The Virtualization Cookbook for SLES 10 SP2 - z/VM - IBM

export/unixdata/homedirs \
@hgrp_autohome_admin(rw,no_root_squash,insecure,sync) \
@hgrp_autohome_hosts(rw,root_squash,insecure,sync)
I look forward to going to NFSv4 with kerberos authentication, but we're not there yet.
Regarding automount maps in LDAP, this works very well for us with one exception. The
problem is that there's a significant number of automount map schemas out there, and
different OS's (and different revisions of OS's) use different ones. As we are a fairly
heterogeneous environment, I found it near impossible to keep a master map in LDAP. Right
now we're just keeping a /etc/auto.master or /etc/auto_master on each host.
In order to make the individual map entries work heterogeneously, I had to add several object
classes and a few redundant attributes to each entry. Here's what my home directory
automount map entry looks like:
# ap00375, auto_home, unix.example.com
dn: automountKey=ap00375,automountMapName=auto_home,dc=unix,dc=example,dc=com
automountInformation: linux01.example.com:/vol/vol2/unixhomes-5gb/75/ap00375
cn: ap00375
automountKey: ap00375
objectClass: automount
objectClass: nisNetId
objectClass: top
Regarding heterogeneous clients, we found AIX in particular to be the hardest of our clients to
configure, and Linux the easiest. Insure on AIX that you have the latest available LDAP client
package from IBM. Also be aware that AIX wants to use it's extended LDAP schema rather
than RFC2307, and wants full write access to the LDAP servers from every AIX client.
Despite that, it will work with RFC2307 and read only access. Solaris, like Linux, has an
option to not use an LDAP proxy account at all via anonymous binding, but I never got Solaris
anonymous binding to work.
I recommend making LDAP use TLS or SSL on the wire, in order to keep clear-text
passwords from flying about. Both AIX and Solaris require the server public SSL certificates
to be loaded on every client to do LDAP over TLS or SSL. Linux can be configured to ignore
authenticating the LDAP servers' certificates and proceed with TLS/SSL anyway - this is
convenient, but does open the possibility of man in the middle attacks. In our environment this
isn't a big deal, but it might be in yours.
We've found POSIX group membership management to be one of our more challenging
issues overall. Some older systems (e.g. solaris