For use with SpaceNet we've installed OpenLDAP on nurdserver. On the new Nurdserver v2 we're going serious with LDAP.
Working implementations on Nurdserver v1 (nurdserver)
- Spacenet
- Samba on NURDServer
- vsFTPd on NURDServer
Working implementations on Nurdserver v2 (nurdservices)
- NFS export
To do
- Spacenet
- FTPd
- Samba?
- Get a certificate, allow access only over TLS
- Create homedir on NFS-export when adding a user to LDAP
- Change password on first login doesn't work in FusionDirectory
- Migrate all local users on Infra machines to LDAP
- Migrate all homedirs to Nurdservices
- Fix storage on Nurdservices (current VM is 32GB)
- Migrate wiki users and merge them with other users
- Use LDAP as userdb back-end for wiki
- Add all relevant fields of Wiki users to LDAP profiles
- Maintain page from LDAP
- Maintain sudo'ers through the LDAP and disable local root accounts (backdoor in case of emergency?)
- Disable all relevant services on Nurdserver v1
Status
I've installed FusionDirectory on a new VM called nurdservices on the proxmox system of Nurdserver v2. I've also added a couple of users to it.
It can be accessed on http://nurdservices/fusiondirectory from within the network.
On Sinterklaas I've got it to work as I think it should be for the local users that existed:
- Homedirs moved to an nfs mount from Nurdservices
- Local homedirs and users deleted
- /home/ is mounted on boot over nfs
- LDAP users can log in and see their homedirs as if nothing has changed
Setting up other workstations in this way
To get this to work you need to:
- create all local users in LDAP (if they don't exist already)
- move homedirs to nurdservices (fix ownership if needed)
- delete local users
- delete local homedirs
- install libnss-ldapd
- mount /home from nurdservices over nfs
- configure the ldap in nss and pam (no ssl, so ldap://nurdservices/)
- and add a line to /etc/pam.d/common-account:
session required pam_mkhomedir.so skel=/etc/skel/ umask=0022
This step will no longer be needed once homedirs are created when you add a user to the LDAP.