2

I'm trying to find the easiest/best way to manage a handful of users (four, right now) and authorization to multiple applications on my Fedora server right now. I'd like there to be one password per user for all of these systems, and authorization does not need to be terribly fine-grained.

The systems I'm working with, and some examples of how I'd like to use auth, are:

  • SSH
  • Apache (limit certain directories to authenticated users)
  • Subversion (allow r/w for authenticated users, nothing for everyone else)
  • Trac (require authenticated user to any type of access)

Would LDAP (which I've never worked with) be the best choice for this?

5 Answers 5

4

LDAP

SSH is a nice option to go for, but if you're looking to implement any more services that depend on centralized authentication, I'd suggest you look at some kind of LDAP implementation, like OpenLDAP. Its wildy popular, and can be integrated into all of the services you mentioned above. Plus, its easy to add new users and have them available anywhere you need them, as long as whatever you're needing to integrate it with has an LDAP plugin. Add in SSL/TLS security (possible, not required) and you're all set.

LDAP is definitely the way to go. Steep learning curve, as I've actually just experienced, but after you get past that, it works wonderfully.

1
  • Agreed. We actually use Novell eDirectory's LDAP implementation, because it gives us some auditing and aggregation capabilities that we need in a much larger environment and our licenses are cheap thanks to being gubmint. Aug 4, 2009 at 22:12
1

LDAP should work for all of those, or PAM and thus LDAP, but you might also think about RADIUS. The key difference is that Radius will proxy to a 3rd party server so you can add two-factor auth down the road. Also, radius is a lot simpler. You can even have the auths go from SSH on linux to AD using the MS Radius plugin. HR can then manage the users. Same for freeradius/openldap, of course. (not that it sounds like a requirement. ;)

Here's a how-to apache & mod radius: http://www.wikidsystems.com/support/wikid-support-center/how-to/two-factor-authentication-for-apache-2.2-or-higher

Here's one that uses apache * ldap for a automated scanner, but you get the drift: http://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-add-two-factor-authentication-to-the-seccubus-automated-vulnerability-scanner

Here's a how to on ssh & pam-radius: http://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-secure-ssh-with-two-factor-authentication-from-wikid. Just ignore the two-factor auth bits.

Essentially, any other service like SVN, you want to use PAM and have pam handle the auth via ldap, radius or local accounts.

HTH

1

LDAP is definitely the way to go.

Apache and SVN are probably the easiest place to get started. Have a look at this guide.

Once you've got this working, shouldn't be to hard: http://trac-hacks.org/wiki/LdapPlugin

SSH is a bit trickier (and more catastrophic if you misconfigure it). You need to configure a Pluggable Authentication Module (PAM) on your OS then point the SSH config to it. This guide shows you how: http://directory.fedoraproject.org/wiki/Howto:PAM.

0
0

Have a look at Free IPA for nice set of wrappers/UI around the lower level tasks of user management.

-1

Why don't you simply use SSH?

Apache, Subversion and trac could live in a little private network that can only be reached by ssh'ing onto a server at the front that does the authentication. From there, users could open port fowardings to the other three services.

3
  • My users are not sysadmins (neither am I, really), so opening up a shell isn't a viable solution.
    – brianz
    Aug 4, 2009 at 20:00
  • Well, maybe they can't deal with a shell, but: 1) You don't have to be a sysadmin to be able to open a shell. and 2) they wouldn't even have to type anything inside the shell.
    – innaM
    Aug 4, 2009 at 20:13
  • I should have clarified...my users aren't even computer folk, so I'd like to avoid any type of terminal. In any case, my lack of knowledge here is preventing me from understanding how your suggestion would actually work, but I appreciate it nonetheless.
    – brianz
    Aug 4, 2009 at 20:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .