[debian-edu-commits] [Git][debian-edu/debian-edu-config][personal/sunweaver/tjener-non-fqdn-hostname] 7 commits: Add new daily running script 'debian-edu-apache2-update-allowlist', which...
Mike Gabriel (@sunweaver)
gitlab at salsa.debian.org
Wed Aug 19 15:30:20 BST 2026
Mike Gabriel pushed to branch personal/sunweaver/tjener-non-fqdn-hostname at Debian Edu / debian-edu-config
Commits:
57b7fda3 by Daniel Teichmann at 2026-08-17T20:34:11+02:00
Add new daily running script 'debian-edu-apache2-update-allowlist', which updates Apache2 'Host:' allowlist.
- - - - -
3aaed7b6 by Daniel Teichmann at 2026-08-17T20:34:11+02:00
Apache2 debian-edu-default.conf: Make Tjener be reachable with custom aliases without 302 redirects.
+ 10.x.x.x/8 is always allowed.
+ Allows .crt .dat files to be downloaded without HTTPS.
+ Supports custom aliases using allowlist map at: '/usr/share/debian-edu-config/apache2_host-allowlist.map'.
+ Allowlist map will be updated by systemd/cron once a day.
+ Uses predefined fallback (www.intern).
- - - - -
1ca2ebec by Daniel Teichmann at 2026-08-17T20:34:11+02:00
Apache2 debian-edu-default.conf: Convert indentation spaces to tabs (whitespace-only).
- - - - -
7edfcae0 by Daniel Teichmann at 2026-08-18T10:02:28+02:00
Rename Apache2 host allowlist to TJENER alias map.
Avoid confusion with Debian Edu hosts (devices). The map lists
HTTP Host header values that refer to TJENER, not client machines.
Also document the timer as 15 minutes after boot, then daily, and
add the author email to debian-edu-apache2-update-tjener-aliases.
- - - - -
71f9695a by Daniel Teichmann at 2026-08-18T18:45:43+02:00
testsuite/ldap-server: Check /var/lib/ldap ownership.
Regression check for Debian#1144741 (slapd / systemd-sysusers).
debian-edu-config does not create the directory.
- - - - -
fc292d0d by Mike Gabriel at 2026-08-19T14:30:13+00:00
share/debian-edu-config/d-i/pre-pkgsel: white-space cleanup
- - - - -
234d3b0c by Mike Gabriel at 2026-08-19T14:30:13+00:00
share/debian-edu-config/d-i/pre-pkgsel: Use 'tjener' in /etc/hostname and derive FQDN from /etc/hosts. (Closes: #893394).
- - - - -
11 changed files:
- Makefile
- debian/changelog
- debian/debian-edu-config.cron.daily
- + debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service
- + debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer
- debian/rules
- etc/apache2/sites-available/debian-edu-default.conf
- + libexec/debian-edu-apache2-update-tjener-aliases
- + share/debian-edu-config/apache2_tjener-aliases.map
- share/debian-edu-config/d-i/pre-pkgsel
- testsuite/ldap-server
Changes:
=====================================
Makefile
=====================================
@@ -22,6 +22,7 @@ SPROGS = \
$(NULL)
LIBEXECPROGS = \
+ debian-edu-apache2-update-tjener-aliases \
debian-edu-cups-queue-autoflush-for-netgroup-hosts \
debian-edu-cups-queue-autoreenable-for-netgroup-hosts \
debian-edu-fsautoresize-for-netgroup-hosts \
@@ -360,6 +361,7 @@ install: install-testsuite
$(INSTALL_DATA) sbin/debian-edu-fsautoresizetab $(DESTDIR)/usr/share/debian-edu-config/fsautoresizetab
set -e ; for f in \
+ share/debian-edu-config/apache2_tjener-aliases.map \
share/debian-edu-config/avahi.smb.service \
share/debian-edu-config/rsyslog-collector \
share/debian-edu-config/rsyslog-filters \
=====================================
debian/changelog
=====================================
@@ -1,3 +1,11 @@
+debian-edu-config (2.13.1) UNRELEASED; urgency=medium
+
+ [ Daniel Teichmann ]
+ * testsuite/ldap-server: Check /var/lib/ldap exists and is owned by
+ openldap:openldap. Regression check for Debian#1144741.
+
+ -- Daniel Teichmann <daniel.teichmann at das-netzwerkteam.de> Tue, 18 Aug 2026 18:45:33 +0200
+
debian-edu-config (2.13.0) unstable; urgency=medium
[ Mike Gabriel ]
=====================================
debian/debian-edu-config.cron.daily
=====================================
@@ -9,3 +9,8 @@ export PATH
if [ -x /usr/libexec/debian-edu-config/debian-edu-cups-queue-autoflush-for-netgroup-hosts ]; then
exec /usr/libexec/debian-edu-config/debian-edu-cups-queue-autoflush-for-netgroup-hosts
fi
+
+# regularly update Apache2 TJENER alias map if the script is present
+if [ -x /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases ]; then
+ exec /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases
+fi
=====================================
debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service
=====================================
@@ -0,0 +1,6 @@
+[Unit]
+Description=Update Apache2 TJENER alias map at /usr/share/debian-edu-config/apache2_tjener-aliases.map
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases
=====================================
debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer
=====================================
@@ -0,0 +1,9 @@
+[Unit]
+Description=Run debian-edu-apache2-update-tjener-aliases.service 15 minutes after boot and then once a day.
+
+[Timer]
+OnBootSec=15min
+OnUnitActiveSec=1d
+
+[Install]
+WantedBy=timers.target
=====================================
debian/rules
=====================================
@@ -23,6 +23,7 @@ override_dh_installsystemd:
dh_installsystemd --no-start --name firefox-ldapconf
dh_installsystemd --no-start --name debian-edu-fsautoresize
dh_installsystemd --no-start --name debian-edu-update-netblock
+ dh_installsystemd --no-start --name debian-edu-apache2-update-tjener-aliases
dh_installsystemd --no-start --name debian-edu-cups-queue-autoflush
dh_installsystemd --no-start --name debian-edu-cups-queue-autoreenable
=====================================
etc/apache2/sites-available/debian-edu-default.conf
=====================================
@@ -1,16 +1,37 @@
<VirtualHost *:80>
- ServerName www.intern
+ ServerName www.intern
ServerAdmin webmaster at postoffice.intern
DocumentRoot /etc/debian-edu/www/
+# ---- <TJENER-alias redirect logic> ----
+ UseCanonicalName On
+
+ RewriteEngine On
+ RewriteMap tjeneralias "txt:/usr/share/debian-edu-config/apache2_tjener-aliases.map"
+
+ # 1. Exclusions: Skip the redirect rules entirely for wpad.dat and Debian-Edu_rootCA.crt
+ RewriteCond %{REQUEST_URI} \.(?:dat|crt)$ [NC]
+ RewriteRule ^ - [L]
+
+ # 2. Check if the requested HTTP Host matches Edu IP subnet e.g. 10.x.x.x/8 subnet..
+ # NOTE: Single IPs should be part of the TJENER alias map.
+ # NOTE: .999.999 is technically possible, but harmless.
+ RewriteCond %1 ^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$ [OR]
+
+ # 3. Path A (The Happy Path): HTTP Host is a known TJENER alias
+ # We strip the port, check the map. If it matches, redirect preserving the requested name.
+ RewriteCond %{HTTP_HOST} ^([^:]+)
+ RewriteCond ${tjeneralias:%1|DENY} ^ALLOW$ [NC]
+ RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
+
+ # 4. Path B (The Fallback): HTTP Host is not a known TJENER alias
+ # If the request makes it past Rule 3 without triggering the [L] flag,
+ # it means the name was not in the map. We safely redirect to the static ServerName.
+ RewriteRule ^(.*)$ https://%{SERVER_NAME}/$1 [R=301,L]
+# ---- </TJENER-alias redirect logic> ----
+
<Directory /etc/debian-edu/www/ >
- RewriteEngine On
- RewriteCond %{SERVER_PORT} 80
- # HTTP only: wpad.dat + Debian-Edu_rootCA.crt
- RewriteCond %{REQUEST_URI} !\.dat$
- RewriteCond %{REQUEST_URI} !\.crt$
- RewriteRule ^(.*)$ https://%{SERVER_ADDRESS}/$1 [R=301,L]
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Require all granted
@@ -32,20 +53,20 @@
CustomLog /var/log/apache2/access.log combined
ServerSignature On
- Alias /doc/ "/usr/share/doc/"
- <Directory "/usr/share/doc/">
- Options Indexes MultiViews FollowSymLinks
- AllowOverride None
+ Alias /doc/ "/usr/share/doc/"
+ <Directory "/usr/share/doc/">
+ Options Indexes MultiViews FollowSymLinks
+ AllowOverride None
Require all denied
- Allow from 127.0.0.0/255.0.0.0 ::1/128
- </Directory>
+ Allow from 127.0.0.0/255.0.0.0 ::1/128
+ </Directory>
- # add alias for munin, though it should really be handled by munin itself,
- # rather than assuming /var/www is the defaultroot..
- Alias /munin "/var/cache/munin/www/"
- <Directory /var/cache/munin/www/ >
+ # add alias for munin, though it should really be handled by munin itself,
+ # rather than assuming /var/www is the defaultroot..
+ Alias /munin "/var/cache/munin/www/"
+ <Directory /var/cache/munin/www/ >
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Require all granted
- </Directory>
+ </Directory>
</VirtualHost>
=====================================
libexec/debian-edu-apache2-update-tjener-aliases
=====================================
@@ -0,0 +1,219 @@
+#!/bin/bash
+#
+# Author: Daniel 'dzatoah' Teichmann <daniel.teichmann at das-netzwerkteam.de>
+# Date: 2026-03-21
+# License: GNU General Public License v2 or later (GPL-2+)
+#
+
+# =============================================================================
+# Queries LDAP for cNAMERecord entries under the Debian Edu DNS zone and
+# smartly merges them into the Apache2 TJENER alias map file.
