blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_seem_to_hold_up_well_in_Debian_testing.html">Parallellized boot seem to hold up well in Debian/testing</a></div>
  24   <div class="date">2010-05-27 23:55</div>
  25   <div class="body">
  26 <p>A few days ago, parallel booting was enabled in Debian/testing.
  27 The feature seem to hold up pretty well, but three fairly serious
  28 issues are known and should be solved:
  29
  30 <p><ul>
  31
  32 <li>The wicd package seen to
  33 <a href="http://bugs.debian.org/508289">break NFS mounting and
  34 <a href="http://bugs.debian.org/581586">network setup</A> when
  35 parallel booting is enabled.  No idea why, but the wicd maintainer
  36 seem to be on the case.</li>
  37
  38 <li>The nvidia X driver seem to
  39 <a href="http://bugs.debian.org/583312">have a race condition</a>
  40 triggered more easily when parallel booting is in effect.  The
  41 maintainer is on the case.</li>
  42
  43 <li>The sysv-rc package fail to properly enable dependency based boot
  44 sequencing (the shutdown is broken) when old file-rc users
  45 <a href="http://bugs.debian.org/550425">try to switch back</a> to
  46 sysv-rc.  One way to solve it would be for file-rc to create
  47 /etc/init.d/.legacy-bootordering, and another is to try to make
  48 sysv-rc more robust.  Will investigate some more and probably upload a
  49 workaround in sysv-rc to help those trying to move from file-rc to
  50 sysv-rc get a working shutdown.</li>
  51
  52 </ul></p>
  53
  54 <p>All in all not many surprising issues, and all of them seem
  55 solvable before Squeeze is released.  In addition to these there are
  56 some packages with bugs in their dependencies and run level settings,
  57 which I expect will be fixed in a reasonable time span.</p>
  58
  59 <p>If you report any problems with dependencies in init.d scripts to
  60 the BTS, please usertag the report to get it to show up at
  61 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
  62 list of usertagged bugs related to this</a>.</p>
  63 </div>
  64   <div class="tags">
  65
  66
  67
  68    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
  69
  70   </div>
  71  </div>
  72  <div class="padding"></div>
  73
  74  <div class="entry">
  75   <div class="title"><a href="http://people.skolelinux.org/pere/blog/More_flexible_firmware_handling_in_debian_installer.html">More flexible firmware handling in debian-installer</a></div>
  76   <div class="date">2010-05-22 21:30</div>
  77   <div class="body">
  78 <p>After a long break from debian-installer development, I finally
  79 found time today to return to the project.  Having to spend less time
  80 working dependency based boot in debian, as it is almost complete now,
  81 definitely helped freeing some time.</p>
  82
  83 <p>A while back, I ran into a problem while working on Debian Edu.  We
  84 include some firmware packages on the Debian Edu CDs, those needed to
  85 get disk and network controllers working.  Without having these
  86 firmware packages available during installation, it is impossible to
  87 install Debian Edu on the given machine, and because our target group
  88 are non-technical people, asking them to provide firmware packages on
  89 an external medium is a support pain.  Initially, I expected it to be
  90 enough to include the firmware packages on the CD to get
  91 debian-installer to find and use them.  This proved to be wrong.
