"Debian Edu / Skolelinux Lenny 5.0.4+edu1 Manual"


Table of Contents
1. Manual for Debian Edu 5.0.4+edu1 Codename "Lenny"
2. À propos de Debian Edu et Skolelinux
3. Architecture
3.1. Réseau
3.1.1. Main server (tjener)
3.1.2. Services exécutés sur le serveur principal
3.1.3. LTSP server(s) (Thin client server(s))
3.1.4. Clients légers
3.1.5. Stations de travail sans disque dur
3.1.6. Clients en réseau
3.2. Administration
3.3. Installation
3.4. Configuration de l'accès au système de fichiers
3.5. Notes diverses
4. Fonctionnalités
4.1. New features in the Debian Edu 5.0.4+edu0 Codename "Lenny" released 2010-02-08
4.2. New features in Debian 5.0.4 upon which Debian Edu 5.0.4+edu0 is based
4.3. Nouvelles fonctionnalités de la version « 3.0r1 Terra », publiée le 2007-12-05
4.4. Nouvelles fonctionnalités de la version « 3.0r0 Terra », publiée le 2007-07-22
4.5. Fonctionnalités de la version 2.0, publiée le 2006-03-14
4.6. Fonctionnalités de « 1.0 Venus », publiée le 20-06-2004
4.7. Davantage d'informations sur les versions précédentes
5. Besoins
5.1. Besoins matériels
5.2. Matériel compatible connu
6. Besoins pour une configuration du réseau
6.1. Default Setup
6.2. Routeur internet
7. Installation
7.1. Where to find additional information
7.2. Download the installation media for Debian Edu 5.0.4+edu0 Codename "Lenny"
7.2.1. DVDs pour i386, amd64 et powerpc
7.3. Demande d'un CD/DVD par courrier électronique
7.4. Installing Debian Edu
7.4.1. The installation process
7.4.2. Note concernant le partitionnement manuel
7.4.3. Note concernant les ordinateurs portables
7.4.4. Note concernant l'installation depuis un DVD
7.4.5. A note on CD installs
7.4.6. A note on some RAID controllers
7.4.7. A note on thin-client-server installations
7.4.8. CD/DVD personnalisés
7.4.9. Installation over the network (PXE) and booting diskless clients
7.5. Screenshot tour
8. Démarrage rapide
8.1. Minimum steps to get started
9. Services exécutés sur le serveur principal
9.1. Gestion par une interface web, à l'aide de lwat
9.2. Gestion des utilisateurs avec lwat
9.2.1. Ajouter des utilisateurs
9.2.2. Search and delete users
9.2.3. Set passwords
9.2.4. Advanced user management
9.3. Administration des groupes avec lwat
9.4. Group Management on the command line
9.4.1. Advanced group management
9.5. Gestion de machines avec lwat
9.5.1. Rechercher et supprimer des machines
9.5.2. Modification de machines existantes / gestion des groupes réseau
9.5.3. Davantage de documentation sur lwat
9.6. Gestion des imprimantes
9.7. Synchronisation de l'horloge
9.8. Extending full partitions
10. Maintenance
10.1. Mis-à-jour du logiciel
10.1.1. Keep yourself informed about security updates
10.2. Gestion des sauvegardes
10.3. Surveillance des serveurs
10.3.1. Munin
10.3.2. Nagios
10.3.3. Sitesummary
10.4. More information about Debian Edu customisations
11. Mises à jour
11.1. General notes on upgrading
12. Upgrades from Debian Edu etch
12.1. The basic upgrade operation
12.2. LDAP service needs to repaired
12.3. DHCP service needs to repaired
12.4. User logins from Windows machines needs to repaired
12.5. DNS service needs to repaired
12.5.1. Bind
12.5.2. powerdns
12.6. Nagios setup has changed
12.7. Recreating an LTSP chroot
13. Upgrades from older Debian Edu / Skolelinux installations (before etch)
14. Manuels (HowTo)
15. Manuels d'administration générale
15.1. Configuration history: tracking /etc/ using the svk version control system
15.1.1. Exemple pratiques
15.1.2. For those who upgraded from Etch
15.2. Resizing Partitions
15.2.1. Gestion d'un volume logique
15.3. Using ldapvi
15.4. Utilisation de volatile.debian.org
15.4.1. Qu'est-ce que debian-volatile ?
15.4.2. Comment utiliser « volatile »
15.5. Using backports.org to install newer software
15.6. Java
15.6.1. running standalone Java applications
15.6.2. running Java applications in the webbrowser
15.7. Creating folders in the home directories of all users
15.8. Easy access to USB drives and CDROMs/DVDs
15.8.1. A warning about removable media on LTSP servers
15.9. Automatic cleanup of left-over processes
15.10. Automatic shutdown of machines during the night
15.10.1. How to set up shutdown-at-night
15.11. Access to skolelinux server from outside a firewall
15.12. Installer des machines exécutant un seul service pour décharger le serveur principal
15.13. Configuring the PXE menu
15.13.1. Configuring the PXE installation
15.14. Manuels de wiki.debian.org
16. Manuels pour le bureau
16.1. KDE Kiosk mode
16.2. Changing kioskmode on diskless workstations
16.2.1. Désactiver le mode kiosque de KDE
16.3. Modification de l'écran de connexion de kdm
16.4. Flash
16.4.1. Sound with Flash on thin clients
16.5. Lire des DVD
16.6. Utilisation du dépôt multimedia
16.7. Handwriting fonts
17. HowTos for networked clients
17.1. Introduction to Thin clients and Diskless workstations
17.1.1. Machine type selection based on the network
17.1.2. Changing the PXE menu on an LTSP server
17.1.3. Separate main- and LTSP servers
17.1.4. How to extend the range of static IP addresses
17.2. LTSP en détail
17.2.1. lts.conf
17.2.2. Load balancing LTSP servers
17.2.3. Sound with LTSP clients
17.2.4. Upgrading the LTSP environment
17.2.5. Slow login and security
17.3. Replacing LDM with KDM
17.4. Connexion de machines Windows au réseau / intégration de Windows
17.4.1. Rejoindre le domaine
17.4.2. XP home
17.4.3. Gérer les profils itinérants
17.4.4. Redirection de parties du profil
17.4.5. Éviter les profils itinérants
17.5. Bureaux distants avec RDP, VNC, NX ou Citrix
17.6. Manuels de wiki.debian.org
18. Manuels pour enseigner et apprendre
18.1. Moodle
18.2. Surveillance des élèves
18.3. Restreindre l'accès des élèves au réseau
18.4. Installing swi-prolog
18.5. Manuels de wiki.debian.org
19. HowTos for users
19.1. Changing passwords
19.2. Changing the sound volume
19.3. Using email
19.3.1. Configuring KMail as a mail client
20. Contribuer
20.1. Faites-vous connaître auprès de nous.
20.2. Contribuer localement
20.3. Contribuer globalement
20.4. Auteurs de la documentation et traducteurs
21. Support
21.1. Support fourni par des bénévoles
21.1.1. en anglais
21.1.2. en norvégien
21.1.3. en allemand
21.1.4. en français
21.1.5. en espagnol
21.2. Support professionnel
22. Droits de reproduction et auteurs
23. Droits de reproduction et auteurs des traductions
24. Traductions de ce document
24.1. Comment traduire ce document
25. Annexe A - La Licence Publique GNU
25.1. Manual for Debian Edu 5.0r0+edu0 Codename "Lenny"
25.2. GNU GENERAL PUBLIC LICENSE
25.3. TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
25.4. END OF TERMS AND CONDITIONS
26. Annexe B - À propos du live CD/DVD Debian Edu
26.1. Fonctionnalités de l'image autonome
26.2. Activation des traductions et du support géographique
26.3. Choses à savoir
26.4. Problèmes connus avec l'image
26.5. Téléchargement

1. Manual for Debian Edu 5.0.4+edu1 Codename "Lenny"

This is the (still incomplete) manual for the Debian Edu Lenny 5.0.4+edu1 release.

This document was put into the debian-edu-doc package on 2010-05-16.

The version at http://wiki.debian.org/DebianEdu/Documentation/Lenny is a wiki and updated frequently.

Translations are part of the debian-edu-doc package, which can be installed on a webserver.


2. À propos de Debian Edu et Skolelinux

Skolelinux is a Linux distribution made by the Debian Edu project. As a Debian Pure Blends distribution it is a official Debian subproject.

What this means for your school is that Skolelinux is a version of Debian providing an out-of-the box environment of a completely configured school-network.

In Norway, where Skolelinux was started, the main target group initially were schools serving the 6-16 years age bracket. Today the system is in use in several countries around the world, with most installations in Norway, Spain, Germany and France.


3. Architecture

Cette section décrit l'architecture du réseau et les services fournis par Skolelinux.


3.1. Réseau

(Le paquet source debian-edu-doc contient cette image sous forme de fichier dia.)

Le diagramme est un schéma de la topologie supposée du réseau. La configuration par défaut d'un réseau Skolelinux suppose qu'il y a un (et un seul) serveur principal et permet l'accueil à la fois de stations de travail normales et de serveurs de clients légers (avec les clients légers associés). Le nombre de stations de travail peut être aussi grand ou petit que vous le souhaitez (d'aucune à beaucoup). De même pour les serveurs de clients légers, chacun étant sur un réseau distinct de sorte que le traffic entre les clients légers et leur serveur n'affecte pas le reste des services du réseau.

La raison pour laquelle il ne peut y avoir qu'un seul serveur principal dans un réseau d'école est que celui-ci fournit DHCP, et il ne peut y avoir qu'une seule machine fournissant ce service sur chaque réseau. Il est possible de déplacer un service depuis le serveur principal vers une autre machine en le configurant sur cette dernière puis en mettant à jour la configuration DNS, en faisant pointer l'alias DNS pour ce service vers l'ordinateur concerné.

Afin de simplifier les réglages de base de Skolelinux, la connexion à l'internet s'effectue via un routeur séparé. Il est possible de configurer Debian avec à la fois un modem et une connexion RNIS, cependant il n'est pas prévu de faire fonctionner ce type de configuration directement dans Skolelinux (les modifications nécessaires à la configuration par défaut devraient être documentées séparement).


3.1.1. Main server (tjener)

A Skolelinux network needs one main server (also called "tjener" which is Norwegian and means "server") which per default has the IP address 10.0.2.2 and is installed by selecting the main server profile. It's possible (but not requiered) to also select and install the thin-client-server and workstation profiles in addition to the main server profile.


3.1.2. Services exécutés sur le serveur principal

À l'exception du contrôle des clients légers, tous les services sont initialement configurés sur un ordinateur central (le serveur principal). Pour des raisons de performances, le serveur de clients légers devrait être une machine séparée (bien qu'il soit possible d'installer à la fois les profils de serveur principal et de serveur de clients légers sur la même machine). Tous les services se voient attribuer un nom DNS et ne sont disponibles que sur IPv4. Le nom DNS attribué permet de déplacer facilement chaque service du serveur central vers une autre machine, simplement en l'arrêtant sur le serveur principal et en changeant la configuration DNS de sorte que l'alias pointe vers la nouvelle machine (sur laquelle il aura été préalablement installé, bien entendu).

Pour des raisons de sécurité, toutes les connexions véhiculant des mots de passe sur le réseau sont chiffrées, de sorte qu'aucun n'apparaît en clair sur le réseau.

Below is a list of the services that are set up by default in a Skolelinux network, with the DNS name of each service given in square brackets. If possible all configuration files will refer to the service by name (without the domain name) thus making it easy for schools to change either their domain (if they have an own DNS domain) or the IP addresses they use.

  • Gestion centalisée des journaux [syslog]

  • DNS (PowerDNS) [domain]

  • Configuration réseau automatique des machines (DHCP) [bootps]

  • Synchronisation de l'horloge (NTP) [ntp]

  • Répertoires personnels via un système de fichiers sur réseau (SMB/NFS) [homes]

  • Courrier électronique [postoffice]

  • Service de répertoire (OpenLDAP) [ldap]

  • Gestion des utilisateurs [lwat]

  • Serveur web (Apache/PHP) [www]

  • Sauvegarde centralisée (sl-backup, slbackup-php) [backup]

  • Cache web / mandataire (Squid) [webcache]

  • Impression (CUPS) [ipp]

  • Connexion à distance (OpenSSH) [ssh]

  • Configuration automatique [cfengine]

  • Serveur(s) de clients légers (LTSP) [ltspserver\#]

  • Surveillance des machines et des services, avec rapport d'erreur, ainsi qu'état et historique sur le web. Rapport d'erreur par courrier électronique (munin, nagios, et site-summary)

Chaque utilisateur enregistre ses fichiers personnels dans son répertoire personnel, disponible sur le serveur. Les répertoires personnels sont accessibles depuis toutes les machines, donnant accès aux mêmes fichiers, quelle que soit la machine qu'ils utilisent. Le serveur ignore le système d'exploitation en permettant l'accès grâce à NFS pour les clients Unix et SMB pour les clients Windows et Macintosh.

By default e-mail is set up for local delivery (i.e. within the school) only, though e-mail delivery to the wider Internet may be set up if the school has a fixed Internet-connection. Mailing lists are set up based on the user database, giving each class their own mailing list. Clients are set up to deliver mail to the server (using 'smarthost'), and users can access their personal mail through either POP3 or IMAP.

Tous les services sont accessibles avec les mêmes nom d'utilisateur et mot de passe, grâce à la base de données d'utilisateurs centralisée gérant l'authentification et les autorisations.

Pour des raisons de performance sur des sites contactés fréquemment, un mandataire (Squid) met en cache local les fichiers correspondants. Associé au blocage du traffic web par le routeur, ceci permet aussi le contrôle de l'accès à l'internet sur chaque machine.

La configuration du réseau sur les clients est effectuée automatiquement à l'aide de DHCP. Les clients normaux reçoivent une adresse IP appartenant au sous-réseau privé 10.0.2.0/23, tandis que les clients légers sont connectés à leur serveur de client léger sur le sous-réseau 192.168.0.0/24 (ceci assure que le trafic réseau des clients légers n'interfère pas avec le reste des services du réseau).

Le système de journal centralisé est configuré de sorte que toutes les machines envoient leur journal système (syslog) au serveur. Seuls les messages provenant du réseau local sont acceptés.

Par défaut, le serveur DNS est configuré avec un domaine réservé à l'usage interne (*.intern), jusqu'à ce qu'un vrai domaine DNS (« externe ») puisse être configuré. Le serveur DNS est configuré en serveur DNS cache de sorte que toutes les machines du réseau puissent l'utiliser comme serveur DNS principal.

Les élèves et les enseignants ont la possibilité de publier des sites web. Le serveur web fournit les mécanismes d'authentification des utilisateurs et de limitation de l'accès aux pages individuelles et sous-répertoires à certains utilisateurs ou groupes. Les utilisateurs auront la possibilité de créer des pages web dynamiques, puisque le serveur web sera programmable.

Les informations concernant les utilisateurs et les machines peuvent être modifiées de manière centralisée et sont rendues accessibles automatiquement à tous les ordinateurs du réseau. Pour cela, un serveur de répertoire centralisé est mis en place. Le répertoire détiendra des informations sur les utilisateurs, les groupes, les machines et les groupes de machines. Afin de ne pas troubler les utilisateurs, il ne sera pas fait de distinction entre les groupes de fichiers, les listes de diffusion et les groupes réseau. Ceci implique que les groupes de machines qui devront constituer des groupes réseau aient le même espace de nommage que les groupes d'utilisateurs et les listes de diffusion.

L'administration des services et des utilisateurs se fera essentiellement par le web et respectera les standards établis, fonctionnant correctement avec les navigateurs web fournis dans Skolelinux. La délégation de certaines tâches à des utilisateurs individuels ou des groupes d'utilisateurs sera possible par les systèmes d'administration.

Afin d'éviter certains problèmes avec NFS ou de simplifier la résolution de problèmes, l'heure des différentes machines doit être synchronisée. Pour cela, le serveur Skolelinux est configuré en serveur local NTP (Network Time Protocol) et toutes les stations de travail ainsi que tous les clients sont configurés pour synchroniser leur horloge avec celle du serveur. Le serveur lui-même devrait synchroniser son horloge par NTP à partir de machines sur l'internet, assurant ainsi une heure correcte sur tout le réseau.

Les imprimantes sont connectées où cela est le plus pratique, soit directement au réseau, soit à un serveur, une station de travail ou un serveur de clients légers. L'accès aux imprimantes peut être contrôlé pour les utilisateurs en fonction des groupes auxquels ils appartiennent, ceci par l'utilisation de quota et de contrôle d'accès aux imprimantes.


3.1.3. LTSP server(s) (Thin client server(s))

A Skolelinux network can have many LTSP servers (also called thin client servers), which are installed by selecting the LTSP server profile.

The thin client servers are set up to receive syslog from the thin clients, and forward these messages to the central syslog recipient.


3.1.4. Clients légers

La configuration en client léger permet à un PC ordinaire de fonctionner en terminal (ou terminal X). Ceci signifie que cette machine s'amorce depuis une disquette ou directement depuis le serveur à l'aide d'une PROM réseau (ou PXE) sans utiliser le disque dur local du client. La configuration de client léger utilisée est celle du projet Linux Terminal Server (LTSP).

Thin clients are a good way to make use of older, weaker machines as they effectively run all programs on the LTSP-Server. This works as follows: The service uses DHCP and TFTP to connect to the network and boot from the network. Next, the file system is mounted via NFS from the LTSP-server, and finally X11 is started. The display manager (LDM) connects to the LTSP-Server via SSH with X-forwarding. That way all data is encrypted on the network. For very old thin clients which are to slow for the encryption this can be set to the behaviour from former versions: use direct X connection via XDMCP.


3.1.5. Stations de travail sans disque dur

For diskless workstations the terms "stateless workstations", "lowfat clients" or "half-thick clients" are also used. For the sake of clarity this manual sticks to the term "diskless workstations".

Une station sans disque exécute tous les logiciels sur le PC sans système d'exploitation installé en local. Ceci signifie que les machines clientes s'amorcent directement depuis le disque dur d'un serveur sans exécuter de logiciel installés sur le disque dur local.

Les stations de travail sans disque dur sont une excellente façon de ré-utiliser du matériel récent avec la même coût réduit de maintenance que les clients légers. Le logiciel est administré et maintenu sur le serveur sans besoin d'installer des logiciels localement sur le client. Les répertoires personnels et les réglages du système sont eux aussi enregistrés sur le serveur.

Les stations de travail sans disque sont apparues dans la version 5.0 du projet Linux Terminal Server (LTSP).


3.1.6. Clients en réseau

Le terme « clients en réseau » fait référence dans ce manuel à la fois aux clients légers et aux stations de travail sans disque, ainsi qu'aux ordinateurs exécutant MacOS ou Windows.


3.2. Administration

Toutes les machines Linux installées au moyen d'un CD ou DVD Skolelinux seront administrables depuis un ordinateur central, très probablement le serveur. Il sera possible de se connecter à toutes les machines par SSH et par la suite d'avoir un accès complet à celles-ci.

Nous utilisons cfengine pour éditer les fichiers de configuration. Ces fichiers sont mis à jour sur les clients depuis le serveur central. Pour changer la configuration d'un client, il suffit d'éditer la configuration sur le serveur et de laisser les changements se propager automatiquement.

Toutes les informations sur les utilisateurs sont conservées dans un répertoire LDAP. Les comptes des utilisateurs sont mis à jour à partir de cette base de données, qui est utilisée par les clients pour authentifier les utilisateurs.


3.3. Installation

L'installation est possible depuis un CD ou un DVD.

L'objectif est de pouvoir installer un serveur à partir d'un CD ou DVD, et d'installer des postes clients au travers du réseau en amorçant toutes les autres machines à partir de ce dernier. L'installation à partir du DVD fonctionne sans accès à l'internet.

L'installation ne devrait pas poser de questions, excepté la langue (par ex. Norvégien Bokmal, néo-norvégien, Sami) et le profil de la machine (serveur, station de travail, serveur de clients légers). Toute autre configuration sera effectuée automatiquement avec des valeurs raisonnables, modifiables de manière centralisée par l'administrateur système après la fin de l'installation.


3.4. Configuration de l'accès au système de fichiers

Une section du système de fichiers du serveur de fichiers est attribuée à chaque compte d'utilisateur Skolelinux. Cette section (répertoire personnel) contient les fichiers de configuration, les documents, courriers électroniques et pages web de l'utilisateur. Certains fichiers devraient être accessibles en lecture par les autres utilisateurs du système, certains devraient l'être par tous sur l'internet, et d'autres ne devraient l'être par personne d'autre que l'utilisateur.

To ensure that all disks that are used for user directories or shared directories can be uniquely named across all the computers in the installation, they can be mounted as /skole/host/directory/. Initially, one directory is created on the file server, /skole/tjener/home0/, in which all the user accounts are created. More directories may then be created when needed, to accomodate particular user groups or particular patterns of usage.

Afin de permettre le contrôle d'accès aux fichiers partagés à l'aide des groupes de fichiers, chaque utilisateur doit être rattaché à un groupe primaire sans autre membre. Le nom de ce groupe privé devrait être identique au nom d'utilisateur. (. Davantage d'informations concernant les groupes privés sont disponibles sur le site de Redhat.) Ceci permet que tous les nouveaux fichiers créés par l'utilisateur disposent d'un accès complet pour le groupe du fichier. Avec le bit set-gid appliqué aux répertoires et l'héritage des droits, ceci permet un partage de fichiers contrôlé entre les membres d'un groupe de fichier. Par conséquent, l'umask des utilisateurs devrait être 00X. (Si tous les utilisateurs doivent initialement être capables de lire les fichiers nouvellement créés, alors X=2. Si seul le groupe pertinent doit avoir initialement l'accès en lecture, alors X=7.)

L'attribution des droits d'accès initiaux pour les fichiers nouvellement créés est un problème de politique. L'accès en lecture peut être accordé à tous le monde, puis être retiré explicitement par l'utilisateur, ou il peut être initialement bloqué, puis être permis par l'utilisateur. La première approche encourage le partage des connaissances et rend le système plus transparent, tandis que la seconde méthode réduit le risque de divulgation involontaire d'informations sensibles. Le problème de la première solution est qu'il n'est pas évident pour les utilisateurs que ce qu'ils créent sera accessible à tous les autres. Ceci n'est tangible qu'en inspectant le contenu du répertoire des autres utilisateurs, permettant ainsi de constater que les fichiers sont lisibles. Le problème de la deuxième solution est que peu d'utilisateurs seront enclins à rendre leurs fichiers accessibles, même s'ils ne contiennent pas d'informations sensibles et même si leur contenu peut s'avérer utile aux utilisateurs curieux, désireux d'apprendre comment d'autres ont résolu des problèmes particuliers (typiquement des problèmes de configuration).

Suggestion : les fichiers sont initialement lisibles par tous, mais certains répertoires particuliers sont créés avec un contenu inaccessible. Décider si un fichier doit être rendu lisible ou non sera simple. Concrètement, l'umask doit être positionné à 002, et ~/ créé avec les privilèges 0775, ~/priv/ avec 0750, et ~/pub/ avec 0775. Les fichiers qui ne doivent pas être lisibles par d'autres seront placés dans ~/priv/, alors que les fichiers publics seront placés dans ~/pub/. Les autres fichiers seront initialement accessibles mais pouront être bloqués si besoin.

ssh requiert que le répertoire personnel ne puisse être accessible en écriture que par le propriétaire, ainsi le droit d'accès maximum pour ~/ est 755.

  • - accès aux répertoires personnels (*~/.) ? - répertoires personnels - répertoires partagés ?


3.5. Notes diverses

Voici diverses notes concernant des sujets devant être présentés dans ce document.

  • Base de données centralisée des utilisateurs avec regroupement et possibilité de contrôler les accès des groupes aux machines.

  • Regroupement de machines et possibilité de contrôler l'accès aux services réseau pour ces groupes (blocage d'accès à l'internet à l'aide de squid)

  • Envisager l'utilisation d'un nom de DNS selon la RFC 2306.

This chapter was initially copied and pasted from http://developer.skolelinux.no/arkitektur/arkitektur.html.en ( at that time it was Copyright © 2001, 2002, 2003, 2004 Petter Reinholdtsen < pere@hungry.com >, released under the GPL) and has since then beed edited.


4. Fonctionnalités

4.1. New features in the Debian Edu 5.0.4+edu0 Codename "Lenny" released 2010-02-08

  • Everything that is new in Debian 5.0.4, see the following paragraph for details.

  • More than 80 applications relevant for education are included based on user feedback and user statistics (through Debian Edu popularity contest). The full list of packages are listed in the task overview page.

  • Improved student desktop with educational software shortcuts to GCompris, Kalzium, KGeography, KMplot, KStars, Stopmotion and OpenOffice Write and Impress.

  • Dynamic desktop icons and menu options that adjust based on user group.

  • Gnome added as a supported desktop, see the Installation chapter to learn how to install with GNOME instead of KDE as desktop.

  • Support for more than 50 languages.

  • Improved system for user administration and machine identification.

  • Improved diskless and thin client setup.

  • New startup menu letting users choose diskless workstation, thin client or workstation.

  • A diskless workstation option is installed but not activated by default on all servers with the thin-client-server profile.

  • Main-server is set up as a PXE server for booting thin clients and diskless workstations and for installing to clients' hard or flash drives.

  • The configuration for DNS and DHCP is stored in LDAP and can be edited using lwat. The DNS server has been switched from bind9 to power-dns.

  • LDAP server for directory services (NSS) are now located using a SRV record in DNS instead of hardcoding the 'ldap' DNS name. LDAP server for password checks (PAM) is still using the hardcoded 'ldap' DNS name.

  • Multi arch (amd64/i386/powerpc) net installer CD.

    • (Most) Packages are downloaded from over the Internet.

  • Multi arch (amd64/i386) installer DVD capable of installing without network.

  • PulseAudio is provided in addition to ALSA and OSS for sound on workstations and diskless workstations machines.

  • The Barebone profile has been renamed to Minimal, to better reflect what it is.

  • The Nagios3 configuration is now automatically created by sitesummary.

  • The per-user file ~/.xsession-errors is now truncated automatically when the user logs in to avoid filling up the home directory partition with a log that grows indefinitely. The user can disable this by creating ~/.xsession-errors-enable. The system administrator can configure the system to redirect the file to /dev/null by editing /etc/X11/Xsession.d/05debian-edu-truncate-xerrorlog.

  • To ease installation of Debian Edu on hardware needing non-free firmware, the CD and DVD include the following firmware packages: firmware-bnx2, firmware-bnx2x, firmware-ipw2x00, firmware-iwlwifi, firmware-qlogic and firmware-ralink.


4.2. New features in Debian 5.0.4 upon which Debian Edu 5.0.4+edu0 is based

  • New Linux kernel 2.6.26 supports more hardware

  • With this release, Debian GNU/Linux updates from X.Org 7.1 to X.Org 7.3 (which includes support of newer hardware) and now includes the desktop environments KDE 3.5.10 and GNOME 2.22. Updates of other desktop applications include Iceweasel (version 3.0.6, which is the unbranded Firefox web browser), Icedove (version 2.0.0.19, which is the unbranded Thunderbird mail client) as well as upgrades to Evolution 2.22.3, OpenOffice.org 2.4.1, and Pidgin 2.4.3 (formerly known as Gaim).

  • Installation from CD/DVD from within Windows

  • Switched from sysklogd to rsyslog as the syslog collector.

  • For more information see the page New in Lenny on wiki.debian.org


4.3. Nouvelles fonctionnalités de la version « 3.0r1 Terra », publiée le 2007-12-05

  • Much improved documentation with updated translations to German, Norwegian Bokmal and Italian

  • Includes more than 40 bug fixes, improvements and security updates that came to our attentention after the 3.0r0 release


4.4. Nouvelles fonctionnalités de la version « 3.0r0 Terra », publiée le 2007-07-22

  • Basée sur Debian 4.0 Etch, publiée le 2007-04-08.

  • Installateur graphique avec support de la souris

  • Écran d'amorce avec usplash

  • Compatible LSB 3.1

  • Noyau Linux version 2.6.18

    • Prise en charge des contrôleurs et disques SATA

  • X.org version 7.1.

  • Environnement de bureau KDE version 3.5.5

  • OpenOffice.org version 2.0.

  • LTSP5 (version 0.99debian12)

  • Suivi automatique des machines installées grâce à Sitesummary.

  • Configuration automatique de munin grâce à Sitesummary.

  • Contrôle de version automatique des fichiers de configuration situés dans /etc/ à l'aide de svk.

  • La taille d'un système de fichiers peut être augmentée alors que celui-ci est monté.

    • Prise en charge automatique de l'extension des systèmes de fichiers selon des règles prédéfinies.

  • Prise en charge de périphériques locaux sur les clients légers.

  • Nouvelles architectures de processeur : amd64 (prise en charge totale) et powerpc (prise en charge expérimentale, le support d'installation amorce seulement sur la sous-architecture newworld)

  • DVD multi-architecture pour i386, amd64 et powerpc

  • Régression : l'installation à partir du CD requiert un accès à l'internet. Les versions précédentes pouvaient être installées depuis un CD sans accès à l'internet.

  • Regression: webmin is now removed from Debian because of problems supporting it. We've added a new web based user administration tool named lwat, which doesn't has the same functionality as wlus, the old user administration tool. But wlus requires webmin.

  • Regression: swi-prolog is not part of etch, but was part of sarge. The HowTo teach and learn Chapter describes how to install swi-prolog on etch.


4.5. Fonctionnalités de la version 2.0, publiée le 2006-03-14

  • Basée sur Debian 3.1 Sarge, publiée le 2005-06-06.

  • Noyau Linux version 2.6.8.

  • XFree86 version 4.3

  • KDE version 3.3.

  • OpenOffice.org 1.1.


4.6. Fonctionnalités de « 1.0 Venus », publiée le 20-06-2004

  • Basée sur Debian 3.0 Woody, publiée le 19-07-2002.

  • Noyau Linux version 2.4.26.

  • XFree86 version 4.1.

  • KDE version 2.2.


5. Besoins

There are different ways of setting up a Skolelinux solution. It can be installed on just one standalone PC or a regional wide solution at many schools operated centrally. This variety of configurations makes a huge difference on how things are set up regarding network components, servers and client machines.


5.1. Besoins matériels

The purpose of the different profiles is explained in the network architecture chapter.

  • The computers running Debian Edu / Skolelinux must have either i386, amd64 or powerpc processors.

    • On powerpc, the installation media will only boot on machines of the newworld sub-architecture, which are the systems from Apple with a translucent case.

  • Thin client servers need two network cards when using the default network architecture:

    • eth0 is connected to the main network (10.0.2.0/23),

    • eth1 is used for serving the thin-clients (192.168.0.0/24) .

    • Consider 2 GB RAM for 30 clients and 4 GB RAM for 50-60 clients.

  • Disk space requirements depend on profiles used, but any disk larger than 10 GiB will be sufficient for a workstation or standalone installation, 15 Gib for a thin-client server and at least 30 GiB on the main server. As usual with disk space on a main-server: the bigger the better.

  • Thin clients can run on as low as 64 MiB RAM and 133 MHz processor, though 128 MiB RAM and somewhat faster processors are recommended.

    • For running Iceweasel/Firefox and OpenOffice.org, 128 MiB RAM is a minimum requirement.

  • For workstations, diskless workstations and standalone PCs 800 MHz, 256 MiB RAM are minimum requirements, though 512 or 1024 MiB RAM will perform considerable better. Just a faster CPU will speed things up.

    • Swapping over the network is automatically enabled, the swap size is 32 MiB, if you need more you can tune this by editing /etc/ltsp/nbdswapd.conf on tjener to set the SIZE variable. Please tune up the swap size either locally on the pc or on the server.

      • If your diskless workstations have harddrives, it is recommended to use them for swap as it is a lot faster than network swapping.

    • On workstations with little RAM the spell checker can cause OpenOffice.org to hang if the swap space is too small. Then the system administrator has to disable the spell checker on OpenOffice.org or students have to kill OpenOffice.org, resulting in loss of work. Enabling at least 512 MiB swap on a 256 MiB RAM workstation solves this, and the spell checker runs smoothly.

  • Laptops have the same requirements as for workstations since they are just movable workstations.


5.2. Matériel compatible connu

A list of tested hardware is provided from http://wiki.debian.org/DebianEdu/Hardware/ . This list is not nearly complete

http://wiki.debian.org/InstallingDebianOn is an effort to document how to install, configure and use Debian on some specific hardware. Therefore potential buyers would know if that hardware is supported and owner would know how get the best out of that hardware.

An excellent database about hardware supported by Debian is online at http://kmuto.jp/debian/hcl/.


6. Besoins pour une configuration du réseau

6.1. Default Setup

When using the default network architecture, these rules apply:

  • you need exactly one main server, the tjener

  • you can have up to 50 (diskless) workstations on the main network

  • you can have up to 20 ltspservers on the main network

    • you can have hundreds of thin clients and/or diskless workstations on each ltspserver network

  • you can have hundreds of other machines which will have dynamic IP addresses assigned

  • for having access to the internet you need a router/gateway (see below)


6.2. Routeur internet

A router/gateway, connected to the internet on the external interface and running on the IP address 10.0.2.1 with netmask 255.255.254.0 on the internal interface, is needed to connect to the internet.

Le routeur ne doit pas exécuter de serveur DHCP, il peut exécuter un serveur DNS, bien qu'il ne soit pas nécessaire et ne sera pas utilisé. (Si le routeur exécute un serveur DHCP, vous devez désactiver celui du serveur pricipal et vous perdrez certaines fonctionnalités et certaines procédures documentées fonctionneront différement. Il est donc conseillé de désactiver le serveur DHCP du routeur.)

Si vous recherchez une solution basée sur i386 (afin de réutiliser un vieux PC), nous vous recommandons IPCop ou floppyfw.

Si vous avez des besoins concernant un routeur ou un point d'accès embarqué, nous vous recommandons d'utiliser OpenWRT , bien que vous puissiez bien sûr aussi utiliser le micro-code initial. L'utilisation du micro-code initial est plus simple, alors que celle de OpenWRT vous offre plus de choix et de contrôle sur le système. Consultez la liste du matériel géré sur les pages web de OpenWRT.

It is possible to use a different network setup, this is the documented procedure to do this. If you are not forced to do this by an existing network infrastructure, we recommend against doing so and recommend you stay with the default network architecture.


7. Installation

7.1. Where to find additional information

We recommend that you read or at least take a look at the release notes for Debian Lenny before you start installing a system for production use. If you just want to give Debian Edu/Skolelinux a try, you don't have to though, it should just work.

Even more information about the Debian Lenny release is available in its installation manual.


7.2. Download the installation media for Debian Edu 5.0.4+edu0 Codename "Lenny"

7.2.1. DVDs pour i386, amd64 et powerpc

The multiarch DVD ISO image is 4.4 GiB large and can be used for installation of amd64 and i386 machines. To download it, use any of these methods:

  • ftp://ftp.skolelinux.org/skolelinux-cd/debian-edu-5.0.4+edu0-DVD.iso

    http://ftp.skolelinux.org/skolelinux-cd/debian-edu-5.0.4+edu0-DVD.iso

    rsync ftp.skolelinux.org::/skolelinux-cd/debian-edu-5.0.4+edu0-DVD.iso

The netinstall CD, which can be used for installation of i386, amd64 and powerpc machines, is available via

  • ftp://ftp.skolelinux.org/skolelinux-cd/debian-edu-5.0.4+edu0-CD.iso

    http://ftp.skolelinux.org/skolelinux-cd/debian-edu-5.0.4+edu0-CD.iso

    rsync ftp.skolelinux.org::skolelinux-cd/debian-edu-5.0.4+edu0-CD.iso

Le portage powerpc n'a pas été autant testé que les autres architectures, il devrait cependant fonctionner correctement et les retours indiquent qu'il fonctionne correctement. Nous le considérons comme une version expérimentale de Debian Edu, que nous ne sommes pas en mesure de supporter comme les autres architectures.

The Sources are available via

  • ftp://ftp.skolelinux.org/skolelinux-cd/debian-edu-5.0.4+edu0-source-DVD.iso

    http://ftp.skolelinux.org/skolelinux-cd/debian-edu-5.0.4+edu0-source-DVD.iso

    rsync ftp.skolelinux.org::skolelinux-cd/debian-edu-5.0.4+edu0-source-DVD.iso


7.3. Demande d'un CD/DVD par courrier électronique

For those without a fast internet connection, we offer to send you a CD or DVD for the cost of the CD or DVD and shipping. Just send an email to cd@skolelinux.no and we will discuss the payment details (for shipping and media) Remember to include the address you want the CD or DVD to be sent to in the email.


7.4. Installing Debian Edu

7.4.1. The installation process

When you do a Debian Edu installation, you have a few options to choose. Don't be afraid; there aren't many. We have done a good job hiding the complexity of Debian during the installation and beyond. However, Debian Edu is Debian, and if you want there are more than 15000 packages to choose from and a billion configuration options. For the majority of our users, our defaults should be fine.

  • Select type of installation

    • Install is the default text mode installation on i386 and amd64.

    • 64 bit install does an amd64 text-mode install.

    • Select Graphical install to have the GTK installer where you can use the mouse.

    • Select 64 bit graphical install to have the amd64 GTK installer where you can use the mouse.

    • The debian-edu-expert boot-option adds the minimal profile to the profile options, and switches to manual partitioning.

    • Further notes:

      • On i386/amd64 boot-options can be edited by pressing the tabulator-key in the boot menu.

      • The powerpc installer does neither support the graphical installation nor the boot menu that i386 and amd64 have.

      • On powerpc, enter install debian-edu-expert at the yaboot prompt to enter expert mode.

      • If you want to boot the amd64 text mode with the multiarch DVD it would be amd64-install.

      • Likewise you can choose amd64-expertgui to get the GUI version on amd64.

      • If you want to boot the i386 mode with the multiarch DVD on an amd64 machine you need to manually select install (text mode) or expertgui (graphical mode).

      • The multiarch DVD defaults to use amd64-installgui on x86 64-bits machines, and installgui on x86 32-bits machines.

      • Si le profil serveur principal est déjà installé sur une machine, vous pouvez utiliser son service de proxy http pour accélérer les installations suivantes depuis le CD. Pour cela, ajoutez l'option d'amorçage d-i mirror/http/proxy string http://10.0.2.2:3128/.

      • to install the GNOME desktop instead of the KDE desktop, add desktop=gnome to the kernel boot params.

  • Choisissez une langue (pour l'installation et le système installé)

  • Choisissez un zone géographique

  • Choisissez une disposition de clavier (généralement, le choix par défaut du pays convient)

  • Choose a profile:

    • Main-Server

      • This is the main server (tjener) for your school providing the following services: file, print, intranet, proxy, DNS, DHCP, LDAP, backup, nagios, sitesummary, and munin. All services are pre-configured to work out of the box. You must only install one main server per school! This profile does not include a graphical user interface. If you want a graphical user interface, then select Workstation or Thin-Client-Server in addition to this one.

    • Workstation

      • Un ordinateur s'amorçant depuis son disque dur local, exécutant tous les logiciels et exploitant tous ses périphériques comme un ordinateur ordinaire, mais la connexion de l'utilisateur est authentifiée par le serveur principal, où les fichiers de l'utilisateur et le profil de bureau sont enregistrés.

    • Thin-Client-Server

      • Thin client (and diskless workstation) server, also called LTSP server. Clients without hard drives boot and run software from this server. This computer needs two network cards, a lot of memory, and ideally more than one processor or core. See the chapter about networked clients for more information on this subject. Chosing this profile also enables the workstation profile (even if it is not selected), a thin client server can always be used as a workstation, too.

    • Standalone

      • Un ordinateur ordinaire qui peut fonctionner sans serveur principal, c-à-d qui n'a pas besoin d'être sur le réseau. Ceci inclut les ordinateurs portables.

    • Minimal

      • Ce profil n'est disponible qu'en utilisant l'option d'amorce « debian-edu-expert ». Il installera les paquets de base et configurera la machine de sorte qu'elle s'intègre dans le réseau Debian Edu, mais sans aucun service ni application. Ceci est utile comme plateforme pour des services retirés manuellement du serveur principal.

    The first 3 profiles can all be installed on the same machine. That means the main server can be a thin client server and also used as a workstation.

  • Say yes or no to automatic partitioning

    • Be aware that saying yes will destroy all data on the harddrives! Saying no on the other hand will require more work and one will need to make sure that the required partitions are created and are big enough.

  • Please say yes to submit information to http://popcon.skolelinux.org/ to allow us to know which packages are popular and should be kept for future releases. Though you don't have to, it is a simple way for you to help.

  • Wait

    • if thin client server is among the selected profiles, then the installer will spent quite some time at the end, "Finishing the installation - Running debian-edu-profile-udeb..."

  • Be happy


7.4.2. Note concernant le partitionnement manuel

As a general advice: if you choose manual paritioning and your system fails to boot, try automatic partitioning first.

If you decide to do manual partitioning for the main-server, you should consider this:

  • Make sure the directory /skole/tjener/home0 exists, usually you will also be mounting a partition there. If you don't create that directory you will only be able to login as root. The reason is that the user creation system require this directory to exist to be able to create users home directories, and without a users home directory the user can not log in.

  • If /var/spool/squid is on a seperate partition, 3GiB free space is a good recommendation. Squids cache size will be set to 80% of the partition size.

  • /boot should have its own partition.


7.4.3. Note concernant les ordinateurs portables

In principal it makes sense either to install notebooks with the workstation or with the standalone profile. Keep in mind that the workstation profile uses LDAP for the user accounts and NFS for the home directories, so those workstations will only work while in the network where they can access the server. If you plan to use your laptop at home or on the road, then choose the standalone profile.

Il est possible de reconfigurer les stations de travail afin qu'elles gardent en cache les informations d'authentification et effectuent une copie des répertoires personnels sur le disque local (et synchronisent ceux-ci lorsqu'elles ont accès au réseau) à l'aide d'unison, mais aucun manuel n'est disponible pour l'instant.


7.4.4. Note concernant l'installation depuis un DVD

If you install from a DVD, /etc/apt/sources.list it will only contain sources from the DVD afterwards. If you have an internet connection we strongly suggest adding the following lines to it so that available (security) updates can be installed:

deb http://ftp.debian.org/debian/ lenny main 
deb http://security.debian.org/ lenny/updates main 
deb http://ftp.skolelinux.org/skolelinux lenny local

7.4.5. A note on CD installs

The netinst installation (which is the type of installation our CD provides) will fetch some packages from the CD and the rest from the net. The amount of packages fetched from the net varies from profile to profile:

  • Main server: 8 pour 115 Mio téléchargés.

  • Serveur principal et serveur de clients légers : 618 pour 1082 Mio téléchargés.

  • Serveur principal et station de travail : 618 pour 1081 Mio téléchargés.

  • Serveur de clients légers : 618 pour 1052 Mio téléchargés.

  • Station de travail : 618 pour 1051 Mio téléchargés.

  • Ordinateur autonome : 618 pour 1020 Mio téléchargés.

  • Minimal: 12 of 83 MiB downloaded.


7.4.6. A note on some RAID controllers

When using a USB drive to add missing firmware during install, with some RAID-controllers GRUB is installed to the USB drive. So a reboot after installation results in a GRUB-error. A workaround for this problem is to remove the USB drive after the firmware is loaded, and preferably before partitioning starts.

More information is available in Debian-Edu bug #1395 and Debian bug 516280.


7.4.7. A note on thin-client-server installations

First of all, this profile name is confusing due to historic reasons: the profile actually installs a LTSP server environment for thin-clients and for workstations. So for the next release of Debian Edu the name of this profile will be changed.

By providing the kernel argument edu-skip-ltsp-make-client it is possible to skip the step which converts the LTSP chroot from a thin-client chroot into a combined thin-client/diskless workstation chroot.

This is useful in certain situations, e.g. if one wants a pure thin client chroot or if there is already a diskless chroot on another server, which can be rsynced. For these situations skipping this step will cut down the installation time considerably.

Except for the longer installation time there is no harm creating combined chroots always and this is why this is done by default.


7.4.8. CD/DVD personnalisés

Creating custom CDs or DVDs is possibly quite easy since we use the debian installer, which has a modular design and other nice features. Preseeding allows you to define answers to the questions normally asked.

Ainsi, vous n'avez qu'à créer un fichier de référence (preseeding) avec vos réponses (ce qui est décrit dans l'annexe du manuel de l'installateur Debian) et re-créer le CD/DVD.


7.4.9. Installation over the network (PXE) and booting diskless clients

For this installation method it is required that you have a running main server. When clients boot via the main network, a new PXE menu with installer and boot selection options is displayed.

This is how the PXE menu looks like with the Main-Server profile only:

This is how the PXE menu looks like with the Main-Server and Thin-Client-Server profile:

This setup also allows to boot diskless workstations and thin clients on the main network. Diskless workstations must be added with LWAT just like normal workstations or thin client servers.

More information about network clients can be found in the Network clients HowTo chapter.


7.4.9.1. Modifying PXE installations

The PXE installation is using a debian-installer preseed file, and this file can be modified to ask for more packages to install.

A line like the following needs to be added to tjener:/etc/debian-edu/www/debian-edu-install.dat

d-i    pkgsel/include string my-extra-package(s)

The PXE installation uses the files /var/lib/tftpboot/debian-edu/install.cfg and the preseeding file in /etc/debian-edu/www/debian-edu-install.dat. These files can be changed to adjust the preseeding used during installation, i.e. to avoid more questions when installing over the net. Another possibility to achieve the same is to provide extra settings in /etc/debian-edu/pxeinstall.conf and /etc/debian-edu/www/debian-edu-install.dat.local and to run /usr/sbin/debian-edu-pxeinstall to update the generated files.

Further information can be found in the manual of the Debian Installer.

To disable or change the use of the proxy when installing via PXE, the lines containing mirror/http/proxy, mirror/ftp/proxy and preseed/early_command in tjener:/etc/debian-edu/www/debian-edu-install.dat need to be changed. To disable the use of a proxy when installing, put '#' in front of the first two lines, and remove the "export xhttp_proxy="http://webcache:3128"; " part from the last one.

Some settings can not be preseeded because they are needed before the preseeding file is downloaded. These are configured in the pxelinux based boot arguments available from /var/lib/tftproot/debian-edu/install.cfg. Language, keyboard layout and desktop are examples of such settings.


7.5. Screenshot tour

The text mode and the graphical installation are identical, only the appearance is different. The graphical mode offers you the opportunity to use a mouse. Of course the graphical mode looks much nicer and more modern. Unless the hardware has trouble with the graphical mode, there is no reason not to use it.

So here is a screenshot tour through a graphical Main-Server + Thin-Client-Server installation:


8. Démarrage rapide

8.1. Minimum steps to get started

Ce chapitre décrit les premières étapes par lesquelles vous devrez passez après l'installation. Le minimum à faire est :

  • add users

  • add workstations to host netgroups (for exporting home-directories via NFS)

    • thin clients don't need to be added, only workstations. And workstations no matter if with disk or diskless.

This is described below, please read this chapter completly. It covers how to do these minumum steps correctly as well as other stuff probably everybody will need to do.

The following HowTo chapter covers more tips and tricks and some frequently asked questions.


9. Services exécutés sur le serveur principal

Plusieurs services sont exécutés sur le serveur principal et peuvent être contrôlés par une interface web. Nous décrirons ici chacun de ces services.


9.1. Gestion par une interface web, à l'aide de lwat

Lwat est un outil de gestion reposant sur une interface web qui vous aidera à contrôler certains réglages importants de Debian Edu. Vous pouvez contrôler les quatre groupes principaux suivants (ajout, modification, suppression) :

  • Administration des utilisateurs

  • Administration des groupes

  • Automount Informations

  • Administration des machines

  • DNS Administration

To access lwat point your web browser to https://www/lwat.

  • In case you are not using a new Debian Edu Lenny machine, you will get an error message about the ssl certificate. Just tell your browser to accept and ignore that.

  • In case you are using a new Debian Edu Lenny machine, the override rule will be already in place and you can't be bothered.

You will then see the login page of LWAT. If you visit this site the first time after installation, the login name there is: admin and the password is the password you entered during the installation for the root account.

After login the you can choose a task in the menu.


9.2. Gestion des utilisateurs avec lwat

In Debian Edu account information is stored in a LDAP directory. This data is used not only by the main server, but also by the (diskless) workstations and thin client servers on the network. In this way data about students, pupils, teachers, etc. needs to be entered only once. After that it is available to all systems on the network.

To get the work done efficiently lwat will assist you on getting your user's data entered to the LDAP directory.

You can add users, group them in usergroups (for example to refer the members of a class more easily), update them and remove them again. By pointing the mouse onto the menu entries "Users" or "Groups" you can choose the action: Add any, or search for existing users or groups to modify or delete them.


9.2.1. Ajouter des utilisateurs

To add users you only have to choose "Add" in the "Users" section of the menu. After choosing this entry you will see a form where you can enter the data of the user you want to add. The most important thing to add is the full name of your user (see image). As you enter you will see, that lwat will generate a user name automatically based on the real name. It automatically chooses a user name that doesn't exist yet, so multiple users with the same full name are not a problem. If you don't like the generated user name you can change it in the corresponding field. Second you need to choose the role of your account, which is used by lwat to determine the privileges the user has for system administration. Currently lwat knows the following roles:

rôle

privilèges accordés

Étudiants

Se connecter et utiliser le système

Professeurs

Identiques à ceux des étudiants

jrAdmins

Same as Teachers, but can also change other user's passwords (except for the Admins' ones)

Administrateurs

Les Admins ont les privilèges les plus avancés. Ils peuvent ajouter/modifier/supprimer des utilisateurs/groupes/machines/montages automatiques et permettre à des systèmes Windows de rejoindre le domaine Skolelinux.

After choosing a suitable role you can hit the "Save" button and the user is added. Do not hit the enter key, or your progress will be lost. This is to avoid security problems with PHP.

Si tout s'est bien passé, un court message en fin de page vous rappelle les données ajoutées au répertoire LDAP (et le formulaire est ré-initialisé) :

Added user: Demo User
username: demuse
password: somethingsecret

It might take several minutes until the new added user's home directory is created. Until that is done he won't be able to log in on any server, workstation or thin client.

You may miss the option to set a password, that has been set automatically. The user can change is own password by clicking on the key icon on his desktop or directly browsing to http://www/lwat/chguserpw.php.

You can also set another password by modifying the user added (see below).


9.2.2. Search and delete users

To modify or delete a user you need to first find her using the search menu entry. You will find the form shown in the screenshot where you can enter either the real name or the user name of the user. The results will show up below. On the left of every result line there is a checkbox you can use to delete or disable one or more users with the two buttons below. If you want to modify a user, just click on it, all names found are links to the modify page.

A new page will show up where you can modify information directly belonging to the user, change the password of the user and modify the list of groups the user belongs to.


9.2.3. Set passwords

To set a new password for a user

  • search the user to be modified like explained above and click on the username once found.

  • click on the button New password

  • on the following page, you can set a new random generated password.

  • note that by default it is not possible to set a self-chosen password, as the corresponding field is not writable

To allow setting self-chosen passwords you need to edit /etc/lwat/config.php on the tjener:

  • Execute nano /etc/lwat/config.php

  • Change $allowPwSet = false ; to $allowPwSet = true ;

  • Press CTRL+X

  • Press Y

  • Press Enter

You can now set any password you like, as long as it is at least 5 digits long. Beware of security implications due to easy to guess passwords!


9.2.4. Advanced user management

It is possible to mass-create users with lwat by using a .csv file, which can be created with any good spreadsheet software (for example oocalc).

The import script expects a file formated with all data for one user on one row, with each field separated with a semicolon. The minimum information needed is the full name of the user. If fullname is not given, the script expects to have both firstname and lastname. The maximum information it expects is "User template; Fullname; Username; Password; Additional group membership".

If a password column is missing, an easy to remember, pronounceable password will be created.

If users are put into groups, these groups have to exist, so you need to create them manually (with lwat, see below) before importing the users.

It's a good idea to do some tests first, best with a .csv file with a few fictional users, which can be deleted later.


9.3. Administration des groupes avec lwat

The mangement of groups is very similar to the management of users. You can enter a name and a description per group. When searching for groups you can also delete or disable all users of the groups found. From the modification page you can access all the users of that group.

Les groupes créés par l'outil d'administration de groupes sont aussi des groupes Unix classiques, si bien que vous pouvez vous appuyer sur eux pour créer les permissions d'accès aux fichiers.


9.4. Group Management on the command line

Here's how:

# List existing group mapping between UNIX and Windows groups.
net groupmap list

# Add your new or otherwise missing groups:
net groupmap add unixgroup=NEW_GROUP type=domain ntgroup="NEW_GROUP"\
                 comment="DESCRIPTION OF NEW GROUP"

This is explained in more detail in the HowTo/NetworkClients chapter of this manual.


9.4.1. Advanced group management

Using lwat it's easy to put users in a specific group (for example named after the year they enter or finish school) and to create all their home directories in a dedicated directory.

To achieve that, add a stanza like the following to the file /etc/lwat/admin.ini:

[2009]
ou = "ou=People,%base%"
objectClass = top posixAccount shadowAccount imapUser sambaSamAccount
homeDirectory = /skole/tjener/home0/2009/%username%
groups = none students 2009
loginShell = /bin/bash
mailMessageStore = /var/lib/maildirs/%username%

To make this work, the 2009 group has to be created before adding the users.

The above stanza simply adds them on top off home0. If you want them somewhere else, using another automount, then you use lwat to add that automount, and change the homeDirectory string in admini.ini correspondingly.


9.5. Gestion de machines avec lwat

With the machine management you can basically manage all IP based devices in your Debian Edu network. Every machine added to the LDAP directory using lwat has a hostname, an IP-address, a MAC-address and a domain name which usually is "intern". For a more verbose description about the Debian Edu architecture see the architecture chapter of this manual.

Si vous ajouter une machine, vous pouvez utiliser une adresse IP/un nom d'hôte de l'espace d'adresses pré-configuré. Les plages d'adresses IP suivantes sont pré-définies :

Première adresse

Dernière adresse

nom d'hôte

10.0.2.10

10.0.2.29

ltspserverxx

10.0.2.30

10.0.2.49

printerxx

10.0.2.50

10.0.2.99

staticxx

Les adresses situées entre 10.0.2.100 et 10.0.2.255 et entre 10.0.3.0 et 10.0.3.243 sont réservées à DHCP et sont assignées dynamiquement.

To assign a host with the MAC-address 52:54:00:12:34:10 a static IP-address you only have to enter the MAC-address and the hostname static00, the remaining fields will be filled automatically according to the predefined configuration:


9.5.1. Rechercher et supprimer des machines

La recherche et la suppression de machines sont assez semblables à celles d'un utilisateur, par conséquent ceci ne sera pas développé ici.


9.5.2. Modification de machines existantes / gestion des groupes réseau

After adding a machine to the ldap tree using lwat, you can modify its properties using the search functionality and clicking on the machine (as you would with users).

The form that is behind these machine links is in one way similar to the one you already know from modifying user entries, but in an other way the informations do mean different things in this context.

For example, adding a machine to a NetGroup does not modify the permissions that machine or the users logged into that machine have on accessing files or programs on the server. But it restricts the services that machine can use on your main-server.

The default installation provides the NetGroups

  • printer-hosts

  • workstation-hosts

  • ltsp-server-hosts

  • server-hosts

  • shutdown-at-night-hosts

  • fs-autoresize-hosts

Currently the NetGroup functionality is used for

  • NFS.

    • The home directories are exported by the main-server to be mounted by the workstations and the ltsp-servers. Because of security reasons only hosts within the workstation-hosts, ltsp-server-hosts and server-hosts NetGroups can mount the exported NFS shares. So it is rather important to remember to configure this kinds of machines properly in the ldap tree using lwat and configuring them to use the static IPs from ldap. Remember to configure workstations and ldap-servers properly with lwat, or your users won't be able to access their home directories.

  • fs-autoresize

    • debian edu machines in this group will automatically resize lvm partitions that run out of space

  • shutdown at night

    • debian edu machines in this group will automatically shutdown at night to save energy

Another important part of the machine configuration is the 'Samba host' flag (in the 'Host information' area). If you plan to add existing Windows systems to the Skolelinux Samba domain, you have to add the Windows host to the ldap tree and set this flag to be able to join the Windows host to the domain. For more information about adding Windows hosts to the Skolelinux network see the HowTo/NetworkClients chapter of this manual.


9.5.3. Davantage de documentation sur lwat

La documentation complète de lwat est disponible sous /usr/share/doc/lwat/ sur le serveur principal ou en ligne.


9.6. Gestion des imprimantes

For Printer Management point your web browser to https://www:631 This is the normal cups management site where you can add/delete/modify your printers and can clean up the printing queue. Changes that require to login as root need ssl encryption.

If you connect the printer for the first time, we suggest to run printconf as root. FIXME: explain what to do when printconf does not accomplish anything.


9.7. Synchronisation de l'horloge

The default configuration in Debian Edu is to keep the clocks on all machines synchronous but not necessarily correct. NTP is used to update the time. The clocks will not be synchronized with an external source by default, to make sure the machines to not use external network connections active all the time. This was configured like this after a school discovered their ISDN network was up all the time, giving them a nasty extra phone bill.

Pour permettre la synchronisation avec une horloge externe, le fichier /etc/ntp.conf sur le serveur principal doit être modifié. Les commentaires en regard des entrées du serveur doivent être supprimés. Après cela, le serveur NTP doit être redémarré en exécutant /etc/init.d/ntp restart en tant que root. Pour tester si le serveur utilise les sources d'horloges externes, exécutez ntpq -c lpeer.


9.8. Extending full partitions

Because of a possible bug with automatic partitioning, some partitions might be too full after installation. To extend these partitions, run debian-edu-fsautoresize -n as root. See the "Resizing Partitions" HowTo in the administration HowTo chapter for more information.


10. Maintenance

10.1. Mis-à-jour du logiciel

Cette section explique comment utiliser aptitude upgrade et kde-update-notifier.

Utiliser aptitude est vraiment simple. Pour mettre à jour un système, vous devez exécuter deux commandes en tant que root : aptitude update (met à jour les listes de paquets disponibles) et aptitude upgrade (met à jour les paquets pour lesquels une mise à jour est disponible).

Instead of using the command line you can also use kde-update-notifier. FIXME: Explain how to use kde-update-notifier, best with screenshots.

Par ailleurs, il est judicieux d'installer cron-apt et apt-listchanges et de les configurer pour envoyer des courriels à une adresse que vous consulterez.

cron-apt vous signalera une fois par jour par courriel quels paquets ont besoin d'une mise à jour. Ce mécanisme n'installe pas les mises à jour mais les télécharge (généralement la nuit), de sorte que vous n'aurez pas besoin d'attendre la fin du téléchargement quand vous lancerez aptitude upgrade.

apt-listchanges peut vous envoyer les entrées de changelog.


10.1.1. Keep yourself informed about security updates

Running cron-apt as described above is a good way to learn that for an installed package a security update is available. Another way to get informed about security updates is to subscribe to the Debian security-announce mailinglist, which has the benefit of also informing what the security update is about. The downside (compared to cron-apt) is that it also includes information about updates for packages which aren't installed.


10.2. Gestion des sauvegardes

For the backup management point your browser to https://www/slbackup-php. Please note that you have to access this site via ssl, since you have to enter the root password there. If you try to access this site without using ssl it will fail.

Per default the tjener will backup /skole/tjener/home0, /etc/, /root/.svk and the ldap to /skole/backup which is in the lvm. If you only want to have things twice (if you delete something) this setup should be fine for you.

Be aware that this backup doesn't protect you from failing harddrives.

Si vous souhaitez sauvegarder vos données sur un serveur externe, un lecteur de bande magnétique ou un autre disque dur, vous devrez légèrement modifier la configuration actuelle.

If you want to restore a complete folder, your best option is to use the command-line:

$ sudo rdiff-backup -r <date>  \
   /skole/backup/tjener/skole/tjener/home0/user \
   /skole/tjener/home0/user_<date>

this will leave the content from /skole/tjener/home0/user from <date> in the folder /skole/tjener/home0/user_<date>

If you want to restore a single file, then you should be able to select the file (and the version) from the web-interface, and download only that file.

  • FIXME: continue description of slbackup-php usage, maybe with screenshots


10.3. Surveillance des serveurs

10.3.1. Munin

Munin trend reporting system is available from https://www/munin/. It provides system status measurement graphis on a daily, weekly, monthly and yearly basis, and allow the system administrator help when looking for bottlenecks and the source of system problems.

The list of machines being monitored using munin is generated automatically based on the list of hosts reporting to sitesummary. All hosts with the package munin-node installed is registered for munin monitoring. It will normally take two days from a machine is installed until munin monitoring start, because of the order the cron jobs are executed. To speed up the process, run sitesummary-client as root on the freshly installed machine, and /etc/cron.daily/sitesummary as root on the sitesummary server (normally the main-server).

Information about the munin system is available from http://munin.projects.linpro.no/ .


10.3.2. Nagios

Nagios system and service monitoring is available from https://www/nagios3/. The set of machines and services being monitored is automatically generated using information collected by the sitesummary system. The machines with the profile Main-server and Thin-client-server receive full monitoring, while workstations and thin clients receive simple monitoring. To enable full monitoring on a workstation, install the nagios-nrpe-server package on the workstation.

The username is nagiosadmin and the password is undefined, you must set your own password before you can login and use nagios. For security reasons, avoid using the same password as root. To change the password you can run the following command as root:

htpasswd /etc/nagios3/htpasswd.users nagiosadmin

By default Nagios does not send email. This can be changed by replacing notify-by-nothing with host-notify-by-email and notify-by-email in the file /etc/nagios3/sitesummary-template-contacts.cfg.

The Nagios configuration file used is /etc/nagios3/sitesummary.cfg. The sitesummary cron job generate /var/lib/sitesummary/nagios-generated.cfg with the list of hosts and services to monitor.

Extra nagios checks can be put in the file /var/lib/sitesummary/nagios-generated.cfg.post to get them included in the generated file.

Information about the nagios system is available from http://www.nagios.org/ or in the nagios3-doc package.


10.3.3. Sitesummary

Sitesummary is used to collect information from each computer and submit it to the central server. The information collected is available in /var/lib/sitesummary/entries/. Scripts in /usr/lib/sitesummary/ are available to generate reports.

A simple report from sitesummary without any details is available from https://www/sitesummary/.

Some documentation on sitesummary is available from http://wiki.debian.org/DebianEdu/HowTo/SiteSummary


10.4. More information about Debian Edu customisations

More information about Debian Edu customisations useful for system administrators can be found in the Administration Howto chapter.


11. Mises à jour

Before explaining how to upgrade, please note, that you do this update on your productive server on your own risk. Debian Edu/Skolelinux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law.

Please read this chapter completly before attempting to upgrade.


11.1. General notes on upgrading

Upgrading Debian from one distribution to the next is generally rather easy. For Debian Edu this is unfortunatly not yet true as we heavily modify configuration files in ways we shouldn't do. (See Debian bug 311188 for more information.) Upgrading is still possible but might requiere some work.

In general, upgrading the servers is more difficult than the workstations and the main-server is the most difficult to upgrade. The diskless machines are easy, as their chroot environment can be deleted and recreated, if you haven't modified it. If you have, the chroot is basically a workstation chroot anyway, so rather easy to upgrade.

If you want to be sure that after the upgrade everything works like before , you should test the upgrade on (a) test systems, which are configured the same way as your production machines. There you can test the upgrade without risk and see if everything works as it should.

Make sure to also read the information about the Debian lenny release from its installation manual.

Also it might be wise to wait a bit and keep running etch for some more weeks, so that others can test the upgrade, experience problems and document them here. Debian Edu etch will receive continued support for some time in the future, but when Debian ceases support for etch, Debian Edu will (have to) do that too. This is expected to happen on Febrary 16th, 2010.


12. Upgrades from Debian Edu etch

Be prepared: make sure you have tested the upgrade from Etch in a test environment or have backups ready to be able to go back.


12.1. The basic upgrade operation

  1. Edit /etc/apt/sources.list and replace all occurances of "etch" with "lenny".

  2. run apt-get update

  3. run apt-get upgrade

  4. run apt-get dist-upgrade


12.2. LDAP service needs to repaired

Upgrading the debian-edu-config package on tjener is likely to disrupt some services:

  1. slapd wouldn't start.

    It may keep running until next restart, then if it gives:

     tjener:~# invoke-rc.d slapd start
     Starting OpenLDAP: slapd - failed.
     The operation failed but no output was produced. For hints on what went
     wrong please refer to the system's logfiles (e.g. /var/log/syslog) or
     try running the daemon in Debug mode like via "slapd -d 16383" (warning:
     this will create copious output).
    
     Below, you can find the command line options used by this script to
     run slapd. Do not forget to specify those options if you
     want to look to debugging output:
     slapd -h 'ldap:/// ldaps:///' -g openldap -u openldap -f /etc/ldap/slapd.conf                     -4

    And searching /var/log/syslog yelds something like:

    tjener slapd[8894]: could not stat config file "/etc/ldap/schema/dnsdomain2.schema": No such file or directory (2)

    then as a temporary measure to get it running until DNS is sorted.

    1. Comment out the line include /etc/ldap/schema/dnsdomain2.schema in /etc/ldap/slapd.conf.

    2. Run invoke-rc.d slapd start

Some new indexes have been added to openldap's configuration. in order to benefit from these you need to regenerate indexes:

  1. stop slapd. invoke-rc.d slapd stop

  2. check syslog or ps output that it have truly stopped.

  3. run sudo -u openldap slapindex

  4. start slapd with invoke-rc.d slapd start


12.3. DHCP service needs to repaired

  1. dhcp3-server wouldn't start.

    If starting dhcp3-server gives:

     tjener:~# invoke-rc.d dhcp3-server start
     dhcpd self-test failed. Please fix the config file.
     The error was:
     Internet Systems Consortium DHCP Server V3.1.1
     Copyright 2004-2008 Internet Systems Consortium.
     All rights reserved.
     For info, please visit http://www.isc.org/sw/dhcp/
     /etc/dhcp3/dhcpd.conf line 2: semicolon expected.
     ldap-server "ldap"
                 ^
     /etc/dhcp3/dhcpd.conf line 3: semicolon expected.
     ldap-port 389;
               ^
     /etc/dhcp3/dhcpd.conf line 4: semicolon expected.
     ldap-base-dn  "dc=skole,dc=skolelinux,dc=no"
                   ^
     /etc/dhcp3/dhcpd.conf line 5: semicolon expected.
     ldap-dhcp-server-cn "dhcp"
                         ^
     /etc/dhcp3/dhcpd.conf line 6: semicolon expected.
     ldap-method dynamic;
                ^
     Configuration file errors encountered -- exiting
     invoke-rc.d: initscript dhcp3-server, action "start" failed.

    Then installing dhcp3-server-ldap is needed install it. Use your favorite package management front-end or run:

     tjener:~# apt-get -q=2 update
     tjener:~# apt-get -q=2 install dhcp3-server-ldap

    If starting dhcp3-server gives:

     tjener:~# invoke-rc.d dhcp3-server start
     dhcpd self-test failed. Please fix the config file.
     The error was:
     Internet Systems Consortium DHCP Server V3.1.1
     Copyright 2004-2008 Internet Systems Consortium.
     All rights reserved.
     For info, please visit http://www.isc.org/sw/dhcp/
     Connecting to LDAP server ldap:389
     Successfully logged into LDAP server ldap
     Cannot find host LDAP entry dhcp (&(objectClass=dhcpServer)(cn=dhcp))
     Configuration file errors encountered -- exiting
     invoke-rc.d: initscript dhcp3-server, action "start" failed.

    Then DHCP configuration needs loading into LDAP. Two ways to do it are:

    1. To load an existing configuration into the database:

      1. Locate the appropriate dhcp.conf, the last one should be in /etc/dhcp3/dhcpd-debian-edu.conf.dpkg-old or get one from backups.

