On Wed, 2006-08-30 at 22:22 -0400, Tom Diehl wrote: > On Wed, 30 Aug 2006, Craig White wrote: > > > On Wed, 2006-08-30 at 17:35 -0500, Les Mikesell wrote: > >> On Wed, 2006-08-30 at 22:23 +0300, Mike Jackson wrote: > >> > >>>> There seems to be a lot of install/design documentation regarding FDS, > >>>> however I've not been able to find a quick "howto" on setting a FDS up > >>>> for a small company. For example, say a shop with 25-50 linux machines > >>>> and 150 or so user accounts. > >> > >>> Hi, > >>> FDS includes the posixAccount, posixGroup, and inetOrgPerson object > >>> classes. You don't really need more than this to do simple user > >>> authentication for linux and apache, as well as basic personnel info > >>> management. > >> > >> And if you want to also use it as a back end for samba windows domain > >> authentication with the same users/passwords? > > ----- > > that's a horse of another color > > > > First you would have to import the samba schema appropriate for the > > version of samba you are using. > > > > Then you would have to realize that the samba schema has > > objectclasses/attributes that have nothing to do with > > posixAccount/posixGroup/inetOrgPerson attributes (well, I do use > > posixGroup but that is with sambaGroupMapping attributes. > > > > Then you would want to use a client that allows a single password entry > > and encodes it for the userPassword (posixAccount/shadowAccount) > > attribute and for the sambaNTPassword and optionally the > > sambaLMPassword. Clients for this purpose are listed here... > > > > http://wiki.samba.org/index.php/Samba_%26_LDAP > > > > or of course, you can write your own code to accomplish this > > Is it really all that different from using an ldap backend as described in the > Samba HowTo?? ---- nope - very little difference between integration on OpenLDAP or FDS - make sure that you visit the samba wiki page on FDS wiki as it tells you how to import openldap schemas and such. ---- > > Is there any reason the idealx scripts and the standard samba schema will not > work? ---- Idealx scripts work fine (I barely use them though). There is no such thing as a standard samba schema - it has been getting continually tweaked at various stages in samba releases. Use the schema appropriate for your samba release which I presume seeing your entries on nahant/taroon lists will be supplied with your samba installation...which would be 3.0.9.xx (taroon) 3.0.10.xx (nahant) unless you replace it with kde-redhat samba like I do... # rpm -q --whatprovides /usr/share/doc/samba-3.0.23b/LDAP/samba.schema samba-3.0.23b-0.1.el4.kde each release is slightly different - there is no 'standard samba schema' ----- > > Just want to be sure I am not missing something, migrating to FDS is on my list > of things to do. ---- go for it - keep openldap installed - do your migration - turn off openldap and then start fds - should be a direct replacement when you get it going. just a little stupid thing that may be of help to you is a little shell script that I wrote to take the slapcat output from openldap and delete the attributes that will poison it so you can't import it into FDS... # cat ol2fds-filter.sh #!/bin/sh # # input=dump.ldif output=import-me.ldif filt1=creatorsName filt2=createTimestamp filt3=modifiersName filt4=modifyTimestamp filt5=structuralObjectClass filt6=entryUUID filt7=entryCSN /bin/grep -v $filt1 $input | \ /bin/grep -v $filt2 | \ /bin/grep -v $filt3 | \ /bin/grep -v $filt4 | \ /bin/grep -v $filt5 | \ /bin/grep -v $filt6 | \ /bin/grep -v $filt7 > $output Craig
