[03:42] Evening all [03:44] . [16:16] kabikaboo 1.7 now out! https://launchpad.net/kabikaboo [16:22] I think we might need this: [16:22] http://git.gnome.org/browse/nanny/tree/ [16:22] I'll see about packaging it. === alkisg1 is now known as alkisg [16:23] sbalneav: at some point you were thinking about packaging an easy to setup ldap template, for schools... care to pick it up? I'm willing to help as much as I can... :) [20:08] I'm trying to setup LDAP for the first time. I can succesfully do `sudo ldapaddgroup test` but I cannot get `sudo ldapadduser test test` to work, it says "ldap_add: no such object (32)". Help?! [20:09] Which package are you using? [20:09] I did: sudo apt-get -y install slapd ldap-utils ldapscripts [20:10] Ahhhh, ldapscripts :) [20:10] Ah got it! The ubuntu guide was using "People" while ldapscripts is using "Users"... [20:10] yeah [20:11] the whole problem with ldap is everything ONLY works if you've got your database laid out the exact way the scripts want. [20:11] and there's NO standard for your ou's [20:11] so some use "users" [20:11] I wonder why http://doc.ubuntu.com/ubuntu/serverguide/C/openldap-server.html doesn't mention this problem, though :( [20:11] some "Users" [20:11] some "People" [20:12] some just use uid= with no ou at all [20:12] Uhm... I think I'll just use whatever the ldapscripts use, to minimize configuration file editing :D [20:12] alkisg: silly boy! You're just supposed to KNOW this!!! [20:12] I've been using ldap for 10+ years. [20:13] next to RS232, it's the most non-standard standard I've ever seen. [20:13] Heh... I was trying to avoid using it for too long now :D [20:13] ...but maybe I need to see it to better decide what's better... [20:14] You talk to any good enterprise sysadm, you'll find they all have their own highly customized shell scripts for dealing with their specific LDAP instance. [20:14] Well, the problem with LDAP is, it's well supported. [20:15] Everything can talk to ldap, problem is, you have to CUSTOMIZE everything to get it to talk to the way YOU layed out your ldap. [20:15] Bah... we should make a package for easy ldap installation for schools! [20:15] I think I saw some packages in synaptic for caching credentials, do they work OK when the server's down? [20:15] Well, it's not hard. [20:16] skolelinux does it. [20:16] you just pick a database layout [20:16] create a package that creates that layouyt [20:16] Really?! Ah, I need to look at it for better compatibility then... they've probably thought about samba, too... [20:16] and patch ldaptools + any other ldap things to support that layout "out of the box: [20:17] it's not HARD [20:17] it's just... tedious [20:17] there's a lot of ldap tools. [20:17] or things that can talk to ldap. [20:18] It's hard to get started with ldap... it'd be much easier if there was some easy-ldap package. ogra had started a spec about this I think 3 years ago, but it was never implemented... [20:18] Then you get told "Well, you shouldn't design an ldap database layout without talking to the server team" [20:18] and you talk to the server team, and 5 guys have 8 different ways they want to do the layout. [20:18] Heh [20:18] And... here we are. [20:18] I was going to implement it. [20:18] I'm STILL willing to implement it. [20:19] Well, there are many schools out there *without sysadmins or server teams* looking for an easy way to install ldap + nfs [20:19] I'm willling to help however I can [20:19] it's EASY to implemnt. Consensus is hard. [20:19] alkisg> Well, there are many schools out there *without sysadmins or server teams* looking for an easy way to install ldap + nfs [20:19] Lets talk about it at tomorrow's meeting. [20:19] this is a correct statement [20:19] sbalneav: nice :) [20:19] * Ahmuck-Sr has been on this soapbox for a while [20:20] Ahmuck-Sr: did you get to install it? [20:20] LaserJock told me about bikeshedding. You guys know what that is? [20:20] isn't LDAP standard? [20:20] Ahmuck-Sr: Yes and no [20:20] LDAP itself is standard. [20:20] just like SQL is standard. [20:20] how you design your DATABASE for access, isn't [20:20] Heh... http://en.wiktionary.org/wiki/bikeshedding [20:20] it's up to you [20:21] right, and ldap becomes the ultimate bikeshed. [20:22] EVERYbody has an opinion as to why a databse should use ou=People instead of ou=Users [20:23] sbalneav: what tools are you using to manage users? ldapscripts? [20:23] Why you should use o=Greek Schools Division instead of dc=greek,dc=edu,dc=gk [20:23] alkisg: I have all my own custom scripts I've written, modified, and dragged with me for the last 10 years. [20:24] Heh, at least that tells me that ldap is stable :D [20:24] Oh, it's a fine system [20:24] it works well. [20:24] Is dc=school,dc=local acceptable to be used by all greek schools? :D [20:25] If so, I'm good to go... [20:28] it's just the barrier to entry is SO FRIGGING HIGH [20:28] sbalneav: are you using kerberos for password storage/policy or not yet ? [20:28] No, I don't use kerberos yet. [20:29] so I'm using pamldap for my auth [20:29] Can ldap work without nfs? [20:29] Sure [20:29] I.e. some package to create the local home dirs etc? [20:30] Sure, that's no problem. [20:30] *ALL* you need to solve this problem is to simply VOTE on a layout. And then say, "screw everybody else, this is the layout we support" [20:30] sbalneav: I deployed it on my LAN (80 or so VMs ;)) and it's freaking cool to be able to ssh to a server, then to another, then to another and never have to re-auth. Then when the ticket expires (once a day), I have to login again and that's it. [20:31] You want something other tthan this, you're on your own. [20:31] which is EXACTLY what skolellinux does [20:31] sbalneav: also I have my IMAP server, web server and proxy using kerberos, so no need to login there too :) [20:31] yeah, I just need to sit down with it for a day and actually play with it. [20:32] stgraber: do put something in the wiki about how to do all this... :) [20:32] That's why, curretnly , skolellinux is the ONLY one that actually SUPPORTS ldap [20:32] * alkisg should better copy skolelinux's layout, then... [20:33] I've actually looked at skolelinux's ldap packages [20:33] it's just a presees. [20:33] it's just a preseed [20:33] My thought was: just steal their stuff :) [20:33] do what they do [20:34] then edubuntu can auth against skolelinux auth servers, or vice versa [20:36] Right. That's what I'd like to have in edubuntu, prepackaged solutions... [20:56] alkisg: I'm not yet finished with looking at kerberos, I have the basics working but I need to connect it better with my LDAP [20:57] It'd be nice to have such solutions in edubuntu, working out of the box...