Re: Samba and Win95/98 drive mounts

[Adam Tauno Williams <awilliam@xxxxxxxxxxxxxxxx>]

>>The NSS LDAP module provided with RedHat and the
>>appropriate flags in /etc/nsswitch.conf let you use
>>LDAP for the automounter, and just about everything
>>else that runs through NSS.
>Yeah, I've seen the NSS LDAP stuff (OSS from the same company that
>makes ypldapd, right?).  I didn't know it could do so much.

PADL.  They make great stuff but NEVER update their web site.  Rather annoying.

>>Yep, your talking about ypldapd, for about $1300 a host.
>>WAY to much money in my book.
>Yep, totally agree.
>> So I wrote ldap2nis.  It is NOT as nice as ypldap because
>> you still have to run a NIS server and invoke ldap2nis when
>> changes occur, while ypldapd does it all in memory and
>> "online".
>Well maybe I can get involved and help out.  I have been meaning to
>do some socket programming.

That would be great.  It doesn't (at first glance) look like it would be that hard,  at least for /etc/passwd and /etc/group, as their aren't that many calls.  The real problem is to do it effeciently.  "ypcat", etc... pull an entire map down but LDAP servers aren't really designed to pump out a sequential steam of data.  Some have limits as to how many objects you can request at a time which make it even harder.  ldap2nis silently requires that you can get all your objects in one query,  which is probably not true for very large sites.

>> But it works well enough for my couple of hundred users.
>> Samba kicks it off whenever anyone changes their password,
>> and CRON runs it once at night just in case.
>I have a hell of a time getting password synchronization to work
>with Samba under both RedHat 6.2 and the latest 7.1, with and
>without NIS.  What's your secret?

No secret.  I don't wrap the "passwd" command but a shell script that takes the new password as a parameter.  This makes the chat script VERY simple,  otherwise I fought like crazy trying to get it to work.  Samba kept saying something about invalid string length.  With a script it just runs the command and expects "OK" if everything worked.  I use the ldappasswd binary in the script to set the LDAP password and kick off ldap2nis (only rebuilding the passwd map).  I do some other things in the script like recording who/when changed there password,  so I can look for anything queer.