Understanding GNOME internals to administrate desktop Debian machines
This is a modal window.
The media could not be loaded, either because the server or network failed or because the format is not supported.
Formal Metadata
| Title |
| |
| Title of Series | ||
| Number of Parts | 90 | |
| Author | ||
| License | CC Attribution 2.0 Belgium: You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor. | |
| Identifiers | 10.5446/40253 (DOI) | |
| Publisher | ||
| Release Date | ||
| Language |
Content Metadata
| Subject Area | ||
| Genre | ||
| Abstract |
|
FOSDEM 201386 / 90
2
5
8
10
12
13
14
15
17
19
21
24
25
28
29
31
32
34
36
39
40
43
44
46
50
51
52
54
55
57
58
62
65
66
67
78
79
87
88
00:00
BDF-VerfahrenEmpirical distribution functionSystem programmingPlane (geometry)MassMultiplication signSystem administratorCASE <Informatik>Integrated development environmentVirtual machinePhysical systemGoodness of fitWorkstation <Musikinstrument>Computer animationLecture/Conference
01:35
Plane (geometry)System programmingScaling (geometry)Workstation <Musikinstrument>System administratorBitMechanism designSet (mathematics)Virtual machineReal numberData managementPasswordTerm (mathematics)Configuration spaceDefault (computer science)Point (geometry)LoginComplete metric spaceLecture/ConferenceComputer animation
03:24
Cloud computingInclusion mapUser interfaceRevision controlBitCore dumpLatent heatPoint (geometry)Different (Kate Ryan album)BootingMessage passingComputer fileOrder (biology)TelecommunicationRhombusType theoryService (economics)Data managementBus (computing)Remote procedure callBinary codePhysical systemCartesian coordinate systemSingle-precision floating-point formatDemonNetzwerkverwaltung
06:16
PasswordDefault (computer science)Physical systemVideo game consoleSet (mathematics)Bus (computing)VideoconferencingComplex (psychology)Game theoryInflection pointGroup actionSystem callVideo game consoleSoftware development kitMechanism designPasswordMereologyProcess (computing)Default (computer science)DemonMilitary base1 (number)Cartesian coordinate systemWrapper (data mining)Physical systemDynamical systemElectronic mailing listService (economics)Socket-SchnittstelleLoginVirtuelles TerminalRhombusSystem administratorCASE <Informatik>Bus (computing)TrailPolygonMathematicsSuite (music)PlanningDirectory serviceBasis <Mathematik>Lecture/ConferenceComputer animation
09:16
Gastropod shellSoftware development kitCuboidPasswordRootkitInformation securityProcess (computing)AuthenticationLecture/Conference
09:55
Complex (psychology)Physical systemIdentity managementMenu (computing)Group actionBefehlsprozessorReal-time operating systemSoftwareExecution unitHill differential equationVirtual machineData managementData storage deviceMehrplatzsystemBefehlsprozessorGroup actionScripting languageComputer fileNetwork topologyJava appletBenchmarkFrequencyLine (geometry)Library (computing)Set (mathematics)Bus (computing)Cartesian coordinate systemReading (process)Parameter (computer programming)Sinc functionDefault (computer science)Dependent and independent variablesDemonRight angleAdditionMathematicsSelectivity (electronic)Computer animation
13:12
Uniformer RaumSicData storage deviceVirtual machineSet (mathematics)Cartesian coordinate systemDefault (computer science)Read-only memoryDistribution (mathematics)Descriptive statisticsWindows RegistryDirectory serviceRootkitWebsiteDerivation (linguistics)Lecture/ConferenceComputer animation
15:07
Phase transitionDemonDecimalSet (mathematics)Function (mathematics)Default (computer science)Data storage deviceBinary codeLibrary (computing)DemonCASE <Informatik>Physical systemLecture/ConferenceComputer animation
16:21
Staff (military)Default (computer science)Event horizonBinary fileDemonFile formatStreaming mediaBitInterface (computing)Data structureComplex (psychology)Array data structureDatabaseLibrary (computing)String (computer science)Data storage deviceBinary codeComputer animationLecture/Conference
17:15
DemonMeta elementComputer iconDefault (computer science)Gastropod shellDeterminantExtension (kinesiology)Directory serviceExterior algebraRhombusStack (abstract data type)Cartesian coordinate systemChainData storage deviceKey (cryptography)Virtual machineRight angleDifferent (Kate Ryan album)Set (mathematics)Default (computer science)Network topologyComputer iconDatabaseGastropod shellElectronic mailing listGroup actionComputer filePoint (geometry)Library (computing)Revision controlMenu (computing)BitDemonXML
20:10
Local ringConfiguration spacePhysical systemDatabaseDefault (computer science)Portable Object AdapterLoginAsynchronous Transfer ModeFormal languageComputer iconFormal grammarDemonSpecial unitary groupBitPhysical systemSet (mathematics)Default (computer science)Server (computing)Process (computing)DemonMereologyVirtuelles TerminalFile formatRevision controlLoginResultantComputer iconDirectory serviceFormal languageService (economics)Sinc functionSoftwareInteractive televisionDatabaseWindowElectronic visual displayReading (process)Maxima and minimaComputer fileConfiguration spaceVideo game consoleDemo (music)CASE <Informatik>Electric dipole momentInformationInterface (computing)Data managementSoftware development kitElectronic mailing listChemical equationLecture/ConferenceProgram flowchart
26:31
Bus (computing)PasswordAdvanced Encryption StandardKey (cryptography)Logical constantCASE <Informatik>LoginInterface (computing)Multiplication signSemiconductor memoryPasswordCartesian coordinate systemDemonLibrary (computing)Computer fileSoftwareBitMiniDiscModule (mathematics)Ring (mathematics)Functional (mathematics)FreewareProcess (computing)User interfaceDefault (computer science)CASE <Informatik>Lecture/ConferenceXMLComputer animation
28:52
Data managementPasswordInformationModule (mathematics)Virtual machineLoginServer (computing)Key (cryptography)User interfaceInterface (computing)Multiplication signSoftwareWikiLecture/Conference
29:51
Bus (computing)PasswordLogical constantLoginDefault (computer science)Physical systemMenu (computing)Default (computer science)Interface (computing)Computer fileDemo (music)Connected spaceBitData storage deviceLoginNetzwerkverwaltungClassical physicsBootingKernel (computing)Directory serviceSoftwareDemonComputer animation
31:07
Physical systemHaar measureGame controllerComputer networkRandom matrixUser interfaceSoftwareConnected spaceData managementMaxima and minimaPhysical systemDemo (music)Direction (geometry)NetzwerkverwaltungComputer animation
31:59
Default (computer science)Physical systemLoginDemonWritingConnected spacePhysical systemEnterprise architectureRootkitSoftware development kitBootingDefault (computer science)Demo (music)Data storage deviceComputer animation
32:58
Data miningGame controllerDrop (liquid)Default (computer science)Physical systemLoginHost Identity ProtocolPhysical systemSeries (mathematics)PasswordGroup actionSoftwareConnected spaceWeightVirtuelles privates NetzwerkAuthenticationEnterprise architectureConfiguration spaceDefault (computer science)Lecture/ConferenceComputer animation
34:22
System on a chipHill differential equationConfiguration spaceVirtual machineSet (mathematics)Connected spacePhysical systemServer (computing)InformationDefault (computer science)WindowSoftwareAddress spaceLecture/ConferenceSource codeXML
35:20
Identity managementDynamic Host Configuration ProtocolComputer fileHill differential equationMIDIUniformer RaumThumbnailConnected spaceDirect numerical simulationDifferent (Kate Ryan album)Server (computing)PlastikkarteAddress spaceSurfaceKey (cryptography)Public key certificateCASE <Informatik>Virtual machineConfiguration spaceLecture/ConferenceSource codeXML
37:04
Hill differential equationLocal GroupSeifert fiber spaceSoftwareServer (computing)NetzwerkverwaltungMereologyLibrary (computing)DemonComputer fileRhombusoutputLecture/ConferenceProgram flowchart
38:21
Directory serviceCartesian coordinate systemServer (computing)Process (computing)DemonLibrary (computing)Multiplication signNumberMetropolitan area networkRight anglePhysical systemInterface (computing)CoprocessorSet (mathematics)CASE <Informatik>Revision controlUtility softwareMiniDiscDependent and independent variablesDifferent (Kate Ryan album)Computer animationProgram flowchart
40:07
Local ringLocal GroupMaxima and minimaSeifert fiber spaceInsertion lossMobile appComputer fileCartesian coordinate systemElectronic mailing listDirectory serviceOffice suiteMereologyFunctional (mathematics)User interfaceProgram flowchart
41:05
Link (knot theory)Power (physics)Interface (computing)DemonPhysical systemServer (computing)TheoremSpherical capDefault (computer science)Server (computing)Category of beingPhysical systemType theoryUser interfaceMenu (computing)File formatLetterpress printingData miningOperator (mathematics)Message passingConfiguration spacePartition (number theory)Shared memoryInheritance (object-oriented programming)Power (physics)Interface (computing)Engineering physicsState of matterCartesian coordinate systemSet (mathematics)Game controllerBitData managementEncryptionSoftware development kitWeb 2.0Pulse (signal processing)Lecture/ConferenceComputer animation
43:47
Power (physics)DemonPhysical systemData managementServer (computing)Proxy serverMenu (computing)Recursive descent parserModul <Datentyp>PasswordAreaInformation and communications technologyInterface (computing)PasswordEnterprise architectureMehrplatzsystemProxy serverCodeJava appletMixed realityScripting languageVirtual machineInternetworkingSet (mathematics)Latent heatPulse (signal processing)Configuration spaceLecture/ConferenceComputer animation
45:31
Menu (computing)Java appletDemonProxy serverPasswordScripting languageComputer fileShared memoryPasswordWindowData storage deviceServer (computing)Lecture/ConferenceComputer animation
46:14
