TweetFollow Us on Twitter

 Integrating OS X With OpenLDAP/Samba, Part 2

Volume Number: 25 (2009)
Issue Number: 01
Column Tag: Network Administration

Integrating OS X With OpenLDAP/Samba, Part 2

An article, in a series, on "Configuring Your Mac To Work With Linux Samba and LDAP Servers."

by Noah Gift

Introduction

In Part 1 we covered talking to a Samba Server running on an Ubuntu Virtual Machine, but we stopped at merely obtaining read only access to data. In this article we fully configure Samba on Linux in an ideal configuration for OS X, and then get into authenticating all of this to LDAP on Linux.

Because we delve into a fairly complex undertaking of getting Linux and Samba configured inside of OS X, it is important to point out how powerful this combination truly is. OS X, universally known for simplicity and ease of use, can yet again, hide the complexity of a Linux server within the shadows of its own operating system by using virtualization. Linux servers talking to, and running inside of OS X is a very compelling choice to consider, as it combines the strengths of both platforms, and minimizes their respective weaknesses.

Dirt Simple Home Samba Configuration

In the last article, we downloaded a pre-configured Ubuntu Virtual Machine here: http://examples.oreilly.com/9780596515829/vm/ and then got it talking to Samba, but we only had Read-Only access. Now it is time to optimize the configuration file to make file-sharing work completely with OS X for a typical home setup behind a firewall.

If you remember from the previous article, we created a very minimal read only configuration. Here are the steps to get a full read/write configuration working from scratch with zero authentication. This is perfect for a home network behind a firewall, in which no username or password is desired in order to connect to the share/.

If you are still working off of the downloaded virtual machine, then go ahead and edit /etc/samba/smb.conf and add the contents below. (Remember that the username and password is py4sa. Alternately, you can simply use this configuration on existing Ubuntu Virtual Machine or server you already have running.)

Step 1: Edit the smb.conf file

Listing 1: (zero security) samba config /etc/samba/smb.conf

[global]
workgroup = home
netbios name = py4sa
security = share
[share]
comment = Home File Server
path = /usr/export
force user = py4sa
force group = py4sa
guest ok = yes
read only = no

With this configuration file squared away, next we need to create the actual directory to share out, change the ownership, and restart samba.

Step 2: Create the shared directory mentioned in the configuration file

py4sa@py4sa:~$ sudo mkdir /usr/export

Step 3: Change ownership to match the "forced" user and group privileges we set in the configuration file

py4sa@py4sa:~$ sudo chown -R py4sa:py4sa /usr/export

Step 4: Restart the samba daemon

py4sa@py4sa:~$ sudo killall -HUP smb

With this out of the way, we can perform a command line debugging step first to see if our share is available. Under OS X, we can simply run this command (note that your IP address may be different):

[ngift@macintosh-8][H:743][J:0]# sudo smbclient -L //192.168.1.200

Next, we should see some form of output like this:

Domain=[HOME] OS=[Unix] Server=[Samba 3.0.26a]
   Sharename    Type   Comment
   ————-    ——   ———-
   share        Disk   Home File Server
   IPC$         IPC    IPC Service (Samba 3.0.26a)
Domain=[HOME] OS=[Unix] Server=[Samba 3.0.26a]
   Server               Comment
   ————-            ———-
   PY4SA                Samba 3.0.26a
   Workgroup            Master
   ————-            ———-
   HOME                 PY4SA
   MOTHERSHIP           MOTHERSHIP

Here, we can see that our share is indeed alive, and it is named "share", with a comment "Home File Server", just as we wrote. I am a huge advocate of doing the simplest possible thing that will work, and in our situation, this is quite literally, the simplest possible configuration a user could want on a home network.

This configuration creates a simple read/write share that requires no password from a Mac. In the next section, we will go through the connection process.

Mounting Samba Read/Write As Guest

Now, that we have Samba configured, and running, we can simply mount the volume by using "Apple + K". Here is a sequence of screenshots showing the processes.


Figure 1: Connect To The Samba Server


Figure 2: Authenticate as Guest (No password required)


Figure 3: Test Read/Write Privileges

In the sequence of screenshots shown in Figures 1 through 3, we demonstrate how handy this simple "home brew" Samba Server really is. It allows us to setup read/write privileges for a guest user in seconds. Having this tip in your back pocket can sure get you out of some potential problems in a pinch, such as sharing a common web development environment. The nice thing about using a virtual machine running inside of your Mac is that the complexity can simply be turned off when you're done, or alternately, it can run forever as a server inside of a desktop Mac, or perhaps Mac Mini.

Now that we have conquered the simple Samba setup for OS X clients, let's get into conquering the simple LDAP setup for OS X clients.

