Jorgen Lundman wrote:> Standard ISP hosting with virtual users here. So we already have an
> existing system setup, based around OpenLDAP data for customer
> information. Currently for WWW hosting, users have FTP access. But FTP
> seems to be a hurdle for certain users, so I was thinking about also
> offering SMB access in parallel with FTP, so they could just MAP a
> drive letter to their WWW area.
Connecting to SMB/CIFS over the internet tends to be extremely slow. I'm
not sure why that should be the case, but having played with direct
access over the internet vs over a VPN, the internet one is
substantially slower (to the point of being practically unusable). That
might be less of an issue if you are their ISP.
Mapping a drive could also cause problems. In the past I have had issues
with very long delays opening My Computer when network drives are slow
to respond. I've just tried to replicate this issue and it doesn't
appear to be a problem in Vista but I have certainly seen it with some
versions of XP.
> Currently the LDAP has user data in "qmail" and POSIX style
schema,
> which seems to be fairly common. (uidNumber, gidNumber, gecos,
> homeDirectory etc). Currently passwords are stored in plain-text.
I hesitate to say that storing passwords in plain-text is "good", but
in
this case it will greatly simplify things. You will need to add the
samba schema.
> 1) Can I make Samba lookup uid,gid,homeDirectory from LDAP directly?
> The new privacy-laws do not allow us to use PAM for the customers as a
> whole. I expected to be able to specify LDAP search filter, and a map
> between our LDAP attributes and those Samba expects (which appear to
> mostly overlap though). But this appears to have been removed?
Samba is able to talk to LDAP directly and fully understands the fields
in the POSIX schema, there are plenty of OSs supported by Samba that
don't use PAM (Slackware, AIX, probably the various BSDs).
> 2) Can I use the plain-text passwords directly, and avoid having to
> store nt and lm passwords?
Not without having to make changes to how the client PCs will
authenticate, so pretty much "no". However since you have the
passwords
in plaintext it isn't too much of a hassle to generate the hashes.
> Since with FTP you login as "ftpuser@example.com" with
appropriate
> password, I was hoping that users could connect to our samba server,
> authenticating as "ftpuser@example.com" and same password. It
would
> then set the share path to the users homeDirectory
> (/export/cust14/com/e/x/example/ftpuser/) and use their uid, gid.
Sounds reasonably straight forward.>
> Are there other reasons why this could not be done? Anyone already
> done something similar? Any pit-falls?
I'm not certain that it is a good idea, but it's not impossible.
*Michael Heydon - IT Administrator *
michaelh@jaswin.com.au <mailto:michaelh@jaswin.com.au>