Home / server / Questions / 1066216
Accepted
Codejoy
Asked: 2021-06-10 10:35:28 +0800 CST

Openldap and nfserver, both work although /home/user cannot be created unless I log into the nfserver first with new ldapusers

  • 772

I have an openldap server I set up on cent os 7. I blended it to work with all my other VMs that mount a nfs mount from a nfs server for their /home.

I just figured out that if I create a new ldap user, and try to log into some VM it lets me login but states how it cannot create /home/user and is unable to chngdir to it.

But I also learned if I first ssh user@mynfsserver It logs in, creates the appropriate /home/user and then after that I can ssh to any other VM with my ldapuser and it works just fine no longer complains about being able to not create the folder in home for said user.

I use autofs on each VM with a home.map file, it looks to have the right permissions:

* -fstype=nfs,rw,nosuid,soft 10.10.1.139:/home/&

so this feels like some sort of permission issue with users getting errors logging into a VM with their newly created ldap credentials. But if that same user logs into the 10.10.1.139 (nfs server where home is mapped from), then it seems to let them log into the VMs with no unable to create /home/user errors anymore.

Does my openldap server have to be made aware of the nfs server somehow?

Aside from the hiccup of having to log into the nfs server first, I can goto another VM touch a file in that home folder and bingo it is on any other VM I log into. So it is like 95% working, just annoying to have to first log into nfserver with ldap user to make the /home/user creation work on other VMs first.

nfs openldap home-directory centos7

1 Answers

  1. Best Answer

    The automatic creation of new home directories is done by root, but by default root is mapped to the anonymous user on nfs mounts and therefore the home directory can't be created on all nfs clients. Add no_root_squash to your line in /etc/exports on your nfs server to disable this and run sudo exportfs -ra for the changes to take effect. So based on your comment it should look like this:

    /home 10.10.1.0/24(rw,no_root_squash)

    This will allow root access to the mounted nfs filesystem on all clients.

    However this has some implications. From the exportfs manpage:

    User ID Mapping

    nfsd bases its access control to files on the server machine on the uid and gid provided in each NFS RPC request. The normal behavior a user would expect is that she can access her files on the server just as she would on a normal file system. This requires that the same uids and gids are used on the client and the server machine. This is not always true, nor is it always desirable.

    Very often, it is not desirable that the root user on a client machine is also treated as root when accessing files on the NFS server. To this end, uid 0 is normally mapped to a different id: the so-called anonymous or nobody uid. This mode of operation (called `root squashing') is the default, and can be turned off with no_root_squash.

    By default, exportfs chooses a uid and gid of 65534 for squashed access. These values can also be overridden by the anonuid and anongid options. Finally, you can map all user requests to the anonymous uid by specifying the all_squash option.

    • 1