Computer musicUser interfaceMaxima and minimaHill differential equationPasswordEnterprise architectureSet (mathematics)Complex (psychology)SynchronizationInstallation artComputer fileOcean currentLetterpress printingRootkitConfiguration spaceVirtual machineSpherical capChecklistServer (computing)FreewarePatch (Unix)Repository (publishing)Multiplication signSoftwareUser interfaceDifferent (Kate Ryan album)AuthenticationBuildingQuantum stateFile systemElectric generatorLecture/ConferenceComputer animation
49:45
RootkitPartition (number theory)Key (cryptography)PasswordCryptographyLaptopDefault (computer science)Physical systemData managementVirtual machineSoftwareGoodness of fitProcess (computing)Lecture/ConferenceXMLComputer animation
50:42
Address spaceLecture/Conference
51:23
Web pageSystem callOpen sourceSlide ruleWebsitePresentation of a groupAddress spaceLecture/Conference
Transcript: English(auto-generated)
00:00
Okay, well, thank you for coming. This talk was not announced, so I think this is why we don't have many people. So I changed the title since the last time I gave this talk. It is about understanding GNOME internals to administrate desktop Debian machines,
00:22
although it can apply to desktop Linux machines in the general case. So, why this talk? We know that Debian is quite widespread
00:40
when you have an environment with a lot of machines, and there are good reasons for that. We have automated deployment tools, easy customization, administration tools, and a reliable system to use. And workstations are getting more and more a good use case,
01:06
although Linux is still a minor player on the desktop side, it's getting really interesting to administrate Linux, Linux desktop machines. So the easy way, what many people do is that,
01:23
okay, they give you machines with administrative permissions and anyway, these Linux users, they are geeks, so they can deal with any problem themselves. When you have a lot of users, of course, it doesn't scale and you can't have any kind of decent support.
01:44
a logical way and a secure way to deploy workstations should be really standard workstations with no specific permissions given to users, so it means you need to do the administration for them. And there is a lot of saying about GNOME
02:02
that it is not easy to administrate. I will show you that it is wrong. And on the contrary, a lot of tools to make it easier for the administrator to, well, to delegate permissions, configurations, and whatever.
02:21
So this should be useful for people who want to administrate their own machine as well, because the mechanisms are the same. But of course, it is a bit easier. I will not give a complete course over that, because it would take several hours, but I will give entry points
02:42
where you need to look at when you have a problem or when you need to configure something, and then by digging, you will find where is your problem. So first, we'll deal with the base plumbing.
03:02
This term was coined not so long ago, but it's really popular. User settings, how to set default settings, monetary settings, login management, password management, networking, very important, and random other stuff that you might want to set up.
03:25
So these are the focuses of my talk. GNOME 2.30 in Squeeze, GNOME 3.4 in Weezie, and the classic GNOME 3.4 also in Weezie.
03:41
There are a bit of Debian-specific stuff in that, but it should apply to all these GNOME versions as well. So first, plumbing, the most basic plumbing, and the one which is used by basically
04:01
every single application in GNOME now is Dbus. What is Dbus? Dbus, at the base, it is a messaging system, a typed messaging system. So you send a message to a recipient, and you can pass different data values with the types,
04:26
which is very important, because it is done at the cost of speed, so you should not use Dbus for where speed is critical, but your data is safe, because it will not be accepted on the other side if the type do not match.
04:42
In GNOME, it is not used, of course, as a messaging system per se. It is used as a RPC system, remote procedural call. So what happens is your, yeah, so you have two buses,
05:04
we call these buses, because the bus is a place that centralizes communication. So messages go always to the bus. So you have a system bus, which is started at boot, and a session bus, which is started right before you log in under the X session.
05:24
And you can start up system services or session services, which will register a name. So simply, you have two ways. For example, network manager is a daemon which starts at boot and registers a name.
05:42
And it is accessible through the name of that free desktop, that network manager. But it is also possible to automatically start up a service, so the daemon is not here, and it will be started in order to answer to a request. And this holds for both system daemons
06:01
and session daemons. So these are the files which define what binary to spawn if you want to access this service. DBus implements a basic permissions management, depending on the call you want to make.
06:20
You can say this or that group is authorized to make that call, but it is not widely used because we have something much better, which is policykit. So consolekit and policykit are the other bases for the plumbing.
06:41
Consolekit is a daemon which keeps tracks of users. It knows which user is logged on, from where, on what virtual terminal, and what processes it is using, although this part doesn't work very well.
07:01
So the cklist sessions command will give you the list of running sessions, and you will see that one of them is active. The active session has more permissions than other ones. And for example, the active session will automatically get specific permissions
07:22
for a lot of devices. For example, sound devices will automatically get read-write permission for the user of the active session. And these are changed dynamically. You switch VT, permissions disappear. So sound is cut.
07:43
In JSC, we will replace consolekits by a systemd-login-d service, which fixes a lot of problems with consolekits. Especially, it will know all processes and not just the session, because consolekits only knows the process that started the session,
08:00
while systemd, by using cgroups, can know the whole session. And it can say this process belongs to this session, so I can give to this process permissions for this session. Policykits, this one is not really a daemon.
08:20
It's a mechanism. Well, there is a daemon, but it's more of a mechanism to add permissions to Dbus, and it allows for much more flexible permissions. So it will wrap Dbus calls. So it is not visible from the application itself. The application uses Dbus, and instead of the system service,
08:41
talks to the policykit wrapper. And this wrapper will, well, as the name says, it will apply a policy. So the policy can be defined either by the system, by the administrator. So to use the default policy is in these directories,
09:02
and it can also look at whether the application calling is in an active session. So in this case, you will have more permissions. And it will also be able to ask for a password. For example, you want to do something that requires root privileges. In no way with policykit,
09:22
you will have a root process running on your X session, which is generally a recipe for a security disaster. So it will only ask for the root password in the user session, using the user policykit agent. So either the GNOME authentication agent
09:42
or GNOME Shell itself can act as the policykit agent, so that the dialog box looks better in GNOME Shell. So policykit allows very easily to tune the policy.
10:03
These are a few selected examples. For example, so by default, you are allowed to shut down the session, to shut down the machine only if you are the only user. And this is good for desktop machines, but maybe you have machines with multiple users
10:21
who can access it through SSH, and you don't want that. So you can allow the active user, the user logged on the machine, to always being able to shut it down, regardless of whether other people are using it. So six lines. Or you can delegate one Unix group permissions
10:43
to manipulate the CPU frequency. For example, you want to run benchmarks, so you don't want the CPU frequency to change. And the user, this way, can lock the CPU frequency using a panel applet.
11:01
Or you can delegate permissions with APT daemon and delegate package installation to one user. So you can do group, user group, or active, inactive selection. In JSC, it will be much more complicated.
11:21
Well, not everyone agreed with this change, including myself. But the advantage is that in addition to PKLA files, it will support JavaScript. Well, currently it's in replacement, but I don't think we can do without PKLA files.
11:40
So JavaScript will allow you to set permissions not only according to the actions you're requesting, but also to the parameters of this action. So for a good example, here you would allow maybe,
12:01
so this is the CPU frequency selector. You would be able to say this user can set the frequency to that and that user to another frequency. Well, of course, this is useless. But I mean, you can dig much deeper into permissions management. And also you can make it a giant mess
12:21
if you write too many JavaScript files. In GNOME 2.30 and still for a few applications, user settings are defined through the well-known GConf. GConf works in not such a complicated way.
12:46
There is a library. There is a daemon, which is spawned by Dbus. It used to be spawned by Cobra, but since Quiz, it is spawned by Dbus. And the daemon accesses to stores of settings,
13:01
which are XML trees, nothing more, nothing less. And the stores are stacked, so there is an ordering, and you can have a read-only store of that read-write store, and so you can have defaults, user settings, and you can have another read-only store on top of that, which would be mandatory settings.
13:23
You cannot override these settings. So this is only used now by a few applications. I don't think in WYSI you will need a lot of GConf tuning for administrating machines. At least we didn't find any setting
13:42
we wanted to change now. This is really Debian-specific. The shimas are installed in a specific directory. The default settings are generated from the shimas in a specific directory.
14:01
The shimas are the description of which settings you are allowed to set. This is the command to change a setting as a user. This is a command to change the setting as root for all users. It should work on all systems.
14:20
And with Debian, you can change the settings in a package. A package can set settings for another package with priorities, so it is very flexible if you want to do local packages for your site or for derivative distribution.
14:40
And this is a command, the GConf tool minus R will list you all settings that you can set, and there is a well-known GConf editor, which is well-known for resembling the Windows registry. While being much, much easier to use, regardless.
15:04
Starting with GNOME 2.32, settings were migrated to G settings. It was not finished in 2.32. It is one of the reasons for not choosing it for Squeeze. In GNOME 3, it is complete. So G settings works entirely differently.
