[ Reason ]
While setting up a new Debian Edu school in Dec/Jan 2021/2022 several
issues popped up in Debian Edu 11 that have now been resolved in Debian
Edu testing/unstable and many of the fixes we would love to see available
in Debian Edu 11, as well.
[ Impact ]
For Debian Edu, the proposed 2.11.56+deb11u4 version of debian-edu-config
will provide many problem solutions for issues that have been encountered
with the current version of debian-edu-config (main package for Debian
Edu 11).
[ Tests ]
(What automated or manual tests cover the affected code?)
[ Risks ]
For non-Debian-Edu users there will be no risk, at all. For Debian Edu
users new issues may be introduced (hopefully not!), esp. due to the
large number of fixes provided / code changes shipped in 2.11.56+deb11u4.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
+ [ Wolfgang Schweer ]
+ * etc/exim4/exim-ldap-server-v4.conf: Accept incoming mail from internal
+ network sent to root@<mynetwork-names>. (Closes: #1003727).
-> TJENER's mainserver is configured as a local MTA collecting system mails
from Debian Edu clients. Such mails have been refused by TJENER's exim
configuration before (since Debian Edu 11).
+ * Use mktemp instead of deprecated tempfile, adjust:
+ - etc/X11/Xsession-debian-edu
+ - sbin/debian-edu-update-netblock
+ - share/debian-edu-config/tools/gosa-sync
+ - testsuite/postoffice
+ (Closes: #1005352).
-> The 'tempfile' executable produces warning messages about being
deprecated when used. The 'mktemp' file does not.
+ [ Mike Gabriel ]
+ * share/d-e-c/tools/gosa-modify-host: Only create Kerberos host and service
+ principals if they don't yet exist. (Closes: #1002014).
-> The above issue has been critical for Debian Edu 11 setups and was
only spotted recently. Whenever a system entry in GOsa² was edited, the
Krb5 principal would change. This lead to login failures on Debian Edu
clients (after a GOsa² edit of the system entry in LDAP).
+ * share/d-e-c/tools/gosa-create-host: Fix copy+paste flaw in comment.
-> Well, maybe not release critical, but comment mentioned stuff about
user accounts while this script is for host accounts.
+ * share/debian-edu-config/tools/setup-freeradius-server: Fix integer
+ comparison in run-by-root check. Script was not executable fully (not even
+ as root).
-> Make the setup-freeradius-server usable without manual editing of the
script before usage.
+ * debian/debian-edu-config.fetch-ldap-cert: Drop retrieval of
+ Debian-Edu_rootCA from this script. This now is the task of the
+ fetch-rootca-cert script. (Closes: #971780).
-> fetch-ldap-cert init script and fetch-rootca-cert script had some common
functionality (retrieval of the .intern domain's rootCA by clients).
After fetch-rootca-cert was added, we failed to reduce functionality of
fetch-ldap-cert.
On Debian Edu clients, these two scripts were actually interfering with
one another.
+ * debian/debian-edu-config.fetch-rootca-cert: Ensure proper symlinking of
+ Debian-Edu_rootCA.crt in /usr/local/share/ca-certificates/ to
+ Debian-Edu_rootCA.crt in /etc/ssl/ca-certificates. Forced symlinking is
+ required, because earlier versions of the fetch-ldap-cert init script put
+ Debian-Edu_rootCA.crt into /etc/ssl/ca-certificates/ as a file. Forced
+ symlinking replaces files by the wanted symlink. The -n option (no-
+ dereference) is required to make sure we don't follow any already existing
+ symlink. (This relates to #971780).
-> Fix an issue resulting from fetch-ldap-cert performing the rootCA
download differently from fetch-rootca-cert in previous versions of
debian-edu-config. With the change explained above, the transition of
Debian Edu client based on debian-edu-config 2.11.56+deb11u3 (and
earlier) to debian-edu-config 2.11.56+deb11u4 should be smooth.
+ * share/debian-edu-config/tools/update-proxy-from-wpad:
+ - Fix typo (wrong protocol) in APT proxy config creation.
+ - Create a Debian Edu specific proxy configuration in /etc/apt/apt.conf.d/
+ named 03debian-edu-config rather than meddling with /etc/apt/apt.conf
+ directly. Clean up any earlier meddling from apt.conf, as well. (Closes:
+ #1003560).
-> Stop meddling with /etc/apt/apt.conf directly, use a debian-edu-config
namespace file instead. Also, this allows deployment of Debian Edu
systems using FAI (and let FAI's default http proxy configuration
superceded Debian Edu's proxy configuration).
+ * share/debian-edu-config/tools/{update-proxy-from-wpad,wpad-extra}:
+ - Don't fail if proxy update is not possible, only send warnings to stderr
+ and syslog. Don't source wpad-extra script, execute it instead and capture
+ stdout. (Closes: #1008067).
-> update-proxy-from-wpad is used in ifupdown as post-up hook. We don't
want to exit with error when doing the proxy update, because then
ifupdown will also fail with error.
+ * sbin/update-hostname-from-ip:
+ - Simply if-then-else-clauses, reduce number of exit calls, don't exit with
+ non-zero exitcode. Improve syslog messages if things fail. (Closes:
+ #1006604).
-> update-hostname-from-ip is (also) used in ifupdown as post-up hook. We
don't want to exit with error when doing the hostname update, because then
ifupdown will also fail with error.
+ * share/debian-edu-config/tools/setup-roaming: Assure libsss-sudo is installed
+ on Roaming Workstation. (Closes: #1004605).
-> sudo for LDAP users is broken on roaming workstations without this...
+ * share/debian-edu-config/tools/gosa-remove: Capture removals of GOsa² user
+ templates and ignore them. (Closes: #815042).
-> user templates in GOsa² normally don't have a Kerberos account nor do
they have a home directory. The gosa-remove takes care of the removal of
both, so this goes down the drain if we don't bail out early for user
templates.
+ * ldap-schemas/: Update schema files from Debian's latest GOsa² list of
+ schemas.
-> Debian Edu ships its own LDAP schema files for GOsa² (why the hack!).
They should be at least of the same version as found in src:pkg gosa.
In fact, there was one issues fixed in src:pkg in the schema files. This
fix is now available to Debian Edu with this change:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989096
+ * share/debian-edu-config/tools/clean-up-host-keytabs: Don't fail
+ on Kerberos principal removal.
-> sometimes (for whatever reason) systems in GOsa² lack a Kerberos host
principal. When we remove such a system from LDAP via GOsa² we want to
ignore those missing Kerberos information.
+ * etc/cups/cups-browsed-debian-edu.conf:
+ - Let TJENER's print queues appear on Debian Edu clients, use same
+ print queue names on clients as on TJENER. (Closes: #1005841).
-> This change has been requested for Debian Edu earlier, but failed to be
really testable due to apparmor block loading of
/etc/cups/cups-browsed-debian-edu.conf. Unfortunately, this blockage was
also missed during Debian Edu testing for the Debian Edu 11 release.
The wanted behaviour is that print queues on Debian Edu clients have the
same name as the corresponding print queue on TJENER (aka ipp.intern).
The introduced change does exactly that.
+ * sbin/debian-edu-pxeinstall:
+ - Don't append 'ipappend 2' to the kernel boot cmdline anymore as it
+ confuses systemd when booting into the installed system. This resolves
+ the graphical.target not coming up on Debian Edu workstations that got
+ installed via the PXE/network based Debian Installer method. (Closes:
+ #1006362).
-> Debian Edu workstations installed via PXE would not come up with a
graphical system before this change got introduced.
+ - Silence stderr output if the artwork theme lacks a plymouth subfolder.
+ This can be silently ignored and should not trouble Debian Edu admins.
-> Don't report warnings/errors that can be ignored.
+ * Support krb5i on Diskless Workstations (aka LTSP FAT Clients):
+ - ldap-bootstrap/netgroup.ldif: Add diskless-workstation-hosts NIS netgroup
+ during LDAP bootstrap.
+ - debian/debian-edu-config.{postinst,postrm}: Create non-privileged
+ debian-edu system user account on Debian Edu mainserver (for distribution
+ of host keytabs to diskless workstations aka LTSP fat clients).
+ - share/debian-edu-config/tools/: Add update-dlw-krb5-keytabs script and
+ call it (with delay) from gosa-modify-host hook script. (Closes: #613167,
+ #1002018).
-> This whole block is more of a functionality backport than an error
fix. For years we have been thinking about secure NFS mounting of NFS
shares on diskless workstations (aka LTSP fat clients). The solution for this now
is:
- provide a folder with .keytab files for each host that is meant to be
a diskless workstation
- make this folder available to a non-privileged user "debian-edu"
- during LTSP fat client boot, use scp debian-edu@tjener:/<path>/<keytabfile>
to copy over this client host's .keytabfile and use it as /etc/krb5.keytab
The above changelog block describes the required steps in debian-edu-config to
provide this feature on the Debian Edu mainserver (aka TJENER).
+ * Move /etc/debian-edu/host-keytabs/* to /var/lib/debian-edu/host-keytabs/
+ and replace directory /etc/debian-edu/host-keytabs by a symlink. (Closes:
+ #1002019).
-> In Debian Edu 11 there was a design flaw regarding the storage of
Kerberos <host>.keytab files. As a place for storing those files
/etc/debian/host-keytabs was used in the first design approach.
Using /etc for dynamic data is never a good idea, esp. if a tool like
etckeeper is used (which we do in Debian Edu by default).
A better place now has been discussed in Debian Edu team:
/var/lib/debian/host-keytabs. This version of debian-edu-config will
migrate existing .keytab files to this new location and provide a symlink
at the old location.
+ * share/debian-edu-config/squid.conf:
+ - Prefer DNSv4 lookups over DNSv6. Debian Edu does not yet fully support
+ IPv6 and many schools still use IPv4 primarily. This gives a great
+ performance boost to squid installations if IPv6 internet is not fully
+ available for whatever reason. (Closes: #1006375).
-> Performance boost for squid if IPv6 has not been set-up properly.
(Something that we observed more than once in a school network).
+ * share/debian-edu-config/tools/list-gosa-systems:
+ - Drop immature list-gosa-systems script again that got sneaked in via
+ upload of 2.11.56+deb11u3. We apologize for the noise.
-> Ouch! The list-gosa-system was lying around in my (Mike's) working copy of
Debian Edu, not yet added to Git. When working on the previous bullseye-security
upload, this script sneaked into the debian-edu-config src:pkg. It was not
installed to the debian-edu-config bin:pkg, though. So, we now remove it again...
[ Other info ]
This bullseye-pu is presented to the SRM as a joint effort by the Debian
Edu team. Thanks for taking the time for looking into all the changes
provided via the attached .debdiff.