Service:LDAP

From OACISS Systems Wiki
Jump to navigation Jump to search

This is all woefully out of date

List of machine on LDAP vs not on LDAP

(Not out of date)

LDAP-login boxes:

  • Chymera
  • Cerberus
  • Godzuki
  • Frankenstein
  • Werewolf
  • Dracula

Standalone boxes:

  • Omega (472 macpro)
  • Delta (470 macmini)
  • Delphi
  • Alpha (Sameer macpro)

Non-user servers:

  • Motion
  • Fripp

Don't know:

  • Godzilla
  • Castor
  • Pollux


Server Setup

Installed openldap2 using package manager.

Configure LDAP server, /etc/openldap/slapd.conf. 

include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema

pidfile         /var/run/slapd/slapd.pid
argsfile        /var/run/slapd/slapd.args

loglevel        256

password-hash {SSHA}

security ssf=63

TLSCipherSuite          HIGH
TLSCertificateFile      /etc/openldap/slapd-cert.pem
TLSCertificateKeyFile   /etc/openldap/slapd-key.pem

allow bind_v2
disallow bind_anon

access to attrs=userPassword
        by self write
        by * auth

access to attrs=loginShell
        by self write
        by users read

access to attrs=shadowLastChange
        by self write
        by users read

access to *
        by users read
        by * auth

database        bdb

suffix          "dc=nic,dc=uoregon,dc=edu"

rootdn          "cn=admin,dc=nic,dc=uoregon,dc=edu"
rootpw          {SSHA}secret

directory       /var/lib/ldap/nic.uoregon.edu

mode            0600

index           objectClass     eq
index           cn,sn,mail      eq,sub

cachesize       1000

replica host=galway.nic.uoregon.edu:389
        tls=yes
        bindmethod=simple
        binddn="cn=updateadmin,dc=nic,dc=uoregon,dc=edu"
        credentials=secret
replogfile /var/lib/ldap/replog

Created new SSL certificate request for ldap server. 

/usr/share/ssl/misc/CA.pl -newreq

Removed password from key to simplify starting and stopping service. 

openssl rsa -in newreq.pem -out newkey.pem
#Edit newreq.pem to remove key section

Signed new certificate. 

CA.pl -sign

Installed certificate. 

cp newcert.pem /etc/openldap/slapd-cert.pem
cp newkey.pem /etc/openldap/slapd-key.pem
chown root.ldap /etc/openldap/slapd*.pem
chmod 640 /etc/openldap/slapd*.pem

Created base ldif file for domain and organizational units. 

dn: dc=nic,dc=uoregon,dc=edu
objectClass: dcObject
objectClass: organizationalUnit
dc: nic
ou: Neuroinformatics Center

dn: ou=people,dc=nic,dc=uoregon,dc=edu
objectClass: organizationalUnit
ou: people

dn: ou=group,dc=nic,dc=uoregon,dc=edu
objectClass: organizationalUnit
ou: group

Created binddn.ldif for bind account. 

dn: cn=anonymous,dc=nic,dc=uoregon,dc=edu
objectClass: person
cn=anonymous
sn=ymous
userPassword: secret

Inserted ldif files. 

slapadd -v -l base.ldif
slapadd -v -l binddn.ldif

Added ldap ports to firewall. 

/usr/sbin/iptables -A INPUT -p tcp --dport ldap -j ACCEPT
/usr/sbin/iptables -A INPUT -p udp --dport ldap -j ACCEPT
/usr/sbin/iptables -A INPUT -p tcp --dport ldaps -j ACCEPT
/usr/sbin/iptables -A INPUT -p udp --dport ldaps -j ACCEPT

Backup Server Setup

Configured /etc/openldap/slapd.conf 

include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/nis.schema

pidfile         /var/run/slapd/slapd.pid
argsfile        /var/run/slapd/slapd.args

loglevel        256

password-hash {SSHA}

security tls=112,simple_bind=112

TLSCipherSuite          HIGH
TLSCertificateFile      /etc/openldap/slapd-cert.pem
TLSCertificateKeyFile   /etc/openldap/slapd-key.pem

allow bind_v2
disallow bind_anon

access to attrs=userPassword
        by self write
        by * auth

access to attrs=loginShell
        by self write
        by users read

access to attrs=shadowLastChange
        by self write
        by users read

access to *
        by users read
        by * auth

database        bdb

suffix          "dc=nic,dc=uoregon,dc=edu"

rootdn          "cn=updateadmin,dc=nic,dc=uoregon,dc=edu"
rootpw          {SSHA}secret

directory       /var/lib/ldap/nic.uoregon.edu

mode            0600

index           objectClass     eq
index           cn,sn,mail      eq,sub

cachesize       1000

updatedn        "cn=updateadmin,dc=nic,dc=uoregon,dc=edu"
updateref       uri://ldap.nic.uoregon.edu:389

Client Setup

Configured /etc/ldap.conf. 

host    ldap.nic.uoregon.edu
base    dc=nic,dc=uoregon,dc=edu
scope   sub

binddn cn=anonymous,dc=nic,dc=uoregon,dc=edu
bindpw secret

pam_login_attribute     uid
pam_filter              objectclass=posixAccount

nss_base_passwd ou=people,dc=nic,dc=uoregon,dc=edu
nss_base_shadow ou=people,dc=nic,dc=uoregon,dc=edu
nss_base_group  ou=group,dc=nic,dc=uoregon,dc=edu?one

pam_check_host_attr     yes
ssl start_tls
tls_cacertdir /etc/ssl/certs
tls_checkpeer yes

Configured /etc/openldap/ldap.conf 

HOST ldap.nic.uoregon.edu
BASE dc=nic,dc=uoregon,dc=edu
TLS_REQCERT allow

NOTE: SLES 8 combines /etc/ldap.conf and /etc/openldap/ldap.conf into /etc/openldap/ldap.conf. 

host ldap.nic.uoregon.edu
base dc=nic,dc=uoregon,dc=edu
ldap_version 3
binddn cn=anonymous,dc=nic,dc=uoregon,dc=edu
bindpw secret
scope sub
pam_filter objectclass=posixAccount
pam_login_attribute uid
pam_check_host_attr yes
pam_password clear
nss_base_passwd ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_shadow ou=people,dc=nic,dc=uoregon,dc=edu?one
nss_base_group  ou=group,dc=nic,dc=uoregon,dc=edu?one
ssl start_tls
tls_cacertfile /etc/cacert.pem
tls_checkpeer yes
TLS_CACERTDIR /etc/ssl/certs
TLS_REQCERT allow

Configure /etc/nsswitch.conf 

passwd: files ldap
shadow: files ldap
group: files ldap

Configured pam.

Redhat, /etc/pam.d/system-auth 

auth        required      /lib/security/$ISA/pam_env.so
auth        sufficient    /lib/security/$ISA/pam_unix.so likeauth nullok
auth        sufficient    /lib/security/$ISA/pam_ldap.so use_first_pass
auth        required      /lib/security/$ISA/pam_deny.so

account     required      /lib/security/$ISA/pam_unix.so broken_shadow
account     sufficient    /lib/security/$ISA/pam_localuser.so
account     sufficient    /lib/security/$ISA/pam_succeed_if.so uid < 100 quiet
account     [default=bad success=ok user_unknown=ignore authinfo_unavail=ignore
service_err=ignore system_err=ignore] /lib/security/$ISA/pam_ldap.so
account     required      /lib/security/$ISA/pam_permit.so

password    required      /lib/security/$ISA/pam_cracklib.so retry=3 type=
password    sufficient    /lib/security/$ISA/pam_unix.so nullok use_authtok md5
shadow
password    sufficient    /lib/security/$ISA/pam_ldap.so use_authtok
password    required      /lib/security/$ISA/pam_deny.so

session     required      /lib/security/$ISA/pam_limits.so
session     required      /lib/security/$ISA/pam_unix.so
session     optional      /lib/security/$ISA/pam_ldap.so

SUSE, /etc/security/pam_unix2.conf 

auth:   use_ldap nullok
account:        use_ldap
password:       use_ldap md5 nullok
session:        none

Pam changes might require a reboot to take affect.

Maintenance

Start LDAP server. 

/etc/init.d/ldap start

Stop LDAP server. 

/etc/init.d/ldap stop

To renew the ssl cert, follow the instructions in server setup to create the new cert.

Retrieved from "https://systems.nic.uoregon.edu/internal-wiki/index.php?title=Service:LDAP&oldid=3026"