Changes between Version 14 and Version 15 of dSite/e0LDAP

Timestamp:

Oct 10, 2014, 9:35:44 PM (10 years ago)

Author:

ssugrim

Comment:

—

dSite/e0LDAP

@@ -5 +5 @@
 === Post-installation OS Services Configuration ===
 
-Run the OS configuration script:
-{{{
+ 1. Run the OS configuration script:
+    {{{
 /usr/sbin/geni_os_setup.rb
-}}}
-It should produce:
-{{{
+    }}}
+    It should produce:
+    {{{
 user@testcons:~# sudo /usr/sbin/geni_os_setup.rb
 Loading /etc/omf-aggmgr-5.4/site.yaml... done.
@@ -108 +108 @@
 SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
 SASL SSF: 0
-}}}
-
-After this script is run, we will need to point the dns resolver to the localhost. To do this edit ''/etc/network/interfaces'' file and change the '''dns-nameservers''' line to use '''localhost''', e.g.:
-{{{
+    }}}
+ 2. After this script is run, we will need to point the dns resolver to the localhost. To do 
+    this edit ''/etc/network/interfaces'' file and change the '''dns-nameservers''' line to 
+    use '''localhost''', e.g.:
+    {{{
 # The primary network interface
 auto eth2
@@ -120 +121 @@
       dns-nameservers localhost
 
-}}}
-then restart the networking service to reflect the DNS change:
-{{{
+    }}}
+    then restart the networking service to reflect the DNS change:
+    {{{
 /etc/init.d/networking restart
-}}}
-Once this setting is done you can test the local dns by tring to resolve node names e.g.:
-{{{
+    }}}
+    Once this setting is done you can test the local dns by tring to resolve node names e.g.:
+    {{{
 host node1.geni.rutgers.edu
 node1.geni.rutgers.edu has address 10.1.1.1
-}}}
-External name resolution should also work.
-
-Next edit ''/etc/nsswitch.conf'' file so that is has the follow non comment lines:
-{{{
+    }}}
+    External name resolution should also work.
+
+ 3. Edit ''/etc/nsswitch.conf'' file so that is has the follow non comment lines:
+    {{{
     passwd:         files ldap compat
     group:          files ldap compat
@@ -147 +148 @@
 
     netgroup:       nis
-}}}
-Finally add the follow line to the /etc/sudoers file (note this is done with the visudo command).
-{{{
+    }}}
+ 4. Add the follow line to the /etc/sudoers file (note this is done with the visudo command).
+    {{{
     %admin ALL=(ALL) ALL
     %sysadmin ALL=NOPASSWD: ALL
-}}}
+    }}}
   
 
-In file /etc/ldap/ldap.conf make sure you have:
-{{{
+ 5. Edit the file /etc/ldap/ldap.conf and make sure the following lines have these values (add 
+    them if they are missing):
+    {{{
 TLS_CACERT      /etc/ssl/certs/cacert.pem
 TLS_REQCERT     never
-}}}
-
-=== Import initial LDAP content ===
+    }}}
+    then restart the ldap daemon with:
+    {{{
+/etc/init.d/slapd restart
+    }}}
+
+=== Import initial GENI LDAP content ===
 Next we will import initial content consisting of first groups and accounts that will be used as administrators for the range of services. The deployment assumes the following delegated accounting structure: users are organized into groups based on their organization or project (or in LDAP terms organizational units (OUs)). Each group can have number of administrators (or users with group management capabilities) but has to have one person who is the main administrator for the OU (the principal investigator - PI). While most of the account management is performed through Control Panel functions, the initial site administrator and the first OU need to be added to LDAP manually. This can be done through ''phpldapadmin'' or through LDIF configuration file and command line tools. The LDIF config for initial import looks like:
 {{{