2

Let's say I have a server with Ubuntu and 10-15 user accounts on it. After some time the server crashes with whatever reason. Of course, you could look at the back-up and reset it to the time before the problem.

I was thinking this morning about the following ( it could be a classic example of reinventing the wheel, but I am not a sys admin for 10 years ;) ). Let's say that you could separate the user accounts from the OS. This way the server gets the account data and software from a different location and load it locally, but let's say your server base image dies. Then there is no problem, you simple spin up a different ubuntu OS and load the user accounts again.

Question: Is there software to support this? or are there different solutions to tackle this problem?

2 Answers 2

2

On Linux, this typically accomplished using LDAP. Commonly used is the OpenLDAP server, with various client-side daemons like nslcd, SSSD, etc. The Ubuntu Server Guide has a section on OpenLDAP.

When using LDAP, it's also common to serve home directories from a common server via NFS, etc. NFS is also covered in the Server Guide.

Of course, if crashing is the issue, then you're just pushing the problem one level down. The difference is that when your LDAP server goes down, all your servers are effectively down.

7
  • Ah, cool! I thought that LDAP only was used to login on a central point, but this way could work.
    – user366546
    Dec 25, 2015 at 9:54
  • 1
    @user3892683 If you're logging in to a central point, what's the use of LDAP? The accounts would all be local to that central server. O.o
    – muru
    Dec 25, 2015 at 9:55
  • 1
    @user3892683 But why? If the users are all accessing the central server, the mail should be delivered there. In my experience, if LDAP is used for mail, its also used for logging into separate systems, both OS-level and application level (like mail, websites, etc.).
    – muru
    Dec 25, 2015 at 10:02
  • 1
    If you have one single central server, you don't need distributed authentication and authorization (yes, that is two different things). Everything is located in that server. If you have different servers, like file servers, web servers and mail servers, you definitely need distributed authentication and authorization or all accounts will turn up as a mess... And standard is using LDAP and Kerberos, but you could distribute /etc/passwd, /etc/shadow, /etc/groups, /etc/fstab etc in some unstandard and probably unsecure way.
    – Anders
    Dec 27, 2015 at 12:56
  • 1
    @Anders As I do have. My point, however, is that the root cause of these crashes must be solved, instead of sticking Band-Aids on them.
    – muru
    Dec 27, 2015 at 13:32
1

LDAP is the obvious and common sollution, but you should also look into Kerberos. With LDAP you basically only get contents of /etc/passwd, /etc/groups, /etc/hosts, etc. distributed, which is a good step to a solution. With Kerberos you will also get authentication distributed, with some real security, authentication of servers too. So if you log in on one machine, you don't need to log in on others and you know you logged in on the right one.

MS AD is basicly a combination of LDAP, Kerberos and scripts and directories distributed by CIF (SMB) with some GUI on top. In Unix/Linux we have been using that for ages before AD.

So, if you want a proper server installation, LDAP and Kerberos is the way to go. Have a look at the new SAMBA 4 for more information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy