I'm using CentOS 5.3 to connect to use Kerberos for authentication and LDAP for user information. Unfortunately, the home directory for all users as stored in LDAP is "/". Very bright! So, that doesn't work. Without having any access to LDAP, I need to figure out how to force users to use the local directory "/home/username" as HOME.

I've tried editing /etc/bashrc but it seems like at that point it's too late to set HOME. Plus, I might need to edit the user's default shell, which is also stored in LDAP. Doesn't seem like changing the local /etc/bashrc would help because it might not even be loaded!

So, when using these components -- Kerberos, LDAP, pam, autofs -- when and where can I specify the environment for my users, if necessary overriding the environment set in LDAP?


  • 1
    Is there a reason you can't change the home directory in ldap? It seems to me that is the best place to change it. If your concern is bulk updates to many users, that sort of thing can be scripted relatively easily with ldapsearch and ldapmodify. – Mark Jun 23 '09 at 21:42
  • I completely agree! Unfortunately, and frustratingly, I don't have permission from my organization to alter the directory in any way. – hourback Jun 25 '09 at 13:30

Warning: Ugly hack ahead! The best thing will of course be to change the data in the LDAP server, and save your self the trouble, but here it goes:

Add the following line at the end of /etc/security/pam_env.conf:

HOME           DEFAULT="/home/@{PAM_USER}"

This will override the users $HOME variable to point to the right directory. However, this is only set after login, so you'll still get an error that login can't find the users home directory. 2nd phase of ugly hack is to add a "cd ~" at the end of /etc/profile, which will bring your user to the right home directory. Hopefully at this stage you'll be able to use automount to map the home directory to the correct NFS server

| improve this answer | |
  • Thank you very much! I think your answer would have worked, but I was unable to finish that project before I moved on to my new job. – hourback Oct 24 '12 at 15:47

I agree with Mark, your best bet would be to modify the entry in LDAP.

If you can't do that, I can suggest something that is a major hack but would get the job done:

Instead of doing the lookups directly to LDAP, use nsscache to pull user data from LDAP. Then in the same cron job that will periodically update cache, add a script that will rewrite the home directory attribute for the users to the one you want. You could also do this by modifying the nsscache source directly.

You can use a similar method to alter the default shell.

This will also have the nice side-effect of reducing/mostly eliminating queries to your LDAP server :)

| improve this answer | |

Have you configured NSS to talk directly to the LDAP server, or are you going through a proxy such as nslcd? If so, look into configuring the proxy to rewrite the user's home directory attribute. For instance, in nslcd.conf you can state:

map passwd homeDirectory "/home/$uid"

Which does the obvious thing.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.