Andrea Veri: The GNOME Infrastructure is now powered by FreeIPA!
As preannounced here the GNOME Infrastructure switched to a new Account Management System which is reachable at https://account.gnome.org. All the details will follow.
Introduction
It s been a while since someone actually touched the underlaying authentication infrastructure that powers the GNOME machines. The very first setup was originally configured by Jonathan Blandford (jrb) who configured an OpenLDAP istance with several customized schemas. (pServer fields in the old CVS days, pubAuthorizedKeys and GNOME modules related fields in recent times)
While OpenLDAP-server was living on the GNOME machine called clipboard (aka ldap.gnome.org) the clients were configured to synchronize users, groups, passwords through the nslcd daemon. After several years Jeff Schroeder joined the Sysadmin Team and during one cold evening (date is Tue, February 1st 2011) spent some time configuring SSSD to replace the nslcd daemon which was missing one of the most important SSSD features: caching. What surely convinced Jeff to adopt SSSD (a very new but promising sofware at that time as the first release happened right before 2010 s Christmas) and as the commit log also states ( New sssd module for ldap information caching ) was SSSD s caching feature.
It was enough for a certain user to log in once and the /var/lib/sss/db directory was populated with its login information preventing the LDAP daemon in charge of picking up login details (from the LDAP server) to query the LDAP server itself every single time a request was made against it. This feature has definitely helped in many occasions especially when the LDAP server was down for a particular reason and sysadmins needed to access a specific machine or service: without SSSD this wasn t ever going to work and sysadmins were probably going to be locked out from the machines they were used to manage. (except if you still had /etc/passwd , /etc/group and /etc/shadow entries as fallback)
Things were working just fine except for a few downsides that appeared later on:
- the web interface (view) on our LDAP user database was managed by Mango, an outdated tool which many wanted to rewrite in Django that slowly became a huge dinosaur nobody ever wanted to look into again
- the Foundation membership information were managed through a MySQL database, so two databases, two sets of users unrelated to each other
- users were not able to modify their own account information on their own but even a single e-mail change required them to mail the GNOME Accounts Team which was then going to authenticate their request and finally update the account.
ssh -l yourgnomeuserid account.gnome.orgThe command will start an SSH connection between you and account.gnome.org, once authenticated (with the SSH key you previously had registered on our Infrastructure) you will trigger a command that will directly send your brand new password on the e-mail registered for your account. From my tests seems GMail sees the e-mail as a phishing attempt probably because the body contains the word password twice. That said if the e-mail won t appear on your INBOX, please double-check your Spam folder. Now that Mango is gone how can I request a new account? With Mango we used to have a form that automatically e-mailed the maintainer of the selected GNOME module which was then going to approve / reject the request. From there and in the case of a positive vote from the maintainer the Accounts Team was going to create the account itself. With the recent introduction of a commit robot directly on l10n.gnome.org the number of account requests reduced its numbers. In addition to that users will now be able to perform pretty much all the needed maintenance on their accounts themselves. That said and while we will probably work on building a form in the future we feel that requesting accounts can definitely be achieved directly by mailing the Accounts Team itself which will mail the maintainer of the respective module and create the account. As just said the number of account creations has become very low and the queue is currently clear. The documentation has been updated to reflect these changes at: https://wiki.gnome.org/AccountsTeam
https://wiki.gnome.org/AccountsTeam/NewAccounts The migration of all the user data and ACLs has been massive and I ve been spending a lot of time reviewing the existing HBAC rules trying to spot possible errors or misconfigurations. If you happen to not being able to access a certain service as you were used to in the past, please get in contact with the Sysadmin Team. All the possible ways to contact us are available at https://wiki.gnome.org/Sysadmin/Contact. What is missing still? Now that the Foundation membership information has been moved to LDAP I ll be looking at porting some of the existing membership scripts to it. What I managed to port already are welcome e-mails for new or existing members. (renewals) Next step will be generating a membership page from LDAP (to populate