Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I run the network for a small company ( with 10 software developers and a laboratory ( with 5 scientists. But the total number of people is 12, as 3 of them work both for the lab and the company. In some sense, the lab is a subsidiary of the company.

Though there are two different domain names (with emails and JIDs in them), the lab and the company share a common server.

At some point we've decided to move the users to LDAP to run a slave LDAP replica at the office and have a centralized auth. That is not a problem if there was a single company, but with two of them I get stuck.

  1. LDAP base: one or two?
  2. LDAP base: dc-based or o/ou-based?
  3. The way to distinguish users 'company/lab'? should we still use groups for that (we have users/groups in passwd/groups now)

On some PCs I would like to have all of them, but some will have to filter users (we are running Linux and some FreeBSD sometimes, so pam_ldapd is our choice)

And, I'll prefer to store sudoers info in LDAP also.

And, we are running Exim4 MTA + Dovecot LDA and it would be great they could automatically decide the domain-part if a single username is given (again, making them using LDAP is not a problem for a single company setup). Note that those people who work both for the company and the lab have both email addresses that actually map to a single maildir :)

Any recipes and ideas appreciated.

share|improve this question

migrated from Apr 27 '12 at 7:18

This question came from our site for computer enthusiasts and power users.

up vote 0 down vote accepted

Ok here's how I would do it:

  1. One LDAP base, always one LDAP base. Even if the suite of tools you're using supports multiple, somewhere along the lines you'll need to use something that doesn't. Disclaimer: I've never even tried.

  2. I always use dc based now. It's much easier to remember and having a DNS structure which matches the LDAP structure just feels more intuitive for me. Saying that, I have had problems getting certificates issued in the past.

  3. Two groups with some common members definately feels the right way forward.

As far as sudoers are concerned, on Linux I always just set up groups in the sudoers file and then add and manage the groups using LDAP. I know you can build sudo to use LDAP natively but it doesn't come like that on any of the platforms I use so I don't.

I've only played with exim and dovecot but I would set up both MX records to point at the same server and have users configure their from and reply-to addresses as they see fit.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.