Rootmanual:ldap
Useful documentation
https://wiki.debian.org/LDAP/OpenLDAPSetup
http://www.openldap.org/doc/admin22/index.html
http://www.zytrax.com/books/ldap/ch6/slapd-config.html
https://wiki.debian.org/LDAP/MigrationTools
http://www.openldap.org/doc/admin24/sasl.html
http://techiezone.rottigni.net/2011/12/change-root-dn-password-on-openldap/
https://bobcares.com/blog/kerberos-and-ldap-so-strong-together/
http://www.lichteblau.com/ldapvi/manual/ <-- Super useful for editing
https://www.digitalocean.com/community/tutorials/how-to-encrypt-openldap-connections-using-starttls
Before you start
Make sure puppet is updated and ran. Our puppet configuration will install some needed schemas and software needed to follow this installation process.
Create certs and keytabs
Certficates
First, generate official certificates. There should be three files, in our case:
/etc/ldap/cert/chain-lysator.liu.se.pem /etc/ldap/cert/ldap.lysator.liu.se.pem /etc/ldap/cert/ldap.lysator.liu.se.key
Make sure that the openldap user has the rights to read these files.
chown -R openldap:openldap /etc/ldap/cert chmod 0500 /etc/ldap/cert chmod -R 0400 /etc/ldap/cert/*
Kerberos
The ldap server needs two keytabs, one for the server itself and one specific to ldap.
The host principal should be located under /etc as with all other machines.
The ldap/ldap.lysator.liu.se principal should be located at /etc/ldap/ldap.keytab and have 440 openldap:openldap.
/etc/default/slapd should be updated with (should already have been configured by puppet)
export KRB5_KTNAME=/etc/ldap/ldap.keytab
Bootstrap slapd
First install debian, configure the network and run puppet. Please see ldap-server in the lysator puppet git repo.
Now, slapd needs to be reconfigured (mainly to set ldap admin password). Run this:
dpkg-reconfigure -plow slapd
Example answers, note the password <ldap-admin>.
Omit OpenLDAP server configuration? no DNS nomain name: lysator.liu.se Organization name: lysator.liu.se Administrator password: <ldap-admin> Database backend to use: MDB Remove database when slapd is purged: no Move old database: yes Allow ldapv2 protocol: no
Last, make sure slapd is running:
service slapd start
You should see this in /var/log/syslog:
<date> ldap slapd[XXX]: slapd starting ldap slapd[XXX]: Starting OpenLDAP: slapd.
Purgin the database
To start from scratch:
service slapd stop rm -r /var/lib/ldap/* rm -r /etc/ldap/slapd.d/*
Configure slapd
The OpenLDAP server (slapd) is configured by making changes to a database call ed "cn=config".
We need to make a number of changes before we are ready to initialize the normal database with user data.
We make the changes by writing so called ldif files and applying them to the database with the ldapmodify tool.
ldapmodify -Y EXTERNAL -H ldapi:/// -f diff.ldif
For viewing changes we use the following:
ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=config"
Configure debug logging
Put this in debug.ldif
dn: cn=config changetype: modify replace: olcLogLevel olcLogLevel: -1
Run this to change log level.
ldapmodify -Y EXTERNAL -H ldapi:/// -f debug.ldif
Verify using this.
ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b "cn=config" "(olcLogLevel=*)" olcLogLevel
Borde skriva ut.
SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: cn=config olcLogLevel: -1
Configure more extensive indexing (To be removed)
Configure slapd to use more indexing to improve performance. Put this into indexing.ldif
dn: olcDatabase={1}mdb,cn=config changetype: modify add: olcDbIndex olcDbIndex: cn pres,sub,eq - add: olcDbIndex olcDbIndex: sn pres,sub,eq - add: olcDbIndex olcDbIndex: uid pres,sub,eq - add: olcDbIndex olcDbIndex: displayName pres,sub,eq - add: olcDbIndex olcDbIndex: default sub - add: olcDbIndex olcDbIndex: uidNumber eq - add: olcDbIndex olcDbIndex: gidNumber eq - add: olcDbIndex olcDbIndex: mail,givenName eq,subinitial - add: olcDbIndex olcDbIndex: dc eq
Run this:
ldapmodify -Y EXTERNAL -H ldapi:/// -f indexing.ldif
Import NIS User schema
Import nis schema
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif
Verify that you can find posixAccount
ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=config" | grep posixAccount
Modify NIS schema, change NetgroupTriple SYNTAX to 1.3.6.1.4.1.1466.115.121.1.26 using ldapvi
ldapvi -h ldapi:/// -D cn=config -Y EXTERNAL -b cn=config
Import AUTOFS schema
Import autofs schema
ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/autofs-ldap.ldif
Verify that you can find automount
ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=config" | grep automount
Add top ou for automount to automount.ldif
dn: ou=automount,dc=lysator,dc=liu,dc=se ou: automount objectClass: top objectClass: organizationalUnit
Import using
ldapadd -H ldapi:/// -D "cn=admin,dc=lysator,dc=liu,dc=se" -W -f automount.ldif
Verify using
ldapsearch -Y EXTERNAL -H ldapi:/// -b "dc=lysator,dc=liu,dc=se" "(objectClass=organizationalUnit)"
Following should be in the output
dn: ou=automount,dc=lysator,dc=liu,dc=se ou: automount objectClass: top objectClass: organizationalUnit
Kerberos Auth
Make ldap use kerberos for auth against ldap (e.g database access). This does not cover using kerberos for login.
NOTE: Double check if schema uses ou People or users. If users is used then replace People with users bellow.
Add the following to kerb.ldif
dn: cn=config changetype: modify add: olcAuthzRegexp olcAuthzRegexp: uid=(.*),cn=lysator.liu.se,cn=gssapi,cn=auth uid=$1,ou=People,dc=lysator,dc=liu,dc=se dn: cn=config changetype: modify add: olcSaslHost olcSaslHost: ldap.lysator.liu.se dn: cn=config changetype: modify add: olcSaslRealm olcSaslRealm: LYSATOR.LIU.SE
Run this:
ldapmodify -Y EXTERNAL -H ldapi:/// -f kerb.ldif
Verify by running
ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b "cn=config" "(olcAuthzRegexp=*)" olcAuthzRegexp
Should output
SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: cn=config olcAuthzRegexp: {0}uid=(.*),cn=lysator.liu.se,cn=gssapi,cn=auth uid=$1,ou=People,dc=lysator,dc=liu,dc=se
ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b "cn=config" "(olcSaslHost=*)" olcSaslHost
Should output
SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: cn=config olcSaslHost: ldap.lysator.liu.se
ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b "cn=config" "(olcSaslRealm=*)" olcSaslRealm
Should output
SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: cn=config olcSaslRealm: LYSATOR.LIU.SE
Verify that the output matches the same as configured above
Next, add 'export KRB5_KTNAME=/etc/ldap/ldap.keytab' to /etc/default/slapd (there should be a similar entry where you can put this line)
Configure SASL/SSL
Put the following in ldif files and apply.
Specify certificate and change verify client to allow (does the default (never) work? (note, dashes between lines should be included)
dn: cn=config changetype: modify add: olcTLSCACertificateFile olcTLSCACertificateFile: /etc/ldap/cert/chain-lysator.liu.se.pem - add: olcTLSCertificateFile olcTLSCertificateFile: /etc/ldap/cert/ldap.lysator.liu.se.pem - add: olcTLSCertificateKeyFile olcTLSCertificateKeyFile: /etc/ldap/cert/ldap.lysator.liu.se.key - add: olcTLSVerifyClient olcTLSVerifyClient: allow
Add using:
ldapadd -Y EXTERNAL -H ldapi:/// -f certs.ldif
Should output:
SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "cn=config"
Check it using:
ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b "cn=config" "(olcTLSCACertificateFile=*)" olcTLSCACertificateFile olcTLSCertificateFile olcTLSCertificateKeyFile olcTLSVerifyClient
Should output:
SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 dn: cn=config olcTLSCACertificateFile: /etc/ldap/cert/chain-lysator.liu.se.pem olcTLSCertificateFile: /etc/ldap/cert/ldap.lysator.liu.se.pem olcTLSCertificateKeyFile: /etc/ldap/cert/ldap.lysator.liu.se.key olcTLSVerifyClient: allow
Check that admin can login using tls:
ldapsearch -LLL -ZZ -W -H ldap:/// -D "cn=admin,dc=lysator,dc=liu,dc=se" -b "dc=lysator,dc=liu,dc=se" "(cn=admin)" description
Should first query for password, like so:
Enter LDAP Password:
It is the password entered during package configuration.
Then it should print the following:
dn: cn=admin,dc=lysator,dc=liu,dc=se description: LDAP administrator
Only allow encrypted connections when accessing the database
dn: olcDatabase={1}mdb,cn=config changetype: modify replace: olcSecurity olcSecurity: tls=1
Add it like so:
ldapadd -Y EXTERNAL -H ldapi:/// -f tls.ldif
Should print:
SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={1}mdb,cn=config"
Check that it is in the config:
ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b "cn=config" "(olcSecurity=*)" olcSecurity | grep olcSecurity
Should output:
SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 olcSecurity: tls=1
Allow chsh, chfn and root to modify anything
In order to allow users to change their shell, an acl rule is required.
Place the following text in shell.ldif:
dn: olcDatabase={1}mdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=loginShell by self write by * read olcAccess: {1}to * by set="[cn=root,ou=Group,dc=lysator,dc=liu,dc=se]/memberUid & user/uid" manage by * read
Then run the following:
ldapmodify -Y EXTERNAL -H ldapi:/// -f shell_access.ldif
It should print:
SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 modifying entry "olcDatabase={1}mdb,cn=config"
Verify by running:
ldapsearch -Y EXTERNAL -H ldapi:/// -b olcDatabase={1}mdb,cn=config olcAccess
It should print:
SASL/EXTERNAL authentication started SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth SASL SSF: 0 # extended LDIF # # LDAPv3 # base <olcDatabase={1}mdb,cn=config> with scope subtree # filter: (objectclass=*) # requesting: olcAccess # # {1}mdb, config dn: olcDatabase={1}mdb,cn=config olcAccess: {0}to attrs=loginShell,gecos by self write by * read olcAccess: {1}to * by set="[cn=root,ou=Group,dc=lysator,dc=liu,dc=se]/memberUi d & user/uid" manage by * read # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1
Importing data from NIS
- Import from nis scripts.
- Autofs conversion.
Add uid counter
Place the following in nextUid.ldif:
dn: cn=nextUid,dc=lysator,dc=liu,dc=se changetype: add objectClass: top objectClass: organizationalRole objectClass: uidObject cn: nextUid uid: 10000
Run:
ldapmodify -Y EXTERNAL -H ldapi:/// -f nextUid.ldif
Should print:
TODO
To verify run:
ldapsearch -ZZ -H ldap://ldap.lysator.liu.se -b "dc=lysator,dc=liu,dc=se" "(objectClass=uidObject)"
Should print:
SASL/GSSAPI authentication started SASL username: net4all@LYSATOR.LIU.SE SASL SSF: 56 SASL data security layer installed. # extended LDIF # # LDAPv3 # base <dc=lysator,dc=liu,dc=se> with scope subtree # filter: (objectClass=uidObject) # requesting: ALL # # nextUid, lysator.liu.se dn: cn=nextUid,dc=lysator,dc=liu,dc=se objectClass: top objectClass: organizationalRole objectClass: uidObject cn: nextUid uid: 10000 # search result search: 5 result: 0 Success # numResponses: 2 # numEntries: 1
Character conversion
Check encoding from output when converting from nis to ldap
file -bi <file>
Convert to utf-8
iconv -f <current-encoding> -t utf-8 <file> > <file>-utf8.ldif
Check top tree nodes in ldap database
Before we import data into the database, we should verify that some structures exist. Also, that admin can login.
ldapsearch -Z -H ldapi:/// -b "dc=lysator,dc=liu,dc=se" -D "cn=admin,dc=lysator,dc=liu,dc=se" -W
Use the password specified during the package configuration.
Should display:
# admin, lysator.liu.se dn: cn=admin,dc=lysator,dc=liu,dc=se objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: <password-hash> # search result search: 3 result: 0 Success # numResponses: 3 # numEntries: 2
Configure migrationtools
Run this:
apt-get install migrationtools
This installs a number of scripts and configuration tools for converting NIS to ldap.
Configuration files can be found here:
/usr/share/migrationtools
Cruically in :
/etc/migrationtools/migrate_common.ph
Change to the following:
$DEFAULT_MAIL_DOMAIN = "lysator.liu.se"; $DEFAULT_BASE = "dc=lysator,dc=liu,dc=se";
Importing into ldap database
Remember to convert the output of the migration scripts. Then run this.
ldapadd -Z -H ldapi:/// -D "cn=admin,dc=lysator,dc=liu,dc=se" -W -f nis-utf8.ldif
It will display many lines similar to this:
adding new entry "uid=<user>,ou=<thing>,dc=lysator,dc=liu,dc=se"
And the command may take several seconds to complete (depending on the dataset size).
Migrating autofs
NOTE: Migration tools provides a tool to migrate from nis but ueses other objectClasses. Some manuall work is needed to match the schema we use.
NOTE: Data should be in utf-8 before importing. Don't forget to convert.
Following needs to be converted: auto.master auto.home auto.pkg auto.lysator
auto.master
Add
dn: ou=auto.master,ou=automount,dc=lysator,dc=liu,dc=se ou: auto.master objectClass: top objectClass: automountMap
Indirect mounts
Next is to add entries for /home, /mp and /pkg Template follows:
dn: cn=/<dir>,ou=auto.master,ou=automount,dc=lysator,dc=liu,dc=se objectClass: top objectClass: automount cn: /<dir> automountInformation: auto.<file> <mount info>
where dir is mount point e.g /home. File is home for auto.home
For each indirect mount you also have to add a "top" for that "file"
dn: ou=auto.<file>,ou=automount,dc=lysator,dc=liu,dc=se ou: auto.<file> objectClass: top objectClass: automountMap
Entry Template
dn: cn=<name>,ou=auto.<file>,ou=automount,dc=lysator,dc=liu,dc=se cn: <name> objectClass: automount objectClass: top automountInformation: -fstype=nfs,rw <additional mount options> <server>:<path>
Errors & Hell
Implementation Specific Error (80)
This can be due to incorrect indentation or possibly that a path to a file specified in the ldif is incorrect. We got this error while trying to add the encryption keys. The path was correct but the files had not been moved there yet. Implementation Specific Error seems to be a catch all kind of error.\
Database config change doesn't take effetct
Try restarting slapd. Some changes doesn't take effect immediately.