OPENLDAP
Pre-requisites:
The first things you need to do is ensure that OpenLDAP is properly installed, along with a few optional packages that will tie our system together. Obviously, the first step is to install OpenLDAP. The packages we need to have installed (on a RedHat system) are:- openldap
- openldap-clients
- openldap-devel
- openldap-servers
- nss_ldap
[root@linux0120 ~]# rpm -qa | grep
openldap
openldap-devel-2.2.13-2
openldap-2.2.13-2
openldap-clients-2.2.13-2
[root@linux0120 ~]#
Since the openldap-server rpms is not
currently with us, the same is upgraded to newer version.
Installing the required rpms:
[root@linux0120 ~]# mount
lnxdev0001:/usr/local/src/ /mnt
[root@linux0120 ~]# rpm -Uvh
/mnt/redhat/es4/RedHat/RPMS/openldap-*
warning:
/mnt/redhat/es4/RedHat/RPMS/openldap-2.2.13-3.i386.rpm: V3 DSA
signature: NOKEY, key ID db42a60e
error: Failed dependencies:
libodbc.so.1 is needed by
openldap-servers-sql-2.2.13-3.i386
Suggested resolutions:
unixODBC-2.2.9-1.i386.rpm
[root@linux0120 ~]# rpm -e
openldap-clients-2.2.13-2
[root@linux0120 ~]# rpm -e
openldap-devel-2.2.13-2
[root@linux0120 ~]# rpm -e
openldap-2.2.13-2
[root@linux0120 ~]# rpm -e
openldap-2.2.13-2 --nodeps
[root@linux0120 ~]# rpm -ivh
/mnt/redhat/es4/RedHat/RPMS/openldap-2.2.13-3.i386.rpm
warning:
/mnt/redhat/es4/RedHat/RPMS/openldap-2.2.13-3.i386.rpm: V3 DSA
signature: NOKEY, key ID db42a60e
Preparing...
########################################### [100%]
1:openldap
########################################### [100%]
[root@linux0120 ~]# rpm -ivh
/mnt/redhat/es4/RedHat/RPMS/openldap-clients-2.2.13-3.i386.rpm
warning:
/mnt/redhat/es4/RedHat/RPMS/openldap-clients-2.2.13-3.i386.rpm: V3
DSA signature: NOKEY, key ID db42a60e
Preparing...
########################################### [100%]
1:openldap-clients
########################################### [100%]
[root@linux0120 ~]# rpm -ivh
/mnt/redhat/es4/RedHat/RPMS/openldap-devel-2.2.13-3.i386.rpm
warning:
/mnt/redhat/es4/RedHat/RPMS/openldap-devel-2.2.13-3.i386.rpm: V3 DSA
signature: NOKEY, key ID db42a60e
Preparing...
########################################### [100%]
1:openldap-devel
########################################### [100%]
[root@linux0120 ~]# rpm -ivh
/mnt/redhat/es4/RedHat/RPMS/openldap-servers-2.2.13-3.i386.rpm
warning:
/mnt/redhat/es4/RedHat/RPMS/openldap-servers-2.2.13-3.i386.rpm: V3
DSA signature: NOKEY, key ID db42a60e
Preparing...
########################################### [100%]
1:openldap-servers
########################################### [100%]
[root@linux0120 ~]# rpm -qa | grep
openldap
openldap-clients-2.2.13-3
openldap-devel-2.2.13-3
openldap-servers-2.2.13-3
openldap-2.2.13-3
[root@linux0120 ~]# rpm -qa | grep
nss_ldap
nss_ldap-226-1
[root@linux0120 ~]# rpm -Uvh
/mnt/redhat/es4/RedHat/RPMS/nss_ldap-226-6.i386.rpm
warning:
/mnt/redhat/es4/RedHat/RPMS/nss_ldap-226-6.i386.rpm: V3 DSA
signature: NOKEY, key ID db42a60e
Preparing...
########################################### [100%]
1:nss_ldap
########################################### [100%]
The openldap-servers and
openldap-devel packages are only required on the system that will be
your authentication server. They are not required on the "client"
systems.
The nss_ldap package is required for PAM authentication and for
NSS information (ie. retrieving group, user, host, etc. information
from the LDAP server). Once you have all of these packages installed,
you can begin to configure your LDAP server.Configuring the OpenLDAP Server
The first step in configuring your server is to edit the /etc/openldap/slapd.conf file. There are a few fields you will need to configure. In this topic, we will assume that your domain name to use on the LAN is "newindia.com" and will illustrate our configuration accordingly.[root@linux0120 ~]# vi /etc/openldap/slapd.conf
database ldbm
suffix "dc=newindia,dc=com"
rootdn "cn=root,dc=newindia,dc=com"
rootpw {MD5}/39oNhuzZDdBZnzCjxM5TA==
password-hash {crypt}
password-crypt-salt-format "$1$%.8s"
Get the MD5 crypt password as follows:
[root@linux0120 ~]# slappasswd -h{MD5}
New password:
Re-enter new password:
{MD5}/39oNhuzZDdBZnzCjxM5TA==
Before configuring your basic ACLs, let's start slapd and make sure it works.
[root@linux0120 ~]# /etc/init.d/ldap start
Checking configuration files for : config file testing succeeded
Starting slapd: [ OK ]
Once you have started the slapd server, you can test it by executing the following query:
[root@linux0120 ~]# ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts
# extended LDIF
#
# LDAPv3
# base <> with scope base
# filter: (objectclass=*)
# requesting: namingContexts
#
#
dn:
namingContexts: dc=newindia,dc=com
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
This ensures that ldap is configured
and working properly.
Enable the daemon to start at boot
time itself:
[root@linux0120 ~]# chkconfig ldap on
Configuring Server ACLs
The final step on the server before we begin migrating data is to set the basic ACLs (Access Control Lists) for the LDAP server. This will ensure that people only have access to what they need to have access to, and will allow users to update their passwords, see their passwords, but prevent others from seeing the same.Once again you need to edit the /etc/openldap/slapd.conf file. If you look in your slapd.conf file, you will see the following near the beginning:
# Define global ACLs to disable default read access.
include /etc/openldap/slapd.access.conf
The /etc/openldap/slapd.access.conf
file is as good as any to place your ACLs in. You can either append your ACL rules to the end of the slapd.conf file, or insert them into slapd.access.conf. The choice is entirely up to you. If you do choose to use the access file, remove the example ACLs at the end of the slapd.conf file. Let's begin with some basic ACLs:
#This is a good place to put the access-control directives
olcAccess to dn=".*,dc=newindia,dc=com" attr=userPassword
by dn.base="cn=root,dc=newindia,dc=com" write
# by self write
by * auth
olcAccess to dn=".*,dc=newindia,dc=com" attr=mail
by dn="cn=root,dc=newindia,dc=com" write
# by self write
by * read
olcAccess to *
by * read
olcAccess to dn=".*,dc=newindia,dc=com"
# by self write
by read
What this does is restrict access to the userPassword attribute of any entry; that is, any dn in dc=newindia,dc=com. The owner of the entry can modify it, and the owner is defined by someone binding to the server using that dn and it's associated password. Otherwise, it can only be accessed for authentication/binding purposes, but cannot be viewed. The second entry allows the user to modify their mail attribute (ie. email address). The third entry specifies that any dn in ou=People,dc=newindia,dc=com must be read-only. This is where we protect the system from users deciding to change their username, gid or uid numbers, home directory, and so forth. Because the ACLs are read top down in a "first match wins" order, we have effectively given users access to change their own password and their own email address, but they are unable to touch any other information on their account. Everything else is read-only... to the world, and the user. Finally, the last entry is a catch-all for other parts of the database. This will allow users to make changes to their own address books, for example. If you will not be allowing users to use their own address books on this LDAP server, feel free to remove the "by self write" ACL of the last entry. This will still allow users to read group and hosts information. If you like, you can duplicate the second entry to allow users to modify their loginShell attribute so they can select what shell they wish to use, but I wouldn't recommend it.
To have the server use the new ACLs, be sure to restart it (service ldap restart on most Linux systems).
[root@linux0120 ~]# /etc/init.d/ldap restart
Stopping slapd: [ OK ]
Checking configuration files for slapd: config file testing succeeded
Starting slapd: [ OK ]
In our environment the self write is
disabled to all attributes.
Creating the LDAP entries:
To create the entry create an ldif
file (LDAP inerchage fomat) and add to the database as follows:
o:
[bharath@linux0120 LDAP]$ cat
domain.ldif
dn: dc=newindia,dc=com
dc: newindia
objectClass: top
objectClass: domain
objectClass:domainRelatedObject
associatedDomain: newindia.com
[bharath@linux0120 LDAP]$ ldapadd -x
-D "cn=root,dc=newindia,dc=com" -W -f domain.ldif
Enter LDAP Password:
adding new entry “dc=newindia,dc=com”
[bharath@linux0120 LDAP]
ou:
[bharath@linux0120 LDAP]$ cat ou.ldif
dn: ou=Group,dc=newindia,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit
objectClass: domainRelatedObject
asscociatedDomain: newindia.com
[bharath@linux0120 LDAP]$ ldapadd -x
-D "cn=root,dc=newindia,dc=com" -W -f ou.ldif
Enter LDAP Password:
adding new entry
"ou=Group,dc=newindia,dc=com"
[bharath@linux0120 LDAP]$
nisMapName:
[bharath@linux0120 LDAP]$ cat
nisMapName.ldif
dn:
nisMapName=netgroup.byhost,dc=newindia,dc=com
nisMapName: netgroup.byhost
objectClass: top
objectClass: nismap
objectClass: domainRelatedObject
associatedDomain: newindia.com
[bharath@linux0120 LDAP]$ ldapadd -x
-D "cn=root,dc=newindia,dc=com" -W -f nisMapName.ldif
Enter LDAP Password:
adding new entry
"nisMapName=netgroup.byhost,dc=newindia,dc=com"
[bharath@linux0120 LDAP]$
cn:
(Simple Group)
[bharath@linux0120 LDAP]$ cat cn.ldif
dn:
cn=users,ou=Group,dc=newindia,dc=com
cn: users
objectClass: top
objectClass: posixGroup
objectClass: domainRelatedObject
associatedDomain: newindia.com
gidNumber: 100
userPassword:
[bharath@linux0120 LDAP]$ ldapadd -x
-D "cn=root,dc=newindia,dc=com" -W -f cn.ldif
Enter LDAP Password:
adding new entry
"cn=users,ou=Group,dc=newindia,dc=com"
[bharath@linux0120 LDAP]$
(Shared Group)
[bharath@linux0120 LDAP]$ cat
scn.ldif
dn:
cn=java,ou=Group,dc=newindia,dc=com
cn: java
objectClass: top
objectClass: posixGroup
objectClass: domainRelatedObject
associatedDomain: newindia.com
gidNumber: 900
userPassword:
memberUid: kishore
memberUid: karthik
[bharath@linux0120 LDAP]$
[bharath@linux0120 LDAP]$ ldapadd -x
-D "cn=root,dc=newindia,dc=com" -W -f scn.ldif
Enter LDAP Password:
adding new entry
"cn=java,ou=Group,dc=newindia,dc=com"
[bharath@linux0120 LDAP]$
uid:
dn:
uid=bharath,ou=People,dc=newindia,dc=com
uid: bharath
cn: bharath
givenName: bharath
sn: I
objectClass: top
objectClass: posixAccount
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
#objectClass: kerberosSecurityObject
objectClass: shadowAccount
mail: bharath@newindia.com
uidNumber: 678
gidNumber: 100
homeDirectory: /home/bharath
loginShell: /bin/bash
gecos: bharath I - SA
userPassword: {CRYPT}Fd4pwcZ.ncH6Q
shadowLastChange: 13200
shadowMax: 99999
shadowWarning: 7
#krbName: bharath@newindia.COM
The objectClass
kerberosSecurityObject is not defined. Need to fix this.
Migrating Data
The next step is to begin migrating your data into your LDAP server.
The openldap servers rpm provides the
migration perl scripts to generate the LDIF file from the existing
files.
[root@linux0120 redhat]# cd
/usr/share/openldap/migration/
Set the following in the
migrate_common.ph file.
[root@linux0120 migration]# vi
migrate_common.ph
$DEFAULT_MAIL_DOMAIN =
"dev02.newindia.com";
$DEFAULT_BASE = "dc=newindia,dc=com";
$DEFAULT_MAIL_HOST =
"mail.dev02.newindia.com";
$EXTENDED_SCHEMA = 1;
Use the migrate_all_online.pl for all
the data's like hosts, services, groups, protocols etc to be
generated in the ldif file. Since the essential entries required
are group and password files, the required ldif files are generated
as follows:
[root@linux0120 migration]#
./migrate_base.pl > base.ldif
[root@linux0120 migration]#
./migrate_group.pl /etc/group group.ldif
[root@linux0120 migration]#
ETC_SHADOW=/etc/shadow- ./migrate_passwd.pl /etc/passwd passwd.ldif
Add the data to the ldap database as
follows:
[bharath@linux0120 LDAP]$ ldapadd -x
-D "cn=root,dc=newindia,dc=com" -W -f base.ldif
Enter LDAP Password:
[bharath@linux0120 LDAP]$ ldapadd -x
-D "cn=root,dc=newindia,dc=com" -W -f group.ldif
Enter LDAP Password:
[bharath@linux0120 LDAP]$ ldapadd -x
-D "cn=root,dc=newindia,dc=com" -W -f passwd.ldif
Creating the AUTOMOUNT MAPS for the
shared directories on the LDAP Server:
The NIS MAPS which are created are as
follows:
/etc/auto.master
/etc/auto.home
/etc/auto.home2
/etc/auto.data
/etc/nb_apps
/etc/nb_apps-7.2
/etc/nb_apps-es4
/etc/auto.clearcase-data
Let us consider all the above maps
as organization units of the LDAP Directory structure.
Create the Organizational units as
follows:
dn: ou=auto.master,dc=newindia,dc=com
ou: auto.master
objectClass: top
objectClass: autoMountMap
Create the share map for each of the
shares with the corresponding map files. For example for /home
share, the map file is auto.home and the same is created as follows:
dn:
cn=/home,ou=auto.master,dc=newindia,dc=com
cn: /home
objectClass: autoMount
autoMountInformation:
ldap:ou=auto.home,dc=newindia,dc=com
The above autoMountInformation
instructs the LDAP server for mounting this share, check with the
corresponding ou entry. (ou=auto.home).
Create the auto.home map as follows:
dn: ou=auto.home,dc=newindia,dc=com
ou: auto.home
objectClass: top
objectClass: autoMountMap
Create the map details for the above
share as follows for each entry. For example,
bharath fileserv:/export/home/bharath
dn:
cn=bharath,ou=auto.home,dc=newindia,dc=com
cn: bharath
objectClass: autoMount
autoMountInformation:
fileserv.dev02.newindia.com:/export/home/bharath
Like this for each and every entry,
the LDAP entry needs to be created for the same.
Create the ldif file as stated above
and add to the LDAP database as follows:
[bharath@linux0120 LDAP]$ ldapadd -x
-D "cn=root,dc=newindia,dc=com" -W -f auto.ldif
Enter LDAP Password:
Note:
Instead of each and every entry for
the user login accounts, a single account can be created and added to
the LDAP database as follows:
dn:
cn=*,ou=auto.home,dc=newindia,dc=com
cn: *
objectClass: autoMount
autoMountInformation:
fileserv.dev02.newindia.com:/export/home/&
[bharath@linux0120 LDAP]$ ldapadd -x
-D "cn=root,dc=newindia,dc=com" -W -f auto.ldif
Enter LDAP Password:
To migrate all the required file use
the following scripts, to create the ldif files.
[bharath@linux0120 LDAP]$ cat
auto.master.pl
#!/usr/bin/perl
use strict;
use warnings;
my $subdomain="dev02";
my $domain="newindia";
my $dom="com";
my $infile;
my $outfile;
my $mount;
my $mapfile;
my $configdir="/home/bharath/LDAP/";
my @data;
print "Enter the Master Map
file\n";
$infile = <STDIN>;
chomp $infile;
$outfile = "$infile.ldif";
open FHO,">$outfile";
print FHO "dn:
ou=$infile,dc=$domain,dc=$dom\n";
print FHO "ou: $infile\n";
print FHO "objectClass: top\n";
print FHO "objectClass:
autoMountMap\n\n\n";
if (open FHI, "$configdir$infile")
{
while (<FHI>)
{
if(/^(\/)/)
{
@data =
split;
$mount =
$data[0];
$mapfile =
$data[1];
print FHO
"dn: cn=$mount,ou=$infile,dc=$domain,dc=$dom\n";
print FHO
"cn: $mount\n";
print FHO
"objectClass: autoMount\n";
print FHO
"autoMountInformation:
ldap:ou=$mapfile,dc=$domain,dc=$dom\n\n\n";
}
}
}
close FHI;
close FHO;
For all other files other than
auto.master, use the following script and provide the file name when
prompted.
[bharath@linux0120 LDAP]$ cat
auto.all.pl
#!/usr/bin/perl
use warnings;
use strict;
my $subdomain="dev02";
my $domain="newindia";
my $dom="com";
my $infile;
my $outfile;
my @data;
my $words;
my $cn;
my $server;
my $share;
my $configdir="/home/bharath/LDAP/";
print "Enter the NIS map
file\n";
$infile=<STDIN>;
chomp($infile);
$outfile="$infile.ldif";
open FHO, ">$outfile";
print FHO "dn:
ou=$infile,dc=$domain,dc=$dom\n";
print FHO "ou: $infile\n";
print FHO "objectClass: top\n";
print FHO "objectClass:
autoMountMap\n\n\n";
if (open FHI, "$configdir$infile")
{
while (<FHI>)
{
chomp($_);
if(/^(\w+)/)
{
s/(\s+)/ /g;
s/[:,&]/
/g;
@data =
split(/\s+/,$_);
$words =
scalar(@data);
if ($words eq
3)
{
$cn =
$data[0];
$server = $data[1];
$share = $data[2];
print
FHO "dn: cn=$cn,ou=$infile,dc=$domain,dc=$dom\n";
print
FHO "cn: $cn\n";
print
FHO "objectClass: autoMount\n";
print
FHO "autoMountInformation:
$server.$subdomain.$domain.$dom:$share\n\n\n";
}
else
{
print
"The file conatins more than two words ($words). So skipped\n";
}
}
}
close FHI;
close FHO;
}
else
{
print "The \"",$infile,
"\" does not exist in the \"" ,$configdir,"\"
directory\n";
}
After creating the required ldif
files, add the same to the LDAP Database.
Useful LDAP Commands:
ldapadd:
-x Simple authentication
-D bindn
-W prompt for bind password
-f ldif file
[bharath@linux0120 LDAP]$ ldapadd -x
-D "cn=root,dc=newindia,dc=com" -W -f auto.data.ldif
ldapmodify:
Same as that of ldapadd.
ldapsearch:
-b basedn
[bharath@linux0120 LDAP]$ ldapsearch
-x -b "ou=auto.home,dc=newindia,dc=com" "(cn=*)"
ldapdelete:
-r recursive
If the specified dn is a tree
containing several leaves, then -r should be used, else only the
specified dn will be deleted.
[bharath@linux0120 LDAP]$ ldapdelete
-x -r -D "cn=root,dc=newindia,dc=com"
"ou=auto.nb_apps-7.2,dc=newindia,dc=com" -W
ldappasswd:
-S prompt for newpassword
[bharath@linux0120 LDAP]$ ldappasswd
-x -S -D "cn=root,dc=newindia,dc=com" -W
"uid=bharath,ou=people,dc=newindia,dc=com"
New password:
Re-enter new password:
Enter LDAP Password:
Result: Success (0)
[root@www ~]# rpm -qa | grep ldap
nss_ldap-226-6
openldap-2.2.13-3
compat-openldap-2.1.30-3
The packages nss_ldap-226-6
