Dnsmasq instead of dhcp3/tftpd-hpa and other ideas

Hi all,

if noone objects, I'd like to commit quite a few changes upstream in the 
next few weeks. Some of those ideas are new; some have been mentioned in 
#ltsp several times in the past. I've tested most of them while 
developing an ltsp-server alternative called "ltsp-pnp" 
(https://help.ubuntu.com/community/UbuntuLTSP/ltsp-pnp), which I would 
also like to merge with upstream.

1) Recommend: dnsmasq instead of isc-dhcp-server/tftpd-hpa. Benefits:

    * Dnsmasq can be used as a proxy DHCP server
    (https://help.ubuntu.com/community/UbuntuLTSP/ProxyDHCP), and that
    will make ltsp-server installation much easier in single-NIC cases
    where an external DHCP server is used (e.g. a router, very common
    setup in small labs, schools etc). The dual-NIC case is very easy
    too, dnsmasq can function as a normal DHCP server in the internal
    192.168.67.x subnet. I'm proposing 192.168.67.x instead of the usual
    192.168.0.x, because the latter is commonly used for the
    external-facing NIC, causing conflicts.
    * Dnsmasq supports a dnsmasq.d/ directory where we can drop our
    configuration files, a static one
    (http://bazaar.launchpad.net/~alkisg/+junk/ltsp-pnp/view/head:/etc/dnsmasq.d/boot-server.conf)
    and a small dynamic dhcp-ranges.conf, automatically generated on
    postinst and updated whenever the user moves the server to a new
    subnet and runs /usr/share/ltsp/update-dhcp-ranges
    (http://bazaar.launchpad.net/~alkisg/+junk/ltsp-pnp/view/head:/ltsp-pnp/update-dhcp-ranges).
    * Dnsmasq can function as a caching DNS server too, which is very
    nice to have for localapps and fat clients. I propose we enable it
    by default, and if someone doesn't want it, he can disable it.
    * Dnsmasq can function as a TFTP server as well. It even supports
    symlinks from the TFTP dir to other dirs by default, and that will
    come in very handy for NFS chroots, where we can symlink
    TFTP/ltsp/arch/ to CHROOT/boot. That change is a big one, and anyone
    that wants to revert to tftpd-hpa will need to remove the --secure
    option from its configuration. Symlinks are also handy for lts.conf,
    which we can now put in /etc/ltsp/lts.conf, and for syslinux
    (/usr/lib/syslinux), which we can use for graphical PXELinux menus.


2) ltsp-update-kernels will get the kernels from within NBD files, 
instead of CHROOTs, so that no kernel version mismatches happen. For 
NFS, it will generate the TFTP symlinks. If the same chroot is exported 
with both NBD and NFS, two TFTP dirs are necessary, due to possible 
kernel mismatches, so new names will need to be introduced, i.e. 
TFTP/ltsp/i386-nbd and TFTP/ltsp/i386-nfs. Code to be merged: 
http://bazaar.launchpad.net/~alkisg/+junk/ltsp-pnp/view/head:/sbin/ltsp-update-kernels

3) ltsp-update-sshkeys and LDM will use hostnames instead of IP 
addresses. This will make it possible to change the server IP without 
having to run ltsp-update-sshkeys and possibly ltsp-update-image, and 
without the need for ssh-hostchecker. If someone has more LDM_SERVERs, 
he'd need to put them in hosts.ltsp (we have support for that now 
already) and specify them by name in lts.conf.

4) Out the the box support for graphical PXE menus 
(http://bazaar.launchpad.net/~alkisg/+junk/ltsp-pnp/view/head:/ltsp-pnp/update-pxe-menu). 
Called by ltsp-update-kernels, a script named 
/usr/share/ltsp/update-pxe-menu will merge all TFTP/*/pxelinux.inc files 
to a master TFTP/pxelinux.cfg/default. The result will be something 
like: http://imagebin.org/index.php?mode=image&id=207317
Dirs under TFTP/ltsp will be sorted in an ascending order, while kernels 
inside them in a descending order, and also options for memtest or 
localboot will be available by default, and the sysadmin can disable 
them if he doesn't want them.

5) An ltsp-export-root tool, which generates an NBD image out of the 
server /. It bind-mounts / to a temp dir, uses a tmpfs/aufs to be able 
to do changes over it before exporting, removes the user accounts, 
regenerates the server ssh keys or other sensitive data, and calls 
mksquashfs. The code to be merged exists in the prepare.d and publish.d 
dirs in 
http://bazaar.launchpad.net/~alkisg/+junk/ltsp-pnp/files/head:/ltsp-pnp/. That's 
the essense of ltsp-pnp, i.e. allowing non-experienced sysadmins to 
manage LTSP without a chroot; they just install whatever they want in 
their server and export it. Of course services like apache, mysql etc 
are prohibited from running in the clients with the RM_SYSTEM_SERVICES 
lts.conf option.

6) Ship an /etc/ltsp dir by default, which will contain a sample 
lts.conf, a vendor.conf with distro-specific variables (BASE=/opt/ltsp; 
DNSMASQ_DIR=/etc/dnsmasq.d; etc), an nbd-exclude file which specifies 
what to exclude from the generated NBD image, and some *.inc files for 
the PXE menus, where the sysadmin can localize the PXE text, customize 
the PXE menus and other options.
Also ship an /etc/default/ltsp file (non-debian distros use a different 
dir for defaults) where the sysadmin can specify the PXE menu default 
entry, whether to automatically update the dnsmasq dhcp ranges, 
additional kernel command line options, IPAPPEND=2/3 etc.

Since there are a lot of changes, the trunk will be somewhat unstable 
for some weeks. We may also want to consider naming it LTSP 6, and when 
the libpam-sshauth and the possibility to use another DM instead of LDM 
are there, we can name that LTSP 7.

Comments? If noone objects, I'll start committing after a few days, 
otherwise I'll keep developing ltsp-pnp in a separate tree.
Thanks!

------------------------------------------------------------------------------
Better than sec? Nothing is better than sec when it comes to
monitoring Big Data applications. Try Boundary one-second 
resolution app monitoring today. Free.
http://p.sf.net/sfu/Boundary-dev2dev
_____________________________________________________________________
Ltsp-developer mailing list.   To un-subscribe, or change prefs, goto:
      https://lists.sourceforge.net/lists/listinfo/ltsp-developer
For additional LTSP help,   try #ltsp channel on irc.freenode.net