Gentoo Guide to OpenLDAP Authentication

-# Include the needed data schemes below core.schema -include /etc/openldap/schema/cosine.schema -include /etc/openldap/schema/inetorgperson.schema -include /etc/openldap/schema/nis.schema - -Uncomment modulepath and hdb module -# Load dynamic backend modules: -modulepath /usr/lib/openldap/openldap -# moduleload back_shell.so -# moduleload back_relay.so -# moduleload back_perl.so -# moduleload back_passwd.so -# moduleload back_null.so -# moduleload back_monitor.so -# moduleload back_meta.so -moduleload back_hdb.so -# moduleload back_dnssrv.so +include /etc/openldap/schema/core.schema +include /etc/openldap/schema/cosine.schema +include /etc/openldap/schema/inetorgperson.schema +include /etc/openldap/schema/nis.schema +include /etc/openldap/schema/misc.schema + +pidfile /var/run/openldap/slapd.pid +argsfile /var/run/openldap/slapd.args =20 -# Uncomment sample access restrictions (Note: maintain indentat= ion!) +serverID 0 Used in case of replication +loglevel 0 + +## Access Controls access to dn.base=3D"" by * read access to dn.base=3D"cn=3DSubschema" by * read access to * - by self write - by users read - by anonymous auth + by self write + by users read + by anonymous read =20 +## Database definition +database hdb +suffix "dc=3Dgenfic,dc=3Dcom" +checkpoint 32 30 +rootdn "cn=3DManager,dc=3Dgenfic,dc=3Dcom" +rootpw "{SSHA}EzP6I82DZRnW+ou6lyiXHGxSpSOw2XO4" # See earlier s= lappasswd command +directory "/var/lib/openldap-ldbm" +index objectClass eq + +## Synchronisation (pull from other LDAP server) +syncrepl rid=3D000 + provider=3Dldap://ldap2.genfic.com + type=3DrefreshAndPersist + retry=3D"5 5 300 +" + searchbase=3D"dc=3Dgenfic,dc=3Dcom" + attrs=3D"*,+" + bindmethod=3D"simple" + binddn=3D"cn=3Dldapreader,dc=3Dgenfic,dc=3Dcom" + credentials=3D"ldapsyncpass" =20 -# BDB Database definition +index entryCSN eq +index entryUUID eq =20 -database hdb -suffix "dc=3Dgenfic,dc=3Dcom" -checkpoint 32 30 # <kbyte> <min> -rootdn "cn=3DManager,dc=3Dgenfic,dc=3Dcom" -rootpw {SSHA}EzP6I82DZRnW+ou6lyiXHGxSpSOw2XO4 -directory /var/lib/openldap-ldbm -index objectClass eq +mirrormode TRUE + +overlay syncprov +syncprov-checkpoint 100 10

-# Note: we don't use cn=3Dconfig here, so stay with this line:<= /comment> -OPTS=3D"-F /etc/openldap/slapd.d -h 'ldaps:// ldap:// ldapi://%2fvar%2fr= un%2fopenldap%2fslapd.sock'" +OPTS=3D"-h 'ldaps:// ldap:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.soc= k'" +

+~# slappasswd -s myreaderpassword + {SSHA}XvbdAv6rdskp9HgFaFL9YhGkJH3HSkiM + +~# cat ldapreader.ldif +dn: cn=3Dldapreader,dc=3Dgenfic,dc=3Dcom +userPassword: {SSHA}XvbdAv6rdskp9HgFaFL9YhGkJH3HSkiM +objectClass: organizationalRole +objectClass: simpleSecurityObject +cn: ldapreader +description: LDAP reader used for synchronization + +~# ldapadd -x -W -D "cn=3DManager,dc=3Dgenfic,dc=3Dcom" -f ldapreader= .ldif +Password: enter the administrative password +

Migrate existing data to ldap =20

+Configuring OpenLDAP for centralized administration and management of co= mmon +Linux/Unix items isn't easy, but thanks to some tools and scripts availa= ble on +the Internet, migrating a system from a single-system administrative +point-of-view towards an OpenLDAP-based, centralized managed system isn'= t hard +either. +

+ +

Go to http://www.padl.com= /OSS/MigrationTools.html -and fetch the scripts there. Configuration is stated on the page. We don= 't ship -this anymore because the scripts are a potential security hole if you le= ave -them on the system after porting. When you've finished migrating your da= ta, -continue to the next section. +and fetch the scripts there. You'll need the migration tools and the +make_master.sh script. +

+ +

+Next, extract the tools and copy the make_master.sh script inside= the +extracted location: +

+ +

+~# mktemp -d
+/tmp/tmp.zchomocO3Q
+~# cd /tmp/tmp.zchomocO3Q
+~# tar xvzf /path/to/MigrationTools.tgz
+~# mv /path/to/make_master.sh MigrationTools-47
+~# cd MigrationTools-47
+

+ +

+The next step now is to migrate the information of your system to OpenLD= AP. The +make_master.sh script will do this for you, after you have provid= ed it +with the information regarding your LDAP structure and environment. +

+ +

+At the time of writing, the tools require the following input: +

+ + + + + + + + + LDAP BaseDN + The base location (root) of your tree + dc=3Dgenfic,dc=3Dcom + + + Mail domain + Domain used in e-mail addresses + genfic.com + + + Mail host + FQDN of your mail server infrastructure + smtp.genfic.com + + + LDAP Root DN + Administrative account information for your LDAP structure + cn=3DManager,dc=3Dgenfic,dc=3Dcom + + + LDAP Root Password + + Password for the administrative account, cfr earlier slappasswd + command + + + +

Input	Description	Example

+ +

+The tool will also ask you which accounts and settings you want to migra= te.

=20 @@ -310,7 +469,7 @@ #%PAM-1.0 =20 auth required pam_env.so -auth sufficient pam_unix.so try_first_pass likeauth nullok +auth sufficient pam_unix.so try_first_pass likeauth nullo= k auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so =20 @@ -318,7 +477,7 @@ account required pam_unix.so =20 password required pam_cracklib.so difok=3D2 minlen=3D8 dcredit=3D2= ocredit=3D2 try_first_pass retry=3D3 -password sufficient pam_unix.so try_first_pass use_authtok nullok md= 5 shadow +password sufficient pam_unix.so try_first_pass use_authtok nu= llok md5 shadow password sufficient pam_ldap.so use_authtok use_first_pass password required pam_deny.so =20 @@ -338,20 +497,20 @@ =20 suffix "dc=3Dgenfic,dc=3Dcom" #rootbinddn uid=3Droot,ou=3DPeople,dc=3Dgenfic,dc=3Dcom - -uri ldap://auth.genfic.com/ -pam_password exop - +bind_policy soft +bind_timelimit 2 ldap_version 3 +nss_base_group ou=3DGroup,dc=3Dgenfic,dc=3Dcom +nss_base_hosts ou=3DHosts,dc=3Dgenfic,dc=3Dcom +nss_base_passwd ou=3DPeople,dc=3Dgenfic,dc=3Dcom +nss_base_shadow ou=3DPeople,dc=3Dgenfic,dc=3Dcom pam_filter objectclass=3DposixAccount pam_login_attribute uid pam_member_attribute memberuid -nss_base_passwd ou=3DPeople,dc=3Dgenfic,dc=3Dcom -nss_base_shadow ou=3DPeople,dc=3Dgenfic,dc=3Dcom -nss_base_group ou=3DGroup,dc=3Dgenfic,dc=3Dcom -nss_base_hosts ou=3DHosts,dc=3Dgenfic,dc=3Dcom - +pam_password exop scope one +timelimit 2 +uri ldap://ldap.genfic.com/ ldap://ldap1.genfic.com ldap://ldap2.genfic.= com =20

@@ -376,26 +535,14 @@ =20

-To test the changes, type: -

- -

-# getent passwd|grep 0:0
-
-(You should get two entries back:)
-root:x:0:0:root:/root:/bin/bash
-root:x:0:0:root:/root:/bin/bash
-

- -

If you noticed one of the lines you pasted into your /etc/ldap.con= f was commented out (the rootbinddn line): you don't need it unless= you want to change a user's password as superuser. In this case you need to = echo the root password to /etc/ldap.secret in plaintext. This is -DANGEROUS and should be chmoded to 600. What I do is keep= that -file blank and when I need to change someones password thats both in the= ldap -and /etc/passwd I put the pass in there for 10 seconds whil= e I -change it and remove it when I'm done. +DANGEROUS and should be chmoded to 600. What you might wa= nt to +do is keep that file blank and when you need to change someones password= thats +both in the ldap and /etc/passwd, put the pass in there for= 10 +seconds while changing the users password and remove it when done.

=20