How do I set up network authentication for network with various OSs and Services

[Niels Olson]

Here's my network:

Internet
- Router
- - Wired
- - - SuSE 10.1 with samba and cups servers
- - - Brother printer with a NIC
- - - Dual boot WinXP Home & Debian 4
- - Wireless using WPA
- - - Dual-boot laptop: WinXP Pro & SuSE 10.1 (knetworkmanager doesn't seem to work when ESSID is not broadcast)
- - - Apple OS X laptop
- - - Dual-boot laptop with WinXP Pro and Ubuntu 6.06 (networkmanager doesn't seem to work at all, but networkadmin can configure the network with ifdown then ifup)

Let's say I have a user, Andy. I want Andy to be able to log in as Andy from any box under any OS and have coherent file permissions, printer usage, etc.

Can I do this? How? I have been reading up on DNS, DHCP, Kerberos, Samba , etc. My brother, self-taught, handles IT for a medium-sized company and has been working with me on this off and on for months, but we're still not there. I think I just need to see this set up once with some help to actually understand what all these things are doing.

Regards,

Niels

[dilbert]

[...] have coherent file permissions, printer usage, etc.

Does that mean you will have a home directory, e.g. "/home/andy" and see the files from any OS?

If yes I think you need first an NFS server where "/home/andy" resides physically. Second task would be to get ALL OSes connected to that NFS server.

Is printer usage working already from different OSes?

[Niels Olson]

Okay, I got the NSF server working and the linux machines can work with that. This thread pointed the way and this NSF howto was invaluable. I got lots of errors working through it and chapters 3, 7, and 8 addressed all of them.

Issues:

Samba is serving the same directories for Windows and really anything can use the samba shares because samba is allowing the 'nobody' user, and that's because I still have a computer using WinXP home. It appears WinXP Home will never handle permissions appropriately because WinXP home can't join a domain and thus can't use LDAP.

True Macintosh networking apparently requires the netatalk implementation of the appletalk protocol. OS X can deal with Samba though and I can still IPP the printer directly, so no major heartburn there.

The NSF-without-LDAP method is not satisfying because the server simply trusts that the UID set on one machine matches the UID set on another machine; this is not true network authentication, but that's trivial compared to the gapping hole of anonymous Samba access. The only thing really securing the network secure is a WPA password. It appears the next priority is to either get another copy of WinXP Pro or migrate off Windows entirely.