OpenLDAP - Revision history

Jciccone: /* slapd.conf */

2009-03-23T00:24:52Z

slapd.conf

← Older revision		Revision as of 17:24, 22 March 2009
Line 207:		Line 207:
	# Map the kerberos principals to actual ldap entities.		# Map the kerberos principals to actual ldap entities.
	#authz-policy from		#authz-policy from
	#authz-regexp "^uid=([^,]+),cn='''''<realm>''''',cn=gssapi,cn=auth" "uid=$1,ou=people,'''''<BASE DN>'''''"		#authz-regexp
			"^uid=([^,]+),cn='''''<realm>''''',cn=gssapi,cn=auth"
			"uid=$1,ou=people,'''''<BASE DN>'''''"

	# Define SSL and TLS properties (optional)		# Define SSL and TLS properties (optional)

Jciccone: /* Configuring */

2009-03-22T21:16:59Z

Configuring

← Older revision		Revision as of 14:16, 22 March 2009
Line 300:		Line 300:

	ldapadd -f entries.ldif -x -D "cn=Manager,'''''<BASEDN>'''''" -W		ldapadd -f entries.ldif -x -D "cn=Manager,'''''<BASEDN>'''''" -W

			=== ldap.conf ===

			Create a basic ldap.conf:

			cat > /etc/openldap/ldap.conf << "EOF"
			# Begin /etc/openldap/ldap.conf

			BASE '''''<BASE DN>'''''
			URI ldap://'''''<fqdn of ldap server>'''''

			#SASL_MECH GSSAPI
			#SASL_REALM '''''<REALM>'''''
			#SASL_SECPROPS none

			# End /etc/openldap/ldap.conf
			EOF

	=== Where to go from here? ===		=== Where to go from here? ===

Jciccone: /* Configuring */

2009-03-22T21:06:50Z

Configuring

← Older revision		Revision as of 14:06, 22 March 2009
Line 132:		Line 132:
	If you plan on using LDAP with Kerberos you will need to create the LDAP Service Principle in the Kerberos database. You will also want to create a keytab for LDAP and LDAP alone.		If you plan on using LDAP with Kerberos you will need to create the LDAP Service Principle in the Kerberos database. You will also want to create a keytab for LDAP and LDAP alone.

	kadmin.local -q "addprinc -randkey ldap/''<fqdn of ldap server>''@''<REALMNAME.COM>''" &&		kadmin.local -q "addprinc -randkey ldap/'''''<fqdn of ldap server>'''''@'''''<REALMNAME.COM>'''''" &&
	kadmin.local -q "ktadd -k /etc/openldap/slapd.keytab ldap/''<fqdn of ldap server>''@''<REALMNAME.COM>''" &&		kadmin.local -q "ktadd -k /etc/openldap/slapd.keytab ldap/'''''<fqdn of ldap server>'''''@'''''<REALMNAME.COM>'''''" &&
	chmod 600 /etc/openldap/slapd.keytab		chmod 600 /etc/openldap/slapd.keytab

	You will also need to add the LDAP Service Principle to the system keytab aswell:		You will also need to add the LDAP Service Principle to the system keytab aswell:

	kadmin.local -q "ktadd -k /etc/krb5.keytab ldap/''<fqdn of ldap server>''@''<REALMNAME.COM>''" &&		kadmin.local -q "ktadd -k /etc/krb5.keytab ldap/'''''<fqdn of ldap server>'''''@'''''<REALMNAME.COM>'''''" &&
	chmod 600 /etc/krb5.keytab		chmod 600 /etc/krb5.keytab

Line 158:		Line 158:
	You also will want to create a user specifically for managing the ldap directory:		You also will want to create a user specifically for managing the ldap directory:

	kadmin.local -q "addprinc ldapadm@''<REALMNAME.COM>''"		kadmin.local -q "addprinc ldapadm@'''''<REALMNAME.COM>'''''"

	=== slapd.conf ===		=== slapd.conf ===
Line 201:		Line 201:
	# Kerberos uncomment and configure the		# Kerberos uncomment and configure the
	# following lines		# following lines
	#sasl-realm ''<REALMNAME.COM>''		#sasl-realm '''''<REALMNAME.COM>'''''
	#sasl-host ''<FQDN OF SASL SERVER>''		#sasl-host '''''<FQDN OF SASL SERVER>'''''
	#sasl-secprops none		#sasl-secprops none

	# Map the kerberos principals to actual ldap entities.		# Map the kerberos principals to actual ldap entities.
	#authz-policy from		#authz-policy from
	#authz-regexp "^uid=([^,]+),cn=''<realm>'',cn=gssapi,cn=auth" "uid=$1,ou=~~People~~,''<BASE DN>''"		#authz-regexp "^uid=([^,]+),cn='''''<realm>''''',cn=gssapi,cn=auth" "uid=$1,ou=people,'''''<BASE DN>'''''"

	# Define SSL and TLS properties (optional)		# Define SSL and TLS properties (optional)
Line 219:		Line 219:

	access to attrs=userPassword		access to attrs=userPassword
	by dn="cn=Manager,''<BASE DN>''" write		by dn="cn=Manager,'''''<BASE DN>'''''" write
	# by dn="uid=ldapadm,ou=people,''<BASE DN>''" write		# by dn="uid=ldapadm,ou=people,'''''<BASE DN>'''''" write
	by dn="uid=root,ou=people,''<BASE DN>''" write		by dn="uid=root,ou=people,'''''<BASE DN>'''''" write
	by self write		by self write
	by anonymous auth		by anonymous auth
Line 230:		Line 230:

	access to *		access to *
	by dn="cn=Manager,''<BASE DN>''" write		by dn="cn=Manager,'''''<BASE DN>'''''" write
	# by dn="uid=ldapadm,ou=people,''<BASE DN>''" write		# by dn="uid=ldapadm,ou=people,'''''<BASE DN>'''''" write
	by dn="uid=root,ou=people,''<BASE DN>''" write		by dn="uid=root,ou=people,'''''<BASE DN>'''''" write
	by * read		by * read
	by * search		by * search
Line 241:		Line 241:

	database bdb		database bdb
	suffix "''<BASEDN>''"		suffix "'''''<BASEDN>'''''"

	# By Default the rootdn always has complete access to the entire ldap directory regardless of ACLs		# By Default the rootdn always has complete access to the entire ldap directory regardless of ACLs
	# It is for this reason that after the database is populated, you disable the rootdn by either		# It is for this reason that after the database is populated, you disable the rootdn by either
	# removing or commenting out the following 2 lines.		# removing or commenting out the following 2 lines.
	rootdn "cn=Manager,''<BASEDN>''"		rootdn "cn=Manager,'''''<BASEDN>'''''"
	rootpw ''<password hash>''		rootpw '''''<password hash>'''''

	directory "/srv/ldap/openldap-data"		directory "/srv/ldap/openldap-data"
Line 283:		Line 283:
	cat > entries.ldif << "EOF"		cat > entries.ldif << "EOF"
	# Organization for Example Corporation		# Organization for Example Corporation
	dn: ''<BASEDN>''		dn: '''''<BASEDN>'''''
	objectClass: dcObject		objectClass: dcObject
	objectClass: organization		objectClass: organization
	dc: ''example''		dc: '''''example'''''
	o: ''Example Corporation''		o: '''''Example Corporation'''''
	description: ''The Example Corperation''		description: '''''The Example Corperation'''''

	# Organizational Role for Directory Manager		# Organizational Role for Directory Manager
	dn: cn=Manager,''<BASEDN>''		dn: cn=Manager,'''''<BASEDN>'''''
	objectClass: organizationalRole		objectClass: organizationalRole
	cn: Manager		cn: Manager
Line 299:		Line 299:
	Adding the entries into the LDAP directory:		Adding the entries into the LDAP directory:

	ldapadd -f entries.ldif -x -D "cn=Manager,''<BASEDN>''" -W		ldapadd -f entries.ldif -x -D "cn=Manager,'''''<BASEDN>'''''" -W

	=== Where to go from here? ===		=== Where to go from here? ===

Jciccone: /* slapd.conf: Fix ACLs */

2009-03-22T21:01:27Z

slapd.conf: Fix ACLs

← Older revision		Revision as of 14:01, 22 March 2009
Line 217:		Line 217:
	# Access Lists		# Access Lists
	#######################################################################		#######################################################################

	~~# The following rules will allow manager and optionally a ldapadm user principal access to the entire directory~~
	access to *
	~~by dn="cn=Manager,''<BASEDN>''" write~~
	~~# by dn="uid=ldapadm,ou=people,''<BASEDN>''" write~~

	access to attrs=userPassword		access to attrs=userPassword
			by dn="cn=Manager,''<BASE DN>''" write
			# by dn="uid=ldapadm,ou=people,''<BASE DN>''" write
			by dn="uid=root,ou=people,''<BASE DN>''" write
	by self write		by self write
	by anonymous auth		by anonymous auth
Line 232:		Line 230:

	access to *		access to *
			by dn="cn=Manager,''<BASE DN>''" write
			# by dn="uid=ldapadm,ou=people,''<BASE DN>''" write
			by dn="uid=root,ou=people,''<BASE DN>''" write
	by * read		by * read
	by * search		by * search

Jciccone: /* Configuring */

2009-03-22T20:35:06Z

Configuring

← Older revision		Revision as of 13:35, 22 March 2009
Line 155:		Line 155:

	chmod +x /usr/sbin/slapd		chmod +x /usr/sbin/slapd

			You also will want to create a user specifically for managing the ldap directory:

			kadmin.local -q "addprinc ldapadm@''<REALMNAME.COM>''"

	=== slapd.conf ===		=== slapd.conf ===
Line 199:		Line 203:
	#sasl-realm ''<REALMNAME.COM>''		#sasl-realm ''<REALMNAME.COM>''
	#sasl-host ''<FQDN OF SASL SERVER>''		#sasl-host ''<FQDN OF SASL SERVER>''
			#sasl-secprops none

			# Map the kerberos principals to actual ldap entities.
			#authz-policy from
			#authz-regexp "^uid=([^,]+),cn=''<realm>'',cn=gssapi,cn=auth" "uid=$1,ou=People,''<BASE DN>''"

	# Define SSL and TLS properties (optional)		# Define SSL and TLS properties (optional)
Line 208:		Line 217:
	# Access Lists		# Access Lists
	#######################################################################		#######################################################################

			# The following rules will allow manager and optionally a ldapadm user principal access to the entire directory
			access to *
			by dn="cn=Manager,''<BASEDN>''" write
			# by dn="uid=ldapadm,ou=people,''<BASEDN>''" write

	access to attrs=userPassword		access to attrs=userPassword

Jciccone: /* Additional Steps with Kerberos */

2009-03-22T20:00:14Z

Additional Steps with Kerberos

← Older revision		Revision as of 13:00, 22 March 2009
Line 135:		Line 135:
	kadmin.local -q "ktadd -k /etc/openldap/slapd.keytab ldap/''<fqdn of ldap server>''@''<REALMNAME.COM>''" &&		kadmin.local -q "ktadd -k /etc/openldap/slapd.keytab ldap/''<fqdn of ldap server>''@''<REALMNAME.COM>''" &&
	chmod 600 /etc/openldap/slapd.keytab		chmod 600 /etc/openldap/slapd.keytab

			You will also need to add the LDAP Service Principle to the system keytab aswell:

			kadmin.local -q "ktadd -k /etc/krb5.keytab ldap/''<fqdn of ldap server>''@''<REALMNAME.COM>''" &&
			chmod 600 /etc/krb5.keytab

