Difference between revisions of "OPS535-lab-ldap"

From CDOT Wiki
Jump to: navigation, search
m (Investigation 2: Setup and Configure OpenLdap Client: - Dealing with centos 8 not including ldap)
m (Pre-Requisites: - removed warning about ldap not being supported in Centos 8. Work-around found.)
Line 10: Line 10:
  
 
==Pre-Requisites==
 
==Pre-Requisites==
The pre-lab must be complete so that your virtual machines share access to a private network.
+
The pre-lab must be complete so that your virtual machines share access to a private network. Lab 1 must be complete so each machine has a well configured firewall.
Due to Centos 8 no longer including support for LDAP, this lab will have to be performed on Centos 7 VMs.  Install 2 new VMs in your virtual networks using a minimal installation of Centos 7, giving them hostnames and addresses appropriate to your domain and network numbers.  In this lab they will be referred to as vm4 (for the ldap server), and vm5 (for the client).
 
  
 
==Investigation 1: OpenLDAP Server Setup and Configuration==
 
==Investigation 1: OpenLDAP Server Setup and Configuration==

Revision as of 21:57, 27 September 2020

OPS535 Lab 3

Purpose

The OpenLDAP software package is a Free and Open Source implementation of the Lightweight Directory Access Protocol (LDAP). It is gaining wide acceptance as the directory access method of the Internet and also with corporate intranets. In this lab, you set up and configure an OpenLDAP server to provide directory service for LDAP Clients to authenticate network users. You can use OpenLDAP server to replace NIS to centrally store network user account information for OpenLDAP client to authenticate network users. The basic components of an LDAP server are its Object Classes and Attribute types defined in one or more Schema. To provide the necessary attribute types (ie. Field) for storing Linux (or Unix, aka Posix) user accounts, you need to include the “cosine”, “nis”, and “inetorgperson” schemata in addition to the “core” schema. Notes: OpenLDAP Use TCP port 389 for regular network communication between clients and servers, and use port 636 for encrypted network communication between clients and servers. If you have firewalls between your LDAP server and LDAP clients, you need to open the above TCP ports on the firewall to allow LDAP traffic to get through.

Designate vm1 as your LDAP server and use vm2 and vm3 as LDAP clients

Pre-Requisites

The pre-lab must be complete so that your virtual machines share access to a private network. Lab 1 must be complete so each machine has a well configured firewall.

Investigation 1: OpenLDAP Server Setup and Configuration

Important.png
Warning
Make a backup before you start this lab. It is very difficult to recover this service if you make a mistake in configuration.

Perform the following steps on a new vm (we'll call it vm4) installed using Centos 7:

  1. Install the following packages
    • openldap
    • openldap-clients
    • openldap-servers
    • migrationtools
  2. Check the content of the file directory /etc/openldap/slapd.d/cn=config/ for the top branch of OpenLDAP directory configuration files:
    cn=schema
    cn=schema.ldif
    olcDatabase={0}config.ldif
    olcDatabase={1}monitor.ldif
    olcDatabase={-1}frontend.ldif
    olcDatabase={2}hdb.ldif

    Examine the contents of olcDatabase={2}hbd.ldif:

    # AUTO-GENERATED FILE - DO NOT EDIT!! Use ldapmodify.
    # CRC32 d9b49d55
    dn: olcDatabase={2}hdb
    objectClass: olcDatabaseConfig
    objectClass: olcHdbConfig
    olcDatabase: {2}hdb
    olcDbDirectory: /var/lib/ldap
    olcSuffix: dc=my-domain,dc=com
    olcRootDN: cn=Manager,dc=my-domain,dc=com
    olcDbIndex: objectClass eq,pres
    olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
    structuralObjectClass: olcHdbConfig
    entryUUID: 5a8d299a-3f2f-1036-9244-a7abff537081
    creatorsName: cn=config
    createTimestamp: 20161115032843Z
    entryCSN: 20161115032843.258885Z#000000#000#000000
    modifiersName: cn=config
    modifyTimestamp: 20161115032843Z
  3. Verify that the directory for storing the OpenLDAP database (/var/lib/ldap) is owned by ldap:ldap. If this is not the case, fix it now.
  4. Verify that the core schema file (/etc/openldap/slapd.d/cn=config/cn=schema) is also owned by ldap:ldap.
  5. Start the ldap service (slapd), and ensure that it will automatically start when your machine boots. Check the status of the service and ensure that it started without error before continuing.
  6. Use the ldap add command to add the cosine, nis, and inetorgperson schemata to your server in that order. Use the authentication type EXTERNAL, and ldapi:/// as the host.
  7. List the schema directory again. This time you should see the core schema, along with the three schemata you just added.
  8. Run an ldapsearch to check that the service is running and will respond to queries:
    [root@rns ~]# ldapsearch -x -b '' -s base '(objectClass=*)' namingContexts
    # extended LDIF
    #
    # LDAPv3
    # base <> with scope baseObject
    # filter: (objectClass=*)
    # requesting: namingContexts
    #
    #
    dn:
    namingContexts: dc=my-domain,dc=com
    # search result
    search: 2
    result: 0 Success
    # numResponses: 2
    # numEntries: 1
  9. Next, you will need a password for the ldap administrator (RootDN), so that they can run commands to modify the database. Use the slappasswd command to create one, and record the output.
  10. Insert your new password into the following ldif file, and apply it to your database with the ldapmodify command.
    Important.png
    Warning
    Do not store your ldif files (or any other files) in the ldap configuration directory. Every file in that directory is automatically read as configuration for ldap.
    # customize domain name
    dn: olcDatabase={2}hdb,cn=config
    changetype: modify
    replace: olcSuffix
    olcSuffix: dc=ops535,dc=com
    
    dn: olcDatabase={2}hdb,cn=config
    changetype: modify
    replace: olcRootDN
    olcRootDN: cn=Manager,dc=ops535,dc=com
    
    dn: olcDatabase={2}hdb,cn=config
    changetype: modify
    add: olcRootPW
    olcRootPW: {SSHA}1Di4Suea6ojE2bFxJhLDScjQyQ97GSef

    Make note of the field that this file will modify.
    As before, use the authentication type EXTERNAL, and ldapi:/// as the host.
    When you run the command you should get output similar to the following:

    SASL/EXTERNAL authentication started
    SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
    SASL SSF: 0
    modifying entry "olcDatabase={2}hdb,cn=config"
    
    modifying entry "olcDatabase={2}hdb,cn=config"
    
    modifying entry "olcDatabase={2}hdb,cn=config"
  11. Examine the contents of your /etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif file again. Your ldif file should have changed three fields. Try to identify them.
  12. Create an LDIF file for the base context ops535.com entry to be added to the OpenLDAP directory. Name the file as base.ldif.
    dn: dc=ops535,dc=com
    dc: ops535
    description: root LDAP entry for ops535
    objectClass: dcObject
    objectClass: organizationalUnit
    ou: rootobject
  13. Create an LDIF file for the People container to be added to the OpenLDAP directory. Name the file as people.ldif
    dn: ou=People, dc=ops535, dc=com
    ou: People
    description: All people in ops535
    objectClass: organizationalUnit
  14. Apply those two ldif files to your database.
    This time you will need to use simple authentication, identify yourself with a distinguished name (use the ldap administrator whose password you just set), and get prompted for a password.
  15. Before we start adding users, we need to provide the migration tools some information about our domain. Before you change anything, make a backup of the /usr/share/migrationstools/migrate_common.ph to the /root directory. Modify the following parameters in the original file to the values shown below:
    $DEFAULT_MAIL_DOMAIN = "ops535.com";
    $DEFAULT_BASE = "dc=ops535,dc=com";
    $EXTENDED_SCHEMA = 1;
  16. Create two new users (ldapuser1 and ldapuser2) on your machine, and set their passwords.
    Importing those users into your ldap database will take several steps:
    • Extract the passwd entries of ldapuser1 and ldapuser2 from /etc/passwd to a file called "ldapusers.entry"
      grep -w ldapuser1 /etc/passwd > /root/ldapusers.entry
      grep -w ldapuser2 /etc/passwd >> /root/ldapusers.entry
    • Use the migrate_passwd.pl file to convert the user information you extracted earlier into an ldif file:
      /usr/share/migrationtools/migrate_passwd.pl ldapusers.entry /root/ldapusers.ldif

