Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:debian-edu-config
User: [email protected]
Usertags: pu
This upload of debian-edu-config targets at making a release candidate
of Debian Edu based on trixie available (via D-I / debian-cd). Note that
Debian Edu 13 development has only started a few weeks back and Debian
Edu in trixie is currently totally non-functional. This upload is the
first step of getting Debian Edu 13 alive (again). (After having skipped
an official Debian Edu 12 release). Hence, the size of shipped changes.
[ Reason ]
Currently, Debian Edu 13 as found in 13.6 fails during installation via D-I:
https://openqa.debian.net/tests/566649#step/_graphical_wait_login/23
This backport of debian-edu-config to Debian trixie addresses that one
problem plus many other problems observed during Debian Edu development
over the past weeks, plus adding various features we'd like to see land
in Debian Edu 13.
Instead of cherry-picking individual fixes the Debian Edu team reached
the decision to propose an upload of debian-edu-config that provides
feature parity with debian-edu-config in Debian testing/unstable.
(Common practice also in previous years / release cycles).
[ Impact ]
No functional Debian Edu 13.
[ Tests ]
All fixes have been tested on Debian 14 (via openQA, manually)
and patch-by-patch on Debian Edu 13 machines. Whether everything
works at installation time will be revealed once we have the
Debian (Edu) 13.7 images for testing.
[ Risks ]
Minimal. Only for Debian Edu.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
```
--- debian-edu-config-2.12.903~deb13u1/debian/changelog 2025-09-15
09:09:50.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/debian/changelog 2026-09-07
10:58:57.000000000 +0200
@@ -1,8 +1,168 @@
-debian-edu-config (2.12.903~deb13u1) trixie; urgency=medium
+debian-edu-config (2.13.2~deb13u1) trixie; urgency=medium
- * Upload to trixie.
+ * Release to trixie.
- -- Mike Gabriel <[email protected]> Mon, 15 Sep 2025 09:09:50 +0200
+ -- Mike Gabriel <[email protected]> Mon, 07 Sep 2026 10:58:57 +0200
+
+debian-edu-config (2.13.2) unstable; urgency=medium
+
+ [ Serhii Horichenko ]
+ * share/debian-edu-config/tools/run-at-firstboot:
+ - Add an environment check to avoid starting the image creation on
+ an LTSP-client (Closes: #1092123).
+ - Add an ability to create a Diskless Workstation chroot and separate
+ the creation of an image on an LTSP-server without the Main-Server
+ role (Closes: #1092123).
+ [ Mike Gabriel ]
+ * sbin/debian-edu-ltsp-install:
+ - When creating a DLW, set PROFILE to 'Workstation' (Closes: #1092123).
+ * share/debian-edu-config/tools/kerberos-kdc-init:
+ - Don't hard-code master_key_type, use MIT/Kerberos' default. (Closes:
+ #1052962).
+ * Stop using killer script in Debian Edu. (Closes: #703710).
+ * cf3/cf.ldapclient:
+ - Ensure empty file /etc/netgroup exists. (Closes: #1146398).
+ * exim4/exim-ldap-{server,client}-v4.conf:
+ - Write logs to syslog. (Closes: #1051836).
+ * run-at-firstboot:
+ - Initialize first user's mailbox only when logging into Main-Server.
+
+ -- Mike Gabriel <[email protected]> Fri, 04 Sep 2026 23:35:24 +0200
+
+debian-edu-config (2.13.1) unstable; urgency=medium
+
+ [ Daniel Teichmann ]
+ * testsuite/ldap-server: Check /var/lib/ldap exists and is owned by
+ openldap:openldap. Regression check for Debian bug #1144741.
+ * debian/debian-edu-config.lintian-overrides: Fix stale reference. (Fixes
+ commit: 63575146)
+ * Drop unused wicd preconnect hook.
+ wicd is no longer in Debian. The hook was the only remaining wicd
+ integration and is not referenced anywhere else in the package.
+ * testsuite/hostname: escape regex dot and exit non-zero on failure.
+ The unescaped dot in the 'tjener.intern' grep matched any character.
+ Escape it so the FQDN check is exact. Both error paths now exit 1 so a
+ broken hostname fails the test instead of silently passing.
+ * share/debian-edu-config/d-i/pre-pkgsel: resolve leftover merge conflict.
+ * debian/control: Depend on iproute2
+ * testsuite/network: Stop using net-tools, use ip from iproute2 instead
+ * ldap-tools/ldap-debian-edu-install: Get MAC addresses via ip link instead
+ of ifconfig
+ * share/debian-edu-config/testsuite-lib.sh: Use ss instead of netstat
+ * testsuite/ldap-server: Use ss instead of netstat
+ * debian/control: Drop Depends: net-tools
+ * share/debian-edu-config/d-i/pre-pkgsel: Tighten hostname= parsing and
+ sanitization from /proc/cmdline.
+ Handle hostname= as first cmdline token, ignore empty values and
+ strip characters invalid in hostnames.
+ * share/debian-edu-config/d-i/pre-pkgsel: strip hyphens only when present.
+ Use 's/^-+//' / 's/-+$//' instead of '-*' so the substitution only
+ fires when there actually is a leading/trailing hyphen to remove.
+ * tools/create-debian-edu-certs: Switch root CA and server key generation
+ to ECDSA prime256v1.
+ RSA with 2048 bits is the bare minimum with OpenSSL 3. Replace
+ 'openssl genrsa' with 'openssl genpkey -algorithm EC' using the
+ prime256v1 (secp256r1 / NIST P-256) curve.
+ * tools/create-server-cert: Switch key generation to ECDSA prime256v1 and
+ drop keyEncipherment key usage
+ keyEncipherment is only meaningful for RSA keys. For ECDSA server
+ certificates only the digitalSignature key usage is applicable
+ (RFC 5480).
+ * v3.cnf: Drop keyEncipherment from server cert key usage
+ keyEncipherment is not applicable to ECDSA keys (RFC 5480), only
+ digitalSignature is required for TLS server certificates.
+
+ [ Mike Gabriel ]
+ * debian/control: Add to D: (debian-edu-config): procps. (Closes: #1136493).
+ * ldap-tools/ldap-debian-edu-install: Make sure interactions with debconf
+ are UTF-8 based.
+ This resolves GECOS field transliteration after having retrieved
+ debian-edu-config/first-user-fullname from the debconf db.
+ (Closes: #939717).
+ * share/debian-edu-config/d-i/pre-pkgsel: white-space cleanup
+ * share/debian-edu-config/d-i/pre-pkgsel: Use 'tjener' in /etc/hostname
+ and derive FQDN from /etc/hosts. (Closes: #893394).
+ * testsuite/hostname: Test that /etc/hostname on installation profile
+ Main-Server is set correctly
+ * cf3/cf.cfengine3: Stop cfengine3 service on all Debian Edu machines.
+ Esp. cf-execd (calling cf-agent command) clobbers the log on all Debian
+ Edu clients (Debian Edu 12 and onwards) and thus on syslog.intern (aka
+ tjener).
+ In Debian Edu, we use cfengine3 for managing configuration adjustments
+ via manual invocation of the cf-agent command, but we don't support
+ (yet?) to use cfengine3 for constant system management.
+ Partially addresses #1051834.
+ * sbin/debian-edu-ltsp-install: Use KERNEL_PARAMETERS variable, if we
+ define it
+ * sbin/debian-edu-ltsp-install: Fix variable interpretation in sed commands
+ ... by using double quotes, not single quotes.
+ * sbin/update-hostname-from-ip: white-space cleanup
+ * sbin/update-hostname-from-ip: Stop using net-tools, use ip command from
+ iproute2 instead
+ * share/debian-edu-config/d-i/pre-pkgsel: Support hostname override via
+ /proc/cmdline. (Closes: #1008597).
+
+ [ Wolfgang Schweer ]
+ * share/debian-edu-config/d-i/pre-pkgsel: Cleanup pre-pkgsel from cruft.
+ (Closes: #1055648).
+
+ [ Serhii Horichenko ]
+ * ltsp: Add 'quiet splash' to hide boot details on clients.
+ (Closes: #1065564).
+ * etc/nagios3/debian-edu/commands.cfg: Add key -l for check_apt to list
+ packages available for upgrade.
+
+ -- Mike Gabriel <[email protected]> Tue, 25 Aug 2026 21:18:07 +0200
+
+debian-edu-config (2.13.0) unstable; urgency=medium
+
+ [ Mike Gabriel ]
+ * sbin/debian-edu-fsautoresize:
+ - Avoid division by zero error on unused mountpoints.
+ * sbin/debian-edu-pxeinstall:
+ - Support overriding tasksel/desktop selection via mydesktop parameter in
+ /etc/debian-edu/pxeinstall.conf.
+ - Fix comment about mapping debconf template keywords to kernel cmdline
+ keywords and drop unused variable assignment.
+ - sbin/debian-edu-pxeinstall: Regression fix, only adjust desktop to
+ mydesktop from pxeinstall.conf if we are processing the tasksel/desktop
+ setting.
+ * share/debian-edu-config/tools/copy-host-keytab:
+ - Support SSH publickey login to tjener, if this is possible (e.g. if admin
+ is using SSH agent forwarding).
+
+ [ Daniel Teichmann ]
+ * Add new file 'debian-edu-router.ldif'. Empty proxy groups should be
+ installed on all new Tjeners.
+ * ldap-bootstrap/debian-edu-router.ldif: Add 'server-hosts' nisNetgroup
+ to 'proxy-trusted' nisNetgroup, via 'memberNisNetgroup' attribute.
+ * share/debian-edu-config/gosa.conf.template: Activate nisNetgroup tab
+ for user accounts.
+ * apache2 debian-edu-default.conf: Do not force HTTPS on *.crt (including
+ Debian-Edu_rootCA.crt).
+ (Closes: #1068388)
+ * etc/dovecot/local.conf: Fix passdb block syntax for Dovecot 2.4.x
+ compatibility.
+ * debian/control: Add 'Conflicts: firefox-esr-mobile-config'.
+ (Closes: #1126881)
+ * v3CA.cnf: Fix Root CA X.509v3 extensions for OpenSSL 3 compatibility.
+ * v3.cnf: Fix server cert X.509v3 extensions for OpenSSL 3 compatibility.
+ * tools/create-debian-edu-certs: Fix script to apply correct configurations.
+ * tools/create-server-cert: Add OpenSSL 3 extensions and fix base config.
+
+ -- Mike Gabriel <[email protected]> Sat, 23 May 2026 00:45:16 +0200
+
+debian-edu-config (2.12.904) unstable; urgency=medium
+
+ * share/glib-2.0/schemas/32-debian-edu.arctica-greeter.gschema.override:
+ + Drop file. This setting is theme-specific and should be shipped in
+ debian-edu-artwork-<THEME> if diverting from system defaults.
+ * cf3/:
+ + Support recognizing FAI based installations of Debian Edu systems (except
+ from main server).
+
+ -- Mike Gabriel <[email protected]> Mon, 15 Sep 2025 15:22:48 +0200
debian-edu-config (2.12.903) unstable; urgency=medium
```
[ Other info ]
Getting this package into trixie before the Debian 13.7 point release
will be highly appreciated!!!
diff -Nru debian-edu-config-2.12.903~deb13u1/cf3/cf.cfengine3
debian-edu-config-2.13.2~deb13u1/cf3/cf.cfengine3
--- debian-edu-config-2.12.903~deb13u1/cf3/cf.cfengine3 2023-09-27
22:34:54.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/cf3/cf.cfengine3 2026-09-07
10:58:26.000000000 +0200
@@ -4,7 +4,7 @@
services:
- debian.systemd.(server|ltspserver).installation::
+ debian.systemd.installation::
"cfengine3.service"
service_policy => "stop";
diff -Nru debian-edu-config-2.12.903~deb13u1/cf3/cf.finalize
debian-edu-config-2.13.2~deb13u1/cf3/cf.finalize
--- debian-edu-config-2.12.903~deb13u1/cf3/cf.finalize 2025-06-11
23:39:21.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/cf3/cf.finalize 2026-08-19
22:24:04.000000000 +0200
@@ -111,7 +111,7 @@
# used during an installation with Main server or LTSP server profile to
avoid
# broken network setup.
- debian.(server|ltspserver).lxqt.di.installation::
+ debian.(server|ltspserver).lxqt.(di|fai).installation::
"/usr/bin/apt-get purge -y connman"
contain => in_shell;
diff -Nru debian-edu-config-2.12.903~deb13u1/cf3/cf.grub
debian-edu-config-2.13.2~deb13u1/cf3/cf.grub
--- debian-edu-config-2.12.903~deb13u1/cf3/cf.grub 2022-02-11
16:47:45.000000000 +0100
+++ debian-edu-config-2.13.2~deb13u1/cf3/cf.grub 2026-08-19
22:24:04.000000000 +0200
@@ -7,24 +7,24 @@
files:
- debian.(standalone|roaming).di.installation::
+ debian.(standalone|roaming).(di|fai).installation::
"/etc/default/grub"
edit_line => grub_conf1;
- debian.workstation.!server.!standalone.!roaming.di.installation::
+ debian.workstation.!server.!standalone.!roaming.(di|fai).installation::
"/etc/default/grub"
edit_line => grub_conf2;
- debian.(server|minimal).di.installation::
+ debian.(server|minimal).(di|fai).installation::
"/etc/default/grub"
edit_line => grub_conf3;
commands:
- debian.di.installation::
+ debian.(di|fai).installation::
"/usr/sbin/update-grub"
contain => in_shell;
diff -Nru debian-edu-config-2.12.903~deb13u1/cf3/cf.ldapclient
debian-edu-config-2.13.2~deb13u1/cf3/cf.ldapclient
--- debian-edu-config-2.12.903~deb13u1/cf3/cf.ldapclient 2023-09-27
22:34:54.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/cf3/cf.ldapclient 2026-09-07
10:58:26.000000000 +0200
@@ -41,6 +41,10 @@
"/etc/nsswitch.conf"
edit_line => nsswitch_conf;
+
+ debian.installation::
+ "/etc/netgroup" create => "true";
+
}
bundle edit_line nsswitch_conf
diff -Nru debian-edu-config-2.12.903~deb13u1/cf3/cf.workarounds
debian-edu-config-2.13.2~deb13u1/cf3/cf.workarounds
--- debian-edu-config-2.12.903~deb13u1/cf3/cf.workarounds 2022-02-11
16:47:45.000000000 +0100
+++ debian-edu-config-2.13.2~deb13u1/cf3/cf.workarounds 2026-09-07
10:58:26.000000000 +0200
@@ -15,13 +15,4 @@
"$(gosa_file)"
create => "true";
-
- debian.ltspserver.installation::
-
- "/etc/cron.hourly/killer"
- delete => tidy;
-
- "/etc/cron.hourly/killer"
- copy_from => local_cp("/usr/share/debian-edu-config/killer.cron"),
- perms => mog("755","root","root");
}
diff -Nru debian-edu-config-2.12.903~deb13u1/cf3/edu.cf
debian-edu-config-2.13.2~deb13u1/cf3/edu.cf
--- debian-edu-config-2.12.903~deb13u1/cf3/edu.cf 2022-02-11
16:47:45.000000000 +0100
+++ debian-edu-config-2.13.2~deb13u1/cf3/edu.cf 2026-08-19 22:24:04.000000000
+0200
@@ -31,7 +31,9 @@
# Set if the Squid cache exists; used to conditionally link Debian Edu
configuration.
"squidcache" expression => isdir("/var/spool/squid");
# Set if running inside Debian Installer; used to avoid useless LDAP setup
upon main server upgrade.
- "di" expression =>
fileexists("/etc/apt/apt.conf.d/00IgnoreTimeConflict");
+ "di" expression =>
fileexists("/etc/apt/apt.conf.d/00IgnoreTimeConflict");
+ # Set if running inside FAI Installer; used to setup grub correctly
+ "fai" expression => isdir("/var/lib/fai/config");
# Set for networked workstation if the 'education-desktop-other' package
is installed.
"desktopintern" and => {
isdir("/usr/share/doc/education-desktop-other"),
isdir("/usr/share/doc/education-networked") };
# Set if xfce4 is installed; used to conditionally configure settings.
diff -Nru debian-edu-config-2.12.903~deb13u1/debian/changelog
debian-edu-config-2.13.2~deb13u1/debian/changelog
--- debian-edu-config-2.12.903~deb13u1/debian/changelog 2025-09-15
09:09:50.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/debian/changelog 2026-09-07
10:58:57.000000000 +0200
@@ -1,8 +1,168 @@
-debian-edu-config (2.12.903~deb13u1) trixie; urgency=medium
+debian-edu-config (2.13.2~deb13u1) trixie; urgency=medium
- * Upload to trixie.
+ * Release to trixie.
- -- Mike Gabriel <[email protected]> Mon, 15 Sep 2025 09:09:50 +0200
+ -- Mike Gabriel <[email protected]> Mon, 07 Sep 2026 10:58:57 +0200
+
+debian-edu-config (2.13.2) unstable; urgency=medium
+
+ [ Serhii Horichenko ]
+ * share/debian-edu-config/tools/run-at-firstboot:
+ - Add an environment check to avoid starting the image creation on
+ an LTSP-client (Closes: #1092123).
+ - Add an ability to create a Diskless Workstation chroot and separate
+ the creation of an image on an LTSP-server without the Main-Server
+ role (Closes: #1092123).
+
+ [ Mike Gabriel ]
+ * sbin/debian-edu-ltsp-install:
+ - When creating a DLW, set PROFILE to 'Workstation' (Closes: #1092123).
+ * share/debian-edu-config/tools/kerberos-kdc-init:
+ - Don't hard-code master_key_type, use MIT/Kerberos' default. (Closes:
+ #1052962).
+ * Stop using killer script in Debian Edu. (Closes: #703710).
+ * cf3/cf.ldapclient:
+ - Ensure empty file /etc/netgroup exists. (Closes: #1146398).
+ * exim4/exim-ldap-{server,client}-v4.conf:
+ - Write logs to syslog. (Closes: #1051836).
+ * run-at-firstboot:
+ - Initialize first user's mailbox only when logging into Main-Server.
+
+ -- Mike Gabriel <[email protected]> Fri, 04 Sep 2026 23:35:24 +0200
+
+debian-edu-config (2.13.1) unstable; urgency=medium
+
+ [ Daniel Teichmann ]
+ * testsuite/ldap-server: Check /var/lib/ldap exists and is owned by
+ openldap:openldap. Regression check for Debian bug #1144741.
+ * debian/debian-edu-config.lintian-overrides: Fix stale reference. (Fixes
+ commit: 63575146)
+ * Drop unused wicd preconnect hook.
+ wicd is no longer in Debian. The hook was the only remaining wicd
+ integration and is not referenced anywhere else in the package.
+ * testsuite/hostname: escape regex dot and exit non-zero on failure.
+ The unescaped dot in the 'tjener.intern' grep matched any character.
+ Escape it so the FQDN check is exact. Both error paths now exit 1 so a
+ broken hostname fails the test instead of silently passing.
+ * share/debian-edu-config/d-i/pre-pkgsel: resolve leftover merge conflict.
+ * debian/control: Depend on iproute2
+ * testsuite/network: Stop using net-tools, use ip from iproute2 instead
+ * ldap-tools/ldap-debian-edu-install: Get MAC addresses via ip link instead
+ of ifconfig
+ * share/debian-edu-config/testsuite-lib.sh: Use ss instead of netstat
+ * testsuite/ldap-server: Use ss instead of netstat
+ * debian/control: Drop Depends: net-tools
+ * share/debian-edu-config/d-i/pre-pkgsel: Tighten hostname= parsing and
+ sanitization from /proc/cmdline.
+ Handle hostname= as first cmdline token, ignore empty values and
+ strip characters invalid in hostnames.
+ * share/debian-edu-config/d-i/pre-pkgsel: strip hyphens only when present.
+ Use 's/^-+//' / 's/-+$//' instead of '-*' so the substitution only
+ fires when there actually is a leading/trailing hyphen to remove.
+ * tools/create-debian-edu-certs: Switch root CA and server key generation
+ to ECDSA prime256v1.
+ RSA with 2048 bits is the bare minimum with OpenSSL 3. Replace
+ 'openssl genrsa' with 'openssl genpkey -algorithm EC' using the
+ prime256v1 (secp256r1 / NIST P-256) curve.
+ * tools/create-server-cert: Switch key generation to ECDSA prime256v1 and
+ drop keyEncipherment key usage
+ keyEncipherment is only meaningful for RSA keys. For ECDSA server
+ certificates only the digitalSignature key usage is applicable
+ (RFC 5480).
+ * v3.cnf: Drop keyEncipherment from server cert key usage
+ keyEncipherment is not applicable to ECDSA keys (RFC 5480), only
+ digitalSignature is required for TLS server certificates.
+
+ [ Mike Gabriel ]
+ * debian/control: Add to D: (debian-edu-config): procps. (Closes: #1136493).
+ * ldap-tools/ldap-debian-edu-install: Make sure interactions with debconf
+ are UTF-8 based.
+ This resolves GECOS field transliteration after having retrieved
+ debian-edu-config/first-user-fullname from the debconf db.
+ (Closes: #939717).
+ * share/debian-edu-config/d-i/pre-pkgsel: white-space cleanup
+ * share/debian-edu-config/d-i/pre-pkgsel: Use 'tjener' in /etc/hostname
+ and derive FQDN from /etc/hosts. (Closes: #893394).
+ * testsuite/hostname: Test that /etc/hostname on installation profile
+ Main-Server is set correctly
+ * cf3/cf.cfengine3: Stop cfengine3 service on all Debian Edu machines.
+ Esp. cf-execd (calling cf-agent command) clobbers the log on all Debian
+ Edu clients (Debian Edu 12 and onwards) and thus on syslog.intern (aka
+ tjener).
+ In Debian Edu, we use cfengine3 for managing configuration adjustments
+ via manual invocation of the cf-agent command, but we don't support
+ (yet?) to use cfengine3 for constant system management.
+ Partially addresses #1051834.
+ * sbin/debian-edu-ltsp-install: Use KERNEL_PARAMETERS variable, if we
+ define it
+ * sbin/debian-edu-ltsp-install: Fix variable interpretation in sed commands
+ ... by using double quotes, not single quotes.
+ * sbin/update-hostname-from-ip: white-space cleanup
+ * sbin/update-hostname-from-ip: Stop using net-tools, use ip command from
+ iproute2 instead
+ * share/debian-edu-config/d-i/pre-pkgsel: Support hostname override via
+ /proc/cmdline. (Closes: #1008597).
+
+ [ Wolfgang Schweer ]
+ * share/debian-edu-config/d-i/pre-pkgsel: Cleanup pre-pkgsel from cruft.
+ (Closes: #1055648).
+
+ [ Serhii Horichenko ]
+ * ltsp: Add 'quiet splash' to hide boot details on clients.
+ (Closes: #1065564).
+ * etc/nagios3/debian-edu/commands.cfg: Add key -l for check_apt to list
+ packages available for upgrade.
+
+ -- Mike Gabriel <[email protected]> Tue, 25 Aug 2026 21:18:07 +0200
+
+debian-edu-config (2.13.0) unstable; urgency=medium
+
+ [ Mike Gabriel ]
+ * sbin/debian-edu-fsautoresize:
+ - Avoid division by zero error on unused mountpoints.
+ * sbin/debian-edu-pxeinstall:
+ - Support overriding tasksel/desktop selection via mydesktop parameter in
+ /etc/debian-edu/pxeinstall.conf.
+ - Fix comment about mapping debconf template keywords to kernel cmdline
+ keywords and drop unused variable assignment.
+ - sbin/debian-edu-pxeinstall: Regression fix, only adjust desktop to
+ mydesktop from pxeinstall.conf if we are processing the tasksel/desktop
+ setting.
+ * share/debian-edu-config/tools/copy-host-keytab:
+ - Support SSH publickey login to tjener, if this is possible (e.g. if admin
+ is using SSH agent forwarding).
+
+ [ Daniel Teichmann ]
+ * Add new file 'debian-edu-router.ldif'. Empty proxy groups should be
+ installed on all new Tjeners.
+ * ldap-bootstrap/debian-edu-router.ldif: Add 'server-hosts' nisNetgroup
+ to 'proxy-trusted' nisNetgroup, via 'memberNisNetgroup' attribute.
+ * share/debian-edu-config/gosa.conf.template: Activate nisNetgroup tab
+ for user accounts.
+ * apache2 debian-edu-default.conf: Do not force HTTPS on *.crt (including
+ Debian-Edu_rootCA.crt).
+ (Closes: #1068388)
+ * etc/dovecot/local.conf: Fix passdb block syntax for Dovecot 2.4.x
+ compatibility.
+ * debian/control: Add 'Conflicts: firefox-esr-mobile-config'.
+ (Closes: #1126881)
+ * v3CA.cnf: Fix Root CA X.509v3 extensions for OpenSSL 3 compatibility.
+ * v3.cnf: Fix server cert X.509v3 extensions for OpenSSL 3 compatibility.
+ * tools/create-debian-edu-certs: Fix script to apply correct configurations.
+ * tools/create-server-cert: Add OpenSSL 3 extensions and fix base config.
