1 |
Hi everyone, |
2 |
|
3 |
I've been attempting to get to grips with LDAP with a view to migrating |
4 |
away from NIS, and using it to support the various services I run |
5 |
(notably Samba). |
6 |
|
7 |
Now my network is not of a particularly large scale, nonetheless I want |
8 |
to structure the directory according to some notion of order (and in |
9 |
such a fashion as it would work well for a larger organisation too). |
10 |
|
11 |
I've come up with a skeletal structure as follows: |
12 |
|
13 |
dc=recruit2recruit,dc=net |
14 |
o=R2R |
15 |
ou = Clients |
16 |
(Address book entries for client contacts |
17 |
go here) |
18 |
ou = IT |
19 |
(Unix/Samba accounts go here) |
20 |
ou = Sales |
21 |
(Unix/Samba accounts go here) |
22 |
|
23 |
ou = serve (name of the main server) |
24 |
ou = Machines |
25 |
(Samba3 machine accounts go here) |
26 |
ou = Groups |
27 |
ou = Hosts |
28 |
ou = Aliases |
29 |
... |
30 |
|
31 |
o=Some_other_company (or branch office?) |
32 |
... |
33 |
|
34 |
So I'm using the 'o' entry to designate the company, with all |
35 |
"top-level" organisation units for the company underneath of that. |
36 |
Clients will contain simple address book entries (inetOrgPerson) for use |
37 |
by email clients. Separate OUs exist for the departments which will |
38 |
contain the actual user accounts (and will also have inetOrgPerson |
39 |
attributes for use with email and anthing else that is necessary such as |
40 |
qmail schema attributes). |
41 |
|
42 |
The OU 'serve' refers to the hostname of my server, and I was thinking |
43 |
of putting the Samba-3 machine accounts under the 'Machines' OU there, |
44 |
and throwing all the other Unix related stuff in there (as ported by |
45 |
PADL's migrationtools scripts ... POSIX groups, mail aliases and so |
46 |
forth). I suppose it doesn't really need to be named after the server at |
47 |
all, but that's a matter of cosmetics. |
48 |
|
49 |
So, does this seem sensible? Perhaps I should make OUs for both |
50 |
'Machines' and 'Accounts' under the OU for each department so that the |
51 |
machines are associated with the department also? Maybe also, the |
52 |
departmental information and address book related OUs should have parent |
53 |
OUs to keep a potentially larger directory clean? Also, I want to ensure |
54 |
that various entries can be found even if they are split accross OUs, |
55 |
but I don't imagine that's a problem (presumably just refining the query |
56 |
used by the various services in their capacity as an LDAP client if |
57 |
necessary). |
58 |
|
59 |
Any insights or additional advice will be gratefully received as I would |
60 |
like to get this just so before fully populating the directory and |
61 |
attempting to configure nss_ldap and such :) |
62 |
|
63 |
Regards, |
64 |
|
65 |
Kerin Francis Millar (kerframil) |