[debian-edu-commits] [Git][debian-edu/debian-edu-config][mr/fix-nsswitch-ldap] 44 commits: testsuite/ldap-server: Check /var/lib/ldap ownership.

Wed Sep 23 16:48:18 BST 2026

Daniel Teichmann pushed to branch mr/fix-nsswitch-ldap at Debian Edu / debian-edu-config

Commits:
71f9695a by Daniel Teichmann at 2026-08-18T18:45:43+02:00
testsuite/ldap-server: Check /var/lib/ldap ownership.

Regression check for Debian#1144741 (slapd / systemd-sysusers).
debian-edu-config does not create the directory.

- - - - -
9710a70a by Mike Gabriel at 2026-08-19T23:25:59+02:00
debian/control: Add to D: (debian-edu-config): procps. (Closes: #1136493).

- - - - -
760801e3 by Wolfgang Schweer at 2026-08-19T23:42:53+02:00
share/debian-edu-config/d-i/pre-pkgsel: Cleanup pre-pkgsel from cruft. (Closes: #1055648).

- - - - -
63575146 by Mike Gabriel at 2026-08-20T18:10:19+02:00
ldap-tools/ldap-debian-edu-install: Make sure interactions with debconf are UTF-8 based.

This resolves GECOS field transliteration after having retrieved
debian-edu-config/first-user-fullname from the debconf db.

(Closes: #939717).

- - - - -
6e60cafb by Daniel Teichmann at 2026-08-21T11:22:45+02:00
debian/debian-edu-config.lintian-overrides: Fix stale reference. (Fixes commit: 63575146)

https://jenkins.debian.net/job/edu-packages_sid_debian-edu-config/1078/console

- - - - -
0033de22 by Daniel Teichmann at 2026-08-21T14:49:39+00:00
Drop unused wicd preconnect hook

wicd is no longer in Debian. The hook was the only remaining wicd
integration and is not referenced anywhere else in the package.

- - - - -
63442a25 by Mike Gabriel at 2026-08-21T20:09:31+02:00
share/debian-edu-config/d-i/pre-pkgsel: white-space cleanup

- - - - -
62717ef0 by Mike Gabriel at 2026-08-21T20:09:31+02:00
share/debian-edu-config/d-i/pre-pkgsel: Use 'tjener' in /etc/hostname and derive FQDN from /etc/hosts. (Closes: #893394).

- - - - -
c618de32 by Mike Gabriel at 2026-08-21T20:09:31+02:00
testsuite/hostname: Test that /etc/hostname on installation profile Main-Server is set correctly

- - - - -
88aae95c by Daniel Teichmann at 2026-08-21T20:22:00+02:00
testsuite/hostname: escape regex dot and exit non-zero on failure

The unescaped dot in the 'tjener.intern' grep matched any character.
Escape it so the FQDN check is exact. Both error paths now exit 1 so a
broken hostname fails the test instead of silently passing.

- - - - -
06e2bd3d by Daniel Teichmann at 2026-08-21T20:22:41+02:00
share/debian-edu-config/d-i/pre-pkgsel: resolve leftover merge conflict

Commit 63442a25 committed a merge-conflict block around the
create_initial_localadmin_user() function. That function was removed
from master by 760801e3 (cruft cleanup, #1055648). Drop the conflict
markers and the cruft to match master.

- - - - -
d319a79f by Mike Gabriel at 2026-08-21T20:48:57+02:00
cf3/cf.cfengine3: Stop cfengine3 service on all Debian Edu machines

Esp. cf-execd (calling cf-agent command) clobbers the log on all Debian
Edu clients (Debian Edu 12 and onwards) and thus on syslog.intern (aka
tjener).

In Debian Edu, we use cfengine3 for managing configuration adjustments
via manual invocation of the cf-agent command, but we don't support
(yet?) to use cfengine3 for constant system management.

Partially addresses #1051834.

- - - - -
a402079a by Serhii Horichenko at 2026-08-21T23:29:58+02:00
ltsp: Add 'quiet splash' to hide boot details on clients

- - - - -
9bdaa01c by Serhii Horichenko at 2026-08-21T23:59:31+02:00
Revert "ltsp: Add 'quiet splash' to hide boot details on clients"

This reverts commit a402079a5101ceb334adc8a0a3824023be527b0d.