15:24
So the settings are managed directly by the GI library, which will manage, in itself, the schemas and overrides. Basically, you can already see the default settings
15:44
without a daemon. And you can plug it, and by default, it is plugged to the GConf daemon. You can plug it to a daemon which stores the settings. But you can also even, as legacy, use GConf.
16:02
For example, some people prefer the XML store. Apparently, it works. We don't recommend that, but there are some cases where you might want that. And GConf, this one only has binary stores. So there is the system binary store and a user one.
16:25
It is a specific format, which is called GVDB. It should be, it should upstream promise that it should appear in the GIO interface soon.
16:41
The reason for inventing a format, yet another format, which looks a bit like a Tokyo cabinet or libraries like that, is to have a typed database exactly like DBUS is typed. So you can match any kind of message, including strings, arrays, arrays of complex data
17:04
structures in this binary store, which other formats do not allow. And the reason also for binary databases instead of XML is that because of XML, GConf was very slow.
17:24
So for example, let's say you want to change the schema is a bit simplified because when it is only read-only, the library will directly access the binary store, which is much faster, of course. You only need the daemon to write.
17:44
So you can change the setting using the GSettings command, which is what I recommend to use as user. You have a DConf, a DTor command. Don't complain if it crashes. It will crash sometimes, but it can be useful
18:04
to look in the tree for a given data. Just like with GConf, you can tune the GSettings in a package. So you can ship GSettings of a write file in the DBN directory, and DevHelper will do the rest for you.
18:26
The same holds as with GConf. You can have stacks of settings with different priorities. A few selected examples, so how to change the default backgrounds, and yes,
18:43
you can also set nice transition backgrounds which will print a different picture depending on the time of day. You can bring back the econs, the desktop directory on the desktop.
19:01
Like in Squeeze, you would have some random trash you can put on the desktop. You can change the theme with a big drawback, which is the GTK theme has to exist for GTK 2 and GTK 3, because unfortunately,
19:21
both versions use the same X setting to read their theme. So unfortunately, there are maybe two or three themes that will actually work for GNOME 3.4 because you still have a pair of GTK 2 applications that will look really bad if you don't use a theme
19:42
that works for both. For example, what we use in the shell to set the default extensions and the default applications. For example, we enable the alternate user status menu so that you can shut down the machine
20:04
directly from GNOME Shell without pressing a hidden key. And using gconf, it is a bit more complicated than with gconf to set mandatory settings, but you can.
20:21
You can by setting a system DB. So you create another system database, and in this database, you set defaults. Just like you would otherwise. But it's not listening's default, it's gconf defaults.
20:43
So the file format is not exactly the same, but it looks very similar. And these defaults will be matched to locks. Sorry. You set the defaults, and you set locks together.
21:02
And when setting a file locks, the list, the settings listed here will not be modifiable anyway. So it gives the same results than what you have with gconf. It's a bit more complicated. And don't forget, gconf updates whenever you change the system database.
21:28
So we are done with user settings. Then an important, really important piece of the desktop is the login manager, because this is where everything starts.
21:41
Sometimes everything ends if it doesn't work. So how does it work? As you can see, I often call it a plate of spaghetti, because there are lots of small pieces that talk to each other, and that's GDM since version 2.28.
22:03
It works really the same in GDM 3.4. So you have a daemon. That's a known piece of software. The daemon will spawn slaves. One slave for each display, it will manage. So at startup, it starts one slave.
22:23
It starts one slave. The slave process starts an X server. It can be useful. And a gnome session, a minimal gnome session, run as a Debian GDM user. Why a full session and not just a few selected processes?
22:44
You will ask me. Because what you need is the same as in a full session. You need accessibility. You need to reset to read default settings. Well, you need the same daemons, basically. So you start a minimal session with many, many processes blacklisted anyway.
23:04
And one, instead of starting a panel on a window manager, you start one process, the greeter. The greeter will contain the actual user interaction. It talks with the slave, and the slave talks to Pam, and you can log in.
23:23
And once you log in, everything like that is killed. All of that is killed, and you get your new X server on the configured session. And you can talk from your session to the GDM daemon through a D-Bus interface, which can spawn another slave on another display,
23:44
because everything is dynamic. So when you close the display, you will be switched to another one. ConsoleKits is used everywhere inside that, because it is the daemon which knows where the slaves and the displays are,
24:03
and who is logged on where. So GDM doesn't have to register that information. It is gathered directly from ConsoleKits, which is more reliable for that. So the useful things to do with GDM is configuring it.
24:23
So as you could see, there is the daemon. So there are things you need to configure for the daemon. There are not a lot of things, but you will enable here automatic login, because in this case, you don't even want to run the first login session.
24:41
Virtual terminal configuration, you can enable debugging. You can enable XDMCP, although it is very slippery. So don't do that, unless you really know what you are doing. Don't do that on untrusted networks. Really, really, please. Never.
25:00
But the real configuration is for stuff that is run inside the minimal session. This, of course, differs between GNOME 2 and GNOME 3, because GNOME 2 uses Likonf. So you set Likonf defaults exactly like you would. You can set them in a package. This is how we set the default background, for example.
25:27
In GNOME 3, you set G settings defaults in the G settings formats. And you can also set other defaults in a package. User defaults,
25:44
I mean, language session and the user icon, the icon you get from your, near your name. They used to be stored in your home directory, but there were some problems with,
26:03
for example, automatic mounting or encrypted home directories. So now it is stored in a system directory, which is managed by the account service I did not talk about account service,
26:21
which is another daemon GDM uses, but it's really, it's part of the internals of GDM, almost. It used to be part of GDM, actually. So once you've logged on, you have to manage the user passwords.
26:41
This is what the GNOME keyring does. What this software does is storing secrets, user secrets, because it is run with a user session, in AES encrypted files. So these files are called keyrings,
27:02
and each keyring comes with its own password. And there is a daemon which accesses the keyrings, and it also does the nifty things like replacing the GNU-PG and SSH agents with GNOME-like prompts. And there is a nice special case, which is the login keyring.
27:20
The login keyring is a specific keyring which uses the login password. So when you login, you automatically unlock the keyring, but it is only unlocked in memory, and on disk, you still have safe passwords. So how this works, it is a PAM module, which is called by GDM at the time of login,
27:42
which starts up a GNOME keyring process, but it is a very, actually it is something like a 20-light function, a main function, which just keeps the password in memory. And when you login, the GNOME session starts the daemon,
28:01
and it would just get back the password, and it can unlock the login keyring. When it has to unlock other keyrings, if you set them up, you will set them up by hand. By default, everything is in the login keyring. And to unlock another keyring, you would be asked to prompt. User applications can use this daemon
28:22
through either the GNOME keyring library or with org.fude-stop.secret's DBus interface. This interface is supposed to be compatible between KDE and GNOME, although I had,
28:40
we had noticed a bit of strange things when running GNOME applications over KDE while the other way around seems to work. There is also a user interface named C-Horse to manage your keyrings.
29:01
It just presents you with the information. It's useful when you, I think I stored the password for something like that. And it will also manage your new PV keys. It's a very lightweight interface for new PV keys. And the same PAM module is called
29:21
when you change your password. So it is important that you change your passwords on the machine using PAM because this will update the login keyring. This may look like nothing, but when you have a big network, it is often a reflex to say, okay, password management will be on the server
29:41
and users will have to use a web interface or whatever to change the passwords. You can do that if you want to use the GNOME keyring. Okay, next is networking.
30:00
A bit complicated too, but extremely useful. GNOME entirely relies on network manager. So at boot time, the network manager demo is started. And it talks directly to the kernel using the Netlink interface to set up connections.
30:23
The network manager demo has a store of connections in this directory. These are text files, simple text files which describe connections to startup. The default behavior when it doesn't find anything is to startup any interface
30:41
that is not managed by something else. For example, if you have eth0 configured in if-up-down, it will not be taken over, but otherwise the default is to start DHCP on that. But you can change that. Everything is configurable. Then when the user logs on,
31:02
it will start network manager agents, either nm-applets in GNOME 2.3 or GNOME Classic or directly GNOME Shell acts as an agent. This agent is responsible for the main user interface, which means you click and you say connect
31:22
to this network, and also password prompts in the same way as the keyring. For example, the network manager demo might say, I need secrets for that connection, prompt the user for these secrets. System connections are always stored here.
31:43
User connections used to be stored in GConf, and now they are also stored at the same place as system connections. But there is a minimal permissions management system in network manager, so the connection is marked as owned by user Joe, instead of being for everyone.
32:03
And only Joe can write connection for user Joe while you need root permissions to write connections for everyone. And the important thing is also that the agent talks to the keyring demo to store the secrets securely.
32:21
So the system connections are started at boot time. You can control them only if you have appropriate policy kit permissions. And you can pre-configure them, which is extremely useful for enterprise setups. User connections, while you can give or not the ability
32:43
for the user to start connections, the default is to allow that. And this way, secrets are stored. For user connection, secrets are stored in the keyring. But of course, the connection becomes attached to the user.
33:01
So if you switch to another user, the connection will be automatically dropped. Some people see this as a feature, some people see this as a bug. And it was solved very recently in Debian by making the behavior depend on your permissions.
