Re: More on the future LDAP admin gui in Debian Edu
On 12:52 Mon 25 Oct , Jürgen Leibner wrote: > > The french team has done their own add-on-cd in 2006. Their packages are > until now in the skolelinux svn. Have you tried to come in to the svn > with your packages? > > CipUX was added to the package lists for being on the CD/DVD by Xavier > Oswald in 2006 as the debian-edu changelog tells: > ---8< > [ Xavier Oswald ] > * main-server task: > - Depend on moodle-debian-edu-theme, moodle-cipux, cipux-all > - Recommend moodle-courses-fr, debian-edu-fr-all, > debian-edu-fr-skels. > These packages contain French data so they are reduce to > recommend. > - Depend on cipux-common, cipux-cibot, cipux-cat-webmin, cipux-rpc, > cipux-profile. These packages come from the cipux repository. > ---8< > > Why not try to come in again? > As you can see how GOsa² came in, why didn't you try to do it the same > way? Since Im quoted I think I should reply. I was planning to come in again after a future IRL meeting which is planned to be soon with Christian. We want to work ASAP on preseeding cipux and do integration tests with debian-edu. I will come back to the list when I have something working, asking for tests and comments. Greetings, -- Xavier Oswald GNU/Linux Debian Developer - http://www.debian.org/ GPG key ID: 0x464B8DE3 signature.asc Description: Digital signature
Re: More on the future LDAP admin gui in Debian Edu
Hi, as I am just back from Tokyo, I can not comment on all mails in this thread where it is needed. Klaus Knopper wrote: [...] > I believe that was the older CipUX version, but CipUX had been restarted > from scratch since then, as far as Christian told me, and has a cleaner > design right now, though less features than the old version. correct >> Why not try to come in again? > > I'm eager to do this, but need help from the CipUX upstream developers > plus one or the other Skolelinux packager in order to get things right. I already offered my help in this thread. As it was said earlier too, the work in the SVN of Skolelinux is *integration* of CipUX. Integration probably mean - as far as I understood this - add the package names to a list (maintained in Skole-SVN), so that installer will install them and add the Debian Edu specific configuration of CipUX to the Skole-SVN at a correct location so that the config ends up at the DVD. Not putting the hole CipUX source code in Skole-SVN. Except for Debian-Edu configuration CipUX is full packaged for squeeze! (I will skip the discussion of italc, catweasel and limbo here - there are needed for RLP but not for CipUX. This should be discussed when the trivial case "CipUX" is clear) So there is no reason not to integrate CipUX. [...] Cheers C. -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/4cc60739.8000...@cipworx.org
Re: More on the future LDAP admin gui in Debian Edu
Hi, On 25/10/10 14:26, Klaus Knopper wrote: > I'm also using SVN for some of my own projects, but indeed, the > possibility to just add packages as "request for comment" without prior > discussion was new for me. So, you propose that I just create svn > repositories for packages, maybe as duplicates of the ones from the > individual developers? just to make it clear: you don't copy _any_ outside packages into the debian-edu SVN. It is the working basis for the debian-edu-* packages and some others like sitesummary. Jonas has, just like me, repeatedly emphasized the term _integration_ of cipux that would need to be done there and explained what this means in his e-mail: http://lists.debian.org/debian-edu/2010/10/msg00195.html Maybe you should check out the SVN and have a look around to get an idea what's actually in there: svn co svn://svn.debian.org/svn/debian-edu/trunk debian-edu Regards, -- .''`. Philipp Huebner : :' : pgp fp: 6719 25C5 B8CD E74A 5225 3DF9 E5CA 8C49 25E4 205F `. `'` HP: http://www.debalance.de, Skype: philipp-huebner `- ICQ: 235-524-440, Jabber: der_scha...@jabber.org signature.asc Description: OpenPGP digital signature
Re: More on the future LDAP admin gui in Debian Edu
On Mon, Oct 25, 2010 at 02:45:46PM +0200, Klaus Knopper wrote: On Mon, Oct 25, 2010 at 02:19:40PM +0200, Holger Levsen wrote: Jonas has packages CipUX (most parts) for Debian, they are in unstable, so they are actually more "squeeze" than "Lenny" and therefore not working too well with the current stable Skolelinux version. But he also creates packages for Skolelinux/Lenny occasionally, just probably not following the precedure Jürgen and Philipp mentioned. Jonas, are you there and can comment on this? I do official packages for Debian, which thereby automatically becomes available in future official releases of Skolelinux too. I do unofficial packages targeted already released Debian too, which do not automatically becomes available for install as part of current or future Skolelinux releases. In principle, with some manual work from some volunteer, my unofficial packages could be made available in Skolelinux releases. I believe none of above contradicts with Skolelinux contribution documentation, although some of it might not be clearly documented. I believe packaging work is not the main issue in this thread, however: Far more than packaging, CipUX needs *integration* with Skolelinux! BTW, now that I have your attention: do you know why cipux-cat-weasel hasnt been packaged yet? Actually, we have an "unofficial" package on rp.skolelinux.de, but since it build-depends on stuff not packaged in Debian yet, it's complicated. Also, there are still a few problems with preconfiguration so that it starts out-of-the-box on Skolelinux, which need to be adressed. Martin wrote about that. Want to help? :-) Great that the RLP project has packaged CATweasel for their own use. I am pretty sure, however, that Holger did not simply mean "packaged" but more specifically "packaged officially for Debian", since he just pointed out how the proper way for code to reach Skolelinux is via Debian. Now, you are both talking about *packaging* here. What [CipUX] lack the most is not packaging, however, but *integration* with Skolelinux. Skolelinux integration is done mostly in the packages debian-edu-config and debian-edu-install. Someone needs to volunteer to help work on those packages to refine the setup of official Debian CipUX packages, to work with Skolelinux. - Jonas [CipUX]: Although CATweasel is considered crucial to the RLP project, the CipUX project itself does not: CipUX CAT Web exists too. Skolelinux prioritizes the use of only official Debian packages, which affects the judgement of those two competitive CipUX frontends. -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: Digital signature
Re: More on the future LDAP admin gui in Debian Edu
On Mon, Oct 25, 2010 at 03:10:57PM +0200, Klaus Knopper wrote: Hi Jonas, On Mon, Oct 25, 2010 at 02:53:34PM +0200, Jonas Smedegaard wrote: On Mon, Oct 25, 2010 at 02:26:31PM +0200, Klaus Knopper wrote: >I already think beyond the projects official end (I see no way to >get anything into Skolelinux earlier), Why not? Are you too busy while project leader and do not consider the integration task of priority now? Or do you not expect help from Skolelinux, Debian or CipUX now, e.g. due to the freeze of Squeeze? Or something else? It's a simple calculation of workload and manpower vs. time and deadlines. Priority 1 is indeed, as mentioned before, that schools in RLP get their installations ready in time. This includes bugfixes and finding workarounds for difficult scenarios and regulations that I can explain in a different thread if someone is interested. Having our new stuff in Skolelinux is also a priority, but not top 1. We need to make sure someone else can take over development later, when our funding ends, and this goal would be reached easier if our addons are already official part of Debian and Skolelinux. I asked for help from Skolelinux but we can't just sit there and wait for it to happen. I understand that Skolelinux suffers from the same problem as most projects that grow quick but have a too small developer and maintainer base. The technical remarks that came on this list were very helpful for me, yet they don't solve the problem of insufficient resources. Hope this answers your question, though it is not a simple "Yes" or "No". My question was not binary, and I am happy for your elaborated response! (and for your others responses too - thanks!) - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: Digital signature
Re: More on the future LDAP admin gui in Debian Edu
On Mon, Oct 25, 2010 at 02:59:34PM +0200, Holger Levsen wrote: > > Actually, we have an "unofficial" package on rp.skolelinux.de, but since > > it build-depends on stuff not packaged in Debian yet, it's complicated. > > Also, there are still a few problems with preconfiguration so that it > > starts out-of-the-box on Skolelinux, which need to be adressed. Martin > > wrote about that. Want to help? :-) > > Sorry, but atm I'm interested to get a usuable UI for squeeze. If you say > catweasel has some unsatisfied build-depends, I'm not interested to help > here(+now), as new build-depends wont make it into squezee... Sorry to hear that, but you may now understand why we "here(+now)" spend a lot of work on our own package on our own platform, since it is just not possible currently to get CATWeasel into squeeze. Even that our packages, too, are installable via apt-get on Skolelinux, like those in official Debian. Regards -Klaus -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101025131944.gb21...@knopper.net
Re: More on the future LDAP admin gui in Debian Edu
Hi, On Montag, 25. Oktober 2010, Klaus Knopper wrote: > Thanks for clarification, but now the next question arises: You are > talking about Debian packaging for squeeze, not packaging for/inside > Skolelinux/lenny following the HOWTO that Jürgen referred to, correct? that howto is about contributing to the debian-edu packages, which are Debian packages for squeeze. we dont package inside Skolelinux only. (and lenny is in maintainance mode anyway...) cheers, Holger signature.asc Description: This is a digitally signed message part.
Re: More on the future LDAP admin gui in Debian Edu
Hi Jonas, On Mon, Oct 25, 2010 at 02:53:34PM +0200, Jonas Smedegaard wrote: > On Mon, Oct 25, 2010 at 02:26:31PM +0200, Klaus Knopper wrote: > >I already think beyond the projects official end (I see no way to > >get anything into Skolelinux earlier), > > Why not? > > Are you too busy while project leader and do not consider the > integration task of priority now? Or do you not expect help from > Skolelinux, Debian or CipUX now, e.g. due to the freeze of Squeeze? > Or something else? It's a simple calculation of workload and manpower vs. time and deadlines. Priority 1 is indeed, as mentioned before, that schools in RLP get their installations ready in time. This includes bugfixes and finding workarounds for difficult scenarios and regulations that I can explain in a different thread if someone is interested. Having our new stuff in Skolelinux is also a priority, but not top 1. We need to make sure someone else can take over development later, when our funding ends, and this goal would be reached easier if our addons are already official part of Debian and Skolelinux. I asked for help from Skolelinux but we can't just sit there and wait for it to happen. I understand that Skolelinux suffers from the same problem as most projects that grow quick but have a too small developer and maintainer base. The technical remarks that came on this list were very helpful for me, yet they don't solve the problem of insufficient resources. Hope this answers your question, though it is not a simple "Yes" or "No". Regards -Klaus -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101025131057.ga21...@knopper.net
Re: More on the future LDAP admin gui in Debian Edu
Hi, On Montag, 25. Oktober 2010, Klaus Knopper wrote: > Sounds nice, and I believed that by myself a while ago, until reality > proved me wrong. ;-) > > Debian and Skolelinux differ a lot in their preconfiguration and > especially LDAP. So, we do need packages that are specific to Skolelinux > once it concerns user and system administration via LDAP. those packages can still be in Debian. There is no point of having packages just in Skolelinux. We did that years ago, but we dont do that anymore (since years). All our packages are in Debian. And yes, if you install Debian, the result will be different than if you install Debian Edu. But both installs use the same *package pool*. It's similar if you install Gnome vs KDE ;) Or NIS vs LDAP. > Jonas has packages CipUX (most parts) for Debian, they are in unstable, > so they are actually more "squeeze" than "Lenny" and therefore not > working too well with the current stable Skolelinux version. This is the development list, we mostly care about the upcoming version, which atm is squeeze. So this is very fine. Whats not so fine is that there are no instructions like http://wiki.cipux.org/installation/cipux_340x_debian_edu is for Lenny, but for Squeeze. Those would be helpful to have *now* (that squeeze is still in development...) > So, you are saying, since CipUX is in Debian, it will be present as > installation option for Skolelinux in the next release, yes? Now this is > a different statement than what Jürgen and Philipp said before. No, thats not what I said. I said, since its in Debian, you can apt-get install it. > > BTW, now that I have your attention: do you know why cipux-cat-weasel > > hasnt been packaged yet? > Actually, we have an "unofficial" package on rp.skolelinux.de, but since > it build-depends on stuff not packaged in Debian yet, it's complicated. > Also, there are still a few problems with preconfiguration so that it > starts out-of-the-box on Skolelinux, which need to be adressed. Martin > wrote about that. Want to help? :-) Sorry, but atm I'm interested to get a usuable UI for squeeze. If you say catweasel has some unsatisfied build-depends, I'm not interested to help here(+now), as new build-depends wont make it into squezee... cheers, Holger signature.asc Description: This is a digitally signed message part.
Re: More on the future LDAP admin gui in Debian Edu
On Mon, Oct 25, 2010 at 02:26:31PM +0200, Klaus Knopper wrote: I already think beyond the projects official end (I see no way to get anything into Skolelinux earlier), Why not? Are you too busy while project leader and do not consider the integration task of priority now? Or do you not expect help from Skolelinux, Debian or CipUX now, e.g. due to the freeze of Squeeze? Or something else? Kind regards, - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: Digital signature
Re: More on the future LDAP admin gui in Debian Edu
On Mon, Oct 25, 2010 at 02:45:42PM +0200, Jonas Smedegaard wrote: > On Mon, Oct 25, 2010 at 02:07:48PM +0200, Klaus Knopper wrote: > >On Mon, Oct 25, 2010 at 02:02:26PM +0200, Philipp Huebner wrote: > >>so the conclusion is the same simple one as stated much earlier > >>in this thread: so far nobody has shown up who is willing (and > >>able) to do the integration work (and the maintenance) to get > >>CipUX into Skolelinux. > >> > >>It's not that CipUX is not wanted, but without manpower to get > >>the work done there is simply no chance. > [snip] > >Good summary. I think we got now to the core of the problem, just no > >solution yet. > > > >Well, I'll continue to search for packagers, and meanwhile we will > >continue to maintain our own repository which may not be > >compliant, but legitimate. ;-) > > Phillip did *not* mention packaging, but integration with Skolelinux > and ongoing maintainance of that integration. > > In other words, it is a Skolelinux-specific task, not a general > Debian task. > > Even if you consider CATweasel a crucial and mandatory part of your > CipUX stack, the parts _below_ CATweasel, the ones in the CipUX > project, needs to be integrated first - as was pointed out by others > in this thread. > > So yes, CATweasel is not in Debian, so needs packaging, but no, > CipUX itself has a packaging team already (me and Xavier, > currently). Thanks for clarification, but now the next question arises: You are talking about Debian packaging for squeeze, not packaging for/inside Skolelinux/lenny following the HOWTO that Jürgen referred to, correct? You can maybe answer this in my previous mail where I basially asked the same question. :-) Regards -Klaus -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101025125127.gk21...@knopper.net
Re: More on the future LDAP admin gui in Debian Edu
Hello Holger, On Mon, Oct 25, 2010 at 02:19:40PM +0200, Holger Levsen wrote: > Hi Klaus, > > reading your mails, I'm not sure you are aware that Debian Edu / Skolelinux > _is_ Debian? If you want to have cipux on Debian Edu, just run "apt-get > install cipux". Voila. Sounds nice, and I believed that by myself a while ago, until reality proved me wrong. ;-) Debian and Skolelinux differ a lot in their preconfiguration and especially LDAP. So, we do need packages that are specific to Skolelinux once it concerns user and system administration via LDAP. > Debian squeeze consists of 14726 source package, Debian Edu squeeze consist > of > the same 14723 sources packages, plus 3 which are in different state atm. I > still hope to finally reach our goal having this match 100% for the squeeze > release or maybe a squeeze pointrelease. Jonas has packages CipUX (most parts) for Debian, they are in unstable, so they are actually more "squeeze" than "Lenny" and therefore not working too well with the current stable Skolelinux version. But he also creates packages for Skolelinux/Lenny occasionally, just probably not following the precedure Jürgen and Philipp mentioned. Jonas, are you there and can comment on this? > See http://ftp.skolelinux.org/skolelinux/squeeze_needs_love.html > If you replace squeeze with lenny in that URL you'll see the progress we made > since lenny :) There is also etch_needs_love... which shows a higher diff. > > So if you want to get something into Debian Edu, get it into Debian ;-) So, you are saying, since CipUX is in Debian, it will be present as installation option for Skolelinux in the next release, yes? Now this is a different statement than what Jürgen and Philipp said before. > BTW, now that I have your attention: do you know why cipux-cat-weasel hasnt > been packaged yet? Actually, we have an "unofficial" package on rp.skolelinux.de, but since it build-depends on stuff not packaged in Debian yet, it's complicated. Also, there are still a few problems with preconfiguration so that it starts out-of-the-box on Skolelinux, which need to be adressed. Martin wrote about that. Want to help? :-) Regards -Klaus -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101025124546.gi21...@knopper.net
Re: More on the future LDAP admin gui in Debian Edu
On Mon, Oct 25, 2010 at 02:07:48PM +0200, Klaus Knopper wrote: On Mon, Oct 25, 2010 at 02:02:26PM +0200, Philipp Huebner wrote: so the conclusion is the same simple one as stated much earlier in this thread: so far nobody has shown up who is willing (and able) to do the integration work (and the maintenance) to get CipUX into Skolelinux. It's not that CipUX is not wanted, but without manpower to get the work done there is simply no chance. [snip] Good summary. I think we got now to the core of the problem, just no solution yet. Well, I'll continue to search for packagers, and meanwhile we will continue to maintain our own repository which may not be compliant, but legitimate. ;-) Phillip did *not* mention packaging, but integration with Skolelinux and ongoing maintainance of that integration. In other words, it is a Skolelinux-specific task, not a general Debian task. Even if you consider CATweasel a crucial and mandatory part of your CipUX stack, the parts _below_ CATweasel, the ones in the CipUX project, needs to be integrated first - as was pointed out by others in this thread. So yes, CATweasel is not in Debian, so needs packaging, but no, CipUX itself has a packaging team already (me and Xavier, currently). Regards, - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: Digital signature
Re: More on the future LDAP admin gui in Debian Edu
Hello Jürgen, I'm trying to keep it short this time, since the outcome was already in the discussion thread with Philipp. :-) On Mon, Oct 25, 2010 at 12:52:52PM +0200, Jürgen Leibner wrote: > So I suspect you havn't read this: > http://wiki.debian.org/DebianEdu/Contribute/Development or asked to for > that information? The page says that it may be "outdated" because of work focus on the DVD, but since you recommend it, I assume it's still valid, which was also Philipps statement. I'm also using SVN for some of my own projects, but indeed, the possibility to just add packages as "request for comment" without prior discussion was new for me. So, you propose that I just create svn repositories for packages, maybe as duplicates of the ones from the individual developers? As mentioned earlier, the main problem is not technology or platform, but manpower. We have merely enough programmers for getting the software in a usable state, but packagers are even more rare. That's why we were setting our hopes in the community, i.e. is there anybody available for helping out with Skolelinux-specific packaging who could work with our team? Apparently, not yet. And before no official packages are present on the Skolelinux platform, CipUX won't appear on the installation CDs. > The french team has done their own add-on-cd in 2006. Their packages are > until now in the skolelinux svn. Have you tried to come in to the svn > with your packages? > > CipUX was added to the package lists for being on the CD/DVD by Xavier > Oswald in 2006 as the debian-edu changelog tells: > ---8< > [ Xavier Oswald ] > * main-server task: > - Depend on moodle-debian-edu-theme, moodle-cipux, cipux-all > - Recommend moodle-courses-fr, debian-edu-fr-all, > debian-edu-fr-skels. > These packages contain French data so they are reduce to > recommend. > - Depend on cipux-common, cipux-cibot, cipux-cat-webmin, cipux-rpc, > cipux-profile. These packages come from the cipux repository. > ---8< I believe that was the older CipUX version, but CipUX had been restarted from scratch since then, as far as Christian told me, and has a cleaner design right now, though less features than the old version. > Why not try to come in again? I'm eager to do this, but need help from the CipUX upstream developers plus one or the other Skolelinux packager in order to get things right. > As you can see how GOsa² came in, why didn't you try to do it the same > way? I didn't see Gosa coming in, sorry if I have not followed discussion close enough. > > What we DID is, installing CipUX on top of official Skolelinux, > > partly from existing packages made by Jonas Smedegaard, and the rest > > by following Kurt Gramlichs long installation instructions for those > > parts that are not officially packaged yet. Also, we created a new > > GUI (CATWeasel) designed to represent only the small subset of LDAP > > tasks needed by teachers and students, while most sysadmin tools are > > used by supporters in our schools and don't need to be accessible by > > teachers. We forked italc (since we were told not to - under any > > circumstances - change existing packages in Debian because some kind > > of assumed "policy violation" that I don't fully comprehend) for > > interfacing with examination mode and internet access control and a > > HTML widget to integrate with CipUX, for easy use by teachers from > > their desktop. In fact, there is a lot of work done in those yet > > "unofficial" packages that are designed to easily be installed on top > > of Skolelinux as well as Debian Lenny. > > Very good work, but why did you build your own infrastructure and did > not use ours? This is easy to answer. Like each and every Free Software project, ours too, has its own development platform right were our work focus is, and we also have our own hardware equipment that allows us to easily build and test a complete installation using a virtualized classroom, plus excellent internet connection at the university of applied sciences in Zweibrücken/Germany, where we also hold developer meetings. > > > So the question I agreed to is: > > > "Why are the people using it in Rheinland-Pfalz, are not activly > > > working on integrating CipUX in skolelinux?" > > > > > > > What is "this"? > > > > > > " integrating CipUX in skolelinux" > > > > So, again, what is "integrating CipUX in Skolelinux" other than > > deciding that existing installable packages are accepted and possibly > > modified in their initial setup so that they fit in? How can we do > > this? Not only for CipUX but also for italc and linbo (which are > > independent of CipUX)? > > This question I leave to be answered by the so called skolelinux > developers, cause I'm not one. ;-) I don't consider myself being a Skolelinux developer, rather a development coordinator for our local add-ons, but I would like to meet some volunteers that could help us with our packagi
Re: More on the future LDAP admin gui in Debian Edu
Hi Klaus, reading your mails, I'm not sure you are aware that Debian Edu / Skolelinux _is_ Debian? If you want to have cipux on Debian Edu, just run "apt-get install cipux". Voila. Debian squeeze consists of 14726 source package, Debian Edu squeeze consist of the same 14723 sources packages, plus 3 which are in different state atm. I still hope to finally reach our goal having this match 100% for the squeeze release or maybe a squeeze pointrelease. See http://ftp.skolelinux.org/skolelinux/squeeze_needs_love.html If you replace squeeze with lenny in that URL you'll see the progress we made since lenny :) There is also etch_needs_love... which shows a higher diff. So if you want to get something into Debian Edu, get it into Debian ;-) BTW, now that I have your attention: do you know why cipux-cat-weasel hasnt been packaged yet? cheers, Holger signature.asc Description: This is a digitally signed message part.
Re: More on the future LDAP admin gui in Debian Edu
On Mon, Oct 25, 2010 at 02:02:26PM +0200, Philipp Huebner wrote: > On 25/10/10 13:50, Klaus Knopper wrote: > >> The last point has nothing to do with CipUX upstream development or > >> packaging, those things are fine and can keep going the way they do. > > > > Great, that surely makes it easier. But still the problem remains of who > > will do the deed. > > [...] > > > My real question was, how can we get someone who gets CipUX into > > Skolelinux when none of the CipUX-Team managed to do this yet? Are there > > volunteeres, or people who can do this as a paid job? I'm asking because > > we did not find anyone yet. I don't feel qualified to do this by myself, > > since I don't know enough about CipUX and its LDAP+Perl dependencies. > > so the conclusion is the same simple one as stated much earlier in this > thread: so far nobody has shown up who is willing (and able) to do the > integration work (and the maintenance) to get CipUX into Skolelinux. > > It's not that CipUX is not wanted, but without manpower to get the work > done there is simply no chance. > > Of course your request for help from the Debian Edu people is > legitimate, but Debian Edu lacks manpower anyway. > For this reason and since CipUX is widely used and supported in > Skolelinux-RLP, it is legitimate for the Debian Edu people to give that > question back to those. Good summary. I think we got now to the core of the problem, just no solution yet. Well, I'll continue to search for packagers, and meanwhile we will continue to maintain our own repository which may not be compliant, but legitimate. ;-) Regards -Klaus -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101025120748.gg21...@knopper.net
Re: More on the future LDAP admin gui in Debian Edu
Hi, On 25/10/10 13:50, Klaus Knopper wrote: >> The last point has nothing to do with CipUX upstream development or >> packaging, those things are fine and can keep going the way they do. > > Great, that surely makes it easier. But still the problem remains of who > will do the deed. [...] > My real question was, how can we get someone who gets CipUX into > Skolelinux when none of the CipUX-Team managed to do this yet? Are there > volunteeres, or people who can do this as a paid job? I'm asking because > we did not find anyone yet. I don't feel qualified to do this by myself, > since I don't know enough about CipUX and its LDAP+Perl dependencies. so the conclusion is the same simple one as stated much earlier in this thread: so far nobody has shown up who is willing (and able) to do the integration work (and the maintenance) to get CipUX into Skolelinux. It's not that CipUX is not wanted, but without manpower to get the work done there is simply no chance. Of course your request for help from the Debian Edu people is legitimate, but Debian Edu lacks manpower anyway. For this reason and since CipUX is widely used and supported in Skolelinux-RLP, it is legitimate for the Debian Edu people to give that question back to those. Regards, -- .''`. Philipp Huebner : :' : pgp fp: 6719 25C5 B8CD E74A 5225 3DF9 E5CA 8C49 25E4 205F `. `'` HP: http://www.debalance.de, Skype: philipp-huebner `- ICQ: 235-524-440, Jabber: der_scha...@jabber.org signature.asc Description: OpenPGP digital signature
Re: More on the future LDAP admin gui in Debian Edu
