X-Git-Url: https://pere.pagekite.me/gitweb/homepage.git/blobdiff_plain/525c8f4d5fe33e5fec2c764cf123c4b2fffeba52..a0a971f55f61855eb0b27b68176b325f2a65995f:/blog/archive/2010/05/05.rss?ds=inline diff --git a/blog/archive/2010/05/05.rss b/blog/archive/2010/05/05.rss index ea74feec2b..79ea17637b 100644 --- a/blog/archive/2010/05/05.rss +++ b/blog/archive/2010/05/05.rss @@ -7,230 +7,160 @@ - Forcing new users to change their password on first login - http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html - http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html - Sun, 2 May 2010 13:47:00 +0200 - <p>One interesting feature in Active Directory, is the ability to -create a new user with an expired password, and thus force the user to -change the password on the first login attempt.</p> - -<p>I'm not quite sure how to do that with the LDAP setup in Debian -Edu, but did some initial testing with a local account. The account -and password aging information is available in /etc/shadow, but -unfortunately, it is not possible to specify an expiration time for -passwords, only a maximum age for passwords.</p> - -<p>A freshly created account (using adduser test) will have these -settings in /etc/shadow:</p> - -<blockquote><pre> -root@tjener:~# chage -l test -Last password change : May 02, 2010 -Password expires : never -Password inactive : never -Account expires : never -Minimum number of days between password change : 0 -Maximum number of days between password change : 99999 -Number of days of warning before password expires : 7 -root@tjener:~# -</pre></blockquote> - -<p>The only way I could come up with to create a user with an expired -account, is to change the date of the last password change to the -lowest value possible (January 1th 1970), and the maximum password age -to the difference in days between that date and today. To make it -simple, I went for 30 years (30 * 365 = 10950) and January 2th (to -avoid testing if 0 is a valid value).</p> - -<p>After using these commands to set it up, it seem to work as -intended:</p> - -<blockquote><pre> -root@tjener:~# chage -d 1 test; chage -M 10950 test -root@tjener:~# chage -l test -Last password change : Jan 02, 1970 -Password expires : never -Password inactive : never -Account expires : never -Minimum number of days between password change : 0 -Maximum number of days between password change : 10950 -Number of days of warning before password expires : 7 -root@tjener:~# -</pre></blockquote> - -<p>So far I have tested this with ssh and console, and kdm (in -Squeeze) login, and all ask for a new password before login in the -user (with ssh, I was thrown out and had to log in again).</p> - -<p>Perhaps we should set up something similar for Debian Edu, to make -sure only the user itself have the account password?</p> - -<p>If you want to comment on or help out with implementing this for -Debian Edu, please contact us on debian-edu@lists.debian.org.</p> + Parallellized boot seem to hold up well in Debian/testing + http://people.skolelinux.org/pere/blog/Parallellized_boot_seem_to_hold_up_well_in_Debian_testing.html + http://people.skolelinux.org/pere/blog/Parallellized_boot_seem_to_hold_up_well_in_Debian_testing.html + Thu, 27 May 2010 23:55:00 +0200 + <p>A few days ago, parallel booting was enabled in Debian/testing. +The feature seem to hold up pretty well, but three fairly serious +issues are known and should be solved: -<p>Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the -shadow(8) page in Debian/testing now state that setting the date of -last password change to zero (0) will force the password to be changed -on the first login. This was not mentioned in the manual in Lenny, so -I did not notice this in my initial testing. I have tested it on -Squeeze, and '<tt>chage -d 0 username</tt>' do work there. I have not -tested it on Lenny yet.</p> +<p><ul> -<p>Update 2010-05-02-19:05: Jim Paris tells me via email that an -equivalent command to expire a password is '<tt>passwd -e -username</tt>', which insert zero into the date of the last password -change.</p> - - - - - Parallellizing the boot in Debian Squeeze - ready for wider testing - http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html - http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html - Thu, 6 May 2010 23:25:00 +0200 - <p>These days, the init.d script dependencies in Squeeze are quite -complete, so complete that it is actually possible to run all the -init.d scripts in parallell based on these dependencies. If you want -to test your Squeeze system, make sure -<a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency -based boot sequencing</a> is enabled, and add this line to -/etc/default/rcS:</p> +<li>The wicd package seen to +<a href="http://bugs.debian.org/508289">break NFS mounting</a> and +<a href="http://bugs.debian.org/581586">network setup</a> when +parallel booting is enabled. No idea why, but the wicd maintainer +seem to be on the case.</li> -<blockquote><pre> -CONCURRENCY=makefile -</pre></blockquote> +<li>The nvidia X driver seem to +<a href="http://bugs.debian.org/583312">have a race condition</a> +triggered more easily when parallel booting is in effect. The +maintainer is on the case.</li> -<p>That is it. It will cause sysv-rc to use the startpar tool to run -scripts in parallel using the dependency information stored in -/etc/init.d/.depend.boot, /etc/init.d/.depend.start and -/etc/init.d/.depend.stop to order the scripts. Startpar is configured -to try to start the kdm and gdm scripts as early as possible, and will -start the facilities required by kdm or gdm as early as possible to -make this happen.</p> +<li>The sysv-rc package fail to properly enable dependency based boot +sequencing (the shutdown is broken) when old file-rc users +<a href="http://bugs.debian.org/575080">try to switch back</a> to +sysv-rc. One way to solve it would be for file-rc to create +/etc/init.d/.legacy-bootordering, and another is to try to make +sysv-rc more robust. Will investigate some more and probably upload a +workaround in sysv-rc to help those trying to move from file-rc to +sysv-rc get a working shutdown.</li> -<p>Give it a try, and see if you like the result. If some services -fail to start properly, it is most likely because they have incomplete -init.d script dependencies in their startup script (or some of their -dependent scripts have incomplete dependencies). Report bugs and get -the package maintainers to fix it. :)</p> +</ul></p> -<p>Running scripts in parallel could be the default in Debian when we -manage to get the init.d script dependencies complete and correct. I -expect we will get there in Squeeze+1, if we get manage to test and -fix the remaining issues.</p> +<p>All in all not many surprising issues, and all of them seem +solvable before Squeeze is released. In addition to these there are +some packages with bugs in their dependencies and run level settings, +which I expect will be fixed in a reasonable time span.</p> <p>If you report any problems with dependencies in init.d scripts to the BTS, please usertag the report to get it to show up at <a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the list of usertagged bugs related to this</a>.</p> + +<p>Update: Correct bug number to file-rc issue.</p> - systemd, an interesting alternative to upstart - http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html - http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html - Thu, 13 May 2010 22:20:00 +0200 - <p>The last few days a new boot system called -<a href="http://www.freedesktop.org/wiki/Software/systemd">systemd</a> -has been -<a href="http://0pointer.de/blog/projects/systemd.html">introduced</a> + More flexible firmware handling in debian-installer + http://people.skolelinux.org/pere/blog/More_flexible_firmware_handling_in_debian_installer.html + http://people.skolelinux.org/pere/blog/More_flexible_firmware_handling_in_debian_installer.html + Sat, 22 May 2010 21:30:00 +0200 + <p>After a long break from debian-installer development, I finally +found time today to return to the project. Having to spend less time +working dependency based boot in debian, as it is almost complete now, +definitely helped freeing some time.</p> -to the free software world. I have not yet had time to play around -with it, but it seem to be a very interesting alternative to -<a href="http://upstart.ubuntu.com/">upstart</a>, and might prove to be -a good alternative for Debian when we are able to switch to an event -based boot system. Tollef is -<a href="http://bugs.debian.org/580814">in the process</a> of getting -systemd into Debian, and I look forward to seeing how well it work. I -like the fact that systemd handles init.d scripts with dependency -information natively, allowing them to run in parallel where upstart -at the moment do not.</p> +<p>A while back, I ran into a problem while working on Debian Edu. We +include some firmware packages on the Debian Edu CDs, those needed to +get disk and network controllers working. Without having these +firmware packages available during installation, it is impossible to +install Debian Edu on the given machine, and because our target group +are non-technical people, asking them to provide firmware packages on +an external medium is a support pain. Initially, I expected it to be +enough to include the firmware packages on the CD to get +debian-installer to find and use them. This proved to be wrong. +Next, I hoped it was enough to symlink the relevant firmware packages +to some useful location on the CD (tried /cdrom/ and +/cdrom/firmware/). This also proved to not work, and at this point I +found time to look at the debian-installer code to figure out what was +going to work.</p> -<p>Unfortunately do systemd have the same problem as upstart regarding -platform support. It only work on recent Linux kernels, and also need -some new kernel features enabled to function properly. This means -kFreeBSD and Hurd ports of Debian will need a port or a different boot -system. Not sure how that will be handled if systemd proves to be the -way forward.</p> +<p>The firmware loading code is in the hw-detect package, and a closer +look revealed that it would only look for firmware packages outside +the installation media, so the CD was never checked for firmware +packages. It would only check USB sticks, floppies and other +"external" media devices. Today I changed it to also look in the +/cdrom/firmware/ directory on the mounted CD or DVD, which should +solve the problem I ran into with Debian edu. I also changed it to +look in /firmware/, to make sure the installer also find firmware +provided in the initrd when booting the installer via PXE, to allow us +to provide the same feature in the PXE setup included in Debian +Edu.</p> -<p>In the mean time, based on the -<a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input -on debian-devel@</a> regarding parallel booting in Debian, I have -decided to enable full parallel booting as the default in Debian as -soon as possible (probably this weekend or early next week), to see if -there are any remaining serious bugs in the init.d dependencies. A -new version of the sysvinit package implementing this change is -already in experimental. If all go well, Squeeze will be released -with parallel booting enabled by default.</p> +<p>To make sure firmware deb packages with a license questions are not +activated without asking if the license is accepted, I extended +hw-detect to look for preinst scripts in the firmware packages, and +run these before activating the firmware during installation. The +license question is asked using debconf in the preinst, so this should +solve the issue for the firmware packages I have looked at so far.</p> + +<p>If you want to discuss the details of these features, please +contact us on debian-boot@lists.debian.org.</p> - Sitesummary tip: Listing MAC address of all clients - http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html - http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html - Fri, 14 May 2010 21:10:00 +0200 - <p>In the recent Debian Edu versions, the -<a href="http://wiki.debian.org/DebianEdu/HowTo/SiteSummary">sitesummary -system</a> is used to keep track of the machines in the school -network. Each machine will automatically report its status to the -central server after boot and once per night. The network setup is -also reported, and using this information it is possible to get the -MAC address of all network interfaces in the machines. This is useful -to update the DHCP configuration.</p> + Magnetstripeinnhold i billetter fra Flytoget og Hurtigruten + http://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html + http://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html + Fri, 21 May 2010 16:00:00 +0200 + <p>For en stund tilbake kjøpte jeg en magnetkortleser for å kunne +titte på hva som er skrevet inn på magnetstripene til ulike kort. Har +ikke hatt tid til å analysere mange kort så langt, men tenkte jeg +skulle dele innholdet på to kort med mine lesere.</p> -<p>To give some idea how to use sitesummary, here is a one-liner to -ist all MAC addresses of all machines reporting to sitesummary. Run -this on the collector host:</p> +<p>For noen dager siden tok jeg flyet til Harstad og Hurtigruten til +Bergen. Flytoget fra Oslo S til flyplassen ga meg en billett med +magnetstripe. Påtrykket finner jeg følgende informasjon:</p> -<blockquote><pre> -perl -MSiteSummary -e 'for_all_hosts(sub { print join(" ", get_macaddresses(shift)), "\n"; });' -</pre></blockquote> +<pre> +Flytoget Airport Express Train -<p>This will list all MAC addresses assosiated with all machine, one -line per machine and with space between the MAC addresses.</p> +Fra - Til : Oslo Sentralstasjon +Kategori : Voksen +Pris : Nok 170,00 +Herav mva. 8,00% : NOK 12,59 +Betaling : Kontant +Til - Fra : Oslo Lufthavn +Utstedt: : 08.05.10 +Gyldig Fra-Til : 08.05.10-07.11.10 +Billetttype : Enkeltbillett -<p>To allow system administrators easier job at adding static DHCP -addresses for hosts, it would be possible to extend this to fetch -machine information from sitesummary and update the DHCP and DNS -tables in LDAP using this information. Such tool is unfortunately not -written yet.</p> - - - - - Parallellized boot is now the default in Debian/unstable - http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html - http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html - Fri, 14 May 2010 22:40:00 +0200 - <p>Since this evening, parallel booting is the default in -Debian/unstable for machines using dependency based boot sequencing. -Apparently the testing of concurrent booting has been wider than -expected, if I am to believe the -<a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input -on debian-devel@</a>, and I concluded a few days ago to move forward -with the feature this weekend, to give us some time to detect any -remaining problems before Squeeze is frozen. If serious problems are -detected, it is simple to change the default back to sequential boot. -The upload of the new sysvinit package also activate a new upstream -version.</p> +102-1015-100508-48382-01-08 +</pre> -More information about -<a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency -based boot sequencing</a> is available from the Debian wiki. It is -currently possible to disable parallel booting when one run into -problems caused by it, by adding this line to /etc/default/rcS:</p> +<p>På selve magnetstripen er innholdet +<tt>;E?+900120011=23250996541068112619257138248441708433322932704083389389062603279671261502492655?</tt>. +Aner ikke hva innholdet representerer, og det er lite overlapp mellom +det jeg ser trykket på billetten og det jeg ser av tegn i +magnetstripen. Håper det betyr at de bruker kryptografiske metoder +for å gjøre det vanskelig å forfalske billetter.</p> -<blockquote><pre> -CONCURRENCY=none -</pre></blockquote> +<p>Den andre billetten er fra Hurtigruten, der jeg mistenker at +strekkoden på fronten er mer brukt enn magnetstripen (det var i hvert +fall den biten vi stakk inn i dørlåsen).</p> -<p>If you report any problems with dependencies in init.d scripts to -the BTS, please usertag the report to get it to show up at -<a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the -list of usertagged bugs related to this</a>.</p> +<p>Påtrykket forsiden er følgende:</p> + +<pre> +Romnummer 727 +Hurtigruten +Midnatsol +Reinholdtsen +Petter +Bookingno: SAX69 0742193 +Harstad-Bergen +Dep: 09.05.2010 Arr: 12.05.2010 +Lugar fra Risøyhamn +Kost: FRO=4 +</pre> + +<p>På selve magnetstripen er innholdet +<tt>;1316010007421930=00000000000000000000?+E?</tt>. Heller ikke her +ser jeg mye korrespondanse mellom påtrykk og magnetstripe.</p> @@ -294,160 +224,230 @@ please contact us on debian-edu@lists.debian.org.</p> - Magnetstripeinnhold i billetter fra Flytoget og Hurtigruten - http://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html - http://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html - Fri, 21 May 2010 16:00:00 +0200 - <p>For en stund tilbake kjøpte jeg en magnetkortleser for å kunne -titte på hva som er skrevet inn på magnetstripene til ulike kort. Har -ikke hatt tid til å analysere mange kort så langt, men tenkte jeg -skulle dele innholdet på to kort med mine lesere.</p> + Parallellized boot is now the default in Debian/unstable + http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html + http://people.skolelinux.org/pere/blog/Parallellized_boot_is_now_the_default_in_Debian_unstable.html + Fri, 14 May 2010 22:40:00 +0200 + <p>Since this evening, parallel booting is the default in +Debian/unstable for machines using dependency based boot sequencing. +Apparently the testing of concurrent booting has been wider than +expected, if I am to believe the +<a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input +on debian-devel@</a>, and I concluded a few days ago to move forward +with the feature this weekend, to give us some time to detect any +remaining problems before Squeeze is frozen. If serious problems are +detected, it is simple to change the default back to sequential boot. +The upload of the new sysvinit package also activate a new upstream +version.</p> -<p>For noen dager siden tok jeg flyet til Harstad og Hurtigruten til -Bergen. Flytoget fra Oslo S til flyplassen ga meg en billett med -magnetstripe. Påtrykket finner jeg følgende informasjon:</p> +More information about +<a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency +based boot sequencing</a> is available from the Debian wiki. It is +currently possible to disable parallel booting when one run into +problems caused by it, by adding this line to /etc/default/rcS:</p> -<pre> -Flytoget Airport Express Train +<blockquote><pre> +CONCURRENCY=none +</pre></blockquote> -Fra - Til : Oslo Sentralstasjon -Kategori : Voksen -Pris : Nok 170,00 -Herav mva. 8,00% : NOK 12,59 -Betaling : Kontant -Til - Fra : Oslo Lufthavn -Utstedt: : 08.05.10 -Gyldig Fra-Til : 08.05.10-07.11.10 -Billetttype : Enkeltbillett +<p>If you report any problems with dependencies in init.d scripts to +the BTS, please usertag the report to get it to show up at +<a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the +list of usertagged bugs related to this</a>.</p> + + + + + Sitesummary tip: Listing MAC address of all clients + http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html + http://people.skolelinux.org/pere/blog/Sitesummary_tip__Listing_MAC_address_of_all_clients.html + Fri, 14 May 2010 21:10:00 +0200 + <p>In the recent Debian Edu versions, the +<a href="http://wiki.debian.org/DebianEdu/HowTo/SiteSummary">sitesummary +system</a> is used to keep track of the machines in the school +network. Each machine will automatically report its status to the +central server after boot and once per night. The network setup is +also reported, and using this information it is possible to get the +MAC address of all network interfaces in the machines. This is useful +to update the DHCP configuration.</p> -102-1015-100508-48382-01-08 -</pre> +<p>To give some idea how to use sitesummary, here is a one-liner to +ist all MAC addresses of all machines reporting to sitesummary. Run +this on the collector host:</p> -<p>På selve magnetstripen er innholdet -<tt>;E?+900120011=23250996541068112619257138248441708433322932704083389389062603279671261502492655?</tt>. -Aner ikke hva innholdet representerer, og det er lite overlapp mellom -det jeg ser trykket på billetten og det jeg ser av tegn i -magnetstripen. Håper det betyr at de bruker kryptografiske metoder -for å gjøre det vanskelig å forfalske billetter.</p> +<blockquote><pre> +perl -MSiteSummary -e 'for_all_hosts(sub { print join(" ", get_macaddresses(shift)), "\n"; });' +</pre></blockquote> -<p>Den andre billetten er fra Hurtigruten, der jeg mistenker at -strekkoden på fronten er mer brukt enn magnetstripen (det var i hvert -fall den biten vi stakk inn i dørlåsen).</p> +<p>This will list all MAC addresses assosiated with all machine, one +line per machine and with space between the MAC addresses.</p> -<p>Påtrykket forsiden er følgende:</p> +<p>To allow system administrators easier job at adding static DHCP +addresses for hosts, it would be possible to extend this to fetch +machine information from sitesummary and update the DHCP and DNS +tables in LDAP using this information. Such tool is unfortunately not +written yet.</p> + + + + + systemd, an interesting alternative to upstart + http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html + http://people.skolelinux.org/pere/blog/systemd__an_interesting_alternative_to_upstart.html + Thu, 13 May 2010 22:20:00 +0200 + <p>The last few days a new boot system called +<a href="http://www.freedesktop.org/wiki/Software/systemd">systemd</a> +has been +<a href="http://0pointer.de/blog/projects/systemd.html">introduced</a> -<pre> -Romnummer 727 -Hurtigruten -Midnatsol -Reinholdtsen -Petter -Bookingno: SAX69 0742193 -Harstad-Bergen -Dep: 09.05.2010 Arr: 12.05.2010 -Lugar fra Risøyhamn -Kost: FRO=4 -</pre> +to the free software world. I have not yet had time to play around +with it, but it seem to be a very interesting alternative to +<a href="http://upstart.ubuntu.com/">upstart</a>, and might prove to be +a good alternative for Debian when we are able to switch to an event +based boot system. Tollef is +<a href="http://bugs.debian.org/580814">in the process</a> of getting +systemd into Debian, and I look forward to seeing how well it work. I +like the fact that systemd handles init.d scripts with dependency +information natively, allowing them to run in parallel where upstart +at the moment do not.</p> -<p>På selve magnetstripen er innholdet -<tt>;1316010007421930=00000000000000000000?+E?</tt>. Heller ikke her -ser jeg mye korrespondanse mellom påtrykk og magnetstripe.</p> +<p>Unfortunately do systemd have the same problem as upstart regarding +platform support. It only work on recent Linux kernels, and also need +some new kernel features enabled to function properly. This means +kFreeBSD and Hurd ports of Debian will need a port or a different boot +system. Not sure how that will be handled if systemd proves to be the +way forward.</p> + +<p>In the mean time, based on the +<a href="http://lists.debian.org/debian-devel/2010/05/msg00122.html">input +on debian-devel@</a> regarding parallel booting in Debian, I have +decided to enable full parallel booting as the default in Debian as +soon as possible (probably this weekend or early next week), to see if +there are any remaining serious bugs in the init.d dependencies. A +new version of the sysvinit package implementing this change is +already in experimental. If all go well, Squeeze will be released +with parallel booting enabled by default.</p> - More flexible firmware handling in debian-installer - http://people.skolelinux.org/pere/blog/More_flexible_firmware_handling_in_debian_installer.html - http://people.skolelinux.org/pere/blog/More_flexible_firmware_handling_in_debian_installer.html - Sat, 22 May 2010 21:30:00 +0200 - <p>After a long break from debian-installer development, I finally -found time today to return to the project. Having to spend less time -working dependency based boot in debian, as it is almost complete now, -definitely helped freeing some time.</p> + Parallellizing the boot in Debian Squeeze - ready for wider testing + http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html + http://people.skolelinux.org/pere/blog/Parallellizing_the_boot_in_Debian_Squeeze___ready_for_wider_testing.html + Thu, 6 May 2010 23:25:00 +0200 + <p>These days, the init.d script dependencies in Squeeze are quite +complete, so complete that it is actually possible to run all the +init.d scripts in parallell based on these dependencies. If you want +to test your Squeeze system, make sure +<a href="http://wiki.debian.org/LSBInitScripts/DependencyBasedBoot">dependency +based boot sequencing</a> is enabled, and add this line to +/etc/default/rcS:</p> -<p>A while back, I ran into a problem while working on Debian Edu. We -include some firmware packages on the Debian Edu CDs, those needed to -get disk and network controllers working. Without having these -firmware packages available during installation, it is impossible to -install Debian Edu on the given machine, and because our target group -are non-technical people, asking them to provide firmware packages on -an external medium is a support pain. Initially, I expected it to be -enough to include the firmware packages on the CD to get -debian-installer to find and use them. This proved to be wrong. -Next, I hoped it was enough to symlink the relevant firmware packages -to some useful location on the CD (tried /cdrom/ and -/cdrom/firmware/). This also proved to not work, and at this point I -found time to look at the debian-installer code to figure out what was -going to work.</p> +<blockquote><pre> +CONCURRENCY=makefile +</pre></blockquote> -<p>The firmware loading code is in the hw-detect package, and a closer -look revealed that it would only look for firmware packages outside -the installation media, so the CD was never checked for firmware -packages. It would only check USB sticks, floppies and other -"external" media devices. Today I changed it to also look in the -/cdrom/firmware/ directory on the mounted CD or DVD, which should -solve the problem I ran into with Debian edu. I also changed it to -look in /firmware/, to make sure the installer also find firmware -provided in the initrd when booting the installer via PXE, to allow us -to provide the same feature in the PXE setup included in Debian -Edu.</p> +<p>That is it. It will cause sysv-rc to use the startpar tool to run +scripts in parallel using the dependency information stored in +/etc/init.d/.depend.boot, /etc/init.d/.depend.start and +/etc/init.d/.depend.stop to order the scripts. Startpar is configured +to try to start the kdm and gdm scripts as early as possible, and will +start the facilities required by kdm or gdm as early as possible to +make this happen.</p> -<p>To make sure firmware deb packages with a license questions are not -activated without asking if the license is accepted, I extended -hw-detect to look for preinst scripts in the firmware packages, and -run these before activating the firmware during installation. The -license question is asked using debconf in the preinst, so this should -solve the issue for the firmware packages I have looked at so far.</p> +<p>Give it a try, and see if you like the result. If some services +fail to start properly, it is most likely because they have incomplete +init.d script dependencies in their startup script (or some of their +dependent scripts have incomplete dependencies). Report bugs and get +the package maintainers to fix it. :)</p> -<p>If you want to discuss the details of these features, please -contact us on debian-boot@lists.debian.org.</p> +<p>Running scripts in parallel could be the default in Debian when we +manage to get the init.d script dependencies complete and correct. I +expect we will get there in Squeeze+1, if we get manage to test and +fix the remaining issues.</p> + +<p>If you report any problems with dependencies in init.d scripts to +the BTS, please usertag the report to get it to show up at +<a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the +list of usertagged bugs related to this</a>.</p> - Parallellized boot seem to hold up well in Debian/testing - http://people.skolelinux.org/pere/blog/Parallellized_boot_seem_to_hold_up_well_in_Debian_testing.html - http://people.skolelinux.org/pere/blog/Parallellized_boot_seem_to_hold_up_well_in_Debian_testing.html - Thu, 27 May 2010 23:55:00 +0200 - <p>A few days ago, parallel booting was enabled in Debian/testing. -The feature seem to hold up pretty well, but three fairly serious -issues are known and should be solved: + Forcing new users to change their password on first login + http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html + http://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html + Sun, 2 May 2010 13:47:00 +0200 + <p>One interesting feature in Active Directory, is the ability to +create a new user with an expired password, and thus force the user to +change the password on the first login attempt.</p> -<p><ul> +<p>I'm not quite sure how to do that with the LDAP setup in Debian +Edu, but did some initial testing with a local account. The account +and password aging information is available in /etc/shadow, but +unfortunately, it is not possible to specify an expiration time for +passwords, only a maximum age for passwords.</p> -<li>The wicd package seen to -<a href="http://bugs.debian.org/508289">break NFS mounting</a> and -<a href="http://bugs.debian.org/581586">network setup</a> when -parallel booting is enabled. No idea why, but the wicd maintainer -seem to be on the case.</li> +<p>A freshly created account (using adduser test) will have these +settings in /etc/shadow:</p> -<li>The nvidia X driver seem to -<a href="http://bugs.debian.org/583312">have a race condition</a> -triggered more easily when parallel booting is in effect. The -maintainer is on the case.</li> +<blockquote><pre> +root@tjener:~# chage -l test +Last password change : May 02, 2010 +Password expires : never +Password inactive : never +Account expires : never +Minimum number of days between password change : 0 +Maximum number of days between password change : 99999 +Number of days of warning before password expires : 7 +root@tjener:~# +</pre></blockquote> -<li>The sysv-rc package fail to properly enable dependency based boot -sequencing (the shutdown is broken) when old file-rc users -<a href="http://bugs.debian.org/575080">try to switch back</a> to -sysv-rc. One way to solve it would be for file-rc to create -/etc/init.d/.legacy-bootordering, and another is to try to make -sysv-rc more robust. Will investigate some more and probably upload a -workaround in sysv-rc to help those trying to move from file-rc to -sysv-rc get a working shutdown.</li> +<p>The only way I could come up with to create a user with an expired +account, is to change the date of the last password change to the +lowest value possible (January 1th 1970), and the maximum password age +to the difference in days between that date and today. To make it +simple, I went for 30 years (30 * 365 = 10950) and January 2th (to +avoid testing if 0 is a valid value).</p> -</ul></p> +<p>After using these commands to set it up, it seem to work as +intended:</p> -<p>All in all not many surprising issues, and all of them seem -solvable before Squeeze is released. In addition to these there are -some packages with bugs in their dependencies and run level settings, -which I expect will be fixed in a reasonable time span.</p> +<blockquote><pre> +root@tjener:~# chage -d 1 test; chage -M 10950 test +root@tjener:~# chage -l test +Last password change : Jan 02, 1970 +Password expires : never +Password inactive : never +Account expires : never +Minimum number of days between password change : 0 +Maximum number of days between password change : 10950 +Number of days of warning before password expires : 7 +root@tjener:~# +</pre></blockquote> -<p>If you report any problems with dependencies in init.d scripts to -the BTS, please usertag the report to get it to show up at -<a href="http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=initscripts-ng-devel@lists.alioth.debian.org">the -list of usertagged bugs related to this</a>.</p> +<p>So far I have tested this with ssh and console, and kdm (in +Squeeze) login, and all ask for a new password before login in the +user (with ssh, I was thrown out and had to log in again).</p> -<p>Update: Correct bug number to file-rc issue.</p> +<p>Perhaps we should set up something similar for Debian Edu, to make +sure only the user itself have the account password?</p> + +<p>If you want to comment on or help out with implementing this for +Debian Edu, please contact us on debian-edu@lists.debian.org.</p> + +<p>Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the +shadow(8) page in Debian/testing now state that setting the date of +last password change to zero (0) will force the password to be changed +on the first login. This was not mentioned in the manual in Lenny, so +I did not notice this in my initial testing. I have tested it on +Squeeze, and '<tt>chage -d 0 username</tt>' do work there. I have not +tested it on Lenny yet.</p> + +<p>Update 2010-05-02-19:05: Jim Paris tells me via email that an +equivalent command to expire a password is '<tt>passwd -e +username</tt>', which insert zero into the date of the last password +change.</p>