      This should generate an ldif file similar to the following:

      dn: uid=ldapuser1,ou=People,dc=ops535,dc=com
      uid: ldapuser1
      cn: ldapuser1
      sn: ldapuser1
      mail: ldapuser1@ops535.com
      objectClass: person
      objectClass: organizationalPerson
      objectClass: inetOrgPerson
      objectClass: posixAccount
      objectClass: top
      objectClass: shadowAccount
      userPassword: {crypt}
      $6$PBqQXRo/ugCCjBe0.ZgvmJl8U2tVjpdR8X9bh4OZ1cl3mv4xf0Hv1HSDavkxusO8R3lI
      uuJ7skrfqpTQpbZ6hbd3e3BGB.
      shadowLastChange: 17120
      shadowMin: 0
      shadowMax: 99999
      shadowWarning: 7
      loginShell: /bin/bash
      uidNumber: 5001
      gidNumber: 5001
      homeDirectory: /home/ldapuser1
      
      dn: uid=ldapuser2,ou=People,dc=ops535,dc=com
      uid: ldapuser2
      cn: ldapuser2
      sn: ldapuser2
      mail: ldapuser2@ops535.com
      objectClass: person
      objectClass: organizationalPersonobjectClass: inetOrgPerson
      objectClass: posixAccount
      objectClass: top
      objectClass: shadowAccount
      userPassword: {crypt}
      $6$VNkVk1TQ$Rgz4GnQlqPBcHhIinUqxFGnqHZmnHHrFyCQ1ZsekoRjHnaKvb84YtjfFRPL
      /xcbryrQRL5eNZeP01A3AdC2lv1
      shadowLastChange: 17120
      shadowMin: 0
      shadowMax: 99999
      shadowWarning: 7
      loginShell: /bin/bash
      uidNumber: 5002
      gidNumber: 5002
      homeDirectory: /home/ldapuser2
  17. Use ldapadd to enter this new information into the database. As before use simple authentication, the distinguished name of the ldap administrator, and get prompted for a password.
  18. Use ldapsearch to confirm that the new users have been added to the database.
    You should get output similar to the following:
    # extended LDIF
    #
    # LDAPv3
    # base <dc=ops535,dc=com> with scope subtree
    # filter: (objectClass=*)
    # requesting: ALL
    #
    
    # ops535.com
    dn: dc=ops535,dc=com
    objectClass: top
    objectClass: dcObject
    objectClass: organization
    o: ops535 com
    dc: ops535
    
    # Manager, ops535.com
    dn: cn=Manager,dc=ops535,dc=com
    objectClass: organizationalRole
    cn: Manager
    description: Directory Manager
    
    # People, ops535.com
    dn: ou=People,dc=ops535,dc=com
    objectClass: organizationalUnit
    ou: People
    
    # ldapuser1, People, ops535.com
    dn: uid=ldapuser1,ou=People,dc=ops535,dc=com
    uid: ldapuser1
    cn: ldapuser1
    sn: ldapuser1
    mail: ldapuser1@ops535.com
    objectClass: personobjectClass: organizationalPerson
    objectClass: inetOrgPerson
    objectClass: posixAccount
    objectClass: top
    objectClass: shadowAccount
    userPassword:: e2NyeXB0fSQ2JFBCcVFYUm8vJHVnQ0NqQmUwLlpndm1KbDhVMnRWanBkUjhYOWJ
    oNE9aMWNsM212NHhmMEh2MUhTRGF2a3h1c084UjNsSXV1Sjdza3JmcXBUUXBiWjZoYmQzZTNCR0Iu
    shadowLastChange: 17120
    shadowMin: 0
    shadowMax: 99999
    shadowWarning: 7
    loginShell: /bin/bash
    uidNumber: 5001
    gidNumber: 5001
    homeDirectory: /home/ldapuser1
    
    # ldapuser2, People, ops535.com
    dn: uid=ldapuser2,ou=People,dc=ops535,dc=com
    uid: ldapuser2
    cn: ldapuser2
    sn: ldapuser2
    mail: ldapuser2@ops535.com
    objectClass: person
    objectClass: organizationalPerson
    objectClass: inetOrgPerson
    objectClass: posixAccount
    objectClass: top
    objectClass: shadowAccount
    userPassword:: e2NyeXB0fSQ2JFZOa1ZrMVRRJFJnejRHblFscVBCY0hoSWluVXF4RkducUhabW5
    ISHJGeUNRMVpzZWtvUmpIbmFLdmI4NFl0amZGUlBML3hjYnJ5clFSTDVlTlplUDAxQTNBZEMybHYx
    shadowLastChange: 17120
    shadowMin: 0
    shadowMax: 99999
    shadowWarning: 7
    loginShell: /bin/bash
    uidNumber: 5002
    gidNumber: 5002
    homeDirectory: /home/ldapuser2
    
    # search result
    search: 2
    result: 0 Success
    
    # numResponses: 10
    # numEntries: 5
  19. Create an ldif file called group.ldif that will add an organizational unit with the distinguished name ou=Group, dc=ops535, dc=com. It will act as an organizer for group information.
  20. Use the /etc/group file and migrate_group.pl to create an ldif file that will add the group entries for ldapuser1 and ldapuser2 to your database.
  21. Add the group entries for ldapuser1 and ldapuser2 to your database. Use ldapsearch to confirm that they have been added.
  22. Modify your firewall to allow incoming ldap traffic from your internal zone. Make sure that this change persists past reboot.

Investigation 2: Setup and Configure OpenLdap Client

Perform the following steps on your other centos 7 vm (I will call it vm5):

  1. Install the following packages
    • openldap
    • openldap-clients
    • nss_ldap
    • nss-pam-ldapd
    If you would like to actually log into the client machines as an ldap user, you need to reconfigure the way the system authentication processes your login. Use the “authconfig” tool on the client machine. Note: the ldap user does not have home directory on the client unless you provide it via NFS.
  2. Prior to making any changes to how your machines handle login information, use the authconfig --savebackup command to save your current configuration into /root/ldap/backup.
  3. Use the authconfig command to configure your vm to use vm4 as the ldap server. Note that you will to enable ldap authentication, identify the ldap server, and the base distinguished name in a single command.
  4. Check the name service switch configuration file /etc/nsswitch.conf to confirm that LDAP is enabled.
  5. Test your OpenLDAP client with the ldapsearch command.
    ldapsearch -x 'uid=ldapuser1'

    You should get something similar to the following (but may not be exactly the same):

    # extended LDIF
    #
    # LDAPv3
    # base <dc=ops535,dc=com> (default) with scope subtree
    # filter: uid=ldapuser1
    # requesting: ALL
    #
    
    # ldapuser1, People, ops535.com
    dn: uid=ldapuser1,ou=People,dc=ops535,dc=com
    uid: ldapuser1
    cn: ldapuser1
    sn: ldapuser1
    mail: ldapuser1@ops535.com
    objectClass: person
    objectClass: organizationalPerson
    objectClass: inetOrgPerson
    objectClass: posixAccount
    objectClass: top
    objectClass: shadowAccount
    userPassword:: e2NyeXB0fSQ2JFBCcVFYUm8vJHVnQ0NqQmUwLlpndm1KbDhVMnRWanBkUjhYOWJ
    oNE9aMWNsM212NHhmMEh2MUhTRGF2a3h1c084UjNsSXV1Sjdza3JmcXBUUXBiWjZoYmQzZTNCR0Iu
    shadowLastChange: 17120
    shadowMin: 0
    shadowMax: 99999
    shadowWarning: 7
    loginShell: /bin/bash
    uidNumber: 5001
    gidNumber: 5001
    homeDirectory: /home/ldapuser1
    # search resultsearch: 2
    result: 0 Success
    # numResponses: 2
    # numEntries: 1
  6. Logout of the client machine, then log back in using the ldapuser1 account. You will notice you get an error message about not being able to find /home/ldapuser1. Normally, we would be remotely mounting home directories, so that even though it doesn't exist on vm5, the machine would be mounting it from a server where it does exist.

Investigation 3: Update LDAP Configuration

  1. Add the following user accounts to your LDAP server:
    user name: your seneca id – password: pick your own
    rchan – password: ops535
    seneca – password: ops535
  2. Run the ldapsearch command for each user, and confirm that their information is correct
  3. Consult the man page on ldappasswd to find out how to change an LDAP user's password. Change seneca's password to seneca.
  4. Consult the man page on ldapdelete to find out how to remove an LDAP user. Delete ldapuser2.

Completing the Lab

You should now have a server providing centralized management of your user information. A service like this will make it much easier to manage and maintain users in your network. When combined with a service like NFS, this centralizes user management and make it much easier to scale your network up.

Follow the instructions on blackboard to submit the lab.

Exploration Questions

  1. What changes would you make in NFS to provide remote access to home directories?