1

My question is I'd like to find out how I I centralise the user names, passwords and permissions? if I setup a new linux installation on a new system, how do I ensure it inherits all the same usernames as everyone else? Can this be centralised in some way?

I'm starting to play with setting up multiple linux (CENTOS) systems and have shared home directories over the network with NFS, but I can't figure out how a new system can inherit all the users, groups, passwords, and existing home dir/permissions in the correct way.

  • 1
    short answer: LDAP (e.g. 389-ds) possibly also with kerberos (or instead Active Directory) but that's easier said than explained in detail – thrig Aug 15 '18 at 20:35
  • 1
    You could always use a tool like ansible to manage local users and groups. This way you get sort of centralized password control and user creation, but without having to implement LDAP or AD. minimum-viable-automation.com/ansible/… – Tim Kennedy Aug 15 '18 at 21:05
  • This question comes up every now and then, e.g. Central user management with multiple servers with SSH keys, LDAP? – Michael Ströder Aug 17 '18 at 0:24
  • I guess I should also add a bit more information... I run 2 linux systems at home, and a QNAP NAS. I also am building a virtual pipe for VFX that would run here and in AWS, with a mind to be cloud agnostic in the future. This solution I'm seeking is primarily aimed at the linux systems I run on AWS though. I started running into trouble everytime I wanted to start a new image, and wanted to keep my home dir folders on softnas. – openCivilisation Aug 18 '18 at 2:15
2

This can be accomplished by running a central OpenLDAP server and configuring the machines to use the LDAP server to authenticate users rather than local /etc/passwd-based unix account authentication.

I'd rate the level of skill required to get it working properly and troubleshoot the problems and issues that come up as "medium-high" to "high".

If you are already an LDAP or MS ActiveDirectory wizard or guru, it will be straightforward. If not, be prepared to learn the underlying pre-requisites.

A few pre-requisites to implementing multi-machine LDAP login:

  1. Must know how to install, manage, configure and use LDAP.

  2. Ability to troubleshoot linux systems, and isolate general symptoms back to root-cause(s), then integrating LDAP expertise to identify and make the fix.


Word of Caution

A single-server implementation of LDAP for unix authentication introduces a new single point of failure into the machines on the network:

Anytime the LDAP server goes offline or becomes unavailable, it will not be possible to login to the linux machines.


Additional Reading and Tutorials

General enough to be useful for other linux distros:

pam_ldap- and nss_ldap- oriented resources: (NOTE: no longer best practices [see discussion below], but may still be informative)

  • One option is freeipa.org, which includes LDAP as well as other tools. It tries to abstract away a lot of the details and gives you a web-based user interface. Depending on the number of systems and users you have, it might be worth checking out. – cherdt Aug 15 '18 at 21:20
  • I would not recommend to follow the howtoforge tutorial because it suggests using pam_ldap and nss_ldap which you don't want to use today anymore for various reasons. – Michael Ströder Aug 17 '18 at 0:27
  • @MichaelStröder Ok, thanks for the helpful information about best practices. Do you know of a better resource guide? – Jay Taylor Aug 17 '18 at 16:24
  • As a NSS/PAM demon you can use nss-pam-ldapd (aka nslcd) or sssd. For the LDAP setup and data you can follow the other tutorials. You might want to use my web2ldap as a web-frontend. (For my Æ-DIR I've implemented a custom NSS/PAM demon called aehostd which is not of general use though.) – Michael Ströder Aug 17 '18 at 16:48
  • Thankyou. for someone who is a total noob to this, do you think this course could be a good start? pluralsight.com/courses/lfcs-linux-user-group-management – openCivilisation Aug 19 '18 at 10:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.