/// article

Centralized Authentication and Home Directories with UCS, LDAP, and NFS

By lordfrancs3

In Part 2, we built the LTSP server for PXE boot thin clients on Ubuntu 24.04. The server can now provide a basic PXE boot environment for client machines. In this third part, we will connect the LTSP environment to Univention Corporate Server, also called UCS. UCS will provide two important services for the thin client setup: LDAP authentication, so users can log in with centralized accounts NFS home directories, so users can access the same files and settings from any thin client This follows the original lab design, where the thin clients boot through PXE, authenticate against an existing UCS LDAP directory, and mount /home from the same UCS server over NFS. Why UCS Is Used in This Design Univention Corporate Server is useful in this setup because it can act as the central identity and file service platform for the thin client environment. Instead of managing users locally on the LTSP server, user accounts are created and managed in UCS. The LTSP server checks UCS when a user logs in. The user’s home directory is also stored on UCS and mounted through NFS. The simplified flow looks like this: Thin Client | | PXE boot v LTSP Server on Ubuntu 24.04 | | User lookup and login v UCS LDAP Directory | | User home directory v UCS NFS Share | v XFCE desktop or kiosk session UCS supports centralized directory management through LDAP, and its manual includes domain services, LDAP directory, user management, and UCS web interface modules as part of the platform. For file storage, UCS supports central management of directory shares. UCS shares can be provided through CIFS for Windows and Linux clients, or through NFS for Linux and Unix clients. UCS-managed NFS shares can be mounted by clients through NFSv3 and NFSv4. What Is LDAP? LDAP means Lightweight Directory Access Protocol. In this design, LDAP is used so the LTSP server can read user account information from UCS. LDAP answers questions like: Does this user exist? What is the user's UID? What is the user's GID? What groups does the user belong to? What is the user's home directory? What shell should the user use? Is the password correct? Linux needs this information when a user logs in. For example, a UCS user may have account data like this: Username: student01 UID number: 20001 GID number: 5001 Home directory: /home/student01 Login shell: /bin/bash The username is what the person types. The UID and GID are what Linux uses for file ownership and permissions. What Is NFS? NFS means Network File System. NFS allows one server to share a directory over the network. Other Linux systems can mount that shared directory and use it like a local folder. In this design, UCS shares /home through NFS. That means user home directories are stored on UCS, not separately on every thin client. Example: UCS server export: ucs01.pinoylinux.intranet:/home LTSP mount point: /home User folder: /home/student01 When student01 logs in from a thin client, the user sees: /home/student01 But the actual files are stored on the UCS server. This is important because /home contains user files and user settings, such as: Documents Downloads Desktop files XFCE settings Browser profile data Application settings .xsession file Without NFS, users may lose settings when they move from one thin client to another. With NFS, the user gets the same home directory from any client. Why LDAP and NFS Work Together LDAP provides the user identity. NFS provides the user files. LDAP tells Linux: student01 has UID 20001 and home directory /home/student01 NFS provides: The actual /home/student01 folder from UCS The most important rule is this: The UID and GID in LDAP must match the owner of the home directory on NFS. If the UID and GID do not match, the user may log in but fail to write files. The user may also see permission errors, broken desktop settings, or login problems. Target Setup This article uses the following sample values: UCS server hostname: ucs01.pinoylinux.intranet UCS server IP address: 192.168.100.75 LDAP base DN: dc=pinoylinux,dc=intranet LDAP user container: cn=users,dc=pinoylinux,dc=intranet LTSP server hostname: ltsp01.pinoylinux.intranet LTSP server OS: Ubuntu 24.04 LTS NFS export from UCS: 192.168.100.75:/home LTSP mount path: /home Replace these values with your own domain, hostname, IP address, and user structure. Do not publish real bind passwords in the article. Step 1: Install UCS Install UCS on a server or virtual machine that will act as the central identity and file server. During installation, choose the correct language, keyboard, storage, network settings, and domain settings. The UCS installer is interactive and asks for the system settings through a graphical interface. For this design, UCS should have a static IP address. Example: Hostname: ucs01 Domain: pinoylinux.intranet IP address: 192.168.100.75 Role: Primary Directory Node Illustration 1: UCS installation starts with language, keyboard, storage, network, and domain setup. Illustration 2: UCS is configured with a static IP address and domain name for centralized user management. Step 2: Log In to the UCS Web Interface After installation, open the UCS web interface from a browser. Example: https://ucs01.pinoylinux.intranet/ or: https://192.168.100.75/ Log in using the UCS administrator account. The UCS manual includes the UCS web interface and management modules as part of the administration workflow. Illustration 3: The UCS web interface is used to manage users, groups, shares, and domain settings. Step 3: Confirm LDAP Service on UCS UCS stores directory information in LDAP. Before configuring the LTSP server, confirm that the UCS LDAP service is reachable from the LTSP server. From the LTSP server: getent hosts ucs01.pinoylinux.intranet ping -c 4 ucs01.pinoylinux.intranet If DNS is not configured yet, add a temporary entry on the LTSP server: sudo nano /etc/hosts Example: 192.168.100.75 ucs01.pinoylinux.intranet ucs01 Test again: getent hosts ucs01.pinoylinux.intranet Step 4: Create a User in UCS In the UCS web interface, open: Users Create a test user. Example: Username: student01 First name: Student Last name: One Password: Set a test password The UCS manual includes user management through the Univention Management Console module. Illustration 4: Users are created centrally in UCS instead of locally on each LTSP client. Step 5: Confirm the User Has Linux Account Attributes For Linux login, the user must have Unix or POSIX account attributes. Confirm that the UCS user has: Username UID number Primary group or GID Home directory Login shell Example: Username: student01 Home directory: /home/student01 Login shell: /bin/bash Illustration 5: The UCS user must have Linux account attributes so the LTSP server can map the login to a UID, GID, shell, and home directory. If the user has no Linux attributes, the LTSP server may not be able to resolve the user correctly through LDAP. Step 6: Prepare the Home Directory on UCS The user’s home directory must exist on the UCS server. Example: /home/student01 If UCS creates the home directory automatically based on user settings, confirm that it exists. On the UCS server: ls -ld /home/student01 Check numeric ownership: ls -ldn /home/student01 Example result: drwx------ 10 20001 5001 4096 Jul 10 10:00 /home/student01 The numeric UID and GID should match the user data from UCS LDAP. Step 7: Configure /home as an NFS Share in UCS In the UCS web interface, open: Shares Create or confirm a share for /home. Example settings: Share name: home Server: ucs01 Path: /home NFS: Enabled Samba/CIFS: Optional, depending on your environment UCS supports central file share management through the UMC module. A share registered in the UMC Shares module is created on a UCS server as part of UCS domain replication. UCS shares can be made available through CIFS or NFS, and NFS shares managed by UCS can be mounted by NFSv3 or NFSv4 clients. Illustration 6: The /home directory is shared from UCS so LTSP users can access the same home directory from any thin client. Illustration 7: NFS access is enabled for Linux clients that need to mount the centralized /home directory. Step 8: Confirm NFS Export from UCS From the LTSP server, install NFS client tools if they are not installed yet: sudo apt update sudo apt install -y nfs-common Check the NFS exports from UCS: showmount -e 192.168.100.75 Expected result: Export list for 192.168.100.75: /home 192.168.100.0/24 If the export does not appear, check the UCS share settings and firewall rules. Step 9: Install SSSD and LDAP Tools on the LTSP Server In the older lab notes, LDAP was configured through /etc/ldap.conf. For Ubuntu 24.04, a cleaner approach is to use SSSD. SSSD can use LDAP for authentication, authorization, and user and group information. Ubuntu’s documentation shows SSSD with LDAP using packages such as sssd-ldap and ldap-utils. Install the required packages: sudo apt update sudo apt install -y \ sssd-ldap sssd-tools ldap-utils \ libnss-sss libpam-sss \ nfs-common Step 10: Test UCS LDAP Lookup Test LDAP lookup from the LTSP server. If using plain LDAP in a closed lab: ldapsearch -x \ -H ldap://192.168.100.75 \ -b "dc=pinoylinux,dc=intranet" \ "(uid=student01)" If using a bind account: ldapsearch -x \ -H ldap://192.168.100.75 \ -D "uid=ldapbind,cn=users,dc=pinoylinux,dc=intranet" \ -W \ -b "dc=pinoylinux,dc=intranet" \ "(uid=student01)" For a real deployment, prefer StartTLS or LDAPS. Ubuntu’s SSSD with LDAP documentation notes that clients must trust the CA that signed the LDAP server certificate when using StartTLS with full certificate checking. Do not hardcode real passwords in the public article. Step 11: Configure SSSD for UCS LDAP Create the SSSD configuration file: sudo nano /etc/sssd/sssd.conf Example configuration: [sssd] services = nss, pam config_file_version = 2 domains = pinoylinux.intranet [domain/pinoylinux.intranet] id_provider = ldap auth_provider = ldap chpass_provider = ldap ldap_uri = ldap://192.168.100.75 ldap_search_base = dc=pinoylinux,dc=intranet ldap_schema = rfc2307 cache_credentials = true enumerate = false fallback_homedir = /home/%u default_shell = /bin/bash If your UCS LDAP server requires a bind account, add: ldap_default_bind_dn = uid=ldapbind,cn=users,dc=pinoylinux,dc=intranet ldap_default_authtok_type = password ldap_default_authtok = CHANGE_THIS_PASSWORD For production, use StartTLS or LDAPS. Example StartTLS settings: ldap_id_use_start_tls = true ldap_tls_reqcert = demand ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt Set the correct permissions: sudo chown root:root /etc/sssd/sssd.conf sudo chmod 600 /etc/sssd/sssd.conf Ubuntu’s SSSD documentation also states that /etc/sssd/sssd.conf should be owned by root and have 0600 permissions. Start SSSD: sudo systemctl enable --now sssd Check status: systemctl status sssd --no-pager Step 12: Configure NSS and PAM Edit NSS configuration: sudo nano /etc/nsswitch.conf Make sure these lines include sss: passwd: files systemd sss group: files systemd sss shadow: files sss Run PAM configuration: sudo pam-auth-update Enable SSS authentication if prompted. For this design, do not depend on local automatic home directory creation. The home directory should come from UCS through NFS. Step 13: Test UCS User Lookup from Ubuntu Clear SSSD cache: sudo sss_cache -E Test user lookup: getent passwd student01 Expected result: student01:*:20001:5001:Student One:/home/student01:/bin/bash Test group lookup: id student01 Expected result: uid=20001(student01) gid=5001(students) groups=5001(students) Step 14: Mount UCS /home Through NFS Before mounting /home, remember this: Mounting UCS /home over the local /home path hides the local /home folders while the NFS mount is active. Keep a local admin account available for recovery. Create a temporary test mount point: sudo mkdir -p /mnt/ucs-home-test Mount the UCS home directory: sudo mount -t nfs4 192.168.100.75:/home /mnt/ucs-home-test Check the mounted folder: ls -lah /mnt/ucs-home-test ls -lah /mnt/ucs-home-test/student01 Check numeric ownership: ls -ldn /mnt/ucs-home-test/student01 Compare it with: id student01 The UID and GID must match. Unmount the test mount: sudo umount /mnt/ucs-home-test Step 15: Add UCS /home to /etc/fstab Back up the current fstab: sudo cp /etc/fstab /etc/fstab.bak.$(date +%F) Edit fstab: sudo nano /etc/fstab Add this line: 192.168.100.75:/home /home nfs4 rw,_netdev,hard,noatime,x-systemd.automount,x-systemd.requires=network-online.target 0 0 Ubuntu’s NFS documentation covers installing and mounting NFS shares on Ubuntu systems. It also lists the NFS client package nfs-common for client-side NFS use. Reload systemd: sudo systemctl daemon-reload Mount the entries: sudo mount -a Check the mount: findmnt /home df -h /home Suggested screenshot: [Screenshot: LTSP terminal showing findmnt /home] Caption: The LTSP server now mounts /home from UCS through NFS. Step 16: Test Login with UCS User Test from the LTSP server first: su - student01 Check the home directory: pwd touch ~/ucs-nfs-test.txt ls -lah ~/ucs-nfs-test.txt Expected result: /home/student01 Exit: exit If the file can be created, the UCS LDAP identity and UCS NFS home directory are working together. Step 17: Confirm LightDM Manual Login Check the LightDM configuration from Part 2: cat /etc/lightdm/lightdm.conf.d/50-xfce.conf Expected configuration: [Seat:*] greeter-session=lightdm-gtk-greeter greeter-hide-users=true greeter-show-manual-login=true user-session=xfce allow-guest=false Restart LightDM: sudo systemctl restart lightdm Illustration 8: Users log in manually using their UCS username and password. Step 18: Rebuild the LTSP Image The LTSP clients need the SSSD, LDAP, PAM, NSS, and NFS configuration. Rebuild the LTSP image: sudo ltsp image / Regenerate the LTSP initrd: sudo ltsp initrd If needed, regenerate the iPXE boot files: sudo ltsp ipxe Reboot a thin client through PXE and test login with the UCS user account. Step 19: Test from the Thin Client From the PXE-booted thin client: Boot through PXE Wait for the LightDM login screen Enter the UCS username Enter the UCS password Confirm XFCE loads Open a terminal Confirm the user and home directory Run: whoami pwd id touch ~/thin-client-ucs-test.txt ls -lah ~/thin-client-ucs-test.txt Expected: whoami -> student01 pwd -> /home/student01 If the file is created successfully, the thin client is using centralized authentication and centralized home storage. Troubleshooting LDAP ldapsearch fails Check: ping -c 4 192.168.100.75 getent hosts ucs01.pinoylinux.intranet Check firewall and LDAP service on UCS. ldapsearch works, but getent passwd student01 fails Check SSSD: systemctl status sssd --no-pager journalctl -u sssd -n 100 --no-pager Check file permissions: ls -l /etc/sssd/sssd.conf Expected: -rw------- 1 root root /etc/sssd/sssd.conf Clear cache: sudo sss_cache -E getent passwd student01 Login fails, but user lookup works Run: sudo pam-auth-update Make sure SSS authentication is enabled. Check that the UCS user has a valid shell and home directory. getent passwd student01 Troubleshooting NFS NFS export does not appear Run: showmount -e 192.168.100.75 If /home does not appear, review the UCS Shares module and confirm NFS is enabled. Permission denied inside /home/student01 Check numeric ownership: id student01 ls -ldn /home/student01 The UID and GID must match. Server hangs during boot after adding NFS Use systemd automount in /etc/fstab: x-systemd.automount This allows /home to mount when first accessed instead of blocking the boot process too early. Security Notes For lab use, plain LDAP and basic NFS may work. For production-style deployments, review these controls: Use StartTLS or LDAPS for LDAP. Use a low-privilege LDAP bind account. Do not publish LDAP passwords. Restrict NFS exports to trusted networks. Prefer NFSv4 where possible. Keep local admin access for recovery. Back up UCS LDAP and /home data. Use firewall rules to limit LDAP and NFS access. LDAP protects identity. NFS protects user files. Both must be configured carefully. What We Completed In this part, we updated the thin client design to use UCS as the central backend. We completed the following: Explained what LDAP does Explained what NFS does Explained why UCS fits the LTSP design Prepared UCS as the LDAP and NFS backend Created a UCS user Confirmed Linux account attributes Configured a UCS /home NFS share Installed SSSD and NFS tools on Ubuntu 24.04 Connected the LTSP server to UCS LDAP Mounted UCS /home through NFS Tested UCS user login Rebuilt the LTSP image Tested the setup from a PXE-booted thin client At this point, the LTSP thin client environment has centralized login and centralized user files through UCS. What Comes Next In Part 4, we will configure the managed desktop experience. We will focus on XFCE, LightDM behavior, and Google Chrome Stable kiosk mode. The goal is to control what users see after login and launch a full-screen browser session when needed. References Univention Corporate Server 5.2 Manual https://docs.software-univention.de/manual/5.2/en/contents.html Univention Corporate Server Installation https://docs.software-univention.de/manual/5.2/en/installation.html Univention Corporate Server File Share Management https://docs.software-univention.de/manual/5.2/en/shares/index.html Ubuntu Server Documentation, SSSD with LDAP https://ubuntu.com/server/docs/how-to/sssd/with-ldap/ Ubuntu Server Documentation, Network File System https://ubuntu.com/server/docs/how-to/networking/install-nfs/ LTSP Documentation https://ltsp.org/docs/ LTSP Installation Guide https://ltsp.org/docs/installation/ LTSP Manual https://ltsp.org/man/ltsp/