LDAP

For use with SpaceNet we've installed OpenLDAP on nurdserver. On the new Nurdserver v2 we're going serious with LDAP.

Working implementations on Nurdserver v1 (nurdserver)

• Spacenet
• Samba on NURDServer
• vsFTPd on NURDServer

Working implementations on Nurdserver v2 (nurdservices)

• NFS export

To do

• Spacenet
• FTPd
• Samba?
• Get a certificate, allow access only over TLS
• Create homedir on NFS-export when adding a user to LDAP
• Change password on first login doesn't work in FusionDirectory
• Migrate all local users on Infra machines to LDAP
• Migrate all homedirs to Nurdservices
• Fix storage on Nurdservices (current VM is 32GB)
• Migrate wiki users and merge them with other users
• Use LDAP as userdb back-end for wiki
• Add all relevant fields of Wiki users to LDAP profiles
• Maintain page from LDAP
• Maintain sudo'ers through the LDAP and disable local root accounts (backdoor in case of emergency?)
• Disable all relevant services on Nurdserver v1

Status

I've installed FusionDirectory on a new VM called nurdservices on the proxmox system of Nurdserver v2. I've also added a couple of users to it.

It can be accessed on http://nurdservices/fusiondirectory from within the network.

On Sinterklaas I've got it to work as I think it should be for the local users that existed:

• Homedirs moved to an nfs mount from Nurdservices
• Local homedirs and users deleted
• /home/ is mounted on boot over nfs
• LDAP users can log in and see their homedirs as if nothing has changed

Setting up other workstations in this way

To get this to work you need to:

• create all local users in LDAP (if they don't exist already)
• move homedirs to nurdservices (fix ownership if needed)
• delete local users
• delete local homedirs
• install libnss-ldapd
• mount /home from nurdservices over nfs
• configure the ldap in nss and pam (no ssl, so ldap://nurdservices/)
• and add a line to /etc/pam.d/common-account:

session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

This step will no longer be needed once homedirs are created when you add a user to the LDAP.