Roaming user profiles in Linux

Question

My company is evaluating a plan to migrate from Windows to Linux. Can you suggest something in Linux analogous to roaming user profiles and domain users in an Active Directory environment?

Answer 1

There's actually not one solution to this, but a kazillion.

The single sign-on that Active Directory does, is nothing more than Kerberos and delegation of credentials. We can do that too, using a Linux KDC or your old domain controllers. No problem: there's your domain users.

Roaming profiles exist (iirc, my Windows days are far behind me) in different forms: you can have the user data on a network share, or you can have (a part of) the user data on the local filesystem and some more data of the same user on a network share.

Both are possible, though the first is easier: with a something like NFS, or even GFS (which has some brilliant features for using it as a filesystem for shared home-directories), having home-directories - and thus user profiles - on the network is easy. Just make sure to use NFSv4 (or Kerberos enabled NFSv3, if you cannot pull off NFSv4) to provide some security and integrity of your data.

Having parts of the user data on a share and parts of it locally either means mounting, for example, /home/user/Documents over NFS again or using one filesystem to 'lay over' another one. I'm not sure how robust that is though, and I'd recommend you go for option 1: everything on a network share.

I'd also recommend hiring someone how know his Linux, btw. It's going to be tough to do this and be successful - both financially and technically - if you are doing this all for the first time. Good luck.

Answer 2

You may want to look into the 389 Directory Server Project (Formerly FedoraDS) which is an LDAP server. http://directory.fedoraproject.org

It would take the place of Active directory (it is completely configurable to do tls authentication and provides a new GUI for an admin).

Then you set up NFS shares on a server (as wzzrd mentioned), set your automount configuration files on your local machines, and you should be all set. What you would get is a single login (handled via LDAP/389DS) with remotely mounted directories, as long as one of them is the users home directory (auto.home) then a user would get their home directory mounted on login which is exactly what you want.

Answer 3

Not really an answer but I've noticed that windows explicitly separates roaming data from local data.

The following folder is not included when synchronising your profile on log on/off (winxp path).

C:\Documents and Settings\tim\Local Settings

however most other folders are. You can also set explicit exclusions on the server which the client will obey.

As far as I know most linux apps and distributions make no attempt to separate out things which should be syncronised (documents and settings) and things which shouldn't (eg the nautilus thumbnail cache, which can be huge).

I'd love to see a resolution to this, both in terms of complete migration to linux, and also interoperability for mixed environments (linux clients making use of profile facilities provided by windows servers).

I suggest bearing this in mind when setting up a solution, as synchronisation of over-sized profiles are a regular cause of slow log on/off complaints for windows users.