0

I have set up FreeIPA as IDM software for my network and successfully configured a Kerberos aware NFS server and Kerberos aware NFS clients. When a user logs into a machine, it's user directory on the NFS server is automatically mounted via autofs from nfs:/srv/nfs/home/userdir to /home/userdir on the local machine.

I am facing the problem that when I need to create a local user on one machine, like the git user, that I cannot as the root user create a new home directory for the git user under /home/git, because it says useradd: cannot create directory /home/git

My auto.home map configuration is the following: * nfs:/srv/nfs/home/& and when I log in as any user, only the user's home directory is mounted under /home And my auto.master map has the following entry: /home auto.home

the output from mount is the following:

auto.home on /home type autofs (rw,relatime,fd=6,pgrp=651,timeout=300,minproto=5,maxproto=5,indirect,pipe_ino=15731)
nfs:/srv/nfs/home/userdir on /home/userdir type nfs4 (rw,relatime,vers=4.2,rsize=524288,wsize=524288,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=krb5,clientaddr=10.110.29.100,local_lock=none,addr=10.110.29.107)

I omitted unnecessary information about other file system and devices.

getfacl for the home directory returns:

file: home
owner: root
group: root
user::rwx
group::r-x
other::r-x

Now, my question is, is this setup preventing my local root account from creating a local home directory on my machine?

1 Answer 1

1

Yes, your current setup prevents you from creating a local home directory for a local user under /home... because you have defined /home as being an automount map of NFS mount points. Since NFS is Kerberos-aware, the user would need at least a Kerberos keytab to access a NFS-mounted home directory, and that keytab would be stored... within the user's home directory. That would seem to be a bit of a chicken/egg problem.

But the home directory for a local user named git does not need to be under /home: it could just as well be at /home.local/git, for example.

Since you've tagged this question with rhel and RHEL uses SELinux by default, you'll probably need to know that you will have to apply appropriate SELinux labels to both the actual home directory and its parent directory.

If you wish to make git's home directory be /home.local/git, you'll need to first prepare SELinux labels as follows:

semanage fcontext -a -t home_root_t -f d /home.local
semanage fcontext -a -t user_home_dir_t -f d '/home.local/[̂^/]+'
semanage fcontext -a -t user_home_t '/home.local/[^/]+/.+'
mkdir /home.local
restorecon -rv /home.local

In other words, /home.local will get home_root_t, each directory immediately under it will get user_home_dir_t, and all files and directories deeper than that will get user_home_t. Similar labeling rules already exist for the regular /home.

After this, you could create the git user:

useradd -d /home.local/git -m [any other options] git

Or if the user already exists and only the home directory creation failed, you could modify its home directory path and manually create the actual home directory:

usermod -d /home.local/git git
cp -a /etc/skel /home.local/git
chown -R git: /home.local/git
chmod 700 /home.local/git  # or according to requirements
4
  • Thank you for the reply. Would there be a possible configuration of autofs to make it possible to mount NFS shares under /home and keeping local directories there as well?
    – Grigorios
    Apr 25, 2023 at 7:46
  • 1
    Sadly, I don't see any realistic configuration that would allow that. It might be technically possible by making each user a separate automount entry instead of a single indirect automount map covering all the users, but that would be an administration nightmare unless you have just a few users.
    – telcoM
    Apr 25, 2023 at 8:38
  • Thank you for the reply. I think I will most likely implement what you have stated in your answers, but I have one more question about an alternate approach. I could set up a git user in FreeIPA and add it's home directory to the nfs server, would that be a possible approach? I can already see problems with the git user getting it's keytab, but what do you think about that?
    – Grigorios
    Apr 25, 2023 at 12:20
  • 1
    Except for the already-mentioned keytab issue, I don't see any other problems with that approach. Unless your use of git is particularly heavy or your network connection to the NFS server is unusually slow (bandwidth and latency), I don't see an obvious reason why the git repository would absolutely have to be local.
    – telcoM
    Apr 25, 2023 at 12:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .