Successfully reported this slideshow.
Your SlideShare is downloading. ×

Remotely accessing files in a distributed LDAP+Samba based infrastructure - LibOCon 2020

Ad
Ad
Ad
Ad
Ad
Ad
Ad
Ad
Ad
Ad
Ad
Upcoming SlideShare
Suse Linux Enterprise Sever
Suse Linux Enterprise Sever
Loading in …3
×

Check these out next

1 of 29 Ad

Remotely accessing files in a distributed LDAP+Samba based infrastructure - LibOCon 2020

Download to read offline

A presentation of the "FUSS Remote Access" product. Slides used for LibOCon/OsLo 2020.

A presentation of the "FUSS Remote Access" product. Slides used for LibOCon/OsLo 2020.

Advertisement
Advertisement

More Related Content

Similar to Remotely accessing files in a distributed LDAP+Samba based infrastructure - LibOCon 2020 (20)

Recently uploaded (20)

Advertisement

Remotely accessing files in a distributed LDAP+Samba based infrastructure - LibOCon 2020

  1. 1. Remotely accessing files in a distributed LDAP+Samba-based infrastructure ”Cloud” in a new manner Marco Marinello me@marcomarinello.it
  2. 2. 2 $ whoami ● CS Student @ UniBZ ● Developer / SysAdmin @ continuity.space (Italy) ● Member of TDF ● President of the Linux User Group of Bolzano ● Developer of the FUSS project
  3. 3. 3 CC-BY-SA 4.0 / Markus Meier / FSFE
  4. 4. 4 GDPR Privacy shield Data protection
  5. 5. 5
  6. 6. 6 What’s FUSS? FUSS stands for Free Upgrade for a digitally Sustainable School
  7. 7. 7 ● Launched in 2005 ● Covers 72 schools with 64 servers and 4000 PCs and Laptops ● Both server and client distro ● Selection of didactic software What’s FUSS?
  8. 8. 8
  9. 9. 9 Schools are far
  10. 10. 10 Goal Make users files available remotely
  11. 11. 11 How a school network works?    DC (FUSS) Clients  Kerberos
  12. 12. 12 What’s FUSS Remote Access?  Solution to access your data outside the school network  Online collaboration suite (LOOL)  Private cloud
  13. 13. 13  Samba  LDAP Online
  14. 14. 14 Why this solution?  Data under control (GDPR)  Distributed storage  Same credentials as the school network (SSO)
  15. 15. 15  DC (FUSS)  Remote Access delegate server Single school LAN FUSS private infrastructure Internal ACME/PKI  Private DNS FUSS public infrastructure  Balanced proxy  LibreOffice Online   access.fuss.bz.it Infrastructure
  16. 16. 16 Building LibreOffice online https://wiki.documentfoundation.org/Development/BuildingOnline https://wiki.documentfoundation.org/Development/LibreOffice_Online
  17. 17. 17 Pillars: the ACME protocol “The Automatic Certificate Management Environment (ACME) protocol is a communications protocol for automating interactions between certificate authorities and their users' web servers, allowing the automated deployment of public key infrastructure at very low cost. It was designed by the Internet Security Research Group (ISRG) for their Let's Encrypt service.” (from Wikipedia)
  18. 18. 18 Pillars: certbot Is the software who implements the ACME protocol
  19. 19. 19 Pillars: the ACME protocol ● The agent says to the server which domains he wants to verify (e.g. domain.tld); ● The server returns a token and a path in which he expects this token to be available; ● The agent moves the token in place and the server challenges via HTTP expecting to find the token he gave to the agent; ● If successful, the server signs a CSR uploaded by the agent. The private key is generated on the host and remains on the host.
  20. 20. 20 Pillars: Smallstep ● Toolikit for internal PKI management ● SSH Single-sign-on ● Implementation of ACME server
  21. 21. 21 Pillars: Proxmox
  22. 22. 22 Access path   User  Proxy server WAN  Schools WAN  His files on the school’s server
  23. 23. 23
  24. 24. 24 Deploy strategy 1. Creation of the delegate server  DC (FUSS) Empty Debian 10 VM Virtualization environment  Debian 10 template 
  25. 25. 25 Deploy strategy 2. Delegate server setup FUSS private infrastructure  FUSS RA controller Internal ACME/PKI  DC (FUSS) Single school LAN VM Debian 10 + Docker 
  26. 26. 26 Deploy strategy 3. Orchestration of the central infrastructure FUSSPrivate infrastructure  Private DNS FUSSpublic infrastructure  Balanced proxy   school.access.fuss.bz.it  FUSS RA controller Public DNS
  27. 27. 27 Give me the code! ● https://gitlab.fuss.bz.it/fuss-team/fuss-nc
  28. 28. 28 Want to know more? Feel free to get in touch with me: marinello@libreoffice.org
  29. 29. Thank you! All trademarks mentioned in this presentation belong to their rightful owners: third party trademarks, manufacturers, product or service names, trade names, corporate and company names, sales platform names, product catalogue names, supplier names and dropshipper, mentioned may be trademarks of their respective owners or registered trademarks, of other companies and have been used for explanatory purposes only and for the benefit of the owner, as well as of the end user, without any purpose of profit or infringement of copyright.

×