Central authentication and /home storage with caching

Question

I want to move my jumble of a home network (mixture of Windows / Mac clients) to run exclusively on Linux. The machines will all move to Linux.

Before I embark on this (sure to be fun) journey, here is my wish list:
1. Central authentication (believe LDAP is the best bet here)
2. Central profile storage for users so all files are accessible from any machine that logs on
3. Does LDAP help with some form of trust management i.e. user can run sudo on each machine, or would I manually need to update each machines sudoers file?

What do people think is the best to achieve the above, bare in mind the following "deal breakers" which I need:
1. Laptops must be able to authenticate when away from the house (i.e. no access to the LDAP/auth server)
2. Machines must cache user home directories, as above, so they are available when not connected to the network

Essentially what I'm after is the equivalent of a Windows domain with roaming profiles.

Bonus points to anyone who can tell me whether they think I would be better running Visual Studio in a virtual machine or via RemoteApp (i.e. which would be snappier assuming similar specc'd hardware).

Also - I have most experience with Debian and Ubuntu, but I'm open to what people would suggest - what server OS should I use? Clients will be Ubuntu.

Thanks in advance for everyone's help.

Answer 1

LDAP is appropriate for this set up.

Cached Authentication

SSSD is an alternative to pam-ldap and nss-ldap that caches passwords for offline use. It doesn't do anything with autofs maps stored in LDAP though. If you have just one file server with all of the home directories, you can use an autofs wildcard map and not worry about it.

Cached Home Directories

There is not really a turnkey solution for this on Linux like there is for OS X. The strategy is to mount the nfs home directory when on the network and use rsync to periodically synchronize the home directories.

TsumuFS looks like a promising turnkey solution, but I don't know how stable it is.

Trust Managment

In Ubuntu, there is a sudo-ldap package that will let you put your sudo configuration in LDAP. Nothing caches this, so you will be better of distributing your sudoers file with a configuration management system.

Answer 2

Instead of relying on centralized authentication (which generally also assumes a persistent connection), you might use something like Puppet (http://www.puppetlabs.com/) to replicate a set of users, passwords, etc to each managed host. Such an approach could allow disconnected operation, could distribute shadow password files, sudoers files, SSH public keys, and any network mount definitions ... or really any configuration/data you wish to share.

Might even incorporate something like Git (http://gitready.com/, http://git-scm.com/) as a means to sync files in a disconnected manner.

My own personal experiences with LDAP, Kerberos, centralized 'profile' storage, and roaming home directories have been painstaking, error prone, and time consuming. While it is theoretically possible to accomplish most of these requirements via these components, their practice is much more complex than might be worth managing on a home network. I completely agree with @mattdm.

Answer 3

It sounds like something like AFS (Andrew File System) will do what you are looking for here. It supports the client caching part, and uses kerberos for auth.

For the auth, that presents a problem.. I'm not aware of any authentication system that supports offline auth. You could cheat and do something like mirror /etc/shadow everywhere though.