5

I want to move my jumble of a home network (mixture of Windows / Mac clients) to run exclusively on Linux. The machines will all move to Linux.

Before I embark on this (sure to be fun) journey, here is my wish list:

  1. Central authentication (believe LDAP is the best bet here)
  2. Central profile storage for users so all files are accessible from any machine that logs on
  3. Does LDAP help with some form of trust management i.e. user can run sudo on each machine, or would I manually need to update each machines sudoers file?

What do people think is the best to achieve the above, bare in mind the following "deal breakers" which I need:

  1. Laptops must be able to authenticate when away from the house (i.e. no access to the LDAP/auth server)
  2. Machines must cache user home directories, as above, so they are available when not connected to the network

Essentially what I'm after is the equivalent of a Windows domain with roaming profiles.

Bonus points to anyone who can tell me whether they think I would be better running Visual Studio in a virtual machine or via RemoteApp (i.e. which would be snappier assuming similar hardware).

Also - I have most experience with Debian and Ubuntu, but I'm open to what people would suggest - what server OS should I use? Clients will be Ubuntu.

Thanks in advance for everyone's help.

2
  • Just how many machines are we talking here? Feb 18, 2011 at 2:34
  • About 10 machines with4 laptops
    – Sam
    Feb 18, 2011 at 2:39

3 Answers 3

3

LDAP is appropriate for this set up.

Cached Authentication

SSSD is an alternative to pam-ldap and nss-ldap that caches passwords for offline use. It doesn't do anything with autofs maps stored in LDAP though. If you have just one file server with all of the home directories, you can use an autofs wildcard map and not worry about it.

Cached Home Directories

There is not really a turnkey solution for this on Linux like there is for OS X. The strategy is to mount the nfs home directory when on the network and use rsync to periodically synchronize the home directories.

TsumuFS looks like a promising turnkey solution, but I don't know how stable it is.

Trust Managment

In Ubuntu, there is a sudo-ldap package that will let you put your sudo configuration in LDAP. Nothing caches this, so you will be better of distributing your sudoers file with a configuration management system.

2
  • wrt. TsumuFS, doesn't look like it's been overly active, there is a fork over on github which includes a couple of fixes if you're looking to try it out: github.com/mikebryant/tsumufs.
    – slm
    Nov 25, 2012 at 3:11
  • Looking at the SSSD website they mention that they can now support the distribution of sudo's sudoer file. See the section of the FAQ: fedorahosted.org/sssd/wiki/FAQ, "How do I configure caching of sudo rules or autofs maps?" The direct link to how to set this up is here: jhrozek.livejournal.com/2065.html
    – slm
    Nov 25, 2012 at 3:45
1

Instead of relying on centralized authentication (which generally also assumes a persistent connection), you might use something like Puppet to replicate a set of users, passwords, etc to each managed host. Such an approach could allow disconnected operation, could distribute shadow password files, sudoers files, SSH public keys, and any network mount definitions ... or really any configuration/data you wish to share.

Might even incorporate something like Git as a means to sync files in a disconnected manner.

My own personal experiences with LDAP, Kerberos, centralized 'profile' storage, and roaming home directories have been painstaking, error prone, and time consuming. While it is theoretically possible to accomplish most of these requirements via these components, their practice is much more complex than might be worth managing on a home network. I completely agree with @mattdm.

1
  • As to "equivalent of a Windows domain with roaming profiles" One of the few pieces of well-written software to ever come from Microsoft is Active Directory. It's ability to unify LDAP, Kerberos, GSS-API, DNS SRV lookup, and other software dances are truly one of Windows Server's least appreciated features. That said, it is also built on the assumption of a homogeneous, Windows network. It is possible to replicate this feature set in Linux yourself - but be prepared to become an expert in the aforementioned topics before you are likely to be successful. Feb 18, 2011 at 4:18
0

It sounds like something like AFS (Andrew File System) will do what you are looking for here. It supports the client caching part, and uses kerberos for auth.

For the auth, that presents a problem.. I'm not aware of any authentication system that supports offline auth. You could cheat and do something like mirror /etc/shadow everywhere though.

1
  • I'd really caution anyone against any serious new deployment of AFS. And I can't imagine someone wanting to inflict administration of it on themselves for a home network. As a specific point, while it supports client caching, disconnected operation is a different story. There's some unfinished experimental code in the development tree if you really want to be on the bleeding edge of deep left field.
    – mattdm
    Feb 18, 2011 at 3:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .