1

I run a small Linux-based network with Linux-only clients and servers. A combination of Samba and Kerberos is used for central authentication, file sharing and file server permission management.

  • Users log in to their laptops and workstations with their central domain account (user name and password).
  • There are shared laptops that can be used by everyone. Everyone can log in using their account without me having to prepare anything on the laptops specially for this user.
  • Home directory etc. are mounted and due to Kerberos SSO you need to type your password only once.

Actually this works fine.

But I need a Windows virtual machine to manage folder / group permissions on the shares. And Samba brings in all the ugly Windows complexity, with magic GUIDs, registry and so on. It feels "not clean" to use a Windows compatibility technology as the foundation of a Linux only network. I'd love to get rid of Windows and Windows-like stuff entirely.

What architecture could you recommend?

The requirements are:

  • We have central user identities. E.g. user "johndoe" has a password. He can log in to any workstation / laptop on the network, without someone having to adduser on the local machines. The notebooks and workstations will not have any machine "local" users except for root.
  • Moreover, this includes: If "johndoe" changes his password, while working on laptop01, the changed password is valid immediately for anything else as well (not machine local and no sync cronjob etc. necessary).
  • "johndoe" can be member of multiple groups, e.g. Employees, Accounting, Marketing_ReadOnly.
  • If "johndoe" uses his laptop on the train and has no internet / VPN connection, he can log in using his cached credentials (e.g. using sssd).
  • When "johndoe" logs into his desktop environment, a shell script mounts his personal server folder, his workgroups' shares and public shares. The mount could reside under /home/domain/johndoe/networkmounts with permissions 0700. He doesn't have to type his credentials again after login in the Desktop Manager (e.g. GDM).
  • Credentials files like /home/johndoe/.cifs with dedicated user names and passwords for each of the shares are no option.
  • While "johndoe" is away, "jenny" can log into the same workstation. She has her own network share mounts and cannot access John's. So static mount points equal for all users, like /mnt/server, won't work.
  • In the network shared file system I can assign permissions with Windows-like flexibility. E.g. users in group Marketing_ReadOnly may only read a certain directory and its files, while Marketing could read, write and delete. So the standard POSIX file system permissions with "user", "group" and "all" is not flexible enough.

What combination of technologies would you use?

Maybe WebDAV-over-TLS instead of CIFS/SMB (Samba)? Still Kerberos for SSO? What about NFS? Its permissions approach seemed not flexible enough when I looked at it for the last time. Maybe it has evolved?

Performance is not a key concern. The file sharing is mainly about OpenOffice documents, PDF documents etc. So no gigabytes of multimedia or something like that.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.