OS X to Linux LDAP Configuration in 60 Seconds

LDAP is another protocol that can be a complete pain to deal with, as it can get quite complex for the newbie in a hurry. In this section, though, we reuse a pre-configured "vanilla" Ubuntu LDAP server running on the virtual machine we downloaded, and shudder, authenticate our OS X client directly to it in about 60 seconds. One of the reasons why this is so easy is because we have a pre-configured virtual machine, which hides the complexity of setting up LDAP initially from scratch.

Our goal in this section is, once again to do the simplest possible thing that works. Here is a sequence of screenshots of authenticating to LDAP:


Figure 4: Using Directory Utility to create a connection to LDAP


Figure 5: Read the error message, (Note, Linux LDAP doesn't just work out of the box).


Figure 6: We use advanced settings to configure a RFC 2307 mapping (chosen from the drop-down menu).


Figure 7: Still using Directory Utility, we manually add our new LDAP server to the search path.


Figure 8: In the Accounts Preference Pane, we setup "fast user switching," simply to allow easy testing of LDAP user account logins

Authenticating to LDAP from OS X

Now that we are configured to talk to Linux LDAP, let's test it out from the command line by interactively exploring our LDAP session from the awesome "dscl" command line tool.

Listing 2: exploring LDAP from the command line

[ngift@macintosh-8][H:753][J:0]# dscl
Entering interactive mode... (type "help" for commands)
 > ls
BSD
LDAPv3
Local
Search
Contact
 > cd LDAPv3/
/LDAPv3 > ls
192.168.1.200
/LDAPv3 > cd 192.168.1.200/
/LDAPv3/192.168.1.200 > ls
Automount
AutomountMap
CertificateAuthorities
Groups
Mounts
People
Users
/LDAPv3/192.168.1.200 > cd Users/
/LDAPv3/192.168.1.200/Users > ls
nobody
py4sa
root

This interactive session for the dscl command shows us that we are indeed connected to the LDAP directory on the Linux server, and can see the user accounts on that machine, such as py4sa. Next, let's actually login using that account.

If you notice, we can log in as the py4sa user, but we get a weird error from bash, because there is no home directory specified inside of LDAP.

Listing 3: using py4sa to login

[ngift@macintosh-8][H:761][J:0]# su py4sa  
Password:
bash: /home/py4sa/.bashrc: Input/output error
bash-3.2$ whoami
py4sa

The final thing to test is to actually do a fast user switch login to the new "py4sa" account that gets pulled from the LDAP database on the Virtual Machine. If you go through with the process it will hang for about 30 seconds, and then bring up a warning that it couldn't find the user's home directory, yet still login, to a temporary home directory.

So what does this prove? Well, it proves that we have the simplest possible Samba, and LDAP connections running from a pre-configured virtual machine. Not to shabby for some virtual machine file on your file system.

Conclusion

In this second article in a four part series, we fully configured a Read/Write Samba share running off of a virtual machine. The security was intentionally set to allow not require a user name and password, as this is very appropriate for ad hoc or home networking.

Next, we did the simplest possible LDAP authentication we could by configuring OS X to talk to the same virtual machine. We stopped at really doing anything too useful though, as we weren't able to use a home directory yet. In the next article, we go beyond our simple Home Samba Server, and lightweight LDAP configuration, to setup a sample Enterprise configuration, that ties in home directories, 3rd party LDAP administration tools, and more. In the final and fourth article we then take our enterprise LDAP/Samba configuration, and make tie in authentication to Apache and Trac. This allows for one firecracker of a virtual machine, that again, is just some file sitting on your OS X box.

BIBLIOGRAPHY AND REFERENCES

Noah Gift. "How To Build A Dirt Easy NAS with Samba". Red Hat Magazine, http://www.redhatmagazine.com/2007/06/26/how-to-build-a-dirt-easy-home-nas-server-using-samba/.

Noah Gift. "Getting Started With Open Directory". O'Reilly. http://www.macdevcenter.com/pub/a/mac/2007/06/01/discover-the-power-of-open-directory.html

Noah Gift and Jeremy Jones. "Python For Unix and Linux Systems Administration". O'Reilly . ISBN: 0596515820


Noah Gift has been a Mac user since his family bought a Macintosh Performa 6300 in 1992, and started connected to BBS networks immediately and then eventually the World Wide Web in 1993 when it become open to the public. He is the co-author of "Python For Unix and Linux System Administration" by O'Reilly, and the upcoming "Google App Engine In Action" by Manning. Noah has a couple of decades of experience in the Television and Film industry starting off as an editor for ABC Network News as a teenager. He contributed to the first feature animated film for Disney Feature Animation and Sony Imageworks. He also had stints at Turner Studios and Caltech, where he worked for the Nobel Prize winning President as a Mac expert. He has a Master's degree in CIS, and is LPI and ACSA certified. He currently works for Weta Digital in New Zealand. Many of his projects and writing are available at www.noahgift.com. He can be contacted at noah.gift@giftcs.com

