blog/archive/2010/05/05.rss

   1 <?xml version="1.0" encoding="ISO-8859-1"?>
   2 <rss version='2.0' xmlns:lj='http://www.livejournal.org/rss/lj/1.0/'>
   3         <channel>
   4                 <title>Petter Reinholdtsen - Entries from May 2010</title>
   5                 <description>Entries from May 2010</description>
   6                 <link>http://people.skolelinux.org/pere/blog/</link>
   7
   8
   9         <item>
  10                 <title>Forcing new users to change their password on first login</title>
  11                 <link>http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html</link>
  12                 <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html</guid>
  13                 <pubDate>Sun, 2 May 2010 13:47:00 +0200</pubDate>
  14                 <description>
  15 &lt;p&gt;One interesting feature in Active Directory, is the ability to
  16 create a new user with an expired password, and thus force the user to
  17 change the password on the first login attempt.&lt;/p&gt;
  18
  19 &lt;p&gt;I&#39;m not quite sure how to do that with the LDAP setup in Debian
  20 Edu, but did some initial testing with a local account.  The account
  21 and password aging information is available in /etc/shadow, but
  22 unfortunately, it is not possible to specify an expiration time for
  23 passwords, only a maximum age for passwords.&lt;/p&gt;
  24
  25 &lt;p&gt;A freshly created account (using adduser test) will have these
  26 settings in /etc/shadow:&lt;/p&gt;
  27
  28 &lt;blockquote&gt;&lt;pre&gt;
  29 root@tjener:~# chage -l test
  30 Last password change                                    : May 02, 2010
  31 Password expires                                        : never
  32 Password inactive                                       : never
  33 Account expires                                         : never
  34 Minimum number of days between password change          : 0
  35 Maximum number of days between password change          : 99999
  36 Number of days of warning before password expires       : 7
  37 root@tjener:~#
  38 &lt;/pre&gt;&lt;/blockquote&gt;
  39
  40 &lt;p&gt;The only way I could come up with to create a user with an expired
  41 account, is to change the date of the last password change to the
  42 lowest value possible (January 1th 1970), and the maximum password age
  43 to the difference in days between that date and today.  To make it
  44 simple, I went for 30 years (30 * 365 = 10950) and January 2th (to
  45 avoid testing if 0 is a valid value).&lt;/p&gt;
  46
  47 &lt;p&gt;After using these commands to set it up, it seem to work as
  48 intended:&lt;/p&gt;
  49
  50 &lt;blockquote&gt;&lt;pre&gt;
  51 root@tjener:~# chage -d 1 test; chage -M 10950 test
  52 root@tjener:~# chage -l test
  53 Last password change                                    : Jan 02, 1970
  54 Password expires                                        : never
  55 Password inactive                                       : never
  56 Account expires                                         : never
  57 Minimum number of days between password change          : 0
  58 Maximum number of days between password change          : 10950
  59 Number of days of warning before password expires       : 7
  60 root@tjener:~#
  61 &lt;/pre&gt;&lt;/blockquote&gt;
  62
  63 &lt;p&gt;So far I have tested this with ssh and console, and kdm (in
  64 Squeeze) login, and all ask for a new password before login in the
  65 user (with ssh, I was thrown out and had to log in again).&lt;/p&gt;
  66
  67 &lt;p&gt;Perhaps we should set up something similar for Debian Edu, to make
  68 sure only the user itself have the account password?&lt;/p&gt;
  69
  70 &lt;p&gt;If you want to comment on or help out with implementing this for
  71 Debian Edu, please contact us on debian-edu@lists.debian.org.&lt;/p&gt;
  72
  73 &lt;p&gt;Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the
  74 shadow(8) page in Debian/testing now state that setting the date of
  75 last password change to zero (0) will force the password to be changed
  76 on the first login.  This was not mentioned in the manual in Lenny, so
  77 I did not notice this in my initial testing.  I have tested it on
  78 Squeeze, and &#39;&lt;tt&gt;chage -d 0 username&lt;/tt&gt;&#39; do work there.  I have not
  79 tested it on Lenny yet.&lt;/p&gt;
  80
  81 &lt;p&gt;Update 2010-05-02-19:05: Jim Paris tells me via email that an
  82 equivalent command to expire a password is &#39;&lt;tt&gt;passwd -e
  83 username&lt;/tt&gt;&#39;, which insert zero into the date of the last password
  84 change.&lt;/p&gt;
  85 </description>
  86         </item>
  87
  88         <item>
  89                 <title>Parallellizing the boot in Debian Squeeze - ready for wider testing</title>
  90                 <link>http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html</link>
  91                 <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html</guid>
  92                 <pubDate>Thu, 6 May 2010 23:25:00 +0200</pubDate>
  93                 <description>
  94 &lt;p&gt;These days, the init.d script dependencies in Squeeze are quite
  95 complete, so complete that it is actually possible to run all the
  96 init.d scripts in parallell based on these dependencies.  If you want
  97 to test your Squeeze system, make sure
  98 &lt;a href=&quot;http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot&quot;&gt;dependency
  99 based boot sequencing&lt;/a&gt; is enabled, and add this line to
 100 /etc/default/rcS:&lt;/p&gt;
 101
 102 &lt;blockquote&gt;&lt;pre&gt;
 103 CONCURRENCY=makefile
 104 &lt;/pre&gt;&lt;/blockquote&gt;
 105
 106 &lt;p&gt;That is it.  It will cause sysv-rc to use the startpar tool to run
 107 scripts in parallel using the dependency information stored in
 108 /etc/init.d/.depend.boot, /etc/init.d/.depend.start and
 109 /etc/init.d/.depend.stop to order the scripts.  Startpar is configured
 110 to try to start the kdm and gdm scripts as early as possible, and will
 111 start the facilities required by kdm or gdm as early as possible to
 112 make this happen.&lt;/p&gt;
 113
 114 &lt;p&gt;Give it a try, and see if you like the result.  If some services
 115 fail to start properly, it is most likely because they have incomplete
 116 init.d script dependencies in their startup script (or some of their
 117 dependent scripts have incomplete dependencies).  Report bugs and get
 118 the package maintainers to fix it. :)&lt;/p&gt;
 119
 120 &lt;p&gt;Running scripts in parallel could be the default in Debian when we
 121 manage to get the init.d script dependencies complete and correct.  I
 122 expect we will get there in Squeeze+1, if we get manage to test and
 123 fix the remaining issues.&lt;/p&gt;
 124
 125 &lt;p&gt;If you report any problems with dependencies in init.d scripts to
 126 the BTS, please usertag the report to get it to show up at
 127 &lt;a href=&quot;http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org&quot;&gt;the
 128 list of usertagged bugs related to this&lt;/a&gt;.&lt;/p&gt;
 129 </description>
 130         </item>
 131
 132         <item>
 133                 <title>systemd, an interesting alternative to upstart</title>
 134                 <link>http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html</link>
 135                 <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html</guid>
 136                 <pubDate>Thu, 13 May 2010 22:20:00 +0200</pubDate>
 137                 <description>
 138 &lt;p&gt;The last few days a new boot system called
 139 &lt;a href=&quot;http://www.freedesktop.org/wiki/Software/systemd&quot;&gt;systemd&lt;/a&gt;
 140 has been
 141 &lt;a href=&quot;http://0pointer.de/blog/projects/systemd.html&quot;&gt;introduced&lt;/a&gt;
 142
 143 to the free software world.  I have not yet had time to play around
 144 with it, but it seem to be a very interesting alternative to
 145 &lt;a href=&quot;http://upstart.ubuntu.com/&quot;&gt;upstart&lt;/a&gt;, and might prove to be
 146 a good alternative for Debian when we are able to switch to an event
 147 based boot system.  Tollef is
 148 &lt;a href=&quot;http://bugs.debian.org/580814&quot;&gt;in the process&lt;/a&gt; of getting
 149 systemd into Debian, and I look forward to seeing how well it work.  I
 150 like the fact that systemd handles init.d scripts with dependency
 151 information natively, allowing them to run in parallel where upstart
 152 at the moment do not.&lt;/p&gt;
 153
 154 &lt;p&gt;Unfortunately do systemd have the same problem as upstart regarding
 155 platform support.  It only work on recent Linux kernels, and also need
 156 some new kernel features enabled to function properly.  This means
 157 kFreeBSD and Hurd ports of Debian will need a port or a different boot
 158 system.  Not sure how that will be handled if systemd proves to be the
 159 way forward.&lt;/p&gt;
 160
 161 &lt;p&gt;In the mean time, based on the
 162 &lt;a href=&quot;http://lists.debian.org/debian-devel/2010/05/msg00122.html&quot;&gt;input
 163 on debian-devel@&lt;/a&gt; regarding parallel booting in Debian, I have
 164 decided to enable full parallel booting as the default in Debian as
 165 soon as possible (probably this weekend or early next week), to see if
 166 there are any remaining serious bugs in the init.d dependencies.  A
 167 new version of the sysvinit package implementing this change is
 168 already in experimental.  If all go well, Squeeze will be released
 169 with parallel booting enabled by default.&lt;/p&gt;
 170 </description>
 171         </item>
 172
 173         </channel>
 174 </rss>