      2. Extract /usr/share/doc/dhcp3-server-ldap/dhcpd-conf-to-ldap.pl.gz

      3. Set /usr/share/doc/dhcp3-server-ldap/dhcpd-conf-to-ldap.pl executable.

      4. Run /usr/share/doc/dhcp3-server-ldap/dhcpd-conf-to-ldap.pl, optionaly with --help first or read the comments in code.

      5. View and check the resulting ldif file. Though DHCP is likely to function fine with this file, to keep as close as possible to the default configuration it is probably best to keep the entries for the configured individual hosts and replace the general entries (i.e. dhcpService, dhcpSharedNetwork, dhcpSubnet, etc.) with those from etc/ldap/dhcp.ldif.

      6. Load the resulting ldif file to the LDAP database.

      7. Start dhcp3-server.

       tjener:~# cd /usr/share/doc/dhcp3-server-ldap/
       tjener:/usr/share/doc/dhcp3-server-ldap# gunzip dhcpd-conf-to-ldap.pl.gz
       tjener:/usr/share/doc/dhcp3-server-ldap# chmod 0744 dhcpd-conf-to-ldap.pl
       tjener:/usr/share/doc/dhcp3-server-ldap#
       tjener:/usr/share/doc/dhcp3-server-ldap# ./dhcpd-conf-to-ldap.pl --server "dhcp" \
       >     --basedn "dc=skole,dc=skolelinux,dc=no" \
       >     --dhcpdn "cn=DHCP Config,dc=skole,dc=skolelinux,dc=no" \
       >     --conf "/etc/dhcp3/dhcpd-debian-edu.conf.dpkg-old" --ldif "/etc/ldap/migrate-dhcp.ldif"
      
       Creating LDAP Configuration with the following options:
              Base DN: dc=skole,dc=skolelinux,dc=no
              DHCP DN: cn=DHCP Config,dc=skole,dc=skolelinux,dc=no
              Server DN: cn=dhcp, dc=skole,dc=skolelinux,dc=no
      
       Done.
       tjener:/usr/share/doc/dhcp3-server-ldap#
       tjener:/usr/share/doc/dhcp3-server-ldap# cd /etc/ldap/
       tjener:/etc/ldap#
       tjener:/etc/ldap#
       tjener:/etc/ldap# # At this point it's recommended to view migrate-dhcp.ldif side by side
       tjener:/etc/ldap# # with dhcp.ldif and make some manual adjustments, before running:
       tjener:/etc/ldap#
       tjener:/etc/ldap# ldapadd -xZWD 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no' \
       >                         -f /etc/ldap/migrate-dhcp.ldif
       Enter LDAP Password:
       adding new entry "cn=dhcp, dc=skole,dc=skolelinux,dc=no"
       ....
       tjener:/etc/ldap#
       tjener:/etc/ldap# invoke-rc.d dhcp3-server start
        * Starting DHCP server dhcpd3                                            [ ok ]
       tjener:/etc/ldap#
    2. To load The fresh configuration into the database:

      If there are only few configured host and adding them later to the configuration is no bother just run ldapadd -xZWD 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no' -f /etc/ldap/dhcp.ldif

  2. Squid wouldn't start.

    If starting Squid gives:

     tjener:~# invoke-rc.d squid start
     * Starting Squid HTTP proxy squid
     2009/08/23 00:20:56| ACL name 'localnet' not defined!
     FATAL: Bungled squid.conf line 2577: http_access allow localnet
     Squid Cache (Version 2.7.STABLE3): Terminated abnormally.

    It's complaint is self explanatory. Two options to overcome this are:

    1. To keep the old /etc/squid/squid.conf just comment-out or remove the offending line http_access allow localnet.

    2. To stay current copy the new squid.conf distributed in the squid package:

       tjener:~# cd /etc/squid/
       tjener:/etc/squid# mv squid.conf etch-squid.conf
       tjener:/etc/squid# cp /usr/share/doc/squid/examples/squid.conf squid.conf

      1. To have the default Debian Edu configuration run cfengine-debian-edu

      2. Any customized settings in the old configuration should be copyed from the old file ( dropping lines acl schoolnet*, acl ltspnet*, http_access allow schoolnet and http_access allow ltspnet these were replaced by the acl localnet* and *access allow localnet lines).


12.4. User logins from Windows machines needs to repaired

  1. Users can't login from Windows machines.

    A change in Samba that has become apparent in Lenny (see 532859) prevents users login to Samba unless sambaPwdLastSet attribute is set other than zero in their LDAP entry.

    1. To add the 'sambaPwdLastSet' attribute for new users to be created in lwat make sure /etc/lwat/admin.ini contain the line 'sambaPwdLastSet = 1' for each group. See also: Debian Edu bug#1364.

    2. To find which users are affected try:

      ldapsearch -xZLLLWD 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no' -b 'ou=People,dc=skole,dc=skolelinux,dc=no' -s one '(&(objectClass=sambaSamAccount)(|(!(sambaPwdLastSet=*))(sambaPwdLastSet=0)))' uid  | less
    3. To add the 'sambaPwdLastSet' attribute to users where it isn't set try:

      ldapsearch -xZLLLWD 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no' -b 'ou=People,dc=skole,dc=skolelinux,dc=no' -s one '(&(objectClass=sambaSamAccount)(!(sambaPwdLastSet=*)))' dn | sed '/.\+/a\changetype: modify\nadd:sambaPwdLastSet\nsambaPwdLastSet: 2\n-' > /etc/ldap/fixamba.ldif
      
      ldapmodify -xZWD 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no' \
                  -f /etc/ldap/fixamba.ldif
    4. If users with 'sambaPwdLastSet = 0' were found and allowing them to login is desired, try:

      ldapsearch -xZLLLWD 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no' -b 'ou=People,dc=skole,dc=skolelinux,dc=no' -s one '(&(objectClass=sambaSamAccount)(sambaPwdLastSet=0))' dn | sed '/.\+/a\changetype: modify\nreplace:sambaPwdLastSet\nsambaPwdLastSet: 2\n-' > /etc/ldap/fixamba.ldif
      
      ldapmodify -xZWD 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no' \
                 -f /etc/ldap/fixamba.ldif

      See also SambaLDAP.


12.5. DNS service needs to repaired

For lenny Debian Edu has switched to powerdns as nameserver. It's however possible to stay with bind9.


12.5.1. Bind

If you want to continue running bind, you must add the RFC 2782 entries in /etc/bind/debian-edu/db.intern:

;RFC2782
_ldap._tcp                      IN      SRV     0 100 389 tjener
_syslog._udp                    IN      SRV     0 100 514 tjener

12.5.2. powerdns

To switch to powerdns:

  1. install the packages pdns-server, pdns-recursor and pdns-backend-ldap.

     tjener:~# apt-get -q=2 update
     tjener:~# apt-get -q=2 install pdns-server pdns-recursor pdns-backend-ldap
  2. In /etc/ldap/slapd.conf:

    1. Uncomment the line include /etc/ldap/schema/dnsdomain2.schema, if it was commented-out earlier (1.1).

    2. It's recommended to index associatedDomain, at the indices area add the lines:

       # PowerDNS index
       index associatedDomain         pres,eq,sub
  3. Restart slapd invoke-rc.d slapd restart.

  4. Load the DNS data into LDAP either using the default Debian Edu or the existing Bind9 configuration:

    1. To use the default Debian Edu configuration:

      1. Add the contents of /etc/ldap/dns_skole.ldif and /etc/ldap/dns_arpa.ldif using ldapadd.

         tjener:~# ldapadd -xZWD 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no' \
         >                 -f '/etc/ldap/dns_skole.ldif'
         tjener:~# ldapadd -xZWD 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no' \
         >                 -f '/etc/ldap/dns_arpa.ldif'
    2. To migrate Bind's configuration:

      1. There is a utility called zone2ldap provided in the PowerDNS distribution which convert zone files used by BIND to the ldif format, it is broken in Lenny (504061), fixed packages are available in Squeeze.

        To use the one from Etch:

        1. Download etch-i386-pdns-backend-ldap.

        2. Unpack it using dpkg or dpkg-deb and replace the faulty /usr/bin/zone2ldap:

           tjener:/tmp# dpkg-deb -x pdns-backend-ldap_2.9.20-8+etch1_i386.deb \
           >                     pdns-backend-ldap_2.9.20
           tjener:/tmp# cp pdns-backend-ldap_2.9.20/usr/bin/zone2ldap /usr/bin/zone2ldap
        3. Apparently PowerDNS in Lenny (2.9.21.2) doesn't understand AFSDB records same for `zone2ldap', when reading an AFSDB record it will quit with an error message.

          To workaround this limitation comment-out (with ' ; ') AFSDB records in the named db.* files, grep -rl AFSDB /etc/bind/* will disclose them.

        4. At last the conversion can be executed:

           tjener:~# zone2ldap --basedn='ou=hosts,dc=skole,dc=skolelinux,dc=no' --layout=tree \
           >                   --named-conf='/etc/bind/debian-edu/named-bind9.conf' --resume \
           >               > /etc/ldap/skole-zone2ldap
      2. Before the data in the new ldif file can be added to the database the "basedn" must be created:

         tjener:~# ldapadd -xZWD 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no'
         Enter LDAP Password:
         dn: ou=hosts,dc=skole,dc=skolelinux,dc=no
         objectClass: organizationalUnit
         objectClass: domainRelatedObject
         ou: hosts
         associatedDomain: intern
      3. The format of the ldif file created by zone2ldap is suitable for `ldapmodify':

         tjener:~# ldapmodify -xZWD 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no' \
         >                    -f /etc/ldap/skole-zone2ldap
  5. Time to stop bind9 and start pdns and pdns-recursor:

     tjener:~# invoke-rc.d bind9 stop
     tjener:~# invoke-rc.d pdns start
     tjener:~# invoke-rc.d pdns-recursor start
  6. After testing the new PowerDNS setup Bind9 may be disabled/removed/purged.


12.6. Nagios setup has changed

Nagios2 is not available in lenny anymore, so nagios3 is now installed.

The nagios3 configuration will already be installed and functional, though the nagios2 configuration won't be functional anymore. If you changed the nagios2 configuration, your changes will be saved in .dpkg-old files, but the changes will not be applied to the nagios3 configuration. So these changes have to be redone manually.


12.7. Recreating an LTSP chroot

On the LTSP server(s) the LTSP chroot should be recreated. The new chroot will automatically support both thin-clients and diskless workstations.

Remove /opt/ltsp/i386 (or /opt/ltsp/amd64, depending on your setup. If you have enough diskspace, consider backing it up.

Recreate the chroot by running debian-edu-ltsp && ltsp-make-client as root.


13. Upgrades from older Debian Edu / Skolelinux installations (before etch)

To upgrade from any older release, you will need to upgrade to the etch based Debian Edu release first, before you can follow the instructions provided above. How to upgrade to etch is described in the Manual for Debian Edu etch.

CategoryPermalink


14. Manuels (HowTo)


15. Manuels d'administration générale

The Getting Started and DebianEdu/Documentation/Lenny/Maintainance chapters describe how to get started with Debian Edu and how to do the basic maintainance work. The howtos in this chapter have some more "advanced" tips and tricks.


15.1. Configuration history: tracking /etc/ using the svk version control system

With the introduction of the etcinsvk script in Debian Edu, all files in /etc/ are tracked using svk as a version control system.

This makes it possible to see when a file is added, changed and removed, as well as what was changed if the file is a text file. The svk repository is stored in ~root/.svk/. Every hour any changes are automatically recorded, allowing configuration history to be extracted and reviewed.

To look at the history, the command etcinsvk log is used. To check the differences between two points in time, a command like etcinsvk diff -r6:8 can be used. The numbers 6 and 8 here represent revision numbers, which can be found by using etcinsvk log. See below for some examples.

See the output of etcinsvk --help for verbose information.

Liste de commandes utiles

etcinsvk diff
etcinsvk log
etcinsvk status
etcinsvk commit
etcinsvk ignore

15.1.1. Exemple pratiques

Sur un système récemment installé, lancez cette commande pour rechercher tous les changements effectués depuis l'installation.

etcinsvk diff -r6 | less

Pour visualiser la liste des changements effectués dans /etc/, utilisez la commande :

etcinsvk log | less

Here check revision numbers by date and time. To see all changes done since revision N say:

etcinsvk diff -rN | less

To see the changes done to a specific file between specific revisions, specify the file and both revisions:

etcinsvk diff -r46 -r64 /etc/resolv.conf | less

Pour annuler un changement, utilisez la commande diff et éditez le fichier, ou utilisez un autre outil pour le faire automatiquement.

( cd /etc && etcinsvk diff -r6 /etc/resolv.conf | patch -p0 -R )

Pour livrer un fichier, parce que vous ne souhaitez pas attendre jusqu'à une heure :

etcinsvk commit /etc/resolv.conf

If you don't want a specific file to be tracked in svk, you can tell to ignore it. But this is rarely useful

etcinsvk ignore /etc/path/to/file/to/be/ignored

15.1.2. For those who upgraded from Etch

debian-edu-etc-svk was moved to a separate package and renamed to etcinsvk for Lenny. Those used to using debian-edu-etc-svk should start to use etcinsvk instead.


15.2. Resizing Partitions

La plupart des partitions dans Debian Edu sont des volumes logiques LVM. Seule la partition /boot/ n'en est pas un. Avec la version Debian/Etch de Debian Edu, il est possible d'étendre les partitions alors qu'elles sont montées. Cette fonctionnalité est disponible depuis la version 2.6.10 du noyau Linux. La réduction d'une partition doit toujours être effectuée lorsque celle-ci est démontée.

It is a good idea to avoid creating very large partitions, as large partitions will take a long time to restore from backup if the need should arise, and file system checks take a very long time for large partitions. A good limit can be 20 GiB. It is better, if possible, to create several smaller partitions than one very large one.

To make it easier to extend full partitions, the debian-edu-fsautoresize script is provided. When invoked, it reads the configuration from /usr/share/debian-edu-config/fsautoresizetab, /site/etc/fsautoresizetab and /etc/fsautoresizetab. It proposes to extend partitions with too little free space based on the rules provided in these files. Without any arguments, it will only show the commands needed to extend the file system. The argument -n is needed to actually execute this commands to extend the file systems.

The script is executed automatically every hour on every client listed in the fsautoresize-hosts netgroup.

When resizing the partition used by the Squid proxy, the cache size in etc/squid/squid.conf need to be updated as well. The helper script /usr/share/debian-edu-config/tools/squid-update-cachedir is provided to do this automatically, checking the current partition size of /var/spool/squid/ and configuring Squid to use 80% of this as its cache size.


15.2.1. Gestion d'un volume logique

Logical Volume Management (LVM) enables resizing the partitions while they are mounted and in use. You can learn more about LVM in the LVM HowTo.

To extend a logical volume manually you simply tell the lvextend command how large you want it to grow to. For example, to extend home0 to 30GB you use the following commands:

lvextend -L30G /dev/vg_system/skole+tjener+home0
resize2fs /dev/vg_system/skole+tjener+home0

15.3. Using ldapvi

ldapvi is a tool to edit the LDAP database with a normal text editor on the commandline.

The following needs to be executed:

ldapvi --host ldap -ZZ --bind simple --tls allow -D 'cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no'

Then make your changes, safe and quit the editor. That's it!

Alternatively, to save key-strokes try:

ldapvi --ldap-conf -ZD '(cn=admin)'

Note: ldapvi will use whatever is the default editor. By executing export EDITOR=vim in the shell prompt one can configure the enviroment to get a vi clone as editor.

Warning: ldapvi is a very powerful tool. Be careful and don't mess up the LDAP database.


15.4. Utilisation de volatile.debian.org

15.4.1. Qu'est-ce que debian-volatile ?

Citation de la page web

  • Certains paquets ont pour objet des cibles très mouvantes comme le filtrage de pourriels et la détection de virus, et même lorsque les données utilisées sont à jour, ils ne fonctionnent pas vraiment durant l'intégralité de la vie d'une version stable. L'objectif principal de « volatile » est de permettre aux administrateurs système de mettre à jour leurs systèmes d'une façon agréable et cohérente sans avoir les inconvénients liés à l'utilisation de la distribution instable, même pour les paquets sélectionnés. debian-volatile ne contiendra donc que des changements à des programmes stables qui sont nécessaires pour garantir leur fonctionnement.


15.4.2. Comment utiliser « volatile »

Since the Lenny release, the volatile archive is enabled and used by default.


15.5. Using backports.org to install newer software

You are running Debian Edu, because you prefer the stability of Debian Edu. It runs great, there is just one problem: Sometimes software is a little bit more outdated as you like. This is where backports.org steps in.

Backports are recompiled packages from Debian testing (mostly) and Debian unstable (in a few cases only, e.g. security updates), so they will run without new libraries (wherever this is possible) on a stable Debian distribution like Debian Edu. We recommend you to pick out single backports which fits your needs, and not to use all backports available there. Please follow the instructions on http://www.backports.org to use these backports.

Vous aurez besoin d'ajouter la clé d'archive de backports.org au trousseau de clés gpg de root, afin que apt puisse utiliser ce dépôt de manière sécurisée. Pour cela, lancez les commandes suivantes en tant que root :

# install the debian-keyring securily:
aptitude install debian-keyring
# fetch the backports.org key insecurily:
gpg --keyserver pgpkeys.pca.dfn.de --recv-keys 16BA136C
# check securily if the key is correct and add it the keyring used by apt if it is:
gpg --keyring /usr/share/keyrings/debian-keyring.gpg --check-sigs 16BA136C && gpg --export 16BA136C | apt-key add -
# add backports.org repo to /etc/apt/sources.list
echo "deb http://www.backports.org/debian lenny-backports main contrib non-free" >> /etc/apt/sources.list
# update the list of available packages:
aptitude update
# Install the keyring package for backports
aptitude install debian-backports-keyring 

Then you can either use aptitude -t lenny-backports install <packagename> to install or update packages once, or you can configure a package to be always installed from backports.org though /etc/apt/preferences. The latter is described in the instructions on backports.org.

The second variant has the advantage, that updates to backports are installed automatically when they are available. With the first variant you need to update manually.


15.6. Java

15.6.1. running standalone Java applications

Standalone Java applications are supported out of the box by the OpenJDK Java runtime.


15.6.2. running Java applications in the webbrowser

The version of the OpenJDK Java runtime available in Debian Edu Lenny does not support to run Java applications in the webbrowser, this will be fixed in the next release. On Lenny, the non-free (but freely available) Java from Sun needs to be installed.

To install Java from Sun you need to edit the /etc/apt/sources.list first to make sure it will install packages from non-free. There needs to be a line like this:

deb http://ftp.debian.org/debian/ lenny main contrib non-free

Then do:

# apt-get update

Now you are ready to run this command:

# apt-get install sun-java6-plugin sun-java6-jre sun-java6-fonts

15.7. Creating folders in the home directories of all users

With this script the administrator can create a folder in each users home directory and set access permissions and ownership.

In the example shown below with group=teachers and permissions=2770 a user can hand in an assignment by saving the file to the folder "assignments" where teachers are given write access to be able to make comments.

home_path="/skole/tjener/home0";
 shared_folder="assignments";
 permissions="2770";
 created_dir=0;
        for home in $(ls $home_path);do
        . if [ ! -d "$home_path/$home/$shared_folder" ]; then
        . mkdir $home_path/$home/$shared_folder
        chmod $permissions $home_path/$home/$shared_folder
. #set the right owner and group
  #"username" = "group name" = "folder name"
        user=$home
        group=teachers
        chown $user:$group $home_path/$home/$shared_folder
        ((created_dir+=1))
 else
  . echo -e "the folder $home_path/$home/$shared_folder already exists.\n"
 . fi
done
echo "$created_dir folders has been created"

15.8. Easy access to USB drives and CDROMs/DVDs

When users insert a USB drive or DVD/CDROM into a (diskless) workstation, there is a popup windows asking what to do with it, just like in any other normal installation.

When users insert a USB drive or DVD/CDROM into a thin client there is no popup window like they are used to from their usual Desktop. Instead it is automatically mounted and they have to browse to the /media/$user folder to access it.. This is quite difficult for many non experienced users.

With the following script the symlink "Media" is created for all users in the home folder for easy access to USB drives, CDROMs or whatever media is connected to the thin client.

home_path="/skole/tjener/home0"; shared_folder="Media"; permissions="775"; created_dir=0;
for home in $(ls $home_path); do
  if [ ! -d "$home_path/$home/$shared_folder" ]; then
    ln -s /media/$home $home_path/$home/$shared_folder ((created_dir+=1))
  else
    echo -e "the folder $home_path/$home/$shared_folder already exists.\n"
  fi
done
echo "$created_dir folders has been created"

15.8.1. A warning about removable media on LTSP servers

Warning: When inserted into a LTSP server USB drives and other removable media cause popup messages on remote LTSP clients.

When a remote users acknowledges the popup or uses pmount from console, a remote user can even mount the removable devices and access the files.

This is being tracked as Debian Edu bug #1376.


15.9. Automatic cleanup of left-over processes

killer is is a perl script that gets rid of background jobs. Background jobs are defined as processes that belong to users who are not currently logged into the machine. It's run by cron job once an hour.

Due to 551753 (also documented as Debian Edu bug #1373) killer should not be installed on thin-client servers when long usernames are used!

To install it run the following command as root:

 apt-get install killer

15.10. Automatic shutdown of machines during the night

It is possible to save energy and money by turning off client machines at night, and turn them automatically on in the morning.

There are some considerations to make when doing this:

  • The clients should not be shut down when someone is using them. This is done by checking the output from who, and as a special case, checking for the LDM ssh connection command to work with LTSP thin clients.

  • To avoid breaking electrical fuses, it is a good idea to make sure all clients do not start at the same time.

  • There are two different methods available to wake up clients. One uses a BIOS feature and require a working and correct hardware clock, as well as a motherboard and BIOS version supported by nvram-wakeup, The other require a server with knowledge about all the clients to wake up and for all the clients to have support for wake-on-lan.


15.10.1. How to set up shutdown-at-night

On clients that should turn off at night, touch /etc/shutdown-at-night/shutdown-at-night, or add the hostname (ie the output from 'uname -n' on the client) to the netgroup "shutdown-at-night-hosts". Adding hosts to the netgroup in LDAP can be done using the lwat web tool. The clients might need to have wake-on-lan configured in the BIOS. It is also important that the switches and routers used between the wake-on-lan server and the clients will pass the WOL packages to the clients even if the clients are turned off. Some switches fail to pass on packages to clients that are missing in the ARP table on the switch, and this block the WOL packages.

To enable wake-on-lan on the server, add the clients to /etc/shutdown-at-night/clients, with one line per client, IP address first, and MAC address (ethernet address) next, with space between them, or create a script /etc/shutdown-at-night/clients-generator to generate the list of clients on the fly.

Here is an example /etc/shutdown-at-night/clients-generator for use with sitesummary:

  #!/bin/sh
  PATH=/usr/sbin:$PATH
  export PATH
  sitesummary-nodes -w

An alternative if the netgroup is used to activate shutdown-at-night on clients is this script using the netgroup tool from the ng-utils package:

  #!/bin/sh
  PATH=/usr/sbin:$PATH
  export PATH
  netgroup -h shutdown-at-night-hosts

This text was originally taken from this README.


15.11. Access to skolelinux server from outside a firewall

A boot script open-backdoor is provided in the debian-edu-config package to "break out" from behind a firewall. It is useful for system administrators responsible for several Debian Edu installations. It set up an SSH tunnel to another machine, allowing ssh login from the outside of the firewall.

To enable it, create a ssh key without a password, create a user on a remote host to use for ssh login, copy the public key into ~/.ssh/authorized_keys for the remote user used for and specify the login information in /etc/default/backdoor.

Content of /etc/default/backdoor should be similar to this:

RHOST=admin.example.net
RPORT=1234
RUSER=backdoor

FIXME: paragraph about access from outside need to be completed and tested.


15.12. Installer des machines exécutant un seul service pour décharger le serveur principal

FIXME: this is so generic its almost useless

  • install the minimal profile using the debian-edu-expert boot-option

  • installer les paquets requis pour le service

  • configurer le service

  • désactiver le service sur le serveur principal

  • update DNS on main-server


15.13. Configuring the PXE menu

The PXE configuration is generated using the debian-edu-pxeinstall script. It allow some settings to be overriden by adding a file /etc/debian-edu/pxeinstall.conf with replacement values.


15.13.1. Configuring the PXE installation

The PXE installation option is by default available to anyone able to PXE boot a machine. To password protect the PXE installation options, a file /var/lib/tftpboot/menupassword.cfg can be created with content similar to this:

MENU PASSWD $4$NDk0OTUzNTQ1NTQ5$7d6KvAlVCJKRKcijtVSPfveuWPM$

The password hash should be replaced with a MD5 hash for the wanted password.

The PXE installation will inherit the language, keyboard layout and mirror settings from the settings used when installing the main-server, and the other questions will be asked during installation (profile, popcon participation, partitioning and root password). To avoid these questions, the file /etc/debian-edu/www/debian-edu-install.dat can be modified to provide preselected answers to debconf values. Some examples of available debconf values are already commented in /etc/debian-edu/www/debian-edu-install.dat. Your changes will be lost as soon as debian-edu-pxeinstall is used to recreate the PXE-installation environment. To append debconf values to /etc/debian-edu/www/debian-edu-install.dat during recreation with debian-edu-pxeinstall, add the file /etc/debian-edu/www/debian-edu-install.dat.local with your additional debconf values.

FIXME: Compare with DebianEdu/Documentation/Lenny/HowTo/NetworkClients and get rid of redundant information.


15.14. Manuels de wiki.debian.org

The HowTos from http://wiki.debian.org/DebianEdu/HowTo/ are either user- or developer-specific. Let's move the user-specific HowTos over here (and delete them over there)! (But first ask the authors (see the history of those pages to find them) if they are fine with moving the howto and putting it under the GPL.)


16. Manuels pour le bureau

16.1. KDE Kiosk mode

Two default profiles are included:

debian_edu_pupils (enabled for members of the students file group)

  • customized set of icons appears on student desktops

  • makes sure that the programs behind the desktop icons also show up in the kde panel

  • adept is not started

  • makes sure that students cannot start another kde session

  • disables possibility to gain root access for students

debian_edu_root (enabled for the root user and members of the admins file group)

  • adds a desktop icon to connect to the local webserver on tjener to provide easy access to all the administration programs

Note:: modifications to the profiles can be done using kiosktool. However, unless you follow the step below, your changes will be overwritten by upgrades. FIXME: this is broken and a bug should be filed: kiosktool upgrades restore default desktop icons

If you want to modify the kiosk profiles, you can either copy the existing ones and modify them, or create new kiosk profiles in (for example) /etc/kde3/kioskprofiles/ and enable them in /etc/kde-user-profile. The kiosk tool will do this for you if you click "profile properties" and browse to a new folder.


16.2. Changing kioskmode on diskless workstations

After you have made changes to the kioskmode settings with kiosktool like described above, you will have to copy some files inside the chroot used by the diskless workstation.

Assuming the diskless workstations are running i386, the following commands must be executed on the workstation server(s):

export LTSPCHROOT=/opt/ltsp/i386/
cp -rv /etc/kde-profile/ $LTSPCHROOT/etc/
cp -v /etc/kderc $LTSPCHROOT/etc/
cp -v /etc/kde-user-profile $LTSPCHROOT/etc/
unset LTSPCHROOT

Sinon, remplacez i386 par amd64 ou powerpc.


16.2.1. Désactiver le mode kiosque de KDE

Si vous ne souhaitez pas utilisez le mode kiosque, supprimez simplement le fichier /etc/kderc, ou, si vous souhaitez seulement le désactiver temporairement, mettez en commentaire toutes les entrées de ce fichier.


16.3. Modification de l'écran de connexion de kdm

Dans Debian/Etch, la manière de personnaliser l'écran de connexion de kdm a changé. Maintenant, ceci se fait en ajoutant dans /etc/default/kdm.d/ un fichier qui spécifie les variables surchargeant les valeurs par défaut.

Voici un exemple utilisé pour activer le thème du paquet desktop-base :

USETHEME="true"
THEME="/usr/share/apps/kdm/themes/debian-moreblue"

Consulter le code de /etc/init.d/kdm pour des informations concernant l'utilisation de ces variables.


16.4. Flash

The free software flash-player gnash is installed by default, but switching to Adobe Flash is an option. To install the (non-free) Adobe Flash Player web browser plugin, install the flashplugin-nonfree debian package from backports.org.

Ceci impose trois conditions :

  • add backports.org to /etc/apt/sources.list as decribed in the general adminstration howtos

  • ajouter les lignes suivantes à /etc/apt/preferences (ce fichier n'existe peut-être pas, vous devez alors le créer) :

Package: flashplugin-nonfree
Pin: release a=lenny-backports
Pin-priority: 999

  • comme le paquet flashplugin-nonfree n'est qu'un installateur (et ne contient pas le greffon lui-même, pour des raisons légales), il a besoin d'une connexion opérationnelle à l'internet afin de télécharger le fichier binaire pré-compilé du site web d'Adobe.


16.4.1. Sound with Flash on thin clients

Additionally to the flashplugin-nonfree package (see above) you just need to install the flashplayer-nonfree-extrasound package.


16.5. Lire des DVD

libdvdcss is needed for playing most commercial! DVDs. For legal reasons it's not included in Debian (Edu). If you are legally allowed to use it, you can use the packages from debian-multimedia.org. Add the multimedia repository (as described just below this paragraph) and install multimedia and dvd libraries:

apt-get install libdvdcss2 w32codecs

16.6. Utilisation du dépôt multimedia

Pour utiliser www.debian-multimedia.org, effectuez les opérations suivantes :

# install the debian-keyring securily:
apt-get install debian-keyring
# fetch the debian-multimedia key insecurily:
gpg --keyserver pgpkeys.pca.dfn.de --recv-keys 1F41B907
# check securily if the key is correct and add it to the keyring used by apt if it is:
gpg --keyring /usr/share/keyrings/debian-keyring.gpg --check-sigs 1F41B907 && gpg --export 1F41B907 | apt-key add -
# add repository to sources.list - please check the homepages for mirrors!
echo "deb http://debian-multimedia.org lenny main" >> /etc/apt/sources.list
# update the list of available packages:
apt-get update

16.7. Handwriting fonts

The package ttf-linex (which is installed by default) installs the font "Abecedario" which is a nice handwriting font for kids. The font has several forms to be used with kids: dotted, and with lines.


17. HowTos for networked clients

17.1. Introduction to Thin clients and Diskless workstations

One generic term for both thin clients and diskless workstations is LTSP client. LTSP is the Linux Terminal Server Project.

Thin client

A thin client setup enables a ordinary PC to function as an (X-)terminal, where all software runs on the LTSP server. This means that this machine boots from a diskette or directly from the server using network-PROM (or PXE) without using a local client hard drive.

Diskless workstation

A diskless workstation runs all software locally. The client machines boot direcly from the LTSP server without a local hard drive. Software is administered and maintained on the LTSP server, but it runs on the diskless workstation. Home directories and system settings are stored on the server too. Diskless workstations are an excellent way of reusing newer hardware with the same low maintanence cost as with thin clients.


17.1.1. Machine type selection based on the network

Each LTSP server has two ethernet cards, one is configured in the 10.0.2.0/23 subnet (which is shared with the main server) and another forming a local 192.168.0.0/24 subnet (this subnet is a seperate subnet for each LTSP server).

Diskless workstations get IP addresses assigned in the private subnet 10.0.2.0/23, while thin clients are connected in the seperate subnet 192.168.0.0/24.


17.1.2. Changing the PXE menu on an LTSP server

The PXE menu allows network booting of LTSP clients, the installer and other alternatives. The file /var/lib/tftpboot/pxelinux.cfg/default is used by default if no other file in that directory matches the client, and out of the box it is set to link to /var/lib/tftpboot/debian-edu/default-menu.cfg.

If one want all clients to boot as diskless workstations instead of getting the full PXE menu, this can be implemented by changing the symlink:

ln -s /var/lib/tftpboot/debian-edu/default-diskless.cfg /var/lib/tftpboot/pxelinux.cfg/default

If one want all clients to boot as thin clients instead, change the symlink like this:

ln -s /var/lib/tftpboot/debian-edu/default-thin.cfg /var/lib/tftpboot/pxelinux.cfg/default

See also the pxelinux documentation at http://syslinux.zytor.com/wiki/index.php/PXELINUX .

If one wants clients on the 192.168.x.x interface of a thin client server to boot as diskless workstations instead of thin clients, edit

/var/lib/tftpboot/ltsp/i386/pxelinux.cfg/default

and add a '3' (no quotes) to the end of the line. There is no need to add these workstations in lwat, saving you some work and some "staticxx" IP addresses (see below).


17.1.3. Separate main- and LTSP servers

For performace and security considerations it might be desired to set up a seperate main server which doesn't act as LTSP server.

To have ltspserver00 serve diskless workstations on the main (10.0.x.x) network, when tjener is not a combined server, one needs to follow these steps:

  • copy the ltsp directory from /var/lib/tftpboot from ltspserver00 to the same directory on tjener.

  • copy /var/lib/tftpboot/debian-edu/default-diskless.cfg to the same directory on tjener.

  • edit /var/lib/tftpboot/debian-edu/default-diskless.cfg to use the IP address of ltspserver00, the following example uses 10.0.2.10 (which is the default):

 DEFAULT ltsp/i386/vmlinuz initrd=ltsp/i386/initrd.img nfsroot=10.0.2.10:/opt/ltsp/i386 boot=nfs ro quiet 3

  • set the symlink in /var/lib/tftpboot/pxelinux.cfg on tjener to point to /var/lib/tftpboot/debian-edu/default-diskless.cfg.


17.1.4. How to extend the range of static IP addresses

Out of the box Debian Edu only has 50 static addresses available on the 10.0.2.0/23 network. To extend this to 90 addresses, you can do the following.

  1. Download ext_static.ldif. The LDIF makes the following changes to the LDAP catalog:

    • It changes the 10.0.2.0/23 dynamic DHCP range from 10.0.2.100-10.0.3.242 to 10.0.2.100-10.0.3.213

    • It deletes the DNS records for dhcp370 (10.0.3.214) to dhcp399 (10.0.3.243)

    • It adds DNS records for static50 (10.0.3.214) to static90 (10.0.3.244)

  2. Apply the changes described in ext_static.ldif:

ldapmodify -x -Z -W -D cn=admin,ou=People,dc=skole,dc=skolelinux,dc=no -f ext_static.ldif

When prompted, enter the LDAP admin password. You now have 40 extra static addresses, at the cost of 29 dynamic addresses.


17.2. LTSP en détail

17.2.1. lts.conf

To make special adaptations and configurations for specific thinclients, you can edit the file /opt/ltsp/i386/etc/lts.conf. Have a look at /opt/ltsp/i386/usr/share/doc/ltsp-client-core/examples/lts.conf to see some examples and see /usr/share/doc/ltsp-server/lts-parameters.txt.gz for all parameters you can specify.

Les valeurs par défaut son définies sous [default], pour configurer un client, spécifiez son adresse MAC ou son adresse IP de cette manière [192.168.0.10].

Exemple : pour régler la résolution du client léger ltsp010 sur 1280x1024, ajoutez quelque chose comme :

[192.168.0.10]
X_MODE_0 = 1280x1024
X_HORZSYNC = "60-70"
X_VERTREFRESH = "59-62"

quelque part sous les réglages par défaut.

Selon les modifications effectuées, il peut être nécessaire de redémarrer X sur le client (en pressant alt+ctrl+backspace) ou de redémarrer le client.

Pour utiliser les adresses IP de lts.conf, vous devrez ajouter l'adresse MAC du client à votre serveur DHCP. Sinon, vous devrez utiliser l'adresse MAC du client directement dans le fichier lts.conf.


17.2.2. Load balancing LTSP servers

17.2.2.1. Part 1

It is possible to set up the clients to connect to one of several servers for load balancing. This is done by providing /opt/ltsp/i386/usr/lib/ltsp/get_hosts as a script printing one or more servers for LDM to connect to. In addition to this, each ltsp chroot need to include the ssh host key for each of the servers.

First of all, you must choose one LTSP server to be the loadbalancing server. All the clients will PXE-boot from this server and load the Skolelinux image. After the image is loaded, LDM chooses which server to connect to by using the "get_hosts" script. How this is done you decide later on.

Now you have to move your clients from the 192.168.1.0 network to the 10.0.2.0 network. This is because when you use loadbalancing, the clients should have direct access to the server LDM chooses. If you leave your clients on the 192.168.1.0 network, all of the clients traffic will go through that server before it reaches the chosen LDM server.

To get the clients working on the 10.0.2.0 network, you have to edit /etc/dhcp3/dhcpd.conf on the main-server (tjener). Where it says:

FIXME: This need to be changed as DHCP configuration is in LDAP.

subnet 10.0.2.0 netmask 255.255.254.0 {
        range 10.0.2.100 10.0.3.242;
        }

you have to add this under "range":

filename "/var/lib/tftpboot/ltsp/i386/pxelinux.0";
next-server xxx;
option root-path "/opt/ltsp/i386";
option log-servers ltspserver01;
use-host-decl-names on;

Next-server should be the IP-address or hostname of the server you chose to be the loadbalancing server. If you use hostname you must have a working DNS. Remember to restart the dhcp service.


17.2.2.2. Part 2

Now you have to make a "get_hosts" script that prints a server for LDM to connect to. The parameter LDM_SERVER overrides this script. In consequence, this parameter must not be defined if the get_hosts is going to be used. The get_hosts script writes on the standard output each server IP address or host names, in the random order.

Edit "/opt/ltsp/i386/etc/lts.conf" and add something like this:

MY_SERVER_LIST = "xxxx xxxx xxxx"

Replace xxxx with either the IP or hostname of the servers, list must be space separated. Then, put the following script in /opt/ltsp/i386/usr/lib/ltsp/get_hosts on the server you chose to be the loadbalancing server.

# Randomize the server list contained in MY_SERVER_LIST parameter
TMP_LIST=""
SHUFFLED_LIST=""
for i in $MY_SERVER_LIST; do
rank=$RANDOM
let "rank %= 100"
TMP_LIST="$TMP_LIST\n${rank}_$i"
done
TMP_LIST=$(echo -e $TMP_LIST | sort)
for i in $TMP_LIST; do
SHUFFLED_LIST="$SHUFFLED_LIST $(echo $i | cut -d_ -f2)"
done
echo $SHUFFLED_LIST

17.2.2.3. Part 3

Now that you've made the "get_hosts" script, it's time to make the ssh host key for the ltsp chroots. This can be done by making a file containing the content of /opt/ltsp/i386/etc/ssh/ssh_known_hosts from all the ltsp servers that will be loadbalanced. Save this file as /etc/ltsp/ssh_known_hosts.extra on all loadbalance servers. The last step is very important because ltsp-update-sshkeys runs every time a server is booted, and /etc/ltsp/ssh_known_hosts.extra is included if it exists.

If you save your new host file as /opt/ltsp/i386/etc/ssh/ssh_known_hosts, it will be erased when you reboot the server.

There is some obvious weaknesses with this setup. All clients get their image from the same server, this causes high loads on the server if many clients are booted at the same time. Also the clients require that server to always be available, without it they cannot boot or get a LDM server. Therefore this setup is very dependent on one server, which isn't very good.

Your clients should now be loadbalanced!


17.2.3. Sound with LTSP clients

LTSP thin clients supports three different audio systems for applications, ESD, PulseAudio and ALSA. ESD and PulseAudio support networked audio and are used to pass audio from the server to the clients. ALSA is configured to redirect its sound via PulseAudio. For selected applications only supporting the OSS audio system, a wrapper is created by /usr/sbin/debian-edu-ltsp-audiodivert to redirect their sound to PulseAudio. Run this script without arguments to get a list of applications with such redirection enabled.

LTSP diskless workstations handle audio locally and have none of the special setup needed for networked audio.


17.2.4. Upgrading the LTSP environment

It is useful to upgrade the LTSP environment with new packages fairly often, to make sure security fixes and improvements are made available. To upgrade, run these commands as user root on each LTSP server:

chroot /opt/ltsp/i386
aptitude update
aptitude upgrade
aptitude dist-upgrade
exit

17.2.4.1. Installing additional software in the LTSP environment

To install additional software for LTSP client you must perform the installation inside the chroot of the LTSP server.

chroot /opt/ltsp/i386
## optionally, edit the sources.list:
#vim /etc/apt/sources.list
aptitude update
aptitude install $new_package
exit

17.2.5. Slow login and security

Skolelinux has added several security features on the client network preventing unauthorised super user access, stopping password sniffing and other tricks which may be used on a local network. One such security measures is secure login using ssh wich is default with LDM. This can slow down some client machines which are older than 10 years, having as little as 160 MHz processor and 32 MB RAM. Even if not recomended, you can add the "True" value in ...

LDM_DIRECTX=True

should be added to the server in the /opt/ltsp/i386/etc/lts.conf file.

Warning: Above protects initial login but all activities after that use unencrypted XDMCP. Passwords (except the initial one) will travel in cleartext over the network, as well as anything else.

Note: Since such 10 year old thin clients may also get trouble with running never versions of OpenOffice.org and Firefox/Iceweasel due to pixmap caching issues, you may consider running thin clients with at least 128 MB RAM, or upgrade to hardware, which will also give you the benefit of being able to use them as diskless workstations.


17.3. Replacing LDM with KDM

Skolelinux 3.0 is running LDM as a login manager. It uses a secure ssh tunnel to log in. When using KDM a switch to XDMCP is neccesary. XDMCP uses less CPU ressources on the clients and on the server.

Warning: XDMCP does not use encryption. Passwords will travel in cleartext over the network, as well as anything else.

Note: local devices with ltspfs will stop working without LDM.

To check if XDMCP is running, run this command from a workstation:

 X -query ltspserverXX

Si vous êtes sur le réseau de clients légers, veuillez lancer la commande suivante :

 X -query 192.168.0.254

L'objectif est de permettre à votre client léger « réel » de contacter le serveur xdmcp sur le réseau 192.168.0.254 (dans le cas d'une configuration standard de Skolelinux).

Si pour une raison quelconque, xdmcp est accessible depuis le serveur qui exécute KDM, veuillez ajouter ceci à /etc/kde3/kdm/Xaccess

 * # any host can get a login window

The star before the comment '#' is important, rest is a comment of course

Ensuite, lancez xdmcp dans kdm grâce à la commande :

 sudo update-ini-file /etc/kde3/kdm/kdmrc Xdmcp Enable true

À la fin, veuillez redémarrer kdm en lançant :

 sudo invoke-rc.d kdm restart

(in courtesy of Finn-Arne Johansen)


17.4. Connexion de machines Windows au réseau / intégration de Windows

17.4.1. Rejoindre le domaine

Les clients Windows peuvent rejoindre le domaine Windows « SKOLELINUX ». Un service spécial, nommé Samba, installé sur le serveur principal tjener, permet aux clients Windows d'enregistrer des profils et des données utilisateurs et authentifie les utilisateurs durant la phase de connexion.

Afin d'ajouter des clients Windows au domaine, quelques étapes sont nécessaires :

1. Créez un utilisateur appartenant au groupe « admins » (s'il n'en existe pas déjà un)

  • Afin d'être capable de rejoindre le domaine « SKOLELINUX », un membre du groupe admins doit autoriser le processus. S'il n'en existe encore aucun, un tel utilisateur doit être ajouté (pour plus d'informations, consulter <lien vers la documentation de lwat>). L'utilisateur « root » ne fonctionnera pas, car root n'a pas de mot de passe sous Samba.

2. Configurez les clients Windows en hôtes statiques

  • When joining a samba domain some special data is stored on the domain controller (tjener). This data is needed to recognize the Windows client later as being allowed to authenticate users. In order to enable Samba to store this data, Samba requires an static host configuration to be present. This could be added by using the LWAT web interface (see also <link to lwat>). When adding the static host configuration it is important to check the "Samba host" option, otherwise will lack the required data to be able to join the domain.

3. Sur les clients Windows : assurez-vous que le réseau et la configuration du système correspondent aux données enregistrées sur tjener (nom d'hôte et configuration IP).

  • Il est vraiment important que les hôtes Windows aient les mêmes données, sinon Samba ne trouvera pas l'hôte ajouté à l'étape 2.

4. Rejoignez le domaine comme d'habitude en utilisant l'utilisateur ajouté à l'étape 1.

  • Selon la version et la langue de votre installation Windows, vous trouverez la configuration du domaine ou du groupe de travail de votre système quelque part dans les propriétés du système. Un système Windows récemment installé devrait appartenir à un groupe de travail par défaut. Vous pouvez rejoindre le domaine en sélectionnant « Domaine » à la place de « Groupe de Travail » et en entrant le nouveau nom de domaine SKOLELINUX. À l'appui sur la touche Entrée, une nouvelle fenêtre s'ouvrira, où les données de connexion de l'utilisateur créé à l'étape 1. peuvent être saisies. Après quelque temps, le client Windows ouvrira une fenêtre surgissante affichant un message d'accueil. Après un redémarrage obligatoire, l'écran de connexion offrira la possibilité de se connecter au domaine.

Windows synchronisera le profil des utilisateurs du domaine à chaque connexion et déconnexion. Selon la quantité de données enregistrées dans le profil, ceci pourra prendre un peu de temps. Afin de réduire le temps nécessaire à cette opération, il est conseillé de désactiver certaines fonctionnalités, comme le cache local des navigateurs (à la place, vous pouvez utilisez le cache du mandataire squid installé sur tjener) et sauvegarder les fichiers dans le volume H: à la place de « Own files ».


17.4.1.1. Groupes utilisateurs dans Windows

Les groupes Samba (groupmaps) doivent aussi être ajoutés pour chaque groupes d'utilisateurs que vous ajoutez à l'aide de lwat. Si vous voulez que vos groupes utilisateurs soient disponibles sous Windows, par ex. pour des scripts netlogon ou d'autres actions relatives à des groupes, vous pouvez les ajouter par des commandes telles que ci-dessous. Samba fonctionnera sans ces groupes Samba, mais les machines Windows n'auront pas connaissances des groupes.

/usr/bin/net groupmap add unixgroup=students \
             type=domain ntgroup="students" \
             comment="All students in the school"

FIXME: should user groups in windows better be explained with lwat first, and then with an example for the command line?

If you want to check user groups on Windows, you need to download the tool IFMEMBER.EXE from Microsoft. Then you can use this for example in the logon script which resides on tjener in /etc/samba/netlogon/LOGON.BAT.


17.4.2. XP home

Les utilisateurs dont le portable est sous XP home peuvent toujours se connecter à tjener en utilisant leur compte Skolelinux, à condition que le groupe de travail soit SKOLELINUX. Cependant, ils devront peut-être désactiver le pare-feu de Windows pour que tjener apparaîsse dans le voisinage réseau (ou quel que soit son nom).


17.4.3. Gérer les profils itinérants

Les profils itinérants contiennent des données de l'environnement de travail des utilisateurs, ce qui comprend les données et la configuration du bureau. Des exemples de ces données d'environnement sont les fichiers personnels, les icônes et menus du bureau, les couleurs de l'écran, les réglages de la souris, la taille et la position des fenêtres, la configuration des applications et les connexions aux réseaux et aux imprimantes. Les profils itinérants sont disponibles quel que soit l'endroit d'où l'utilisateur se connecte, à condition que le serveur soit accessible.

Puisque le profil est copié depuis le serveur sur la machine durant la connexion, et copié de nouveau vers le serveur lors de la déconnexion, un profil volumineux peut rendre les connexions/déconnexions de Windows très lentes. Un profil peut être volumineux pour diverses raisons mais les problèmes les plus courants sont dus au fait que les utilisateurs sauvegardent leurs fichiers sur le bureau de Windows ou dans le répertoire « Mes Documents » et non dans leur répertoire personnel. Par ailleurs, certains programmes mal conçus utilisent le profil comme espace de travail temporaire ou pour enregistrer d'autres données.

L'approche éducative : une manière de gérer les profils volumineux consiste à expliquer la situation aux utilisateurs. Dites-leur de ne pas enregistrer de fichiers volumineux sur le bureau et s'ils ne vous écoutent pas, ils seront responsables du temps nécessaire à la connexion.

Ajustement du profil : une manière différente de gérer le problème consiste à supprimer des parties du profil, et de rediriger d'autres parties vers des modes courants de sauvegarde de fichiers. Ceci déplace la charge de travail des utilisateurs vers l'administrateur, en augmentant la complexité de l'installation. Il y a au moins trois manières de modifier les parties qui sont supprimées du profil itinérant.


17.4.3.1. Example smb.conf's for roaming profiles

Already delivered while installation, you can find an example smb.conf hopefully in your prefered language. You can find the config example files on your tjener under /usr/share/debian-edu-config/examples/. The source file is in English and is called smb-roaming-profiles-en.conf. If it is translated to German for example, it is named smb-roaming-profiles-de.conf. So if you search a file translated to your prefered language, look at the country code part in the filename. Inside the config file are a lot of explanations, so you should have a look at.


17.4.3.2. Utilisation des stratégies machine

Les stratégies machine peuvent être modifiées et copiées sur tous les autres ordinateurs.

  1. Sur un ordinateur disposant d'un Windows récemment installé, lancez gpedit.msc

  2. Sous la sélection Configuration utilisateur -> Modèles d'administration -> Système -> Profils utilisateur -> Exclure des répertoires dans les profils itinérants, vous pouvez entrer une suite de répertoires à exclure du profil séparés par des points-virgules ; les répertoires sont internationalisés et doivent être écrits dans votre propre langue, tels qu'ils le sont dans le profil. Exemples de répertoires à exclure :

    • log

    • Local settings

    • Temporary Internet Files

    • Mes Documents

    • Application Data

    • Temporary Internet Files

  3. Sauvegardez vos modifications et fermez l'éditeur.

  4. Copiez c:\windows\system32\GroupPolicy sur toutes les autres machines Windows.

    • Copier ce profil sur votre système de déploiement de Windows est une bonne idée afin d'en disposer au moment de l'installation.


17.4.3.3. Utilisation de stratégies globales

By using the legacy windows policy editor (poledit.exe), you can can create a Policy file (NTConfig.pol) file and put it in your netlogon share on tjener. This has the advantage of working almost instantly on all windows machines.

Since some time the policy editor standalone download has been removed from the Microsoft website, but it's still available as part of the ORK Tools.

With poledit.exe you can create .pol files. If you put such a file on tjener as /etc/samba/netlogon/NTLOGON.POL it will be read by the windows machine automatically and temporarily overwrite the registry, thus applying the changes.

To make sensible use of poledit.exe you also need to download appriate .adm files for your operating system and applications, otherwise you cannot define many settings in poledit.exe.

Be aware that the new group policy tools, gpedit.msc and gpmc.msc cannot create .pol files, they either only work for the local machine or need an active directory server.

If you understand german, http://gruppenrichtlinien.de is a very good website on this topic.


17.4.3.4. Édition du registre Windows

Vous pouvez éditer le registre de l'ordinateur local et copier cette clé de registre sur les autres ordinateurs

  1. Lancez l'éditeur de registre.

  2. Déplacez vous jusqu'à HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

  3. Utilisez le menu Édition->Nouveau->Valeur chaîne.

  4. Nommez le ExcludeProfileDirs

  5. Entrez une suite de chemins à exclure séparés par des points-virgules (de manière identique à la stratégie machine)

Maintenant, vous pouvez choisir d'exporter cette clé de registre sous la forme d'un fichier .reg. Sélectionnez-la, cliquez sur le bouton droit de la souris et sélectionnez exporter. Sauvegarder le fichier et vous pouvez double-cliquer dessus ou l'ajouter à un script pour le diffuser sur les autres machines.

Sources :


17.4.4. Redirection de parties du profil

Parfois, simplement supprimer le répertoire du profil n'est pas suffisant. Vous pouvez rencontrer le cas où des utilisateurs perdent des fichiers parce qu'ils enregistrent des données dans Mes Documents, alors que ce répertoire n'est pas sauvegardé dans les profils. Par ailleurs, vous pouvez souhaiter rediriger les répertoires d'applications mal programmées vers des répertoires partagés sur le réseau.


17.4.4.1. Utilisation des stratégies machine

Tout ce qui a été dit dans « Utilisation des stratégies machine » ci-dessus s'applique. Éditez en utilisant gpedit.msc et copiez la stratégie sur toutes les machines. La redirection devrait être disponible sous Configuration utilisateur -> Paramètres Windows -> Redirection de répertoires. Il peut être intéressant de rediriger Bureau et Mes Documents.

Rappelez-vous que si vous activez la redirection de répertoires, ceux-ci sont automatiquement ajoutés à la liste des répertoires synchronisés. Si vous ne le souhaitez pas, désactivez ce comportement dans

  • Configuration utilisateur -> Modèles d'administration -> Réseau -> Fichiers hors connexion

  • Configuration ordinateur -> Modèles d'administration -> Réseau -> Fichiers hors connexion


17.4.4.2. Utilisation de stratégies globales

FIXME explain how to use profiles from global policies for windows machines in the skolelinux network


17.4.5. Éviter les profils itinérants

17.4.5.1. Utilisation d'une stratégie locale

À l'aide des stratégies locales, vous pouvez désactiver le profil itinérant sur des machines individuelles. Ceci est souvent souhaité sur des machines spéciales, par exemple, sur des machines dédiées ou des machines dont la bande passante est faible.

Vous pouvez utiliser la méthode de la stratégie machine décrite plus haut, la clé se situe dans

  • Modèles d'administration -> Système -> Profils utilisateur -> Autoriser seulement les profils locaux


17.4.5.2. Utilisation de stratégies globales

FIXME: describe roaming profile key for the global policy editor here


17.4.5.3. modifier la configuration de samba

En éditant le fichier de configuration de samba, vous pouvez désactiver les profils d'itinérance pour l'ensemble du réseau. Peut-être tout le monde a-t-il sa machine dédié et personne n'a-t-il le droit d'y toucher ? Pour désactiver les profils d'itinérance pour tout le réseau, vous pouvez modifier le fichier smb.conf sur tjner, supprimer les variables de chemin de connexion et de répertoire personnel, et redémarrer samba.

logon path = ""
logon home = ""

17.5. Bureaux distants avec RDP, VNC, NX ou Citrix

Certaines municipalités fournissent une solution de bureau à distance afin que les étudiants et les professeurs puissent avoir accès à Skolelinux depuis leur ordinateur domestique fonctionnant sous Windows, Mac ou Linux.

  • RDP - la manière la plus simple d'accéder à un serveur de terminal Windows. Installer simplement le paquet rdesktop.

  • Les clients VNC (Virtual Network Computer) donnent accès à Skolelinux à distance. Installez simplement le paquet xvncviewer

  • Le client graphique NX permet aux étudiants et professeurs d'accéder à Skolelinux à distance depuis des PC sous Windows, Mac ou Linux. Une municipalité de Norvège fournit un support NX à tous ses étudiants depuis 2005. Elle rapporte que cette solution est stable.

  • Manuel du client Citrix ICA pour accéder à un serveur de terminal Windows depuis Skolelinux.


17.6. Manuels de wiki.debian.org

The HowTos from http://wiki.debian.org/DebianEdu/HowTo/ are either user- or developer-specific. Let's move the user-specific HowTos over here (and delete them over there)! (But first ask the authors (see the history of those pages to find them) if they are fine with moving the howto and putting it under the GPL.)


18. Manuels pour enseigner et apprendre

18.1. Moodle

Lancez aptitude install moodle en tant que root pour installer moodle.

Moodle est une plate-forme d'apprentissage en ligne (Course Management System, CMS) - un ensemble de logiciels libres conçus selon des principes pédagogiques, afin d'aider les éducateurs à créer des communautés d'apprentissage en ligne efficaces. Vous pouvez le télécharger et l'utiliser sur tous les ordinateurs à votre disposition (y compris un hôte web), il peut être utilisé sur un simple site géré par un professeur comme par une université de 200000 étudiants. Certains établissments français utilisent Moodle pour gérer les étudiants.

There are moodle sites all over the world, mostly concentrated in Europe and North America. Check the site of an institution near you to get an idea about it. More information is available at the moodle project page, including documentation and support.


18.2. Surveillance des élèves

Certaines écoles utilisent des outils de contrôle comme Controlaula ou Italc pour superviser leurs étudiants.

Take a look at their wiki: http://italc.sourceforge.net/wiki/index.php?title=Main_Page

FIXME: explain how to install and use italc - 511387 explains this quite well actually.

apt-get install italc-client italc-master

Warning: monitoring humans might be unethical and illegal in your jurisdiction.


18.3. Restreindre l'accès des élèves au réseau

Some schools use squidguard or dansguardian to restrict internet access. FIXME: explain how to install and use squidguard and/or dansguardian

Warning: restricting access to information or freedom of speech might be unethical and illegal in your jurisdiction.


18.4. Installing swi-prolog

swi-prolog was available in sarge, but was not part of etch, but it was possible to install the sarge version on etch. Lenny again ships swi-prolog so installing is very easy. Just apt-get install swi-prolog and be done


18.5. Manuels de wiki.debian.org

The HowTos from http://wiki.debian.org/DebianEdu/HowTo/ are either user- or developer-specific. Let's move the user-specific HowTos over here (and delete them over there)! (But first ask the authors (see the history of those pages to find them) if they are fine with moving the howto and putting it under the GPL.)


19. HowTos for users

19.1. Changing passwords

Every student should use the shorcut on their Desktop, which should point to something like https://ldap/lwat/chguserpw.php?username=$(id -un). (On Windows they have to manually put in their username.)

Using lwat to change their password, ensures that linux (userPassword) and samba (sabmaNTPassword and smbaLMPassword) passwords are the same.


19.2. Changing the sound volume

On local machines, which are workstations and LTSP servers, and diskless workstations, kmix works as usual. alsamixer can also be used to change the sound volume.

On thin clients, pavucontrol works, and so does alsamixer but kmix does not work at all.


19.3. Using email

Every user can send and receive mails within the internal network. The following paragraphs describe how to configure kmail for each user.

To be able to send and receive mails outside the internal network, the adminstrator needs to configure the mailserver exim4 according to the local situation, dpkg-reconfigure exim4-config is a good first step to do this.


19.3.1. Configuring KMail as a mail client

This needs to be done once by every user who wants to use email.

First, start KMail and skip the wizard ("Cancel"). Open the configuration-window and enter your identity (username and mail-address: username@postoffice.intern). Now move on to "Accounts" and there choose the "Sending"-tab. Add SMTP, host is "postoffice". default port 25. Do not forget to enter "postoffice.intern" as default domain and click "Apply". Send a mail to yourself (username@postoffice.intern) now to make sure your directory on the imap-server is created.

After that, add a new IMAP account under the "Receiving"-tab. Enter your username and password, the host is again "postoffice". Switch to the "Security"-tab and click on "Check What the Server Supports". Click "Continue" in the warning about the missing server certificate and accept that forever. Go back to the "General"-tab. Port should be 993 now. Click "Ok" and check if the mail to yourself is there.


20. Contribuer

20.1. Faites-vous connaître auprès de nous.

There are Debian Edu users all over the world. A very easy form of contribution is to let us know you exist and use Debian Edu - this motivates us very much and therefore is already a valuable contribution.

Le projet Debian Edu fournit une base de données des écoles et des utilisateurs du système afin d'aider ces derniers à s'identifier et d'avoir une idée de la localisation géographique de ceux-ci. Veuillez faire connaître votre installation en vous enregistrant dans cette base de données. Pour enregistrer votre école, utilisez ce formulaire web.


20.2. Contribuer localement

Currently there are local teams in Norway, Germany, the region of Extremadura in Spain, Taiwan and France. "Isolated" contributors and users exist in Greece, the Netherlands, Japan and elsewhere.

The support chapter explains and links to localized ressources, as contribute and support are two sides of the same coin.


20.3. Contribuer globalement

Au niveau international, nous sommes organisés en différentes équipes travaillant sur différents sujets.

The developer mailing list is most of the time our main medium for communication, though we have monthly meetings on IRC on #debian-edu on irc.debian.org and less frequently even real gatherings, where we meet each other in person. New contributors should read our http://wiki.debian.org/DebianEdu/ArchivePolicy.

Une bonne façon d'apprendre ce qui se passe dans le développement de Debian Edu consiste à s'inscrire à la liste de diffusion des livraisons.


20.4. Auteurs de la documentation et traducteurs

Ce document a besoin de votre aide ! Tout d'abord, il n'est pas encore terminé : si vous le lisez, vous remarquerez divers FIXME dans le texte. Si jamais vous connaissez (un peu) ce dont il est question, s'il-vous-plait, pensez à nous faire partager vos connaissances.

The source of the text is a wiki and can be edited with a simple webbrowser. Just go to http://wiki.debian.org/DebianEdu/Documentation/Lenny/ and you can contribute easily. Note: An user account is needed to edit the pages, you need to create a wiki user first.

Another very good way to contribute and to help users is by translating software and documentation. Information how to translate this document can be found in the translation chapter of this book. Please consider to help the translation effort of this book!


21. Support

21.1. Support fourni par des bénévoles

21.1.1. en anglais


21.1.2. en norvégien


21.1.3. en allemand


21.2. Support professionnel

Lists of companies providing professional support are available from http://wiki.debian.org/DebianEdu/Help/ProfessionalHelp.


22. Droits de reproduction et auteurs

This document is written and copyrighted by Holger Levsen (2007, 2008, 2009, 2010), Petter Reinholdtsen (2007, 2008, 2009, 2010), Daniel Heß (2007), Patrick Winnertz (2007), Knut Yrvin (2007), Ralf Gesellensetter (2007), Ronny Aasen (2007), Morten Werner Forsbring (2007), Bjarne Nielsen (2007, 2008) Nigel Barker (2007), José L. Redrejo Rodríguez (2007), John Bildoy (2007), Joakim Seeberg (2008), Jürgen Leibner (2009), Oded Naveh (2009), Philipp Hübner (2009, 2010) and Andreas Mundt (2010) and is released under the GPL2 or any later version. Enjoy!

If you add content to it, please only do so if you are the author. You need to release it under the same conditions! Then add your name here and release it under the GPL2 or later version.


23. Droits de reproduction et auteurs des traductions

The Spanish translation is copyrighted by José L. Redrejo Rodríguez (2007), Rafael Rivas (2009) and Norman Garcia (2010) and is released under the GPL2 or any later version.

The Bokmål translation is copyrighted by Petter Reinholdtsen (2007), Håvard Korsvoll (2007, 2008), Tore Skogly (2008), Ole-Anders Andreassen (2010) and Jan Roar Rød (2010) and is released under the GPL2 or any later version.

The German translation is copyrighted by Holger Levsen (2007), Patrick Winnertz (2007), Ralf Gesellensetter (2007, 2009), Roland F. Teichert (2007, 2008, 2009), Jürgen Leibner (2007), Ludger Sicking (2008), Kai Hatje (2008), Kurt Gramlich (2009), Franziska Teichert (2009), Philipp Hübner (2009) and Andreas Mundt (2009, 2010) and is released under the GPL2 or any later version.

The Italian translation is copyrighted by Claudio Carboncini (2007, 2008, 2009, 2010) and is released under the GPL2 or any later version.

The French translation is copyrighted by Christophe Masson (2008) and the French l10n team (2009) and is released under the GPL2 or any later version.

The Traditional Chinese translation is copyrighted by Andrew Lee (李健秋) (2009) and is released under the GPL2 or any later version.


24. Traductions de ce document

Fully translated versions of this document to German and Italian are available. Incomplete translations for Norwegian Bokmål, French, Spanish and Chinese exist, take a look for your language here.


24.1. Comment traduire ce document

As in many free software projects, translations of this document are kept in .po files. More information about the process can be found in /usr/share/doc/debian-edu-doc/README.debian-edu-lenny-manual-translations. The svn-repository (see below) contains this file too. Take a look there and at the language specific conventions if you want to help translating this document.

To commit your translations you need to be a member of the alioth project debian-edu. To translate, you just need to check out some files from from svn (which can be done anonymously) and create patches. Please file a bug against the debian-edu-doc package and attach the .po file to the bugreport. Find some instructions on how to submit bugs here.

Vous pouvez télécharger le source du paquet debian-edu-doc anonymement à l'aide de la commande suivante (vous devez avoir installé le paquet subversion pour cela) :

  • svn co svn://svn.debian.org/svn/debian-edu/trunk/src/debian-edu-doc

Then edit the documentation/debian-edu-lenny/debian-edu-lenny-manual.$CC.po (where you replace $CC with your language code). There are many tools for translating available, we suggest to use kbabel.

Then you either commit the file directly to svn (if you have the rights to do so) or send the file to the bugreport.

Pour mettre à jour votre copie locale du dépôt, utilisez la commande suivante dans le répertoire debian-edu-doc :

  • svn up

Read /usr/share/doc/debian-edu-doc/README.debian-edu-lenny-manual-translations to find information how to create a new .po file for your language if there is none yet, and how to update translations.

Basic information about Alioth (the host where our SVN repository is located) and SVN is available at http://wiki.debian.org/Alioth/Svn.

If you are new to SVN, look at the SVN book, it has a chapter on the basic workflow with SVN. Also you might want to look at he kdesvn package if you prefer a GUI client for SVN instead of using the commandline client.

Veuillez signaler tout problème.


25. Annexe A - La Licence Publique GNU

Note aux traducteurs : il n'est pas nécessaire de traduire le texte de la license GPL. 

25.1. Manual for Debian Edu 5.0r0+edu0 Codename "Lenny"

Copyright (C) 2007-2009 Holger Levsen < holger@layer-acht.org > and others, see the Copyright chapter for the full list of copyright owners.

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.


25.2. GNU GENERAL PUBLIC LICENSE

Version 2, June 1991

Copyright (C) 1989, 1991 Free Software Foundation, Inc. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.


25.3. TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you".

Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does.

1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program.

You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee.

2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions:

  • a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change.

    b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.

    c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.)

These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it.

Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program.

In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License.

3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:

  • a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

    b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

    c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.)

The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable.

If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code.

4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.

5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it.

6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License.

7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program.

If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances.

It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice.

This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License.

8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.

9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.

Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation.

10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally.

NO WARRANTY

11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.

12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.


26. Annexe B - À propos du live CD/DVD Debian Edu

Debian Edu Live CD/DVDs for Lenny are not available at the moment.


26.1. Fonctionnalités de l'image autonome

  • Presque tous les paquets du profil Autonome

  • Tous les paquets de la tâche portable

  • Le profil de bureau KDE pour étudiants/élèves.


26.2. Activation des traductions et du support géographique

Pour activer une traduction spécifique, amorcez en utilisant l'option locale=ll_CC.UTF-8, où ll_CC.UTF-8 est le code des paramètres régionaux souhaités. Pour activer une disposition de clavier spécifique, utilisez l'option keyb=KB, où KB est la disposition souhaitée. Davantage d'informations sur cette fonctionnalité sont disponibles dans la documentation du script de construction du live CD. Voici une liste de codes de paramètres régionaux couramment utilisés :

Langue (Région)

Code de paramètres régionaux

Disposition de clavier

Bokmal

nb_NO.UTF-8

no

Néo-norvégien

nn_NO.UTF-8

no

Allemand

de_DE.UTF-8

de

Français (France)

fr_FR.UTF-8

fr

Grec (Grèce)

el_GR.UTF-8

el

Japonais

ja_JP.UTF-8

jp

Sami (Norvège)

se_NO

no(smi)

Une liste complète des codes de paramètres régionaux est disponible dans /usr/share/i18n/SUPPORTED, mais seuls les paramètres régionaux UTF-8 sont supportés par les images live. Cependant, tous les paramètres régionaux ne disposent pas de traductions. Les noms de dispositions de clavier peuvent être trouvés dans /usr/share/keymaps/i386/.


26.3. Choses à savoir

  • Le mot de passe pour l'utilisateur est « user », root n'a pas de mot de passe défini.


26.4. Problèmes connus avec l'image

  • there are no lenny images yet


26.5. Téléchargement

The image is 1.2 GiB and currently NOT available using FTP, HTTP or rsync from ftp.skolelinux.org at cd-lenny-live/.