Since Freenode has been compromised my nickserv password might be too. Unless they had the good sense to hash the passwords, which isn’t common. So after checking my 121 line long vim encrypted “accounts” file, I noticed that this particular weak password is used in 17 other systems. Woops. You know what be good? Web standards in regards to user accounts. Now I have to fiddle with umpteen annoyingly different systems to change my password. Pain and suffering. It would be far better is I could do this task with a CLI tool or some handy trusted Web application that would implement such a standard. Though would such a standard make it easier for “crackers” to script attacks to change your password and really screw you over? Actually after thinking about it, the best option would just be to reset the password via email. Though that process can be sniffed… If the cracker tried to change your email address too, the user management system should send you an email to the old address to confirm the change. If the user management system had any doubt, it should just send you email a link to proceed. Btw, I’ve made the move to the OFTC IRC network. I also found lilo’s “money badgering” a bit too annoying.

I'm trying to replace SourceSafe at work with Subversion but it is going slowly. If anybody has any Java Web development using Subversion from Windows experiences they want to share, please toss me an email

There are three reviews this week, because I neglected to review one which I watched earlier. I'm also trying to decide whether the links at the end are of any use, and whether it's useful to syndicate this to Planet Debian. Feedback is encouraged!

Jawbreaker

The whole premise of Jawbreaker gets laid out right at the beginning - after a opening sequence in which we see the title candy being made, a couple of girls kill a friend by surprising her and using a jawbreaker as a gag. The movie then degenerates into a formulaic nerdy girl gets to be pretty storyline. Unfortunately Jawbreaker doesn't pull it off as well as Mean Girls does, and ends up falling pretty flat. One saving grace of this movie is that it is very short at just 87 minutes. One small treat is that Rose McGowan is playing a decent role, although I do have a much older vision whenever I see her from her work on Charmed. One thing which keeps bugging me is how the movie reminds me of But I'm a Cheerleader, even though the plots and premises are very different. The soundtrack is very well done with good placement of good songs. Jawbreaker is bittersweet at a 5. (imdb, amazon)

Real Genius

I have always heard good things about Real Genius, but never saw it all the way through. Supposedly this is a tragedy. Apparently ceilingsarecool saw it before, but didn't remember a bunch of the plot. A whiz kid enters college early and starts working for a professor. The premise is setup in the first 10 minutes or so, which is that Herr Professor is really corrupt and working to provide a laser weapon to the military. This leaves ample time for the comedy in the movie to play out, as Whiz Kid gets to experience all the wild antics of college with a high-IQ twist. Lasers are used fairly extensively in the movie (mostly as part of the plot) and get a nice chunk of credits in the end. The movie unfortunately doesn't really age well with time, unless you're a fan of 80's movies. There are no less than 2 montages with music, and the ultimate 80's end-of-movie song "Everybody wants to rule the world" by Tears for Fears is playing at the end. Real Genius still is smarter than many movies you'll see nowadays, so it burns in a 7. (imdb, amazon)

Primer

Small budget films are usually interesting to watch, because either they are simple masterpieces, or they try to be way more than they can be and end up being a trainwreck which you just can't stop watching. Primer is the rare gem which found a happy medium between complex and simple. At the start, a garage business is introduced with four tech friends making a bit of money selling to hobbyists. Apparently they have some sort of deal about who gets to pick the next thing they try, and one of them wants to try something related to physics. Two decide to attempt it on their own and they create a device which apparently lowers density, or gravity, or something. Then they discover it does much more than that - it can manipulate time. Fortunately there is still much of the movie left after this. The acting is not top notch by any means, and comes off as cardboardish, but it seems well-placed in this script because most techies that I know are not the best with social skills. It's important to note that the main focus doesn't lie on the device, but on the implications and ramifications. As the movie approaches it's end, the pace and convolution increases quickly. A rewatch is in order for Primer - and even then you still may be missing parts in the giant puzzle which is laid out before you. Shane Carruth directs, writes, and produces an amazing film, especially considering the sub-10k budget. Primer scores e^2.30258509. (imdb, amazon)

Today I mostly packaged a current version of ecartis, to avoid content-transfer-encoding weirdness (#176667). There is also a compiled version of the package for sarge should that be useful to anybody. I also updated the “blog” facilities on the Debian Administration website - this was after I wrote a very long entry - and was annoyed that it seemed to spam the associated planet site. Entries can now be truncated by the use of the magic “<cut>” tag. I imagine few people will need/want it, but I’m sure I’ll find it handy.

Quick travel updates: we spent Saturday afternoon at Andy and Pam's and had some great Baby Time with all three cousins. Sunday Dad left for his IPO road show early in the morning, then we went up to San Francisco for burritos on Mission with Nabil and Ted. Sunday evening we hung out with Maj's parents Rita and Mike, and we had dinner with them and Maj's brother Brian. We decided to spend the night in Tiburon and slept on the Jenkins's boat, the Pau Hana.

I’ve seen several people writing here about using different kinds of network configuration depending upon where they are. This is fine and dandy, but for the more general case is there a simple mechanism for switching system configurations depending on “environment”? I use Xen a lot on my systems, but sometimes I boot into a normal kernel. If I’m running a normal kernel I want to use the non-free nvidia driver for X, since this has better performance when viewing DVDs, etc. If I’m running Xen I need to use the free nv driver, since the non-free driver isn’t available. Can I make this switch automatically? I could add an init script to symlink the right file into place depending on whether xend is running, but that just seems fragile and suboptimal.

Today, I needed to do something that I didn't find a handy method for in Rails. The API has both a send_data and send_file method, but they are both 'one shot' in that you have to send all your data at once.

def generate_file
  @headers["Content-Type"] = "text/comma-separated-values;"
  @headers["Content-Disposition"] = "filename=\"some.file.txt\";"
  i = 0
  render :text => Proc.new    response, output 
    ...
    output.write("some generated text...")
    ...
   , :layout => false
end

I more or less copied that from the send_file method, and indeed, I'll even admit that I'm not entirely sure why it works. What I don't get is what "connects" the output variable in the Proc to an actual file descriptor somewhere. render_text doesn't really clear things up (well, for me, at least!).

  def render_text(text = nil, status = nil) #:nodoc:
    @performed_render = true
    @response.headers['Status'] = (status   DEFAULT_RENDER_STATUS_CODE).to_s
    @response.body = text
  end

In any case, the code does do what I want - perhaps someone else will find it useful. NOTE Comments are broken, as the typo journal system seems to have been somewhat abbandoned... argh!

I saw on Planet Debian that Enrico Zini had some trouble using xen-tools:

Installing the base system.   This will take a while!
	
Copying files from host to image.
Finished
Something went wrong with the debootstrap installation
Aborting

This basically means that the invocation of debootstrap failed to leave the system with a /bin/ls present - meaning it failed for some reason. My immediate mad debugging skillz suggest retrying with either –verbose, or –cache=no. The first will hopefully show the problem, the second will most likely fix the problem. I’ve seen this a few times, but haven’t updated the code to check for it. When creating a new Xen instance of, say 4gb, we copy all the packages from the host systems /var/cache/apt/archives so that debootstrap doesn’t redownload things and use up bandidth. If these cached files are >4gb then the new image is 100% full and debootstrap won’t run successfully! In related news I’m currently working on a system called image-server - this is a distributed xen-create-image script. The idea is that you have a central host which is responsible for creating Xen images of Debian, RedHat, Gentoo, and serving them to clients. This isn’t much use for a home user, but as a hosting company wanting to provide Xen instances of semi-arbitary Linux distributions it should come in handy. In other news I want to work on modularising the Xen tools scripts and moving them onto xen-tools.org.

While working on Hecl, it has sometimes really surprised me how much it's possible to delve into seemingly trivial details. Just for starters, we've been talking about what to call string commands. Originally, I'd used names like slen and sindex to have something quick and easy to write, but no one seemed to like them that much. Wolfgang implemented a bunch of new string commands (very much appreciated!), and took the Tcl approach of command subcommand, like string index, and also suggested some other things like str.index. I am strongly opposed to the string length style commands though, because I think that's just too much typing for a language that's supposed to get you up and running quickly. The compromise I proposed and implemented was to use more 'C style' commands like strlen, strindex, strfind, and so on. I'm not a big PHP fan, but they seem to have taken a similar approach. It's not too verbose, but you can tell more or less what the command is for. Even more seemingly trivial - indexes for strings and arrays. Hecl takes the Lisp approach rather than the C approach, and utilizes commands instead of syntax, even for list and string access, so to get the second character of the string "foo", you would do: strindex "foo" 1 . Like C, Hecl indexes start at 0. Where things get tricky is in calculating indexes "from the end" - how do you tell the language to "fetch the last character from the string 'foo'"? Tcl lets you write a string like "end" or "end-1", which is handy compared to the process you would go through in a language that doesn't help you out: take the length of the string, and subtract from that as needs be. I prefer the approach that I first saw in Python, though, use -1 for the last character:

>>> "abcde"[-1]
'e'

Ruby takes the same approach. It's nice to be able to just insert a -1 rather than have "end-1", which sort of looks like an expression, but isn't really (Hecl doesn't even have normal infix expressions), especially because you can easily calculate the -1 and insert it as is, instead of having to do some string interpolation like "end-$foo". Where things get tricky is when you want to do something like specify a range, say from the 3rd letter to the end of the string. In Python, they use syntax, specifically by simply not including the end of the range:

>>> "abcde"[3:]
'de'

That doesn't work really well with Hecl - I suppose we could pass in a blank string instead of a number, like so:

strrange "abcde" 3 ""

But that's not very clear, and IMO it's slighly ugly to pass in a string where you want to use a number. I had a look at Ruby's behavior, and found it more to my liking:

irb(main):001:0> "abcde"[3..-1]
=> "de"

The difference with Python is that the second index is inclusive, whereas Python includes the character at the first index, and excludes the second:

>>> "abcde"[3:-1]
'd'

I decided the Ruby approach worked best for Hecl, so now we have:

hecl> strrange abcde 3 -1
de

If you're still reading this, I guess you see what I mean by how much one must delve into what must seem like very unimportant minutiae to... well... normal people!

I think the next handy device that needs to be integrated into mobile phones is a heater. It must be strong enough for a tent, while I'd probably use it for thawing myself enough to recognize the vibration alarm. Why yes, it is June.

I'm writing an application in Ruby that makes heavy use of XMLRPC (the application of XMLRPC-over-Unix-socket fame), and so I'm using Mock Objects to mock out the XMLRPC client proxy and provide an interface that doesn't involve having a whole other infrastructure running on my laptop so I can run my test suite. For those who don't know, mock objects are objects which look and superficially act like the real objects you might use to communicate with an external service, but don't actually do the communication -- instead, they return canned responses to your calls. Why is this useful? Well, imagine that the real object talks to a SOAP service on the 'net (such as the Google search API). It means that every time you run your test suite, you need access to the Internet. The external service may also cost something everytime you talk to it -- or it may be impossible to use to test, since there's statistics generation or something going on that means that hammering it for test purposes is just impractical. In addition to returning values to your application, mock objects will usually record what has been called, so that after your test run is complete, you can also verify that all of the methods you wanted called have actually been called. This means that you can have a good idea that what you wanted to happen to the service actually would have been done. Handy. Some people have a (justified) ditrust of Mocks, because it's easy to make a mock object that doesn't perform like the real one (and hence invalidate your tests), but they provide a necessary evil in cases where you just can't use the real object when running your test suite. The XMLRPC proxy I'm using has a bit of a quirk. Everything runs through one method on that object -- XMLRPC::Client#call(). This seems really limiting, especially in a wonderfully dynamic language like Ruby. In reality, it's not too bad -- it makes the object interface easier to mock, and you couldn't emulate the whole thing with method_missing anyway, because you can have various Ruby-illegal characters in XMLRPC method names. The downside to this all-in-one-method thing, though, is that simply verifying that #call() has been invoked a dozen times doesn't really tell me much about whether the mock was used the way I wanted it to be used. My chosen mock object suite, Test::Unit::MockObject, whilst otherwise excellent, is (or rather, was) missing the ability to verify the arguments that are passed to your calls -- you can say "I need methods x(), y(), and z() called", but you couldn't say "I need the call y('foo', 'bar', 42) made". Of course, this change the mock object class is non-trivial, and needs to be tested itself (it'd be pretty lame if a class intended to facilitate automated testing lacked a test suite of it's own). I added a bunch of tests to the test suite, and got some good results. I had a couple of false starts, where I wasn't checking most of the corner cases (where bugs lurk in the shadows), but eventually I got a test suite that was fairly complete, which drove the new features I needed to a good place. So I carted my newly enhanced mock object class across to my production project, and off I went. Except that I was getting some downright weird failure messages when my code wasn't invoking the mock object the right way. Why? Because I hadn't tested that my failure messages were appropriate. Why was that? Because the assert_raise assertion in Test::Unit doesn't have a facility to make sure that you're passing back the right exception message, only that you're passing back the right exception class. Whisky, Tango, Foxtrot? Over. (This space intentionally left blank for me to insert the correction to this claim that the lazyweb is sure to provide) So I had to write a new assertion (assert_exception_message) which checked that both the right class and the right message came back. This code, of course, needs to be tested too, because otherwise you can't be sure that your test code is performing right. At this point, I was writing test code to test a new assertion I'd written so I could test the mock object class I had modified so I could test my application. At this point, things got a bit "meta". It got a bit difficult to separate out the tests from the tests' tests. But I fought through the brain melt, and shortly thereafter came out the other end with a properly working piece of actual application, and all was well in the world. By now, a certain Mr. Tendys is probably rubbing his hands with glee, as he gets ready to espouse at length about how this whole post just proves how utterly useless test-first programming (or even testing in general) is for producing economically-viable software. Let me analyse what I "spent" on getting all this functionality, though -- about 3 train trips home -- maybe 4 hours of time total, including writing the extra tests in my application to use the wonderful new features I'd made. That's not much, in the grand scheme of things. I've wasted that much time in a day skiving off work in the past because I was frustrated with what I was trying (and failing) to program, usually because I was swamped with bugs. What did that four hours of my time buy me? Heaps. I can now better verify my software works as anticipated. I have confidence that my software is a lot more robust than it was before. My tests identified several issues that passed my eyeball check, but blew up when I tried to actually use them in a particular way. But with the help of my tests, I identified the problems quickly and went on my way. Since I was working in a localised area of the application, I was immediately familiar with the code, and could stomp the bug almost immediately. If I'd only done end-to-end testing at the end of development (or worse, released it with the bugs still in there), the debugging would have been much harder because I'd forgotten little details about the code. I reckon that benefit, alone, has probably saved me 4 hours already, since I've spent whole days hunting down little bugs in an ad-hoc fashion in the past. I'm fairly sure most any programmer can empathise with me there.

Never ever fly on Iberia anymore unless they can certify that only Finnish or Norwegian people are in the flight. Or that I have my wooden base-ball bat handy to puch the two jerks who speak (loud) all night long in the two seats in front of me (and Petr)....and laugh louder and louder as long as they keep drinking the whishy-cokes offered by an incompetent and inefficient crew. First time this happens to me in transatlantic flights where, usually, people are more civilized. PS, later: these morons were indeed Mexican, not Spanish.

Two books have recently been published that I want to read.

• Rails Recipes (Chad Fowler)
  
• Building a Scalable Web Application (Cal Henderson)

The first of these I took delivery of instantly in PDF form, and a paper copy will make its way to me in due course so I have it as a handy reference.The second of these is going to take 12-14 days from Amazon (5-7 days if ordered through O'Reilly's UK distributor Wiley).
There's been a lot of talk on David Heinemeier Hansson's blog about PDF publishing, but to me it's simply a way of getting me the information I need quickly. Normally, I want the paper copy too.Another small but significant benefit is that PDFs weigh very little! Having just taught a Rails tutorial at XTech, I can vouch that there was no way we wanted to carry around 30+ copies of the Rails book on the offchance attendees wanted to buy it. Whereas some publishers have experimented with certain product lines available only as PDFs, I can't quite shake the feeling they're offering an inferior product in which they are not confident enough to commit to paper.My suggestion is that PDF and print is not an "either/or" choice, but an "and/or".

I finaly sent the report of course I forgot some details but you can found them on a mail from Mark

Mark Wielaard posted this yesterday: Escaping the Java Trap
A practical road map to the Free Software and Open Source alternatives

For the last couple of years the community has been working to
ensure that developers can create applications using the java
programming language without having to depend on proprietary
software. Today, the free (as in libre) implementations are
already very capable and support a vast amount of functionality
that developers expect from a java-like environment. Important
large applications like JOnAS, OpenOffice.org 2, Eclipse 3 and
Tomcat 5 are known to work. This document provides a road map of
the various projects; how they work together, where they are,
where they’re going, and how we make sure that they work well
and are compatible.

http://developer.classpath.org/support/ Thanks Mark, very useful informations.

And what about Java Server Faces (JSF) in Debian? We already have Struts and it seems JSF could replace it. While googling around, I found a lot of websites, tutorials, plugins and so. It seems the JSF community is growing and the API seems powerful. I already work with Struts, maybe I have to have a look at this promising technology too. If we put JSF to Debian, maybe we should start with release 1.1 because of the lack of free J2SE50 at the moment (even if ecj, classpath-generic-branche, jamvm are very promising). We’ll need (list of dependencies):

• Tomcat 5.5.x
• J2SE1.4 — ok — (we already have free ones )
• Ant 1.6.5 — ok –
• Junit 3.8.1 — ok –
• Cactus 1.4.1 (JSF 1.1) for the Servlet 2.3 API
• HtmlUnit 1.4
• Tag Library Documentation Generator 1.3 (only needed if you plan to generate the TLD documentation)

Great news! I upgrade charva (a Java Windowing Toolkit for Text Terminals) to the latest 1.1.1 release and it compiles and runs with kaffe! Just apt-get install libcharva1-java (when it’ll be available because the move to main can take some days) and you’ll be able to compile the examples:

$ cd /usr/share/doc/libcharva1-java/
$ ecj-gcj -nowarn -classpath /usr/share/java/charva1.jar -d /tmp/ examples/charva/* examples/java/*
$ cd /tmp
$ kaffe -classpath .:/usr/share/java/charva1.jar example.java.AppFrame


And the same in terminal mode:
$ kaffe -classpath .:/usr/share/java/charva1.jar example.charva.AppFrame

The third point of the Debian Social Contract says that we won’t hide the problems. In GNU Classpath we are now 94% of the JDK 1.4 compatibility (see the Japitool daily report), but as discussed at the Oldenburg DevJam, we must admit that there are methods that just do nothing. Being API compatible is great, but in the past, there were stubs methods (no one deos it for more than a year or two). From CVS tonight:

(sid)arnaud@oz:~/gnu/classpath$ find -name '*.java'   
    xargs egrep '(TODO FIXME (not Not) (I i)mplemented XXX UnsupportedOperationException)'   wc -l
2617

We need to tag all these FIXEME and TODO comments and process it with gjdoc and an XSLT stylesheet so we can easily see were we have to put our efforts.

We went out for a potluck dinner last night to see our friends Lena and Jeremy and their great kids Sylvie and Clea. (Their daughters are named after Lawrence Durrell characters, which, like, is there a faster way to my heart? I think not.) Papa made hummus, baby was fine and dandy but increasingly shy.

So about two weeks ago I started playing with Kerberos. And I'm still not finished with it, kerberizing one service after the other. Really fun, that. Kerberizing a network protocol involves somehow sending the Kerberos ticket in-band with the rest of the conversation. This is not entirely defined by the Kerberos protocol, and indeed, different network protocols have come up with different ways of sending the Kerberos ticket to the service. So far, I've encountered SPNEGO for HTTP, GSSAPI for IMAP and SSH, and SASL for LDAP. It sounds like a complex mess, but it really isn't; in general, kerberizing a service involves three steps:

1. Installing the Kerberos plugin (if any) for both the server and the client;
2. Generating the service principal, and adding it to a/the keytab;
3. Configuring the service so that it knows it can do Kerberos, and so that it knows how to act when a Kerberos request is sent

Yes, in the cases I've seen it's really that simple. Although I'm skipping step 0 here–reading the documentation. But I've done that for you already ;-) The hardest part is the initial setup. But even that isn't very hard, because the process is very well documented. For starters, install the krb5-doc package, and read the excellent /usr/share/doc/krb5-doc/README.KDC which explains just enough of the system to get you started. The rest will be explained to you through debconf and the like; and if you want more, the krb5-doc package also contains three info files which explain concepts and usage very well. There's an alternative implentation called heimdal, which I presume works similar; but I haven't tried it, so I don't have much details on that one. The process of installing krb5 is very straightforward; the only thing I'll let you know is that you should ensure that any host you're going to kerberize should have reverse name lookups configured and working correctly; otherwise, you're going to run into a bunch of serious problems. After the initial setup, you'll have a Kerberos realm, usually your domain name in upper case (GREP.BE in my case). You'll now want to set up principals for your users and principals for your hosts. Now, let me show you how to configure Kerberos for LDAP, PAM, HTTP, IMAP, and SSH:

PAM

By installing and using the libpam-krb5 package, you'll log in to kerberos and receive your TGT immediately at login time; the alternative would be having to use kinit (in the krb5-user package) afterwards. pam_krb5.so also takes care of destroying your tickets when you log out, so that you don't have to worry about that. This is very handy, but not really required; you could just use kinit all the time. Of course, using pam_krb5.so also means you have only one password for everything—and that is a very good argument to use it.

Anyway; our three steps:

1. Installing the plugin
As you've guessed, libpam-krb5 is the package you'll need. That, or the heimdal implementation.
2. Generating and installing the service principal
In the case of any service such as PAM that will give you a shell (thus, as we'll see later on, also SSH), the principal is supposed to be host/<hostname>@<REALM>. For instance, on rock.grep.be, the principal PAM will use is host/rock.grep.be@GREP.BE. We'll create it with kadmin (which can be done on any kerberized host):

wouter@rock:~$ sudo kadmin
Password for root/admin@GREP.BE:
kadmin:  addprinc -randkey host/rock.grep.be@GREP.BE
WARNING: no policy specified for host/rock.grep.be@GREP.BE; defaulting to no policy
Principal "host/rock.grep.be@GREP.BE" created.
kadmin:  ktadd host/rock.grep.be@GREP.BE
Entry for principal host/rock.grep.be@GREP.BE with kvno 3, encryption type Triple DES cbc mode with HMAC/sha1 added to keytab WRFILE:/etc/krb5.keytab.
Entry for principal host/rock.grep.be@GREP.BE with kvno 3, encryption type DES cbc mode with CRC-32 added to keytab WRFILE:/etc/krb5.keytab.
kadmin:  q

Generating the principal can really be done as any /admin user; but as the same isn't true for writing the keytab, I'm using sudo in the above example to become root.
3. Configuring

account	required	pam_krb5.so ignore_root
auth	sufficient	pam_krb5.so ignore_root forwardable
password optional	pam_krb5.so ignore_root
session	optional	pam_krb5.so ignore_root

After adding the above lines to the relevant files in /etc/pam.d, you should log off, then log on again, run 'klist', and marvel. If you add the lines to your passwd file as shown above, and don't remove the pam_unix.so lines, then local passwd-based authentication will still work. This can be nice if, for example, the Kerberos server is down, or you're working on a laptop that isn't always within reach of the Kerberos server. It doesn't do any harm; the worst that can happen is that at some point you happen to be on a network where there's a firewall which drops packets on the floor rather than sending you an ICMP port unreachable; in that case, you need to wait for the Kerberos login to time out, which takes half a minute or so (I haven't timed).

SSH

1. Installation
If you're running unstable, you don't need to do anything. The OpenSSH packages in unstable are all set to understand Kerberos. If, however, you're running stable, you'll want to replace your ssh package by the ssh-krb5 package, which is the regular SSH package plus some patches to enable GSSAPI (read: Kerberos) authentication.
2. Service principal
If you've done the PAM setup above, you're all set; SSH, being a service which gives you a shell, also uses the host/ service principal.
3. Configuration
Make sure both the server and the client have the GSSAPIAuthentication option enabled. After you've done so, restart the server.

IMAP

I'm using dovecot as my IMAP server, which has builtin support for GSSAPI authentication (at least in unstable; haven't checked stable in this regard).

1. Installation
As dovecot comes with everything compiled in, there is no need for installing extra packages.
2. Service principal
You'll need the imap/ principal (e.g., imap/rock.grep.be@GREP.BE). Note that the host name which is found by doing a reverse lookup on the ip of the server is what counts, not the name of the server as you're using it (so not, e.g., imap/imap.grep.be@GREP.BE)
3. Configuration
Edit your dovecot.conf, and find the line that starts with "mechanisms" in the auth default stanza. Make sure it contains at least the word gssapi. Restart dovecot. I haven't found a Free (as in speech) IMAP client that supports GSSAPI authentication. My client of choice, offlineimap, doesn't seem to support it; mutt doesn't either (unless I'm missing something); and while thunderbird in unstable is supposed to support it, I haven't been able to configure it correctly yet. Probably me. I have, however, been able to verify that it works by using a non-free software package. Obviously, this isn't good enough. In addition, I found that horde and imp don't like an IMAP server that has GSSAPI enabled if they don't, while enabling GSSAPI in horde requires a PHP extension that isn't packaged in Debian. So I've disabled it for the time being. Stay tuned.

LDAP

1. Installation
LDAP requires uses SASL for authentication, which doesn't have GSSAPI modules in the default package; for those, you need the libsasl2-modules-gssapi-heimdal package. Attentive readers will have noticed that this package contains the string heimdal in it, rather than krb5, and that this is not the same implementation that I've been using previously. Yes, true. But since there's no libsasl2-modules-gssapi-krb5, and since Kerberos is, after all, a well-defined protocol, this is not an issue—except in that you need a bit more diskspace for the additional libraries. Note that the modules have to be installed on both the client and the server.
2. Service principal
You need a service principal that starts with ldap/, obviously followed by the hostname and the realm.
3. Configuration
For those people whom you want to allow to authenticate themselves using Kerberos, make sure they have ' SASL <principal>' in their userPassword attribute set (e.g., I have userPassword: SASL wouter@GREP.BE). You can have that in addition to a regular encrypted password; the userPassword attribute is a multi-value attribute. Now if you use ldapsearch or anything similar, it will try to negotiate GSSAPI authentication as the SASL mechanism. If it doesn't do so, you can force it by adding -Y GSSAPI to the command line.

HTTP

1. Installation
You need the libapache-mod-auth-kerb or libapache2-mod-auth-kerb modules on the server. For the client, you need a browser which has SPNEGO support; Konqueror and Firefox are two examples of browsers that do.
2. Service principal.
The prefix here should be HTTP/. That's right, in upper case, contrary to previous examples where this wasn't the case. HTTP is also different in that apache usually isn't running as root. This is a good thing; however, it does mean that the kerberos authentication module is unable to read /etc/krb5.keytab. You'll have to write the service principal to a different keytab for apache; I've used the -k option to the ktadd command in kadmin to specify the keytab as /etc/apache2/keytab; I'll assume you do the same.
3. Configuration
Something like this, on the server:

<Location /some/URL>
	AuthType Kerberos
	KrbMethodNegotiate on
	Require valid-user
	Krb5Keytab /etc/apache2/keytab
</Location>

This will enable SPNEGO authentication; and if SPNEGO authentication fails for some reason (for example, because the used browser doesn't support SPNEGO, or because the user isn't logged in to Kerberos), it will fall back to Basic Authentication. While the latter is usually a good idea, it's less of a good idea if you're not using SSL, since then your password would be sent over the wire in cleartext. Luckily, the basic authentication can be switched off, by using KrbMethodK5Passwd off. If you go to my webserver logs, you'll see that you'll get a 401 right away, while the HTTPS version of the same allows you to try to log in by using basic authentication. On the client side, if you're using Firefox, you need to go to about:config, and set the option network.negotiate-auth.trusted-uris to a string that will identify the servers that may do SPNEGO authentication in your realm. In my case, I've set it to grep.be. For konqueror, doing something similar is not required—it'll do SPNEGO authentication out of the box.

So, that's what I've got set up on my network currently. Next on the list: NFS4 kerberos auth (requires updated nfs utilities, which aren't in Debian yet because of issues with NFS2, IIRC), PostgreSQL (it does seem to support it), and finding out if or how I can create principals can't be used for one authentication scheme or the other. Phew, that was a long post. I'll stop now.