For this series of posts I’m going to deviate a little from the standard journal style of a blog while also steering clear of a traditional HOWTO-style document.

I’m going to talk about the steps I’ve taken to integrate two Macs into my home network, which is based on Samba, LDAP and Kerberos. But rather than simply list a bunch of steps that describe how to get from nothing to what I have now, or write a hefty reference guide on the technologies involved, I’m going to write a series of posts in which I detail the evolution of the setup. I learned some interesting stuff along the way and it would be a shame not to write a little about it just because the optimal configuration doesn’t depend on it.

Network overview

The three interesting (and one not so interesting) machines on the network are:

• files: This, as the name implies, is a fileserver, LDAP master, KDC and Samba DC rolled into one. It runs OpenLDAP and Heimdal Kerberos on Linux.
• belsunce: This is my MacBook Pro. Being a laptop it sometimes is away from the network.
• maling: This is Rebecca’s Mac Mini. It’s permanently connected to the network, which is distinguishes it from belsunce.
• games: This is a Windows workstation. I mention it only to justify the effort in setting up Samba.

Before all this started, user authentication on the network was a step or two away from a free-for-all but still some distance from true single sign-on. files has almost no user accounts and its PAM configuration is linked into LDAP so when you log on you are using credentials from the directory. games is joined to the Samba domain and authenticates the same users against the same directory. Home shares are exported across the network. belsunce and maling are (were) effectively independent machines. Rebecca and I both have user accounts on both Macs but the UIDs are different on each and do not match the corresponding LDAP accounts, which exist so we can have network filestores shared by Samba. Our home directories exist – individually and independently – on both Macs

This was about to change.