]> pere.pagekite.me Git - homepage.git/blob - blog/index.html
Generated.
[homepage.git] / blog / index.html
1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
2 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
3 <html>
4 <head>
5 <title>Petter Reinholdtsen</title>
6 <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
7 <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
8
9 </head>
10 <body>
11
12 <div class="title">
13 <h1>
14 <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
15
16 </h1>
17
18 </div>
19
20
21
22 <div class="entry">
23 <div class="title"><a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">Testing if a file system can be used for home directories...</a></div>
24 <div class="date">2010-08-08 21:20</div>
25 <div class="body">
26 <p>A few years ago, I was involved in a project planning to use
27 Windows file servers as home directory servers for Debian
28 Edu/Skolelinux machines. This was thought to be no problem, as the
29 access would be through the SMB network file system protocol, and we
30 knew other sites used SMB with unix and samba as the file server to
31 mount home directories without any problems. But, after months of
32 struggling, we had to conclude that our goal was impossible.</p>
33
34 <p>The reason is simply that while SMB can be used for home
35 directories when the file server is Samba running on Unix, this only
36 work because of Samba have some extensions and the fact that the
37 underlying file system is a unix file system. When using a Windows
38 file server, the underlying file system do not have POSIX semantics,
39 and several programs will fail if the users home directory where they
40 want to store their configuration lack POSIX semantics.</p>
41
42 <p>As part of this work, I wrote a small C program I want to share
43 with you all, to replicate a few of the problematic applications (like
44 OpenOffice.org and GCompris) and see if the file system was working as
45 it should. If you find yourself in spooky file system land, it might
46 help you find your way out again. This is the fs-test.c source:</p>
47
48 <pre>
49 /*
50 * Some tests to check the file system sematics. Used to verify that
51 * CIFS from a windows server do not work properly as a linux home
52 * directory.
53 * License: GPL v2 or later
54 *
55 * needs libsqlite3-dev and build-essential installed
56 * compile with: gcc -Wall -lsqlite3 -DTEST_SQLITE fs-test.c -o fs-test
57 */
58
59 #define _FILE_OFFSET_BITS 64
60 #define _LARGEFILE_SOURCE 1
61 #define _LARGEFILE64_SOURCE 1
62
63 #define _GNU_SOURCE /* for asprintf() */
64
65 #include <errno.h>
66 #include <fcntl.h>
67 #include <stdio.h>
68 #include <string.h>
69 #include <stdlib.h>
70 #include <sys/file.h>
71 #include <sys/stat.h>
72 #include <sys/types.h>
73 #include <unistd.h>
74
75 #ifdef TEST_SQLITE
76 /*
77 * Test sqlite open, as done by gcompris require the libsqlite3-dev
78 * package and linking with -lsqlite3. A more low level test is
79 * below.
80 * See also <URL: http://www.sqlite.org./faq.html#q5 >.
81 */
82 #include <sqlite3.h>
83 #define CREATE_TABLE_USERS \
84 "CREATE TABLE users (user_id INT UNIQUE, login TEXT, lastname TEXT, firstname TEXT, birthdate TEXT, class_id INT ); "
85 int test_sqlite_open(void) {
86 char *zErrMsg;
87 char *name = "testsqlite.db";
88 sqlite3 *db=NULL;
89 unlink(name);
90 int rc = sqlite3_open(name, &db);
91 if( rc ){
92 printf("error: sqlite open of %s failed: %s\n", name, sqlite3_errmsg(db));
93 sqlite3_close(db);
94 return -1;
95 }
96
97 /* create tables */
98 rc = sqlite3_exec(db,CREATE_TABLE_USERS, NULL, 0, &zErrMsg);
99 if( rc != SQLITE_OK ){
100 printf("error: sqlite table create failed: %s\n", zErrMsg);
101 sqlite3_close(db);
102 return -1;
103 }
104 printf("info: sqlite worked\n");
105 sqlite3_close(db);
106 return 0;
107 }
108 #endif /* TEST_SQLITE */
109
110 /*
111 * Demonstrate locking issue found in gcompris using sqlite3. This
112 * work with ext3, but not with cifs server on Windows 2003. This is
113 * done in the sqlite3 library.
114 * See also
115 * <URL:http://www.cygwin.com/ml/cygwin/2001-08/msg00854.html> and the
116 * POSIX specification
117 * <URL:http://www.opengroup.org/onlinepubs/009695399/functions/fcntl.html>.
118 */
119 int test_gcompris_locking(void) {
120 struct flock fl;
121 char *name = "testsqlite.db";
122 unlink(name);
123 int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, 0644);
124 printf("info: testing fcntl locking\n");
125
126 fl.l_whence = SEEK_SET;
127 fl.l_pid = getpid();
128 printf(" Read-locking 1 byte from 1073741824");
129 fl.l_start = 1073741824;
130 fl.l_len = 1;
131 fl.l_type = F_RDLCK;
132 if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
133
134 printf(" Read-locking 510 byte from 1073741826");
135 fl.l_start = 1073741826;
136 fl.l_len = 510;
137 fl.l_type = F_RDLCK;
138 if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
139
140 printf(" Unlocking 1 byte from 1073741824");
141 fl.l_start = 1073741824;
142 fl.l_len = 1;
143 fl.l_type = F_UNLCK;
144 if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
145
146 printf(" Write-locking 1 byte from 1073741824");
147 fl.l_start = 1073741824;
148 fl.l_len = 1;
149 fl.l_type = F_WRLCK;
150 if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
151
152 printf(" Write-locking 510 byte from 1073741826");
153 fl.l_start = 1073741826;
154 fl.l_len = 510;
155 if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
156
157 printf(" Unlocking 2 byte from 1073741824");
158 fl.l_start = 1073741824;
159 fl.l_len = 2;
160 fl.l_type = F_UNLCK;
161 if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
162
163 close(fd);
164 return 0;
165 }
166
167 /*
168 * Test if permissions of freshly created directories allow entries
169 * below them. This was a problem with OpenOffice.org and gcompris.
170 * Mounting with option 'sync' seem to solve this problem while
171 * slowing down file operations.
172 */
173 int test_subdirectory_creation(void) {
174 #define LEVELS 5
175 char *path = strdup("test");
176 char *dirs[LEVELS];
177 int level;
178 printf("info: testing subdirectory creation\n");
179 for (level = 0; level < LEVELS; level++) {
180 char *newpath = NULL;
181 if (-1 == mkdir(path, 0777)) {
182 printf(" error: Unable to create directory '%s': %s\n",
183 path, strerror(errno));
184 break;
185 }
186 asprintf(&newpath, "%s/%s", path, "test");
187 free(path);
188 path = newpath;
189 }
190 return 0;
191 }
192
193 /*
194 * Test if symlinks can be created. This was a problem detected with
195 * KDE.
196 */
197 int test_symlinks(void) {
198 printf("info: testing symlink creation\n");
199 unlink("symlink");
200 if (-1 == symlink("file", "symlink"))
201 printf(" error: Unable to create symlink\n");
202 return 0;
203 }
204
205 int main(int argc, char **argv) {
206 printf("Testing POSIX/Unix sematics on file system\n");
207 test_symlinks();
208 test_subdirectory_creation();
209 #ifdef TEST_SQLITE
210 test_sqlite_open();
211 #endif /* TEST_SQLITE */
212 test_gcompris_locking();
213 return 0;
214 }
215 </pre>
216
217 <p>When everything is working, it should print something like
218 this:</p>
219
220 <pre>
221 Testing POSIX/Unix sematics on file system
222 info: testing symlink creation
223 info: testing subdirectory creation
224 info: sqlite worked
225 info: testing fcntl locking
226 Read-locking 1 byte from 1073741824
227 Read-locking 510 byte from 1073741826
228 Unlocking 1 byte from 1073741824
229 Write-locking 1 byte from 1073741824
230 Write-locking 510 byte from 1073741826
231 Unlocking 2 byte from 1073741824
232 </pre>
233
234 <p>I do not remember the exact details of the problems we saw, but one
235 of them was with locking, where if I remember correctly, POSIX allow a
236 read-only lock to be upgraded to a read-write lock without unlocking
237 the read-only lock (while Windows do not). Another was a bug in the
238 CIFS/SMB client implementation in the Linux kernel where directory
239 meta information would be wrong for a fraction of a second, making
240 OpenOffice.org fail to create its deep directory tree because it was
241 not allowed to create files in its freshly created directory.</p>
242
243 <p>Anyway, here is a nice tool for your tool box, might you never need
244 it. :)</p>
245 </div>
246 <div class="tags">
247
248
249
250 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
251
252 </div>
253 </div>
254 <div class="padding"></div>
255
256 <div class="entry">
257 <div class="title"><a href="http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html">Autodetecting Client setup for roaming workstations in Debian Edu</a></div>
258 <div class="date">2010-08-07 14:45</div>
259 <div class="body">
260 <p>A few days ago, I
261 <a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">tried
262 to install</a> a Roaming workation profile from Debian Edu/Squeeze
263 while on the university network here at the University of Oslo, and
264 noticed how much had to change to get it operational using the
265 university infrastructure. It was fairly easy, but it occured to me
266 that Debian Edu would improve a lot if I could get the client to
267 connect without any changes at all, and thus let the client configure
268 itself during installation and first boot to use the infrastructure
269 around it. Now I am a huge step further along that road.</p>
270
271 <p>With our current squeeze-test packages, I can select the roaming
272 workstation profile and get a working laptop connecting to the
273 university LDAP server for user and group and our active directory
274 servers for Kerberos authentication. All this without any
275 configuration at all during installation. My users home directory got
276 a bookmark in the KDE menu to mount it via SMB, with the correct URL.
277 In short, openldap and sssd is correctly configured. In addition to
278 this, the client look for http://wpad/wpad.dat to configure a web
279 proxy, and when it fail to find it no proxy settings are stored in
280 /etc/environment and /etc/apt/apt.conf. Iceweasel and KDE is
281 configured to look for the same wpad configuration and also do not use
282 a proxy when at the university network. If the machine is moved to a
283 network with such wpad setup, it would automatically use it when DHCP
284 gave it a IP address.</p>
285
286 <p>The LDAP server is located using DNS, by first looking for the DNS
287 entry ldap.$domain. If this do not exist, it look for the
288 _ldap._tcp.$domain SRV records and use the first one as the LDAP
289 server. Next, it connects to the LDAP server and search all
290 namingContexts entries for posixAccount or posixGroup objects, and
291 pick the first one as the LDAP base. For Kerberos, a similar
292 algorithm is used to locate the LDAP server, and the realm is the
293 uppercase version of $domain.</p>
294
295 <p>So, what is not working, you might ask. SMB mounting my home
296 directory do not work. No idea why, but suspected the incorrect
297 Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
298 the cause. These are not properly configured during installation, and
299 had to be hand-edited to get the correct Kerberos realm and server,
300 but SMB mounting still do not work. :(</p>
301
302 <p>With this automatic configuration in place, I expect a Debian Edu
303 roaming profile installation would be able to automatically detect and
304 connect to any site using LDAP and Kerberos for NSS directory and PAM
305 authentication. It should also work out of the box in a Active
306 Directory environment providing posixAccount and posixGroup objects
307 with UID and GID values.</p>
308
309 <p>If you want to help out with implementing these things for Debian
310 Edu, please contact us on debian-edu@lists.debian.org.</p>
311 </div>
312 <div class="tags">
313
314
315
316 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
317
318 </div>
319 </div>
320 <div class="padding"></div>
321
322 <div class="entry">
323 <div class="title"><a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">Debian Edu roaming workstation - at the university of Oslo</a></div>
324 <div class="date">2010-08-03 23:30</div>
325 <div class="body">
326 <p>The new roaming workstation profile in Debian Edu/Squeeze is fairly
327 similar to the laptop setup am I working on using Ubuntu for the
328 University of Oslo, and just for the heck of it, I tested today how
329 hard it would be to integrate that profile into the university
330 infrastructure. In this case, it is the university LDAP server,
331 Active Directory Kerberos server and SMB mounting from the Netapp file
332 servers.</p>
333
334 <p>I was pleasantly surprised that the only three files needed to be
335 changed (/etc/sssd/sssd.conf, /etc/ldap.conf and
336 /etc/mklocaluser.d/20-debian-edu-config) and one file had to be added
337 (/usr/share/perl5/Debian/Edu_Local.pm), to get the client working.
338 Most of the changes were to get the client to use the university LDAP
339 for NSS and Kerberos server for PAM, but one was to change a hard
340 coded DNS domain name in the mklocaluser hook from .intern to
341 .uio.no.</p>
342
343 <p>This testing was so encouraging, that I went ahead and adjusted the
344 Debian Edu scripts and setup in subversion to centralise the roaming
345 workstation setup a bit more and avoid the hardcoded DNS domain name,
346 so that when I test this tomorrow, I expect to get away with modifying
347 only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the
348 university servers.</p>
349
350 <p>My goal is to get the clients to have no hardcoded settings and
351 fetch all their initial setup during installation and first boot, to
352 allow them to be inserted also into environments where the default
353 setup in Debian Edu has been changed or as with the university, where
354 the environment is different but provides the protocols Debian Edu
355 uses.</p>
356 </div>
357 <div class="tags">
358
359
360
361 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
362
363 </div>
364 </div>
365 <div class="padding"></div>
366
367 <div class="entry">
368 <div class="title"><a href="http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html">Circular package dependencies harms apt recovery</a></div>
369 <div class="date">2010-07-27 23:50</div>
370 <div class="body">
371 <p>I discovered this while doing
372 <a href="http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html">automated
373 testing of upgrades from Debian Lenny to Squeeze</a>. A few packages
374 in Debian still got circular dependencies, and it is often claimed
375 that apt and aptitude should be able to handle this just fine, but
376 some times these dependency loops causes apt to fail.</p>
377
378 <p>An example is from todays
379 <a href="http://people.skolelinux.org/~pere/debian-upgrade-testing//test-20100727-lenny-squeeze-kde-aptitude.txt">upgrade
380 of KDE using aptitude</a>. In it, a bug in kdebase-workspace-data
381 causes perl-modules to fail to upgrade. The cause is simple. If a
382 package fail to unpack, then only part of packages with the circular
383 dependency might end up being unpacked when unpacking aborts, and the
384 ones already unpacked will fail to configure in the recovery phase
385 because its dependencies are unavailable.</p>
386
387 <p>In this log, the problem manifest itself with this error:</p>
388
389 <blockquote><pre>
390 dpkg: dependency problems prevent configuration of perl-modules:
391 perl-modules depends on perl (>= 5.10.1-1); however:
392 Version of perl on system is 5.10.0-19lenny2.
393 dpkg: error processing perl-modules (--configure):
394 dependency problems - leaving unconfigured
395 </pre></blockquote>
396
397 <p>The perl/perl-modules circular dependency is already
398 <a href="http://bugs.debian.org/527917">reported as a bug</a>, and will
399 hopefully be solved as soon as possible, but it is not the only one,
400 and each one of these loops in the dependency tree can cause similar
401 failures. Of course, they only occur when there are bugs in other
402 packages causing the unpacking to fail, but it is rather nasty when
403 the failure of one package causes the problem to become worse because
404 of dependency loops.</p>
405
406 <p>Thanks to
407 <a href="http://lists.debian.org/debian-devel/2010/06/msg00116.html">the
408 tireless effort by Bill Allombert</a>, the number of circular
409 dependencies
410 <a href="http://debian.semistable.com/debgraph.out.html">left in Debian
411 is dropping</a>, and perhaps it will reach zero one day. :)</p>
412
413 <p>Todays testing also exposed a bug in
414 <a href="http://bugs.debian.org/590605">update-notifier</a> and
415 <a href="http://bugs.debian.org/590604">different behaviour</a> between
416 apt-get and aptitude, the latter possibly caused by some circular
417 dependency. Reported both to BTS to try to get someone to look at
418 it.</p>
419 </div>
420 <div class="tags">
421
422
423
424 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
425
426 </div>
427 </div>
428 <div class="padding"></div>
429
430 <div class="entry">
431 <div class="title"><a href="http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html">First Debian Edu test release (alpha0) based on Squeeze is released</a></div>
432 <div class="date">2010-07-27 17:45</div>
433 <div class="body">
434 <p>I just posted this announcement culminating several months of work
435 with the next Debian Edu release. Not nearly done, but one major step
436 completed.</p>
437
438 <blockquote>
439 <p>This is the first test release based on Squeeze. The focus of this
440 release is to test the user application selection. To have a look,
441 install the standalone profile and let the developers know if the set
442 of installed packages i.e. applications should be modified. If some
443 user application is missing, or if there are some applications that no
444 longer make sense to be included in Debian Edu, please let us know.
