[homepage.git] / blog / index.rss

<?xml version="1.0" encoding="utf-8"?>
<rss version='2.0' xmlns:lj='http://www.livejournal.org/rss/lj/1.0/' xmlns:atom="http://www.w3.org/2005/Atom">
        <channel>
                <title>Petter Reinholdtsen</title>
                <description></description>
                <link></link>
                <atom:link href="index.rss" rel="self" type="application/rss+xml" />
        
        <item>
                <title>Forcing new users to change their password on first login</title>
                <link>Forcing_new_users_to_change_their_password_on_first_login.html</link>
                <guid isPermaLink="true">Forcing_new_users_to_change_their_password_on_first_login.html</guid>
                <pubDate>Sun, 2 May 2010 13:47:00 +0200</pubDate>
                <description>
&lt;p&gt;One interesting feature in Active Directory, is the ability to
create a new user with an expired password, and thus force the user to
change the password on the first login attempt.&lt;/p&gt;

&lt;p&gt;I&#39;m not quite sure how to do that with the LDAP setup in Debian
Edu, but did some initial testing with a local account.  The account
and password aging information is available in /etc/shadow, but
unfortunately, it is not possible to specify an expiration time for
passwords, only a maximum age for passwords.&lt;/p&gt;

&lt;p&gt;A freshly created account (using adduser test) will have these
settings in /etc/shadow:&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
root@tjener:~# chage -l test
Last password change                                    : May 02, 2010
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 99999
Number of days of warning before password expires       : 7
root@tjener:~#
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;p&gt;The only way I could come up with to create a user with an expired
account, is to change the date of the last password change to the
lowest value possible (January 1th 1970), and the maximum password age
to the difference in days between that date and today.  To make it
simple, I went for 30 years (30 * 365 = 10950) and January 2th (to
avoid testing if 0 is a valid value).&lt;/p&gt;

&lt;p&gt;After using these commands to set it up, it seem to work as
intended:&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
root@tjener:~# chage -d 1 test; chage -M 10950 test
root@tjener:~# chage -l test
Last password change                                    : Jan 02, 1970
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 10950
Number of days of warning before password expires       : 7
root@tjener:~#  
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;p&gt;So far I have tested this with ssh and console, and kdm (in
Squeeze) login, and all ask for a new password before login in the
user (with ssh, I was thrown out and had to log in again).&lt;/p&gt;

&lt;p&gt;Perhaps we should set up something similar for Debian Edu, to make
sure only the user itself have the account password?&lt;/p&gt;

&lt;p&gt;If you want to comment on or help out with implementing this for
Debian Edu, please contact us on debian-edu@lists.debian.org.&lt;/p&gt;

&lt;p&gt;Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the
shadow(8) page in Debian/testing now state that setting the date of
last password change to zero (0) will force the password to be changed
on the first login.  This was not mentioned in the manual in Lenny, so
I did not notice this in my initial testing.  I have tested it on
Squeeze, and &#39;&lt;tt&gt;chage -d 0 username&lt;/tt&gt;&#39; do work there.  I have not
tested it on Lenny yet.&lt;/p&gt;

&lt;p&gt;Update 2010-05-02-19:05: Jim Paris tells me via email that an
equivalent command to expire a password is &#39;&lt;tt&gt;passwd -e
username&lt;/tt&gt;&#39;, which insert zero into the date of the last password
change.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Thoughts on roaming laptop setup for Debian Edu</title>
                <link>Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html</link>
                <guid isPermaLink="true">Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html</guid>
                <pubDate>Wed, 28 Apr 2010 20:40:00 +0200</pubDate>
                <description>
&lt;p&gt;For some years now, I have wondered how we should handle laptops in
Debian Edu.  The Debian Edu infrastructure is mostly designed to
handle stationary computers, and less suited for computers that come
and go.&lt;/p&gt;

&lt;p&gt;Now I finally believe I have an sensible idea on how to adjust
Debian Edu for laptops, by introducing a new profile for them, for
example called Roaming Workstations.  Here are my thought on this.
The setup would consist of the following:&lt;/p&gt;

&lt;ul&gt;

