<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> <p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> freeipa-users-bounces@redhat.com [mailto:freeipa-users-bounces@redhat.com] <b>On Behalf Of </b>Dale Macartney<br> <b>Sent:</b> Sunday, January 11, 2015 2:16 PM<br> <b>To:</b> freeipa-users@redhat.com<br> <b>Subject:</b> [Freeipa-users] Group Policy-like features in FreeIPA<o:p></o:p></span></p> <p class="MsoNormal"><o:p> </o:p></p> <div> <div> <div> <div> <div> <div> <div> <div> <div> <div> <div> <p class="MsoNormal" style="margin-bottom:12.0pt">Morning folks<o:p></o:p></p> </div> <p class="MsoNormal" style="margin-bottom:12.0pt">I am currently working on a little pet project which I think some would find useful. <br> <br> I would like to introduce some group policy like functionality into a FreeIPA domain. <o:p></o:p></p> </div> <p class="MsoNormal">For example: <o:p></o:p></p> </div> <p class="MsoNormal" style="margin-bottom:12.0pt">In an environment running FreeIPA Server with Fedora or RHEL based workstations, I would like to be able to introduce a few extra features which initially may be pushed via a login script (maybe even configure a dbus session as well, who knows?). <o:p></o:p></p> </div> <p class="MsoNormal" style="margin-bottom:12.0pt">My intentions here would be to be able to apply host specific policies as well as have the option for user specific policies which would be applied when the user logs in. <o:p></o:p></p> </div> <p class="MsoNormal" style="margin-bottom:12.0pt">Practically speaking, adding an attribute to LDAP to specify a login script file name is easy enough, however actually fetching this is where I am hoping for a bit of brain storming. My thoughts would be the local user would fetch the name of the login script via ldap, and then perhaps fetch the file from a shared resource on the FreeIPA masters in order to be executed locally. <o:p></o:p></p> </div> <p class="MsoNormal" style="margin-bottom:12.0pt">LDAP is obviously replicated, however to my knowledge, there is no file synchronization between masters. I am thinking something similar to the MS equivalent of the SYSVOL data that replicates between MS Domain Controllers. One option would be to store all data within LDAP, however I've seen many scenarios where admins store CD ISO's in replicated domain data, so I am not certain this would be the best option.<o:p></o:p></p> </div> <p class="MsoNormal" style="margin-bottom:12.0pt">With this replicated data folder, I would be able to store centrally managed scripts which would be used for hosts or users, and then configure the default user template on each workstation (/etc/skel/) to add the login script file name which would be fetched from the users LDAP attributes. <br> <br> <o:p></o:p></p> </div> <p class="MsoNormal" style="margin-bottom:12.0pt">Real world usability for what I am thinking of is a way to manage users who can have their corporate email mailbox configured on login, automatically setting the users session to point to an internal SSO enabled proxy server or perhaps any other number of things which an admin may wish to achieve without the need to manually do the work themselves. <o:p></o:p></p> </div> <p class="MsoNormal" style="margin-bottom:12.0pt">Has anyone undertaken a similar scenario in their environments or would perhaps have any suggestions on how to manage the centrally accessible file stores? <o:p></o:p></p> </div> <p class="MsoNormal" style="margin-bottom:12.0pt">Many thanks<br> <span style="color:#1F497D">----</span><o:p></o:p></p> <p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Specifically, I haven’t fully implemented what you are asking but obviously parts and pieces yes.<o:p></o:p></span></p> <p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">One of the best features of Linux and all of its various toolsets is that one are quite so overarching and the objectives are more focused. String them together and you have a working tool set. As a system administrator, you learn to pipe grep output to awk or sed or cut etc.<o:p></o:p></span></p> <p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">SYSVOL </span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">ó</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> NFS and if that doesn’t do it for you, check out Unison.<o:p></o:p></span></p> <p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I guess one of the temptations of FreeIPA is to try to make it exactly like active directory. The FreeIPA developers are already doing an amazing job without a ton of manpower.<o:p></o:p></span></p> <p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Craig<o:p></o:p></span></p> </div> </div> </body> </html>