Configuration for LDAP client

[2] Configure LDAP server
[root@master ~]# cp /etc/pki/tls/certs/server.* /etc/openldap/cacerts/
[root@master ~]# chown ldap. /etc/openldap/cacerts/*
[root@master ~]# vi /etc/openldap/slapd.conf

include/etc/openldap/schema/core.schema
include/etc/openldap/schema/cosine.schema
include/etc/openldap/schema/inetorgperson.schema
include/etc/openldap/schema/nis.schema

# line 10: add these lines
TLSCertificateFile /etc/openldap/cacerts/server.crt
TLSCertificateKeyFile /etc/openldap/cacerts/server.key

[root@master ~]# /etc/rc.d/init.d/ldap restart
Stopping slapd:[ OK ]
Checking configuration files for slapd: /etc/openldap/slapd.conf: line 117: rootdn is always granted unlimited privileges.
/etc/openldap/slapd.conf: line 121: rootdn is always granted unlimited privileges.
config file testing succeeded[ OK ]
Starting slapd: [ OK ]
[3] Config on Client
[root@www ~]# vi /etc/openldap/ldap.conf

# add at the bottom
URI ldaps://10.0.0.100/
BASE dc=server,dc=world
TLS_CACERTDIR /etc/openldap/cacerts
TLS_REQCERT allow

[root@www ~]# vi /etc/ldap.conf

# near bottom
uri ldap://10.0.0.100/
ssl start_tls# change
tls_cacertdir /etc/openldap/cacerts
pam_password md5
[4] Configuration is completed. Connection is encrypted like below.
# for normal connection, password is shown ( yellow words )
[root@master ~]# tcpdump port ldap -i eth0 -X -s 1024
16:39:34.551462 IP 192.168.0.50.50530 > master.server.world.ldap: P 137:237(100) ack 349 win 108
0x0000: 4500 0098 a57d 4000 4006 1342 c0a8 0032 E....}@.@..B...2
0x0010: c0a8 001e c562 0185 7f88 5b3e 311f 4816 .....b....[>1.H.
0x0020: 8018 006c 0650 0000 0101 080a fffe ffc3 ...l.P..........
0x0030: 001a da06 3062 0201 0360 3e02 0103 042a ....0b...`>....*
0x0040: 7569 643d 736c 6573 2c6f 753d 5065 6f70 uid=sles,ou=Peop
0x0050: 6c65 2c64 633d 7365 7276 6572 2d77 6f72 le,dc=server
0x0060: 6c64 2c64 633d 696e 666f 800d 6869 726f ux,dc=world..pass
0x0070: 6b75 6e74 616e 6664 37a0 1d30 1b04 1931 wordcent..0...1.
0x0080: 2e33 2e36 2e31 2e34 2e31 2e34 322e 322e 3.6.1.4.1.42.2.2
0x0090: 3237 2e38 2e35 2e31 7.8.5.1

# for encrypted connection, password is not shown
[root@master ~]# tcpdump port ldap -i eth0 -X -s 1024
16:43:41.240075 IP 192.168.0.50.37173 > master.server.world.ldap: P 902:976(74) ack 1656 win 143
0x0000: 4500 007e d2d4 4000 4006 e604 c0a8 0032 E..~..@.@......2
0x0010: c0a8 001e 9135 0185 6994 2ee0 17a9 5c4c .....5..i.....
0x0020: 8018 008f 613e 0000 0101 080a fffe f9b1 ....a>..........
0x0030: 001b cae8 1703 0100 2067 f3c9 a959 5eb8 .........g...y^.
0x0040: 828a 80c4 a6d0 1d49 ccf7 ebcb 3a0e 0468 .......i....:..h
0x0050: a4d6 3756 1639 dcc2 bf17 0301 0020 bb89 ..7v.9..........
0x0060: 34ab 231f 0457 513c 3901 5950 b95e 8287 4.#..wq<9.yp.^..
0x0070: 7c77 74c5 7391 9c8a cdb0 0523 9f8d |wt.s......#..

LDAP Server

[1] Install and Configure OpenLDAP.

