On Tue, 20 Jan 2004, Stephane Dudzinski wrote:
> I basically want to move to a central 1/2 servers model where i would
> have all my users without using NIS. I have a variety of servers ranging
> from Linux to FreeBSD and Solaris. Any thoughts ?
In an ideal world:
Kerberos for authentication.
LDAP for distributing information (user/group/etc.. account info)
You could use LDAP for the authorisation side, but to my mind getting
the LDAP acl's right can be finicky with OpenLDAP's slapd server, and
if you make a mistake you can leave the userPasswords readable and
you've gained nothing over NIS. If authentication is handled by
kerberos you dont really have to care too much about locking down
LDAP. The docs for MIT kerberos are pretty good are cover everything
you need to know about setting up a KDC step by step.
The down side can be OS support. RH9 and Fedora support krb5 and ldap
out of the box. Dont know about FreeBSD. Solaris 8 does not, iirc.
Solaris 9, not sure, it might but if not I think there are point
updates that add support - next release of Solaris definitely does
support krb5 and LDAP though. If thats all you run, you're grand, but
other Nixes tend not to have support (eg IRIX doesnt unless you have
a support contract and access to the latest point releases).
Paul Jakma paul at clubi.iepaul at jakma.org Key ID: 64A2FF6A
warning: do not ever send email to spam at dishone.st
Don't mind him; politicians always sound like that.
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!