LDAP - Revision history

Bigfoot65 at 03:34, 18 June 2017

2017-06-18T03:34:50Z

Bigfoot65: /* Update slapd.conf */

2012-07-17T21:13:34Z

Update slapd.conf

Bigfoot65: /* Update slapd.conf */

2012-07-17T21:13:20Z

Update slapd.conf

Gboudreau at 17:50, 10 May 2010

2010-05-10T17:50:25Z

Gboudreau at 15:17, 10 May 2010

2010-05-10T15:17:56Z

Gboudreau at 15:16, 10 May 2010

2010-05-10T15:16:43Z

Gboudreau at 14:46, 10 May 2010

2010-05-10T14:46:15Z

Gboudreau: Created page with '==Install prerequisites==
yum -y in…'

2010-05-10T14:15:49Z

Created page with '==Install prerequisites== <div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;"> yum -y in…'

New page

==Install prerequisites==
<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
yum -y install openldap openldap-servers openldap-clients migrationtools
</div>

==Update slapd.conf==
<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
DOMAIN=`mysql -u amahihda -pAmahiHDARulez -e "select value from settings where name = 'domain'" hda_production | grep -v value`<br/>
SUFFIX=`echo '<?php $domain = explode(".", $argv[1]); echo "dc=". implode(",dc=", $domain); ?>' | php -- $DOMAIN`<br/>
<br/>
cd /etc/openldap<br/>
<br/>
mv slapd.conf.bak slapd.conf<br/>
POS=`grep -n "# allow onl. rootdn to read the monitor" slapd.conf | awk -F':' '{print $1}'`<br/>
head -n `echo $POS-1|bc` slapd.conf > slapd.conf.new && mv -f slapd.conf.new slapd.conf<br/>
<br/>
sed --in-place -e "s/suffix.*.dc=my-domain,dc=com./suffix \"$SUFFIX\"/" slapd.conf<br/>
sed --in-place -e "s/rootdn.*.cn=Manager,dc=my-domain,dc=com./rootdn \"cn=root,$SUFFIX\"/" slapd.conf<br/>
sed --in-place -e "s/# rootpw.*crypt.*/rootpw {MD5}ISMvKXpXpadDiUoOSoAfww==\npassword-hash {crypt}\npassword-crypt-salt-format \"\$1\$%.8s\"/" slapd.conf<br/>
<br/>
cat >> slapd.conf <<'EOF'<br/>
access to dn.regex=".*,$SUFFIX" attrs=userPassword
by dn="cn=root,$SUFFIX" write
by self write
by * auth

access to dn.regex=".*,$SUFFIX" attrs=mail
by dn="cn=root,$SUFFIX" write
by self write
by * read

access to dn.regex=".*,ou=People,$SUFFIX"
by * read

access to dn.regex=".*,$SUFFIX"
by self write
by * read
EOF<br/>
sed --in-place -e "s/\$SUFFIX/$SUFFIX/" slapd.conf
</div>

==Add authorizedService schema==
<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
cat > /etc/openldap/schema/ldapns.schema <<'EOF'<br/>
attributetype ( 1.3.6.1.4.1.5322.17.2.1 NAME 'authorizedService'
DESC 'IANA GSS-API authorized service name'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )

objectclass ( 1.3.6.1.4.1.5322.17.1.1 NAME 'authorizedServiceObject'
DESC 'Auxiliary object class for adding authorizedService attribute'
SUP top
AUXILIARY
MAY authorizedService )
EOF

echo "include /etc/openldap/schema/ldapns.schema" >> slapd.conf
</div>

==Setup DB_CONFIG==
<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
cp /usr/share/doc/openldap-servers-*/DB_CONFIG.example /var/lib/ldap/DB_CONFIG<br/>
chown -R ldap:ldap /var/lib/ldap/
</div>

==Disable slap.d config files==
<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
mv slapd.d slapd.d.orig
</div>

==Start service==
<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
chown -R ldap:ldap .<br/>
service slapd start<br/>
chkconfig slapd on
</div>

==Import base schema==
<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
/usr/share/migrationtools/migrate_base.pl > base.ldif<br/>
sed --in-place -e "s/dc=padl,dc=com/$SUFFIX/" base.ldif<br/>
ldapadd -h localhost -D "cn=root,$SUFFIX" -w admin -x -f base.ldif
</div>

If you only want to use LDAP as an address book, you're done.

Just find a way to insert entries in your LDAP server, and you'll be able to use it in your email clients as your address book.

If you want to use LDAP to control who can use SSH, web-applications, etc. continue below.

==Import Linux accounts details in schema==
<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
/usr/share/migrationtools/migrate_hosts.pl /etc/hosts hosts.ldif<br/>
sed --in-place -e "s/dc=padl,dc=com/$SUFFIX/" hosts.ldif<br/>
ldapadd -h localhost -D "cn=root,$SUFFIX" -w admin -x -f hosts.ldif
</div>
Error is fine. Duplicate names for IPv6 probably...

<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
/usr/share/migrationtools/migrate_group.pl /etc/group group.ldif<br/>
vi group.ldif # Remove all system groups; keep 'users' etc.<br/>
sed --in-place -e "s/dc=padl,dc=com/$SUFFIX/" group.ldif<br/>
ldapadd -h localhost -D "cn=root,$SUFFIX" -w admin -x -f group.ldif
</div>

<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
ETC_SHADOW=/etc/shadow /usr/share/migrationtools/migrate_passwd.pl /etc/passwd passwd.ldif<br/>
vi passwd.ldif # Remove all system users; keep only 'real' users<br/>
sed --in-place -e "s/dc=padl,dc=com/$SUFFIX/" passwd.ldif<br/>
ldapadd -h localhost -D "cn=root,$SUFFIX" -w admin -x -f passwd.ldif
</div>

← Older revision		Revision as of 03:34, 18 June 2017
Line 1:		Line 1:
		+	{{NeedsUpdate}}
	__NOTOC__		__NOTOC__
	==Contents==		==Contents==

← Older revision		Revision as of 17:50, 10 May 2010
Line 1:		Line 1:
		+	__NOTOC__
		+	==Contents==
		+	<ol>
		+	<li class="toclevel-1">[[#Install_prerequisites\|Install prerequisites]]</li>
		+	<li class="toclevel-1">[[#Update_slapd.conf\|Update slapd.conf]]</li>
		+	<li class="toclevel-1">[[#Add_authorizedService_schema\|Add authorizedService schema]]</li>
		+	<li class="toclevel-1">[[#Setup_DB_CONFIG\|Setup DB_CONFIG]]</li>
		+	<li class="toclevel-1">[[#Disable_slap.d_config_files\|Disable slap.d config files]]</li>
		+	<li class="toclevel-1">[[#Start_service\|Start service]]</li>
		+	<li class="toclevel-1">[[#Import_base_schema\|Import base schema]]</li>
		+	<li class="toclevel-1">[[#Import_Linux_accounts_details_in_schema\|Import Linux accounts details in schema]]</li>
		+	<li class="toclevel-1">[[#Setup_LDAP_client_on_the_HDA\|Setup LDAP client on the HDA]]</li>
		+	<li class="toclevel-1">[[#Change_a_LDAP_user_to_use_authorizedService\|Change a LDAP user to use authorizedService]]</li>
		+	<li class="toclevel-1">[[#Allow_a_user_SSH_access\|Allow a user SSH access]]</li>
		+	<li class="toclevel-1">[[#Control_a_web-application_access_using_LDAP\|Control a web-application access using LDAP]]</li>
		+	</ol>
		+
	==Install prerequisites==		==Install prerequisites==
	<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">		<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">

@@ Line 160: / Line 160: @@
 </div>
 Replace '''uid=some_user''' with the Linux username you want to modify.
 ==Control a web-application access using LDAP==

← Older revision		Revision as of 15:16, 10 May 2010
Line 160:		Line 160:
	</div>		</div>
	Replace '''uid=some_user''' with the Linux username you want to modify.		Replace '''uid=some_user''' with the Linux username you want to modify.
		+
		+	==Control a web-application access using LDAP==
		+	The procedure below will allow you to use Linux user accounts to allow or deny access to specific web-applications.<br/>
		+	Note that this level of authentication '''will not replace''' the web-app login, if any (there are exceptions). It will prevent or allow specific users to reach the web-app homepage.
		+
		+	<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
		+	cat > give_webapp_access.ldif <<'EOF'<br/>
		+	dn: uid=some_user,ou=People,dc=home,dc=com
		+	changetype: modify
		+	add: authorizedService
		+	authorizedService: webapp-some_name
		+	EOF<br/>
		+	ldapadd -h localhost -D "cn=root,$SUFFIX" -w admin -x -f give_webapp_access.ldif
		+	</div>
		+	Replace '''uid=some_user''' with the Linux username you want to modify, and '''some_name''' with the name of the web-app you want to protect (for example, ''authorizedService: webapp-bookmarks'').
		+
		+	You'll also need to modify the httpd conf for the web-app you want to protect.<br/>
		+	You'll find it in ''/etc/httpd/conf.d/xxxx-web_app_name.conf''<br/>
		+	In this file, remove the following two lines:
		+	<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
		+	Order allow,deny<br/>
		+	Allow from all
		+	</div>
		+
		+	And replace them with those lines:
		+
		+	<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
		+	Deny from all<br/>
		+	Order deny,allow<br/>
		+	AllowOverride None<br/>
		+	AuthType Basic<br/>
		+	AuthName LDAP<br/>
		+	AuthBasicAuthoritative off<br/>
		+	AuthBasicProvider ldap<br/>
		+	AuthzLDAPAuthoritative on<br/>
		+	AuthLDAPURL ldap://127.0.0.1/dc=home,dc=com?uid?sub?(authorizedService=webapp-some_name)<br/>
		+	require valid-user<br/>
		+	satisfy any<br/>
		+	AuthLDAPBindDN "cn=root,dc=home,dc=com"<br/>
		+	AuthLDAPBindPassword "admin"
		+	</div>
		+	Replace '''some_name''' with the name of the web-app you want to protect (for example, ''authorizedService: webapp-bookmarks''). Make sure to use the same string as you used in ''give_webapp_access.ldif'' above.

← Older revision		Revision as of 14:46, 10 May 2010
Line 110:		Line 110:
	ldapadd -h localhost -D "cn=root,$SUFFIX" -w admin -x -f passwd.ldif		ldapadd -h localhost -D "cn=root,$SUFFIX" -w admin -x -f passwd.ldif
	</div>		</div>
		+
		+	==Setup LDAP client on the HDA==
		+
		+	<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
		+	sed --in-place -e "s/#host 127.0.0.1/host hda.home.com/" /etc/ldap.conf<br/>
		+	sed --in-place -e "s/base dc=example,dc=com/base $SUFFIX/" /etc/ldap.conf<br/>
		+	sed --in-place -e "s/#rootbinddn cn=manager,dc=example,dc=com/rootbinddn cn=root,$SUFFIX/" /etc/ldap.conf<br/>
		+	sed --in-place -e "s/#scope one/scope one/" /etc/ldap.conf<br/>
		+	sed --in-place -e "s/#pam_filter objectclass=account/pam_filter objectclass=posixaccount/" /etc/ldap.conf<br/>
		+	sed --in-place -e "s/#pam_login_attribute uid/pam_login_attribute uid/" /etc/ldap.conf<br/>
		+	sed --in-place -e "s/#pam_member_attribute uniquemember/pam_member_attribute gid/" /etc/ldap.conf<br/>
		+	sed --in-place -e "s/#nss_base_passwd.ou=People,dc=example,dc=com./nss_base_passwd ou=People,$SUFFIX?one/" /etc/ldap.conf<br/>
		+	sed --in-place -e "s/#nss_base_shadow.ou=People,dc=example,dc=com./nss_base_shadow ou=People,$SUFFIX?one/" /etc/ldap.conf<br/>
		+	sed --in-place -e "s/#nss_base_group.ou=Group,dc=example,dc=com./nss_base_group ou=Group,$SUFFIX?one/" /etc/ldap.conf<br/>
		+	sed --in-place -e "s/#nss_base_hosts.ou=Hosts,dc=example,dc=com./nss_base_hosts ou=Hosts,$SUFFIX?one/" /etc/ldap.conf<br/>
		+	sed --in-place -e "s/#pam_check_service_attr yes/pam_check_service_attr yes/" /etc/ldap.conf
		+
		+	echo admin > /etc/ldap.secret<br/>
		+	chown root:root /etc/ldap.secret<br/>
		+	chmod 600 /etc/ldap.secret
		+
		+	sed --in-place -e "s/^passwd:.*/passwd: files ldap/" /etc/nsswitch.conf<br/>
		+	sed --in-place -e "s/^shadow:.*/shadow: files ldap/" /etc/nsswitch.conf<br/>
		+	sed --in-place -e "s/^hosts:.*/hosts: files ldap dns mdns/" /etc/nsswitch.conf
		+	</div>
		+
		+	==Change a LDAP user to use authorizedService==
		+	For a specific user to be authorized or not on specific services, you need to add an objectClass to it's LDAP object, like this:
		+	<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
		+	cat > authorizedService.ldif <<'EOF'<br/>
		+	dn: uid=some_user,ou=People,dc=home,dc=com
		+	changetype: modify
		+	add: objectclass
		+	objectclass: authorizedServiceObject
		+	EOF<br/>
		+	ldapadd -h localhost -D "cn=root,$SUFFIX" -w admin -x -f authorizedService.ldif
		+	</div>
		+	Replace '''uid=some_user''' with the Linux username you want to modify.
		+
		+	==Allow a user SSH access==
		+	<div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
		+	cat > give_ssh_access.ldif <<'EOF'<br/>
		+	dn: uid=some_user,ou=People,dc=home,dc=com
		+	changetype: modify
		+	add: authorizedService
		+	authorizedService: sshd
		+	EOF<br/>
		+	ldapadd -h localhost -D "cn=root,$SUFFIX" -w admin -x -f give_ssh_access.ldif
		+	</div>
		+	Replace '''uid=some_user''' with the Linux username you want to modify.

@@ Line 23: / Line 23: @@
 ==Update slapd.conf==
 <div style="text-align: left; border: 1px solid #A3B1BF; padding: .5em 1em; color: #000; background-color: #E6F2FF; margin: 3px 3px 1em 3px;">
-DOMAIN=`mysql -u root -phda -e "select value from settings where name = 'domain'" hda_production | grep -v value`<br/>
+DOMAIN=`mysql -uroot -phda -e "select value from settings where name = 'domain'" hda_production | grep -v value`<br/>
 SUFFIX=`echo '<?php $domain = explode(".", $argv[1]); echo "dc=". implode(",dc=", $domain); ?>' | php -- $DOMAIN`<br/>
 <br/>

LDAP - Revision history

Bigfoot65 at 03:34, 18 June 2017

Bigfoot65: /* Update slapd.conf */

Bigfoot65: /* Update slapd.conf */

Gboudreau at 17:50, 10 May 2010

Gboudreau at 15:17, 10 May 2010

Gboudreau at 15:16, 10 May 2010

Gboudreau at 14:46, 10 May 2010

Gboudreau: Created page with '==Install prerequisites== yum -y in…'

Gboudreau: Created page with '==Install prerequisites==
yum -y in…'