Changes between Initial Version and Version 1 of dSite/e0LDAP

Timestamp:

Sep 30, 2014, 2:17:18 PM (10 years ago)

Author:

seskar

Comment:

—

dSite/e0LDAP

@@ +1 @@
+== Configure LDAP ==
+
+We will asume that the FQDN based DN base is '''dc=geni,dc=net'''
+
+ 
+=== Setting up LDAP server ===
+
+'''These need to be fixed - we are copying all the neccessary files and should not need anything here'''
+2. Edit /etc/ldap.conf 
+ 1. Check that you have a proper URI (round line 30):
+{{{
+uri ldap://console.geni.net/
+}}}
+ 2. Uncommend line for host attribute:
+{{{
+pam_check_host_attr yes
+}}}
+3. Add these two schemas to your ldap  by copying to schema directory (/etc/ldap/slapd.d/cn=config/cn=schema)
+{{{
+cd  /etc/ldap/slapd.d/cn\=config/cn\=schema
+wget http://wimax.orbit-lab.org/mmm/cn={4}openssh-lpk-opnldap.ldif
+wget http://www.orbit-lab.org/mmm/cn={5}ldapns.ldif
+}}}
+
+4. Import initial group and user
+{{{
+cd /etc/ldap
+wget http://www.orbit-lab.org/mmm/cn={5}ldapns.ldif
+ldapadd -vvv -x -D cn=admin,dc=geni,dc=net -H ldap:/// -W -f init.ldif
+}}}
+
+5. Fix the configuration for LDAP for phpldapadmin:
+{{{ 
+edit /etc/phpldapadmin/config.php and change dc=example,dc=com to dc=geni,dc=net
+
+$servers->setValue('server','base',array('dc=geni,dc=net'));
+$servers->setValue('login','bind_id','cn=admin,dc=geni,dc=net');
+}}}
+6. Point the Firefox web browser to http://<ip>/phpldapadmin. Set password for group admin user (add attribute -> Password -> set password -> update object)
+
+
+7. Make sure you can access the service with admin credentials:
+{{{
+   ldapsearch -x   -b "dc=geni,dc=net"  "objectClass=organizationalRole"
+   ldapsearch -x   -b "dc=geni,dc=net"  "objectClass=organizationalUnit"
+   ldapsearch -x   -b "dc=geni,dc=net"  "objectclass=organizationalUnit"
+   ldapsearch -x   -b "dc=geni,dc=net"  "objectClass=posixGroup"
+   ldapsearch -x localhost -D "cn=admin,dc=geni,dc=net" -W -b "dc=geni,dc=net" uid=*
+}}}
+
+=== Configure the client ===
+1. Edit the /etc/ldap.conf file to configure the ldap client. 
+{{{
+    base dc=geni,dc=net
+    uri ldap://ldap.geni.net/
+    ldap_version 3
+    binddn
+    rootbinddn cn=admin,dc=geni,dc=net
+    pam_password md5
+    nss_initgroups_ignoreusers backup,bin,daemon,games,gnats,irc,libuuid,libvirt- qemu,list,lp,mail,man,messagebus,news,ntp,postfix,proxy,root,sshd,statd,sync,sys,syslog,usbmux,uucp,www-data
+}}}
+
+2.  The /etc/nsswitch.conf file should have the follow non comment lines:
+{{{
+    passwd:         files ldap compat
+    group:          files ldap compat
+    shadow:         files compat
+
+    hosts:          files dns
+    networks:       files
+
+    protocols:      db files
+    services:       db files
+    ethers:         db files
+    rpc:            db files
+
+    netgroup:       nis
+}}}
+
+3. Copy or create the /etc/ldap.secret file. It should contain the ldap password in clear text.
+4. Finally add the follow line to the /etc/sudoers file (note this is done with the visudo command).
+{{{
+    %admin ALL=(ALL) ALL
+    %sysadmin ALL=NOPASSWD: ALL
+}}}
+    This has to be done manually.