2

I have a Raspberry Pi home server with Debian Wheezy on it. I also have a couple of Ubuntu and Debian boxes sitting here, and I would like to use some sort of management this them. Specifically, I would like to do the following:

  • Have the same software repositories on the machines with the same Ubuntu version on them. So one /etc/apt/sources.list for all Ubuntu and one for the Debian Stable and one for the Debian Wheezy.

  • Same users on all machines and the same passwords.

  • Same /etc/profile so that login on all computers feels the same.

I guess for user files I'll use something like Samba or so, but the things above sound like configuration management.

So far, I have heard about:

  • Puppet
  • Chef
  • CF Engine
  • Ansible
  • Salt

From the Debian Wheezy repository, it seems like all but Ansible are in the repository. Ansible does not require any software installation on the other computers, so I could just attempt to package that myself or install from source.

I have not so much experience with administrating multiple computers. So far, I only had my single computer and that was about it. I do have a programming background, though. Could you please give me a suggestion which tool I should start with?


So far, I have played around with Puppet for two hours. It seems to be able to do what I want, it might be just a little too much.

  • A raw idea would be using Git for that (see e.g. Using Git to manage a web site). So basically, you manage all your (config) files on a local machine, and once tested and OK push it to the "central repo" – where a post-receive hook would take care to "distribute" (e.g. checking out locally, and using rsync to xfer stuff to the other machines). Almost no overhead. Does that sound acceptable? – Izzy Jul 17 '14 at 18:30
  • I was thinking about having a ~/configuration/debian-wheezy/etc/profile and a script that copies those files to all Debian Wheezy machines. But I read elsewhere that this might be good for a couple days and will end up in a nightmare to maintain since that does not scale. I might do something if the other options turn out to be overkill, but I would like to try a tool that was made for the job instead of tinkering around. – Martin Ueding Jul 17 '14 at 18:36
  • OK, I see. I just think software like CFEngine or Puppet might be a little overkill for just a few machines (can't tell about the others), so I was just suggesting. Not working with any of this kind, I better leave further arguments to someone with more knowledge in this area ;) – Izzy Jul 17 '14 at 18:38
1

The more tricky bit here is in syncing the users (and passwords) to create a single sign-on (SSO) - for the /etc/apt/sources.list and /etc/profile you could use rsync as these files are unlikely to change too much.

Single Sign-On

However, for the SSO you'll need something like an LDAP server (Lightweight Directory Access Protocol). To install this run the following on your server machine (for the server I'd recommend Debian stable, so run the following on there):

sudo aptitude install slapd ldap-utils

It'll ask you to enter a password, remember it! Now slapd should ask you for a domain, but it didn't with me from memory, so run the following to set that up:

sudo dpkg-reconfigure slapd

At the first screen select no as you'll want to change the config. Then enter a domain name (this can be anything as it's on the local network, I'll use mylovelyserver.lan as the example domain here). Then enter an organisation name (again this can be anything, say My Lovely Server). Then enter a password for the admin. account, and re-enter it when prompted. Then select HDB as the database (not used BDB before, not entirely sure what the difference is!). Say no to purging the database when prompted. Select yes when prompted to move old database. Say no to allowing LDAPv2 (it's old and not needed for compatibility).

That should have an LDAP server running now, but it needs managing. Previously I've done this via the command line, but that to be honest was a ball-ache. So instead use phpldapadmin - it's a graphical web interface for managing LDAP servers. This requires a webserver, I'll use nginX here as it's lightweight and fine for the job. So run the following to install:

sudo aptitude install php5-fpm php5-cli php5-ldap php-apc phpldapadmin nginx

Next you'll need to edit /etc/phpldapadmin/config.php to change the settings to your own:

sudo nano /etc/phpldapadmin/config.php

Change this: $servers->setValue('server','base',array('dc=example,dc=com'));

To this: $servers->setValue('server','base',array('dc=mylovelyserver,dc=lan'))

And change this: $servers->setValue('login','bind_id','cn=admin,dc=example,dc=com');

To this: $servers->setValue('login','bind_id','cn=admin,dc=mylovelyserver,dc=lan');

Now you need to tell the webserver (nginX) where to server the phpldapadmin from. So open up the following:

sudo nano /etc/nginx/sites-available/default

Delete the main server block, and add in the following:

server {
        root /usr/share/phpldapadmin/htdocs;
        index index.php index.html;
        server_name localhost;
        location ~ \.php$ {
                fastcgi_pass unix:/var/run/php5-fpm.sock;
                fastcgi_index index.php;
                include fastcgi_params;
        }
}

Then restart the webserver:

sudo service nginx restart

Now open up a browser and go to http://localhost or the IP address of the server. You should be on the phpLDAPadmin page, click login (on the left) and enter the admin. username and password set up above.

Click Create new entry here (on the left). Create a group first (Generic: POSIX Group). Type a name for the group (I'll use ldapgroup as the example). Click Create object, then commit.

Do the same for creating a new user, selecting the group you just made. Fill in the required fields.

That's the server-side stuff done! Now for the client-side (the other Debian, Ubuntu, and Raspberry Pi(s)).

On the clients install the following:

sudo aptitude install libpam-ldapd libnss-ldapd

On the first setup screen enter the localhost server address ldap://127.0.0.1

Then enter the LDAP server search base dc=mylovelyserver,dc=lan

When asked which name services to configure, just select everything there (using the space bar..).

The edit /etc/pam.d/common-session by running:

sudo nano /etc/pam.d/common-session

Adding the following at the end of the file:

session required pam_mkhomedir.so umask=0022 skel=/etc/skel

The client authentication should now be setup, running the following should show the user previously added at the end of the output of:

sudo getent passwd

Open up an SSH connection to the LDAP user and it should now work!

That's the username and password (SSO) bits done. Now you've not mentioned syncing /home directories, so I'll leave that bit for now, unless you need that too (it takes a bit more setting up).

Syncing Config Files

You have a few options here I think with /etc/apt/sources.list and /etc/profile. There's rsync (and SSH with rsync), cfengine (as you've said, probably overkill for this), and git (you could create a repo. then use that). However, although I don't like proprietary software, Dropbox could be the answer here (or OwnCLoud if you wanted to set that up, but again for a few config files, probably a little overkill).

Dropbox has a nice .deb for Debian / Ubuntu (and RPMs, etc. for Red Hat based systems), so get that form the Dropbox website (or use the Python script here: http://wiki.getdropbox.com/DropboxAddons/DropboxLinuxCLI if you don't want to use the GUI version).

Create a directory in your Dropbox directory once you've installed Dropbox:

mkdir -p ~/Dropbox/configs

Add in the config files you want to share in that directory.

Then create a symbolic link (symlink) on each client to the config files you want to share:

sudo ln -s ~/Dropbox/configs/sources.list /etc/apt/sources.list
sudo ln -s ~/Dropbox/configs/profile /etc/profile

And that should have your files synced! For further reading, etc. have a look at the Ubuntu LDAP and RSync, etc. documents and community wikis, I've found them a bit simpler than the Debian ones!

Also, for sharing /home directories, have a look at NFS (Network File System) and LDAP.

Just realised that was a long post..

  • The LDAP part looks good, somebody said that it also supports caching so that laptops can be used away from the network. Copying the files with rsync is indeed possible. There is no way I will use Dropbox to manage my system configuration, it would have to run as root. I have no good experience with ownCloud or PHP, it is clippling slow and you could not really throw more hardware at it than I did (Opteron, 16 GB). For sharing home directories, I will probably use Samba. – Martin Ueding Jul 18 '14 at 9:25
  • Yea, I also found OwnCloud to be slow. I would recommend NFS over Samba any day though, I found it easier to set up and faster. Also, Sambas main 'good point' is with Windows support, which you don't seem to require. – Elliot Reed Jul 18 '14 at 9:32
  • Samba is already set up. There are two Windows computers here, but one is for gaming and the other is my GF's, so they do not need to be managed that closely. – Martin Ueding Jul 18 '14 at 11:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.