Nic-wiki: /* Replace /etc/ldap.conf */

2022-02-04T23:23:51Z

Replace /etc/ldap.conf

← Older revision		Revision as of 23:23, 4 February 2022
Line 28:		Line 28:
	cat <<EOF >/etc/ldap.conf		cat <<EOF >/etc/ldap.conf
	binddn cn=anonymous,dc=nic,dc=uoregon,dc=edu		binddn cn=anonymous,dc=nic,dc=uoregon,dc=edu
	bindpw ~~cVx75!#L~~		bindpw ________
	pam_check_host_attr yes		pam_check_host_attr yes
	scope sub		scope sub

Brandond at 20:01, 13 April 2009

2009-04-13T20:01:45Z

New page

This page documents the steps necessary to add a new client that will use LDAP accounts and mount the shared home directories over NFS.

== Host Setup Steps ==

These steps are valid for Red Hat 4.x and 5.x systems, Red Hat and derivatives such as CentOS, Scientific Linux, and Rocks.
* For other Linux distributions, follow the AutoFS sections of this page, as well as the [[Procedures:New_LDAP_Client/Manual_Setup|Manual Setup steps]].
* For Solaris , see [[Procedures:New_LDAP_Client/Solaris_10_Setup|Solaris 10 steps]].
* For AIX 5.3, see [[Procedures:New_LDAP_Client/AIX_5.3_Setup|AIX 5.3 Setup steps]].
* AIX 5.2 and earlier hosts do not support OpenLDAP, but can still mount NFS. See the [[Procedures:New_LDAP_Client/AIX_5.2_Setup|AIX 5.2 Setup steps]], and the [[Procedures:New_User/AIX|AIX User Creation Proceedure]] for user synchronization steps.

== Prerequisites ==

Make sure the following requirements are met on the new system:

* Packages
** autofs
** pam_ldap
** nss_ldap
** authconfig
** openldap-clients
* Network
** On Storage Network (172.17.x.x IP address)
** 9000 byte MTU Jumbo frames (for best performance; [[Procedures:New_LDAP_Client#Create_Netapp_AutoFS_map_file|see note below]])

=== Replace /etc/ldap.conf ===
<pre>
cat <<EOF >/etc/ldap.conf
binddn cn=anonymous,dc=nic,dc=uoregon,dc=edu
bindpw cVx75!#L
pam_check_host_attr yes
scope sub
nss_base_passwd ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_shadow ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_group ou=group,dc=nic,dc=uoregon,dc=edu?one
tls_checkpeer no
EOF
</pre>

=== Replace /etc/openldap/ldap.conf ===
<pre>
cat <<EOF >/etc/openldap/ldap.conf
TLS_CHECKPEER no
EOF
</pre>

=== Create Netapp AutoFS map file ===
''' Note:''' If your host does not support jumbo frames, replace 'udp' in these lines with 'tcp', or filesystem operations on NFS paths may fail.
<pre>
cat <<EOF >/etc/auto.netapp
home -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,udp 172.17.8.63:/vol/home
home1 -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,udp 172.17.8.63:/vol/home1
home2 -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,udp 172.17.8.64:/vol/home2
research -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,udp 172.17.8.64:/vol/research
packages -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,udp 172.17.8.64:/vol/packages/ARCH
EOF
sed -i -e "s/ARCH/`uname -i`/" /etc/auto.netapp
</pre>

=== Append Netapp maps to AutoFS master map ===
<pre>
cat <<EOF >>/etc/auto.master
/mnt/netapp /etc/auto.netapp --timeout=1200 --ghost
EOF
</pre>

=== Enable Netapp mounts and add path links ===
<pre>
service autofs reload
ln -sf /mnt/netapp/packages/ /usr/local/packages
ln -sf /mnt/netapp/home/users/ /home/users
</pre>

=== Enable LDAP authentication ===
<pre>
authconfig --update --enablecache --enablepamaccess \
--enableldap --enableldapauth --enableldapssl \
--ldapbasedn=dc=nic,dc=uoregon,dc=edu \
--ldaploadcacert=http://systems.nic.uoregon.edu/ca/NIC-cacert.pem \
--ldapserver=172.17.202.25,172.17.8.66
</pre>

=== Test Configuration ===
If everything is set up right, you should be able to run the following commands, and see some output without any errors or hanging:
<pre>
getent passwd chemadmin
</pre>
<pre>
ls -la /mnt/netapp/home
</pre>

== LDAP Setup Steps ==
In order to enable granular host access control, you must also log into the [https://systems.nic.uoregon.edu/slam/ NIC user control panel], go to the 'Manage Hosts' section, and add an entry for the new system.

The 'Host FQDN' field should match the results of the 'hostname' command when run on the new host. The 'Display Name' field is optional, and is only used when informing the user what hosts they are allowed to log in to, in place of the FQDN. After the host has been added, you may select the entry, click the 'Edit Selected' button, and select which users are allowed to log into the host.

'''Note:''' The functionality of this feature depends on the host's LDAP libraries honoring the 'pam_check_host_attr' option. If it does not, any user with an LDAP account will be able to log in.

[[Category:Proceedure]]

Procedure:New LDAP Client - Revision history

Nic-wiki: /* Replace /etc/ldap.conf */

Brandond at 20:01, 13 April 2009