Automount locations
Requires the automount module. The location / map / key structure, the standard on-demand home directory setup, enabling clients, and why the UI stops at locations.
Requires the automount module. Automount moves every host's /etc/auto.master and /etc/auto.home into the directory; the client's autofs reads them through sssd and mounts NFS on demand when a user enters /home/<uid>.
Three levels
| Level | autofs equivalent | Notes |
|---|---|---|
| location | one complete configuration | one per site / NFS server; a client picks one. default is shipped |
| map | one map file (auto.master, auto.home, auto.direct) | auto.master is the entry point, auto.direct holds direct mounts |
| key | one line of a map | in auto.master the key is the mount point and the value a map name; in other maps the key is a subdirectory and the value the mount info |
The standard on-demand home directory setup:
location: default
map auto.master
key /home → auto.home
map auto.home
key * → -fstype=nfs4,rw nfs01.linux.ipa.test:/export/home/&* matches any subdirectory and & substitutes the accessed name: /home/zhangwei mounts nfs01:/export/home/zhangwei. Mount options go before the value; -fstype=nfs4,sec=krb5 needs an nfs/ principal on the NFS server (Services).
UI and CLI
The 1.0.2 UI stops at the location list; maps and keys are CLI:
ipa automountmap-add default auto.home
ipa automountkey-add default auto.master --key=/home --info=auto.home
ipa automountkey-add default auto.home --key='*' --info='-fstype=nfs4 nfs01.linux.ipa.test:/export/home/&'
ipa automountlocation-tofiles default # print the whole set in autofs file format
ipa automountlocation-import default /etc/auto.master # import from existing filesClient
ipa-client-automount --location=defaultSets autofs_provider = ipa in sssd.conf, automount: sss files in nsswitch.conf, and starts autofs. After a map change, sss_cache -A on the client or wait for the cache to expire.
Boundaries
- With NFS home directories, the default home
/homeon the Configuration page and the map's mount point must agree. - Automount does not create directories;
/export/home/<uid>must exist on the NFS server (or be created locally byoddjob-mkhomedir). - Locations cannot be renamed.
DNS
Requires the dns module. IPA's own DNS: zones, records, forward zones and forward policy, per-server forwarders, global config; how host records are maintained automatically, and why this group is meaningless with IPA_SETUP_DNS=false.
Role-based access control (RBAC)
Delegating administration: the permission → privilege → role layers, what the shipped roles can do, giving a help desk a reset-password-only account, and how the admins group relates to RBAC.