m (→Status) |
|||
| Line 16: | Line 16: | ||
= Status = | = Status = | ||
[http://fusiondirectory.org FusionDirectory] is running on | [http://fusiondirectory.org FusionDirectory] is running on [[NURDServices]] on the [[Proxmox2]]. Most users are migrated. | ||
It can be accessed on | It can be accessed on [https://ldap.nurdspace.nl]. | ||
On [[Hp_dc5800_sinterklaas|Sinterklaas]], [[Dell_Optiplex_GX270|Vjdeb]] and the [[PrinterPC]] I've got it to work as I think it should be for the local users that existed: | On [[Hp_dc5800_sinterklaas|Sinterklaas]], [[Dell_Optiplex_GX270|Vjdeb]] and the [[PrinterPC]] I've got it to work as I think it should be for the local users that existed: | ||
* Homedirs moved to nfs mount from [[ | * Homedirs moved to nfs mount from [[NURDServices]] (soon to be migrated to [[Proxmox1]]) | ||
* Local homedirs and users deleted (except user 'printer' on [[PrinterPC]]) | * Local homedirs and users deleted (except user 'printer' on [[PrinterPC]]) | ||
* /home/ is mounted over nfs on boot | * /home/ is mounted over nfs on boot | ||
Revision as of 03:41, 27 April 2013
For use with Spacenet we've installed OpenLDAP on NURDServer. On the new Nurdserver v2 we're going serious with LDAP.
Working implementations on Nurdserver v1 (nurdserver)
- Samba on NURDServer
- vsFTPd on NURDServer
Working implementations on Nurdserver v2 (nurdservices)
- NFS export for homedirs
- Spacenet
Connected workstations
Status
FusionDirectory is running on NURDServices on the Proxmox2. Most users are migrated.
It can be accessed on [1].
On Sinterklaas, Vjdeb and the PrinterPC I've got it to work as I think it should be for the local users that existed:
- Homedirs moved to nfs mount from NURDServices (soon to be migrated to Proxmox1)
- Local homedirs and users deleted (except user 'printer' on PrinterPC)
- /home/ is mounted over nfs on boot
- LDAP users can log in and see their homedirs as if nothing has changed
- Users in the LDAP 'sudo' group can sudo on connected workstations.
- Homedir is created on NFS-export when adding a user to LDAP (like this)
Setting up other workstations in this way
To get this to work you need to:
- create all local users in LDAP (if they don't exist already)
- move homedirs to nurdservices (fix ownership because LDAP-users have a different UID)
- delete local users (optional)
- delete local homedirs
- install libnss-ldapd and libpam-ldap
- config the binddn (read-user) in nslcd.conf (this is needed to look up the cn based on the UID the user inputs)
- mount /home from nurdservices over nfs
- restart nslcd and nscd
- if sudo doesn't work until you type 'id': lower the minimum_uid to 100 instead of the original 1000 in /etc/pam.d/common-* (why this works is kind of a mystery)
Also useful: http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian#NSS_configuration
To do
- Read http://www.openldap.org/doc/admin24/slapdconf2.html
FTPdnevermindSambanevermindGet a certificate,Cert installed for ldap.nurdspace.nl. Allow access only over TLS as soon as this works (ldapsearch -v -H ldaps:/// -D uid=fwd,ou=people,dc=nurdspace,dc=lan -W -b dc=nurdspace,dc=lan)- Fix "nurdservices slapd[32524]: <= bdb_equality_candidates: (uid) not indexed" errors in /var/log/syslog
- Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
- Migrate all local users on Infra machines to LDAP
- Migrate all homedirs to Nurdservices
- Migrate wiki users and merge them with other users
- Use LDAP as userdb back-end for wiki (like so)
- Add all relevant fields of Wiki users to LDAP profiles
- Maintain Members page from LDAP (Like so, but this has limitations. Maybe only members details pages?)
- Maintain sudo'ers only through the LDAP and disable local root accounts (backdoor in case of emergency?)
- Disable all relevant services on Nurdserver v1