Today was a strange christian day here in Kanton Solothurn and I didn’t have to work, so I had a lot of time to prepare my presentation for next Friday about OpenLDAP. First of all I prepared the stuff for the school which begins tomorrow, so my holidays are now definitely past

. I was excited that I didn’t receive my timetable by snailmail so I had to google and
found it finally. Poorwise i have now to stand up very early in the morning, my train goes at 07.07 in the morning. Now to OpenLDAP, fortunately Mathias Weyland, the president from the LUGS, gave me a book about OpenLDAP from O’reilly, I really like it: It’s quite informative and sometimes the author is making some jokes. Priska Rubischon already bothered that i have to tell something about netgroups and autofs, this was completely new because I newer worked with NIS (and netgroups etc.) and neither with autofs (in most cases I use samba and libpam-mount). It’s not so difficult as i thaught. OpenLDAP in Debian comes with nice schemas which help to migrate from NIS to LDAP, so I had a look at those schemes and the chapter about netgroups in the book. Also autofs is not complicated, for example, if you want to share /home to the clients you have to prepare a NFS-Server which shares this directory and configure /etc/auto.master and /etc/auto.home on the clients. These two files can lookup where and how it can mount /home. On my testing-infrastructure I just used netgroups for the NFS-exports, so I have now an example what they’re for. After all I realized that my speech will also be about “How do I plan a network in a company”, so I realized that the security of LDAP is also very important. Fortunately OpenLDAP can be secured quite hard, it supports SASL and KERBEROS_V4 authentication mechanisms! When I would realize now a network i would do the following:
- Most parts of the directory readable anonymously
- Use SSL for LDAP
- The password writable by “self” (the “dn” can write the password itself when authenticated as it)
- Create an NFS Share, writable by some netgroups
I still ask me how i can protect my netgroups so that nobody can plug computer “x” out and plug in his computer, take the IP of “x” and mount the NFS-shares. Kerberos as user authentication would be a solution, but I don’t really like it. As I already told I prefer libpam-mount, with it’s help it would be possible that every user gets his share mounted maybe over smb. Now I will search for a solution how i can properly secure NFS, so it does only allow connections from users@boxes authenticated with LDAP and not user@host-which-can-be-faked. If you have an idea feel free to write it down here in my blog!
In the evening I went to “Biel” by train to join the LUG-Seeland meeting. Beat Fasel explained me a lot about genetical biology, his work and the evolution, this was very interesting. Later we talked about the future of our community, I will prepare bylaws for the next meeting which we will sign. Other ideas were about preparing an install event and a mailinglist because we don’t have communication over the internet and this is quite complicated if we want to organise something in teamwork.