Back to the main page

Automount and FreeIPA (IdM)

Introduction

FreeIPA (or RedHat IdM, for Identity Management ) is tool for managing Identity, Policy and Audit (IPA). It's something like Microsoft Active Directory, only it's for Linux/Unix systems.
This page is the evaluation of Automount feature. As per IdM docs, for automount to work within the IdM domain, the NFS server must be configured as an IdM client (member of IdM domain).
In this evaluation I use Oracle Linux 6 (OL6) and ZS3-2 (ZFS appliance) as a NFS Server.
The VM (OL6) is the member of IdM domain and it exports its /home (it's just directory in root file system).
The ZS3 has share "home" that's accessible via NFS protocol.
Evaluated clients are OL6 and Solaris 11, yes Solaris can be FreeIPA client. see Solaris as FreeIPA client

NFS Server

OL6

A Virtual Machine (VM) running OL6 is the NFS server, exporting its /home (it's just the directory in root filesystem). The VM is member of IdM domain. 

[root@nfs-server ~]$ df -h /home
Filesystem                        Size  Used Avail Use% Mounted on
/dev/mapper/vg_nfsserver-lv_root   11G  2.8G  6.8G  30%   /

[root@nfs-server ~]# cat /etc/exports
/home   *.kompanija.com(rw,root_squash)

The view from potential client: 

[root@nfs-client ~]# showmount -e nfs-server
Export list for nfs-server:
/home *.kompanija.com

ZS3-2

The home share has been created on ZS3-2 (ca-sastor1), it doesn't accept any Kerberos setting in Share - Protocol - Security Mode, but looks that this doesn't affect automount. Users' home directories have been manually created under /home.



FreeIPA Server

NFS Server: OL6

The VM is member of IdM domain, via Web see Identity - Hosts - Enrolled = True.
The "default" automount location already exist, but let's create new one and name it "userdirs" (this is only for OL clients). 

[root@freeipa-server ~]# kinit admin
Password for admin@KOMPANIJA.COM:

[root@freeipa-server ~]# ipa automountlocation-add userdirs
-----------------------------------
Added automount location "userdirs"
-----------------------------------
  Location: userdirs

Maps auto.master and auto.direct will be created under this location. The auto.master doesn't need any change, but we need to add key in auto.direct map. 

[root@freeipa-server ~]# ipa automountkey-add userdirs auto.direct --key=/home --info="-rw,bg,intr,hard, nfs-server.kompanija.com:/home"
---------------------------
Added automount key "/home"
---------------------------
  Key: /home
  Mount information: -rw,bg,intr,hard,nobrowse, nfs-server.kompanija.com:/home

NOTE: The showmount may not show clients that user nfs version 4, so if needed, version 3 can be specified in previous ipa command ( -rw,bg,intr,hard,nobrowse,nfsvers=3, nfs-serverb.kompanija.com:/home )
If you prefer, this can be done via web interface.



To verify configuration: 

[root@freeipa-server ~]# ipa automountlocation-tofiles userdirs
/etc/auto.master:
/-      /etc/auto.direct
---------------------------
/etc/auto.direct:
/home   -rw,bg,intr,hard, nfs-server.kompanija.com:/home
maps not connected to /etc/auto.master:

As said, this setup works only for OL clients, for Solaris we'll have to create different location "solaris-userdirs". The location has configuration: 

[root@freeipa-server ~]# ipa automountlocation-tofiles solaris-userdirs
/etc/auto.master:
/-      /etc/auto.direct
---------------------------
/etc/auto.direct:
*     nfs-server.kompanija.com:/home/&

NFS Server: ZS3-2

The ZFS appliance (zfs-app) has been added to Identity - Hosts, but Enrolled is not True, so seems that storage is not really member of IdM domain. This is the same behavior as with Solaris system.
I also believe that if even ZS3-2 and Solaris system are not added to IdM domain, a user should be able to SSH and automount home directory.

Two new automount locations have been created (via Web interface), for OL and Solaris (same as we did with a VM as NFS server).
This is verification. 

[root@freeipa-server ~]# ipa automountlocation-tofiles zs3-2-ol
/etc/auto.master:
/-      /etc/auto.direct
---------------------------
/etc/auto.direct:
/home   -rw,bg,intr,hard,nobrowse,nfsvers=3, zfs-app.kompanija.com:/export/home

[root@freeipa-server ~]# ipa automountlocation-tofiles zs3-2_solaris
/etc/auto.master:
/-      /etc/auto.direct
---------------------------
/etc/auto.direct:
*       zfs-app.kompanija.com:/export/home/&

Here are all 4 automount locations.


NFS Client

* OL6

** NFS Server: OL6

Note that client is already member of IdM domain. Run this command for automatic autofs configuration. 

[root@ol6-client ~]# ipa-client-automount
Searching for IPA server...
IPA server: [u'freeipa-server.kompanija.com']
Location: default
Continue to configure the system with these values? [no]: yes
Configured /etc/nsswitch.conf
Configured /etc/sysconfig/nfs
Configured /etc/idmapd.conf
Started rpcidmapd
Started rpcgssd
Restarting sssd, waiting for it to become available.
Started autofs

You may need to verify automount location in /etc/sssd/sssd.conf file, just in case it's not "default". 

[root@ol6-client ~]# cat /etc/sssd/sssd.conf  
[domain/kompanija.com]
cache_credentials = True
krb5_store_password_if_offline = True
ipa_domain = kompanija.com
id_provider = ipa
auth_provider = ipa
access_provider = ipa
ipa_hostname = ol6-client.kompanija.com
chpass_provider = ipa
ipa_server = _srv_, freeipa-server.kompanija.com
ldap_tls_cacert = /etc/ipa/ca.crt
autofs_provider = ipa
ipa_automount_location = userdirs  <---- it is "userdirs"
[sssd]
services = nss, sudo, pam, autofs, ssh
domains = kompanija.com
[nss]
homedir_substring = /home
[pam]
[sudo]
[autofs]
[ssh]
[pac]
[ifp]

The ldapsearch can be done, for curiosity. 

[root@ol6-client ~]# ldapsearch -LLL -x -h freeipa-server -b "dc=kompanija,dc=com" objectclass="automount"
dn: description=/- auto.direct,automountmapname=auto.master,cn=default,cn=automount,dc=kompanija,dc=com
objectClass: automount
objectClass: top
automountKey: /-
automountInformation: auto.direct
description: /- auto.direct

dn: description=/home,automountmapname=auto.direct,cn=default,cn=automount,dc=kompanija,dc=com
objectClass: automount
objectClass: top
automountKey: /home
automountInformation: -rw,bg,intr,hard, nfs-server.kompanija.com:/home
description: /home

dn: description=/- auto.direct,automountmapname=auto.master,cn=userdirs,cn=automount,dc=kompanija,dc=com
objectClass: automount
objectClass: top
automountKey: /-
automountInformation: auto.direct
description: /- auto.direct

dn: description=/home,automountmapname=auto.direct,cn=userdirs,cn=automount,dc=kompanija,dc=com
objectClass: automount
objectClass: top
automountKey: /home
automountInformation: -rw,bg,intr,hard, nfs-server.us.oracle.com:/home
description: /home

This may also be needed if you want to enable creation of home directory: 

[root@ol6-client ~]# authconfig --enablemkhomedir --update

Make sure that this service is running, it's essential for automount to work. 

[root@ol6-client ~]# chkconfig  oddjobd on
[root@ol6-client ~]# service oddjobd status
oddjobd (pid  15958) is running...

And finally login as LDAP/FreeIPA user that doesn't have local account on machine. 

login as: zarko1
Authenticating with public key "rsa-key-20150217" from agent
Last login: Fri Jul 22 17:54:23 2016 from 10.x.x.x

[zarko1@ol6-client ~]$ pwd
/home/zarko1

[zarko1@ol6-client ~]$ df -h .
Filesystem                      Size  Used Avail Use% Mounted on
nfs-server.kompanija.com:/home   11G  2.8G  6.8G  30% /home

** NFS Server: ZS3-2

All it's needed is to change automount location in /etc/sssd/sssd.conf and restart services : autofs, sssd and oddjobd. 

[root@ol6-client /]# grep location /etc/sssd/sssd.conf
ipa_automount_location = zs3-2-ol

Another verification can be: 

[root@ol6-client /]# automount -m 
autofs dump map information
===========================
global options: none configured
Mount point: /-
source(s):
  instance type(s): sss
  map: auto.direct
  /home | -rw,bg,intr,hard,nobrowse,nfsvers=3, zfs-app.kompanija.com:/export/home

Let's test and login as FreeIPA user: 

login as: zarko1
Authenticating with public key "rsa-key-20150217" from agent
Last login: Thu Jul 28 15:07:30 2016 from 10.x.x.x

-bash-4.1$ pwd
/home/zarko1

-bash-4.1$ df -h .
Filesystem                         Size  Used Avail Use% Mounted on
zfs-all.kompanija.com:/export/home 1.0G     0  1.0G   0% /home

* Solaris 11

** NFS Server: OL6

If the NFS server is running on OL, then the max supported NFS version on Solaris has to be 3. 

 
root@sol-x86:~# sharectl status
autofs  disabled client
smb     disabled
nfs     disabled

See the NFS properties. 

root@sol-x86:~# sharectl get nfs
servers=1024
lockd_listen_backlog=32
lockd_servers=1024
lockd_retransmit_timeout=5
grace_period=90
server_versmin=2
server_versmax=4
client_versmin=2
client_versmax=4 <--- need to change to v3
server_delegation=on
nfsmapid_domain=
max_connections=-1
protocol=ALL
listen_backlog=32
device=
showmount_info=full
server_authz_cache_refresh=600
netgroup_refresh=600
resvport=false

Change max version for client to ve 3. 

root@sol-x86:~# sharectl set -p client_versmax=3 nfs 

root@sol-x86:~# sharectl get nfs | grep versmax 
server_versmax=4
client_versmax=3

When configuring automount, it looks that manual configuration of ldap client is needed. Use proper automount location which is solaris-userdirs. 

root@sol-x86:~# ldapclient -v manual -a authenticationMethod=none \
-a defaultSearchBase=dc=kompanija,dc=com \
-a defaultServerList=freeipa-server.kompanija.com \
-a serviceSearchDescriptor=passwd:cn=users,cn=accounts,dc=kompanija,dc=com \
-a serviceSearchDescriptor=group:cn=groups,cn=compat,dc=us,dc=oracle,dc=com \
-a serviceSearchDescriptor=auto_master:automountMapName=auto.master,cn=solaris-userdirs,cn=automount,dc=kompanija,dc=com?one \
-a serviceSearchDescriptor=auto_home:automountMapName=auto.direct,cn=solaris-userdirs,cn=automount,dc=kompanija,dc=com?one \
-a objectClassMap=shadow:shadowAccount=posixAccount \
-a searchTimelimit=15 -a bindTimeLimit=5 

root@sol-x86:/var/ldap# ldapclient list
NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_SERVERS= freeipa-server.kompanija.com
NS_LDAP_SEARCH_BASEDN= dc=kompanija,dc=com
NS_LDAP_AUTH= none
NS_LDAP_SEARCH_TIME= 15
NS_LDAP_CACHETTL= 0
NS_LDAP_SERVICE_SEARCH_DESC= passwd:cn=users,cn=accounts,dc=kompanija,dc=com
NS_LDAP_SERVICE_SEARCH_DESC= group:cn=groups,cn=compat,dc=kompanija,dc=com
NS_LDAP_SERVICE_SEARCH_DESC= auto_master:automountMapName=auto.master,cn=solaris-userdirs,cn=automount,dc=kompanija,dc=com?one
NS_LDAP_SERVICE_SEARCH_DESC= auto_home:automountMapName=auto.direct,cn=solaris-userdirs,cn=automount,dc=kompanija,dc=com?one
NS_LDAP_BIND_TIME= 5
NS_LDAP_OBJECTCLASSMAP= shadow:shadowAccount=posixAccount

Verify NSS config file (automount must have both files and ldap, the order is not important). 

dudic@sol-x86:~$ grep automount /etc/nsswitch.conf
automount:      files ldap

Verify /etc/auto_master file, it needs to have +auto_master (this file must exist, other auto_* files can be omitted). 

root@sol-x86:/etc# cat /etc/auto_master | grep auto_master
+auto_master

In case LDAP user can SSH but cannot mount home directory, the first troubleshoot step would be to restart below services on LDAP Solaris client. 

root@sol-x86:/# svcadm restart nfs/client autofs ldap/client

Now a LDAP user can SSH and have mounted home directory. 

login as: dudic
Using keyboard-interactive authentication.
Password:
Using keyboard-interactive authentication.
Your Kerberos account/password will expire in 89 days.

Last login: Mon Jul 25 14:34:24 2016 from some-box
Oracle Corporation   SunOS 5.11   11.3  September 2015

dudic@ca-sunstor2old:~$ pwd
/home/dudic

dudic@sol-x86:~$ df -h .
Filesystem                           Size  Used  Available Capacity  Mounted on
nfs-server.kompanija.com:/home/dudic 10G   2.8G    6.7G    30%      /home/dudic

** NFS Server: ZS3-2

The ldapclient has to be modified by changing automount location. 

root@sol-x86:/etc# ldapclient -v mod \
-a serviceSearchDescriptor=auto_master:automountMapName=auto.master,cn=zs3-2_solaris,cn=automount,dc=kompanija,dc=com?one \
-a serviceSearchDescriptor=auto_home:automountMapName=auto.direct,cn=zs3-2_solaris,cn=automount,dc=kompanija,dc=com?one

Run "ldapclient list" to confirm changes and restart three services with the command : 

root@sol-x86:/#  svcadm restart nfs/client autofs ldap/client

Let's test user login: 

login as: zarko1
Using keyboard-interactive authentication.
Password:
Your Kerberos account/password will expire in 73 days.
Last login: Thu Jul 28 15:07:45 2016 from some-machine
Oracle Corporation   SunOS 5.11      11.3    September 2015

-bash-4.1$ pwd
/home/zarko1

-bash-4.1$ df -h .
Filesystem                                Size   Used  Available Capacity  Mounted on
zfs-app.komanija.com:/export/home/zarko1  1.0G   104K     1.0G     1%    /home/zarko1


Back to the main page