blog/archive/2010/05/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen: entries from May 2010</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="05.rss" type="application/rss+xml">
   8  </head>
   9  <body>
  10 <!-- XML FEED -->
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20  <p>Entries from May 2010.</p>
  21
  22
  23 <div class="entry">
  24  <div class="title">
  25  <a href="http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html">Forcing new users to change their password on first login</a>
  26  </div>
  27  <div class="date">
  28   2010-05-02 13:47
  29  </div>
  30
  31  <div class="body">
  32
  33 <p>One interesting feature in Active Directory, is the ability to
  34 create a new user with an expired password, and thus force the user to
  35 change the password on the first login attempt.</p>
  36
  37 <p>I'm not quite sure how to do that with the LDAP setup in Debian
  38 Edu, but did some initial testing with a local account.  The account
  39 and password aging information is available in /etc/shadow, but
  40 unfortunately, it is not possible to specify an expiration time for
  41 passwords, only a maximum age for passwords.</p>
  42
  43 <p>A freshly created account (using adduser test) will have these
  44 settings in /etc/shadow:</p>
  45
  46 <blockquote><pre>
  47 root@tjener:~# chage -l test
  48 Last password change                                    : May 02, 2010
  49 Password expires                                        : never
  50 Password inactive                                       : never
  51 Account expires                                         : never
  52 Minimum number of days between password change          : 0
  53 Maximum number of days between password change          : 99999
  54 Number of days of warning before password expires       : 7
  55 root@tjener:~#
  56 </pre></blockquote>
  57
  58 <p>The only way I could come up with to create a user with an expired
  59 account, is to change the date of the last password change to the
  60 lowest value possible (January 1th 1970), and the maximum password age
  61 to the difference in days between that date and today.  To make it
  62 simple, I went for 30 years (30 * 365 = 10950) and January 2th (to
  63 avoid testing if 0 is a valid value).</p>
  64
  65 <p>After using these commands to set it up, it seem to work as
  66 intended:</p>
  67
  68 <blockquote><pre>
  69 root@tjener:~# chage -d 1 test; chage -M 10950 test
  70 root@tjener:~# chage -l test
  71 Last password change                                    : Jan 02, 1970
  72 Password expires                                        : never
  73 Password inactive                                       : never
  74 Account expires                                         : never
  75 Minimum number of days between password change          : 0
  76 Maximum number of days between password change          : 10950
  77 Number of days of warning before password expires       : 7
  78 root@tjener:~#
  79 </pre></blockquote>
  80
  81 <p>So far I have tested this with ssh and console, and kdm (in
  82 Squeeze) login, and all ask for a new password before login in the
  83 user (with ssh, I was thrown out and had to log in again).</p>
  84
  85 <p>Perhaps we should set up something similar for Debian Edu, to make
  86 sure only the user itself have the account password?</p>
  87
  88 <p>If you want to comment on or help out with implementing this for
  89 Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
  90
  91 <p>Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the
  92 shadow(8) page in Debian/testing now state that setting the date of
  93 last password change to zero (0) will force the password to be changed
  94 on the first login.  This was not mentioned in the manual in Lenny, so
  95 I did not notice this in my initial testing.  I have tested it on
  96 Squeeze, and '<tt>chage -d 0 username</tt>' do work there.  I have not
  97 tested it on Lenny yet.</p>
  98
  99 <p>Update 2010-05-02-19:05: Jim Paris tells me via email that an
 100 equivalent command to expire a password is '<tt>passwd -e
 101 username</tt>', which insert zero into the date of the last password
 102 change.</p>
 103
 104  </div>
 105  <div class="tags">
 106
 107
 108
 109   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 110
 111  </div>
 112 </div>
 113  <div class="padding"></div>
 114
 115 <div class="entry">
 116  <div class="title">
 117  <a href="http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html">Parallellizing the boot in Debian Squeeze - ready for wider testing</a>
 118  </div>
 119  <div class="date">
 120   2010-05-06 23:25
 121  </div>
 122
 123  <div class="body">
 124
 125 <p>These days, the init.d script dependencies in Squeeze are quite
 126 complete, so complete that it is actually possible to run all the
 127 init.d scripts in parallell based on these dependencies.  If you want
 128 to test your Squeeze system, make sure
 129 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 130 based boot sequencing</a> is enabled, and add this line to
 131 /etc/default/rcS:</p>
 132
 133 <blockquote><pre>
 134 CONCURRENCY=makefile
 135 </pre></blockquote>
 136
 137 <p>That is it.  It will cause sysv-rc to use the startpar tool to run
 138 scripts in parallel using the dependency information stored in
 139 /etc/init.d/.depend.boot, /etc/init.d/.depend.start and
 140 /etc/init.d/.depend.stop to order the scripts.  Startpar is configured
 141 to try to start the kdm and gdm scripts as early as possible, and will
 142 start the facilities required by kdm or gdm as early as possible to
 143 make this happen.</p>
 144
 145 <p>Give it a try, and see if you like the result.  If some services
 146 fail to start properly, it is most likely because they have incomplete
 147 init.d script dependencies in their startup script (or some of their
 148 dependent scripts have incomplete dependencies).  Report bugs and get
 149 the package maintainers to fix it. :)</p>
 150
 151 <p>Running scripts in parallel could be the default in Debian when we
 152 manage to get the init.d script dependencies complete and correct.  I
 153 expect we will get there in Squeeze+1, if we get manage to test and
 154 fix the remaining issues.</p>
 155
 156 <p>If you report any problems with dependencies in init.d scripts to
 157 the BTS, please usertag the report to get it to show up at
 158 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 159 list of usertagged bugs related to this</a>.</p>
 160
 161  </div>
 162  <div class="tags">
 163
 164
 165
 166   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 167
 168  </div>
 169 </div>
 170  <div class="padding"></div>
 171
 172 <div class="entry">
 173  <div class="title">
 174  <a href="http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html">systemd, an interesting alternative to upstart</a>
 175  </div>
 176  <div class="date">
 177   2010-05-13 22:20
 178  </div>
 179
 180  <div class="body">
 181
 182 <p>The last few days a new boot system called
 183 <a href="http://www.freedesktop.org/wiki/Software/systemd">systemd</a>
 184 has been
 185 <a href="http://0pointer.de/blog/projects/systemd.html">introduced</a>
 186
 187 to the free software world.  I have not yet had time to play around
 188 with it, but it seem to be a very interesting alternative to
 189 <a href="http://upstart.ubuntu.com/">upstart</a>, and might prove to be
 190 a good alternative for Debian when we are able to switch to an event
 191 based boot system.  Tollef is
 192 <a href="http://bugs.debian.org/580814">in the process</a> of getting
 193 systemd into Debian, and I look forward to seeing how well it work.  I
 194 like the fact that systemd handles init.d scripts with dependency
 195 information natively, allowing them to run in parallel where upstart
 196 at the moment do not.</p>
 197
 198 <p>Unfortunately do systemd have the same problem as upstart regarding
 199 platform support.  It only work on recent Linux kernels, and also need
 200 some new kernel features enabled to function properly.  This means
 201 kFreeBSD and Hurd ports of Debian will need a port or a different boot
 202 system.  Not sure how that will be handled if systemd proves to be the
 203 way forward.</p>
 204
 205 <p>In the mean time, based on the
 206 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 207 on debian-devel@</a> regarding parallel booting in Debian, I have
 208 decided to enable full parallel booting as the default in Debian as
 209 soon as possible (probably this weekend or early next week), to see if
 210 there are any remaining serious bugs in the init.d dependencies.  A
 211 new version of the sysvinit package implementing this change is
 212 already in experimental.  If all go well, Squeeze will be released
 213 with parallel booting enabled by default.</p>
 214
 215  </div>
 216  <div class="tags">
 217
 218
 219
 220   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 221
 222  </div>
 223 </div>
 224  <div class="padding"></div>
 225
 226 <div class="entry">
 227  <div class="title">
 228  <a href="http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html">Sitesummary tip: Listing MAC address of all clients</a>
 229  </div>
 230  <div class="date">
 231   2010-05-14 21:10
 232  </div>
 233
 234  <div class="body">
 235
 236 <p>In the recent Debian Edu versions, the
 237 <a href="http://wiki.debian.org/DebianEdu/HowTo/SiteSummary">sitesummary
 238 system</a> is used to keep track of the machines in the school
 239 network.  Each machine will automatically report its status to the
 240 central server after boot and once per night.  The network setup is
 241 also reported, and using this information it is possible to get the
 242 MAC address of all network interfaces in the machines.  This is useful
 243 to update the DHCP configuration.</p>
 244
 245 <p>To give some idea how to use sitesummary, here is a one-liner to
 246 ist all MAC addresses of all machines reporting to sitesummary.  Run
 247 this on the collector host:</p>
 248
 249 <blockquote><pre>
 250 perl -MSiteSummary -e 'for_all_hosts(sub { print join(" ", get_macaddresses(shift)), "\n"; });'
 251 </pre></blockquote>
 252
 253 <p>This will list all MAC addresses assosiated with all machine, one
 254 line per machine and with space between the MAC addresses.</p>
 255
 256 <p>To allow system administrators easier job at adding static DHCP
 257 addresses for hosts, it would be possible to extend this to fetch
 258 machine information from sitesummary and update the DHCP and DNS
 259 tables in LDAP using this information.  Such tool is unfortunately not
 260 written yet.</p>
 261
 262  </div>
 263  <div class="tags">
 264
 265
 266
 267   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary</a>.
 268
 269  </div>
 270 </div>
 271  <div class="padding"></div>
 272
 273 <div class="entry">
 274  <div class="title">
 275  <a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html">Parallellized boot is now the default in Debian/unstable</a>
 276  </div>
 277  <div class="date">
 278   2010-05-14 22:40
 279  </div>
 280
 281  <div class="body">
 282
 283 <p>Since this evening, parallel booting is the default in
 284 Debian/unstable for machines using dependency based boot sequencing.
 285 Apparently the testing of concurrent booting has been wider than
 286 expected, if I am to believe the
 287 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 288 on debian-devel@</a>, and I concluded a few days ago to move forward
 289 with the feature this weekend, to give us some time to detect any
 290 remaining problems before Squeeze is frozen.  If serious problems are
 291 detected, it is simple to change the default back to sequential boot.
 292 The upload of the new sysvinit package also activate a new upstream
 293 version.</p>
 294
 295 More information about
 296 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 297 based boot sequencing</a> is available from the Debian wiki.  It is
 298 currently possible to disable parallel booting when one run into
 299 problems caused by it, by adding this line to /etc/default/rcS:</p>
 300
 301 <blockquote><pre>
 302 CONCURRENCY=none
 303 </pre></blockquote>
 304
 305 <p>If you report any problems with dependencies in init.d scripts to
 306 the BTS, please usertag the report to get it to show up at
 307 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 308 list of usertagged bugs related to this</a>.</p>
 309
 310  </div>
 311  <div class="tags">
 312
 313
 314
 315   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian-edu">debian-edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 316
 317  </div>
 318 </div>
 319  <div class="padding"></div>
 320
 321  <p style="text-align: right;"><a href="05.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14"></a></p>
 322
 323
 324
 325 <div id="sidebar">
 326
 327 <h2>Archive</h2>
 328 <ul>
 329
 330 <li>2010
 331 <ul>
 332
 333 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 334
 335 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 336
 337 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 338
 339 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 340
 341 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (5)</a></li>
 342
 343 </ul></li>
 344
 345 <li>2009
 346 <ul>
 347
 348 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 349
 350 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 351
 352 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 353
 354 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 355
 356 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 357
 358 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 359
 360 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 361
 362 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 363
 364 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 365
 366 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 367
 368 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 369
 370 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 371
 372 </ul></li>
 373
 374 <li>2008
 375 <ul>
 376
 377 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 378
 379 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 380
 381 </ul></li>
 382
 383 </ul>
 384
 385
 386
 387 <h2>Tags</h2>
 388 <ul>
 389
 390  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 391
 392  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 393
 394  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 395
 396  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (18)</a></li>
 397
 398  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (16)</a></li>
 399
 400  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian-edu">debian-edu (1)</a></li>
 401
 402  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (28)</a></li>
 403
 404  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 405
 406  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (6)</a></li>
 407
 408  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
 409
 410  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
 411
 412  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 413
 414  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 415
 416  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (64)</a></li>
 417
 418  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (72)</a></li>
 419
 420  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (12)</a></li>
 421
 422  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (11)</a></li>
 423
 424  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 425
 426  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 427
 428  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (7)</a></li>
 429
 430  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (1)</a></li>
 431
 432  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (11)</a></li>
 433
 434  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 435
 436  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 437
 438  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 439
 440  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
 441
 442 </ul>
 443
 444 </div>
 445 </body>
 446 </html>