Hello Philipp, On Mon, Oct 25, 2010 at 01:19:01PM +0200, Philipp Huebner wrote: > Hi, > > On 25/10/10 12:44, Klaus Knopper wrote: > > Hey, what about you? You are an official DM, aren't you? ;-) > > There is quite a difference between DM and DD, I am the latter. > But it doesn't matter here because I neither have the time nor the > interest to integrate CipUX into Skolelinux. Accepted. In knew you would say that. :-) > > So, your statement is that only if the CipUX team would transfer all of > > its development platforms to Skolelinux/Debian-alioth, it will happen > > that CipUX is recognized as an official option for LDAP account > > administration in Skolelinux? Is this really the procedure? I think not. > > > > Why can't Skolelinux instead check out from the official CipUX > > repositories and Debian packages for testing? Was Jonas work on Debian > > packages a waste of time? > > Sorry, it seems you have no understanding of Debian Edu's development > process at all and thus misunderstood me completely. Let's say, I understand the Debian Edu's development process in the greater parts, but still questioning in order to get an approach for improvement of my own understanding. ;-) > A few simple facts: > - the debian-edu-* packages are built from the SVN on alioth Yes. > - CD/DVD images are built from those packages, other files also from > that SVN and the Debian archive Yse. > - by working there I didn't mean copy all your packages there, I meant > to put your implementations there that pull in the cipux packages from > Debian and set them up correctly Yes. You again assume that developers of upstream will do all of this automatically on their own. Actually, I was asking for help from the Skolelinux community, for someone who is an expert in the process, and can do quicker and more easily what upstream apparently has difficulties with. As for linbo, I'm one of the upstream developers, yet I'm uncertain how to represent a 2 GB source building an operations system, as a single Debian-Edu package via SVN. > The last point has nothing to do with CipUX upstream development or > packaging, those things are fine and can keep going the way they do. Great, that surely makes it easier. But still the problem remains of who will do the deed. > >>> So, again, what is "integrating CipUX in Skolelinux" other than deciding > >>> that existing installable packages are accepted and possibly modified in > >>> their initial setup so that they fit in? How can we do this? Not only > >>> for CipUX but also for italc and linbo (which are independent of CipUX)? > >> > >> => SVN on alioth > > > > Sorry, I don't think you can demand from all Free Software projects to > > exclusively work on the Debia-Edu SVN in order to get recognized at all. > > That's not what I said. I said the SVN is where Debian Edu is made, the > point for _integrating_ additional software. > > I don't see how you could understand me that wrong. Following your > assumption, Debian Edu would need to have a copy of the complete Debian > Archive in that SVN repository. Actually, the GPL demands to copy the complete source when a derivate is made, of all dependencies incolved. For Knoppix, I need to keep about 3 GB of sources for each DVD I release, even that 99% are pure and unchanged Debian packages. I had a discussion with the FSF about this, and it seems tobe necessary to really provide the complete source when you release binaries, ponting to upstream is no enough. Well, off-topic now. My real question was, how can we get someone who gets CipUX into Skolelinux when none of the CipUX-Team managed to do this yet? Are there volunteeres, or people who can do this as a paid job? I'm asking because we did not find anyone yet. I don't feel qualified to do this by myself, since I don't know enough about CipUX and its LDAP+Perl dependencies. > Jürgen already pointed you to > http://wiki.debian.org/DebianEdu/Contribute/Development Yes, that was indeed helpful, but does not cover the entire story. > Although that page could use some polishing, it is still mostly correct. Well, the page says it may be outdated, but that seems to be common practice nowadays. ;-) > And as a last reminder: this thread was and is only about "the future > LDAP admin gui in Debian Edu" and thus CipUX. The other additional > features of Skolelinux-RLP don't belong here. Sorry, you are of course right, I will change the mail subject for the other topics which are no less important to us than CipUX. Regards -Klaus -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101025115048.ge21...@knopper.net
Re: More on the future LDAP admin gui in Debian Edu
Hello, On Mon, Oct 25, 2010 at 01:31:50AM +0200, Klaus Knopper wrote: > On Mon, Oct 25, 2010 at 12:26:49AM +0200, Jürgen Leibner wrote: > > On Sunday 24 October 2010 23:20 Klaus Knopper wrote: > > As Holger Levsen asks: "who in skolelinux is activly working on > > integrating cipux?" which is "doing this". I think we work (and worked in the past) a lot to make CipUX usable within Skolelinux. We even developed a GUI for it: Catweasel. But to be honest, I can understand why it is not officially packaged yet. A working Catweasel depends on a configured CipUX. If CipUX is not installed and configured correctly you simply can't use Catweasel. You will login and see an empty set of configuration modules. Or you won't even be able to login. To fulfill the dependency to CipUX the appropriate packages have to be installed (that's the easy part, dependencies solve this) and this howto needs to be executed: http://wiki.cipux.org/installation/cipux_340x_debian_edu To resolve CipUX-ready-for-Catweasel as dependency, these steps need to be automated inside the CipUX packages. This would be the expected behaviour for complex packages. Honestly, we don't want these steps inside a big installation script. It would of course be possible, but I would consider this an ugly solution. If we get that far the Catweasel installation is pretty easy. There are one or two minor problems (Google Webkit not packaged for Lenny [a build dependency], Catweasel itself is not completely finished) but these are definitely no show stoppers. CipUX is a quite solid middleware that solves a lot of problems. It may not be perfect yet (common problem of software, we can live with this) but together with Catweasel we have a nice frontend for the teacher. Both can be enhanced for our needs that are not that uncommon. Remember, the features we implement are wishlist items from teachers. We're free to exchange the frontent of CipUX depending on our needs (this speaks for a good system design), so if we need an accessible GUI we can plug it in. Most probably you're following the same goal with GOsa. Everyone here is interested to have our stuff integrated in Skolelinux, everyone wants this stuff in Debian, but at the moment we don't progress as expected with packaging (see above). Concerning Skolelinux and RLP modifications for Skolelinux: I don't think there is a need for differences. To be honest, the people that currently write code (Christian, Jochen, Klaus, me) are busy finishing their work so there is not much time for interaction with the core group from Oslo at the moment. We need to work on this, really. :-) Of course we follow different needs *in small details* but if you take a look at the bigger picture, we're bringing Linux to schools. And we decided to do this using Skolelinux. Regards, Martin -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101025115021.go9...@localhost.localdomain
Re: More on the future LDAP admin gui in Debian Edu
Hi, On 25/10/10 12:44, Klaus Knopper wrote: > Hey, what about you? You are an official DM, aren't you? ;-) There is quite a difference between DM and DD, I am the latter. But it doesn't matter here because I neither have the time nor the interest to integrate CipUX into Skolelinux. > So, your statement is that only if the CipUX team would transfer all of > its development platforms to Skolelinux/Debian-alioth, it will happen > that CipUX is recognized as an official option for LDAP account > administration in Skolelinux? Is this really the procedure? I think not. > > Why can't Skolelinux instead check out from the official CipUX > repositories and Debian packages for testing? Was Jonas work on Debian > packages a waste of time? Sorry, it seems you have no understanding of Debian Edu's development process at all and thus misunderstood me completely. A few simple facts: - the debian-edu-* packages are built from the SVN on alioth - CD/DVD images are built from those packages, other files also from that SVN and the Debian archive - by working there I didn't mean copy all your packages there, I meant to put your implementations there that pull in the cipux packages from Debian and set them up correctly The last point has nothing to do with CipUX upstream development or packaging, those things are fine and can keep going the way they do. >>> So, again, what is "integrating CipUX in Skolelinux" other than deciding >>> that existing installable packages are accepted and possibly modified in >>> their initial setup so that they fit in? How can we do this? Not only >>> for CipUX but also for italc and linbo (which are independent of CipUX)? >> >> => SVN on alioth > > Sorry, I don't think you can demand from all Free Software projects to > exclusively work on the Debia-Edu SVN in order to get recognized at all. That's not what I said. I said the SVN is where Debian Edu is made, the point for _integrating_ additional software. I don't see how you could understand me that wrong. Following your assumption, Debian Edu would need to have a copy of the complete Debian Archive in that SVN repository. Jürgen already pointed you to http://wiki.debian.org/DebianEdu/Contribute/Development Although that page could use some polishing, it is still mostly correct. And as a last reminder: this thread was and is only about "the future LDAP admin gui in Debian Edu" and thus CipUX. The other additional features of Skolelinux-RLP don't belong here. Regards, -- .''`. Philipp Huebner : :' : pgp fp: 6719 25C5 B8CD E74A 5225 3DF9 E5CA 8C49 25E4 205F `. `'` HP: http://www.debalance.de, Skype: philipp-huebner `- ICQ: 235-524-440, Jabber: der_scha...@jabber.org signature.asc Description: OpenPGP digital signature
Re: More on the future LDAP admin gui in Debian Edu
On Mon, Oct 25, 2010 at 12:00:01PM +0200, Philipp Huebner wrote: > On 25/10/10 01:31, Klaus Knopper wrote: > > None of us can "integrate CipUX into Skolelinux". We need an official > > Yes you can! That's always nice to hear, over and over again. My problem is that from personal experience, I lost my faith in believing in that over-simplified motivational phrase when just nothing happens after almost 3 years of vain efforts from our developers to assemble a larger group of Skolelinux developers for the team, endless discussions + a lot of contraversity about "which is the right way" instead of working on concrete solutions for real problems. My motto is now rather "do it yourself and publish your results, it may happen that someone gets interested and wants to join". Keep in mind that we cannot justify for schools who want their installation happen in time for the new school year to begin, that we have to wait for the community to make a decision, or for official maintainers to take over a package. Hey, what about you? You are an official DM, aren't you? ;-) > > Debian-Edu maintainer to do this. None of our developers is capable of > > making an official decision on which packages go into Skolelinux and > > which don't (at least I don't recall having one in our group yet). We > > WISH that all of our stuff goes into Skolelinux as optional add-on some > > day, as soon as it's complete (and most of it is), but we are not the > > decision makers here. > > The usual procedure so far has been that somebody prepared a new feature > and gave the others the possibility to test and then judge it. > Since the work is done in SVN, the change could be easily reverted if > neglected. So, your statement is that only if the CipUX team would transfer all of its development platforms to Skolelinux/Debian-alioth, it will happen that CipUX is recognized as an official option for LDAP account administration in Skolelinux? Is this really the procedure? I think not. Why can't Skolelinux instead check out from the official CipUX repositories and Debian packages for testing? Was Jonas work on Debian packages a waste of time? > Debian Edu is a rather open project. So are the majority of Free Software projects. > If you would like to join, simply > contribute to the project via bugzilla and alioth and additionally ask > for an account on the developer machines. I know the procedure of joining Skolelinux, but apparently, it did not work for CipUX. > AFAIK, there are no strictly defined rules who may decide on Skolelinux > features. Probably, but I can rather live with a definite decision NOT to include CipUX in Skole, than uncertainty and doubt. We will continue using CipUX in the RLP project unless Skolelinux comes up with something more useful and compatible with our subprojects. > Those who care take part in the discussions and the majority decides. > At least that is what I experienced and how I got to Debian Edu. It's good that it worked for you. Although it may sound this way, I'm not bitter about that it did not work out that way for CipUX and the RLP extensions, but still looking forward for it to happen even some day after our official project end. > >> So the question I agreed to is: > >> "Why are the people using it in Rheinland-Pfalz, are not activly working > >> on integrating CipUX in skolelinux?" > >> > >>> What is "this"? > >> > >> " integrating CipUX in skolelinux" > > > > So, again, what is "integrating CipUX in Skolelinux" other than deciding > > that existing installable packages are accepted and possibly modified in > > their initial setup so that they fit in? How can we do this? Not only > > for CipUX but also for italc and linbo (which are independent of CipUX)? > > => SVN on alioth Sorry, I don't think you can demand from all Free Software projects to exclusively work on the Debia-Edu SVN in order to get recognized at all. > There is a big difference between packages being available in Debian and > them being set up and pre-configured correctly with the Debian Edu > installer. Apparently, the CipUX-Team alone was not able to address these necessary changes on its own, and needs help from the Skolelinux community. > > Unfortunately, the developer base working on CipUX itself is very small, > > but, as Jonas already said, the core parts of CipUX are already in > > Debian. > > > > What needs to be changed in order to make these packages fit into an > > official Debian blend, needs to be done by an official Debian-Edu > > maintainer, or am I wrong here? It's not sufficient that our packages > > run fine on our own Skolelinux installations. > > I already tried to describe it above: the description "official > Debian-Edu maintainer/developer" doesn't fit reality. > Basically anybody who supports Skolelinux and who's work is appreciated > by the existing contributors can get an account and call himself a > Debian Edu Developer. > There's nothing like the Debian NM process in place for Debia
Re: More on the future LDAP admin gui in Debian Edu
Hi, On 25/10/10 01:31, Klaus Knopper wrote: > None of us can "integrate CipUX into Skolelinux". We need an official Yes you can! > Debian-Edu maintainer to do this. None of our developers is capable of > making an official decision on which packages go into Skolelinux and > which don't (at least I don't recall having one in our group yet). We > WISH that all of our stuff goes into Skolelinux as optional add-on some > day, as soon as it's complete (and most of it is), but we are not the > decision makers here. The usual procedure so far has been that somebody prepared a new feature and gave the others the possibility to test and then judge it. Since the work is done in SVN, the change could be easily reverted if neglected. Debian Edu is a rather open project. If you would like to join, simply contribute to the project via bugzilla and alioth and additionally ask for an account on the developer machines. AFAIK, there are no strictly defined rules who may decide on Skolelinux features. Those who care take part in the discussions and the majority decides. At least that is what I experienced and how I got to Debian Edu. >> So the question I agreed to is: >> "Why are the people using it in Rheinland-Pfalz, are not activly working >> on integrating CipUX in skolelinux?" >> >>> What is "this"? >> >> " integrating CipUX in skolelinux" > > So, again, what is "integrating CipUX in Skolelinux" other than deciding > that existing installable packages are accepted and possibly modified in > their initial setup so that they fit in? How can we do this? Not only > for CipUX but also for italc and linbo (which are independent of CipUX)? => SVN on alioth There is a big difference between packages being available in Debian and them being set up and pre-configured correctly with the Debian Edu installer. > Unfortunately, the developer base working on CipUX itself is very small, > but, as Jonas already said, the core parts of CipUX are already in > Debian. > > What needs to be changed in order to make these packages fit into an > official Debian blend, needs to be done by an official Debian-Edu > maintainer, or am I wrong here? It's not sufficient that our packages > run fine on our own Skolelinux installations. I already tried to describe it above: the description "official Debian-Edu maintainer/developer" doesn't fit reality. Basically anybody who supports Skolelinux and who's work is appreciated by the existing contributors can get an account and call himself a Debian Edu Developer. There's nothing like the Debian NM process in place for Debian Edu. If you want to do work for Skolelinux, get started! There is nothing that holds you back, except for your imagination (and probably your time). >>> What does it mean? >> >> Making CipUX being on the install medium and provide it ready to use and >> preconfigured at first boot after installation. > > So, how can I make CipUX "appear" on the official Skolelinux install > medium? Make it a working alternative by working on the SVN and thus making it appear on the install media. Of course it requires some time until you have figured out how the Debian Edu Installer works. Andreas B. Mundt has done this with gosa in a rather short time and an excellent way I think. You could simply follow his example. Regards, -- .''`. Philipp Huebner : :' : pgp fp: 6719 25C5 B8CD E74A 5225 3DF9 E5CA 8C49 25E4 205F `. `'` HP: http://www.debalance.de, Skype: philipp-huebner `- ICQ: 235-524-440, Jabber: der_scha...@jabber.org signature.asc Description: OpenPGP digital signature
Re: More on the future LDAP admin gui in Debian Edu
On Mon, Oct 25, 2010 at 12:26:49AM +0200, Jürgen Leibner wrote: > On Sunday 24 October 2010 23:20 Klaus Knopper wrote: > > Hello Jürgen, > > > > On Sun, Oct 24, 2010 at 10:33:45PM +0200, Jürgen Leibner wrote: > > > On Sunday 24 October 2010 21:55 Philipp Huebner wrote: > > > > Hi, > > > > > > > > On 23/10/10 17:14, Holger Levsen wrote: > > > > >>> who in skolelinux is activly working on integrating cipux? > > > > >> > > > > >> Noone. > > > > > > > > > > Which makes me wonder why the people using it in > > > > > Rheinland-Pfalz are not doing this. Or why you dont do it. Care > > > > > to explain? > > > > > > > > IMHO this is a very good question which I would also love to see > > > > answered. > > > > > > > > > > > > Regards, > > > > > > +1 > > > > > > ... and me would also like to hear a statement / answer from the > > > project leader of the RLP project to the question above to get it > > > answered from the officials. > > > > I'm not sure whether I qualify as "official", but from my point of > > view as coordinator of developers for Skolelinux-RLP, all of our > > previous attempts of working together with the Skolelinux community, > > trying to integrate new features and options/requirements that are > > necessary by (german) law for german schools, have been turned down > > as being "not very interesting for mainstream Skolelinux" (exam mode) > > or "violating the policy" (italc), which is kind of frustrating, as > > you can imagine. > > For me, you quallify as an official. > As I'm having an eye on CipUX since it was first shown to the project on > the gathering in Erkelenz (Germany) in 2006 iirc and being part of the > CipUX-Project at that time where the decision was done to choose LWAT > and not CipUX, you can beleave me, that I can understand that kind of > frustration. LWAT was OK, when it was still working. On the previous-last Skolelinux edition, LWAT even worked parallel to CipUX. > But for me it is much more frustrating to see people with that huge > amount of knowledge like you, Petter Reinholdsen and others, not > pulling at the same end of the rope. Actually, I think we do. We just have different priorities. My job in RLP is making sure that things required for our schools are present at the end of the project, which means, I have to work with fixed deadlines as well as regulations determined by law and our project requirements specification that was given to me. Petter does not have to follow any of these restrictions, and I can understand if he thinks that they are extra work not currently relevant to Skolelinux. Also, release schedule of Skolelinux updates is much more relaxed than ours, because as usual in free software, mainstream Skolelinux is ready when it's ready, while our tools have to be production-ready as soon as schools are scheduled for installation. > > Besides administration of classes, this mainly concerns examination > > modes and requirements for privacy and teacher supervision of > > desktops, disk quotas and x2go as replacement for ltsp. > > > > Before I get too much into details which you probably don't intended > > to hear, would you please define for me the part "not doing this" in > > the quote you voted +1 for: > > > >"Which makes me wonder why the people using it in Rheinland-Pfalz > > are not doing this." > > As Holger Levsen asks: "who in skolelinux is activly working on > integrating cipux?" which is "doing this". Sorry, I think you missed my point. None of us can "integrate CipUX into Skolelinux". We need an official Debian-Edu maintainer to do this. None of our developers is capable of making an official decision on which packages go into Skolelinux and which don't (at least I don't recall having one in our group yet). We WISH that all of our stuff goes into Skolelinux as optional add-on some day, as soon as it's complete (and most of it is), but we are not the decision makers here. What we DID is, installing CipUX on top of official Skolelinux, partly from existing packages made by Jonas Smedegaard, and the rest by following Kurt Gramlichs long installation instructions for those parts that are not officially packaged yet. Also, we created a new GUI (CATWeasel) designed to represent only the small subset of LDAP tasks needed by teachers and students, while most sysadmin tools are used by supporters in our schools and don't need to be accessible by teachers. We forked italc (since we were told not to - under any circumstances - change existing packages in Debian because some kind of assumed "policy violation" that I don't fully comprehend) for interfacing with examination mode and internet access control and a HTML widget to integrate with CipUX, for easy use by teachers from their desktop. In fact, there is a lot of work done in those yet "unofficial" packages that are designed to easily be installed on top of Skolelinux as well as Debian Lenny. > So the question I agreed to is: > "Why are the people using it in Rheinland-Pfalz, are n
Re: More on the future LDAP admin gui in Debian Edu
Hello Jürgen, On Sun, Oct 24, 2010 at 10:33:45PM +0200, Jürgen Leibner wrote: > On Sunday 24 October 2010 21:55 Philipp Huebner wrote: > > Hi, > > > > On 23/10/10 17:14, Holger Levsen wrote: > > >>> who in skolelinux is activly working on integrating cipux? > > >> > > >> Noone. > > > > > > Which makes me wonder why the people using it in Rheinland-Pfalz > > > are not doing this. Or why you dont do it. Care to explain? > > > > IMHO this is a very good question which I would also love to see > > answered. > > > > > > Regards, > > +1 > > ... and me would also like to hear a statement / answer from the > project leader of the RLP project to the question above to get it > answered from the officials. I'm not sure whether I qualify as "official", but from my point of view as coordinator of developers for Skolelinux-RLP, all of our previous attempts of working together with the Skolelinux community, trying to integrate new features and options/requirements that are necessary by (german) law for german schools, have been turned down as being "not very interesting for mainstream Skolelinux" (exam mode) or "violating the policy" (italc), which is kind of frustrating, as you can imagine. Besides administration of classes, this mainly concerns examination modes and requirements for privacy and teacher supervision of desktops, disk quotas and x2go as replacement for ltsp. Before I get too much into details which you probably don't intended to hear, would you please define for me the part "not doing this" in the quote you voted +1 for: "Which makes me wonder why the people using it in Rheinland-Pfalz are not doing this." What is "this"? What does it mean? What else can we do to help getting our extensions into Skolelinux, besides providing a proof-of-concept of our addons working in schools, in real life? > Greetings, Jürgen Greets -Klaus -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101024212029.gi8...@knopper.net
Re: More on the future LDAP admin gui in Debian Edu
Hi Philipp & List, On Sun, Oct 24, 2010 at 09:55:02PM +0200, Philipp Huebner wrote: > Hi, > > On 23/10/10 17:14, Holger Levsen wrote: > >>> who in skolelinux is activly working on integrating cipux? > >> Noone. > > > > Which makes me wonder why the people using it in Rheinland-Pfalz are not > > doing > > this. Or why you dont do it. Care to explain? > > IMHO this is a very good question which I would also love to see answered. Alright, then, what do we have to do to get CipUX into Skolelinux? I, too, would love to see that question answered. Actually, we asked this question over a year ago at the developer meeting in Oslo. :-) The same question would be asked for - italc-rlp - linbo-rlp which are currently all "unofficial" add-on packages available on http://rp.skolelinux.de/packages/ . Anyone willing to take over official Skolelinux package maintainership? Regards -Klaus -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101024204633.gg8...@knopper.net
Re: More on the future LDAP admin gui in Debian Edu
On Sun, Oct 24, 2010 at 09:55:02PM +0200, Philipp Huebner wrote: Hi, On 23/10/10 17:14, Holger Levsen wrote: who in skolelinux is activly working on integrating cipux? Noone. Which makes me wonder why the people using it in Rheinland-Pfalz are not doing this. Or why you dont do it. Care to explain? IMHO this is a very good question which I would also love to see answered. +1 - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: Digital signature
Re: More on the future LDAP admin gui in Debian Edu
Hi, On 23/10/10 17:14, Holger Levsen wrote: >>> who in skolelinux is activly working on integrating cipux? >> Noone. > > Which makes me wonder why the people using it in Rheinland-Pfalz are not > doing > this. Or why you dont do it. Care to explain? IMHO this is a very good question which I would also love to see answered. Regards, -- .''`. Philipp Huebner : :' : pgp fp: 6719 25C5 B8CD E74A 5225 3DF9 E5CA 8C49 25E4 205F `. `'` HP: http://www.debalance.de, Skype: philipp-huebner `- ICQ: 235-524-440, Jabber: der_scha...@jabber.org signature.asc Description: OpenPGP digital signature
Re: More on the future LDAP admin gui in Debian Edu
On Samstag, 23. Oktober 2010, Jonas Smedegaard wrote: > On Sat, Oct 23, 2010 at 06:32:39PM +0200, Andreas B. Mundt wrote: > >Regardless of my new job it's not (and probably has and will never be > >the case) that we have too many developers. > > > >That's the main reason why I always favor a standard setup, where the > >work left for the project is the configuration of available software > >packages and there's no need to code at all. > > +1 me too, cheers, Holger signature.asc Description: This is a digitally signed message part.
Re: More on the future LDAP admin gui in Debian Edu
On Sat, Oct 23, 2010 at 06:32:39PM +0200, Andreas B. Mundt wrote: On Sat, Oct 23, 2010 at 01:07:27PM +0200, Jonas Smedegaard wrote: Andreas Mundt has been _very_ active on GoSA (and thanks for that!) but now starts as a teacher and do not expect himself to be able to continue contributing at same pace. Regardless of my new job it's not (and probably has and will never be the case) that we have too many developers. That's the main reason why I always favor a standard setup, where the work left for the project is the configuration of available software packages and there's no need to code at all. +1 - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: Digital signature
Re: More on the future LDAP admin gui in Debian Edu
On Sat, Oct 23, 2010 at 01:07:27PM +0200, Jonas Smedegaard wrote: > Andreas Mundt has been _very_ active on GoSA (and thanks for that!) > but now starts as a teacher and do not expect himself to be able to > continue contributing at same pace. Regardless of my new job it's not (and probably has and will never be the case) that we have too many developers. That's the main reason why I always favor a standard setup, where the work left for the project is the configuration of available software packages and there's no need to code at all. Following this philosophy, we would only install the squeeze packages (as it's done already) and provide a prepared ldap tree. That's all. Part of this tree is already there, and another part is here (experimental): http://svn.debian.org/wsvn/debian-edu/trunk/src/debian-edu-config/ldap-bootstrap/gosa-server.ldif> The more we depart from the standard way provided by the packages, the more work has to be done by us. Especially if the person who does the work sees no real benefit of debian-edu specialities, this will always be a problem. We better invest time and resources in features that are not (yet) available but provide real benefit. In addition, this is where upstream will have open ears too. Best regards, Andi -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101023163239.ga3...@flashgordon
Re: More on the future LDAP admin gui in Debian Edu
On Sat, Oct 23, 2010 at 05:14:50PM +0200, Holger Levsen wrote: >cipux is, but afaik cipux is not the UI. When I say that it is in Debian, I mean it. I'm sorry, but in <20101023110727.gl5...@jones.dk> you said Cipux is used in Rheinland-Pfalz and that it should be trivial to include it into Edu as its already in Debian and in the mail I'm now answering to you say that some important part of Cipux (called CatWeasel, used in Rheinland-Pfalz) is not packaged yet. I never claimed CATweasel to be an important part of CipUX. I did, however, describe it as an "alternative". No, I do not mean an alternative to a library. No, I do not mean an alternative to a CLI (command-line interface). Halleluja, what a fruitful discussion. Why the heck don't you just answer my short simple question?!?!?!? - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: Digital signature
Re: More on the future LDAP admin gui in Debian Edu
Hi, On Samstag, 23. Oktober 2010, Jonas Smedegaard wrote: > >yes, but last I heard it wasnt installable from packages. > > Interesting. Would be nice if that could be filed as a bugreport. > > Yes, I did notice that you only *heard* about this, so do not want you > to file a bugreport yourself but wish that you would ask those you heard > it from to maybe do so: bugfixing is difficult based only on a rumor - > as is decision making. Absolutly. I just searched in relevant mailinglists and couldnt find the mail from where I took the info. :( http://wiki.cipux.org/installation/cipux_340x_debian_edu is for lenny, so I have a question now: assuming one is using the official Debian squeeze repo and not yours, does one still need to download a CipUX-Trait-DebianEdu-3.4.0.3.tar.gz ? > >cipux is, but afaik cipux is not the UI. > > When I say that it is in Debian, I mean it. I'm sorry, but in <20101023110727.gl5...@jones.dk> you said Cipux is used in Rheinland-Pfalz and that it should be trivial to include it into Edu as its already in Debian and in the mail I'm now answering to you say that some important part of Cipux (called CatWeasel, used in Rheinland-Pfalz) is not packaged yet. > I found it irrelevant to go into detail in this thread, but can do so > if you insist. We are looking for an admin user interface, so I think it is relevant, whether a cipux UI is available. And if a tool has several UIs, it is relevant which are available. (Then, the detail that some people (including me) consider a CLI an UI is irrelevant nitpicking IMO, as we are looking for a UI for all/many people.) > Both CLI tools and the web-based UI provided as part of CipUX itself, > called CipUX CAT Web, are packaged officially for Debian. packaged for or available in? (sorry if you obviously ment both :) > An alternative web-based UI, called CATweasel, which funded and promoted > by the Skolelinux Rheinland-Pfalz project, is still in development and > not packaged officially. :( > >who in skolelinux is activly working on integrating cipux? > Noone. Which makes me wonder why the people using it in Rheinland-Pfalz are not doing this. Or why you dont do it. Care to explain? > Do you still remember what was the main message of my email, or did you > succeed by now in distracting the conversation? I don't think discussing the usefulness/readyness of cipux is distracting the conversation. AFAICS the topic is "LDAP admin gui"... > Now would you please care to answer my question? > >which cipux-UI are available in squeeze today? If your main question was whether _I_ work on integrating gosa2 in Debian Edu, the answer is yes. So that's at least 3 people. cheers, Holger, sad about the nitpicky language of this subthread signature.asc Description: This is a digitally signed message part.
Re: More on the future LDAP admin gui in Debian Edu
Dear Skolelinux's friends, I think that discussion is very important. I suggest the persons (with divergence) talk and work to establish a road map (cronogram) to determine what could be released soon in squeeze, but it also verify the future possibilities. I think that everybody wish the best to Skolelinux, but there is variety in knowledge and experience that need matching. Thanks, Sérgio Saraiva 2010/10/23 Jonas Smedegaard > On Sat, Oct 23, 2010 at 03:03:30PM +0200, Holger Levsen wrote: > >> On Samstag, 23. Oktober 2010, Jonas Smedegaard wrote: >> >>> It should not be "unknown" that CipUX is in production use on >>> Skolelinux-based systems in Rheinland-Pfalz. >>> >> >> yes, but last I heard it wasnt installable from packages. >> > > Interesting. Would be nice if that could be filed as a bugreport. > > Yes, I did notice that you only *heard* about this, so do not want you to > file a bugreport yourself but wish that you would ask those you heard it > from to maybe do so: bugfixing is difficult based only on a rumor - as is > decision making. > > > > It should be trivial to include CipUX, as it is already officially in >>> Debian. >>> >> >> cipux is, but afaik cipux is not the UI. >> > > When I say that it is in Debian, I mean it. > > I found it irrelevant to go into detail in this thread, but can do so if > you insist. > > Do you still remember what was the main message of my email, or did you > succeed by now in distracting the conversation? > > > > which cipux-UI are available in squeeze today? >> > > Both CLI tools and the web-based UI provided as part of CipUX itself, > called CipUX CAT Web, are packaged officially for Debian. > > An alternative web-based UI, called CATweasel, which funded and promoted by > the Skolelinux Rheinland-Pfalz project, is still in development and not > packaged officially. > > > > Who else in Skolelinux besides Andreas is actively working on GoSA? >>> >> >> who in skolelinux is activly working on integrating cipux? >> > > Noone. > > Now would you please care to answer my question? > > > > - Jonas > > -- > * Jonas Smedegaard - idealist & Internet-arkitekt > * Tlf.: +45 40843136 Website: http://dr.jones.dk/ > > [x] quote me freely [ ] ask before reusing [ ] keep private > > -BEGIN PGP SIGNATURE- > Version: GnuPG v1.4.10 (GNU/Linux) > > iQIcBAEBCgAGBQJMwuj9AAoJECx8MUbBoAEhXZMP/jb1sG3z37csfkWAevHLhHvT > X7/j9wiiMEh9AKQv+y/X+AANqPpzl/vQp2Dm7eBtvf6aHuQMXZkjoY57Ztdo+xIn > uxeVkFBFAMMZ3w6OtsHg+XHLRlqVVl4yofQIS534AxPi/y1QXZCyNe85bAU/7e25 > /eUd9alCjsKIHUK4p3vjYY5P9iD9d45wqmasCXVWEKWsEVd6Uroz3CIHXXyMTgOS > E2RaqUWAab66JZ5uqN1uQ2YtPiJThjGsD6+ZjPQicpu7KECr59A/n1ZMKfAPPUEP > WtTtoMfJr9QMXvpijca3AKtwhTbjiIanlCpW6bBp0eybTlAVmDXHq3Vhn2/xtiJ/ > RDVgaNIvsgJDeP1WiZBc6ynO3kfgvpiCVtrIHEEpDgtdtRIgxgIi7XIquzrg8J+l > eJPaGNjtKiJzABYuGoPjOvFn9C4J/PQJK0HNA+M9CbEpQdPenhB4SU/QgtKfGi6C > 2i+P/z8niF6iLGJJohdfWrGWzyngR36oOPmvPyA7Gt+2sO9FTh1VavP8y2OqIBkP > H5Mr6Sehv1qfASVVqrRQXX9dH9SGa7riQAQg02vIB4zY5Pymm+OnGYqDNYSY6p6H > cZWxJf/Hiz4O9AygwNh7+fiE5hj13mTIOelIjgHa9NFoMwXzAURcay+UT918/6lK > Tl4qW8UdxegG1xFc1bF6 > =0TeX > -END PGP SIGNATURE- > >
Re: More on the future LDAP admin gui in Debian Edu
On Sat, Oct 23, 2010 at 03:03:30PM +0200, Holger Levsen wrote: On Samstag, 23. Oktober 2010, Jonas Smedegaard wrote: It should not be "unknown" that CipUX is in production use on Skolelinux-based systems in Rheinland-Pfalz. yes, but last I heard it wasnt installable from packages. Interesting. Would be nice if that could be filed as a bugreport. Yes, I did notice that you only *heard* about this, so do not want you to file a bugreport yourself but wish that you would ask those you heard it from to maybe do so: bugfixing is difficult based only on a rumor - as is decision making. It should be trivial to include CipUX, as it is already officially in Debian. cipux is, but afaik cipux is not the UI. When I say that it is in Debian, I mean it. I found it irrelevant to go into detail in this thread, but can do so if you insist. Do you still remember what was the main message of my email, or did you succeed by now in distracting the conversation? which cipux-UI are available in squeeze today? Both CLI tools and the web-based UI provided as part of CipUX itself, called CipUX CAT Web, are packaged officially for Debian. An alternative web-based UI, called CATweasel, which funded and promoted by the Skolelinux Rheinland-Pfalz project, is still in development and not packaged officially. Who else in Skolelinux besides Andreas is actively working on GoSA? who in skolelinux is activly working on integrating cipux? Noone. Now would you please care to answer my question? - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: Digital signature
Re: More on the future LDAP admin gui in Debian Edu
Hi, On Samstag, 23. Oktober 2010, Jonas Smedegaard wrote: > It should not be "unknown" that CipUX is in production use on > Skolelinux-based systems in Rheinland-Pfalz. yes, but last I heard it wasnt installable from packages. > It should be trivial to include CipUX, as it is already officially in > Debian. cipux is, but afaik cipux is not the UI. which cipux-UI are available in squeeze today? > Who else in Skolelinux besides Andreas is actively working on GoSA? who in skolelinux is activly working on integrating cipux? cheers, Holger signature.asc Description: This is a digitally signed message part.
Re: More on the future LDAP admin gui in Debian Edu
On Sat, Oct 23, 2010 at 02:27:32PM +0200, Benoit Mortier wrote: The idea behind using GOsa² is that the software is mature, supported and have people willing to help debian Edu to use it :) Yes. That is the idea behind CipUX too. Or do you mean to say that all of those favor GOsa² over CipUX? Who else in Skolelinux besides Andreas is actively working on GoSA? i offered my help, and already started at looking at and ldap tree from debian-edu to see how it fit onto GOsa² and what is missing. Great! - Jonas P.S. Sorry for consistently misspelling GOsa² previously - I have no idea where I got that from. -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: Digital signature
Re: More on the future LDAP admin gui in Debian Edu
Le Friday 22 October 2010 16:38:13 Petter Reinholdtsen, vous avez écrit : > [Andreas B. Mundt] Hello, [] > > Main difference to our current setup: Bind instead of powerDNS. > > Actually, we can continue to use powerDNS if we adjust GOsa to update > an extra attribute in the DNS tree. See > http://article.gmane.org/gmane.comp.ldap.gosa/506> for the > details. i could look at it but we discussed about a global schema for bind and powerdns, is this done already ? > > I think the decision we have to take is: Do we want to continue > > using powerDNS (which means we cannot use the GOsa packages because > > they use bind, so we have to find a solution, hack something or > > whatever...) or can we switch to bind which should make most (if not > > all) of the tools we need available in the squeeze repositories. So > > if there are no grave arguments against bind I think that's the > > easier way to go. > > I believe we want to continue to use a DNS server that look up > information directly in LDAP, to ensure that DNS changes done in LDAP > take effect imediately. All the bind based solutions I have seen so > far uses regular exports from LDAP to files bind understands, causing > a delay until changes show up in DNS. Because of this, I believe we > are better off by keeping PowerDNS. And thus I believe a third option > - change GOsa to work with PowerDNS - is the best one. i understand your reason well i could take the actual dns plugin and look if we can change it to manage powerdns Cheers -- Benoit Mortier CEO OpenSides "logiciels libres pour entreprises" : http://www.opensides.eu/ Promouvoir et défendre le Logiciel Libre http://www.april.org/ Contributor to Gosa Project : http://gosa-project.org/ -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/201010231445.03441.benoit.mort...@opensides.be
Re: More on the future LDAP admin gui in Debian Edu
Le Friday 22 October 2010 16:07:50 Andreas B. Mundt, vous avez écrit : > Hi all, Hello, > with regard to the replies to my mail, I conclude that we agree that > for the time being it is best to focus on GOsa for squeeze. I hoped > that we can get some consensus, which seems to be the case, at > least when I look at the replies so far. Cool > Well, then let's start to have a look and discuss what needs to be > done. > > On Thu, Oct 21, 2010 at 05:55:45PM +0200, Petter Reinholdtsen wrote: > [...] > > > For the specific LDAP setup, I believe we should change our Gosa > > setup to have a "flat" ldap directory (ie no students and teachers > > subtrees), and use the traditional three levels of administrative > > access (admin with full access, jr. admin with limited access and the > > rest with no special privileges. > > The idea behind the structure I implemented so far (separated teacher- > and student sub-trees) is the following: > > This structure allows the application of additional access rules. From > my experience, students loose their password (and if you really force > them not to loose it, they will either choose '123' and/or write it > down. Both things you don't want to teach them). So there will be > lectures where the students/pupils have to work at the machines, and > in the frequent case one or two students will not be able to log in. > You can say: 'Well that's not my problem', but depending on age and > school it will become your problem, for example when your lecture is > spoiled by these two pupils (they are not able to do anything now and > look for interesting alternatives). Or when parents turn up and > complain. > > So in my opinion, every teacher needs to be able to change/renew the > password of a pupil. If only admins or jadmins can do that, they will > not be available when needed (or every teacher will be jadmin, which > you also don't want). > > With the teacher and student sub-trees, every teacher can change > every students password, but does not have access to change the > one of his colleague. +1 > It is no problem to change this and use a flat tree, but we waste > usability that is available (and, at least in the schools I've seen so > far, part of our competitors' systems). no flat tree, is not a godd idea when you have lots of stuff > [...] > > > With the flat structure and the three levels of access, we > > have not tied ourself too tight to gosa and should be able to migrate > > to other tools in the future, as well as making it possible for sites > > to use other tools if they want to. > > Another disadvantage of a flat tree is the following: If you have a > school with 1000 pupils, every year about 100 of these pupils will > leave the school. What happens to their accounts? Currently we simply > ignore this. It is something nobody cares about and, at least after > some years, it will be the problem of the local sysadmin. What can he > do? In the flat tree, he has to remove all the users that graduate > every year. He has to work trough a list of names, search them in the > flat tree and remove them. (I know that my sysadmin will prefer his > windows system, when I try to convince him to use our system, but have > to admit that he will have to do that job from now on). +1 > So I suggest not only to have the student and teacher trees, but in > addition have age-groups in the students-tree: Every year at > school enrolment, a new organizational unit (subtree, called > department in GOsa) is added, it contains all pupils that start now > and will (with hopefully only a few exceptions) graduate x years > later. After x+1 years, the whole department and the corresponding > accounts can be deleted easily. In addition, if you want to add all > pupils in this age-group to a posix group, it's easy to select them in > that GOsa-department. > > We have that feature why not offer them to our users? I would also try > to keep the structure flexible, i.e. allow also something like: > > students--yr2005--classA > --classB > --classC > --yr2006--... > --... > --yr2007 > -- ... Will look at the ldif you send me and make proposal from that, but this one seems nice. > I guess this or comparable structures are in use already in most > schools. And if we want to be a serious alternative, we have to > support some more structure than the flat tree, regardless of the tool > we offer for administration. CipUX also uses much more structuring of > the tree. > > The way back from structure to a flat, unstructured tree is easy, but > please think about the prospects some more structure offers. > > Next issue: > > I expect us to have to maintain our own set of gosa packages in our > > own repository to get a version with support for netgroups and > > kerberos and the other things that are missing. I also hope we can > > get support for powerdns to avoid having to rewrite that part of the > > server setup. > > I hope we do no
Re: More on the future LDAP admin gui in Debian Edu
Le Saturday 23 October 2010 13:07:27 Jonas Smedegaard, vous avez écrit : > On Thu, Oct 21, 2010 at 06:08:01PM +0200, Petter Reinholdtsen wrote: > >[Sérgio Saraiva] > > > >> Is it possible to show a table with positive and negative aspects of > >> administration tools? > >> > >| lwat | broken in edu/squeeze | used to do what we wanted | > >| > >| | missing people | | > >| > >| cipux | missing in edu/squeeze | unknown if it fits us | > >| > >| | missing people | | > >| > >| gosa | missing some features | partly working in edu/squeeze | > >| > >| || got people| > > It should not be "unknown" that CipUX is in production use on > Skolelinux-based systems in Rheinland-Pfalz. Hello, > It should be trivial to include CipUX, as it is already officially in > Debian. > > So apparently people is the main reason for favoring GoSA over CipUX. > > ...and with "people" I mean "people specifically devoted to > Skolelinux". The idea behind using GOsa² is that the software is mature, supported and have people willing to help debian Edu to use it :) > Andreas Mundt has been _very_ active on GoSA (and thanks for that!) but > now starts as a teacher and do not expect himself to be able to > continue contributing at same pace. > > Who else in Skolelinux besides Andreas is actively working on GoSA? i offered my help, and already started at looking at and ldap tree from debian-edu to see how it fit onto GOsa² and what is missing. Cheers -- Benoit Mortier CEO OpenSides "logiciels libres pour entreprises" : http://www.opensides.eu/ Promouvoir et défendre le Logiciel Libre http://www.april.org/ Contributor to Gosa Project : http://gosa-project.org/ -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/201010231427.32898.benoit.mort...@opensides.be
Re: More on the future LDAP admin gui in Debian Edu
On Thu, Oct 21, 2010 at 06:08:01PM +0200, Petter Reinholdtsen wrote: [Sérgio Saraiva] Is it possible to show a table with positive and negative aspects of administration tools? | lwat | broken in edu/squeeze | used to do what we wanted | | | missing people | | | cipux | missing in edu/squeeze | unknown if it fits us | | | missing people | | | gosa | missing some features | partly working in edu/squeeze | | || got people| It should not be "unknown" that CipUX is in production use on Skolelinux-based systems in Rheinland-Pfalz. It should be trivial to include CipUX, as it is already officially in Debian. So apparently people is the main reason for favoring GoSA over CipUX. ...and with "people" I mean "people specifically devoted to Skolelinux". Andreas Mundt has been _very_ active on GoSA (and thanks for that!) but now starts as a teacher and do not expect himself to be able to continue contributing at same pace. Who else in Skolelinux besides Andreas is actively working on GoSA? - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: Digital signature
Re: More on the future LDAP admin gui in Debian Edu
Hello, On Fri, Oct 22, 2010 at 04:38:13PM +0200, Petter Reinholdtsen wrote: > [Andreas B. Mundt] > > So in my opinion, every teacher needs to be able to change/renew the > > password of a pupil. If only admins or jadmins can do that, they > > will not be available when needed (or every teacher will be jadmin, > > which you also don't want). > > Some schools might want this, while others do not. I believe it is a > bad idea to let all teachers change passwords of all pupils, and > suspect some schools agree with me. Can you give an argument why it is a bad idea for the majority of schools in your belief? > I also believe it is a good idea > to control access using information visible from within unix, like > file groups, and not using information invisible from within unix, > like LDAP object position in the tree. The ldap access rules defined in slapd.conf are completely independent of the unix 'access rules'. For example the user admin doesn't even exist as a posix user, but has full access to the ldap tree. However, lwat associates rules depending of posix group membership, and they allow to make sure that a (posix group) 'jadmin' cannot change the password of a (posix group) 'admin'. GOsa does not use the access ruling defined in slapd.conf, but defines a completely independent access policy. It is possible to associate access rules with posix group membership, but as far as I know, it is not possible to limit the access depending on the posix group membership of the object that's going to be changed (someone should check that). The GOsa access rules will not be available to any other software like ldapsearch, ldapadd, etc. (It would need to be especially made to use the information saved within ldap and used by GOsa). To sum up: it doesn't help or hinder any other ldap tool what we define as ldap access rules for GOsa. We talk about different things. The only valid argument to stick with the historic rules (or better said their names) is to give the user the same names which, in my opinion is not worth it. Because of the different implementation, there will not be a 1-to-1 mapping anyway. (Perhaps using the same name is even a bad idea because it will not be the same). [...] > > > Another disadvantage of a flat tree is the following: If you have a > > school with 1000 pupils, every year about 100 of these pupils will > > leave the school. What happens to their accounts? > > A common and sensible approach in use today, is to add all these 100 > pupils to a group for their year when the accounts are created. Then > it is trivial to remove these accounts when the pupils are done. > There is no need for a non-flat LDAP structure for this. > > > The way back from structure to a flat, unstructured tree is easy, > > but please think about the prospects some more structure offers. > > I believe all the "problems" you have sketched are trivially handled > using groups, and believe this is the best solution for our LDAP > structure. As I tried to explain above, the problem of a teacher being able to change pupils' passwords but not his colleagues one is not solved trivially with posix groups and a flat structure. What I learned about ldap: It is a good idea to map the structure of your organization, enterprise or in our case school within the structure of the ldap tree. Why not use it that way? Sure you can list all users that are members of a posix group in GOsa and remove them, but why not handling them in a department and mark them all together to put them in a posix group? I don't understand why to limit ourselves to the flat structure, in my opinion it simply makes no sense. Sure there is no "need". There's no "need" for graphical tools at all, but they make information and structures visible and easier to work with. > > Main difference to our current setup: Bind instead of powerDNS. > > Actually, we can continue to use powerDNS if we adjust GOsa to update > an extra attribute in the DNS tree. See > http://article.gmane.org/gmane.comp.ldap.gosa/506> for the > details. > > I think the decision we have to take is: Do we want to continue > > using powerDNS (which means we cannot use the GOsa packages because > > they use bind, so we have to find a solution, hack something or > > whatever...) or can we switch to bind which should make most (if not > > all) of the tools we need available in the squeeze repositories. So > > if there are no grave arguments against bind I think that's the > > easier way to go. > > I believe we want to continue to use a DNS server that look up > information directly in LDAP, to ensure that DNS changes done in LDAP > take effect imediately. All the bind based solutions I have seen so > far uses regular exports from LDAP to files bind understands, causing > a delay until changes show up in DNS. Because of this, I believe we > are better off by keeping PowerDNS. And thus I believe a third option > - change GOsa to work with PowerDNS - is the best one
Re: More on the future LDAP admin gui in Debian Edu
[Christian Kuelker] > A plea: please change the LDAP tree /default objects and attributes > as less as possible compare to the last released stable Debian Edu > version. Changing the tree cause a huge effort for migrating > installations. (With or without CipUX) It is one of my goals for Squeeze to change the LDAP structure as little as possible while still cleaning up and improving the situation. But the only way to make sure CipUX migration is little work, is for someone working on CipUX to test and report any problems back to the Debian Edu developers, or for someone working on CipUX to help out as a Debian Edu developer. Happy hacking, -- Petter Reinholdtsen -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101022184253.ge6...@login1.uio.no
Re: More on the future LDAP admin gui in Debian Edu
Hi, Petter Reinholdtsen wrote: > [Sérgio Saraiva] >> Is it possible to show a table with positive and negative aspects of >> administration tools? > > | lwat | broken in edu/squeeze | used to do what we wanted | > | | missing people | | > | cipux | missing in edu/squeeze | unknown if it fits us | > | | missing people | | > | gosa | missing some features | partly working in edu/squeeze | > | || got people| Yes Skolelinux lacks of enthusiasts integrating CipUX to edu/squeeze. As I said before on the list. I am willing to help. CipUX do fit Debian Edu. Unfortunately this can not be seen by the international Debian Edu community because missing in edu/squeeze. Is it possible to add CipUX to edu/squeeze without disturbing the work on Gosa? > If someone got time and interest in making a better comparison, feel > free to add it to the wiki. But given that only one of the > alternatives (Gosa) have people interested in working on it and > getting it to work properly in edu/squeeze, I do not really see the > point. > We have waited for lwat and cipux people for a long time, so it seem > unlikely that anyone will show up. And even if they did, it would be > hard to believe they were here for the long run, given the complete > lack of progress and interest for a long time. Indeed I do agree on the point that we wait a long time for LWAT and CipUX. I am a little bit surprised by the above statement. If you speak about 'cipux people' keep in mind that you can sometimes not distinguish this clearly since we all work on several projects. There are several "CipUX people": a) CipUX developers (me, others + testers of upstream code incl. RLP!) b) CipUX users (RLP project + old-time users) c) CipUX distributors (Jonas and Xavier + testers of packaging) d) CipUX Debian Edu re-distributors (none) So we are lacking d) people. The other parts of the CipUX community is flourishing. The current code status of 3.4.x.x is stable. No bugs reported in the last month's. So the upstream base is good. Currently CipUX is used by schools in Germany and translated into several languages. It has at least 2 GUIs. The current installations are based partly on Debian Packages and upstream releases. It is intended to switch to pure packaged version in February. The Debian packages are not as much tested as I would like to see it. A pure package installation for Debian Edu is not possible at the moment. Only _one_ Perl modul needs to be packaged. Nevertheless it is a minor problem. With or without packaging this will vanish in 3.6.0.x. Then we will have a CipUX on CPAN. One reason why I attended the Perl Conference last week here in Tokyo. CipUX is working on Debian Edu Etch and Lenny. Some features in Lenny are missing: DNS,... No work as so far be done to squeeze. My guess is that it should be easy to use CipUX for the base functionality. A plea: please change the LDAP tree /default objects and attributes as less as possible compare to the last released stable Debian Edu version. Changing the tree cause a huge effort for migrating installations. (With or without CipUX) Cheers Christian -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/4cc1d09a.10...@cipworx.org
Re: More on the future LDAP admin gui in Debian Edu
[Andreas B. Mundt] > So in my opinion, every teacher needs to be able to change/renew the > password of a pupil. If only admins or jadmins can do that, they > will not be available when needed (or every teacher will be jadmin, > which you also don't want). Some schools might want this, while others do not. I believe it is a bad idea to let all teachers change passwords of all pupils, and suspect some schools agree with me. I also believe it is a good idea to control access using information visible from within unix, like file groups, and not using information invisible from within unix, like LDAP object position in the tree. Why should not the schools that want all teachers to be able to change the passwords of all pupils not be members of the jradmin grup? The jradmin group is supposed to give privileges to change passwords of all non-admin non-jradmin users, which seem to be exactly what you talk about. I believe the correct solution for schools that want all teachers to be able to change pupils passwords it to add all teachers to the jradmin group. > Another disadvantage of a flat tree is the following: If you have a > school with 1000 pupils, every year about 100 of these pupils will > leave the school. What happens to their accounts? A common and sensible approach in use today, is to add all these 100 pupils to a group for their year when the accounts are created. Then it is trivial to remove these accounts when the pupils are done. There is no need for a non-flat LDAP structure for this. > The way back from structure to a flat, unstructured tree is easy, > but please think about the prospects some more structure offers. I believe all the "problems" you have sketched are trivially handled using groups, and believe this is the best solution for our LDAP structure. > Main difference to our current setup: Bind instead of powerDNS. Actually, we can continue to use powerDNS if we adjust GOsa to update an extra attribute in the DNS tree. See http://article.gmane.org/gmane.comp.ldap.gosa/506> for the details. > I think the decision we have to take is: Do we want to continue > using powerDNS (which means we cannot use the GOsa packages because > they use bind, so we have to find a solution, hack something or > whatever...) or can we switch to bind which should make most (if not > all) of the tools we need available in the squeeze repositories. So > if there are no grave arguments against bind I think that's the > easier way to go. I believe we want to continue to use a DNS server that look up information directly in LDAP, to ensure that DNS changes done in LDAP take effect imediately. All the bind based solutions I have seen so far uses regular exports from LDAP to files bind understands, causing a delay until changes show up in DNS. Because of this, I believe we are better off by keeping PowerDNS. And thus I believe a third option - change GOsa to work with PowerDNS - is the best one. Happy hacking, -- Petter Reinholdtsen -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101022143813.ga6...@login1.uio.no
Re: More on the future LDAP admin gui in Debian Edu
Hi Andi, thanks for your summary and pushing this forward! On Freitag, 22. Oktober 2010, Andreas B. Mundt wrote: > So I suggest not only to have the student and teacher trees, but in > addition have age-groups in the students-tree: +1 > Main > difference to our current setup: Bind instead of powerDNS. > I think the decision we have to take is: > Do we want to continue using powerDNS (which means we cannot use the > GOsa packages because they use bind, so we have to find a solution, > hack something or whatever...) or can we switch to bind which should > make most (if not all) of the tools we need available in the squeeze > repositories. So if there are no grave arguments against bind I think > that's the easier way to go. +1 - I think so too. It's (very) unfortunate that we switched to powerdns just in the last release and now switch back, but I think it's still the best way to go now. :-/ > Finally, as Petter pointed out, netgroups are missing. how bad do we need them? Could we live with a cli-solution only? Or should we try harder to get your patch ready? cheers, Holger signature.asc Description: This is a digitally signed message part.
Re: More on the future LDAP admin gui in Debian Edu
Hi all, with regard to the replies to my mail, I conclude that we agree that for the time being it is best to focus on GOsa for squeeze. I hoped that we can get some consensus, which seems to be the case, at least when I look at the replies so far. Well, then let's start to have a look and discuss what needs to be done. On Thu, Oct 21, 2010 at 05:55:45PM +0200, Petter Reinholdtsen wrote: [...] > For the specific LDAP setup, I believe we should change our Gosa setup > to have a "flat" ldap directory (ie no students and teachers > subtrees), and use the traditional three levels of administrative > access (admin with full access, jr. admin with limited access and the > rest with no special privileges. The idea behind the structure I implemented so far (separated teacher- and student sub-trees) is the following: This structure allows the application of additional access rules. From my experience, students loose their password (and if you really force them not to loose it, they will either choose '123' and/or write it down. Both things you don't want to teach them). So there will be lectures where the students/pupils have to work at the machines, and in the frequent case one or two students will not be able to log in. You can say: 'Well that's not my problem', but depending on age and school it will become your problem, for example when your lecture is spoiled by these two pupils (they are not able to do anything now and look for interesting alternatives). Or when parents turn up and complain. So in my opinion, every teacher needs to be able to change/renew the password of a pupil. If only admins or jadmins can do that, they will not be available when needed (or every teacher will be jadmin, which you also don't want). With the teacher and student sub-trees, every teacher can change every students password, but does not have access to change the one of his colleague. It is no problem to change this and use a flat tree, but we waste usability that is available (and, at least in the schools I've seen so far, part of our competitors' systems). [...] > With the flat structure and the three levels of access, we > have not tied ourself too tight to gosa and should be able to migrate > to other tools in the future, as well as making it possible for sites > to use other tools if they want to. Another disadvantage of a flat tree is the following: If you have a school with 1000 pupils, every year about 100 of these pupils will leave the school. What happens to their accounts? Currently we simply ignore this. It is something nobody cares about and, at least after some years, it will be the problem of the local sysadmin. What can he do? In the flat tree, he has to remove all the users that graduate every year. He has to work trough a list of names, search them in the flat tree and remove them. (I know that my sysadmin will prefer his windows system, when I try to convince him to use our system, but have to admit that he will have to do that job from now on). So I suggest not only to have the student and teacher trees, but in addition have age-groups in the students-tree: Every year at school enrolment, a new organizational unit (subtree, called department in GOsa) is added, it contains all pupils that start now and will (with hopefully only a few exceptions) graduate x years later. After x+1 years, the whole department and the corresponding accounts can be deleted easily. In addition, if you want to add all pupils in this age-group to a posix group, it's easy to select them in that GOsa-department. We have that feature why not offer them to our users? I would also try to keep the structure flexible, i.e. allow also something like: students--yr2005--classA --classB --classC --yr2006--... --... --yr2007 -- ... I guess this or comparable structures are in use already in most schools. And if we want to be a serious alternative, we have to support some more structure than the flat tree, regardless of the tool we offer for administration. CipUX also uses much more structuring of the tree. The way back from structure to a flat, unstructured tree is easy, but please think about the prospects some more structure offers. Next issue: > I expect us to have to maintain our own set of gosa packages in our > own repository to get a version with support for netgroups and > kerberos and the other things that are missing. I also hope we can > get support for powerdns to avoid having to rewrite that part of the > server setup. I hope we do not need to maintain too much. The most important part currently missing is the machine management. First we need to integrate the services run by tjener into GOsa. I started with some testing a while back, the ldif is still in svn: http://svn.debian.org/wsvn/debian-edu/trunk/src/debian-edu-config/ldap-bootstrap/gosa-server.ldif> This looked promising, I used GOsa to define the services. Main
Re: More on the future LDAP admin gui in Debian Edu
Hi, On 21/10/10 18:10, Holger Levsen wrote: > I also support the decission to concentrate effords on a out of the box setup > with gosa now. +1 > On Donnerstag, 21. Oktober 2010, Petter Reinholdtsen wrote: >> Who do you expect to make this decision? > > which reminds me, I think we should have an irc meeting again... +1 Regards, -- .''`. Philipp Huebner : :' : pgp fp: 6719 25C5 B8CD E74A 5225 3DF9 E5CA 8C49 25E4 205F `. `'` HP: http://www.debalance.de, Skype: philipp-huebner `- ICQ: 235-524-440, Jabber: der_scha...@jabber.org signature.asc Description: OpenPGP digital signature
Re: More on the future LDAP admin gui in Debian Edu
Hi, On Donnerstag, 21. Oktober 2010, Petter Reinholdtsen wrote: > You misunderstand me. I propose to drop the subtrees, and keep the > groups. And to only use groups for access control, not location in > the ldap tree. Ah, good. cheers, Holger, who will try to organize another irc meeting soon signature.asc Description: This is a digitally signed message part.
Re: More on the future LDAP admin gui in Debian Edu
[Holger Levsen] > which reminds me, I think we should have an irc meeting again... Yeah. :) > why do you propose to drop these two groups? they are used in schools. You misunderstand me. I propose to drop the subtrees, and keep the groups. And to only use groups for access control, not location in the ldap tree. Happy hacking, -- Petter Reinholdtsen -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101021174458.gf17...@login1.uio.no
Re: More on the future LDAP admin gui in Debian Edu
Le Thursday 21 October 2010 17:55:45 Petter Reinholdtsen, vous avez écrit : > [Andreas B. Mundt] > > > What is the plan? > > Who do you expect to make this decision? > > > Almost since the beginning of this year we decide *not* to decide > > anything at all concerning LDAP administration. I think this is fine > > for some time, to see how things evolve. > > Given the lack of progress with alternatives cipux and lwat, and the > fact that gosa is the only solution that is working thought it only > partly solve our needs, I propose we decide that we drop lwat from > squeeze, and bring gosa up to speed with our needs. > > For the specific LDAP setup, I believe we should change our Gosa setup > to have a "flat" ldap directory (ie no students and teachers > subtrees), and use the traditional three levels of administrative > access (admin with full access, jr. admin with limited access and the > rest with no special privileges. > > And if no-one else are ready to make the decision, I am happy to take > it as the system architect of Debian Edu, but it require someone to > actually implement the directory structure change and the access level > change. With the flat structure and the three levels of access, we > have not tied ourself too tight to gosa and should be able to migrate > to other tools in the future, as well as making it possible for sites > to use other tools if they want to. > > > As Petter already listed, we have 3 candidates: CipUX, GOsa and > > lwat. (Or is there already another one approaching?) > > Given that cipux is not not present as a solution in Squeeze, lwat is > broken and gosa is limping along, I believe we only have one realistic > alternative - gosa. Not to happy with the home grown LDAP schemas > gosa is using, but our hands seem tied and no sensible alternative > have shown up this year. > > I expect us to have to maintain our own set of gosa packages in our > own repository to get a version with support for netgroups and > kerberos and the other things that are missing. I also hope we can > get support for powerdns to avoid having to rewrite that part of the > server setup. Hello, you don't need to have you own version of GOsa in your repository :) you could just have plugins for your netgroups and the other things that are missing. and if developped well enough to be generic for other people we can even put them in the official GOsa releases :) You just need php developpers and some help from the gosa project people like me :) Cheers -- Benoit Mortier CEO OpenSides "logiciels libres pour entreprises" : http://www.opensides.eu/ Promouvoir et défendre le Logiciel Libre http://www.april.org/ Contributor to Gosa Project : http://gosa-project.org/ -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/201010211813.36096.benoit.mort...@opensides.be
Re: More on the future LDAP admin gui in Debian Edu
Le Thursday 21 October 2010 17:43:26 Jürgen Leibner, vous avez écrit : > On Thursday 21 October 2010 17:17 Andreas B. Mundt wrote: > > Hi, > > Hi Andreas, Hello, > > once again a mail about the LDAP administration tool we need in > > Debian-Edu. Since Petter's mail > > http://lists.debian.org/debian-edu/2010/09/msg00110.html> > > almost a month passed: > > > > On Mon, Sep 27, 2010 at 06:59:44PM +0200, Petter Reinholdtsen wrote: > > > Here is a short update on the LDAP admin status for Debian Edu > > > based on Squeeze. > > > > The only changes I know of concern GOsa and the latest package in > > squeeze which fixes the password exposure issue; now you need to > > be either root or www-data to see the environment in the process > > list. Changes to debian-edu-config are minimal, I will apply them as > > soon as 2.6.11-2 enters squeeze, which should happen in approximately > > a week from now. The mass creation of users works in my tests too. > > > > Please add information about progress on the other tools mentioned. > > > > My question is: > > > > What is the plan? Almost since the beginning of this year we decide > > *not* to decide anything at all concerning LDAP administration. I > > think this is fine for some time, to see how things evolve. > > > > But at some point it just takes away motivation and leads to a > > passive waiting for the things to come. Nobody wants to spend his > > time on things that are rejected in the end. > > > > How long do we want to continue waiting and for what? For another > > alternative tool turning up at the horizon that promises everything? > > Squeeze+1? Miracles? Or do we prefer to have 2 half-baked > > administration tools, one for users and groups, one for machines and > > netgroups, a couple of scripts to add users and ldapvi for all > > remaining stuff? > > > > In my opinion it is better to accept that there is no perfect tool > > available at the moment (and perhaps forever), and to decide _now_ > > which administration tool we want to ship for squeeze. After that > > decision, it makes sense to complete the integration. There should be > > time left to test and look into remaining issues and fixes, to > > document and prepare the manual. > > > > So let's name things by their names: > > > > As Petter already listed, we have 3 candidates: CipUX, GOsa and > > lwat. (Or is there already another one approaching?) > > > > Which tool do we ship for squeeze? (And keep in mind: not deciding is > > also a decision, but I doubt it's the best one for > > Debian-Edu/skolelinux a couple (?) of months before squeeze release). > > for me, lwat is dead, CipUX is not suited enough for the system > administration tasks and GOsa is not near enough to the educational > tasks. > The smallest pain seems to be GOsa in my opinion. > So please go ahead and integrate it, with the hope to get help from the > GOsa people around here. If GOsa is decide to be the interface to Debian Edu i will be happy to help you. Cheers -- Benoit Mortier CEO OpenSides "logiciels libres pour entreprises" : http://www.opensides.eu/ Promouvoir et défendre le Logiciel Libre http://www.april.org/ Contributor to Gosa Project : http://gosa-project.org/ -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/201010211810.34981.benoit.mort...@opensides.be
Re: More on the future LDAP admin gui in Debian Edu
So there is not dubt. Let's GOsa! Thanks. Sérgio Saraiva Brazil 2010/10/21 Petter Reinholdtsen > [Sérgio Saraiva] > > Is it possible to show a table with positive and negative aspects of > > administration tools? > > | lwat | broken in edu/squeeze | used to do what we wanted | > | | missing people | | > | cipux | missing in edu/squeeze | unknown if it fits us | > | | missing people | | > | gosa | missing some features | partly working in edu/squeeze | > | || got people| > > If someone got time and interest in making a better comparison, feel > free to add it to the wiki. But given that only one of the > alternatives (Gosa) have people interested in working on it and > getting it to work properly in edu/squeeze, I do not really see the > point. > > We have waited for lwat and cipux people for a long time, so it seem > unlikely that anyone will show up. And even if they did, it would be > hard to believe they were here for the long run, given the complete > lack of progress and interest for a long time. > > Happy hacking, > -- > Petter Reinholdtsen > > > -- > To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org > with a subject of "unsubscribe". Trouble? Contact > listmas...@lists.debian.org > Archive: http://lists.debian.org/20101021160801.gd17...@login1.uio.no > >
Re: More on the future LDAP admin gui in Debian Edu
Hi, I also support the decission to concentrate effords on a out of the box setup with gosa now. On Donnerstag, 21. Oktober 2010, Petter Reinholdtsen wrote: > Who do you expect to make this decision? which reminds me, I think we should have an irc meeting again... > For the specific LDAP setup, I believe we should change our Gosa setup > to have a "flat" ldap directory (ie no students and teachers > subtrees), why do you propose to drop these two groups? they are used in schools. cheers, Holger signature.asc Description: This is a digitally signed message part.
Re: More on the future LDAP admin gui in Debian Edu
[Sérgio Saraiva] > Is it possible to show a table with positive and negative aspects of > administration tools? | lwat | broken in edu/squeeze | used to do what we wanted | | | missing people | | | cipux | missing in edu/squeeze | unknown if it fits us | | | missing people | | | gosa | missing some features | partly working in edu/squeeze | | || got people| If someone got time and interest in making a better comparison, feel free to add it to the wiki. But given that only one of the alternatives (Gosa) have people interested in working on it and getting it to work properly in edu/squeeze, I do not really see the point. We have waited for lwat and cipux people for a long time, so it seem unlikely that anyone will show up. And even if they did, it would be hard to believe they were here for the long run, given the complete lack of progress and interest for a long time. Happy hacking, -- Petter Reinholdtsen -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101021160801.gd17...@login1.uio.no
Re: More on the future LDAP admin gui in Debian Edu
Is it possible to show a table with positive and negative aspects of administration tools? lwat CipUX GOsa Thanks, Sergio Brazil 2010/10/21 Andreas B. Mundt > Hi, > > once again a mail about the LDAP administration tool we need in > Debian-Edu. Since Petter's mail > http://lists.debian.org/debian-edu/2010/09/msg00110.html> > almost a month passed: > > On Mon, Sep 27, 2010 at 06:59:44PM +0200, Petter Reinholdtsen wrote: > > Here is a short update on the LDAP admin status for Debian Edu based > > on Squeeze. > > The only changes I know of concern GOsa and the latest package in > squeeze which fixes the password exposure issue; now you need to > be either root or www-data to see the environment in the process > list. Changes to debian-edu-config are minimal, I will apply them as > soon as 2.6.11-2 enters squeeze, which should happen in approximately > a week from now. The mass creation of users works in my tests too. > > Please add information about progress on the other tools mentioned. > > My question is: > > What is the plan? Almost since the beginning of this year we decide > *not* to decide anything at all concerning LDAP administration. I > think this is fine for some time, to see how things evolve. > > But at some point it just takes away motivation and leads to a passive > waiting for the things to come. Nobody wants to spend his time on > things that are rejected in the end. > > How long do we want to continue waiting and for what? For another > alternative tool turning up at the horizon that promises everything? > Squeeze+1? Miracles? Or do we prefer to have 2 half-baked > administration tools, one for users and groups, one for machines and > netgroups, a couple of scripts to add users and ldapvi for all > remaining stuff? > > In my opinion it is better to accept that there is no perfect tool > available at the moment (and perhaps forever), and to decide _now_ > which administration tool we want to ship for squeeze. After that > decision, it makes sense to complete the integration. There should be > time left to test and look into remaining issues and fixes, to > document and prepare the manual. > > So let's name things by their names: > > As Petter already listed, we have 3 candidates: CipUX, GOsa and > lwat. (Or is there already another one approaching?) > > Which tool do we ship for squeeze? (And keep in mind: not deciding is > also a decision, but I doubt it's the best one for > Debian-Edu/skolelinux a couple (?) of months before squeeze release). > > Regards, > >Andi > > > > > > > > > > > -- > To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org > with a subject of "unsubscribe". Trouble? Contact > listmas...@lists.debian.org > Archive: http://lists.debian.org/20101021151712.ga29...@flashgordon > >
Re: More on the future LDAP admin gui in Debian Edu
[Andreas B. Mundt] > What is the plan? Who do you expect to make this decision? > Almost since the beginning of this year we decide *not* to decide > anything at all concerning LDAP administration. I think this is fine > for some time, to see how things evolve. Given the lack of progress with alternatives cipux and lwat, and the fact that gosa is the only solution that is working thought it only partly solve our needs, I propose we decide that we drop lwat from squeeze, and bring gosa up to speed with our needs. For the specific LDAP setup, I believe we should change our Gosa setup to have a "flat" ldap directory (ie no students and teachers subtrees), and use the traditional three levels of administrative access (admin with full access, jr. admin with limited access and the rest with no special privileges. And if no-one else are ready to make the decision, I am happy to take it as the system architect of Debian Edu, but it require someone to actually implement the directory structure change and the access level change. With the flat structure and the three levels of access, we have not tied ourself too tight to gosa and should be able to migrate to other tools in the future, as well as making it possible for sites to use other tools if they want to. > As Petter already listed, we have 3 candidates: CipUX, GOsa and > lwat. (Or is there already another one approaching?) Given that cipux is not not present as a solution in Squeeze, lwat is broken and gosa is limping along, I believe we only have one realistic alternative - gosa. Not to happy with the home grown LDAP schemas gosa is using, but our hands seem tied and no sensible alternative have shown up this year. I expect us to have to maintain our own set of gosa packages in our own repository to get a version with support for netgroups and kerberos and the other things that are missing. I also hope we can get support for powerdns to avoid having to rewrite that part of the server setup. Happy hacking, -- Petter Reinholdtsen -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101021155545.gc17...@login1.uio.no
Re: More on the future LDAP admin gui in Debian Edu
Hi, once again a mail about the LDAP administration tool we need in Debian-Edu. Since Petter's mail http://lists.debian.org/debian-edu/2010/09/msg00110.html> almost a month passed: On Mon, Sep 27, 2010 at 06:59:44PM +0200, Petter Reinholdtsen wrote: > Here is a short update on the LDAP admin status for Debian Edu based > on Squeeze. The only changes I know of concern GOsa and the latest package in squeeze which fixes the password exposure issue; now you need to be either root or www-data to see the environment in the process list. Changes to debian-edu-config are minimal, I will apply them as soon as 2.6.11-2 enters squeeze, which should happen in approximately a week from now. The mass creation of users works in my tests too. Please add information about progress on the other tools mentioned. My question is: What is the plan? Almost since the beginning of this year we decide *not* to decide anything at all concerning LDAP administration. I think this is fine for some time, to see how things evolve. But at some point it just takes away motivation and leads to a passive waiting for the things to come. Nobody wants to spend his time on things that are rejected in the end. How long do we want to continue waiting and for what? For another alternative tool turning up at the horizon that promises everything? Squeeze+1? Miracles? Or do we prefer to have 2 half-baked administration tools, one for users and groups, one for machines and netgroups, a couple of scripts to add users and ldapvi for all remaining stuff? In my opinion it is better to accept that there is no perfect tool available at the moment (and perhaps forever), and to decide _now_ which administration tool we want to ship for squeeze. After that decision, it makes sense to complete the integration. There should be time left to test and look into remaining issues and fixes, to document and prepare the manual. So let's name things by their names: As Petter already listed, we have 3 candidates: CipUX, GOsa and lwat. (Or is there already another one approaching?) Which tool do we ship for squeeze? (And keep in mind: not deciding is also a decision, but I doubt it's the best one for Debian-Edu/skolelinux a couple (?) of months before squeeze release). Regards, Andi -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20101021151712.ga29...@flashgordon
Re: Please help make a alpha1 test release (Was: More on the future LDAP admin gui in Debian Edu)
Hi Petter, On Dienstag, 28. September 2010, Petter Reinholdtsen wrote: > This alpha1 release is now possible, after the new apt-setup and > base-installer versions showed up in squeeze today. The DVD > installation is now working again. :) Am I right, that #598457 makes this statement mood? cheers, Holger signature.asc Description: This is a digitally signed message part.
Please help make a alpha1 test release (Was: More on the future LDAP admin gui in Debian Edu)
[Petter Reinholdtsen] > I was planning to make a alpha1 release and ask for tester of LTSP, > but then a bug causing DVD installs to fail (#595903) showed up, and > it was impossible to make the release. :( This should be fixed in > apt-setup version 1:0.47, but it is not in Squeeze yet. When it is > in squeeze, I hope we can make a alpha1 release. This alpha1 release is now possible, after the new apt-setup and base-installer versions showed up in squeeze today. The DVD installation is now working again. :) As far as I know, the only thing left to do is to update the release notes and test that the netinst CD and DVD produce working installations. Please help with wik page updating and testing. http://wiki.debian.org/DebianEdu/ReleaseNotes Happy hacking, -- Petter Reinholtsen -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20100928175145.gu31...@login2.uio.no
Re: More on the future LDAP admin gui in Debian Edu
Hi, On Mon, Sep 27, 2010 at 06:59:44PM +0200, Petter Reinholdtsen wrote: > Here is a short update on the LDAP admin status for Debian Edu based > on Squeeze. The short summary is that we have no working alternative > for administrating the LDAP directory information, and basicly is in > an unreleasable state. [...] [GOsa:] > The code for setting the Kerberos password > exposes the password to everyone looking at the output from ps at the > right time, and Gosa can not log in users using Kerberos so we will > have to have passwords both in LDAP and in Kerberos. The first issue has been addressed and fixed upstream: https://oss.gonicus.de/labs/gosa/ticket/1026 > I am still hoping (hint, hint) for a GOsa 2.6.11-2 package which ports the fix from upstream to the squeeze GOsa package. In addition, We definitely need the user mass creation with gosa-plugin-ldapmanager. This is fixed in 2.6.11-1, but currently only available in unstable. Best Regards, Andi -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20100928123431.ga3...@flashgordon
Re: More on the future LDAP admin gui in Debian Edu
On 18:59 Mon 27 Sep , Petter Reinholdtsen wrote: > The Cipux option is still unknown. I am not aware of anyone having > spent any time to get it working out of the box with Debian > Edu/Squeeze It's on my Todo list to work on this with Christian. I don't know when it will be done but it's one of our next goals. Greetings, -- Xavier Oswald GNU/Linux Debian Developer - http://www.debian.org/ GPG key ID: 0x464B8DE3 signature.asc Description: Digital signature
Re: More on the future LDAP admin gui in Debian Edu
Here is a short update on the LDAP admin status for Debian Edu based on Squeeze. The short summary is that we have no working alternative for administrating the LDAP directory information, and basicly is in an unreleasable state. The Gosa option is the only option kind of working, but it only provide admin GUI for users and groups. It is missing netgroup, powerdns and dhcp. By reorganizing where we store the DHCP information and switching to a gosa specific LDAP schema, we can get it to administrate DHCP. It is unable to handle powerdns info in LDAP, and only support a bind9 related setup. netgroup support is not implemented at all. The code for setting the Kerberos password exposes the password to everyone looking at the output from ps at the right time, and Gosa can not log in users using Kerberos so we will have to have passwords both in LDAP and in Kerberos. The LWAT option is not working at all. Finn-Arne said he was going to get a working version (presumably into Debian/Squeeze) some weeks ago, but this is not in place so far. There is support in the coe for users, groups, netgroups, powerdns and dhcp. There is no support for using or updating Kerberos for passwords. The Cipux option is still unknown. I am not aware of anyone having spent any time to get it working out of the box with Debian Edu/Squeeze So this comment is still true: [Petter Reinholdtsen 2010-07-30] > At the moment, we have no working LDAP adminstration tool in Debian > Edu/Squeeze. This is a problem that need to be adressed. I was planning to make a alpha1 release and ask for tester of LTSP, but then a bug causing DVD installs to fail (#595903) showed up, and it was impossible to make the release. :( This should be fixed in apt-setup version 1:0.47, but it is not in Squeeze yet. When it is in squeeze, I hope we can make a alpha1 release. Happy hacking, -- Petter Reinholtsen -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20100927165944.gm31...@login2.uio.no
Re: More on the future LDAP admin gui in Debian Edu (Was: Is LWAT completely broken in Squeeze?)
Hi, I answer here, because my name was dropped. Jonas Smedegaard wrote: If you mean if webmin stuff is relevant to reuse for CipUX, then no: Webmin related to an ancient abandoned branch of CipUX only - current CipUX 3.4.x.x uses its own framework called CAT, with two actual implementations availabl, CAT::Web and CATWeasel. CipUX is mature, and is reported working well with Skolelinux in Germany. What Petter writes above, and that I fully agree with, is *not* that CipUX is broken, but that *this* list have received no reports of succesful tests using CipUX with Skolelinux currently in development. I agree on all above. Klaus, Christian, Kurt and others supposedly subscribed to this list: now is the time to tell the (Skolelinux) world how wonderful CipUX is! CipUX is working well in Rheinland-Pfalz for more then one year (or more?). The actual Debian packages are mostly build on that code base and I did not hear of major failures. Only some smaller bug fixes where made. However testers are welcome. This version should work well with Debian and Debian-Edu Lenny. I have to admit that there are some complains about the style of CAT-Web. If you would like to change that, please contribute. (It is themeable) However the Rheinland-Pfalz project developed a stylish CAT-Weasel GUI to meet exact the demands of the teachers from Rheinland-Pfalz. CipUX was tested with Debian Squeeze but not with Debian-Edu squeeze. To support the newest features of Debian-Edu there has probably some work to be done. I personally would like to see CipUX working with any major school server distribution. If this is done via default install or as a decision by the admin is not so important for me. Since I have a full time Job in the HPC business and have to travel quite a lot between Italy, Germany and Japan I do not have the time to make the configuration work for Skolelinux by myself. I would think that this should be done under the lead of the Rheinland-Pfalz Project (@Klaus - you might consider assigning work to that task) _and_ others who would like see it work. In any case I will offer my help and knowledge. Future: The next major release of CipUX will be released to CPAN directly. Perl coders who would like to take part in the design of this now are highly welcome. (...or file bugreports, so that I can improve the packaging!) Cheers C. -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/4c5b0c47.1080...@cipworx.org
Re: More on the future LDAP admin gui in Debian Edu (Was: Is LWAT completely broken in Squeeze?)
Hi, Jonas Smedegaard wrote: On Fri, Jul 30, 2010 at 07:55:44PM +0200, Petter Reinholdtsen wrote: For Cipux, no developer so far seem willing to spend the time to get it working out of the box with Debian Edu. Working packages might be in squeeze, but it is unknown as no-one has tried to get them working with Debian Edu/Squeeze as far as I know. I do not know what schemas are used, nor if it is compatible with the current LDAP structure. True, all of it. Yes that is true. If Cipux is to become an alternative for Squeeze, someone need to spend time to get it working out of the box with Debian Edu/Squeeze, and allow us to test it to see how it compare to Gosa. Great opportunity for the Rheinland-Pfalz project to invest some of the remaining resources, I guess. Yes that is a great opportunity for the Rheinland-Pfalz project to participate and contribute actively there demands to Skolelinux. ...or alternatively for some of the others actively using CipUX together with Skolelinux to come out of the bushes and share with this list their judgement of current status. I would also like to hear more. Cheers C. -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/4c5b047e.7000...@cipworx.org
Re: More on the future LDAP admin gui in Debian Edu (Was: Is LWAT completely broken in Squeeze?)
Le Friday 30 July 2010 19:55:44 Petter Reinholdtsen, vous avez écrit : Hello, > For Gosa, Andreas have already spent the time to get it working out of > the box with Debian Edu. Working packages are missing in squeeze, but > present in unstable and should enter testing in 9 days. It require > its own schemas for storing information about computers, its edited > version of the dhcp schema and only work with the dnszone DNS schema > used by bind/ldap2zone. Do not work with powerdns at the moment, but > could probably be patched to work with it if we switch powerdns to > scrict LDAP mode. I could help further with GOsa and Debian-Edu if needed, as i think it will be a valuable adition to Debian-Edu and facilitate the management of the Debian Edu server Cheers -- Benoit Mortier CEO OpenSides "logiciels libres pour entreprises" : http://www.opensides.eu/ Promouvoir et défendre le Logiciel Libre http://www.april.org/ Contributor to Gosa Project : http://gosa-project.org/ -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/201007311220.08533.benoit.mort...@opensides.be
Re: More on the future LDAP admin gui in Debian Edu (Was: Is LWAT completely broken in Squeeze?)
On Fri, Jul 30, 2010 at 08:46:21PM +0100, Berni Elbourn wrote: On 30/07/10 20:19, Jonas Smedegaard wrote: On Fri, Jul 30, 2010 at 07:55:44PM +0200, Petter Reinholdtsen wrote: For Cipux, no developer so far seem willing to spend the time to get it working out of the box with Debian Edu. Working packages might be in squeeze, but it is unknown as no-one has tried to get them working with Debian Edu/Squeeze as far as I know. I do not know what schemas are used, nor if it is compatible with the current LDAP structure. True, all of it. If Cipux is to become an alternative for Squeeze, someone need to spend time to get it working out of the box with Debian Edu/Squeeze, and allow us to test it to see how it compare to Gosa. Great opportunity for the Rheinland-Pfalz project to invest some of the remaining resources, I guess. ...or alternatively for some of the others actively using CipUX together with Skolelinux to come out of the bushes and share with this list their judgement of current status. Is there something in webmins ldap add-ons that could be re-used? If you mean if webmin stuff is relevant to reuse for CipUX, then no: Webmin related to an ancient abandoned branch of CipUX only - current CipUX 3.4.x.x uses its own framework called CAT, with two actual implementations availabl, CAT::Web and CATWeasel. CipUX is mature, and is reported working well with Skolelinux in Germany. What Petter writes above, and that I fully agree with, is *not* that CipUX is broken, but that *this* list have received no reports of succesful tests using CipUX with Skolelinux currently in development. Klaus, Christian, Kurt and others supposedly subscribed to this list: now is the time to tell the (Skolelinux) world how wonderful CipUX is! (...or file bugreports, so that I can improve the packaging!) :-) - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: Digital signature
Re: More on the future LDAP admin gui in Debian Edu (Was: Is LWAT completely broken in Squeeze?)
On 30/07/10 20:19, Jonas Smedegaard wrote: On Fri, Jul 30, 2010 at 07:55:44PM +0200, Petter Reinholdtsen wrote: For Cipux, no developer so far seem willing to spend the time to get it working out of the box with Debian Edu. Working packages might be in squeeze, but it is unknown as no-one has tried to get them working with Debian Edu/Squeeze as far as I know. I do not know what schemas are used, nor if it is compatible with the current LDAP structure. True, all of it. If Cipux is to become an alternative for Squeeze, someone need to spend time to get it working out of the box with Debian Edu/Squeeze, and allow us to test it to see how it compare to Gosa. Great opportunity for the Rheinland-Pfalz project to invest some of the remaining resources, I guess. ...or alternatively for some of the others actively using CipUX together with Skolelinux to come out of the bushes and share with this list their judgement of current status. Kind regards, - Jonas Is there something in webmins ldap add-ons that could be re-used? Berni -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/4c532c0d.4000...@elbournb.fsnet.co.uk
Re: More on the future LDAP admin gui in Debian Edu (Was: Is LWAT completely broken in Squeeze?)
On Fri, Jul 30, 2010 at 07:55:44PM +0200, Petter Reinholdtsen wrote: For Cipux, no developer so far seem willing to spend the time to get it working out of the box with Debian Edu. Working packages might be in squeeze, but it is unknown as no-one has tried to get them working with Debian Edu/Squeeze as far as I know. I do not know what schemas are used, nor if it is compatible with the current LDAP structure. True, all of it. If Cipux is to become an alternative for Squeeze, someone need to spend time to get it working out of the box with Debian Edu/Squeeze, and allow us to test it to see how it compare to Gosa. Great opportunity for the Rheinland-Pfalz project to invest some of the remaining resources, I guess. ...or alternatively for some of the others actively using CipUX together with Skolelinux to come out of the bushes and share with this list their judgement of current status. Kind regards, - Jonas -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private signature.asc Description: Digital signature
More on the future LDAP admin gui in Debian Edu (Was: Is LWAT completely broken in Squeeze?)
At the moment, we have no working LDAP adminstration tool in Debian Edu/Squeeze. This is a problem that need to be adressed. On the other hand we do have some options (lwat, cipux, gosa), and some developers working to find a solution. For lwat, there is as far as I know no developer willing to spend the time needed to get it back in shape for Squeeze. Upstream seem to have abandened the project, with no new versions for a long time, no commits to the svn and no replies to our emails on the topic. The last package is missing in squeeze, and is only in the Debian Edu lenny repository. Neither version is working in Squeeze. Lwat work with the schemas we use already, which are the ones from IETF and the upstream source for the relevant packages (dhcp/pdns). It can be made compatible with our current LDAP structure by changing its configuration. For Cipux, no developer so far seem willing to spend the time to get it working out of the box with Debian Edu. Working packages might be in squeeze, but it is unknown as no-one has tried to get them working with Debian Edu/Squeeze as far as I know. I do not know what schemas are used, nor if it is compatible with the current LDAP structure. For Gosa, Andreas have already spent the time to get it working out of the box with Debian Edu. Working packages are missing in squeeze, but present in unstable and should enter testing in 9 days. It require its own schemas for storing information about computers, its edited version of the dhcp schema and only work with the dnszone DNS schema used by bind/ldap2zone. Do not work with powerdns at the moment, but could probably be patched to work with it if we switch powerdns to scrict LDAP mode. If Cipux is to become an alternative for Squeeze, someone need to spend time to get it working out of the box with Debian Edu/Squeeze, and allow us to test it to see how it compare to Gosa. It would probably be a good idea to create a wiki page with pros and cons for the various LDAP frontends, to make it easier to choose which one we should use for Squeeze. As we try to figure out a good LDAP strucuture for the future, it would be useful to know that the structure do not limit our frontend choices. I believe that if we can design a structure that work with lwat, Gosa and Cipux, we should have a good design that might even work with the next frontend to be selected when we have to replace whatever is selected for Squeeze some time in the future. Happy hacking, -- Petter Reinholtsen -- To UNSUBSCRIBE, email to debian-edu-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20100730175544.ge6...@login2.uio.no
