2

I am aware that questions about migration to LDAP are nothing new. I've searched for info for quite a bit now, but the problem I found is that information seems rather fragmented on the topic. So I hope that someone experienced can point me to the right direction.

The current situation:

  • Small enterprise, growing in users and desktops
  • About 10 Fedora-20 desktops / 3 Fedora-20 servers
  • 1 Synology NAS DS1813+
  • About 10 users
  • All logins are local on the desktops
  • Users DO NOT have the same UIDs and GIDs across the network of machines.

Obviously, it becomes more and more attractive to use a centralised user directory such as LDAP.

The problem:

Unfortunately, I was not able to find reliable and complete guides that cover the whole process for a real-life scenario.

  • Setting up the server and configuring the clients: OK, from what I read, not the most streamlined process, but even if a bit tricky I believe this is doable.
  • Migrating all users, from all machines: here's the "delicate" part. Obviously, I don't want to risk any information loss. Again, I've found some guides about migration and about the MigrationTools, but none of such sources gives me the feeling of a trustworthy guide. Typical scenario: there's a wiki page or something with instructions and a huge pile of comments complaining that the procedure failed at some point. The questions raised are often way more than the answers given. How can this make me feel I can safely start this process?

Some specific questions:

  • Is there an up-to-date set of best practices / advised tools that one should certainly consider for such migration process? In particular with attention to real-life scenarios? Which sequence of actions to follow, what to pay attention to, how to minimise the risks of data loss, how to minimise the down-time for users, etc?
  • Suppose user 'roberto' is present (with different IDs) on two machines. By migrating /etc/passwd information from both machines to LDAP, are they "merged" during the process? If not, what should be done?
  • Can the migration be done in steps, only for one user to start with? Is it advisable?
  • Another (perhaps naive?) approach I could think of is: create new LDAP users, then change ownership of all files from old local users to these new users, then remove old local users. Does this make sense at all? Any previous experience?
  • How does LDAP relate to ACL? Do they go well together?
  • The following desired step is to centralise users' home directories to a shared space on NFS. Any pointer to this following step would also be welcome, especially if linked to the migration to LDAP.
  • After the correct remarks on two answers, I removed requests for tutorials from my question. – cornuz Oct 15 '14 at 12:37
  • You should look into FreeIPA. As for migrating the users, that's just going to be a lot of hard manual work. – Michael Hampton Oct 16 '14 at 0:51
1

First, questions for tutorials etc. are off-topic.

Some thoughts:

  • You are right, information regarding this is scattered, often out-of-date and unreliable. As an example, you find lots of informations on how to configure OpenLDAP with config files, but very little about cn=config. My guess is that this is a result of the fact that every migration like this is different and there simply is no golden way to proceed. It's impossible to write a tutorial about this that will work everywhere or you end up writing a very big book.
  • This means that you have to puzzle the parts together and adapt them to your situation. There is no way around it. You are lucky though, as your environment seems very small and simple and if need be, all of what is necessary can be done on one weekend.
  • Virtualization tools are an excellent help with this as you easily can simulate everything on your laptop, without affecting anyone else.

I've some general tips for you how to proceed. This assumes a step-by-step method without much downtime.

  • Create a list of all users.
  • Manually make sure that they have the same UID etc. on all systems. Mostly, this means editing /etc/passwd etc. and then find and chmod all files belonging to a user.
  • If you have conflicting usernames, this should be resolved at this step (e.g. the two Bobs from Sales and Customer Care both are named bob on their machines)
  • At this point, you can add all users with the unified UIDs to the LDAP database. Pro tip: With OpenLDAP on Linux, you can reuse the password from /etc/shadow if you add {crypt} as a password type prefix into the LDAP userPassword field (so you turn $1$E.1Saa9d$LcRBQDLfnzR6WF4HmbjpC/ into {crypt}$1$E.1Saa9d$LcRBQDLfnzR6WF4HmbjpC/
  • You can now configure your machines one by one to authenticate against LDAP and user accounts should still work with the same password (but remember to delete/rename the local users).
  • Create an NFS server for home directories and make sure it's mounted everywhere (iSCSI has a different purpose).
  • Copy users home directories to the NFS share, rename the old /home to something else and mount the NFS share as /home.

This can be a more or less straightforward process, but depending on your environment, issues might (will!) pop up. But when doing things along this path, you can deal with them on a one-by-one base as they appear. There is no point where you are in an all-or-nothing situation that has the potential to halt everything. This is a very comfortable situation for such a project.

If you end up having specific questions along the way, ask new questions here.

  • Thank you, very useful tips. As you say, I'll need to align UIDs across the network before migrating. That means I'll have to change ownership of files. If this is the case, and my uses are for now just a few, could the approach I describe as "naive" in my original post be an option as well? – cornuz Oct 15 '14 at 12:44
  • It might work, but I think you are better of with changing UIDs and file ownwership afterwards. It's easy to do with find and you stay in a position where you can just turn off LDAP again if problems appear. – Sven Oct 15 '14 at 12:47
1

Requests for learning materials and tutorials are off-topic.

Which sequence of actions to follow, what to pay attention to, how to minimise the risks of data loss, how to minimise the down-time for users, etc?

Start by deciding on your requirements and scope. Write them down and have them reviewed.
Think about setting up Kerberos in addition to LDAP as well. The possibility of single-sign-on will often be a real business benefit for your end-users as well as making them more willing to put up with disruptions during the migration process. End-users typically don't care about change in general and quite obviously see no immediate benefit in what perceive as operational improvements that only benefit the lives of the system administrators.
FreeIPA offers an integrated approach there.

Make an inventory of the existing passwd and group files as well as sudo configurations. Don't overlook other services that are currently username/password protected which may benefit from integration with a central user directory (and SSO) such as secured directories on your web servers etc.

Test your approach, scripts etc. Make back-ups and test restoring them. SSSD seems the way to configure your workstations and servers to integrate with the directory (and FreeIPA) relatively painlessly.

Mounting central home directories on workstations is typically a good idea, especially combined with the auto mounter (autofs). Doing the same on servers (also on demand with auto-fs) seems to generate more discussion. If you do go that route think long and hard if you or your users should be the one to merge them.

The risk of dataloss is relatively small, but you do make back-ups and test restoring regularly, right?

Suppose user 'roberto' is present (with different IDs) on two machines. By migrating /etc/passwd information from both machines to LDAP, are they "merged" during the process? If not, what should be done?

No they are not merged automatically since user accounts can only have a single UID number, and each username must be unique too. Since file-ownership is stored by the file-system on the UID number, discarding one UID would result in the owner losing the rights to those files. You'll need to change to owner from the original to match the eventual UID number you decide on for the duplicate user that is the same real person. e.g. something along the lines find -owner old-UID -exec chown new-UID '{}' \; duplicate username for different real people will result in a new username for one of them, or both of you believe in sharing the pain.

The same holds for the primary group users are in.

Can the migration be done in steps, only for one user to start with? Is it advisable?

The authentication method is mostly defined per system and not on a user basis, migrating host by host makes more sense than migrating per user. If each user has their own workstation you could start with those, one at a time, as any issues there will limit the impact to a single user. Once all users are then in the directory, then doing the servers is relatively easy.

The following desired step is to centralise users' home directories to some network space (NFS or iSCSI). Any pointer to this following step would also be welcome, especially if linked to the migration to LDAP.

A file share is much better place for centralized home directories than a block device, so definitely go for NFS. With NFSv4 a lot of the problems of classical NFS have been resolved and combined with Kerberos also the security is much improved.

Converting authentication on a workstation could happen concurrently with the move to a centralized home directory.

  • Thank you, that was very helpful. One additional question: I now know that I need to align UIDs across the network before migrating. That means I'll have to change ownership of files. If this is the case, and my uses are for now just a few, could the approach I describe as "naive" in my original post be an option as well? – cornuz Oct 15 '14 at 12:43
  • I would accept your answer as well if I could, it helped me much. – cornuz Oct 16 '14 at 7:34
0

As to the system you're aiming at, it could be worth you going for Free IPA because if, in the future someone implements some Active Directory boxes, it's pretty easy to link in.

As to migration.. Well, at least you're talking small scale so "etch-a-sketch end of the network" is an option.

Sudo rights, obviously that's vital, with that small amount of machines, any acl stuff should be easy enough to handle though.

Obviously you can't have users with the same name in LDAP and local so I would start by getting your servers fixed and onboard with the directory and then move onto the desktops.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.