On Срд, 18 сне 2024, John W. Himpel via server wrote:
On Tue, 2024-12-17 at 15:11 -0600, John W. Himpel via server wrote:
The Fedora Server WG is trying to create ansible roles for the client and server portions of NFS file sharing.
I have created ansible roles that work fine if the userid associated with the UID & GID of the files on the server matchs the user associated with the UID & GID of the files on the client. i.e. USERA (UID=1006 GID=1006) on the server matches USERA (UID=1006 GID=1006) on the client.
However if USERB (UID=1007 GID=1007) on the server tries to serve files to USERB (UID=1008 GID=1008) on the client, things deteriorate quickly due to the UID and/or GID mismatch.
The best and cleanest solution is to use NIS or LDAP or some other database to keep the UID & GID in sync between the server and it's clients. This is a reasonable solution in a large scale (i.e. datacenter) environment, but in my opinion is not a reasonable solution in a home lab or Small Office / Home Office environment.
Another alternative might be to instead use CIFS or Samba for file sharing.
Since I am at a crossroads as to which approach to take, I thought I would ask for some feedback.
- Is is reasonable/unreasonable to assume LDP/NIS/etc is suitable for home lab / Small
Office / Home Office type environments.
- Is is reasonable/unreasonable to assume Fedora Server has a place in the datacenter
environment?
- What would be your solution to keep userid/UID/GID in sync across different hosts?
Thanks.
I appreciate the inputs on this M/L thread, in the Matrix channel during the Server WG meeting, as well as a couple of private off-list emails. The consensus seems to be that for very small home labs, manually keeping userids/UIDs/GIDs in sync is the simplest was to go.
NIS (an old Solaris product) is being completely removed from Fedora.
That leaves LDAP and FreeIPA. My initial objections to LDAP and FreeIPA were related to the skill level and time requirements for the sysadmin that would be required to provide ongoing maintenance and updates of these two alternatives. Ansible could be quite useful in the initial installation and the necessary "hooking up of the plumbing" to serve as the directory for the various network services.
ansible-freeipa is already providing that level of easy plumbing. See, for example, https://rafaeljeffman.com/projects/freeipa/en/cluster-deployment-ansible which goes over simple scenarios one by one for deploying FreeIPA infrastructure.
I am a complete novice in this subject area, so I could be very wrong the following opinions.
a) FreeIPA is much more comprehensive than just LDAP. I believe FreeIPA makes extensive use of LDAP, Kerberos and Certificates to provide not only directory services, but also enterprise security access control. At this point in time, I do not believe the Server WG is ready to tackle that level of security access control. I do not have enough knowledge to know if FreeIPA can be "stripped down" or modularized to just provide directory services.
b) LDAP seems to use far less computer resources than FreeIPA. There are several existing Ansible roles publicly available to install and perform initial setup of LDAP. In my humble opinion, ongoing directory entries for users, hosts, dns, dhcp, etc, is often accomplished by formatted ldif files. The syntax for these ldif files is something that the beginning sysadmin (or more likely power user) would probably struggle with to master. Again, this MIGHT be easier with a simple Ansible role (I don't have enought LDAP experience to know). There seems to be a php based web front end that a beginning sysadmin or power user could use in a web interface to maintain users, hosts, dns, dhcp, etc.
If anyone has pointers to a GUI based interface app that maintains records inside of the LDAP directory, I would appreciate links.
I think your main mistake here in assuming you only need a source to provide central repository of identities. As soon as you'd start relying on those identities to do actual work, you will need to solve two additional problems: authentication and authorization, both at the hosts where you are intenting to use those identities and in transit, over network connections. You'll realize that both authentication and authorization also need reasonable secure communication channels, to guarantee that a data exchanged between the hosts was not modified. That, in turn, requires use of something which can be used to provide such protection, typically TLS (ideally, mutual TLS) or GSSAPI with Kerberos mechanism. NFS without Kerberos is pretty much insecure even at home. SMB without Kerberos will soon be impossible even for standalone Windows machines.
We quickly come to a scenario where an LDAP server deployment would need to be complemented by a TLS-enforcing infrastructure and/or Kerberos infra. Setting up both has not been easy in past, especially prior to FreeIPA (which as a project exists since 2007). These days it is much easier, even without FreeIPA. For example, we are working on making so-called 'local KDC' functionality avaialble on Fedora by default.
Enabling local KDC will be as easy as running a single command. So is already for FreeIPA. Or Samba AD DC, all without Ansible playbooks:
- 'ipa-server-install' (for FreeIPA) - 'samba-tool domain provision' (for Samba AD) - 'localkdc-setup.sh' (for local KDC, in future Fedora)
All these configurations already reduced to a single command. Or a simple Ansible playbook use, in case of ansible-freeipa.
If you really start looking into 'day two' operations, when your initial server infrastructure was deployed, then you'd eventually come to realization that most of operations require recurring actions. TLS certificates usually issued for a certain time period and need to be renewed periodically. User passwords need changes as well. Pretty much everything asks for more than a single simple individual LDAP server.
Both FreeIPA and LDAP server it uses, 389-ds, have own Web UIs for management, as well as command line tools. From my experience communicating with FreeIPA users, many of them actually use Web UI to manage majority of their tasks already. In case of 389-ds, there is a Cockpit Web UI plugin that implements comprehensive LDAP server management interface. There is no need to develop new tools for that, they already are in Fedora for years.
The consensus seems to be manual sync of /etc/passwd and /etc/group via cli (or some other tool) for very small numbers of hosts. LDAP for a larger number of hosts. And FreeIPA for enterprise level datacenters and/or security access control.
A lot of FreeIPA users are hobbists that maintain their own infrastructure without having deep (or sometimes even minimal) knowledge of LDAP, Kerberos, and other used technologies. I've been told that at some Red Hat customers, for example, RHEL IdM (Red Hat supported package of FreeIPA) is actively used because its Web UI provides a nice way of managing DNS zones for those customers, allowing them to avoid direct configuration files' management. This is something that we get as a feedback from the field.
A lot of FreeIPA community users consume FreeIPA via its containers (freeipa/freeipa-container). They don't even install anything directly on their distributions. This is for sure the case for majority of Debian and Ubuntu users as with those distributions have been hard to coordinate package maintenance so that multiple components are done 'right' to provide a coherent setup (some package maintainers in Debian community do not like to collaborate, unfortunately).
Days of 'Kerberos and LDAP are hard' are gone, years ago.