Open LDAP
Contents
LDAP RESOURCES
Online References:
OBJECTIVES
The OpenLDAP software package is an Open Source and Free implementation of the Lightweight Directory Access Protocol (LDAP). It is gaining wide acceptance as the directory access method of the Internet and also with corporate intranets.
In this lab, you set up and configure a OpenLDAP server and clients to provide network service of user authenication. You can then use the OpenLDAP client/server to replace your NIS client/server for network user authentication.
Notes: OpenLDAP Use TCP port 389 for regular communication and port 636 for encrypted transactions
INVESTIGATION 1: OpenLDAP server setup and configuration on CentOS 7
OPENLDAP INSTALLATION & INITIAL CONFIGURATION
Perform the following steps:
- Make certain all VMs are running.
- Switch to your VM2 machine.
- Install the following packages required for the OpenLDAP server on centos2:
openldap
openldap-clients
openldap-devel
openldap-servers
nss_ldap
migrationtools
NOTE: Refer to following URL for documentation:
Text Book Chapter 17 - OpenLDAP
Documentation: file:///usr/share/doc/openldap-servers-2.3.27/guide.html
Sample nsswitch configuration file for LDAP: /usr/share/doc/nss_ldap-220/nsswitch_ldap - Create an OpenLDAP database
- Create an OpenLDAP “root” password and edit the OpenLDAP main configuration file /etc/openldap/slapd.conf
- Start the OpenLDAP server daemon
- Create an LDIF file for importing to the OpenLDAP database
- Import an LDIF file into the OpenLDAP database
OpenLDAP Server Configuration
- Complete this step on centos2 ***
Only the LDAP's “rootdn” user can create, import, and export data into a LDAP database. You can use the slappasswd command to create a password and use it in the LDAP configuration file: slappasswd
New password: [enterpassword]
Re-enter new password: [enterpassword]
{SSHA}3NVLOWwqIMka3OyIYLyGrrkirD0pU0Qx <-- Copy this to the configuration file as outlined below, this is sample output only. Copy what your command outputs.
Modify the configuration file (/etc/openldap/slapd.d/cn=config/olcDatabase={2}hdb.ldif). Specifically the following lines need to be added/changed to show as:
olcSuffix: dc=learnid,dc=org
olcRootDN: cn=Manager,dc=learnid,dc=org
olcRootPW: {SSHA}3NVLOWwqIMka3OyIYLyGrrkirD0pU0Qx
olcDbDirectory: /var/lib/ldap {only if this doesn't exist}
Modify the configuration file (/etc/openldap/slapd.d/cn=config/olcDatabase={0}config.ldif). Add a password entry only using YOUR output from the slappasswd command:
olcRootPW: {SSHA}3NVLOWwqIMka3OyIYLyGrrkirD0pU0Qx
Start the OpenLDAP server daemon and enable it to start on boot sudo systemctl start slapd
sudo systemctl enable slapd To verify that the service is working, try the following query command:
ldapsearch -x -b -s base '(objectclass=*)' nameingContexts
Create an LDIF file for importing to the OpenLDAP database a. add an user called “ldapuser”
useradd -g users ldapuser passwd ldapuser
b. extract the passwd entry of ldapuser from /etc/passwd to a file called "entry.ldapuser"
grep -w ldapuser /etc/passwd > /etc/openldap/entry.ldapuser
c. extract the passwd entry of root from /etc/passwd to a file called "entry.root"
grep -w root /etc/passwd > /etc/openldap/entry.root
d. Before running the migration script, edit the file “migrate_common.ph” in /usr/share/migrationtools and change the following lines to match your base domain. If you don't change these, the migration script will use the default values which are "padl.com", "dc=padl,dc=com".
Default DNS domain
$DEFAULT_MAIL_DOMAIN = "learnid.org";
Default base
$DEFAULT_BASE = "dc=learnid,dc=org";
e. Convert the entries for ldapuser and root to the LDIF format (ldif.ldapuser and ldif.root)
(Note that "\" is used to tell the shell the next line as a continuation of the current line)
For ldapuser: /usr/share/migrationtools/migrate_passwd.pl \
/etc/openldap/entry.ldapuser /etc/openldap/ldif.ldapuser
For root: /usr/share/migrationtools/migrate_passwd.pl \
/etc/openldap/entry.root /etc/openldap/ldif.root f. create an LDIF file (in /etc/openldap) for your domain (ldif.learnid.org)
dn: dc=learnid,dc=org dc: learnid description: root LDAP entry for learnid objectClass: dcObject objectClass: organizationalUnit ou: rootobject
g. create an LDIF file (in /etc/openldap) for the container People (ldif.people
dn: ou=People, dc=learnid, dc=org ou: People description: All people in learnid objectClass: organizationalUnit Before importing the user ldif files, the required Schema's must be imported with the following commands
ldapadd -D "cn=config" -W -H ldapi:// -f /etc/openldap/schema/cosine.ldif
ldapadd -D "cn=config" -W -H ldapi:// -f /etc/openldap/schema/nis.ldif
Import LDIF files into the OpenLDAP database
ldapadd -x -D “cn=Manager,dc=learnid,dc=org” -W -f /etc/openldap/ldif.learnid.org
ldapadd -x -D “cn=Manager,dc=learnid,dc=org” -W -f /etc/openldap/ldif.root
ldapadd -x -D “cn=Manager,dc=learnid,dc=org” -W -f /etc/openldap/ldif.ldapuser
To test the OpenLDAP database:
ldapsearch -x -b 'dc=learnid,dc=org' '(objectclass=*)'
Record steps, commands, and your observations in INVESTIGATION 1 in your OPS335 lab log-book
INVESTIGATION 2: - SETUP & CONFIGURE OPENLDAP CLIENT
*** to be completed on centos3 ***
Required RPMS for LDAP client
openldap openldap-clients nss_ldap nss-pam-ldapd OpenLDAP Client configuration
If you would like to actually log into the client machines as an ldap user, you need to reconfigure the way the system authentication processes your login. Use the “authconfig-tui” tool on the client machine.
- Note: the ldap user does not have home directory on the client unless you provide it via NFS. ***
Configure the name service switch configuration (/etc/nsswitch.conf) file to use ldap for authentication:
passwd: files sss ldap shadow: files sss ldap group: files sss ldap
2. Edit the ldap configuration file to set up client configuration (/etc/openldap/ldap.conf):
BASE: dc=learnid,dc=org
To complete the lab, show the output of the "ldapsearch" command to your instructor or lab assistant.
ldapsearch -x -b 'dc=learnid,dc=org' -h ip-of-your-ldap-server 'uid=ldapuser'
Record steps, commands, and your observations in INVESTIGATION 2 in your OPS335 lab log-book
COMPLETING THE LAB
Arrange proof that you can send e-mail from your VM2 machine to your Seneca College e-mail account, and than you can send and receive e-mail messages locally on your VM2 machine only. Also show your logbook notes regarding MTA information from your sent email header on your Seneca College mail account.
