Visit The New, Modern Unix Linux Community


Different login shells in LDAP


 
Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users Different login shells in LDAP
# 1  
Different login shells in LDAP

Hi folks,

we have a very heterogenous server environment. There are also lots of AIX and Linux servers which usually have different login shells and all servers have to be integrated into LDAP. The LDAP Meta Directory is hosted by a Novell eDirectory.
On our Linux boxes it is usually bash, on AIX ksh. We also don't want to change it in that way, so that we only use one type of shell on all servers. We want to be flexible, judging by type of host and/or by user, which login shell the user would get. There is also the possibility that users just get a /bin/false so they don't have a login that easy.

So we could just go add new attributes in LDAP to a user. This could be mapped locally to the attribute the LDAP client of the OS needs.
Downside is, that our department for permissions wants to have permissions and rights, like which shell on which host etc. set by assigning users to a group. They don't want to handle each user's attributes seprately.
They want it the way they just put users into groups like they do it already.

We currently have no idea how to set attributes like LoginShell, HomeDirectory etc. for the same user on different hosts and even different OS'es while keeping it easy for the permissions department to assing users just to groups etc.

Also we tried filtering the group a user is in by shell script which was very easy but by no way being able to set the Login Shell with this method. You can add it witch chsh, write it into /etc/shells or on AIX /etc/security/login.cfg but we can't get a working shell for the user by this at all.

So if anyone would like to share his/her experience with such an LDAP environment I would be very thankful for any insight.

The IBM Redbook for AIX in a heterogenous LDAP enviroment was a big help in setting up everything, but no hint in it for the problem described above. Also not in the IBM LDAP White Papers incl. the troubleshooting part.

Also on Google I found no solution for this.

Last edited by zaxxon; 03-20-2009 at 03:11 AM.. Reason: typos
# 2  
We found out that the shell script was simply missing a Shebang (/selfslap) so when trying to interpret the shell script it didn't know which program it should use.

So sorting out groups and assigning a shell to a user locally on a host works without problems so far on AIX and Linux.
# 3  
Hi Zaxxon.

I'm in the same situation here at a client. How did you do that ? Can you make your script available ?
# 4  
I can make it available to you but I have to warn you since we threw it aboard. On Linux boxes we got problems that some applications were not able to launch properly and on AIX we had same problems with Eclipse even though on both OS'es the parameters for the login shell seemed ok.
After all the experimenting with the script we took the advise in the Redbook that you should just use /bin/sh for all users. On Linux it usually translates to bash and on AIX to ksh. Exceptions like developers that need csh etc. we wanted to spare out of LDAP since our permission management that control the permissions via LDAP groups on some front end are not in the mood to administer different shells for users.
# 5  
No problem to me. Our machines that use ldap are all Linux, and only acessed through shell (ssh).
I'll keep in touch to tell if it worked out ok, and reveal any caveat to watch for when doing so. Smilie

Thanks again man.
# 6  
We are also going the route of a single home directory and a single login shell for our AIX/HPUX/Solaris/SuSE/Redhat across i686, ia64, powerpc, sparc hardware boxes but we are using NIS instead of LDAP.

How are your user profile files ($HOME/.profile/.login/.cshrc, etc, etc) being designed so your users can start their shell of choice?

How are you planning handle the user's private bin directories?,

How are you going to handle the issue the user wants unique home directories verses having a common home directory for all machines?

How are you handling shell variables defined by the LDAP login shell that do not belong to the user's defined shell that have been exported?

How are you handling the shell command history file?

How are you handling programs that look in the user's HOME directory for startup files?

Do you know if the .Xauthority file can be shared across all your environments?


I started working this issue by having the initial user profile define variables for hostname, ostype, platform and osversion.

From these values the code decides which shell to run.

I also use these values to make shell variables unique to the level the user wants such as the HISTFILE and HOME variables.

I needed to create small c programs that would call the proper shell as a login shell to allow the proper shell initialization to occur. Also the profile file needed to call these c programs using the exec builtin to replace the original shell. The c program also adds a shell variable to deal with the recursion issue since the user's profile will be called a second time.

A function was written for adding to PATH style variables to avoid adding the same directory twice.

Figuring out which shell variables that need to be removed from the environment is a work in progress.

I have not worked the BSD C shell issues yet but expect that I will need to use the source command to separate Bourne shell style syntax away from the BSD C shell style syntax.

Have you considered using the Korn shell for the all platforms as your LDAP login shell? At least for us either the ATT version the PD version exists on our servers.

What other issues do you know of we might run into?

Previous Thread | Next Thread
Thread Tools Search this Thread
Search this Thread:
Advanced Search

Test Your Knowledge in Computers #666
Difficulty: Medium
IEEE 802.3 is a working group and a collection of Institute of Electrical and Electronics Engineers (IEEE) standards produced by the working group defining the physical layer and data link layer's media access control (MAC) of wireless Ethernet.
True or False?

10 More Discussions You Might Find Interesting

1. Solaris

LDAP Client not connecting to LDAP server

I have very limited knowledge on LDAP configuration and have been trying fix one issue, but unsuccessful. The server, I am working on, is Solaris-10 zone. sudoers is configured on LDAP (its not on local server). I have access to login directly on server with root, but somehow sudo is not working... (9 Replies)
Discussion started by: solaris_1977
9 Replies

2. UNIX for Advanced & Expert Users

Can adding to a new group be effective in current login environment without re-login?

Hey folks, When a user is added to a new group, the user has to be log out and log in again to make the new group effective. Is there any system command or technique to refresh user group ID update without re-login? I am not talking about to use "login" or "su -l" commands which can only make... (2 Replies)
Discussion started by: hce
2 Replies

3. UNIX for Dummies Questions & Answers

Please what are shells?

I mean like this: http://shells.red-pill.eu/ Can anyone explain how this works? I hope my post is not spam. I think its related to linux. Thank you (1 Reply)
Discussion started by: postcd
1 Replies

4. OS X (Apple)

Where does OS X store LDAP and login settings?

I'm writing scripts to check for compliance with the DISA STIG. Several items refer to manually click-click-clicking to verify settings regarding LDAP or accounts like guest account disabled, "Allow Guests to connect to shared folders", "Display login window as:", "Show input menu in login... (7 Replies)
Discussion started by: jnojr
7 Replies

5. UNIX for Dummies Questions & Answers

Shells

Lets say my default shell is bash and then i load up csh and then ksh. How would i exit csh without exiting ksh? so basically i gone from bash > csh > ksh and i wish to close csh (2 Replies)
Discussion started by: Bill Thompson
2 Replies

6. Red Hat

How to cache login in ldap clients !!! Please helpppp !!!!

Hey guys iīve one big problem with nscd.conf this donīt work i tried many examples of configuration the nscd.conf simply donīt work when i stop the ldap server i try access by ssh on the client i canīt make logon. And the database on /var/db/nscd donīt work. follows below the conf of... (0 Replies)
Discussion started by: paulo_eduardo
0 Replies

7. UNIX for Advanced & Expert Users

something like LDAP Administrator 2011.1 "LDAP-SQL" but for the CLI

Hi I am searching a tool like "LDAP Administrator 2011.1"/ "LDAP-SQL" but for the CLI. Wish to use LDAP-SQL in scripts (non Windows GUI environment) http://ldapadministrator.com/resources/english/2011.1/images/sqlquery_large.png Softerra LDAP Administrator 2011.1 - What's New OS is... (2 Replies)
Discussion started by: slashdotweenie
2 Replies

8. UNIX for Advanced & Expert Users

why we have different shells?

Can you pls. tell me, why we have different shells in UNIX OS ( Eg. SunOs) and also I would like to know what is the specific difference b/w SVR and BSD ? Thanks. (2 Replies)
Discussion started by: shahnazurs
2 Replies

9. Web Development

APACHE: Tie in Web Page login with server login

Hello, I have created a web page on a server using apache and added .htaccess and .htpasswd in the folder for authentification. I was wondering if there was anyway to tie-in the login for this page with the login used to logon to the server. i.e. the same login info. is used for both,... (2 Replies)
Discussion started by: WhotheWhat
2 Replies

10. UNIX for Advanced & Expert Users

Shells

I have came across the definitions of these shells korn bourne c etc .. but honestly till now i din't get the exact difference between these threes , the advantages ..... can anyone pinpoint me where it actually lies ..... don;t include me answers like aliasing in c is posible and not in bourne ..... (3 Replies)
Discussion started by: dino_leix
3 Replies

Featured Tech Videos