445 Also, if a useful application is missing the translation for your
446 language of choice, please let us know too.</p>
447
448 <p>In addition, feedback and help to polish the desktop (menus,
449 artwork, starters, etc.) is appreciated. We would like to ship a nice
450 and handy KDE4 desktop targeted for schools out of the box.</p>
451
452 <p>The other profiles should be installable, but there is a lot more
453 work left to be done before they are ready, so do not expect to
454 much.</p>
455
456 <p>Changes compared to the lenny based version</p>
457
458 <ul>
459 <li>Everything from Debian Squeeze
460 <ul>
461 <li>Desktop environment KDE 4.4 => the new KDE desktop in
462 combination with some new artwork
463 <li>Web browser Iceweasel 3.5
464 <li>OpenOffice.org 3.2
465 <li>Educational toolbox GCompris 9.3
466 <li>Music creator Rosegarden 10.04.2
467 <li>Image editor Gimp 2.6.10
468 <li>Virtual universe Celestia 1.6.0
469 <li>Virtual stargazer Stellarium 0.10.4
470 <li>3D modeler Blender 2.49.2 (new application)
471 <li>Video editor Kdenlive 0.7.7 (new application)
472 </ul></li>
473 <li>Now using Kerberos for password checking (migration not finished).
474 Enabled for:
475 <ul>
476 <li>PAM
477 <li>LDAP
478 <li>IMAP
479 <li>SMTP (sender verification)
480 </ul>
481 </li>
482 <li>New experimental roaming workstation profile for laptops.</li>
483 <li>Show welcome page to users when they first log in. The URL is
484 fetched from LDAP.</li>
485 <li>New LXDE desktop option, in addition to KDE (default) and Gnome.</li>
486 <li>General cleanup (not finished)</li>
487 </ul>
488 <p>The following features are not working as they should</p>
489
490 <ul>
491 <li>No web based administration tool for creating users and groups. The
492 scripts ldap-createuser-krb and ldap-add-user-to-group can be used
493 for testing.</li>
494 <li>DVD installs are missing debian-installer images for the PXE boot,
495 and do not set up the PXE menu on eth0 because of this. LTSP
496 clients should still boot from eth1 on thin client servers.</li>
497 <li>The restructured KDE menu is not implemented.</li>
498 <li>The LDAP server setup need to be reviewed for security.</li>
499 <li>The LDAP directory structure need to be reworked.</li>
500 <li>Different sets of packages are installed when using the DVD and the
501 netinst CD. More packages are installed using the netinst CD.</li>
502 <li>The jackd package fail to install. This is believed to be caused by
503 some ongoing transition, and hopefully should be solved soon. The
504 jackd1 package can be installed manually for those that need it.</li>
505 <li>Some packages lack translations. See
506 http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status,
507 and help out with translations.</li>
508 </ul>
509
510 <p>To download this multiarch netinstall release you can use</p>
511
512 <ul>
513 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
514 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
515 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</li>
516 </ul>
517 <p>To download this multiarch dvd release you can use</p>
518
519 <ul>
520 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
521 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
522 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</li>
523 </ul>
524
525 <p>There is no source DVD available yet. It will be prepared when we
526 get closer to the final release.</p>
527
528 <p>The MD5SUM of these images are</p>
529
530 <ul>
531 <li>3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-6.0.0+edua0-CD.iso</li>
532 <li>22f2cbfce281d1c6e478be452638675d debian-edu-6.0.0+edua0-DVD.iso</li>
533 </ul>
534
535 <p>The SHA1SUM of these images are</p>
536 <ul>
537 <li>c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-6.0.0+edua0-CD.iso</li>
538 <li>2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-6.0.0+edua0-DVD.iso</li>
539 </ul>
540 <p>How to report bugs:
541 http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla</p>
542
543 <p>Please direct replies to debian-edu@lists.debian.org</p>
544 </blockquote>
545 </div>
546 <div class="tags">
547
548
549
550 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
551
552 </div>
553 </div>
554 <div class="padding"></div>
555
556 <div class="entry">
557 <div class="title"><a href="http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html">One step closer to single signon in Debian Edu</a></div>
558 <div class="date">2010-07-25 10:00</div>
559 <div class="body">
560 <p>The last few months me and the other Debian Edu developers have
561 been working hard to get the Debian/Squeeze based version of Debian
562 Edu/Skolelinux into shape. This future version will use Kerberos for
563 authentication, and services are slowly migrated to single signon,
564 getting rid of password questions one at the time.</p>
565
566 <p>It will also feature a roaming workstation profile with local home
567 directory, for laptops that are only some times on the Skolelinux
568 network, and for this profile a shortcut is created in Gnome and KDE
569 to gain access to the users home directory on the file server. This
570 shortcut uses SMB at the moment, and yesterday I had time to test if
571 SMB mounting had started working in KDE after we added the cifs-utils
572 package. I was pleasantly surprised how well it worked.</p>
573
574 <p>Thanks to the recent changes to our samba configuration to get it
575 to use Kerberos for authentication, there were no question about user
576 password when mounting the SMB volume. A simple click on the shortcut
577 in the KDE menu, and a window with the home directory popped
578 up. :)</p>
579
580 <p>One step closer to a single signon solution out of the box in
581 Debian Edu. We already had PAM, LDAP, IMAP and SMTP in place, and now
582 also Samba. Next step is Cups and hopefully also NFS.</p>
583
584 <p>We had planned a alpha0 release of Debian Edu for today, but thanks
585 to the autobuilder administrators for some architectures being slow to
586 sign packages, we are still missing the fixed LTSP package we need for
587 the release. It was uploaded three days ago with urgency=high, and if
588 it had entered testing yesterday we would have been able to test it in
589 time for a alpha0 release today. As the binaries for ia64 and powerpc
590 still not uploaded to the Debian archive, we need to delay the alpha
591 release another day.</p>
592
593 <p>If you want to help out with implementing Kerberos for Debian Edu,
594 please contact us on debian-edu@lists.debian.org.</p>
595 </div>
596 <div class="tags">
597
598
599
600 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
601
602 </div>
603 </div>
604 <div class="padding"></div>
605
606 <div class="entry">
607 <div class="title"><a href="http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til____slutte____kj__pe_musikk.html">Digitale restriksjonsmekanismer fikk meg til å slutte å kjøpe musikk</a></div>
608 <div class="date">2010-07-22 23:50</div>
609 <div class="body">
610 <p>For mange år siden slutte jeg å kjøpe musikk-CDer. Årsaken var at
611 musikkbransjen var godt i gang med å selge platene sine med DRM som
612 gjorde at jeg ikke fikk spilt av musikken jeg kjøpte på utstyret jeg
613 hadde tilgjengelig, dvs. min datamaskin. Det var umulig å se på en
614 plate om den var ødelagt eller ikke, og jeg hadde jo allerede en
615 anseelig samling med plater, så jeg bestemme meg for å slutte å gi
616 penger til en bransje som åpenbart ikke respekterte meg.</p>
617
618 <p>Jeg har mange titalls dager med musikk på CD i dag. Det meste er
619 lagt i et stort arkiv som kan spilles av fra husets datamaskiner (har
620 ikke rukket rippe alt). Jeg ser dermed ikke behovet for å skaffe mer
621 musikk. De fleste av mine favoritter er i hus, og jeg er dermed godt
622 fornøyd.</p>
623
624 <p>Hvis musikkbransjen ønsker mine penger, så må de demonstrere at de
625 setter pris på meg som kunde, og ikke skremme meg bort med DRM og
626 antydninger om at kundene er kriminelle.</p>
627
628 <p>Filmbransjen er like ille, men mens musikk gjerne varer lenge, er
629 filmer mer ferskvare. Har dermed ikke helt sluttet å kjøpe filmer, men
630 holder meg til DVD-filmer som kan spilles av på mine Linuxbokser.
631 Kommer neppe til å ta i bruk Blueray, og ei heller de nye DRM-greiene
632 «Ultraviolet» som be annonsert her om dagen.</p>
633 </div>
634 <div class="tags">
635
636
637
638 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>.
639
640 </div>
641 </div>
642 <div class="padding"></div>
643
644 <div class="entry">
645 <div class="title"><a href="http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html">OpenStreetmap one step closer to having routing on its front page</a></div>
646 <div class="date">2010-07-18 16:45</div>
647 <div class="body">
648 <p>Thanks to
649 <a href="http://feedproxy.google.com/~r/Opengeodata/~3/wUTCzDZk3lc/project-of-the-week-which-way-home">todays
650 opengeodata blog entry</a>, I just discovered that the
651 OpenStreetmap.org site have gotten
652 <a href="http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT">support
653 for calculating routes</a>. The support is still experimental and
654 only available from the development server, until more experience is
655 gathered on the user interface and any scalability issues.</p>
656
657 <p>Earlier, the routing I knew about using the OpenStreetmap.org data
658 was provided by <a href="http://maps.cloudmade.com/">Cloudmade</a>,
659 but having it on the main page is required to make everyone aware of
660 the issue. I've had people reject Openstreetmap.org as a viable
661 alternative for them because the front page lacked routing support,
662 and I hope their needs will be catered for when routing show up on the
663 www.openstreetmap.org front page.</p>
664 </div>
665 <div class="tags">
666
667
668
669 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/kart">kart</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
670
671 </div>
672 </div>
673 <div class="padding"></div>
674
675 <div class="entry">
676 <div class="title"><a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a></div>
677 <div class="date">2010-07-17 21:00</div>
678 <div class="body">
679 <p>This is a
680 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
681 on my
682 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
683 work</a> on
684 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
685 all</a> the computer related LDAP objects in Debian Edu.</p>
686
687 <p>As a step to try to see if it possible to merge the DNS and DHCP
688 LDAP objects, I have had a look at how the packages pdns-backend-ldap
689 and dhcp3-server-ldap in Debian use the LDAP server. The two
690 implementations are quite different in how they use LDAP.</p>
691
692 To get this information, I started slapd with debugging enabled and
693 dumped the debug output to a file to get the LDAP searches performed
694 on a Debian Edu main-server. Here is a summary.
695
696 <p><strong>powerdns</strong></p>
697
698 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
699 on how to</a> set up PowerDNS to use a LDAP backend is available on
700 the web.
701
702 <p>PowerDNS have two modes of operation using LDAP as its backend.
703 One "strict" mode where the forward and reverse DNS lookups are done
704 using the same LDAP objects, and a "tree" mode where the forward and
705 reverse entries are in two different subtrees in LDAP with a structure
706 based on the DNS names, as in tjener.intern and
707 2.2.0.10.in-addr.arpa.</p>
708
709 <p>In tree mode, the server is set up to use a LDAP subtree as its
710 base, and uses a "base" scoped search for the DNS name by adding
711 "dc=tjener,dc=intern," to the base with a filter for
712 "(associateddomain=tjener.intern)" for the forward entry and
713 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
714 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry. For
715 forward entries, it is looking for attributes named dnsttl, arecord,
716 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
717 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
718 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
719 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
720 spfrecord and modifytimestamp. For reverse entries it is looking for
721 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
722 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
723 locrecord, srvrecord, naptrrecord and modifytimestamp. The equivalent
724 ldapsearch commands could look like this:</p>
725
726 <blockquote><pre>
727 ldapsearch -h ldap \
728 -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
729 -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
730 cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
731 rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
732 nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
733 rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
734
735 ldapsearch -h ldap \
736 -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
737 -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
738 dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
739 hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
740 srvrecord naptrrecord modifytimestamp
741 </pre></blockquote>
742
743 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
744 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
745 example LDAP objects used there. In addition to these objects, the
746 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
747 also exist.</p>
748
749 <blockquote><pre>
750 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
751 objectclass: top
752 objectclass: dnsdomain
753 objectclass: domainrelatedobject
754 dc: tjener
755 arecord: 10.0.2.2
756 associateddomain: tjener.intern
757
758 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
759 objectclass: top
760 objectclass: dnsdomain2
761 objectclass: domainrelatedobject
762 dc: 2
763 ptrrecord: tjener.intern
764 associateddomain: 2.2.0.10.in-addr.arpa
765 </pre></blockquote>
766
767 <p>In strict mode, the server behaves differently. When looking for
768 forward DNS entries, it is doing a "subtree" scoped search with the
769 same base as in the tree mode for a object with filter
770 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
771 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
772 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
773 naptrrecord and modifytimestamp. For reverse entires it also do a
774 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
775 and the requested attributes are associateddomain, dnsttl and
776 modifytimestamp. In short, in strict mode the objects with ptrrecord
777 go away, and the arecord attribute in the forward object is used
778 instead.</p>
779
780 <p>The forward and reverse searches can be simulated using ldapsearch
781 like this:</p>
782
783 <blockquote><pre>
784 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
785 '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
786 cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
787 rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
788 nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
789 rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
790
791 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
792 '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
793 </pre></blockquote>
794
795 <p>In addition to the forward and reverse searches , there is also a
796 search for SOA records, which behave similar to the forward and
797 reverse lookups.</p>
798
799 <p>A thing to note with the PowerDNS behaviour is that it do not
800 specify any objectclass names, and instead look for the attributes it
801 need to generate a DNS reply. This make it able to work with any
802 objectclass that provide the needed attributes.</p>
803
804 <p>The attributes are normally provided in the cosine (RFC 1274) and
805 dnsdomain2 schemas. The latter is used for reverse entries like
806 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
807
808 <p>In Debian Edu, we have created DNS objects using the object classes
809 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
810 attributes) and domainrelatedobject (for associatedDomain). The use
811 of structural object classes make it impossible to combine these
812 classes with the object classes used by DHCP.</p>
813
814 <p>There are other schemas that could be used too, for example the
815 dnszone structural object class used by Gosa and bind-sdb for the DNS
816 attributes combined with the domainrelatedobject object class, but in
817 this case some unused attributes would have to be included as well
818 (zonename and relativedomainname).</p>
819
820 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
821 mode and not use any of the existing objectclasses (dnsdomain,
822 dnsdomain2 and dnszone) when one want to combine the DNS information
823 with DHCP information, and instead create a auxiliary object class
824 defined something like this (using the attributes defined for
825 dnsdomain and dnsdomain2 or dnszone):</p>
826
827 <blockquote><pre>
828 objectclass ( some-oid NAME 'dnsDomainAux'
829 SUP top
830 AUXILIARY
831 MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
832 DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
833 TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
834 NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
835 A6Record $ DNAMERecord
836 ))
837 </pre></blockquote>
838
839 <p>This will allow any object to become a DNS entry when combined with
840 the domainrelatedobject object class, and allow any entity to include
841 all the attributes PowerDNS wants. I've sent an email to the PowerDNS
842 developers asking for their view on this schema and if they are
843 interested in providing such schema with PowerDNS, and I hope my
844 message will be accepted into their mailing list soon.</p>
845
846 <p><strong>ISC dhcp</strong></p>
847
848 <p>The DHCP server searches for specific objectclass and requests all
849 the object attributes, and then uses the attributes it want. This
850 make it harder to figure out exactly what attributes are used, but
851 thanks to the working example in Debian Edu I can at least get an idea
852 what is needed without having to read the source code.</p>
853
854 <p>In the DHCP server configuration, the LDAP base to use and the
855 search filter to use to locate the correct dhcpServer entity is
856 stored. These are the relevant entries from
857 /etc/dhcp3/dhcpd.conf:</p>
858
859 <blockquote><pre>
860 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
861 ldap-dhcp-server-cn "dhcp";
862 </pre></blockquote>
863
864 <p>The DHCP server uses this information to nest all the DHCP
865 configuration it need. The cn "dhcp" is located using the given LDAP
866 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))". The
867 search result is this entry:</p>
868
869 <blockquote><pre>
870 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
871 cn: dhcp
872 objectClass: top
873 objectClass: dhcpServer
874 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
875 </pre></blockquote>
876
877 <p>The content of the dhcpServiceDN attribute is next used to locate the
878 subtree with DHCP configuration. The DHCP configuration subtree base
879 is located using a base scope search with base "cn=DHCP
880 Config,dc=skole,dc=skolelinux,dc=no" and filter
881 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
882 The search result is this entry:</p>
883
884 <blockquote><pre>
885 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
886 cn: DHCP Config
887 objectClass: top
888 objectClass: dhcpService
889 objectClass: dhcpOptions
890 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
891 dhcpStatements: ddns-update-style none
892 dhcpStatements: authoritative
893 dhcpOption: smtp-server code 69 = array of ip-address
894 dhcpOption: www-server code 72 = array of ip-address
895 dhcpOption: wpad-url code 252 = text
896 </pre></blockquote>
897
898 <p>Next, the entire subtree is processed, one level at the time. When
899 all the DHCP configuration is loaded, it is ready to receive requests.
900 The subtree in Debian Edu contain objects with object classes
901 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
902 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost. These provide options
903 and information about netmasks, dynamic range etc. Leaving out the
904 details here because it is not relevant for the focus of my
905 investigation, which is to see if it is possible to merge dns and dhcp
906 related computer objects.</p>
907
908 <p>When a DHCP request come in, LDAP is searched for the MAC address
909 of the client (00:00:00:00:00:00 in this example), using a subtree
910 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
911 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
912 00:00:00:00:00:00))" as the filter. This is what a host object look
913 like:</p>
914
915 <blockquote><pre>
916 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
917 cn: hostname
918 objectClass: top
919 objectClass: dhcpHost
920 dhcpHWAddress: ethernet 00:00:00:00:00:00
921 dhcpStatements: fixed-address hostname
922 </pre></blockquote>
923
924 <p>There is less flexiblity in the way LDAP searches are done here.
925 The object classes need to have fixed names, and the configuration
926 need to be stored in a fairly specific LDAP structure. On the
927 positive side, the invidiual dhcpHost entires can be anywhere without
928 the DN pointed to by the dhcpServer entries. The latter should make
929 it possible to group all host entries in a subtree next to the
930 configuration entries, and this subtree can also be shared with the
931 DNS server if the schema proposed above is combined with the dhcpHost
932 structural object class.
933
934 <p><strong>Conclusion</strong></p>
935
936 <p>The PowerDNS implementation seem to be very flexible when it come
937 to which LDAP schemas to use. While its "tree" mode is rigid when it
938 come to the the LDAP structure, the "strict" mode is very flexible,
939 allowing DNS objects to be stored anywhere under the base cn specified
940 in the configuration.</p>
941
942 <p>The DHCP implementation on the other hand is very inflexible, both
943 regarding which LDAP schemas to use and which LDAP structure to use.
944 I guess one could implement ones own schema, as long as the
945 objectclasses and attributes have the names used, but this do not
946 really help when the DHCP subtree need to have a fairly fixed
947 structure.</p>
948
949 <p>Based on the observed behaviour, I suspect a LDAP structure like
950 this might work for Debian Edu:</p>
951
952 <blockquote><pre>
953 ou=services
954 cn=machine-info (dhcpService) - dhcpServiceDN points here
955 cn=dhcp (dhcpServer)
956 cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
957 cn=10.0.2.0 (dhcpSubnet)
958 cn=group1 (dhcpGroup/dhcpOptions)
959 cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
960 cn=192.168.0.0 (dhcpSubnet)
961 cn=group1 (dhcpGroup/dhcpOptions)
962 ou=machines - PowerDNS base points here
963 cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
964 </pre></blockquote>
965
966 <P>This is not tested yet. If the DHCP server require the dhcpHost
967 entries to be in the dhcpGroup subtrees, the entries can be stored
968 there instead of a common machines subtree, and the PowerDNS base
969 would have to be moved one level up to the machine-info subtree.</p>
970
971 <p>The combined object under the machines subtree would look something
972 like this:</p>
973
974 <blockquote><pre>
975 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
976 dc: hostname
977 objectClass: top
978 objectClass: dhcpHost
979 objectclass: domainrelatedobject
980 objectclass: dnsDomainAux
981 associateddomain: hostname.intern
982 arecord: 10.11.12.13
983 dhcpHWAddress: ethernet 00:00:00:00:00:00
984 dhcpStatements: fixed-address hostname.intern
985 </pre></blockquote>
986
987 </p>One could even add the LTSP configuration associated with a given
988 machine, as long as the required attributes are available in a
989 auxiliary object class.</p>
990 </div>
991 <div class="tags">
992
993
994
995 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
996
997 </div>
998 </div>
999 <div class="padding"></div>
1000
1001 <div class="entry">
1002 <div class="title"><a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a></div>
1003 <div class="date">2010-07-14 23:45</div>
1004 <div class="body">
1005 <p>For a while now, I have wanted to find a way to change the DNS and
1006 DHCP services in Debian Edu to use the same LDAP objects for a given
1007 computer, to avoid the possibility of having a inconsistent state for
1008 a computer in LDAP (as in DHCP but no DNS entry or the other way
1009 around) and make it easier to add computers to LDAP.</p>
1010
1011 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
1012 information finally found a solution that seem to work.</p>
1013
1014 <p>The old setup required three LDAP objects for a given computer.
1015 One forward DNS entry, one reverse DNS entry and one DHCP entry. If
1016 we switch powerdns to use its strict LDAP method (ldap-method=strict
1017 in pdns-debian-edu.conf), the forward and reverse DNS entries are
1018 merged into one while making it impossible to transfer the reverse map
1019 to a slave DNS server.</p>
1020
1021 <p>If we also replace the object class used to get the DNS related
1022 attributes to one allowing these attributes to be combined with the
1023 dhcphost object class, we can merge the DNS and DHCP entries into one.
1024 I've written such object class in the dnsdomainaux.schema file (need
1025 proper OIDs, but that is a minor issue), and tested the setup. It
1026 seem to work.</p>
1027
1028 <p>With this test setup in place, we can get away with one LDAP object
1029 for both DNS and DHCP, and even the LTSP configuration I suggested in
1030 an earlier email. The combined LDAP object will look something like
1031 this:</p>
1032
1033 <blockquote><pre>
1034 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
1035 cn: hostname
1036 objectClass: dhcphost
1037 objectclass: domainrelatedobject
1038 objectclass: dnsdomainaux
1039 associateddomain: hostname.intern
1040 arecord: 10.11.12.13
1041 dhcphwaddress: ethernet 00:00:00:00:00:00
1042 dhcpstatements: fixed-address hostname
1043 ldapconfigsound: Y
1044 </pre></blockquote>
1045
1046 <p>The DNS server uses the associateddomain and arecord entries, while
1047 the DHCP server uses the dhcphwaddress and dhcpstatements entries
1048 before asking DNS to resolve the fixed-adddress. LTSP will use
1049 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
1050
1051 <p>I am not yet sure if I can get the DHCP server to look for its
1052 dhcphost in a different location, to allow us to put the objects
1053 outside the "DHCP Config" subtree, but hope to figure out a way to do
1054 that. If I can't figure out a way to do that, we can still get rid of
1055 the hosts subtree and move all its content into the DHCP Config tree
1056 (which probably should be renamed to be more related to the new
1057 content. I suspect cn=dnsdhcp,ou=services or something like that
1058 might be a good place to put it.</p>
1059
1060 <p>If you want to help out with implementing this for Debian Edu,
1061 please contact us on debian-edu@lists.debian.org.</p>
1062 </div>
1063 <div class="tags">
1064
1065
1066
1067 Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1068
1069 </div>
1070 </div>
1071 <div class="padding"></div>
1072
1073 <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
1074
1075 <div id="sidebar">
1076
1077
1078
1079
1080
1081 <h2>Archive</h2>
1082 <ul>
1083
1084 <li>2010
1085 <ul>
1086
1087 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
1088
1089 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
1090
1091 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1092
1093 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1094
1095 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1096
1097 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1098
1099 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
1100
1101 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (3)</a></li>
1102
1103 </ul></li>
1104
1105 <li>2009
1106 <ul>
1107
1108 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1109
1110 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1111
1112 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1113
1114 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1115
1116 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1117
1118 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1119
1120 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1121
1122 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1123
1124 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1125
1126 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1127
1128 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1129
1130 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1131
1132 </ul></li>
1133
1134 <li>2008
1135 <ul>
1136
1137 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1138
1139 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1140
1141 </ul></li>
1142
1143 </ul>
1144
1145
1146
1147 <h2>Tags</h2>
1148 <ul>
1149
1150 <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
1151
1152 <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1153
1154 <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1155
1156 <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
1157
1158 <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (35)</a></li>
1159
1160 <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (39)</a></li>
1161
1162 <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (54)</a></li>
1163
1164 <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
1165
1166 <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (8)</a></li>
1167
1168 <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (3)</a></li>
1169
1170 <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
1171
1172 <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
1173
1174 <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1175
1176 <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
1177
1178 <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (71)</a></li>
1179
1180 <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (91)</a></li>
1181
1182 <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (14)</a></li>
1183
1184 <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (14)</a></li>
1185
1186 <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
1187
1188 <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1189
1190 <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (10)</a></li>
1191
1192 <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
1193
1194 <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
1195
1196 <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
1197
1198 <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
1199
1200 <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
1201
1202 <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (7)</a></li>
1203
1204 </ul>
1205
1206 </div>
1207
1208 <p style="text-align: right">
1209 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
1210 </p>
1211 </body>
1212 </html>