Re: urpmi and ldap

--Boundary-00=_4TkjCpntxKdednK
Content-Type: text/plain;
  charset="iso-8859-15"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

On Friday 20 May 2005 19:55, Buchan Milne wrote:
> Michael Scherer wrote:
> > Le Jeudi 19 Mai 2005 14:45, Buchan Milne a =E9crit :
> >>Michael Scherer wrote:
> >>>Le Mardi 17 Mai 2005 09:19, Buchan Milne a =E9crit :
> >>>>Such as the commented out objectidentifier (which is all that
> >>>> would need to be changed if we can get an oid arc from flepied).
> >>>
> >>>I didn't asked yet, we should first finish the schema.
> >>
> >>Sure, but the previous schema wouldn't load up on my LDAP server,
> >> and now it's *really* trivial to change it when it can be
> >> finalised.
> >
> > Yes, of course.
> > Is there nothing to add to the scheme, you think we can propose it
> > ?
>
> I think so ...
>
> My only concern is that if we (or others) start adding LDAP support
> to lots of apps ... each with custom schema ... we're going to end up
> with *lots* of schema, meaning schema-aware applications will need to
> transfer a lot of data to get the schema ... and if we need to have
> fast searches, we may need to index a lot more attributes (incurring
> a performance hit, and using addtional disk space).

Yes, but from a pratical point of view, we should first start to use=20
ldap and then, standardisation will ( may ) happen. I do not think we=20
should wait for a consensus and suffer from the "jabber" effect ( see=20
the time needed to have a jabber enhancement proposal validated :=20
http://www.jabber.org/jeps/ ).

> And, not very many of the attributes actually need to be searchable.
>
> So, I think it would be more useful to have a more generic schema:
>
>
> cn=3D10_2_main,ou=3Durpmi,ou=3Dconfiguration,ou=3DHosts,$dn
> objectclass: softwareConfiguration
> softwareName: urpmi
> softwareVersion: 10.2
> configurationClass: medium
> uri: http://foo/path/etc
> cn: 10_2_main
> configurationEntry: hdlist=3D10_2_main.hdlist.cz
> configurationEntry: withhdlist=3Dpath/to/hdlist.cz
> configurationEntry: http_proxy=3Dhttp://proxy:8080
>
> So, instead of a search for
> (&(objectClass=3DurpmiRepository)(cn=3D10_2_main)), you would do a search
> for
> (&(objectClass=3DsoftwareConfiguration)(softwareName=3Durpmi)(softwareVer
>sion=3D10.2))
>
> But, this would only be useful if we have more software that would
> use a schema like this.

This could be changed with the configuration file after, or added=20
afterwards. I do not want to wait too much.


> >>>>>>For dns-autoconfiguration, I don't think the OpenLDAP libs
> >>>>>> support it (but pam_ldap and nss_ldap do to some extent,
> >>>>>> though I am not sure about autofs and sudo - which use
> >>>>>> /etc/ldap.conf as well ...).
> >>>>>>
> >>>>>>So, I'll need to think about this some more.
> >>>>>
> >>>>>It would be nice to have a common way to autoconfigure, using
> >>>>> srv record, we just need to agree with other people about the
> >>>>> name ( and the need )
> >>>>
> >>>>I don't see the need to be able to locate anything but the LDAP
> >>>> server (assuming the BASEDN is configured somewhere already, as
> >>>> it will have to be anyway).
> >>>
> >>>If we need to add the basedn by hand, we could also add the ldap
> >>> server at the same time, so what is the interest ?
> >>
> >>The basedn will not change ... however the LDAP server could be
> >>different (based on location for instance).
> >
> > Indeed.
> > Since the config file could be placed on installation, maybe there
> > is no need for basedn auto configuration. Maybe I read too much
> > thing about zeroconf and macos X :)
> > (
> > http://images.apple.com/server/pdfs/Workgroup_Manager_TB_v10.4.pdf,
> > page 6 )
>
> Thanks, I'll take a look at that.
>
> But, remember, we don't really want to produce a setup which could be
> easily exploited (ie by having someone plug your laptop into a
> network which has DNS/LDAP etc configured, and have your machine
> trust everything enough to let someone log in).

If I look at urpmi-ldap, the package need first to be installed, and I=20
do not think it should placed by default, because of this.

And yes, mac os x suffered in the past from similar problem=20
( http://www.carrel.org/dhcp-vuln.html ).

However, I think the main problem was that it was turned on by default.

If someone gain access to your dns with enough power to inject a false=20
ldap server serving you bad rpm, they can also change the regular ldap=20
server. And I think people should not install it if they do not plan to=20
use it at all.

> There has to be at least some configuration that must be done
> manually that will guarantee the security of the system ... maybe SSL
> CA cert would be best/easiest?

With a wizard to generate keys, maybe, I still think openssl is too=20
complex for me :)
( hint for a perl coder that do not know what to code :=20
http://qa.mandrakesoft.com/twiki/bin/view/Main/WritingWizard )

> >>>>>Either we use srv record to give the server and other
> >>>>> informations, or we use the dns to give the url of the file to
> >>>>> download with the configuration ( like ie proxy detection
> >>>>> http://www.wlug.org.nz/WPAD ).
> >>>>
> >>>>This looks partially broken compared to using a SRV record IMHO
> >>>> (since you could have collisions with a host with a short
> >>>> hostname of 'wpad', which the use of SRV records prevents).
> >>>>
> >>>>$ dig +short @win2k3 _ldap._tcp.hp441.co.za SRV
> >>>>0 100 389 win2k3.hp441.co.za.
> >>>>
> >>>>IMHO, WPAD would be better if it used something like a SRV record
> >>>> for webcache (ie _webcache._tcp)
> >>>
> >>>Yes, of course, a fixed name is bad, but what about using SRV
> >>> record to store the url of the config file ?
> >>
> >>SRV records should be:
> >>$priority $weight $port $hostname
> >>
> >>(this url may be of interest:
> >>http://www.microsoft.com/resources/documentation/Windows/2000/serve
> >>r/reskit
> >> /en-us/Default.asp?url=3D/resources/documentation/Windows/2000/serve
> >>r/reskit/e n-us/distrib/dsbc_nar_sdns.asp)
> >
> > Ok, so, what should we choose for srv record ?
>
> For WPAD? Or something related to urpmi (which I don't think needs
> anything else auto-configured, if it can find the LDAP server, and we
> want to manually choose the basedn ..).

=46or urpmi, the wpad stuff was just a example.

> > Is there something "standard" for this ?
> > Would it be useful to have a config item for this ?
> >
> > And we still need to add round robin support.
>
> SRV records already provide for that via the priority and weight. You
> should cater for multiple answers ... take the ones with the lowest
> priority, and then the ones with the highest weight (I think), and
> then if you still have more than one, take a random one.

Yes, but not in the urpmi module ( for the moment ).


> >>>>>What would be nice also is to use the same system with
> >>>>> $ARCH/$VERSION in the ldap config file, especially with the
> >>>>> filter.
> >>>>
> >>>>I was thinking that myself ... although for now $ARCH/$VERSION
> >>>> support in the url attribute may be enough (and, I guess it may
> >>>> work already), depending on the mirror.
> >>>
> >>>Adding support for domain name  would also be nice i think ( and
> >>> easy ).
> >>>
> >>>With a substitution on the filter, we could have something like :
> >>>
> >>>base_filter=3D"(&(objectClass=3DurpmiRepository)(associatedDomain=3D$D=
OM
> >>>AIN)"
> >>
> >>Hmm, not very many of me entries have an associatedDomain
> >> attribute.
> >
> > Adding $domain support is easy, this is just a difference case of
> > $HOST. And we can already use hostname and a anonymous ldap for
> > this.
> >
> >>Additionally, I think we need to consider a scheme that would be
> >> useful for all software using LDAP for configuration (which
> >> hopefully someday will include KDE/GNOME etc).
> >>
> >>My idea was that we should be able to get to the point where every
> >> host has an entry in LDAP (and, be able to authenticate to the
> >> LDAP server using a Kerberos keytab file). Then, host-specific
> >> configurations could be dependant on the group memberships of the
> >> host ...
> >>
> >>So, the host would do an ldapsearch to determine its dn (ie
> >> ldapwhoami), then search (&(objectclass=3Dgroup)(member=3D$dn)), and
> >> then search the groups for configurations.
> >
> > Ok, we could also add support for this :
> >
> > $dn =3D> `ldapwhoami -x` or $user
> >  ( if $user  in ldap config file  ).
>
> I was thinking more of the situation without "-x", aka SASL, aka
> GSS-API (kerberos).

Without -w, there is nothing that can block the software ( ie wait for=20
input ) ?

Here is a trivial patch for this. Rafael, can you review it ?


> > Would it be sufficient, or this need more information  ?
>
> I think it should be sufficient ... but it means users need to set up
> additional information, and it should be easy to do this (aka
> choosing the - currently non-existent - "LDAP + Kerberos" option in
> drakauth should create an LDAP entry for the host and retrieve the
> keytab).

Is it difficult to do ?
I do not think I will be able to test, but it may not be too difficult=20
to add.

> >>>Then, all computer named roomX.firstgrade.student.example.com
> >>> would fetch student hdlists, and
> >>> roomY.secondgrade.student.example.com would fetch other hdlist,
> >>> based on the filtering, and on associatedDomain.
> >>>
> >>>>Another thing ... how about adding LDIF support to urpmi-web
> >>>> (user to provide the basedn).
> >>>
> >>>Can you elaborate ?
> >>
> >>Well, to generate this:
> >>>>http://www.zarb.org/~bgmilne/obsidian-urpmi.ldif
> >>
> >>I went to urpmi-addmedia.org, chose my mirrors, and then added the
> >>information to the relevant attributes etc
> >>
> >>The only information in the LDIF (besides the proxy, which isn't
> >> taken into account directly by urpmi yet) that was not known
> >> already was the basedn (in this case
> >> cn=3Durpmi,cn=3DConfig,ou=3DHosts,dc=3Dobsidian,dc=3Dco,dc=3Dza).
> >>
> >>So, a checkbox for "Generate LDIF for urpmi-ldap" and a field to
> >> enter a basedn would be nice ....
> >
> > This is quite specialized, but it would be easier to add than
> > .urpmi-media file.
> > (
> > http://qa.mandriva.com/twiki/bin/view/Main/CreateRepository#Providi
> >ng_a_easy_way_to_add_your ).
> >
> > Just ask to easy urpmi people ( nanardon, trem, at zarb.org ).
>
> OK ... next week ... I'm late already.

Mhh, same here :/

=2D-=20
Micha=EBl Scherer

On the importance to respond to proposal email :
http://www.nntp.perl.org/group/perl.bootstrap/1127

--Boundary-00=_4TkjCpntxKdednK
Content-Type: text/x-diff;
  charset="iso-8859-15";
  name="urpmi.dn_expand.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename="urpmi.dn_expand.patch"

Index: urpm/cfg.pm
===================================================================
RCS file: /cooker/soft/urpmi/urpm/cfg.pm,v
retrieving revision 1.31
diff -u -d -p -r1.31 cfg.pm
--- urpm/cfg.pm	16 May 2005 08:11:29 -0000	1.31
+++ urpm/cfg.pm	20 May 2005 13:08:39 -0000
@@ -58,6 +58,8 @@ sub get_arch () { _init_arch_release(); 
 
 sub get_release () { _init_arch_release(); $release }
 
+sub get_dn() { my $h = `/usr/bin/ldapwhoami 2>/dev/null` || 'anonymous'; chomp $h; $h }
+
 sub get_host () {
     my $h;
     if (open my $f, '/proc/sys/kernel/hostname') {
@@ -89,6 +91,7 @@ sub expand_line {
 	    HOST => get_host(),
 	    ARCH => get_arch(),
 	    RELEASE => get_release(),
+        DN => get_dn(),
 	);
     }
     foreach my $sub (keys %substitutions) {

--Boundary-00=_4TkjCpntxKdednK--