Is it possible to have a setup similar to the following scenario:
I have three buildings. There are users that move among the buildings on different days to use NT workstations (Win2K).
I'd like to put in four servers, identical in hard drive space and with similar configurations running Samba.
I'd like every user to have a UNIX account and home directory.
There would be a master server called MASTER. The three buildings would have different domains (AD support is still developing in SAMBA, as I recall? "almost there"?)...domain1, domain2, and domain3, plus the master server.
I'd like every night for the domain servers to rsync data to the master server, then the master server would dole out periodically the changes to remaining buildings. I.e., John logs into domain1 and works on NT for the day, then logs off. domain1 server syncs back to the master server that night, and then later syncs with domain2 and domain3.
John comes into building 2 for the day and logs in to domain2 domain. Because it's domain2, a script runs that maps his home directory to J: on \\domain2server\home\john. Because of the syncing, his home directory contents are the same as they were on \\domain1server\home\john.
The questions are, 1) is this type of setup feasible?
2) is it possible to "duplicate" accounts from the master server easily to remote servers if they're unix accounts, or is it simpler to use a different authentication and permission scheme? I know I can't just sync home directories because UIDs and GIDs would not exist on the remote systems without adding them to those machines, but can those accounts be created by just syncing some files in /etc to those remote machines (passwd, groups, etc.) and then syncing the directories in question, since that should map the passwords and UID/GIDs? Or can there be a simple syncing of samba users and their home directories by just syncing a couple files that would make that layout simpler?
3) Would it be possible to have each of the workstations hardcoded to log into their individual domains and, based on that, map the user's home directory to their "local" server's version of the home directory in question? I don't want them to be manipulating home directory data on a server in building one when they're actually logged into a workstation in building two, for example...I want the workstation they're sitting at to log into the domain for domain2 and then map their "home drive" to domain2's local server for later syncing with the master server (and subsequent distribution to other systems).
4) What security problems would be immediately apparent with respect to home directory access? I'd like just the owner of the directory and root to have access to the home directories, but there may be other shares for select groups of people to access being distributed as well. I am still reading up on what Samba can and can't do, and it seems some documentation is out of date out there, but looks like ACLs are kind of iffy in support? How can this be done then, with cross-domain access? Or is there another easier way to do it?
5) can users be "remotely created" easily by just copying a few files among the servers? I.e., add a user on Master, then copy Master's passwd, passwd.db., etc. files to each of the sub-servers, then the subservers should know about "newuser" and "newuser"'s home directory (also synced up from Master) without actually having to sit down and create the user at each console. Or is there a way to sync information using just Samba to have the correct password, directory info, ownership, etc.?
***
What this would essentially be attempting to achieve is to have a way for a geographically spread out network allow people to easily access their home directories and shares no matter where they logged using local servers acting as time-delayed proxies...all the user login information, user home directory data, user shared data directories...it's a lot of duplicated information out there, but it would fix the problem with authentication and home directory information being temporarily inaccessible when a link is down between building locations. No matter what building they were in, they would have access to that building's copy of their home directory; the next day, logging into a different building, they'd get their information again.
Thoughts and/or ideas? I'd like to do this using either just SAMBA to authenticate or underlying FreeBSD accounts, whichever would still have it easy to duplicate by just syncing up some files and not messing up GID/UID ownership and passwords. I know there are ways for single sign-on using services like LDAP, but LDAP is an unfamiliar beast to me (for now!) and while it may sync usernames and password, I don't think it would handle things like permissions to home directories, especially when trying to get workstations to map to their local building's server instead of a single master home directory server.
Thanks, -Bart
_______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
