I have recently setup Ubuntu ldap client authentication
on karmic and lucid desktop clients and the ldap server is running on an 10.04 LTS server and this is the link I followed for client setup and probably this also works for 11.04. I could able to login to clients with the ldap user accounts and also, on the clients I used an entry session required pam_mkhomedir.so umask=0022 skel=/etc/skel
in pam.d/common-session
to automatically create the home directory on client computers when the user logs in for the first time. I guess there would be a way to synchronize the home directory from Client to Server and vice-versa so that users have their documents on which ever the client they login to.
I have the below task left to be done:
- Synchronize the home directories between client and server(just like roaming profile in windows).
I tried with autofs
but the problem is with local user accounts(admin, guest) on client computers which also gets synchronized or overwritten(which I don't want them to get mounted) when I place the entry * server:/ldaphome/&
in /etc/auto.home
to get the ldap user's home directory synchronized(included the entry /home /etc/autofs.home
in /etc/autofs.master
).
Anybody has any trick to do this or with any other way so that I can login to clients with both ldap and local user credentials having the home directory synchronized for ldap users?. I know many masters are here, how one would do this with their style?.
Update:1
I tried autofs
automounting of different directory(ldaphome) other than home
on a client and I tried to link the ldaphome/$USER
and home/$USER
on the same client so that when the ldaphome on server mounts ldaphome on client, user's home directory home/$USER will be synced because of symlink. So I edited /etc/profile.d/custom.sh
file and placed ln -sf "/ldaphome/$USER" "/home/$USER"
to link those directories at the login. I realized symlinks doesn't work as expected for directory as it's creating a link name under /home/$USER/$USER.
DROPPED THIS SYMLINK METHOD!
Update:2
It feels no way other than changing the local user's home directory on clients and auto-mounting the home
directory in autofs
but the same local admin user on clients which I am aiming to secure is also available as user accounts on server(admin, guest)...
Update:3
I compromised just moving(usermod -m -d /local-home/admin admin
) the already existing local user accounts to different home directory and then I setup automount for home
on client. Again I fell into problem, once the client is authenticated by ldap, it's not fetching the home documents from server but works only if I manually mount it(mount ldapserver:/ldaphome/test /home/test
) on the client. The client is karmic
...
Client Config:
vim /etc/nsswitch.conf:
# pre_auth-client-config # passwd: compat
passwd: files ldap
# pre_auth-client-config # group: compat
group: files ldap
# pre_auth-client-config # shadow: compat
shadow: files ldap
hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
# pre_auth-client-config # netgroup: nis
netgroup: nis
vim /etc/ldap.conf:
base dc=mydomain,dc=net
uri ldap://192.168.1.2
ldap_version 3
rootbinddn cn=admin,dc=mydomain,dc=net
bind_policy soft
pam_password md5
nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,games,gdm,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,vboxadd,www-data
vim /etc/ldap/ldap.conf:
BASE dc=mydomain,dc=net
URI ldap://192.168.1.2
SIZELIMIT 0
TIMELIMIT 0
DEREF never
# TLS certificates (needed for GnuTLS)
TLS_CACERT /etc/ssl/certs/ca-certificates.crt
vim /etc/auto.master:
+auto.master
/home /etc/auto.home
vim /etc/auto.home:
* 192.168.1.2:/ldaphome/&
I shared ldaphome
at the server(192.168.1.2). Now the problem is I have /home
as a separate partition on client and I unmounted it in fstab
and mounted it with ldaphome which you could see in autofs config. When I try to login with ldap, after successful authentication, it again takes to the login screen. When I stop autofs
service, it normally logs in creating the home directory as I used session required pam_mkhomedir.so umask=0022
in pam.d/common-session.
When I try to login for the first time with any new ldap account it gives the following error:
Creating directory '/home/user3'.
Unable to create and initialize directory '/home/user3'.
No directory, logging in with HOME=/
vim /var/log/auth.log:
lucid mkhomedir_helper: PAM unable to create directory /home/user3: No such file or directory
/home
partition for your clients? I've tried this and have since settled on using/export/home/<USERNAME>
. I leave/home
for local system accounts. Anyways, so I ran into the same issue but I'm using winbind to authenticate with Active Directory. I'm able to automatically create the home directories locally but wasn't able to remotely using autofs. My fix? You know who all your users are so create their home folder on the NFS server first./home
is a separate partition of 30GB which mount nfs share/ldaphome
on server. Any trick to play?.