1

I have the use case that on default all users are working within remote mounted home directories. However, sometimes they prefer a local home on one or more machines, e.g. because the network is too slow, data is too big, etc.

Thus, I like to set up the following:

  1. Users are distributed via LDAP
  2. On default, users get their remote home folder, e.g. /mnt/smb/$SERVER/$USER
  3. If a home folder at /home/$USER exists (symlink or folder) this should be choosen and set as $HOME-env etc.
  4. If a home-directory needs to be created (because it points to /home/$USER), it should be created with ecryptfs

In short: Do not define the user's home directory globally but on machine-level with a default location.

Current status:

  1. OpenLDAP with authentification etc. is up and running. homeDirectory is set to /home/$USER in LDAP
  2. Remote folder is mounted using pam_mount with hardcoded server and location to /smb/$USER
  3. If an user wants to use his remote folder on a machine, he symlinks /home/$USER to /smb/$USER. On the other side, an empty directory (or a copy of /etc/skel) is created manually if the user wants a local home folder.

ToDo:

  1. Get rid of the symlink (if possible)
  2. Make it possible to specify a dynamic remote server where the home folder resides
  3. Create an encrypted home folder (ecryptfs) if no local one exists or if it's impossible to mount the remote folder

While trying to implement it with the help of pam_script I came across several obstacles:

  1. Script is run as root, thus simply exporting a new $HOME-variable does not take any effect
  2. ecryptfs-utils are horrible documented and have many shortcomings. There is no possibility to specify manually the user's home directory. Afaik it's taken from getent which would be the mount-point of the remote folder and not of /home/$USER
Improve this question
2
  • Use pam_env to tinker with the user environment. The HOME variable is obtained from the environment state prior to execution of the login shell. You can play with your environment and invoke bash --login to experiment. Conditional invocation of pam_env can be achieved using the extended syntax supported by Linux-PAM to jump over lines. Search the pam.conf manpage for "more complicated syntax".
    – Andrew B
    May 5, 2015 at 19:52
  • pam_env seems to be the solution for my $HOME-env problem. However cryptfs-utils will still use the $HOME in passwd which is always the remote one (source). I doubt that's even possible to trick it... Maybe I need another start like conditional home folders in LDAP. I didn't find any hints on this but this would solve the whole pam rewriting and would be much cleaner as an administrator can manage it and won't need any user interaction.
    – Noxx
    May 6, 2015 at 6:14

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .