X-Git-Url: https://pere.pagekite.me/gitweb/homepage.git/blobdiff_plain/43afa7e32e2d9f7be65988f2d98a5d95db5e7f5a..9874ebb15b7a85d0d6e59d17eb4a66c9cb704948:/blog/archive/2012/02/02.rss

diff --git a/blog/archive/2012/02/02.rss b/blog/archive/2012/02/02.rss
index cb5d9f3bd2..50ea277d31 100644
--- a/blog/archive/2012/02/02.rss
+++ b/blog/archive/2012/02/02.rss
@@ -180,5 +180,83 @@ vil ha det.</p>
 </description>
 	</item>
 	
+	<item>
+		<title>Automatic proxy configuration with Debian Edu / Skolelinux</title>
+		<link>http://people.skolelinux.org/pere/blog/Automatic_proxy_configuration_with_Debian_Edu___Skolelinux.html</link>        
+		<guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Automatic_proxy_configuration_with_Debian_Edu___Skolelinux.html</guid>
+                <pubDate>Mon, 13 Feb 2012 23:40:00 +0100</pubDate>
+		<description>&lt;p&gt;New in the Squeeze version of
+&lt;a href=&quot;http://www.skolelinux.org/&quot;&gt;Debian Edu / Skolelinux&lt;/a&gt; is the
+ability for clients to automatically configure their proxy settings
+based on their environment.  We want all systems on the client to use
+the WPAD based proxy definition fetched from &lt;tt&gt;http://wpad/wpad.dat&lt;/tt&gt;, to
+allow sites to control the proxy setting from a central place and make
+sure clients do not have hard coded proxy settings.  The schools can
+change the global proxy setting by editing
+&lt;tt&gt;tjener:/etc/debian-edu/www/wpad.dat&lt;/tt&gt; and the change propagate
+to all Debian Edu clients in the network.&lt;/p&gt;
+
+&lt;p&gt;The problem is that some systems do not understand the WPAD system.
+In other words, how do one get from a WPAD file like this (this is a
+simple one, they can run arbitrary code):&lt;/p&gt;
+
+&lt;blockquote&gt;&lt;pre&gt;
+function FindProxyForURL(url, host)
+{
+   if (!isResolvable(host) ||
+       isPlainHostName(host) ||
+       dnsDomainIs(host, &quot;.intern&quot;))
+      return &quot;DIRECT&quot;;
+   else
+      return &quot;PROXY webcache:3128; DIRECT&quot;;
+}
+&lt;/pre&gt;&lt;/blockquote&gt;
+
+&lt;p&gt;to a proxy setting in the process environment looking like this:&lt;/p&gt;
+
+&lt;blockquote&gt;&lt;pre&gt;
+http_proxy=http://webcache:3128/
+ftp_proxy=http://webcache:3128/
+&lt;/pre&gt;&lt;/blockquote&gt;
+
+&lt;p&gt;To do this conversion I developed a perl script that will execute
+the javascript fragment in the WPAD file and return the proxy that
+would be used for
+&lt;tt&gt;&lt;a href=&quot;http://www.debian.org/&quot;&gt;http://www.debian.org/&lt;/a&gt;&lt;/tt&gt;,
+and insert this extracted proxy URL in &lt;tt&gt;/etc/environment&lt;/tt&gt; and
+&lt;tt&gt;/etc/apt/apt.conf&lt;/tt&gt;.  The perl script wpad-extract work just
+fine in Squeeze, but in Wheezy the library it need to run the
+javascript code is &lt;a href=&quot;http://bugs.debian.org/631045&quot;&gt;no longer
+able to build&lt;/a&gt; because the C library it depended on is now a C++
+library.  I hope someone find a solution to that problem before Wheezy
+is frozen.  An alternative would be for us to rewrite wpad-extract to
+use some other javascript library currently working in Wheezy, but no
+known alternative is known at the moment.&lt;/p&gt;
+
+&lt;p&gt;This automatic proxy system allow the roaming workstation (aka
+laptop) setup in Debian Edu/Squeeze to use the proxy when the laptop
+is connected to the backbone network in a Debian Edu setup, and to
+automatically use any proxy present and announced using the WPAD
+feature when it is connected to other networks.  And if no proxy is
+announced, direct connections will be used instead.&lt;/p&gt;
+
+&lt;p&gt;Silently using a proxy announced on the network might be a privacy
+or security problem.  But those controlling DHCP and DNS on a network
+could just as easily set up a transparent proxy, and force all HTTP
+and FTP connections to use a proxy anyway, so I consider that
+distinction to be academic.  If you are afraid of using the wrong
+proxy, you should avoid connecting to the network in question in the
+first place.  In Debian Edu, the proxy setup is updated using dhcp and
+ifupdown hooks, to make sure the configuration is updated every time
+the network setup changes.&lt;/p&gt;
+
+The WPAD system is documented in a
+&lt;a href=&quot;http://tools.ietf.org/html/draft-ietf-wrec-wpad-01&quot;&gt;IETF
+draft&lt;/a&gt; and a
+&lt;a href=&quot;http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol&quot;&gt;Wikipedia
+page&lt;/a&gt; for those that want to learn more.
+</description>
+	</item>
+	
         </channel>
 </rss>