-2

I have created an LDAP (OpenLDAP and LAM) server with a structure, I solved the remote configuration of using sudo. I configured the client stations (will be exclusively Linux Ubuntu) to use LDAP with SSSD and the connections are encrypted (ldaps). Now I need to resolve remote shared home directories for users that are created in the LDAP database. A sufficiently large disk with set appropriate quotas is connected to the server where the LDAP server is running. The user from the client PC logs into the system after successful authentication using LDAP and SSSD. At this point I would need to:

  • After logging in via SSSD and LDAP, the user gets access to his remote home directory (on the server where LDAP is running).
  • The remote directory will be automatically mounted to /home/user_name-from_LDAP after login.

I have read several tutorials, how-to's and tried deploying Samba. However, many instructions are outdated, incomplete and often focus only on a certain part. I'm just a beginner in LDAP, Samba, Kerberos.

With Samba, I read about a problem with connecting Samba-LDAP user databases, where maintaining and managing users is difficult. I ran into this problem when trying to configure and also failed to connect Samba to LDAPS with constant errors with TLS, while all test steps with ldapsearch and openssl went OK.

I also read about the possibility of using Kerberos in addition to LDAP and Samba. Compatibility with Windows clients was also often addressed, which will not be my case. I'm honestly confused and I'm looking for the most efficient, easiest to manage, and easiest to implement solution with some clear instructions.

So my question is: What alternative choose for using remote home directories please? So that LDAP is used, the user database is created in OpenLDAP and the client stations will be Linux Ubuntu operating systems with SSSD only. The goal is also to automatically mount remote home directories after client login.

Thanks for all advices and guidance.

Improve this question
2
  • NFS may be a better option Commented Aug 25, 2024 at 9:34
  • I think what you want to use is automount and let it automatically mount home directories. And if I were you, I would use 389-DS instead of openldap. You really do not want to use shared home directories since users may overwrite config files that others may object to. You could instead automount some shared directory under each persons home. Commented Aug 25, 2024 at 9:43

1 Answer 1

Reset to default
3

Remote home directories have very little to do with LDAP. Though you can host them on the same machine as the LDAP server, there's nothing about the two services that says you should host them on the same machine; indeed usually they're kept separate due to having different resource needs.

It is mostly a historical artifact that Samba contains both a directory server (LDAP) and a file server (SMB), but you should still think of them as two separate components – you don't "deploy Samba" as such, you either deploy Samba as an AD/LDAP directory server or Samba as a SMB/CIFS file server.

So your first step should be to put LDAP aside and plan how the remote storage will be accessed. There are generally two main options: NFS (I'd suggest NFSv4.2 specifically) is probably the best choice for Linux-only environments, while SMBv3 is best for Windows but can be made to work with Linux clients... if both sides support SMBv3 POSIX extensions.

Both network filesystems need some kind user authentication, which is where Kerberos usually comes in (although NFS also has the traditional "no authentication" mode for clients that are trusted not to lie about the user's UID). If you're using standalone OpenLDAP (not Samba AD), you could set up a standalone Kerberos KDC so that users who log in via SSSD will get a Kerberos ticket for NFS/SMB access. (In this setup, the LDAP server itself would no longer store passwords; it would delegate that to Kerberos as well.)

Once you have the network filesystem working, decide on how to mount the home directories automatically. This can be most likely done via autofs without LDAP – that is, the LDAP user data would continue pointing to "/home/whoever" and autofs would handle mounting that.

Improve this answer

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.