- - - - -
edbfefbb by Serhii Horichenko at 2026-08-23T10:19:19+02:00
ltsp: Add 'quiet splash' to hide boot details on clients

- - - - -
6966abd0 by Mike Gabriel at 2026-08-25T21:04:20+02:00
sbin/debian-edu-ltsp-install: Use KERNEL_PARAMETERS variable, if we define it

- - - - -
6169ac8e by Mike Gabriel at 2026-08-25T21:05:47+02:00
sbin/debian-edu-ltsp-install: Fix variable interpretation in sed commands

... by using double quotes, not single quotes.

- - - - -
13b1674d by Serhii Horichenko at 2026-08-25T19:06:31+00:00
etc/nagios3/debian-edu/commands.cfg: Add key -l for check_apt to list packages available for upgrade.

- - - - -
028e3f93 by Daniel Teichmann at 2026-08-25T19:07:16+00:00
debian/control: Depend on iproute2

- - - - -
beb42a3b by Mike Gabriel at 2026-08-25T19:07:16+00:00
sbin/update-hostname-from-ip: white-space cleanup

- - - - -
36910c1e by Mike Gabriel at 2026-08-25T19:07:16+00:00
sbin/update-hostname-from-ip: Stop using net-tools, use ip command from iproute2 instead

- - - - -
021b4b13 by Daniel Teichmann at 2026-08-25T19:07:16+00:00
testsuite/network: Stop using net-tools, use ip from iproute2 instead

- - - - -
703ccd7f by Daniel Teichmann at 2026-08-25T19:07:16+00:00
ldap-tools/ldap-debian-edu-install: Get MAC addresses via ip link instead of ifconfig

- - - - -
cde0e7df by Daniel Teichmann at 2026-08-25T19:07:16+00:00
share/debian-edu-config/testsuite-lib.sh: Use ss instead of netstat

- - - - -
b509dcee by Daniel Teichmann at 2026-08-25T19:07:16+00:00
testsuite/ldap-server: Use ss instead of netstat

- - - - -
c24d32a2 by Daniel Teichmann at 2026-08-25T19:07:16+00:00
debian/control: Drop Depends: net-tools

- - - - -
8b60974e by Mike Gabriel at 2026-08-25T19:07:48+00:00
share/debian-edu-config/d-i/pre-pkgsel: Support hostname override via /proc/cmdline. (Closes: #1008597).

- - - - -
22bbc38a by Daniel Teichmann at 2026-08-25T19:07:48+00:00
share/debian-edu-config/d-i/pre-pkgsel: Tighten hostname= parsing and sanitization from /proc/cmdline.

Handle hostname= as first cmdline token, ignore empty values and
strip characters invalid in hostnames.

- - - - -
107e8bf0 by Daniel Teichmann at 2026-08-25T19:07:48+00:00
share/debian-edu-config/d-i/pre-pkgsel: strip hyphens only when present

Use 's/^-+//' / 's/-+$//' instead of '-*' so the substitution only
fires when there actually is a leading/trailing hyphen to remove.

- - - - -
d5cef833 by Daniel Teichmann at 2026-08-25T19:09:26+00:00
tools/create-debian-edu-certs: Switch root CA and server key generation to ECDSA prime256v1

RSA with 2048 bits is the bare minimum with OpenSSL 3. Replace
'openssl genrsa' with 'openssl genpkey -algorithm EC' using the
prime256v1 (secp256r1 / NIST P-256) curve.

- - - - -
a15aa1fc by Daniel Teichmann at 2026-08-25T19:09:26+00:00
tools/create-server-cert: Switch key generation to ECDSA prime256v1 and drop keyEncipherment key usage

keyEncipherment is only meaningful for RSA keys. For ECDSA server
certificates only the digitalSignature key usage is applicable
(RFC 5480).

- - - - -
4bfee5ad by Daniel Teichmann at 2026-08-25T19:09:26+00:00
v3.cnf: Drop keyEncipherment from server cert key usage

keyEncipherment is not applicable to ECDSA keys (RFC 5480), only
digitalSignature is required for TLS server certificates.

- - - - -
3ae89a7c by Mike Gabriel at 2026-08-25T21:18:28+02:00
release as 2.13.1

Signed-off-by: Mike Gabriel <mike.gabriel at das-netzwerkteam.de>

- - - - -
c2ba0299 by Serhii Horichenko at 2026-09-04T19:26:12+02:00
share/debian-edu-config/tools/run-at-firstboot: Add an environment check to avoid starting the image creation on an LTSP-client (Closes: #1092123).

- - - - -
8b5765b6 by Serhii Horichenko at 2026-09-04T19:40:06+02:00
share/debian-edu-config/tools/run-at-firstboot: Add an ability to create a Diskless Workstation chroot and separate the creation of an image on an LTSP-server without the Main-Server role (Closes: #1092123).

- - - - -
1b3d05e6 by Mike Gabriel at 2026-09-04T21:24:53+00:00
sbin/debian-edu-ltsp-install: When creating a DLW, set PROFILE to 'Workstation' (Closes: #1092123).

- - - - -
18d340a3 by Mike Gabriel at 2026-09-04T21:26:05+00:00
share/debian-edu-config/tools/kerberos-kdc-init: Don't hard-code master_key_type, use MIT/Kerberos' default. (Closes: #1052962).

- - - - -
a3082be9 by Mike Gabriel at 2026-09-04T21:26:19+00:00
Stop using killer script in Debian Edu. (Closes: #703710).

- - - - -
b03fe98b by Mike Gabriel at 2026-09-04T21:26:55+00:00
cf3/cf.ldapclient: Ensure empty file /etc/netgroup exists. (Closes: #1146398).

- - - - -
476a3853 by Mike Gabriel at 2026-09-04T21:27:14+00:00
exim4/exim-ldap-{server,client}-v4.conf: Write logs to syslog. (Closes: #1051836).

- - - - -
a6cd1123 by Mike Gabriel at 2026-09-04T21:27:45+00:00
run-at-firstboot: Initialize first user's mailbox only when logging into Main-Server

- - - - -
bd9d8250 by Mike Gabriel at 2026-09-04T23:38:51+02:00
release as 2.13.2

Signed-off-by: Mike Gabriel <mike.gabriel at das-netzwerkteam.de>

- - - - -
b89ecda1 by Mike Gabriel at 2026-09-15T21:56:17+02:00
bin/debian-edu-ldapserver: Don't use $ldapserver uninitialised.

- - - - -
d58f0e3b by Daniel Teichmann at 2026-09-23T17:47:04+02:00
Stop appending a second nsswitch passwd/group line; drop winbind.

cf.ldapclient used to append "passwd: files ldap" and comment out an
exact "passwd: files" line. That no longer matches Debian's default
(files systemd, and often winbind from Samba). Merge ldap into the
existing passwd/group/shadow/netgroup/automount line, drop winbind,
and comment leftover duplicates. Run the same repair from postinst
so dist-upgrades fix already installed hosts.

- - - - -

32 changed files:

- Makefile
- bin/debian-edu-ldapserver
- cf3/cf.cfengine3
- cf3/cf.ldapclient
- cf3/cf.workarounds
- debian/changelog
- debian/control
- debian/debian-edu-config.lintian-overrides
- debian/debian-edu-config.maintscript
- debian/debian-edu-config.postinst
- etc/exim4/exim-ldap-client-v4.conf
- etc/exim4/exim-ldap-server-v4.conf
- etc/nagios3/debian-edu/commands.cfg
- − etc/wicd/scripts/preconnect/set_wireless_mac_from_eth0
- ldap-tools/ldap-debian-edu-install
- sbin/debian-edu-ltsp-install
- sbin/debian-edu-ltsp-ipxe
- sbin/update-hostname-from-ip
- share/debian-edu-config/d-i/pre-pkgsel
- − share/debian-edu-config/killer.cron
- share/debian-edu-config/testsuite-lib.sh
- share/debian-edu-config/tools/create-debian-edu-certs
- share/debian-edu-config/tools/create-server-cert
- + share/debian-edu-config/tools/ensure-nsswitch-ldap
- share/debian-edu-config/tools/kerberos-kdc-init
- share/debian-edu-config/tools/run-at-firstboot
- share/debian-edu-config/tools/setup-roaming
- share/debian-edu-config/v3.cnf
- + testsuite/hostname
- testsuite/ldap-client
- testsuite/ldap-server
- testsuite/network

The diff was not included because it is too large.

View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/b6263cd2cd438cbc81a2f045d51fb32df74386e1...d58f0e3bfb505c1247e03b22574ac1350b238b70

-- 
View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/b6263cd2cd438cbc81a2f045d51fb32df74386e1...d58f0e3bfb505c1247e03b22574ac1350b238b70
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-edu-commits/attachments/20260923/e8148236/attachment-0001.htm>