On Tue, 2024-12-17 at 15:11 -0600, John W. Himpel via server wrote:
The Fedora Server WG is trying to create ansible roles for the client and server portions of NFS file sharing.
I have created ansible roles that work fine if the userid associated with the UID & GID of the files on the server matchs the user associated with the UID & GID of the files on the client. i.e. USERA (UID=1006 GID=1006) on the server matches USERA (UID=1006 GID=1006) on the client.
However if USERB (UID=1007 GID=1007) on the server tries to serve files to USERB (UID=1008 GID=1008) on the client, things deteriorate quickly due to the UID and/or GID mismatch.
The best and cleanest solution is to use NIS or LDAP or some other database to keep the UID & GID in sync between the server and it's clients. This is a reasonable solution in a large scale (i.e. datacenter) environment, but in my opinion is not a reasonable solution in a home lab or Small Office / Home Office environment.
Another alternative might be to instead use CIFS or Samba for file sharing.
Since I am at a crossroads as to which approach to take, I thought I would ask for some feedback.
- Is is reasonable/unreasonable to assume LDP/NIS/etc is suitable for home lab / Small
Office / Home Office type environments.
- Is is reasonable/unreasonable to assume Fedora Server has a place in the datacenter
environment?
- What would be your solution to keep userid/UID/GID in sync across different hosts?
Thanks.
I appreciate the inputs on this M/L thread, in the Matrix channel during the Server WG meeting, as well as a couple of private off-list emails. The consensus seems to be that for very small home labs, manually keeping userids/UIDs/GIDs in sync is the simplest was to go.
NIS (an old Solaris product) is being completely removed from Fedora.
That leaves LDAP and FreeIPA. My initial objections to LDAP and FreeIPA were related to the skill level and time requirements for the sysadmin that would be required to provide ongoing maintenance and updates of these two alternatives. Ansible could be quite useful in the initial installation and the necessary "hooking up of the plumbing" to serve as the directory for the various network services.
I am a complete novice in this subject area, so I could be very wrong the following opinions.
a) FreeIPA is much more comprehensive than just LDAP. I believe FreeIPA makes extensive use of LDAP, Kerberos and Certificates to provide not only directory services, but also enterprise security access control. At this point in time, I do not believe the Server WG is ready to tackle that level of security access control. I do not have enough knowledge to know if FreeIPA can be "stripped down" or modularized to just provide directory services.
b) LDAP seems to use far less computer resources than FreeIPA. There are several existing Ansible roles publicly available to install and perform initial setup of LDAP. In my humble opinion, ongoing directory entries for users, hosts, dns, dhcp, etc, is often accomplished by formatted ldif files. The syntax for these ldif files is something that the beginning sysadmin (or more likely power user) would probably struggle with to master. Again, this MIGHT be easier with a simple Ansible role (I don't have enought LDAP experience to know). There seems to be a php based web front end that a beginning sysadmin or power user could use in a web interface to maintain users, hosts, dns, dhcp, etc.
If anyone has pointers to a GUI based interface app that maintains records inside of the LDAP directory, I would appreciate links.
The consensus seems to be manual sync of /etc/passwd and /etc/group via cli (or some other tool) for very small numbers of hosts. LDAP for a larger number of hosts. And FreeIPA for enterprise level datacenters and/or security access control.
Thanks for reading this far.