LDAP: Difference between revisions

From OACISS Systems Wiki
Jump to navigation Jump to search
(Redirecting to Service:LDAP)
 
(3 intermediate revisions by one other user not shown)
Line 1: Line 1:
[[[TableOfContents]]]
#REDIRECT [[Service:LDAP]]
 
== Server Setup ==
 
Installed openldap2 using package manager.
 
Configure LDAP server, /etc/openldap/slapd.conf.
 
<pre>
include        /etc/openldap/schema/core.schema
include        /etc/openldap/schema/cosine.schema
include        /etc/openldap/schema/inetorgperson.schema
include        /etc/openldap/schema/nis.schema
 
pidfile        /var/run/slapd/slapd.pid
argsfile        /var/run/slapd/slapd.args
 
loglevel        256
 
password-hash {SSHA}
 
security ssf=63
 
TLSCipherSuite          HIGH
TLSCertificateFile      /etc/openldap/slapd-cert.pem
TLSCertificateKeyFile  /etc/openldap/slapd-key.pem
 
allow bind_v2
disallow bind_anon
 
access to attrs=userPassword
        by self write
        by * auth
 
access to attrs=loginShell
        by self write
        by users read
 
access to attrs=shadowLastChange
        by self write
        by users read
 
access to *
        by users read
        by * auth
 
database        bdb
 
suffix          "dc=nic,dc=uoregon,dc=edu"
 
rootdn          "cn=admin,dc=nic,dc=uoregon,dc=edu"
rootpw          {SSHA}secret
 
directory      /var/lib/ldap/nic.uoregon.edu
 
mode            0600
 
index          objectClass    eq
index          cn,sn,mail      eq,sub
 
cachesize      1000
 
replica host=galway.nic.uoregon.edu:389
        tls=yes
        bindmethod=simple
        binddn="cn=updateadmin,dc=nic,dc=uoregon,dc=edu"
        credentials=secret
replogfile /var/lib/ldap/replog
</pre>
 
Created new SSL certificate request for ldap server.
 
<pre>
/usr/share/ssl/misc/CA.pl -newreq
</pre>
 
Removed password from key to simplify starting and stopping service.
 
<pre>
openssl rsa -in newreq.pem -out newkey.pem
#Edit newreq.pem to remove key section
</pre>
 
Signed new certificate.
 
<pre>
CA.pl -sign
</pre>
 
Installed certificate.
 
<pre>
cp newcert.pem /etc/openldap/slapd-cert.pem
cp newkey.pem /etc/openldap/slapd-key.pem
chown root.ldap /etc/openldap/slapd*.pem
chmod 640 /etc/openldap/slapd*.pem
</pre>
 
Created base ldif file for domain and organizational units.
 
<pre>
dn: dc=nic,dc=uoregon,dc=edu
objectClass: dcObject
objectClass: organizationalUnit
dc: nic
ou: Neuroinformatics Center
 
dn: ou=people,dc=nic,dc=uoregon,dc=edu
objectClass: organizationalUnit
ou: people
 
dn: ou=group,dc=nic,dc=uoregon,dc=edu
objectClass: organizationalUnit
ou: group
</pre>
 
Created binddn.ldif for bind account.
 
<pre>
dn: cn=anonymous,dc=nic,dc=uoregon,dc=edu
objectClass: person
cn=anonymous
sn=ymous
userPassword: secret
</pre>
 
Inserted ldif files.
 
<pre>
slapadd -v -l base.ldif
slapadd -v -l binddn.ldif
</pre>
 
Added ldap ports to firewall.
 
<pre>
/usr/sbin/iptables -A INPUT -p tcp --dport ldap -j ACCEPT
/usr/sbin/iptables -A INPUT -p udp --dport ldap -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport ldaps -j ACCEPT
/usr/sbin/iptables -A INPUT -p udp --dport ldaps -j ACCEPT
</pre>
 
== Backup Server Setup ==
 
Configured /etc/openldap/slapd.conf
 
<pre>
include        /etc/openldap/schema/core.schema
include        /etc/openldap/schema/cosine.schema
include        /etc/openldap/schema/inetorgperson.schema
include        /etc/openldap/schema/nis.schema
 
pidfile        /var/run/slapd/slapd.pid
argsfile        /var/run/slapd/slapd.args
 
loglevel        256
 
password-hash {SSHA}
 
security tls=112,simple_bind=112
 
TLSCipherSuite          HIGH
TLSCertificateFile      /etc/openldap/slapd-cert.pem
TLSCertificateKeyFile  /etc/openldap/slapd-key.pem
 
allow bind_v2
disallow bind_anon
 
access to attrs=userPassword
        by self write
        by * auth
 
access to attrs=loginShell
        by self write
        by users read
 
access to attrs=shadowLastChange
        by self write
        by users read
 
access to *
        by users read
        by * auth
 
database        bdb
 
suffix          "dc=nic,dc=uoregon,dc=edu"
 
rootdn          "cn=updateadmin,dc=nic,dc=uoregon,dc=edu"
rootpw          {SSHA}zbC3FDhzsPtR+vJTjXlp4HEF1mn0ZN2M
 
directory      /var/lib/ldap/nic.uoregon.edu
 
mode            0600
 
index          objectClass    eq
index          cn,sn,mail      eq,sub
 
cachesize      1000
 
updatedn        "cn=updateadmin,dc=nic,dc=uoregon,dc=edu"
updateref      uri://ldap.nic.uoregon.edu:389
</pre>
 
== Client Setup ==
 
Configured /etc/ldap.conf.
 
<pre>
host    ldap.nic.uoregon.edu
base    dc=nic,dc=uoregon,dc=edu
scope  sub
 
binddn cn=anonymous,dc=nic,dc=uoregon,dc=edu
bindpw secret
 
pam_login_attribute    uid
pam_filter              objectclass=posixAccount
 
nss_base_passwd ou=people,dc=nic,dc=uoregon,dc=edu
nss_base_shadow ou=people,dc=nic,dc=uoregon,dc=edu
nss_base_group  ou=group,dc=nic,dc=uoregon,dc=edu?one
 
pam_check_host_attr    yes
ssl start_tls
tls_cacertfile /etc/cacert.pem
tls_checkpeer yes
</pre>
 
Configured /etc/openldap/ldap.conf
 
<pre>
HOST ldap.nic.uoregon.edu
BASE dc=nic,dc=uoregon,dc=edu
TLS_REQCERT allow
</pre>
 
''NOTE: SLES 8 combines /etc/ldap.conf and /etc/openldap/ldap.conf into /etc/openldap/ldap.conf.''
 
<pre>
host ldap.nic.uoregon.edu
base dc=nic,dc=uoregon,dc=edu
ldap_version 3
binddn cn=anonymous,dc=nic,dc=uoregon,dc=edu
bindpw secret
scope sub
pam_filter objectclass=posixAccount
pam_login_attribute uid
pam_check_host_attr yes
pam_password clear
nss_base_passwd ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_shadow ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_group  ou=group,dc=nic,dc=uoregon,dc=edu?one
ssl start_tls
tls_cacertfile /etc/cacert.pem
tls_checkpeer yes
TLS_CACERT /etc/cacert.pem
TLS_REQCERT allow
</pre>
 
Configure /etc/nsswitch.conf
 
<pre>
passwd: files ldap
shadow: files ldap
group: files ldap
</pre>
 
Configured pam.
 
Redhat, /etc/pam.d/system-auth
 
<pre>
auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient    /lib/security/$ISA/pam_ldap.so use_first_pass
auth        required      /lib/security/$ISA/pam_deny.so
 
account    required      /lib/security/$ISA/pam_unix.so broken_shadow
account    sufficient    /lib/security/$ISA/pam_localuser.so
account    sufficient    /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet
account    [default=bad success=ok user_unknown=ignore authinfo_unavail=ignore
service_err=ignore system_err=ignore] /lib/security/$ISA/pam_ldap.so
account    required      /lib/security/$ISA/pam_permit.so
 
password    required      /lib/security/$ISA/pam_cracklib.so retry=3 type=
password    sufficient    /lib/security/$ISA/pam_unix.so nullok use_authtok md5
shadow
password    sufficient    /lib/security/$ISA/pam_ldap.so use_authtok
password    required      /lib/security/$ISA/pam_deny.so
 
session    required      /lib/security/$ISA/pam_limits.so
session    required      /lib/security/$ISA/pam_unix.so
session    optional      /lib/security/$ISA/pam_ldap.so
</pre>
 
SUSE, /etc/security/pam_unix2.conf
 
<pre>
auth:  use_ldap nullok
account:        use_ldap
password:      use_ldap md5 nullok
session:        none
</pre>
 
Pam changes might require a reboot to take affect.
 
== Maintenance ==
 
Start LDAP server.
 
<pre>
/etc/init.d/ldap start
</pre>
 
Stop LDAP server.
 
<pre>
/etc/init.d/ldap stop
</pre>
 
To renew the ssl cert, follow the instructions in server setup to create the new cert.

Latest revision as of 01:47, 2 August 2006

Redirect to:

Retrieved from "https://systems.nic.uoregon.edu/internal-wiki/index.php?title=LDAP&oldid=1516"