blog/draft/2010-05-29-roaming-debian.txt

   1 Title: Caching password, user and group on a roaming Debian laptop
   2 Tags: english, nuug, debian edu
   3 Date: 2010-05-30 13:00
   4
   5 <p>For a laptop, centralized user directories and password checking is
   6 a bit troubling.  Laptops are typically used also when not connected
   7 to the network, and it is vital for a user to be able to log in or
   8 unlock the screen saver lock also when the central servers are
   9 unavailable.  This is possible by caching passwords and directory
  10 information locally, and the packages to do so are available in
  11 Debian.  Here follow two recipes to set this up in Debian/Squeeze.  It
  12 is also possible to set up in Debian/Lenny, but require more manual
  13 setup there because pam-auth-update is missing in Lenny.</p>
  14
  15 <p>If you want to help out with implementing this for Debian Edu,
  16 please contact us on debian-edu@lists.debian.org.</p>
  17
  18 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
  19
  20 This is the traditional method with a twist.  The password caching is
  21 provided by libpam-ccreds (version 10-4 or later, currently only in
  22 experimental), and the directory caching is done by nscd.  The
  23 directory lookup and password checking is done using LDAP.  If one
  24 want to use Kerberos for password checking the libpam-ldapd package
  25 can be replaced with for example libpam-krb5.  If one is happy having
  26 a local home directory with the path listed in LDAP, one can use
  27 pam_mkhomedir to make this happen.  A setup for pam-auth-update will
  28 have to be written until a fix for
  29 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
  30
  31 archive.  Because I believe it is a bad idea to have local home
  32 directories using misleading paths like /site/server/partition/, I
  33 prefer to create a local user with the home directory in /home/
  34 instead.  This is done using the libpam-mklocaluser package entering
  35 Squeeze in the next few days.</p>
  36
  37 <p>These packages need to be installed and configured</p>
  38
  39 <blockquote><pre>
  40 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
  41 </pre></blockquote>
  42
  43 Because nscd do not have a default configuration fit for offline
  44 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
  45 is fixed, this configuration should be used instead of the one
  46 currently in /etc/nscd.conf.  The changes are in the fields
  47 reload-count and positive-time-to-live, and is based on the
  48 instructions I found in the
  49 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
  50 instructions by Flyn Computing.
  51
  52 <blockquote><pre>
  53         debug-level             0
  54         reload-count            unlimited
  55         paranoia                no
  56
  57         enable-cache            passwd          yes
  58         positive-time-to-live   passwd          2592000
  59         negative-time-to-live   passwd          20
  60         suggested-size          passwd          211
  61         check-files             passwd          yes
  62         persistent              passwd          yes
  63         shared                  passwd          yes
  64         max-db-size             passwd          33554432
  65         auto-propagate          passwd          yes
  66
  67         enable-cache            group           yes
  68         positive-time-to-live   group           2592000
  69         negative-time-to-live   group           20
  70         suggested-size          group           211
  71         check-files             group           yes
  72         persistent              group           yes
  73         shared                  group           yes
  74         max-db-size             group           33554432
  75         auto-propagate          group           yes
  76
  77         enable-cache            hosts           no
  78         positive-time-to-live   hosts           2592000
  79         negative-time-to-live   hosts           20
  80         suggested-size          hosts           211
  81         check-files             hosts           yes
  82         persistent              hosts           yes
  83         shared                  hosts           yes
  84         max-db-size             hosts           33554432
  85
  86         enable-cache            services        yes
  87         positive-time-to-live   services        2592000
  88         negative-time-to-live   services        20
  89         suggested-size          services        211
  90         check-files             services        yes
  91         persistent              services        yes
  92         shared                  services        yes
  93         max-db-size             services        33554432
  94 </pre></blockquote>
  95
  96 <p>While we wait for the mechanism to update /etc/nsswitch.conf
  97 automatically provided in <a href="http://bugs.debian.org/496915">bug
  98 #496915</a>, it need to be replaced manually to ensure LDAP is used as
  99 the directory.  /etc/nsswitch.conf should look like this:</p>
 100
 101 <blockquote><pre>
 102 passwd:         files ldap
 103 group:          files ldap
 104 shadow:         files ldap
 105 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 106 networks:       files
 107 protocols:      files
 108 services:       files
 109 ethers:         files
 110 rpc:            files
 111 netgroup:       files ldap
 112 </pre></blockquote>
 113
 114 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser/pam_mkhomedir</h2>
 115
 116 <p>These packages need to be installed and configured</p>
 117
 118 <blockquote><pre>
 119 libpam-sss libnss-sss libpam-mklocaluser
 120 </pre></blockquote>
 121
 122 /etc/sssd/sssd.conf
 123
 124 <blockquote><pre>
 125 [sssd]
 126 config_file_version = 2
 127 reconnection_retries = 3
 128 sbus_timeout = 30
 129 services = nss, pam
 130 domains = UIO.NO
 131
 132 [nss]
 133 filter_groups = root
 134 filter_users = root
 135 reconnection_retries = 3
 136
 137 [pam]
 138 reconnection_retries = 3
 139
 140 [domain/UIO.NO]
 141 enumerate = false
 142 cache_credentials = true
 143
 144 id_provider = ldap
 145 auth_provider = ldap
 146 chpass_provider = ldap
 147
 148 ldap_uri = ldap://ldap.uio.no
 149 ldap_search_base = cn=system,dc=uio,dc=no
 150 ldap_tls_reqcert = never
 151 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 152 </pre></blockquote>
 153
 154 <blockquote><pre>
 155 </pre></blockquote>