Chapter 32. Using Ansible to automount NFS shares for IdM users
Chapter 32. Using Ansible to automount NFS shares for IdM users Automount is a way to manage, organize, and access directories across multiple systems. Automount automatically mounts a directory whenever access to it is requested. This works well within an Identity Management (IdM) domain as it allows you to share directories on clients within the domain easily. You can use Ansible to configure NFS shares to be mounted automatically for IdM users logged in to IdM clients in an IdM location. The example in this chapter uses the following scenario: nfs-server.idm.example.com is the fully-qualified domain name (FQDN) of a Network File System (NFS) server. nfs-server.idm.example.com is an IdM client located in the raleigh automount location. The NFS server exports the /exports/project directory as read-write. Any IdM user belonging to the developers group can access the contents of the exported directory as /devel/project/ on any IdM client that is located in the same raleigh automount location as the NFS server. idm-client.idm.example.com is an IdM client located in the raleigh automount location. Important If you want to use a Samba server instead of an NFS server to provide the shares for IdM clients, see the Red Hat Knowledgebase solution How do I configure kerberized CIFS mounts with Autofs in an IPA environment? . The chapter contains the following sections: Autofs and automount in IdM Setting up an NFS server with Kerberos in IdM Configuring automount locations, maps, and keys in IdM by using Ansible Using Ansible to add IdM users to a group that owns NFS shares Configuring automount on an IdM client Verifying that an IdM user can access NFS shares on an IdM client 32.1. Autofs and automount in IdM The autofs service automates the mounting of directories, as needed, by directing the automount daemon to mount directories when they are accessed. In addition, after a period of inactivity, autofs directs automount to unmount auto-mounted directories. Unlike static mounting, on-demand mounting saves system resources. Automount maps On a system that utilizes autofs , the automount configuration is stored in several different files. The primary automount configuration file is /etc/auto.master , which contains the master mapping of automount mount points, and their associated resources, on a system. This mapping is known as automount maps . The /etc/auto.master configuration file contains the master map . It can contain references to other maps. These maps can either be direct or indirect. Direct maps use absolute path names for their mount points, while indirect maps use relative path names. Automount configuration in IdM While automount typically retrieves its map data from the local /etc/auto.master and associated files, it can also retrieve map data from other sources. One common source is an LDAP server. In the context of Identity Management (IdM), this is a 389 Directory Server. If a system that uses autofs is a client in an IdM domain, the automount configuration is not stored in local configuration files. Instead, the autofs configuration, such as maps, locations, and keys, is stored as LDAP entries in the IdM directory. For example, for the idm.example.com IdM domain, the default master map is stored as follows: Additional resources Mounting file systems on demand 32.2. Setting up an NFS server with Kerberos in a Red Hat Enterprise Linux Identity Management domain If you use Red Hat Enterprise Linux Identity Management (IdM), you can join your NFS server to the IdM domain. This enables you to centrally manage users and groups and to use Kerberos for authentication, integrity protection, and traffic encryption. Prerequisites The NFS server is enrolled in a Red Hat Enterprise Linux Identity Management (IdM) domain. The NFS server is running and configured. Procedure Obtain a kerberos ticket as an IdM administrator: Create a nfs/<FQDN> service principal: Retrieve the nfs service principal from IdM, and store it in the /etc/krb5.keytab file: Optional: Display the principals in the /etc/krb5.keytab file: By default, the IdM client adds the host principal to the /etc/krb5.keytab file when you join the host to the IdM domain. If the host principal is missing, use the ipa-getkeytab -s idm_server.idm.example.com -p host/nfs_server.idm.example.com -k /etc/krb5.keytab command to add it. Use the ipa-client-automount utility to configure mapping of IdM IDs: Update your /etc/exports file, and add the Kerberos security method to the client options. For example: If you want that your clients can select from multiple security methods, specify them separated by colons: Reload the exported file systems: 32.3. Configuring automount locations, maps, and keys in IdM by using Ansible As an Identity Management (IdM) system administrator, you can configure automount locations and maps in IdM so that IdM users in the specified locations can access shares exported by an NFS server by navigating to specific mount points on their hosts. Both the exported NFS server directory and the mount points are specified in the maps. In LDAP terms, a location is a container for such map entries. The example describes how to use Ansible to configure the raleigh location and a map that mounts the nfs-server.idm.example.com:/exports/project share on the /devel/project mount point on the IdM client as a read-write directory. Prerequisites On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure On your Ansible control node, navigate to your ~/ MyPlaybooks / directory: Copy the automount-location-present.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/automount/ directory: Open the automount-location-map-and-key-present.yml file for editing. Adapt the file by setting the following variables in the ipaautomountlocation task section: Set the ipaadmin_password variable to the password of the IdM admin . Set the name variable to raleigh . Ensure that the state variable is set to present . This is the modified Ansible playbook file for the current example: Continue editing the automount-location-map-and-key-present.yml file: In the tasks section, add a task to ensure the presence of an automount map: Add another task to add the mount point and NFS server information to the map: Add another task to ensure auto.devel is connected to auto.master : Save the file. Run the Ansible playbook and specify the playbook and inventory files: 32.4. Using Ansible to add IdM users to a group that owns NFS shares As an Identity Management (IdM) system administrator, you can use Ansible to create a group of users that is able to access NFS