Nic-systems: Redirecting to Service:LDAP

2006-08-02T01:47:49Z

128.223.202.180: /* Client Setup */

2006-08-01T19:23:15Z

Client Setup

← Older revision		Revision as of 19:23, 1 August 2006
Line 236:		Line 236:
	</pre>		</pre>

	'''NOTE''': SLES 8 combines /etc/ldap.conf and /etc/openldap/ldap.conf into /etc/openldap/ldap.conf.		'''NOTE:''' SLES 8 combines /etc/ldap.conf and /etc/openldap/ldap.conf into /etc/openldap/ldap.conf.

	<pre>		<pre>

128.223.202.180: /* Client Setup */

2006-08-01T19:23:06Z

Client Setup

← Older revision		Revision as of 19:23, 1 August 2006
Line 236:		Line 236:
	</pre>		</pre>

	''NOTE: SLES 8 combines /etc/ldap.conf and /etc/openldap/ldap.conf into /etc/openldap/ldap.conf.''		'''NOTE''': SLES 8 combines /etc/ldap.conf and /etc/openldap/ldap.conf into /etc/openldap/ldap.conf.

	<pre>		<pre>

128.223.202.180: /* Client Setup */

2006-08-01T19:22:49Z

Client Setup

← Older revision		Revision as of 19:22, 1 August 2006
Line 224:		Line 224:
	pam_check_host_attr yes		pam_check_host_attr yes
	ssl start_tls		ssl start_tls
	~~tls_cacertfile~~ /etc/~~cacert.pem~~		tls_cacertdir /etc/ssl/certs
	tls_checkpeer yes		tls_checkpeer yes
	</pre>		</pre>
Line 255:		Line 255:
	tls_cacertfile /etc/cacert.pem		tls_cacertfile /etc/cacert.pem
	tls_checkpeer yes		tls_checkpeer yes
	~~TLS_CACERT~~ /etc/~~cacert.pem~~		TLS_CACERTDIR /etc/ssl/certs
	TLS_REQCERT allow		TLS_REQCERT allow
	</pre>		</pre>

128.223.202.180: /* Client Setup */

2006-08-01T19:22:07Z

Client Setup

← Older revision		Revision as of 19:22, 1 August 2006
Line 236:		Line 236:
	</pre>		</pre>

	''NOTE:'' SLES 8 combines /etc/ldap.conf and /etc/openldap/ldap.conf into /etc/openldap/ldap.conf.		''NOTE: SLES 8 combines /etc/ldap.conf and /etc/openldap/ldap.conf into /etc/openldap/ldap.conf.''

	<pre>		<pre>

128.223.202.180: /* Client Setup */

2006-08-01T19:21:09Z

Client Setup

← Older revision		Revision as of 19:21, 1 August 2006
Line 236:		Line 236:
	</pre>		</pre>

	""NOTE"" SLES 8 combines /etc/ldap.conf and /etc/openldap/ldap.conf into /etc/openldap/ldap.conf.		''NOTE:'' SLES 8 combines /etc/ldap.conf and /etc/openldap/ldap.conf into /etc/openldap/ldap.conf.

	<pre>		<pre>

128.223.202.180 at 19:20, 1 August 2006

2006-08-01T19:20:36Z

New page

[[[TableOfContents]]]

== Server Setup ==

Installed openldap2 using package manager.

Configure LDAP server, /etc/openldap/slapd.conf.

<pre>
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema

pidfile /var/run/slapd/slapd.pid
argsfile /var/run/slapd/slapd.args

loglevel 256

password-hash {SSHA}

security ssf=63

TLSCipherSuite HIGH
TLSCertificateFile /etc/openldap/slapd-cert.pem
TLSCertificateKeyFile /etc/openldap/slapd-key.pem

allow bind_v2
disallow bind_anon

access to attrs=userPassword
by self write
by * auth

access to attrs=loginShell
by self write
by users read

access to attrs=shadowLastChange
by self write
by users read

access to *
by users read
by * auth

database bdb

suffix "dc=nic,dc=uoregon,dc=edu"

rootdn "cn=admin,dc=nic,dc=uoregon,dc=edu"
rootpw {SSHA}secret

directory /var/lib/ldap/nic.uoregon.edu

mode 0600

index objectClass eq
index cn,sn,mail eq,sub

cachesize 1000

replica host=galway.nic.uoregon.edu:389
tls=yes
bindmethod=simple
binddn="cn=updateadmin,dc=nic,dc=uoregon,dc=edu"
credentials=secret
replogfile /var/lib/ldap/replog
</pre>

Created new SSL certificate request for ldap server.

<pre>
/usr/share/ssl/misc/CA.pl -newreq
</pre>

Removed password from key to simplify starting and stopping service.

<pre>
openssl rsa -in newreq.pem -out newkey.pem
#Edit newreq.pem to remove key section
</pre>

Signed new certificate.

<pre>
CA.pl -sign
</pre>

Installed certificate.

<pre>
cp newcert.pem /etc/openldap/slapd-cert.pem
cp newkey.pem /etc/openldap/slapd-key.pem
chown root.ldap /etc/openldap/slapd*.pem
chmod 640 /etc/openldap/slapd*.pem
</pre>

Created base ldif file for domain and organizational units.

<pre>
dn: dc=nic,dc=uoregon,dc=edu
objectClass: dcObject
objectClass: organizationalUnit
dc: nic
ou: Neuroinformatics Center

dn: ou=people,dc=nic,dc=uoregon,dc=edu
objectClass: organizationalUnit
ou: people

dn: ou=group,dc=nic,dc=uoregon,dc=edu
objectClass: organizationalUnit
ou: group
</pre>

Created binddn.ldif for bind account.

<pre>
dn: cn=anonymous,dc=nic,dc=uoregon,dc=edu
objectClass: person
cn=anonymous
sn=ymous
userPassword: secret
</pre>

Inserted ldif files.

<pre>
slapadd -v -l base.ldif
slapadd -v -l binddn.ldif
</pre>

Added ldap ports to firewall.

<pre>
/usr/sbin/iptables -A INPUT -p tcp --dport ldap -j ACCEPT
/usr/sbin/iptables -A INPUT -p udp --dport ldap -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport ldaps -j ACCEPT
/usr/sbin/iptables -A INPUT -p udp --dport ldaps -j ACCEPT
</pre>

== Backup Server Setup ==

Configured /etc/openldap/slapd.conf

<pre>
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema

pidfile /var/run/slapd/slapd.pid
argsfile /var/run/slapd/slapd.args

loglevel 256

password-hash {SSHA}

security tls=112,simple_bind=112

TLSCipherSuite HIGH
TLSCertificateFile /etc/openldap/slapd-cert.pem
TLSCertificateKeyFile /etc/openldap/slapd-key.pem

allow bind_v2
disallow bind_anon

access to attrs=userPassword
by self write
by * auth

access to attrs=loginShell
by self write
by users read

access to attrs=shadowLastChange
by self write
by users read

access to *
by users read
by * auth

database bdb

suffix "dc=nic,dc=uoregon,dc=edu"

rootdn "cn=updateadmin,dc=nic,dc=uoregon,dc=edu"
rootpw {SSHA}zbC3FDhzsPtR+vJTjXlp4HEF1mn0ZN2M

directory /var/lib/ldap/nic.uoregon.edu

mode 0600

index objectClass eq
index cn,sn,mail eq,sub

cachesize 1000

updatedn "cn=updateadmin,dc=nic,dc=uoregon,dc=edu"
updateref uri://ldap.nic.uoregon.edu:389
</pre>

== Client Setup ==

Configured /etc/ldap.conf.

<pre>
host ldap.nic.uoregon.edu
base dc=nic,dc=uoregon,dc=edu
scope sub

binddn cn=anonymous,dc=nic,dc=uoregon,dc=edu
bindpw secret

pam_login_attribute uid
pam_filter objectclass=posixAccount

nss_base_passwd ou=people,dc=nic,dc=uoregon,dc=edu
nss_base_shadow ou=people,dc=nic,dc=uoregon,dc=edu
nss_base_group ou=group,dc=nic,dc=uoregon,dc=edu?one

pam_check_host_attr yes
ssl start_tls
tls_cacertfile /etc/cacert.pem
tls_checkpeer yes
</pre>

Configured /etc/openldap/ldap.conf

<pre>
HOST ldap.nic.uoregon.edu
BASE dc=nic,dc=uoregon,dc=edu
TLS_REQCERT allow
</pre>

""NOTE"" SLES 8 combines /etc/ldap.conf and /etc/openldap/ldap.conf into /etc/openldap/ldap.conf.

<pre>
host ldap.nic.uoregon.edu
base dc=nic,dc=uoregon,dc=edu
ldap_version 3
binddn cn=anonymous,dc=nic,dc=uoregon,dc=edu
bindpw secret
scope sub
pam_filter objectclass=posixAccount
pam_login_attribute uid
pam_check_host_attr yes
pam_password clear
nss_base_passwd ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_shadow ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_group ou=group,dc=nic,dc=uoregon,dc=edu?one
ssl start_tls
tls_cacertfile /etc/cacert.pem
tls_checkpeer yes
TLS_CACERT /etc/cacert.pem
TLS_REQCERT allow
</pre>

Configure /etc/nsswitch.conf

<pre>
passwd: files ldap
shadow: files ldap
group: files ldap
</pre>

Configured pam.

Redhat, /etc/pam.d/system-auth

<pre>
auth required /lib/security/$ISA/pam_env.so
auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok
auth sufficient /lib/security/$ISA/pam_ldap.so use_first_pass
auth required /lib/security/$ISA/pam_deny.so

account required /lib/security/$ISA/pam_unix.so broken_shadow
account sufficient /lib/security/$ISA/pam_localuser.so
account sufficient /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet
account [default=bad success=ok user_unknown=ignore authinfo_unavail=ignore
service_err=ignore system_err=ignore] /lib/security/$ISA/pam_ldap.so
account required /lib/security/$ISA/pam_permit.so

password required /lib/security/$ISA/pam_cracklib.so retry=3 type=
password sufficient /lib/security/$ISA/pam_unix.so nullok use_authtok md5
shadow
password sufficient /lib/security/$ISA/pam_ldap.so use_authtok
password required /lib/security/$ISA/pam_deny.so

session required /lib/security/$ISA/pam_limits.so
session required /lib/security/$ISA/pam_unix.so
session optional /lib/security/$ISA/pam_ldap.so
</pre>

SUSE, /etc/security/pam_unix2.conf

<pre>
auth: use_ldap nullok
account: use_ldap
password: use_ldap md5 nullok
session: none
</pre>

Pam changes might require a reboot to take affect.

== Maintenance ==

Start LDAP server.

<pre>
/etc/init.d/ldap start
</pre>

Stop LDAP server.

<pre>
/etc/init.d/ldap stop
</pre>

To renew the ssl cert, follow the instructions in server setup to create the new cert.

LDAP - Revision history

Nic-systems: Redirecting to Service:LDAP

128.223.202.180: /* Client Setup */

128.223.202.180: /* Client Setup */

128.223.202.180: /* Client Setup */

128.223.202.180: /* Client Setup */

128.223.202.180: /* Client Setup */

128.223.202.180 at 19:20, 1 August 2006