blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2           "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr">
   4   <head>
   5     <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
   6     <title>Petter Reinholdtsen: Caching password, user and group on a roaming Debian laptop</title>
   7     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css" />
   8     <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/vim.css" />
   9   </head>
  10   <body>
  11     <div class="title">
  12  <h1>
  13      <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  14
  15  </h1>
  16
  17 </div>
  18
  19
  20     <div class="entry">
  21       <div class="title">Caching password, user and group on a roaming Debian laptop</div>
  22       <div class="date"> 1st July 2010</div>
  23       <div class="body"><p>For a laptop, centralized user directories and password checking is
  24 a bit troubling.  Laptops are typically used also when not connected
  25 to the network, and it is vital for a user to be able to log in or
  26 unlock the screen saver also when a central server is unavailable.
  27 This is possible by caching passwords and directory information (user
  28 and group attributes) locally, and the packages to do so are available
  29 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
  30 It is also possible to set up in Debian/Lenny, but require more manual
  31 setup there because pam-auth-update is missing in Lenny.</p>
  32
  33 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
  34
  35 This is the traditional method with a twist.  The password caching is
  36 provided by libpam-ccreds (version 10-4 or later is needed on
  37 Squeeze), and the directory caching is done by nscd.  The directory
  38 lookup and password checking is done using LDAP.  If one want to use
  39 Kerberos for password checking the libpam-ldapd package can be
  40 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
  41 local home directory with the path listed in LDAP, one can use the
  42 pam_mkhomedir module from pam-modules to make this happen instead of
  43 using libpam-mklocaluser.  A setup for pam-auth-update to enable
  44 pam_mkhomedir will have to be written until a fix for
  45 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
  46 archive.  Because I believe it is a bad idea to have local home
  47 directories using misleading paths like /site/server/partition/, I
  48 prefer to create a local user with the home directory in /home/.  This
  49 is done using the libpam-mklocaluser package.</p>
  50
  51 <p>These packages need to be installed and configured</p>
  52
  53 <blockquote><pre>
  54 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
  55 </pre></blockquote>
  56
  57 <p>The ldapd packages will ask for LDAP connection information, and
  58 one have to fill in the values that fits ones own site.  Make sure the
  59 PAM part uses encrypted connections, to make sure the password is not
  60 sent in clear text to the LDAP server.  I've been unable to get TLS
  61 certificate checking for a self signed certificate working, which make
  62 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
  63 is talking to the correct LDAP server), and very much welcome feedback
  64 on how to get this working.</p>
  65
  66 <p>Because nscd do not have a default configuration fit for offline
  67 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
  68 is fixed, this configuration should be used instead of the one
  69 currently in /etc/nscd.conf.  The changes are in the fields
  70 reload-count and positive-time-to-live, and is based on the
  71 instructions I found in the
  72 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
  73 instructions by Flyn Computing.</p>
  74
  75 <blockquote><pre>
  76         debug-level             0
  77         reload-count            unlimited
  78         paranoia                no
  79
  80         enable-cache            passwd          yes
  81         positive-time-to-live   passwd          2592000
  82         negative-time-to-live   passwd          20
  83         suggested-size          passwd          211
  84         check-files             passwd          yes
  85         persistent              passwd          yes
  86         shared                  passwd          yes
  87         max-db-size             passwd          33554432
  88         auto-propagate          passwd          yes
  89
  90         enable-cache            group           yes
  91         positive-time-to-live   group           2592000
  92         negative-time-to-live   group           20
  93         suggested-size          group           211
  94         check-files             group           yes
  95         persistent              group           yes
  96         shared                  group           yes
  97         max-db-size             group           33554432
  98         auto-propagate          group           yes
  99
 100         enable-cache            hosts           no
 101         positive-time-to-live   hosts           2592000
 102         negative-time-to-live   hosts           20
 103         suggested-size          hosts           211
 104         check-files             hosts           yes
 105         persistent              hosts           yes
 106         shared                  hosts           yes
 107         max-db-size             hosts           33554432
 108
 109         enable-cache            services        yes
 110         positive-time-to-live   services        2592000
 111         negative-time-to-live   services        20
 112         suggested-size          services        211
 113         check-files             services        yes
 114         persistent              services        yes
 115         shared                  services        yes
 116         max-db-size             services        33554432
 117 </pre></blockquote>
 118
 119 <p>While we wait for a mechanism to update /etc/nsswitch.conf
 120 automatically like the one provided in
 121 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
 122 content need to be manually replaced to ensure LDAP is used as the
 123 directory service on the machine.  /etc/nsswitch.conf should normally
 124 look like this:</p>
 125
 126 <blockquote><pre>
 127 passwd:         files ldap
 128 group:          files ldap
 129 shadow:         files ldap
 130 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 131 networks:       files
 132 protocols:      files
 133 services:       files
 134 ethers:         files
 135 rpc:            files
 136 netgroup:       files ldap
 137 </pre></blockquote>
 138
 139 <p>The important parts are that ldap is listed last for passwd, group,
 140 shadow and netgroup.</p>
 141
 142 <p>With these changes in place, any user in LDAP will be able to log
 143 in locally on the machine using for example kdm, get a local home
 144 directory created and have the password as well as user and group
 145 attributes cached.
 146
 147 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 148   libpam-mklocaluser/pam_mkhomedir</h2>
 149
 150 <p>Because nscd have had its share of problems, and seem to have
 151 problems doing proper caching, I've seen suggestions and recipes to
 152 use nss-updatedb to copy parts of the LDAP database locally when the
 153 LDAP database is available.  I have not tested such setup, because I
 154 discovered sssd.</p>
 155
 156 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
 157
 158 <p>A more flexible and robust setup than the nscd combination
 159 mentioned earlier that has shown up recently, is the
 160 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
 161 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
 162 to provide a Active Directory like directory service for Linux
 163 machines.  The sssd system combines the caching of passwords and user
 164 information into one package, and remove the need for nscd and
 165 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 166 1.2 do not support netgroups, but it is said that it will support this
 167 in version 1.5 expected to show up later in 2010.  Because the
 168 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
 169 was missing in Debian, I ended up co-maintaining it with Werner, and
 170 version 1.2 is now in testing.
 171
 172 <p>These packages need to be installed and configured to get the
 173 roaming setup I want</p>
 174
 175 <blockquote><pre>
 176 libpam-sss libnss-sss libpam-mklocaluser
 177 </pre></blockquote>
 178
 179 The complete setup of sssd is done by editing/creating
 180 <tt>/etc/sssd/sssd.conf</tt>.
 181
 182 <blockquote><pre>
 183 [sssd]
 184 config_file_version = 2
 185 reconnection_retries = 3
 186 sbus_timeout = 30
 187 services = nss, pam
 188 domains = INTERN
 189
 190 [nss]
 191 filter_groups = root
 192 filter_users = root
 193 reconnection_retries = 3
 194
 195 [pam]
 196 reconnection_retries = 3
 197
 198 [domain/INTERN]
 199 enumerate = false
 200 cache_credentials = true
 201
 202 id_provider = ldap
 203 auth_provider = ldap
 204 chpass_provider = ldap
 205
 206 ldap_uri = ldap://ldap
 207 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 208 ldap_tls_reqcert = never
 209 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 210 </pre></blockquote>
 211
 212 <p>I got the same problem here with certificate checking.  Had to set
 213 "ldap_tls_reqcert = never" to get it working.</p>
 214
 215 <p>With the libnss-sss package in testing at the moment, the
 216 nsswitch.conf file is update automatically, so there is no need to
 217 modify it manually.</p>
 218
 219 <p>If you want to help out with implementing this for Debian Edu,
 220 please contact us on debian-edu@lists.debian.org.</p>
 221 </div>
 222
 223       <div class="tags">Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.</div>
 224
 225
 226     </div>
 227
 228
 229
 230
 231     <div id="sidebar">
 232
 233
 234
 235 <h2>Archive</h2>
 236 <ul>
 237
 238 <li>2012
 239 <ul>
 240
 241 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/01/">January (7)</a></li>
 242
 243 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/02/">February (10)</a></li>
 244
 245 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/03/">March (17)</a></li>
 246
 247 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/04/">April (12)</a></li>
 248
 249 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/05/">May (12)</a></li>
 250
 251 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/06/">June (20)</a></li>
 252
 253 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/07/">July (17)</a></li>
 254
 255 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/08/">August (6)</a></li>
 256
 257 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/09/">September (9)</a></li>
 258
 259 <li><a href="http://people.skolelinux.org/pere/blog/archive/2012/10/">October (13)</a></li>
 260
 261 </ul></li>
 262
 263 <li>2011
 264 <ul>
 265
 266 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/01/">January (16)</a></li>
 267
 268 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/02/">February (6)</a></li>
 269
 270 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/03/">March (6)</a></li>
 271
 272 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/04/">April (7)</a></li>
 273
 274 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/05/">May (3)</a></li>
 275
 276 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/06/">June (2)</a></li>
 277
 278 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/07/">July (7)</a></li>
 279
 280 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/08/">August (6)</a></li>
 281
 282 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/09/">September (4)</a></li>
 283
 284 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/10/">October (2)</a></li>
 285
 286 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/11/">November (3)</a></li>
 287
 288 <li><a href="http://people.skolelinux.org/pere/blog/archive/2011/12/">December (1)</a></li>
 289
 290 </ul></li>
 291
 292 <li>2010
 293 <ul>
 294
 295 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 296
 297 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 298
 299 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 300
 301 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 302
 303 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 304
 305 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 306
 307 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (12)</a></li>
 308
 309 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/08/">August (13)</a></li>
 310
 311 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/09/">September (7)</a></li>
 312
 313 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/10/">October (9)</a></li>
 314
 315 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/11/">November (13)</a></li>
 316
 317 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/12/">December (12)</a></li>
 318
 319 </ul></li>
 320
 321 <li>2009
 322 <ul>
 323
 324 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 325
 326 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 327
 328 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 329
 330 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 331
 332 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 333
 334 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 335
 336 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 337
 338 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 339
 340 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 341
 342 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 343
 344 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 345
 346 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 347
 348 </ul></li>
 349
 350 <li>2008
 351 <ul>
 352
 353 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 354
 355 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 356
 357 </ul></li>
 358
 359 </ul>
 360
 361
 362
 363 <h2>Tags</h2>
 364 <ul>
 365
 366  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (13)</a></li>
 367
 368  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 369
 370  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 371
 372  <li><a href="http://people.skolelinux.org/pere/blog/tags/bitcoin">bitcoin (2)</a></li>
 373
 374  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (12)</a></li>
 375
 376  <li><a href="http://people.skolelinux.org/pere/blog/tags/bsa">bsa (2)</a></li>
 377
 378  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (57)</a></li>
 379
 380  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (115)</a></li>
 381
 382  <li><a href="http://people.skolelinux.org/pere/blog/tags/digistan">digistan (9)</a></li>
 383
 384  <li><a href="http://people.skolelinux.org/pere/blog/tags/docbook">docbook (7)</a></li>
 385
 386  <li><a href="http://people.skolelinux.org/pere/blog/tags/drivstoffpriser">drivstoffpriser (4)</a></li>
 387
 388  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (154)</a></li>
 389
 390  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (18)</a></li>
 391
 392  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (12)</a></li>
 393
 394  <li><a href="http://people.skolelinux.org/pere/blog/tags/freeculture">freeculture (8)</a></li>
 395
 396  <li><a href="http://people.skolelinux.org/pere/blog/tags/frikanalen">frikanalen (8)</a></li>
 397
 398  <li><a href="http://people.skolelinux.org/pere/blog/tags/intervju">intervju (31)</a></li>
 399
 400  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (17)</a></li>
 401
 402  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (8)</a></li>
 403
 404  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (4)</a></li>
 405
 406  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 407
 408  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (25)</a></li>
 409
 410  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (208)</a></li>
 411
 412  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (145)</a></li>
 413
 414  <li><a href="http://people.skolelinux.org/pere/blog/tags/offentlig innsyn">offentlig innsyn (6)</a></li>
 415
 416  <li><a href="http://people.skolelinux.org/pere/blog/tags/open311">open311 (2)</a></li>
 417
 418  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (36)</a></li>
 419
 420  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (52)</a></li>
 421
 422  <li><a href="http://people.skolelinux.org/pere/blog/tags/raid">raid (1)</a></li>
 423
 424  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (11)</a></li>
 425
 426  <li><a href="http://people.skolelinux.org/pere/blog/tags/rfid">rfid (2)</a></li>
 427
 428  <li><a href="http://people.skolelinux.org/pere/blog/tags/robot">robot (4)</a></li>
 429
 430  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 431
 432  <li><a href="http://people.skolelinux.org/pere/blog/tags/ruter">ruter (4)</a></li>
 433
 434  <li><a href="http://people.skolelinux.org/pere/blog/tags/scraperwiki">scraperwiki (2)</a></li>
 435
 436  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (23)</a></li>
 437
 438  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (4)</a></li>
 439
 440  <li><a href="http://people.skolelinux.org/pere/blog/tags/skepsis">skepsis (4)</a></li>
 441
 442  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (38)</a></li>
 443
 444  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (3)</a></li>
 445
 446  <li><a href="http://people.skolelinux.org/pere/blog/tags/stortinget">stortinget (5)</a></li>
 447
 448  <li><a href="http://people.skolelinux.org/pere/blog/tags/surveillance">surveillance (10)</a></li>
 449
 450  <li><a href="http://people.skolelinux.org/pere/blog/tags/valg">valg (7)</a></li>
 451
 452  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (35)</a></li>
 453
 454  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (4)</a></li>
 455
 456  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (26)</a></li>
 457
 458 </ul>
 459
 460
 461     </div>
 462     <p style="text-align: right">
 463  Created by <a href="http://steve.org.uk/Software/chronicle">Chronicle v4.4</a>
 464 </p>
 465
 466   </body>
 467 </html>