Skolelinux autoconfig system
============================
Uses cfengine to automatically configure the hosts.
This package is used for all configuration that is impossible to do
using debconf answers during first time install. Configuration
changes, replacement config files and extra files to install in a
Skolelinux installation belong to this package.
All the configuration done in this package should in principle be
possible to do using debconf answers. We should strive to get patches
into the Debian packages or upstream source, to reduce the need for
Skolelinux specific configuration.
Adding / replacing config files
-------------------------------
If we want to install (add) a file which is not included in another
Debian package, the file should be installed as a normal file in the
Debian package. This is only useful if the file can be safely
installed for all profiles.
If the file already exist in another package, we should try to use
cfengine edit commands to modify the existing file. If the changes
are massive, it will be more sensible to replace the existing file
with out of our files, and only in this case should we use the
masterfiles to copy an replacement file on top of the existing
configuration file.
Source overview
---------------
cf3/ - the cfengine configuration files, installed into
/etc/cfengine3/debian-edu
etc/... - New files installed into /etc/...
bin/ - New files installed into /usr/bin/
share/... - New files installed into /usr/share/...
Contact Petter Reinholdtsen <pere@hungry.com> if you have questions.
What is configured
==================
This is a high-level description on the configuration changes done by
this package, including the files related to che configuration change.
DNS server (bind)
------------------
Preconfigured DNS zone .intern with DNS names for services used by
debian-edu. Also includes the DHCP distributed IP addressess used.
The address range is separated into groups.
https://wiki.debian.org/DebianEdu/Documentation/Bullseye/Architecture
includes a list of services that are set up by default in a Skolelinux
network, please update it when you add new services.
Where possible the DNS name correspond to the service name in /etc/services,
where this is not possible the common name of the service is used as the DNS
name. All configuration files will, if possible, refer to the service by name
(without the domain name) thus making it easy for schools to change either
their domain (if they have an own DNS domain), or the IP addresses they use.
DHCP server (dhcp)
-------------------
Contains info on the IP range and DNS server used on the network,
and what to hand out to the clients. Also contain LTSP
configuration options.
syslog (rsyslog)
----------------
The main-server profile is configured as a syslog message collector,
and all clients (workstation and ltsp-server) is configured
to send all syslog messages to the host behind the DNS name syslog.
NTP clients and server
----------------------
The main-server profile is configured as a publicly available NTP
server, and the workstation and ltsp-server profiles are
configured as NTP clients using the host behind the DNS name ntp as
their NTP server.
LDAP server (slapd)
-------------------
Prepare it to work as NIS replacement for PAM, NSS and
automount (autofs). Also prepare it work as backend storage for
Samba domain controller.
Prepare it to contain gosa and sudoers default configuration.
NFS server (nfs-kernel-server)
------------------------------
HTTP proxy (squid)
------------------
SMB domain controller and file server (samba)
---------------------------------------------
Samba server is configured as workgroup 'skolelinux' and ldap-based
authentication. Printing is configured with cups, and an automatic
drive mapping is set for a connected user on its home at h:\
The samba server act as a domain controller and wins (windows name
service) server.
Samba client workstations are using tjener as their auth server,wins
and domain controller. Their netbios name is automatically set.
Roaming profiles are on by default, but the profiles are not separated
from the homes data into specific directories for each Windows
-Version like Win2K or WinXP.
SMTP and IMAP post office (exim and dovecot)
---------------------------------------------
Dovecot imap server is configured and can be accessed using kerberos
ticket/gssapi.
Exim is configured as a simple local mail relay on workstations and
as a server for local users on servers. Local users are searched in
the ldap database using exim ldap module.
X terminal server solution (LTSP)
---------------------------------
Printer system (CUPS)
---------------------
Configure CUPS to work out of the box. Disable non-encrypted access
for all hosts except localhost.
cf3/cf.cups
etc/cups/cupsd-debian-edu.conf
HTTP server (apache2)
--------------------
For now, Apache configuration is only tuned to know user homepage
are on /skole/tjener/home*/*/public_html (see cf3/cf.apache2)
KDE client config
-----------------
SSH (openssh)
-------------
inetd
-----
Disable unused network services (discard, daytime, time) on all
hosts, and diable SMTP listening on all client machines.
cf3/cf.inetd
Design choices
==============
Local device access
-------------------
Petter Reinholdtsen, 2006-10-17
The local user should have access to some of the local devices
(sound, cdrom, etc) after logging in on the console or via
gdm/xdm/etc, but not when logging in from remote via ssh. There
are as far as I know two ways to make this happen. One way is to
add the local user to the groups needed to access these devices, the
other is to change the permissions on these devices to give access
to the local user. The former is done using pam_group, while the
latter is done using pam_devperm. Both have advantages and
weaknesses.
pam_group
---------
By updating /etc/pam.d/common-auth and /etc/security/group.conf it is
possible to add the logged in user to the grous needed (audio,
floppy, cdrom, plugdev, video). In addition to getting access to
the devices present during login, it also make sure hotplugged
devices like USB sticks work (group membership in plugdev take care
of this).
The problem with this method is that every member of the groups in
question can create a setgid program to gain access to the devices
also when not logged into the machine. This will make it possible
to record from the microphone, read and from the floppy, cdrom and
usb stick, as well as play unwanted sound on other users computers.
It is also possible to start long-running processes in the
background to keep the access privileges to the devices in question.
There are some problems with this apporach with kde 3.5, as it
switched from using pmount (which work) to using hal callouts which
do not. More info on bug #377689.
--- /etc/pam.d/common-auth.orig 2006-10-17 11:25:40.000000000 +0000
+++ /etc/pam.d/common-auth 2006-10-17 11:25:29.000000000 +0000
@@ -7,4 +7,5 @@
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
+auth optional pam_group.so
auth required pam_unix.so nullok_secure
--- /etc/security/group.conf.orig 2006-10-17 11:27:32.000000000 +0000
+++ /etc/security/group.conf 2006-10-17 11:31:43.000000000 +0000
@@ -55,6 +55,8 @@
#xsh; tty* ;*;Al0900-1800;floppy
+*; tty*&!ttyp*; *; Al0000-2400; audio,cdrom,floppy,plugdev,video
+*; :0; *; Al0000-2400; audio,cdrom,floppy,plugdev,video
#
# End of group.conf file
pam_devperm
-----------
By installing libpam-devperm and updating /etc/pam.d/common-sessionn
(and /etc/logindevperm to fix bug #393661 and get access to
/dev/dsp), it is possible to modify the permissions of relevant
devices when a user log in, and reset the permissions when the user
log out. The user of the device is changed to the logged in user,
and the mode is normally set to 0600 granting exclusive access.
The problem with this method is that hotplug devices do not work, as
they are not available when the user is logged in, and the device
ownership is only modified when the user log in. Another problem is
that the user can keep the access privileges for the devices after
he log out by starting long-running processes in the background.
--- /etc/pam.d/common-session.orig 2006-10-17 11:23:21.000000000 +0000
+++ /etc/pam.d/common-session 2006-10-17 10:42:08.000000000 +0000
@@ -7,3 +7,4 @@
# non-interactive). The default is pam_unix.
#
session required pam_unix.so
+session required pam_devperm.so
--- /etc/logindevperm.orig 2006-10-17 10:51:58.000000000 +0000
+++ /etc/logindevperm 2006-10-17 10:53:08.000000000 +0000
@@ -24,7 +24,7 @@
:0 0600 /dev/cdrecorder:/dev/cdrecorder1:/dev/cdrecorder2:/dev/cdrecorder3
:0 0600 /dev/dvd:/dev/dvd1:/dev/dvd2:/dev/dvd3
:0 0600 /dev/zip:/dev/zip1:/dev/zip2:/dev/zip3
-:0 0600 /dev/dsp0:/dev/dsp1:/dev/dsp2:/dev/dsp3
+:0 0600 /dev/dsp:/dev/dsp0:/dev/dsp1:/dev/dsp2:/dev/dsp3
:0 0600 /dev/fd0:/dev/fd0u1440:/dev/fd0h1440:/dev/fd0u720:/dev/fd0h720
:0 0600 /dev/fd1:/dev/fd1u1440:/dev/fd1h1440:/dev/fd1u720:/dev/fd1h720
:0 0600 /dev/sequencer:/dev/sequencer2:/dev/music
Conclusion
----------
I recommend using the pam_group mechanism to get a working hotplug
support, and recommend solving the setgid-issue by adding the nosuid
mount flag to the partitions where users can add files (/home/,
/tmp/, /dev/shm/, /var/lock/), and solving the problem with
long-running processes by running some kind of idle-job killer to
kill long-running processes.
Ideas for LDAP based client configuration, reducing the amount of
configuration stored on clients.
=================================================================
The basic idea is to let the clients derive all the information they
need by starting with the DHCP reply and continue from there. At the
moment, clients have LDAP tree information hardcoded. This can be
fetched dynamically from the LDAP server, if the LDAP server can be
located. The LDAP server can be found using the same mechanism used
by MS AD, by adding the _ldap._tcp SRV records, or just using our
'ldap' DNS alias as before.
- use _ldap._tcp SRV record to find LDAP server
- use ldap "root" object to find LDAP tree info (like AD
defaultNamingContext attribute)
"ldapsearch -x -s base -h $server -b '' -x '*'"
- subnet three with relevant information? AD have subtree
"CN=Subnets,CN=Sites,CN=Configuration,$base" with objectClass=subnet
objects.
- like printers to use?
- like proxy setting?
- like browser home page?
- proxy configuration using WPAD provided by DHCP or from LDAP?
"Web Access ProtocolDiscovery" (WAPD).
- browser home page provided from LDAP for the host and/or user
- LDAP populated using sitesummary information
- for host group membership
- for dhcp mac address binding
- for dns names
- LTSP configuration?
Can the browser fetch configuration from LDAP?
An alternative is to use the avahi service announcement mechanism.