Painless Security

I’ve been at Debcamp since July 16. The people have been great; the food is reasonable . I’m reminded how wonderful Debian is as a community. There are a huge variety of interests here: conversations have ranged from how to balance embedded system constraints against abstraction, security, computability and complexity of dependency management, sex, drinking and politics. I had been under the impression that the Debian community was very young. While there are a lot of young people here, there are definitely people older than I am, and the depth of experience is amazing. People have been very helpful bouncing ideas around, debugging, or just helping when things get too frustrating.

Yesterday, I redebconfiscated krb5-config package. The previous package had few heuristics for configuring Kerberos; it assumed that the Kerberos realm name mapped directly on the DNS domain name. It also assumed people generally wanted to specify Kerberos servers locally rather than relying on DNS. The new version will hopefully never interact with most users. It supports all the automated mechanisms I’m aware of for determining the Kerberos domain name . If the script can find a plausible realm and find KDCs for that realm, it will not bother most users. If it cannot find KDCs, then it is quite noisy until you help it along. There were a few tricks to the implementation:

• It’s tricky to write a debconf script that reads a user config file to pre-populate debconf, allows the user to change things in debconf, and keeps the file and debconf in sync while giving preference to the file. One thing that makes this tricky is that the config script will be run twice between runs of the postinst script if preconfiguration is involved. The hardest situation to deal with correctly I’ve found is:
  1. Install the package at a relatively high debconf priority so you see few questions.
  2. Lower your debconf priority so that if the package were installed you’d see more questions.
  3. Wait for an upgrade of the package to come out and go through preconfiguration. Does the package behave correctly?
• I ended up having to auto-generate the config script because I need a fair bit of static configuration data that won’t be available until the package is actually installed.
• I think I may have over used the Perl ... operator.

This entry was posted on Wednesday, July 22nd, 2009 at 5:24 am by hartmans and is filed under Debian. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.