TweetFollow Us on Twitter

Integrating OS X With OpenLDAP/Samba, Part 3

Volume Number: 25
Issue Number: 03
Column Tag: Networking

Integrating OS X With OpenLDAP/Samba, Part 3

Configuring Your Mac To Work With Linux Samba and LDAP Servers

by Noah Gift

Introduction

In the last two articles, we got familiar with using virtualization to build a Samba /LDAP environment that our Macs could talk to. For many people those two articles would be enough to setup a simple home file sharing and authentication system. And because our Ubuntu virtual machine is just a file, it is simple to keep copies of this configuration laying around in case something goes wrong.

In part two we reached a stopping point after we got basic authentication working with OpenLDAP. In this article we tackle how to fully configure and tweak OS X to work with OpenLDAP, and Samba, including automounting a network home directory via Samba or NFS served out from the virtual machine. It is almost a little too science fiction to talk about without seeing some examples, so I have included quite a few.

In the first two articles, we downloaded a pre-configured Ubuntu virtual machine here: http://examples.oreilly.com/9780596515829/vm/

All of the following steps will be based on the assumption that you have been continuing to work from either this Samba/OpenLDAP server, or a similar one you configured.

Getting Used to Automounting with Leopard

OS X has been around for almost a decade, with first version OS X server coming out in 1999. Many Systems Administrators have wrestled with trying to get OS X to behave more like Unix and Linux for all of this time. With 10.4 Tiger, a few changes brought OS X very close to acting like traditional Unix machines, and finally with Leopard becoming POSIX and SUSv3 compliant.

One of the new, and welcome, changes is a working automounting system just like your favorite Unix or Linux system. To demonstrate how useful this is, we are going to go back to our virtual machine to create an NFS exported file system, and then automount it on our Mac.

Step 1: Install NFS on the Ubuntu virtual machine:

sudo apt-get install nfs-kernel

(Note, if you are not familiar with the apt-get command on Ubuntu, it is a package installer, that works a lot like Fink or Mac Ports on the Mac)

Step 2: Add an entry into /etc/exports (again, on the virtualized server)

#directory exported      host(options)
/usr/export         *(rw,sync,insecure)

(Note, we are using * instead of specifying a host or range of IP addresses. This is insecure and exports the volume to the world. This is not recommended unless you are testing a configuration behind a firewall. Also, note that we use the option "insecure". This is because OS X uses a different port than Linux to communicate over NFS. If this option is not set on the server, an OS X client will not be able to mount a NFS volume without a special client side NFS configuration.)

Step 3: Back on the OS X machine, browse to /net/192.168.1.200/usr/export (or whatever the IP address is)

# cd /net/192.168.1.200/usr/export/

This is the beauty of automounting. You simply browse to a hostname/ip address, and the shares just mount. We can see this in action by looking at the output of the df command:

# df -h
Filesystem                  Size   Used  Avail Capacity  Mounted on
/dev/disk0s2                93Gi   81Gi   12Gi    88%    /
devfs                      110Ki  110Ki    0Bi   100%    /dev
fdesc                      1.0Ki  1.0Ki    0Bi   100%    /dev
map -hosts                   0Bi    0Bi    0Bi   100%    /net
map auto_home                0Bi    0Bi    0Bi   100%    /home
trigger                      0Bi    0Bi    0Bi   100%    /net/192.168.1.200/usr
trigger                      0Bi    0Bi    0Bi   100%    /net/192.168.1.200/usr/export
192.168.1.200:/usr/export  2.0Gi  461Mi  1.4Gi    25%    /net/192.168.1.200/usr/export

Step 4: Try to create a file

# touch foo
touch: foo: Permission denied

We get permission denied because NFS uses two levels of security. The first layer of security is host/ip based. We passed that layer of security, and were able to mount the volume. The reason we can't write to the file though, is that owner/group permissions are not set to allow my user account to write. Let's fix this now.

Creating LDAP/Samba Accounts for Mac on a Linux Server

In the last section we were able to setup a NFS server and mount it on our client, but we weren't able to write to it yet because we didn't have proper permission. Let's fix this, by creating a LDAP/Samba User account, and then changing permissions so we write to on when we automount it on the Mac.

Step 1: Use the smbldap-useradd command to create a mactech account

$ sudo smbldap-useradd mactech

Step 2: Use the smbldap-passwd command to set the password

$ sudo smbldap-passwd mactech
Changing UNIX password for mactech
New password: 
Retype new password: 

Step 3: Verify the account works

py4sa@py4sa:~$ su - mactech
Password: 
mactech@py4sa:~$ pwd
/home/mactech
mactech@py4sa:~$ id
uid=30003(mactech) gid=513(Domain Users) groups=513(Domain Users)

This command-line tool creates an account that simultaneously is able to authenticate to Samba, and LDAP. Now, we can go back to our exported volume, and change the ownership to reflect a uid(user id) of 30003, and a gid(group user id) of 513. Note, that the group is called Domain Users, which is a default Samba/LDAP group. All new user accounts get added to this account.

Step 4: Changing ownership of /usr/export to our new mactech user

mactech@py4sa:~$ exit logout py4sa@py4sa:~$ sudo chown -R 30003:513 /usr/export/ [sudo] password for py4sa:

Now, let's test this out on the Mac by changing to our newly created mactech user, and attempting to write to this automounted volume.

Step 5: Authenticating, Mounting, and Writing as an Samba/LDAP user. This takes place on your client OS X machine.

Change to the mactech user:

# su mactech
Password:
bash: /home/mactech/.bashrc: Input/output error

Enter the export directory and set off the automount:

bash-3.2$ cd /net/192.168.1.200/broadcasthost/localhost/
bash-3.2$ cd /net/192.168.1.200/usr/export/

List the contents of the directory:

bash-3.2$ ls
foo

Create a new file in this directory:

bash-3.2$ touch test.txt

No error, so list the contents again:

bash-3.2$ ls -la
total 31
drwxr-xr-x  3 mactech  Domain Users  4096 Nov  5 13:34 .
dr-xr-xr-x  3 root     wheel            2 Nov  5 12:21 ..
-rwxrw-rw-  1 mactech  Domain Users  6148 Oct 14 02:40 .DS_Store
drwxr-xr-x  2 mactech  Domain Users  4096 Oct 14 02:06 foo
-rw-r--r--  1 mactech  Domain Users     0 Nov  5 13:34 test.txt

There are a couple of things to point out. First, our shell complained when we logged into the mactech user, because there is no home directory path that matches /home/mactech on our Mac, like it does on the Ubuntu machine. We are going to fix that in the next section, but for now, if we move past this, we can see that yes, we can create a test file. And, if we look at the permissions, they are set to the username and group that we would expect. Ok, on to fixing the home directory.

Cross Platform Linux/Mac NFS Automounted Home Directory

In both the last article, and this article, we ran into problems when using LDAP user accounts, because when we created a user account in LDAP on the linux machine, the path to mount the home directory didn't exist on our Macs. In addition, it makes sense that we would want to share common network mounted home directories between the two platforms.

Fortunately, with a little help from symbolic links, it is quite easy to accomplish a cross platform home directory.

Step 1: Create a home directory in /net/192.168.1.200/usr/export/

While still logged in as the mactech user:

$ mkdir -p /net/192.168.1.200/usr/export/home/mactech

Step 2: On the Ubuntu server create symbolic link from /usr/export to /export

py4sa@py4sa:/$ sudo ln -s /usr/export/ /export

This allows us to create a common path to a home directory that we can also symbolically link on the Mac when it is mounted.

Step 3: Change the LDAP record for mactech to reflect the new location

py4sa@py4sa:/$ sudo smbldap-usermod -d /export/home/mactech mactech

Step 4: Create a symbolic link on OS X from the automount directory to /export

# sudo ln -s /net/192.168.1.200/usr/export /export

Step 5: Log in via the command line to the mactech account on OS X to verify it works, and verify the mount point.

# su - mactech
Password:
$
$ pwd
/export/home/mactech
$ df -h
Filesystem                  Size   Used  Avail Capacity  Mounted on
/dev/disk0s2                93Gi   80Gi   13Gi    87%    /
devfs                      111Ki  111Ki    0Bi   100%    /dev
fdesc                      1.0Ki  1.0Ki    0Bi   100%    /dev
map -hosts                   0Bi    0Bi    0Bi   100%    /net
map auto_home                0Bi    0Bi    0Bi   100%    /home
trigger                      0Bi    0Bi    0Bi   100%    /net/192.168.1.200/usr
trigger                      0Bi    0Bi    0Bi   100%    /net/192.168.1.200/usr/export
192.168.1.200:/usr/export  2.0Gi  461Mi  1.4Gi    25%    /net/192.168.1.200/usr/export

Ah, everything works this time. Now, let's make a test file just to be sure.

Step 6: Creating a test file

$ touch mycommondir.txt
$ ls -lan   
total 16
drwxr-xr-x  2 30003  513  4096 Nov  5 14:50 .
drwxr-xr-x  3 30003  513  4096 Nov  5 13:36 ..
-rw-r--r--  1 30003  513     0 Nov  5 15:10 mycommondir.txt

When we login to the Linux machine, we should see this same file and have access to it because the uid/gid are the same between the systems. Before we do that though, let's use fast user switching to login to this NFS mounted network account. After all this is a Mac, not just a command line only Operating System.

Step 7: Use fast user switching to login to the mactech account, and verify it works. (Note, using fast user switching is important because you need to keep your virtual machine running).

Your Mac should take a few seconds, and then you should get a home directory that looks like this:


Figure 1: NFS Mounted Mac Home Directory

What is cool about this, is that it automatically created "Mac stuff" for us, including the Desktop, Pictures, Downloads, and Library folder, yet kept the test file we created mycommondir.txt. Now when you are ready to log out of this account, we can test what happens when we ssh into our virtual machine as the mactech user. Want to guess what we see?

Step 8: ssh into Virtual Machine as mactech user

$ ssh mactech@192.168.1.200
mactech@py4sa:~$ pwd
/export/home/mactech
mactech@py4sa:~$ ls -lan
total 144
drwxr-xr-x  8 30003 513  4096 2008-11-05 15:28 .
drwxr-xr-x  3 30003 513  4096 2008-11-05 13:36 ..
drwx------  2 30003 513  4096 2008-11-05 15:14 Desktop
drwx------  2 30003 513  4096 2008-11-05 15:12 Downloads
-rw-r--r--  1 30003 513  6148 2008-11-05 15:14 .DS_Store
drwx------ 12 30003 513  4096 2008-11-05 15:15 Library
-rw-r--r--  1 30003 513  4096 2008-11-05 15:14 ._mactech_home_dir.png
-rw-r--r--  1 30003 513 98015 2008-11-05 15:14 mactech_home_dir.png
-rw-r--r--  1 30003 513     0 2008-11-05 15:10 mycommondir.txt
drwxr-xr-x  3 30003 513  4096 2008-11-05 15:13 Pictures
drwx------  3 30003 513  4096 2008-11-05 15:12 .Spotlight-V100
drwx------  2 30003 513  4096 2008-11-05 15:28 .ssh
mactech@py4sa:~$ 

Awesome! We have a common NFS mounted home directory that "just works" on OS X and Linux, and we did it all with a virtual machine.

Conclusion

In this third of a four-part series, we created a common NFS mounted home directory by leveraging the power of LDAP, Linux, NFS and the automount daemon. As a result, we now have a recipe for a complete cross platform authentication and network home directories.

Because we used an LDAP/Samba configuration that was configured to work together, we are able to create Samba shares that work with Linux, OS X, or Windows. These could be home directories, and common mount points via Samba, or you could do as we demonstrated in this article, and share out the same directory via Samba and NFS.

The beauty of this configuration is its flexibility, as we can use this one virtual machine to accomplish several different, yet robust configurations. In addition, due to the use of symbolic links, and the automounter, we didn't need to touch LDAP on OS X, other then our initial work in the second article. One thing we didn't cover in detail that bares a mention though, is that NFS requires a thorough understanding of Unix permissions. If you run into problems deploying this in a wider environment, remember to review that you have intentionally configured a proper umask, and group and user permissions. This is the most common problem when first dealing with common NFS home directories for first-timers.

In the final article, we will close the gaps of dealing with LDAP and Samba on OS X. We will briefly talk about OS X's extended attributes and Managed Preferences, and then get into configuring a project management and version control tool, trac, to work with LDAP. We will also briefly talk about how LDAP works with Apache authentication, and how the PHP LDAP admin tool can make dealing with LDAP much easier. Remember, all of this works with the exact same username and password, too, and that is the fun part of setting up centralized authentication.

BIBLIOGRAPHY AND REFERENCES

Noah Gift. "How To Build A Dirt Easy NAS with Samba". Red Hat Magazine, http://www.redhatmagazine.com/2007/06/26/how-to-build-a-dirt-easy-home-nas-server-using-samba/.

Noah Gift and Grig Gheorghiu "LDAP Crud". IBM Developerworks, http://www.ibm.com/developerworks/aix/library/au-ldap_crud/.

Noah Gift. "Getting Started With Open Directory". O'Reilly. http://www.macdevcenter.com/pub/a/mac/2007/06/01/discover-the-power-of-open-directory.html

Noah Gift and Jeremy Jones. "Python For Unix and Linux Systems Administration". O'Reilly . ISBN: 0596515820


Noah Gift has been a Mac user since his family bought a Macintosh Performa 6300 in 1992, and started connected to BBS networks immediately and then eventually the World Wide Web in 1993 when it become open to the public. He is the co-author of "Python For Unix and Linux System Administration" by O'Reilly, and the upcoming "Google App Engine In Action" by Manning.

Noah has a couple of decades of experience in the Television and Film industry starting off as an editor for ABC Network News as a teenager. He contributed to the first feature animated film for Disney Feature Animation and Sony Imageworks. He also had stints at Turner Studios and Caltech, where he worked for the Nobel Prize-winning President as a Mac expert. He has a Master's degree in CIS, and is LPI and ACSA certified. He currently works for WetaDigital in New Zealand. Many of his projects and writing are available at www.noahgift.com. He can be contacted at noah.gift@giftcs.com

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

FotoMagico 5.6.12 - Powerful slideshow c...
FotoMagico lets you create professional slideshows from your photos and music with just a few, simple mouse clicks. It sports a very clean and intuitive yet powerful user interface. High image... Read more
OmniGraffle Pro 7.12.1 - Create diagrams...
OmniGraffle Pro helps you draw beautiful diagrams, family trees, flow charts, org charts, layouts, and (mathematically speaking) any other directed or non-directed graphs. We've had people use... Read more
beaTunes 5.2.1 - Organize your music col...
beaTunes is a full-featured music player and organizational tool for music collections. How well organized is your music library? Are your artists always spelled the same way? Any R.E.M. vs REM?... Read more
HandBrake 1.3.0 - Versatile video encode...
HandBrake is a tool for converting video from nearly any format to a selection of modern, widely supported codecs. Features Supported Sources VIDEO_TS folder, DVD image or real DVD (unencrypted... Read more
Macs Fan Control 1.5.1.6 - Monitor and c...
Macs Fan Control allows you to monitor and control almost any aspect of your computer's fans, with support for controlling fan speed, temperature sensors pane, menu-bar icon, and autostart with... Read more
TunnelBear 3.9.3 - Subscription-based pr...
TunnelBear is a subscription-based virtual private network (VPN) service and companion app, enabling you to browse the internet privately and securely. Features Browse privately - Secure your data... Read more
calibre 4.3.0 - Complete e-book library...
Calibre is a complete e-book library manager. Organize your collection, convert your books to multiple formats, and sync with all of your devices. Let Calibre be your multi-tasking digital librarian... Read more
Lyn 1.13 - Lightweight image browser and...
Lyn is a fast, lightweight image browser and viewer designed for photographers, graphic artists, and Web designers. Featuring an extremely versatile and aesthetically pleasing interface, it delivers... Read more
Visual Studio Code 1.40.0 - Cross-platfo...
Visual Studio Code provides developers with a new choice of developer tool that combines the simplicity and streamlined experience of a code editor with the best of what developers need for their... Read more
OmniGraffle 7.12.1 - Create diagrams, fl...
OmniGraffle helps you draw beautiful diagrams, family trees, flow charts, org charts, layouts, and (mathematically speaking) any other directed or non-directed graphs. We've had people use Graffle to... Read more

Latest Forum Discussions

See All

The House of Da Vinci 2 gets a new gamep...
The House of Da Vinci launched all the way back in 2017. Now, developer Blue Brain Games is gearing up to deliver a second dose of The Room-inspired puzzling. Some fresh details have now emerged, alongside the game's first official trailer. [Read... | Read more »
Shoot 'em up action awaits in Battl...
BattleBrew Productions has just introduced another entry into its award winning, barrelpunk inspired, BattleSky Brigade series. Whilst its previous title BattleSky Brigade TapTap provided fans with idle town building gameplay, this time the... | Read more »
Arcade classic R-Type Dimensions EX blas...
If you're a long time fan of shmups and have been looking for something to play lately, Tozai Games may have just released an ideal game for you on iOS. R-Type Dimensions EX brings the first R-Type and its sequel to iOS devices. [Read more] | Read more »
Intense VR first-person shooter Colonicl...
Our latest VR obsession is Colonicle, an intense VR FPS, recently released on Oculus and Google Play, courtesy of From Fake Eyes and Goboogie Games. It's a pulse-pounding multiplayer shooter which should appeal to genre fanatics and newcomers alike... | Read more »
PUBG Mobile's incoming update bring...
PUGB Mobile's newest Royale Pass season they're calling Fury of the Wasteland arrives tomorrow and with it comes a fair chunk of new content to the game. We'll be seeing a new map, weapon and even a companion system. [Read more] | Read more »
PSA: Download Bastion for free, but wait...
There hasn’t been much news from Supergiant Games on mobile lately regarding new games, but there’s something going on with their first game. Bastion released on the App Store in 2012, and back then it was published by Warner Bros. This Warner... | Read more »
Apple Arcade: Ranked - 51+ [Updated 11.5...
This is Part 2 of our Apple Arcade Ranking list. To see part 1, go here. 51. Patterned [Read more] | Read more »
NABOKI is a blissful puzzler from acclai...
Acclaimed developer Rainbow Train's latest game, NABOKI, is set to launch for iOS, Android, and Steam on November 13th. It's a blissful puzzler all about taking levels apart in interesting, inventive ways. [Read more] | Read more »
A Case of Distrust is a narrative-driven...
A Case of Distrust a narrative-focused mystery game that's set in the roaring 20s. In it, you play as a detective with one of the most private eye sounding names ever – Phyllis Cadence Malone. You'll follow her journey in San Francisco as she... | Read more »
Brown Dust’s October update offers playe...
October is turning out to be a productive month for the Neowiz team, and a fantastic month to be a Brown Dust player. First, there was a crossover event with the popular manga That Time I Got Reincarnated as a Slime. Then, there was the addition of... | Read more »

Price Scanner via MacPrices.net

Score a 37% discount on Apple Smart Keyboards...
Amazon has Apple Smart Keyboards for current-generation 10″ iPad Airs and previous-generation 10″ iPad Pros on sale today for $99.99 shipped. That’s a 37% discount over Apple’s regular MSRP of $159... Read more
Apple has refurbished 2019 13″ 1.4GHz MacBook...
Apple has a full line of Certified Refurbished 2019 13″ 1.4GHz 4-Core Touch Bar MacBook Pros available starting at $1099 and up to $230 off MSRP. Apple’s one-year warranty is included, shipping is... Read more
2019 13″ 1.4GHz 4-Core MacBook Pros on sale f...
Amazon has new 2019 13″ 1.4GHz 4-Core Touch Bar MacBook Pros on sale for $150-$200 off Apple’s MSRP. These are the same MacBook Pros sold by Apple in its retail and online stores: – 2019 13″ 1.4GHz/... Read more
11″ 64GB Gray WiFi iPad Pro on sale for $674,...
Amazon has the 11″ 64GB Gray WiFi iPad Pro on sale today for $674 shipped. Their price is $125 off MSRP for this iPad, and it’s the lowest price available for the 64GB model from any Apple reseller. Read more
2019 15″ MacBook Pros available for up to $42...
Apple has a full line of 2019 15″ 6-Core and 8-Core Touch Bar MacBook Pros, Certified Refurbished, available for up to $420 off the cost of new models. Each model features a new outer case, shipping... Read more
2019 15″ MacBook Pros on sale this week for $...
Apple resellers B&H Photo and Amazon are offering the new 2019 15″ MacBook Pros for up to $300 off Apple’s MSRP including free shipping. These are the same MacBook Pros sold by Apple in its... Read more
Sunday Sale: AirPods with Wireless Charging C...
B&H Photo has Apple AirPods with Wireless Charging Case on sale for $159.99 through 11:59pm ET on November 11th. Their price is $40 off Apple’s MSRP, and it’s the lowest price available for these... Read more
Details of Sams Club November 9th one day App...
Through midnight Saturday night (November 9th), Sams Club online has several Apple products on sale as part of their One Day sales event. Choose free shipping or free local store pickup (if available... Read more
Sprint is offering the 64GB Apple iPhone 11 f...
Sprint has the new 64GB iPhone 11 available for $15 per month for new lines. That’s about 50% off their standard monthly lease of $29.17. Over is valid until November 24, 2019. The fine print: “Lease... Read more
New Sprint November iPhone deal: Lease one iP...
Switch to Sprint and purchase an Apple iPhone 11, 11 Pro, or 11 Pro Max, and get a second 64GB iPhone 11 for free. Requires 2 new lines or 1 upgrade-eligible line and 1 new line. Offer is valid from... Read more

Jobs Board

*Apple* Mobility Pro - Best Buy (United Stat...
**746087BR** **Job Title:** Apple Mobility Pro **Job Category:** Store Associates **Store NUmber or Department:** 000319-Harlem & Irving-Store **Job Description:** Read more
Best Buy *Apple* Computing Master - Best Bu...
**743392BR** **Job Title:** Best Buy Apple Computing Master **Job Category:** Store Associates **Store NUmber or Department:** 001171-Southglenn-Store **Job Read more
Best Buy *Apple* Computing Master - Best Bu...
**746015BR** **Job Title:** Best Buy Apple Computing Master **Job Category:** Sales **Store NUmber or Department:** 000372-Federal Way-Store **Job Description:** Read more
*Apple* Mobility Pro - Best Buy (United Stat...
**744658BR** **Job Title:** Apple Mobility Pro **Job Category:** Store Associates **Store NUmber or Department:** 000586-South Hills-Store **Job Description:** At Read more
Best Buy *Apple* Computing Master - Best Bu...
**741552BR** **Job Title:** Best Buy Apple Computing Master **Job Category:** Sales **Store NUmber or Department:** 000277-Metcalf-Store **Job Description:** **What Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.