Debian – NFS, Quota and LDAP

debianldapnfsopenldapquota

I have the following scenario in two servers with Debian:

Server #1
OpenLDAP, NFS exporting /home

Server #2
PAM with pam_ldap configured to authenticate against Server #1, /home directory mounted via NFS in Server #1.

The users authenticates in Server #2 via SSH.

Now I need to configure user quotas, installed quota package and mounted /home with usrquota and grpquota (Server #1). I have loaded quota.schema in the LDAP server, and every user has the attribute quota: /home,softlimit,hardlimit,softinode,hartinode

How I can make this quota effective? Doing repquota /home on Server #1 doesn't show this limits. I am missing something to configure?

Thanks!

Best Answer

afaict repquota doesn't activate the quotas. it's quota.on 's job. make sure you created the quota.group and quota.user files at the root of the fs. also remember that some filesystem (xfs) use different mount options for quota activation.

maybe this will help you:

http://www.debian-administration.org/articles/47

Related Solutions

Ldap – Securing userPassword access with OpenLDAP in RHEL

pam_ldap shouldn't be attempting to read the userPassword value to log you in -- It logs you in by doing an LDAP bind with the DN that it retrieves.

It's possible the search parameters pam_ldap uses are over-broad & it tries to pull userPassword as a result, but if your ACL is set up correctly (looks fine to me) it won't get that value in its results.

Just in case your ACLs aren't fine (I've been known to miss stupidly obvious stuff before), here's the working ACL list from my production LDAP environment :)

# Access and Security Restrictions
# (Most restrictive entries first)
access to attrs=userPassword
    by self write
    by dn.sub="ou=sync,dc=mydomain,dc=com" read
    by anonymous auth
by users none

access to * by * read

The trailing access to * by * read is important, I didn't see it in your examples so I'm not sure if it's missing or just omitted from your snippet.

The sync line is for my LDAP synchronization service and isn't necessary if you're not doing replication...

Linux – Access xfs quota info from NFS client

What worked for CentOS7 was to install quota package and enable the service on the file server:

yum install quota
systemctl enable rpc-rquota
systemctl start rpc-rquota

Then on the client the quota command returned user quota information. Previously I received "Connection refused" error:

$ quota
quota: error while getting quota from XXX.XXX.XX.XX:/XXXX/XXXX for XXXX (id XXXX): Connection refused

References

https://bugzilla.redhat.com/show_bug.cgi?id=1207239 https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/storage_administration_guide/nfs-serverconfig#sf2-nfs-accessing-rpc-quote-through-a-firewall

Best Answer

Related Solutions

Ldap – Securing userPassword access with OpenLDAP in RHEL

Linux – Access xfs quota info from NFS client

Related Topic