Openldap is a client/server protocol used to access and manage directory information and store username and password .
LDAP, or lightweight directory access protocol
-
install openldap
$ sudo pacman -S openldap
-
Configuration server
2.1 The server configuration file is located at
/etc/openldap/slapd.conf
.Edit the suffix and rootdn. The suffix typically is your domain name but it does not have to be. It depends on how you use your directory. We will use example for the domain name, and com for the tld. The rootdn is your LDAP administrator's name (we will use Manager here).
suffix "dc=example,dc=local" rootdn "cn=Manager,dc=example,dc=local"
2.2 Now we delete the default root password and create a strong one:
sed -i "/rootpw/ d" /etc/openldap/slapd.conf #find the line with rootpw and delete it echo "rootpw $(slappasswd)" >> /etc/openldap/slapd.conf #add a line which includes the hashed password output from slappasswd
2.3 Add some typically used schemas to the top of
slapd.conf
:include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema #include /etc/openldap/schema/samba.schema
2.4 Add some typically used indexes to the bottom of
slapd.conf
:index uid pres,eq index mail pres,sub,eq index cn pres,sub,eq index sn pres,sub,eq index dc eq
-
Create User
$ sudo useradd -mg users -G wheel,power,storage -s /bin/bash your_user
-
Configure LDAP Server
4.1 Create initial entry
$ sudo nano base.ldif dn: dc=example,dc=local dc: example o: example Organization objectClass: dcObject objectClass: organization dn: cn=Manager,dc=example,dc=local cn: Manager description: LDAP administrator objectClass: organizationalRole objectClass: top roleOccupant: dc=example,dc=local dn: ou=Account,dc=example,dc=local ou: Account objectClass: top objectClass: organizationalUnit dn: ou=Marketing,dc=example,dc=local ou: Marketing objectClass: top objectClass: organizationalUnit dn: ou=Sale,dc=example,dc=local ou: Sale objectClass: top objectClass: organizationalUnit
4.2 Add entry
ldapadd -x -D cn=Manager,dc=example,dc=local -W -f base.ldif Enter LDAP Password: adding new entry "dc=example,dc=local" adding new entry"cn=Manager,dc=example,dc=local" adding new entry"ou=Account,dc=example,dc=local" adding new entry"ou=Marketing,dc=example,dc=local" adding new entry"ou=Sale,dc=example,dc=local"
4.3 confirm settings
$ slapcat dn: dc=example,dc=local dc: example o: example Organization objectClass: dcObject objectClass: organization structuralObjectClass: organization entryUUID: fe6ddbed-15fa-4ee8-9651-2c2d4345a9b9 creatorsName: cn=Manager,dc=example,dc=local createTimestamp: 20190428095513Z entryCSN: 20190428095513.544597Z#000000#000#000000 modifiersName: cn=Manager,dc=example,dc=local modifyTimestamp: 20190428095513Z dn: cn=Manager,dc=example,dc=local cn: Manager description: LDAP administrator objectClass: organizationalRole objectClass: top roleOccupant: dc=example,dc=local structuralObjectClass: organizationalRole entryUUID: 01d2463f-88da-47e6-b031-2159874e8825 creatorsName: cn=Manager,dc=example,dc=local createTimestamp: 20190428095513Z entryCSN: 20190428095513.668328Z#000000#000#000000 modifiersName: cn=Manager,dc=example,dc=local modifyTimestamp: 20190428095513Z dn: ou=Account,dc=example,dc=local ou: Account objectClass: top objectClass: organizationalUnit structuralObjectClass: organizationalUnit entryUUID: 3ce92f9a-3cb6-4b3d-857a-9b9bf0efff12 creatorsName: cn=Manager,dc=example,dc=local createTimestamp: 20190428095513Z entryCSN: 20190428095513.768210Z#000000#000#000000 modifiersName: cn=Manager,dc=example,dc=local modifyTimestamp: 20190428095513Z
4.4 Add user to ldap