+
+ -- Mike Gabriel <[email protected]> Sat, 23 May 2026 00:45:16 +0200
+
+debian-edu-config (2.12.904) unstable; urgency=medium
+
+ * share/glib-2.0/schemas/32-debian-edu.arctica-greeter.gschema.override:
+ + Drop file. This setting is theme-specific and should be shipped in
+ debian-edu-artwork-<THEME> if diverting from system defaults.
+ * cf3/:
+ + Support recognizing FAI based installations of Debian Edu systems (except
+ from main server).
+
+ -- Mike Gabriel <[email protected]> Mon, 15 Sep 2025 15:22:48 +0200
debian-edu-config (2.12.903) unstable; urgency=medium
diff -Nru debian-edu-config-2.12.903~deb13u1/debian/control
debian-edu-config-2.13.2~deb13u1/debian/control
--- debian-edu-config-2.12.903~deb13u1/debian/control 2025-06-02
16:15:39.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/debian/control 2026-09-07
10:58:26.000000000 +0200
@@ -18,6 +18,7 @@
Package: debian-edu-config
Architecture: all
+Conflicts: firefox-esr-mobile-config,
Depends: ${misc:Depends},
adduser,
bind9-host,
@@ -30,6 +31,7 @@
education-tasks,
fping,
gnutls-bin,
+ iproute2,
iptables,
isenkram-cli,
ldap-utils,
@@ -49,10 +51,10 @@
lockfile-progs,
lsb-release,
media-types,
- net-tools,
ng-utils,
openssl,
patch,
+ procps,
python3,
python3-notify2,
ssl-cert,
diff -Nru
debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.cron.daily
debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.cron.daily
--- debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.cron.daily
2023-09-27 22:34:54.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.cron.daily
2026-09-07 10:58:26.000000000 +0200
@@ -9,3 +9,8 @@
if [ -x
/usr/libexec/debian-edu-config/debian-edu-cups-queue-autoflush-for-netgroup-hosts
]; then
exec
/usr/libexec/debian-edu-config/debian-edu-cups-queue-autoflush-for-netgroup-hosts
fi
+
+# regularly update Apache2 TJENER alias map if the script is present
+if [ -x
/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases ]; then
+ exec
/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases
+fi
diff -Nru
debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service
debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service
---
debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service
1970-01-01 01:00:00.000000000 +0100
+++
debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service
2026-09-07 10:58:26.000000000 +0200
@@ -0,0 +1,6 @@
+[Unit]
+Description=Update Apache2 TJENER alias map at
/usr/share/debian-edu-config/apache2_tjener-aliases.map
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases
diff -Nru
debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer
debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer
---
debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer
1970-01-01 01:00:00.000000000 +0100
+++
debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer
2026-09-07 10:58:26.000000000 +0200
@@ -0,0 +1,9 @@
+[Unit]
+Description=Run debian-edu-apache2-update-tjener-aliases.service 15 minutes
after boot and then once a day.
+
+[Timer]
+OnBootSec=15min
+OnUnitActiveSec=1d
+
+[Install]
+WantedBy=timers.target
diff -Nru
debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.lintian-overrides
debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.lintian-overrides
---
debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.lintian-overrides
2023-09-27 22:34:54.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.lintian-overrides
2026-09-07 10:58:26.000000000 +0200
@@ -1,5 +1,5 @@
debian-edu-config: non-standard-apache2-configuration-name
debian-edu-config-doc.conf != debian-edu-config.conf
[etc/apache2/conf-available/debian-edu-config-doc.conf]
-debian-edu-config: debconf-is-not-a-registry
[usr/bin/ldap-debian-edu-install:12]
+debian-edu-config: debconf-is-not-a-registry
[usr/bin/ldap-debian-edu-install:15]
debian-edu-config: debconf-is-not-a-registry
[usr/share/debian-edu-config/d-i/finish-install:10]
debian-edu-config: debconf-is-not-a-registry
[usr/share/debian-edu-config/d-i/pre-pkgsel:9]
debian-edu-config: debconf-is-not-a-registry
[usr/share/debian-edu-config/tools/edu-icinga-setup:24]
diff -Nru
debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.maintscript
debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.maintscript
--- debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.maintscript
2024-02-01 10:51:20.000000000 +0100
+++ debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.maintscript
2026-09-07 10:58:26.000000000 +0200
@@ -4,3 +4,4 @@
dir_to_symlink /etc/debian-edu/host-keytabs /var/lib/debian-edu/host-keytabs
2.12.18~
rm_conffile /etc/init.d/fetch-ldap-cert 2.12.34~
rm_conffile /etc/dhcp/dhclient-exit-hooks.d/fetch-ldap-cert 2.12.44~
+rm_conffile /etc/wicd/scripts/preconnect/set_wireless_mac_from_eth0 2.13.1~
diff -Nru debian-edu-config-2.12.903~deb13u1/debian/rules
debian-edu-config-2.13.2~deb13u1/debian/rules
--- debian-edu-config-2.12.903~deb13u1/debian/rules 2023-09-27
22:34:54.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/debian/rules 2026-09-07
10:58:26.000000000 +0200
@@ -23,6 +23,7 @@
dh_installsystemd --no-start --name firefox-ldapconf
dh_installsystemd --no-start --name debian-edu-fsautoresize
dh_installsystemd --no-start --name debian-edu-update-netblock
+ dh_installsystemd --no-start --name
debian-edu-apache2-update-tjener-aliases
dh_installsystemd --no-start --name debian-edu-cups-queue-autoflush
dh_installsystemd --no-start --name debian-edu-cups-queue-autoreenable
diff -Nru
debian-edu-config-2.12.903~deb13u1/etc/apache2/sites-available/debian-edu-default.conf
debian-edu-config-2.13.2~deb13u1/etc/apache2/sites-available/debian-edu-default.conf
---
debian-edu-config-2.12.903~deb13u1/etc/apache2/sites-available/debian-edu-default.conf
2025-09-04 13:14:42.000000000 +0200
+++
debian-edu-config-2.13.2~deb13u1/etc/apache2/sites-available/debian-edu-default.conf
2026-09-07 10:58:26.000000000 +0200
@@ -1,14 +1,37 @@
<VirtualHost *:80>
- ServerName www.intern
+ ServerName www.intern
ServerAdmin [email protected]
DocumentRoot /etc/debian-edu/www/
+# ---- <TJENER-alias redirect logic> ----
+ UseCanonicalName On
+
+ RewriteEngine On
+ RewriteMap tjeneralias
"txt:/usr/share/debian-edu-config/apache2_tjener-aliases.map"
+
+ # 1. Exclusions: Skip the redirect rules entirely for wpad.dat and
Debian-Edu_rootCA.crt
+ RewriteCond %{REQUEST_URI} \.(?:dat|crt)$ [NC]
+ RewriteRule ^ - [L]
+
+ # 2. Check if the requested HTTP Host matches Edu IP subnet e.g.
10.x.x.x/8 subnet..
+ # NOTE: Single IPs should be part of the TJENER alias map.
+ # NOTE: .999.999 is technically possible, but harmless.
+ RewriteCond %1 ^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$ [OR]
+
+ # 3. Path A (The Happy Path): HTTP Host is a known TJENER alias
+ # We strip the port, check the map. If it matches, redirect
preserving the requested name.
+ RewriteCond %{HTTP_HOST} ^([^:]+)
+ RewriteCond ${tjeneralias:%1|DENY} ^ALLOW$ [NC]
+ RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
+
+ # 4. Path B (The Fallback): HTTP Host is not a known TJENER alias
+ # If the request makes it past Rule 3 without triggering the [L]
flag,
+ # it means the name was not in the map. We safely redirect to the
static ServerName.
+ RewriteRule ^(.*)$ https://%{SERVER_NAME}/$1 [R=301,L]
+# ---- </TJENER-alias redirect logic> ----
+
<Directory /etc/debian-edu/www/ >
- RewriteEngine On
- RewriteCond %{SERVER_PORT} 80
- RewriteCond %{REQUEST_URI} !\.dat$
- RewriteRule ^(.*)$ https://%{SERVER_ADDRESS}/$1 [R=301,L]
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Require all granted
@@ -30,20 +53,20 @@
CustomLog /var/log/apache2/access.log combined
ServerSignature On
- Alias /doc/ "/usr/share/doc/"
- <Directory "/usr/share/doc/">
- Options Indexes MultiViews FollowSymLinks
- AllowOverride None
+ Alias /doc/ "/usr/share/doc/"
+ <Directory "/usr/share/doc/">
+ Options Indexes MultiViews FollowSymLinks
+ AllowOverride None
Require all denied
- Allow from 127.0.0.0/255.0.0.0 ::1/128
- </Directory>
+ Allow from 127.0.0.0/255.0.0.0 ::1/128
+ </Directory>
- # add alias for munin, though it should really be handled by munin itself,
- # rather than assuming /var/www is the defaultroot..
- Alias /munin "/var/cache/munin/www/"
- <Directory /var/cache/munin/www/ >
+ # add alias for munin, though it should really be handled by munin
itself,
+ # rather than assuming /var/www is the defaultroot..
+ Alias /munin "/var/cache/munin/www/"
+ <Directory /var/cache/munin/www/ >
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Require all granted
- </Directory>
+ </Directory>
</VirtualHost>
diff -Nru debian-edu-config-2.12.903~deb13u1/etc/dovecot/local.conf
debian-edu-config-2.13.2~deb13u1/etc/dovecot/local.conf
--- debian-edu-config-2.12.903~deb13u1/etc/dovecot/local.conf 2025-06-13
09:58:17.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/etc/dovecot/local.conf 2026-09-07
10:58:26.000000000 +0200
@@ -7,8 +7,12 @@
mail_driver = maildir
mail_path = ~/Maildir
mail_inbox_path = /var/mail/%u
-passdb {
- args = uid=uid home=homeDirectory
- driver = static
+
+passdb static {
+ fields {
+ uid = uid
+ home = homeDirectory
+ }
}
+
protocols = "imap"
diff -Nru debian-edu-config-2.12.903~deb13u1/etc/exim4/exim-ldap-client-v4.conf
debian-edu-config-2.13.2~deb13u1/etc/exim4/exim-ldap-client-v4.conf
--- debian-edu-config-2.12.903~deb13u1/etc/exim4/exim-ldap-client-v4.conf
2023-09-27 22:34:54.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/etc/exim4/exim-ldap-client-v4.conf
2026-09-07 10:58:26.000000000 +0200
@@ -17,6 +17,9 @@
# constant warning messages in the log file
keep_environment =
+# Send log messages to syslog
+log_file_path = syslog
+
# These options specify the Access Control Lists (ACLs) that
# are used for incoming SMTP messages - after the RCPT and DATA
# commands, respectively.
diff -Nru debian-edu-config-2.12.903~deb13u1/etc/exim4/exim-ldap-server-v4.conf
debian-edu-config-2.13.2~deb13u1/etc/exim4/exim-ldap-server-v4.conf
--- debian-edu-config-2.12.903~deb13u1/etc/exim4/exim-ldap-server-v4.conf
2025-06-02 10:30:33.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/etc/exim4/exim-ldap-server-v4.conf
2026-09-07 10:58:26.000000000 +0200
@@ -17,6 +17,9 @@
# from 'check_local_user' directive instead.
# -- Wolfgang Schweer <[email protected]>, 2020-06-27.
+# Send log messages to syslog
+log_file_path = syslog
+
##
keep_environment = KRB5_KTNAME : PWD : ^LDAP
tls_advertise_hosts = *
diff -Nru
debian-edu-config-2.12.903~deb13u1/etc/nagios3/debian-edu/commands.cfg
debian-edu-config-2.13.2~deb13u1/etc/nagios3/debian-edu/commands.cfg
--- debian-edu-config-2.12.903~deb13u1/etc/nagios3/debian-edu/commands.cfg
2015-03-20 13:49:11.000000000 +0100
+++ debian-edu-config-2.13.2~deb13u1/etc/nagios3/debian-edu/commands.cfg
2026-09-07 10:58:26.000000000 +0200
@@ -42,7 +42,7 @@
define command{
command_name check_apt
-command_line /usr/lib/nagios/plugins/check_apt
+command_line /usr/lib/nagios/plugins/check_apt -l
}
define command{
diff -Nru
debian-edu-config-2.12.903~deb13u1/etc/wicd/scripts/preconnect/set_wireless_mac_from_eth0
debian-edu-config-2.13.2~deb13u1/etc/wicd/scripts/preconnect/set_wireless_mac_from_eth0
---
debian-edu-config-2.12.903~deb13u1/etc/wicd/scripts/preconnect/set_wireless_mac_from_eth0
2015-03-20 13:49:11.000000000 +0100
+++
debian-edu-config-2.13.2~deb13u1/etc/wicd/scripts/preconnect/set_wireless_mac_from_eth0
1970-01-01 01:00:00.000000000 +0100
@@ -1,24 +0,0 @@
-#!/bin/sh
-#
-# Make sure wifi MAC is the same as wired MAC, to get DHCP to work with
-# static assignment.