shares, and add IdM users to this group. This example describes how to use an Ansible playbook to ensure that the idm_user account belongs to the developers group, so that idm_user can access the /exports/project NFS share. Prerequisites You have root access to the nfs-server.idm.example.com NFS server, which is an IdM client located in the raleigh automount location. On the control node: You are using Ansible version 2.13 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password . The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. In ~/ MyPlaybooks / , you have created the automount-location-map-and-key-present.yml file that already contains tasks from Configuring automount locations, maps, and keys in IdM by using Ansible . Procedure On your Ansible control node, navigate to the ~/ MyPlaybooks / directory: Open the automount-location-map-and-key-present.yml file for editing. In the tasks section, add a task to ensure that the IdM developers group exists and idm_user is added to this group: Save the file. Run the Ansible playbook and specify the playbook and inventory files: On the NFS server, change the group ownership of the /exports/project directory to developers so that every IdM user in the group can access the directory: 32.5. Configuring automount on an IdM client As an Identity Management (IdM) system administrator, you can configure automount services on an IdM client so that NFS shares configured for a location to which the client has been added are accessible to an IdM user automatically when the user logs in to the client. The example describes how to configure an IdM client to use automount services that are available in the raleigh location. Prerequisites You have root access to the IdM client. You are logged in as IdM administrator. The automount location exists. The example location is raleigh . Procedure On the IdM client, enter the ipa-client-automount command and specify the location. Use the -U option to run the script unattended: Stop the autofs service, clear the SSSD cache, and start the autofs service to load the new configuration settings: 32.6. Verifying that an IdM user can access NFS shares on an IdM client As an Identity Management (IdM) system administrator, you can test if an IdM user that is a member of a specific group can access NFS shares when logged in to a specific IdM client. In the example, the following scenario is tested: An IdM user named idm_user belonging to the developers group can read and write the contents of the files in the /devel/project directory automounted on idm-client.idm.example.com , an IdM client located in the raleigh automount location. Prerequisites You have set up an NFS server with Kerberos on an IdM host . You have configured automount locations, maps, and mount points in IdM in which you configured how IdM users can access the NFS share. You have used Ansible to add IdM users to the developers group that owns the NFS shares . You have configured automount on the IdM client . Procedure Verify that the IdM user can access the read-write directory: Connect to the IdM client as the IdM user: Obtain the ticket-granting ticket (TGT) for the IdM user: Optional: View the group membership of the IdM user: Navigate to the /devel/project directory: List the directory contents: Add a line to the file in the directory to test the write permission: Optional: View the updated contents of the file: The output confirms that idm_user can write into the file.
dn: automountmapname=auto.master,cn=default,cn=automount,dc=idm,dc=example,dc=com objectClass: automountMap objectClass: top automountMapName: auto.master kinit admin ipa service-add nfs/nfs_server.idm.example.com ipa-getkeytab -s idm_server.idm.example.com -p nfs/nfs_server.idm.example.com -k /etc/krb5.keytab klist -k /etc/krb5.keytab Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM 1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM 1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM 1 nfs/nfs_server.idm.example.com@IDM.EXAMPLE.COM 7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM 7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM 7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM 7 host/nfs_server.idm.example.com@IDM.EXAMPLE.COM ipa-client-automount Searching for IPA server IPA server: DNS discovery Location: default Continue to configure the system with these values? [no]: yes Configured /etc/idmapd.conf Restarting sssd, waiting for it to become available. Started autofs /nfs/projects/ 192.0.2.0/24(rw, sec=krb5i ) /nfs/projects/ 192.0.2.0/24(rw, sec=krb5:krb5i:krb5p ) exportfs -r cd ~/ MyPlaybooks / cp /usr/share/doc/ansible-freeipa/playbooks/automount/automount-location-present.yml automount-location-map-and-key-present.yml --- - name: Automount location present example hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Ensure automount location is present ipaautomountlocation: ipaadmin_password: "{{ ipaadmin_password }}" name: raleigh state: present [...] vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: [...] - name: ensure map named auto.devel in location raleigh is created ipaautomountmap: ipaadmin_password: "{{ ipaadmin_password }}" name: auto.devel location: raleigh state: present [...] vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: [...] - name: ensure automount key /devel/project is present ipaautomountkey: ipaadmin_password: "{{ ipaadmin_password }}" location: raleigh mapname: auto.devel key: /devel/project info: nfs-server.idm.example.com:/exports/project state: present [...] vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: [...] - name: Ensure auto.devel is connected in auto.master: ipaautomountkey: ipaadmin_password: "{{ ipaadmin_password }}" location: raleigh mapname: auto.map key: /devel info: auto.devel state: present ansible-playbook --vault-password-file=password_file -v -i inventory automount-location-map-and-key-present.yml cd ~/ MyPlaybooks / [...] vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: [...] - ipagroup: ipaadmin_password: "{{ ipaadmin_password }}" name: developers user: - idm_user state: present ansible-playbook --vault-password-file=password_file -v -i inventory automount-location-map-and-key-present.yml chgrp developers /exports/project ipa-client-automount --location raleigh -U systemctl stop autofs ; sss_cache -E ; systemctl start autofs ssh idm_user@idm-client.idm.example.com Password: kinit idm_user ipa user-show idm_user User login: idm_user [...] Member of groups: developers, ipausers cd /devel/project ls rw_file echo "idm_user can write into the file" > rw_file cat rw_file this is a read-write file idm_user can write into the file