Procedures:New LDAP Client/Manual Setup

This is a subpage of New LDAP Client

Authconfig automates the editing of several files. The changes can be made manually, and are listed below:

LDAP Client

/etc/ldap.conf should contain settings similar to those in the following section. The tls_cacertdir setting may be different on your machine; some distros set it to /etc/ssl/cacerts.

binddn cn=anonymous,dc=nic,dc=uoregon,dc=edu
bindpw cVx75!#L
pam_check_host_attr yes
scope sub
nss_base_passwd ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_shadow ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_group  ou=group,dc=nic,dc=uoregon,dc=edu?one
tls_checkpeer no
uri ldap://172.17.202.25/ ldap://172.17.8.66/
base dc=nic,dc=uoregon,dc=edu
ssl start_tls
tls_cacertdir /etc/openldap/cacerts
pam_password md5

SSL Certificate

In the directory specified by the tls_cacertdir setting in ldap.conf, run the following commands:

wget http://systems.nic.uoregon.edu/ca/NIC-cacert.pem
CACERT_HASH=`openssl x509 -hash -noout -in NIC-cacert.pem`
ln -sf NIC-cacert.pem ${CACERT_HASH}.0

PAM Authentication Stack

/etc/pam.d/system-auth (or your distro's equivalent file) should look like something like the following example. The important lines are the ones that include pam_ldap.so

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so

Name Service Switch

/etc/nsswitch.conf should have passwd/shadow/group lines that look like the following example.

passwd:     files ldap
shadow:     files ldap
group:      files ldap

Name Service Cacheing Daemon

The NSCD service should be running and set to start on boot.

Changes in RHEL/Centos/Scientific Linux 6.x (rough draft)

/etc/ldap.conf no longer exists, modify /etc/pam_ldap.conf and /etc/nslcd.conf instead.

May need to change pam_sss.so to pam_ldap.so in /etc/pam.d/system-auth.

In addition to starting NSCD, NSLCD also needs to be started (and set to start at boot).