-
-set -e
-
-PATH=/sbin:$PATH
-export PATH
-
-iface_mac() {
- IF="$1"
- LC_ALL=C ifconfig $IF | grep HWa | cut -c39-55
-}
-
-MAC1=$(iface_mac eth0)
-MACW0=$(iface_mac wlan0)
-if [ "$MACW0" ] ; then
- logger -t wicd/set_wireless_mac_from_eth0 \
- "changing MAC address of wlan0 from $MACW0 to $MAC1"
- ifconfig wlan0 down
- ifconfig wlan0 hw ether $MAC1
- ifconfig wlan0 up
-fi
diff -Nru
debian-edu-config-2.12.903~deb13u1/ldap-bootstrap/debian-edu-router.ldif
debian-edu-config-2.13.2~deb13u1/ldap-bootstrap/debian-edu-router.ldif
--- debian-edu-config-2.12.903~deb13u1/ldap-bootstrap/debian-edu-router.ldif
1970-01-01 01:00:00.000000000 +0100
+++ debian-edu-config-2.13.2~deb13u1/ldap-bootstrap/debian-edu-router.ldif
2026-09-07 10:58:26.000000000 +0200
@@ -0,0 +1,37 @@
+dn: cn=proxy-trusted,ou=netgroup,dc=skole,dc=skolelinux,dc=no
+objectClass: top
+objectClass: nisNetgroup
+cn: proxy-trusted
+description: Completely unfiltered internet access (+ bypasses NAT/T-P-M) -
ProxyTrusted{User,Client} - Debian Edu Router Plugin: Content filter
+# This should enable direct unNAT'ted (bypasses transparent-proxy-mode)
internet access to all internal servers in the Debian Edu network.
+memberNisNetgroup: server-hosts
+
+dn: cn=proxy-allow,ou=netgroup,dc=skole,dc=skolelinux,dc=no
+objectClass: top
+objectClass: nisNetgroup
+cn: proxy-allow
+description: Generally unfiltered internet access - ProxyAllow{User,Client} -
Debian Edu Router Plugin: Content filter
+
+dn: cn=proxy-deny,ou=netgroup,dc=skole,dc=skolelinux,dc=no
+objectClass: top
+objectClass: nisNetgroup
+cn: proxy-deny
+description: Disables internet access completely - ProxyDeny{User,Client} -
Debian Edu Router Plugin: Content filter
+
+dn: cn=proxy-blacklist,ou=netgroup,dc=skole,dc=skolelinux,dc=no
+objectClass: top
+objectClass: nisNetgroup
+cn: proxy-blacklist
+description: Allows all but specific blacklisted websites -
ProxyBlacklist{User,Client} - Debian Edu Router Plugin: Content filter
+
+dn: cn=proxy-whitelist,ou=netgroup,dc=skole,dc=skolelinux,dc=no
+objectClass: top
+objectClass: nisNetgroup
+cn: proxy-whitelist
+description: Allows nothing but specific whitelisted websites -
ProxyWhitelist{User,Client} - Debian Edu Router Plugin: Content filter
+
+dn: cn=proxy-noauth-client,ou=netgroup,dc=skole,dc=skolelinux,dc=no
+objectClass: top
+objectClass: nisNetgroup
+cn: proxy-noauth-client
+description: Fully disable auth. for these clients (BYOD Clients) -
ProxyNoauthClient - Debian Edu Router Plugin: Content filter
diff -Nru debian-edu-config-2.12.903~deb13u1/ldap-tools/ldap-debian-edu-install
debian-edu-config-2.13.2~deb13u1/ldap-tools/ldap-debian-edu-install
--- debian-edu-config-2.12.903~deb13u1/ldap-tools/ldap-debian-edu-install
2023-09-27 22:34:54.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/ldap-tools/ldap-debian-edu-install
2026-09-07 10:58:26.000000000 +0200
@@ -1,6 +1,9 @@
#!/bin/bash
set -e
+# Assure that interactions with debconf database are UTF-8 interactions.
+export LANG=C.UTF-8
+
# This script is run during installation of the main server inside Debian
Installer.
# Don't ever use it manually! You will definitely ruin your main server!
@@ -111,7 +114,7 @@
################# password available now ##################
lookup_mac_addrs() {
- PATH=/sbin:$PATH LANG=C ifconfig 2>/dev/null | grep -i hwaddr | awk
'{print $5}' | sort -u
+ LANG=C ip link | awk '/link\/ether/ { print $2 }' | sort -u
}
slapd_stop() {
@@ -282,7 +285,8 @@
/etc/ldap/gosa-server.ldif \
/etc/ldap/ltsp.ldif \
/etc/ldap/firstuser.ldif \
- /etc/ldap/krb5.ldif
+ /etc/ldap/krb5.ldif \
+ /etc/ldap/debian-edu-router.ldif
do
if cat $ldif | sed -e "s:\$ROOTPWDHASH:$ROOTPWDHASH:" \
-e "s/\$MAC/$MAC/" \
diff -Nru
debian-edu-config-2.12.903~deb13u1/libexec/debian-edu-apache2-update-tjener-aliases
debian-edu-config-2.13.2~deb13u1/libexec/debian-edu-apache2-update-tjener-aliases
---
debian-edu-config-2.12.903~deb13u1/libexec/debian-edu-apache2-update-tjener-aliases
1970-01-01 01:00:00.000000000 +0100
+++
debian-edu-config-2.13.2~deb13u1/libexec/debian-edu-apache2-update-tjener-aliases
2026-09-07 10:58:26.000000000 +0200
@@ -0,0 +1,219 @@
+#!/bin/bash
+#
+# Author: Daniel 'dzatoah' Teichmann <[email protected]>
+# Date: 2026-03-21
+# License: GNU General Public License v2 or later (GPL-2+)
+#
+
+# =============================================================================
+# Queries LDAP for cNAMERecord entries under the Debian Edu DNS zone and
+# smartly merges them into the Apache2 TJENER alias map file.
+#
+# Usage:
/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases
+# =============================================================================
+
+set -euo pipefail
+
+# -----------------------------------------------------------------------------
+# Configuration
+# -----------------------------------------------------------------------------
+SCRIPT_PATH="/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases"
+MAP_FILE="/usr/share/debian-edu-config/apache2_tjener-aliases.map"
+BACKUP_DIR="/var/backups/apache2-tjener-aliases"
+LDAP_BASE="relativeDomainName=tjener,zoneName=intern,cn=tjener,ou=servers,ou=systems,dc=skole,dc=skolelinux,dc=no"
+LDAP_OPTS="-x"
+LOG_TAG="update-apache2-tjener-aliases"
+
+# Debian Edu default hostnames (short + .intern variants) — always included
+# in the auto-generated block regardless of LDAP output.
+DEBIAN_EDU_DEFAULTS=(
+ "www" "www.intern"
+ "tjener" "tjener.intern"
+ "ldap" "ldap.intern"
+)
+
+# -----------------------------------------------------------------------------
+# Helpers
+# -----------------------------------------------------------------------------
+log() { logger -t "$LOG_TAG" "$*"; echo "[$(date '+%F %T')] $*"; }
+die() { log "ERROR: $*"; exit 1; }
+
+# -----------------------------------------------------------------------------
+# Sanity checks
+# -----------------------------------------------------------------------------
+command -v ldapsearch >/dev/null 2>&1 || die "ldapsearch not found. Install
ldap-utils."
+[[ -d "$(dirname "$MAP_FILE")" ]] || die "Target directory does not exist:
$(dirname "$MAP_FILE")"
+
+# -----------------------------------------------------------------------------
+# Backup existing map file
+# -----------------------------------------------------------------------------
+mkdir -p "$BACKUP_DIR"
+if [[ -f "$MAP_FILE" ]]; then
+ BACKUP_FILE="$BACKUP_DIR/apache2_tjener-aliases.map.$(date
'+%Y%m%d_%H%M%S')"
+ cp "$MAP_FILE" "$BACKUP_FILE"
+ log "Backed up existing map to: $BACKUP_FILE"
+
+ # Prune backups older than 30 days
+ find "$BACKUP_DIR" -name "apache2_tjener-aliases.map.*" -mtime +30 -delete
+fi
+
+# -----------------------------------------------------------------------------
+# Parse HAND-EDIT block from existing file (preserve user additions)
+# -----------------------------------------------------------------------------
+HAND_EDIT_BLOCK=""
+if [[ -f "$MAP_FILE" ]]; then
+ # Extract everything from the HAND-EDIT marker to end of file
+ HAND_EDIT_BLOCK=$(awk '/^# ----- IMPORTANT HAND-EDIT ADDITIONS
-----/{found=1} found{print}' "$MAP_FILE")
+fi
+
+# If there was no hand-edit block yet, use the default placeholder
+if [[ -z "$HAND_EDIT_BLOCK" ]]; then
+ HAND_EDIT_BLOCK='# ----- IMPORTANT HAND-EDIT ADDITIONS -----
+# If a user browses to the raw IP and it is not here, it will trigger a 302
+# response to a pre-defined server name.
+# Add any other IP addresses assigned to Tjeners interfaces:
+# 192.168.0.1 ALLOW'
+fi
+
+# -----------------------------------------------------------------------------
+# Query LDAP for cNAMERecord entries
+# -----------------------------------------------------------------------------
+log "Querying LDAP for cNAMERecord entries..."
+LDAP_OUTPUT=$(ldapsearch $LDAP_OPTS -b "$LDAP_BASE" 2>&1) \
+ || die "ldapsearch failed: $LDAP_OUTPUT"
+
+# Parse relativeDomainName values that have a cNAMERecord attribute.
+# Strategy: track the current relativeDomainName per stanza; only emit it
+# if a cNAMERecord line is also present in the same stanza.
+mapfile -t LDAP_CNAMES < <(
+ awk '
+ /^$/ { if (has_cname && rdn != "" && rdn != "tjener") print rdn;
rdn=""; has_cname=0; next }
+ /^relativeDomainName:/ { rdn=$2 }
+ /^cNAMERecord:/ { has_cname=1 }
+ END { if (has_cname && rdn != "" && rdn != "tjener") print rdn }
+ ' <<< "$LDAP_OUTPUT" | sort -u
+)
+
+log "LDAP returned ${#LDAP_CNAMES[@]} cNAME entries: ${LDAP_CNAMES[*]:-<none>}"
+
+# -----------------------------------------------------------------------------
+# Build the de-duplicated LDAP-only section
+# (skip anything already in the Debian Edu defaults block)
+# -----------------------------------------------------------------------------
+
+# Build a lookup set of already-covered hostnames (short names only)
+declare -A COVERED
+for h in "${DEBIAN_EDU_DEFAULTS[@]}"; do
+ # Strip .intern suffix for comparison
+ short="${h%.intern}"
+ COVERED["$short"]=1
+done
+# Also mark static entries
+for h in localhost tjener; do COVERED["$h"]=1; done
+
+LDAP_EXTRA_LINES=()
+for cname in "${LDAP_CNAMES[@]}"; do
+ if [[ -z "${COVERED[$cname]+_}" ]]; then
+ LDAP_EXTRA_LINES+=("$cname")
+ COVERED["$cname"]=1
+ fi
+done
+
+# -----------------------------------------------------------------------------
+# Format helper: pad hostname to column 20 then append ALLOW
+# -----------------------------------------------------------------------------
+fmt_allow() {
+ printf "%-20s ALLOW\n" "$1"
+}
+
+# -----------------------------------------------------------------------------
+# Assemble the new map file in a temp file, then atomically replace
+# -----------------------------------------------------------------------------
+TMPFILE=$(mktemp "${MAP_FILE}.tmp.XXXXXX")
+trap 'rm -f "$TMPFILE"' EXIT
+
+{
+# ── Static header
─────────────────────────────────────────────────────────────
+cat <<HEADER
+# /usr/share/debian-edu-config/apache2_tjener-aliases.map
+# Format: <server_alias_or_IP> ALLOW
+#
+# IMPORTANT: This file will be changed daily by a script using cron/systemd.
+# It contains allowed HTTP Host: header values (TJENER aliases
+# and IPs), not client machines.
+# The script tries to smartly merge existing hand-made entries,
+# but you should execute the script manually once to make sure your
+# changes are sticking:
+# $ ${SCRIPT_PATH}
+
+# Local loopback devices
+$(fmt_allow localhost)
+$(fmt_allow "::1")
+$(fmt_allow "127.0.0.1")
+HEADER
+
+# ── Auto-generated Debian Edu defaults
────────────────────────────────────────
+cat <<'AUTOGEN_HEADER'
+
+# ---------------------------
+# | Debian Edu defaults |
+# ---------------------------
+AUTOGEN_HEADER
+
+echo "# NOTE: 10.x.x.x/8 network is allowed anyway, so next line is redundand."
+fmt_allow "10.0.2.2"
+fmt_allow "www"
+fmt_allow "www.intern"
+fmt_allow "tjener"
+fmt_allow "tjener.intern"
+fmt_allow "ldap"
+fmt_allow "ldap.intern"
+echo "# ---------------------------"
+
+# ── LDAP-discovered cNAMEs (not already in defaults)
──────────────────────────
+if [[ ${#LDAP_EXTRA_LINES[@]} -gt 0 ]]; then
+ echo ""
+ echo ""
+ echo "# ---------------------------"
+ echo "# | LDAP-discovered CNAMEs |"
+ echo "# | (auto-updated daily) |"
+ echo "# ---------------------------"
+ echo "# Last updated: $(date '+%Y-%m-%d %H:%M:%S')"
+ for h in "${LDAP_EXTRA_LINES[@]}"; do
+ fmt_allow "$h"
+ # Also emit the .intern variant if not already covered
+ intern_variant="${h}.intern"
+ if [[ -z "${COVERED[$intern_variant]+_}" ]]; then
+ fmt_allow "$intern_variant"
+ COVERED["$intern_variant"]=1
+ fi
+ done
+ echo "# ---------------------------"
+fi
+
+# ── Preserved hand-edit block
─────────────────────────────────────────────────
+echo ""
+echo ""
+echo "$HAND_EDIT_BLOCK"
+
+} > "$TMPFILE"
+
+# Validate the temp file is non-empty before replacing
+[[ -s "$TMPFILE" ]] || die "Generated file is empty — aborting."
+
+# Atomic replace
+mv "$TMPFILE" "$MAP_FILE"
+chmod 644 "$MAP_FILE"
+log "Successfully updated: $MAP_FILE"
+
+# -----------------------------------------------------------------------------
+# Reload Apache2 if running (graceful — no dropped connections)
+# -----------------------------------------------------------------------------
+if systemctl is-active --quiet apache2; then
+ log "Reloading Apache2..."
+ systemctl reload apache2 \
+ && log "Apache2 reloaded successfully." \
+ || log "WARNING: Apache2 reload failed. Check 'systemctl status
apache2'."
+else
+ log "Apache2 is not running — skipping reload."
+fi
diff -Nru debian-edu-config-2.12.903~deb13u1/Makefile
debian-edu-config-2.13.2~deb13u1/Makefile
--- debian-edu-config-2.12.903~deb13u1/Makefile 2025-06-13 11:16:21.000000000
+0200
+++ debian-edu-config-2.13.2~deb13u1/Makefile 2026-09-07 10:58:26.000000000
+0200
@@ -22,6 +22,7 @@
$(NULL)
LIBEXECPROGS = \
+ debian-edu-apache2-update-tjener-aliases \
debian-edu-cups-queue-autoflush-for-netgroup-hosts \
debian-edu-cups-queue-autoreenable-for-netgroup-hosts \
debian-edu-fsautoresize-for-netgroup-hosts \
@@ -157,7 +158,6 @@
mklocaluser.d/20-debian-edu-config \
shutdown-at-night/clients-generator \
resolvconf/update.d/bind-debian-edu \
- wicd/scripts/preconnect/set_wireless_mac_from_eth0 \
X11/Xsession-debian-edu \
$(NULL)
@@ -195,6 +195,7 @@
ltsp.ldif \
gosa.ldif \
gosa-server.ldif \
+ debian-edu-router.ldif \
$(NULL)
LDAPPROGRAMS = \
@@ -288,7 +289,6 @@
set -e ; for f in \
share/debian-edu-config/d-i/finish-install \
share/debian-edu-config/d-i/pre-pkgsel \
- share/debian-edu-config/killer.cron \
share/debian-edu-config/tools/passwd \
share/debian-edu-config/tools/clean-up-host-keytabs \
share/debian-edu-config/tools/create-debian-edu-certs \
@@ -359,6 +359,7 @@
$(INSTALL_DATA) sbin/debian-edu-fsautoresizetab
$(DESTDIR)/usr/share/debian-edu-config/fsautoresizetab
set -e ; for f in \
+ share/debian-edu-config/apache2_tjener-aliases.map \
share/debian-edu-config/avahi.smb.service \
share/debian-edu-config/rsyslog-collector \
share/debian-edu-config/rsyslog-filters \
@@ -387,7 +388,6 @@
share/firefox-esr/distribution/policies.json \
share/glib-2.0/schemas/21_debian-edu+gdm.gschema.override \
share/glib-2.0/schemas/31_debian-edu+mate.gschema.override \
-
share/glib-2.0/schemas/32-debian-edu.arctica-greeter.gschema.override \
share/mate-panel/layouts/debian-edu-mate.layout \
; do \
$(INSTALL_DATA) $$f $(DESTDIR)/usr/$$f ; \
diff -Nru debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-fsautoresize
debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-fsautoresize
--- debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-fsautoresize
2015-10-16 14:57:58.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-fsautoresize
2026-08-19 22:24:04.000000000 +0200
@@ -226,7 +226,7 @@
$size = $volsizeblocks/2;
}
- my $fracavail = 100 * $avail / $size;
+ my $fracavail = 100 * $avail / ( $size + 1 );
print STDERR " A: $size $used $avail ($fracavail%)\n" if $opts{v};
my %minfo =
(
diff -Nru debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-ltsp-install
debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-ltsp-install
--- debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-ltsp-install
2023-09-27 22:34:54.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-ltsp-install
2026-09-07 10:58:26.000000000 +0200
@@ -262,6 +262,7 @@
POST_INIT_PRINTER="cp /etc/ltsp/p910d.conf /etc/default/p910d"
HOSTS_1="10.0.2.2 tjener.intern tjener"
HOSTS_2="$ETH1_IP $HOSTNAME"
+KERNEL_PARAMETERS="quiet splash"
EOF
fi
@@ -606,11 +607,15 @@
rm -f /etc/resolv.conf
echo "nameserver $dns_server" > /etc/resolv.conf
echo "search intern" >> /etc/resolv.conf
+ # Temporary workaround needed to turn DLW images into machines of
profile type 'Workstation'
+ sed -i /etc/debian-edu/config -e
"s/^PROFILE=.*/PROFILE=\"Workstation\"/g"
# Create SqashFS image.
ltsp image /,,/boot,subdir=boot,,/usr,subdir=usr,,/var,subdir=var
# Revert resolver workaround from above.
rm -f /etc/resolv.conf
ln -s /run/resolvconf/resolv.conf /etc/resolv.conf
+ # Revert temporary change to PROFILE in /etc/debian-edu/config
+ sed -i /etc/debian-edu/config -e
"s/^PROFILE=.*/PROFILE=\"${PROFILE}\"/g"
# next modification avoids ltsp command error if lot of images are
available.
ALL_IMAGES=1 ltsp kernel
ltsp initrd
@@ -674,7 +679,7 @@
chroot /srv/ltsp/dlw apt-get install -y -qq apt-utils ltsp
# Turn system into a Debian Edu workstation.
- chroot /srv/ltsp/dlw sh -c "DESKTOP=$desktop /sbin/debian-edu-bless"
+ chroot /srv/ltsp/dlw sh -c "PROFILE=Workstation DESKTOP=$desktop
/sbin/debian-edu-bless"
mkdir -p /srv/ltsp/dlw/skole
chmod 755 /srv/ltsp/dlw/skole
rm -f /srv/ltsp/dlw/etc/resolv.conf
@@ -788,4 +793,6 @@
fi
# Make sure /srv/tftp/ltsp/ltsp.ipxe is Debian Edu specific.
-sed -i 's#ltsp/ltsp.img#ltsp/${img}/ltsp.img#' /srv/tftp/ltsp/ltsp.ipxe
+sed -i "s#ltsp/ltsp.img#ltsp/${img}/ltsp.img#" /srv/tftp/ltsp/ltsp.ipxe
+# Add "quiet" and "splash" parameters to hide kernel logs on a boot screen.
+sed -i "s/set cmdline ${cmdline_method} ${cmdline_ltsp} ${cmdline_client}$/set
cmdline ${cmdline_method} ${cmdline_ltsp} ${cmdline_client}
${KERNEL_PARAMETERS}/" /srv/tftp/ltsp/ltsp.ipxe
diff -Nru debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-ltsp-ipxe
debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-ltsp-ipxe
--- debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-ltsp-ipxe
2022-02-11 16:47:45.000000000 +0100
+++ debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-ltsp-ipxe 2026-09-07
10:58:26.000000000 +0200
@@ -20,5 +20,7 @@
# Make sure /srv/tftp/ltsp/ltsp.ipxe is Debian Edu specific.
sed -i 's#ltsp/ltsp.img#ltsp/${img}/ltsp.img#' /srv/tftp/ltsp/ltsp.ipxe
+# Add "quiet" and "splash" parameters to hide kernel logs on a boot screen.
+sed -i 's/set cmdline ${cmdline_method} ${cmdline_ltsp} ${cmdline_client}$/set
cmdline ${cmdline_method} ${cmdline_ltsp} ${cmdline_client} quiet splash/'
/srv/tftp/ltsp/ltsp.ipxe
echo ""
echo "/srv/tftp/ltsp/ltsp.ipxe has been modified."
diff -Nru debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-pxeinstall
debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-pxeinstall
--- debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-pxeinstall
2025-06-02 10:30:33.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-pxeinstall 2026-09-07
10:58:26.000000000 +0200
@@ -57,11 +57,13 @@
dist=$(lsb_release -sc)
fi
+default_mydesktop="xfce"
+
[ "$archs" ] || archs="amd64 i386"
[ "$mirrorurl" ] || mirrorurl=http://deb.debian.org/debian
[ "$hostname" ] || hostname=pxeinstall
[ "$domain" ] || domain=intern
-[ "$mydesktop" ] || mydesktop=xfce
+[ "$mydesktop" ] || mydesktop="${default_mydesktop}"
[ "$graphicdi" ] || graphicdi=false
[ "$dailydi" ] || dailydi=false
[ "$theme" ] || theme="$(ls -L /etc/alternatives/desktop-theme/plymouth
2>/dev/null | grep script | cut -d'.' -f 1)"
@@ -86,21 +88,22 @@
# debian-edu-install, copying the files a bit earlier.
installconfig=""
for template in debian-installer/locale \
- keyboard-configuration/xkb-keymap \
- tasksel/desktop; do
+ keyboard-configuration/xkb-keymap \
+ tasksel/desktop; do
value="$(debconf-get-selections --installer | grep $template | awk
'{print $4}')"
if [ -z "$value" ] ; then
# If there is no value in the installer debconf database, set
the default one.
# Useful if modular main server installation has been used (no
desktop).
- value="$mydesktop"
+ value="${default_mydesktop}"
fi
- # Using desktop= as kernel argument work, while tasksel/desktop=
- # do not. No idea why, but lets use the one that work.
- if [ "tasksel/desktop" = $template ] ; then template=desktop ;
desktop=$value; fi
+ if [ "tasksel/desktop" = $template ] && [ "${mydesktop}" !=
"${default_mydesktop}" ]; then
+ # Let setting from /etc/debian-edu/pxeinstall.conf override
tasksel/desktop.
+ value="${mydesktop}"
+ fi
- # Map the long name to the short alias, to keep the argument list
- # shorter.
+ # Map the long debconf names to the keywords supported in the kernel
cmdline.
+ if [ "tasksel/desktop" = $template ] ; then template=desktop; fi
if [ "debian-installer/locale" = $template ] ; then template=locale; fi
if [ "keyboard-configuration/xkb-keymap" = $template ] ; then
template=keymap; fi
diff -Nru debian-edu-config-2.12.903~deb13u1/sbin/update-hostname-from-ip
debian-edu-config-2.13.2~deb13u1/sbin/update-hostname-from-ip
--- debian-edu-config-2.12.903~deb13u1/sbin/update-hostname-from-ip
2023-09-27 22:34:54.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/sbin/update-hostname-from-ip
2026-09-07 10:58:26.000000000 +0200
@@ -26,9 +26,9 @@
# Generate FQDN based on hardware MAC address
ether2hostname() {
if [ "$1" ] ; then
- mac="$1"
+ mac="$1"
else
- mac=$(ifconfig $INTERFACE | awk '/ether/ { print $2; exit}')
+ mac=$(ip addr show ${INTERFACE} | grep 'link/ether ' | awk '{print $2;
exit}')
fi
# Generate NetBIOS compliant hostname.
mac=$(echo $mac | sed 's/[^0-9a-f-]//gi')
@@ -42,12 +42,12 @@
ip2hostname() {
ip=$1
host $ip | grep 'domain name pointer' | cut -d ' ' -f 5 | \
- rev |cut -d '.' -f 2-|rev
+ rev | cut -d '.' -f 2- | rev
}
PATH="/sbin:$PATH"
-INTERFACE="$(/sbin/route -n | awk '/^0\.0\.0\.0 / { print $8; exit }')"
+INTERFACE="$(ip -4 route | awk '/^default via / { print $5; exit }')"
if [ -z "$INTERFACE" ] ; then
INTERFACE=eth0
@@ -57,11 +57,11 @@
hostname="$1"
namesource="$2"
if hostname $hostname ; then
- echo $hostname > /etc/hostname
- log "info: changing hostname to $hostname based on $namesource"
+ echo $hostname > /etc/hostname
+ log "info: changing hostname to $hostname based on $namesource"
else
- log "warning: unable to set hostname to $hostname."
- return -1
+ log "warning: unable to set hostname to $hostname."
+ return -1
fi
}
@@ -69,15 +69,15 @@
TEMP=$(getopt -n update-hostname-from-ip -o dmM:nI:q -- "$@")
# Abort when there was a bug
-[ $? = 0 ] || die "error parsing arguments. Try $0 --help"
+[ $? = 0 ] || die "error parsing arguments. Try $0 --help"
eval set -- "$TEMP"
-while true; do
- case $1 in
+while true; do
+ case $1 in
-m)
USEMAC=true; shift; continue
- ;;
- -M)
+ ;;
+ -M)
MAC="$2"; shift; shift; continue
;;
-I)
@@ -102,7 +102,7 @@
# Extract current IP if non was provided on the command line
if [ -z "$IP" ] ; then
- IP=`ifconfig $INTERFACE 2>&1 |grep 'inet '|tr a-zA-Z: " "|awk '{print $1;
exit}'`
+ IP=$(ip addr show ${INTERFACE} | grep 'inet ' | awk '{print $2; exit}' |
cut -d "/" -f1)
fi
if [ "127.0.0.1" = "$IP" ] ; then
@@ -121,7 +121,7 @@
if [ "$MY_HOSTNAME" ]; then
if $onlyprint ; then
- echo $MY_HOSTNAME
+ echo $MY_HOSTNAME
else
# Already got the correct host name?
if [ "$MY_HOSTNAME" != "$(uname -n)" ] ; then
diff -Nru
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map
---
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map
1970-01-01 01:00:00.000000000 +0100
+++
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map
2026-09-07 10:58:26.000000000 +0200
@@ -0,0 +1,44 @@
+# /usr/share/debian-edu-config/apache2_tjener-aliases.map
+# Format: <server_alias_or_IP> ALLOW
+#
+# IMPORTANT: This file will be changed daily by a script using cron/systemd.
+# It contains allowed HTTP Host: header values (TJENER aliases
+# and IPs), not client machines.
+# The script tries to smartly merge existing hand-made entries,
+# but you should execute the script manually once to make sure your
+# changes are sticking:
+# $
/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases
+#
+# WARNING: If you can read this and the file modification date is more than 24h
+# in the past, then there is an issue with the automatic updating
+# script managed by either cron or systemd. This file only contains
+# the most basic configuration settings for Debian Edu and needs to be
+# updated.
+#
+# DEV NOTE: If you're are updating this file in the debian-edu-config package
+# please be aware that you'll have to adapt the update script too.
+
+# Local loopback devices
+localhost ALLOW
+::1 ALLOW
+127.0.0.1 ALLOW
+
+# ---------------------------
+# | Debian Edu defaults |
+# ---------------------------
+# NOTE: 10.x.x.x/8 network is allowed, so next line is redundand.
+10.0.2.2 ALLOW
+www ALLOW
+www.intern ALLOW
+tjener ALLOW
+tjener.intern ALLOW
+ldap ALLOW
+ldap.intern ALLOW
+# ---------------------------
+
+
+# ----- IMPORTANT HAND-EDIT ADDITIONS -----
+# If a user browses to the raw IP and it is not here, it will trigger a 302
+# response to a pre-defined server name.
+# Add any other IP addresses assigned to Tjeners interfaces:
+# 172.16.0.51 ALLOW
diff -Nru
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/d-i/pre-pkgsel
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/d-i/pre-pkgsel
--- debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/d-i/pre-pkgsel
2023-11-30 08:36:09.000000000 +0100
+++ debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/d-i/pre-pkgsel
2026-09-07 10:58:26.000000000 +0200
@@ -21,7 +21,7 @@
configure_network() {
# Write a functional /target/etc/network/interfaces
if [ -z "$PROFILE" ]; then
- PROFILE=Workstation
+ PROFILE=Workstation
fi
# Default hostname is 'localhost'
@@ -44,21 +44,21 @@
# Hm, what if both server and workstation is choosen? Choose the
# server config for eth0.
for value in `echo $PROFILE |sed 's/ /-/g' | sed 's/,-/ /g'`; do
- case $value in
- Roaming-Workstation)
- # Configure network-manager to connect to eth0 by
- # default, to be able to look up user information in
- # LDAP.
- eth0=none
- autoeth0=""
- eth1=none
- autoeth1=""
- DNSDOMAIN=
- MAILNAME=
- MY_HOSTNAME=
- eth0uuid=$(chroot /target uuid)
- mkdir -p /target/etc/NetworkManager/system-connections
- cat > /target/etc/NetworkManager/system-connections/eth0 <<EOF
+ case $value in
+ Roaming-Workstation)
+ # Configure network-manager to connect to eth0 by
+ # default, to be able to look up user information in
+ # LDAP.
+ eth0=none
+ autoeth0=""
+ eth1=none
+ autoeth1=""
+ DNSDOMAIN=
+ MAILNAME=
+ MY_HOSTNAME=
+ eth0uuid=$(chroot /target uuid)
+ mkdir -p /target/etc/NetworkManager/system-connections
+ cat > /target/etc/NetworkManager/system-connections/eth0 <<EOF
[connection]
id=eth0
uuid=$eth0uuid
@@ -70,46 +70,46 @@
[ipv4]
method=auto
EOF
- ;;
- Standalone)
- # Leave network configuration to network-manager on
- # Standalone
- eth0=none
- autoeth0=""
- eth1=none
- autoeth1=""
- DNSDOMAIN=
- MAILNAME=
- MY_HOSTNAME=
- ;;
- Workstation)
- # Use this unless Server also was choosen.
- if [ -z "$eth0" ] ; then
- eth0=none
- autoeth0=""
- eth1=none
- autoeth1=""
- fi
- ;;
- Main-Server)
- # Override for workstations combining as servers
- eth0=10.0.2.2:255.0.0.0:10.255.255.255:10.0.0.1
- MY_HOSTNAME=tjener.intern
- NAMESERVER=127.0.0.1
- autoeth0="auto eth0"
- ;;
- LTSP-Server)
- # Use this unless Server also was choosen.
- if [ -z "$eth0" ] ; then
- eth0=none
- autoeth0=""
- fi
- eth1=192.168.0.254:255.255.255.0:192.168.0.255:none
- autoeth1="auto eth1"
- ;;
- esac
+ ;;
+ Standalone)
+ # Leave network configuration to network-manager on
+ # Standalone
+ eth0=none
+ autoeth0=""
+ eth1=none
+ autoeth1=""
+ DNSDOMAIN=
+ MAILNAME=
+ MY_HOSTNAME=
+ ;;
+ Workstation)
+ # Use this unless Server also was choosen.
+ if [ -z "$eth0" ] ; then
+ eth0=none
+ autoeth0=""
+ eth1=none
+ autoeth1=""
+ fi
+ ;;
+ Main-Server)
+ # Override for workstations combining as servers
+ eth0=10.0.2.2:255.0.0.0:10.255.255.255:10.0.0.1
+ MY_HOSTNAME=tjener
+ NAMESERVER=127.0.0.1
+ autoeth0="auto eth0"
+ ;;
+ LTSP-Server)
+ # Use this unless Server also was choosen.
+ if [ -z "$eth0" ] ; then
+ eth0=none
+ autoeth0=""
+ fi
+ eth1=192.168.0.254:255.255.255.0:192.168.0.255:none
+ autoeth1="auto eth1"
+ ;;
+ esac
done
-
+
# Every host need the loopback interface
cat > $interfaces <<EOF
# Created by debian-edu-profile during the Debian installation.
@@ -123,24 +123,24 @@
EOF
for interface in eth0 eth1 ; do
- eval "ifinfo=\$$interface"
- eval "ifauto=\$auto$interface"
- log "setting up network interface $interface using $ifinfo"
- case $ifinfo in
- dhcp)
- cat >> $interfaces <<EOF
+ eval "ifinfo=\$$interface"
+ eval "ifauto=\$auto$interface"
+ log "setting up network interface $interface using $ifinfo"
+ case $ifinfo in
+ dhcp)
+ cat >> $interfaces <<EOF
$ifauto
iface $interface inet dhcp
EOF
- ;;
- [0-9]*)
- address=`echo $ifinfo | cut -d: -f1`
- netmask=`echo $ifinfo | cut -d: -f2`
- broadcast=`echo $ifinfo | cut -d: -f3`
- gateway=`echo $ifinfo | cut -d: -f4`
- cat >> $interfaces <<EOF
+ ;;
+ [0-9]*)
+ address=`echo $ifinfo | cut -d: -f1`
+ netmask=`echo $ifinfo | cut -d: -f2`
+ broadcast=`echo $ifinfo | cut -d: -f3`
+ gateway=`echo $ifinfo | cut -d: -f4`
+ cat >> $interfaces <<EOF
auto $interface
iface $interface inet static
@@ -148,37 +148,50 @@
netmask $netmask
broadcast $broadcast
EOF
- if [ none != "$gateway" ] ; then
- cat >> $interfaces <<EOF
+ if [ none != "$gateway" ] ; then
+ cat >> $interfaces <<EOF
gateway $gateway
EOF
- fi
- if [ "$DNSDOMAIN" ] && [ "$NAMESERVER" = "127.0.0.1" ] ; then
- cat >> $interfaces <<EOF
+ fi
+ if [ "$DNSDOMAIN" ] && [ "$NAMESERVER" = "127.0.0.1" ] ; then
+ cat >> $interfaces <<EOF
dns-search $DNSDOMAIN
dns-nameservers $NAMESERVER
EOF
- fi
- cat >> $interfaces <<EOF
+ fi
+ cat >> $interfaces <<EOF
# The commented lines below is to be used if a DHCP server is in use
#iface $interface inet dhcp
EOF
- ;;
- *)
- # Nothing to do?
- ;;
- esac
+ ;;
+ *)
+ # Nothing to do?
+ ;;
+ esac
done
(
- echo "127.0.0.1 localhost.localdomain localhost"
- echo "::1 localhost ip6-localhost ip6-loopback"
- echo "fe00::0 ip6-localnet"
- echo "ff00::0 ip6-mcastprefix"
- echo "ff02::1 ip6-allnodes"
- echo "ff02::2 ip6-allrouters"
- echo "ff02::3 ip6-allhosts"
+ echo "127.0.0.1 localhost.localdomain localhost"
+ echo "::1 localhost ip6-localhost ip6-loopback"
+ echo "fe00::0 ip6-localnet"
+ echo "ff00::0 ip6-mcastprefix"
+ echo "ff02::1 ip6-allnodes"
+ echo "ff02::2 ip6-allrouters"
+ echo "ff02::3 ip6-allhosts"
) > /target/etc/hosts
+ # Check whether hostname= was given on boot's /proc/cmdline prompt
+ # and use that if not installing a Main-Server.
+ PROC_CMDLINE_HOSTNAME=$(cat /proc/cmdline |
+ sed -n -re "s/.*(^| )hostname=([^ ]+).*/\2/p" |
+ tr A-Z a-z |
+ tr -cd 'a-z0-9-' |
+ sed -e 's/^-+//' -e 's/-+$//')
+ if echo $PROFILE | grep -q Main-Server ; then
+ :
+ elif [ -n "${PROC_CMDLINE_HOSTNAME}" ]; then
+ MY_HOSTNAME="${PROC_CMDLINE_HOSTNAME}"
+ fi
+
if [ ! -z "$MY_HOSTNAME" ] ; then
echo "$MY_HOSTNAME" > /target/etc/hostname
in-target /bin/hostname "$MY_HOSTNAME"
@@ -187,37 +200,37 @@
# Update hostname based on reverse DNS entry of current IP or
# generate from MAC address, unless installing main-server.
if echo $PROFILE | grep -q Main-Server ; then
- :
- elif [ -x /target/usr/sbin/update-hostname-from-ip ] ; then
- in-target /usr/sbin/update-hostname-from-ip -m || true
+ :
+ elif [ -x /target/usr/sbin/update-hostname-from-ip ] && [ -z
"${PROC_CMDLINE_HOSTNAME}" ]; then
+ in-target /usr/sbin/update-hostname-from-ip -m || true
fi
# Avoid hardcoding entries on the clients, to make sure IP address
# range can be changed on the clients by changing DHCP
# configuration on the server.
- if [ "tjener.intern" = "$MY_HOSTNAME" ] ; then
- (
- echo
- echo "10.0.2.2 tjener.intern tjener"
- ) >> /target/etc/hosts
+ if [ "tjener" = "$MY_HOSTNAME" ] ; then
+ (
+ echo
+ echo "10.0.2.2 ${MY_HOSTNAME}.${DNSDOMAIN} ${MY_HOSTNAME}"
+ ) >> /target/etc/hosts
fi
# Set /etc/mailname if it is missing
if [ "$MAILNAME" ] && [ ! -f /target/etc/mailname ] ; then
- echo "$MAILNAME" > /target/etc/mailname
+ echo "$MAILNAME" > /target/etc/mailname
fi
# Make sure that the interfaces are there for the cfengine run if
# network isn't already configured
if route | grep -q default ; then
- log "Not restarting network, as it seem to be up already."
+ log "Not restarting network, as it seem to be up already."
else
- log "Restarting network to prepare for cfengine run."
- # Redirecting fd 3 as a workaround for skolelinux bug #1229.
- # make sure the redirecting happen inside the chroot, as
- # in-target need to talk to debconf.
- in-target /bin/sh -c "/etc/init.d/networking start 3> /dev/null" || true
- touch /tmp/debian-edu-nonetwork
+ log "Restarting network to prepare for cfengine run."
+ # Redirecting fd 3 as a workaround for skolelinux bug #1229.
+ # make sure the redirecting happen inside the chroot, as
+ # in-target need to talk to debconf.
+ in-target /bin/sh -c "/etc/init.d/networking start 3> /dev/null" ||
true
+ touch /tmp/debian-edu-nonetwork
fi
}
@@ -225,32 +238,32 @@
# finish-install hook.
set_kerberos_ldap_passwords() {
if db_get passwd/root-password-crypted && [ "$RET" ] ; then
- log "No clear text root password, unable to pass it on to
Kerberos/LDAP."
+ log "No clear text root password, unable to pass it on to
Kerberos/LDAP."
else
- log "Fetching password for Kerberos KDC and LDAP." 1>&2
- db_get passwd/root-password
- ROOTPWD="$RET"
-
- log "Fetching info for first user." 1>&2
-
- if db_get passwd/username && [ "$RET" ] ; then
- FIRSTUSERNAME="$RET"
- else
- FIRSTUSERNAME="localadmin"
- fi
- if db_get passwd/user-fullname && [ "$RET" ] ; then
- FIRSTUSERGECOS="$RET"
- else
- FIRSTUSERGECOS="LDAP initial admin user"
- fi
- if db_get passwd/user-password && [ "$RET" ] ; then
- FIRSTUSERPWD="$RET"
- else
- FIRSTUSERPWD="$ROOTPWD"
- fi
+ log "Fetching password for Kerberos KDC and LDAP." 1>&2
+ db_get passwd/root-password
+ ROOTPWD="$RET"
+
+ log "Fetching info for first user." 1>&2
+
+ if db_get passwd/username && [ "$RET" ] ; then
+ FIRSTUSERNAME="$RET"
+ else
+ FIRSTUSERNAME="localadmin"
+ fi
+ if db_get passwd/user-fullname && [ "$RET" ] ; then
+ FIRSTUSERGECOS="$RET"
+ else
+ FIRSTUSERGECOS="LDAP initial admin user"
+ fi
+ if db_get passwd/user-password && [ "$RET" ] ; then
+ FIRSTUSERPWD="$RET"
+ else
+ FIRSTUSERPWD="$ROOTPWD"
+ fi
- file=/tmp/passwords-preseed
- cat > $file <<EOF
+ file=/tmp/passwords-preseed
+ cat > $file <<EOF
debian-edu-config debian-edu-config/kdc-password password $ROOTPWD
debian-edu-config debian-edu-config/kdc-password-again password $ROOTPWD
debian-edu-config debian-edu-config/ldap-password password $ROOTPWD
@@ -259,41 +272,10 @@
debian-edu-config debian-edu-config/first-user-fullname string $FIRSTUSERGECOS
debian-edu-config debian-edu-config/first-user-password password $FIRSTUSERPWD
EOF
- # Pass user and password information into the target
- cat $file | LANG=C chroot /target debconf-set-selections || \
- error "Failed to load preseed values from $file."
- rm $file
- fi
-}
-
-create_initial_localadmin_user() {
- LOCAL_USER_ID="localadmin"
- LOCAL_USER_GECOS="Local Administrator"
- LOCAL_USER_UIDNUMBER="1000"
- LOCAL_USER_PRIMGIDNUMBER="1000"
-
- LOCAL_USER_INGROUPS="$LOCAL_USER_INGROUPS adm sudo"
-
- if db_get passwd/root-password-crypted && [ "$RET" ] ; then
- log "No clear text root password, unable to use it for creating the
initial local user"
- else
- # retrieve root password
- db_get passwd/root-password
- LOCAL_USER_PASSWD=$RET
- # create initial local user
- in-target /usr/sbin/addgroup --gid $LOCAL_USER_PRIMGIDNUMBER
$LOCAL_USER_ID 1>&2 || true
- in-target /usr/sbin/adduser --gid $LOCAL_USER_PRIMGIDNUMBER \
- --firstuid $LOCAL_USER_UIDNUMBER \
- --home /home/$LOCAL_USER_ID \
- --shell /bin/bash \
- --disabled-login \
- --gecos "$LOCAL_USER_GECOS" $LOCAL_USER_ID 1>&2 || true
- # add initial local user to some standard system groups
- for group in ${LOCAL_USER_INGROUPS}; do
- in-target /usr/sbin/adduser $LOCAL_USER_ID $group 1>&2 || true
- done
- # set password (batch mode)
- in-target /bin/sh -c "echo ${LOCAL_USER_ID}:${LOCAL_USER_PASSWD} |
/usr/sbin/chpasswd" 1>&2 || true
+ # Pass user and password information into the target
+ cat $file | LANG=C chroot /target debconf-set-selections || \
+ error "Failed to load preseed values from $file."
+ rm $file
fi
}
@@ -311,15 +293,15 @@
# want.
db_get grub-installer/choose_bootdev || true
if [ "$RET" ] && [ "manual" != "$RET" ]; then
- log "not overriding grub-installer/choose_bootdev to $grubdev, its
value was '$RET'"
- return
+ log "not overriding grub-installer/choose_bootdev to $grubdev, its
value was '$RET'"
+ return
fi
case "$bootdev" in
- /dev/sd*|/dev/vd*|/dev/hd*|/dev/xvd*)
- log "overriding grub-installer/choose_bootdev, setting it to
$grubdev"
- db_set grub-installer/choose_bootdev "$grubdev" || true
- ;;
+ /dev/sd*|/dev/vd*|/dev/hd*|/dev/xvd*)
+ log "overriding grub-installer/choose_bootdev, setting it to
$grubdev"
+ db_set grub-installer/choose_bootdev "$grubdev" || true
+ ;;
esac
}
@@ -341,20 +323,19 @@
edu-etcvcs commit
if echo "$PROFILE" | grep -q Main-Server ; then
- set_kerberos_ldap_passwords
+ set_kerberos_ldap_passwords
fi
for p in $(echo $PROFILE | tr , " ") ; do
case $p in
- # Only do this for the networked tasks, not for standalone
- Main-Server|Workstation|Roaming-Workstation|LTSP-Server|Minimal)
- #create_initial_localadmin_user
- in-target /usr/share/debian-edu-config/tools/preseed-ldap-kerberos
- in-target /usr/share/debian-edu-config/tools/preseed-sitesummary
-
- # Tell user-setup to not create a user, needed on
- # Main-Server to be able to create the user in LDAP.
- db_set passwd/make-user boolean false
- ;;
+ # Only do this for the networked tasks, not for standalone
+ Main-Server|Workstation|Roaming-Workstation|LTSP-Server|Minimal)
+ in-target /usr/share/debian-edu-config/tools/preseed-ldap-kerberos
+ in-target /usr/share/debian-edu-config/tools/preseed-sitesummary
+
+ # Tell user-setup to not create a user, needed on
+ # Main-Server to be able to create the user in LDAP.
+ db_set passwd/make-user boolean false
+ ;;
esac
done
diff -Nru
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/gosa.conf.template
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/gosa.conf.template
---
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/gosa.conf.template
2025-06-02 10:30:33.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/gosa.conf.template
2026-09-07 10:58:26.000000000 +0200
@@ -117,6 +117,7 @@
<tab class="gofaxAccount" name="Fax" />
<tab class="phoneAccount" name="Phone" />
<tab class="nagiosAccount" name="Nagios" />
+ <tab class="netgroupAccount" name="NIS Netgroup" />
</usertabs>
<!-- User dialog -->
diff -Nru
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/killer.cron
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/killer.cron
--- debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/killer.cron
2022-02-11 16:47:45.000000000 +0100
+++ debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/killer.cron
1970-01-01 01:00:00.000000000 +0100
@@ -1,3 +0,0 @@
-#!/bin/sh
-
-if [ "$(ps aux | grep sshd: | grep @notty)" = "" ] && [ -x /usr/sbin/killer ]
; then /usr/sbin/killer; fi
diff -Nru
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/testsuite-lib.sh
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/testsuite-lib.sh
--- debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/testsuite-lib.sh
2022-10-24 22:07:40.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/testsuite-lib.sh
2026-09-07 10:58:26.000000000 +0200
@@ -19,7 +19,8 @@
proto=$2
service="$3"
- if netstat -a --numeric-hosts 2>&1 | grep ":$port " | grep -q "^$proto" ;
then
+ if ss -H -t -u -a 2>&1 | grep ":$port " | grep -q "^$proto" || \
+ ss -H -n -t -u -a 2>&1 | grep ":$port " | grep -q "^$proto" ; then
echo "success: $0: $service service is listening on $port/$proto."
true
else
diff -Nru
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/copy-host-keytab
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/copy-host-keytab
---
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/copy-host-keytab
2022-10-24 22:07:40.000000000 +0200
+++
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/copy-host-keytab
2026-09-07 10:58:26.000000000 +0200
@@ -1,6 +1,21 @@
#!/bin/sh
set -e
-kinit
+
+if [ $(id -u) -gt 0 ]; then
+ echo "ERROR: This script has to run as super-user root."
+ exit 1
+fi
+
+# Attempt passwordless SSH login root@tjener (could be publickey,
gssapi-keyex, or gssapi-with-mic)
+set +e
+ssh -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no tjener
"echo -n" 2>/dev/null
+ret=$?
+set -e
+if [ "${ret}" != "0" ]; then
+ # Try to get a Kerberos ticket for root instead to use GSSAPI login.
+ kinit root
+fi
+
scp tjener:/var/lib/debian-edu/host-keytabs/$(hostname -s).intern.keytab
/etc/krb5.keytab
# Special case separate LTSP server.
diff -Nru
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/create-debian-edu-certs
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/create-debian-edu-certs
---
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/create-debian-edu-certs
2023-02-06 21:17:21.000000000 +0100
+++
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/create-debian-edu-certs
2026-09-07 10:58:26.000000000 +0200
@@ -32,11 +32,12 @@
generate() {
# Generate Debian Edu root CA private key.
- openssl genrsa -out $CA_KEY 2048
- # Request rootCA certificate.
- openssl req -x509 -new -nodes -key $CA_KEY -days 3650 -out $CA_CERT
-config $SSL_CA_CONF
+ openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:prime256v1 -out
$CA_KEY
+ # Request rootCA CSR and self-sign it to apply v3 extensions.
+ openssl req -new -nodes -key $CA_KEY -out $TMP/ca.csr -config $SSL_CA_CONF
+ openssl x509 -req -in $TMP/ca.csr -signkey $CA_KEY -days 3650 -out
$CA_CERT -extfile $V3_CA_CONF
# Request web server key.
- openssl req -new -nodes -out $TMP/server.csr -newkey rsa:2048 -keyout
$SERVER_KEY -config $SSL_CA_CONF
+ openssl req -new -nodes -out $TMP/server.csr -newkey ec -pkeyopt
ec_paramgen_curve:prime256v1 -keyout $SERVER_KEY -config $SSL_CONF
# Request web server certificate.
openssl x509 -req -in $TMP/server.csr -CA $CA_CERT -CAkey $CA_KEY
-CAcreateserial -out $SERVER_CERT -days 3650 -extfile $V3_CONF
# Adjust owner and rights.
diff -Nru
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/create-server-cert
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/create-server-cert
---
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/create-server-cert
2022-02-11 16:47:45.000000000 +0100
+++
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/create-server-cert
2026-09-07 10:58:26.000000000 +0200
@@ -135,20 +135,23 @@
tempdir=$(mktemp -d)
+# Same as in /usr/share/debian-edu-config/tools/create-debian-edu-certs
cat > "${tempdir}/v3.conf" <<EOF
# v3.ext
authorityKeyIdentifier=keyid,issuer
+keyUsage = digitalSignature
+extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
$(for item in ${SANs[*]}; do echo $item; done)
EOF
-# same as in /usr/share/debian-edu-config/tools/create-debian-edu-certs
-SSL_CA_CONF="/usr/share/debian-edu-config/sslCA.cnf"
+# Same as in /usr/share/debian-edu-config/tools/create-debian-edu-certs
+SSL_CONF="/usr/share/debian-edu-config/ssl.cnf"
# tweak the common name to match our FQDN
-cp "${SSL_CA_CONF}" "${tempdir}/ssl.cnf"
+cp "${SSL_CONF}" "${tempdir}/ssl.cnf"
sed -r -i "${tempdir}/ssl.cnf" -e
"s/(commonName\s+=\s+)(.*)/\1${server_name}.${server_domain}/"
if [ -f "${keydir}/${keyfile}" ]; then
@@ -162,7 +165,7 @@
echo "Creating new key file: ${keydir}/${keyfile}"
echo
openssl req -config "${tempdir}/ssl.cnf" \
- -nodes -new -newkey rsa:2048 \
+ -nodes -new -newkey ec -pkeyopt
ec_paramgen_curve:prime256v1 \
-keyout "${keydir}/${keyfile}" \
-out "${tempdir}/${csrfile}"
fi
diff -Nru
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/kerberos-kdc-init
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/kerberos-kdc-init
---
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/kerberos-kdc-init
2023-09-27 22:34:54.000000000 +0200
+++
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/kerberos-kdc-init
2026-09-07 10:58:26.000000000 +0200
@@ -173,7 +173,6 @@
kdc_ports = 750,88
max_life = 10h 0m 0s
max_renewable_life = 7d 0h 0m 0s
- master_key_type = des3-hmac-sha1
default_principal_flags = +preauth
}
EOF
diff -Nru
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/run-at-firstboot
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/run-at-firstboot
---
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/run-at-firstboot
2022-02-11 16:47:45.000000000 +0100
+++
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/run-at-firstboot
2026-09-07 10:58:26.000000000 +0200
@@ -26,6 +26,14 @@
error "script $0 terminated unexpectedly."
}
disable_exception() { trap - INT TERM EXIT; }
+is_ltsp_client() {
+ if grep -q "initrd=ltsp.img" < /proc/cmdline; then
+ return 0
+ else
+ return 1
+ fi
+}
+
trap at_exit INT TERM EXIT
info "Executing run-at-firstboot script."
@@ -62,9 +70,23 @@
# information from some daemons isn't available during installation. It's done
# for a combined server but not for a separate LTSP server because the image
# needs to include the krb5.keytab file which isn't available at this time.
-if echo "$PROFILE" | grep -Eq 'Main-Server.*LTSP-Server' && \
- [ ! -f /srv/ltsp/images/$ltspimg ] ; then
- /usr/sbin/debian-edu-ltsp-install --diskless_workstation yes
+if ! is_ltsp_client; then
+ # If this runs on a combi server (Main-Server + LTSP-Server), create
+ # Diskless Workstation chroot from scratch as clean environment.
+ if echo "$PROFILE" | grep -Eq 'Main-Server' && \
+ echo "$PROFILE" | grep -Eq 'LTSP-Server'; then
+ if [ ! -d /srv/ltsp/dlw ]; then
+ /usr/sbin/debian-edu-ltsp-install --dlw yes
+ fi
+ # else if this runs on a pure LTSP-Server (no Main-Server role), then
+ # let's use the file system of the LTSP-Server and generate the LTSP
+ # image directly from it (faster!).
+ elif echo "$PROFILE" | grep -Eqv 'Main-Server' && \
+ echo "$PROFILE" | grep -Eq 'LTSP-Server'; then
+ if [ ! -f /srv/ltsp/images/$ltspimg ] ; then
+ /usr/sbin/debian-edu-ltsp-install
--diskless_workstation yes
+ fi
+ fi
fi
# Update PXE setup on LTSP servers with proxy values set in environment
@@ -100,10 +122,11 @@
# Send mail to the first user to avoid the Dovecot permission pitfall
# also in this special case. It doesn't seem to work during installation,
# because Exim4 needs to grab information from LDAP which fails at that time.
-FIRSTUSER=$(grep -1 first-user-name /var/cache/debconf/config.dat | grep Value
| cut -d' ' -f2)
+if echo "$PROFILE" | grep -q Main-Server ; then
+ FIRSTUSER=$(grep -1 first-user-name /var/cache/debconf/config.dat |
grep Value | cut -d' ' -f2)
-if [ ! -d /var/mail/"$FIRSTUSER" ] ; then
- cat << EOF | /usr/lib/sendmail $FIRSTUSER
+ if [ ! -d /var/mail/"$FIRSTUSER" ] ; then
+ cat << EOF | /usr/lib/sendmail $FIRSTUSER
Subject: Welcome to the mail-system
Hello $FIRSTUSER,
@@ -113,7 +136,8 @@
(Sent from the Debian Edu first boot script.)
EOF
- logger -t exim-create-environment -p notice Sent mail to first-user.
+ logger -t exim-create-environment -p notice Sent mail to
first-user.
+ fi
fi
# Create first user's Samba account. The smbpasswd command fails inside d-i
diff -Nru
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/setup-roaming
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/setup-roaming
---
debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/setup-roaming
2022-03-21 15:18:05.000000000 +0100
+++
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/setup-roaming
2026-09-07 10:58:26.000000000 +0200
@@ -27,10 +27,6 @@
# Avoid double caching, as sssd is already caching
apt-get purge -y nscd
-# Roaming workstations are typically single user machines, so do not
-# throw out the user if he is idle.
-apt-get purge -y killer
-
# try to configure sssd dynamically, fall back to default setup if
# generation fail
# sssd refuses to read the sssd.conf file unless it is 0600 root:root
diff -Nru debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/v3CA.cnf
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/v3CA.cnf
--- debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/v3CA.cnf
2022-02-11 16:44:49.000000000 +0100
+++ debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/v3CA.cnf
2026-09-07 10:58:26.000000000 +0200
@@ -1,9 +1,8 @@
# v3.ext
-authorityKeyIdentifier=keyid,issuer
-basicConstraints=CA:True
-keyUsage = digitalSignature
+authorityKeyIdentifier = keyid, issuer
+basicConstraints = critical, CA:TRUE
+keyUsage = critical, digitalSignature, cRLSign, keyCertSign
subjectAltName = @alt_names
[alt_names]
DNS = www
-
diff -Nru debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/v3.cnf
debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/v3.cnf
--- debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/v3.cnf
2022-02-11 16:44:49.000000000 +0100
+++ debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/v3.cnf
2026-09-07 10:58:26.000000000 +0200
@@ -1,5 +1,7 @@
# v3.ext
authorityKeyIdentifier=keyid,issuer
+keyUsage = digitalSignature
+extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
diff -Nru
debian-edu-config-2.12.903~deb13u1/share/glib-2.0/schemas/32-debian-edu.arctica-greeter.gschema.override
debian-edu-config-2.13.2~deb13u1/share/glib-2.0/schemas/32-debian-edu.arctica-greeter.gschema.override
---
debian-edu-config-2.12.903~deb13u1/share/glib-2.0/schemas/32-debian-edu.arctica-greeter.gschema.override
2022-02-11 16:47:45.000000000 +0100
+++
debian-edu-config-2.13.2~deb13u1/share/glib-2.0/schemas/32-debian-edu.arctica-greeter.gschema.override
1970-01-01 01:00:00.000000000 +0100
@@ -1,2 +0,0 @@
-[org.ArcticaProject.arctica-greeter]
-logo=''
diff -Nru debian-edu-config-2.12.903~deb13u1/testsuite/hostname
debian-edu-config-2.13.2~deb13u1/testsuite/hostname
--- debian-edu-config-2.12.903~deb13u1/testsuite/hostname 1970-01-01
01:00:00.000000000 +0100
+++ debian-edu-config-2.13.2~deb13u1/testsuite/hostname 2026-09-07
10:58:26.000000000 +0200
@@ -0,0 +1,27 @@
+#!/bin/sh
+#
+# Check that Main-Server's hostname is set to short hostname 'tjener', not
FQDN 'tjener.intern'.
+
+if test -r /etc/debian-edu/config ; then
+ . /etc/debian-edu/config
+fi
+
+LC_ALL=C
+export LC_ALL
+
+scriptname="$0"
+
+case $PROFILE in
+*Main-Server*)
+ # Check that the hostname of the Main-Server is set to its short hostname
(not FQDN)
+ if [ -e /etc/hostname ] && grep -q -E "^tjener\$" /etc/hostname; then
+ printf "success: %s: Main-Server's hostname is set to 'tjener'\n"
"${scriptname}"
+ elif [ -e /etc/hostname ] && grep -q -E "^tjener\.intern\$" /etc/hostname;
then
+ printf "error: %s: Main-Server's hostname is (still) set to
'tjener.intern', please drop the DNS domain part from it\n" "${scriptname}"
+ exit 1
+ else
+ printf "error: %s: Main-Server's hostname is not 'tjener'\n"
"${scriptname}"
+ exit 1
+ fi
+ ;;
+esac
diff -Nru debian-edu-config-2.12.903~deb13u1/testsuite/ldap-server
debian-edu-config-2.13.2~deb13u1/testsuite/ldap-server
--- debian-edu-config-2.12.903~deb13u1/testsuite/ldap-server 2023-09-27
22:34:54.000000000 +0200
+++ debian-edu-config-2.13.2~deb13u1/testsuite/ldap-server 2026-09-07
10:58:26.000000000 +0200
@@ -36,6 +36,19 @@
RESULT=0
+if [ -d /var/lib/ldap ] ; then
+ owner=$(stat -c %U:%G /var/lib/ldap)
+ if [ "$owner" = "openldap:openldap" ]; then
+ echo "success: $0: /var/lib/ldap is owned by openldap:openldap"
+ else
+ echo "error: $0: /var/lib/ldap is owned by $owner, not
openldap:openldap"
+ RESULT=1
+ fi
+else
+ echo "error: $0: /var/lib/ldap is missing"
+ RESULT=1
+fi
+
for port in ldap; do
netstat_check $port tcp slapd || RESULT=1
done
@@ -61,7 +74,7 @@
fi
echo "info: connection per ldap-client"
-netstat -a --numeric-hosts | grep :ldap |
+ss -H -t -u -a | grep :ldap |
awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n |
sed "s%^%info: $0: clients: %"
diff -Nru debian-edu-config-2.12.903~deb13u1/testsuite/network
debian-edu-config-2.13.2~deb13u1/testsuite/network
--- debian-edu-config-2.12.903~deb13u1/testsuite/network 2022-02-11
16:44:49.000000000 +0100
+++ debian-edu-config-2.13.2~deb13u1/testsuite/network 2026-09-07
10:58:26.000000000 +0200
@@ -14,16 +14,11 @@
. /etc/debian-edu/config
fi
-if [ -x /sbin/ifconfig ] ; then
- /sbin/ifconfig -a | sed "s%^%info: $0: ifconfig: %" || true
+if command -v ip >/dev/null ; then
+ ip addr | sed "s%^%info: $0: ip addr: %" || true
+ ip route | sed "s%^%info: $0: ip route: %" || true
else
- error "Unable to find /sbin/ifconfig"
-fi
-
-if [ -x /sbin/route ] ; then
- /sbin/route -n | sed "s%^%info: $0: route: %" || true
-else
- error "Unable to find /sbin/route"
+ error "Unable to find ip (iproute2)"
fi
if [ -x /usr/bin/nmap ] ; then
@@ -65,11 +60,7 @@
######################################################################
have_interface() {
- if /sbin/ifconfig "$1" > /dev/null 2>&1 ; then
- true
- else
- false
- fi
+ ip link show "$1" > /dev/null 2>&1
}
for value in `echo $PROFILE |sed 's/ /-/g' | sed 's/,-/ /g'`; do
