blog/archive/2010/07/07.rss

   1 <?xml version="1.0" encoding="ISO-8859-1"?>
   2 <rss version='2.0' xmlns:lj='http://www.livejournal.org/rss/lj/1.0/'>
   3         <channel>
   4                 <title>Petter Reinholdtsen - Entries from July 2010</title>
   5                 <description>Entries from July 2010</description>
   6                 <link>http://people.skolelinux.org/pere/blog/</link>
   7
   8
   9         <item>
  10                 <title>Caching password, user and group on a roaming Debian laptop</title>
  11                 <link>http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html</link>
  12                 <guid isPermaLink="true">http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html</guid>
  13                 <pubDate>Thu, 1 Jul 2010 11:40:00 +0200</pubDate>
  14                 <description>
  15 &lt;p&gt;For a laptop, centralized user directories and password checking is
  16 a bit troubling.  Laptops are typically used also when not connected
  17 to the network, and it is vital for a user to be able to log in or
  18 unlock the screen saver also when a central server is unavailable.
  19 This is possible by caching passwords and directory information (user
  20 and group attributes) locally, and the packages to do so are available
  21 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
  22 It is also possible to set up in Debian/Lenny, but require more manual
  23 setup there because pam-auth-update is missing in Lenny.&lt;/p&gt;
  24
  25 &lt;h2&gt;LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir&lt;/h2&gt;
  26
  27 This is the traditional method with a twist.  The password caching is
  28 provided by libpam-ccreds (version 10-4 or later is needed on
  29 Squeeze), and the directory caching is done by nscd.  The directory
  30 lookup and password checking is done using LDAP.  If one want to use
  31 Kerberos for password checking the libpam-ldapd package can be
  32 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
  33 local home directory with the path listed in LDAP, one can use the
  34 pam_mkhomedir module from pam-modules to make this happen instead of
  35 using libpam-mklocaluser.  A setup for pam-auth-update to enable
  36 pam_mkhomedir will have to be written until a fix for
  37 &lt;a href=&quot;http://bugs.debian.org/568577&quot;&gt;bug #568577&lt;/a&gt; is in the
  38 archive.  Because I believe it is a bad idea to have local home
  39 directories using misleading paths like /site/server/partition/, I
  40 prefer to create a local user with the home directory in /home/.  This
  41 is done using the libpam-mklocaluser package.&lt;/p&gt;
  42
  43 &lt;p&gt;These packages need to be installed and configured&lt;/p&gt;
  44
  45 &lt;blockquote&gt;&lt;pre&gt;
  46 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
  47 &lt;/pre&gt;&lt;/blockquote&gt;
  48
  49 &lt;p&gt;The ldapd packages will ask for LDAP connection information, and
  50 one have to fill in the values that fits ones own site.  Make sure the
  51 PAM part uses encrypted connections, to make sure the password is not
  52 sent in clear text to the LDAP server.  I&#39;ve been unable to get TLS
  53 certificate checking for a self signed certificate working, which make
  54 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
  55 is talking to the correct LDAP server), and very much welcome feedback
  56 on how to get this working.&lt;/p&gt;
  57
  58 &lt;p&gt;Because nscd do not have a default configuration fit for offline
  59 caching until &lt;a href=&quot;http://bugs.debian.org/485282&quot;&gt;bug #485282&lt;/a&gt;
  60 is fixed, this configuration should be used instead of the one
  61 currently in /etc/nscd.conf.  The changes are in the fields
  62 reload-count and positive-time-to-live, and is based on the
  63 instructions I found in the
  64 &lt;a href=&quot;http://www.flyn.org/laptopldap/&quot;&gt;LDAP for Mobile Laptops&lt;/a&gt;
  65 instructions by Flyn Computing.&lt;/p&gt;
  66
  67 &lt;blockquote&gt;&lt;pre&gt;
  68         debug-level             0
  69         reload-count            unlimited
  70         paranoia                no
  71
  72         enable-cache            passwd          yes
  73         positive-time-to-live   passwd          2592000
  74         negative-time-to-live   passwd          20
  75         suggested-size          passwd          211
  76         check-files             passwd          yes
  77         persistent              passwd          yes
  78         shared                  passwd          yes
  79         max-db-size             passwd          33554432
  80         auto-propagate          passwd          yes
  81
  82         enable-cache            group           yes
  83         positive-time-to-live   group           2592000
  84         negative-time-to-live   group           20
  85         suggested-size          group           211
  86         check-files             group           yes
  87         persistent              group           yes
  88         shared                  group           yes
  89         max-db-size             group           33554432
  90         auto-propagate          group           yes
  91
  92         enable-cache            hosts           no
  93         positive-time-to-live   hosts           2592000
  94         negative-time-to-live   hosts           20
  95         suggested-size          hosts           211
  96         check-files             hosts           yes
  97         persistent              hosts           yes
  98         shared                  hosts           yes
  99         max-db-size             hosts           33554432
 100
 101         enable-cache            services        yes
 102         positive-time-to-live   services        2592000
 103         negative-time-to-live   services        20
 104         suggested-size          services        211
 105         check-files             services        yes
 106         persistent              services        yes
 107         shared                  services        yes
 108         max-db-size             services        33554432
 109 &lt;/pre&gt;&lt;/blockquote&gt;
 110
 111 &lt;p&gt;While we wait for a mechanism to update /etc/nsswitch.conf
 112 automatically like the one provided in
 113 &lt;a href=&quot;http://bugs.debian.org/496915&quot;&gt;bug #496915&lt;/a&gt;, the file
 114 content need to be manually replaced to ensure LDAP is used as the
 115 directory service on the machine.  /etc/nsswitch.conf should normally
 116 look like this:&lt;/p&gt;
 117
 118 &lt;blockquote&gt;&lt;pre&gt;
 119 passwd:         files ldap
 120 group:          files ldap
 121 shadow:         files ldap
 122 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 123 networks:       files
 124 protocols:      files
 125 services:       files
 126 ethers:         files
 127 rpc:            files
 128 netgroup:       files ldap
 129 &lt;/pre&gt;&lt;/blockquote&gt;
 130
 131 &lt;p&gt;The important parts are that ldap is listed last for passwd, group,
 132 shadow and netgroup.&lt;/p&gt;
 133
 134 &lt;p&gt;With these changes in place, any user in LDAP will be able to log
 135 in locally on the machine using for example kdm, get a local home
 136 directory created and have the password as well as user and group
 137 attributes cached.
 138
 139 &lt;h2&gt;LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 140   libpam-mklocaluser/pam_mkhomedir&lt;/h2&gt;
 141
 142 &lt;p&gt;Because nscd have had its share of problems, and seem to have
 143 problems doing proper caching, I&#39;ve seen suggestions and recipes to
 144 use nss-updatedb to copy parts of the LDAP database locally when the
 145 LDAP database is available.  I have not tested such setup, because I
 146 discovered sssd.&lt;/p&gt;
 147
 148 &lt;h2&gt;LDAP/Kerberos + sssd + libpam-mklocaluser&lt;/h2&gt;
 149
 150 &lt;p&gt;A more flexible and robust setup than the nscd combination
 151 mentioned earlier that has shown up recently, is the
 152 &lt;a href=&quot;https://fedorahosted.org/sssd/&quot;&gt;sssd&lt;/a&gt; package from Redhat.
 153 It is part of the &lt;a href=&quot;http://www.freeipa.org/&quot;&gt;FreeIPA&lt;/A&gt; project
 154 to provide a Active Directory like directory service for Linux
 155 machines.  The sssd system combines the caching of passwords and user
 156 information into one package, and remove the need for nscd and
 157 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 158 1.2 do not support netgroups, but it is said that it will support this
 159 in version 1.5 expected to show up later in 2010.  Because the
 160 &lt;a href=&quot;http://packages.qa.debian.org/s/sssd.html&quot;&gt;sssd package&lt;/a&gt;
 161 was missing in Debian, I ended up co-maintaining it with Werner, and
 162 version 1.2 is now in testing.
 163
 164 &lt;p&gt;These packages need to be installed and configured to get the
 165 roaming setup I want&lt;/p&gt;
 166
 167 &lt;blockquote&gt;&lt;pre&gt;
 168 libpam-sss libnss-sss libpam-mklocaluser
 169 &lt;/pre&gt;&lt;/blockquote&gt;
 170
 171 The complete setup of sssd is done by editing/creating
 172 &lt;tt&gt;/etc/sssd/sssd.conf&lt;/tt&gt;.
 173
 174 &lt;blockquote&gt;&lt;pre&gt;
 175 [sssd]
 176 config_file_version = 2
 177 reconnection_retries = 3
 178 sbus_timeout = 30
 179 services = nss, pam
 180 domains = INTERN
 181
 182 [nss]
 183 filter_groups = root
 184 filter_users = root
 185 reconnection_retries = 3
 186
 187 [pam]
 188 reconnection_retries = 3
 189
 190 [domain/INTERN]
 191 enumerate = false
 192 cache_credentials = true
 193
 194 id_provider = ldap
 195 auth_provider = ldap
 196 chpass_provider = ldap
 197
 198 ldap_uri = ldap://ldap
 199 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 200 ldap_tls_reqcert = never
 201 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 202 &lt;/pre&gt;&lt;/blockquote&gt;
 203
 204 &lt;p&gt;I got the same problem here with certificate checking.  Had to set
 205 &quot;ldap_tls_reqcert = never&quot; to get it working.&lt;/p&gt;
 206
 207 &lt;p&gt;With the libnss-sss package in testing at the moment, the
 208 nsswitch.conf file is update automatically, so there is no need to
 209 modify it manually.&lt;/p&gt;
 210
 211 &lt;p&gt;If you want to help out with implementing this for Debian Edu,
 212 please contact us on debian-edu@lists.debian.org.&lt;/p&gt;
 213 </description>
 214         </item>
 215
 216         </channel>
 217 </rss>