I have recently setup Ubuntu
ldap client authentication on karmic and lucid desktop clients and the ldap server is running on an 10.04 LTS server and this is the link I followed for client setup and probably this also works for 11.04. I could able to login to clients with the ldap user accounts and also, on the clients I used an entry
session required pam_mkhomedir.so umask=0022 skel=/etc/skel in pam.d/
common-session to automatically create the home directory on client computers when the user logs in for the first time. I guess there would be a way to synchronize the home directory from Client to Server and vice-versa so that users have their documents on which ever the client they login to.
I have the below task left to be done:
- Synchronize the home directories between client and server(just like roaming profile in windows).
I tried with
autofs but the problem is with local user accounts(admin, guest) on client computers which also gets synchronized or overwritten(which I don't want them to get mounted) when I place the entry
* server:/ldaphome/& in
/etc/auto.home to get the ldap user's home directory synchronized(included the entry
/home /etc/autofs.home in
Anybody has any trick to do this or with any other way so that I can login to clients with both ldap and local user credentials having the home directory synchronized for ldap users?. I know many masters are here, how one would do this with their style?.
autofs automounting of different directory(ldaphome) other than
home on a client and I tried to link the
home/$USER on the same client so that when the ldaphome on server mounts ldaphome on client, user's home directory home/$USER will be synced because of symlink. So I edited
/etc/profile.d/custom.sh file and placed
ln -sf "/ldaphome/$USER" "/home/$USER" to link those directories at the login. I realized symlinks doesn't work as expected for directory as it's creating a link name under /home/$USER/$USER.
DROPPED THIS SYMLINK METHOD!
It feels no way other than changing the local user's home directory on clients and auto-mounting the
home directory in
autofs but the same local admin user on clients which I am aiming to secure is also available as user accounts on server(admin, guest)...
I compromised just moving(
usermod -m -d /local-home/admin admin) the already existing local user accounts to different home directory and then I setup automount for
home on client. Again I fell into problem, once the client is authenticated by ldap, it's not fetching the home documents from server but works only if I manually mount it(
mount ldapserver:/ldaphome/test /home/test) on the client. The client is
# pre_auth-client-config # passwd: compat passwd: files ldap # pre_auth-client-config # group: compat group: files ldap # pre_auth-client-config # shadow: compat shadow: files ldap hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4 networks: files protocols: db files services: db files ethers: db files rpc: db files # pre_auth-client-config # netgroup: nis netgroup: nis
base dc=mydomain,dc=net uri ldap://192.168.1.2 ldap_version 3 rootbinddn cn=admin,dc=mydomain,dc=net bind_policy soft pam_password md5 nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,colord,daemon,games,gdm,gnats,hplip,irc,kernoops,libuuid,lightdm,list,lp,mail,man,messagebus,news,proxy,pulse,root,rtkit,saned,speech-dispatcher,sshd,statd,sync,sys,syslog,usbmux,uucp,vboxadd,www-data
BASE dc=mydomain,dc=net URI ldap://192.168.1.2 SIZELIMIT 0 TIMELIMIT 0 DEREF never # TLS certificates (needed for GnuTLS) TLS_CACERT /etc/ssl/certs/ca-certificates.crt
+auto.master /home /etc/auto.home
ldaphome at the server(192.168.1.2). Now the problem is I have
/home as a separate partition on client and I unmounted it in
fstab and mounted it with ldaphome which you could see in autofs config. When I try to login with ldap, after successful authentication, it again takes to the login screen. When I stop
autofs service, it normally logs in creating the home directory as I used
session required pam_mkhomedir.so umask=0022 in pam.d/common-session.
When I try to login for the first time with any new ldap account it gives the following error:
Creating directory '/home/user3'. Unable to create and initialize directory '/home/user3'. No directory, logging in with HOME=/ vim /var/log/auth.log: lucid mkhomedir_helper: PAM unable to create directory /home/user3: No such file or directory