[12:04] should just be eth0 in the guest [12:04] it'll act like an additional box on my network? [12:04] yes [12:05] hrm.. [12:05] it won't even ping itself.. [12:06] (network-script 'network-bridge netdev=eth1') [12:06] ignore the netdev=eth1 bit [12:06] but you should have something like that on the dom0 [12:06] I do === ajmitch just wanted to make sure it bridged with the wired interface on the laptop, not the wireless [12:07] though, here's the issue I had... [12:07] my main interface is ra0 [12:07] so I did (network-script 'network-bridge netdev=ra0') [12:07] but then networking wouldn't work on dom0 === ajmitch has had all sorts of fun with bridging.. [12:10] should I be using eth0 in dom0? [12:11] dom0/eth0 -> xenbr0 -> ra0 -> network ? [12:11] and domU/eth0 -> xenbr0 -> ra0 -> network [12:11] is that how it works [12:13] no, the bridging is from domU to dom0 [12:13] so only domU/eth0 -> xenbr0 -> ra0 -> network [12:13] hmm.. [12:13] ra0 only exists in dom0 [12:14] so the question is, why does ra0 break in dom0 when I use network-bridge netdev=ra0 === ajmitch shrugs :) [12:15] cuz I should be using eth0 in dom0.. [12:15] I think [12:18] why? [12:18] do you even have an eth0 in dom0? [12:19] yeah [12:19] ugh.. this is confusing.. [12:19] just use the interface that's normally connected & it ought to work :) [12:19] no.. [12:19] why it suddenly stops in dom0 is beyond me [12:19] when I use network-bridge netdev=ra0 [12:19] ra0 says "no wireless extensions" [12:19] hm right [12:19] though it creates pra0, which has wireless extensions [12:20] though this could be why I switched to eth1 (the wired interface) [12:20] since the ipw2200 was playing funny tricks [12:20] but this was also when i was testing 2.6.16 & the firmware was broken :) [12:20] but I tried using pra0 and it didn't work either [12:20] I haven't set it to use wireless since then [12:21] I don't really have a choice [12:21] has to use wireless :| [12:21] laptop sits on top of my tower case usually [12:21] this is a desktop ;) [12:21] fun [12:21] hrm.. [12:21] I could hardly put my main box on my desk :) [12:22] haha [12:22] okay, its a tower :P [12:22] not a laptop [12:22] but.. [12:22] paste warning [12:23] nm [12:23] in /etc/xen/xend-config.sxp, there's a little diagram... [12:23] dom0: fake eth0 -> vif0.0 -> bridge -> real eth0 -> network [12:23] domU: fake eth0 -> vifN.0 -> bridge -> real eth0 -> network [12:24] so if I use netdev=ra0, it becomes "real ra0 -> network" [12:24] but would the fake ones remain eth0, or become ra0? [12:26] hm === ajmitch doesn't know, hasn't checked it [12:26] and also... [12:26] is fake eth0 called 'eth0' or peth0? :P [12:27] see reponse above [12:27] hrm [12:50] wasabi_: rh uses a joined /etc/ldap.conf [12:50] How do they deal with maintainer scripts, or do they not? [12:50] no idea [12:50] looking at my FC4 machines [12:50] It might be fine to not deal with it, and move ldap.conf configuration completely into authtooll [12:50] And remove conffile from the files. [12:51] Get rid of the debconf questions on libnss-ldap, etc [12:54] yep [12:54] I think that works [12:54] whiprush: what does SLED 10 have? [12:55] but FC doesn't have our common-* stuff [12:55] at least 4 doesn't [12:57] also, fedora bundles pam_ldap.so in with nss_ldap [01:00] Burgwork:How do you plan to supply the functions smbldap-tools provides? [01:02] What functions are those? [01:02] those from smb.conf...adding machines passwrord changes [01:03] winbind. [01:03] In the case of AD. [01:04] i guess i need to read the spec..ive been working on perl stuff to replace the functions smbldap-passwd smbldap-useradd etc do [01:04] how does ccreds interact with nssdb? [01:04] It doesn't. [01:04] It's completely seperate. [01:04] right [01:05] You reading my novel? [01:05] 'cause db doesn't appear to cache auth stuff [01:05] no [01:05] It does not. [01:05] so I need both? [01:05] NSS does not involve auth. [01:05] why does ad come up? [01:05] Yes. [01:05] NSS involves only passwd/group entries. [01:05] in This situation [01:05] pam is hte "is your password correct?" pipeline. [01:05] right [01:05] Kerberos users have no entry in shadow. [01:05] No hashed password, etc. [01:06] auth sufficient pam_ldap.so <-- replace with pam_ccreds.so ? [01:06] pam_ldap shouldn't be used. [01:06] right [01:06] Oh, this is at your office? [01:06] yes [01:06] Ahh. You have no kerberos. [01:06] https://wiki.ubuntu.com/NetworkAuthentication/ScratchPad/Client#preview [01:06] Jump to my sample pam file. [01:06] And my long explanation of it's purpose. [01:07] and I discovered the pain when my ldap server decided to start using a dhcp addy [01:07] Hah. [01:07] still haven't figured why [01:08] given I have hacked /etc/network/interfaces to list it as static [01:10] wasabi_: your novel can assume more knowledge on the part of the read [01:10] ie: don't tell use what pam is, etc. [01:10] I don't want it to. [01:10] Also it's only one sentence. [01:11] I assume those assumptions are inherent throughout the text [01:11] You'd be suprised how many people don't actually understand PAM and NSS. [01:11] Again, I want this to be blogged about, and get people talking/interested. [01:12] okay, spec time [01:12] that is way too long to a be blog post [01:12] It won't be IN a blog post. [01:12] still too long [01:12] Linked from, sure. [01:12] look, you need to catch peoples attention [01:12] novels don't do it [01:12] Actually, specifically, I need to sell it to mark. [01:13] So he'll pay for it. [01:13] that is not going to catch his eye either [01:13] remember, mark has add [01:13] ADD, raterh [01:13] Haha [01:13] I have ADD. It worked for me. [01:13] yours is probably treated [01:13] Marks is not [01:13] Mine isn't. =) [01:14] I don't get anything done if I do. =( [01:14] ok, if you must keep the fracking novel [01:14] at least point the point form stuff at the top [01:14] the todos, etc. [01:14] would you guys mind a short discussion about directory services in general? [01:14] Sure. [01:14] then put everything else in a discussion section [01:14] I suspect you should read my novel though. ;) [01:14] I sifted through it ;) [01:14] it looks interesting, in a text book way [01:14] I need facts and short bits, not learning [01:15] lophyte: shoot [01:15] I just basically wanted to do a braindump of my own and see how it matches up with other people's visions [01:15] The NSCD daemon will run as root. <-- lets figure out a way around this, if possible [01:15] There is no way around it. [01:15] ok [01:15] Except to one run copy for every user. [01:15] question about your pam block [01:15] Including root. [01:16] Each with massively duplicated information. [01:16] And redundant LDAP queries. [01:16] if I don't run kerberos, can I just nuke that line? [01:16] Replace the line with pam_ldap [01:16] In some intelligent way. [01:16] UDS (ubuntu directory services, not developer summit) should, imo, be a group of packages that can either work standalone or together.. [01:16] wasabi_: ok [01:16] USUS for example.. can be run on its own, but works better with other packages, ie the GPO-like configuration system [01:17] so you've got network auth, update services, config deployment... all things that can be run standalone or together as one big system [01:18] unlike AD which is one big bloated package that you take all or none [01:18] yep [01:18] Not really, but okay. ;) [01:18] WSUS is not tied to AD. [01:18] The only real tie is that you're forced to use both their LDAP and their KDC. [01:18] well, no.. but you can't have SSO services without GPO services [01:18] wsus not tied to AD is a mistake on MS's part [01:19] lophyte: Well, you don't have to USE GPO. [01:19] no, but its still there [01:19] For instance, I use other software to deploy software. [01:19] wpkg.sf.net [01:20] is there any work being done on a GPO-like system? === wasabi_ shrugs. [01:20] https://wiki.ubuntu.com/NetworkAuthentication/Client Moved my novel. [01:21] another question.. is UDS going to be tied to specific packages, or is it going to be versatile and flexible? [01:21] ie. you don't /have/ to use openldap and krb5-kdc [01:21] Depends what you mean by that. [01:21] wasabi_: can you forward that on to federico [01:21] addy? [01:21] lophyte: we are going to pick a best of breed ldap server [01:21] ask whiprush [01:22] ubuntu is about making decisions [01:22] indeed [01:22] I suspuect UDS will be nothing but some automated utilities to install a server, configure it, and setup some schema. [01:22] No reason you can't setup your own server instead of using that. [01:22] That's sort of why we'll work with AD. [01:23] but under the umbrella of 'UDS' includes our own centralized config deployment system [01:23] and network auth [01:23] and perhaps other packages [01:24] Sure... but again, the client component is just Ubuntu configured to talk LDAP/Kerberos. [01:24] NO reason you have to use our server component for that. [01:24] right.. so you don't have to use the config system if you don't want to [01:25] no [01:25] I don't think there's anyway we could force you to do so. [01:25] but we are going to provide the complete stack, client and server [01:25] for the server side, we are going to choose technologies and go with them [01:25] at a bare minimum, UDS is simply Ubuntu configured to talk LDAP/Kerberos on the client side, and LDAP/KDC on the server side [01:26] the client is fairly generic [01:26] the server is going to be much more specific [01:26] I wouldn't even consider UDS a product name. [01:26] but you can install fancy extras on top of that.. ie. config system, usus, etc. [01:26] Really. [01:26] we are going to say OpenLDAP or FDS [01:27] FDS? [01:27] fedora directory server [01:28] why fedora? [01:28] because FDS is better than most out there [01:28] OpenLDAP vs FDS is debatable right now [01:28] and the world doesn't need another ds [01:29] so what are we doing then? [01:29] need to evaluate both of them and decide === Fujitsu [n=Fujitsu@ubuntu/member/fujitsu] has joined #ubuntu-directory [01:29] if the world doesn't need another ds.. are we just making ubuntu work with existing DS systems? [01:30] Yes. [01:30] A DS is just a database though. [01:30] yes, but we also don't need to go out and fork an existing DS [01:30] Something has to install it, configure it, and set it up with proper information for clients to use it. [01:30] ah, alright [01:30] I suspect we'd like to reduce that down to a single wizard on a server. [01:31] so if we choose FDS, how would we migrate that into ubuntu? [01:31] there is a spec for that [01:31] ah. [01:31] Somebody needs to package it. [01:32] alright.. [01:32] I'm just more or less catching up to what's going on :P [01:32] and figuring out what our goals are [01:32] Doesn't it depend on pretty much everything on the planet? [01:33] Fujitsu: less everyday [01:33] Burgwork: Good! [01:33] they are splitting out the web frontend, which requires non-free java, in the next release [01:34] is FDS free? [01:34] yes [01:34] all RH stuff is open source [01:34] everything [01:35] Did you give me federico's email? [01:35] whiprush has it [01:35] just a sec, let me see if have it [01:36] oh yeah i remember now [01:36] federico@novell.com [01:36] This one: [01:36] http://primates.ximian.com/~federico/news.html [01:36] k [01:38] Burgwork: you didn't get a tracking # for that package did you? [01:38] yep, but it is at home [01:38] ah [01:38] should check it [01:38] my mom said she hasn't gotten anything by courier [01:43] it came by regular post [01:44] how big is it? [01:44] I wonder if the mailman stuffed it in the mailbox [01:50] envelope [01:50] ah [01:50] probably in the mailbox [01:50] brb I'll check [01:53] right, I'm back [01:54] wasabi_: yes, I started packaging FDS, nothing new there [01:56] so of the todo list you have there, I've got stuff for the last 2. [02:01] Burgwork: got it, thanks [02:01] perfect [02:01] I'll hand them out tomorrow and pass some on to djp [02:03] 1 down, 3 to go [02:06] wasabi_: just got bitten by https://launchpad.net/distros/ubuntu/+source/pam/+bug/67276 [02:08] Burgwork: is there a list of goals for the directory team somewhere? [02:09] our specs [02:13] ah, good point [02:19] what is the FC equiv of /var/log/auth.log ? === ajmitch rages at ugly php code [02:23] ajmitch: That's what PHP is for! [02:24] Being ugly, and raged at. [02:31] Burgwork: alright, I'm gonna start merging our braindump with /UpdateServer [02:31] perfect [02:31] also, re: -ca approval.. I'm gonna put us on the CC agenda, is there anything else we need? [02:31] we need the approval form [02:31] did you see that? [02:31] I glanced at it briefly [02:32] please fill that out [02:32] I am fighting with FC4 [02:32] Burgwork: Yeah. So... You see why we need C coders. ;) [02:32] ajmitch: got a stumper of a question of you [02:32] userdel claims that I am logged in [02:33] but I am, have no open files and have no running processes [02:33] what else should I check? [02:33] w [02:33] ? [02:33] w [02:33] type it [02:34] nope, doesn't list me [02:34] ok === ajmitch wonders what userdel is using then [02:34] no idea [02:35] It's Fedora, does it need a reason to do crazy stuff? [02:36] no [02:36] I am currently on dapper [02:36] oohhh burrrrn. [02:36] my boss wants a "homogenous" environment with our main office [02:36] Ah, you said `I am fighting with FC4' :P [02:36] 1 Ubuntu machine, 2 FC [02:36] I've never had userdel do that sort of thing to me. [02:37] wasabi_: how are you working around the ccreds brokenness? [02:42] auth_err=reset [02:42] Which is incorrect functionally, but works for now. [02:42] It's returning auth_err. [02:44] what should it return? [02:47] right, o [02:47] ok === Burgwork grumbles further at FC4 [02:49] getent passwd corey --> uid 10000 [02:49] chown corey:corey --> uid of home dir? 0 [02:52] ? [02:52] hmm, ok [02:52] that worked [02:53] That's another interesting point... probably a place where i'd be willing to take a stand against everybody else. [02:53] libnss-ldap should not make groups for users. [02:53] you mean, it shouldn't do the Ubuntu default? [02:53] Nope. It shouldn't. [02:53] a corey group along with the corey user? [02:53] why not? [02:54] Because it serves no real purpose, and muddles the issue tremendously... the LDAP server would have to have groups for each user. [02:54] And make sure there were no conflicting gids, etc. [02:54] are we talking ldap groups or local groups? [02:54] Neither really. [02:55] I make my LDAP members primary group 65535, nogroup. [02:55] we shouldn't diverge from ubuntu [02:55] I don't see a benefit to diverging, so why do it? [02:55] Because we have no way to not diverge. [02:55] Unless you're going to mandate AD make a group for every user. [02:55] oh? [02:56] is that a bad thing? [02:56] we shouldn't shoehorn Ubuntu into Windows [02:56] Hmm. I'd say so. [02:56] that's a lot of unnecessary groups [02:56] No, certainly not, but we should carefully examine the reasons MS doesn't make a group for every user. [02:56] ANd I assert that reason is because nobody suggested it, because they had no problem to solve. [02:56] Because it solves no problem. =) [02:57] the groups one? [02:57] Yes. [02:57] what about standalone machines? [02:57] I believe the old-schoolr eason for doing it is because POSIX permissions are limiting. [02:57] And you can only have one owner. [02:57] I find them quite elegant, actually [02:57] So, in the case you want to share your folder with one other perosn, you setgroup it to him. [02:58] Posix ACLs don't make that a problem anymore. [02:58] which is why windows never really needed a group per user [02:58] Yup. THey were never working around a Posix permission set. [02:58] They started with ACLs [02:59] Anyways, so the options are thus: Either we leave it up to the admin to make a AD group for every user (not likely to happen) [02:59] We mandate they do, no way to enforce it. [02:59] We auto generate matching "fake groups" in libnss-ldap [02:59] (horribly hacky, might make conflicting gids) [02:59] Or we fix the problem that made us need a per-user group in the first place. [02:59] Which is probably a better long term goal. [03:00] then write a spec for that [03:00] local users can still have their own group, it hurts nothing. [03:00] and get it on the MTV === Fujitsu likes that last solution, there's a lot of clutter otherwise... [03:00] wasabi: so do you want to spec up ACLs enabled throughout ubuntu? [03:00] Hmm. I don't think it's required at first. [03:00] ajmitch: There's already a spec on that... [03:00] And I think somebody else will do that. ;) [03:00] Yeah. [03:00] Fujitsu: sure, but when might that get done? [03:01] there's a spec for nearly everything [03:01] NOt having a per user group doesn't break anything. [03:01] doesn't mean it's useful :) [03:01] It just makes it slightly more difficult to give a single user access to one of your files. [03:01] ajmitch: True, but it's not difficult to implement... [03:01] other linux distros have managed fine without group-per-user [03:01] I think it's an option in debian [03:01] I don't mind per-user groups for local stuff. It hurts nothing. [03:01] Let it continue. [03:02] My first user I create in Ubuntu is "admin".. and that creates an "admin" group. [03:02] And that group has sudo access. [03:02] then let's break from that for remote users [03:02] So I add remote users to the local admin group, to give other users sudo access. [03:02] adduser jhaltom@DOM admin [03:02] And that's worked wonderfully. [03:03] Since all users require a primary gid, I've been using 65534 I believe, for nogroup. [03:03] Which has no permissions. [03:03] Other groups are secondary. [03:04] hey guys, where can I find a decent ldap+kerb howto? [03:04] Don't think there is one. [03:04] yeah 65534 is default for nogroup it seems [03:04] hah [03:04] you're telling me ;) [03:04] bayour had a good one. [03:04] decent? [03:04] but it's been aging. [03:04] okay, half-decent. [03:04] there are 1001 useful ones [03:04] none decent [03:05] Burgwork: what's the news about UDS? [03:05] uds? [03:05] MTV I mean [03:05] need to look into my finances [03:05] I don't know if I'm comfortable with you sending me :P [03:06] we'll help relieve you of your finances, that's fine [03:06] that's quite a bit of buck [03:06] ajmitch: heh === ajmitch looks into his bank account & cringes === lophyte does the same [03:06] mine is pretty bad too [03:06] hopefully I get paid again before I get to the US [03:06] just slightly less worse [03:06]