+#
+# Usage: /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases
+# =============================================================================
+
+set -euo pipefail
+
+# -----------------------------------------------------------------------------
+# Configuration
+# -----------------------------------------------------------------------------
+SCRIPT_PATH="/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases"
+MAP_FILE="/usr/share/debian-edu-config/apache2_tjener-aliases.map"
+BACKUP_DIR="/var/backups/apache2-tjener-aliases"
+LDAP_BASE="relativeDomainName=tjener,zoneName=intern,cn=tjener,ou=servers,ou=systems,dc=skole,dc=skolelinux,dc=no"
+LDAP_OPTS="-x"
+LOG_TAG="update-apache2-tjener-aliases"
+
+# Debian Edu default hostnames (short + .intern variants) — always included
+# in the auto-generated block regardless of LDAP output.
+DEBIAN_EDU_DEFAULTS=(
+ "www" "www.intern"
+ "tjener" "tjener.intern"
+ "ldap" "ldap.intern"
+)
+
+# -----------------------------------------------------------------------------
+# Helpers
+# -----------------------------------------------------------------------------
+log() { logger -t "$LOG_TAG" "$*"; echo "[$(date '+%F %T')] $*"; }
+die() { log "ERROR: $*"; exit 1; }
+
+# -----------------------------------------------------------------------------
+# Sanity checks
+# -----------------------------------------------------------------------------
+command -v ldapsearch >/dev/null 2>&1 || die "ldapsearch not found. Install ldap-utils."
+[[ -d "$(dirname "$MAP_FILE")" ]] || die "Target directory does not exist: $(dirname "$MAP_FILE")"
+
+# -----------------------------------------------------------------------------
+# Backup existing map file
+# -----------------------------------------------------------------------------
+mkdir -p "$BACKUP_DIR"
+if [[ -f "$MAP_FILE" ]]; then
+ BACKUP_FILE="$BACKUP_DIR/apache2_tjener-aliases.map.$(date '+%Y%m%d_%H%M%S')"
+ cp "$MAP_FILE" "$BACKUP_FILE"
+ log "Backed up existing map to: $BACKUP_FILE"
+
+ # Prune backups older than 30 days
+ find "$BACKUP_DIR" -name "apache2_tjener-aliases.map.*" -mtime +30 -delete
+fi
+
+# -----------------------------------------------------------------------------
+# Parse HAND-EDIT block from existing file (preserve user additions)
+# -----------------------------------------------------------------------------
+HAND_EDIT_BLOCK=""
+if [[ -f "$MAP_FILE" ]]; then
+ # Extract everything from the HAND-EDIT marker to end of file
+ HAND_EDIT_BLOCK=$(awk '/^# ----- IMPORTANT HAND-EDIT ADDITIONS -----/{found=1} found{print}' "$MAP_FILE")
+fi
+
+# If there was no hand-edit block yet, use the default placeholder
+if [[ -z "$HAND_EDIT_BLOCK" ]]; then
+ HAND_EDIT_BLOCK='# ----- IMPORTANT HAND-EDIT ADDITIONS -----
+# If a user browses to the raw IP and it is not here, it will trigger a 302
+# response to a pre-defined server name.
+# Add any other IP addresses assigned to Tjeners interfaces:
+# 192.168.0.1 ALLOW'
+fi
+
+# -----------------------------------------------------------------------------
+# Query LDAP for cNAMERecord entries
+# -----------------------------------------------------------------------------
+log "Querying LDAP for cNAMERecord entries..."
+LDAP_OUTPUT=$(ldapsearch $LDAP_OPTS -b "$LDAP_BASE" 2>&1) \
+ || die "ldapsearch failed: $LDAP_OUTPUT"
+
+# Parse relativeDomainName values that have a cNAMERecord attribute.
+# Strategy: track the current relativeDomainName per stanza; only emit it
+# if a cNAMERecord line is also present in the same stanza.
+mapfile -t LDAP_CNAMES < <(
+ awk '
+ /^$/ { if (has_cname && rdn != "" && rdn != "tjener") print rdn; rdn=""; has_cname=0; next }
+ /^relativeDomainName:/ { rdn=$2 }
+ /^cNAMERecord:/ { has_cname=1 }
+ END { if (has_cname && rdn != "" && rdn != "tjener") print rdn }
+ ' <<< "$LDAP_OUTPUT" | sort -u
+)
+
+log "LDAP returned ${#LDAP_CNAMES[@]} cNAME entries: ${LDAP_CNAMES[*]:-<none>}"
+
+# -----------------------------------------------------------------------------
+# Build the de-duplicated LDAP-only section
+# (skip anything already in the Debian Edu defaults block)
+# -----------------------------------------------------------------------------
+
+# Build a lookup set of already-covered hostnames (short names only)
+declare -A COVERED
+for h in "${DEBIAN_EDU_DEFAULTS[@]}"; do
+ # Strip .intern suffix for comparison
+ short="${h%.intern}"
+ COVERED["$short"]=1
+done
+# Also mark static entries
+for h in localhost tjener; do COVERED["$h"]=1; done
+
+LDAP_EXTRA_LINES=()
+for cname in "${LDAP_CNAMES[@]}"; do
+ if [[ -z "${COVERED[$cname]+_}" ]]; then
+ LDAP_EXTRA_LINES+=("$cname")
+ COVERED["$cname"]=1
+ fi
+done
+
+# -----------------------------------------------------------------------------
+# Format helper: pad hostname to column 20 then append ALLOW
+# -----------------------------------------------------------------------------
+fmt_allow() {
+ printf "%-20s ALLOW\n" "$1"
+}
+
+# -----------------------------------------------------------------------------
+# Assemble the new map file in a temp file, then atomically replace
+# -----------------------------------------------------------------------------
+TMPFILE=$(mktemp "${MAP_FILE}.tmp.XXXXXX")
+trap 'rm -f "$TMPFILE"' EXIT
+
+{
+# ── Static header ─────────────────────────────────────────────────────────────
+cat <<HEADER
+# /usr/share/debian-edu-config/apache2_tjener-aliases.map
+# Format: <server_alias_or_IP> ALLOW
+#
+# IMPORTANT: This file will be changed daily by a script using cron/systemd.
+# It contains allowed HTTP Host: header values (TJENER aliases
+# and IPs), not client machines.
+# The script tries to smartly merge existing hand-made entries,
+# but you should execute the script manually once to make sure your
+# changes are sticking:
+# $ ${SCRIPT_PATH}
+
+# Local loopback devices
+$(fmt_allow localhost)
+$(fmt_allow "::1")
+$(fmt_allow "127.0.0.1")
+HEADER
+
+# ── Auto-generated Debian Edu defaults ────────────────────────────────────────
+cat <<'AUTOGEN_HEADER'
+
+# ---------------------------
+# | Debian Edu defaults |
+# ---------------------------
+AUTOGEN_HEADER
+
+echo "# NOTE: 10.x.x.x/8 network is allowed anyway, so next line is redundand."
+fmt_allow "10.0.2.2"
+fmt_allow "www"
+fmt_allow "www.intern"
+fmt_allow "tjener"
+fmt_allow "tjener.intern"
+fmt_allow "ldap"
+fmt_allow "ldap.intern"
+echo "# ---------------------------"
+
+# ── LDAP-discovered cNAMEs (not already in defaults) ──────────────────────────
+if [[ ${#LDAP_EXTRA_LINES[@]} -gt 0 ]]; then
+ echo ""
+ echo ""
+ echo "# ---------------------------"
+ echo "# | LDAP-discovered CNAMEs |"
+ echo "# | (auto-updated daily) |"
+ echo "# ---------------------------"
+ echo "# Last updated: $(date '+%Y-%m-%d %H:%M:%S')"
+ for h in "${LDAP_EXTRA_LINES[@]}"; do
+ fmt_allow "$h"
+ # Also emit the .intern variant if not already covered
+ intern_variant="${h}.intern"
+ if [[ -z "${COVERED[$intern_variant]+_}" ]]; then
+ fmt_allow "$intern_variant"
+ COVERED["$intern_variant"]=1
+ fi
+ done
+ echo "# ---------------------------"
+fi
+
+# ── Preserved hand-edit block ─────────────────────────────────────────────────
+echo ""
+echo ""
+echo "$HAND_EDIT_BLOCK"
+
+} > "$TMPFILE"
+
+# Validate the temp file is non-empty before replacing
+[[ -s "$TMPFILE" ]] || die "Generated file is empty — aborting."
+
+# Atomic replace
+mv "$TMPFILE" "$MAP_FILE"
+chmod 644 "$MAP_FILE"
+log "Successfully updated: $MAP_FILE"
+
+# -----------------------------------------------------------------------------
+# Reload Apache2 if running (graceful — no dropped connections)
+# -----------------------------------------------------------------------------
+if systemctl is-active --quiet apache2; then
+ log "Reloading Apache2..."
+ systemctl reload apache2 \
+ && log "Apache2 reloaded successfully." \
+ || log "WARNING: Apache2 reload failed. Check 'systemctl status apache2'."
+else
+ log "Apache2 is not running — skipping reload."
+fi
=====================================
share/debian-edu-config/apache2_tjener-aliases.map
=====================================
@@ -0,0 +1,44 @@
+# /usr/share/debian-edu-config/apache2_tjener-aliases.map
+# Format: <server_alias_or_IP> ALLOW
+#
+# IMPORTANT: This file will be changed daily by a script using cron/systemd.
+# It contains allowed HTTP Host: header values (TJENER aliases
+# and IPs), not client machines.
+# The script tries to smartly merge existing hand-made entries,
+# but you should execute the script manually once to make sure your
+# changes are sticking:
+# $ /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases
+#
+# WARNING: If you can read this and the file modification date is more than 24h
+# in the past, then there is an issue with the automatic updating
+# script managed by either cron or systemd. This file only contains
+# the most basic configuration settings for Debian Edu and needs to be
+# updated.
+#
+# DEV NOTE: If you're are updating this file in the debian-edu-config package
+# please be aware that you'll have to adapt the update script too.
+
+# Local loopback devices
+localhost ALLOW
+::1 ALLOW
+127.0.0.1 ALLOW
+
+# ---------------------------
+# | Debian Edu defaults |
+# ---------------------------
+# NOTE: 10.x.x.x/8 network is allowed, so next line is redundand.
+10.0.2.2 ALLOW
+www ALLOW
+www.intern ALLOW
+tjener ALLOW
+tjener.intern ALLOW
+ldap ALLOW
+ldap.intern ALLOW
+# ---------------------------
+
+
+# ----- IMPORTANT HAND-EDIT ADDITIONS -----
+# If a user browses to the raw IP and it is not here, it will trigger a 302
+# response to a pre-defined server name.
+# Add any other IP addresses assigned to Tjeners interfaces:
+# 172.16.0.51 ALLOW
=====================================
share/debian-edu-config/d-i/pre-pkgsel
=====================================
@@ -21,7 +21,7 @@ error() {
configure_network() {
# Write a functional /target/etc/network/interfaces
if [ -z "$PROFILE" ]; then
- PROFILE=Workstation
+ PROFILE=Workstation
fi
# Default hostname is 'localhost'
@@ -44,21 +44,21 @@ configure_network() {
# Hm, what if both server and workstation is choosen? Choose the
# server config for eth0.
for value in `echo $PROFILE |sed 's/ /-/g' | sed 's/,-/ /g'`; do
- case $value in
- Roaming-Workstation)
- # Configure network-manager to connect to eth0 by
- # default, to be able to look up user information in
- # LDAP.
- eth0=none
- autoeth0=""
- eth1=none
- autoeth1=""
- DNSDOMAIN=
- MAILNAME=
- MY_HOSTNAME=
- eth0uuid=$(chroot /target uuid)
- mkdir -p /target/etc/NetworkManager/system-connections
- cat > /target/etc/NetworkManager/system-connections/eth0 <<EOF
+ case $value in
+ Roaming-Workstation)
+ # Configure network-manager to connect to eth0 by
+ # default, to be able to look up user information in
+ # LDAP.
+ eth0=none
+ autoeth0=""
+ eth1=none
+ autoeth1=""
+ DNSDOMAIN=
+ MAILNAME=
+ MY_HOSTNAME=
+ eth0uuid=$(chroot /target uuid)
+ mkdir -p /target/etc/NetworkManager/system-connections
+ cat > /target/etc/NetworkManager/system-connections/eth0 <<EOF
[connection]
id=eth0
uuid=$eth0uuid
@@ -70,46 +70,46 @@ method=auto
[ipv4]
method=auto
EOF
- ;;
- Standalone)
- # Leave network configuration to network-manager on
- # Standalone
- eth0=none
- autoeth0=""
- eth1=none
- autoeth1=""
- DNSDOMAIN=
- MAILNAME=
- MY_HOSTNAME=
- ;;
- Workstation)
- # Use this unless Server also was choosen.
- if [ -z "$eth0" ] ; then
- eth0=none
- autoeth0=""
- eth1=none
- autoeth1=""
- fi
- ;;
- Main-Server)
- # Override for workstations combining as servers
- eth0=10.0.2.2:255.0.0.0:10.255.255.255:10.0.0.1
- MY_HOSTNAME=tjener.intern
- NAMESERVER=127.0.0.1
- autoeth0="auto eth0"
- ;;
- LTSP-Server)
- # Use this unless Server also was choosen.
- if [ -z "$eth0" ] ; then
- eth0=none
- autoeth0=""
- fi
- eth1=192.168.0.254:255.255.255.0:192.168.0.255:none
- autoeth1="auto eth1"
- ;;
- esac
+ ;;
+ Standalone)
+ # Leave network configuration to network-manager on
+ # Standalone
+ eth0=none
+ autoeth0=""
+ eth1=none
+ autoeth1=""
+ DNSDOMAIN=
+ MAILNAME=
+ MY_HOSTNAME=
+ ;;
+ Workstation)
+ # Use this unless Server also was choosen.
+ if [ -z "$eth0" ] ; then
+ eth0=none
+ autoeth0=""
+ eth1=none
+ autoeth1=""
+ fi
+ ;;
+ Main-Server)
+ # Override for workstations combining as servers
+ eth0=10.0.2.2:255.0.0.0:10.255.255.255:10.0.0.1
+ MY_HOSTNAME=tjener
+ NAMESERVER=127.0.0.1
+ autoeth0="auto eth0"
+ ;;
+ LTSP-Server)
+ # Use this unless Server also was choosen.
+ if [ -z "$eth0" ] ; then
+ eth0=none
+ autoeth0=""
+ fi
+ eth1=192.168.0.254:255.255.255.0:192.168.0.255:none
+ autoeth1="auto eth1"
+ ;;
+ esac
done
-
+
# Every host need the loopback interface
cat > $interfaces <<EOF
# Created by debian-edu-profile during the Debian installation.
@@ -123,24 +123,24 @@ iface lo inet loopback
EOF
for interface in eth0 eth1 ; do
- eval "ifinfo=\$$interface"
- eval "ifauto=\$auto$interface"
- log "setting up network interface $interface using $ifinfo"
- case $ifinfo in
- dhcp)
- cat >> $interfaces <<EOF
+ eval "ifinfo=\$$interface"
+ eval "ifauto=\$auto$interface"
+ log "setting up network interface $interface using $ifinfo"
+ case $ifinfo in
+ dhcp)
+ cat >> $interfaces <<EOF
$ifauto
iface $interface inet dhcp
EOF
- ;;
- [0-9]*)
- address=`echo $ifinfo | cut -d: -f1`
- netmask=`echo $ifinfo | cut -d: -f2`
- broadcast=`echo $ifinfo | cut -d: -f3`
- gateway=`echo $ifinfo | cut -d: -f4`
- cat >> $interfaces <<EOF
+ ;;
+ [0-9]*)
+ address=`echo $ifinfo | cut -d: -f1`
+ netmask=`echo $ifinfo | cut -d: -f2`
+ broadcast=`echo $ifinfo | cut -d: -f3`
+ gateway=`echo $ifinfo | cut -d: -f4`
+ cat >> $interfaces <<EOF
auto $interface
iface $interface inet static
@@ -148,35 +148,35 @@ iface $interface inet static
netmask $netmask
broadcast $broadcast
EOF
- if [ none != "$gateway" ] ; then
- cat >> $interfaces <<EOF
+ if [ none != "$gateway" ] ; then
+ cat >> $interfaces <<EOF
gateway $gateway
EOF
- fi
- if [ "$DNSDOMAIN" ] && [ "$NAMESERVER" = "127.0.0.1" ] ; then
- cat >> $interfaces <<EOF
+ fi
+ if [ "$DNSDOMAIN" ] && [ "$NAMESERVER" = "127.0.0.1" ] ; then
+ cat >> $interfaces <<EOF
dns-search $DNSDOMAIN
dns-nameservers $NAMESERVER
EOF
- fi
- cat >> $interfaces <<EOF
+ fi
+ cat >> $interfaces <<EOF
# The commented lines below is to be used if a DHCP server is in use
#iface $interface inet dhcp
EOF
- ;;
- *)
- # Nothing to do?
- ;;
- esac
+ ;;
+ *)
+ # Nothing to do?
+ ;;
+ esac
done
(
- echo "127.0.0.1 localhost.localdomain localhost"
- echo "::1 localhost ip6-localhost ip6-loopback"
- echo "fe00::0 ip6-localnet"
- echo "ff00::0 ip6-mcastprefix"
- echo "ff02::1 ip6-allnodes"
- echo "ff02::2 ip6-allrouters"
- echo "ff02::3 ip6-allhosts"
+ echo "127.0.0.1 localhost.localdomain localhost"
+ echo "::1 localhost ip6-localhost ip6-loopback"
+ echo "fe00::0 ip6-localnet"
+ echo "ff00::0 ip6-mcastprefix"
+ echo "ff02::1 ip6-allnodes"
+ echo "ff02::2 ip6-allrouters"
+ echo "ff02::3 ip6-allhosts"
) > /target/etc/hosts
if [ ! -z "$MY_HOSTNAME" ] ; then
@@ -187,37 +187,37 @@ EOF
# Update hostname based on reverse DNS entry of current IP or
# generate from MAC address, unless installing main-server.
if echo $PROFILE | grep -q Main-Server ; then
- :
+ :
elif [ -x /target/usr/sbin/update-hostname-from-ip ] ; then
- in-target /usr/sbin/update-hostname-from-ip -m || true
+ in-target /usr/sbin/update-hostname-from-ip -m || true
fi
# Avoid hardcoding entries on the clients, to make sure IP address
# range can be changed on the clients by changing DHCP
# configuration on the server.
- if [ "tjener.intern" = "$MY_HOSTNAME" ] ; then
- (
- echo
- echo "10.0.2.2 tjener.intern tjener"
- ) >> /target/etc/hosts
+ if [ "tjener" = "$MY_HOSTNAME" ] ; then
+ (
+ echo
+ echo "10.0.2.2 ${MY_HOSTNAME}.${DNSDOMAIN} ${MY_HOSTNAME}"
+ ) >> /target/etc/hosts
fi
# Set /etc/mailname if it is missing
if [ "$MAILNAME" ] && [ ! -f /target/etc/mailname ] ; then
- echo "$MAILNAME" > /target/etc/mailname
+ echo "$MAILNAME" > /target/etc/mailname
fi
# Make sure that the interfaces are there for the cfengine run if
# network isn't already configured
if route | grep -q default ; then
- log "Not restarting network, as it seem to be up already."
+ log "Not restarting network, as it seem to be up already."
else
- log "Restarting network to prepare for cfengine run."
- # Redirecting fd 3 as a workaround for skolelinux bug #1229.
- # make sure the redirecting happen inside the chroot, as
- # in-target need to talk to debconf.
- in-target /bin/sh -c "/etc/init.d/networking start 3> /dev/null" || true
- touch /tmp/debian-edu-nonetwork
+ log "Restarting network to prepare for cfengine run."
+ # Redirecting fd 3 as a workaround for skolelinux bug #1229.
+ # make sure the redirecting happen inside the chroot, as
+ # in-target need to talk to debconf.
+ in-target /bin/sh -c "/etc/init.d/networking start 3> /dev/null" || true
+ touch /tmp/debian-edu-nonetwork
fi
}
@@ -225,32 +225,32 @@ EOF
# finish-install hook.
set_kerberos_ldap_passwords() {
if db_get passwd/root-password-crypted && [ "$RET" ] ; then
- log "No clear text root password, unable to pass it on to Kerberos/LDAP."
+ log "No clear text root password, unable to pass it on to Kerberos/LDAP."
else
- log "Fetching password for Kerberos KDC and LDAP." 1>&2
- db_get passwd/root-password
- ROOTPWD="$RET"
-
- log "Fetching info for first user." 1>&2
-
- if db_get passwd/username && [ "$RET" ] ; then
- FIRSTUSERNAME="$RET"
- else
- FIRSTUSERNAME="localadmin"
- fi
- if db_get passwd/user-fullname && [ "$RET" ] ; then
- FIRSTUSERGECOS="$RET"
- else
- FIRSTUSERGECOS="LDAP initial admin user"
- fi
- if db_get passwd/user-password && [ "$RET" ] ; then
- FIRSTUSERPWD="$RET"
- else
- FIRSTUSERPWD="$ROOTPWD"
- fi
-
- file=/tmp/passwords-preseed
- cat > $file <<EOF
+ log "Fetching password for Kerberos KDC and LDAP." 1>&2
+ db_get passwd/root-password
+ ROOTPWD="$RET"
+
+ log "Fetching info for first user." 1>&2
+
+ if db_get passwd/username && [ "$RET" ] ; then
+ FIRSTUSERNAME="$RET"
+ else
+ FIRSTUSERNAME="localadmin"
+ fi
+ if db_get passwd/user-fullname && [ "$RET" ] ; then
+ FIRSTUSERGECOS="$RET"
+ else
+ FIRSTUSERGECOS="LDAP initial admin user"
+ fi
+ if db_get passwd/user-password && [ "$RET" ] ; then
+ FIRSTUSERPWD="$RET"
+ else
+ FIRSTUSERPWD="$ROOTPWD"
+ fi
+
+ file=/tmp/passwords-preseed
+ cat > $file <<EOF
debian-edu-config debian-edu-config/kdc-password password $ROOTPWD
debian-edu-config debian-edu-config/kdc-password-again password $ROOTPWD
debian-edu-config debian-edu-config/ldap-password password $ROOTPWD
@@ -259,10 +259,10 @@ debian-edu-config debian-edu-config/first-user-name string $FIRSTUSERNAME
debian-edu-config debian-edu-config/first-user-fullname string $FIRSTUSERGECOS
debian-edu-config debian-edu-config/first-user-password password $FIRSTUSERPWD
EOF
- # Pass user and password information into the target
- cat $file | LANG=C chroot /target debconf-set-selections || \
- error "Failed to load preseed values from $file."
- rm $file
+ # Pass user and password information into the target
+ cat $file | LANG=C chroot /target debconf-set-selections || \
+ error "Failed to load preseed values from $file."