  92 Next, I hoped it was enough to symlink the relevant firmware packages
  93 to some useful location on the CD (tried /cdrom/ and
  94 /cdrom/firmware/).  This also proved to not work, and at this point I
  95 found time to look at the debian-installer code to figure out what was
  96 going to work.</p>
  97
  98 <p>The firmware loading code is in the hw-detect package, and a closer
  99 look revealed that it would only look for firmware packages outside
 100 the installation media, so the CD was never checked for firmware
 101 packages.  It would only check USB sticks, floppies and other
 102 "external" media devices.  Today I changed it to also look in the
 103 /cdrom/firmware/ directory on the mounted CD or DVD, which should
 104 solve the problem I ran into with Debian edu.  I also changed it to
 105 look in /firmware/, to make sure the installer also find firmware
 106 provided in the initrd when booting the installer via PXE, to allow us
 107 to provide the same feature in the PXE setup included in Debian
 108 Edu.</p>
 109
 110 <p>To make sure firmware deb packages with a license questions are not
 111 activated without asking if the license is accepted, I extended
 112 hw-detect to look for preinst scripts in the firmware packages, and
 113 run these before activating the firmware during installation.  The
 114 license question is asked using debconf in the preinst, so this should
 115 solve the issue for the firmware packages I have looked at so far.</p>
 116
 117 <p>If you want to discuss the details of these features, please
 118 contact us on debian-boot@lists.debian.org.</p>
 119 </div>
 120   <div class="tags">
 121
 122
 123
 124    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 125
 126   </div>
 127  </div>
 128  <div class="padding"></div>
 129
 130  <div class="entry">
 131   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html">Magnetstripeinnhold i billetter fra Flytoget og Hurtigruten</a></div>
 132   <div class="date">2010-05-21 16:00</div>
 133   <div class="body">
 134 <p>For en stund tilbake kjøpte jeg en magnetkortleser for å kunne
 135 titte på hva som er skrevet inn på magnetstripene til ulike kort.  Har
 136 ikke hatt tid til å analysere mange kort så langt, men tenkte jeg
 137 skulle dele innholdet på to kort med mine lesere.</p>
 138
 139 <p>For noen dager siden tok jeg flyet til Harstad og Hurtigruten til
 140 Bergen.  Flytoget fra Oslo S til flyplassen ga meg en billett med
 141 magnetstripe.  Påtrykket finner jeg følgende informasjon:</p>
 142
 143 <pre>
 144 Flytoget Airport Express Train
 145
 146 Fra - Til        : Oslo Sentralstasjon
 147 Kategori         : Voksen
 148 Pris             : Nok 170,00
 149 Herav mva. 8,00% : NOK 12,59
 150 Betaling         : Kontant
 151 Til - Fra        : Oslo Lufthavn
 152 Utstedt:         : 08.05.10
 153 Gyldig Fra-Til   : 08.05.10-07.11.10
 154 Billetttype      : Enkeltbillett
 155
 156 102-1015-100508-48382-01-08
 157 </pre>
 158
 159 <p>På selve magnetstripen er innholdet
 160 <tt>;E?+900120011=23250996541068112619257138248441708433322932704083389389062603279671261502492655?</tt>.
 161 Aner ikke hva innholdet representerer, og det er lite overlapp mellom
 162 det jeg ser trykket på billetten og det jeg ser av tegn i
 163 magnetstripen.  Håper det betyr at de bruker kryptografiske metoder
 164 for å gjøre det vanskelig å forfalske billetter.</p>
 165
 166 <p>Den andre billetten er fra Hurtigruten, der jeg mistenker at
 167 strekkoden på fronten er mer brukt enn magnetstripen (det var i hvert
 168 fall den biten vi stakk inn i dørlåsen).</p>
 169
 170 <p>Påtrykket forsiden er følgende:</p>
 171
 172 <pre>
 173 Romnummer 727
 174 Hurtigruten
 175 Midnatsol
 176 Reinholdtsen
 177 Petter
 178 Bookingno: SAX69   0742193
 179 Harstad-Bergen
 180 Dep: 09.05.2010 Arr: 12.05.2010
 181 Lugar fra Risøyhamn
 182 Kost: FRO=4
 183 </pre>
 184
 185 <p>På selve magnetstripen er innholdet
 186 <tt>;1316010007421930=00000000000000000000?+E?</tt>.  Heller ikke her
 187 ser jeg mye korrespondanse mellom påtrykk og magnetstripe.</p>
 188 </div>
 189   <div class="tags">
 190
 191
 192
 193    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 194
 195   </div>
 196  </div>
 197  <div class="padding"></div>
 198
 199  <div class="entry">
 200   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Pieces_of_the_roaming_laptop_puzzle_in_Debian.html">Pieces of the roaming laptop puzzle in Debian</a></div>
 201   <div class="date">2010-05-19 19:00</div>
 202   <div class="body">
 203 <p>Today, the last piece of the puzzle for roaming laptops in Debian
 204 Edu finally entered the Debian archive.  Today, the new
 205 <a href="http://packages.qa.debian.org/libp/libpam-mklocaluser.html">libpam-mklocaluser</a>
 206 package was accepted.  Two days ago, two other pieces was accepted
 207 into unstable.  The
 208 <a href="http://packages.qa.debian.org/p/pam-python.html">pam-python</a>
 209 package needed by libpam-mklocaluser, and the
 210 <a href="http://packages.qa.debian.org/s/sssd.html">sssd</a> package
 211 passed NEW on Monday.  In addition, the
 212 <a href="http://packages.qa.debian.org/libp/libpam-ccreds.html">libpam-ccreds</a>
 213 package we need is in experimental (version 10-4) since Saturday, and
 214 hopefully will be moved to unstable soon.</p>
 215
 216 <p>This collection of packages allow for two different setups for
 217 roaming laptops.  The traditional setup would be using libpam-ccreds,
 218 nscd and libpam-mklocaluser with LDAP or Kerberos authentication,
 219 which should work out of the box if the configuration changes proposed
 220 for nscd in <a href="http://bugs.debian.org/485282">BTS report
 221 #485282</a> is implemented.  The alternative setup is to use sssd with
 222 libpam-mklocaluser to connect to LDAP or Kerberos and let sssd take
 223 care of the caching of passwords and group information.</p>
 224
 225 <p>I have so far been unable to get sssd to work with the LDAP server
 226 at the University, but suspect the issue is some SSL/GnuTLS related
 227 problem with the server certificate.  I plan to update the Debian
 228 package to version 1.2, which is scheduled for next week, and hope to
 229 find time to make sure the next release will include both the
 230 Debian/Ubuntu specific patches.  Upstream is friendly and responsive,
 231 and I am sure we will find a good solution.</p>
 232
 233 <p>The idea is to set up the roaming laptops to authenticate using
 234 LDAP or Kerberos and create a local user with home directory in /home/
 235 when a usre in LDAP logs in via KDM or GDM for the first time, and
 236 cache the password for offline checking, as well as caching group
 237 memberhips and other relevant LDAP information.  The
 238 libpam-mklocaluser package was created to make sure the local home
 239 directory is in /home/, instead of /site/server/directory/ which would
 240 be the home directory if pam_mkhomedir was used.  To avoid confusion
 241 with support requests and configuration, we do not want local laptops
 242 to have users in a path that is used for the same users home directory
 243 on the home directory servers.</p>
 244
 245 <p>One annoying problem with gdm is that it do not show the PAM
 246 message passed to the user from libpam-mklocaluser when the local user
 247 is created.  Instead gdm simply reject the login with some generic
 248 message.  The message is shown in kdm, ssh and login, so I guess it is
 249 a bug in gdm.  Have not investigated if there is some other message
 250 type that can be used instead to get gdm to also show the message.</p>
 251
 252 <p>If you want to help out with implementing this for Debian Edu,
 253 please contact us on debian-edu@lists.debian.org.</p>
 254 </div>
 255   <div class="tags">
 256
 257
 258
 259    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 260
 261   </div>
 262  </div>
 263  <div class="padding"></div>
 264
 265  <div class="entry">
 266   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html">Parallellized boot is now the default in Debian/unstable</a></div>
 267   <div class="date">2010-05-14 22:40</div>
 268   <div class="body">
 269 <p>Since this evening, parallel booting is the default in
 270 Debian/unstable for machines using dependency based boot sequencing.
 271 Apparently the testing of concurrent booting has been wider than
 272 expected, if I am to believe the
 273 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 274 on debian-devel@</a>, and I concluded a few days ago to move forward
 275 with the feature this weekend, to give us some time to detect any
 276 remaining problems before Squeeze is frozen.  If serious problems are
 277 detected, it is simple to change the default back to sequential boot.
 278 The upload of the new sysvinit package also activate a new upstream
 279 version.</p>
 280
 281 More information about
 282 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 283 based boot sequencing</a> is available from the Debian wiki.  It is
 284 currently possible to disable parallel booting when one run into
 285 problems caused by it, by adding this line to /etc/default/rcS:</p>
 286
 287 <blockquote><pre>
 288 CONCURRENCY=none
 289 </pre></blockquote>
 290
 291 <p>If you report any problems with dependencies in init.d scripts to
 292 the BTS, please usertag the report to get it to show up at
 293 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 294 list of usertagged bugs related to this</a>.</p>
 295 </div>
 296   <div class="tags">
 297
 298
 299
 300    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 301
 302   </div>
 303  </div>
 304  <div class="padding"></div>
 305
 306  <div class="entry">
 307   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html">Sitesummary tip: Listing MAC address of all clients</a></div>
 308   <div class="date">2010-05-14 21:10</div>
 309   <div class="body">
 310 <p>In the recent Debian Edu versions, the
 311 <a href="http://wiki.debian.org/DebianEdu/HowTo/SiteSummary">sitesummary
 312 system</a> is used to keep track of the machines in the school
 313 network.  Each machine will automatically report its status to the
 314 central server after boot and once per night.  The network setup is
 315 also reported, and using this information it is possible to get the
 316 MAC address of all network interfaces in the machines.  This is useful
 317 to update the DHCP configuration.</p>
 318
 319 <p>To give some idea how to use sitesummary, here is a one-liner to
 320 ist all MAC addresses of all machines reporting to sitesummary.  Run
 321 this on the collector host:</p>
 322
 323 <blockquote><pre>
 324 perl -MSiteSummary -e 'for_all_hosts(sub { print join(" ", get_macaddresses(shift)), "\n"; });'
 325 </pre></blockquote>
 326
 327 <p>This will list all MAC addresses assosiated with all machine, one
 328 line per machine and with space between the MAC addresses.</p>
 329
 330 <p>To allow system administrators easier job at adding static DHCP
 331 addresses for hosts, it would be possible to extend this to fetch
 332 machine information from sitesummary and update the DHCP and DNS
 333 tables in LDAP using this information.  Such tool is unfortunately not
 334 written yet.</p>
 335 </div>
 336   <div class="tags">
 337
 338
 339
 340    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary</a>.
 341
 342   </div>
 343  </div>
 344  <div class="padding"></div>
 345
 346  <div class="entry">
 347   <div class="title"><a href="http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html">systemd, an interesting alternative to upstart</a></div>
 348   <div class="date">2010-05-13 22:20</div>
 349   <div class="body">
 350 <p>The last few days a new boot system called
 351 <a href="http://www.freedesktop.org/wiki/Software/systemd">systemd</a>
 352 has been
 353 <a href="http://0pointer.de/blog/projects/systemd.html">introduced</a>
 354
 355 to the free software world.  I have not yet had time to play around
 356 with it, but it seem to be a very interesting alternative to
 357 <a href="http://upstart.ubuntu.com/">upstart</a>, and might prove to be
 358 a good alternative for Debian when we are able to switch to an event
 359 based boot system.  Tollef is
 360 <a href="http://bugs.debian.org/580814">in the process</a> of getting
 361 systemd into Debian, and I look forward to seeing how well it work.  I
 362 like the fact that systemd handles init.d scripts with dependency
 363 information natively, allowing them to run in parallel where upstart
 364 at the moment do not.</p>
 365
 366 <p>Unfortunately do systemd have the same problem as upstart regarding
 367 platform support.  It only work on recent Linux kernels, and also need
 368 some new kernel features enabled to function properly.  This means
