NAD810 LDAP LAB
LDAP server using OpenLDAP
The OpenLDAP software package is an Open Source and Free implementation of the Lightweight Directory Access Protocol (LDAP). It is gaining wide acceptance as the directory access method of the Internet and also with corporate intranets.
In this lab, the instruction is for setting up an LDAP server with the base context of "dc=nad810,dc=com". Replace this with your own base context. After setting up the OpenLDAP server, you need to configure the LDAP clients to use the user account information stored in the LDAP server to perform user authenication on the client machine. You can use the OpenLDAP client/server to replace your NIS client/server for network user authentication.
Notes: OpenLDAP Use TCP port 389 for regular communication and port 636 for encrypted transactions You need to have these ports opened on your firewall.
Part 1 - OpenLDAP server setup and configuration
Required RPMS for the OpenLDAP server
- openldap
- openldap-clients (for testing the server)
- openldap-devel (optional)
- openldap-servers
- nss_ldap
- migrationtools
OpenLDAP Server configuration Summary
- Create an OpenLDAP database
- Create an OpenLDAP “root” password and edit the OpenLDAP database configuration file /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif
- Start the OpenLDAP server daemon - slapd.service
- Create a base LDIF file for importing to the OpenLDAP database
- Create a user account LDIF file for importing to the OpenLDAP database
- Import the LDIF files into the OpenLDAP database
OpenLDAP Server configuration details:
(1) Create/verify the directory for OpenLDAP database files
mkdir /var/lib/ldap/ chown ldap.ldap /var/lib/ldap chmod 700 /var/lib/ldap
The directory listing of /var/lib/ldap should be:
[root@localhost cn=config]# ls -ldZ /var/lib/ldap drwx------. ldap ldap system_u:object_r:slapd_db_t:s0 /var/lib/ldap
(2) Configure the OpenLDAP “root” user and password by editing the OpenLDAP server's database configuration file “/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif”
Only the LDAP's “rootdn” user can create, import, and export data into a LDAP database. You can use the slappasswd command to create the password and put it in the LDAP server database configuration file mentioned above:
slappasswd New password: [secret] Re-enter new password: [secret] {SSHA}FavfvViq/edEw8x4TV6y7w1L2llXzZzz <-- Copy this to the olcDatabase={2}hdb.ldif file
Add/Modify the olcDatabase={2}hdb.ldif file to have the following:
olcSuffix: dc=nad810,dc=com olcRootDN: cn=Manager,dc=nad810,dc=com olcRootPW: {SSHA}FavfvViq/edEw8x4TV6y7w1L2llXzZzz
Do not change other lines.
(3) Start the OpenLDAP server daemon slapd.service
systemctl start slapd.service
To verify that the OpenLDAP server daemon is running and working, try the following query command:
ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts
You should get something similar to the following:
# extended LDIF # # LDAPv3 # base <> with scope baseObject # filter: (objectclass=*) # requesting: namingContexts # # dn: namingContexts: dc=nad810,dc=com # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1
(4)Create an LDIF file for importing to the OpenLDAP database
a. add an user called “ldapuser”
useradd -g users ldapuser passwd ldapuser
b. extract the passwd entry of ldapuser from /etc/passwd to a file called "entry.ldapuser"
grep ldapuser /etc/passwd > /etc/openldap/entry.ldapuser
c. extract the passwd entry of root from /etc/passwd to a file called "entry.root"
grep root /etc/passwd > /etc/openldap/entry.root
d. convert the entries for the "ldapuser" and "root" to LDIF format (ldif.ldapuser and ldif.root):
(Note that "\" at the end of the line is used to tell the shell that the next line as a continuation of the current line)
For ldapuser: /usr/share/openldap/migration/migrate_passwd.pl \ /etc/openldap/entry.ldapuser /etc/openldap/ldif.ldapuser For Fedora 10, replace /usr/share/openldap/migration/migrate_passwd.pl with /usr/share/migrationtools/migrate_passwd.pl
For root: /usr/share/openldap/migration/migrate_passwd.pl \ /etc/openldap/entry.root /etc/openldap/ldif.root For Fedora 10, replace /usr/share/openldap/migration/migrate_passwd.pl with /usr/share/migrationtools/migrate_passwd.pl
NesNote: here is a trick, do 'ln /usr/share/openldap/migration/migrate_passwd.pl /usr/sbin/migrate_passwd.pl', so u can call up migrate_passwd.pl in any where. :-) now, u can do..
e. edit ldif.ldapuser (change dc=pad1 to dc=nad810)
dn: uid=ldapuser,ou=People,dc=padl,dc=com uid: ldapuser cn: ldapuser objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}!! shadowLastChange: 12821 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 501 gidNumber: 100 homeDirectory: /home/ldapuser
f. edit ldif.root (change dc=pad1 to dc=nad810)
dn: uid=root,ou=People,dc=padl,dc=com uid: root cn: root objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}$1$3gRCMQww$8OCADPFZLjFr6DiFUi8Nn1 shadowLastChange: 12759 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 0 gidNumber: 0 homeDirectory: /root gecos: root
g. create an LDIF file (nad810.com.ldif) for the nad810.com domain
dn: dc=nad810,dc=com dc: nad810 description: root LDAP entry for nad810 objectClass: dcObject objectClass: organizationalUnit ou: rootobject dn: ou=People, dc=nad810, dc=com ou: People description: All people in nad810 objectClass: organizationalUnit
(Make sure that you have a blank line before the 2nd "dn:" line)
(5) Import LDIF files into the OpenLDAP database
NesNote: DO NOT USE double quote ", use single quote ' trust me.. @@ i wasted 2 days because of this..
ldapadd -x -D 'cn=Manager,dc=nad810,dc=com' -W -f /etc/openldap/nad810.com.ldif ldapadd -x -D 'cn=Manager,dc=nad810,dc=com' -W -f /etc/openldap/ldif.root ldapadd -x -D 'cn=Manager,dc=nad810,dc=com' -W -f /etc/openldap/ldif.ldapuser
To test the OpenLDAP database:
ldapsearch -x -b 'dc=nad810,dc=com' '(objectclass=*)'
(6)
cp /usr/share/doc/openldap-servers-2.4.12/DB_CONFIG.example /var/lib/ldap/nad810.com
mv DB_CONFIG.example DB_CONFIG
service ldap restart
Part 2 - Setup and configure OpenLDAP Client
Required RPMS for LDAP client
- openldap
- openldap-clients
- openldap-devel (optional)
- nss_ldap
OpenLDAP Client configuration
Edit the client configuration file /etc/ldap.conf
1.- Find the line starts with the word "host" and set the IP address to the appropriate value -> Use 127.0.0.1 if the OpenLDAP server is running on your own machine, otherwise set it to the IP address of the OpenLDAP server.
2.- Find the line starts with the word "base" and set the context to your base directory -> For the purpose of this lab, set it to: base dc=nad810,dc=com
3.- Find the line starting with "uri ldap://", if your client is the same machine than your server, leave 127.0.0.1, otherwise set it to the IP of the OpenLDAP server.
Note: The lines "base" and "uri ldap://" should be set in /etc/openldap/ldap.conf file as well.
Edit the name service switch configuration file /etc/nsswitch.conf
Enable LDAP for user authentication.
NesTutorial for Dummy.. and now, config ldap client in GUI mode, lets do this..
authconfig-tui
Test your OpenLDAP client with the ldapsearch command
ldapsearch -x 'uid=ldapuser'
To Complete the Lab
Document how to replace NIS with OpenLDAP and develop an interface to add new network users to the OpenLDAP server. Due Date: March 10, 2009