2016 is coming. We still use openldap.
I have openldap server from ubuntu 12.04 with existing users. It provides the authentication layer in addition to containing the user, group, and machine account information on ubuntu hosts through sssd.
I have samba file server on ubuntu, which is authenticate users througth pam and standart system accounts. I use pam_smbpass.so
pam module to sync usernames/passwords in tdb samba db on fileserver. It's no good workaround, because users must pass authenticate first on ftp service. Then they be able to access samba shares.
I decided to migrate ldap server from 12.04 to 14.04 and found a new package slapd-smbk5pwd
in 14.04. It will contains smbk5pwd
openldap module. This module can update passwords for samba-specific attributes, like sambaNTPassword
.
I successfully carried out migration of ldap catalog on the new version of ubuntu on the test container with samba scheme for test smbk5pwd module. But faced with absense of samba-specific attributes.
I must wrote a script to update existing users with proper samba attributes, like sambaSamAccount
, etc. It is well documented at ibm kb. There is no problem for me.
But in that case my already difficult algorithm (I use phpldapadmin to add new users) becomes more complicated. It will be necessary to add additional attributes to the new user manually. Every time I must generate the new sambaSID, and update user in catalog with templated ldif file.
There is smbldap-tools
package, and smbldap-useradd
utility. But I never used them. Maybe I should create users through smbldap-useradd
only ? It will be enough for ubuntu machines auth and samba server?
What problems I can face in such scheme?
Is there are more easy ways to support users in my case ?
What about migration to freeipa or samba4 ?
Samba4 must be expanded with many of standart unix schemas. Is it possible in the real world?
Most of all our desktops is ubuntu and macosx systems. We also need sudoers and ppolicy scheme to lock accounts and be protected from bruteforce.