Service:LDAP

This is all woefully out of date

List of machine on LDAP vs not on LDAP

(Not out of date)

LDAP-login boxes:

• Chymera
• Cerberus
• Godzuki
• Frankenstein
• Werewolf
• Dracula

Standalone boxes:

• Omega (472 macpro)
• Delta (470 macmini)
• Delphi
• Alpha (Sameer macpro)

Non-user servers:

• Motion
• Fripp

Don't know:

• Godzilla
• Castor
• Pollux

Server Setup

Installed openldap2 using package manager.

Configure LDAP server, /etc/openldap/slapd.conf.

include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema

pidfile         /var/run/slapd/slapd.pid
argsfile        /var/run/slapd/slapd.args

loglevel        256

password-hash {SSHA}

security ssf=63

TLSCipherSuite          HIGH
TLSCertificateFile      /etc/openldap/slapd-cert.pem
TLSCertificateKeyFile   /etc/openldap/slapd-key.pem

allow bind_v2
disallow bind_anon

access to attrs=userPassword
        by self write
        by * auth

access to attrs=loginShell
        by self write
        by users read

access to attrs=shadowLastChange
        by self write
        by users read

access to *
        by users read
        by * auth

database        bdb

suffix          "dc=nic,dc=uoregon,dc=edu"

rootdn          "cn=admin,dc=nic,dc=uoregon,dc=edu"
rootpw          {SSHA}secret

directory       /var/lib/ldap/nic.uoregon.edu

mode            0600

index           objectClass     eq
index           cn,sn,mail      eq,sub

cachesize       1000

replica host=galway.nic.uoregon.edu:389
        tls=yes
        bindmethod=simple
        binddn="cn=updateadmin,dc=nic,dc=uoregon,dc=edu"
        credentials=secret
replogfile /var/lib/ldap/replog

Created new SSL certificate request for ldap server.

/usr/share/ssl/misc/CA.pl -newreq

Removed password from key to simplify starting and stopping service.

openssl rsa -in newreq.pem -out newkey.pem
#Edit newreq.pem to remove key section

Signed new certificate.

CA.pl -sign

Installed certificate.

cp newcert.pem /etc/openldap/slapd-cert.pem
cp newkey.pem /etc/openldap/slapd-key.pem
chown root.ldap /etc/openldap/slapd*.pem
chmod 640 /etc/openldap/slapd*.pem

Created base ldif file for domain and organizational units.

dn: dc=nic,dc=uoregon,dc=edu
objectClass: dcObject
objectClass: organizationalUnit
dc: nic
ou: Neuroinformatics Center

dn: ou=people,dc=nic,dc=uoregon,dc=edu
objectClass: organizationalUnit
ou: people

dn: ou=group,dc=nic,dc=uoregon,dc=edu
objectClass: organizationalUnit
ou: group

Created binddn.ldif for bind account.

dn: cn=anonymous,dc=nic,dc=uoregon,dc=edu
objectClass: person
cn=anonymous
sn=ymous
userPassword: secret

Inserted ldif files.

slapadd -v -l base.ldif
slapadd -v -l binddn.ldif

Added ldap ports to firewall.

/usr/sbin/iptables -A INPUT -p tcp --dport ldap -j ACCEPT
/usr/sbin/iptables -A INPUT -p udp --dport ldap -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport ldaps -j ACCEPT
/usr/sbin/iptables -A INPUT -p udp --dport ldaps -j ACCEPT

Backup Server Setup

Configured /etc/openldap/slapd.conf

include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema

pidfile         /var/run/slapd/slapd.pid
argsfile        /var/run/slapd/slapd.args

loglevel        256

password-hash {SSHA}

security tls=112,simple_bind=112

TLSCipherSuite          HIGH
TLSCertificateFile      /etc/openldap/slapd-cert.pem
TLSCertificateKeyFile   /etc/openldap/slapd-key.pem

allow bind_v2
disallow bind_anon

access to attrs=userPassword
        by self write
        by * auth

access to attrs=loginShell
        by self write
        by users read

access to attrs=shadowLastChange
        by self write
        by users read

access to *
        by users read
        by * auth

database        bdb

suffix          "dc=nic,dc=uoregon,dc=edu"

rootdn          "cn=updateadmin,dc=nic,dc=uoregon,dc=edu"
rootpw          {SSHA}secret

directory       /var/lib/ldap/nic.uoregon.edu

mode            0600

index           objectClass     eq
index           cn,sn,mail      eq,sub

cachesize       1000

updatedn        "cn=updateadmin,dc=nic,dc=uoregon,dc=edu"
updateref       uri://ldap.nic.uoregon.edu:389

Client Setup

Configured /etc/ldap.conf.

host    ldap.nic.uoregon.edu
base    dc=nic,dc=uoregon,dc=edu
scope   sub

binddn cn=anonymous,dc=nic,dc=uoregon,dc=edu
bindpw secret

pam_login_attribute     uid
pam_filter              objectclass=posixAccount

nss_base_passwd ou=people,dc=nic,dc=uoregon,dc=edu
nss_base_shadow ou=people,dc=nic,dc=uoregon,dc=edu
nss_base_group  ou=group,dc=nic,dc=uoregon,dc=edu?one

pam_check_host_attr     yes
ssl start_tls
tls_cacertdir /etc/ssl/certs
tls_checkpeer yes

Configured /etc/openldap/ldap.conf

HOST ldap.nic.uoregon.edu
BASE dc=nic,dc=uoregon,dc=edu
TLS_REQCERT allow

NOTE: SLES 8 combines /etc/ldap.conf and /etc/openldap/ldap.conf into /etc/openldap/ldap.conf.

host ldap.nic.uoregon.edu
base dc=nic,dc=uoregon,dc=edu
ldap_version 3
binddn cn=anonymous,dc=nic,dc=uoregon,dc=edu
bindpw secret
scope sub
pam_filter objectclass=posixAccount
pam_login_attribute uid
pam_check_host_attr yes
pam_password clear
nss_base_passwd ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_shadow ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_group  ou=group,dc=nic,dc=uoregon,dc=edu?one
ssl start_tls
tls_cacertfile /etc/cacert.pem
tls_checkpeer yes
TLS_CACERTDIR /etc/ssl/certs
TLS_REQCERT allow

Configure /etc/nsswitch.conf

passwd: files ldap
shadow: files ldap
group: files ldap

Configured pam.

Redhat, /etc/pam.d/system-auth

auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient    /lib/security/$ISA/pam_ldap.so use_first_pass
auth        required      /lib/security/$ISA/pam_deny.so

account     required      /lib/security/$ISA/pam_unix.so broken_shadow
account     sufficient    /lib/security/$ISA/pam_localuser.so
account     sufficient    /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet
account     [default=bad success=ok user_unknown=ignore authinfo_unavail=ignore
service_err=ignore system_err=ignore] /lib/security/$ISA/pam_ldap.so
account     required      /lib/security/$ISA/pam_permit.so

password    required      /lib/security/$ISA/pam_cracklib.so retry=3 type=
password    sufficient    /lib/security/$ISA/pam_unix.so nullok use_authtok md5
shadow
password    sufficient    /lib/security/$ISA/pam_ldap.so use_authtok
password    required      /lib/security/$ISA/pam_deny.so

session     required      /lib/security/$ISA/pam_limits.so
session     required      /lib/security/$ISA/pam_unix.so
session     optional      /lib/security/$ISA/pam_ldap.so

SUSE, /etc/security/pam_unix2.conf

auth:   use_ldap nullok
account:        use_ldap
password:       use_ldap md5 nullok
session:        none

Pam changes might require a reboot to take affect.

Maintenance

Start LDAP server.

/etc/init.d/ldap start

Stop LDAP server.

/etc/init.d/ldap stop

To renew the ssl cert, follow the instructions in server setup to create the new cert.