Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using FreeBSD with ZFS to run several jails. For jail management I'm using ezjail, and I have a template jail which I use for provisioning.

I want to share passwd, groups, and authentication information across all jails and the host. For the jails it can be read-only.

Is there some mechanism which can share the host passwd, groups, etc. without any complex system such as LDAP/NIS/etc.?

share|improve this question
add comment

3 Answers 3

up vote 1 down vote accepted

LDAP or NIS is the Right Solution -- it's really not that complicated, and you should take a day and learn both (figure about half a day each to get the basics. Less if you buy the O'Reilly NIS book & LDAP book.
The big advantage here is you can centralize some accounts (administrative access/support users), authorize others on a per-jail basis, and still have local users on specific machines.


If you're really dead-set against LDAP or NIS the next best thing is to use Puppet, Chef, radmind, or similar to update the passwd and group files -- you can automatically synchronize the authentication/authorization files as part of a site-wide deployment process.
Automatic deployment tools have their own complexity issues, but also bring a number of benefits which may make them appropriate for your environment


The next step down is a cron job on the host system that copies standard passwd and group files to each jail at a set time. This is the simplest solution and works very well, though it is only a very small step up from copying the files yourself manually.

share|improve this answer
    
I know LDAP & NIS, but I simply would rather avoid it. radmind seems good, I was considering rdist aswell. But I thought there would exist a self-contained solution. –  n n Feb 26 '13 at 5:34
    
Is there a particular reason you want to avoid both of the standard, well-tested, generally-accepted-as-best-practice solutions? –  voretaq7 Feb 26 '13 at 16:12
    
Thanks @voretaq7, I just wanted a simplistic solution, I think I'll settle on cronjobs. –  n n May 16 '13 at 15:41
add comment

You could try hardlinks (ln(1)).

share|improve this answer
    
These jails are using ZFS, and so hard links do not cross filesystems. –  n n Feb 25 '13 at 2:51
add comment

If I remember right, then ezjail sets up a lot of directories and files in the default jail, that are shared across the other jails. I guess you could put users in there too. Maybe it's a bit of analysis first and manual work then.

But to be honest, I think this ruins your jails security. I normally create a jail to isolate as much as possible.

share|improve this answer
    
This would provision the initial users and groups, but would not keep them synchronized. –  Chris S Mar 10 '13 at 13:55
    
You're right, thanks! I missed that point. One more reason to not do it at all (from a security perspective) –  Sascha Mar 10 '13 at 14:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.