Creating Centralized Home Directories in Trusted Extensions

In Trusted Extensions, users need access to their home directories at every label at which the users work. By default, home directories are created automatically by the automounter that is running in each zone. However, if you use an NFS server to centralize home directories, you must enable home directory access at every label for your users.

How to Create the Home Directory Server in Trusted Extensions

Before You Begin

You are in the root role in the global zone.

1. Add Trusted Extensions software to the home directory server and configure its labeled zones.

   • Because users require a home directory at every label that they they can log in to, create a home directory server at every user label. For example, if you create a default configuration, you would create a home directory server for the PUBLIC label and a server for the INTERNAL label.

2. For every labeled zone, follow the automount procedure in How to NFS Mount Files in a Labeled Zone. Then, return to this procedure.
3. Verify that the home directories have been created.
   1. Log out of the home directory server.
   2. As a regular user, log in to the home directory server.
   3. In the login zone, open a terminal.
   4. In the terminal window, verify that the user's home directory exists.
   5. Create workspaces for every zone that the user can work in.
   6. In each zone, open a terminal window to verify that the user's home directory exists.
4. Log out of the home directory server.

How to Enable Users to Access Their Remote Home Directories at Every Label by Logging In to Each NFS Server

In this procedure, you allow users to create a home directory at each label by letting them directly log in to each home directory server. After creating each home directory on the central server, users can access their home directories from any system.

Alternatively, you, as administrator, can create a mount point on each home directory server by running a script, then modifying the automounter. For this method, see How to Enable Users to Access Their Remote Home Directories by Configuring the Automounter on Each Server.

Before You Begin

The home directory servers for your Trusted Extensions domain are configured.

• Enable users to log in directly to each home directory server.

  Typically, you have created one NFS server per label.

  1. Instruct each user to log in to each NFS server at the label of the server.
  2. When the login is successful, instruct the user to log out of the server.

     A home directory for the user is available at the label of the server when the login is successful.

  3. Instruct the users to log in from their regular workstation.

     The home directory for their default label is available from the home directory server. When a user changes the label of a session or adds a workspace at a different label, the user's home directory for that label is mounted.

Next Steps

Users can log in at a different label from their default label by choosing a different label from the label builder during login.

How to Enable Users to Access Their Remote Home Directories by Configuring the Automounter on Each Server

In this procedure you run a script that creates a mount point for home directories on each NFS server. Then, you modify the auto_home entry at the label of the server to add the mount point. Then, users can log in.

Before You Begin

The home directory servers for your Trusted Extensions domain are configured as LDAP clients. User accounts have been created on the LDAP server by using the useradd command with the -S ldap option. You must be in the root role.

1. Write a script that creates a home directory mount point for every user.

   The sample script makes the following assumptions:

   • The LDAP server is a different server from the NFS home directory server.

   • The client systems are also different systems.

   • The hostname entry specifies the external IP address of the zone, that is, the NFS home directory server for its label.

   • The script will be run on the NFS server in the zone that serves clients at that label.

   #!/bin/sh
   hostname=$(hostname)
   scope=ldap
   
   for j in $(getent passwd|tr ' ' _); do
       uid=$(echo $j|cut -d: -f3)
       if [ $uid -ge 100 ]; then
           home=$(echo $j|cut -d: -f6)
           if [[ $home == /home/* ]]; then
               user=$(echo $j|cut -d: -f1)
               echo Updating home directory for $user
               homedir=/export/home/$user
               usermod -md ${hostname}:$homedir -S $scope $user
               mp=$(mount -p|grep  " $homedir zfs" )
               dataset=$(echo $mp|cut -d" " -f1)
               if [[ -n $dataset ]]; then
                   zfs set sharenfs=on $dataset
               fi
           fi
       fi
   done

2. On each NFS server, run the preceding script in the labeled zone that serves clients at that label.