Changes

In this lab, you set the instruction is for setting up and configure an LDAP server with the base context of "dc=nad810,dc=com". Replace this with your own base context. After setting up the OpenLDAP server and , you need to configure the LDAP clients to use the user account information stored in the LDAP server to perform user authenicationon the client machine. You can use the OpenLDAP client/server to replace your NIS client/server for network user authentication.

* migrationtools (for Fedora 10)Sample nsswitch configuration file for LDAP: /usr/share/doc/nss_ldap-220/nsswitch_ldap

 ===OpenLDAP Server configuration Summary===

#Create an OpenLDAP “root” password and edit the OpenLDAP main database configuration file /etc/openldap/slapd.confd/cn=config/olcDatabase={2}hdb.ldif#Start the OpenLDAP server daemon- slapd.service#Create an a base LDIF file for importing to the OpenLDAP database#Create a user account LDIF file for importing to the OpenLDAP database#Import an the LDIF file files into the OpenLDAP database

====OpenLDAP Server configuration details:====

===(1) Create an /verify the directory for OpenLDAP databasefiles===<pre> mkdir /var/lib/ldap/ chown ldap.ldap /var/lib/ldap chmod 700 /var/lib/ldap</pre>The directory listing of /var/lib/ldap should be:<pre>[root@localhost cn=config]# ls -ldZ /var/lib/ldapdrwx------. ldap ldap system_u:object_r:slapd_db_t:s0 /var/lib/ldap</pre>

mkdir /var/lib/ldap/nad810.com===(2) Configure base content and root user "olcRootDN" and "olcRootPW" === chown ldap.ldap Configure the OpenLDAP “root” user and password by editing the OpenLDAP server's database configuration file “/varetc/libopenldap/ldap/nad810slapd.com chmod 700 /var/libd/ldapcn=config/nad810olcDatabase={2}hdb.comldif”

(2)Create an OpenLDAP “root” password and edit the OpenLDAP server's main configuration file “/etc/openldap/slapd.conf” Only the LDAP's “rootdn” user can create, import, and export data into a LDAP database. You can use the slappasswd command to create a the password and use put it in the LDAP server database configuration filementioned above:<pre>

New password: [nad810secret]

Re-enter new password: [nad810secret]

{SSHA}3NVLOWwqIMka3OyIYLyGrrkirD0pU0Qx FavfvViq/edEw8x4TV6y7w1L2llXzZzz <-- Copy this to the slapdolcDatabase={2}hdb.conf ldif file</pre>

Add/Modify the slapdolcDatabase={2}hdb.conf ldif file to show have the following: <pre> database bdb suffix “dc olcSuffix: dc=nad810,dc=com”com rootdn “cn olcRootDN: cn=Manager,dc=nad810,dc=com”com rootpw olcRootPW: {SSHA}3NVLOWwqIMka3OyIYLyGrrkirD0pU0QxFavfvViq/edEw8x4TV6y7w1L2llXzZzz directory </var/lib/ldap/nad810pre>Do not change other lines.com

===(3) Start the OpenLDAP server daemonslapd.service===<pre> systemctl start slapd.service</pre>

service ldap start To verify that the service OpenLDAP server daemon is running and working, try the following query command:

  <pre>

 ===(4)Create an LDIF file files for importing to the OpenLDAP database===  a. add an user called “ldapuser” useradd -g users ldapuser passwd ldapuser  b. extract ====create the passwd entry of ldapuser from /etc/passwd to a base context LDIF file called "entryfor the nad810.ldapuser"com domain==== grep ldapuser /etc/passwd > /etc/openldap/entry.ldapuser  c. extract the passwd entry of root from /etc/passwd to Create a file called "entryldif.root" grep root /etc/passwd > /etc/openldap/entry.root  d. convert the entries for the "ldapuserbase" and "root" to LDIF format (ldif.ldapuser and ldif.root):  (Note that "\" at the end of the line is used to tell the shell that the next line as a continuation of add the current line)  For ldapuser: /usr/share/openldap/migration/migrate_passwd.pl \ /etc/openldap/entry.ldapuser /etc/openldap/ldif.ldapuser For Fedora 10, replace /usr/share/openldap/migration/migrate_passwd.pl with /usr/share/migrationtools/migrate_passwd.pl For root: /usr/share/openldap/migration/migrate_passwd.pl \ /etc/openldap/entry.root /etc/openldap/ldif.root For Fedora 10, replace /usr/share/openldap/migration/migrate_passwd.pl with /usr/share/migrationtools/migrate_passwd.pl  e. edit ldif.ldapuser (change dc=pad1 to dc=nad810) dn: uid=ldapuser,ou=People,dc=padl,dc=com uid: ldapuser cn: ldapuser objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}!! shadowLastChange: 12821 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 501 gidNumber: 100 homeDirectory: /home/ldapuser  f. edit ldif.root (change dc=pad1 to dc=nad810) dn: uid=root,ou=People,dc=padl,dc=com uid: root cn: root objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}$1$3gRCMQww$8OCADPFZLjFr6DiFUi8Nn1 shadowLastChange: 12759 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 0 gidNumber: 0 homeDirectory: /root gecosfollowing lines: root

====d. convert the entries for the "ldapuser" to LDIF format (5ldif.ldapuser) Import LDIF files into the OpenLDAP database====

1.- Find the line starts with the word "'''host'''" and set the IP address to the appropriate value. -> Use 127.0.0.1 if the OpenLDAP server is running on your own machine, otherwise set it to the IP address of the OpenLDAP server. 2.- Find the line starts with the word "'''base'''" and set the context to your base directory -> For the purpose of this lab, set it to:base dc=nad810,dc=com 3.- Find the line starting with "'''uri ldap://'''", if your client is the same machine than your server, leave 127.0.0.1, otherwise set it to the IP of the OpenLDAP server.

Find the line starts with the word Note: The lines "'''base'''" and "'''uri ldap://'''" should be set the context to your base directoryin '''/etc/openldap/ldap.conf''' file as well. For the purpose of this lab, set it tobase dc=ops535,cd=com