33:22
So if you are a member of the studio group or of the netdev group, you have permissions to edit system connections without a password. And the agent detects that and will try to create system connections by default,
33:43
which will be shared between all users. But if you don't have this permission, instead it will create a user connection, which will not be shared. There are some complicated setups like system connections, but with the user secrets,
34:01
this is mostly useful for VPNs and for 802.1X authentication, which means authenticated WPA2 enterprise or authenticated Ethernet.
34:23
So a configuration can look like that. Let's say you have a very, very stupid problem, only a very, very bad company could have such a problem, say. Let's say your DHCP server returns information that is only valid for Windows machines.
34:42
But you want to plug Linux machines. So, oh, no problem, I will override the DHCP settings. Yes, but you will also need to connect these machines on outside networks where, well, the DHCP server will return information you need.
35:01
So you can set up two system connections and external connections, which is some kind of a default. So you define an Ethernet connection, which use DHCP, method is auto. You have to specify the MAC address, it is to say, to identify the device, of course.
35:24
This Ethernet card, and you enable IPv6. But you set up another connection with the same MAC address and this one is, you override everything from the DHCP server.
35:41
So you return a different DNS, different DNS surfaces. And the user will be shown with the two and you also disable IPv6 because usually when you have such a bad setup, it won't work. And the user will be presented with both connections
36:01
and will be able to switch from one to another in one click. This is, of course, a simple example for a very bad case, but it is a real one, fortunately. Other use cases, you can preconfigure a pre-shared key for the Wi-Fi without the user knowing the key.
36:21
It is not very useful anyway, but it is more useful than giving the shared key to the users. This way they don't have to remember it. But you can also do 802.1X, either with a machine certificate, so this way you deploy the certificate on the machine but the user doesn't give the certificate.
36:41
But you can also give a user certificate, in which case you configure 802.1X and the user can select the connection, it is preconfigured, but he will be asked for his personal credentials. All of that while still allowing users to create other connections like Wi-Fi,
37:00
to do roaming, et cetera. So it's very flexible, and if some of you were at this morning's talk about Network Manager, they are adding a lot of features like bonding support, InfiniBand, which will make all of that very relevant also on servers.
37:37
Yeah, permissions are important.
37:45
Related to networking is the VFS layer, which is named GVFS, you know. This one works also with the GIO library, which is part of GLib.
38:03
The GIO library accesses the GVFS daemon, which is spawned when needed. So let's say you are accessing only file URL, so no need to go access the daemon, and suddenly you ask for something else. Well, the GVFS daemon will do a lot of things.
38:24
First of all, it will spawn an explicit request. This is a huge difference if some of you knew old versions of GNOME 2. Mounting is explicit, so you will ask, for example, a mount for this SMB server,
38:43
and it will start a specific process to talk to this server. You can start as many GVFS processes as you need. They are started upon request. And the same daemon talks to the libgdu, GNOME Disk Utility Library,
39:03
which talks to udisk daemon, and udisk is the system daemon responsible for mounting system devices. Let's say you plug a USB device. This is a very useful case to see. Udev notices the device, says to udisk,
39:23
oh no, you have a device. Udisk notifies libgdu. One of the applications using it is gnome-shell, or gnome-settings-demon, which has a policy of mounting USB devices when they are plugged.
39:41
So, oh, mount it. Policy kit, oh, do you have the right to mount this? Yes, you have the right. Mount. And after being mounted, of course, you get a signal that it has been mounted. Two other interesting things. You have a FUSE interface for applications that don't understand, that don't use libgi0.
40:03
So it appears in the .gvfs directory. And Nautilus knows how to tell apart applications which do know how to access it, or those who don't.
40:21
So for example, OpenOffice doesn't have GIO support, so Nautilus will start it by giving it the path to a file in this directory, and it will still transparently access the remote files. LibreOffice, anyway, uses GIO now, so it is not relevant anymore, an example.
40:47
What did I forget? Yes, how to do a mount command from the command line. All of that can be done from the command line. The last part is the palimpsest user interface,
41:03
which exposes all the internal functions. So this is, for example, what happens when you look at the partitions, and you can control almost everything on a disk. All operations can be done here, so mounting, formatting, encryption, whatever.
41:24
Tons of features. Last but not least, miscellaneous stuff. That you might want to know if you have trouble debugging a system
41:40
or delegating permissions or whatever. So applications, they use the XDG MIME system, user-shared applications, and the user counterparts. This includes applications that appear in the menus and applications that can be associated with the MIME type.
42:03
This is how you add a submenu in your main menu, where you can say these application categories will go there. CUPS, for printing, you have little stuff
42:24
which is named CUPS package kit helper, which complements CUPS because, as you know, CUPS is a bit rough to use directly because you have to go to the web interface. The package kit helper allows to control CUPS through DBUS.
