Differences between revisions 1 and 2
Revision 1 as of 2018-01-25 11:27:07
Size: 2618
Editor: HolgerLevsen
Comment: copied+derived from https://wiki.debian.org/DebianEdu/Documentation/Stretch
Revision 2 as of 2018-04-03 19:35:37
Size: 2398
Editor: ?WolfgangSchweer
Comment: java plugin support will go away soon.
Deletions are marked like this. Additions are marked like this.
Line 17: Line 17:

=== Running Java applications in the web browser ===

Running Java applets is supported in the Firefox ESR browser by the OpenJDK Java runtime. Please note that this support will end early 2018, FIXME which is now.

HowTos for users

Changing passwords

Every user should change her or his password by using GOsa². To do so, just use a browser and go to https://www/gosa/.

Using GOsa² to change the password ensures that passwords for Kerberos (krbPrincipalKey), LDAP (userPassword) and Samba (sambaNTPassword and sambaLMPassword) are the same.

Changing passwords using PAM is working also at the GDM login prompt, but this will only update the Kerberos password, and not the Samba and GOsa² (LDAP) password. So after you changed your password at the login prompt, you really should also change it using GOsa².


Running standalone Java applications

Standalone Java applications are supported out of the box by the OpenJDK Java runtime.

Using email

All users can send and receive mails within the internal network; self-signed certificates are provided to allow TLS secured connections. To allow mail outside the internal network, the administrator needs to configure the mailserver exim4 to suit the local situation, starting with dpkg-reconfigure exim4-config.

Every user who wants to use Thunderbird needs to configure it as follows. For a user with username jdoe the internal email address is jdoe@postoffice.intern.


  • Start Thunderbird
  • Click 'Skip this and use my existing email'
  • Enter your email address
  • Uncheck 'Remember password'
  • Don't enter your password as Kerberos single sign on will be used
  • Click 'Continue'
  • For both IMAP and SMTP the settings should be 'STARTTLS' and 'Kerberos/GSSAPI'; adjust if not detected automatically
  • Click 'Done'
  • First time accessing the inbox click 'Confirm Security Exception' to accept the certificate; same applies if sending mail for the first time.

Obtaining a Kerberos ticket to read email on diskless workstations

If working on a diskless workstation, you don't have a Kerberos TGT by default. To get one, click the credentials button in the system tray. Enter your password and the ticket will be granted.

Volume control

On thin clients, pavucontrol or alsamixer (but not kmix) can be used to change audio volume.

On other machines (workstations, LTSP servers, and diskless workstations), kmix or alsamixer can be used.