0

So me and my team are responsible for administrating computer labs for students back at my university. For that matter, we have an Ubuntu Server 14.04 as a Lightweight Directory Access Protocol (LDAP) and Network File System (NFS) server, giving them accounts with remote access to their files to work in any computer within those labs.

To easily handle the administration and organization of these accounts, we use the LDAP Account Manager (LAM), the web front-end. And here comes the issue: the LAM is not capable of doing his whole purpose. Through it, we create user accounts, for example. So far so good. But we have to manually log into de LDAP server and create the user's home directory for it to properly work. That is, until now, the lamdaemon was not configured, so we have to manually make the necessary changes in the server. You could say that it was not the priority when the server was implemented and now we are giving it attention.

That being said, we started trying to make the lamdaemon work. It is installed on the server, and the LAM admin account was modified (giving it the attributes "PosixAccount" and "id") to be able to run the lamdaemon.pl. It is able to run, but not as expected. Now I will try to actually show what are the errors and the configurations of the server.

  • Users accounts have their home directories created at /export/home.
  • For the automount, we have set the configuration files auto.master and auto.home as follows:

auto.master:

/home   /etc/auto.home
+auto.master

auto.home:

 *    192.168.1.254,192.168.2.254:/export/home/&
  • A user foo has it's entry as follows:
dn: cn=foo,ou=bar,ou=group,dc=server,dc=at,dc=this,dc=location
cn: foo
gidnumber: 2000
homedirectory: /home/foo
loginshell: /bin/bash
objectclass: account
objectclass: posixAccount
objectclass: top
uid: foo
uidnumber: 22273
userpassword: {MD5}aY3BnUicTk23PiinE+qwew==

These are some of the configurations of our working LDAP and NFS server, but without the lamdaemon feature. As you may have noticed, the user entry says it's home directory is located at /home/foo but I told you that it actually is at /export/home/foo.

So we figured this was a problem for the lamdaemon after we had it configured and tested it by creating a user (using the LAM) with the correct home location according to the server. The user is created and the home folder too (without the need of manually creating the folder. It's what we want!). All the permissions and ownership are correct. When trying to login with the user, it logs in, but the following error is showed:

Could not chdir to home directory /export/home/foo: Permission denied
-bash: /export/home/foo/.bash_profile: Permission denied

And his directory in not mounted, therefore the user is not able to initiate a graphic session. That's the main issue. The lamdaemon seems to be working but something is off with the server configurations that is making this error happen. And we don't really know what is causing it, or where it could be at this point, so I'm sorry for this long text and possibly short with useful information that could help. If there's anything relevant missing, please leave a comment so I can get it.

Any tips or suggestions are highly welcome.

0

What role does LAM play in the user logging in? Isn't it just a frontend to creating/deleting users and so on?

Are you using NFSv3 or NFSv4? If the latter, are you using Kerberos?

Look at UID/GID mappings (idmapd). Both nfsd and slapd need to agree what UID/GID to map to users.

  • Yes, LAM is just a web frontend. My problem is that it works in a seemingly wrong way. And when we changed the settings, the LAM using the lamdaemon worked but users couldn't login anymore. We don't use Kerberos. And the idmpd seems to be ok. As I said, the server works. We just want to "improve" it by making the lamdeamon functional. – dellief Dec 14 '15 at 15:59
  • If logins only break for users created with LAM I suggest you compare LDAP entries for users created manually and those created with LAM. – pmatulis Dec 14 '15 at 16:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.