View source

From Antiflux Wiki

You do not have permission to do that, for the following reason:
The action you have requested is limited to users in the group user.
You can view and copy the source of this page:
== Migrating the User Database ==

The migrationtools package will generate LDIF files based on information in /etc/shadow and /etc/passwd. The ldapadd command can be used to import these files into the database. The migrationtools utilities may include certain Kerberos-related attributes in the LDIF fields that slapd may not understand. These should be removed before importing the LDIF files, or else ldapadd will give an error.

<code>
cd /usr/share/migrationtools<br/>
./migrate_passwd.pl /etc/passwd | egrep -vi "krb|kerb" > /tmp/users.ldif<br/>
./migrate_group.pl /etc/group > /tmp/groups.ldif<br/>
ldapadd -D "cn=admin,dc=example,dc=com" -W -x -f /tmp/users.ldif<br/>
ldapadd -D "cn=admin,dc=example,dc=com" -W -x -f /tmp/groups.ldif<br/>
rm /tmp/groups.ldif /tmp/users.ldif<br/>
</code>

== LDAP and NSS ==

To configure NSS to use LDAP for directory lookups, add the following to /etc/nsswitch.conf

<code>
passwd:         ldap files<br/>
group:          ldap files<br/>
shadow:         ldap files<br/>
</code>


== LDAP and PAM ==

Add the following to /etc/pam_ldap.conf to tell the pam_ldap module how to access the user directory over LDAP. This assumes the LDAP server is on localhost.

<code>
host 127.0.0.1<br/>
base ou=People,dc=example,dc=com<br/>
ldap_version 3<br/>
rootbinddn cn=admin,dc=example,dc=com<br/>
pam_password exop<br/>
</code>

pam_password controls the hashing function used when changing passwords. The exop (extended operation) option is recommended, as then password are hashed using MD5 or SHA or whatever slapd is set up to use.

Add the following to the common files in /etc/pam.d in order to configure PAM to use LDAP in conjunction with /etc/passwd and /etc/shadow. This setup assumes that users exist in both /etc/shadow|passwd and in the LDAP directory. It may not be appropriate when only system users (such as root) exist in /etc/passwd and regular users exist only in the LDAP directory.

For /etc/pam.d/common-account:

<code>
account [success=1 default=ignore] pam_ldap.so<br/>
account required pam_unix.so use_first_pass<br/>
account required pam_permit.so<br/>
</code>

For /etc/pam.d/comment-auth:

<code>
auth [success=1 default=ignore] pam_ldap.so<br/>
auth required pam_unix.so try_first_pass<br/> 
auth required pam_permit.so<br/>
</code>

For /etc/pam.d/common-password:

<code>
password required         pam_ldap.so ignore_unknown_user<br/>
password optional         pam_unix.so nullok obscure min=6 md5 try_first_pass<br/>
</code>

== LDAP and SSL ==

Add the following to slapd.conf to configure slapd to use TLS.

<code>TLSCipherSuite HIGH:MEDIUM:+SSLv2<br/>
TLSCertificateFile /etc/ssl/certs/hostname.crt<br/>
TLSCertificateKeyFile /etc/ssl/private/hostname.key<br/>
TLSCACertificateFile /etc/ssl/CA/cacert.pem<br/>
TLSVerifyClient demand</code>

TLSCertificateFile contains the server certificate used by slapd. TLSCertificateKeyFile contains the server key. TLSCACertificateFile contains the CA certificate which signed both server and client certificates. TLSVerifyClient determines how forgiving slapd should be with clients who provide faulty certificates - demand is the strongest form of verification.

You will also need to configure slapd to serve on port 636 (ldaps) as well as port 389 (ldap). Adding the following line to /etc/default/slapd will configure slapd to only listen on port 389 on localhost but accept connections on port 636 on all interfaces. 

<code>
SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:///"
</code>

LDAP clients will need to know the location of the CA certificate file in order to verify the server's identity. Add the following to /etc/ldap/ldap.conf:

<code>
TLS_CACERT      /etc/ssl/antiflux/cacert.pem<br/>
TLS_REQCERT     demand<br/>
</code>

[[Category:Admin]]
Return to Using LDAP for Authentication.
Retrieved from "http://antiflux.org/wiki/Using_LDAP_for_Authentication"
View source

From Antiflux Wiki

Views

Personal tools

Navigation

Search

Toolbox
