[Fedora-directory-users] Re: Howto on Basic Setup

[Craig White]

On Wed, 2006-08-30 at 22:22 -0400, Tom Diehl wrote:
> On Wed, 30 Aug 2006, Craig White wrote:
> 
> > On Wed, 2006-08-30 at 17:35 -0500, Les Mikesell wrote:
> >> On Wed, 2006-08-30 at 22:23 +0300, Mike Jackson wrote:
> >>
> >>>> There seems to be a lot of install/design documentation regarding FDS,
> >>>> however I've not been able to find a quick "howto" on setting a FDS up
> >>>> for a small company. For example, say a shop with 25-50 linux machines
> >>>> and 150 or so user accounts.
> >>
> >>> Hi,
> >>>   FDS includes the posixAccount, posixGroup, and inetOrgPerson object
> >>> classes. You don't really need more than this to do simple user
> >>> authentication for linux and apache, as well as basic personnel info
> >>> management.
> >>
> >> And if you want to also use it as a back end for samba windows domain
> >> authentication with the same users/passwords?
> > -----
> > that's a horse of another color
> >
> > First you would have to import the samba schema appropriate for the
> > version of samba you are using.
> >
> > Then you would have to realize that the samba schema has
> > objectclasses/attributes that have nothing to do with
> > posixAccount/posixGroup/inetOrgPerson attributes (well, I do use
> > posixGroup but that is with sambaGroupMapping attributes.
> >
> > Then you would want to use a client that allows a single password entry
> > and encodes it for the userPassword (posixAccount/shadowAccount)
> > attribute and for the sambaNTPassword and optionally the
> > sambaLMPassword. Clients for this purpose are listed here...
> >
> > http://wiki.samba.org/index.php/Samba_%26_LDAP
> >
> > or of course, you can write your own code to accomplish this
> 
> Is it really all that different from using an ldap backend as described in the
> Samba HowTo??
----
nope - very little difference between integration on OpenLDAP or FDS -
make sure that you visit the samba wiki page on FDS wiki as it tells you
how to import openldap schemas and such.
----
> 
> Is there any reason the idealx scripts and the standard samba schema will not
> work?
----
Idealx scripts work fine (I barely use them though).

There is no such thing as a standard samba schema - it has been getting
continually tweaked at various stages in samba releases. Use the schema
appropriate for your samba release which I presume seeing your entries
on nahant/taroon lists will be supplied with your samba
installation...which would be 3.0.9.xx (taroon) 3.0.10.xx (nahant)
unless you replace it with kde-redhat samba like I do...

# rpm -q --whatprovides /usr/share/doc/samba-3.0.23b/LDAP/samba.schema
samba-3.0.23b-0.1.el4.kde

each release is slightly different - there is no 'standard samba schema'
-----
> 
> Just want to be sure I am not missing something, migrating to FDS is on my list
> of things to do.
----
go for it - keep openldap installed - do your migration - turn off
openldap and then start fds - should be a direct replacement when you
get it going.

just a little stupid thing that may be of help to you is a little shell
script that I wrote to take the slapcat output from openldap and delete
the attributes that will poison it so you can't import it into FDS...

# cat ol2fds-filter.sh
#!/bin/sh
#
#
input=dump.ldif
output=import-me.ldif
filt1=creatorsName
filt2=createTimestamp
filt3=modifiersName
filt4=modifyTimestamp
filt5=structuralObjectClass
filt6=entryUUID
filt7=entryCSN

/bin/grep -v $filt1 $input | \
/bin/grep -v $filt2 | \
/bin/grep -v $filt3 | \
/bin/grep -v $filt4 | \
/bin/grep -v $filt5 | \
/bin/grep -v $filt6 | \
/bin/grep -v $filt7 > $output

Craig