 369 kFreeBSD and Hurd ports of Debian will need a port or a different boot
 370 system.  Not sure how that will be handled if systemd proves to be the
 371 way forward.</p>
 372
 373 <p>In the mean time, based on the
 374 <a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input
 375 on debian-devel@</a> regarding parallel booting in Debian, I have
 376 decided to enable full parallel booting as the default in Debian as
 377 soon as possible (probably this weekend or early next week), to see if
 378 there are any remaining serious bugs in the init.d dependencies.  A
 379 new version of the sysvinit package implementing this change is
 380 already in experimental.  If all go well, Squeeze will be released
 381 with parallel booting enabled by default.</p>
 382 </div>
 383   <div class="tags">
 384
 385
 386
 387    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 388
 389   </div>
 390  </div>
 391  <div class="padding"></div>
 392
 393  <div class="entry">
 394   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html">Parallellizing the boot in Debian Squeeze - ready for wider testing</a></div>
 395   <div class="date">2010-05-06 23:25</div>
 396   <div class="body">
 397 <p>These days, the init.d script dependencies in Squeeze are quite
 398 complete, so complete that it is actually possible to run all the
 399 init.d scripts in parallell based on these dependencies.  If you want
 400 to test your Squeeze system, make sure
 401 <a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency
 402 based boot sequencing</a> is enabled, and add this line to
 403 /etc/default/rcS:</p>
 404
 405 <blockquote><pre>
 406 CONCURRENCY=makefile
 407 </pre></blockquote>
 408
 409 <p>That is it.  It will cause sysv-rc to use the startpar tool to run
 410 scripts in parallel using the dependency information stored in
 411 /etc/init.d/.depend.boot, /etc/init.d/.depend.start and
 412 /etc/init.d/.depend.stop to order the scripts.  Startpar is configured
 413 to try to start the kdm and gdm scripts as early as possible, and will
 414 start the facilities required by kdm or gdm as early as possible to
 415 make this happen.</p>
 416
 417 <p>Give it a try, and see if you like the result.  If some services
 418 fail to start properly, it is most likely because they have incomplete
 419 init.d script dependencies in their startup script (or some of their
 420 dependent scripts have incomplete dependencies).  Report bugs and get
 421 the package maintainers to fix it. :)</p>
 422
 423 <p>Running scripts in parallel could be the default in Debian when we
 424 manage to get the init.d script dependencies complete and correct.  I
 425 expect we will get there in Squeeze+1, if we get manage to test and
 426 fix the remaining issues.</p>
 427
 428 <p>If you report any problems with dependencies in init.d scripts to
 429 the BTS, please usertag the report to get it to show up at
 430 <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the
 431 list of usertagged bugs related to this</a>.</p>
 432 </div>
 433   <div class="tags">
 434
 435
 436
 437    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 438
 439   </div>
 440  </div>
 441  <div class="padding"></div>
 442
 443  <div class="entry">
 444   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html">Forcing new users to change their password on first login</a></div>
 445   <div class="date">2010-05-02 13:47</div>
 446   <div class="body">
 447 <p>One interesting feature in Active Directory, is the ability to
 448 create a new user with an expired password, and thus force the user to
 449 change the password on the first login attempt.</p>
 450
 451 <p>I'm not quite sure how to do that with the LDAP setup in Debian
 452 Edu, but did some initial testing with a local account.  The account
 453 and password aging information is available in /etc/shadow, but
 454 unfortunately, it is not possible to specify an expiration time for
