blog/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="http://people.skolelinux.org/pere/blog/index.rss" type="application/rss+xml">
   8
   9  </head>
  10  <body>
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20
  21
  22  <div class="entry">
  23   <div class="title"><a href="http://people.skolelinux.org/pere/blog/What_are_they_searching_for___PowerDNS_and_ISC_DHCP_in_LDAP.html">What are they searching for - PowerDNS and ISC DHCP in LDAP</a></div>
  24   <div class="date">2010-07-17 21:00</div>
  25   <div class="body">
  26 <p>This is a
  27 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">followup</a>
  28 on my
  29 <a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">previous
  30 work</a> on
  31 <a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">merging
  32 all</a> the computer related LDAP objects in Debian Edu.</p>
  33
  34 <p>As a step to try to see if it possible to merge the DNS and DHCP
  35 LDAP objects, I have had a look at how the packages pdns-backend-ldap
  36 and dhcp3-server-ldap in Debian use the LDAP server.  The two
  37 implementations are quite different in how they use LDAP.</p>
  38
  39 To get this information, I started slapd with debugging enabled and
  40 dumped the debug output to a file to get the LDAP searches performed
  41 on a Debian Edu main-server.  Here is a summary.
  42
  43 <p><strong>powerdns</strong></p>
  44
  45 <a href="http://www.linuxnetworks.de/doc/index.php/PowerDNS_LDAP_Backend">Clues
  46 on how to</a> set up PowerDNS to use a LDAP backend is available on
  47 the web.
  48
  49 <p>PowerDNS have two modes of operation using LDAP as its backend.
  50 One "strict" mode where the forward and reverse DNS lookups are done
  51 using the same LDAP objects, and a "tree" mode where the forward and
  52 reverse entries are in two different subtrees in LDAP with a structure
  53 based on the DNS names, as in tjener.intern and
  54 2.2.0.10.in-addr.arpa.</p>
  55
  56 <p>In tree mode, the server is set up to use a LDAP subtree as its
  57 base, and uses a "base" scoped search for the DNS name by adding
  58 "dc=tjener,dc=intern," to the base with a filter for
  59 "(associateddomain=tjener.intern)" for the forward entry and
  60 "dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa," with a filter for
  61 "(associateddomain=2.2.0.10.in-addr.arpa)" for the reverse entry.  For
  62 forward entries, it is looking for attributes named dnsttl, arecord,
  63 nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord, mxrecord,
  64 txtrecord, rprecord, afsdbrecord, keyrecord, aaaarecord, locrecord,
  65 srvrecord, naptrrecord, kxrecord, certrecord, dsrecord, sshfprecord,
  66 ipseckeyrecord, rrsigrecord, nsecrecord, dnskeyrecord, dhcidrecord,
  67 spfrecord and modifytimestamp.  For reverse entries it is looking for
  68 the attributes dnsttl, arecord, nsrecord, cnamerecord, soarecord,
  69 ptrrecord, hinforecord, mxrecord, txtrecord, rprecord, aaaarecord,
  70 locrecord, srvrecord, naptrrecord and modifytimestamp.  The equivalent
  71 ldapsearch commands could look like this:</p>
  72
  73 <blockquote><pre>
  74 ldapsearch -h ldap \
  75   -b dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no \
  76   -s base -x '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
  77   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
  78   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
  79   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
  80   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
  81
  82 ldapsearch -h ldap \
  83   -b dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no \
  84   -s base -x '(associateddomain=2.2.0.10.in-addr.arpa)'
  85   dnsttl, arecord, nsrecord, cnamerecord soarecord ptrrecord \
  86   hinforecord mxrecord txtrecord rprecord aaaarecord locrecord \
  87   srvrecord naptrrecord modifytimestamp
  88 </pre></blockquote>
  89
  90 <p>In Debian Edu/Lenny, the PowerDNS tree mode is used with
  91 ou=hosts,dc=skole,dc=skolelinux,dc=no as the base, and these are two
  92 example LDAP objects used there.  In addition to these objects, the
  93 parent objects all th way up to ou=hosts,dc=skole,dc=skolelinux,dc=no
  94 also exist.</p>
  95
  96 <blockquote><pre>
  97 dn: dc=tjener,dc=intern,ou=hosts,dc=skole,dc=skolelinux,dc=no
  98 objectclass: top
  99 objectclass: dnsdomain
 100 objectclass: domainrelatedobject
 101 dc: tjener
 102 arecord: 10.0.2.2
 103 associateddomain: tjener.intern
 104
 105 dn: dc=2,dc=2,dc=0,dc=10,dc=in-addr,dc=arpa,ou=hosts,dc=skole,dc=skolelinux,dc=no
 106 objectclass: top
 107 objectclass: dnsdomain2
 108 objectclass: domainrelatedobject
 109 dc: 2
 110 ptrrecord: tjener.intern
 111 associateddomain: 2.2.0.10.in-addr.arpa
 112 </pre></blockquote>
 113
 114 <p>In strict mode, the server behaves differently.  When looking for
 115 forward DNS entries, it is doing a "subtree" scoped search with the
 116 same base as in the tree mode for a object with filter
 117 "(associateddomain=tjener.intern)" and requests the attributes dnsttl,
 118 arecord, nsrecord, cnamerecord, soarecord, ptrrecord, hinforecord,
 119 mxrecord, txtrecord, rprecord, aaaarecord, locrecord, srvrecord,
 120 naptrrecord and modifytimestamp.  For reverse entires it also do a
 121 subtree scoped search but this time the filter is "(arecord=10.0.2.2)"
 122 and the requested attributes are associateddomain, dnsttl and
 123 modifytimestamp.  In short, in strict mode the objects with ptrrecord
 124 go away, and the arecord attribute in the forward object is used
 125 instead.</p>
 126
 127 <p>The forward and reverse searches can be simulated using ldapsearch
 128 like this:</p>
 129
 130 <blockquote><pre>
 131 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 132   '(associateddomain=tjener.intern)' dNSTTL aRecord nSRecord \
 133   cNAMERecord sOARecord pTRRecord hInfoRecord mXRecord tXTRecord \
 134   rPRecord aFSDBRecord KeyRecord aAAARecord lOCRecord sRVRecord \
 135   nAPTRRecord kXRecord certRecord dSRecord sSHFPRecord iPSecKeyRecord \
 136   rRSIGRecord nSECRecord dNSKeyRecord dHCIDRecord sPFRecord modifyTimestamp
 137
 138 ldapsearch -h ldap -b ou=hosts,dc=skole,dc=skolelinux,dc=no -s sub -x \
 139   '(arecord=10.0.2.2)' associateddomain dnsttl modifytimestamp
 140 </pre></blockquote>
 141
 142 <p>In addition to the forward and reverse searches , there is also a
 143 search for SOA records, which behave similar to the forward and
 144 reverse lookups.</p>
 145
 146 <p>A thing to note with the PowerDNS behaviour is that it do not
 147 specify any objectclass names, and instead look for the attributes it
 148 need to generate a DNS reply.  This make it able to work with any
 149 objectclass that provide the needed attributes.</p>
 150
 151 <p>The attributes are normally provided in the cosine (RFC 1274) and
 152 dnsdomain2 schemas.  The latter is used for reverse entries like
 153 ptrrecord and recent DNS additions like aaaarecord and srvrecord.</p>
 154
 155 <p>In Debian Edu, we have created DNS objects using the object classes
 156 dcobject (for dc), dnsdomain or dnsdomain2 (structural, for the DNS
 157 attributes) and domainrelatedobject (for associatedDomain).  The use
 158 of structural object classes make it impossible to combine these
 159 classes with the object classes used by DHCP.</p>
 160
 161 <p>There are other schemas that could be used too, for example the
 162 dnszone structural object class used by Gosa and bind-sdb for the DNS
 163 attributes combined with the domainrelatedobject object class, but in
 164 this case some unused attributes would have to be included as well
 165 (zonename and relativedomainname).</p>
 166
 167 <p>My proposal for Debian Edu would be to switch PowerDNS to strict
 168 mode and not use any of the existing objectclasses (dnsdomain,
 169 dnsdomain2 and dnszone) when one want to combine the DNS information
 170 with DHCP information, and instead create a auxiliary object class
 171 defined something like this (using the attributes defined for
 172 dnsdomain and dnsdomain2 or dnszone):</p>
 173
 174 <blockquote><pre>
 175 objectclass ( some-oid NAME 'dnsDomainAux'
 176     SUP top
 177     AUXILIARY
 178     MAY ( ARecord $ MDRecord $ MXRecord $ NSRecord $ SOARecord $ CNAMERecord $
 179           DNSTTL $ DNSClass $ PTRRecord $ HINFORecord $ MINFORecord $
 180           TXTRecord $ SIGRecord $ KEYRecord $ AAAARecord $ LOCRecord $
 181           NXTRecord $ SRVRecord $ NAPTRRecord $ KXRecord $ CERTRecord $
 182           A6Record $ DNAMERecord
 183     ))
 184 </pre></blockquote>
 185
 186 <p>This will allow any object to become a DNS entry when combined with
 187 the domainrelatedobject object class, and allow any entity to include
 188 all the attributes PowerDNS wants.  I've sent an email to the PowerDNS
 189 developers asking for their view on this schema and if they are
 190 interested in providing such schema with PowerDNS, and I hope my
 191 message will be accepted into their mailing list soon.</p>
 192
 193 <p><strong>ISC dhcp</strong></p>
 194
 195 <p>The DHCP server searches for specific objectclass and requests all
 196 the object attributes, and then uses the attributes it want.  This
 197 make it harder to figure out exactly what attributes are used, but
 198 thanks to the working example in Debian Edu I can at least get an idea
 199 what is needed without having to read the source code.</p>
 200
 201 <p>In the DHCP server configuration, the LDAP base to use and the
 202 search filter to use to locate the correct dhcpServer entity is
 203 stored.  These are the relevant entries from
 204 /etc/dhcp3/dhcpd.conf:</p>
 205
 206 <blockquote><pre>
 207 ldap-base-dn "dc=skole,dc=skolelinux,dc=no";
 208 ldap-dhcp-server-cn "dhcp";
 209 </pre></blockquote>
 210
 211 <p>The DHCP server uses this information to nest all the DHCP
 212 configuration it need.  The cn "dhcp" is located using the given LDAP
 213 base and the filter "(&(objectClass=dhcpServer)(cn=dhcp))".  The
 214 search result is this entry:</p>
 215
 216 <blockquote><pre>
 217 dn: cn=dhcp,dc=skole,dc=skolelinux,dc=no
 218 cn: dhcp
 219 objectClass: top
 220 objectClass: dhcpServer
 221 dhcpServiceDN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 222 </pre></blockquote>
 223
 224 <p>The content of the dhcpServiceDN attribute is next used to locate the
 225 subtree with DHCP configuration.  The DHCP configuration subtree base
 226 is located using a base scope search with base "cn=DHCP
 227 Config,dc=skole,dc=skolelinux,dc=no" and filter
 228 "(&(objectClass=dhcpService)(|(dhcpPrimaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)(dhcpSecondaryDN=cn=dhcp,dc=skole,dc=skolelinux,dc=no)))".
 229 The search result is this entry:</p>
 230
 231 <blockquote><pre>
 232 dn: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 233 cn: DHCP Config
 234 objectClass: top
 235 objectClass: dhcpService
 236 objectClass: dhcpOptions
 237 dhcpPrimaryDN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
 238 dhcpStatements: ddns-update-style none
 239 dhcpStatements: authoritative
 240 dhcpOption: smtp-server code 69 = array of ip-address
 241 dhcpOption: www-server code 72 = array of ip-address
 242 dhcpOption: wpad-url code 252 = text
 243 </pre></blockquote>
 244
 245 <p>Next, the entire subtree is processed, one level at the time.  When
 246 all the DHCP configuration is loaded, it is ready to receive requests.
 247 The subtree in Debian Edu contain objects with object classes
 248 top/dhcpService/dhcpOptions, top/dhcpSharedNetwork/dhcpOptions,
 249 top/dhcpSubnet, top/dhcpGroup and top/dhcpHost.  These provide options
 250 and information about netmasks, dynamic range etc.  Leaving out the
 251 details here because it is not relevant for the focus of my
 252 investigation, which is to see if it is possible to merge dns and dhcp
 253 related computer objects.</p>
 254
 255 <p>When a DHCP request come in, LDAP is searched for the MAC address
 256 of the client (00:00:00:00:00:00 in this example), using a subtree
 257 scoped search with "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" as
 258 the base and "(&(objectClass=dhcpHost)(dhcpHWAddress=ethernet
 259 00:00:00:00:00:00))" as the filter.  This is what a host object look
 260 like:</p>
 261
 262 <blockquote><pre>
 263 dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 264 cn: hostname
 265 objectClass: top
 266 objectClass: dhcpHost
 267 dhcpHWAddress: ethernet 00:00:00:00:00:00
 268 dhcpStatements: fixed-address hostname
 269 </pre></blockquote>
 270
 271 <p>There is less flexiblity in the way LDAP searches are done here.
 272 The object classes need to have fixed names, and the configuration
 273 need to be stored in a fairly specific LDAP structure.  On the
 274 positive side, the invidiual dhcpHost entires can be anywhere without
 275 the DN pointed to by the dhcpServer entries.  The latter should make
 276 it possible to group all host entries in a subtree next to the
 277 configuration entries, and this subtree can also be shared with the
 278 DNS server if the schema proposed above is combined with the dhcpHost
 279 structural object class.
 280
 281 <p><strong>Conclusion</strong></p>
 282
 283 <p>The PowerDNS implementation seem to be very flexible when it come
 284 to which LDAP schemas to use.  While its "tree" mode is rigid when it
 285 come to the the LDAP structure, the "strict" mode is very flexible,
 286 allowing DNS objects to be stored anywhere under the base cn specified
 287 in the configuration.</p>
 288
 289 <p>The DHCP implementation on the other hand is very inflexible, both
 290 regarding which LDAP schemas to use and which LDAP structure to use.
 291 I guess one could implement ones own schema, as long as the
 292 objectclasses and attributes have the names used, but this do not
 293 really help when the DHCP subtree need to have a fairly fixed
 294 structure.</p>
 295
 296 <p>Based on the observed behaviour, I suspect a LDAP structure like
 297 this might work for Debian Edu:</p>
 298
 299 <blockquote><pre>
 300 ou=services
 301   cn=machine-info (dhcpService) - dhcpServiceDN points here
 302     cn=dhcp (dhcpServer)
 303     cn=dhcp-internal (dhcpSharedNetwork/dhcpOptions)
 304       cn=10.0.2.0 (dhcpSubnet)
 305         cn=group1 (dhcpGroup/dhcpOptions)
 306     cn=dhcp-thinclients (dhcpSharedNetwork/dhcpOptions)
 307       cn=192.168.0.0 (dhcpSubnet)
 308         cn=group1 (dhcpGroup/dhcpOptions)
 309     ou=machines - PowerDNS base points here
 310       cn=hostname (dhcpHost/domainrelatedobject/dnsDomainAux)
 311 </pre></blockquote>
 312
 313 <P>This is not tested yet.  If the DHCP server require the dhcpHost
 314 entries to be in the dhcpGroup subtrees, the entries can be stored
 315 there instead of a common machines subtree, and the PowerDNS base
 316 would have to be moved one level up to the machine-info subtree.</p>
 317
 318 <p>The combined object under the machines subtree would look something
 319 like this:</p>
 320
 321 <blockquote><pre>
 322 dn: dc=hostname,ou=machines,cn=machine-info,dc=skole,dc=skolelinux,dc=no
 323 dc: hostname
 324 objectClass: top
 325 objectClass: dhcpHost
 326 objectclass: domainrelatedobject
 327 objectclass: dnsDomainAux
 328 associateddomain: hostname.intern
 329 arecord: 10.11.12.13
 330 dhcpHWAddress: ethernet 00:00:00:00:00:00
 331 dhcpStatements: fixed-address hostname.intern
 332 </pre></blockquote>
 333
 334 </p>One could even add the LTSP configuration associated with a given
 335 machine, as long as the required attributes are available in a
 336 auxiliary object class.</p>
 337 </div>
 338   <div class="tags">
 339
 340
 341
 342    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 343
 344   </div>
 345  </div>
 346  <div class="padding"></div>
 347
 348  <div class="entry">
 349   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Combining_PowerDNS_and_ISC_DHCP_LDAP_objects.html">Combining PowerDNS and ISC DHCP LDAP objects</a></div>
 350   <div class="date">2010-07-14 23:45</div>
 351   <div class="body">
 352 <p>For a while now, I have wanted to find a way to change the DNS and
 353 DHCP services in Debian Edu to use the same LDAP objects for a given
 354 computer, to avoid the possibility of having a inconsistent state for
 355 a computer in LDAP (as in DHCP but no DNS entry or the other way
 356 around) and make it easier to add computers to LDAP.</p>
 357
 358 <p>I've looked at how powerdns and dhcpd is using LDAP, and using this
 359 information finally found a solution that seem to work.</p>
 360
 361 <p>The old setup required three LDAP objects for a given computer.
 362 One forward DNS entry, one reverse DNS entry and one DHCP entry.  If
 363 we switch powerdns to use its strict LDAP method (ldap-method=strict
 364 in pdns-debian-edu.conf), the forward and reverse DNS entries are
 365 merged into one while making it impossible to transfer the reverse map
 366 to a slave DNS server.</p>
 367
 368 <p>If we also replace the object class used to get the DNS related
 369 attributes to one allowing these attributes to be combined with the
 370 dhcphost object class, we can merge the DNS and DHCP entries into one.
 371 I've written such object class in the dnsdomainaux.schema file (need
 372 proper OIDs, but that is a minor issue), and tested the setup.  It
 373 seem to work.</p>
 374
 375 <p>With this test setup in place, we can get away with one LDAP object
 376 for both DNS and DHCP, and even the LTSP configuration I suggested in
 377 an earlier email.  The combined LDAP object will look something like
 378 this:</p>
 379
 380 <blockquote><pre>
 381   dn: cn=hostname,cn=group1,cn=THINCLIENTS,cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
 382   cn: hostname
 383   objectClass: dhcphost
 384   objectclass: domainrelatedobject
 385   objectclass: dnsdomainaux
 386   associateddomain: hostname.intern
 387   arecord: 10.11.12.13
 388   dhcphwaddress: ethernet 00:00:00:00:00:00
 389   dhcpstatements: fixed-address hostname
 390   ldapconfigsound: Y
 391 </pre></blockquote>
 392
 393 <p>The DNS server uses the associateddomain and arecord entries, while
 394 the DHCP server uses the dhcphwaddress and dhcpstatements entries
 395 before asking DNS to resolve the fixed-adddress.  LTSP will use
 396 dhcphwaddress or associateddomain and the ldapconfig* attributes.</p>
 397
 398 <p>I am not yet sure if I can get the DHCP server to look for its
 399 dhcphost in a different location, to allow us to put the objects
 400 outside the "DHCP Config" subtree, but hope to figure out a way to do
 401 that.  If I can't figure out a way to do that, we can still get rid of
 402 the hosts subtree and move all its content into the DHCP Config tree
 403 (which probably should be renamed to be more related to the new
 404 content.  I suspect cn=dnsdhcp,ou=services or something like that
 405 might be a good place to put it.</p>
 406
 407 <p>If you want to help out with implementing this for Debian Edu,
 408 please contact us on debian-edu@lists.debian.org.</p>
 409 </div>
 410   <div class="tags">
 411
 412
 413
 414    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 415
 416   </div>
 417  </div>
 418  <div class="padding"></div>
 419
 420  <div class="entry">
 421   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Idea_for_storing_LTSP_configuration_in_LDAP.html">Idea for storing LTSP configuration in LDAP</a></div>
 422   <div class="date">2010-07-11 22:00</div>
 423   <div class="body">
 424 <p>Vagrant mentioned on IRC today that ltsp_config now support
 425 sourcing files from /usr/share/ltsp/ltsp_config.d/ on the thin
 426 clients, and that this can be used to fetch configuration from LDAP if
 427 Debian Edu choose to store configuration there.</p>
 428
 429 <p>Armed with this information, I got inspired and wrote a test module
 430 to get configuration from LDAP.  The idea is to look up the MAC
 431 address of the client in LDAP, and look for attributes on the form
 432 ltspconfigsetting=value, and use this to export SETTING=value to the
 433 LTSP clients.</p>
 434
 435 <p>The goal is to be able to store the LTSP configuration attributes
 436 in a "computer" LDAP object used by both DNS and DHCP, and thus
 437 allowing us to store all information about a computer in one place.</p>
 438
 439 <p>This is a untested draft implementation, and I welcome feedback on
 440 this approach.  A real LDAP schema for the ltspClientAux objectclass
 441 need to be written.  Comments, suggestions, etc?</p>
 442
 443 <blockquote><pre>
 444 # Store in /opt/ltsp/$arch/usr/share/ltsp/ltsp_config.d/ldap-config
 445 #
 446 # Fetch LTSP client settings from LDAP based on MAC address
 447 #
 448 # Uses ethernet address as stored in the dhcpHost objectclass using
 449 # the dhcpHWAddress attribute or ethernet address stored in the
 450 # ieee802Device objectclass with the macAddress attribute.
 451 #
 452 # This module is written to be schema agnostic, and only depend on the
 453 # existence of attribute names.
 454 #
 455 # The LTSP configuration variables are saved directly using a
 456 # ltspConfig prefix and uppercasing the rest of the attribute name.
 457 # To set the SERVER variable, set the ltspConfigServer attribute.
 458 #
 459 # Some LDAP schema should be created with all the relevant
 460 # configuration settings.  Something like this should work:
 461 #
 462 # objectclass ( 1.1.2.2 NAME 'ltspClientAux'
 463 #     SUP top
 464 #     AUXILIARY
 465 #     MAY ( ltspConfigServer $ ltsConfigSound $ ... )
 466
 467 LDAPSERVER=$(debian-edu-ldapserver)
 468 if [ "$LDAPSERVER" ] ; then
 469     LDAPBASE=$(debian-edu-ldapserver -b)
 470     for MAC in $(LANG=C ifconfig |grep -i hwaddr| awk '{print $5}'|sort -u) ; do
 471         filter="(|(dhcpHWAddress=ethernet $MAC)(macAddress=$MAC))"
 472         ldapsearch -h "$LDAPSERVER" -b "$LDAPBASE" -v -x "$filter" | \
 473             grep '^ltspConfig' | while read attr value ; do
 474             # Remove prefix and convert to upper case
 475             attr=$(echo $attr | sed 's/^ltspConfig//i' | tr a-z A-Z)
 476             # bass value on to clients
 477             eval "$attr=$value; export $attr"
 478         done
 479     done
 480 fi
 481 </pre></blockquote>
 482
 483 <p>I'm not sure this shell construction will work, because I suspect
 484 the while block might end up in a subshell causing the variables set
 485 there to not show up in ltsp-config, but if that is the case I am sure
 486 the code can be restructured to make sure the variables are passed on.
 487 I expect that can be solved with some testing. :)</p>
 488
 489 <p>If you want to help out with implementing this for Debian Edu,
 490 please contact us on debian-edu@lists.debian.org.</p>
 491 </div>
 492   <div class="tags">
 493
 494
 495
 496    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 497
 498   </div>
 499  </div>
 500  <div class="padding"></div>
 501
 502  <div class="entry">
 503   <div class="title"><a href="http://people.skolelinux.org/pere/blog/jXplorer__a_very_nice_LDAP_GUI.html">jXplorer, a very nice LDAP GUI</a></div>
 504   <div class="date">2010-07-09 12:55</div>
 505   <div class="body">
 506 <p>Since
 507 <a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">my
 508 last post</a> about available LDAP tools in Debian, I was told about a
 509 LDAP GUI that is even better than luma.  The java application
 510 <a href="http://jxplorer.org/">jXplorer</a> is claimed to be capable of
 511 moving LDAP objects and subtrees using drag-and-drop, and can
 512 authenticate using Kerberos.  I have only tested the Kerberos
 513 authentication, but do not have a LDAP setup allowing me to rewrite
 514 LDAP with my test user yet.  It is
 515 <a href="http://packages.qa.debian.org/j/jxplorer.html">available in
 516 Debian</a> testing and unstable at the moment.  The only problem I
 517 have with it is how it handle errors.  If something go wrong, its
 518 non-intuitive behaviour require me to go through some query work list
 519 and remove the failing query.  Nothing big, but very annoying.</p>
 520 </div>
 521   <div class="tags">
 522
 523
 524
 525    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 526
 527   </div>
 528  </div>
 529  <div class="padding"></div>
 530
 531  <div class="entry">
 532   <div class="title"><a href="http://people.skolelinux.org/pere/blog/MS_Word_kr__ller_det_til_for_politiet_.html">MS Word krøller det til for politiet?</a></div>
 533   <div class="date">2010-07-08 14:00</div>
 534   <div class="body">
 535 <p>De siste dagene har Aftenposten
 536 <a href="http://www.aftenposten.no/nyheter/iriks/article3718597.ece">fortalt</a>
 537 <a href="http://www.aftenposten.no/nyheter/iriks/article3724249.ece">hvordan</a>
 538 politet har brukt skriveverktøy som ikke håndterer arabisk tekst og
 539 tekst som skal skrives fra høyre mot venstre når de har laget
 540 løpeseddel for å be om informasjon fra publikum.  Resultatet har vært
 541 en uleselig arabisk-bit på løpeseddelen.  Feilen har oppstått når
 542 teksten har blitt "kopiert inn i programvare som ikke har støtte for
 543 språk som skrives fra høyre mot venstre", og jeg er ganske sikker på
 544 at det er snakk om Microsoft Office i dette tilfellet.  Er det slik at
 545 MS Office i norsk språkdrakt ikke har støtte for tekst som skal
 546 skrives fra høyre mot venstre?  Jeg tror alle utgaver av
 547 OpenOffice.org har slik støtte, og det er jo ikke veldig vanskelig å
 548 la slik støtte finnes i alle utgaver av et program hvis støtten først
 549 er utviklet.  Aftenpostens melding får meg til å undre om problemet
 550 ville vært unngått hvis politiet brukte OpenOffice.org i stedet for MS
 551 Office.</p>
 552
 553 <p>Mon tro om det er flere eksempler på at MS Office har ødelagt for
 554 offentlig myndighet?</p>
 555 </div>
 556   <div class="tags">
 557
 558
 559
 560    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk</a>.
 561
 562   </div>
 563  </div>
 564  <div class="padding"></div>
 565
 566  <div class="entry">
 567   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Lenny__Squeeze_upgrades__apt_vs_aptitude_with_the_Gnome_desktop.html">Lenny->Squeeze upgrades, apt vs aptitude with the Gnome desktop</a></div>
 568   <div class="date">2010-07-03 23:55</div>
 569   <div class="body">
 570 <p>Here is a short update on my <a
 571 href="http://people.skolelinux.org/~pere/debian-upgrade-testing/">my
 572 Debian Lenny->Squeeze upgrade testing</a>.  Here is a summary of the
 573 difference for Gnome when it is upgraded by apt-get and aptitude.  I'm
 574 not reporting the status for KDE, because the upgrade crashes when
 575 aptitude try because of missing conflicts
 576 (<a href="http://bugs.debian.org/584861">#584861</a> and
 577 <a href="http://bugs.debian.org/585716">#585716</a>).</p>
 578
 579 <p>At the end of the upgrade test script, dpkg -l is executed to get a
 580 complete list of the installed packages.  Based on this I see these
 581 differences when I did a test run today.  As usual, I do not really
 582 know what the correct set of packages would be, but thought it best to
 583 publish the difference.</p>
 584
 585 <p>Installed using apt-get, missing with aptitude</p>
 586
 587 <blockquote><p>
 588   at-spi cpp-4.3 finger gnome-spell gstreamer0.10-gnomevfs
 589   libatspi1.0-0 libcupsys2 libeel2-data libgail-common libgdl-1-common
 590   libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin
 591   libgtksourceview-common libpt-1.10.10-plugins-alsa
 592   libpt-1.10.10-plugins-v4l libservlet2.4-java libxalan2-java
 593   libxerces2-java openoffice.org-writer2latex openssl-blacklist p7zip
 594   python-4suite-xml python-eggtrayicon python-gtkhtml2
 595   python-gtkmozembed svgalibg1 xserver-xephyr zip
 596 </p></blockquote>
 597
 598 <p>Installed using apt-get, removed with aptitude</p>
 599
 600 <blockquote><p>
 601   bluez-utils dhcdbd djvulibre-desktop epiphany-gecko
 602   gnome-app-install gnome-mount gnome-vfs-obexftp gnome-volume-manager
 603   libao2 libavahi-compat-libdnssd1 libavahi-core5 libbind9-50
 604   libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcurl3
 605   libdirectfb-1.0-0 libdvdread3 libedata-cal1.2-6 libedataserver1.2-9
 606   libeel2-2.20 libepc-1.0-1 libepc-ui-1.0-1 libexchange-storage1.2-3
 607   libfaad0 libgd2-noxpm libgda3-3 libgda3-common libggz2 libggzcore9
 608   libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnome-desktop-2
 609   libgnome-pilot2 libgnomecups1.0-1 libgnomeprint2.2-0
 610   libgnomeprintui2.2-0 libgpod3 libgraphviz4 libgtkhtml2-0
 611   libgtksourceview1.0-0 libgucharmap6 libhesiod0 libicu38 libisccc50
 612   libisccfg50 libiw29 libkpathsea4 libltdl3 liblwres50 libmagick++10
 613   libmagick10 libmalaga7 libmtp7 libmysqlclient15off libnautilus-burn4
 614   libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5
 615   libparted1.8-10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3
 616   libpt-1.10.10 libraw1394-8 libsensors3 libsmbios2 libsoup2.2-8
 617   libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1
 618   libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj
 619   libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3
 620   mysql-common swfdec-gnome totem-gstreamer wodim
 621 </p></blockquote>
 622
 623 <p>Installed using aptitude, missing with apt-get</p>
 624
 625 <blockquote><p>
 626   gnome gnome-desktop-environment hamster-applet python-gnomeapplet
 627   python-gnomekeyring python-wnck rhythmbox-plugins xorg
 628   xserver-xorg-input-all xserver-xorg-input-evdev
 629   xserver-xorg-input-kbd xserver-xorg-input-mouse
 630   xserver-xorg-input-synaptics xserver-xorg-video-all
 631   xserver-xorg-video-apm xserver-xorg-video-ark xserver-xorg-video-ati
 632   xserver-xorg-video-chips xserver-xorg-video-cirrus
 633   xserver-xorg-video-dummy xserver-xorg-video-fbdev
 634   xserver-xorg-video-glint xserver-xorg-video-i128
 635   xserver-xorg-video-i740 xserver-xorg-video-mach64
 636   xserver-xorg-video-mga xserver-xorg-video-neomagic
 637   xserver-xorg-video-nouveau xserver-xorg-video-nv
 638   xserver-xorg-video-r128 xserver-xorg-video-radeon
 639   xserver-xorg-video-radeonhd xserver-xorg-video-rendition
 640   xserver-xorg-video-s3 xserver-xorg-video-s3virge
 641   xserver-xorg-video-savage xserver-xorg-video-siliconmotion
 642   xserver-xorg-video-sis xserver-xorg-video-sisusb
 643   xserver-xorg-video-tdfx xserver-xorg-video-tga
 644   xserver-xorg-video-trident xserver-xorg-video-tseng
 645   xserver-xorg-video-vesa xserver-xorg-video-vmware
 646   xserver-xorg-video-voodoo
 647 </p></blockquote>
 648
 649 <p>Installed using aptitude, removed with apt-get</p>
 650
 651 <blockquote><p>
 652   deskbar-applet xserver-xorg xserver-xorg-core
 653   xserver-xorg-input-wacom xserver-xorg-video-intel
 654   xserver-xorg-video-openchrome
 655 </p></blockquote>
 656
 657 <p>I was told on IRC that the xorg-xserver package was
 658 <a href="http://git.debian.org/?p=pkg-xorg/xserver/xorg-server.git;a=commit;h=9c8080d06c457932d3bfec021c69ac000aa60120">changed
 659 in git</a> today to try to get apt-get to not remove xorg completely.
 660 No idea when it hits Squeeze, but when it does I hope it will reduce
 661 the difference somewhat.
 662 </div>
 663   <div class="tags">
 664
 665
 666
 667    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>.
 668
 669   </div>
 670  </div>
 671  <div class="padding"></div>
 672
 673  <div class="entry">
 674   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a></div>
 675   <div class="date">2010-07-01 11:40</div>
 676   <div class="body">
 677 <p>For a laptop, centralized user directories and password checking is
 678 a bit troubling.  Laptops are typically used also when not connected
 679 to the network, and it is vital for a user to be able to log in or
 680 unlock the screen saver also when a central server is unavailable.
 681 This is possible by caching passwords and directory information (user
 682 and group attributes) locally, and the packages to do so are available
 683 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
 684 It is also possible to set up in Debian/Lenny, but require more manual
 685 setup there because pam-auth-update is missing in Lenny.</p>
 686
 687 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
 688
 689 This is the traditional method with a twist.  The password caching is
 690 provided by libpam-ccreds (version 10-4 or later is needed on
 691 Squeeze), and the directory caching is done by nscd.  The directory
 692 lookup and password checking is done using LDAP.  If one want to use
 693 Kerberos for password checking the libpam-ldapd package can be
 694 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
 695 local home directory with the path listed in LDAP, one can use the
 696 pam_mkhomedir module from pam-modules to make this happen instead of
 697 using libpam-mklocaluser.  A setup for pam-auth-update to enable
 698 pam_mkhomedir will have to be written until a fix for
 699 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
 700 archive.  Because I believe it is a bad idea to have local home
 701 directories using misleading paths like /site/server/partition/, I
 702 prefer to create a local user with the home directory in /home/.  This
 703 is done using the libpam-mklocaluser package.</p>
 704
 705 <p>These packages need to be installed and configured</p>
 706
 707 <blockquote><pre>
 708 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
 709 </pre></blockquote>
 710
 711 <p>The ldapd packages will ask for LDAP connection information, and
 712 one have to fill in the values that fits ones own site.  Make sure the
 713 PAM part uses encrypted connections, to make sure the password is not
 714 sent in clear text to the LDAP server.  I've been unable to get TLS
 715 certificate checking for a self signed certificate working, which make
 716 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
 717 is talking to the correct LDAP server), and very much welcome feedback
 718 on how to get this working.</p>
 719
 720 <p>Because nscd do not have a default configuration fit for offline
 721 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
 722 is fixed, this configuration should be used instead of the one
 723 currently in /etc/nscd.conf.  The changes are in the fields
 724 reload-count and positive-time-to-live, and is based on the
 725 instructions I found in the
 726 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
 727 instructions by Flyn Computing.</p>
 728
 729 <blockquote><pre>
 730         debug-level             0
 731         reload-count            unlimited
 732         paranoia                no
 733
 734         enable-cache            passwd          yes
 735         positive-time-to-live   passwd          2592000
 736         negative-time-to-live   passwd          20
 737         suggested-size          passwd          211
 738         check-files             passwd          yes
 739         persistent              passwd          yes
 740         shared                  passwd          yes
 741         max-db-size             passwd          33554432
 742         auto-propagate          passwd          yes
 743
 744         enable-cache            group           yes
 745         positive-time-to-live   group           2592000
 746         negative-time-to-live   group           20
 747         suggested-size          group           211
 748         check-files             group           yes
 749         persistent              group           yes
 750         shared                  group           yes
 751         max-db-size             group           33554432
 752         auto-propagate          group           yes
 753
 754         enable-cache            hosts           no
 755         positive-time-to-live   hosts           2592000
 756         negative-time-to-live   hosts           20
 757         suggested-size          hosts           211
 758         check-files             hosts           yes
 759         persistent              hosts           yes
 760         shared                  hosts           yes
 761         max-db-size             hosts           33554432
 762
 763         enable-cache            services        yes
 764         positive-time-to-live   services        2592000
 765         negative-time-to-live   services        20
 766         suggested-size          services        211
 767         check-files             services        yes
 768         persistent              services        yes
 769         shared                  services        yes
 770         max-db-size             services        33554432
 771 </pre></blockquote>
 772
 773 <p>While we wait for a mechanism to update /etc/nsswitch.conf
 774 automatically like the one provided in
 775 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
 776 content need to be manually replaced to ensure LDAP is used as the
 777 directory service on the machine.  /etc/nsswitch.conf should normally
 778 look like this:</p>
 779
 780 <blockquote><pre>
 781 passwd:         files ldap
 782 group:          files ldap
 783 shadow:         files ldap
 784 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 785 networks:       files
 786 protocols:      files
 787 services:       files
 788 ethers:         files
 789 rpc:            files
 790 netgroup:       files ldap
 791 </pre></blockquote>
 792
 793 <p>The important parts are that ldap is listed last for passwd, group,
 794 shadow and netgroup.</p>
 795
 796 <p>With these changes in place, any user in LDAP will be able to log
 797 in locally on the machine using for example kdm, get a local home
 798 directory created and have the password as well as user and group
 799 attributes cached.
 800
 801 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 802   libpam-mklocaluser/pam_mkhomedir</h2>
 803
 804 <p>Because nscd have had its share of problems, and seem to have
 805 problems doing proper caching, I've seen suggestions and recipes to
 806 use nss-updatedb to copy parts of the LDAP database locally when the
 807 LDAP database is available.  I have not tested such setup, because I
 808 discovered sssd.</p>
 809
 810 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
 811
 812 <p>A more flexible and robust setup than the nscd combination
 813 mentioned earlier that has shown up recently, is the
 814 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
 815 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
 816 to provide a Active Directory like directory service for Linux
 817 machines.  The sssd system combines the caching of passwords and user
 818 information into one package, and remove the need for nscd and
 819 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 820 1.2 do not support netgroups, but it is said that it will support this
 821 in version 1.5 expected to show up later in 2010.  Because the
 822 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
 823 was missing in Debian, I ended up co-maintaining it with Werner, and
 824 version 1.2 is now in testing.
 825
 826 <p>These packages need to be installed and configured to get the
 827 roaming setup I want</p>
 828
 829 <blockquote><pre>
 830 libpam-sss libnss-sss libpam-mklocaluser
 831 </pre></blockquote>
 832
 833 The complete setup of sssd is done by editing/creating
 834 <tt>/etc/sssd/sssd.conf</tt>.
 835
 836 <blockquote><pre>
 837 [sssd]
 838 config_file_version = 2
 839 reconnection_retries = 3
 840 sbus_timeout = 30
 841 services = nss, pam
 842 domains = INTERN
 843
 844 [nss]
 845 filter_groups = root
 846 filter_users = root
 847 reconnection_retries = 3
 848
 849 [pam]
 850 reconnection_retries = 3
 851
 852 [domain/INTERN]
 853 enumerate = false
 854 cache_credentials = true
 855
 856 id_provider = ldap
 857 auth_provider = ldap
 858 chpass_provider = ldap
 859
 860 ldap_uri = ldap://ldap
 861 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 862 ldap_tls_reqcert = never
 863 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 864 </pre></blockquote>
 865
 866 <p>I got the same problem here with certificate checking.  Had to set
 867 "ldap_tls_reqcert = never" to get it working.</p>
 868
 869 <p>With the libnss-sss package in testing at the moment, the
 870 nsswitch.conf file is update automatically, so there is no need to
 871 modify it manually.</p>
 872
 873 <p>If you want to help out with implementing this for Debian Edu,
 874 please contact us on debian-edu@lists.debian.org.</p>
 875 </div>
 876   <div class="tags">
 877
 878
 879
 880    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 881
 882   </div>
 883  </div>
 884  <div class="padding"></div>
 885
 886  <div class="entry">
 887   <div class="title"><a href="http://people.skolelinux.org/pere/blog/LUMA__a_very_nice_LDAP_GUI.html">LUMA, a very nice LDAP GUI</a></div>
 888   <div class="date">2010-06-28 00:30</div>
 889   <div class="body">
 890 <p>The last few days I have been looking into the status of the LDAP
 891 directory in Debian Edu, and in the process I started to miss a GUI
 892 tool to browse the LDAP tree.  The only one I was able to find in
 893 Debian/Squeeze and Lenny is
 894 <a href="http://luma.sourceforge.net/">LUMA</a>, which has proved to
 895 be a great tool to get a overview of the current LDAP directory
 896 populated by default in Skolelinux.  Thanks to it, I have been able to
 897 find empty and obsolete subtrees, misplaced objects and duplicate
 898 objects.  It will be installed by default in Debian/Squeeze.  If you
 899 are working with LDAP, give it a go. :)</p>
 900
 901 <p>I did notice one problem with it I have not had time to report to
 902 the BTS yet.  There is no .desktop file in the package, so the tool do
 903 not show up in the Gnome and KDE menus, but only deep down in in the
 904 Debian submenu in KDE.  I hope that can be fixed before Squeeze is
 905 released.</p>
 906
 907 <p>I have not yet been able to get it to modify the tree yet.  I would
 908 like to move objects and remove subtrees directly in the GUI, but have
 909 not found a way to do that with LUMA yet.  So in the mean time, I use
 910 <a href="http://www.lichteblau.com/ldapvi/">ldapvi</a> for that.</p>
 911
 912 <p>If you have tips on other GUI tools for LDAP that might be useful
 913 in Debian Edu, please contact us on debian-edu@lists.debian.org.</p>
 914
 915 <p>Update 2010-06-29: Ross Reedstrom tipped us about the
 916 <a href="http://packages.qa.debian.org/g/gq.html">gq</a> package as a
 917 useful GUI alternative.  It seem like a good tool, but is unmaintained
 918 in Debian and got a RC bug keeping it out of Squeeze.  Unless that
 919 changes, it will not be an option for Debian Edu based on Squeeze.</p>
 920 </div>
 921   <div class="tags">
 922
 923
 924
 925    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 926
 927   </div>
 928  </div>
 929  <div class="padding"></div>
 930
 931  <div class="entry">
 932   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Idea_for_a_change_to_LDAP_schemas_allowing_DNS_and_DHCP_info_to_be_combined_into_one_object.html">Idea for a change to LDAP schemas allowing DNS and DHCP info to be combined into one object</a></div>
 933   <div class="date">2010-06-24 00:35</div>
 934   <div class="body">
 935 <p>A while back, I
 936 <a href="http://people.skolelinux.org/pere/blog/Time_for_new__LDAP_schemas_replacing_RFC_2307_.html">complained
 937 about the fact</a> that it is not possible with the provided schemas
 938 for storing DNS and DHCP information in LDAP to combine the two sets
 939 of information into one LDAP object representing a computer.</p>
 940
 941 <p>In the mean time, I discovered that a simple fix would be to make
 942 the dhcpHost object class auxiliary, to allow it to be combined with
 943 the dNSDomain object class, and thus forming one object for one
 944 computer when storing both DHCP and DNS information in LDAP.</p>
 945
 946 <p>If I understand this correctly, it is not safe to do this change
 947 without also changing the assigned number for the object class, and I
 948 do not know enough about LDAP schema design to do that properly for
 949 Debian Edu.</p>
 950
 951 <p>Anyway, for future reference, this is how I believe we could change
 952 the
 953 <a href="http://tools.ietf.org/html/draft-ietf-dhc-ldap-schema-00">DHCP
 954 schema</a> to solve at least part of the problem with the LDAP schemas
 955 available today from IETF.</p>
 956
 957 <pre>
 958 --- dhcp.schema    (revision 65192)
 959 +++ dhcp.schema    (working copy)
 960 @@ -376,7 +376,7 @@
 961  objectclass ( 2.16.840.1.113719.1.203.6.6
 962         NAME 'dhcpHost'
 963         DESC 'This represents information about a particular client'
 964 -       SUP top
 965 +       SUP top AUXILIARY
 966         MUST cn
 967         MAY  (dhcpLeaseDN $ dhcpHWAddress $ dhcpOptionsDN $ dhcpStatements $ dhcpComments $ dhcpOption)
 968         X-NDS_CONTAINMENT ('dhcpService' 'dhcpSubnet' 'dhcpGroup') )
 969 </pre>
 970
 971 <p>I very much welcome clues on how to do this properly for Debian
 972 Edu/Squeeze.  We provide the DHCP schema in our debian-edu-config
 973 package, and should thus be free to rewrite it as we see fit.</p>
 974
 975 <p>If you want to help out with implementing this for Debian Edu,
 976 please contact us on debian-edu@lists.debian.org.</p>
 977 </div>
 978   <div class="tags">
 979
 980
 981
 982    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 983
 984   </div>
 985  </div>
 986  <div class="padding"></div>
 987
 988  <div class="entry">
 989   <div class="title"><a href="http://people.skolelinux.org/pere/blog/Calling_tasksel_like_the_installer__while_still_getting_useful_output.html">Calling tasksel like the installer, while still getting useful output</a></div>
 990   <div class="date">2010-06-16 14:55</div>
 991   <div class="body">
 992 <p>A few times I have had the need to simulate the way tasksel
 993 installs packages during the normal debian-installer run.  Until now,
 994 I have ended up letting tasksel do the work, with the annoying problem
 995 of not getting any feedback at all when something fails (like a
 996 conffile question from dpkg or a download that fails), using code like
 997 this:
 998
 999 <blockquote><pre>
1000 export DEBIAN_FRONTEND=noninteractive
1001 tasksel --new-install
1002 </pre></blockquote>
1003
1004 This would invoke tasksel, let its automatic task selection pick the
1005 tasks to install, and continue to install the requested tasks without
1006 any output what so ever.
1007
1008 Recently I revisited this problem while working on the automatic
1009 package upgrade testing, because tasksel would some times hang without
1010 any useful feedback, and I want to see what is going on when it
1011 happen.  Then it occured to me, I can parse the output from tasksel
1012 when asked to run in test mode, and use that aptitude command line
1013 printed by tasksel then to simulate the tasksel run.  I ended up using
1014 code like this:
1015
1016 <blockquote><pre>
1017 export DEBIAN_FRONTEND=noninteractive
1018 cmd="$(in_target tasksel -t --new-install | sed 's/debconf-apt-progress -- //')"
1019 $cmd
1020 </pre></blockquote>
1021
1022 <p>The content of $cmd is typically something like "<tt>aptitude -q
1023 --without-recommends -o APT::Install-Recommends=no -y install
1024 ~t^desktop$ ~t^gnome-desktop$ ~t^laptop$ ~pstandard ~prequired
1025 ~pimportant</tt>", which will install the gnome desktop task, the
1026 laptop task and all packages with priority standard , required and
1027 important, just like tasksel would have done it during
1028 installation.</p>
1029
1030 <p>A better approach is probably to extend tasksel to be able to
1031 install packages without using debconf-apt-progress, for use cases
1032 like this.</p>
1033 </div>
1034   <div class="tags">
1035
1036
1037
1038    Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian">debian</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
1039
1040   </div>
1041  </div>
1042  <div class="padding"></div>
1043
1044  <p style="text-align: right;"><a href="index.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS feed" width="36" height="14"></a></p>
1045
1046 <div id="sidebar">
1047
1048
1049
1050
1051
1052 <h2>Archive</h2>
1053 <ul>
1054
1055 <li>2010
1056 <ul>
1057
1058 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
1059
1060 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
1061
1062 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
1063
1064 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
1065
1066 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
1067
1068 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
1069
1070 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (7)</a></li>
1071
1072 </ul></li>
1073
1074 <li>2009
1075 <ul>
1076
1077 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
1078
1079 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
1080
1081 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
1082
1083 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
1084
1085 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
1086
1087 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
1088
1089 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
1090
1091 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
1092
1093 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
1094
1095 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
1096
1097 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
1098
1099 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
1100
1101 </ul></li>
1102
1103 <li>2008
1104 <ul>
1105
1106 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
1107
1108 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
1109
1110 </ul></li>
1111
1112 </ul>
1113
1114
1115
1116 <h2>Tags</h2>
1117 <ul>
1118
1119  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
1120
1121  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
1122
1123  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
1124
1125  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
1126
1127  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (34)</a></li>
1128
1129  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (34)</a></li>
1130
1131  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (47)</a></li>
1132
1133  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
1134
1135  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (7)</a></li>
1136
1137  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
1138
1139  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
1140
1141  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
1142
1143  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
1144
1145  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
1146
1147  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (70)</a></li>
1148
1149  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (84)</a></li>
1150
1151  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (13)</a></li>
1152
1153  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (13)</a></li>
1154
1155  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
1156
1157  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
1158
1159  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (9)</a></li>
1160
1161  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
1162
1163  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
1164
1165  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
1166
1167  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
1168
1169  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
1170
1171  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
1172
1173 </ul>
1174
1175 </div>
1176
1177 <p style="text-align: right">
1178 Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v3.7</a>
1179 </p>
1180 </body>
1181 </html>