$ sudo nano ldapuser.ldif dn: uid=user1,ou=Account,dc=example,dc=local changetype: modify objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount sn: user1 givenName: user1 cn: user1 displayName: user1 uidNumber: 1002 gidNumber: 1002 userPassword: {SSHA}6rgTV4xwDFTEgXamybrWofP1+C3Ts6MR gecos: user1 loginShell: /bin/bash homeDirectory: /home/user1 shadowExpire: -1 shadowFlag: 0 shadowWarning: 7 shadowMin: 0 shadowMax: 99999 shadowLastChange: 18014 dn: cn=user1,ou=Account,dc=example,dc=local changetype: modify objectClass: posixGroup cn: user1 gidNumber: 1002 memberUid: user1
4.4 Add entry user
$ ldapadd -x -D cn=Manager,dc=example,dc=local -W -f ldapuser.ldif Enter LDAP Password: adding new entry "uid=user1,ou=Account,dc=example,dc=local" adding new entry "cn=user1,ou=Account,dc=example,dc=local"
Configure LDAP Client
-
Install the OpenLDAP client
$ sudo pacman -S nss-pam-ldapd
-
NSS Configuration
Edit
/etc/nsswitch.conf
which is the central configuration file for NSS. It tells NSS which sources to use for which system databases. We need to add theldap
directive to thepasswd
,group
andshadow
databases, so be sure your file looks like this:passwd: files ldap group: files ldap shadow: files ldap
-
PAM Configuration
First edit
/etc/pam.d/system-auth
$ sudo nano /etc/pam.d/system-auth
auth sufficient pam_ldap.so auth required pam_unix.so try_first_pass nullok auth optional pam_permit.so auth required pam_env.so
account sufficient pam_ldap.so account required pam_unix.so account optional pam_permit.so account required pam_time.so
password sufficient pam_ldap.so password required pam_unix.so try_first_pass nullok sha512 shadow password optional pam_permit.so
session required pam_limits.so session required pam_unix.so session optional pam_ldap.so session optional pam_permit.so
Then edit both
/etc/pam.d/su
$ sudo nano /etc/pam.d/su
#%PAM-1.0 auth sufficient pam_rootok.so auth sufficient pam_ldap.so #Uncomment the following line to implicitly trust users in the "wheel" group. #auth sufficient pam_wheel.so trust use_uid Uncomment the following line to require a user to be in the "wheel" group. #auth required pam_wheel.so use_uid auth required pam_unix.so use_first_pass account sufficient pam_ldap.so account required pam_unix.so session sufficient pam_ldap.so session required pam_unix.so
Enable users to edit their password,edit
/etc/pam.d/passwd
$ sudo nano /etc/pam.d/passwd
#%PAM-1.0 password sufficient pam_ldap.so #password required pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3 #password required pam_unix.so sha512 shadow use_authtok password required pam_unix.so sha512 shadow nullok
If you want home folders to be created at login (eg: if you are not using NFS to store home folders), edit
/etc/pam.d/system-login
and addpam_mkhomedir.so
to the session section above any "sufficient" items. And edit/etc/pam.d/su-l
file is used when the user runssu --login
.$ sudo nano /etc/pam.d/systemd-login
...top of file not shown... session optional pam_loginuid.so session include system-auth session optional pam_motd.so motd=/etc/motd session optional pam_mail.so dir=/var/spool/mail standard quiet -session optional pam_systemd.so session required pam_env.so session required pam_mkhomedir.so skel=/etc/skel umask=0022
$ sudo nano /etc/pam.d/su-l
...top of file not shown... session required pam_mkhomedir.so skel=/etc/skel umask=0022 session sufficient pam_ldap.so session required pam_unix.so
To enable sudo from an LDAP user, edit
/etc/pam.d/sudo
. You will also need to modify sudoers accordingly.$ sudo nano /etc/pam.d/sudo
#%PAM-1.0 auth sufficient pam_ldap.so auth required pam_unix.so try_first_pass auth required pam_nologin.so
You will also need to add in
/etc/openldap/ldap.conf
the following.$sudo nano /etc/openldap/ldap.conf sudoers_base ou=sudoers,dc=AFOLA
-
Start service
$ sudo systemctl enable nslcd $ sudo systemctl start nslcd $ sudo systemctl status nslcd
-
verity on client
# getent passwd user1 user1:x:1002:1002::/home/kunthy:/bin/bash