Systems and Network Management

Setting Up Local (Non-LDAP) Accounts

1 Background

When you configure your computer to use ldap for authentication using the program authconfig, a program called the automounter will control access to the /home directory, and will attempt to mount a network drive whenever you access any subdirectory of /home. This prevents you from creating local user accounts with home directories under /home. The solution is to put local users under another directory, such as /home2, and configure useradd to create new accounts there instead. Your ldap account will be under /home, and your local accounts will be under /home2.

2 Procedure

1. Switch to a local console with [figure: Alt-Ctrl-F1]and log in as root.

2. Create a new directory under which all new local home directories should go:

# mkdir /home2

3. Change the default base for the home directories created by useradd:

# useradd -D -b /home2

See the documentation for useradd for more details: man useradd

4…. then finally switch back to the X console with [figure: Alt-Ctrl-F7], and log into your local account. Now you can log into both your ldap account and your local account. Any new accounts created using useradd will be local user accounts, and their home directories will appear under /home2.

5. Warning: There is one problem with this scheme; useradd will, by default, select a user id number greater than that of any user on the system. This will be in the ldap server. However, as new accounts are added to the ldap server, there will be a user id conflict between your local accounts and these future ldap accounts. A solution is to specify the user id number manually as part of the useradd command, with the -u option. You would need to choose a user id number higher than any others in your password file, but lower than about 2000, since the ldap accounts have user id numbers of 2000 and above.

Another (perhaps better) approach is to turn the ldap authentication off temporarily with authconfig, create a number of local accounts, then turn ldap authentication back on with authconfig.

Nick Urbanik <nicku(at)nicku.org>  ver. 1.2