+ rm $file
fi
}
@@ -275,25 +275,25 @@ create_initial_localadmin_user() {
LOCAL_USER_INGROUPS="$LOCAL_USER_INGROUPS adm sudo"
if db_get passwd/root-password-crypted && [ "$RET" ] ; then
- log "No clear text root password, unable to use it for creating the initial local user"
+ log "No clear text root password, unable to use it for creating the initial local user"
else
- # retrieve root password
- db_get passwd/root-password
- LOCAL_USER_PASSWD=$RET
- # create initial local user
- in-target /usr/sbin/addgroup --gid $LOCAL_USER_PRIMGIDNUMBER $LOCAL_USER_ID 1>&2 || true
- in-target /usr/sbin/adduser --gid $LOCAL_USER_PRIMGIDNUMBER \
- --firstuid $LOCAL_USER_UIDNUMBER \
- --home /home/$LOCAL_USER_ID \
- --shell /bin/bash \
- --disabled-login \
- --gecos "$LOCAL_USER_GECOS" $LOCAL_USER_ID 1>&2 || true
- # add initial local user to some standard system groups
- for group in ${LOCAL_USER_INGROUPS}; do
- in-target /usr/sbin/adduser $LOCAL_USER_ID $group 1>&2 || true
- done
- # set password (batch mode)
- in-target /bin/sh -c "echo ${LOCAL_USER_ID}:${LOCAL_USER_PASSWD} | /usr/sbin/chpasswd" 1>&2 || true
+ # retrieve root password
+ db_get passwd/root-password
+ LOCAL_USER_PASSWD=$RET
+ # create initial local user
+ in-target /usr/sbin/addgroup --gid $LOCAL_USER_PRIMGIDNUMBER $LOCAL_USER_ID 1>&2 || true
+ in-target /usr/sbin/adduser --gid $LOCAL_USER_PRIMGIDNUMBER \
+ --firstuid $LOCAL_USER_UIDNUMBER \
+ --home /home/$LOCAL_USER_ID \
+ --shell /bin/bash \
+ --disabled-login \
+ --gecos "$LOCAL_USER_GECOS" $LOCAL_USER_ID 1>&2 || true
+ # add initial local user to some standard system groups
+ for group in ${LOCAL_USER_INGROUPS}; do
+ in-target /usr/sbin/adduser $LOCAL_USER_ID $group 1>&2 || true
+ done
+ # set password (batch mode)
+ in-target /bin/sh -c "echo ${LOCAL_USER_ID}:${LOCAL_USER_PASSWD} | /usr/sbin/chpasswd" 1>&2 || true
fi
}
@@ -311,15 +311,15 @@ workaround_grub_issue() {
# want.
db_get grub-installer/choose_bootdev || true
if [ "$RET" ] && [ "manual" != "$RET" ]; then
- log "not overriding grub-installer/choose_bootdev to $grubdev, its value was '$RET'"
- return
+ log "not overriding grub-installer/choose_bootdev to $grubdev, its value was '$RET'"
+ return
fi
case "$bootdev" in
- /dev/sd*|/dev/vd*|/dev/hd*|/dev/xvd*)
- log "overriding grub-installer/choose_bootdev, setting it to $grubdev"
- db_set grub-installer/choose_bootdev "$grubdev" || true
- ;;
+ /dev/sd*|/dev/vd*|/dev/hd*|/dev/xvd*)
+ log "overriding grub-installer/choose_bootdev, setting it to $grubdev"
+ db_set grub-installer/choose_bootdev "$grubdev" || true
+ ;;
esac
}
@@ -341,20 +341,20 @@ configure_network
edu-etcvcs commit
if echo "$PROFILE" | grep -q Main-Server ; then
- set_kerberos_ldap_passwords
+ set_kerberos_ldap_passwords
fi
for p in $(echo $PROFILE | tr , " ") ; do
case $p in
- # Only do this for the networked tasks, not for standalone
- Main-Server|Workstation|Roaming-Workstation|LTSP-Server|Minimal)
- #create_initial_localadmin_user
- in-target /usr/share/debian-edu-config/tools/preseed-ldap-kerberos
- in-target /usr/share/debian-edu-config/tools/preseed-sitesummary
-
- # Tell user-setup to not create a user, needed on
- # Main-Server to be able to create the user in LDAP.
- db_set passwd/make-user boolean false
- ;;
+ # Only do this for the networked tasks, not for standalone
+ Main-Server|Workstation|Roaming-Workstation|LTSP-Server|Minimal)
+ #create_initial_localadmin_user
+ in-target /usr/share/debian-edu-config/tools/preseed-ldap-kerberos
+ in-target /usr/share/debian-edu-config/tools/preseed-sitesummary
+
+ # Tell user-setup to not create a user, needed on
+ # Main-Server to be able to create the user in LDAP.
+ db_set passwd/make-user boolean false
+ ;;
esac
done
=====================================
testsuite/ldap-server
=====================================
@@ -36,6 +36,19 @@ fi
RESULT=0
+if [ -d /var/lib/ldap ] ; then
+ owner=$(stat -c %U:%G /var/lib/ldap)
+ if [ "$owner" = "openldap:openldap" ]; then
+ echo "success: $0: /var/lib/ldap is owned by openldap:openldap"
+ else
+ echo "error: $0: /var/lib/ldap is owned by $owner, not openldap:openldap"
+ RESULT=1
+ fi
+else
+ echo "error: $0: /var/lib/ldap is missing"
+ RESULT=1
+fi
+
for port in ldap; do
netstat_check $port tcp slapd || RESULT=1
done
View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/682ac86dd03658eaab8a5d0a08ca03cecc184ad3...234d3b0ca8b6da45830a9cfc95682f6449cda3ba
--
View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/682ac86dd03658eaab8a5d0a08ca03cecc184ad3...234d3b0ca8b6da45830a9cfc95682f6449cda3ba
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-edu-commits/attachments/20260819/15189e0e/attachment-0001.htm>
More information about the debian-edu-commits
mailing list