Version in base suite: 2.12.903~deb13u1 Base version: debian-edu-config_2.12.903~deb13u1 Target version: debian-edu-config_2.13.2~deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/d/debian-edu-config/debian-edu-config_2.12.903~deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/d/debian-edu-config/debian-edu-config_2.13.2~deb13u1.dsc Makefile | 6 cf3/cf.cfengine3 | 2 cf3/cf.finalize | 2 cf3/cf.grub | 8 cf3/cf.ldapclient | 4 cf3/cf.workarounds | 9 cf3/edu.cf | 4 debian/changelog | 166 ++++ debian/control | 4 debian/debian-edu-config.cron.daily | 5 debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service | 6 debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer | 9 debian/debian-edu-config.lintian-overrides | 2 debian/debian-edu-config.maintscript | 1 debian/rules | 1 etc/apache2/sites-available/debian-edu-default.conf | 55 + etc/dovecot/local.conf | 10 etc/exim4/exim-ldap-client-v4.conf | 3 etc/exim4/exim-ldap-server-v4.conf | 3 etc/nagios3/debian-edu/commands.cfg | 2 etc/wicd/scripts/preconnect/set_wireless_mac_from_eth0 | 24 ldap-bootstrap/debian-edu-router.ldif | 37 + ldap-tools/ldap-debian-edu-install | 8 libexec/debian-edu-apache2-update-tjener-aliases | 219 ++++++ sbin/debian-edu-fsautoresize | 2 sbin/debian-edu-ltsp-install | 11 sbin/debian-edu-ltsp-ipxe | 2 sbin/debian-edu-pxeinstall | 21 sbin/update-hostname-from-ip | 30 share/debian-edu-config/apache2_tjener-aliases.map | 44 + share/debian-edu-config/d-i/pre-pkgsel | 339 ++++------ share/debian-edu-config/gosa.conf.template | 1 share/debian-edu-config/killer.cron | 3 share/debian-edu-config/testsuite-lib.sh | 3 share/debian-edu-config/tools/copy-host-keytab | 17 share/debian-edu-config/tools/create-debian-edu-certs | 9 share/debian-edu-config/tools/create-server-cert | 11 share/debian-edu-config/tools/kerberos-kdc-init | 1 share/debian-edu-config/tools/run-at-firstboot | 38 - share/debian-edu-config/tools/setup-roaming | 4 share/debian-edu-config/v3.cnf | 2 share/debian-edu-config/v3CA.cnf | 7 share/glib-2.0/schemas/32-debian-edu.arctica-greeter.gschema.override | 2 testsuite/hostname | 27 testsuite/ldap-server | 15 testsuite/network | 19 46 files changed, 876 insertions(+), 322 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp_r1eavsk/debian-edu-config_2.12.903~deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp_r1eavsk/debian-edu-config_2.13.2~deb13u1.dsc: no acceptable signature found diff -Nru debian-edu-config-2.12.903~deb13u1/Makefile debian-edu-config-2.13.2~deb13u1/Makefile --- debian-edu-config-2.12.903~deb13u1/Makefile 2025-06-13 09:16:21.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/Makefile 2026-09-07 08:58:26.000000000 +0000 @@ -22,6 +22,7 @@ $(NULL) LIBEXECPROGS = \ + debian-edu-apache2-update-tjener-aliases \ debian-edu-cups-queue-autoflush-for-netgroup-hosts \ debian-edu-cups-queue-autoreenable-for-netgroup-hosts \ debian-edu-fsautoresize-for-netgroup-hosts \ @@ -157,7 +158,6 @@ mklocaluser.d/20-debian-edu-config \ shutdown-at-night/clients-generator \ resolvconf/update.d/bind-debian-edu \ - wicd/scripts/preconnect/set_wireless_mac_from_eth0 \ X11/Xsession-debian-edu \ $(NULL) @@ -195,6 +195,7 @@ ltsp.ldif \ gosa.ldif \ gosa-server.ldif \ + debian-edu-router.ldif \ $(NULL) LDAPPROGRAMS = \ @@ -288,7 +289,6 @@ set -e ; for f in \ share/debian-edu-config/d-i/finish-install \ share/debian-edu-config/d-i/pre-pkgsel \ - share/debian-edu-config/killer.cron \ share/debian-edu-config/tools/passwd \ share/debian-edu-config/tools/clean-up-host-keytabs \ share/debian-edu-config/tools/create-debian-edu-certs \ @@ -359,6 +359,7 @@ $(INSTALL_DATA) sbin/debian-edu-fsautoresizetab $(DESTDIR)/usr/share/debian-edu-config/fsautoresizetab set -e ; for f in \ + share/debian-edu-config/apache2_tjener-aliases.map \ share/debian-edu-config/avahi.smb.service \ share/debian-edu-config/rsyslog-collector \ share/debian-edu-config/rsyslog-filters \ @@ -387,7 +388,6 @@ share/firefox-esr/distribution/policies.json \ share/glib-2.0/schemas/21_debian-edu+gdm.gschema.override \ share/glib-2.0/schemas/31_debian-edu+mate.gschema.override \ - share/glib-2.0/schemas/32-debian-edu.arctica-greeter.gschema.override \ share/mate-panel/layouts/debian-edu-mate.layout \ ; do \ $(INSTALL_DATA) $$f $(DESTDIR)/usr/$$f ; \ diff -Nru debian-edu-config-2.12.903~deb13u1/cf3/cf.cfengine3 debian-edu-config-2.13.2~deb13u1/cf3/cf.cfengine3 --- debian-edu-config-2.12.903~deb13u1/cf3/cf.cfengine3 2023-09-27 20:34:54.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/cf3/cf.cfengine3 2026-09-07 08:58:26.000000000 +0000 @@ -4,7 +4,7 @@ services: - debian.systemd.(server|ltspserver).installation:: + debian.systemd.installation:: "cfengine3.service" service_policy => "stop"; diff -Nru debian-edu-config-2.12.903~deb13u1/cf3/cf.finalize debian-edu-config-2.13.2~deb13u1/cf3/cf.finalize --- debian-edu-config-2.12.903~deb13u1/cf3/cf.finalize 2025-06-11 21:39:21.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/cf3/cf.finalize 2026-08-19 20:24:04.000000000 +0000 @@ -111,7 +111,7 @@ # used during an installation with Main server or LTSP server profile to avoid # broken network setup. - debian.(server|ltspserver).lxqt.di.installation:: + debian.(server|ltspserver).lxqt.(di|fai).installation:: "/usr/bin/apt-get purge -y connman" contain => in_shell; diff -Nru debian-edu-config-2.12.903~deb13u1/cf3/cf.grub debian-edu-config-2.13.2~deb13u1/cf3/cf.grub --- debian-edu-config-2.12.903~deb13u1/cf3/cf.grub 2022-02-11 15:47:45.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/cf3/cf.grub 2026-08-19 20:24:04.000000000 +0000 @@ -7,24 +7,24 @@ files: - debian.(standalone|roaming).di.installation:: + debian.(standalone|roaming).(di|fai).installation:: "/etc/default/grub" edit_line => grub_conf1; - debian.workstation.!server.!standalone.!roaming.di.installation:: + debian.workstation.!server.!standalone.!roaming.(di|fai).installation:: "/etc/default/grub" edit_line => grub_conf2; - debian.(server|minimal).di.installation:: + debian.(server|minimal).(di|fai).installation:: "/etc/default/grub" edit_line => grub_conf3; commands: - debian.di.installation:: + debian.(di|fai).installation:: "/usr/sbin/update-grub" contain => in_shell; diff -Nru debian-edu-config-2.12.903~deb13u1/cf3/cf.ldapclient debian-edu-config-2.13.2~deb13u1/cf3/cf.ldapclient --- debian-edu-config-2.12.903~deb13u1/cf3/cf.ldapclient 2023-09-27 20:34:54.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/cf3/cf.ldapclient 2026-09-07 08:58:26.000000000 +0000 @@ -41,6 +41,10 @@ "/etc/nsswitch.conf" edit_line => nsswitch_conf; + + debian.installation:: + "/etc/netgroup" create => "true"; + } bundle edit_line nsswitch_conf diff -Nru debian-edu-config-2.12.903~deb13u1/cf3/cf.workarounds debian-edu-config-2.13.2~deb13u1/cf3/cf.workarounds --- debian-edu-config-2.12.903~deb13u1/cf3/cf.workarounds 2022-02-11 15:47:45.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/cf3/cf.workarounds 2026-09-07 08:58:26.000000000 +0000 @@ -15,13 +15,4 @@ "$(gosa_file)" create => "true"; - - debian.ltspserver.installation:: - - "/etc/cron.hourly/killer" - delete => tidy; - - "/etc/cron.hourly/killer" - copy_from => local_cp("/usr/share/debian-edu-config/killer.cron"), - perms => mog("755","root","root"); } diff -Nru debian-edu-config-2.12.903~deb13u1/cf3/edu.cf debian-edu-config-2.13.2~deb13u1/cf3/edu.cf --- debian-edu-config-2.12.903~deb13u1/cf3/edu.cf 2022-02-11 15:47:45.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/cf3/edu.cf 2026-08-19 20:24:04.000000000 +0000 @@ -31,7 +31,9 @@ # Set if the Squid cache exists; used to conditionally link Debian Edu configuration. "squidcache" expression => isdir("/var/spool/squid"); # Set if running inside Debian Installer; used to avoid useless LDAP setup upon main server upgrade. - "di" expression => fileexists("/etc/apt/apt.conf.d/00IgnoreTimeConflict"); + "di" expression => fileexists("/etc/apt/apt.conf.d/00IgnoreTimeConflict"); + # Set if running inside FAI Installer; used to setup grub correctly + "fai" expression => isdir("/var/lib/fai/config"); # Set for networked workstation if the 'education-desktop-other' package is installed. "desktopintern" and => { isdir("/usr/share/doc/education-desktop-other"), isdir("/usr/share/doc/education-networked") }; # Set if xfce4 is installed; used to conditionally configure settings. diff -Nru debian-edu-config-2.12.903~deb13u1/debian/changelog debian-edu-config-2.13.2~deb13u1/debian/changelog --- debian-edu-config-2.12.903~deb13u1/debian/changelog 2025-09-15 07:09:50.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/debian/changelog 2026-09-07 08:58:57.000000000 +0000 @@ -1,8 +1,168 @@ -debian-edu-config (2.12.903~deb13u1) trixie; urgency=medium +debian-edu-config (2.13.2~deb13u1) trixie; urgency=medium - * Upload to trixie. + * Release to trixie. - -- Mike Gabriel Mon, 15 Sep 2025 09:09:50 +0200 + -- Mike Gabriel Mon, 07 Sep 2026 10:58:57 +0200 + +debian-edu-config (2.13.2) unstable; urgency=medium + + [ Serhii Horichenko ] + * share/debian-edu-config/tools/run-at-firstboot: + - Add an environment check to avoid starting the image creation on + an LTSP-client (Closes: #1092123). + - Add an ability to create a Diskless Workstation chroot and separate + the creation of an image on an LTSP-server without the Main-Server + role (Closes: #1092123). + + [ Mike Gabriel ] + * sbin/debian-edu-ltsp-install: + - When creating a DLW, set PROFILE to 'Workstation' (Closes: #1092123). + * share/debian-edu-config/tools/kerberos-kdc-init: + - Don't hard-code master_key_type, use MIT/Kerberos' default. (Closes: + #1052962). + * Stop using killer script in Debian Edu. (Closes: #703710). + * cf3/cf.ldapclient: + - Ensure empty file /etc/netgroup exists. (Closes: #1146398). + * exim4/exim-ldap-{server,client}-v4.conf: + - Write logs to syslog. (Closes: #1051836). + * run-at-firstboot: + - Initialize first user's mailbox only when logging into Main-Server. + + -- Mike Gabriel Fri, 04 Sep 2026 23:35:24 +0200 + +debian-edu-config (2.13.1) unstable; urgency=medium + + [ Daniel Teichmann ] + * testsuite/ldap-server: Check /var/lib/ldap exists and is owned by + openldap:openldap. Regression check for Debian bug #1144741. + * debian/debian-edu-config.lintian-overrides: Fix stale reference. (Fixes + commit: 63575146) + * Drop unused wicd preconnect hook. + wicd is no longer in Debian. The hook was the only remaining wicd + integration and is not referenced anywhere else in the package. + * testsuite/hostname: escape regex dot and exit non-zero on failure. + The unescaped dot in the 'tjener.intern' grep matched any character. + Escape it so the FQDN check is exact. Both error paths now exit 1 so a + broken hostname fails the test instead of silently passing. + * share/debian-edu-config/d-i/pre-pkgsel: resolve leftover merge conflict. + * debian/control: Depend on iproute2 + * testsuite/network: Stop using net-tools, use ip from iproute2 instead + * ldap-tools/ldap-debian-edu-install: Get MAC addresses via ip link instead + of ifconfig + * share/debian-edu-config/testsuite-lib.sh: Use ss instead of netstat + * testsuite/ldap-server: Use ss instead of netstat + * debian/control: Drop Depends: net-tools + * share/debian-edu-config/d-i/pre-pkgsel: Tighten hostname= parsing and + sanitization from /proc/cmdline. + Handle hostname= as first cmdline token, ignore empty values and + strip characters invalid in hostnames. + * share/debian-edu-config/d-i/pre-pkgsel: strip hyphens only when present. + Use 's/^-+//' / 's/-+$//' instead of '-*' so the substitution only + fires when there actually is a leading/trailing hyphen to remove. + * tools/create-debian-edu-certs: Switch root CA and server key generation + to ECDSA prime256v1. + RSA with 2048 bits is the bare minimum with OpenSSL 3. Replace + 'openssl genrsa' with 'openssl genpkey -algorithm EC' using the + prime256v1 (secp256r1 / NIST P-256) curve. + * tools/create-server-cert: Switch key generation to ECDSA prime256v1 and + drop keyEncipherment key usage + keyEncipherment is only meaningful for RSA keys. For ECDSA server + certificates only the digitalSignature key usage is applicable + (RFC 5480). + * v3.cnf: Drop keyEncipherment from server cert key usage + keyEncipherment is not applicable to ECDSA keys (RFC 5480), only + digitalSignature is required for TLS server certificates. + + [ Mike Gabriel ] + * debian/control: Add to D: (debian-edu-config): procps. (Closes: #1136493). + * ldap-tools/ldap-debian-edu-install: Make sure interactions with debconf + are UTF-8 based. + This resolves GECOS field transliteration after having retrieved + debian-edu-config/first-user-fullname from the debconf db. + (Closes: #939717). + * share/debian-edu-config/d-i/pre-pkgsel: white-space cleanup + * share/debian-edu-config/d-i/pre-pkgsel: Use 'tjener' in /etc/hostname + and derive FQDN from /etc/hosts. (Closes: #893394). + * testsuite/hostname: Test that /etc/hostname on installation profile + Main-Server is set correctly + * cf3/cf.cfengine3: Stop cfengine3 service on all Debian Edu machines. + Esp. cf-execd (calling cf-agent command) clobbers the log on all Debian + Edu clients (Debian Edu 12 and onwards) and thus on syslog.intern (aka + tjener). + In Debian Edu, we use cfengine3 for managing configuration adjustments + via manual invocation of the cf-agent command, but we don't support + (yet?) to use cfengine3 for constant system management. + Partially addresses #1051834. + * sbin/debian-edu-ltsp-install: Use KERNEL_PARAMETERS variable, if we + define it + * sbin/debian-edu-ltsp-install: Fix variable interpretation in sed commands + ... by using double quotes, not single quotes. + * sbin/update-hostname-from-ip: white-space cleanup + * sbin/update-hostname-from-ip: Stop using net-tools, use ip command from + iproute2 instead + * share/debian-edu-config/d-i/pre-pkgsel: Support hostname override via + /proc/cmdline. (Closes: #1008597). + + [ Wolfgang Schweer ] + * share/debian-edu-config/d-i/pre-pkgsel: Cleanup pre-pkgsel from cruft. + (Closes: #1055648). + + [ Serhii Horichenko ] + * ltsp: Add 'quiet splash' to hide boot details on clients. + (Closes: #1065564). + * etc/nagios3/debian-edu/commands.cfg: Add key -l for check_apt to list + packages available for upgrade. + + -- Mike Gabriel Tue, 25 Aug 2026 21:18:07 +0200 + +debian-edu-config (2.13.0) unstable; urgency=medium + + [ Mike Gabriel ] + * sbin/debian-edu-fsautoresize: + - Avoid division by zero error on unused mountpoints. + * sbin/debian-edu-pxeinstall: + - Support overriding tasksel/desktop selection via mydesktop parameter in + /etc/debian-edu/pxeinstall.conf. + - Fix comment about mapping debconf template keywords to kernel cmdline + keywords and drop unused variable assignment. + - sbin/debian-edu-pxeinstall: Regression fix, only adjust desktop to + mydesktop from pxeinstall.conf if we are processing the tasksel/desktop + setting. + * share/debian-edu-config/tools/copy-host-keytab: + - Support SSH publickey login to tjener, if this is possible (e.g. if admin + is using SSH agent forwarding). + + [ Daniel Teichmann ] + * Add new file 'debian-edu-router.ldif'. Empty proxy groups should be + installed on all new Tjeners. + * ldap-bootstrap/debian-edu-router.ldif: Add 'server-hosts' nisNetgroup + to 'proxy-trusted' nisNetgroup, via 'memberNisNetgroup' attribute. + * share/debian-edu-config/gosa.conf.template: Activate nisNetgroup tab + for user accounts. + * apache2 debian-edu-default.conf: Do not force HTTPS on *.crt (including + Debian-Edu_rootCA.crt). + (Closes: #1068388) + * etc/dovecot/local.conf: Fix passdb block syntax for Dovecot 2.4.x + compatibility. + * debian/control: Add 'Conflicts: firefox-esr-mobile-config'. + (Closes: #1126881) + * v3CA.cnf: Fix Root CA X.509v3 extensions for OpenSSL 3 compatibility. + * v3.cnf: Fix server cert X.509v3 extensions for OpenSSL 3 compatibility. + * tools/create-debian-edu-certs: Fix script to apply correct configurations. + * tools/create-server-cert: Add OpenSSL 3 extensions and fix base config. + + -- Mike Gabriel Sat, 23 May 2026 00:45:16 +0200 + +debian-edu-config (2.12.904) unstable; urgency=medium + + * share/glib-2.0/schemas/32-debian-edu.arctica-greeter.gschema.override: + + Drop file. This setting is theme-specific and should be shipped in + debian-edu-artwork- if diverting from system defaults. + * cf3/: + + Support recognizing FAI based installations of Debian Edu systems (except + from main server). + + -- Mike Gabriel Mon, 15 Sep 2025 15:22:48 +0200 debian-edu-config (2.12.903) unstable; urgency=medium diff -Nru debian-edu-config-2.12.903~deb13u1/debian/control debian-edu-config-2.13.2~deb13u1/debian/control --- debian-edu-config-2.12.903~deb13u1/debian/control 2025-06-02 14:15:39.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/debian/control 2026-09-07 08:58:26.000000000 +0000 @@ -18,6 +18,7 @@ Package: debian-edu-config Architecture: all +Conflicts: firefox-esr-mobile-config, Depends: ${misc:Depends}, adduser, bind9-host, @@ -30,6 +31,7 @@ education-tasks, fping, gnutls-bin, + iproute2, iptables, isenkram-cli, ldap-utils, @@ -49,10 +51,10 @@ lockfile-progs, lsb-release, media-types, - net-tools, ng-utils, openssl, patch, + procps, python3, python3-notify2, ssl-cert, diff -Nru debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.cron.daily debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.cron.daily --- debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.cron.daily 2023-09-27 20:34:54.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.cron.daily 2026-09-07 08:58:26.000000000 +0000 @@ -9,3 +9,8 @@ if [ -x /usr/libexec/debian-edu-config/debian-edu-cups-queue-autoflush-for-netgroup-hosts ]; then exec /usr/libexec/debian-edu-config/debian-edu-cups-queue-autoflush-for-netgroup-hosts fi + +# regularly update Apache2 TJENER alias map if the script is present +if [ -x /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases ]; then + exec /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases +fi diff -Nru debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service --- debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service 1970-01-01 00:00:00.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.service 2026-09-07 08:58:26.000000000 +0000 @@ -0,0 +1,6 @@ +[Unit] +Description=Update Apache2 TJENER alias map at /usr/share/debian-edu-config/apache2_tjener-aliases.map + +[Service] +Type=oneshot +ExecStart=/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases diff -Nru debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer --- debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer 1970-01-01 00:00:00.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.debian-edu-apache2-update-tjener-aliases.timer 2026-09-07 08:58:26.000000000 +0000 @@ -0,0 +1,9 @@ +[Unit] +Description=Run debian-edu-apache2-update-tjener-aliases.service 15 minutes after boot and then once a day. + +[Timer] +OnBootSec=15min +OnUnitActiveSec=1d + +[Install] +WantedBy=timers.target diff -Nru debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.lintian-overrides debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.lintian-overrides --- debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.lintian-overrides 2023-09-27 20:34:54.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.lintian-overrides 2026-09-07 08:58:26.000000000 +0000 @@ -1,5 +1,5 @@ debian-edu-config: non-standard-apache2-configuration-name debian-edu-config-doc.conf != debian-edu-config.conf [etc/apache2/conf-available/debian-edu-config-doc.conf] -debian-edu-config: debconf-is-not-a-registry [usr/bin/ldap-debian-edu-install:12] +debian-edu-config: debconf-is-not-a-registry [usr/bin/ldap-debian-edu-install:15] debian-edu-config: debconf-is-not-a-registry [usr/share/debian-edu-config/d-i/finish-install:10] debian-edu-config: debconf-is-not-a-registry [usr/share/debian-edu-config/d-i/pre-pkgsel:9] debian-edu-config: debconf-is-not-a-registry [usr/share/debian-edu-config/tools/edu-icinga-setup:24] diff -Nru debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.maintscript debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.maintscript --- debian-edu-config-2.12.903~deb13u1/debian/debian-edu-config.maintscript 2024-02-01 09:51:20.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/debian/debian-edu-config.maintscript 2026-09-07 08:58:26.000000000 +0000 @@ -4,3 +4,4 @@ dir_to_symlink /etc/debian-edu/host-keytabs /var/lib/debian-edu/host-keytabs 2.12.18~ rm_conffile /etc/init.d/fetch-ldap-cert 2.12.34~ rm_conffile /etc/dhcp/dhclient-exit-hooks.d/fetch-ldap-cert 2.12.44~ +rm_conffile /etc/wicd/scripts/preconnect/set_wireless_mac_from_eth0 2.13.1~ diff -Nru debian-edu-config-2.12.903~deb13u1/debian/rules debian-edu-config-2.13.2~deb13u1/debian/rules --- debian-edu-config-2.12.903~deb13u1/debian/rules 2023-09-27 20:34:54.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/debian/rules 2026-09-07 08:58:26.000000000 +0000 @@ -23,6 +23,7 @@ dh_installsystemd --no-start --name firefox-ldapconf dh_installsystemd --no-start --name debian-edu-fsautoresize dh_installsystemd --no-start --name debian-edu-update-netblock + dh_installsystemd --no-start --name debian-edu-apache2-update-tjener-aliases dh_installsystemd --no-start --name debian-edu-cups-queue-autoflush dh_installsystemd --no-start --name debian-edu-cups-queue-autoreenable diff -Nru debian-edu-config-2.12.903~deb13u1/etc/apache2/sites-available/debian-edu-default.conf debian-edu-config-2.13.2~deb13u1/etc/apache2/sites-available/debian-edu-default.conf --- debian-edu-config-2.12.903~deb13u1/etc/apache2/sites-available/debian-edu-default.conf 2025-09-04 11:14:42.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/etc/apache2/sites-available/debian-edu-default.conf 2026-09-07 08:58:26.000000000 +0000 @@ -1,14 +1,37 @@ - ServerName www.intern + ServerName www.intern ServerAdmin webmaster@postoffice.intern DocumentRoot /etc/debian-edu/www/ +# ---- ---- + UseCanonicalName On + + RewriteEngine On + RewriteMap tjeneralias "txt:/usr/share/debian-edu-config/apache2_tjener-aliases.map" + + # 1. Exclusions: Skip the redirect rules entirely for wpad.dat and Debian-Edu_rootCA.crt + RewriteCond %{REQUEST_URI} \.(?:dat|crt)$ [NC] + RewriteRule ^ - [L] + + # 2. Check if the requested HTTP Host matches Edu IP subnet e.g. 10.x.x.x/8 subnet.. + # NOTE: Single IPs should be part of the TJENER alias map. + # NOTE: .999.999 is technically possible, but harmless. + RewriteCond %1 ^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$ [OR] + + # 3. Path A (The Happy Path): HTTP Host is a known TJENER alias + # We strip the port, check the map. If it matches, redirect preserving the requested name. + RewriteCond %{HTTP_HOST} ^([^:]+) + RewriteCond ${tjeneralias:%1|DENY} ^ALLOW$ [NC] + RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L] + + # 4. Path B (The Fallback): HTTP Host is not a known TJENER alias + # If the request makes it past Rule 3 without triggering the [L] flag, + # it means the name was not in the map. We safely redirect to the static ServerName. + RewriteRule ^(.*)$ https://%{SERVER_NAME}/$1 [R=301,L] +# ---- ---- + - RewriteEngine On - RewriteCond %{SERVER_PORT} 80 - RewriteCond %{REQUEST_URI} !\.dat$ - RewriteRule ^(.*)$ https://%{SERVER_ADDRESS}/$1 [R=301,L] Options Indexes FollowSymLinks MultiViews AllowOverride None Require all granted @@ -30,20 +53,20 @@ CustomLog /var/log/apache2/access.log combined ServerSignature On - Alias /doc/ "/usr/share/doc/" - - Options Indexes MultiViews FollowSymLinks - AllowOverride None + Alias /doc/ "/usr/share/doc/" + + Options Indexes MultiViews FollowSymLinks + AllowOverride None Require all denied - Allow from 127.0.0.0/255.0.0.0 ::1/128 - + Allow from 127.0.0.0/255.0.0.0 ::1/128 + - # add alias for munin, though it should really be handled by munin itself, - # rather than assuming /var/www is the defaultroot.. - Alias /munin "/var/cache/munin/www/" - + # add alias for munin, though it should really be handled by munin itself, + # rather than assuming /var/www is the defaultroot.. + Alias /munin "/var/cache/munin/www/" + Options Indexes FollowSymLinks MultiViews AllowOverride None Require all granted - + diff -Nru debian-edu-config-2.12.903~deb13u1/etc/dovecot/local.conf debian-edu-config-2.13.2~deb13u1/etc/dovecot/local.conf --- debian-edu-config-2.12.903~deb13u1/etc/dovecot/local.conf 2025-06-13 07:58:17.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/etc/dovecot/local.conf 2026-09-07 08:58:26.000000000 +0000 @@ -7,8 +7,12 @@ mail_driver = maildir mail_path = ~/Maildir mail_inbox_path = /var/mail/%u -passdb { - args = uid=uid home=homeDirectory - driver = static + +passdb static { + fields { + uid = uid + home = homeDirectory + } } + protocols = "imap" diff -Nru debian-edu-config-2.12.903~deb13u1/etc/exim4/exim-ldap-client-v4.conf debian-edu-config-2.13.2~deb13u1/etc/exim4/exim-ldap-client-v4.conf --- debian-edu-config-2.12.903~deb13u1/etc/exim4/exim-ldap-client-v4.conf 2023-09-27 20:34:54.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/etc/exim4/exim-ldap-client-v4.conf 2026-09-07 08:58:26.000000000 +0000 @@ -17,6 +17,9 @@ # constant warning messages in the log file keep_environment = +# Send log messages to syslog +log_file_path = syslog + # These options specify the Access Control Lists (ACLs) that # are used for incoming SMTP messages - after the RCPT and DATA # commands, respectively. diff -Nru debian-edu-config-2.12.903~deb13u1/etc/exim4/exim-ldap-server-v4.conf debian-edu-config-2.13.2~deb13u1/etc/exim4/exim-ldap-server-v4.conf --- debian-edu-config-2.12.903~deb13u1/etc/exim4/exim-ldap-server-v4.conf 2025-06-02 08:30:33.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/etc/exim4/exim-ldap-server-v4.conf 2026-09-07 08:58:26.000000000 +0000 @@ -17,6 +17,9 @@ # from 'check_local_user' directive instead. # -- Wolfgang Schweer , 2020-06-27. +# Send log messages to syslog +log_file_path = syslog + ## keep_environment = KRB5_KTNAME : PWD : ^LDAP tls_advertise_hosts = * diff -Nru debian-edu-config-2.12.903~deb13u1/etc/nagios3/debian-edu/commands.cfg debian-edu-config-2.13.2~deb13u1/etc/nagios3/debian-edu/commands.cfg --- debian-edu-config-2.12.903~deb13u1/etc/nagios3/debian-edu/commands.cfg 2015-03-20 12:49:11.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/etc/nagios3/debian-edu/commands.cfg 2026-09-07 08:58:26.000000000 +0000 @@ -42,7 +42,7 @@ define command{ command_name check_apt -command_line /usr/lib/nagios/plugins/check_apt +command_line /usr/lib/nagios/plugins/check_apt -l } define command{ diff -Nru debian-edu-config-2.12.903~deb13u1/etc/wicd/scripts/preconnect/set_wireless_mac_from_eth0 debian-edu-config-2.13.2~deb13u1/etc/wicd/scripts/preconnect/set_wireless_mac_from_eth0 --- debian-edu-config-2.12.903~deb13u1/etc/wicd/scripts/preconnect/set_wireless_mac_from_eth0 2015-03-20 12:49:11.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/etc/wicd/scripts/preconnect/set_wireless_mac_from_eth0 1970-01-01 00:00:00.000000000 +0000 @@ -1,24 +0,0 @@ -#!/bin/sh -# -# Make sure wifi MAC is the same as wired MAC, to get DHCP to work with -# static assignment. - -set -e - -PATH=/sbin:$PATH -export PATH - -iface_mac() { - IF="$1" - LC_ALL=C ifconfig $IF | grep HWa | cut -c39-55 -} - -MAC1=$(iface_mac eth0) -MACW0=$(iface_mac wlan0) -if [ "$MACW0" ] ; then - logger -t wicd/set_wireless_mac_from_eth0 \ - "changing MAC address of wlan0 from $MACW0 to $MAC1" - ifconfig wlan0 down - ifconfig wlan0 hw ether $MAC1 - ifconfig wlan0 up -fi diff -Nru debian-edu-config-2.12.903~deb13u1/ldap-bootstrap/debian-edu-router.ldif debian-edu-config-2.13.2~deb13u1/ldap-bootstrap/debian-edu-router.ldif --- debian-edu-config-2.12.903~deb13u1/ldap-bootstrap/debian-edu-router.ldif 1970-01-01 00:00:00.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/ldap-bootstrap/debian-edu-router.ldif 2026-09-07 08:58:26.000000000 +0000 @@ -0,0 +1,37 @@ +dn: cn=proxy-trusted,ou=netgroup,dc=skole,dc=skolelinux,dc=no +objectClass: top +objectClass: nisNetgroup +cn: proxy-trusted +description: Completely unfiltered internet access (+ bypasses NAT/T-P-M) - ProxyTrusted{User,Client} - Debian Edu Router Plugin: Content filter +# This should enable direct unNAT'ted (bypasses transparent-proxy-mode) internet access to all internal servers in the Debian Edu network. +memberNisNetgroup: server-hosts + +dn: cn=proxy-allow,ou=netgroup,dc=skole,dc=skolelinux,dc=no +objectClass: top +objectClass: nisNetgroup +cn: proxy-allow +description: Generally unfiltered internet access - ProxyAllow{User,Client} - Debian Edu Router Plugin: Content filter + +dn: cn=proxy-deny,ou=netgroup,dc=skole,dc=skolelinux,dc=no +objectClass: top +objectClass: nisNetgroup +cn: proxy-deny +description: Disables internet access completely - ProxyDeny{User,Client} - Debian Edu Router Plugin: Content filter + +dn: cn=proxy-blacklist,ou=netgroup,dc=skole,dc=skolelinux,dc=no +objectClass: top +objectClass: nisNetgroup +cn: proxy-blacklist +description: Allows all but specific blacklisted websites - ProxyBlacklist{User,Client} - Debian Edu Router Plugin: Content filter + +dn: cn=proxy-whitelist,ou=netgroup,dc=skole,dc=skolelinux,dc=no +objectClass: top +objectClass: nisNetgroup +cn: proxy-whitelist +description: Allows nothing but specific whitelisted websites - ProxyWhitelist{User,Client} - Debian Edu Router Plugin: Content filter + +dn: cn=proxy-noauth-client,ou=netgroup,dc=skole,dc=skolelinux,dc=no +objectClass: top +objectClass: nisNetgroup +cn: proxy-noauth-client +description: Fully disable auth. for these clients (BYOD Clients) - ProxyNoauthClient - Debian Edu Router Plugin: Content filter diff -Nru debian-edu-config-2.12.903~deb13u1/ldap-tools/ldap-debian-edu-install debian-edu-config-2.13.2~deb13u1/ldap-tools/ldap-debian-edu-install --- debian-edu-config-2.12.903~deb13u1/ldap-tools/ldap-debian-edu-install 2023-09-27 20:34:54.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/ldap-tools/ldap-debian-edu-install 2026-09-07 08:58:26.000000000 +0000 @@ -1,6 +1,9 @@ #!/bin/bash set -e +# Assure that interactions with debconf database are UTF-8 interactions. +export LANG=C.UTF-8 + # This script is run during installation of the main server inside Debian Installer. # Don't ever use it manually! You will definitely ruin your main server! @@ -111,7 +114,7 @@ ################# password available now ################## lookup_mac_addrs() { - PATH=/sbin:$PATH LANG=C ifconfig 2>/dev/null | grep -i hwaddr | awk '{print $5}' | sort -u + LANG=C ip link | awk '/link\/ether/ { print $2 }' | sort -u } slapd_stop() { @@ -282,7 +285,8 @@ /etc/ldap/gosa-server.ldif \ /etc/ldap/ltsp.ldif \ /etc/ldap/firstuser.ldif \ - /etc/ldap/krb5.ldif + /etc/ldap/krb5.ldif \ + /etc/ldap/debian-edu-router.ldif do if cat $ldif | sed -e "s:\$ROOTPWDHASH:$ROOTPWDHASH:" \ -e "s/\$MAC/$MAC/" \ diff -Nru debian-edu-config-2.12.903~deb13u1/libexec/debian-edu-apache2-update-tjener-aliases debian-edu-config-2.13.2~deb13u1/libexec/debian-edu-apache2-update-tjener-aliases --- debian-edu-config-2.12.903~deb13u1/libexec/debian-edu-apache2-update-tjener-aliases 1970-01-01 00:00:00.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/libexec/debian-edu-apache2-update-tjener-aliases 2026-09-07 08:58:26.000000000 +0000 @@ -0,0 +1,219 @@ +#!/bin/bash +# +# Author: Daniel 'dzatoah' Teichmann +# Date: 2026-03-21 +# License: GNU General Public License v2 or later (GPL-2+) +# + +# ============================================================================= +# Queries LDAP for cNAMERecord entries under the Debian Edu DNS zone and +# smartly merges them into the Apache2 TJENER alias map file. +# +# Usage: /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases +# ============================================================================= + +set -euo pipefail + +# ----------------------------------------------------------------------------- +# Configuration +# ----------------------------------------------------------------------------- +SCRIPT_PATH="/usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases" +MAP_FILE="/usr/share/debian-edu-config/apache2_tjener-aliases.map" +BACKUP_DIR="/var/backups/apache2-tjener-aliases" +LDAP_BASE="relativeDomainName=tjener,zoneName=intern,cn=tjener,ou=servers,ou=systems,dc=skole,dc=skolelinux,dc=no" +LDAP_OPTS="-x" +LOG_TAG="update-apache2-tjener-aliases" + +# Debian Edu default hostnames (short + .intern variants) — always included +# in the auto-generated block regardless of LDAP output. +DEBIAN_EDU_DEFAULTS=( + "www" "www.intern" + "tjener" "tjener.intern" + "ldap" "ldap.intern" +) + +# ----------------------------------------------------------------------------- +# Helpers +# ----------------------------------------------------------------------------- +log() { logger -t "$LOG_TAG" "$*"; echo "[$(date '+%F %T')] $*"; } +die() { log "ERROR: $*"; exit 1; } + +# ----------------------------------------------------------------------------- +# Sanity checks +# ----------------------------------------------------------------------------- +command -v ldapsearch >/dev/null 2>&1 || die "ldapsearch not found. Install ldap-utils." +[[ -d "$(dirname "$MAP_FILE")" ]] || die "Target directory does not exist: $(dirname "$MAP_FILE")" + +# ----------------------------------------------------------------------------- +# Backup existing map file +# ----------------------------------------------------------------------------- +mkdir -p "$BACKUP_DIR" +if [[ -f "$MAP_FILE" ]]; then + BACKUP_FILE="$BACKUP_DIR/apache2_tjener-aliases.map.$(date '+%Y%m%d_%H%M%S')" + cp "$MAP_FILE" "$BACKUP_FILE" + log "Backed up existing map to: $BACKUP_FILE" + + # Prune backups older than 30 days + find "$BACKUP_DIR" -name "apache2_tjener-aliases.map.*" -mtime +30 -delete +fi + +# ----------------------------------------------------------------------------- +# Parse HAND-EDIT block from existing file (preserve user additions) +# ----------------------------------------------------------------------------- +HAND_EDIT_BLOCK="" +if [[ -f "$MAP_FILE" ]]; then + # Extract everything from the HAND-EDIT marker to end of file + HAND_EDIT_BLOCK=$(awk '/^# ----- IMPORTANT HAND-EDIT ADDITIONS -----/{found=1} found{print}' "$MAP_FILE") +fi + +# If there was no hand-edit block yet, use the default placeholder +if [[ -z "$HAND_EDIT_BLOCK" ]]; then + HAND_EDIT_BLOCK='# ----- IMPORTANT HAND-EDIT ADDITIONS ----- +# If a user browses to the raw IP and it is not here, it will trigger a 302 +# response to a pre-defined server name. +# Add any other IP addresses assigned to Tjeners interfaces: +# 192.168.0.1 ALLOW' +fi + +# ----------------------------------------------------------------------------- +# Query LDAP for cNAMERecord entries +# ----------------------------------------------------------------------------- +log "Querying LDAP for cNAMERecord entries..." +LDAP_OUTPUT=$(ldapsearch $LDAP_OPTS -b "$LDAP_BASE" 2>&1) \ + || die "ldapsearch failed: $LDAP_OUTPUT" + +# Parse relativeDomainName values that have a cNAMERecord attribute. +# Strategy: track the current relativeDomainName per stanza; only emit it +# if a cNAMERecord line is also present in the same stanza. +mapfile -t LDAP_CNAMES < <( + awk ' + /^$/ { if (has_cname && rdn != "" && rdn != "tjener") print rdn; rdn=""; has_cname=0; next } + /^relativeDomainName:/ { rdn=$2 } + /^cNAMERecord:/ { has_cname=1 } + END { if (has_cname && rdn != "" && rdn != "tjener") print rdn } + ' <<< "$LDAP_OUTPUT" | sort -u +) + +log "LDAP returned ${#LDAP_CNAMES[@]} cNAME entries: ${LDAP_CNAMES[*]:-}" + +# ----------------------------------------------------------------------------- +# Build the de-duplicated LDAP-only section +# (skip anything already in the Debian Edu defaults block) +# ----------------------------------------------------------------------------- + +# Build a lookup set of already-covered hostnames (short names only) +declare -A COVERED +for h in "${DEBIAN_EDU_DEFAULTS[@]}"; do + # Strip .intern suffix for comparison + short="${h%.intern}" + COVERED["$short"]=1 +done +# Also mark static entries +for h in localhost tjener; do COVERED["$h"]=1; done + +LDAP_EXTRA_LINES=() +for cname in "${LDAP_CNAMES[@]}"; do + if [[ -z "${COVERED[$cname]+_}" ]]; then + LDAP_EXTRA_LINES+=("$cname") + COVERED["$cname"]=1 + fi +done + +# ----------------------------------------------------------------------------- +# Format helper: pad hostname to column 20 then append ALLOW +# ----------------------------------------------------------------------------- +fmt_allow() { + printf "%-20s ALLOW\n" "$1" +} + +# ----------------------------------------------------------------------------- +# Assemble the new map file in a temp file, then atomically replace +# ----------------------------------------------------------------------------- +TMPFILE=$(mktemp "${MAP_FILE}.tmp.XXXXXX") +trap 'rm -f "$TMPFILE"' EXIT + +{ +# ── Static header ───────────────────────────────────────────────────────────── +cat <
ALLOW +# +# IMPORTANT: This file will be changed daily by a script using cron/systemd. +# It contains allowed HTTP Host: header values (TJENER aliases +# and IPs), not client machines. +# The script tries to smartly merge existing hand-made entries, +# but you should execute the script manually once to make sure your +# changes are sticking: +# $ ${SCRIPT_PATH} + +# Local loopback devices +$(fmt_allow localhost) +$(fmt_allow "::1") +$(fmt_allow "127.0.0.1") +HEADER + +# ── Auto-generated Debian Edu defaults ──────────────────────────────────────── +cat <<'AUTOGEN_HEADER' + +# --------------------------- +# | Debian Edu defaults | +# --------------------------- +AUTOGEN_HEADER + +echo "# NOTE: 10.x.x.x/8 network is allowed anyway, so next line is redundand." +fmt_allow "10.0.2.2" +fmt_allow "www" +fmt_allow "www.intern" +fmt_allow "tjener" +fmt_allow "tjener.intern" +fmt_allow "ldap" +fmt_allow "ldap.intern" +echo "# ---------------------------" + +# ── LDAP-discovered cNAMEs (not already in defaults) ────────────────────────── +if [[ ${#LDAP_EXTRA_LINES[@]} -gt 0 ]]; then + echo "" + echo "" + echo "# ---------------------------" + echo "# | LDAP-discovered CNAMEs |" + echo "# | (auto-updated daily) |" + echo "# ---------------------------" + echo "# Last updated: $(date '+%Y-%m-%d %H:%M:%S')" + for h in "${LDAP_EXTRA_LINES[@]}"; do + fmt_allow "$h" + # Also emit the .intern variant if not already covered + intern_variant="${h}.intern" + if [[ -z "${COVERED[$intern_variant]+_}" ]]; then + fmt_allow "$intern_variant" + COVERED["$intern_variant"]=1 + fi + done + echo "# ---------------------------" +fi + +# ── Preserved hand-edit block ───────────────────────────────────────────────── +echo "" +echo "" +echo "$HAND_EDIT_BLOCK" + +} > "$TMPFILE" + +# Validate the temp file is non-empty before replacing +[[ -s "$TMPFILE" ]] || die "Generated file is empty — aborting." + +# Atomic replace +mv "$TMPFILE" "$MAP_FILE" +chmod 644 "$MAP_FILE" +log "Successfully updated: $MAP_FILE" + +# ----------------------------------------------------------------------------- +# Reload Apache2 if running (graceful — no dropped connections) +# ----------------------------------------------------------------------------- +if systemctl is-active --quiet apache2; then + log "Reloading Apache2..." + systemctl reload apache2 \ + && log "Apache2 reloaded successfully." \ + || log "WARNING: Apache2 reload failed. Check 'systemctl status apache2'." +else + log "Apache2 is not running — skipping reload." +fi diff -Nru debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-fsautoresize debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-fsautoresize --- debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-fsautoresize 2015-10-16 12:57:58.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-fsautoresize 2026-08-19 20:24:04.000000000 +0000 @@ -226,7 +226,7 @@ $size = $volsizeblocks/2; } - my $fracavail = 100 * $avail / $size; + my $fracavail = 100 * $avail / ( $size + 1 ); print STDERR " A: $size $used $avail ($fracavail%)\n" if $opts{v}; my %minfo = ( diff -Nru debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-ltsp-install debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-ltsp-install --- debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-ltsp-install 2023-09-27 20:34:54.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-ltsp-install 2026-09-07 08:58:26.000000000 +0000 @@ -262,6 +262,7 @@ POST_INIT_PRINTER="cp /etc/ltsp/p910d.conf /etc/default/p910d" HOSTS_1="10.0.2.2 tjener.intern tjener" HOSTS_2="$ETH1_IP $HOSTNAME" +KERNEL_PARAMETERS="quiet splash" EOF fi @@ -606,11 +607,15 @@ rm -f /etc/resolv.conf echo "nameserver $dns_server" > /etc/resolv.conf echo "search intern" >> /etc/resolv.conf + # Temporary workaround needed to turn DLW images into machines of profile type 'Workstation' + sed -i /etc/debian-edu/config -e "s/^PROFILE=.*/PROFILE=\"Workstation\"/g" # Create SqashFS image. ltsp image /,,/boot,subdir=boot,,/usr,subdir=usr,,/var,subdir=var # Revert resolver workaround from above. rm -f /etc/resolv.conf ln -s /run/resolvconf/resolv.conf /etc/resolv.conf + # Revert temporary change to PROFILE in /etc/debian-edu/config + sed -i /etc/debian-edu/config -e "s/^PROFILE=.*/PROFILE=\"${PROFILE}\"/g" # next modification avoids ltsp command error if lot of images are available. ALL_IMAGES=1 ltsp kernel ltsp initrd @@ -674,7 +679,7 @@ chroot /srv/ltsp/dlw apt-get install -y -qq apt-utils ltsp # Turn system into a Debian Edu workstation. - chroot /srv/ltsp/dlw sh -c "DESKTOP=$desktop /sbin/debian-edu-bless" + chroot /srv/ltsp/dlw sh -c "PROFILE=Workstation DESKTOP=$desktop /sbin/debian-edu-bless" mkdir -p /srv/ltsp/dlw/skole chmod 755 /srv/ltsp/dlw/skole rm -f /srv/ltsp/dlw/etc/resolv.conf @@ -788,4 +793,6 @@ fi # Make sure /srv/tftp/ltsp/ltsp.ipxe is Debian Edu specific. -sed -i 's#ltsp/ltsp.img#ltsp/${img}/ltsp.img#' /srv/tftp/ltsp/ltsp.ipxe +sed -i "s#ltsp/ltsp.img#ltsp/${img}/ltsp.img#" /srv/tftp/ltsp/ltsp.ipxe +# Add "quiet" and "splash" parameters to hide kernel logs on a boot screen. +sed -i "s/set cmdline ${cmdline_method} ${cmdline_ltsp} ${cmdline_client}$/set cmdline ${cmdline_method} ${cmdline_ltsp} ${cmdline_client} ${KERNEL_PARAMETERS}/" /srv/tftp/ltsp/ltsp.ipxe diff -Nru debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-ltsp-ipxe debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-ltsp-ipxe --- debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-ltsp-ipxe 2022-02-11 15:47:45.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-ltsp-ipxe 2026-09-07 08:58:26.000000000 +0000 @@ -20,5 +20,7 @@ # Make sure /srv/tftp/ltsp/ltsp.ipxe is Debian Edu specific. sed -i 's#ltsp/ltsp.img#ltsp/${img}/ltsp.img#' /srv/tftp/ltsp/ltsp.ipxe +# Add "quiet" and "splash" parameters to hide kernel logs on a boot screen. +sed -i 's/set cmdline ${cmdline_method} ${cmdline_ltsp} ${cmdline_client}$/set cmdline ${cmdline_method} ${cmdline_ltsp} ${cmdline_client} quiet splash/' /srv/tftp/ltsp/ltsp.ipxe echo "" echo "/srv/tftp/ltsp/ltsp.ipxe has been modified." diff -Nru debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-pxeinstall debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-pxeinstall --- debian-edu-config-2.12.903~deb13u1/sbin/debian-edu-pxeinstall 2025-06-02 08:30:33.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/sbin/debian-edu-pxeinstall 2026-09-07 08:58:26.000000000 +0000 @@ -57,11 +57,13 @@ dist=$(lsb_release -sc) fi +default_mydesktop="xfce" + [ "$archs" ] || archs="amd64 i386" [ "$mirrorurl" ] || mirrorurl=http://deb.debian.org/debian [ "$hostname" ] || hostname=pxeinstall [ "$domain" ] || domain=intern -[ "$mydesktop" ] || mydesktop=xfce +[ "$mydesktop" ] || mydesktop="${default_mydesktop}" [ "$graphicdi" ] || graphicdi=false [ "$dailydi" ] || dailydi=false [ "$theme" ] || theme="$(ls -L /etc/alternatives/desktop-theme/plymouth 2>/dev/null | grep script | cut -d'.' -f 1)" @@ -86,21 +88,22 @@ # debian-edu-install, copying the files a bit earlier. installconfig="" for template in debian-installer/locale \ - keyboard-configuration/xkb-keymap \ - tasksel/desktop; do + keyboard-configuration/xkb-keymap \ + tasksel/desktop; do value="$(debconf-get-selections --installer | grep $template | awk '{print $4}')" if [ -z "$value" ] ; then # If there is no value in the installer debconf database, set the default one. # Useful if modular main server installation has been used (no desktop). - value="$mydesktop" + value="${default_mydesktop}" fi - # Using desktop= as kernel argument work, while tasksel/desktop= - # do not. No idea why, but lets use the one that work. - if [ "tasksel/desktop" = $template ] ; then template=desktop ; desktop=$value; fi + if [ "tasksel/desktop" = $template ] && [ "${mydesktop}" != "${default_mydesktop}" ]; then + # Let setting from /etc/debian-edu/pxeinstall.conf override tasksel/desktop. + value="${mydesktop}" + fi - # Map the long name to the short alias, to keep the argument list - # shorter. + # Map the long debconf names to the keywords supported in the kernel cmdline. + if [ "tasksel/desktop" = $template ] ; then template=desktop; fi if [ "debian-installer/locale" = $template ] ; then template=locale; fi if [ "keyboard-configuration/xkb-keymap" = $template ] ; then template=keymap; fi diff -Nru debian-edu-config-2.12.903~deb13u1/sbin/update-hostname-from-ip debian-edu-config-2.13.2~deb13u1/sbin/update-hostname-from-ip --- debian-edu-config-2.12.903~deb13u1/sbin/update-hostname-from-ip 2023-09-27 20:34:54.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/sbin/update-hostname-from-ip 2026-09-07 08:58:26.000000000 +0000 @@ -26,9 +26,9 @@ # Generate FQDN based on hardware MAC address ether2hostname() { if [ "$1" ] ; then - mac="$1" + mac="$1" else - mac=$(ifconfig $INTERFACE | awk '/ether/ { print $2; exit}') + mac=$(ip addr show ${INTERFACE} | grep 'link/ether ' | awk '{print $2; exit}') fi # Generate NetBIOS compliant hostname. mac=$(echo $mac | sed 's/[^0-9a-f-]//gi') @@ -42,12 +42,12 @@ ip2hostname() { ip=$1 host $ip | grep 'domain name pointer' | cut -d ' ' -f 5 | \ - rev |cut -d '.' -f 2-|rev + rev | cut -d '.' -f 2- | rev } PATH="/sbin:$PATH" -INTERFACE="$(/sbin/route -n | awk '/^0\.0\.0\.0 / { print $8; exit }')" +INTERFACE="$(ip -4 route | awk '/^default via / { print $5; exit }')" if [ -z "$INTERFACE" ] ; then INTERFACE=eth0 @@ -57,11 +57,11 @@ hostname="$1" namesource="$2" if hostname $hostname ; then - echo $hostname > /etc/hostname - log "info: changing hostname to $hostname based on $namesource" + echo $hostname > /etc/hostname + log "info: changing hostname to $hostname based on $namesource" else - log "warning: unable to set hostname to $hostname." - return -1 + log "warning: unable to set hostname to $hostname." + return -1 fi } @@ -69,15 +69,15 @@ TEMP=$(getopt -n update-hostname-from-ip -o dmM:nI:q -- "$@") # Abort when there was a bug -[ $? = 0 ] || die "error parsing arguments. Try $0 --help" +[ $? = 0 ] || die "error parsing arguments. Try $0 --help" eval set -- "$TEMP" -while true; do - case $1 in +while true; do + case $1 in -m) USEMAC=true; shift; continue - ;; - -M) + ;; + -M) MAC="$2"; shift; shift; continue ;; -I) @@ -102,7 +102,7 @@ # Extract current IP if non was provided on the command line if [ -z "$IP" ] ; then - IP=`ifconfig $INTERFACE 2>&1 |grep 'inet '|tr a-zA-Z: " "|awk '{print $1; exit}'` + IP=$(ip addr show ${INTERFACE} | grep 'inet ' | awk '{print $2; exit}' | cut -d "/" -f1) fi if [ "127.0.0.1" = "$IP" ] ; then @@ -121,7 +121,7 @@ if [ "$MY_HOSTNAME" ]; then if $onlyprint ; then - echo $MY_HOSTNAME + echo $MY_HOSTNAME else # Already got the correct host name? if [ "$MY_HOSTNAME" != "$(uname -n)" ] ; then diff -Nru debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map --- debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map 1970-01-01 00:00:00.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/apache2_tjener-aliases.map 2026-09-07 08:58:26.000000000 +0000 @@ -0,0 +1,44 @@ +# /usr/share/debian-edu-config/apache2_tjener-aliases.map +# Format: ALLOW +# +# IMPORTANT: This file will be changed daily by a script using cron/systemd. +# It contains allowed HTTP Host: header values (TJENER aliases +# and IPs), not client machines. +# The script tries to smartly merge existing hand-made entries, +# but you should execute the script manually once to make sure your +# changes are sticking: +# $ /usr/libexec/debian-edu-config/debian-edu-apache2-update-tjener-aliases +# +# WARNING: If you can read this and the file modification date is more than 24h +# in the past, then there is an issue with the automatic updating +# script managed by either cron or systemd. This file only contains +# the most basic configuration settings for Debian Edu and needs to be +# updated. +# +# DEV NOTE: If you're are updating this file in the debian-edu-config package +# please be aware that you'll have to adapt the update script too. + +# Local loopback devices +localhost ALLOW +::1 ALLOW +127.0.0.1 ALLOW + +# --------------------------- +# | Debian Edu defaults | +# --------------------------- +# NOTE: 10.x.x.x/8 network is allowed, so next line is redundand. +10.0.2.2 ALLOW +www ALLOW +www.intern ALLOW +tjener ALLOW +tjener.intern ALLOW +ldap ALLOW +ldap.intern ALLOW +# --------------------------- + + +# ----- IMPORTANT HAND-EDIT ADDITIONS ----- +# If a user browses to the raw IP and it is not here, it will trigger a 302 +# response to a pre-defined server name. +# Add any other IP addresses assigned to Tjeners interfaces: +# 172.16.0.51 ALLOW diff -Nru debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/d-i/pre-pkgsel debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/d-i/pre-pkgsel --- debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/d-i/pre-pkgsel 2023-11-30 07:36:09.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/d-i/pre-pkgsel 2026-09-07 08:58:26.000000000 +0000 @@ -21,7 +21,7 @@ configure_network() { # Write a functional /target/etc/network/interfaces if [ -z "$PROFILE" ]; then - PROFILE=Workstation + PROFILE=Workstation fi # Default hostname is 'localhost' @@ -44,21 +44,21 @@ # Hm, what if both server and workstation is choosen? Choose the # server config for eth0. for value in `echo $PROFILE |sed 's/ /-/g' | sed 's/,-/ /g'`; do - case $value in - Roaming-Workstation) - # Configure network-manager to connect to eth0 by - # default, to be able to look up user information in - # LDAP. - eth0=none - autoeth0="" - eth1=none - autoeth1="" - DNSDOMAIN= - MAILNAME= - MY_HOSTNAME= - eth0uuid=$(chroot /target uuid) - mkdir -p /target/etc/NetworkManager/system-connections - cat > /target/etc/NetworkManager/system-connections/eth0 < /target/etc/NetworkManager/system-connections/eth0 < $interfaces <> $interfaces <> $interfaces <> $interfaces <> $interfaces <> $interfaces <> $interfaces <> $interfaces <> $interfaces <> $interfaces <> $interfaces < /target/etc/hosts + # Check whether hostname= was given on boot's /proc/cmdline prompt + # and use that if not installing a Main-Server. + PROC_CMDLINE_HOSTNAME=$(cat /proc/cmdline | + sed -n -re "s/.*(^| )hostname=([^ ]+).*/\2/p" | + tr A-Z a-z | + tr -cd 'a-z0-9-' | + sed -e 's/^-+//' -e 's/-+$//') + if echo $PROFILE | grep -q Main-Server ; then + : + elif [ -n "${PROC_CMDLINE_HOSTNAME}" ]; then + MY_HOSTNAME="${PROC_CMDLINE_HOSTNAME}" + fi + if [ ! -z "$MY_HOSTNAME" ] ; then echo "$MY_HOSTNAME" > /target/etc/hostname in-target /bin/hostname "$MY_HOSTNAME" @@ -187,37 +200,37 @@ # Update hostname based on reverse DNS entry of current IP or # generate from MAC address, unless installing main-server. if echo $PROFILE | grep -q Main-Server ; then - : - elif [ -x /target/usr/sbin/update-hostname-from-ip ] ; then - in-target /usr/sbin/update-hostname-from-ip -m || true + : + elif [ -x /target/usr/sbin/update-hostname-from-ip ] && [ -z "${PROC_CMDLINE_HOSTNAME}" ]; then + in-target /usr/sbin/update-hostname-from-ip -m || true fi # Avoid hardcoding entries on the clients, to make sure IP address # range can be changed on the clients by changing DHCP # configuration on the server. - if [ "tjener.intern" = "$MY_HOSTNAME" ] ; then - ( - echo - echo "10.0.2.2 tjener.intern tjener" - ) >> /target/etc/hosts + if [ "tjener" = "$MY_HOSTNAME" ] ; then + ( + echo + echo "10.0.2.2 ${MY_HOSTNAME}.${DNSDOMAIN} ${MY_HOSTNAME}" + ) >> /target/etc/hosts fi # Set /etc/mailname if it is missing if [ "$MAILNAME" ] && [ ! -f /target/etc/mailname ] ; then - echo "$MAILNAME" > /target/etc/mailname + echo "$MAILNAME" > /target/etc/mailname fi # Make sure that the interfaces are there for the cfengine run if # network isn't already configured if route | grep -q default ; then - log "Not restarting network, as it seem to be up already." + log "Not restarting network, as it seem to be up already." else - log "Restarting network to prepare for cfengine run." - # Redirecting fd 3 as a workaround for skolelinux bug #1229. - # make sure the redirecting happen inside the chroot, as - # in-target need to talk to debconf. - in-target /bin/sh -c "/etc/init.d/networking start 3> /dev/null" || true - touch /tmp/debian-edu-nonetwork + log "Restarting network to prepare for cfengine run." + # Redirecting fd 3 as a workaround for skolelinux bug #1229. + # make sure the redirecting happen inside the chroot, as + # in-target need to talk to debconf. + in-target /bin/sh -c "/etc/init.d/networking start 3> /dev/null" || true + touch /tmp/debian-edu-nonetwork fi } @@ -225,32 +238,32 @@ # finish-install hook. set_kerberos_ldap_passwords() { if db_get passwd/root-password-crypted && [ "$RET" ] ; then - log "No clear text root password, unable to pass it on to Kerberos/LDAP." + log "No clear text root password, unable to pass it on to Kerberos/LDAP." else - log "Fetching password for Kerberos KDC and LDAP." 1>&2 - db_get passwd/root-password - ROOTPWD="$RET" - - log "Fetching info for first user." 1>&2 - - if db_get passwd/username && [ "$RET" ] ; then - FIRSTUSERNAME="$RET" - else - FIRSTUSERNAME="localadmin" - fi - if db_get passwd/user-fullname && [ "$RET" ] ; then - FIRSTUSERGECOS="$RET" - else - FIRSTUSERGECOS="LDAP initial admin user" - fi - if db_get passwd/user-password && [ "$RET" ] ; then - FIRSTUSERPWD="$RET" - else - FIRSTUSERPWD="$ROOTPWD" - fi + log "Fetching password for Kerberos KDC and LDAP." 1>&2 + db_get passwd/root-password + ROOTPWD="$RET" + + log "Fetching info for first user." 1>&2 + + if db_get passwd/username && [ "$RET" ] ; then + FIRSTUSERNAME="$RET" + else + FIRSTUSERNAME="localadmin" + fi + if db_get passwd/user-fullname && [ "$RET" ] ; then + FIRSTUSERGECOS="$RET" + else + FIRSTUSERGECOS="LDAP initial admin user" + fi + if db_get passwd/user-password && [ "$RET" ] ; then + FIRSTUSERPWD="$RET" + else + FIRSTUSERPWD="$ROOTPWD" + fi - file=/tmp/passwords-preseed - cat > $file < $file <&2 || true - in-target /usr/sbin/adduser --gid $LOCAL_USER_PRIMGIDNUMBER \ - --firstuid $LOCAL_USER_UIDNUMBER \ - --home /home/$LOCAL_USER_ID \ - --shell /bin/bash \ - --disabled-login \ - --gecos "$LOCAL_USER_GECOS" $LOCAL_USER_ID 1>&2 || true - # add initial local user to some standard system groups - for group in ${LOCAL_USER_INGROUPS}; do - in-target /usr/sbin/adduser $LOCAL_USER_ID $group 1>&2 || true - done - # set password (batch mode) - in-target /bin/sh -c "echo ${LOCAL_USER_ID}:${LOCAL_USER_PASSWD} | /usr/sbin/chpasswd" 1>&2 || true + # Pass user and password information into the target + cat $file | LANG=C chroot /target debconf-set-selections || \ + error "Failed to load preseed values from $file." + rm $file fi } @@ -311,15 +293,15 @@ # want. db_get grub-installer/choose_bootdev || true if [ "$RET" ] && [ "manual" != "$RET" ]; then - log "not overriding grub-installer/choose_bootdev to $grubdev, its value was '$RET'" - return + log "not overriding grub-installer/choose_bootdev to $grubdev, its value was '$RET'" + return fi case "$bootdev" in - /dev/sd*|/dev/vd*|/dev/hd*|/dev/xvd*) - log "overriding grub-installer/choose_bootdev, setting it to $grubdev" - db_set grub-installer/choose_bootdev "$grubdev" || true - ;; + /dev/sd*|/dev/vd*|/dev/hd*|/dev/xvd*) + log "overriding grub-installer/choose_bootdev, setting it to $grubdev" + db_set grub-installer/choose_bootdev "$grubdev" || true + ;; esac } @@ -341,20 +323,19 @@ edu-etcvcs commit if echo "$PROFILE" | grep -q Main-Server ; then - set_kerberos_ldap_passwords + set_kerberos_ldap_passwords fi for p in $(echo $PROFILE | tr , " ") ; do case $p in - # Only do this for the networked tasks, not for standalone - Main-Server|Workstation|Roaming-Workstation|LTSP-Server|Minimal) - #create_initial_localadmin_user - in-target /usr/share/debian-edu-config/tools/preseed-ldap-kerberos - in-target /usr/share/debian-edu-config/tools/preseed-sitesummary - - # Tell user-setup to not create a user, needed on - # Main-Server to be able to create the user in LDAP. - db_set passwd/make-user boolean false - ;; + # Only do this for the networked tasks, not for standalone + Main-Server|Workstation|Roaming-Workstation|LTSP-Server|Minimal) + in-target /usr/share/debian-edu-config/tools/preseed-ldap-kerberos + in-target /usr/share/debian-edu-config/tools/preseed-sitesummary + + # Tell user-setup to not create a user, needed on + # Main-Server to be able to create the user in LDAP. + db_set passwd/make-user boolean false + ;; esac done diff -Nru debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/gosa.conf.template debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/gosa.conf.template --- debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/gosa.conf.template 2025-06-02 08:30:33.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/gosa.conf.template 2026-09-07 08:58:26.000000000 +0000 @@ -117,6 +117,7 @@ + diff -Nru debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/killer.cron debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/killer.cron --- debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/killer.cron 2022-02-11 15:47:45.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/killer.cron 1970-01-01 00:00:00.000000000 +0000 @@ -1,3 +0,0 @@ -#!/bin/sh - -if [ "$(ps aux | grep sshd: | grep @notty)" = "" ] && [ -x /usr/sbin/killer ] ; then /usr/sbin/killer; fi diff -Nru debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/testsuite-lib.sh debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/testsuite-lib.sh --- debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/testsuite-lib.sh 2022-10-24 20:07:40.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/testsuite-lib.sh 2026-09-07 08:58:26.000000000 +0000 @@ -19,7 +19,8 @@ proto=$2 service="$3" - if netstat -a --numeric-hosts 2>&1 | grep ":$port " | grep -q "^$proto" ; then + if ss -H -t -u -a 2>&1 | grep ":$port " | grep -q "^$proto" || \ + ss -H -n -t -u -a 2>&1 | grep ":$port " | grep -q "^$proto" ; then echo "success: $0: $service service is listening on $port/$proto." true else diff -Nru debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/copy-host-keytab debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/copy-host-keytab --- debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/copy-host-keytab 2022-10-24 20:07:40.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/copy-host-keytab 2026-09-07 08:58:26.000000000 +0000 @@ -1,6 +1,21 @@ #!/bin/sh set -e -kinit + +if [ $(id -u) -gt 0 ]; then + echo "ERROR: This script has to run as super-user root." + exit 1 +fi + +# Attempt passwordless SSH login root@tjener (could be publickey, gssapi-keyex, or gssapi-with-mic) +set +e +ssh -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no tjener "echo -n" 2>/dev/null +ret=$? +set -e +if [ "${ret}" != "0" ]; then + # Try to get a Kerberos ticket for root instead to use GSSAPI login. + kinit root +fi + scp tjener:/var/lib/debian-edu/host-keytabs/$(hostname -s).intern.keytab /etc/krb5.keytab # Special case separate LTSP server. diff -Nru debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/create-debian-edu-certs debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/create-debian-edu-certs --- debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/create-debian-edu-certs 2023-02-06 20:17:21.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/create-debian-edu-certs 2026-09-07 08:58:26.000000000 +0000 @@ -32,11 +32,12 @@ generate() { # Generate Debian Edu root CA private key. - openssl genrsa -out $CA_KEY 2048 - # Request rootCA certificate. - openssl req -x509 -new -nodes -key $CA_KEY -days 3650 -out $CA_CERT -config $SSL_CA_CONF + openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:prime256v1 -out $CA_KEY + # Request rootCA CSR and self-sign it to apply v3 extensions. + openssl req -new -nodes -key $CA_KEY -out $TMP/ca.csr -config $SSL_CA_CONF + openssl x509 -req -in $TMP/ca.csr -signkey $CA_KEY -days 3650 -out $CA_CERT -extfile $V3_CA_CONF # Request web server key. - openssl req -new -nodes -out $TMP/server.csr -newkey rsa:2048 -keyout $SERVER_KEY -config $SSL_CA_CONF + openssl req -new -nodes -out $TMP/server.csr -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -keyout $SERVER_KEY -config $SSL_CONF # Request web server certificate. openssl x509 -req -in $TMP/server.csr -CA $CA_CERT -CAkey $CA_KEY -CAcreateserial -out $SERVER_CERT -days 3650 -extfile $V3_CONF # Adjust owner and rights. diff -Nru debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/create-server-cert debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/create-server-cert --- debian-edu-config-2.12.903~deb13u1/share/debian-edu-config/tools/create-server-cert 2022-02-11 15:47:45.000000000 +0000 +++ debian-edu-config-2.13.2~deb13u1/share/debian-edu-config/tools/create-server-cert 2026-09-07 08:58:26.000000000 +0000 @@ -135,20 +135,23 @@ tempdir=$(mktemp -d) +# Same as in /usr/share/debian-edu-config/tools/create-debian-edu-certs cat > "${tempdir}/v3.conf" </dev/null ; then + ip addr | sed "s%^%info: $0: ip addr: %" || true + ip route | sed "s%^%info: $0: ip route: %" || true else - error "Unable to find /sbin/ifconfig" -fi - -if [ -x /sbin/route ] ; then - /sbin/route -n | sed "s%^%info: $0: route: %" || true -else - error "Unable to find /sbin/route" + error "Unable to find ip (iproute2)" fi if [ -x /usr/bin/nmap ] ; then @@ -65,11 +60,7 @@ ###################################################################### have_interface() { - if /sbin/ifconfig "$1" > /dev/null 2>&1 ; then - true - else - false - fi + ip link show "$1" > /dev/null 2>&1 } for value in `echo $PROFILE |sed 's/ /-/g' | sed 's/,-/ /g'`; do