Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm looking into building a more unified user and workstation management system and I thought it would be a good idea to ask others how they have solved the apparent issues.

I would use LDAP for user management and have the home directories mounted over NFS to the workstations, which is quite straight forward and which would also result in "roaming profiles".

But what would be a sort of best practice for managing the workstations? Management would in this case include updating, installing and removing packages, updating configuration files, dist-upgrade:s and so on. Preparing new workstations (semi-) automatically might also be of use.

I'm building everything on Debian and I'd like to do it "the Debian way". Please tell about your experiences, even if they'd be with other distributions.

//DGnome

share|improve this question
add comment

4 Answers

up vote 2 down vote accepted

As far as user management goes, you'd want to look at doing LDAP authentication. NFS is a good solution for home directories. One small problem with NFS is that it becomes a single point of failure; if the NFS server dies, then all your workstations become completely useless. Any process that accesses a file on the NFS server will block until the NFS server returns.

As far as managing the workstations, we use Puppet, which is incredibly useful. It allows you to describe in a declarative way how you want your workstations to look like and it reconfigures them to make sure they look the right way. You can create files, install packages, create users etc, and build up constructs to make higher level tasks. We have starts trialling using Puppet to do security updates. We're a little wary of automatically upgrading everything, because we don't want to restart important services, and we don't want to do everything by hand. More experience will show if this is a suitable approach.

share|improve this answer
1  
LDAP user management is of course to be combined with krb5 for user/password management. –  wazoox Jul 3 '09 at 16:48
    
@wazoox, +1 for kerberos authentication. @David Pashley, +1 for a nice, thorough description of a functional setup. –  Avery Payne Jul 3 '09 at 17:45
    
Why not use NIS? Installing and maintaining it is pretty simple, compared to LDAP and/or krb5. –  pjc50 Jul 17 '09 at 16:38
    
It's not as flexible. It can't store as much information. It can't be used for interoperating with other operating systems. It can't be replicated as well LDAP. LDAP allows you to split your administration. They're just the few I can think of off the top of my head. –  David Pashley Jul 17 '09 at 19:03
add comment

I'm managing ~70 Servers with cfengine2

I would suggest, you let cfengine do the whole configuration management.

You can also have a look at cron-apt for automatic installation of updates.

share|improve this answer
add comment

You might be interested in using puppet or cfengine for managing your configurations.

There's also expect to automate administrative tasks against many workstations

share|improve this answer
add comment

Try and keep as many of the customizations as you can inside a "my-company-customizations" .deb, which you keep on an internal repository linked from sources.list. Then, you can make a policy change in one place (a newer version of the package) and then just apt-get update your machines.

Config files are a special case - dpkg isn't great at keeping track of them if they are provided by two different packages (see this debian-devel thread). If you can't add an override config file without disturbing the packaged ones (and many Debian-packages utils let you drop files in a conf.d directory), then consider cfengine/puppet as Maxwell suggests.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.