小型办公室Ubuntu用户跨设备登录及账号管理方案咨询

Great question! For a small office setup where you want Ubuntu users to log into any machine and retain their personal settings, desktop layout, and core files, you’ve got two practical paths to choose from—one leaning on your existing GSuite, another using a lightweight authentication server if you prefer full control. Let’s break this down:

路径1：基于GSuite + SSSD 实现无额外服务器的漫游登录 #

This uses your existing GSuite identity system to manage users, so you don’t need to deploy a dedicated server. Note: You’ll need a GSuite Business/Enterprise plan or Cloud Identity Premium to access GSuite’s LDAP service.

步骤1：开启GSuite LDAP服务 #

• Log into your GSuite Admin console, navigate to Apps > LDAP
• Enable LDAP access, note down the LDAP server addresses (e.g., ldap.google.com), your domain’s base DN, and create a service account for LDAP binding (this account will let Ubuntu machines sync user data)

步骤2：配置每台Ubuntu客户端 #

1. Install required packages:

   sudo apt update && sudo apt install sssd sssd-ldap libnss-sss libpam-sss nfs-common
   

2. Create and edit the SSSD config file /etc/sssd/sssd.conf (set proper permissions with sudo chmod 600 /etc/sssd/sssd.conf):

   [sssd]
   services = nss, pam, ssh
   domains = your-gsuite-domain.com
   
   [domain/your-gsuite-domain.com]
   id_provider = ldap
   auth_provider = ldap
   ldap_uri = ldaps://ldap.google.com:636
   ldap_search_base = dc=your-gsuite-domain,dc=com
   ldap_bind_dn = cn=ldap-service-account,ou=Users,dc=your-gsuite-domain,dc=com
   ldap_bind_password = your-service-account-password
   ldap_user_object_class = inetOrgPerson
   override_homedir = /home/%u
   ldap_id_use_start_tls = False
   cache_credentials = True
   

3. Update system authentication and name services:
   • Run sudo pam-auth-update and check the SSSD option to enable PAM integration
   • Edit /etc/nsswitch.conf and add sss to the end of these lines:

     passwd:         files systemd sss
     group:          files systemd sss
     shadow:         files sss
     

4. Enable automatic home directory creation:
   Add this line to /etc/pam.d/common-session:

   session required pam_mkhomedir.so skel=/etc/skel umask=0022
   

5. Restart SSSD to apply changes:

   sudo systemctl restart sssd
   

步骤3：实现设置与文件漫游 #

• For file sync: Install the official Google Drive client on each Ubuntu machine, set it to auto-mount on user login. This syncs core files to GSuite, accessible from any machine.
• For desktop settings: Configure Ubuntu to sync .config and .local directories (where desktop preferences are stored) to Google Drive. You can use a script or symlink these folders to your Drive mount point.

用户管理 #

All user operations happen directly in the GSuite Admin console:

• Add user: Create a new user in GSuite—SSSD will sync the account to all Ubuntu machines within minutes
• Edit user: Update user details (name, email) in GSuite, changes propagate automatically
• Delete user: Disable/delete the user in GSuite; they’ll lose access to all Ubuntu machines immediately

路径2：部署轻量LDAP+NFS服务器（自主管理） #

If you want to avoid relying on GSuite or need more control over user data, deploy a low-cost Ubuntu Server as your authentication and home directory server.

步骤1：部署OpenLDAP服务器 #

1. Install LDAP packages on your server:

   sudo apt install slapd ldap-utils phpldapadmin
   

2. Run the setup wizard: sudo dpkg-reconfigure slapd—set your office domain (e.g., office.local), admin password, and enable database backup
3. Access the web management interface at http://your-server-ip/phpldapadmin to create users, groups, and manage permissions

步骤2：部署NFS共享家目录 #

1. Install NFS server on the same machine:

   sudo apt install nfs-kernel-server
   

2. Create a shared directory for user homes:

   sudo mkdir /srv/nfs/homes
   sudo chmod 755 /srv/nfs/homes
   

3. Edit /etc/exports to allow office machines access:

   /srv/nfs/homes 192.168.1.0/24(rw,sync,no_subtree_check)
   

4. Restart NFS server:

   sudo systemctl restart nfs-kernel-server
   

步骤3：配置Ubuntu客户端 #

Follow similar steps to Path 1, but point SSSD to your local LDAP server instead of GSuite. Key differences:

• In /etc/sssd/sssd.conf, set ldap_uri to your server’s IP (e.g., ldap://192.168.1.100)
• Configure auto-mount of NFS home directories using autofs or add the mount to /etc/fstab

用户管理 #

Use the phpLDAPadmin web interface for all user operations:

• Add user: Create a new user entry, set their home directory to /srv/nfs/homes/username
• Edit user: Update user attributes (password, group memberships) directly in the interface
• Delete user: Remove the user entry and optionally delete their home directory from the NFS share

额外优化建议 #

• Enable SSH key authentication: Store user SSH keys in LDAP (or GSuite) for passwordless, secure logins
• Enable automatic updates: Keep all Ubuntu machines and servers patched with sudo apt install unattended-upgrades
• Backup critical data: For LDAP, schedule regular backups with slapcat; for GSuite, use built-in backup tools

内容的提问来源于stack exchange，提问作者Rod