 455 passwords, only a maximum age for passwords.</p>
 456
 457 <p>A freshly created account (using adduser test) will have these
 458 settings in /etc/shadow:</p>
 459
 460 <blockquote><pre>
 461 root@tjener:~# chage -l test
 462 Last password change                                    : May 02, 2010
 463 Password expires                                        : never
 464 Password inactive                                       : never
 465 Account expires                                         : never
 466 Minimum number of days between password change          : 0
 467 Maximum number of days between password change          : 99999
 468 Number of days of warning before password expires       : 7
 469 root@tjener:~#
 470 </pre></blockquote>
 471
 472 <p>The only way I could come up with to create a user with an expired
 473 account, is to change the date of the last password change to the
 474 lowest value possible (January 1th 1970), and the maximum password age
 475 to the difference in days between that date and today.  To make it
 476 simple, I went for 30 years (30 * 365 = 10950) and January 2th (to
 477 avoid testing if 0 is a valid value).</p>
 478
 479 <p>After using these commands to set it up, it seem to work as
 480 intended:</p>
 481
 482 <blockquote><pre>
 483 root@tjener:~# chage -d 1 test; chage -M 10950 test
 484 root@tjener:~# chage -l test
 485 Last password change                                    : Jan 02, 1970
 486 Password expires                                        : never
 487 Password inactive                                       : never
 488 Account expires                                         : never
 489 Minimum number of days between password change          : 0
 490 Maximum number of days between password change          : 10950
 491 Number of days of warning before password expires       : 7
 492 root@tjener:~#
 493 </pre></blockquote>
 494
 495 <p>So far I have tested this with ssh and console, and kdm (in
 496 Squeeze) login, and all ask for a new password before login in the
 497 user (with ssh, I was thrown out and had to log in again).</p>
 498
 499 <p>Perhaps we should set up something similar for Debian Edu, to make
 500 sure only the user itself have the account password?</p>
 501
 502 <p>If you want to comment on or help out with implementing this for
 503 Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 504
 505 <p>Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the
 506 shadow(8) page in Debian/testing now state that setting the date of
 507 last password change to zero (0) will force the password to be changed
 508 on the first login.  This was not mentioned in the manual in Lenny, so
 509 I did not notice this in my initial testing.  I have tested it on
 510 Squeeze, and '<tt>chage -d 0 username</tt>' do work there.  I have not
 511 tested it on Lenny yet.</p>
 512
 513 <p>Update 2010-05-02-19:05: Jim Paris tells me via email that an
 514 equivalent command to expire a password is '<tt>passwd -e
 515 username</tt>', which insert zero into the date of the last password
 516 change.</p>
 517 </div>
 518   <div class="tags">
 519
 520
 521
 522    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 523
 524   </div>
 525  </div>
 526  <div class="padding"></div>
 527
 528  <div class="entry">
 529   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Thoughts_on_roaming_laptop_setup_for_Debian_Edu.html">Thoughts on roaming laptop setup for Debian Edu</a></div>
 530   <div class="date">2010-04-28 20:40</div>
 531   <div class="body">
 532 <p>For some years now, I have wondered how we should handle laptops in
 533 Debian Edu.  The Debian Edu infrastructure is mostly designed to
 534 handle stationary computers, and less suited for computers that come
 535 and go.</p>
 536
 537 <p>Now I finally believe I have an sensible idea on how to adjust
 538 Debian Edu for laptops, by introducing a new profile for them, for
 539 example called Roaming Workstations.  Here are my thought on this.
 540 The setup would consist of the following:</p>
 541
 542 <ul>
 543
 544  <li>During installation, the user name of the owner / primary user of
 545    the laptop is requested and a local home directory is set up for
 546    the user, with uid and gid information fetched from the LDAP
 547    server.  This allow the user to work also when offline.  The
 548    central home directory can be available in a subdirectory on
 549    request, for example mounted via CIFS.  It could be mounted
 550    automatically when a user log in while on the Debian Edu network,
 551    and unmounted when the machine is taken away (network down,
 552    hibernate, etc), it can be set up to do automatic mounting on
 553    request (using autofs), or perhaps some GUI button on the desktop
 554    can be used to access it when needed.  Perhaps it is enough to use
 555    the fish protocol in KDE?</li>
 556
 557  <li>Password checking is set up to use LDAP or Kerberos
 558    authentication when the machine is on the Debian Edu network, and
 559    to cache the password for offline checking when the machine unable
 560    to reach the LDAP or Kerberos server.  This can be done using
 561    <a href="http://www.padl.com/OSS/pam_ccreds.html">libpam-ccreds</a>
 562    or the Fedora developed
 563    <a href="https://fedoraproject.org/wiki/Features/SSSD">System
 564    Security Services Daemon</a> packages.</li>
 565
 566  <li>File synchronisation with the central home directory is set up
 567    using a shared directory in both the local and the central home
 568    directory, using unison.</li>
 569
 570  <li>Printing should be set up to print to all printers broadcasting
 571    their existence on the local network, and should then work out of
 572    the box with CUPS.  For sites needing accurate printer quotas, some
 573    system with Kerberos authentication or printing via ssh could be
 574    implemented.</li>
 575
 576  <li>For users that should have local root access to their laptop,
 577    sudo should be used to allow this to the local user.</li>
 578
 579  <li>It would be nice if user and group information from LDAP is
 580    cached on the client, but given that there are entries for the
 581    local user and primary group in /etc/, it should not be needed.</li>
 582
 583 </ul>
 584
 585 <p>I believe all the pieces to implement this are in Debian/testing at
 586 the moment.  If we work quickly, we should be able to get this ready
 587 in time for the Squeeze release to freeze.  Some of the pieces need
 588 tweaking, like libpam-ccreds should get support for pam-auth-update
 589 (<a href="http://bugs.debian.org/566718">#566718</a>) and nslcd (or
 590 perhaps debian-edu-config) should get some integration code to stop
 591 its daemon when the LDAP server is unavailable to avoid long timeouts
 592 when disconnected from the net.  If we get Kerberos enabled, we need
 593 to make sure we avoid long timeouts there too.</p>
 594
 595 <p>If you want to help out with implementing this for Debian Edu,
 596 please contact us on debian-edu@lists.debian.org.</p>
 597 </div>
 598   <div class="tags">
 599
 600
 601
 602    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 603
 604   </div>
 605  </div>
 606  <div class="padding"></div>
 607
 608  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
 609
 610 <div id="sidebar">
 611
 612
 613
 614
 615
 616 <h2>Archive</h2>
 617 <ul>
 618
 619 <li>2010
 620 <ul>
 621
 622 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 623
 624 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 625
 626 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 627
 628 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 629
 630 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 631
 632 </ul></li>
 633
 634 <li>2009
 635 <ul>
 636
 637 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 638
 639 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 640
 641 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 642
 643 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 644
 645 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 646
 647 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 648
 649 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 650
 651 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 652
 653 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 654
 655 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 656
 657 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 658
 659 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 660
 661 </ul></li>
 662
 663 <li>2008
 664 <ul>
 665
 666 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 667
 668 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 669
 670 </ul></li>
 671
 672 </ul>
 673
 674
 675
 676 <h2>Tags</h2>
 677 <ul>
 678
 679  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 680
 681  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 682
 683  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 684
 685  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (20)</a></li>
 686
 687  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (20)</a></li>
 688
 689  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (31)</a></li>
 690
 691  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 692
 693  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (6)</a></li>
 694
 695  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
 696
 697  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
 698
 699  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 700
 701  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 702
 703  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (65)</a></li>
 704
 705  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (74)</a></li>
 706
 707  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (12)</a></li>
 708
 709  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (11)</a></li>
 710
 711  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 712
 713  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 714
 715  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (8)</a></li>
 716
 717  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (1)</a></li>
 718
 719  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (11)</a></li>
 720
 721  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 722
 723  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 724
 725  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 726
 727  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
 728
 729 </ul>
 730
 731 </div>
 732
 733 <p style="text-align: right">
 734 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
 735 </p>
 736 </body>
 737 </html>