Difference between revisions of "LDAP Ramblings"
m (Protected "LDAP Ramblings" ([edit=comp] (indefinite) [move=comp] (indefinite) [read=comp] (indefinite)))
Revision as of 01:38, 5 November 2009
On the IAC's user accessable Linux servers (Brems, web, Inca, backup) there is a need for centralized user authentication. With the addition of email users this need becomes critical. The proposed solution is to use OpenLDAP replicated across the mail servers for redundancy.
Adding users manually
- Create ldap entry, either by web form or manually
- Create home directory: mkdir /home/user
- Copy skel files: cp /etc/skel/.* /home/user/
- Change permissions: chown -R user:email /home/user/
Converting mail from Athena
On athena, create .forward with the following contents:
And make sure the permissions are fine:
chmod a+x . chown user:group .forward chmod a+r .forward
Then on IAC mail:
mkdir oldmail chmod go-rwx ./oldmail cd oldmail rsync -rzP email@example.com:/var/spool/mail/user ./mbox rsync -rzP firstname.lastname@example.org:/home/whatever/user/mail ./ rsync -rzP email@example.com:/home/whatever/user/Sent ./
---and so on for all mail folders
Translate the old mbox files to Maildir
mb2md -s oldmail/ mv Maildir/.mbox/cur/* Maildir/cur ##this glob man fail for huge numbers of messages
Maildir/.mbox/new/, Maildir/.mbox/tmp/ should be empty
This should be it, but maybe Sent needs to be copied somewhere else?
Administrative users will retain entries in the local /etc/passwd and /etc/shadow files for troubleshooting access. All other users will exist in LDAP and will have individual server permissions.
Ideally email users can be accommodated without having local accounts. If this is not possible, the local shell can be set to disallow logins for security purposes.
Currently not planned, but possible once the setup has been proven. This would allow users to log into any machine using their username and login. Only a select few machines (data aquisition etc.) would retain generic iacuser access.
The standard LDIF:
version: 1 dn: uid=oborn,ou=People,dc=iac,dc=isu,dc=edu cn: Brian Oborn sn: Brian Oborn uid: oborn loginShell: /bin/bash mail: firstname.lastname@example.org gidNumber: 5001 homeDirectory: /home/oborn uidNumber: 20XX objectClass: person objectClass: organizationalPerson objectClass: IACperson objectClass: posixAccount objectClass: CourierMailAccount objectClass: shadowAccount userPassword:: e0N... IACpermission: iacmail
Note that sn breaks the standard (should be last name), but it's easier to create as-is
For samba authentication add the following classes:
- These are in samba.schema, but require nis.schema, inetorgperson.schema, and cosine.schema first
- Check ACL's as explained on page 126 of "Using Samba"
Example LDAP Commands
Create a ssh tunnel from local port 3890 to darwin.iac.isu.edu port 389
- ssh -L 3890:localhost:389 darwin.iac.isu.edu
Search directory, simple password bind:
- ldapsearch -h localhost -x -D cn=admin,dc=iac,dc=isu,dc=edu -W -b dc=iac,dc=isu,dc=edu '*'
Search directory, anonymous bind:
- ldapsearch -h localhost -x -b dc=iac,dc=isu,dc=edu '*'
Add an LDIF file:
- ldapadd -h localhost -x -D cn=admin,dc=iac,dc=isu,dc=edu -W < ~brian/oborn.ldif
Delete an LDAP entry:
- ldapdelete -h localhost -x -D cn=admin,dc=iac,dc=isu,dc=edu -W 'uid=oborn,dc=iac,dc=isu,dc=edu'
Change an LDAP password:
- ldappasswd -h localhost -x -D uid=oborn,ou=People,dc=iac,dc=isu,dc=edu -A -W -S
As admin, change someone else's password:
- ldappasswd -h localhost -x -D cn=admin,dc=iac,dc=isu,dc=edu -A -W -S uid=oborn,ou=People,dc=iac,dc=isu,dc=edu
Debian LDAP VM
- Distinguished name of the search base:"dc=iac,dc=isu,dc=edu"
- LDAP version 3
- Priviledged account for libpam/libnss ldap: "cn=admin,dc=iac,dc=isu,dc=edu"
- Need to modify /etc/nsswitch.conf to use the "ldap" datasource. Example file /usr/share/doc/libnss-ldap/examples/nsswitch.ldap
The following /etc/nsswitch lines:
passwd: compat group: compat shadow: compat hosts: files dns netgroup: nis
will be changed to:
passwd: files ldap group: files ldap #shadow line removed (only needed for pre-nsswitch compat programs?) hosts: files dns ldap netgroup: files ldap
- Base DN: dc=iac, dc=isu, dc=edu
- Root DN: cn=Administrator, Append Base DN=true
- Default Policy Object DN: cn=Default Password Policy, Append Base DN=true
The rest of the schema was set up by the SUSE tools SUSE /etc/nsswitch.conf file has the following relevent lines:
passwd: compat group: files ldap services: files ldap #probably not needed netgroup: files ldap aliases: files ldap passwd_compat: ldap
The line "passwd: ldap" should be able to replace the 2 passwd lines as long as you're not using the "+" NIS notation in the /etc/passwd file?
- Requires ntp time syncronization between replication servers.
- Only works with OpenLDAP 2.4 (not available in current Debian/Ubuntu/SUSE repositories)
- Probably not needed with our very infrequent writes