Changes between Version 2 and Version 3 of dSite/e0LDAP

Timestamp:

Oct 1, 2014, 7:24:41 PM (10 years ago)

Author:

seskar

Comment:

—

dSite/e0LDAP

@@ -1 +1 @@
 == Configure LDAP ==
 
-We will asume that the FQDN based DN base is '''dc=geni,dc=net'''
+These instructions assume that the FQDN is console.geni.net and that (based on FQDN) LDAP DN base is '''dc=geni,dc=net'''.
 
 [[TOC(WiMAX/dSite*)]]
  
 === Setting up LDAP server ===
-
-'''These need to be fixed - we are copying all the neccessary files and should not need anything here'''
-2. Edit /etc/ldap.conf 
- 1. Check that you have a proper URI (round line 30):
+1. Create file '''/etc/ssl/geni-site-ca.info" with:
 {{{
-uri ldap://console.geni.net/
+cn = GENI WiMAX Company
+ca
+cert_signing_key
 }}}
- 2. Uncommend line for host attribute:
+1. Create file '''/etc/ssl/geni-site-console.info''' with (please change console.geni.net to match your FQDN):
 {{{
-pam_check_host_attr yes
+organization = Example Company
+cn = console.geni.net
+tls_www_server
+encryption_key
+signing_key
+expiration_days = 3650
 }}}
-3. Add these two schemas to your ldap  by copying to schema directory (/etc/ldap/slapd.d/cn=config/cn=schema)
+1. Execute the following command to create SSL certificates:
 {{{
-cd  /etc/ldap/slapd.d/cn\=config/cn\=schema
-wget http://wimax.orbit-lab.org/mmm/cn={4}openssh-lpk-opnldap.ldif
-wget http://www.orbit-lab.org/mmm/cn={5}ldapns.ldif
+/usr/sbin/create_ldap_certificates.sh
 }}}
-
-4. Import initial group and user
+1. Create LDIF file for our newly created certificates in the file named /etc/ssl/geni-cer-info.ldif:
 {{{
-cd /etc/ldap
-wget http://www.orbit-lab.org/mmm/cn={5}ldapns.ldif
-ldapadd -vvv -x -D cn=admin,dc=geni,dc=net -H ldap:/// -W -f init.ldif
+dn: cn=config
+add: olcTLSCACertificateFile
+olcTLSCACertificateFile: /etc/ssl/certs/cacert.pem
+-
+add: olcTLSCertificateFile
+olcTLSCertificateFile: /etc/ssl/certs/console_slapd_cert.pem
+-
+add: olcTLSCertificateKeyFile
+olcTLSCertificateKeyFile: /etc/ssl/private/console_slapd_key.pem
 }}}
-
-5. Fix the configuration for LDAP for phpldapadmin:
+and then execute:
+{{{
+ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ssl/geni-cert-info.ldif
+}}}
+5. Fix the configuration for newly create LDAP for phpldapadmin:
 {{{ 
 edit /etc/phpldapadmin/config.php and change dc=example,dc=com to dc=geni,dc=net
@@ -38 +48 @@
 $servers->setValue('login','bind_id','cn=admin,dc=geni,dc=net');
 }}}
-6. Point the Firefox web browser to http://<ip>/phpldapadmin. Set password for group admin user (add attribute -> Password -> set password -> update object)
-
-
-7. Make sure you can access the service with admin credentials:
+1. Point the Firefox web browser to http://<console-ip-address>/phpldapadmin. Set password for group admin user (add attribute -> Password -> set password -> update object)
+1. Make sure you can access the service with admin credentials:
 {{{
    ldapsearch -x   -b "dc=geni,dc=net"  "objectClass=organizationalRole"
@@ -50 +58 @@
 }}}
 
-=== Configure the client ===
-1. Edit the /etc/ldap.conf file to configure the ldap client. 
-{{{
-    base dc=geni,dc=net
-    uri ldap://ldap.geni.net/
-    ldap_version 3
-    binddn
-    rootbinddn cn=admin,dc=geni,dc=net
-    pam_password md5
-    nss_initgroups_ignoreusers backup,bin,daemon,games,gnats,irc,libuuid,libvirt- qemu,list,lp,mail,man,messagebus,news,ntp,postfix,proxy,root,sshd,statd,sync,sys,syslog,usbmux,uucp,www-data
-}}}
-
-2.  The /etc/nsswitch.conf file should have the follow non comment lines:
-{{{
-    passwd:         files ldap compat
-    group:          files ldap compat
-    shadow:         files compat
-
-    hosts:          files dns
-    networks:       files
-
-    protocols:      db files
-    services:       db files
-    ethers:         db files
-    rpc:            db files
-
-    netgroup:       nis
-}}}
-
-3. Copy or create the /etc/ldap.secret file. It should contain the ldap password in clear text.
-4. Finally add the follow line to the /etc/sudoers file (note this is done with the visudo command).
-{{{
-    %admin ALL=(ALL) ALL
-    %sysadmin ALL=NOPASSWD: ALL
-}}}
-    This has to be done manually.