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

FotoMagico 5.4.1 - Powerful slideshow cr...
FotoMagico lets you create professional slideshows from your photos and music with just a few, simple mouse clicks. It sports a very clean and intuitive yet powerful user interface. High image... Read more
Espresso 3.0 - Powerful HTML, XML, CSS,...
Espresso is back. For people who make delightful, innovative, and fast websites -- in an app to match. Espresso helps you write, code, design, build, and publish with flair and efficiency.... Read more
Spotify 1.0.51.693. - Stream music, crea...
Spotify is a streaming music service that gives you on-demand access to millions of songs. Whether you like driving rock, silky R&B, or grandiose classical music, Spotify's massive catalogue puts... Read more
Gutenprint 5.2.12 - Quality drivers for...
Gutenprint is a suite of printer drivers that may be used with most common UNIX print spooling systems, including CUPS, lpr, LPRng, or others. Gutenprint currently supports over 2000 printer models.... Read more
Firefox 52.0.2 - Fast, safe Web browser.
Firefox offers a fast, safe Web browsing experience. Browse quickly, securely, and effortlessly. With its industry-leading features, Firefox is the choice of Web development professionals and casual... Read more
Google Chrome 57.0.2987.133 - Modern and...
Google Chrome is a Web browser by Google, created to be a modern platform for Web pages and applications. It utilizes very fast loading of Web pages and has a V8 engine, which is a custom built... Read more
RapidWeaver 7.3.3 - Create template-base...
RapidWeaver is a next-generation Web design application to help you easily create professional-looking Web sites in minutes. No knowledge of complex code is required, RapidWeaver will take care of... Read more
Chromium 57.0.2987.133 - Fast and stable...
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all Internet users to experience the web. Version 27.0.2987.133: Note: This update has no Flash... Read more
Lyn 1.8.8 - Lightweight image browser an...
Lyn is a fast, lightweight image browser and viewer designed for photographers, graphic artists, and Web designers. Featuring an extremely versatile and aesthetically pleasing interface, it delivers... Read more
Adobe Animate CC 2017 16.2.0 - Advanced...
Animate CC 2017 is available as part of Adobe Creative Cloud for as little as $19.99/month (or $9.99/month if you're a previous Flash Professional customer). Animate CC 2017 (was Flash CC) lets you... Read more

Dynasty Warriors: Unleashed arrives on m...
No one does mindless hack and slash quite like a Musou game. What's more fun than single-handedly chopping your way through hundreds of enemies? Now, for the first time ever, that unrivaled experience goes mobile with Dynasty Warriors: Unleashed.... | Read more »
Crash of Cars beginner's guide
Crash of Cars is a fun new entry in the realm of multiplayer beat 'em ups. It's basically bumper cars off the rails -- players drive around in vehicles of their choosing -- anything from a mini-van to the weinermobile in all of its glory --... | Read more »
Dynasty Blades new update introduces a n...
Sharpen your weapons -- Dynasty Blades is back with new and improved hack n’ slash stylings. The Romance of the Three Kingdoms-inspired action MMORPG introduces a bunch of fun new features in its latest update. For the uninitiated, Dynasty Blades... | Read more »
Meganoid(2017) (Games)
Meganoid(2017) 1.0 Device: iOS Universal Category: Games Price: $3.99, Version: 1.0 (iTunes) Description: LAUNCH DISCOUNT 20% UNTIL APRIL 2nd! Support, tip and tricks: http://www.orangepixel.net/forum/ Subscribe to our newsletter... | Read more »
Telltale's Guardians of the Galaxy...
Telltale will be releasing their rendition of Guardians of the Galaxy later this month. The first episode, Tangled Up in Blue, features familiar faces including Star-Lord, Groot, Rocket, Gamora, and Drax. If the first episode's title is any... | Read more »
Royal Dungeon (Games)
Royal Dungeon 1.0 Device: iOS Universal Category: Games Price: $2.99, Version: 1.0 (iTunes) Description: The king and his queen are trapped in their castle which suddenly turned out as a very dangerous place. The goal is to escape... | Read more »
Tom Clancy's ShadowBreak is a real-...
Ubisoft is treating Tom Clancy fans to the series' very first mobile-exclusive game in ShadowBreak, a real-time, multiplayer shooter in which players snipe at enemies in fast-paced tactics-driven combat. [Read more] | Read more »
Power Rangers: Legacy Wars beginner...
Rita Repulsa is back, but this time she's invading your mobile phone in Power Rangers: Legacy Wars. What looks to be a straightforward beat 'em up is actually a tough-as-nails multiplayer strategy game that requires some deft tactical maneuvering.... | Read more »
Hearthstone celebrates the upcoming Jour...
Hearthstone gets a new expansion, Journey to Un'Goro, in a little over a week, and they'll be welcoming the Year of the Mammoth, the next season, at the same time. There's a lot to be excited about, so Blizzard is celebrating in kind. Players will... | Read more »
4 smart and stylish puzzle games like Ty...
TypeShift launched a little over a week ago, offering some puzzling new challenges for word nerds equipped with an iOS device. Created by Zach Gage, the mind behind Spelltower, TypeShift boasts, like its predecessor, a sleak design and some very... | Read more »

Price Scanner via MacPrices.net

The True Color Of iPhone 7 and iPhone 7 Plus...
The vibrant color of iPhone 7 and iPhone 7 Plus (PRODUCT)RED Special Edition makes it hard to cover these attractive devices in a case. Let the true color shine through with Symmetry Series clear... Read more
Deal alert! 13-inch 2.0GHz MacBook Pros now f...
B&H Photo has lowered their price on 13″ Apple 2.0GHz MacBook Pros to $225 off MSRP through midnight tonight (3/30/17). Shipping is free, and B&H charges NY sales tax only: - 13″ 2.0GHz... Read more
1.4GHz Mac mini on sale for $399, $100 off MS...
B&H Photo has the 1.4GHz Mac mini on sale for $100 off MSRP including free shipping plus NY sales tax only: - 1.4GHz Mac mini: $399 $100 off MSRP Sale ends on March 31st. Read more
13-inch 128GB MacBook Air on sale for $849, s...
B&H Photo has lowered their price on the 13″ 1.6GHz/128GB MacBook Air to $849, or $150 off MSRP. Shipping is free, and B&H charges NY sales tax only: - 13″ 1.6GHz/128GB MacBook Air (MMGF2LL/A... Read more
Is Apple Planning An iPhone Based Modular Doc...
Today’s more powerful and larger-screened smartphones and phablets are becoming the default anchor computing device for more and more users computing devices, but even a five or six inch panel is not... Read more
Razer Launches New Razer Blade Pro World’s Fi...
Razer, the gaming and high performance hardware specialists, have announced the new Razer Blade Pro laptop — the first laptop to be qualified for THX Mobile Certification, an accreditation reserved... Read more
Gro CRM’s Apple Small Business Mac And iOS CR...
Gro Software, developers of the Mac CRM software for small business and enterprise, are included in FinancesOnline 2017 CRM Rising Stars and Great User Experience lists by business software review... Read more
Deal alert! 15-inch and 13-inch MacBook Pros...
B&H Photo has the new 2016 15″ and 13″ Apple MacBook Pros in stock today and on sale for up to $200 off MSRP. Shipping is free, and B&H charges NY sales tax only: - 15″ 2.7GHz Touch Bar... Read more
Save up to $420 on a new MacBook Pro with App...
Apple is offering Certified Refurbished 2016 15″ and 13″ MacBook Pros, including some Touch Bar models, for up to $420 off original MSRP. An Apple one-year warranty is included with each model, and... Read more
12-inch 1.2GHz Retina MacBooks on sale for $1...
B&H has 12″ 1.2GHz Retina MacBooks on sale for up to $200 off MSRP. Shipping is free, and B&H charges NY sales tax only: - 12″ 1.2GHz Space Gray Retina MacBook: $1449 $150 off MSRP - 12″ 1.... Read more

Jobs Board

Fulltime aan de slag als shopmanager in een h...
Ben jij helemaal gek van Apple -producten en vind je het helemaal super om fulltime shopmanager te zijn in een jonge en hippe elektronicazaak? Wil jij werken in Read more
Fulltime aan de slag als shopmanager in een h...
Ben jij helemaal gek van Apple -producten en vind je het helemaal super om fulltime shopmanager te zijn in een jonge en hippe elektronicazaak? Wil jij werken in Read more
Fulltime aan de slag als shopmanager in een h...
Ben jij helemaal gek van Apple -producten en vind je het helemaal super om fulltime shopmanager te zijn in een jonge en hippe elektronicazaak? Wil jij werken in Read more
Desktop Analyst - *Apple* Products - Montef...
…technology to improve patient care. JOB RESPONSIBILITIES: Provide day-to-day support for Apple Hardware and Software in the environment based on the team's support Read more
*Apple* Mobile Master - Best Buy (United Sta...
**493168BR** **Job Title:** Apple Mobile Master **Location Number:** 000827-Denton-Store **Job Description:** **What does a Best Buy Apple Mobile Master do?** At Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.