6

What would you recommend as a way to manage users in a small Linux network, so that users only need to be created on one machine with them synchronized automatically on the others. Some are laptops that are not always connected if that matters. Currently only Ubuntu or Xubuntu machines exist, but this may change.

Also, a link to a tutorial for the tool if you're familiar with a good one.

Thank you!

4 Answers 4

5

Forget about any syncronization tools (of course you can use rsync in cron but it can lead to missycronized user passwords and corrupted during power failure passwd & shadow files)

Just use OpenLDAP just bacause it's standard solution that everybody use

Read: http://tldp.org/HOWTO/LDAP-HOWTO/

For home directories you can use SAMBA or NFS.

3
  • LDAP's a start, but how do you handle home directories?
    – jldugger
    May 3, 2009 at 19:16
  • 1
    How well does a ldap solution work for laptops? Don't you need to be connected pretty much all the time?
    – Zoredache
    May 3, 2009 at 19:40
  • Best way to handle home directories, IMO, is to use the automount daemon and have an NFS share that gets mounted as needed (when someone logs in). You can mount it at /home and you're good to go. As for laptops, nscd (Name Service Cache Daemon) can potentially help, but I'd recommend setting up matching local auth for it. It's not worth the risk of getting locked out of the machine because you don't have network access. May 16, 2009 at 0:20
1

Take a look at puppet. In addition to user management, you can do package, service and configuration management. Puppet runs in a client / server model, using ssl certificates to secure traffic, so you can even use it to push configuration to anyone who can connect to the puppet server

1

Ideally you'd want to use LDAP for this so password sync, you can disable globally etc

As a hacky way you could simply have a cron to scp the /etc/passwd file from one machine to others. Although if you did that you'd have to make sure users always change their password on this one machine rather than another.

-2

what I use are 2 options.

Option 1: if theres a windows machine that you can throw 2003 or 2008 server on you can use like-wise open on the ubuntu machins and use domain users. Like-wise will even auto create home directories. then you can couple this with pam auto mount to auto mout a cifs share from the windows machine on login and unmount on logoff.

Option 2: if no windows machine you can also have pam auth users via a mysql database backend. Simply add users to the mysql database and they will exist on all machines then use nfs automount to mount home directories. This option will even preserve permissions accoss machines easily as the nfs server can pull auth from same database table. for this you would want a dedicated mysql server with highest security and a "need-to-access" policy. I use iptables, fail2ban and strong passwords for this.

Both are fairly easy to setup and both work well.

1
  • if your going to downvote an answer that is proven to work you should at least post a comment why your downvoting
    – BrierMay
    Jan 18, 2013 at 4:39

Not the answer you're looking for? Browse other questions tagged .