 &lt;li&gt;During installation, the user name of the owner / primary user of
   the laptop is requested and a local home directory is set up for
   the user, with uid and gid information fetched from the LDAP
   server.  This allow the user to work also when offline.  The
   central home directory can be available in a subdirectory on
   request, for example mounted via CIFS.  It could be mounted
   automatically when a user log in while on the Debian Edu network,
   and unmounted when the machine is taken away (network down,
   hibernate, etc), it can be set up to do automatic mounting on
   request (using autofs), or perhaps some GUI button on the desktop
   can be used to access it when needed.  Perhaps it is enough to use
   the fish protocol in KDE?&lt;/li&gt;

 &lt;li&gt;Password checking is set up to use LDAP or Kerberos
   authentication when the machine is on the Debian Edu network, and
   to cache the password for offline checking when the machine unable
   to reach the LDAP or Kerberos server.  This can be done using
   &lt;a href=&quot;http://www.padl.com/OSS/pam_ccreds.html&quot;&gt;libpam-ccreds&lt;/a&gt;
   or the Fedora developed
   &lt;a href=&quot;https://fedoraproject.org/wiki/Features/SSSD&quot;&gt;System
   Security Services Daemon&lt;/a&gt; packages.&lt;/li&gt;

 &lt;li&gt;File synchronisation with the central home directory is set up
   using a shared directory in both the local and the central home
   directory, using unison.&lt;/li&gt;

 &lt;li&gt;Printing should be set up to print to all printers broadcasting
   their existence on the local network, and should then work out of
   the box with CUPS.  For sites needing accurate printer quotas, some
   system with Kerberos authentication or printing via ssh could be
   implemented.&lt;/li&gt;

 &lt;li&gt;For users that should have local root access to their laptop,
   sudo should be used to allow this to the local user.&lt;/li&gt;

 &lt;li&gt;It would be nice if user and group information from LDAP is
   cached on the client, but given that there are entries for the
   local user and primary group in /etc/, it should not be needed.&lt;/li&gt;

&lt;/ul&gt;

&lt;p&gt;I believe all the pieces to implement this are in Debian/testing at
the moment.  If we work quickly, we should be able to get this ready
in time for the Squeeze release to freeze.  Some of the pieces need
tweaking, like libpam-ccreds should get support for pam-auth-update
(&lt;a href=&quot;http://bugs.debian.org/566718&quot;&gt;#566718&lt;/a&gt;) and nslcd (or
perhaps debian-edu-config) should get some integration code to stop
its daemon when the LDAP server is unavailable to avoid long timeouts
when disconnected from the net.  If we get Kerberos enabled, we need
to make sure we avoid long timeouts there too.&lt;/p&gt;

&lt;p&gt;If you want to help out with implementing this for Debian Edu,
please contact us on debian-edu@lists.debian.org.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Great book: &quot;Content: Selected Essays on Technology, Creativity, Copyright, and the Future of the Future&quot;</title>
                <link>Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html</link>
                <guid isPermaLink="true">Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html</guid>
                <pubDate>Mon, 19 Apr 2010 17:10:00 +0200</pubDate>
                <description>
&lt;p&gt;The last few weeks i have had the pleasure of reading a
thought-provoking collection of essays by Cory Doctorow, on topics
touching copyright, virtual worlds, the future of man when the
conscience mind can be duplicated into a computer and many more. The
book titled &quot;Content: Selected Essays on Technology, Creativity,
Copyright, and the Future of the Future&quot; is available with few
restrictions on the web, for example from
&lt;a href=&quot;http://craphound.com/content/&quot;&gt;his own site&lt;/a&gt;. I read the
epub-version from
&lt;a href=&quot;http://www.feedbooks.com/book/2883&quot;&gt;feedbooks&lt;/a&gt; using
&lt;a href=&quot;http://www.fbreader.org/&quot;&gt;fbreader&lt;/a&gt; and my N810. I
strongly recommend this book.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Kerberos for Debian Edu/Squeeze?</title>
                <link>Kerberos_for_Debian_Edu_Squeeze_.html</link>
                <guid isPermaLink="true">Kerberos_for_Debian_Edu_Squeeze_.html</guid>
                <pubDate>Wed, 14 Apr 2010 17:20:00 +0200</pubDate>
                <description>
&lt;p&gt;&lt;a href=&quot;http://www.nuug.no/aktiviteter/20100413-kerberos/&quot;&gt;Yesterdays
NUUG presentation&lt;/a&gt; about Kerberos was inspiring, and reminded me
about the need to start using Kerberos in Skolelinux.  Setting up a
Kerberos server seem to be straight forward, and if we get this in
place a long time before the Squeeze version of Debian freezes, we
have a chance to migrate Skolelinux away from NFSv3 for the home
directories, and over to an architecture where the infrastructure do
not have to trust IP addresses and machines, and instead can trust
users and cryptographic keys instead.&lt;/p&gt;

&lt;p&gt;A challenge will be integration and administration.  Is there a
Kerberos implementation for Debian where one can control the
administration access in Kerberos using LDAP groups?  With it, the
school administration will have to maintain access control using flat
files on the main server, which give a huge potential for errors.&lt;/p&gt;

&lt;p&gt;A related question I would like to know is how well Kerberos and
pam-ccreds (offline password check) work together.  Anyone know?&lt;/p&gt;

&lt;p&gt;Next step will be to use Kerberos for access control in Lwat and
Nagios.  I have no idea how much work that will be to implement.  We
would also need to document how to integrate with Windows AD, as such
shared network will require two Kerberos realms that need to cooperate
to work properly.&lt;/p&gt;

&lt;p&gt;I believe a good start would be to start using Kerberos on the
skolelinux.no machines, and this way get ourselves experience with
configuration and integration.  A natural starting point would be
setting up ldap.skolelinux.no as the Kerberos server, and migrate the
rest of the machines from PAM via LDAP to PAM via Kerberos one at the
time.&lt;/p&gt;

&lt;p&gt;If you would like to contribute to get this working in Skolelinux,
I recommend you to see the video recording from yesterdays NUUG
presentation, and start using Kerberos at home.  The video show show
up in a few days.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>På vegne av vanvitting mange, Aftenposten!</title>
                <link>P___vegne_av_vanvitting_mange__Aftenposten_.html</link>
                <guid isPermaLink="true">P___vegne_av_vanvitting_mange__Aftenposten_.html</guid>
                <pubDate>Sat, 6 Mar 2010 21:15:00 +0100</pubDate>
                <description>
&lt;p&gt;&lt;a href=&quot;http://fotball.aftenposten.no/incoming/article163000.ece&quot;&gt;Aftenposten
melder&lt;/a&gt; på forsiden av webavisen sin at de tror Erling Fossen
provoserer nordlendinger med sine uttalelser på
fotballtinget.  Jeg er utflyttet nordlending, og må innrømme at jeg
ikke kjennet så mye som et snev av provokasjon fra denne litt morsomme
uttalelsen til Hr. Fossen.  Lurer på om Aftenposten har noen kilder
utenom redaksjonen for sin påstand om at nordledinger er provosert av
Hr. Fossen.  Må innrømme at jeg tviler på det.&lt;/p&gt;

&lt;p&gt;Det hele bringer tankene tilbake til Sture Hansen i Hallo i Uken.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>After 6 years of waiting, the Xreset.d feature is implemented</title>
                <link>After_6_years_of_waiting__the_Xreset_d_feature_is_implemented.html</link>
                <guid isPermaLink="true">After_6_years_of_waiting__the_Xreset_d_feature_is_implemented.html</guid>
                <pubDate>Sat, 6 Mar 2010 18:15:00 +0100</pubDate>
                <description>
&lt;p&gt;6 years ago, as part of the Debian Edu development I am involved
in, I asked for a hook in the kdm and gdm setup to run scripts as root
when the user log out.  A bug was submitted against the xfree86-common
package in 2004 (&lt;a href=&quot;http://bugs.debian.org/230422&quot;&gt;#230422&lt;/a&gt;),
and revisited every time Debian Edu was working on a new release.
Today, this finally paid off.&lt;/p&gt;

&lt;p&gt;The framework for this feature was today commited to the git
repositry for the xorg package, and the git repository for xdm has
been updated to use this framework.  Next on my agenda is to make sure
kdm and gdm also add code to use this framework.&lt;/p&gt;

&lt;p&gt;In Debian Edu, we want to ability to run commands as root when the
user log out, to get rid of runaway processes and do general cleanup
after a user.  With this framework in place, we finally can do that in
a generic way that work with all display managers using this
framework.  My goal is to get all display managers in Debian use it,
similar to how they use the Xsession.d framework today.&lt;p&gt;
</description>
        </item>
        
        <item>
                <title>Digitale bøker uten digitale restriksjonsmekanismer (DRM) bør få mva-fritak</title>
                <link>Digitale_b__ker_uten_digitale_restriksjonsmekanismer__DRM__b__r_f___mva_fritak.html</link>
                <guid isPermaLink="true">Digitale_b__ker_uten_digitale_restriksjonsmekanismer__DRM__b__r_f___mva_fritak.html</guid>
                <pubDate>Wed, 3 Mar 2010 19:00:00 +0100</pubDate>
                <description>
&lt;p&gt;Den norske bokbransjen har
&lt;a href=&quot;http://www.digi.no/823912/nei-til-moms-paa-e-boker&quot;&gt;bedt om at
digitale bøker må få mva-fritak&lt;/a&gt; slik papirbøker har det, og
&lt;a href=&quot;http://www.digi.no/836875/moms-paa-alt-digitalt-innhold&quot;&gt;finansdepartementet
har sagt nei&lt;/a&gt;.  Det er et interessant spørsmål om digitale bøker
bør ha mva-fritak eller ikke, og svaret er ikke så enkelt som et ja
eller nei.
&lt;a href=&quot;http://www.digi.no/836925/norske-e-boker-truet-av-moms&quot;&gt;Enkelte
medlemmer&lt;/a&gt; av bokbransjen truer med å droppe den planlagte
lanseringen av norske digitale bøker med digitale restriksjonsmekanismer
(DRM) som de har snakket om å gjennomføre nå i vår, og det må de
gjerne gjøre for min del.&lt;/p&gt;

&lt;p&gt;Papirbøker har mva-fritak pga. at de fremmer kultur- og
kunnskapsspredning.  Digitale bøker uten digitale
restriksjonsmekanismer (DRM) fremmer kultur- og kunnskapsspredning,
mens digitale bøker med DRM hindrer kultur og kunnskapsspredning.
Digitale bøker uten DRM bør få mva-fritak da det er salg av bøker på
lik linje med salg av papirbøker, mens digitale bøker med DRM ikke bør
få det da det er utleie av bøker og ikke salg.&lt;/p&gt;

&lt;p&gt;Jeg foretrekker å kjøpe bøker, og velger dermed å la være å bruke
DRM-belastede digitale bøker.  Vet ikke helt hva jeg ville være villig
til å betale for å leie en bok, men tror ikke det er mange kronene.
Heldigvis er det mye bøker tilgjengelig uten slike restriksjoner, og
de som vil ha tak i engelske bøker kan laste ned bøker som er
tilgjengelig uten bruksbegresninger fra &lt;a href=&quot;http://www.archive.org/&quot;&gt;The
Internet Archive&lt;/a&gt;. Der er det pr. i dag 1 889 313 bøker
tilgjengelig. De er tilgjengelig i flere formater. Besøk
&lt;a href=&quot;http://www.archive.org/details/texts&quot;&gt;oversikten over tekster
der&lt;/a&gt; for å se hva de har.
</description>
        </item>
        
        <item>
                <title>Debian Edu / Skolelinux based on Lenny released, work continues</title>
                <link>Debian_Edu___Skolelinux_based_on_Lenny_released__work_continues.html</link>
                <guid isPermaLink="true">Debian_Edu___Skolelinux_based_on_Lenny_released__work_continues.html</guid>
                <pubDate>Thu, 11 Feb 2010 17:15:00 +0100</pubDate>
                <description>
&lt;p&gt;On Tuesday, the Debian/Lenny based version of
&lt;a href=&quot;http://www.skolelinux.org/&quot;&gt;Skolelinux&lt;/a&gt; was finally
shipped.  This was a major leap forward for the project, and I am very
pleased that we finally got the release wrapped up.  Work on the first
point release starts imediately, as we plan to get that one out a
month after the major release, to include all fixes for bugs we found
and fixed too late in the release process to include last Tuesday.&lt;/p&gt;

&lt;p&gt;Perhaps it even is time for some partying?&lt;/p&gt;

&lt;p&gt;After this first point release, my plan is to focus again on the
next major release, based on Squeeze.  We will try to get as many of
the fixes we need into the official Debian packages before the freeze,
and have just a few weeks or months to make it happen.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Danmark går for ODF?</title>
                <link>Danmark_g__r_for_ODF_.html</link>
                <guid isPermaLink="true">Danmark_g__r_for_ODF_.html</guid>
                <pubDate>Fri, 29 Jan 2010 12:00:00 +0100</pubDate>
                <description>
&lt;p&gt;Ble nettopp gjort oppmerksom på en
&lt;a href=&quot;http://www.version2.dk/artikel/13690-breaking-odf-vinder-dokumentformat-krigen &quot;&gt;nyhet fra Version2&lt;/a&gt;
fra Danmark, der det hevdes at Folketinget har vedtatt at ODF skal
brukes som dokumentutvekslingsformat i Staten.&lt;/p&gt;

&lt;p&gt;Hyggelig lesning, spesielt hvis det viser seg at de av vedtatt
kravlisten for hva som skal aksepteres som referert i kommentarfeltet
til artikkelen og
&lt;a href=&quot;http://www.version2.dk/artikel/13693-er-ooxml-doemt-ude-her-er-kravene-til-en-offentlig-dokumentstandard&quot;&gt;en
annen artikkel&lt;/a&gt; i samme nett-avis.  Liker spesielt godt denne:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt; Det skal demonstreres, at standarden i sin helhed kan
implementeres af alle direkte i sin helhed på flere
platforme.&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;Noe slikt burde være et krav også i Norge.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Automatic Munin and Nagios configuration</title>
                <link>Automatic_Munin_and_Nagios_configuration.html</link>
                <guid isPermaLink="true">Automatic_Munin_and_Nagios_configuration.html</guid>
                <pubDate>Wed, 27 Jan 2010 15:15:00 +0100</pubDate>
                <description>
&lt;p&gt;One of the new features in the next Debian/Lenny based release of
Debian Edu/Skolelinux, which is scheduled for release in the next few
days, is automatic configuration of the service monitoring system
Nagios.  The previous release had automatic configuration of trend
analysis using Munin, and this Lenny based release take that a step
further.&lt;/p&gt;

&lt;p&gt;When installing a Debian Edu Main-server, it is automatically
configured as a Munin and Nagios server.  In addition, it is
configured to be a server for the
&lt;a href=&quot;http://wiki.debian.org/DebianEdu/HowTo/SiteSummary&quot;&gt;SiteSummary
system&lt;/a&gt; I have written for use in Debian Edu.  The SiteSummary
system is inspired by a system used by the University of Oslo where I
work.  In short, the system provide a centralised collector of
information about the computers on the network, and a client on each
computer submitting information to this collector.  This allow for
automatic information on which packages are installed on each machine,
which kernel the machines are using, what kind of configuration the
packages got etc.  This also allow us to automatically generate Munin
and Nagios configuration.&lt;/p&gt;

&lt;p&gt;All computers reporting to the sitesummary collector with the
munin-node package installed is automatically enabled as a Munin
client and graphs from the statistics collected from that machine show
up automatically on http://www/munin/ on the Main-server.&lt;/p&gt;

&lt;p&gt;All non-laptop computers reporting to the sitesummary collector are
automatically monitored for network presence (ping and any network
services detected).  In addition, all computers (also laptops) with
the nagios-nrpe-server package installed and configured the way
sitesummary would configure it, are monitored for full disks, software
raid status, swap free and other checks that need to run locally on
the machine.&lt;/p&gt;

&lt;p&gt;The result is that the administrator on a school using Debian Edu
based on Lenny will be able to check the health of his installation
with one look at the Nagios settings, without having to spend any time
keeping the Nagios configuration up-to-date.&lt;/p&gt;

&lt;p&gt;The only configuration one need to do to get Nagios up and running
is to set the password used to get access via HTTP.  The system
administrator need to run &quot;&lt;tt&gt;htpasswd /etc/nagios3/htpasswd.users
nagiosadmin&lt;/tt&gt;&quot; to create a nagiosadmin user and set a password for
it to be able to log into the Nagios web pages.  After that,
everything is taken care of.&lt;/p&gt;
</description>
        </item>
        
        </channel>
</rss>