Dynamic login for multiple users
http://ajdiaz.me/doc/2011/06031-dynamic-login.txt
Version: 2011-06-03



Few years ago I was working in design of a large cluster of systems to
perform some actions (solving some mathematical models, sharding
database…). From the point of view of the systems, I had to deal with a
number of pesky troubles. One of them was the user management.

Since I had more than one hundred of hosts, and this number could be grow up
in short, and I’ve a number of users which need to access to all hosts, I
need to think in a way to easy user management. Actually user management is,
in my opinion a pain in the butt. If you ve a central user directory, you
need to deal with a big and fat single point of failure, so you need to
create some kind of HA service for this directory. And if you ve systems
around the world, then you need to replicate the user data in different
directories and keep them synchronized. If it is not the hell, it must be
very similar.

Dealing with user managemet is a royal hassle for system administrators in
every place, but in the cloud (i.e. a number of hosts distributed around the
world), it’s also a punishment. So, I need to solve (almost in part) this
problem before moving forward in my deployment. I do not need a full user
management really, just a basic UID mapping and a way to authenticate users
(for which I could use the old-and-friendly authorized_keys).

So, How can I manage a big number of users in a single way, and to be
effective in a distributed environment? That’s not a simple questions, and
of course each implementation has its own solution, from authentication
services to suites of scripts. Anyway, I was looking for a simple to manage
ones, cause of I was the responsible to manage the entire environment and
I’m too lazy too ;)

Thinking about the problem, I imagine a system without any user, let’s
imaging that there are just one user, and any other user is just an alias for
the first one. It could be easy to manage, because we only need one UID, but
we need to solve the alias mapping.
Here is when libnss_map join into the game. The libnss_map is a library
designed to be used with GNU NSS service. The NSS allows the system to get
user credentials from many sources, which can be configured easy from the
/etc/nsswitch.conf file.

For example, we can configure our system in the following way:

passwd:      files map
shadow:      files map
group:       files map
So, for each user to get credentials NSS will lookup in standard files first,
and then using the map module (libnss_map).The map module works as the flow
diagram shows.

Flow diagram of how get credentials works with libnss_map

As you can see in the diagram there are two major steps in lookup. The first
one is the responsible to map an user to a virtual one. The virtual user is
static, and it’s defined in /etc/nssmap.conf. This file has the same syntax
like passwd does. For example:

virtual:x:10000:10000:,,,:/home/:/secure_shell

Which means that any user who does not exists in /etc/passwd will be mapped
into this one, with UID 10000.

Okay, sounds good, but there are a lot questions yet. What about the
password? What about the home dir?

Well, I do not find a good solution for password, so nssmap will return a
masked password (account is enabled, but password will be unpredictable), and
I authenticate the user using other methods via PAM, or public keys via SSH.

Home directory is easier. The home directory field in the user definition
(inside /etc/nssmap.conf file) is used as prefix, and it will be completed
with the user name (the name of the user which is intended to login, not the
virtual one). So, for example, for the hypothetical user “sample”, the
effective home directory will be “/home/sample”, because “/home/” is
the prefix. Please note that the end slash is mandatory in current
implementation.

Finally I need to solve another big problem: if two users has the same UID
then both can change the same files, or delete the files of other
“virtual” user. How can we solve it? There are not single answer, not
easy afterall. In my case I use special shell, which
ensure that the user cannot remove, touch or even read files in any path into
/home except his own home directory, but it’s not a full solution yet.

Here is an example using nss map:

host ~ # sudo su - test
No directory, logging in with HOME=/
test@host / $ id
uid=10000(virtual) gid=10000(virtual) groups=10000(virtual)