blog/archive/2010/07/index.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2         "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html>
   4  <head>
   5   <title>Petter Reinholdtsen: entries from July 2010</title>
   6   <link rel="stylesheet" type="text/css" media="screen" href="http://people.skolelinux.org/pere/blog/style.css">
   7   <link rel="alternate" title="RSS Feed" href="07.rss" type="application/rss+xml">
   8  </head>
   9  <body>
  10 <!-- XML FEED -->
  11
  12  <div class="title">
  13   <h1>
  14        <a href="http://people.skolelinux.org/pere/blog/">Petter Reinholdtsen</a>
  15
  16   </h1>
  17
  18  </div>
  19
  20  <p>Entries from July 2010.</p>
  21
  22
  23 <div class="entry">
  24  <div class="title">
  25  <a href="http://people.skolelinux.org/pere/blog/Caching_password__user_and_group_on_a_roaming_Debian_laptop.html">Caching password, user and group on a roaming Debian laptop</a>
  26  </div>
  27  <div class="date">
  28   2010-07-01 11:40
  29  </div>
  30
  31  <div class="body">
  32
  33 <p>For a laptop, centralized user directories and password checking is
  34 a bit troubling.  Laptops are typically used also when not connected
  35 to the network, and it is vital for a user to be able to log in or
  36 unlock the screen saver also when a central server is unavailable.
  37 This is possible by caching passwords and directory information (user
  38 and group attributes) locally, and the packages to do so are available
  39 in Debian.  Here follow two recipes to set this up in Debian/Squeeze.
  40 It is also possible to set up in Debian/Lenny, but require more manual
  41 setup there because pam-auth-update is missing in Lenny.</p>
  42
  43 <h2>LDAP/Kerberos + nscd + libpam-ccreds + libpam-mklocaluser/pam_mkhomedir</h2>
  44
  45 This is the traditional method with a twist.  The password caching is
  46 provided by libpam-ccreds (version 10-4 or later is needed on
  47 Squeeze), and the directory caching is done by nscd.  The directory
  48 lookup and password checking is done using LDAP.  If one want to use
  49 Kerberos for password checking the libpam-ldapd package can be
  50 replaced with libpam-krb5 or libpam-heimdal.  If one is happy having a
  51 local home directory with the path listed in LDAP, one can use the
  52 pam_mkhomedir module from pam-modules to make this happen instead of
  53 using libpam-mklocaluser.  A setup for pam-auth-update to enable
  54 pam_mkhomedir will have to be written until a fix for
  55 <a href="http://bugs.debian.org/568577">bug #568577</a> is in the
  56 archive.  Because I believe it is a bad idea to have local home
  57 directories using misleading paths like /site/server/partition/, I
  58 prefer to create a local user with the home directory in /home/.  This
  59 is done using the libpam-mklocaluser package.</p>
  60
  61 <p>These packages need to be installed and configured</p>
  62
  63 <blockquote><pre>
  64 libnss-ldapd libpam-ldapd nscd libpam-ccreds libpam-mklocaluser
  65 </pre></blockquote>
  66
  67 <p>The ldapd packages will ask for LDAP connection information, and
  68 one have to fill in the values that fits ones own site.  Make sure the
  69 PAM part uses encrypted connections, to make sure the password is not
  70 sent in clear text to the LDAP server.  I've been unable to get TLS
  71 certificate checking for a self signed certificate working, which make
  72 LDAP authentication unsafe for Debian Edu (nslcd is not checking if it
  73 is talking to the correct LDAP server), and very much welcome feedback
  74 on how to get this working.</p>
  75
  76 <p>Because nscd do not have a default configuration fit for offline
  77 caching until <a href="http://bugs.debian.org/485282">bug #485282</a>
  78 is fixed, this configuration should be used instead of the one
  79 currently in /etc/nscd.conf.  The changes are in the fields
  80 reload-count and positive-time-to-live, and is based on the
  81 instructions I found in the
  82 <a href="http://www.flyn.org/laptopldap/">LDAP for Mobile Laptops</a>
  83 instructions by Flyn Computing.</p>
  84
  85 <blockquote><pre>
  86         debug-level             0
  87         reload-count            unlimited
  88         paranoia                no
  89
  90         enable-cache            passwd          yes
  91         positive-time-to-live   passwd          2592000
  92         negative-time-to-live   passwd          20
  93         suggested-size          passwd          211
  94         check-files             passwd          yes
  95         persistent              passwd          yes
  96         shared                  passwd          yes
  97         max-db-size             passwd          33554432
  98         auto-propagate          passwd          yes
  99
 100         enable-cache            group           yes
 101         positive-time-to-live   group           2592000
 102         negative-time-to-live   group           20
 103         suggested-size          group           211
 104         check-files             group           yes
 105         persistent              group           yes
 106         shared                  group           yes
 107         max-db-size             group           33554432
 108         auto-propagate          group           yes
 109
 110         enable-cache            hosts           no
 111         positive-time-to-live   hosts           2592000
 112         negative-time-to-live   hosts           20
 113         suggested-size          hosts           211
 114         check-files             hosts           yes
 115         persistent              hosts           yes
 116         shared                  hosts           yes
 117         max-db-size             hosts           33554432
 118
 119         enable-cache            services        yes
 120         positive-time-to-live   services        2592000
 121         negative-time-to-live   services        20
 122         suggested-size          services        211
 123         check-files             services        yes
 124         persistent              services        yes
 125         shared                  services        yes
 126         max-db-size             services        33554432
 127 </pre></blockquote>
 128
 129 <p>While we wait for a mechanism to update /etc/nsswitch.conf
 130 automatically like the one provided in
 131 <a href="http://bugs.debian.org/496915">bug #496915</a>, the file
 132 content need to be manually replaced to ensure LDAP is used as the
 133 directory service on the machine.  /etc/nsswitch.conf should normally
 134 look like this:</p>
 135
 136 <blockquote><pre>
 137 passwd:         files ldap
 138 group:          files ldap
 139 shadow:         files ldap
 140 hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
 141 networks:       files
 142 protocols:      files
 143 services:       files
 144 ethers:         files
 145 rpc:            files
 146 netgroup:       files ldap
 147 </pre></blockquote>
 148
 149 <p>The important parts are that ldap is listed last for passwd, group,
 150 shadow and netgroup.</p>
 151
 152 <p>With these changes in place, any user in LDAP will be able to log
 153 in locally on the machine using for example kdm, get a local home
 154 directory created and have the password as well as user and group
 155 attributes cached.
 156
 157 <h2>LDAP/Kerberos + nss-updatedb + libpam-ccreds +
 158   libpam-mklocaluser/pam_mkhomedir</h2>
 159
 160 <p>Because nscd have had its share of problems, and seem to have
 161 problems doing proper caching, I've seen suggestions and recipes to
 162 use nss-updatedb to copy parts of the LDAP database locally when the
 163 LDAP database is available.  I have not tested such setup, because I
 164 discovered sssd.</p>
 165
 166 <h2>LDAP/Kerberos + sssd + libpam-mklocaluser</h2>
 167
 168 <p>A more flexible and robust setup than the nscd combination
 169 mentioned earlier that has shown up recently, is the
 170 <a href="https://fedorahosted.org/sssd/">sssd</a> package from Redhat.
 171 It is part of the <a href="http://www.freeipa.org/">FreeIPA</A> project
 172 to provide a Active Directory like directory service for Linux
 173 machines.  The sssd system combines the caching of passwords and user
 174 information into one package, and remove the need for nscd and
 175 libpam-ccreds.  It support LDAP and Kerberos, but not NIS.  Version
 176 1.2 do not support netgroups, but it is said that it will support this
 177 in version 1.5 expected to show up later in 2010.  Because the
 178 <a href="http://packages.qa.debian.org/s/sssd.html">sssd package</a>
 179 was missing in Debian, I ended up co-maintaining it with Werner, and
 180 version 1.2 is now in testing.
 181
 182 <p>These packages need to be installed and configured to get the
 183 roaming setup I want</p>
 184
 185 <blockquote><pre>
 186 libpam-sss libnss-sss libpam-mklocaluser
 187 </pre></blockquote>
 188
 189 The complete setup of sssd is done by editing/creating
 190 <tt>/etc/sssd/sssd.conf</tt>.
 191
 192 <blockquote><pre>
 193 [sssd]
 194 config_file_version = 2
 195 reconnection_retries = 3
 196 sbus_timeout = 30
 197 services = nss, pam
 198 domains = INTERN
 199
 200 [nss]
 201 filter_groups = root
 202 filter_users = root
 203 reconnection_retries = 3
 204
 205 [pam]
 206 reconnection_retries = 3
 207
 208 [domain/INTERN]
 209 enumerate = false
 210 cache_credentials = true
 211
 212 id_provider = ldap
 213 auth_provider = ldap
 214 chpass_provider = ldap
 215
 216 ldap_uri = ldap://ldap
 217 ldap_search_base = dc=skole,dc=skolelinux,dc=no
 218 ldap_tls_reqcert = never
 219 ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
 220 </pre></blockquote>
 221
 222 <p>I got the same problem here with certificate checking.  Had to set
 223 "ldap_tls_reqcert = never" to get it working.</p>
 224
 225 <p>With the libnss-sss package in testing at the moment, the
 226 nsswitch.conf file is update automatically, so there is no need to
 227 modify it manually.</p>
 228
 229 <p>If you want to help out with implementing this for Debian Edu,
 230 please contact us on debian-edu@lists.debian.org.</p>
 231
 232  </div>
 233  <div class="tags">
 234
 235
 236
 237   Tags: <a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu</a>, <a href="http://people.skolelinux.org/pere/blog/tags/english">english</a>, <a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap</a>, <a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug</a>.
 238
 239  </div>
 240 </div>
 241  <div class="padding"></div>
 242
 243  <p style="text-align: right;"><a href="07.rss"><img src="http://people.skolelinux.org/pere/blog/xml.gif" alt="RSS Feed" width="36" height="14"></a></p>
 244
 245
 246
 247 <div id="sidebar">
 248
 249 <h2>Archive</h2>
 250 <ul>
 251
 252 <li>2010
 253 <ul>
 254
 255 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/01/">January (2)</a></li>
 256
 257 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/02/">February (1)</a></li>
 258
 259 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/03/">March (3)</a></li>
 260
 261 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/04/">April (3)</a></li>
 262
 263 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/05/">May (9)</a></li>
 264
 265 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/06/">June (14)</a></li>
 266
 267 <li><a href="http://people.skolelinux.org/pere/blog/archive/2010/07/">July (1)</a></li>
 268
 269 </ul></li>
 270
 271 <li>2009
 272 <ul>
 273
 274 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/01/">January (8)</a></li>
 275
 276 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/02/">February (8)</a></li>
 277
 278 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/03/">March (12)</a></li>
 279
 280 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/04/">April (10)</a></li>
 281
 282 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/05/">May (9)</a></li>
 283
 284 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/06/">June (3)</a></li>
 285
 286 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/07/">July (4)</a></li>
 287
 288 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/08/">August (3)</a></li>
 289
 290 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/09/">September (1)</a></li>
 291
 292 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/10/">October (2)</a></li>
 293
 294 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/11/">November (3)</a></li>
 295
 296 <li><a href="http://people.skolelinux.org/pere/blog/archive/2009/12/">December (3)</a></li>
 297
 298 </ul></li>
 299
 300 <li>2008
 301 <ul>
 302
 303 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/11/">November (5)</a></li>
 304
 305 <li><a href="http://people.skolelinux.org/pere/blog/archive/2008/12/">December (7)</a></li>
 306
 307 </ul></li>
 308
 309 </ul>
 310
 311
 312
 313 <h2>Tags</h2>
 314 <ul>
 315
 316  <li><a href="http://people.skolelinux.org/pere/blog/tags/3d-printer">3d-printer (11)</a></li>
 317
 318  <li><a href="http://people.skolelinux.org/pere/blog/tags/amiga">amiga (1)</a></li>
 319
 320  <li><a href="http://people.skolelinux.org/pere/blog/tags/aros">aros (1)</a></li>
 321
 322  <li><a href="http://people.skolelinux.org/pere/blog/tags/bootsystem">bootsystem (10)</a></li>
 323
 324  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian">debian (29)</a></li>
 325
 326  <li><a href="http://people.skolelinux.org/pere/blog/tags/debian edu">debian edu (29)</a></li>
 327
 328  <li><a href="http://people.skolelinux.org/pere/blog/tags/english">english (42)</a></li>
 329
 330  <li><a href="http://people.skolelinux.org/pere/blog/tags/fiksgatami">fiksgatami (1)</a></li>
 331
 332  <li><a href="http://people.skolelinux.org/pere/blog/tags/fildeling">fildeling (7)</a></li>
 333
 334  <li><a href="http://people.skolelinux.org/pere/blog/tags/kart">kart (2)</a></li>
 335
 336  <li><a href="http://people.skolelinux.org/pere/blog/tags/ldap">ldap (4)</a></li>
 337
 338  <li><a href="http://people.skolelinux.org/pere/blog/tags/lenker">lenker (1)</a></li>
 339
 340  <li><a href="http://people.skolelinux.org/pere/blog/tags/ltsp">ltsp (1)</a></li>
 341
 342  <li><a href="http://people.skolelinux.org/pere/blog/tags/multimedia">multimedia (5)</a></li>
 343
 344  <li><a href="http://people.skolelinux.org/pere/blog/tags/norsk">norsk (69)</a></li>
 345
 346  <li><a href="http://people.skolelinux.org/pere/blog/tags/nuug">nuug (80)</a></li>
 347
 348  <li><a href="http://people.skolelinux.org/pere/blog/tags/opphavsrett">opphavsrett (13)</a></li>
 349
 350  <li><a href="http://people.skolelinux.org/pere/blog/tags/personvern">personvern (13)</a></li>
 351
 352  <li><a href="http://people.skolelinux.org/pere/blog/tags/reprap">reprap (10)</a></li>
 353
 354  <li><a href="http://people.skolelinux.org/pere/blog/tags/rss">rss (1)</a></li>
 355
 356  <li><a href="http://people.skolelinux.org/pere/blog/tags/sikkerhet">sikkerhet (9)</a></li>
 357
 358  <li><a href="http://people.skolelinux.org/pere/blog/tags/sitesummary">sitesummary (3)</a></li>
 359
 360  <li><a href="http://people.skolelinux.org/pere/blog/tags/standard">standard (13)</a></li>
 361
 362  <li><a href="http://people.skolelinux.org/pere/blog/tags/stavekontroll">stavekontroll (1)</a></li>
 363
 364  <li><a href="http://people.skolelinux.org/pere/blog/tags/video">video (10)</a></li>
 365
 366  <li><a href="http://people.skolelinux.org/pere/blog/tags/vitenskap">vitenskap (1)</a></li>
 367
 368  <li><a href="http://people.skolelinux.org/pere/blog/tags/web">web (6)</a></li>
 369
 370 </ul>
 371
 372 </div>
 373 </body>
 374 </html>