[Git][debian-edu/debian-edu-config][mr/followup-40_change-default-cert-algo] 20 commits: ltsp: Add 'quiet splash' to hide boot details on clients

"Mike Gabriel (@sunweaver)" <[email protected]>
Newsgroups gmane.linux.skolelinux.cvs
Message-ID <[email protected]> 

Mike Gabriel pushed to branch mr/followup-40_change-default-cert-algo at Debian Edu / debian-edu-config


Commits:
a402079a by Serhii Horichenko at 2026-08-21T23:29:58+02:00
ltsp: Add 'quiet splash' to hide boot details on clients

- - - - -
9bdaa01c by Serhii Horichenko at 2026-08-21T23:59:31+02:00
Revert "ltsp: Add 'quiet splash' to hide boot details on clients"

This reverts commit a402079a5101ceb334adc8a0a3824023be527b0d.

- - - - -
edbfefbb by Serhii Horichenko at 2026-08-23T10:19:19+02:00
ltsp: Add 'quiet splash' to hide boot details on clients

- - - - -
6966abd0 by Mike Gabriel at 2026-08-25T21:04:20+02:00
sbin/debian-edu-ltsp-install: Use KERNEL_PARAMETERS variable, if we define it

- - - - -
6169ac8e by Mike Gabriel at 2026-08-25T21:05:47+02:00
sbin/debian-edu-ltsp-install: Fix variable interpretation in sed commands

... by using double quotes, not single quotes.

- - - - -
13b1674d by Serhii Horichenko at 2026-08-25T19:06:31+00:00
etc/nagios3/debian-edu/commands.cfg: Add key -l for check_apt to list packages available for upgrade.

- - - - -
028e3f93 by Daniel Teichmann at 2026-08-25T19:07:16+00:00
debian/control: Depend on iproute2

- - - - -
beb42a3b by Mike Gabriel at 2026-08-25T19:07:16+00:00
sbin/update-hostname-from-ip: white-space cleanup

- - - - -
36910c1e by Mike Gabriel at 2026-08-25T19:07:16+00:00
sbin/update-hostname-from-ip: Stop using net-tools, use ip command from iproute2 instead

- - - - -
021b4b13 by Daniel Teichmann at 2026-08-25T19:07:16+00:00
testsuite/network: Stop using net-tools, use ip from iproute2 instead

- - - - -
703ccd7f by Daniel Teichmann at 2026-08-25T19:07:16+00:00
ldap-tools/ldap-debian-edu-install: Get MAC addresses via ip link instead of ifconfig

- - - - -
cde0e7df by Daniel Teichmann at 2026-08-25T19:07:16+00:00
share/debian-edu-config/testsuite-lib.sh: Use ss instead of netstat

- - - - -
b509dcee by Daniel Teichmann at 2026-08-25T19:07:16+00:00
testsuite/ldap-server: Use ss instead of netstat

- - - - -
c24d32a2 by Daniel Teichmann at 2026-08-25T19:07:16+00:00
debian/control: Drop Depends: net-tools

- - - - -
8b60974e by Mike Gabriel at 2026-08-25T19:07:48+00:00
share/debian-edu-config/d-i/pre-pkgsel: Support hostname override via /proc/cmdline. (Closes: #1008597).

- - - - -
22bbc38a by Daniel Teichmann at 2026-08-25T19:07:48+00:00
share/debian-edu-config/d-i/pre-pkgsel: Tighten hostname= parsing and sanitization from /proc/cmdline.

Handle hostname= as first cmdline token, ignore empty values and
strip characters invalid in hostnames.

- - - - -
107e8bf0 by Daniel Teichmann at 2026-08-25T19:07:48+00:00
share/debian-edu-config/d-i/pre-pkgsel: strip hyphens only when present

Use 's/^-+//' / 's/-+$//' instead of '-*' so the substitution only
fires when there actually is a leading/trailing hyphen to remove.

- - - - -
d5cef833 by Daniel Teichmann at 2026-08-25T19:09:26+00:00
tools/create-debian-edu-certs: Switch root CA and server key generation to ECDSA prime256v1

RSA with 2048 bits is the bare minimum with OpenSSL 3. Replace
'openssl genrsa' with 'openssl genpkey -algorithm EC' using the
prime256v1 (secp256r1 / NIST P-256) curve.

- - - - -
a15aa1fc by Daniel Teichmann at 2026-08-25T19:09:26+00:00
tools/create-server-cert: Switch key generation to ECDSA prime256v1 and drop keyEncipherment key usage

keyEncipherment is only meaningful for RSA keys. For ECDSA server
certificates only the digitalSignature key usage is applicable
(RFC 5480).

- - - - -
4bfee5ad by Daniel Teichmann at 2026-08-25T19:09:26+00:00
v3.cnf: Drop keyEncipherment from server cert key usage

keyEncipherment is not applicable to ECDSA keys (RFC 5480), only
digitalSignature is required for TLS server certificates.

- - - - -


13 changed files:

- debian/control
- etc/nagios3/debian-edu/commands.cfg
- ldap-tools/ldap-debian-edu-install
- sbin/debian-edu-ltsp-install
- sbin/debian-edu-ltsp-ipxe
- sbin/update-hostname-from-ip
- share/debian-edu-config/d-i/pre-pkgsel
- share/debian-edu-config/testsuite-lib.sh
- share/debian-edu-config/tools/create-debian-edu-certs
- share/debian-edu-config/tools/create-server-cert
- share/debian-edu-config/v3.cnf
- testsuite/ldap-server
- testsuite/network


Changes:

=====================================
debian/control
=====================================
@@ -31,6 +31,7 @@ Depends: ${misc:Depends},
          education-tasks,
          fping,
          gnutls-bin,
+         iproute2,
          iptables,
          isenkram-cli,
          ldap-utils,
@@ -50,7 +51,6 @@ Depends: ${misc:Depends},
          lockfile-progs,
          lsb-release,
          media-types,
-         net-tools,
          ng-utils,
          openssl,
          patch,


=====================================
etc/nagios3/debian-edu/commands.cfg
=====================================
@@ -42,7 +42,7 @@ command_line	/usr/lib/nagios/plugins/check_disk -w $ARG1$ -c $ARG2$
 
 define command{
 command_name	check_apt
-command_line	/usr/lib/nagios/plugins/check_apt
+command_line	/usr/lib/nagios/plugins/check_apt -l
 }
 
 define command{


=====================================
ldap-tools/ldap-debian-edu-install
=====================================
@@ -114,7 +114,7 @@ fi
 ################# password available now ##################
 
 lookup_mac_addrs() {
-    PATH=/sbin:$PATH ifconfig 2>/dev/null | grep -i hwaddr | awk '{print $5}' | sort -u
+    LANG=C ip link | awk '/link\/ether/ { print $2 }' | sort -u
 }
 
 slapd_stop() {


=====================================
sbin/debian-edu-ltsp-install
=====================================
@@ -262,6 +262,7 @@ NAT=1
 POST_INIT_PRINTER="cp /etc/ltsp/p910d.conf /etc/default/p910d"
 HOSTS_1="10.0.2.2 tjener.intern tjener"
 HOSTS_2="$ETH1_IP $HOSTNAME"
+KERNEL_PARAMETERS="quiet splash"
 EOF
 fi
 
@@ -788,4 +789,6 @@ item\
 fi
 
 # Make sure /srv/tftp/ltsp/ltsp.ipxe is Debian Edu specific.
-sed -i 's#ltsp/ltsp.img#ltsp/${img}/ltsp.img#' /srv/tftp/ltsp/ltsp.ipxe
+sed -i "s#ltsp/ltsp.img#ltsp/${img}/ltsp.img#" /srv/tftp/ltsp/ltsp.ipxe
+# Add "quiet" and "splash" parameters to hide kernel logs on a boot screen.
+sed -i "s/set cmdline ${cmdline_method} ${cmdline_ltsp} ${cmdline_client}$/set cmdline ${cmdline_method} ${cmdline_ltsp} ${cmdline_client} ${KERNEL_PARAMETERS}/" /srv/tftp/ltsp/ltsp.ipxe


=====================================
sbin/debian-edu-ltsp-ipxe
=====================================
@@ -20,5 +20,7 @@ fi
 
 # Make sure /srv/tftp/ltsp/ltsp.ipxe is Debian Edu specific.
 sed -i 's#ltsp/ltsp.img#ltsp/${img}/ltsp.img#' /srv/tftp/ltsp/ltsp.ipxe
+# Add "quiet" and "splash" parameters to hide kernel logs on a boot screen.
+sed -i 's/set cmdline ${cmdline_method} ${cmdline_ltsp} ${cmdline_client}$/set cmdline ${cmdline_method} ${cmdline_ltsp} ${cmdline_client} quiet splash/' /srv/tftp/ltsp/ltsp.ipxe
 echo ""
 echo "/srv/tftp/ltsp/ltsp.ipxe has been modified."


=====================================
sbin/update-hostname-from-ip
=====================================
@@ -26,9 +26,9 @@ log() {
 # Generate FQDN based on hardware MAC address
 ether2hostname() {
     if [ "$1" ] ; then
-	mac="$1"
+        mac="$1"
     else
-	mac=$(ifconfig $INTERFACE | awk '/ether/ { print $2; exit}')
+        mac=$(ip addr show ${INTERFACE} | grep 'link/ether ' | awk '{print $2; exit}')
     fi
     # Generate NetBIOS compliant hostname.
     mac=$(echo $mac | sed 's/[^0-9a-f-]//gi')
@@ -42,12 +42,12 @@ ether2hostname() {
 ip2hostname() {
     ip=$1
     host $ip | grep 'domain name pointer' | cut -d ' ' -f 5 | \
-	rev |cut -d '.' -f 2-|rev
+        rev | cut -d '.' -f 2- | rev
 }
 
 PATH="/sbin:$PATH"
 
-INTERFACE="$(/sbin/route -n | awk '/^0\.0\.0\.0 / { print $8; exit }')"
+INTERFACE="$(ip -4 route | awk '/^default via / { print $5; exit }')"
 
 if [ -z "$INTERFACE" ] ; then
     INTERFACE=eth0
@@ -57,11 +57,11 @@ sethostname() {
     hostname="$1"
     namesource="$2"
     if hostname $hostname ; then
-	echo $hostname > /etc/hostname
-	log "info: changing hostname to $hostname based on $namesource"
+        echo $hostname > /etc/hostname
+        log "info: changing hostname to $hostname based on $namesource"
     else
-	log "warning: unable to set hostname to $hostname."
-	return -1
+        log "warning: unable to set hostname to $hostname."
+        return -1
     fi
 }
 
@@ -69,15 +69,15 @@ sethostname() {
 TEMP=$(getopt -n update-hostname-from-ip -o dmM:nI:q -- "$@")
 
 # Abort when there was a bug
-[ $? = 0 ] || die "error parsing arguments. Try $0 --help"       
+[ $? = 0 ] || die "error parsing arguments. Try $0 --help"
 
 eval set -- "$TEMP"
-while true; do     
-    case $1 in 
+while true; do
+    case $1 in
         -m)
             USEMAC=true; shift; continue
-            ;;                                    
-        -M)                            
+            ;;
+        -M)
             MAC="$2"; shift; shift; continue
             ;;
         -I)
@@ -102,7 +102,7 @@ done
 
 # Extract current IP if non was provided on the command line
 if [ -z "$IP" ] ; then
-    IP=`ifconfig $INTERFACE 2>&1 |grep 'inet '|tr a-zA-Z: " "|awk '{print $1; exit}'`
+    IP=$(ip addr show ${INTERFACE} | grep 'inet ' | awk '{print $2; exit}' | cut -d "/" -f1)
 fi
 
 if [ "127.0.0.1" = "$IP" ] ; then
@@ -121,7 +121,7 @@ fi
 
 if [ "$MY_HOSTNAME" ]; then
     if $onlyprint ; then
-	echo $MY_HOSTNAME
+        echo $MY_HOSTNAME
     else
         # Already got the correct host name?
         if [ "$MY_HOSTNAME" != "$(uname -n)" ] ; then


=====================================
share/debian-edu-config/d-i/pre-pkgsel
=====================================
@@ -179,6 +179,19 @@ EOF
         echo "ff02::3         ip6-allhosts"
     ) > /target/etc/hosts
 
+    # Check whether hostname= was given on boot's /proc/cmdline prompt
+    # and use that if not installing a Main-Server.
+    PROC_CMDLINE_HOSTNAME=$(cat /proc/cmdline |
+        sed -n -re "s/.*(^| )hostname=([^ ]+).*/\2/p" |
+        tr A-Z a-z |
+        tr -cd 'a-z0-9-' |
+        sed -e 's/^-+//' -e 's/-+$//')
+    if echo $PROFILE | grep -q Main-Server ; then
+        :
+    elif [ -n "${PROC_CMDLINE_HOSTNAME}" ]; then
+        MY_HOSTNAME="${PROC_CMDLINE_HOSTNAME}"
+    fi
+
     if [ ! -z "$MY_HOSTNAME" ] ; then
         echo "$MY_HOSTNAME" > /target/etc/hostname
         in-target /bin/hostname "$MY_HOSTNAME"
@@ -188,7 +201,7 @@ EOF
     # generate from MAC address, unless installing main-server.
     if echo $PROFILE | grep -q Main-Server ; then
         :
-    elif [ -x /target/usr/sbin/update-hostname-from-ip ] ; then
+    elif [ -x /target/usr/sbin/update-hostname-from-ip ] && [ -z "${PROC_CMDLINE_HOSTNAME}" ]; then
         in-target /usr/sbin/update-hostname-from-ip -m || true
     fi
 


=====================================
share/debian-edu-config/testsuite-lib.sh
=====================================
@@ -19,7 +19,8 @@ netstat_check() {
     proto=$2
     service="$3"
 
-    if netstat -a --numeric-hosts 2>&1 | grep ":$port " | grep -q "^$proto" ; then
+    if ss -H -t -u -a 2>&1 | grep ":$port " | grep -q "^$proto" || \
+       ss -H -n -t -u -a 2>&1 | grep ":$port " | grep -q "^$proto" ; then
 	echo "success: $0: $service service is listening on $port/$proto."
 	true
     else


=====================================
share/debian-edu-config/tools/create-debian-edu-certs
=====================================
@@ -32,12 +32,12 @@ SERVER_KEY="$KEY_DIR/debian-edu-server.key"
 
 generate() {
     # Generate Debian Edu root CA private key.
-    openssl genrsa -out $CA_KEY 2048
+    openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:prime256v1 -out $CA_KEY
     # Request rootCA CSR and self-sign it to apply v3 extensions.
     openssl req -new -nodes -key $CA_KEY -out $TMP/ca.csr -config $SSL_CA_CONF
     openssl x509 -req -in $TMP/ca.csr -signkey $CA_KEY -days 3650 -out $CA_CERT -extfile $V3_CA_CONF
     # Request web server key.
-    openssl req -new -nodes -out $TMP/server.csr -newkey rsa:2048 -keyout $SERVER_KEY -config $SSL_CONF
+    openssl req -new -nodes -out $TMP/server.csr -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -keyout $SERVER_KEY -config $SSL_CONF
     # Request web server certificate.
     openssl x509 -req -in $TMP/server.csr -CA $CA_CERT -CAkey $CA_KEY -CAcreateserial -out $SERVER_CERT -days 3650 -extfile $V3_CONF
     # Adjust owner and rights.


=====================================
share/debian-edu-config/tools/create-server-cert
=====================================
@@ -139,7 +139,7 @@ tempdir=$(mktemp -d)
 cat > "${tempdir}/v3.conf"  <<EOF
 # v3.ext
 authorityKeyIdentifier=keyid,issuer
-keyUsage = digitalSignature, keyEncipherment
+keyUsage = digitalSignature
 extendedKeyUsage = serverAuth
 subjectAltName = @alt_names
 
@@ -165,7 +165,7 @@ else
 	echo "Creating new key file: ${keydir}/${keyfile}"
 	echo
 	openssl  req  -config "${tempdir}/ssl.cnf" \
-	              -nodes  -new -newkey rsa:2048 \
+	              -nodes  -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \
 	              -keyout "${keydir}/${keyfile}" \
 	              -out "${tempdir}/${csrfile}"
 fi


=====================================
share/debian-edu-config/v3.cnf
=====================================
@@ -1,6 +1,6 @@
 # v3.ext
 authorityKeyIdentifier=keyid,issuer
-keyUsage = digitalSignature, keyEncipherment
+keyUsage = digitalSignature
 extendedKeyUsage = serverAuth
 subjectAltName = @alt_names
 


=====================================
testsuite/ldap-server
=====================================
@@ -74,7 +74,7 @@ else
 fi
 
 echo "info: connection per ldap-client"
-netstat -a --numeric-hosts | grep :ldap |
+ss -H -t -u -a | grep :ldap |
     awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n |
     sed "s%^%info: $0: clients: %"
 


=====================================
testsuite/network
=====================================
@@ -14,16 +14,11 @@ if test -r /etc/debian-edu/config ; then
     . /etc/debian-edu/config
 fi
 
-if [ -x /sbin/ifconfig ] ; then
-	/sbin/ifconfig -a | sed "s%^%info: $0: ifconfig: %" || true
+if command -v ip >/dev/null ; then
+	ip addr | sed "s%^%info: $0: ip addr: %" || true
+	ip route | sed "s%^%info: $0: ip route: %" || true
 else
-	error "Unable to find /sbin/ifconfig"
-fi
-
-if [ -x /sbin/route ] ; then
-	/sbin/route -n | sed "s%^%info: $0: route: %" || true
-else
-	error "Unable to find /sbin/route"
+	error "Unable to find ip (iproute2)"
 fi
 
 if [ -x /usr/bin/nmap ] ; then
@@ -65,11 +60,7 @@ fi
 ######################################################################
 
 have_interface() {
-    if /sbin/ifconfig "$1" > /dev/null 2>&1 ; then
-        true
-    else
-        false
-    fi
+    ip link show "$1" > /dev/null 2>&1
 }
 
 for value in `echo $PROFILE |sed 's/ /-/g' | sed 's/,-/ /g'`; do



View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/b3d1e22193bcf1396be39aad702f226295404c0f...4bfee5ad89b4c95e7b5c39f43cc701b38bd8a786

-- 
View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/b3d1e22193bcf1396be39aad702f226295404c0f...4bfee5ad89b4c95e7b5c39f43cc701b38bd8a786
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help

_______________________________________________
debian-edu-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-edu-commits
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.