Correct way to setup Linux users, UIDs, GIDs etc for simple home network - Page 1
Forum section: electronics / general

author: Delta
author_rank: Super Contributor
timestamp: March 02, 2017, 10:16:21 am
content: I am setting up a new home network using an Olimex SBC running Debian as a server, and don't want to end up with the same mess I currently have with my old RasPi / Ubuntu Server setup.We have two laptops and a desktop, with a Linux TV set-top-box as well.The problems I encountered last time where that the laptops and desktop were already running Linux (before I even thought about a server), thus mine had the main user as "delta" with UID:GID of 1000:1000, and she had "missus" 1000:1000, and the default user on the Pi was "ubuntu" 1000:1000, so you can see right away where my problems started. (Despite having used Linux on the desktop for a good while, I have absolutely no training or proper experience in setting up proper multi-user network environment). Through a variety of kludges, bodges and problem very stupid permission settings, it did "work" in that it was a basic NAS.Now I am starting again (the Olimex has Gigabit Ethernet and SATA), I want to do things properly.The default user on the Olimex Debian install is "olimex" 1000:1000 - should I be using this as I set the thing up? Should I delete this user, create "delta" as 1000:1000 which and use that as the main account?I'm really not sure what I'm even trying to ask here, so sorry if this post is all over the place, but I know that what I did last time was rubbish, so I want to do it properly this time.I am thinking I will:1. Delete the default olimex user on the server.2. Create "delta 1000:1000" on the server and use that as the "main" account.3. Reinstall her laptop and setup as delta, then add "missus" 1001:1001(?), add that to server.4. Create "stb"?:? on the server, and set the STB up to connect to an NFS share with that login.I want all (human) users to have RW access to a shared directory on an NFS share, so should we both have the same GID?I want the STB to have it's own dedicated share with RW access (for recording, timeshifting, saving EPG data etc), but also to be able read media from the "human" share.Again, apologies that this must make cringeworthy reading for Linux gurus, but please bear with me!

author: gnif
author_rank: Unknown
timestamp: March 02, 2017, 11:17:37 am
content: You have a few options here, depends on what you are trying to achieve.1) NFS and Idmap - Works fine for small networks, a few computers etc, but can be an absolute pain to make things work well2) NFS and fixed/forced UID/GID - Works fine for shares you don't care much about security with, for a home network that is usually the case.3) Active Directory and SSSD or similar, this works great, but if you are like me and used Samba for your AD server, be aware the documentation is very sketchy and in some cases completely outdated and wrong.IMO if you just want a NAS type setup without worring about security, use NFS and force uid/gid on the export for linux shares, if you want windows shares too, use Samba and force the same UID/GID. For an anonymous share I usually force the user & group to nobody:nogroup as across all main distros they are the same UID/GID also (65534:65534).

author: SingedFingers
author_rank: Frequent Contributor
timestamp: March 02, 2017, 12:03:38 pm
content: I gave up on this. We just have separate machines and a NAS that shares everything via SMB/CIFS for shared stuff.Didn't want to bugger around with LDAP, YP or AD.

author: CatalinaWOW
author_rank: Super Contributor
timestamp: March 02, 2017, 02:57:02 pm
content: Here in a nutshell is why Linux hasn't taken over the world. You have to be a ninja to get everything right. Most of us aren't ninjas, and have other ways to occupy our time.I have had Linux machines operating off and on for almost two decades now, starting with kernal 0.98 (distributed on 75 or so 5.25 inch floppy disks). It works fine for all the mundane stuff, but as soon as you get off the beaten track you have to spend a lot of time tracking down sparse information and evaluating often dodgy or incomplete advice.As Windows gets worse and worse I keep pushing more and more into the Linux world, but the cost is spending more time than I really wanted learning to be a system admin. All I really want is to keep my home network of a half dozen computers and printers and scanners up and talking while playing with odds and ends of connected hardware (GPIB, A-D converters, serial ports .....).

author: HAL-42b
author_rank: Frequent Contributor
timestamp: March 02, 2017, 04:46:16 pm
content: My usual approach is to read whatever the Arch Wiki has to say on the topic. In your casehttps://wiki.archlinux.org/index.php/NFSand especiallyhttps://wiki.archlinux.org/index.php/NFS_Troubleshooting#Group.2FGID_permissions_issuesmight be useful.The problem with Linux is that most of the time it offers too much configurability and too many options. Keeping it simple helps.

author: Red Squirrel
author_rank: Super Contributor
timestamp: March 04, 2017, 03:44:34 am
content: This is one of my pet peeves of Linux. Who thought it was a good idea to use UID/GUID to authenticate users across systems? That is ridiculously unsecure not to mention cumbersome to manage. It should go by username and password. Yeah you can setup kerberos and ldap but that is a huge pain in the ass, and think they still need to match anyway.That said I'm in a mess myself as my main account uses 1000 but some oddball different number for the group, so it always becomes problematic when I first setup a new system.One thing Linux could use is something equivalent to AD.

author: lanshaoe66
author_rank: Newbie
timestamp: March 04, 2017, 06:54:28 am
content: I also gave up on this._________________________________________Dentist's life is simple!dentaldeal.es

author: donmr
author_rank: Regular Contributor
timestamp: March 04, 2017, 05:56:36 pm
content: I find it very easy to manually the password files.Just put your shared info on a thumb drive and copy it into the new computer.Use chown -R to change anything with old settings to the new ones.I do this for networking too, managing any on-line sharing system takes some work and isn't worth it for a few computers with a few users.

author: grumpydoc
author_rank: Super Contributor
timestamp: March 04, 2017, 06:20:01 pm
content: Quote from: Red Squirrel on March 04, 2017, 03:44:34 amWell, you cannot send username+password for every block level read&write as password checking is intentionally slow and expensive.This means that you send a token of some sort. In the early days GID+UID was perfectly OK because the chances are that you knew and trusted everyone else on the network anyway. It is probably still OK on a small network where you are not really expecting anyone to try to "hack" anything. Of course that means keeping things well isolated from the Internet - but there are better protocols for that anyway.If you need better security then you do need to put the effort into setting it up.QuoteSamba?Kerberos+NFSv4

author: Monkeh
author_rank: Super Contributor
timestamp: March 04, 2017, 07:10:25 pm
content: Quote from: Red Squirrel on March 04, 2017, 03:44:34 amNobody. Because they're not used for authentication, they're used for access control.

author: helius
author_rank: Super Contributor
timestamp: March 04, 2017, 07:18:01 pm
content: NFS is designed as a "stateless" protocol where the client doesn't need to keep a connection open to the server, but can just transmit requests as needed. The access control is provided by the client and server cooperating: all it takes to break it is a modified client. NFS also has big problems with unreliable networks (note the "hard" vs "soft" mount options and their consequences), which make it not very suitable for use on the internet. If you don't need your remote storage to be "stateless" might as well just bite the bullet and use AFS or WebDAV, and if you only need file transfers, scp.

author: nctnico
author_rank: Super Contributor
timestamp: March 04, 2017, 07:30:20 pm
content: Quote from: Delta on March 02, 2017, 10:16:21 amDon't use NFS. AFAIK NFS has been declared obsolete decades ago and probably exactly because of the problems you describe. In the past 20+ years I have been using Linux I never used NFS.Either use SMB / Samba (Microsoft networking) or Fuse / SSHFS (which also includes encryption)https://en.wikipedia.org/wiki/SSHFS. On my Debian Linux system I can get onto the Microsoft networking shares from the standard file explorer (Nautilus) so that seems to be the easiest solution to me.

author: SingedFingers
author_rank: Frequent Contributor
timestamp: March 04, 2017, 08:15:12 pm
content: NFS is fine and is not obsolete. In fact NFSv4 makes it a rather attractive proposition. The problem is that it's only good for large deployments. Household or small hosting ones, forget it; you can't afford to be the sysadmin to look at it. Then again there's GlusterFS now so meh.

author: CatalinaWOW
author_rank: Super Contributor
timestamp: March 05, 2017, 01:45:02 am
content: Quote from: evb149 on March 04, 2017, 08:17:59 pmAfter disagreeing with me, you wrote out a rather complete description of what puts me off with Linux. Better written than I could have done. Obviously our satisfaction with those situations differs.I personally have found one large benefit of Linux. Windows support for old hardware (printers, scanners, cameras and the like) declines over time. Usually doesn't go to zero, but support of all but the most basic features become unsupported. I have had significant success accessing the more advanced features of this hardware in the Linux world.

author: Red Squirrel
author_rank: Super Contributor
timestamp: March 05, 2017, 05:46:14 am
content: Quote from: grumpydoc on March 04, 2017, 06:20:01 pmThat's a HUGE pain to setup though, I can't imagine having to go through that whole process for every single system. I read up on it and gave up after the 30th page realizing it's just not feasible to go through that much work for every single machine. They really need to come up with something simpler that is built in. Ex: a flag you turn to "on" and you point it to a server. Now all your user accounts are synced and authenticate to that server. Make it just as easy as in Windows where you just join to the domain and it's a few clicks.The whole ID syncing thing is ridiculous on many levels too not just security. It's just ridiculous in a large environment having to sync up all the machines so the local IDs match. A proper server protocol should not even care what the local IDs are. There should be an initial hand shake that involves a user/password hash or something. At very least it should go by username not by ID.But yeah NFS is not meant to be secure, but it could still have a somewhat half decent way to do access control without relying on every single machine having matching user IDs.Linux is great, but it does have it's quirks as far as ease to configure certain things. Don't get me started with it's crappy permission system and lack of inheritance or ability to add multiple groups to a folder.

author: Monkeh
author_rank: Super Contributor
timestamp: March 05, 2017, 07:02:09 am
content: Quote from: Red Squirrel on March 05, 2017, 05:46:14 amIt's not quite that simple, but there's this thing called LDAP. Yes, you need to know more than 'a few clicks', you also get more flexibility. It's not Windows - deal.QuoteIt's not crappy. We don't lack inheritance, and we do have the ability to grant multiple users or groups permissions on a file or directory. It's not 1986, we've had ACLs for many years. Just because you've never bothered to learn..

author: Red Squirrel
author_rank: Super Contributor
timestamp: March 05, 2017, 08:37:33 am
content: The issue with those things is that they arn't really native and require extensive configuration and hours of setup and reading. To me something like that should be very easy and mostly automated. Any system I've tried to use ACLs on it just says it's not supported. I assume it's some kind of kernel flag or something you have to setup, and that would probably require a reboot. Stuff like that should just work out of the box.One of these days I want to see what it takes to make/modify a distro so I can automate all of that so that it's turn key.I just want to be able to drag and drop files, create/delete etc and have them take on the right permissions without even having to open the console.

author: grumpydoc
author_rank: Super Contributor
timestamp: March 05, 2017, 01:12:19 pm
content: Quote from: Red Squirrel on March 05, 2017, 08:37:33 amI'm not quite sure how ACLs are not native, yes there is a flag which needs to be set to support them but on a per filesystem basis. I would be a bit surprised at any desktop distribution defaulting to not supporting ACLs unless it is specifically aimed at being a very minimal, lightweight installation - which "system" are you talking about?Nor for that matter do I see that any of the other tools are "less native" than AD on M$ Windows Server - AD is, after all, just a suite of user space programs on top of the underlying operating system, plus some kernel support for the filesystem itself.I'm afraid that no-one "owes" you easy. If setting Linux up is so hard then go get a copy of Windows Server and set up AD on that. I'm actually not convinced it is any easier to set up AD properly in a Windows network but you will find that it is definitely a rather more expensive exercise - something like $800 for the 2016 Server standard edition media and another $180 for a 5-user CAL pack at a minimum.If you use Linux chances are youwillhave to spend some time to understand the options and set things up how you want but that you have much more flexibility. The fact that there are a significant number of Linux machines running as web and file servers commercially suggests that "it works" for many people. It sounds as though you want things to just "magically happen" which is never going to be the case (and I include Windows Server in this)Sure a nice GUI tool would help lower the bar but it does not take very long to read the relevant documentation.You might want to look at something like FreeNAS (which is actually BSD based) or one of the other distributions aimed at building small storage servers. FreeNAS has (AFAIK) a point & click interface to join a Domain as a client or can be set up as an AD controller although, in this case, it does require editing config files.As to setting up a modern Linix distribution as an AD client. Well, yes, you might have to edit a few files but e.g.this pageseems to pretty well cover it for Ubuntu - hardly that onerous.

author: nctnico
author_rank: Super Contributor
timestamp: March 05, 2017, 02:57:18 pm
content: IMHO you are all vastly overthinking this. Just configure some Samba shares (with the GUI tool if you want) with some groups and users and be done with it. On the client browse to the share and enter the user's credentials to access the data. The topic says 'simple home network'.

author: grumpydoc
author_rank: Super Contributor
timestamp: March 05, 2017, 03:02:47 pm
content: Quote from: nctnico on March 05, 2017, 02:57:18 pmIf you (manually) set the password that Samba uses to be the same as the windows box you will not need to (re)enter a password.My home set up is one machine running Scientific Linux which acts as file (and everything else) server. Home directories are served using Samba or NFS. There are only three user accounts (mine, my wife's and my son's) so it's not hard to do that manually.Took less than an hour to set up and has been running like that for at least 5 years without trouble.

author: Monkeh
author_rank: Super Contributor
timestamp: March 05, 2017, 05:00:41 pm
content: Quote from: Red Squirrel on March 05, 2017, 08:37:33 amThey are entirely native, they do not require extensive configuration or hours of setup, but yes, you do have to do some reading. About 20 minutes worth.Quote.. ACLs are enabled by default on every major distro. Either you're working on >decade old information, or you've been playing with distros designed for people who know what they're doing.