There are some 30 systems (standalone PCs) in my lab and nearly 200 students who will be using it. Each system has an account called USER whose password is 123456 which is known to those 200 people. Hence they access whichever system is free and work for sometime. Their usage is logged by just register book entry. I want to give each users separate logins and passwords which is easily achieved by LDAP server. But i do not want to create 200 user accounts in each PC. i want to map all the 200 peoples login to be made into the USER account itself. They will have same profile and same home directory. I just want to log the Time and date of individuals' lab usage in a file. Can this be done using LDAP or some other software?


Agree with SLESKE but to expand on his/her comments, you need to do a couple things first!

In Linux, the libraries that control logging in need to be redirected to use an LDAP backend as oppose to looking things up in /etc/passwd.

If you are using OpenLDAP then you will want to look at two things:

NSCD (Name Server Caching Daemon) which caches the LDAP queries. You will run this on each host where users log in.

NSSLDAP (Name Server Switch for LDAP) this is the glue that causes logins to query NSCD, which in turn, will query LDAP backend or NSSLDAP will query LDAP backend directly if NSCD is stale or not available.

So on each workstation you will need to install OpenLDAP, NSCD, and NSSLDAP if not part of your distribution. OpenLDAP is required to get the client libraries which know how to speak LDAP protocol.

Then you need to make edits to some files:

/etc/nscd.conf This file controls what gets cached. Here is a dump from one of my systems that acts as a Samba server:

    enable-cache            passwd          yes
    positive-time-to-live   passwd          10
    negative-time-to-live   passwd          3
    suggested-size          passwd          211
    check-files             passwd          yes
    persistent              passwd          yes
    shared                  passwd          yes
    max-db-size             passwd          33554432
    auto-propagate          passwd          yes

    enable-cache            group           yes
    positive-time-to-live   group           3600
    negative-time-to-live   group           3
    suggested-size          group           211
    check-files             group           yes
    persistent              group           yes
    shared                  group           yes
    max-db-size             group           33554432
    auto-propagate          group           yes

    enable-cache            hosts           yes
    positive-time-to-live   hosts           3600
    negative-time-to-live   hosts           3
    suggested-size          hosts           211
    check-files             hosts           yes
    persistent              hosts           yes
    shared                  hosts           yes
    max-db-size             hosts           33554432

You'll then need to modify your nsswitch.ldap file (read the DOCs on it, too much to go into here).


If your LDAP server is down, you want to make sure the local root account can still log in. Or if one of your workstations is having network issues, you'll want to make sure that you can still log in.

So when my Linux boxes boot up, I have a script that always copies a nsswitch.conf file into place that looks as follows:

passwd: compat group: compat

hosts: files dns networks: files

services: files protocols: files rpc: files ethers: files netmasks: files netgroup: files bootparams: files

automount: files aliases: files

and once I'm ready to use LDAP for logins, I replace the nsswitch.conf file with the following:

passwd: files ldap group: files ldap shadow: files ldap

hosts: files dns networks: files

services: files protocols: files rpc: files ethers: files netmasks: files netgroup: files bootparams: files

automount: files aliases: files

The former allows me to login locally and the latter allows both but due to caching by NSCD, it takes time for NSCD to get stale thus causing login delays or issues.

There is much more to be said on this but this hopefully gets you started.

BTW: I'm the developer of Pozix Linux and the Pozix Linux Small Business Server and we have over 400 Samba systems running much this way!

Agreed, TRS80's comments are valid but here is a script we use to create LDIF files from /etc/passwd files. The resulting LDIF file can be used to populate your LDAP database. You'll need to make sure that if you run this script on multiple workstations that you weed out duplicate account names so that you wind up with unique account names with unique UIDs.

cat /etc/passwd | while read i; do
  uid=`echo $i | cut -d : -f 1`
  uidNumber=`echo $i | cut -d : -f 3`
  gidNumber=`echo $i | cut -d : -f 4`
  gecos=`echo $i | cut -d : -f 5`
  homeDirectory=`echo $i | cut -d : -f 6`
  loginShell=`echo $i | cut -d : -f 6`
  userPassword=`cat /etc/shadow | grep $uid | cut -d : -f 2`

  echo "dn: cn=$gecos,ou=people,dc=mycompany,dc=com"
  echo "objectClass: account"
  echo "objectClass: posixAccount"
  echo "cn: $gecos"
  echo "uid: $uid"
  echo "uidNumber: $uidNumber"
  echo "gidNumber: $gidNumber"
  echo "homeDirectory: $homeDirectory"
  echo "loginShell: $loginShell"
  echo "userPassword: $userPassword"

  • Whoa, nice comment :-). Is there a reason you must do this replacing? If you just always put compat at the beginning and only had sys accounts in /etc/passwd, wouldn't that be the same?
    – sleske
    Jul 9 '09 at 16:37
  • compact allows us to support NIS +/- in /etc/passwd. Pozix Linux is a scaled down Linux distribution and part of the distribution is NIS & NIS+ and we ship with NSSLDAP support in the lib6; most modern distributions adhere to this philosophy too. However, you are right, we could do away with compact and use file if we had no need to support NIS or NIS+. The other part of your question about onlyh having sys accounts, if that were the case then we would not swap the nsswitch.conf file at all; we only do this if user wants LDAP authentication. See my comments about NSCD again too. ;)
    – Kilo
    Jul 9 '09 at 23:34
  • Combining this with what TRS-80 suggests should get you where you want to be.
    – Frenchie
    Jul 18 '09 at 8:23

If you set the uidNumber and homeDirectory attributes to the same for every account things should probably work the way you want.


You don't need to create 200 user accounts on each PC. Linux can fetch all user information from LDAP, so the accounts do not exist locally (i.e. in /etc/passwd). The home directory is then usually on a network drive (NFS or similar).

This is the standard approach. Is there a reason why you are not doing this?

  • 1
    If the PC's are Windows, the unspoken requirement here is, that he set up a Samba server to provide local home directories.
    – kmarsh
    Jul 9 '09 at 11:48
  • The reason is that we do not have a server machine with hardware capable of supporting that much load, that much disk space etc.
    – Akilan
    Jul 10 '09 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.