http://www.gnome.org/foundation/membership) and all the your-membership-is-going-to-lapse e-mails that were being sent till today. Other news /home/users mount on master.gnome.org You will notice that loggin in into master.gnome.org will result in your home directory being empty, don t worry, you did not lose any of your files but master.gnome.org is now currently hosting your home directories itself. As you may have been aware of adding files to the public_html directory on master resulted in them appearing on your people.gnome.org/~userid space. That was unfortunately expected as both master and webapps2 (the machine serving people.gnome.org s webspaces) were mounting the same GlusterFS share. We wanted to prevent that behaviour to happen as we wanted to know who has access to what resource and where. From today master s home directories will be there just as a temporary spot for your tarballs, just scp and use ftpadmin against them, that should be all you need from master. If you are interested in receiving or keeping using your people.gnome.org s webspace please mail stating so. Other news a shiny and new error 500 page has been deployed Thanks to Magdalen Berns (magpie) a new error 500 web page has been deployed on all the Apache istances we host. The page contains an iframe of status.gnome.org and will appear every single time the web server behind the service you are trying to reach will be unreachable for maintenance or other purposes. While I hope you won t see the page that often you can still enjoy it at https://static.gnome.org/error-500/500.html. Make sure to whitelist status.gnome.org on your browser as it currently loads it without https. (as the service is currently hosted on OpenShift which provides us with a *.rhcloud.com wildcard certificate, which differs from the CN the browser would expect it to be)
There are three basic systems:
The first is slick and easy to use, but fiddly to set up correctly and if you want to do something that its makers don t want you to, it s rather difficult. If it breaks, then fixing it is also fiddly, if not impossible and requiring complete reinitialisation.
The second system is an older approach, tried and tested, but fell out of fashion with the rise of the first and very rarely comes preinstalled on new machines. Many recent installations can be switched to and from the first system at the flick of a switch if wanted. It needs a bit more thought to operate but not much and it s still pretty obvious and intuitive. You can do all sorts of customisations and it s usually safe to mix and match parts. It s debatable whether it is more efficient than the first or not.
The third system is a similar approach to the other two, but simplified in some ways and all the ugly parts are hidden away inside neat packaging. These days you can maintain and customise it yourself without much more difficulty than the other systems, but the basic hardware still attracts a price premium. In theory, it s less efficient than the other types, but in practice it s easier to maintain so doesn t lose much efficiency. Some support companies for the other types won t touch it while others will only work with it.
So that s the three types of bicycle gears: indexed, friction and hub. What did you think it was?
The new model provides an xTuple application server that can handle requests from web users and potentially other third-party apps too.
Who is it for?
Some people may feel that the web UI is intended to appeal to mobile users. While it is useful for mobile and tablet devices, this is not strictly the aim, 
Jebediah boarded the airplane. It was a Bombardier CRJ900 with two
turbofan jet engines. Run by SPARK, a subset of Ada. He sat down
in his assigned seat and listened to the purser inform him that he
was free to use his phone door-to-door on all Delta Connection
flights. As long as the Airplane Mode was switched on.
Jebediah knew that this was why Delta owned 49% of Virgin Atlantic.
On the plane ride, a woman in too much makeup asked Jebediah to
get the man next to him so she could borrow his copy of the
Economist. The man said she could keep it and that it was old.
He had stubby little fingers. She was foreign.
At Terminal 2, they passed by Kids on the Fly, an exhibit of the
Chicago Children's Museum at Chicago O'Hare International Airport.
A play area. Jebediah thought of Dennis.
The Blue Line of the Chicago Transit Authority was disrupted by
weekend construction, so they had to take a small detour through
Wicker Park. Wicker Park is a neighborhood. In Chicago. Jebediah
looked at Glazed & Infused Doughnuts. He wondered if they made
doughnuts there. Because of the meeting, he knocked someone off
a Divvy bike and pedaled it to the Loop.
The Berghoff was opened in 1898 by Herman Joseph Berghoff.
Once he got to the Berghoff, he got a table for seven on the west
wall. He eyed the electrical outlet and groaned. He had brought
3 cigarette lighter adapters with him, but nothing to plug into
an AC outlet. How would he charge his device? An older gentleman
came in. And greeted him.
