2. Computers & electronics
  3. Software
  4. Novell
  5. Open Enterprise Server 11 SP3

Novell Open Enterprise Server 11 SP3 Administration Guide

  • Hello! I am an AI chatbot trained to assist you with the Novell Open Enterprise Server 11 SP3 Administration Guide. I’ve already reviewed the document and can help you find the information you need or explain it in simple terms. Just ask your questions, and providing more details will help me assist you more effectively!
www.novell.com/documentation
Linux User Management
Administration Guide
Open Enterprise Server 11 SP2
January 2014
Legal Notices
Novell,Inc.,makesnorepresentationsorwarrantieswithrespecttothecontentsoruseofthisdocumentation,andspecifically
disclaimsanyexpressorimpliedwarrantiesofmerchantabilityorfitnessforanyparticularpurpose.Further,Novell,Inc.,
reservestherighttorevisethispublicationandtomakechangestoitscontent,at
anytime,withoutobligationtonotifyany
personorentityofsuchrevisionsorchanges.
Further,Novell,Inc.,makesnorepresentationsorwarrantieswithrespecttoanysoftware,andspecificallydisclaimsany
expressorimpliedwarrantiesofmerchantabilityorfitnessforanyparticularpurpose.Further,Novell,Inc.,reservestheright
to
makechangestoanyandallpartsofNovellsoftware,atanytime,withoutanyobligationtonotifyanypersonorentityof
suchchanges.
AnyproductsortechnicalinformationprovidedunderthisAgreementmaybesubjecttoU.S.exportcontrolsandthetrade
lawsofothercountries.Youagreeto
complywithallexportcontrolregulationsandtoobtainanyrequiredlicensesor
classificationtoexport,re‐exportorimportdeliverables.Youagreenottoexportorre‐exporttoentitiesonthecurrentU.S.
exportexclusionlistsortoanyembargoedorterroristcountriesasspecifiedintheU.S.
exportlaws.Youagreetonotuse
deliverablesforprohibitednuclear,missile,orchemicalbiologicalweaponryenduses.SeetheNovellInternationalTrade
ServicesWebpage(http://www.novell.com/info/exports/)formoreinformationonexportingNovellsoftware.Novellassumes
noresponsibilityforyourfailuretoobtainanynecessaryexportapprovals.
Copyright©2005–2014Novell,
Inc.Allrightsreserved.Nopartofthispublicationmaybereproduced,photocopied,stored
onaretrievalsystem,ortransmittedwithouttheexpresswrittenconsentofthepublisher.
Novell, Inc.
1800 South Novell Place
Provo, UT 84606
U.S.A.
www.novell.com
OnlineDocumentation:ToaccessthelatestonlinedocumentationforthisandotherNovellproducts,seetheNovell
DocumentationWebpage(http://www.novell.com/documentation/oes11).
Novell Trademarks
ForNovelltrademarks,seetheNovellTrademarkandServiceMarklist(http://www.novell.com/company/legal/trademarks/
tmlist.html).
Third-Party Materials
Allthird‐partytrademarksarethepropertyoftheirrespectiveowners.
Contents 3
Contents
About This Guide 7
1 Overview 9
1.1 Benefits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
1.1.1 Administrator Benefits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.1.2 User Benefits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.2 Understanding Linux User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
1.2.1 User Name and User ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
1.2.2 Password. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10
1.2.3 Primary Group Name and Group ID . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
1.2.4 Secondary Group Names and Group IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
1.2.5 Home Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
1.2.6 Preferred Shell. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
1.3 Understanding eDirectory Objects and Linux. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11
1.3.1 User Accounts in eDirectory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
1.3.2 Group Objects in eDirectory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
1.3.3 Source Workstations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
1.3.4 Linux/UNIX Workstation Objects in eDirectory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13
1.3.5 The Linux/UNIX Config Object in eDirectory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
1.4 Putting It All Together. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
1.5 What's Next . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
2 What’s New or Changed in Linux User Management 17
2.1 What’s New (OES 11 SP2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.2 What’s New (OES 11 SP1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.3 What’s New (OES 11) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18
3 Setting Up Linux User Management 19
3.1 Setting Up Linux Computers to Use eDirectory Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19
3.2 Using iManager to Enable Users for Linux Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22
3.2.1 Running iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22
3.2.2 Determining if a Computer Is Running Linux User Management . . . . . . . . . . . . . . . . . . . .23
3.2.3 Enabling eDirectory Users to Log In to Linux Computers . . . . . . . . . . . . . . . . . . . . . . . . . .24
3.3 Turning Off Linux User Management and eDirectory Authentication. . . . . . . . . . . . . . . . . . . . . . . . . 25
4 Setting Up Linux User Management for Domain Services for Windows 27
5 Linux User Management Technology 29
5.1 Tips and Technologies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29
5.2 Understanding Linux User Management Methods for Enabling User Access . . . . . . . . . . . . . . . . . . 30
5.3 Files Modified by Linux User Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31
5.3.1 The namcd Linux User Management Caching Daemon . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
5.3.2 Starting and Stopping namcd . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
5.4 Linux User Management and the Pluggable Authentication Module . . . . . . . . . . . . . . . . . . . . . . . . . 32
4 OES 11 SP2: Novell Linux User Management Administration Guide
6 Using the Command Line to Configure Linux User Management 33
6.1 Using namconfig . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33
6.1.1 namconfig Command Line Parameters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33
6.1.2 Configuring a Failover Mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .34
6.1.3 Configuring a Workstation with Linux User Management . . . . . . . . . . . . . . . . . . . . . . . . . .34
6.1.4 Configuring Linux User Management with LDAP SSL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
6.1.5 Removing Linux User Management Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .35
6.1.6 Setting or Getting Linux User Management Configuration Parameters. . . . . . . . . . . . . . . .35
6.1.7 Using namconfig to Import an SSL Certificate. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .36
6.2 Editing the nam.conf File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
7 Managing User and Group Objects in eDirectory 41
7.1 Using Novell iManager for Linux User Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7.1.1 Running iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .41
7.1.2 Creating a New Group Object for Linux User Management Users . . . . . . . . . . . . . . . . . . . 42
7.1.3 Enabling an Existing Group Object for Linux User Management . . . . . . . . . . . . . . . . . . . . 43
7.1.4 Creating a User Object for Linux User Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
7.1.5 Enabling an Existing User Object for Linux User Management. . . . . . . . . . . . . . . . . . . . . . 46
7.1.6 Enabling Multiple Users for Linux in a LUM Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
7.1.7 Enabling Multiple Users for Linux in a Container. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
7.1.8 Modifying a UNIX Config Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49
7.1.9 Modifying a UNIX Workstation Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51
7.1.10 Disabling LUM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51
7.2 Using Command Line Utilities to Manage Users and Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52
7.2.1 Security Considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52
7.2.2 nambulkadd. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52
7.2.3 namdiagtool. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55
7.2.4 namuseradd. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .56
7.2.5 namgroupadd. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
7.2.6 namusermod . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .59
7.2.7 namgroupmod . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
7.2.8 namuserdel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
7.2.9 namgroupdel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .63
7.2.10 namuserlist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64
7.2.11 namgrouplist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64
8 Running LUM in a Virtualized Environment 67
9 Troubleshooting 69
9.1 Troubleshooting Linux User Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .69
9.1.1 Incorrect Syntax of alternate-ldap-server-list Parameter Leads to Spaces in LDAP
Certificate File Names . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .70
9.1.2 LUM User Fails to Display . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .70
9.1.3 namdiagtool Fails to Report User Conflict . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .70
9.1.4 LUM-Enabling Using iManager Fails During Custom User Selection . . . . . . . . . . . . . . . . .70
9.1.5 Reuse Group and User ID Feature of LUM (UCO) Does Not Work if the
LUM-Enabled Group or User is Deleted Using iManager . . . . . . . . . . . . . . . . . . . . . . . . . .70
9.1.6 namcd Fails to Come Up When Anonymous Binds are Disabled on the LDAP Server. . . . 71
9.1.7 Root Login to a LUM-enabled Service logs a Message in the /var/log/message File . . . . .71
9.1.8 LUM Users and Groups Are Not Displayed in the Permissions Tab of the File
Browser . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .71
9.1.9 The ls-l Command Hangs if Large Number of Users Are LUM-Enabled . . . . . . . . . . . . . . .71
9.1.10 Linux User Management Returns an Invalid UID and GID for Users and Groups. . . . . . . .72
9.1.11 namconfig Fails . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
9.1.12 namcd Indicates That a Certificate Is Not Found. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72
9.1.13 Duplication of UIDs and GIDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .72
Contents 5
9.1.14 A User Cannot Log In . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73
9.1.15 Password Expiration Information for the User Is Not Available . . . . . . . . . . . . . . . . . . . . . 73
9.1.16 ID Command Not Giving the Desired Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
9.1.17 namcd Not Coming Up after a System Reboot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
9.1.18 Log Files for Linux User Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
9.1.19 Missing Mandatory Attribute Error When Adding a User to a Linux User
Management Group. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
9.1.20 SUSE Linux Enterprise Desktops Configured as UNIX Workstation Objects . . . . . . . . . . . 74
9.2 Making Home Directories Private . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74
9.3 Troubleshooting Account Redirection Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
9.4 Changing the Name of the Original Container Passed to namconfig. . . . . . . . . . . . . . . . . . . . . . . . .75
10 Security Considerations 77
10.1 Configuring Linux User Management for Domain Services for Windows. . . . . . . . . . . . . . . . . . . . . . 77
10.2 Ensuring Unique UIDs and GIDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77
11 Other Issues and Considerations 79
11.1 LUM Configuration Fails With an Unknown Error. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .79
11.2 LUM-Enabled Services for a Workstation Object Are Not Displayed in iManager. . . . . . . . . . . . . . . 79
11.3 Missing Details on a LUM Group in iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .79
11.4 Allocating User IDs and Group IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .80
11.5 RFC 2307 Schema Extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
11.6 Running Linux User Management in a Virtualized Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . .80
11.7 Configuring Linux User Management for Novell Cluster Services . . . . . . . . . . . . . . . . . . . . . . . . . . .80
11.8 Usernames for Linux User Management Users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
A Documentation Updates 81
A.1 January 2014 (OES 11 SP2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
A.1.1 What’s New or Changed in Linux User Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
A.1.2 New Parameter in nam.conf . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
A.2 April 2012 (OES 11 SP1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
A.2.1 What’s New or Changed in Linux User Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
A.2.2 Enabling Multiple Users for Linux in a LUM Group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .82
A.2.3 Enabling Multiple Users for Linux in a Container. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .82
6 OES 11 SP2: Novell Linux User Management Administration Guide
About This Guide 7
About This Guide
ThisguideexplainsanddescribeshowtouseNovellLinuxUserManagement(LUM),adirectory‐
enabledapplicationthatsimplifiesandunifiesthemanagementofuserprofilesonLinuxplatforms.
LinuxUserManagementleveragesallthescalability,utility,andextensibilityofNetIQeDirectory
andaddscrucialintegrationcapability.WithLinuxUserManagement,
youcaneliminatemanyofthe
complexitiesofadministeringamixed‐platformnetworkwhilesmoothingovercompatibilityissues.
Thisguideisdividedintothefollowingsections:
Chapter 1,“Overview,”onpage 9
Chapter 2,“What’sNeworChangedinLinuxUserManagement,”onpage 17
Chapter 3,“SettingUpLinuxUserManagement,”onpage 19
Chapter 4,“Setting
UpLinuxUserManagementforDomainServicesforWindows,”onpage 27
Chapter 5,“LinuxUserManagementTechnology,”onpage 29
Chapter 6,“UsingtheCommandLinetoConfigureLinuxUserManagement,”onpage 33
Chapter 7,“ManagingUserandGroupObjectsineDirectory,”onpage 41
Chapter 8,“RunningLUMinaVirtualizedEnvironment,”onpage 67
Chapter 9,
“Troubleshooting,”onpage 69
Chapter 10,“SecurityConsiderations,”onpage 77
Chapter 11,“OtherIssuesandConsiderations,”onpage 79
Appendix A,“DocumentationUpdates,”onpage 81
Audience
Thisguideisintendedfornetworkadministratorsresponsibleforintegratingandmanagingusersin
aLinuxandeDirectoryenvironment.
Feedback
Wewanttohearyourcommentsandsuggestionsaboutthismanualand theotherdocumentation
includedwiththisproduct.PleaseusetheUserCommentsfeatureatthebottomofeachpageofthe
onlinedocumentation.
Documentation Updates
ThemostrecentversionofLinuxUserManagementAdministrationGuideisavailableontheNovell
documentationWebsite(http://www.novell.com/documentation/oes11).
8 OES 11 SP2: Novell Linux User Management Administration Guide
1
Overview 9
1
Overview
LinuxUserManagementletsyouconfigureLinuxworkstationsandserversonthenetworksousers
canlogintothembyusinguserlogininformationstoredineDirectoryinsteadofuserlogin
informationstoredoneachcomputer.
Section 1.1,“Benefits,”onpage 9
Section 1.2,“UnderstandingLinuxUserAccounts,”onpage 10
Section 1.3,“Understanding
eDirectoryObjectsandLinux,”onpage 11
Section 1.4,“PuttingItAllTogether,”onpage 14
Section 1.5,“WhatʹsNext,”onpage 15
1.1 Benefits
LinuxUserManagementandeDirectoryworktogethertosimplifyadministrationandprovideusers
withaccesstonetworkresources.
Section 1.1.1,“A d m i n i s t r a t o r Benefits,”onpage 9
Section 1.1.2,“UserBenefits,”onpage 9
1.1.1 Administrator Benefits
UsingLinuxUserManagementandeDirectorytomanageuserlogininformationeliminatestheneed
tocreatelocalusersinthe
/etc/passwd
and
/etc/shadow
filesoneachLinuxcomputer.Itsimplifies
useraccountmanagementbyconsolidatinguseraccountsintoacentralpointofadministration.
YoucanuseeDirectorytoolsandtechnologiestomanageaccesstoLinuxresourcesonthenetwork.
Afterauthenticating,usershavetherightsandprivilegesasspecifiedineDirectory.Theseare
the
samerightsandprivilegesthatwouldtypicallyneedtobestoredinalocalaccountorredirectedto
otherauthenticationmethods,suchasNIS(NetworkInformationService).Theuseraccount
informationstoredineDirectoryletsusersaccessfileandprinterresourcesonthenetwork.
1.1.2 User Benefits
UserscanlogintoLinuxcomputersbyusingaccessmethodssuchaslogin,FTP,SSH,su,rsh,rlogin,
andgdm(GNOME).TheysimplyentertheirfamiliareDirectorycredentials.Thereisnoneedto
rememberafullcontext.LinuxUserManagementfindsthecorrectuserineDirectory.
Userscanlogin
once,usingasingleusernameandpassword,andhaveseamlessaccesstoalltheir
networkresourcesregardlessofplatform.
10 OES 11 SP2: Novell Linux User Management Administration Guide
1.2 Understanding Linux User Accounts
SettingupandusingeDirectorytomanageLinuxaccessrequiresyoutounderstandhowtheLinux
operatingsystemmanagesuserlogins.
UserswhowanttologintoaLinuxcomputermusthaveanexistinguseraccount,whichconsistsof
propertiesthatallowausertoaccessfilesandfoldersstored
onthecomputer.Thisaccount
informationcanbecreatedandstoredonthecomputeritselforonanothercomputeronthenetwork.
Accountsstoredonthecomputerarecalledlocaluseraccounts.AccountsstoredineDirectoryare
calledeDirectoryuseraccounts,regardlessofwhethertheyarestoredonthesame
computeroranother
computer.AtypicalaccountusedtologintoaLinuxcomputerconsistsofthefollowinginformation:
UsernameanduserID(UID)
Password
PrimarygroupnameandgroupID(GID)
SecondarygroupnamesandgroupIDs
Locationofthehomedirectory
Preferredshell
Whenalocaluseraccount
iscreated,Linuxrecordstheuser’slogininformationandstoresthevalues
inthe
/etc/passwd
fileonthecomputeritself.The
passwd
filecanbeviewedandeditedwithany
texteditor.Eachuseraccounthasanentryrecordedinthefollowingformat:
username:password:UID:GID:name:home directory:shell
1.2.1 User Name and User ID
TheusernameanduserID(UID)identifytheuseronthesystem.Whenauseraccountiscreated,itis
givenanameandassignedaUIDfromapredeterminedrangeofnumbers.TheUIDmustbea
positivenumberandisusuallyabove500foruseraccounts.Systemaccountsusually
havenumbers
below100.
1.2.2 Password
Eachuseraccounthasitsownpassword,whichisencryptedandstoredonthecomputeritselforon
anothercomputeronthenetwork.Localpasswordsarestoredinthe
/etc/passwd
fileor
/etc/
shadow
file.Whentheuserlogsinbyenteringausernameandpassword,Linuxtakestheentered
password,encryptsit,andthencomparestheencryptedvaluetothevalueofthepasswordstoredin
theuseraccount.Iftheenteredvalueisthesameasthevaluestoredinthepassword
fieldonthe
computer,theuserisgrantedaccess.
Administratorsoftenusethe
/etc/passwd
filetoholduseraccountinformationbutstorethe
encryptedpasswordinthe
/etc/shadow
file.Whenthismethodisused,the
passwd
fileentryhasan
xinthepasswordfield.
Overview 11
1.2.3 Primary Group Name and Group ID
Groupsareusedtoadministerandorganizeuseraccounts.Whenrightsandpermissionsare
assignedtoagroup,alluseraccountsthatarepartofthegroupinheritthesamerightsand
permissions.Thegrouphasauniquenameandidentificationnumber(GID).TheprimaryGIDand
groupnamearestored
asentriesinthe
/etc/passwd
fileonthecomputerwhereuseraccountsare
createdorineDirectory.
Eachuserhasadesignatedprimary(ordefault)groupandcanalsobeamemberofadditional
groupscalledsecondarygroups.Whenuserscreatefilesorlaunchprograms,thosefilesandprograms
areassociatedwithaprimaryor
secondarygroup.Auserwhoisapartofthegroupcanaccessthese
fileandprogramsifnecessarypermissionsareavailable.
1.2.4 Secondary Group Names and Group IDs
Althoughnotstrictlypartoftheuseraccount,secondarygroupsarealsoapartoftheuserlogin
experience.GroupsandGIDsareusedtomanagerightsandpermissionstootherfilesandfolders.
Secondarygroupsforeachuserarelistedasentriesin
/etc/group
onthecomputeritself.
NOTE:Whenyouusethe
id
commandtoshowuserIDsandgroups,ifcase‐sensitivityissetto
no
,
youmustentertheexactcasetodisplaysecondarygroups.Ifyouenteradifferentcase,youseeonly
theprimarygroups.
1.2.5 Home Directory
Thehomedirectoryisafolderusedtostoreauser’spersonaldocuments.Inamulti‐user
environment,eachuserisassignedaspecificdirectorythatisaccessibleonlybytheuserandthe
systemadministrator.Inaddition,thehomedirectoryoffersaplacetostoreconfigurationfiles
uniquetothe
user.Therefore,ausercanloginandfindhisorherenvironmentwiththesamesettings
thatwereusedbefore,evenifanotheruserhasusedthecomputer.Typically ,mostcomputers haveall
homedirectoriesat
/home
,andthenindividualdirectorieslistedbyloginname(forexample,
/home/
jsmith
).The
root
user’shomedirectoryisanexception.Itistraditionallylocatedat
/
or
/root
.
Placinghomedirectoriesunder
/home
isnotrequired,butitmakesorganizationalsense.Some
administratorsdividethe
/home
directorybyfunctionordepartmentandthensubdividethe
/home
directorywithusersinthatdepartment(forexample,
/home/engineering/jsmith
).
1.2.6 Preferred Shell
Shellisacommandlanguageinterpreterthatexecutescommandsreadfromthestandardinput
device(keyboard)orfromafile.Shellisnotpartofsystemkernel,butusesthesys temkernelfor
operationssuchasexecutingprogramsorcreatingfiles.ItissimilartotheDOScommand.com
commandinterpreter.Several
standardshellsareavailablewithLi nux.Thedefaultisusually
/bin/
bash
.
1.3 Understanding eDirectory Objects and Linux
eDirectoryandLinuxUserManagementtechnologiesworkintandemtoprovideasolutionfor
managinguseraccesstonetworkresources.eDirectoryuserlogininformationisstoredasaproperty
oftheUserobject.ItisviewedandmodifiedbyusingNovelliManager.
12 OES 11 SP2: Novell Linux User Management Administration Guide
Figure 1-1 TheNovelliManagerWindow
WhenauserlogsintoaLinuxcomputerrunningLinuxUserManagement,therequestisredirected
toeDirectoryandcheckedagainstinformationineDirectory.Forthistowork,thecomputersand
eDirectorymustbeconfiguredasfollows:
ThetargetworkstationmustberunningLinuxUserManagementsoftwareandmustpoint
to
theLinux/UNIXConfigobjectonthenetwork.
ThetargetworkstationmusthavearepresentativeLinux/UNIXWorkstationobjectin
eDirectory,created whenLinuxUserManagementcomponentsareinstalled.
TheusermustbeenabledforLinux,whichmeansthattheusermustbeamemberofagroup
enabledforLinux
andstoredinthepropertiesofLinux/UNIXWorkstationobject.TheLinux/
UNIXConfigobjectmustspecifythecontextoftheLinuxWorkst ationobject.
Section 1.3.1,“UserAccountsineDirectory,”onpage 13
Section 1.3.2,“GroupObjectsineDirectory,”onpage 13
Section 1.3.3,“SourceWorkstations,”onpage 13
Section 1.3.4,“Linux/UNIXWorkstationObjectsineDirectory,”onpage 13
Section 1.3.5,
“TheLinux/UNIXConfigObjectineDirectory,”onpage 14
Overview 13
1.3.1 User Accounts in eDirectory
UseraccountsresidingontheLinuxcomputeraresaidtobelocaluseraccountsandarestoredas
entriesinthe
/etc/passwd
file.UseraccountsineDirectoryarerepresentedbyUserobjectsstoredin
theeDirectorytree.
AneDirectoryUserobjecthasarichsetofpropertiesandfieldstoholduser‐loginproperties.When
aneDirectoryUserobjectisextendedtoholdLinuxuserloginproperties,itissaidtobe
LUM‐enabled
orenabledforLinux.WhentheyareenabledforLinux,userscanaccesstheLinuxcomputer(byusing
Telnet,SSH,oranothersupportedmethod)andsimplyenterausernameandpassword.Theaccess
requestisredirectedtofindtheappropriateusernameandlogininformationstoredineDirectory.
When
itisextendedforLinux,theeDirectoryUserobjectholdsLinux‐relatedproperties,suchasthe
userID,primarygroupID,primarygroupname,locationofthe homedirectory,andpreferredshell.
1.3.2 Group Objects in eDirectory
WhenagroupisenabledforLinux,thegroupIDisstoredasapropertyofaLinux/UNIX
Workstationobject.WhentheuserattemptstologintoaLinuxcomputer,heorsheonlyneedsto
enterausernameandpassword.Nocontextisrequired.TheLinuxcomputerchecksits
correspondingLinux/UNIXWorkstation objectineDirectoryforthelistofgroupsapprovedtologin.
Eachapprovedgroupissearchedfortheusernameoftheuserrequestingaccess.Whenthefirst
matchingusernameisfound,theloginisallowedbyusingtheUID,GID,password,andotherlog in
informationstored
ineDirectory.Iftheusernameisnotfoundinanyofthegroups,theloginisnot
allowed.
NOTE:WhenyouLinux‐enableaGroupobject,youcanchoosetoenableallmembersofthegroupor
youcanenablespecificusers.Usersbeingenabledforthe firsttimereceivethegroupIDastheir
primaryID.UserspreviouslyenabledforLinuxreceivetheGIDasasecondaryGID.
Userobjectsnot
enabledforLinuxcannotlogintoaLinuxcomputer,eveniftheybelongtoaLinux‐enabledgroup.
InadditiontothetypicalLinux‐relatedproperties(forexample,GroupID),theeDirectoryGroup
objectextendedforLinuxholdssomeadditionalproperties:
UamPosixWorkstationList:ListstheUNIXWorkstationobjectsthatthegroup
haspermissions
toaccess.
Description:Displaysanalternativedescription.
1.3.3 Source Workstations
Thesourceworkstationisthecomputerthattheuseraccessesthetargetworkstationfrom.Itisnot
representedasanobjectineDirectory.Itcanberunninganytypeofoperatingsystem,desktop,or
serverthatsupportsloginaccessprotocolssuchasFTP,SSH,rlogin,andrsh.Tologinto
atarget
workstation,theuserlaunchesaprogramthatprovidesoneofthesupportedloginaccessprotocols
andthenenterstheaddressofthetargetworkstation.
1.3.4 Linux/UNIX Workstation Objects in eDirectory
IneDirectory,theLinux/UNIX Workstationobjectrepresentstheactualcomputertheuserlogsinto.
Thecomputer,alsoknownasthetargetcomputer,musthavethefollowingcharacteristics:
ItisrunningLinuxaseitheraserverorworkstation.
14 OES 11 SP2: Novell Linux User Management Administration Guide
ItisrunningPluggableAuthenticationModule(PAM)alongwithNovellLinuxUser
ManagementtechnologytoredirectloginrequeststoeDirectory(seethe
/etc/pam.d
directory).
ItstoresthelocationoftheUNIXConfigobjectonthenetwork(seethe
nam.conf
file).
ALinux/UNIXWorkstationobjectiscreatedwhenLinuxUserManagementcomponentsare
installedonthetargetcomputer.TheobjectcanbeplacedinanyOrganization(O)orOrganizational
Unit(OU)containerintheeDirectorytree.
Whenloggingintoatargetworkstation,theuserneedstoenteronly theusername
andpassword.
ThetargetworkstationreceivestheloginrequestandusesLinuxUserManagementandPAMto
redirectauthenticationtoeDirectoryandthe Linux/UNIXConfigobjectonthenetwork.TheLinux/
UNIXConfigobjectdirectstherequesttothetargetcomputerʹsrepresentativeLinux/UNIX
Workstationobject,wherethegroups,usernames,and
fullcontextsaredetermined.
TheLinux/UNIXWorkstationobjectholdsthefollowingsetofproperties:
Targetworkstationname.ThenameisLinux/UNIXWorkstationappendedwiththehostname
ofthetargetworkstation(forexample,Linux/UNIXWorkstation‐Server1).
ListofeDirectorygroups(namesand contexts)thathaveaccesstothetargetworkstation.
1.3.5 The Linux/UNIX Config Object in eDirectory
TheLinux/UNIXConfigobjectisanobjectineDirectorythatstoresalistofthelocations(contexts)
indicatingwhereLinux/UNIXWorkstationobjectsresideonthenetwork(ineDirectory).Italso
controlstherangeofnumberstobeassignedasUIDsandGIDswhenUserandGroupobjectsare
created.Geographicallydispersed
networksmightrequiremultipleLinux/UNIXConfigobjectsina
singletree,butbasicnetworksneedonlyoneLinux/UNIXConfigobjectintheeDirectorytree.The
objectiscreatedduringtheLinuxOperatingSysteminstallation(byselectingLinuxUser
Management)andshouldbeplacedintheuppercontainersoftheeDirectory
tree.
1.4 Putting It All Together
Whenproperlyconfigured,eDirectoryobjectsandLinuxUserManagementtechnologyletyou
manageaccesstoLinuxresourcesonthenetwork.Hereʹshowitworks:
1. Atasourceworkstation,theuserlaunchesaprogram(suchasSSHorFTP)thatprovideslogin
accesstoanothercomputer.
2. Whenpromptedbytheloginprogram,
theuserentershisorherusernameandidentifiesthe
nameoraddressofatargetworkstation.Forexample,theusermightlaunchSSH,enter
tom
as
theusername,andtheaddressofatargetworkstation withthefollowingcommand:
ssh -l tom 10.10.1.1
3. Thetargetworkstationreceivestheloginrequest,butbeforegrantingaccess,itmustfindthe
requesterʹsfullcontextusernameandverifythatthepasswordiscorrect.Thislogininformation
isstoredineDirectoryinsteadofonthetargetworkstation.
4. Tofindtherequesterʹslogininformation,thetargetworkstation(configured
withLinuxUser
Management)performsthefollowingactions:
a. FindsthelocationoftheLinux/UNIXWorkstationobjectineDirectoryaslistedinthelocal
nam.conf
file.
b. SearchesthegroupsapprovedforaccesslistedintheLinux/UNIXWorkstation objectto
findtherequesterʹsusername.
Overview 15
Forexample,iftheloginrequestisfromausernamedTom,thelistofgroupsissearched
untilaUserobjectwiththeusernameTomisfound.
c. Submitstherequesterʹspasswordforverificationagainsttheuserinformationstoredin
eDirectory.
d. GrantstheloginrequestbyusingeDirectorylog ininformation,such
asUID,GID,home
directory,andpreferredshell.
ThefollowingillustrationshowshowLinuxUserManagement,eDirectory,and PAMallwork
togethertoletuserslogintotargetworkstationsonthenetwork.
Figure 1-2 LoggingIntoTarge tWorkstations
1.5 What's Next
ToinstallandsetupLinuxUserManagementinyournetworkenvironment,seeChapter 3,“Setting
UpLinuxUserManagement,”onpage 19.
16 OES 11 SP2: Novell Linux User Management Administration Guide
2
What’s New or Changed in Linux User Management 17
2
What’s New or Changed in Linux User
Management
ThissectiondescribesthechangesmadetoLinuxUserManagementsincetheNovellOpen
EnterpriseServer(OES)11release.
Section 2.1,“What’sNew(OES11SP2),”onpage 17
Section 2.2,“What’sNew(OES11SP1),”onpage 17
Section 2.3,“What’sNew(OES11),”onpage 18
2.1 What’s New (OES 11 SP2)
LinuxUserManagementinOES11SP2hasbeenmodifiedtorunon64‐bitSUSELinuxEnterprise
Server(SLES)11 SP3.Inadditiontobugfixes,LinuxUserManagementprovidesthefollowing
enhancementandbehaviorchangeintheOES11SP2release:
Changes to the LUM Configuration
TheLUMconfigurationnowincludestwonewparameters:
dont-deny-pamservice
and
non-
posix-members
.Formoreinformation,see“Editingthenam.confFile”intheOES11SP2:Novell
LinuxUserManagementAdministrationGuide.
Adding External LDAP Servers
LUMnowenablesyoutoadd externalLDAPserversduringLUMconfiguration.Formore
information,see“Se ttingUpLinuxComputerstoUseeDirectoryAuthentication”intheOES11SP2:
NovellLinuxUserManagementAdministrationGuide.
2.2 What’s New (OES 11 SP1)
LinuxUserManagementinOES11SP1hasbeenmodifiedtorunon64‐bitSUSELinuxEnterprise
Server(SLES)11 SP2.Inadditiontobugfixes,LinuxUserManagementprovidesthefollowing
enhancementsandbehaviorchangesintheOES11SP1release:
EnablingMultipleUsersforLinuxinaLUM
Group:TheLUMiManagerplug‐inprovidesa
newtabthatallowsyoutolinux‐enablemultipleusersinagroupinasimplifiedmanner.For
moreinformation,see“EnablingMultipleUsersforLinuxinaLUMGroup”(http://
www.novell.com/documentation/oes11/acc_linux_svcs_lx/index.html?page=/documentation/
oes11/acc_linux_svcs_lx/data/bv1u9ka.html#bzv3vj6.)intheOES11SP1:NovellLinuxUser
Management
AdministrationGuide(http://www.novell.com/documentation/oes11/
acc_linux_svcs_lx/?page=/documentation/oes11/acc_linux_svcs_lx/data/bookinfo.html).
18 OES 11 SP2: Novell Linux User Management Administration Guide
EnablingMultipleUsersforLinuxinaContainer:YoucannowLinux‐enablemultipleusersin
acontainer.TheLUMiManagerplug‐inprovidesanewtabthatallowsyoutolinux‐enable
multipleusersinacontainer.Formoreinformation,see“EnablingMultipleUsersforLinuxina
Container”
(http://www.novell.com/documentation/oes11/acc_linux_svcs_lx/?page=/
documentation/oes11/acc_linux_svcs_lx/data/bv1u9ka.html)intheOES11SP1:NovellLinux
UserManagementAdministrationGuide(http://www.novell.com/documentation/oes11/
acc_linux_svcs_lx/?page=/documentation/oes11/acc_linux_svcs_lx/data/bookinfo.html).
Youcanlinux‐enablemultipleusersusingthecommandlineaswell.The
namuseradd
command
providesthe‐Aoptionthatallowsyoutoenableallnon‐LUMusersinthespecifiedcontext.For
moreinformation,seethenamuseraddutility(http://www.novell.com/documentation/oes11/
acc_linux_svcs_lx/?page=/documentation/oes11/acc_linux_svcs_lx/data/bv1u77n.html)inthe
OES11SP1:NovellLinuxUserManagementAdministrationGuide(http://www.novell.com/
documentation/oes11/acc_linux_svcs_lx/?page=/documentation/oes11/acc_linux_svcs_ lx/data/
bookinfo.html).
OptiontoSelectadministratorgroupinYaST:TheLUM
configurationinYaSTalwaysaddsthe
administratortoagroupcalledtheadmingroup.LUMconfigurationinYaSTnowprovidesan
optiontobrowseandspecifyanalreadyexistinggroupinsteadofcreatinganewadmingroup.
2.3 What’s New (OES 11)
TheLUMservicehasbeenmodifiedtorunonOES11.TherearenofeaturechangesintheOES11
releaseofLUM.
3
Setting Up Linux User Management 19
3
Setting Up Linux User Management
ThefollowinginformationcanhelpyouinstallandsetupLinuxUserManagementtechnologyon
yournetworktogaintheadvantagesofeDirectoryforuserauthentication.iManagercanbeusedfor
basicsetup,butyoumightneedtouseacommandlineinterfacetoaccomplishsomespecifictasks.
Formoreinformation
onusingthecommandlinetoconfigureLUM,refertoChapter 6,“Usingthe
CommandLinetoConfigureLinuxUserManagement,”onpage 33.Ineithercase,youneedtosetup
thecomputertouseeDirectoryauthenticationandcreateandcorrectlyconfiguretheeDirectory
objects.
Section 3.1,“SettingUpLinuxComputers
toUseeDirectoryAuthentication,”onpage 19
Section 3.2,“UsingiManagertoEnableUsersforLinuxAccess,”onpage 22
Section 3.3,“TurningOffLinuxUserManagementandeDirectoryAuthentication,”onpage 25
3.1 Setting Up Linux Computers to Use eDirectory
Authentication
BeforeuserscanuseeDirectorylogininformationtologin,thetargetworkstationorservermustbe
configuredwithLinuxUserManagementcomponents.YouarepromptedtosetupLinuxUser
Managementwhileinstallingtheoperatingsystem.YoucanalsosetitupafterwardsbyusingYaST.
IMPORTANT:SettingupLinuxUserManagementrequiresadministratorrightstothecontainer
wheretheLinuxUserManagementobjectsarecreated.Formoreinformationonrights,referto
“RightsRequiredforSubcontainerAdministrators”intheOES11SP2:InstallationGuide.
TouseYaSTtoinstallandconfigureLinuxUserManagementonaworkstationorserverthatis
alreadyrunning:
1 Followtheinstructionsforyourplatformforaddingservicestoanexistingserveror
workstation.Formoreinformation,seetheOES11SP2:InstallationGuide.
2 FromtheOESServicesoption,selectNovellLUM.ClickAccept.
3 Specifytheadminpassword.
4 Specifythefollowingvalues:
20 OES 11 SP2: Novell Linux User Management Administration Guide
4a TheDirectoryServerAddressfielddisplaysthedefaultLDAPserverforthisservice.Ifyou
wanttospecifyanLDAPserverotherthanthedefaultLDAPserver,selectanLDAPserver
fromtheDirectoryServerAddresslist.
4b BrowseorentertheUnixConfigcontextintheUnixConfigContextfield.
TheUnixConfigobjectholdsalistofthelocations(contexts)ofUnixWo rkstationobjectsin
eDirectory.
4c BrowseorentertheUnixWorkstationcontextintheUnixWorkstationContextfield.
ComputersrunningLinuxUserManagement(LUM)arerepresentedbyUnixWorkstation
objectsineDirectory.Theobjectholdsthesetofpropertiesandinformationassociatedwith
thetargetcomputer,suchasthetargetworkstationnameoralistof
eDirectorygroupsthat
haveaccesstothetargetworkstation.
4d BrowseorspecifytheAdmingroupnamewithcontextintheAdmingroupnamewithcontext
field.
4e (Optional)BrowseorspecifyauserwithrightstosearchtheLDAPtreeforLUMobjectsin
theProxyUserName withContextfield.
4f SpecifyapasswordfortheProxyuserintheProxyuserpasswordfield.
ThisfieldisdisabledifyouselectedtheUseOESCommonProxyUsercheckbox.
4g (Optional)SelecttheUseOESCommonProxyUseroptionifyouwanttouseanOES
commonproxyuser.Donotchangethecommonproxyuserpassword.
Thisoptionisdisabledbydefault.
/