Debian Bug report logs - #613988
kerberized nfs4 mounting

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Holger Levsen <holger@layer-acht.org>

To: submit@bugs.debian.org

Subject: kerberized nfs4 mounting

Date: Sun, 13 Feb 2011 13:37:10 +0100

[Message part 1 (text/plain, inline)]

package: debian-edu-config
severity: wishlist

Hi,

to ease maintainance (no more adding of workstations to be able to access home 
shares) and to improve security, it would be desirable to use kerberized nfs4 
mounting. 

This bug is for tracking this issue, ie by documenting the needed steps.

It's a wishlist feature and we can certainly release squeeze without. (It 
needs some time to implement and test properly.)


cheers,
	Holger

[signature.asc (application/pgp-signature, inline)]

Message #10 received at 613167@bugs.debian.org (full text, mbox, reply):

From: "Andreas B. Mundt" <andi.mundt@web.de>

To: 613167@bugs.debian.org

Subject: /etc/hosts on Diskless Clients

Date: Wed, 16 Feb 2011 15:46:32 +0100

Hi,

to get Diskless Clients work with Kerberos we first have to find a way
to modify the entires in /etc/hosts.

Currently, there is an entry: 

10.0.2.2   server  

which spoils Kerberos (error messages about for example
ldap/server@INTERN service tickets not being available). 

I tried to find a way to change this by editing a variable in
lts.conf, but without success (the same after considering 'man
lts.conf').

Any help or pointers are appreciated,

    Andi

Message #15 received at 613167@bugs.debian.org (full text, mbox, reply):

From: Wolfgang Schweer <schweer@cityweb.de>

To: 613167@bugs.debian.org

Subject: Re: Bug#613167: /etc/hosts on Diskless Clients

Date: Wed, 16 Feb 2011 21:59:44 +0100

[Message part 1 (text/plain, inline)]

On Mi, 16 Feb 2011, Andreas B. Mundt wrote:

> to get Diskless Clients work with Kerberos we first have to find a way
> to modify the entires in /etc/hosts.
> 
> Currently, there is an entry: 
> 
> 10.0.2.2   server  
  
This entry is supposed to be written by /usr/share/ltsp/screen.d/ldm 
(inside the chroot - by default /opt/ltsp/i386)

Wolfgang

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 613167@bugs.debian.org (full text, mbox, reply):

From: "Andreas B. Mundt" <andi.mundt@web.de>

To: 613167@bugs.debian.org

Cc: debian-edu@lists.debian.org

Subject: Re: Bug#613167: /etc/hosts on Diskless Clients

Date: Fri, 18 Feb 2011 17:03:47 +0100

X-Debbugs-Cc: vagrant@debian.org

Hi,

On Wed, Feb 16, 2011 at 09:59:44PM +0100, Wolfgang Schweer wrote:
> On Mi, 16 Feb 2011, Andreas B. Mundt wrote:
> 
> > to get Diskless Clients work with Kerberos we first have to find a way
> > to modify the entires in /etc/hosts.
> > 
> > Currently, there is an entry: 
> > 
> > 10.0.2.2   server  
>   
> This entry is supposed to be written by /usr/share/ltsp/screen.d/ldm 
> (inside the chroot - by default /opt/ltsp/i386)

Thanks for the pointer. With its help I found the following:

The 'server' looks like being hardcoded in the function configure_resolver()
defined in:  

     /opt/ltsp/i386/usr/share/ltsp/ltsp-init-common

Any ideas how to modify that entry easily?

Regards

	Andi

Message #25 received at 613167@bugs.debian.org (full text, mbox, reply):

From: Wolfgang Schweer <schweer@cityweb.de>

To: 613167@bugs.debian.org

Subject: Re: Bug#613167: /etc/hosts on Diskless Clients

Date: Fri, 18 Feb 2011 19:02:01 +0100

[Message part 1 (text/plain, inline)]

Hi,

On Fr, 18 Feb 2011, Andreas B. Mundt wrote:

> The 'server' looks like being hardcoded in the function configure_resolver()
> defined in:  
> 
>      /opt/ltsp/i386/usr/share/ltsp/ltsp-init-common

maybe this way (not sure, if SERVER_NAME is used already):

replace »$SERVER server« by »$SERVER ${SERVER_NAME:-"server"}« in
ltsp-init-common.

then set SERVER_NAME in lts.conf

(if getltscfg is called SERVER_NAME will be taken out of lts.conf and
exported)

for testing set PILLE_PALLE=something in lts.conf and execute
»getltscfg -a« after entering the chroot using »ltsp-chroot«
 
Wolfgang

[signature.asc (application/pgp-signature, inline)]

Message #30 received at 613167@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@freegeek.org>

To: 613167@bugs.debian.org, debian-edu@lists.debian.org

Subject: Re: Bug#613167: /etc/hosts on Diskless Clients

Date: Fri, 18 Feb 2011 10:12:31 -0800

clone 613167 -1
reassign -1 ltsp-client-core
found -1 5.1.10-2
thanks

On Fri, Feb 18, 2011 at 05:03:47PM +0100, Andreas B. Mundt wrote:
> On Wed, Feb 16, 2011 at 09:59:44PM +0100, Wolfgang Schweer wrote:
> > On Mi, 16 Feb 2011, Andreas B. Mundt wrote:
> > 
> > > to get Diskless Clients work with Kerberos we first have to find a way
> > > to modify the entires in /etc/hosts.
> > > 
> > > Currently, there is an entry: 
> > > 
> > > 10.0.2.2   server  
> >   
> > This entry is supposed to be written by /usr/share/ltsp/screen.d/ldm 
> > (inside the chroot - by default /opt/ltsp/i386)

that's a different, but nearly identical, problem...
 
> Thanks for the pointer. With its help I found the following:
> 
> The 'server' looks like being hardcoded in the function configure_resolver()
> defined in:  
> 
>      /opt/ltsp/i386/usr/share/ltsp/ltsp-init-common
> 
> Any ideas how to modify that entry easily?

there is no good way to do this, unfortunately. gah. sorry about that. for
years, LTSP development assumed DNS would not available, and this is clearly a
poor assumption.

live well,
  vagrant

Message #41 received at 613988@bugs.debian.org (full text, mbox, reply):

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: 613988@bugs.debian.org, 613167@bugs.debian.org

Subject: /etc/hosts not a problem on Debian Edu diskless workstations

Date: Sat, 04 Jun 2011 15:36:38 +0200

[Message part 1 (text/plain, inline)]

When setting up a test installation of Debian Edu squeeze at end of  
April there definitely had to be done some fixes still, but none of  
them addressed

  /etc/hostname
  /etc/hosts

For kerberized NFSv4 (on diskless workstations) you have to

(a)
tweak /etc/default/nfs-common and add the line

RPCGSSDOPTS=-n

(b)
make sure that the diskless workstations is set up as a Kerberos  
client, including the

  [libdefaults]
  allow_weak_crypto = true

line...

Mike

-- 

DAS-NETZWERKTEAM
mike gabriel, dorfstr. 27, 24245 barmissen
fon: +49 (4302) 281418, fax: +49 (4302) 281419

GnuPG Key ID 0xB588399B
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.