Procedures:New LDAP Client/Manual Setup - Revision history

Nic-systems at 23:54, 28 November 2011

2011-11-28T23:54:56Z

← Older revision		Revision as of 23:54, 28 November 2011
Line 65:		Line 65:
	== Name Service Cacheing Daemon ==		== Name Service Cacheing Daemon ==
	The NSCD service should be running and set to start on boot.		The NSCD service should be running and set to start on boot.

			== Changes in RHEL/Centos/Scientific Linux 6.x (rough draft) ==
			/etc/ldap.conf no longer exists, modify /etc/pam_ldap.conf and /etc/nslcd.conf instead.

			May need to change pam_sss.so to pam_ldap.so in /etc/pam.d/system-auth.

			In addition to starting NSCD, NSLCD also needs to be started (and set to start at boot).

Brandond at 01:09, 4 April 2009

2009-04-04T01:09:16Z

← Older revision		Revision as of 01:09, 4 April 2009
Line 1:		Line 1:
	This is a subpage of [[Procedures:New_LDAP_Client]]		This is a subpage of [[Procedures:New_LDAP_Client\|New LDAP Client]]

	Authconfig automates the editing of several files. The changes can be made manually, and are listed below:		Authconfig automates the editing of several files. The changes can be made manually, and are listed below:

Brandond at 01:09, 4 April 2009

2009-04-04T01:09:03Z

← Older revision		Revision as of 01:09, 4 April 2009
Line 1:		Line 1:
			This is a subpage of [[Procedures:New_LDAP_Client]]

	Authconfig automates the editing of several files. The changes can be made manually, and are listed below:		Authconfig automates the editing of several files. The changes can be made manually, and are listed below:

Brandond: Procedures:New LDAP Client\Manual Setup moved to Procedures:New LDAP Client/Manual Setup: Wanted a subpage

2009-04-04T01:07:42Z

Procedures:New LDAP Client\Manual Setup moved to Procedures:New LDAP Client/Manual Setup: Wanted a subpage

← Older revision	Revision as of 01:07, 4 April 2009
(No difference)

128.223.202.244 at 01:06, 4 April 2009

2009-04-04T01:06:57Z

New page

Authconfig automates the editing of several files. The changes can be made manually, and are listed below:

== LDAP Client ==
'''/etc/ldap.conf''' should contain settings similar to those in the following section. The '''tls_cacertdir''' setting may be different on your machine; some distros set it to '''/etc/ssl/cacerts'''.
<pre>
binddn cn=anonymous,dc=nic,dc=uoregon,dc=edu
bindpw cVx75!#L
pam_check_host_attr yes
scope sub
nss_base_passwd ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_shadow ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_group ou=group,dc=nic,dc=uoregon,dc=edu?one
tls_checkpeer no
uri ldap://172.17.202.25/ ldap://172.17.8.66/
base dc=nic,dc=uoregon,dc=edu
ssl start_tls
tls_cacertdir /etc/openldap/cacerts
pam_password md5
</pre>

== SSL Certificate ==
In the directory specified by the '''tls_cacertdir''' setting in ldap.conf, run the following commands:
<pre>
wget http://systems.nic.uoregon.edu/ca/NIC-cacert.pem
CACERT_HASH=`openssl x509 -hash -noout -in NIC-cacert.pem`
ln -sf NIC-cacert.pem ${CACERT_HASH}.0
</pre>

== PAM Authentication Stack ==
'''/etc/pam.d/system-auth''' (or your distro's equivalent file) should look like something like the following example. The important lines are the ones that include '''pam_ldap.so'''
<pre>
auth required pam_env.so
auth sufficient pam_unix.so nullok try_first_pass
auth requisite pam_succeed_if.so uid >= 500 quiet
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so

account required pam_unix.so broken_shadow
account sufficient pam_succeed_if.so uid < 500 quiet
account [default=bad success=ok user_unknown=ignore] pam_ldap.so
account required pam_permit.so

password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password sufficient pam_ldap.so use_authtok
password required pam_deny.so

session optional pam_keyinit.so revoke
session required pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required pam_unix.so
session optional pam_ldap.so
</pre>

== Name Service Switch ==
'''/etc/nsswitch.conf''' should have passwd/shadow/group lines that look like the following example.
<pre>
passwd: files ldap
shadow: files ldap
group: files ldap
</pre>

== Name Service Cacheing Daemon ==
The NSCD service should be running and set to start on boot.