The Fedora Server WG is trying to create ansible roles for the client and server portions of NFS file sharing.
I have created ansible roles that work fine if the userid associated with the UID & GID of the files on the server matchs the user associated with the UID & GID of the files on the client. i.e. USERA (UID=1006 GID=1006) on the server matches USERA (UID=1006 GID=1006) on the client.
However if USERB (UID=1007 GID=1007) on the server tries to serve files to USERB (UID=1008 GID=1008) on the client, things deteriorate quickly due to the UID and/or GID mismatch.
The best and cleanest solution is to use NIS or LDAP or some other database to keep the UID & GID in sync between the server and it's clients. This is a reasonable solution in a large scale (i.e. datacenter) environment, but in my opinion is not a reasonable solution in a home lab or Small Office / Home Office environment.
Another alternative might be to instead use CIFS or Samba for file sharing.
Since I am at a crossroads as to which approach to take, I thought I would ask for some feedback.
1) Is is reasonable/unreasonable to assume LDP/NIS/etc is suitable for home lab / Small Office / Home Office type environments.
2) Is is reasonable/unreasonable to assume Fedora Server has a place in the datacenter environment?
3) What would be your solution to keep userid/UID/GID in sync across different hosts?
Thanks.
On Tue, Dec 17, 2024 at 03:11:12PM -0600, John W. Himpel via server wrote:
The Fedora Server WG is trying to create ansible roles for the client and server portions of NFS file sharing.
I have created ansible roles that work fine if the userid associated with the UID & GID of the files on the server matchs the user associated with the UID & GID of the files on the client. i.e. USERA (UID=1006 GID=1006) on the server matches USERA (UID=1006 GID=1006) on the client.
However if USERB (UID=1007 GID=1007) on the server tries to serve files to USERB (UID=1008 GID=1008) on the client, things deteriorate quickly due to the UID and/or GID mismatch.
The best and cleanest solution is to use NIS or LDAP or some other database to keep the UID & GID in sync between the server and it's clients. This is a reasonable solution in a large scale (i.e. datacenter) environment, but in my opinion is not a reasonable solution in a home lab or Small Office / Home Office environment.
Another way to solve the problem is to use Kerberos for NFS authentication. Fedora Server already has FreeIPA role, providing kerberos services. FreeIPA is certainly usable in home environment, I'm using it to manage DNS, have the same users on all home computers and to provide ACME certificates for my services.
On Аўт, 17 сне 2024, John W. Himpel via server wrote:
The Fedora Server WG is trying to create ansible roles for the client and server portions of NFS file sharing.
I have created ansible roles that work fine if the userid associated with the UID & GID of the files on the server matchs the user associated with the UID & GID of the files on the client. i.e. USERA (UID=1006 GID=1006) on the server matches USERA (UID=1006 GID=1006) on the client.
However if USERB (UID=1007 GID=1007) on the server tries to serve files to USERB (UID=1008 GID=1008) on the client, things deteriorate quickly due to the UID and/or GID mismatch.
The best and cleanest solution is to use NIS or LDAP or some other database to keep the UID & GID in sync between the server and it's clients. This is a reasonable solution in a large scale (i.e. datacenter) environment, but in my opinion is not a reasonable solution in a home lab or Small Office / Home Office environment.
Another alternative might be to instead use CIFS or Samba for file sharing.
Since I am at a crossroads as to which approach to take, I thought I would ask for some feedback.
- Is is reasonable/unreasonable to assume LDP/NIS/etc is suitable for home lab / Small
Office / Home Office type environments.
Fedora decided to remove NIS support as of Fedora 37 already. Earlier this year I removed the remaining bits of NIS server code from slapi-nis in Fedora Rawhide, aiming Fedora 42.
- Is is reasonable/unreasonable to assume Fedora Server has a place in the datacenter
environment?
Fedora Server has all bits and pieces to run a proper centralized identity and authentication in a datacenter environment. You can set up either FreeIPA or Samba AD for that and use Kerberos authentication with both NFS and SMB networking file systems.
- What would be your solution to keep userid/UID/GID in sync across different hosts?
Both FreeIPA and Samba AD do provide you an integrated solution for that.
On Срд, 18 сне 2024, Alexander Bokovoy via server wrote:
On Аўт, 17 сне 2024, John W. Himpel via server wrote:
The Fedora Server WG is trying to create ansible roles for the client and server portions of NFS file sharing.
I have created ansible roles that work fine if the userid associated with the UID & GID of the files on the server matchs the user associated with the UID & GID of the files on the client. i.e. USERA (UID=1006 GID=1006) on the server matches USERA (UID=1006 GID=1006) on the client.
However if USERB (UID=1007 GID=1007) on the server tries to serve files to USERB (UID=1008 GID=1008) on the client, things deteriorate quickly due to the UID and/or GID mismatch.
The best and cleanest solution is to use NIS or LDAP or some other database to keep the UID & GID in sync between the server and it's clients. This is a reasonable solution in a large scale (i.e. datacenter) environment, but in my opinion is not a reasonable solution in a home lab or Small Office / Home Office environment.
Another alternative might be to instead use CIFS or Samba for file sharing.
Since I am at a crossroads as to which approach to take, I thought I would ask for some feedback.
- Is is reasonable/unreasonable to assume LDP/NIS/etc is suitable for home lab / Small
Office / Home Office type environments.
Fedora decided to remove NIS support as of Fedora 37 already. Earlier this year I removed the remaining bits of NIS server code from slapi-nis in Fedora Rawhide, aiming Fedora 42.
- Is is reasonable/unreasonable to assume Fedora Server has a place in the datacenter
environment?
Fedora Server has all bits and pieces to run a proper centralized identity and authentication in a datacenter environment. You can set up either FreeIPA or Samba AD for that and use Kerberos authentication with both NFS and SMB networking file systems.
- What would be your solution to keep userid/UID/GID in sync across different hosts?
Both FreeIPA and Samba AD do provide you an integrated solution for that.
I'd like to add that in FreeIPA we do test use of NFS and SMB with FreeIPA in our weekly tests against Fedora versions.
NFS tests: https://pagure.io/freeipa/blob/master/f/ipatests/test_integration/test_nfs.p... SMB tests: https://pagure.io/freeipa/blob/master/f/ipatests/test_integration/test_smb.p...
You can use instructions encoded in those test cases to create appropriate configurations but we don't have Ansible playbooks for them.
FreeIPA and Samba AD themselves are tested with every Fedora compose using OpenQA, and working basic FreeIPA deployment is a part of the release criteria for Fedora Server. So this is already in place and available for about 7-8 years.
Regarding Ansible roles, ansible-freeipa provides comprehensive coverage of the installation and administration of FreeIPA environments, including client side configuration: https://galaxy.ansible.com/ui/repo/published/freeipa/ansible_freeipa/docs/
Linux system roles project provides a lot of the roles associated with generic administration too: https://linux-system-roles.github.io/ They don't have a role to handle NFS or SMB server configuration, though, and do not have a way to automate setup of NFS or SMB clients. May be it would be good to join forces with them?
* Alexander Bokovoy via server [18/12/2024 10:13] :
I'd like to add that in FreeIPA we do test use of NFS and SMB with FreeIPA in our weekly tests against Fedora versions.
If John doesn't consider an LDAP server to be a reasonable solution in a Home Lab or SOHO setting, I'm having a hard time believing that he'll think otherwise about FreeIPA.
Linux system roles project provides a lot of the roles associated with generic administration too: https://linux-system-roles.github.io/ They don't have a role to handle NFS or SMB server configuration, though, and do not have a way to automate setup of NFS or SMB clients. May be it would be good to join forces with them?
We discussed contributing roles back in July[1] and I was invited to package other Ansible collections in Fedora[2] instead.
Emmanuel
[1] https://lists.fedoraproject.org/archives/list/server@lists.fedoraproject.org... [2] https://lists.fedoraproject.org/archives/list/server@lists.fedoraproject.org...
* John W. Himpel via server [17/12/2024 15:11] :
- Is is reasonable/unreasonable to assume LDP/NIS/etc is suitable for home lab / Small
Office / Home Office type environments.
I would suggest LDAP is suitable if your infrastructure is somewhat dynamic (ie. hosts appear and disappear regularly) or if the list of users is dynamic (people are coming and going and need to log onto the hosts).
- Is is reasonable/unreasonable to assume Fedora Server has a place in the datacenter
environment?
I would say yes.
- What would be your solution to keep userid/UID/GID in sync across different hosts?
If you're in a dynamic environment (see above), I would recommend LDAP. If not, I would just assign a UID/GID set to every user and track them by hand.
There might be a middle ground where you use something like rdebock's users role[1] to apply UIDs and GIDs consistently across all systems.
Emmanuel
[1] https://galaxy.ansible.com/ui/standalone/roles/robertdebock/users/
On Tue, 2024-12-17 at 15:11 -0600, John W. Himpel via server wrote:
The Fedora Server WG is trying to create ansible roles for the client and server portions of NFS file sharing.
I have created ansible roles that work fine if the userid associated with the UID & GID of the files on the server matchs the user associated with the UID & GID of the files on the client. i.e. USERA (UID=1006 GID=1006) on the server matches USERA (UID=1006 GID=1006) on the client.
However if USERB (UID=1007 GID=1007) on the server tries to serve files to USERB (UID=1008 GID=1008) on the client, things deteriorate quickly due to the UID and/or GID mismatch.
The best and cleanest solution is to use NIS or LDAP or some other database to keep the UID & GID in sync between the server and it's clients. This is a reasonable solution in a large scale (i.e. datacenter) environment, but in my opinion is not a reasonable solution in a home lab or Small Office / Home Office environment.
Another alternative might be to instead use CIFS or Samba for file sharing.
Since I am at a crossroads as to which approach to take, I thought I would ask for some feedback.
- Is is reasonable/unreasonable to assume LDP/NIS/etc is suitable for home lab / Small
Office / Home Office type environments.
- Is is reasonable/unreasonable to assume Fedora Server has a place in the datacenter
environment?
- What would be your solution to keep userid/UID/GID in sync across different hosts?
Thanks.
I appreciate the inputs on this M/L thread, in the Matrix channel during the Server WG meeting, as well as a couple of private off-list emails. The consensus seems to be that for very small home labs, manually keeping userids/UIDs/GIDs in sync is the simplest was to go.
NIS (an old Solaris product) is being completely removed from Fedora.
That leaves LDAP and FreeIPA. My initial objections to LDAP and FreeIPA were related to the skill level and time requirements for the sysadmin that would be required to provide ongoing maintenance and updates of these two alternatives. Ansible could be quite useful in the initial installation and the necessary "hooking up of the plumbing" to serve as the directory for the various network services.
I am a complete novice in this subject area, so I could be very wrong the following opinions.
a) FreeIPA is much more comprehensive than just LDAP. I believe FreeIPA makes extensive use of LDAP, Kerberos and Certificates to provide not only directory services, but also enterprise security access control. At this point in time, I do not believe the Server WG is ready to tackle that level of security access control. I do not have enough knowledge to know if FreeIPA can be "stripped down" or modularized to just provide directory services.
b) LDAP seems to use far less computer resources than FreeIPA. There are several existing Ansible roles publicly available to install and perform initial setup of LDAP. In my humble opinion, ongoing directory entries for users, hosts, dns, dhcp, etc, is often accomplished by formatted ldif files. The syntax for these ldif files is something that the beginning sysadmin (or more likely power user) would probably struggle with to master. Again, this MIGHT be easier with a simple Ansible role (I don't have enought LDAP experience to know). There seems to be a php based web front end that a beginning sysadmin or power user could use in a web interface to maintain users, hosts, dns, dhcp, etc.
If anyone has pointers to a GUI based interface app that maintains records inside of the LDAP directory, I would appreciate links.
The consensus seems to be manual sync of /etc/passwd and /etc/group via cli (or some other tool) for very small numbers of hosts. LDAP for a larger number of hosts. And FreeIPA for enterprise level datacenters and/or security access control.
Thanks for reading this far.
On Срд, 18 сне 2024, John W. Himpel via server wrote:
On Tue, 2024-12-17 at 15:11 -0600, John W. Himpel via server wrote:
The Fedora Server WG is trying to create ansible roles for the client and server portions of NFS file sharing.
I have created ansible roles that work fine if the userid associated with the UID & GID of the files on the server matchs the user associated with the UID & GID of the files on the client. i.e. USERA (UID=1006 GID=1006) on the server matches USERA (UID=1006 GID=1006) on the client.
However if USERB (UID=1007 GID=1007) on the server tries to serve files to USERB (UID=1008 GID=1008) on the client, things deteriorate quickly due to the UID and/or GID mismatch.
The best and cleanest solution is to use NIS or LDAP or some other database to keep the UID & GID in sync between the server and it's clients. This is a reasonable solution in a large scale (i.e. datacenter) environment, but in my opinion is not a reasonable solution in a home lab or Small Office / Home Office environment.
Another alternative might be to instead use CIFS or Samba for file sharing.
Since I am at a crossroads as to which approach to take, I thought I would ask for some feedback.
- Is is reasonable/unreasonable to assume LDP/NIS/etc is suitable for home lab / Small
Office / Home Office type environments.
- Is is reasonable/unreasonable to assume Fedora Server has a place in the datacenter
environment?
- What would be your solution to keep userid/UID/GID in sync across different hosts?
Thanks.
I appreciate the inputs on this M/L thread, in the Matrix channel during the Server WG meeting, as well as a couple of private off-list emails. The consensus seems to be that for very small home labs, manually keeping userids/UIDs/GIDs in sync is the simplest was to go.
NIS (an old Solaris product) is being completely removed from Fedora.
That leaves LDAP and FreeIPA. My initial objections to LDAP and FreeIPA were related to the skill level and time requirements for the sysadmin that would be required to provide ongoing maintenance and updates of these two alternatives. Ansible could be quite useful in the initial installation and the necessary "hooking up of the plumbing" to serve as the directory for the various network services.
ansible-freeipa is already providing that level of easy plumbing. See, for example, https://rafaeljeffman.com/projects/freeipa/en/cluster-deployment-ansible which goes over simple scenarios one by one for deploying FreeIPA infrastructure.
I am a complete novice in this subject area, so I could be very wrong the following opinions.
a) FreeIPA is much more comprehensive than just LDAP. I believe FreeIPA makes extensive use of LDAP, Kerberos and Certificates to provide not only directory services, but also enterprise security access control. At this point in time, I do not believe the Server WG is ready to tackle that level of security access control. I do not have enough knowledge to know if FreeIPA can be "stripped down" or modularized to just provide directory services.
b) LDAP seems to use far less computer resources than FreeIPA. There are several existing Ansible roles publicly available to install and perform initial setup of LDAP. In my humble opinion, ongoing directory entries for users, hosts, dns, dhcp, etc, is often accomplished by formatted ldif files. The syntax for these ldif files is something that the beginning sysadmin (or more likely power user) would probably struggle with to master. Again, this MIGHT be easier with a simple Ansible role (I don't have enought LDAP experience to know). There seems to be a php based web front end that a beginning sysadmin or power user could use in a web interface to maintain users, hosts, dns, dhcp, etc.
If anyone has pointers to a GUI based interface app that maintains records inside of the LDAP directory, I would appreciate links.
I think your main mistake here in assuming you only need a source to provide central repository of identities. As soon as you'd start relying on those identities to do actual work, you will need to solve two additional problems: authentication and authorization, both at the hosts where you are intenting to use those identities and in transit, over network connections. You'll realize that both authentication and authorization also need reasonable secure communication channels, to guarantee that a data exchanged between the hosts was not modified. That, in turn, requires use of something which can be used to provide such protection, typically TLS (ideally, mutual TLS) or GSSAPI with Kerberos mechanism. NFS without Kerberos is pretty much insecure even at home. SMB without Kerberos will soon be impossible even for standalone Windows machines.
We quickly come to a scenario where an LDAP server deployment would need to be complemented by a TLS-enforcing infrastructure and/or Kerberos infra. Setting up both has not been easy in past, especially prior to FreeIPA (which as a project exists since 2007). These days it is much easier, even without FreeIPA. For example, we are working on making so-called 'local KDC' functionality avaialble on Fedora by default.
Enabling local KDC will be as easy as running a single command. So is already for FreeIPA. Or Samba AD DC, all without Ansible playbooks:
- 'ipa-server-install' (for FreeIPA) - 'samba-tool domain provision' (for Samba AD) - 'localkdc-setup.sh' (for local KDC, in future Fedora)
All these configurations already reduced to a single command. Or a simple Ansible playbook use, in case of ansible-freeipa.
If you really start looking into 'day two' operations, when your initial server infrastructure was deployed, then you'd eventually come to realization that most of operations require recurring actions. TLS certificates usually issued for a certain time period and need to be renewed periodically. User passwords need changes as well. Pretty much everything asks for more than a single simple individual LDAP server.
Both FreeIPA and LDAP server it uses, 389-ds, have own Web UIs for management, as well as command line tools. From my experience communicating with FreeIPA users, many of them actually use Web UI to manage majority of their tasks already. In case of 389-ds, there is a Cockpit Web UI plugin that implements comprehensive LDAP server management interface. There is no need to develop new tools for that, they already are in Fedora for years.
The consensus seems to be manual sync of /etc/passwd and /etc/group via cli (or some other tool) for very small numbers of hosts. LDAP for a larger number of hosts. And FreeIPA for enterprise level datacenters and/or security access control.
A lot of FreeIPA users are hobbists that maintain their own infrastructure without having deep (or sometimes even minimal) knowledge of LDAP, Kerberos, and other used technologies. I've been told that at some Red Hat customers, for example, RHEL IdM (Red Hat supported package of FreeIPA) is actively used because its Web UI provides a nice way of managing DNS zones for those customers, allowing them to avoid direct configuration files' management. This is something that we get as a feedback from the field.
A lot of FreeIPA community users consume FreeIPA via its containers (freeipa/freeipa-container). They don't even install anything directly on their distributions. This is for sure the case for majority of Debian and Ubuntu users as with those distributions have been hard to coordinate package maintenance so that multiple components are done 'right' to provide a coherent setup (some package maintainers in Debian community do not like to collaborate, unfortunately).
Days of 'Kerberos and LDAP are hard' are gone, years ago.
* John W. Himpel via server [18/12/2024 17:36] :
Again, this MIGHT be easier with a simple Ansible role (I don't have enought LDAP experience to know).
On this note, I've gone through Ansible Galaxy and have failed to find an openldap role that satisfies my needs (supports Fedora, doesn't hardcode the admin password, ...). So I've started writing my own and wil share the results on the list.
If anyone has pointers to a GUI based interface app that maintains records inside of the LDAP directory, I would appreciate links.
The best GUI LDAP client I know is ADS (Apache Directory Studio)[1].
The best GUI LDAP client to be packaged in Fedora might be gq. Sadly, there hasn't been a new release for 15 years (and I haven't used it in 20+ years).
If you want higher-level CLI tools than the ldap{add,modify,search,...} that come with OpenLDAP, you have shelldap and ldapvi in the distribution.
Emmanuel
server@lists.fedoraproject.org