Revision as of 10:38, 4 April 2013

For use with SpaceNet we've installed OpenLDAP on nurdserver. On the new Nurdserver v2 we're going serious with LDAP.

Working implementations on Nurdserver v1 (nurdserver)

Spacenet
Samba on NURDServer
vsFTPd on NURDServer

Working implementations on Nurdserver v2 (nurdservices)

NFS export for homedirs
Spacenet

To do

FTPd
Samba?
Get a certificate, allow access only over TLS
Create homedir on NFS-export when adding a user to LDAP (maybe like this?)
Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
Migrate all local users on Infra machines to LDAP
Migrate all homedirs to Nurdservices
Migrate wiki users and merge them with other users
Use LDAP as userdb back-end for wiki
Add all relevant fields of Wiki users to LDAP profiles
Maintain page from LDAP
Maintain sudo'ers through the LDAP and disable local root accounts like so (backdoor in case of emergency?)
Disable all relevant services on Nurdserver v1

Status

I've installed FusionDirectory on a new VM called nurdservices on the proxmox system of Nurdserver v2. I've also added a couple of users to it.

It can be accessed on http://nurdservices/fusiondirectory from within the network.

On Sinterklaas, Vjdeb and the PrinterPC I've got it to work as I think it should be for the local users that existed:

Homedirs moved to nfs mount from Nurdservices
Local homedirs and users deleted (except user 'printer' on PrinterPC)
/home/ is mounted over nfs on boot
LDAP users can log in and see their homedirs as if nothing has changed

Setting up other workstations in this way

To get this to work you need to:

create all local users in LDAP (if they don't exist already)
move homedirs to nurdservices (fix ownership if needed)
delete local users (optional)
delete local homedirs
install libnss-ldapd
config the binddn (read-user) in pam_ldap.conf and nslcd.conf (this is needed to look up the cn based on the UID the user inputs)
mount /home from nurdservices over nfs
configure the ldap in nss and pam (no ssl, so ldap://nurdservices/)
and add a line to /etc/pam.d/common-account:

session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

This step will no longer be needed once homedirs are created when you add a user to the LDAP.

Also useful: http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian#NSS_configuration

@@ Line 7: / Line 7: @@
 = Working implementations on Nurdserver v2 (nurdservices) =
-* NFS export
+* NFS export for homedirs
+* [[Spacenet]]
 = To do=
-* [[Spacenet]]
 * FTPd
 * Samba?
 * Get a certificate, allow access only over TLS
 * Create homedir on NFS-export when adding a user to LDAP (maybe [http://documentation.fusiondirectory.org/en/documentation_faq/command_after like this]?)
-* Change password on first login doesn't work in FusionDirectory
+* Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
 * Migrate all local users on [[Infra]] machines to LDAP
 * Migrate all homedirs to [[NURDserver_v2|Nurdservices]]
-* Fix storage on [[NURDserver_v2|Nurdservices]] (current VM is 32GB)
 * Migrate [[wiki]] users and merge them with other users
 * Use LDAP as userdb back-end for [[wiki]]
@@ Line 31: / Line 30: @@
 It can be accessed on http://nurdservices/fusiondirectory from within the network.
-On [[Hp_dc5800_sinterklaas|Sinterklaas]] I've got it to work as I think it should be for the local users that existed:
+On [[Hp_dc5800_sinterklaas|Sinterklaas]], [[Dell_Optiplex_GX270|Vjdeb]] and the [[PrinterPC]] I've got it to work as I think it should be for the local users that existed:
-* Homedirs moved to an nfs mount from [[NURDserver_v2|Nurdservices]]
+* Homedirs moved to nfs mount from [[NURDserver_v2|Nurdservices]]
-* Local homedirs and users deleted
+* Local homedirs and users deleted (except user 'printer' on [[PrinterPC]])
-* /home/ is mounted on boot over nfs
+* /home/ is mounted over nfs on boot
 * LDAP users can log in and see their homedirs as if nothing has changed
@@ Line 41: / Line 40: @@
 * create all local users in LDAP (if they don't exist already)
 * move homedirs to nurdservices (fix ownership if needed)
-* delete local users
+* delete local users (optional)
 * delete local homedirs
 * install [http://wiki.debian.org/LDAP/NSS#NSS_Setup_with_libnss-ldapd libnss-ldapd]