Hello, I'm Detective Chief Inspector Detweiler. Did you bring
the evidence? Said the man.
Jebediah coughed and said that he had to go downstairs. He went
downstairs and looked at the doors. He breathed a sigh of relief.
Seeing the word washroom in print reminded him of his home state
of Canada. Back at the table he opened a bag, glared angrily
at a cigarette lighter adapter, and pulled out a Palm m125.
Running Palm OS 4.0. He noticed a third person at the table.
It was the ghost of Bob Ross.
, said the ghost of Bob Ross. It was
good for him to communicate telepathically with Sarah Palin.
This has eight megabytes of RAM, Jebediah informed the newcomer.
Bob Ross's ghost right-clicked on his face and rated him one star.
Jebediah looked angrily at the AC outlet and fidgeted with two
of his cigarette lighter adapters.
DCI Detweiler said, I had a Handspring Visor Deluxe, and pulled
out a Samsung Galaxy Tab 3 8.0 eight-inch Android-based tablet
computer running the Android 4.2.2 Jelly Bean operating system
by Google. This also has eight megabytes of RAM, he continued.
As you requested, I brought the video of your nemesis at the
Robie House.
Jebediah stared at the tablet. He could see a compressed video
file, compressed with NetBSD compression and GNU encryption.
It was on the tablet. Some bridges you just don't cross,
he hissed.
Meanwhile, in Gloucestershire, someone who looked suspiciously
like Bobby Rainsbury opened up a MacBook Air and typed in a
three-digit passcode. Across the street a wall safe slid
out of the wall. And dropped onto someone's head. She
closed the laptop. And went to Dumfries.
Not far from the fallen safe, a group of men held a discussion.
FBI: Why are we here on this junket?
CIA: Where are we?
DIA: We're here.
JIA: This is confusing.
NSA: I have to get back to that place in Germany where I don't work.
ATF: We're talking about giant robots here, people.
EPA: Huh?
Part 2
AUD:USD 1.0645
donuts:dozen 12
Gold $1318.60
Giant robot spiders fought each other in a supermarket parking
lot.
Detective Seabiscuit sucked on a throat lozenge. Who are you
again? he asked the toll-booth operator.
I said my name is Rogery Sterling, replied the toll-booth
operator.
Rajry what?
I said my name is Rogery Sterling, replied the toll-booth
operator. Again.
Where am I?
Look, I'm telling you that that murder you're investigating
was caused by software bugs in the software.
Are we on a boat?
Look at the diagram. This agency paid money to introduce,
quite deliberately, weaknesses in the security of this library,
through this company here, and this company here.
Library, oh no. I have overdue fees.
And they're running a PR campaign to increase use of this
library. Saying that the competing options are inferior.
But don't worry, they're trying to undermine those too.
Detective Seabiscuit wasn't listening. He had just remembered
that he needed to stop by the Robie House.
I'm replacing my OTR key for XMPP because of heartbleed (see below). If the plain ASCII text below is mangled beyond verification, you can retrieve a copy of it 
Wow. 3G delta. I haven t booted this laptop for a while I think I m finally ready to make the move from gnome2 to gnome3. There are bits that still annoy me, but I think it s off to a good start. Upgrading perl from 5.10 to 5.14.
Java Sound on Linux
I m often in the position of having my favorite Java program (AltosUI)
unable to make any sounds. Here s a history of the various adventures
I ve had.
Java and PulseAudio ALSA support
When we started playing with Java a few years ago, we discovered that
if PulseAudio were enabled, Java wouldn t make any sound. Presumably,
that was because the ALSA emulation layer offered by PulseAudio wasn t
capable of supporting Java.
The fix for that was to make sure pulseaudio would never run. That s
harder than it seems; pulseaudio is like the living dead; rising from
the grave every time you kill it. As it s nearly impossible to install
any desktop applications without gaining a bogus dependency on
pulseaudio, the solution that works best is to make sure dpkg never
manages to actually install the program with dpkg-divert:
