[CentOS] User accounts management for small office

Thu Apr 21 18:39:58 UTC 2011
Jeff Boyce <jboyce at meridianenv.com>

Greetings -

This may be a little off-topic here so if someone wants to point me to a 
more appropriate mailing list I would appreciate it.

I administer the network for my small company and am preparing to install a 
new server in the next month or so.  It will be running CentOS 6 and 
function primarily as a Samba file server to 10 Windows workstations (XP, 
Vista, 7).  It will also host our OpenVPN server and possibly our FTP 
server; however I am hoping to move our FTP server to a gateway box when the 
new server is installed.

The issue that I would like to be able to resolve when the new server is 
installed, is that currently if a user wants to change the password on their 
Windows workstation, I have to manually update that new password on the 
Linux user account, and also manually change the Samba user account. 
Manually updating the password in three different locations is a minor 
headache that I would like to correct.  I have been researching and reading 
lots of information about account management to try and understand what is 
available, and what would be the best fit for my network size.  Much of what 
I have read is related to larger networks or larger user bases, which seem 
to have a lot of extraneous stuff that would be unnecessary in my small user 
environment.  I looked into OpenLDAP, and have recently been reading about 
Samba/Winbind.  But after encountering the following statement in the Samba 
documentation, I am still lost about what I could, or should, be using.
"A standalone Samba server is an implementation that is not a member of a 
Windows NT4 domain, a Windows 200X Active Directory domain, or a Samba 
domain.  By definition, this means that users and groups will be created and 
controlled locally, and the identity of a network user must match a local 
UNIX/Linux user login. The IDMAP facility is therefore of little to no 
interest, winbind will not be necessary, and the IDMAP facility will not be 
relevant or of interest."

My only goal is to be able to allow my users to change their Windows 
password at their workstation and have it perpetuate through the system so 
that it also changes their Linux User and Samba User account passwords.  I 
don't expect to ever have more than a dozen users, so I want something that 
fits our size network and is simple to administer.  I am not looking for a 
how-to to set something up, but some opinions about what I should consider 
using, and why it would be a good fit to achieve my goal.  I can do the 
additional research to understand configuration once I know what I should be 
researching.  Thanks.  Please cc me directly, as I only get the list in 
daily digest mode.

Jeff Boyce

Meridian Environmental