samba - Dec 2024 - Linux desktop setup with authentication against Samba AD DC

On Mon, 2 Dec 2024 10:29:22 +0100
Peter Milesson via samba <samba at lists.samba.org> wrote:
> >>
> >> Peter
> > So, it works with Gnome.
> > It appears that, provided all the required packages can be
> > installed, it will probably work on any distro, I cannot test them
> > all ;-)
> >
> > Rowland
> >
> >
> >
> Oh, c'mon Rowland (^_^)
> 
> I'm going to start duplicating from a master image. Let's see what 
> surprises I get from UEFI...
> 
> Peter
I looked into Rocky Linux a bit further and found a repo for hxtools
and set pam_mount up on Rocky and it works, just like on Debian.

To date, I have working examples on Debian Gnome, XCFE and MATE.
However the MATE version has problems with the panels, they keep
segfaulting but the user gets logged in and the home directory share is
mounted, so it looks like pam-mount is working. I have also have
working examples on LMDE6 with the Cinnamon desktop and on Rocky Linux
9 with the Gnome desktop.

It appears that you just need 3 things:

A Samba AD DC to create users on.

A Samba Unix domain member to share the users home directory from.

A Samba Unix domain member to act as the client, with pam_mount,
hxtools and cifs-utils installed and configured correctly.

The only real downside I can see is, because of the various different
configuration files that the different desktops use, it is very
probably limited to one desktop per domain.

Rowland

On 03.12.2024 17:22, Rowland Penny via samba wrote:
> On Mon, 2 Dec 2024 10:29:22 +0100
> Peter Milesson via samba <samba at lists.samba.org> wrote:
>
>>>> Peter
>>> So, it works with Gnome.
>>> It appears that, provided all the required packages can be
>>> installed, it will probably work on any distro, I cannot test them
>>> all ;-)
>>>
>>> Rowland
>>>
>>>
>>>
>> Oh, c'mon Rowland (^_^)
>>
>> I'm going to start duplicating from a master image. Let's see
what
>> surprises I get from UEFI...
>>
>> Peter
> I looked into Rocky Linux a bit further and found a repo for hxtools
> and set pam_mount up on Rocky and it works, just like on Debian.
>
> To date, I have working examples on Debian Gnome, XCFE and MATE.
> However the MATE version has problems with the panels, they keep
> segfaulting but the user gets logged in and the home directory share is
> mounted, so it looks like pam-mount is working. I have also have
> working examples on LMDE6 with the Cinnamon desktop and on Rocky Linux
> 9 with the Gnome desktop.
>
> It appears that you just need 3 things:
>
> A Samba AD DC to create users on.
>
> A Samba Unix domain member to share the users home directory from.
>
> A Samba Unix domain member to act as the client, with pam_mount,
> hxtools and cifs-utils installed and configured correctly.
>
> The only real downside I can see is, because of the various different
> configuration files that the different desktops use, it is very
> probably limited to one desktop per domain.
>
> Rowland
>
>
Hi Rowland,

You can add Archlinux also.

I'm not really sure what you mean by one desktop per domain.

Let's say you configure user home directories for a large group of users.

Then you can create one master with LXDE on Debian, another master Gnome 
on Archlinux, another master with Fluxbox on Rocky Linux ...

There are no centrally stored machine profiles. There are only user 
profiles stored on a common server. When the user logs on for the first 
time, the profile is created with all folders and default settings, 
according to what's defined in the distribution's defaults. Let's
say
PCs with different distributions are not mixed between different 
locations, then I don't really see any problems. If OTOH there's a mix 
of PCs with different distributions available on one site, then you 
probably hit a brick wall with incompatibilities. Then the concept is 
not viable without extensive administration.

My intention was setting up one type of PC with a specific Linux 
distribution, with a specific desktop. If you're the modern sort of 
sysadmin, you could let the users have vote on it first. But when the 
decision is made, it must be set in concrete.

Administration must be dead simple, deploying new PCs in a snap, 
otherwise the whole concept defeats its purpose, and you could as well 
jump onto the Azure bandwagon. This concept is probably best suited for 
limited work groups with common requirements.

For those deploying many Linux PCs, it's probably useful to set up some 
kind of central management for updates, and other tasks. But that's 
another beast.

Best regards,

Peter

Mandi! Rowland Penny via samba
  In chel di` si favelave...
> However the MATE version has problems with the panels, they keep
> segfaulting but the user gets logged in and the home directory share is
> mounted, so it looks like pam-mount is working.
Sure. If you mounted the home on '~', probably is MATE that is trying to
create some special files (socket? pipe?) on the home, failing it.

I've tried in the past to debug it, but with no luck.

--