode);
  76   if (-1 != fd) {
  77     unlink(name);
  78     struct stat statbuf;
  79     if (-1 != fstat(fd, &statbuf)) {
  80       retval = statbuf.st_mode & 0x1ff;
  81     }
  82     close(fd);
  83   }
  84   return retval;
  85 }
  86
  87 /* Try to detect problem discovered using sshfs */
  88 int test_umask(void) {
  89   printf("info: testing umask effect on file creation\n");
  90
  91   mode_t orig_umask = umask(000);
  92   mode_t newmode;
  93   if (0666 != (newmode = touch_get_mode("foobar", 0666))) {
  94     printf("  error: Wrong file mode %o when creating using mode 666 and umask 000\n",
  95            newmode);
  96   }
  97   umask(007);
  98   if (0660 != (newmode = touch_get_mode("foobar", 0666))) {
  99     printf("  error: Wrong file mode %o when creating using mode 666 and umask 007\n",
 100            newmode);
 101   }
 102
 103   umask (orig_umask);
 104   return 0;
 105 }
 106
 107 int main(int argc, char **argv) {
 108   [...]
 109   test_umask();
 110   return 0;
 111 }
 112 </pre>
 113
 114 <p>Sure enough.  On NFS to a netapp, I get this result:</p>
 115
 116 <pre>
 117 Testing POSIX/Unix sematics on file system
 118 info: testing symlink creation
 119 info: testing subdirectory creation
 120 info: testing fcntl locking
 121   Read-locking 1 byte from 1073741824
 122   Read-locking 510 byte from 1073741826
 123   Unlocking 1 byte from 1073741824
 124   Write-locking 1 byte from 1073741824
 125   Write-locking 510 byte from 1073741826
 126   Unlocking 2 byte from 1073741824
 127 info: testing umask effect on file creation
 128 </pre>
 129
 130 <p>When mounting the same directory using sshfs, I get this
 131 result:</p>
 132
 133 <pre>
 134 Testing POSIX/Unix sematics on file system
 135 info: testing symlink creation
 136 info: testing subdirectory creation
 137 info: testing fcntl locking
 138   Read-locking 1 byte from 1073741824
 139   Read-locking 510 byte from 1073741826
 140   Unlocking 1 byte from 1073741824
 141   Write-locking 1 byte from 1073741824
 142   Write-locking 510 byte from 1073741826
 143   Unlocking 2 byte from 1073741824
 144 info: testing umask effect on file creation
 145   error: Wrong file mode 644 when creating using mode 666 and umask 000
 146   error: Wrong file mode 640 when creating using mode 666 and umask 007
 147 </pre>
 148
 149 <p>So, I can conclude that sshfs is better than smb to a Netapp or a
 150 Windows server, but not good enough to be used as a home
 151 directory.</p>
 152
 153 <p>Update 2010-08-26: Reported the issue in
 154 <a href="http://bugs.debian.org/594498">BTS report #594498</a></p>
 155
 156 <p>Update 2010-08-27: Michael Gebetsroither report that he found the
 157 script so useful that he created a GIT repository and stored it in
 158 <a href="http://github.com/gebi/fs-test">http://github.com/gebi/fs-test</a>.</p>
 159 </div>
 160   <div class="tags">
 161
 162
 163
 164    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 165
 166   </div>
 167  </div>
 168  <div class="padding"></div>
 169
 170  <div class="entry">
 171   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Elektronisk_stemmegiving_er_ikke_til____stole_p_____heller_ikke_i_Norge.html">Elektronisk stemmegiving er ikke til å stole på - heller ikke i Norge</a></div>
 172   <div class="date">2010-08-23 19:30</div>
 173   <div class="body">
 174 <p>I Norge pågår en prosess for å
 175 <a href="http://www.e-valg.dep.no/">innføre elektronisk
 176 stemmegiving</a> ved kommune- og stortingsvalg.  Dette skal
 177 introduseres i 2011.  Det er all grunn til å tro at valg i Norge ikke
 178 vil være til å stole på hvis dette blir gjennomført.  Da det hele var
 179 oppe til høring i 2006 forfattet jeg
 180 <a href="http://www.nuug.no/dokumenter/valg-horing-2006-09.pdf">en
 181 høringsuttalelse fra NUUG</a> (og EFN som hengte seg på) som skisserte
 182 hvilke punkter som må oppfylles for at en skal kunne stole på et valg,
 183 og elektronisk stemmegiving mangler flere av disse.  Elektronisk
 184 stemmegiving er for alle praktiske formål å putte ens stemme i en sort
 185 boks under andres kontroll, og satse på at de som har kontroll med
 186 boksen er til å stole på - uten at en har mulighet til å verifisere
 187 dette selv.  Det er ikke slik en gjennomfører demokratiske valg.</p>
 188
 189 <p>Da problemet er fundamentalt med hvordan elektronisk stemmegiving
 190 må fungere for at også ikke-krypografer skal kunne delta, har det vært
 191 mange rapporter om hvordan elektronisk stemmegiving har sviktet i land
 192 etter land.  En
 193 <a href="http://wiki.nuug.no/uttalelser/2006-elektronisk-stemmegiving">liten
 194 samling referanser</a> finnes på NUUGs wiki.  Den siste er fra India,
 195 der valgkomisjonen har valgt
 196 <a href="http://www.freedom-to-tinker.com/blog/jhalderm/electronic-voting-researcher-arrested-over-anonymous-source">å
 197 pusse politiet på en forsker</a> som har dokumentert svakheter i
 198 valgsystemet.</p>
 199
 200 <p>Her i Norge har en valgt en annen tilnærming, der en forsøker seg
 201 med teknobabbel for å få befolkningen til å tro at dette skal bli
 202 sikkert.  Husk, elektronisk stemmegiving underminerer de demokratiske
 203 valgene i Norge, og bør ikke innføres.</p>
 204
 205 <p>Den offentlige diskusjonen blir litt vanskelig av at media har
 206 valgt å kalle dette "evalg", som kan sies å både gjelde elektronisk
 207 opptelling av valget som Norge har gjort siden 60-tallet og som er en
 208 svært god ide, og elektronisk opptelling som er en svært dårlig ide.
 209 Diskusjonen gir ikke mening hvis en skal diskutere om en er for eller
 210 mot "evalg", og jeg forsøker derfor å være klar på at jeg snakker om
 211 elektronisk stemmegiving og unngå begrepet "evalg".</p>
 212 </div>
 213   <div class="tags">
 214
 215
 216
 217    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 218
 219   </div>
 220  </div>
 221  <div class="padding"></div>
 222
 223  <div class="entry">
 224   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Robot__reis_deg___.html">Robot, reis deg...</a></div>
 225   <div class="date">2010-08-21 22:10</div>
 226   <div class="body">
 227 <p>I dag fikk jeg endelig tittet litt på mine nyinnkjøpte roboter, og
 228 har brukt noen timer til å google etter interessante referanser og
 229 aktuell kildekode for bruk på Linux.  Det mest lovende så langt er
 230 <a href="http://ispykee.toyz.org/">ispykee</a>, som har en
 231 BSD-lisensiert linux-daemon som står som mellomledd mellom roboter på
 232 lokalnettet og en sentral tjeneste der en iPhone kan koble seg opp for
 233 å fjernstyre roboten.  Linux-daemonen implementerer deler av
 234 protokollen som roboten forstår.  Etter å ha knotet litt med å oppnå
 235 kontakt med roboten (den oppretter et eget ad-hoc wifi-nett, så jeg
 236 måtte gå av mitt vanlige nett for å få kontakt), og kommet frem til at
 237 den lytter på IP-port 9000 og 9001, gikk jeg i gang med å finne ut
 238 hvordan jeg kunne snakke med roboten vha. disse portene.  Robotbiten
 239 av protokollen er publisert av produsenten med GPL-lisens, slik at det
 240 er mulig å se hvordan protokollen fungerer.  Det finnes en java-klient
 241 for Android som så ganske snasen ut, men fant ingen kildekode for
 242 denne.  Derimot hadde iphone-løsningen kildekode, så jeg tok
 243 utgangspunkt i den.</p>
 244
 245 <p>Daemonen ville i utgangspunktet forsøke å kontakte den sentrale
 246 tjenesten som iphone-programmet kobler seg til.  Jeg skrev dette om
 247 til i stedet å sette opp en nettverkstjeneste på min lokale maskin,
 248 som jeg kan koble meg opp til med telnet og gi kommandoer til roboten
 249 (act, forward, right, left, etc).  Det involverte i praksis å bytte ut
 250 socket()/connect() med socket()/bind()/listen()/accept() for å gjøre
 251 klienten om til en tjener.</p>
 252
 253 <p>Mens jeg har forsøkt å få roboten til å bevege seg har min samboer
 254 skrudd sammen resten av roboten for å få montert kamera og plastpynten
 255 (armer, plastfiber for lys).  Nå er det hele montert, og roboten er
 256 klar til bruk.  Må få flyttet den over til mitt vanlige trådløsnett
 257 før det blir praktisk, men de bitene av protokollen er ikke
 258 implementert i ispykee-daemonen, så der må jeg enten få tak i en mac
 259 eller en windows-maskin, eller implementere det selv.</p>
 260
 261 <p>Vi var tre som kjøpte slike roboter, og vi har blitt enige om å
 262 samle notater og referanser på <a
 263 href="http://wiki.nuug.no/grupper/robot/">NUUGs wiki</a>.  Ta en titt
 264 der hvis du er nysgjerrig.</p>
 265 </div>
 266   <div class="tags">
 267
 268
 269
 270    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/robot">robot</a>.
 271
 272   </div>
 273  </div>
 274  <div class="padding"></div>
 275
 276  <div class="entry">
 277   <div class="title"><a href="http://people.skolelinux.org/pere/blog/2_Spykee_roboter_i_hus__n___skal_det_lekes.html">2 Spykee-roboter i hus, nå skal det lekes</a></div>
 278   <div class="date">2010-08-18 13:30</div>
 279   <div class="body">
 280 <p>Jeg kjøpte nettopp to
 281 <a href="http://www.spykee-robot.com/">Spykee</a>-roboter, for test og
 282 leking.  Kjøpte to da det var så billige, og gir meg mulighet til å
 283 eksperimentere uten å være veldig redd for å ødelegge alt ved å bytte
 284 ut firmware og slikt.  Oppdaget at lekebutikken på Bryn senter hadde
 285 en liten stabel på lager som de ikke hadde klart å selge ut etter
 286 fjorårets juleinnkjøp, og var villig til å selge for en femtedel av
 287 vanlig pris.  Jeg, Ronny og Jarle har skaffet oss restbeholdningen, og
 288 det blir morsomt å se hva vi får ut av dette.</p>
 289
 290 <p>Roboten har belter styrt av to motorer, kamera, høytaler, mikrofon
 291 og wifi-tilkobling.  Det hele styrt av en GPL-lisensiert databoks som
 292 jeg mistenker kjører linux.  Firmware-kildekoden ble visst publisert i
 293 mai.  Eneste utfordringen er at kontroller-programvaren kun finnes til
 294 Windows, men det må en kunne jobbe seg rundt når vi har kildekoden til
 295 firmwaren. :)</p>
 296
 297 <ul>
 298 <li><a href="http://en.wikipedia.org/wiki/Spykee">Wikipedia-oppføring</a></li>
 299 <li><a href=http://www.spykeeworld.com/spykee/US/freeSoftware.html">Nedlasting av firmware-kilden</a></li>
 300 <li><a href="http://wiki.nuug.no/grupper/robot">prosjektwiki hos NUUG</a></li>
 301 </ul>
 302 </div>
 303   <div class="tags">
 304
 305
 306
 307    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/robot">robot</a>.
 308
 309   </div>
 310  </div>
 311  <div class="padding"></div>
 312
 313  <div class="entry">
 314   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Rob_Weir__How_to_Crush_Dissent.html">Rob Weir: How to Crush Dissent</a></div>
 315   <div class="date">2010-08-15 22:20</div>
 316   <div class="body">
 317 <p>I found the notes from Rob Weir on
 318 <a href="http://feedproxy.google.com/~r/robweir/antic-atom/~3/VGb23-kta8c/how-to-crush-dissent.html">how
 319 to crush dissent</a> matching my own thoughts on the matter quite
 320 well.  Highly recommended for those wondering which road our society
 321 should go down.  In my view we have been heading the wrong way for a
 322 long time.</p>
 323 </div>
 324   <div class="tags">
 325
 326
 327
 328    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 329
 330   </div>
 331  </div>
 332  <div class="padding"></div>
 333
 334  <div class="entry">
 335   <div class="title"><a href="http://people.skolelinux.org/pere/blog/No_hardcoded_config_on_Debian_Edu_clients.html">No hardcoded config on Debian Edu clients</a></div>
 336   <div class="date">2010-08-09 20:15</div>
 337   <div class="body">
 338 <p>As reported earlier, the last few days I have looked at how Debian
 339 Edu clients are configured, and tried to get rid of all hardcoded
 340 configuration settings on the clients.  I believe the work to be
 341 mostly done, and the clients seem to work just fine with dynamically
 342 generated configuration.</p>
 343
 344 <p>What is the point, you might ask?  The point is to allow a Debian
 345 Edu desktop to integrate into an existing network infrastructure
 346 without any manual configuration.</p>
 347
 348 <p>This is what happens when installing a Debian Edu client here at
 349 the University of Oslo using PXE.  With the PXE installation, I am
 350 asked for language (Norwegian Bokmål), locality (Norway) and keyboard
 351 layout (no-latin1), Debian Edu profile (Roaming Workstation), if I
 352 accept to reformat the hard drive (yes), if I want to submit info to
 353 popcon.debian.org (no) and root password (secret).  After answering
 354 these questions, the installer goes ahead and does its thing, and
 355 after around 50 minutes it is done.  I press enter to finish the
 356 installation, and the machine reboots into KDE.  When the machine is
 357 ready and kdm asks for login information, I enter my university
 358 username and password, am told by kdm that a local home directory has
 359 been created and that I must log in again, and finally log in with the
 360 same username and password to the KDE 4.4 desktop.  At no point during
 361 this process did it ask for university specific settings, and all the
 362 required configuration was dynamically detected using information
 363 fetched via DHCP and DNS.  The roaming workstation is now ready for
 364 use.</p>
 365
 366 <p>How was this done, you might wonder?  First of all, here is the
 367 list of things that need to be configured on the client to get it
 368 working properly out of the box:</p>
 369
 370 <ul>
 371 <li>IP address/netmask and DNS server.</li>
 372 <li>Web proxy URL.</li>
 373 <li>LDAP server for NSS directory information (user, group, etc).</li>
 374 <li>Kerberos server for PAM password checking.</li>
 375 <li>SMB mount point to access the network home directory. (*)</li>
 376 <li>Central syslog server to send syslog messages to. (*)</li>
 377 <li>Sitesummary collector URL to submit info to central server. (*)</li>
 378 </ul>
 379
 380 <p>(Hm, did I forget anything?  Let me knew if I did.)</p>
 381
 382 <p>The points marked (*) are not required to be able to use the
 383 machine, but needed to provide central storage and allowing system
 384 administrators to track their machines.  Since yesterday, everything
 385 but the sitesummary collector URL is dynamically discovered at boot
 386 and installation time in the svn version of Debian Edu.</p>
 387
 388 <p>The IP and DNS setup is fetched during boot using DHCP as usual.
 389 When a DHCP update arrives, the proxy setup is updated by looking for
 390 http://wpat/wpad.dat and using the content of this WPAD file to
 391 configure the http and ftp proxy in /etc/environment and
 392 /etc/apt/apt.conf.  I decided to update the proxy setup using a DHCP
 393 hook to ensure that the client stops using the Debian Edu proxy when
 394 it is moved outside the Debian Edu network, and instead uses any local
 395 proxy present on the new network when it moves around.</p>
 396
 397 <p>The DNS names of the LDAP, Kerberos and syslog server and related
 398 configuration are generated using DNS information at boot.  First the
 399 installer looks for a host named ldap in the current DNS domain.  If
 400 not found, it looks for _ldap._tcp SRV records in DNS instead.  If an
 401 LDAP server is found, its root DSE entry is requested and the
 402 attributes namingContexts and defaultNamingContext are used to
 403 determine which LDAP base to use for NSS.  If there are several
 404 namingContexts attibutes and the defaultNamingContext is present, that
 405 LDAP subtree is used as the base.  If defaultNamingContext is missing,
 406 the subtrees listed as namingContexts are searched in sequence for any
 407 object with class posixAccount or posixGroup, and the first one with
 408 such an object is used as the LDAP base.  For Kerberos, a similar
 409 search is done by first looking for a host named kerberos, and then
 410 for the _kerberos._tcp SRV record.  I've been unable to find a way to
 411 look up the Kerberos realm, so for this the upper case string of the
 412 current DNS domain is used.</p>
 413
 414 <p>For the syslog server, the hosts syslog and loghost are searched
 415 for, and the _syslog._udp SRV record is consulted if no such host is
 416 found.  This algorithm works for both Debian Edu and the University of
 417 Oslo.  A similar strategy would work for locating the sitesummary
 418 server, but have not been implemented yet.  I decided to fetch and
 419 save these settings during installation, to make sure moving to a
 420 different network does not change the set of users being allowed to
 421 log in nor the passwords required to log in.  Usernames and passwords
 422 will be cached by sssd when the user logs in on the Debian Edu
 423 network, and will not change as the laptop move around.  For a
 424 non-roaming machine, there is no caching, but given that it is
 425 supposed to stay in place it should not matter much.  Perhaps we
 426 should switch those to use sssd too?</p>
 427
 428 <p>The user's SMB mount point for the network home directory is
 429 located when the user logs in for the first time.  The LDAP server is
 430 consulted to look for the user's LDAP object and the sambaHomePath
 431 attribute is used if found.  If it isn't found, the home directory
 432 path fetched from NSS is used instead.  Assuming the path is of the
 433 form /site/server/directory/username, the second part is looked up in
 434 DNS and used to generate a SMB URL of the form
 435 smb://server.domain/username.  This algorithm works for both Debian
 436 edu and the University of Oslo.  Perhaps there are better attributes
 437 to use or a better algorithm that works for more sites, but this will
 438 do for now. :)</p>
 439
 440 <p>This work should make it easier to integrate the Debian Edu clients
 441 into any LDAP/Kerberos infrastructure, and make the current setup even
 442 more flexible than before.  I suspect it will also work for thin
 443 client servers, allowing one to easily set up LTSP and hook it into a
 444 existing network infrastructure, but I have not had time to test this
 445 yet.</p>
 446
 447 <p>If you want to help out with implementing these things for Debian
 448 Edu, please contact us on debian-edu@lists.debian.org.</p>
 449
 450 <p>Update 2010-08-09: Simon Farnsworth gave me a heads-up on how to
 451 detect Kerberos realm from DNS, by looking for _kerberos TXT entries
 452 before falling back to the upper case DNS domain name.  Will have to
 453 implement it for Debian Edu. :)</p>
 454 </div>
 455   <div class="tags">
 456
 457
 458
 459    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 460
 461   </div>
 462  </div>
 463  <div class="padding"></div>
 464
 465  <div class="entry">
 466   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">Testing if a file system can be used for home directories...</a></div>
 467   <div class="date">2010-08-08 21:20</div>
 468   <div class="body">
 469 <p>A few years ago, I was involved in a project planning to use
 470 Windows file servers as home directory servers for Debian
 471 Edu/Skolelinux machines.  This was thought to be no problem, as the
 472 access would be through the SMB network file system protocol, and we
 473 knew other sites used SMB with unix and samba as the file server to
 474 mount home directories without any problems.  But, after months of
 475 struggling, we had to conclude that our goal was impossible.</p>
 476
 477 <p>The reason is simply that while SMB can be used for home
 478 directories when the file server is Samba running on Unix, this only
 479 work because of Samba have some extensions and the fact that the
 480 underlying file system is a unix file system.  When using a Windows
 481 file server, the underlying file system do not have POSIX semantics,
 482 and several programs will fail if the users home directory where they
 483 want to store their configuration lack POSIX semantics.</p>
 484
 485 <p>As part of this work, I wrote a small C program I want to share
 486 with you all, to replicate a few of the problematic applications (like
 487 OpenOffice.org and GCompris) and see if the file system was working as
 488 it should.  If you find yourself in spooky file system land, it might
 489 help you find your way out again.  This is the fs-test.c source:</p>
 490
 491 <pre>
 492 /*
 493  * Some tests to check the file system sematics.  Used to verify that
 494  * CIFS from a windows server do not work properly as a linux home
 495  * directory.
 496  * License: GPL v2 or later
 497  *
 498  * needs libsqlite3-dev and build-essential installed
 499  * compile with: gcc -Wall -lsqlite3 -DTEST_SQLITE fs-test.c -o fs-test
 500 */
 501
 502 #define _FILE_OFFSET_BITS 64
 503 #define _LARGEFILE_SOURCE 1
 504 #define _LARGEFILE64_SOURCE 1
 505
 506 #define _GNU_SOURCE /* for asprintf() */
 507
 508 #include &lt;errno.h>
 509 #include &lt;fcntl.h>
 510 #include &lt;stdio.h>
 511 #include &lt;string.h>
 512 #include &lt;stdlib.h>
 513 #include &lt;sys/file.h>
 514 #include &lt;sys/stat.h>
 515 #include &lt;sys/types.h>
 516 #include &lt;unistd.h>
 517
 518 #ifdef TEST_SQLITE
 519 /*
 520  * Test sqlite open, as done by gcompris require the libsqlite3-dev
 521  * package and linking with -lsqlite3.  A more low level test is
 522  * below.
 523  * See also &lt;URL: http://www.sqlite.org./faq.html#q5 >.
 524  */
 525 #include &lt;sqlite3.h>
 526 #define CREATE_TABLE_USERS                                              \
 527   "CREATE TABLE users (user_id INT UNIQUE, login TEXT, lastname TEXT, firstname TEXT, birthdate TEXT, class_id INT ); "
 528 int test_sqlite_open(void) {
 529   char *zErrMsg;
 530   char *name = "testsqlite.db";
 531   sqlite3 *db=NULL;
 532   unlink(name);
 533   int rc = sqlite3_open(name, &db);
 534   if( rc ){
 535     printf("error: sqlite open of %s failed: %s\n", name, sqlite3_errmsg(db));
 536     sqlite3_close(db);
 537     return -1;
 538   }
 539
 540   /* create tables */
 541   rc = sqlite3_exec(db,CREATE_TABLE_USERS, NULL,  0, &zErrMsg);
 542   if( rc != SQLITE_OK ){
 543     printf("error: sqlite table create failed: %s\n", zErrMsg);
 544     sqlite3_close(db);
 545     return -1;
 546   }
 547   printf("info: sqlite worked\n");
 548   sqlite3_close(db);
 549   return 0;
 550 }
 551 #endif /* TEST_SQLITE */
 552
 553 /*
 554  * Demonstrate locking issue found in gcompris using sqlite3.  This
 555  * work with ext3, but not with cifs server on Windows 2003.  This is
 556  * done in the sqlite3 library.
 557  * See also
 558  * &lt;URL:http://www.cygwin.com/ml/cygwin/2001-08/msg00854.html> and the
 559  * POSIX specification
 560  * &lt;URL:http://www.opengroup.org/onlinepubs/009695399/functions/fcntl.html>.
 561  */
 562 int test_gcompris_locking(void) {
 563   struct flock fl;
 564   char *name = "testsqlite.db";
 565   unlink(name);
 566   int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, 0644);
 567   printf("info: testing fcntl locking\n");
 568
 569   fl.l_whence = SEEK_SET;
 570   fl.l_pid    = getpid();
 571   printf("  Read-locking 1 byte from 1073741824");
 572   fl.l_start  = 1073741824;
 573   fl.l_len    = 1;
 574   fl.l_type   = F_RDLCK;
 575   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 576
 577   printf("  Read-locking 510 byte from 1073741826");
 578   fl.l_start  = 1073741826;
 579   fl.l_len    = 510;
 580   fl.l_type   = F_RDLCK;
 581   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 582
 583   printf("  Unlocking 1 byte from 1073741824");
 584   fl.l_start  = 1073741824;
 585   fl.l_len    = 1;
 586   fl.l_type   = F_UNLCK;
 587   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 588
 589   printf("  Write-locking 1 byte from 1073741824");
 590   fl.l_start  = 1073741824;
 591   fl.l_len    = 1;
 592   fl.l_type   = F_WRLCK;
 593   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 594
 595   printf("  Write-locking 510 byte from 1073741826");
 596   fl.l_start  = 1073741826;
 597   fl.l_len    = 510;
 598   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 599
 600   printf("  Unlocking 2 byte from 1073741824");
 601   fl.l_start  = 1073741824;
 602   fl.l_len    = 2;
 603   fl.l_type   = F_UNLCK;
 604   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 605
 606   close(fd);
 607   return 0;
 608 }
 609
 610 /*
 611  * Test if permissions of freshly created directories allow entries
 612  * below them.  This was a problem with OpenOffice.org and gcompris.
 613  * Mounting with option 'sync' seem to solve this problem while
 614  * slowing down file operations.
 615  */
 616 int test_subdirectory_creation(void) {
 617 #define LEVELS 5
 618   char *path = strdup("test");
 619   char *dirs[LEVELS];
 620   int level;
 621   printf("info: testing subdirectory creation\n");
 622   for (level = 0; level &lt; LEVELS; level++) {
 623     char *newpath = NULL;
 624     if (-1 == mkdir(path, 0777)) {
 625       printf("  error: Unable to create directory '%s': %s\n",
 626              path, strerror(errno));
 627       break;
 628     }
 629     asprintf(&newpath, "%s/%s", path, "test");
 630     free(path);
 631     path = newpath;
 632   }
 633   return 0;
 634 }
 635
 636 /*
 637  * Test if symlinks can be created.  This was a problem detected with
 638  * KDE.
 639  */
 640 int test_symlinks(void) {
 641   printf("info: testing symlink creation\n");
 642   unlink("symlink");
 643   if (-1 == symlink("file", "symlink"))
 644     printf("  error: Unable to create symlink\n");
 645   return 0;
 646 }
 647
 648 int main(int argc, char **argv) {
 649   printf("Testing POSIX/Unix sematics on file system\n");
 650   test_symlinks();
 651   test_subdirectory_creation();
 652 #ifdef TEST_SQLITE
 653   test_sqlite_open();
 654 #endif /* TEST_SQLITE */
 655   test_gcompris_locking();
 656   return 0;
 657 }
 658 </pre>
 659
 660 <p>When everything is working, it should print something like
 661 this:</p>
 662
 663 <pre>
 664 Testing POSIX/Unix sematics on file system
 665 info: testing symlink creation
 666 info: testing subdirectory creation
 667 info: sqlite worked
 668 info: testing fcntl locking
 669   Read-locking 1 byte from 1073741824
 670   Read-locking 510 byte from 1073741826
 671   Unlocking 1 byte from 1073741824
 672   Write-locking 1 byte from 1073741824
 673   Write-locking 510 byte from 1073741826
 674   Unlocking 2 byte from 1073741824
 675 </pre>
 676
 677 <p>I do not remember the exact details of the problems we saw, but one
 678 of them was with locking, where if I remember correctly, POSIX allow a
 679 read-only lock to be upgraded to a read-write lock without unlocking
 680 the read-only lock (while Windows do not).  Another was a bug in the
 681 CIFS/SMB client implementation in the Linux kernel where directory
 682 meta information would be wrong for a fraction of a second, making
 683 OpenOffice.org fail to create its deep directory tree because it was
 684 not allowed to create files in its freshly created directory.</p>
 685
 686 <p>Anyway, here is a nice tool for your tool box, might you never need
 687 it. :)</p>
 688
 689 <p>Update 2010-08-27: Michael Gebetsroither report that he found the
 690 script so useful that he created a GIT repository and stored it in
 691 <a href="http://github.com/gebi/fs-test">http://github.com/gebi/fs-test</a>.</p>
 692 </div>
 693   <div class="tags">
 694
 695
 696
 697    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 698
 699   </div>
 700  </div>
 701  <div class="padding"></div>
 702
 703  <div class="entry">
 704   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html">Autodetecting Client setup for roaming workstations in Debian Edu</a></div>
 705   <div class="date">2010-08-07 14:45</div>
 706   <div class="body">
 707 <p>A few days ago, I
 708 <a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">tried
 709 to install</a> a Roaming workation profile from Debian Edu/Squeeze
 710 while on the university network here at the University of Oslo, and
 711 noticed how much had to change to get it operational using the
 712 university infrastructure.  It was fairly easy, but it occured to me
 713 that Debian Edu would improve a lot if I could get the client to
 714 connect without any changes at all, and thus let the client configure
 715 itself during installation and first boot to use the infrastructure
 716 around it.  Now I am a huge step further along that road.</p>
 717
 718 <p>With our current squeeze-test packages, I can select the roaming
 719 workstation profile and get a working laptop connecting to the
 720 university LDAP server for user and group and our active directory
 721 servers for Kerberos authentication.  All this without any
 722 configuration at all during installation.  My users home directory got
 723 a bookmark in the KDE menu to mount it via SMB, with the correct URL.
 724 In short, openldap and sssd is correctly configured.  In addition to
 725 this, the client look for http://wpad/wpad.dat to configure a web
 726 proxy, and when it fail to find it no proxy settings are stored in
 727 /etc/environment and /etc/apt/apt.conf.  Iceweasel and KDE is
 728 configured to look for the same wpad configuration and also do not use
 729 a proxy when at the university network.  If the machine is moved to a
 730 network with such wpad setup, it would automatically use it when DHCP
 731 gave it a IP address.</p>
 732
 733 <p>The LDAP server is located using DNS, by first looking for the DNS
 734 entry ldap.$domain.  If this do not exist, it look for the
 735 _ldap._tcp.$domain SRV records and use the first one as the LDAP
 736 server.  Next, it connects to the LDAP server and search all
 737 namingContexts entries for posixAccount or posixGroup objects, and
 738 pick the first one as the LDAP base.  For Kerberos, a similar
 739 algorithm is used to locate the LDAP server, and the realm is the
 740 uppercase version of $domain.</p>
 741
 742 <p>So, what is not working, you might ask.  SMB mounting my home
 743 directory do not work.  No idea why, but suspected the incorrect
 744 Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
 745 the cause.  These are not properly configured during installation, and
 746 had to be hand-edited to get the correct Kerberos realm and server,
 747 but SMB mounting still do not work. :(</p>
 748
 749 <p>With this automatic configuration in place, I expect a Debian Edu
 750 roaming profile installation would be able to automatically detect and
 751 connect to any site using LDAP and Kerberos for NSS directory and PAM
 752 authentication.  It should also work out of the box in a Active
 753 Directory environment providing posixAccount and posixGroup objects
 754 with UID and GID values.</p>
 755
 756 <p>If you want to help out with implementing these things for Debian
 757 Edu, please contact us on debian-edu@lists.debian.org.</p>
 758 </div>
 759   <div class="tags">
 760
 761
 762
 763    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 764
 765   </div>
 766  </div>
 767  <div class="padding"></div>
 768
 769  <div class="entry">
 770   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">Debian Edu roaming workstation - at the university of Oslo</a></div>
 771   <div class="date">2010-08-03 23:30</div>
 772   <div class="body">
 773 <p>The new roaming workstation profile in Debian Edu/Squeeze is fairly
 774 similar to the laptop setup am I working on using Ubuntu for the
 775 University of Oslo, and just for the heck of it, I tested today how
 776 hard it would be to integrate that profile into the university
 777 infrastructure.  In this case, it is the university LDAP server,
 778 Active Directory Kerberos server and SMB mounting from the Netapp file
 779 servers.</p>
 780
 781 <p>I was pleasantly surprised that the only three files needed to be
 782 changed (/etc/sssd/sssd.conf, /etc/ldap.conf and
 783 /etc/mklocaluser.d/20-debian-edu-config) and one file had to be added
 784 (/usr/share/perl5/Debian/Edu_Local.pm), to get the client working.
 785 Most of the changes were to get the client to use the university LDAP
 786 for NSS and Kerberos server for PAM, but one was to change a hard
 787 coded DNS domain name in the mklocaluser hook from .intern to
 788 .uio.no.</p>
 789
 790 <p>This testing was so encouraging, that I went ahead and adjusted the
 791 Debian Edu scripts and setup in subversion to centralise the roaming
 792 workstation setup a bit more and avoid the hardcoded DNS domain name,
 793 so that when I test this tomorrow, I expect to get away with modifying
 794 only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the
 795 university servers.</p>
 796
 797 <p>My goal is to get the clients to have no hardcoded settings and
 798 fetch all their initial setup during installation and first boot, to
 799 allow them to be inserted also into environments where the default
 800 setup in Debian Edu has been changed or as with the university, where
 801 the environment is different but provides the protocols Debian Edu
 802 uses.</p>
 803 </div>
 804   <div class="tags">
 805
 806
 807
 808    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 809
 810   </div>
 811  </div>
 812  <div class="padding"></div>
 813
 814  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
 815
 816 <div id="sidebar">
 817
 818
 819
 820
 821
 822 <h2>Archive</h2>
 823 <ul>
 824
 825 <li>2010
 826 <ul>
 827
 828 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 829
 830 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 831
 832 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 833
 834 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 835
 836 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 837
 838 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 839
 840 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
 841
 842 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (10)</a></li>
 843
 844 </ul></li>
 845
 846 <li>2009
 847 <ul>
 848
 849 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 850
 851 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 852
 853 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 854
 855 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 856
 857 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 858
 859 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 860
 861 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 862
 863 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 864
 865 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 866
 867 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 868
 869 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 870
 871 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 872
 873 </ul></li>
 874
 875 <li>2008
 876 <ul>
 877
 878 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 879
 880 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 881
 882 </ul></li>
 883
 884 </ul>
 885
 886
 887
 888 <h2>Tags</h2>
 889 <ul>
 890
 891  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 892
 893  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 894
 895  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 896
 897  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
 898
 899  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (35)</a></li>
 900
 901  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (42)</a></li>
 902
 903  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (57)</a></li>
 904
 905  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 906
 907  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (8)</a></li>
 908
 909  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (3)</a></li>
 910
 911  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
 912
 913  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (2)</a></li>
 914
 915  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 916
 917  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 918
 919  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (75)</a></li>
 920
 921  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (97)</a></li>
 922
 923  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (14)</a></li>
 924
 925  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (15)</a></li>
 926
 927  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 928
 929  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (2)</a></li>
 930
 931  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 932
 933  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (12)</a></li>
 934
 935  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
 936
 937  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
 938
 939  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 940
 941  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 942
 943  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 944
 945  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (7)</a></li>
 946
 947 </ul>
 948
 949 </div>
 950
 951 <p style="text-align: right">
 952 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
 953 </p>
 954 </body>
 955 </html>