blog/data/2012-06-11-skolelinux-wheezy.txt

   1 Title: Debian Edu - some ideas for the future versions
   2 Tags: english, debian edu
   3 Date: 2012-06-11 14:30
   4
   5 <p>During my work on
   6 <a href="http://www.debian.org/News/2012/20120311.nb.html">Debian Edu
   7 based on Squeeze</a>, I came across some issues that should be
   8 addressed in the Wheezy release.  I finally found time to wrap up my
   9 notes and provide quick summary of what I found, with a bit
  10 explanation.</p>
  11
  12 <p><ul>
  13
  14 <li>We need to rewrite our package installation framework, as tasksel
  15 changed from using tasksel tasks to using meta packages (aka packages
  16 with dependencies like our education-* packages), and our installation
  17 system depend on tasksel tasks in
  18 /usr/share/tasksel/debian-edu-tasks.desc for package
  19 installation.</li>
  20
  21 <li>Enable Kerberos login for more services.  Now with the Kerberos
  22 foundation in place, we should use it to get single sign on with more
  23 services, and avoiding unneeded password / login questions.  We should
  24 at least try to enable it for these services:
  25 <ul>
  26
  27   <li>CUPS for admins to add/configure printers and users when using
  28     quotas.</li>
  29   <li>Nagios for admins checking the system status.</li>
  30   <li>GOsa for admins updating LDAP and users changing their passwords.</li>
  31   <li>LDAP for admins updating LDAP.</li>
  32   <li>Squid for users when exam mode / filtering is active.</li>
  33   <li>ssh for admins and users to save a password prompt.</li>
  34
  35 </ul></li>
  36
  37 <li>When we move GOsa to use Kerberos instead of LDAP bind to
  38 authenticate users, we should try to block or at least limit access to
  39 use LDAP bind for authentication, to ensure Kerberos is used when it
  40 is intended, and nothing fall back to using the less safe LDAP bind</li>
  41
  42 <li>Merge debian-edu-config and debian-edu-install.  The split made
  43 sense when d-e-install did a lot more, but these days it is just an
  44 inconvenience when we update the debconf preseeding values.</li>
  45
  46 <li>Fix partman-auto to allow us to abort the installation before
  47 touching the disk if the disk is too small.  This is
  48 <a href="http://bugs.debian.org/653305">BTS report #653305</a> and the
  49 d-i developers are fine with the patch and someone just need to apply
  50 it and upload.  After this is done we need to adjust
  51 debian-edu-install to use this new hook.</li>
  52
  53 <li>Adjust to new LTSP framework (boot time config instead of install
  54 time config).  LTSP changed its design, and our hooks to install
  55 packages and update the configuration is most likely not going to work
  56 in Wheezy.
  57
  58 <li>Consider switching to NBD instead of NFS for LTSP root, to allow
  59 the Kernel to cache files in its normal file cache, possibly speeding
  60 up KDE login on slow networks.</li>
  61
  62 <li>Make it possible to create expired user passwords that need to
  63 change on first login.  This is useful when handing out password on
  64 paper, to make sure only the user know the password.  This require
  65 fixes to the PAM handling of kdm and gdm.</li>
  66
  67 <li>Make GUI for adding new machines automatically from sitesummary.
  68 The current command line script is not very friendly to people most
  69 familiar with GUIs.  This should probably be integrated into GOsa to
  70 have it available where the admin will be looking for it..</li>
  71
  72 <li>We should find way for Nagios to check that the DHCP service
  73 actually is working (as in handling out IP addresses).  None of the
  74 Nagios checks I have found so far have been working for me.</li>
  75
  76 <li>We should switch from libpam-nss-ldapd to sssd for all profiles
  77 using LDAP, and not only on for roaming workstations, to have less
  78 packages to configure and consistent setup across all profiles.</li>
  79
  80 <li>We should configure Kerberos to update LDAP and Samba password
  81 when changing password using the Kerberos protocol.  The hook was
  82 requested in <a href="http://bugs.debian.org/588968">BTS report
  83 #588968</a> and is now available in Wheezy.  We might need to write a
  84 MIT Kerberos plugin in C to get this.</li>
  85
  86 <li>We should clean up the set of applications installed by default.
  87 <ul>
  88
  89 <li>reduce the number of chemistry visualisers</li>
  90 <li>consider dropping xpaint</li>
  91 <li>and probably more?</li>
  92 </ul></li>
  93
  94 <li>Some hardware need external firmware to work properly.  This is
  95 mostly the case for WiFi network cards, but there are some other
  96 examples too.  For popular laptops to work out of the box, such
  97 firmware need to be installed from non-free, and we should provide
  98 some GUI to do this.  Ubuntu already have this implemented, and we
  99 could consider using their packages.  At the moment we have some
 100 command line script to do this (one for the running system, another
 101 for the LTSP chroot).</li>
 102
 103
 104 <li>In Squeeze, we provide KDE, Gnome and LXDE as desktop options.  We
 105 should extend the list to Xfce and Sugar, and preferably find a way to
 106 install several and allow the admin or the user to select which one to
 107 use.</li>
 108
 109 <li>The golearn tool from the goplay package make it easy to check out
 110 interesting educational packages.  We should work on the package
 111 tagging in Debian to ensure it represent all the useful educational
 112 packages, and extend the tool to allow it to use packagekit to install
 113 new applications with a simple mouse click.</li>
 114
 115 <li>The Squeeze version got half a exam solution already in place,
 116 with the introduction of iptable based network blocking, but for it to
 117 be a complete exam solution the Squid proxy need to enable
 118 filtering/blocking as well when the exam mode is enabled.  We should
 119 implement a way to easily enable this for the schools that want it,
 120 instead of the "it is documented" method of today.</li>
 121
 122 <li>A feature used in several schools is the ability for a teacher to
 123 "take over" the desktop of individual or all computers in the room.
 124 There are at least three implementations,
 125 <a href="italc.sourceforge.net/">italc</a>,
 126 <a href="http://www.itais.net/help/en/">controlaula</a> og
 127 <a href="http://www.epoptes.org/">epoptes</a> and we should pick one of
 128 them and make it trivial to set it up in a school.  The challenges is
 129 how to distribute crypto keys and how to group computers in one room
 130 and how to set up which machine/user can control the machines in a
 131 given room.</li>
 132
 133 <li>Tablets and surf boards are getting more and more popular, and we
 134 should look into providing a good solution for integrating these into
 135 the Debian Edu network.  Not quite sure how.  Perhaps we should
 136 provide a installation profile with better touch screen support for
 137 them, or add some sync services to allow them to exchange
 138 configuration and data with the central server.  This should be
 139 investigated.</li>
 140
 141 </ul></p>
 142
 143 <p>I guess we will discover more as we continue to work on the Wheezy
 144 version.</p>