0

I have been goolging around LDAP these days. And I'm trying to deploy a central authentication server for quite a few ubuntu servers.

After all the research, one question come to my mind.

Where are LDAP user's home stored?

Are they stored in the LDAP server (the central one who manages all?).If so, what if we have a huge expansion, and the original server does not meet the needs more. Should we migrate it to another machine? Or is there a way to cluster it?

If not, are they stored on client machines? When user logs into different servers, they have different homes?

How is LDAP acls talk to client acls? If I have www:www on some of the client machines, how do I allow certain users to access them?

THX.

Improve this question

2 Answers 2

Reset to default
2

Your LDAP database only holds metadata about your users. The path name of the user's home directory will be in there (because that's metadata), but the home directory itself will not (because that's data). Shared/non-shared home directories is a problem entirely orthogonal from where user metadata is stored. You can have shared home directories (via NFS, AFS or something else) entirely independent of how you store and distribute the user information. Or you can have a home directory per machine. It's totally your choice.

Improve this answer
2
  • So it's like storing /etc/passwd /etc/group for all clients? Does ACL still behave normally like there is no LDAP, just with reading user/group info from LDAP server?
    – Qiaosen Huang
    Jul 16, 2015 at 6:18
  • 1
    Yes, it is exactly like that. It's the same information, the only difference is if it's stored in local files or an LDAP database.
    – Calle Dybedahl
    Jul 16, 2015 at 7:13
0

PAM use for user authentication https://wiki.debian.org/LDAP/PAM

When user logs into different servers, they have different homes?

Yes.

How is LDAP acls talk to client acls? If I have www:www on some of the client machines, how do I allow certain users to access them?

You need to read about ACL (setfacl, getfacl)

Also you need to read about SAMBA (PDC) http://www.unixmen.com/setup-samba-domain-controller-with-openldap-backend-in-ubuntu-13-04/

Improve this answer
2
  • Thx, so the LDAP client will automatically "download" server's users/groups and "stores" them locally. And all the ugo relations will behave normally like the LDAP users were created locally?
    – Qiaosen Huang
    Jul 16, 2015 at 6:54
  • > Thx, so the LDAP client will automatically "download" server's users/groups and "stores" Yes. You can use command "getent passwd" for list users. > And all the ugo relations will behave normally like the LDAP users were created locally? Did you read about Samba (PDC)?
    – darkhex
    Jul 16, 2015 at 7:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .