4

Like many, I've been trying to move away from Microsoft Active Directory + CIFS file sharing into a custom LDAP solution + NFSv4. All the workstations here run Windows 7, and I have set up the following so far:

  • pGina is installed in every workstation and Logging into my custom OpenLDAP server works fine. The latest beta version of pGina even allows the user to change their password!
  • After activating NFS for Windows 7, I am able to successfuly mount an NFS share, although the server treats me like nobody/nogroup instead of giving me what is rightfully mine!

Now, the last item has been a big source of headaches for the last two days, because up-to-date, thorough information is hard to find. Here is the info that I gathered:

  • idmapd.conf is only used if you use the krb5 - or similar - authentication method to mount the NFS share. This means that you need to set up Kerberos, not a trivial task.
  • Windows needs an Identity Mapping Service to map local accounts to Unix accounts. There is some very good info on this here, but I've failed to find anyone that managed to do this on the internet. I've found an user with a problem, but without solution (and I fear it might happen to me).
  • It seems like there is (still?) a bug on Ubuntu 12.04's distribution of nfs-utils when configuring idmapd to retrieve mappings from a LDAP server (umich_ldap translation method). This is really important because it allows for centralized account management, one of the whole points of doing all this.

Now, before I delve into Kerberos and Windows Identity Mapping and apply Ubuntu patches and find even more problems, my questions are:
Has anyone gone down this road and managed to accomplish this successfuly? Should I head another direction? Where can I find some decent, thorough material on all this?

Thank you.

0

I would recommend using FreeIPA and it's Kerberos cross-realm trust with Active Directory. How this works:

  1. Install FreeIPA server as the Linux machines domain controller
  2. Create cross-realm trust between FreeIPA and AD (trust-add command) - related testing instructions
  3. Configure a Kerberos protected NFS share on the FreeIPA server or on another machine which is a FreeIPA client
  4. Mount that share either in Windows or Linux machines
  5. Profit!

I was playing with that recently and I was able to mount a Kerberos protected NFS share to Windows Server 2012 (after I installed the Unix extension), with Kerberos and single sign on.

| improve this answer | |
  • Thank you for your help, but one of the greatest concerns here is to stay away from AD, mostly due to licensing costs – Marcelo Zabani Feb 18 '14 at 11:40
  • Please ignore the last comment, I've just realized that the links you provided show how to set up AD with Samba. I would still rather go with a custom LDAP + NFSv4 solution (although if I don't manage to make it that way, I'll look into Samba) – Marcelo Zabani Feb 18 '14 at 12:11
  • FreeIPA is a LDAP-based Identity Management solution, it is not so related to Samba. Only the FreeIPA-AD cross-realm trust part of FreeIPA uses some parts of the Samba libraries to communicate with AD, but it does not configure parts like Samba4 DC or similar - it is all LDAP. – Martin Kosek Feb 18 '14 at 12:26
  • BTW with FreeIPA being an identity management solution there should not be any added costs as the Linux hosts would be enrolled with FreeIPA, not AD - i.e. no additional AD license needed. – Martin Kosek Feb 18 '14 at 12:27
  • I didn't know FreeIPA and it looks really interesting! Thanks for the info. However, I would still rather stay away from Samba, even if it is only doing a tiny part of the job - this is now almost a personal matter. – Marcelo Zabani Feb 18 '14 at 12:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.