	The '''''slapd''''' binary in /usr/sbin should be a symlink. Remove it and put a wrapper script that will point ldap at the proper keytab in its place:		The '''''slapd''''' binary in /usr/sbin should be a symlink. Remove it and put a wrapper script that will point ldap at the proper keytab in its place:

Jciccone at 22:09, 19 March 2009

2009-03-19T22:09:46Z

← Older revision		Revision as of 15:09, 19 March 2009
Line 286:		Line 286:

	The [[nss_ldap]] page contains information on creating some base OUs (Organizational Units) and starting to create your users and groups.		The [[nss_ldap]] page contains information on creating some base OUs (Organizational Units) and starting to create your users and groups.

			[[Category:Servers]]

Jim at 03:47, 14 February 2009

2009-02-14T03:47:09Z

← Older revision		Revision as of 20:47, 13 February 2009
Line 36:		Line 36:
	Compile the package:		Compile the package:

			sed -i 's@$^STRIP = $.*@\1 @' build/top.mk &&
	CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr --sysconfdir=/etc \		CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr --sysconfdir=/etc \
	--libexecdir=/usr/lib/openldap --localstatedir=/srv/ldap --disable-debug \		--libexecdir=/usr/lib/openldap --localstatedir=/srv/ldap --disable-debug \
Line 61:		Line 62:
	Compile the package:		Compile the package:

			sed -i 's@$^STRIP = $.*@\1 @' build/top.mk &&
	CC="gcc ${BUILD32}" CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr --sysconfdir=/etc \		CC="gcc ${BUILD32}" CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr --sysconfdir=/etc \
	--libexecdir=/usr/lib/openldap --localstatedir=/srv/ldap --disable-debug \		--libexecdir=/usr/lib/openldap --localstatedir=/srv/ldap --disable-debug \
Line 79:		Line 81:
	Compile the package:		Compile the package:

			sed -i 's@$^STRIP = $.*@\1 @' build/top.mk &&
	CC="gcc ${BUILDN32}" CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr --sysconfdir=/etc \		CC="gcc ${BUILDN32}" CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr --sysconfdir=/etc \
	--libexecdir=/usr/lib/openldap --localstatedir=/srv/ldap --disable-debug \		--libexecdir=/usr/lib/openldap --localstatedir=/srv/ldap --disable-debug \
Line 97:		Line 100:
	Compile the package:		Compile the package:

			sed -i 's@$^STRIP = $.*@\1 @' build/top.mk &&
	CC="gcc ${BUILD64}" CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr \		CC="gcc ${BUILD64}" CPPFLAGS="-D_GNU_SOURCE" ./configure --prefix=/usr \
	--sysconfdir=/etc --libdir=/usr/lib64 --libexecdir=/usr/lib/openldap \		--sysconfdir=/etc --libdir=/usr/lib64 --libexecdir=/usr/lib/openldap \

Animeloe: /* Optional */

2009-02-04T02:44:13Z

Optional

← Older revision		Revision as of 19:44, 3 February 2009
Line 23:		Line 23:
	* [[TCP Wrappers]]		* [[TCP Wrappers]]
	* [[unixODBC]]		* [[unixODBC]]
	* [[GMP]]
	* [[GNU Pth]]		* [[GNU Pth]]
	* [[OpenSLP]]		* [[OpenSLP]]

Jciccone: /* Configuring */

2008-11-16T01:03:14Z

Configuring

← Older revision		Revision as of 18:03, 15 November 2008
Line 122:		Line 122:
	The information in the sections below are based off information from the following pages:		The information in the sections below are based off information from the following pages:

	http://www.bayour.com/LDAPv3-HOWTO.~~htm~~		http://www.bayour.com/LDAPv3-HOWTO.html
	http://aput.net/~jheiss/krbldap/		http://aput.net/~jheiss/krbldap/