[root@master ~]# yum -y install openldap-servers openldap-clients

# generate password for ldap admin
[root@master ~]# slappasswd -s password -h {MD5}
# (1) remember
{MD5}*********************

[root@master ~]# vi /etc/openldap/slapd.conf

# line 86: specify suffix
suffix "dc=server,dc=world"

# line 87: specify admin suffix
rootdn "cn=Manager,dc=server,dc=world"

# line 93: specify password generated (1)
rootpw {MD5}************************

# add at the bottom
access to attrs=userPassword
by self write
by dn="cn=Manager,dc=server,dc=world" write
by anonymous auth
by * none

access to *
by dn="cn=Manager,dc=server,dc=world" write
by self write
by * read

[root@master ~]# cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@master ~]# /etc/rc.d/init.d/ldap start
Checking configuration files for slapd: /etc/openldap/slapd.conf: line 116: rootdn is always granted unlimited privileges.
/etc/openldap/slapd.conf: line 121: rootdn is always granted unlimited privileges.
config file testing succeeded
[ OK ]
Starting slapd: [ OK ]
[root@master ~]# chkconfig ldap on

[2] Add initial information

[root@master ~]# cd /usr/share/openldap/migration
[root@master migration]# vi migrate_common.ph

# line 71: specify domain name
$DEFAULT_MAIL_DOMAIN = "server.world";

# line 74: specify suffix
$DEFAULT_BASE = "dc=server,dc=world";

[root@master migration]# ./migrate_base.pl > base.ldif
[root@master migration]# vi base.ldif

# edit only sections that are needed for your environment ( The follows is minimum requirement example )
dn: dc=server,dc=world
dc: server
objectClass: top
objectClass: domain

dn: ou=Hosts,dc=server,dc=world
ou: Hosts
objectClass: top
objectClass: organizationalUnit

dn: ou=People,dc=server,dc=world
ou: People
objectClass: top
objectClass: organizationalUnit

dn: ou=Group,dc=server,dc=world
ou: Group
objectClass: top
objectClass: organizationalUnit

[root@master migration]# ldapadd -x -W -D "cn=Manager,dc=server,dc=world" -f base.ldif
Enter LDAP Password:# ldap admin password
adding new entry "dc=server,dc=world"

adding new entry "ou=Hosts,dc=server,dc=world"

adding new entry "ou=People,dc=server,dc=world"

adding new entry "ou=Group,dc=server,dc=world"

[3] Add Existing User and Group to LDAP Server

# get users from /etc/passwd
[root@master migration]# grep "x:[5-9][0-9][0-9]" /etc/passwd > passwd
# get groups from /etc/group
[root@master migration]# grep "x:[5-9][0-9][0-9]" /etc/group > group
[root@master migration]# ./migrate_passwd.pl passwd > passwd.ldif
[root@master migration]# ./migrate_group.pl group > group.ldif

# add user and group to LDAP Server
[root@master migration]# ldapadd -x -W -D "cn=Manager,dc=server,dc=world" -f passwd.ldif
Enter LDAP Password:
adding new entry "uid=fedora,ou=People,dc=server,dc=world"

adding new entry "uid=suse,ou=People,dc=server,dc=world"

adding new entry "uid=ubuntu,ou=People,dc=server,dc=world"

adding new entry "uid=cent,ou=People,dc=server,dc=world"

adding new entry "uid=debian,ou=People,dc=server,dc=world"

[root@master migration]# ldapadd -x -W -D "cn=Manager,dc=server,dc=world" -f group.ldif
Enter LDAP Password:
adding new entry "cn=fedora,ou=Group,dc=server,dc=world"

adding new entry "cn=suse,ou=Group,dc=server,dc=world"

adding new entry "cn=ubuntu,ou=Group,dc=server,dc=world"

adding new entry "cn=cent,ou=Group,dc=server,dc=world"

adding new entry "cn=debian,ou=Group,dc=server,dc=world"

[4] If you'd like to delete User or Group that is added in LDAP Server, Do as below.

[root@master ~]# ldapdelete -x -W -D 'cn=Manager,dc=server,dc=world' "uid=cent,ou=people,dc=server,dc=world"
Enter LDAP Password:
[root@master ~]# ldapdelete -x -W -D 'cn=Manager,dc=server,dc=world' "cn=cent,ou=group,dc=server,dc=world"
Enter LDAP Password:

Build LDAP Server

[1] Install and Configure OpenLDAP. Replace my domain name section [linuxbasiccommand.blogspot.com] with your domain name.

[root@ns ~]# yum -y install openldap*

# create password
[root@ns ~]# slappasswd -s password -h {MD5}
# (1) remember it
{MD5}*********************

[root@ns ~]# vi /etc/openldap/slapd.conf

# line 85: specify domain name
suffix "dc=server-linux,dc=info"

# line 86: specify domain name
rootdn "cn=Manager,dc=server-linux,dc=info"

# line 91: add password that is set in (1)
rootpw {MD5}************************

# add these lines at the bottom
access to attrs=userPassword
by self write
by dn="cn=Manager,dc=server-linux,dc=info" write
by anonymous auth
by * none

access to *
by dn="cn=Manager,dc=server-linux,dc=info" write
by self write
by * read

[root@ns ~]# vi /etc/openldap/ldap.conf

# line 15: specify domain name
URI ldap://127.0.0.1/
BASE dc=server-linux,dc=info
TLS_CACERTDIR /etc/openldap/cacerts

[root@ns ~]# vi /etc/ldap.conf

# line 20: specify domain name
base dc=server-linux,dc=info

[root@ns ~]# cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
[root@ns ~]# /etc/rc.d/init.d/ldap start
Checking configuration files for slapd: /etc/openldap/slapd.conf: line 114: rootdn is always granted unlimited privileges.
/etc/openldap/slapd.conf: line 118: rootdn is always granted unlimited privileges.
config file testing succeeded[ OK ]
Starting slapd:[ OK ]
[root@ns ~]# chkconfig ldap on

[2] Add initial information

[root@ns ~]# cd /usr/share/openldap/migration
[root@ns migration]# vi migrate_common.ph

# line 71: specify domain name
$DEFAULT_MAIL_DOMAIN = "server-linux.info";

# line 74: specify domain name
$DEFAULT_BASE = "dc=server-linux,dc=info";

[root@ns migration]# ./migrate_base.pl > base.ldif
[root@ns migration]# vi base.ldif

# edit only sections that are needed for your environment ( The follows is minimum requirement example )
dn: dc=server-linux,dc=info
dc: server-linux
objectClass: top
objectClass: domain


dn: ou=People,dc=server-linux,dc=info
ou: People
objectClass: top
objectClass: organizationalUnit


dn: ou=Group,dc=server-linux,dc=info
ou: Group
objectClass: top
objectClass: organizationalUnit


[root@ns migration]# ldapadd -x -W -D "cn=Manager,dc=server-linux,dc=info" -f base.ldif
Enter LDAP Password:# passowrd set in (1)
adding new entry "dc=server-linux,dc=info"

adding new entry "ou=People,dc=server-linux,dc=info"

adding new entry "ou=Group,dc=server-linux,dc=info"

[3] Add Existing User and Group to LDAP Server


[root@ns migration]# grep ":5[0-9][0-9]" /etc/passwd > passwd
[root@ns migration]# grep ":5[0-9][0-9]" /etc/group > group
[root@ns migration]# ./migrate_passwd.pl passwd > passwd.ldif
[root@ns migration]# ./migrate_group.pl group > group.ldif

# add user and group to LDAP Server
[root@ns migration]# ldapadd -x -W -D "cn=Manager,dc=server-linux,dc=info" -f passwd.ldif
Enter LDAP Password:

adding new entry "uid=cent,ou=People,dc=server-linux,dc=info"

[root@ns migration]# ldapadd -x -W -D "cn=Manager,dc=server-linux,dc=info" -f group.ldif
Enter LDAP Password:

adding new entry "cn=cent,ou=Group,dc=server-linux,dc=info"

[4] If you'd like to delete User or Group that is added in LDAP Server, Do as below.

[root@ns ~]# ldapdelete -x -W -D 'cn=Manager,dc=server-linux,dc=info' "uid=cent,ou=people,dc=server-linux,dc=info"
Enter LDAP Password:
[root@ns ~]# ldapdelete -x -W -D 'cn=Manager,dc=server-linux,dc=info' "cn=cent,ou=group,dc=server-linux,dc=info"
Enter LDAP Password:

[5] After building LDAP Server, Configure on clients in order to share users' accounts

[root@www ~]# yum -y install openldap-clients

[root@www ~]# setup# run config tool
(1) Select 'Authentication Configuration' and go next

(2) Check boxes like following example and go next


(3) Specify IP address and Domain name of LDAP Server like following example

[root@www ~]# shutdown -r now

www.server-linux.info login:cent# the user on LDAP server
Password:
Last login: Mon Sep 10 22:10:17 on xvc0
[cent@www ~]$# could login normally