On Sun, Feb 25, 2018 at 8:06 PM, TomK via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
For newly added AD or IPA users, is there a way to automatically
create the
user folders on the FreeIPA server under say /nfs/home/bill, for example so
that when the remote client logs in, it sees the NFS mounted folder?
Instructions that I can find right now require precreating the folders. Need
them precreated via the FreeIPA master servers anytime someone attempts to
login on a client using their AD credentials. Is this possible? Assume the
NFS server will be local to the FreeIPA masters.
I know you've had some answers since this, but I thought I'd chime in
that I'm doing the same thing (or at least trying to). All the hosts
on my network have a slightly modified pam config for system-auth-ac,
and one host which is allowed to create directories uses
oddjobd-mkhomedir.
Puppet template snippet for /etc/pam.d/system-auth-ac:
session optional pam_keyinit.so revoke
session required pam_limits.so
<% if @mkhomedir_host == scope['::fqdn'].downcase -%>
session optional pam_oddjob_mkhomedir.so
<% else -%>
session optional pam_exec.so /usr/libexec/mkhomedir.sh
<% end -%>
/usr/libexec/mkhomedir.sh:
#!/bin/bash
if [ "$PAM_USER" != "root" -a "$PAM_USER" != "gdm"
-a "$PAM_TTY" !=
"cron" ] ; then
if [ ! -d /u/$PAM_USER ] ; then
ssh $PAM_USER@${mkhomedir_host} > /dev/null 2>&1
sleep 5
fi
fi
And oddjobd-mkhomedir.conf:
<?xml version="1.0"?>
<oddjobconfig>
<service name="com.redhat.oddjob_mkhomedir">
<object name="/">
<interface name="org.freedesktop.DBus.Introspectable">
<allow min_uid="0" max_uid="0"/>
<!-- <method name="Introspect"/> -->
</interface>
<interface name="com.redhat.oddjob_mkhomedir">
<method name="mkmyhomedir">
<helper exec="/usr/libexec/oddjob/mkhomedir"
arguments="0"
prepend_user_name="yes"/>
<!-- no acl entries -> not allowed for anyone -->
</method>
<method name="mkhomedirfor">
<helper exec="/usr/libexec/oddjob/mkhomedir -u 0077 -s
/u/skel/Userfiles"
arguments="1"/>
<allow user="root"/>
</method>
</interface>
</object>
</service>
</oddjobconfig>
So if you login to a host, and you don't have a home directory, pam
will SSH to the host that creates home directories. Because Kerberos
is configured on everything, that should silently work, and "creating
home directory" is output to the user. Then the login continues.
In practice, however, this works perfectly in my testing but on actual
hardware it seems to always fail. I haven't figured out why yet - the
Kerberos credential doesn't seem to be getting sent through, and so
the SSH fails.
--
Steve Huston - W2SRH - Unix Sysadmin, PICSciE/CSES & Astrophysical Sci
Princeton University | ICBM Address: 40.346344 -74.652242
345 Lewis Library |"On my ship, the Rocinante, wheeling through
Princeton, NJ 08544 | the galaxies; headed for the heart of Cygnus,
(267) 793-0852 | headlong into mystery." -Rush, 'Cygnus X-1'