0

Just a few questions on how roaming profiles work. These may have simple and obvious answers but bear with me. For reference, I am volunteering to set up the user profile management systems at a not for profit. I have some Linux experience, but not a lot, thus thorough answers would be supremely useful. We have 20 Ubuntu 18.04 computers, and 20 iMacs running macOS High Sierra. We want to be able to login to any of them with a specific profile, and manipulate files previously used on other devices. We want users to be able to pick up where they left off, even on different computers. (Just like the systems currently implemented at schools.) We have a Server set up on a fresh install of Ubuntu Server 18.04.

  1. Is what I have described possible?
  2. If so, how would I go about setting this up? Can you direct me to any tutorials or provide a step by step?
  3. Will it interface well with macOS or should I put Linux on those as well?

Am I asking the right questions? Is roaming login the correct terminology?

Again, it is likely a foolish question, but I really appreciate any direction you could provide. If this is unwarranted or off topic, please direct me to somewhere where I can find the information I need.

0

1) It sounds like you're looking for a way for a given user to login to any workstation on the LAN and have a way of sharing directories across these systems. Certainly possible.

2) You will need to manage and maintain user IDs (UID numbers) and Group IDs (GID numbers) as well as authentication across all of these various platforms. Regardless of how this gets done, it comes down to the UID and GID must be the same on each system or you will run into problems when it comes to file sharing on a network resource.

Typically, this is most easily done with an OpenLDAP server (or a variant with extra support software piled on) but I would not recommend that based on your volunteer time and the added complexities involved with provisioning, securing and maintaining those systems.

This leaves you with little choice but to maintain all the user accounts locally on each machine. Historically, this has never worked out well. Logging into each system to remove a user or change a password or add/remove a group becomes incredibly burdensome when more than a couple machines are involved. It is, however, what I would consider the most straightforward way of getting what you need using the standard Linux tools-at-hand.

You will need to spend some time learning how best to manage those user accounts UIDs/GIDs, supplementary group memberships and passwords. Find out what UIDs/GIDs are already in use by each mac/linux system. Pick a range to standardize on. In the past, I ended up using 40000 but the number is arbitrary. It used to be limited to 65535 but I believe that has changed years ago. Secondly, learn Ansible for managing users/groups. It's basically a way of running a shell script on each and every system and it has user, group and password managment built in. You would make a single change to a master file on your Ansible "controller" and then launch Ansible to go make that change on every other system you are maintaining. This isn't ideal, but the automation part pays off big time. You certainly don't want to be logging in by hand to manage users & groups on every machine. You will make typos on just about everything. When there is a problem, your eyes dry out staring and comparing auth logs on different machines. In the end, you'll have a bunch of machines that are not the same. Users exist on some and not on others. Group memberships will be messed up and some users will be able to edit files, others will not and you won't really know why.

Lastly, you will need a network based file server of some sort. In the past I've used NFS and SAMBA. Both suck in different ways. Last time I tried to get a Mac to use SAMBA there was a lot of hacking involved. I would explore NFS for that reason. It knows about *nix users/groups. Tons of documentation for it. Last time I messed with NFS it did not do SSL, which may have changed. NOTE: If you need encryption (people want to work on their files from a coffee shop) for the mounted filesystem however, look into SSHFS. I don't know if exists for Mac in a stable form. But it will save you from having to setup OpenVPN sometime down the road if user's want to work on these files away from the org.

3) Most of this stuff should be Mac compatible but if you can do without it, just put Linux on everything. It will save you the hassle of compiling stuff from brew or Having a second platform in the mix with inherent library incompatibilities (LibreSSl/OpenSSL issues for one).

"Roaming Profile" is more of a Windowism, but it gets the point across. I doin't know that Linux ever coined a term for it but "centralized logins" and "shared network resources" should cover the semantics.

Good luck. PS: just a quick look turned up a link to someone doing user management using Ansible and Mac

3
  • Thanks. I appreciate the clarity and thoroughly worded answer. How much maintenance would it require to run OpenLDAP? How complex would that maintenance be? Is it simple adding and removing of users, or much more complex? I read the OpenLDAP manuals, but struggled with the jargon, thus left slightly confused. Again, thanks. – user469495 May 15 '18 at 1:28
  • You're welcome. Honestly, OpenLDAP is about one of the most stable pieces of software I run on Linux. Manipulating LDIF files on the command line and upgrading to new OS versions is where it becomes a headache. You may be able to alleviate some of that using PHPLdapAdmin[1]. I've used it in the past and it does some things well enough. I recall it spitting out errors and wondering if the operation succeeded or not. Might be a good start if you prefer the OpenLDAP route: [1] digitalocean.com/community/tutorials/… – Server Fault May 15 '18 at 18:04
  • Previous link has possibly outdated info, perhaps try here. It looks to cover most of the setup well: linuxbabe.com/ubuntu/… – Server Fault May 15 '18 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.