Has anyone gone completly linux

[kesomir]

• I had used both fstab nfs mounting and the autofs method.
  
• The home directory was mounted as well as a couple of other shares.
  
• Throughout my trialling I was using debian based distros for the majority (debian or ubuntu).
  
• A lot of problems with NFS were distro related (bugs in nautilus causing server to get swamped for example).
  
• Debian appeared to perform better than ubuntu as an in place swap nfs server.
  

 

I accept that the nfs implementation on these distros could have contributed to / been the cause of my problems, and while I did try a variety of clients (including fedora and suse), the server was always debian based (i had trouble connected ubuntu clients to a suse NFS server). I also did not try a non-linux *nix server such as bsd (or solaris) which may be better.

 

I should have said " In my opinion - NFS on the linux distros I tried is a dog"

 

I did a lot of tweaking in an attempt to eliminate the problems - specifically increasing the number of nfs deamons running on the server, switching the mount methods (static to autofs) and adjusting the mount options.

 

I also made a large number of posts across the ubuntu forums and subscribed to some of the mailing lists. - Some of the posts I read mentioned nfs being fine for small networks up to 10 clients - had a quick search and couldn't find them to reference though.

 

Additionally, I was using NFSv3 as I couldn't for the life of me get NFSv4 to work.

 

While I appreciate that NFS can be and is used in extremely large implementations, I stand by my view that using nfs (or anything else for that matter) to remote mount the home folder is not as good in theory as caching the data locally and sending it back and forth during sign on/off - less network traffic is a better thing.

 

I also maintain that trialling it in this way will teach you loads and that linux networking does have room for improvement - although perhaps more in the "work as an appliance" or "apt-get install the-network" sense.

[Geoff]

The problems you describe stem from the fact that you were using NFSv3.

[Whitestar]

AFAIK Karoshi was designed and built up by people like us (e.g not professional software developers) who've done a wonderful job that deserves lots of praise and they were in an enviroment (Direct IP to the internet - not tied to an RBOC dictated IP range) that worked for them.

 

 

 

You CAN change the ip addresses (check out my posts and Jo's replies on the Karoshi forum about 12-18mth ago) - but it takes a little bit more effort and all it needs is a pre-configuration tool to setup the IP ranges you need but since the developers don't need it - it was never written and tested (AFAIK - times might have changed since I last looked at it)

 

But its a very impressive piece of work IMO

 

 

regards

 

Simon

PS

 

Is the forum dead??? [EDIT] just checked out site - no forum! and a few other changes that now explains your post![/EDIT]

 

 

I agree that the developers of Karoshi have done an amazing job and that its a great piece of software that could make everyones life so much easier, but I still think its a bit odd that you can't use the IP ranges and hostname you want right from the work go.

Even if the developers can use their own ranges, most schools can't.

 

But, I decided to crack on with Karoshi. I set it up as a PDC and now get to my next problem. I can't log in to the Network Manager or Technician parts of the system.

I've tried using the username and password that I use to log onto the box itself, but I still can't get in.

 

Any ideas?

[ajtaylor]

The problems you describe stem from the fact that you were using NFSv3.

 

Really? How can you determine that?

 

I stand by my view that using nfs (or anything else for that matter) to remote mount the home folder is not as good in theory as caching the data locally and sending it back and forth during sign on/off - less network traffic is a better thing.

 

Unlike Windows, there really shouldn't be that much extra data flying back and forth with a Linux (gnome/kde or any other window manager) login. You'll have, not necessarily in this order:

- auth data (a few bytes)

- name service lookup for the automounter (a few bytes)

- mount (a few bytes)

- source .profile

- read gconf settings (assuming gnome)

- read Desktop

 

Shouldn't be a lot else...

 

Seriously, there's really no reason not to use NFS - it's a much lighter weight protocol than smb/CIFS, and the whole Linux desktop login is much much much lighter weight than Windows profiles.

 

You also have to remember that whereas Windows will copy the user's profile to the box, then work on it locally, the Linux/UNIX way is just to read/write it on the NFS share. It really doesn't care whether the user data is local or remote, it doesn't even know about it!

 

If you actually look at how it's implemented (I'm talking Solaris here, 'cos that's what I know, but I can't imagine Linux does it much differently), the desktop manager and login has no idea where the "profile" data is, all it has is a bunch of file descriptors that point to vnodes. It calls read() (or write) and then the OS works out what flavour of read op it needs - vnode maps to an inode or rnode, and the vnode contains a vnode_ops pointer to a struct which maps out what actual function to call for each op, e.g. read -> nfs_read. This is how the OS works out that a file in /dev can be rm'd from the f/s (unlink -> ufs_unlink or ext3_unlink), but when you open it it opens the actual device rather than the file.

[ajtaylor]

 

[*]Debian appeared to perform better than ubuntu as an in place swap nfs server.

 

Sorry, I know I'm being an argumentative pedant (I can't help it!), but what do you mean by swap nfs server? The way I read it is that you're using NFS to serve up swap space in someway, but I must be misunderstanding you!

[linuxgirlie]

I have replied to your PM. For security reasons the login for the web management is separate from the actual box.

 

If anyone else has any complaints about the system if you could email them to me I would be grateful and we will do our best to make the changes.

 

Most of what Simon said was correct, except that we don't have a direct connection, we have to have an IP range given to us via the county like most other schools, its just that we have a firewall, that uses NAT so that in the internal green and DMZ orange zones we can have whatever IPs we like. You can build a cheap firewall using IPcop and 3 network cards, which will do the same job for your own school.

 

Saying that we are looking into making the changes so that all the system can have its own IPs, the first step is that we are stream-lining the current IPs so that you can just edit a text file and it will just work. The second step, once we have LDAP fully tested is to allow for any IPs, the reason we were restricted before hand was for security and data reasons, so that the servers knew who to talk to etc, this would have been no problem if all schools use just 1 server, actually that would make our life easier, but because we need to be able to spread the load and the fact that Karoshi scales up to 8 servers we had to have a way of dealing with this.

 

One another note, Dover Grammar School for Boys have been running a nearly fully Linux system for 4 years. We have 12 servers, use both Sims and CMIS, and have 350 computers. Now Sims is used for finance only, so they have laptops running XP to do that. CMIS is web based, so for our admin staff we have 10 XP computers but all other staff can access it from any web browser inside and outside school. The 350 curriculum computers about 300 are Linux and 50 windows, but we are daily getting asked if 'said teacher' can have theirs 'upgraded' to the same as 'so and so' down the corridor.

 

You are quite welcome to visit....as well as anyone else interested.

 

Right, off to do some work now!!

 

Jo

[Whitestar]

I've replied to your PM.

 

I tried the UN and Pwd its asks for at the end of PDC setup and it worked this time. Dunno why, but there we go.

 

Just quickly.

How do you lock down your windows workstations. Is there something like group policy that you can apply?

 

Mark

[Geoff]

If your using a Linux PDC you will have to do things the NT4 way, so mandatory profiles.

[CyberNerd]

How do you lock down your windows workstations. Is there something like group policy that you can apply?

 

If you open up a group policy ADM file, you'll see that it refers to registry keys. These keys can be set in a login script, which can be defined in the samba configuration.

Alternatively you'd need to wait for Samba4

[linuxgirlie]

The username and password for the web management is different from the one on the box because of security reasons.

 

We lock down the clients with mandatory profiles, using kix. http://www.kixtart.org/

 

It takes the information of which group the user is in, and provides them with a specific type of lockdown, for example itadmins have administrator rights, yr2005 will be locked down but may have different icons to yr 2007. The lockdowns are mostly done by regedits, and group policies, that like stated above are dragged down by each user who logs in and are removed when they logout. All these can be deleted or added, in the groups 'kix file' which has a list of regedits etc in them.

 

Jo

 

ps. This also means we can use roaming profiles, but we don't recommend it.

Edited May 21, 2008 by linuxgirlie

[SimpleSi]

@Jo

 

If you have time, could you list the applications you use and what area they are used for? (if not obvious from the name )

 

regards

 

Simon

[linuxgirlie]

Ok, here is the list it should be all there but might not be 100% - the list is in a random come to mind order! Its also only correct for the 6.0 beta as the older versions didn't use ldap etc..:

 

• web management - written by us, from scratch to admin/manage day to day tasks and the functions of the rest of the software found below. Uses cgi and bash.
  
• Samba - Used for domain control and file access for windows and linux
  
• Cups - Printing for clients
  
• Apache - Web server - two versions running, one for ports 80/433 and another for ports 2001/3001
  
• mysql - for database based apps
  
• php - for php based apps
  
• Shorewall - firewall for each server
  
• Kixtart - Windows client drive mappings and permissions
  
• Pam_Mount - Linux client drive mappings
  
• ldap - user and group information for servers and linux clients( pre version 6 this was done via ypserv and ypbind), user and group info.
  
• Squid and Dansguardian - Proxy and Filtering system
  
• dnsmasq - internal dns server for the network
  
• dhcp - dhcp server
  
• various apps (moodle, website baker, egroupware, squirrelmail, joomla, phpnuke etc)
  
• postfix - mail transport agent
  
• imap
  
• clamav and spamassisin - for virus and spam scanning
  
• mailscanner - monitors/controls the mail stuff
  
• pop3
  
• ssh server - so all the other servers can be controled by the main one
  
• mon - network monitoring
  

 

and lastly over 1000 config files that we wrote to hold the thing together!

 

Thats it, should probably put this one in the karoshi documentation somewhere!

Edited May 21, 2008 by linuxgirlie

[kesomir]

Sorry, I know I'm being an argumentative pedant (I can't help it!), but what do you mean by swap nfs server? The way I read it is that you're using NFS to serve up swap space in someway, but I must be misunderstanding you!

 

"in place swap" NFS Server or in-situ swap, not "NFS swap" server.

 

ie the debian box switched for ubuntu gutsy box appeared to be more stable. I was using it to export home directories and a network share.

 

Not currently though as my fat-clients are running XP and my fileservers Win2003

[SimpleSi]

Sorry Jo

 

I meant Linux apps used by the pupils.

 

regards

 

Simon

[kesomir]

Since you're looking at primary schools:

 

Open Office

Firefox (with flash) -> This gives you 95% of resources used.

 

Tuxtype

Tuxmaths

Ktouch

Gcompris

[linuxgirlie]

oh....rofl

 

Here is the installed packages on the main computers. I am working my way though to create one that is just the packages we use, but this is what is installed, and most of the packages available though the menu are used. Blender at the moment is in favour with the year 7's they are making amazing movies with it.

 

 

 

 

Jo

installed-all.txt

[linuxgirlie]

ok here is the finished list.

 

In ICT they tend to use OpenOffice, Nvu, Blender, Firefox, Alice, Scratch. Music use Rosegarden, Hydrogen et al, Media Studies use Celtx, WinFF and a few others, history at the moment are using audacity to create revision podcasts. Most people just use Internet and Office.

 

We have all the plugins installed, Flash, Java, WinCodec, etc etc

 

Jo

installed-most-used.txt

Edited May 21, 2008 by linuxgirlie

[SimpleSi]

Ta

 

BTW - what do you use to drive IWBs?

 

regards

 

Simon

[linuxgirlie]

We use the SmartBoard software, you can download it from their website and it works native on Linux. We don't have any promeathens so I can't speak if they have equivalents or not. The software is identical to the windows one, including the notepad items etc, so far no staff have noticed the difference.

 

Jo

[Whitestar]

Jo,

 

Is it possible to add my own primary groups?

[linuxgirlie]

Not at the moment, but you are the second person to ask that in the last few days so we are looking into making that change. I can pm you a way of creating an extra primary group. What did you want the primary group for?

[Whitestar]

I wanted to create my student year groups and staff groups.

 

Do the primary groups control what access users get?

[linuxgirlie]

The primary groups for staff and students are created by default I think up to 2050. The students are place in groups via yearof entry, so yr2006(yr9), yr2007(yr8), yr2008(yr7) the staff are placed in either itadmin(administrator access on Windows/Linux), tech, staff, studentstaff. You also have exams and guests groups. All lockdowns are performed per user group.

 

When creating a user you will be asked what group you wish to place them into, this will then determine profile, etc and will also create them a login, email account, moodle account, and internet access.

 

Hope this helps.

 

Jo

[Whitestar]

Does Karoshi act as a DNS server?

[linuxgirlie]

Yes.