On Срд, 18 сне 2024, Alexander Bokovoy via server wrote:
On Аўт, 17 сне 2024, John W. Himpel via server wrote:
The Fedora Server WG is trying to create ansible roles for the client and server portions of NFS file sharing.
I have created ansible roles that work fine if the userid associated with the UID & GID of the files on the server matchs the user associated with the UID & GID of the files on the client. i.e. USERA (UID=1006 GID=1006) on the server matches USERA (UID=1006 GID=1006) on the client.
However if USERB (UID=1007 GID=1007) on the server tries to serve files to USERB (UID=1008 GID=1008) on the client, things deteriorate quickly due to the UID and/or GID mismatch.
The best and cleanest solution is to use NIS or LDAP or some other database to keep the UID & GID in sync between the server and it's clients. This is a reasonable solution in a large scale (i.e. datacenter) environment, but in my opinion is not a reasonable solution in a home lab or Small Office / Home Office environment.
Another alternative might be to instead use CIFS or Samba for file sharing.
Since I am at a crossroads as to which approach to take, I thought I would ask for some feedback.
- Is is reasonable/unreasonable to assume LDP/NIS/etc is suitable for home lab / Small
Office / Home Office type environments.
Fedora decided to remove NIS support as of Fedora 37 already. Earlier this year I removed the remaining bits of NIS server code from slapi-nis in Fedora Rawhide, aiming Fedora 42.
- Is is reasonable/unreasonable to assume Fedora Server has a place in the datacenter
environment?
Fedora Server has all bits and pieces to run a proper centralized identity and authentication in a datacenter environment. You can set up either FreeIPA or Samba AD for that and use Kerberos authentication with both NFS and SMB networking file systems.
- What would be your solution to keep userid/UID/GID in sync across different hosts?
Both FreeIPA and Samba AD do provide you an integrated solution for that.
I'd like to add that in FreeIPA we do test use of NFS and SMB with FreeIPA in our weekly tests against Fedora versions.
NFS tests: https://pagure.io/freeipa/blob/master/f/ipatests/test_integration/test_nfs.p... SMB tests: https://pagure.io/freeipa/blob/master/f/ipatests/test_integration/test_smb.p...
You can use instructions encoded in those test cases to create appropriate configurations but we don't have Ansible playbooks for them.
FreeIPA and Samba AD themselves are tested with every Fedora compose using OpenQA, and working basic FreeIPA deployment is a part of the release criteria for Fedora Server. So this is already in place and available for about 7-8 years.
Regarding Ansible roles, ansible-freeipa provides comprehensive coverage of the installation and administration of FreeIPA environments, including client side configuration: https://galaxy.ansible.com/ui/repo/published/freeipa/ansible_freeipa/docs/
Linux system roles project provides a lot of the roles associated with generic administration too: https://linux-system-roles.github.io/ They don't have a role to handle NFS or SMB server configuration, though, and do not have a way to automate setup of NFS or SMB clients. May be it would be good to join forces with them?