----- Original Message -----
From: "Jeff Boyce" <jboyce@xxxxxxxxxxxxxxx>
To: <centos@xxxxxxxxxx>
Sent: Thursday, April 21, 2011 11:39 AM
Subject: User accounts management for small office
> Greetings -
>
> This may be a little off-topic here so if someone wants to point me to a
> more appropriate mailing list I would appreciate it.
>
> I administer the network for my small company and am preparing to install
> a new server in the next month or so. It will be running CentOS 6 and
> function primarily as a Samba file server to 10 Windows workstations (XP,
> Vista, 7). It will also host our OpenVPN server and possibly our FTP
> server; however I am hoping to move our FTP server to a gateway box when
> the new server is installed.
>
> The issue that I would like to be able to resolve when the new server is
> installed, is that currently if a user wants to change the password on
> their Windows workstation, I have to manually update that new password on
> the Linux user account, and also manually change the Samba user account.
> Manually updating the password in three different locations is a minor
> headache that I would like to correct. I have been researching and
> reading lots of information about account management to try and understand
> what is available, and what would be the best fit for my network size.
> Much of what I have read is related to larger networks or larger user
> bases, which seem to have a lot of extraneous stuff that would be
> unnecessary in my small user environment. I looked into OpenLDAP, and
> have recently been reading about Samba/Winbind. But after encountering
> the following statement in the Samba documentation, I am still lost about
> what I could, or should, be using.
> "A standalone Samba server is an implementation that is not a member of a
> Windows NT4 domain, a Windows 200X Active Directory domain, or a Samba
> domain. By definition, this means that users and groups will be created
> and controlled locally, and the identity of a network user must match a
> local UNIX/Linux user login. The IDMAP facility is therefore of little to
> no interest, winbind will not be necessary, and the IDMAP facility will
> not be relevant or of interest."
>
> My only goal is to be able to allow my users to change their Windows
> password at their workstation and have it perpetuate through the system so
> that it also changes their Linux User and Samba User account passwords. I
> don't expect to ever have more than a dozen users, so I want something
> that fits our size network and is simple to administer. I am not looking
> for a how-to to set something up, but some opinions about what I should
> consider using, and why it would be a good fit to achieve my goal. I can
> do the additional research to understand configuration once I know what I
> should be researching. Thanks. Please cc me directly, as I only get the
> list in daily digest mode.
>
> Jeff Boyce
> Meridian Environmental
>
>
>
Thanks to everyone that replied, you have helped me understand what
direction I should be going (or staying away from). Here are the highlights
and my comments to some of the suggestions that were provided, since I can't
respond to every thread from the digest. The opinions both for and against
OpenLDAP have made me take a little closer look at it, but my conclusion is
that it is more cumbersome than what I really want to handle right now for
the size of the network. I have looked closer at Samba/Wins/Winbind, etc.
and it looks like the main source of my current problem is that my Samba
network is setup now as a Workgroup and not as a Domain. I didn't
understand that difference when I ran across the quote I included above. It
looks like if I change to a Domain and configure it properly with
Wins/Winbind that I should be able to have the single point password
changing option occur from the Windows desktop. I am now re-reading
sections of my copy of the Definitive Guide to Samba 3 which should help me
(although it was published before Vista and 7, which all my workstations are
now).
Also thanks to some for the suggestions of using ClearOS or Webmin. I do
have Webmin installed and use it for some of my administrative functions.
So if I do try playing around with OpenLDAP I will certainly see if it will
reduce my learning curve on getting it setup properly. With the new gateway
box that I mentioned above, I have been planning on installing ClearOS on
it, so I will take a look at how it might be used to learn about using LDAP.
Although I was thinking to have this box function more strictly as a gateway
than providing services to the internal lan.
Jeff
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
http://lists.centos.org/mailman/listinfo/centos
