Procedure:New LDAP Client

This page documents the steps necessary to add a new client that will use LDAP accounts and mount the shared home directories over NFS.

Host Setup Steps

These steps are valid for Red Hat 4.x and 5.x systems, Red Hat and derivatives such as CentOS, Scientific Linux, and Rocks.

• For other Linux distributions, follow the AutoFS sections of this page, as well as the Manual Setup steps.
• For Solaris , see Solaris 10 steps.
• For AIX 5.3, see AIX 5.3 Setup steps.
• AIX 5.2 and earlier hosts do not support OpenLDAP, but can still mount NFS. See the AIX 5.2 Setup steps, and the AIX User Creation Proceedure for user synchronization steps.

Prerequisites

Make sure the following requirements are met on the new system:

• Packages
  • autofs
  • pam_ldap
  • nss_ldap
  • authconfig
  • openldap-clients
• Network
  • On Storage Network (172.17.x.x IP address)
  • 9000 byte MTU Jumbo frames (for best performance; see note below)

Replace /etc/ldap.conf

cat <<EOF >/etc/ldap.conf
binddn cn=anonymous,dc=nic,dc=uoregon,dc=edu
bindpw ________
pam_check_host_attr yes
scope sub
nss_base_passwd ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_shadow ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_group  ou=group,dc=nic,dc=uoregon,dc=edu?one
tls_checkpeer no
EOF

Replace /etc/openldap/ldap.conf

cat <<EOF >/etc/openldap/ldap.conf
TLS_CHECKPEER no
EOF

Create Netapp AutoFS map file

Note: If your host does not support jumbo frames, replace 'udp' in these lines with 'tcp', or filesystem operations on NFS paths may fail.

cat <<EOF >/etc/auto.netapp
home       -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,udp     172.17.8.63:/vol/home
home1      -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,udp     172.17.8.63:/vol/home1
home2      -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,udp     172.17.8.64:/vol/home2
research   -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,udp     172.17.8.64:/vol/research
packages   -fstype=nfs,hard,intr,async,rsize=32768,wsize=32768,nfsvers=3,udp     172.17.8.64:/vol/packages/ARCH
EOF
sed -i -e "s/ARCH/`uname -i`/" /etc/auto.netapp

Append Netapp maps to AutoFS master map

cat <<EOF >>/etc/auto.master
/mnt/netapp     /etc/auto.netapp        --timeout=1200 --ghost
EOF

Enable Netapp mounts and add path links

service autofs reload
ln -sf /mnt/netapp/packages/ /usr/local/packages
ln -sf /mnt/netapp/home/users/ /home/users

Enable LDAP authentication

authconfig --update --enablecache --enablepamaccess \
           --enableldap --enableldapauth --enableldapssl \
           --ldapbasedn=dc=nic,dc=uoregon,dc=edu \
           --ldaploadcacert=http://systems.nic.uoregon.edu/ca/NIC-cacert.pem \
           --ldapserver=172.17.202.25,172.17.8.66

Test Configuration

If everything is set up right, you should be able to run the following commands, and see some output without any errors or hanging:

getent passwd chemadmin

ls -la /mnt/netapp/home

LDAP Setup Steps

In order to enable granular host access control, you must also log into the NIC user control panel, go to the 'Manage Hosts' section, and add an entry for the new system.

The 'Host FQDN' field should match the results of the 'hostname' command when run on the new host. The 'Display Name' field is optional, and is only used when informing the user what hosts they are allowed to log in to, in place of the FQDN. After the host has been added, you may select the entry, click the 'Edit Selected' button, and select which users are allowed to log into the host.

Note: The functionality of this feature depends on the host's LDAP libraries honoring the 'pam_check_host_attr' option. If it does not, any user with an LDAP account will be able to log in.