1

2016 is coming. We still use openldap.

I have openldap server from ubuntu 12.04 with existing users. It provides the authentication layer in addition to containing the user, group, and machine account information on ubuntu hosts through sssd.

I have samba file server on ubuntu, which is authenticate users througth pam and standart system accounts. I use pam_smbpass.so pam module to sync usernames/passwords in tdb samba db on fileserver. It's no good workaround, because users must pass authenticate first on ftp service. Then they be able to access samba shares.

I decided to migrate ldap server from 12.04 to 14.04 and found a new package slapd-smbk5pwd in 14.04. It will contains smbk5pwd openldap module. This module can update passwords for samba-specific attributes, like sambaNTPassword.

I successfully carried out migration of ldap catalog on the new version of ubuntu on the test container with samba scheme for test smbk5pwd module. But faced with absense of samba-specific attributes.

I must wrote a script to update existing users with proper samba attributes, like sambaSamAccount, etc. It is well documented at ibm kb. There is no problem for me.

But in that case my already difficult algorithm (I use phpldapadmin to add new users) becomes more complicated. It will be necessary to add additional attributes to the new user manually. Every time I must generate the new sambaSID, and update user in catalog with templated ldif file.

There is smbldap-tools package, and smbldap-useradd utility. But I never used them. Maybe I should create users through smbldap-useradd only ? It will be enough for ubuntu machines auth and samba server?

What problems I can face in such scheme?

Is there are more easy ways to support users in my case ?

What about migration to freeipa or samba4 ?

Samba4 must be expanded with many of standart unix schemas. Is it possible in the real world?

Most of all our desktops is ubuntu and macosx systems. We also need sudoers and ppolicy scheme to lock accounts and be protected from bruteforce.

2 Answers 2

0

Just sharing my experience.

My organization's data are on OpenLDAP. OpenLDAP is going to remain.

We planned to pair OpenLDAP with samba4 with AD support. It is another Directory service: it can't be based (yet) on OpenLDAP (maybe release 4.4, but nobody sure, now).

But there is a handy tool to migrate data from OpenLDAP to AD (samba4 is compliant): lsc

Of course you need some special magic mech to keep password in sync: but I think you are able to devise it.

Just a real use case,

5
  • There are existing official tool to migrate from openldap to samba4. But it won't help us. Because we want to continue use specific components for unix workstations, like ppolicy module and sudoers scheme. But as far as I know sudoers cannot be integrated to samba internal ldap server. Also we cannot rewrite ppolicy module for samba4 etc.
    – vskubriev
    Dec 4, 2015 at 13:35
  • I did't mean that. They both shall work au-pair. We are going to export data from OpenLDAP to samba4 but to keep them in sync.
    – 473183469
    Dec 4, 2015 at 13:47
  • How do you want to implement syncing between samba4 and openldap (via lsc) ? I know that samba4 internal ldap server has some hardcoded internal features, that are not compatible with standart ldap servers like as 389ds or openldap.
    – vskubriev
    Dec 7, 2015 at 6:13
  • We have OpenLDAP as provider and samba4's internal directory service as consumer. Please look lsc example about OpenLDAP -> AD replicas. Of course you need to run in cron (or async from syncrepl).
    – 473183469
    Dec 8, 2015 at 17:01
  • Well good. So you still use openldap along with a samba4. And how I can understand it is possible with lsc scripts. But you said in answer about migration. This is confused me.
    – vskubriev
    Dec 9, 2015 at 9:30
0

I am working at Univention and unless you want to reinvent the wheel, I suggest you to take a look at Univention Corporate Server (UCS), which is a free, Debian-based, enterprise level operating system. It should be able to satisfy your needs because it works also well as a domain/identity management for heterogeneous environments. It comes with the features you mentioned:

  • OpenLDAP where you can connect all the *nix clients to
  • Samba (4) AD directory where you can connect all the Windows clients to
  • a service called "univention-s4-connector" that syncs all relevant information and attributes between both directory services immediately
  • a nice web-based administration interface that is much prettier than phpldapadmin ;)

All that is backed by Univention, so if you need professional support there's someone to call. If you want to use the free "Core Edition", which is fully-featured, you can also contact the Univention forum for questions. More information on UCS on Univention's website.

I hope, I was able to help you!

Best regards, Maren

By the way, just in case: There will be an easy way to configure sudoers with one of the next errata updates. Password policies are implemented via Univention policies, see UCS manual

3
  • Thank you. I have heard of this product, but forgot about it. Now I will look at it again. Earlier we used zentyal. But decided to refuse it because it was required to change manually a lot of things in it to fit our needs. For example sudoers, ppolicy etc. It will be neccessary to analyze this product very deeply, before started using it.
    – vskubriev
    Dec 8, 2015 at 11:17
  • HI Vladimir, read what I added to my answer. We will publish an errata update on the issue of sudoers, probably in the next few days. I recommend to wait for that before you start the tests. Dec 8, 2015 at 13:29
  • Ok, I will wait.
    – vskubriev
    Dec 8, 2015 at 14:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .