[Discuss] Moving servers from NIS to LDAP

[invalid at pizzashack.org (Derek Martin)]

On Wed, Jul 11, 2012 at 05:07:30PM -0400, Jerry Feldman wrote:
> Will I have to change uids and gids This is an issue for our IT people.
> If they wil create a separate OU or LDAP group for us, great. If they
> want to merge is in, that creates a few more issues
> If we get merged in, then I will also have to set up a way to restrict
> access to our servers either by using LDAP or a few other tools that I
> previously mentioned. In most cases, I can do it once and push it to all
> the other servers like I do with automount.

Sorry, I meant to comment on this too...  

The goal of a good IT person should (roughly) be to make things as
easy to manage as possible while still enabling everyone else to make
effective use of computing resources (and most especially, they should
not make your job *harder*, if it can be avoided).  Hopefully they are
that sort.

FWIW, I've found that most sysadmins want to be helpful, but they also
have their own goals.  They tend to like to solve puzzles.  I've found
that if you present them with a(n interesting) problem, rather than
your solution to the problem, they're generally more amenable to
helping you accomplish your goals, and to working with you to find a
solution that's mutually beneficial.

Point being, I suspect ultimately this is something you're just going
to have to negotiate with your IT people.  You said "IBM" -- they're
probably not new to managing LDAP, and I also doubt that your problem
is a new one for them.  Probably they already have some canned
solution which will be forced on you, or maybe you'll get to pick from
a small set of options.  If they're IBM employees, I expect them to
act like robots (I have MANY coworkers who say so, who are
ex-IBM-by-way-of-some-other-startup-that-got-bought-out employees),
but they might behave like monkeys, if you give them a banana.

-- 
Derek D. Martin    http://www.pizzashack.org/   GPG Key ID: 0xDFBEAD02
-=-=-=-=-
This message is posted from an invalid address.  Replying to it will result in
undeliverable mail due to spam prevention.  Sorry for the inconvenience.