LDAP Server Configuration

LDAP Configuration in RHEL 5.0

Release:

RedHat Enterprise Linux 5.0

Problem:

LDAP Configuration in RHEL 5.0

Solution:

Assumptions:

Domain Name                : tech.in

Host Name                    : server

IP Address                     : 172.16.1.248

Server Side Configuration:

1)      Install the required RPMs for LDAP server

a.       Openldap

b.       Openldap-devel

c.       Openldap-clients

d.       Openldap-servers

e.       Nss_ldap

2)      Create a dedicated directory for putting all database information, with the ownership of “ldap”. Default directory is /var/lib/ldap.

# mkdir /var/lib/ldap/tech.in

# chown ldap:ldap /var/lib/ldap/tech.in

3)      Create an encrypted password for LDAP “root” user and save the output, because it is needed in the “slapd.conf” file

# slappasswd

4)      Update the LDAP configuration file

# vi /etc/openldap/slapd.conf

#####################################          

# ldbm and/or bdb database definitions

#####################################    

database         ldbm

suffix           "dc=tech,dc=in"

rootdn           "cn=Manager,dc=tech,dc=in"

rootpw           {SSHA}+TARB6GQJ7rJvzx5f8h7fGT9r0fwDh32                          (* It is generated from "slappasswd" command)

directory        /var/lib/ldap/example

5)      Start the LDAP daemon to load the contents of the slapd.conf file

# service ldap start

6)      Crete a user account

# useradd –g users ldaptest

# passwd ldaptest

Note: The user’s password must be in LDAP Data Interchange Files (LDIF) format before it can be imported to the LDAP database.

7)      Extract the “ldaptest” user information from the /etc/passwd file and save it for converting to LDIF format

# grep ldaptest /etc/passwd > /etc/openldap/passwd.ldaptest

8)      If  it is freshly configured LDAP database, “root” user account also needed

# grep root /etc/passwd > /etc/openldap/passwd.root

9)      Now convert the /etc/passwd data into an LDIF format using the “migrate_passwd.pl” conversion program

# /usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.ladptest /etc/openldap/ldaptest.ldif

# /usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.root /etc/openldap/root.ldif

10)    Before import this LDIF files to LDAP database we need to edit this LDIF file

# vi /etc/openldap/ldaptest.ldif

dn: uid=ldaptest,ou=People,dc=tech,dc=in

uid: ldaptest

cn: ldaptest

objectClass: account

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

userPassword: {crypt}$1$Z2XOYyLu$QNCNnYWqL1hh9.7S3HWEv.

shadowLastChange: 14771

shadowMax: 99999

shadowWarning: 7

loginShell: /bin/bash

uidNumber: 503

gidNumber: 100

homeDirectory: /home/ldaptest

11)    In slapd.conf, “root” user have a common name (CN) of “Manager”. Add this information to the root LDIF file.

# vi /etc/openldap/root.ldif

dn: uid=root,ou=People,dc=tech,dc=in

uid: root

cn: Manager

objectClass: account

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

userPassword: {crypt}$1$RyAMPQs9$LejMX5ACSu2Qe4Os6fzFa/

shadowLastChange: 14766

shadowMax: 99999

shadowWarning: 7

loginShell: /bin/bash

uidNumber: 0

gidNumber: 0

homeDirectory: /root

gecos: root

dn: uid=operator,ou=People,dc=tech,dc=in

uid: operator

cn: operator

objectClass: account

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

userPassword: {crypt}*

shadowLastChange: 14711

shadowMax: 99999

shadowWarning: 7

loginShell: /sbin/nologin

uidNumber: 11

gidNumber: 0

homeDirectory: /root

gecos: operator

12)    The attributes of the “tech.in” domain defined by using the below LDIF file.

# vi /etc/openldap/tech.in.ldif

dn: dc=tech,dc=in

dc: tech

description: Root LDAP entry for tech.in

objectClass: dcObject

objectClass: organizationalUnit

ou: rootobject

dn: ou=People,dc=tech,dc=in

ou: People

description: All people in organisation

objectClass: organizationalUnit

13)    Import all the three LDIF files into the database using the ldapadd command

# ldapadd –x –D “cn=Manager,dc=tech,dc=in” –W –f /etc/openldap/tech.in.ldif

# ldapadd –x –D “cn=Manager,dc=tech,dc=in” –W –f /etc/openldap/root.ldif

# ldapadd –x –D “cn=Manager,dc=tech,dc=in” –W –f /etc/openldap/ldaptest.ldif

14)    View all the LDAP database entries using the ldapsearch command

# ldapsearch –x –b ‘dc=tech,dc=in’ ‘(objectclass=*)’

Client side Configuration:

15)    Install the required RPMs

a.       Openldap

b.       Openldap-clients

c.       Openldap-devel

d.       Nss_ldap

16)    LDAP clients are configured using the /etc/openldap/ldap.conf file. Mention the LDAP server IP and domain name here

#vi /etc/openldap/ldap.conf

#

# LDAP Defaults

#

# See ldap.conf(5) for details

# This file should be world readable but not world writable.

HOST    172.16.1.248

BASE    dc=tech, dc=in

#URI    ldap://ldap.example.com ldap://ldap-master.example.com:666

#SIZELIMIT      12

#TIMELIMIT      15

#DEREF          never

~

17)    Add the LDAP server information to the client using the authconfig command

# authconfig–tui

    

Note: After this step check the “/etc/nsswitch.conf” file and ensure that, it has references to the LDAP.

     

18)    Restart the SSH daemon to re-read the modified nsswitch.conf file

# service sshd restart

19)    Create home directories for “ldaptest” user in client machine.

# mkdir /home/ldaptest

# chmod 700 /home/ldaptest

# chown ldaptest:users /home/ldaptest

# cp /etc/skel/.bash* /home/ldaptest

# chown ldaptest /home /home/ldaptest/.bash*

20)    Now login as a “ldaptest” user and check

Modifying LDAP account by “root” user:

21)   Create a script to add a user into LDAP database and place it into the “/usr/local/bin/addldapuser”

# vi /usr/local/bin/addldapuser

#!/bin/bash

grep $1 /etc/passwd > /tmp/changeldappasswd.tmp

/usr/share/openldap/migration/migrate_passwd.pl /tmp/changeldappasswd.tmp /tmp/changeldappasswd.ldif.tmp

cat /tmp/changeldappasswd.ldif.tmp | sed s/padl/tech/ > /tmp/changeldappasswd.ldif

cat /tmp/changeldappasswd.ldif | sed s/com/in/ > /tmp/changeldappasswd.ldif

ldapadd -x -D "cn=Manager,dc=tech,dc=in" -W –f /tmp/changeldappasswd.ldif

rm -f /tmp/changeldappasswd.*

22)   Script to delete a LDAP user

# vi /usr/local/bin/deleteldapuser

#!/bin/bash

ldapdelete -x -W -D "cn=Manager,dc=tech,dc=in" "uid=$1,ou=People,dc=tech,dc=in"

23)   To modify the LDAP user  accounts use the below scripts

# vi /usr/local/bin/modifyldapuser

#!/bin/bash

grep $1 /etc/passwd > /tmp/modifyldapuser.tmp

/usr/share/openldap/migration/migrate_passwd.pl /tmp/modifyldapuser.tmp /tmp/modifyldapuser.ldif.tmp

cat /tmp/modifyldapuser.ldif.tmp | sed s/padl/tech/ >  /tmp/modifyldapuser.ldif

cat /tmp/modifyldapuser.ldif | sed s/com/in/ > /tmp/modifyldapuser.ldif

/usr/bin/ldapmodify -x -D "cn=Manager,dc=tech,dc=in" -W –f /tmp/modifyldapuser.ldif

rm -f /tmp/modifyldapuser.*

24)   Make the Scripts executables using the “chmod” command

# chmod 700 /usr/local/bin/addldapuser

# chmod 700 /usr/local/bin/deleteldapuser

# chmod 700 /usr/local/bin/modifyldapuser

25)   Ldap Admin is free Win32 administration tool for LDAP directory management. This application lets you browse, search, modify, create and delete objects on LDAP server.