0

I have an AD running under Windows 2008 R2 and have several Ubuntu & Debian Servers.

I have configured the linux login against the AD using Centrify Express, but now I have another problem:

Every time that a user logins on a linux server for the first time, Linux automatically creates a home folder for that user. I want Linux to stop creating those folders, and (if it is possible) to make a generic, previously created folder (let's say /home/users) to be user's home folder.

6
  • 1
    So you want all users to share a single local home folder on each server?
    – MDMarra
    Jun 5, 2013 at 21:48
  • 1
    "I have configured the linux login against the AD," <-- HOW? pam_ldap? samba/winbindd? something else? (Little details like this are important!)
    – voretaq7
    Jun 5, 2013 at 21:55
  • 1
    Why, WHY would you want this? Sure, it's possible but there's absolutely NO good reason to do this. Jun 5, 2013 at 22:05
  • @voretaq7 Using Centrify Express. MDMarra and Dennis: Users will just connect to the servers to edit apache.conf or tomcat conf files, but they won't (and shouldn't) need a private home folder. Just a shared home folder where they can temporarily put some files. Thank you all for yous responses...
    – hecstevez
    Jun 6, 2013 at 16:13
  • Hmm... no experience with Centrify Express -- does it work at all like pam_ldap/nss_ldap? (RFC 2307 compliant LDAP data stored in AD that the unix machines reference)
    – voretaq7
    Jun 6, 2013 at 17:01

1 Answer 1

3

You can do what you're asking, but you REALLY should not -- Unix users should always have a dedicated home directory, owned by that user's UID.
This is what Unix expects, and the reason you're giving above is a poor justification for Doing It Wrong.

To briefly summarize the problems:

  • Permissions
    If your users have different UIDs and are sharing a home directory LOTS of things break.
    SSH won't work properly (because ~/.ssh will have the wrong owner/permissions)
    Shell history may not work (and will almost certainly throw errors).
    Your users will invariably make files nobody else can read/manage, or step on each other's files.

  • Security and Auditing
    Unix relies on the numeric UID for pretty much everything. If you get around the permissions problem by assigning everyone the same UID you wind up losing the ability to audit who did what.
    If John Doe and Jane Smith are both logged in to the system and someone deletes the Apache configuration (out of malice or by accident) it becomes very difficult to track down the responsible person.

  • Principle of Least Astonishment
    Generally you should set up systems that behave as the majority of the world expects them to.
    This means every user has a distinct username, User ID, and Home Directory (and in the general case that the user's home directory name matches their username).
    Setting up a system that violates the Principle of Least Astonishment should only be done with extremely good reason (and as I mentioned above you seem to lack a good reason).


Given the above, if you still want to do this then based on the fact that you've told us that Centrify Express is RFC 2307 compliant, the best possible solution would be to assign all your users the same User and Group ID (uidNumber/gidNumber), and Home Directory (homeDirectory).

This minimizes the chance of breaking things (SSH, shell history, file permissions, etc. will all be fine because the numeric UID is the same) at the expense of security/accountability.

This also means that you can't use these accounts as "normal" unix accounts on any other system -- the accounts are effectively aliases to one account (UID) with different passwords.

A better solution to this situation would be to create a local admin account on your Unix systems and allow your users to access it using their SSH keys. This still breaks accountability to some extent, but leaves you with LDAP/AD accounts that can still be used as "normal" unix logins.

1
  • Thanks Voretaq7, for your answer and for explaining why is sutch a bad idea. The thing is, Users just need to put temp files in a folder. The System administrator will erase that folder once a week... And we have near 200 users, so it´s more difficult to manage 200 folders than just one...
    – hecstevez
    Jun 10, 2013 at 18:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .