On ma, 19 maalis 2018, Steve Huston via FreeIPA-users wrote:
On Sun, Feb 25, 2018 at 8:06 PM, TomK via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
> For newly added AD or IPA users, is there a way to automatically create the
> user folders on the FreeIPA server under say /nfs/home/bill, for example so
> that when the remote client logs in, it sees the NFS mounted folder?
> Instructions that I can find right now require precreating the folders. Need
> them precreated via the FreeIPA master servers anytime someone attempts to
> login on a client using their AD credentials. Is this possible? Assume the
> NFS server will be local to the FreeIPA masters.
I know you've had some answers since this, but I thought I'd chime in
that I'm doing the same thing (or at least trying to). All the hosts
on my network have a slightly modified pam config for system-auth-ac,
and one host which is allowed to create directories uses
oddjobd-mkhomedir.
Puppet template snippet for /etc/pam.d/system-auth-ac:
session optional pam_keyinit.so revoke
session required pam_limits.so
<% if @mkhomedir_host == scope['::fqdn'].downcase -%>
session optional pam_oddjob_mkhomedir.so
<% else -%>
session optional pam_exec.so /usr/libexec/mkhomedir.sh
<% end -%>
/usr/libexec/mkhomedir.sh:
#!/bin/bash
if [ "$PAM_USER" != "root" -a "$PAM_USER" != "gdm"
-a "$PAM_TTY" !=
"cron" ] ; then
if [ ! -d /u/$PAM_USER ] ; then
ssh $PAM_USER@${mkhomedir_host} > /dev/null 2>&1
sleep 5
fi
fi
And oddjobd-mkhomedir.conf:
<?xml version="1.0"?>
<oddjobconfig>
<service name="com.redhat.oddjob_mkhomedir">
<object name="/">
<interface name="org.freedesktop.DBus.Introspectable">
<allow min_uid="0" max_uid="0"/>
<!-- <method name="Introspect"/> -->
</interface>
<interface name="com.redhat.oddjob_mkhomedir">
<method name="mkmyhomedir">
<helper exec="/usr/libexec/oddjob/mkhomedir"
arguments="0"
prepend_user_name="yes"/>
<!-- no acl entries -> not allowed for anyone -->
</method>
<method name="mkhomedirfor">
<helper exec="/usr/libexec/oddjob/mkhomedir -u 0077 -s
/u/skel/Userfiles"
arguments="1"/>
<allow user="root"/>
</method>
</interface>
</object>
</service>
</oddjobconfig>
So if you login to a host, and you don't have a home directory, pam
will SSH to the host that creates home directories. Because Kerberos
is configured on everything, that should silently work, and "creating
home directory" is output to the user. Then the login continues.
This looks
good. Thanks, Steve.
In practice, however, this works perfectly in my testing but on
actual
hardware it seems to always fail. I haven't figured out why yet - the
Kerberos credential doesn't seem to be getting sent through, and so
the SSH fails.
Check if you have GSSAPI ticket delegation enabled in the test
environment and disabled in the production.
ssh -oGSSAPIDelegateCredentials=yes
Default is 'no'.
--
/ Alexander Bokovoy