42:41
It doesn't do all the operations you can do on the web interface, but it does already a lot, because you can configure printers or start them, stop them, print, whatever. So it is accessed through the configuration interface, which is in system config printer, or in WYSI GNOME control center,
43:03
and from the notification applets that will tell you something is printing, we bring you messages, or the printer has no more paper. There is a power management interface, U-Power,
43:20
which is accessed directly by the settings daemon to apply the policy. The sound server, which is Pulse Audio, which we intentionally excluded from Squeeze because we felt it was not ready, given the state of sound drivers, but which is here by default in WYSI.
43:43
So by default, all mixing interfaces, so this includes what happens when you press this or that. Maybe it's because this interface is now done through Pulse Audio only.
44:01
So if you want to disable Pulse Audio, you also have to remind that mixing will not work regardless. It's not often a problem if you do that, but Pulse Audio is now really required for mixing.
44:23
An interesting setting can be to, if you have really a multiple user machine, you can configure Pulse Audio to mute the sounds whenever switching users. So it's quite funny, you switch users and it doesn't play anymore, and you come back, it resumes playing.
44:47
Okay, final things, I'm almost finished. Scripting GNOME, which is also something you want to do when you have a lot of users. You also often have enterprise-specific stuff.
45:03
It is very easy to integrate your stuff in GNOME. You can script in Python. You can script in JavaScript. Finally, why would you want to do that? Well, we have a real example here. An enterprise proxy which only works
45:22
with Internet Explorer. A Python code that bypasses it and requires the user a password. The password is stored in the GNOME Keiring, so it is only asked once. So this is where you would want to interface with the GNOME Keiring and with GTK and with auto-starting.
45:42
You might want to share data with Windows servers. So you want here to store, to look for the correct path in the active directory and ask the user for his password for the search and use the same password for accessing the files
46:01
and put it, et cetera, et cetera. So all in all, the GNOME Keiring is the thing we interface with the most on our setups because it makes it really easy to manage all the passwords you have in a complex enterprise setting.
46:24
But all of that is nothing compared to the work you have to do for the infrastructure. Configuring one desktop, you put all the settings I told you, and your machine works fine. Now you want to have a thousand machines.
46:40
This is different. You need an infrastructure. So this is just a checklist because it always depends on what you want. There was a very nice talk, by the way, yesterday about free IPA. It gives a good example of what an infrastructure can look like.
47:01
So you might want a Debian mirror and a custom repository to have specific packages, a custom installation CD using one of the two available solutions in Debian, FAI or Debian Installer. You need authentication. Printing, printing doesn't look like
47:23
it should still be a problem. Printing is what will cause you the most trouble if you want to enable it from Linux machines. Why is that? You can have a cap server with hundreds of printers,
47:42
even thousands of printers now. If you do that, the user interface will present you all of the printers, and you don't have easy ways to filter them out. Well, so there is no easy solution. So some people put a lot of print servers.
48:02
So you have one print server for each building, but it's expensive, so you put them in virtual machines, but you have then tons of virtual machines with only 10 printers. Julian Blasch, who used to work for us, found a good solution, but it requires patching caps.
48:23
And patching caps, well, you can, but you will never have your patch accepted by Upstream, because Upstream is Apple. Apple requires copyright assignment, so. Thank you, Apple, for keeping caps non-working.
48:42
Every time you use a network, never forget, this was stressed by many other speakers, never forget about time synchronization. Out of sync machines will behave erratically. In many, many ways. Network file systems, authentication,
49:02
even printing, everything will fail if you don't have NTP. And you will need, most of the time, because none of this solution is complete, you will need a solution to configure stuff directly on your machines. So that means puppet, beconfig2,
49:20
or other emerging solution, like salt. It's very, very vibrant community, currently. You will need that if you have a lot of machines. Two things that are not handled at all by any tool I've looked at,
49:40
root password generation, because you don't want to put the same root password for all machines, right? And installation systems don't deal with that. Oh yes, yes, you can set up a root password by default and have it transmitted in clear over the network. Good job. So you don't have any solution
50:00
for root password management, and the same holds for encryption keys. If you decide to use dmcrypts to encrypt your partitions on laptops, the same holds, you don't have an easy way to generate a key and then make the user select a password for this key, et cetera.
50:25
And that is all. Thank you for listening. Any questions? Yes?
50:41
Yeah, yeah, certainly. They are already uploaded. I will, let me show a place. Oh, I think they should, do they?
51:01
I show you an address where you will find them starting from today, from tomorrow. Okay.
51:26
This address, this is my personal site, and it is the same presentation I did in Paris, so the slides are already here, by the way.
51:44
Other questions?
52:01
Oh, sorry. How do that? No. Yeah.
52:24
Ah yes, did you talk right? Oh, okay. Okay, thank you again.