blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html">Testing if a file system can be used for home directories...</a></div>
  24   <div class="date">2010-08-08 21:20</div>
  25   <div class="body">
  26 <p>A few years ago, I was involved in a project planning to use
  27 Windows file servers as home directory servers for Debian
  28 Edu/Skolelinux machines.  This was thought to be no problem, as the
  29 access would be through the SMB network file system protocol, and we
  30 knew other sites used SMB with unix and samba as the file server to
  31 mount home directories without any problems.  But, after months of
  32 struggling, we had to conclude that our goal was impossible.</p>
  33
  34 <p>The reason is simply that while SMB can be used for home
  35 directories when the file server is Samba running on Unix, this only
  36 work because of Samba have some extensions and the fact that the
  37 underlying file system is a unix file system.  When using a Windows
  38 file server, the underlying file system do not have POSIX semantics,
  39 and several programs will fail if the users home directory where they
  40 want to store their configuration lack POSIX semantics.</p>
  41
  42 <p>As part of this work, I wrote a small C program I want to share
  43 with you all, to replicate a few of the problematic applications (like
  44 OpenOffice.org and GCompris) and see if the file system was working as
  45 it should.  If you find yourself in spooky file system land, it might
  46 help you find your way out again.  This is the fs-test.c source:</p>
  47
  48 <pre>
  49 /*
  50  * Some tests to check the file system sematics.  Used to verify that
  51  * CIFS from a windows server do not work properly as a linux home
  52  * directory.
  53  * License: GPL v2 or later
  54  *
  55  * needs libsqlite3-dev and build-essential installed
  56  * compile with: gcc -Wall -lsqlite3 -DTEST_SQLITE fs-test.c -o fs-test
  57 */
  58
  59 #define _FILE_OFFSET_BITS 64
  60 #define _LARGEFILE_SOURCE 1
  61 #define _LARGEFILE64_SOURCE 1
  62
  63 #define _GNU_SOURCE /* for asprintf() */
  64
  65 #include <errno.h>
  66 #include <fcntl.h>
  67 #include <stdio.h>
  68 #include <string.h>
  69 #include <stdlib.h>
  70 #include <sys/file.h>
  71 #include <sys/stat.h>
  72 #include <sys/types.h>
  73 #include <unistd.h>
  74
  75 #ifdef TEST_SQLITE
  76 /*
  77  * Test sqlite open, as done by gcompris require the libsqlite3-dev
  78  * package and linking with -lsqlite3.  A more low level test is
  79  * below.
  80  * See also <URL: http://www.sqlite.org./faq.html#q5 >.
  81  */
  82 #include <sqlite3.h>
  83 #define CREATE_TABLE_USERS                                              \
  84   "CREATE TABLE users (user_id INT UNIQUE, login TEXT, lastname TEXT, firstname TEXT, birthdate TEXT, class_id INT ); "
  85 int test_sqlite_open(void) {
  86   char *zErrMsg;
  87   char *name = "testsqlite.db";
  88   sqlite3 *db=NULL;
  89   unlink(name);
  90   int rc = sqlite3_open(name, &db);
  91   if( rc ){
  92     printf("error: sqlite open of %s failed: %s\n", name, sqlite3_errmsg(db));
  93     sqlite3_close(db);
  94     return -1;
  95   }
  96
  97   /* create tables */
  98   rc = sqlite3_exec(db,CREATE_TABLE_USERS, NULL,  0, &zErrMsg);
  99   if( rc != SQLITE_OK ){
 100     printf("error: sqlite table create failed: %s\n", zErrMsg);
 101     sqlite3_close(db);
 102     return -1;
 103   }
 104   printf("info: sqlite worked\n");
 105   sqlite3_close(db);
 106   return 0;
 107 }
 108 #endif /* TEST_SQLITE */
 109
 110 /*
 111  * Demonstrate locking issue found in gcompris using sqlite3.  This
 112  * work with ext3, but not with cifs server on Windows 2003.  This is
 113  * done in the sqlite3 library.
 114  * See also
 115  * <URL:http://www.cygwin.com/ml/cygwin/2001-08/msg00854.html> and the
 116  * POSIX specification
 117  * <URL:http://www.opengroup.org/onlinepubs/009695399/functions/fcntl.html>.
 118  */
 119 int test_gcompris_locking(void) {
 120   struct flock fl;
 121   char *name = "testsqlite.db";
 122   unlink(name);
 123   int fd = open(name, O_RDWR|O_CREAT|O_LARGEFILE, 0644);
 124   printf("info: testing fcntl locking\n");
 125
 126   fl.l_whence = SEEK_SET;
 127   fl.l_pid    = getpid();
 128   printf("  Read-locking 1 byte from 1073741824");
 129   fl.l_start  = 1073741824;
 130   fl.l_len    = 1;
 131   fl.l_type   = F_RDLCK;
 132   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 133
 134   printf("  Read-locking 510 byte from 1073741826");
 135   fl.l_start  = 1073741826;
 136   fl.l_len    = 510;
 137   fl.l_type   = F_RDLCK;
 138   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 139
 140   printf("  Unlocking 1 byte from 1073741824");
 141   fl.l_start  = 1073741824;
 142   fl.l_len    = 1;
 143   fl.l_type   = F_UNLCK;
 144   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 145
 146   printf("  Write-locking 1 byte from 1073741824");
 147   fl.l_start  = 1073741824;
 148   fl.l_len    = 1;
 149   fl.l_type   = F_WRLCK;
 150   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 151
 152   printf("  Write-locking 510 byte from 1073741826");
 153   fl.l_start  = 1073741826;
 154   fl.l_len    = 510;
 155   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 156
 157   printf("  Unlocking 2 byte from 1073741824");
 158   fl.l_start  = 1073741824;
 159   fl.l_len    = 2;
 160   fl.l_type   = F_UNLCK;
 161   if (0 != fcntl(fd, F_SETLK, &fl) ) printf(" - error!\n"); else printf("\n");
 162
 163   close(fd);
 164   return 0;
 165 }
 166
 167 /*
 168  * Test if permissions of freshly created directories allow entries
 169  * below them.  This was a problem with OpenOffice.org and gcompris.
 170  * Mounting with option 'sync' seem to solve this problem while
 171  * slowing down file operations.
 172  */
 173 int test_subdirectory_creation(void) {
 174 #define LEVELS 5
 175   char *path = strdup("test");
 176   char *dirs[LEVELS];
 177   int level;
 178   printf("info: testing subdirectory creation\n");
 179   for (level = 0; level < LEVELS; level++) {
 180     char *newpath = NULL;
 181     if (-1 == mkdir(path, 0777)) {
 182       printf("  error: Unable to create directory '%s': %s\n",
 183              path, strerror(errno));
 184       break;
 185     }
 186     asprintf(&newpath, "%s/%s", path, "test");
 187     free(path);
 188     path = newpath;
 189   }
 190   return 0;
 191 }
 192
 193 /*
 194  * Test if symlinks can be created.  This was a problem detected with
 195  * KDE.
 196  */
 197 int test_symlinks(void) {
 198   printf("info: testing symlink creation\n");
 199   unlink("symlink");
 200   if (-1 == symlink("file", "symlink"))
 201     printf("  error: Unable to create symlink\n");
 202   return 0;
 203 }
 204
 205 int main(int argc, char **argv) {
 206   printf("Testing POSIX/Unix sematics on file system\n");
 207   test_symlinks();
 208   test_subdirectory_creation();
 209 #ifdef TEST_SQLITE
 210   test_sqlite_open();
 211 #endif /* TEST_SQLITE */
 212   test_gcompris_locking();
 213   return 0;
 214 }
 215 </pre>
 216
 217 <p>When everything is working, it should print something like
 218 this:</p>
 219
 220 <pre>
 221 Testing POSIX/Unix sematics on file system
 222 info: testing symlink creation
 223 info: testing subdirectory creation
 224 info: sqlite worked
 225 info: testing fcntl locking
 226   Read-locking 1 byte from 1073741824
 227   Read-locking 510 byte from 1073741826
 228   Unlocking 1 byte from 1073741824
 229   Write-locking 1 byte from 1073741824
 230   Write-locking 510 byte from 1073741826
 231   Unlocking 2 byte from 1073741824
 232 </pre>
 233
 234 <p>I do not remember the exact details of the problems we saw, but one
 235 of them was with locking, where if I remember correctly, POSIX allow a
 236 read-only lock to be upgraded to a read-write lock without unlocking
 237 the read-only lock (while Windows do not).  Another was a bug in the
 238 CIFS/SMB client implementation in the Linux kernel where directory
 239 meta information would be wrong for a fraction of a second, making
 240 OpenOffice.org fail to create its deep directory tree because it was
 241 not allowed to create files in its freshly created directory.</p>
 242
 243 <p>Anyway, here is a nice tool for your tool box, might you never need
 244 it. :)</p>
 245 </div>
 246   <div class="tags">
 247
 248
 249
 250    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 251
 252   </div>
 253  </div>
 254  <div class="padding"></div>
 255
 256  <div class="entry">
 257   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Autodetecting_Client_setup_for_roaming_workstations_in_Debian_Edu.html">Autodetecting Client setup for roaming workstations in Debian Edu</a></div>
 258   <div class="date">2010-08-07 14:45</div>
 259   <div class="body">
 260 <p>A few days ago, I
 261 <a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">tried
 262 to install</a> a Roaming workation profile from Debian Edu/Squeeze
 263 while on the university network here at the University of Oslo, and
 264 noticed how much had to change to get it operational using the
 265 university infrastructure.  It was fairly easy, but it occured to me
 266 that Debian Edu would improve a lot if I could get the client to
 267 connect without any changes at all, and thus let the client configure
 268 itself during installation and first boot to use the infrastructure
 269 around it.  Now I am a huge step further along that road.</p>
 270
 271 <p>With our current squeeze-test packages, I can select the roaming
 272 workstation profile and get a working laptop connecting to the
 273 university LDAP server for user and group and our active directory
 274 servers for Kerberos authentication.  All this without any
 275 configuration at all during installation.  My users home directory got
 276 a bookmark in the KDE menu to mount it via SMB, with the correct URL.
 277 In short, openldap and sssd is correctly configured.  In addition to
 278 this, the client look for http://wpad/wpad.dat to configure a web
 279 proxy, and when it fail to find it no proxy settings are stored in
 280 /etc/environment and /etc/apt/apt.conf.  Iceweasel and KDE is
 281 configured to look for the same wpad configuration and also do not use
 282 a proxy when at the university network.  If the machine is moved to a
 283 network with such wpad setup, it would automatically use it when DHCP
 284 gave it a IP address.</p>
 285
 286 <p>The LDAP server is located using DNS, by first looking for the DNS
 287 entry ldap.$domain.  If this do not exist, it look for the
 288 _ldap._tcp.$domain SRV records and use the first one as the LDAP
 289 server.  Next, it connects to the LDAP server and search all
 290 namingContexts entries for posixAccount or posixGroup objects, and
 291 pick the first one as the LDAP base.  For Kerberos, a similar
 292 algorithm is used to locate the LDAP server, and the realm is the
 293 uppercase version of $domain.</p>
 294
 295 <p>So, what is not working, you might ask.  SMB mounting my home
 296 directory do not work.  No idea why, but suspected the incorrect
 297 Kerberos settings in /etc/krb5.conf and /etc/samba/smb.conf might be
 298 the cause.  These are not properly configured during installation, and
 299 had to be hand-edited to get the correct Kerberos realm and server,
 300 but SMB mounting still do not work. :(</p>
 301
 302 <p>With this automatic configuration in place, I expect a Debian Edu
 303 roaming profile installation would be able to automatically detect and
 304 connect to any site using LDAP and Kerberos for NSS directory and PAM
 305 authentication.  It should also work out of the box in a Active
 306 Directory environment providing posixAccount and posixGroup objects
 307 with UID and GID values.</p>
 308
 309 <p>If you want to help out with implementing these things for Debian
 310 Edu, please contact us on debian-edu@lists.debian.org.</p>
 311 </div>
 312   <div class="tags">
 313
 314
 315
 316    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 317
 318   </div>
 319  </div>
 320  <div class="padding"></div>
 321
 322  <div class="entry">
 323   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Debian_Edu_roaming_workstation___at_the_university_of_Oslo.html">Debian Edu roaming workstation - at the university of Oslo</a></div>
 324   <div class="date">2010-08-03 23:30</div>
 325   <div class="body">
 326 <p>The new roaming workstation profile in Debian Edu/Squeeze is fairly
 327 similar to the laptop setup am I working on using Ubuntu for the
 328 University of Oslo, and just for the heck of it, I tested today how
 329 hard it would be to integrate that profile into the university
 330 infrastructure.  In this case, it is the university LDAP server,
 331 Active Directory Kerberos server and SMB mounting from the Netapp file
 332 servers.</p>
 333
 334 <p>I was pleasantly surprised that the only three files needed to be
 335 changed (/etc/sssd/sssd.conf, /etc/ldap.conf and
 336 /etc/mklocaluser.d/20-debian-edu-config) and one file had to be added
 337 (/usr/share/perl5/Debian/Edu_Local.pm), to get the client working.
 338 Most of the changes were to get the client to use the university LDAP
 339 for NSS and Kerberos server for PAM, but one was to change a hard
 340 coded DNS domain name in the mklocaluser hook from .intern to
 341 .uio.no.</p>
 342
 343 <p>This testing was so encouraging, that I went ahead and adjusted the
 344 Debian Edu scripts and setup in subversion to centralise the roaming
 345 workstation setup a bit more and avoid the hardcoded DNS domain name,
 346 so that when I test this tomorrow, I expect to get away with modifying
 347 only /etc/sssd/sssd.conf and /etc/ldap.conf to get it to use the
 348 university servers.</p>
 349
 350 <p>My goal is to get the clients to have no hardcoded settings and
 351 fetch all their initial setup during installation and first boot, to
 352 allow them to be inserted also into environments where the default
 353 setup in Debian Edu has been changed or as with the university, where
 354 the environment is different but provides the protocols Debian Edu
 355 uses.</p>
 356 </div>
 357   <div class="tags">
 358
 359
 360
 361    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 362
 363   </div>
 364  </div>
 365  <div class="padding"></div>
 366
 367  <div class="entry">
 368   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Circular_package_dependencies_harms_apt_recovery.html">Circular package dependencies harms apt recovery</a></div>
 369   <div class="date">2010-07-27 23:50</div>
 370   <div class="body">
 371 <p>I discovered this while doing
 372 <a href="http://people.skolelinux.org/pere/blog/Automatic_upgrade_testing_from_Lenny_to_Squeeze.html">automated
 373 testing of upgrades from Debian Lenny to Squeeze</a>.  A few packages
 374 in Debian still got circular dependencies, and it is often claimed
 375 that apt and aptitude should be able to handle this just fine, but
 376 some times these dependency loops causes apt to fail.</p>
 377
 378 <p>An example is from todays
 379 <a href="http://people.skolelinux.org/~pere/debian-upgrade-testing//test-20100727-lenny-squeeze-kde-aptitude.txt">upgrade
 380 of KDE using aptitude</a>.  In it, a bug in kdebase-workspace-data
 381 causes perl-modules to fail to upgrade.  The cause is simple.  If a
 382 package fail to unpack, then only part of packages with the circular
 383 dependency might end up being unpacked when unpacking aborts, and the
 384 ones already unpacked will fail to configure in the recovery phase
 385 because its dependencies are unavailable.</p>
 386
 387 <p>In this log, the problem manifest itself with this error:</p>
 388
 389 <blockquote><pre>
 390 dpkg: dependency problems prevent configuration of perl-modules:
 391  perl-modules depends on perl (>= 5.10.1-1); however:
 392   Version of perl on system is 5.10.0-19lenny2.
 393 dpkg: error processing perl-modules (--configure):
 394  dependency problems - leaving unconfigured
 395 </pre></blockquote>
 396
 397 <p>The perl/perl-modules circular dependency is already
 398 <a href="http://bugs.debian.org/527917">reported as a bug</a>, and will
 399 hopefully be solved as soon as possible, but it is not the only one,
 400 and each one of these loops in the dependency tree can cause similar
 401 failures.  Of course, they only occur when there are bugs in other
 402 packages causing the unpacking to fail, but it is rather nasty when
 403 the failure of one package causes the problem to become worse because
 404 of dependency loops.</p>
 405
 406 <p>Thanks to
 407 <a href="http://lists.debian.org/debian-devel/2010/06/msg00116.html">the
 408 tireless effort by Bill Allombert</a>, the number of circular
 409 dependencies
 410 <a href="http://debian.semistable.com/debgraph.out.html">left in Debian
 411 is dropping</a>, and perhaps it will reach zero one day. :)</p>
 412
 413 <p>Todays testing also exposed a bug in
 414 <a href="http://bugs.debian.org/590605">update-notifier</a> and
 415 <a href="http://bugs.debian.org/590604">different behaviour</a> between
 416 apt-get and aptitude, the latter possibly caused by some circular
 417 dependency.  Reported both to BTS to try to get someone to look at
 418 it.</p>
 419 </div>
 420   <div class="tags">
 421
 422
 423
 424    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 425
 426   </div>
 427  </div>
 428  <div class="padding"></div>
 429
 430  <div class="entry">
 431   <div class="title"><a href="http://people.skolelinux.org/pere/blog/First_Debian_Edu_test_release__alpha0__based_on_Squeeze_is_released.html">First Debian Edu test release (alpha0) based on Squeeze is released</a></div>
 432   <div class="date">2010-07-27 17:45</div>
 433   <div class="body">
 434 <p>I just posted this announcement culminating several months of work
 435 with the next Debian Edu release.  Not nearly done, but one major step
 436 completed.</p>
 437
 438 <blockquote>
 439 <p>This is the first test release based on Squeeze. The focus of this
 440 release is to test the user application selection. To have a look,
 441 install the standalone profile and let the developers know if the set
 442 of installed packages i.e. applications should be modified. If some
 443 user application is missing, or if there are some applications that no
 444 longer make sense to be included in Debian Edu, please let us know.
 445 Also, if a useful application is missing the translation for your
 446 language of choice, please let us know too.</p>
 447
 448 <p>In addition, feedback and help to polish the desktop (menus,
 449 artwork, starters, etc.) is appreciated. We would like to ship a nice
 450 and handy KDE4 desktop targeted for schools out of the box.</p>
 451
 452 <p>The other profiles should be installable, but there is a lot more
 453 work left to be done before they are ready, so do not expect to
 454 much.</p>
 455
 456 <p>Changes compared to the lenny based version</p>
 457
 458 <ul>
 459 <li>Everything from Debian Squeeze
 460 <ul>
 461   <li>Desktop environment KDE 4.4 => the new KDE desktop in
 462          combination with some new artwork
 463   <li>Web browser Iceweasel 3.5
 464   <li>OpenOffice.org 3.2
 465   <li>Educational toolbox GCompris 9.3
 466   <li>Music creator Rosegarden 10.04.2
 467   <li>Image editor Gimp 2.6.10
 468   <li>Virtual universe Celestia 1.6.0
 469   <li>Virtual stargazer Stellarium 0.10.4
 470   <li>3D modeler Blender 2.49.2 (new application)
 471   <li>Video editor Kdenlive 0.7.7 (new application)
 472 </ul></li>
 473 <li>Now using Kerberos for password checking (migration not finished).
 474     Enabled for:
 475 <ul>
 476   <li>PAM
 477   <li>LDAP
 478   <li>IMAP
 479   <li>SMTP (sender verification)
 480 </ul>
 481 </li>
 482 <li>New experimental roaming workstation profile for laptops.</li>
 483 <li>Show welcome page to users when they first log in. The URL is
 484     fetched from LDAP.</li>
 485 <li>New LXDE desktop option, in addition to KDE (default) and Gnome.</li>
 486 <li>General cleanup (not finished)</li>
 487 </ul>
 488 <p>The following features are not working as they should</p>
 489
 490 <ul>
 491 <li>No web based administration tool for creating users and groups. The
 492     scripts ldap-createuser-krb and ldap-add-user-to-group can be used
 493     for testing.</li>
 494 <li>DVD installs are missing debian-installer images for the PXE boot,
 495     and do not set up the PXE menu on eth0 because of this. LTSP
 496     clients should still boot from eth1 on thin client servers.</li>
 497 <li>The restructured KDE menu is not implemented.</li>
 498 <li>The LDAP server setup need to be reviewed for security.</li>
 499 <li>The LDAP directory structure need to be reworked.</li>
 500 <li>Different sets of packages are installed when using the DVD and the
 501     netinst CD. More packages are installed using the netinst CD.</li>
 502 <li>The jackd package fail to install. This is believed to be caused by
 503     some ongoing transition, and hopefully should be solved soon. The
 504     jackd1 package can be installed manually for those that need it.</li>
 505 <li>Some packages lack translations. See
 506     http://wiki.debian.org/DebianEdu/Status/Squeeze for updated status,
 507     and help out with translations.</li>
 508 </ul>
 509
 510 <p>To download this multiarch netinstall release you can use</p>
 511
 512 <ul>
 513 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
 514 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</a></li>
 515 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-CD.iso</li>
 516 </ul>
 517 <p>To download this multiarch dvd release you can use</p>
 518
 519 <ul>
 520 <li><a href="ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">ftp://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
 521 <li><a href="http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso">http://ftp.skolelinux.org/skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</a></li>
 522 <li>rsync -avzP ftp.skolelinux.org::skolelinux-cd/squeeze-alpha/debian-edu-6.0.0+edua0-DVD.iso</li>
 523 </ul>
 524
 525 <p>There is no source DVD available yet. It will be prepared when we
 526 get closer to the final release.</p>
 527
 528 <p>The MD5SUM of these images are</p>
 529
 530 <ul>
 531 <li>3dbf45d59f42a53518b6e3c9ec3b5eb6 debian-edu-6.0.0+edua0-CD.iso</li>
 532 <li>22f2cbfce281d1c6e478be452638675d debian-edu-6.0.0+edua0-DVD.iso</li>
 533 </ul>
 534
 535 <p>The SHA1SUM of these images are</p>
 536 <ul>
 537 <li>c53d1b69b40cf37cd27aefaf33f6f6a3821bedf0 debian-edu-6.0.0+edua0-CD.iso</li>
 538 <li>2ec29d7db676d59d32197b05c277ffe16348376c debian-edu-6.0.0+edua0-DVD.iso</li>
 539 </ul>
 540 <p>How to report bugs:
 541 http://wiki.debian.org/DebianEdu/HowTo/ReportBugsInBugzilla</p>
 542
 543 <p>Please direct replies to debian-edu@lists.debian.org</p>
 544 </blockquote>
 545 </div>
 546   <div class="tags">
 547
 548
 549
 550    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 551
 552   </div>
 553  </div>
 554  <div class="padding"></div>
 555
 556  <div class="entry">
 557   <div class="title"><a href="http://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html">One step closer to single signon in Debian Edu</a></div>
 558   <div class="date">2010-07-25 10:00</div>
 559   <div class="body">
 560 <p>The last few months me and the other Debian Edu developers have
 561 been working hard to get the Debian/Squeeze based version of Debian
 562 Edu/Skolelinux into shape.  This future version will use Kerberos for
 563 authentication, and services are slowly migrated to single signon,
 564 getting rid of password questions one at the time.</p>
 565
 566 <p>It will also feature a roaming workstation profile with local home
 567 directory, for laptops that are only some times on the Skolelinux
 568 network, and for this profile a shortcut is created in Gnome and KDE
 569 to gain access to the users home directory on the file server.  This
 570 shortcut uses SMB at the moment, and yesterday I had time to test if
 571 SMB mounting had started working in KDE after we added the cifs-utils
 572 package.  I was pleasantly surprised how well it worked.</p>
 573
 574 <p>Thanks to the recent changes to our samba configuration to get it
 575 to use Kerberos for authentication, there were no question about user
 576 password when mounting the SMB volume.  A simple click on the shortcut
 577 in the KDE menu, and a window with the home directory popped
 578 up. :)</p>
 579
 580 <p>One step closer to a single signon solution out of the box in
 581 Debian Edu.  We already had PAM, LDAP, IMAP and SMTP in place, and now
 582 also Samba.  Next step is Cups and hopefully also NFS.</p>
 583
 584 <p>We had planned a alpha0 release of Debian Edu for today, but thanks
 585 to the autobuilder administrators for some architectures being slow to
 586 sign packages, we are still missing the fixed LTSP package we need for
 587 the release.  It was uploaded three days ago with urgency=high, and if
 588 it had entered testing yesterday we would have been able to test it in
 589 time for a alpha0 release today.  As the binaries for ia64 and powerpc
 590 still not uploaded to the Debian archive, we need to delay the alpha
 591 release another day.</p>
 592
 593 <p>If you want to help out with implementing Kerberos for Debian Edu,
 594 please contact us on debian-edu@lists.debian.org.</p>
 595 </div>
 596   <div class="tags">
 597
 598
 599
 600    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet</a>.
 601
 602   </div>
 603  </div>
 604  <div class="padding"></div>
 605
 606  <div class="entry">
 607   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Digitale_restriksjonsmekanismer_fikk_meg_til____slutte____kj__pe_musikk.html">Digitale restriksjonsmekanismer fikk meg til å slutte å kjøpe musikk</a></div>
 608   <div class="date">2010-07-22 23:50</div>
 609   <div class="body">
 610 <p>For mange år siden slutte jeg å kjøpe musikk-CDer. Årsaken var at
 611 musikkbransjen var godt i gang med å selge platene sine med DRM som
 612 gjorde at jeg ikke fikk spilt av musikken jeg kjøpte på utstyret jeg
 613 hadde tilgjengelig, dvs. min datamaskin. Det var umulig å se på en
 614 plate om den var ødelagt eller ikke, og jeg hadde jo allerede en
 615 anseelig samling med plater, så jeg bestemme meg for å slutte å gi
 616 penger til en bransje som åpenbart ikke respekterte meg.</p>
 617
 618 <p>Jeg har mange titalls dager med musikk på CD i dag. Det meste er
 619 lagt i et stort arkiv som kan spilles av fra husets datamaskiner (har
 620 ikke rukket rippe alt). Jeg ser dermed ikke behovet for å skaffe mer
 621 musikk. De fleste av mine favoritter er i hus, og jeg er dermed godt
 622 fornøyd.</p>
 623
 624 <p>Hvis musikkbransjen ønsker mine penger, så må de demonstrere at de
 625 setter pris på meg som kunde, og ikke skremme meg bort med DRM og
 626 antydninger om at kundene er kriminelle.</p>
 627
 628 <p>Filmbransjen er like ille, men mens musikk gjerne varer lenge, er
 629 filmer mer ferskvare. Har dermed ikke helt sluttet å kjøpe filmer, men
 630 holder meg til DVD-filmer som kan spilles av på mine Linuxbokser.
 631 Kommer neppe til å ta i bruk Blueray, og ei heller de nye DRM-greiene
 632 «Ultraviolet» som be annonsert her om dagen.</p>
 633 </div>
 634   <div class="tags">
 635
 636
 637
 638    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling</a>, <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>, <a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett</a>, <a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern</a>.
 639
 640   </div>
 641  </div>
 642  <div class="padding"></div>
 643
 644  <div class="entry">
 645   <div class="title"><a href="http://people.skolelinux.org/pere/blog/OpenStreetmap_one_step_closer_to_having_routing_on_its_front_page.html">OpenStreetmap one step closer to having routing on its front page</a></div>
 646   <div class="date">2010-07-18 16:45</div>
 647   <div class="body">
 648 <p>Thanks to
 649 <a href="http://feedproxy.google.com/~r/Opengeodata/~3/wUTCzDZk3lc/project-of-the-week-which-way-home">todays
 650 opengeodata blog entry</a>, I just discovered that the
 651 OpenStreetmap.org site have gotten
 652 <a href="http://nroets.dev.openstreetmap.org/demo/index.html?layers=B000FTFTT">support
 653 for calculating routes</a>.  The support is still experimental and
 654 only available from the development server, until more experience is
 655 gathered on the user interface and any scalability issues.</p>
 656
 657 <p>Earlier, the routing I knew about using the OpenStreetmap.org data
 658 was provided by <a href="http://maps.cloudmade.com/">Cloudmade</a>,
 659 but having it on the main page is required to make everyone aware of
 660 the issue.  I've had people reject Openstreetmap.org as a viable
 661 alternative for them because the front page lacked routing support,
 662 and I hope their needs will be catered for when routing show up on the
 663 www.openstreetmap.org front page.</p>
 664 </div>
 665   <div class="tags">
 666
 667
 668
 669    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/kart">kart</a>, <a href="http://people.skolelinux.org/pere/blog/tags/web">web</a>.
 670
 671   </div>
 672  </div>
 673  <div class="padding"></div>
 674
 675  <div class="entry">
 676   <div class="title"><a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a></div>
 677   <div class="date">2010-07-17 21:00</div>
 678   <div class="body">
 679 <p>This is a
 680 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
 681 on my
 682 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
 683 work</a> on
 684 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
 685 all</a> the computer related LDAP objects in Debian Edu.</p>
 686
 687 <p>As a step to try to see if it possible to merge the DNS and DHCP
 688 LDAP objects, I have had a look at how the packages pdns-backend-ldap
 689 and dhcp3-server-ldap in Debian use the LDAP server.  The two
 690 implementations are quite different in how they use LDAP.</p>
 691
 692 To get this information, I started slapd with debugging enabled and
 693 dumped the debug output to a file to get the LDAP searches performed
 694 on a Debian Edu main-server.  Here is a summary.
 695
 696 <p><strong>powerdns</strong></p>
 697
 698 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
 699 on how to</a> set up PowerDNS to use a LDAP backend is available on
 700 the web.
 701
 702 <p>PowerDNS have two modes of operation using LDAP as its backend.
 703 One "strict" mode where the forward and reverse DNS lookups are done
 704 using the same LDAP objects, and a "tree" mode where the forward and
 705 reverse entries are in two different subtrees in LDAP with a structure
 706 based on the DNS names, as in tjener.intern and
 707 2.2.0.10.in-addr.arpa.</p>
 708
 709 <p>In tree mode, the server is set up to use a LDAP subtree as its
 710 base, and uses a "base" scoped search for the DNS name by adding
 711 "dc=tjener,dc=intern," to the base with a filter for
 712 "(associateddomain=tjener.intern)" for the forward entry and
 713 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
 714 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
 715 forward entries, it is looking for attributes named dnsttl, arecord,
 716 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
 717 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
 718 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
 719 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
 720 spfrecord and modifytimestamp.  For reverse entries it is looking for
 721 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
 722 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
 723 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
 724 ldapsearch commands could look like this:</p>
 725
 726 <blockquote><pre>
 727 ldapsearch -h ldap \
 728   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 729   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 730   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 731   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 732   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 733   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 734
 735 ldapsearch -h ldap \
 736   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
 737   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
 738   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
 739   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
 740   srvrecord naptrrecord modifytimestamp
 741 </pre></blockquote>
 742
 743 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
 744 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
 745 example LDAP objects used there.  In addition to these objects, the
 746 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
 747 also exist.</p>
 748
 749 <blockquote><pre>
 750 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
 751 objectclass: top
 752 objectclass: dnsdomain
 753 objectclass: domainrelatedobject
 754 dc: tjener
 755 arecord: 10.0.2.2
 756 associateddomain: tjener.intern
 757
 758 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
 759 objectclass: top
 760 objectclass: dnsdomain2
 761 objectclass: domainrelatedobject
 762 dc: 2
 763 ptrrecord: tjener.intern
 764 associateddomain: 2.2.0.10.in-addr.arpa
 765 </pre></blockquote>
 766
 767 <p>In strict mode, the server behaves differently.  When looking for
 768 forward DNS entries, it is doing a "subtree" scoped search with the
 769 same base as in the tree mode for a object with filter
 770 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
 771 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
 772 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
 773 naptrrecord and modifytimestamp.  For reverse entires it also do a
 774 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
 775 and the requested attributes are associateddomain, dnsttl and
 776 modifytimestamp.  In short, in strict mode the objects with ptrrecord
 777 go away, and the arecord attribute in the forward object is used
 778 instead.</p>
 779
 780 <p>The forward and reverse searches can be simulated using ldapsearch
 781 like this:</p>
 782
 783 <blockquote><pre>
 784 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 785   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 786   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 787   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 788   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 789   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 790
 791 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 792   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
 793 </pre></blockquote>
 794
 795 <p>In addition to the forward and reverse searches , there is also a
 796 search for SOA records, which behave similar to the forward and
 797 reverse lookups.</p>
 798
 799 <p>A thing to note with the PowerDNS behaviour is that it do not
 800 specify any objectclass names, and instead look for the attributes it
 801 need to generate a DNS reply.  This make it able to work with any
 802 objectclass that provide the needed attributes.</p>
 803
 804 <p>The attributes are normally provided in the cosine (RFC 1274) and
 805 dnsdomain2 schemas.  The latter is used for reverse entries like
 806 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
 807
 808 <p>In Debian Edu, we have created DNS objects using the object classes
 809 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
 810 attributes) and domainrelatedobject (for associatedDomain).  The use
 811 of structural object classes make it impossible to combine these
 812 classes with the object classes used by DHCP.</p>
 813
 814 <p>There are other schemas that could be used too, for example the
 815 dnszone structural object class used by Gosa and bind-sdb for the DNS
 816 attributes combined with the domainrelatedobject object class, but in
 817 this case some unused attributes would have to be included as well
 818 (zonename and relativedomainname).</p>
 819
 820 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
 821 mode and not use any of the existing objectclasses (dnsdomain,
 822 dnsdomain2 and dnszone) when one want to combine the DNS information
 823 with DHCP information, and instead create a auxiliary object class
 824 defined something like this (using the attributes defined for
 825 dnsdomain and dnsdomain2 or dnszone):</p>
 826
 827 <blockquote><pre>
 828 objectclass ( some-oid NAME 'dnsDomainAux'
 829     SUP top
 830     AUXILIARY
 831     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
 832           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
 833           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
 834           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
 835           A6Record $ DNAMERecord
 836     ))
 837 </pre></blockquote>
 838
 839 <p>This will allow any object to become a DNS entry when combined with
 840 the domainrelatedobject object class, and allow any entity to include
 841 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
 842 developers asking for their view on this schema and if they are
 843 interested in providing such schema with PowerDNS, and I hope my
 844 message will be accepted into their mailing list soon.</p>
 845
 846 <p><strong>ISC dhcp</strong></p>
 847
 848 <p>The DHCP server searches for specific objectclass and requests all
 849 the object attributes, and then uses the attributes it want.  This
 850 make it harder to figure out exactly what attributes are used, but
 851 thanks to the working example in Debian Edu I can at least get an idea
 852 what is needed without having to read the source code.</p>
 853
 854 <p>In the DHCP server configuration, the LDAP base to use and the
 855 search filter to use to locate the correct dhcpServer entity is
 856 stored.  These are the relevant entries from
 857 /etc/dhcp3/dhcpd.conf:</p>
 858
 859 <blockquote><pre>
 860 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
 861 ldap-dhcp-server-cn "dhcp";
 862 </pre></blockquote>
 863
 864 <p>The DHCP server uses this information to nest all the DHCP
 865 configuration it need.  The cn "dhcp" is located using the given LDAP
 866 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
 867 search result is this entry:</p>
 868
 869 <blockquote><pre>
 870 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
 871 cn: dhcp
 872 objectClass: top
 873 objectClass: dhcpServer
 874 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 875 </pre></blockquote>
 876
 877 <p>The content of the dhcpServiceDN attribute is next used to locate the
 878 subtree with DHCP configuration.  The DHCP configuration subtree base
 879 is located using a base scope search with base "cn=DHCP
 880 Config,dc=skole,dc=skolelinux,dc=no" and filter
 881 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
 882 The search result is this entry:</p>
 883
 884 <blockquote><pre>
 885 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 886 cn: DHCP Config
 887 objectClass: top
 888 objectClass: dhcpService
 889 objectClass: dhcpOptions
 890 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
 891 dhcpStatements: ddns-update-style none
 892 dhcpStatements: authoritative
 893 dhcpOption: smtp-server code 69 = array of ip-address
 894 dhcpOption: www-server code 72 = array of ip-address
 895 dhcpOption: wpad-url code 252 = text
 896 </pre></blockquote>
 897
 898 <p>Next, the entire subtree is processed, one level at the time.  When
 899 all the DHCP configuration is loaded, it is ready to receive requests.
 900 The subtree in Debian Edu contain objects with object classes
 901 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
 902 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
 903 and information about netmasks, dynamic range etc.  Leaving out the
 904 details here because it is not relevant for the focus of my
 905 investigation, which is to see if it is possible to merge dns and dhcp
 906 related computer objects.</p>
 907
 908 <p>When a DHCP request come in, LDAP is searched for the MAC address
 909 of the client (00:00:00:00:00:00 in this example), using a subtree
 910 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
 911 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
 912 00:00:00:00:00:00))" as the filter.  This is what a host object look
 913 like:</p>
 914
 915 <blockquote><pre>
 916 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 917 cn: hostname
 918 objectClass: top
 919 objectClass: dhcpHost
 920 dhcpHWAddress: ethernet 00:00:00:00:00:00
 921 dhcpStatements: fixed-address hostname
 922 </pre></blockquote>
 923
 924 <p>There is less flexiblity in the way LDAP searches are done here.
 925 The object classes need to have fixed names, and the configuration
 926 need to be stored in a fairly specific LDAP structure.  On the
 927 positive side, the invidiual dhcpHost entires can be anywhere without
 928 the DN pointed to by the dhcpServer entries.  The latter should make
 929 it possible to group all host entries in a subtree next to the
 930 configuration entries, and this subtree can also be shared with the
 931 DNS server if the schema proposed above is combined with the dhcpHost
 932 structural object class.
 933
 934 <p><strong>Conclusion</strong></p>
 935
 936 <p>The PowerDNS implementation seem to be very flexible when it come
 937 to which LDAP schemas to use.  While its "tree" mode is rigid when it
 938 come to the the LDAP structure, the "strict" mode is very flexible,
 939 allowing DNS objects to be stored anywhere under the base cn specified
 940 in the configuration.</p>
 941
 942 <p>The DHCP implementation on the other hand is very inflexible, both
 943 regarding which LDAP schemas to use and which LDAP structure to use.
 944 I guess one could implement ones own schema, as long as the
 945 objectclasses and attributes have the names used, but this do not
 946 really help when the DHCP subtree need to have a fairly fixed
 947 structure.</p>
 948
 949 <p>Based on the observed behaviour, I suspect a LDAP structure like
 950 this might work for Debian Edu:</p>
 951
 952 <blockquote><pre>
 953 ou=services
 954   cn=machine-info (dhcpService) - dhcpServiceDN points here
 955     cn=dhcp (dhcpServer)
 956     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
 957       cn=10.0.2.0 (dhcpSubnet)
 958         cn=group1 (dhcpGroup/dhcpOptions)
 959     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
 960       cn=192.168.0.0 (dhcpSubnet)
 961         cn=group1 (dhcpGroup/dhcpOptions)
 962     ou=machines - PowerDNS base points here
 963       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
 964 </pre></blockquote>
 965
 966 <P>This is not tested yet.  If the DHCP server require the dhcpHost
 967 entries to be in the dhcpGroup subtrees, the entries can be stored
 968 there instead of a common machines subtree, and the PowerDNS base
 969 would have to be moved one level up to the machine-info subtree.</p>
 970
 971 <p>The combined object under the machines subtree would look something
 972 like this:</p>
 973
 974 <blockquote><pre>
 975 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
 976 dc: hostname
 977 objectClass: top
 978 objectClass: dhcpHost
 979 objectclass: domainrelatedobject
 980 objectclass: dnsDomainAux
 981 associateddomain: hostname.intern
 982 arecord: 10.11.12.13
 983 dhcpHWAddress: ethernet 00:00:00:00:00:00
 984 dhcpStatements: fixed-address hostname.intern
 985 </pre></blockquote>
 986
 987 </p>One could even add the LTSP configuration associated with a given
 988 machine, as long as the required attributes are available in a
 989 auxiliary object class.</p>
 990 </div>
 991   <div class="tags">
 992
 993
 994
 995    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 996
 997   </div>
 998  </div>
 999  <div class="padding"></div>
1000
1001  <div class="entry">
1002   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a></div>
1003   <div class="date">2010-07-14 23:45</div>
1004   <div class="body">
1005 <p>For a while now, I have wanted to find a way to change the DNS and
1006 DHCP services in Debian Edu to use the same LDAP objects for a given
1007 computer, to avoid the possibility of having a inconsistent state for
1008 a computer in LDAP (as in DHCP but no DNS entry or the other way
1009 around) and make it easier to add computers to LDAP.</p>
1010
1011 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
1012 information finally found a solution that seem to work.</p>
1013
1014 <p>The old setup required three LDAP objects for a given computer.
1015 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
1016 we switch powerdns to use its strict LDAP method (ldap-method=strict
1017 in pdns-debian-edu.conf), the forward and reverse DNS entries are
1018 merged into one while making it impossible to transfer the reverse map
1019 to a slave DNS server.</p>
1020
1021 <p>If we also replace the object class used to get the DNS related
1022 attributes to one allowing these attributes to be combined with the
1023 dhcphost object class, we can merge the DNS and DHCP entries into one.
1024 I've written such object class in the dnsdomainaux.schema file (need
1025 proper OIDs, but that is a minor issue), and tested the setup.  It
1026 seem to work.</p>
1027
1028 <p>With this test setup in place, we can get away with one LDAP object
1029 for both DNS and DHCP, and even the LTSP configuration I suggested in
1030 an earlier email.  The combined LDAP object will look something like
1031 this:</p>
1032
1033 <blockquote><pre>
1034   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
1035   cn: hostname
1036   objectClass: dhcphost
1037   objectclass: domainrelatedobject
1038   objectclass: dnsdomainaux
1039   associateddomain: hostname.intern
1040   arecord: 10.11.12.13
1041   dhcphwaddress: ethernet 00:00:00:00:00:00
1042   dhcpstatements: fixed-address hostname
1043   ldapconfigsound: Y
1044 </pre></blockquote>
1045
1046 <p>The DNS server uses the associateddomain and arecord entries, while
1047 the DHCP server uses the dhcphwaddress and dhcpstatements entries
1048 before asking DNS to resolve the fixed-adddress.  LTSP will use
1049 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
1050
1051 <p>I am not yet sure if I can get the DHCP server to look for its
1052 dhcphost in a different location, to allow us to put the objects
1053 outside the "DHCP Config" subtree, but hope to figure out a way to do
1054 that.  If I can't figure out a way to do that, we can still get rid of
1055 the hosts subtree and move all its content into the DHCP Config tree
1056 (which probably should be renamed to be more related to the new
1057 content.  I suspect cn=dnsdhcp,ou=services or something like that
1058 might be a good place to put it.</p>
1059
1060 <p>If you want to help out with implementing this for Debian Edu,
1061 please contact us on debian-edu@lists.debian.org.</p>
1062 </div>
1063   <div class="tags">
1064
1065
1066
1067    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1068
1069   </div>
1070  </div>
1071  <div class="padding"></div>
1072
1073  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
1074
1075 <div id="sidebar">
1076
1077
1078
1079
1080
1081 <h2>Archive</h2>
1082 <ul>
1083
1084 <li>2010
1085 <ul>
1086
1087 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
1088
1089 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
1090
1091 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1092
1093 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1094
1095 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1096
1097 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1098
1099 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
1100
1101 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (3)</a></li>
1102
1103 </ul></li>
1104
1105 <li>2009
1106 <ul>
1107
1108 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1109
1110 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1111
1112 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1113
1114 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1115
1116 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1117
1118 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1119
1120 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1121
1122 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1123
1124 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1125
1126 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1127
1128 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1129
1130 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1131
1132 </ul></li>
1133
1134 <li>2008
1135 <ul>
1136
1137 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1138
1139 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1140
1141 </ul></li>
1142
1143 </ul>
1144
1145
1146
1147 <h2>Tags</h2>
1148 <ul>
1149
1150  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
1151
1152  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1153
1154  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1155
1156  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
1157
1158  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (35)</a></li>
1159
1160  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (39)</a></li>
1161
1162  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (54)</a></li>
1163
1164  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
1165
1166  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (8)</a></li>
1167
1168  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (3)</a></li>
1169
1170  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
1171
1172  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
1173
1174  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1175
1176  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
1177
1178  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (71)</a></li>
1179
1180  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (91)</a></li>
1181
1182  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (14)</a></li>
1183
1184  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (14)</a></li>
1185
1186  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
1187
1188  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1189
1190  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (10)</a></li>
1191
1192  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
1193
1194  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
1195
1196  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
1197
1198  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
1199
1200  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
1201
1202  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (7)</a></li>
1203
1204 </ul>
1205
1206 </div>
1207
1208 <p style="text-align: right">
1209 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
1210 </p>
1211 </body>
1212 </html>