FC2 and general LDAP Support

[Roland Käser]

Hi all

What about moving the user database to LDAP for the FC2 release? It 
would be possible to integrate also the samba part of the user records 
directly to the LDAP directory.  The only thing we need is a useful ldap 
administration frontend and the command line tools for creating and 
modifying the user records from the command line. The most of the 
command line tools are shipped with the samba source code. It it is 
desired, i can make a RPM for that.

Greetings

Roland

-- 
Roland Käser
Bocksrietstr. 54
8200 Schaffhausen
Webmaster www.Israel-Jugendtag.ch

******************************************
 ** Schon vom Israel-Jugendtag gehört? **
******************************************
                   www.israel-jugendtag.ch

[Ralph angenendt]

Roland Käser wrote:
>  Hi all
>  
>  What about moving the user database to LDAP for the FC2 release?  
In general? Yikes! There's home users using Fedora, why throw LDAP unto
them - there's another daemon which has to run and be secured.

Ralph

[Roland Käser]

Hi

Whats wrong with the home users? You can bind the ldap server only to 
the localhost device. And if all the command line tools are customized 
for that, it would not make any changes for the home users. They can 
just create, modify and delete users as the normal passwd database. But 
it would get many advantages for the professional users and the network 
administrators. Think about all the other "operating systems" which have 
user directory support. There are many other possibilities for future 
releases such as saving the bind (DNS) structure inside the ldap, 
hosting the printers information from cups in the ldap,  mail routing 
information for postfix and courier etc. This main ldap infrastructure 
would be a big improvement to the distribution. And there are many other 
daemons which running on a "normal" system, one more whould doesn't matter.

Roland

Ralph Angenendt schrieb:

> Roland Käser wrote:
>   
>
> >Hi all
> >
> >What about moving the user database to LDAP for the FC2 release? 
> >    
> >
>
> In general? Yikes! There's home users using Fedora, why throw LDAP unto
> them - there's another daemon which has to run and be secured.
>
> Ralph
>   
>  
-- 
Roland Käser
Bocksrietstr. 54
8200 Schaffhausen
Webmaster www.Israel-Jugendtag.ch

******************************************
 ** Schon vom Israel-Jugendtag gehört? **
******************************************
                   www.israel-jugendtag.ch

[Alan Cox]

>  hosting the printers information from cups in the ldap,  mail routing
>
>  information for postfix and courier etc. This main ldap infrastructure 
>  would be a big improvement to the distribution. And there are many other 
>  daemons which running on a "normal" system, one more whould doesn't matter.
"When all you have is a hammer everything looks like a nail"

[Roland Käser]

What you mean with that?

Alan Cox schrieb:

> >hosting the printers information from cups in the ldap,  mail
> routing 
> >information for postfix and courier etc. This main ldap infrastructure 
> >would be a big improvement to the distribution. And there are many other 
> >daemons which running on a "normal" system, one more whould doesn't
> matter.
> >    
> >
>
> "When all you have is a hammer everything looks like a nail"
>
>
>
> --
> fedora-devel-list mailing list
> fedora-devel-list(a)redhat.com
> http://www.redhat.com/mailman/listinfo/fedora-devel-list
>   
>  
-- 
Roland Käser
Bocksrietstr. 54
8200 Schaffhausen
Webmaster www.Israel-Jugendtag.ch

******************************************
 ** Schon vom Israel-Jugendtag gehört? **
******************************************
                   www.israel-jugendtag.ch

[Alan Cox]

>  >"When all you have is a hammer everything looks like a
> nail" 
(Lost your question, please quote email the right way up)

It is a very famous quote about the dangers of trying to make everything fit
one paradigm when in fact it might not be a good fit.

[Wil Cooley]

On Wed, 2003-11-26 at 03:18, Roland Käser wrote:

>  What about moving the user database to LDAP for the FC2 release? It 
>  would be possible to integrate also the samba part of the user records 
>  directly to the LDAP directory.  The only thing we need is a useful ldap 
>  administration frontend and the command line tools for creating and 
>  modifying the user records from the command line. The most of the 
>  command line tools are shipped with the samba source code. It it is 
>  desired, i can make a RPM for that. 
While I am an LDAP advocate and agree that an admin tool for managing
users and groups in LDAP would be an appreciated addition (and maybe
managing printers and such there too), using it as the default would be
way overkill.  There are simply too many problems and it's not easy for
the less experienced to deal with.

Wil
-- 
Wil Cooley                                 wcooley(a)nakedape.cc
Naked Ape Consulting                        http://nakedape.cc
* * * * Linux, UNIX, Networking and Security Solutions * * * *
*     Tired of spam and viruses in your e-mail?  Get the     *
* Naked Ape Mail Defender! http://nakedape.cc/r/maildefender *

[Ulrich Drepper]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Lengthy thread, but I still want to add my 2¢.

Making LDAP the default is overkill for a lot of people.  Centralized
administration is useful in larger networks and maybe even in some home
networks.  My home network certainly qualifies as not-small but I still
wouldn't want it since I have different configurations on the different
machines.  LDAP must be introduced on demand, and not forced upon one.

BTW: it's not only the LDAP daemon which is needed, every machine in the
network would also have to use nscd.  Without it LDAP can be, ehm, slow.


What I completely agree with is that the LDAP integration into the
distribution isn't as good as it could get (euphemism).  Every time I
have to install it I do something wrong and it ends up costing me hours.

So, what I'd suggest as a first step is writing some meta RPMs which do
the conversion for you.  This Sun jvm RPM which has been repeatedly
mentioned here is a splendid idea: don't distribute the code, just a way
to make it work.  Make the code a dependency.

Same can be done for the LDAP stuff.  Make an RPM which requires all the
LDAP components which then does all or parts of this list:

~ create a key for the server
~ run the migration scripts
~ make the ldap nss module used locally
~ make sure nscd is running
~ eventually replace programs like useradd with useradd.ldap
~ create a script the admin can run on the other machines in the network
~ etc etc

Make it a pleasant experience to install LDAP.  No programming
experience requires, just admin knowledge.


Step 2 is then creating an environment to actually maintain such an
installation.  Probably graphic tools etc.  But this is step 2.


IMO such meta RPMs are truly a nice way to do these things.  There can
even be multiple versions of such RPMs.  For instance for the LDAP case,
with or without AD support.  That's a nice little project for somebody
who wants to get involved in the FC project.  I can certainly add what I
know.  Volunteers?

- -- 
➧ Ulrich Drepper ➧ Red Hat, Inc. ➧ 444 Castro St ➧ Mountain View, CA ❖
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.3 (GNU/Linux)
>
> iD8DBQE/xUpR2ijCOnn/RHQRAoshAKChePkYG8o4qhZ3utsxNEj20pYDIgCeJOc6
> XaITdUs0RAW1LV0/PtWKBlI=
> =9LLk
> -----END PGP SIGNATURE-----

meta-packages (was Re: FC2 and general LDAP Support)

[Steven Pritchard]

On Wed, Nov 26, 2003 at 04:50:25PM -0800, Ulrich Drepper wrote:
>  IMO such meta RPMs are truly a nice way to do these things. 
That reminds me...  Since Fedora Core includes tools that will
automatically install dependencies, would now be a good time to think
about adding meta-packages for things like KDE, GNOME, etc.?

Steve
-- 
Steven Pritchard - K&S Pritchard Enterprises, Inc.
Email: steve(a)kspei.com             http://www.kspei.com/
Phone: [phone]               Mobile: [phone]

meta-packages (was Re: FC2 and general LDAP Support)

[Panu Matilainen]

On Wed, 26 Nov 2003, Steven Pritchard wrote:

>  On Wed, Nov 26, 2003 at 04:50:25PM -0800, Ulrich Drepper wrote:
>  > IMO such meta RPMs are truly a nice way to do these things.
>  
>  That reminds me...  Since Fedora Core includes tools that will
>  automatically install dependencies, would now be a good time to think
>  about adding meta-packages for things like KDE, GNOME, etc.? 
Been there, done that, trust me you do not want those as meta-packages 
(empty packages except with huge amount of requires: foo, bar ...). 
There are better ways to achieve the effect, have a look at yum's 
groupinstall operation which uses comps.xml to find out what belongs to 
what group but doesn't require installing additional bogus packages which 
just create bogus dependencies. Apt can do the same with a little help 
from Lua, latest apt-rpm version has apt-groupinstall in contrib/ 
directory which does just that.

	- Panu -

[Enrico Scholz]

roli(a)israel-jugendtag.ch (Roland Käser) writes:

>  What about moving the user database to LDAP for the FC2 release?
LDAP is not LDAP. Depending on the environment, different schemes with
different, perhaps mandatory attributes will be used. So you will need
some pre-configuration before installing the real Fedora Core and the
useradd tools must be configurable to support the used scheme with
reasonable defaults. 'useradd' will have to deal with other attributes
(address, jpegphoto) and used authentication method (e.g. krb5 allows
special password attributes).

Implementing this is not trivial and would be too much overkill for normal
usage of FC (a standalone desktop). The nss_ldap module is ... aeh .. a
little bit unstable; using it with TLS and non-selfsigned certificates
gives mysterious faults when CA chain is not known, and network-faults are
giving authentication errors for local users (root).



>  It would be possible to integrate also the samba part of the user
>  records directly to the LDAP directory.  The only thing we need is a
>  useful ldap administration frontend 
I have never tested it, but http://www.gonicus.de/eng/index.html sounds
very promising.




Enrico

[Shahms King]

On Wed, 2003-11-26 at 18:12, Enrico Scholz wrote:
>  roli(a)israel-jugendtag.ch (Roland Käser) writes:
>  
>  > What about moving the user database to LDAP for the FC2 release?
>  
>  LDAP is not LDAP. Depending on the environment, different schemes with
>  different, perhaps mandatory attributes will be used. So you will need
>  some pre-configuration before installing the real Fedora Core and the
>  useradd tools must be configurable to support the used scheme with
>  reasonable defaults. 'useradd' will have to deal with other attributes
>  (address, jpegphoto) and used authentication method (e.g. krb5 allows
>  special password attributes).
>  
>  Implementing this is not trivial and would be too much overkill for normal
>  usage of FC (a standalone desktop). The nss_ldap module is ... aeh .. a
>  little bit unstable; using it with TLS and non-selfsigned certificates
>  gives mysterious faults when CA chain is not known, and network-faults are
>  giving authentication errors for local users (root). 
Different schemas is one thing, but, um, there are actually standard
schemas defined (that come with OpenLDAP) for all of this.  You can
pretty much bet that if someone has users and groups in the LDAP server,
they're using posixAccount and posixGroup objectclasses to do it.  And
if they're using Samba 2.x with LDAP they're using sambaAccount (yes, I
promise you they are, they don't have a choice in the matter). The
useradd tools don't need to know anything about the schema beyond what
is already available in /etc/ldap.conf (which provides a simple system
of 'attribute maps'  to deal with slight variations in attribute names
between schemas that don't follow the "standard" -- NDS, AIX, and AD SFU
being the most egregious offenders).

Additionally, while I think it's ridiculous to put the user database in
LDAP where it isn't warranted (especially by default), if that were to
happen, schemas would not be an issue as there would only be one schema
used by the Fedora LDAP user information and you can be almost certain
the Fedora user management tools would understand that schema at the
very least.

There is a difference between stability and a poor default
configuration.  I have had problems with SSL/TLS as well (but, well, the
certs we use have issues, they're self-signed and expired, so having
problems is to be expected ;-P).  Network faults (well, *any* fault) can
cause auth errors for local users if pam is configured incorrectly,
otherwise network errors will not impact local users *at all* (well,
other than a possible delay when they enter their password). 
Unfortunately, the Fedora authconfig *slightly* misconfigures pam by
leaving out 'service_err=ignore' (I think, it's been a while since I've
had to fix this anywhere it might be 'system_err=ignore' that it doesn't
add.) But anyway, once it's correctly configured I've never had any
problems with stability.

-- 
--Shahms