3

(I couldn't really choose an accurate title as I don't know exactly what the feature I'm looking for is called. Sorry about that. I hope that the following lines may clear this aspect.)

I own a dozen PCs, mostly running UNIX-based OSes (FreeBSD and various flavors of GNU/Linux), with a few running Windows 7 or Windows XP.

I'd like to begin centralizing all my data on one machine running FreeBSD as well as acting as my NAS with ZFS.

Furthermore I'd like to have a central system to manage users, password, groups that are common to some (or all) of my machines. Basically I'd like to edit my password on the master server and then being able to login on any of my PCs using the new password (without needing to update dozens of times the same user's password). I think as far as this goes that's what LDAP (or maybe even Kerberos?) does, though I'm not sure about the Windows support.

My questions are the following

  1. What should I use for a home-based environment with 1-3 human users (beside all UNIXes users like root, ...)? LDAP / Kerberos / Windows Server 2008?
  2. Does (the one on point 1.) support Windows 7 / Windows XP acting as client?

I already plan to mount shares on each PC I work on via Samba, which would provide a centralized and redundant data storage.

I hope I explained in a clear way what I'd like to do. I'm sorry if I got some technical terms wrong. Please don't hesitate to reply or ask for clarifications.

|improve this question
  • 1
    This site works best if you ask one question at the time. Is it possible for you to focus your questions into clear one or to split them into several? – N.N. Oct 22 '12 at 18:40
  • The matter about NAS and ZFS is not to be treated in this question. It was just additional information. I don't really know if it's useful to break this question into 9 separated ones because then there would be a lot of cross-references trying to explain the whole situation. I'd say we could start with questions 1. and 2. and then maybe develop further. Maybe I'll erase the question 9 that is really subjective. – user51166 Oct 22 '12 at 18:46
  • You're probably going to have trouble getting an answer with so many questions asked all at once. You might want to just focus on "should I use LDAP or Kerberos or something else", and when you get the answer to that you can do more research and ask individual questions if you can't find e.g. a list of security-related problems – Michael Mrozek♦ Oct 22 '12 at 20:31
  • @MichaelMrozek: removed questions 3 to 8. Removed the Pfsense reference as well – user51166 Oct 22 '12 at 21:02
1

I would say LDAP. This is because you need to cater to your Windows machines, there is good open support for these protocols.

Example link: http://tldp.org/HOWTO/LDAP-HOWTO/authentication.html

Samba as you said is a great choice (trying to get things mounted on windows is usually buggy otherwise).

In general, use windows methods, you will be able to find open source support for them. Unfortunately Microsoft doesn't find it in their interest to support other (often superior) technologies.

|improve this answer
0

Since you mentioned integrating your authentication as well as network services such as NFS, I'd recommend FreeIPA Server. It isn's designed for windows clients, but there are tools that support it (however, they are bodge fixes).

FreeIPA contians a Kerberos KDC, and LDAP server, and it will administer your NFS authentication and automounts too. You can control sudo access to all machines. I think the server itself requires a Enterprise Linux Host, but you could run this in a VM on your FreeBSD Machine. It does seem to support FreeBSD Clients in some fashion though.

FreeIPA is a heavy duty enterprise solution, but it does everything you want and is considerably easier to configure than OpenLDAP alone.

As for the Windows Clients. The preffered method in FreeIPA is to setup a SAMBA AD DC and create a trust between it and FreeIPA, which is discussed here. However, if you don't want that hastle, you can enable kerberised authentication on windows clients as explained on the same page.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.