LDAP: Difference between revisions

From NURDspace
mNo edit summary
 
(68 intermediate revisions by 5 users not shown)
Line 1: Line 1:
{{Outdated}}
{{Project
{{Project
|ProjectSkills=Linux, OpenLDAP, reading documentation, asking Wilco for help
|Name=LDAP
|ProjectStatus=Active
|Skills=Linux, OpenLDAP, FreeRadius,
|ProjectNiche=Software
|Status=Finished
|ProjectPurpose=Infrastructure
|Niche=Software
|Purpose=Infrastructure
|Tool=Yes
}}
}}
= Status =


For use with [[Spacenet]] we've installed OpenLDAP on [[NURDServer]]. On the new [[NURDServices]] we're going serious with LDAP.
= Adding a new member =
There's a guide [[Adding_a_new_member_to_the_ldap|here]] explaining the steps for adding a new member to the LDAP.
= Connected machines and services =


= Connected machines =
== Workstations ==
* [[Hp_dc5800_sinterklaas|Sinterklaas]]
* [[Hp_dc5800_sinterklaas|Sinterklaas]]
* [[Dell_Optiplex_GX270|Vjdeb]]
* [[Dell_Optiplex_GX270|Vjdeb]]
* [[PrinterPC]]
* [[PrinterPC]]
* [[NURDServices]]
* [[Sun_Ultra_1|plankton]]
* [[Proxmox1]] (for fixing homedir ownership, only users in group "admins" can actually log in)
* [[BPM_Studio_Jukebox|BPM_Studio_Jukebox (all-in-one hark)]]
* [[Tankstation]]


= Status =
The workstations listed above are set up as follows:
[http://fusiondirectory.org FusionDirectory] is running on [[NURDServices]].
* Homedirs mounted over NFS from [[dumpster-a]] (except user 'printer' on [[PrinterPC]])
* Users in the LDAP 'sudo' group can sudo.
* Homedirs are created on the NFS-export when adding a user to LDAP ([http://documentation.fusiondirectory.org/en/documentation_faq/command_after like this])


It can be accessed on https://ldap.nurdspace.nl.
=== Setting up other workstations in this way ===
 
On [[Hp_dc5800_sinterklaas|Sinterklaas]], [[Dell_Optiplex_GX270|Vjdeb]] and the [[PrinterPC]] it's working for the local users that existed:
* Homedirs moved to NFS mount from [[Proxmox1]]
* Local homedirs and users deleted (except user 'printer' on [[PrinterPC]])
* /home/ is mounted over NFS on boot
* LDAP users can log in and see their homedirs as if nothing has changed
* Users in the LDAP 'sudo' group can sudo on connected workstations.
* Homedir is created on NFS-export when adding a user to LDAP ([http://documentation.fusiondirectory.org/en/documentation_faq/command_after like this])
* Port 636 (ldaps) is [[Cisco800series#Port_forwarding_howto|forwarded]] to [[NURDServices]] for future use by the [[Wiki]]
 
= Setting up other workstations in this way =
To get this to work you need to:
To get this to work you need to:
* create all local users in LDAP (if they don't exist already)
* create all local users in LDAP and then delete local users (else UIDs/GIDs get confusing)
* delete local users (optional)
* move homedirs to nurdservices (fix ownership because LDAP-users have a different UID) then delete local homedirs
* move homedirs to nurdservices (fix ownership because LDAP-users have a different UID)
* delete local homedirs
* mount /home from proxmox1:/mnt/md0/homedirs over nfs (put it in /etc/fstab)
* install [http://wiki.debian.org/LDAP/NSS#NSS_Setup_with_libnss-ldapd libnss-ldapd] and libpam-ldap (URI ldaps://ldap.nurdspace.nl/)
* put https://www.sslcertificaten.nl/files/PositiveSSLCA2.crt in /etc/ssl/certs/ with permissions 644
* put https://www.sslcertificaten.nl/files/PositiveSSLCA2.crt in /etc/ssl/certs/ with permissions 644
* in nslcd.conf set the following:
*insert into /etc/fstab:
<code>dumpster-a.nurdspace.lan:/vol/home  /home  nfs  rw,auto,exec,vers=3  0  0</code>
* install nfs client stuff:
<code>apt-get install rpcbind nfs-common</code>
* install [http://wiki.debian.org/LDAP/NSS#NSS_Setup_with_libnss-ldapd libnss-ldapd] (see below for settings asked during installation, in the selection list check passwd, group and shadow)
* install nslcd and libpam-ldapd (see below for settings asked during installation)
* /etc/nslcd.conf should mention at least the following:
  uri ldaps://ldap.nurdspace.nl/
  uri ldaps://ldap.nurdspace.nl/
  base dc=nurdspace,dc=lan
  base dc=nurdspace,dc=lan
Line 46: Line 44:
  ssl on
  ssl on
  tls_reqcert demand
  tls_reqcert demand
  tls_cacertfile /etc/ssl/certs/PositiveSSLCA2.crt
  tls_cacertfile /etc/ssl/certs/ca-certificates.crt
* configure /etc/nsswitch.conf:
passwd:    files ldap
group:    files ldap
shadow:    files ldap
* restart nslcd
* restart nslcd
* this information should also be used for pam_ldap.conf
* restart nscd
 
 
* check if ldap users are listed when you run "getent passwd"
* sudo might not work until you type 'id' which is [http://wiki.debian.org/LDAP/PAM kind of a mystery]
* sudo might not work until you type 'id' which is [http://wiki.debian.org/LDAP/PAM kind of a mystery]


Also useful: http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian#NSS_configuration
Useful reading: http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian


In certain cases sudo can break. This can be fixed with [http://osdir.com/ml/general/2013-01/msg44182.html a patch] while it's not fixed properly.
In certain cases sudo can break. This can be fixed with [http://osdir.com/ml/general/2013-01/msg44182.html a patch] while it's not fixed properly.


= To do=
== VM's ==
* <s>Read http://www.openldap.org/doc/admin24/slapdconf2.html</s>
* [[NURDServices]] (only users in group "admins" can log in)
* <s>FTPd</s> nevermind
* [[Egg]] (a VM for all members to irssi or other processes)
* <s>Samba</s> nevermind
 
* <s>Cert installed for ldap.nurdspace.nl. Allow access only over TLS as soon as this works (ldapsearch -v -H ldaps://ldap.nurdspace.nl/ -D uid=fwd,ou=people,dc=nurdspace,dc=lan -W -b dc=nurdspace,dc=lan)</s>
== ldap.nurdspace.nl ==
* <s>Fix "nurdservices slapd[32524]: <= bdb_equality_candidates: (uid) not indexed" errors in /var/log/syslog</s>
Slapd and [http://fusiondirectory.org FusionDirectory] are running on [[NURDServices]]. FusionDirectory's web interface can be accessed on https://ldap.nurdspace.nl.
* <s>Connect machines to LDAP over ldap<b>s</b> instead of ldap.</s>
 
* <s>Disable non-SSL ldap</s>
== Wiki ==
* <s>Migrate all local users on [[Infra]] machines to LDAP</s>
Authentication on this wiki is done via SAML. Zarya needs to document this.
* <s>Migrate all homedirs to [[Proxmox1]]</s>
 
* <s>Maintain sudo'ers only through the LDAP and</s> disable local root accounts (backdoor in case of emergency?)
=== Limitations ===
* <s>Disable all relevant services on Nurdserver v1</s>
* The mediawiki login system converts the first character of usernames to uppercase due to [http://en.wikipedia.org/wiki/Wikipedia:Naming_conventions_(technical_restrictions)#Restrictions_on_usernames restrictions on usernames]. To get around this we've enabled [http://www.mediawiki.org/wiki/Extension:LDAP_Authentication/Changelog#v2.0a $wgLDAPLowercaseUsernameScheme]. This requires usernames to be all lowercase in the LDAP.
* <s>Upgrade FusionDirectory from [http://documentation.fusiondirectory.org/en/documentation/admin_installation_migration_1.0.5 1.0.4 to 1.0.5]</s>
* Users are maintained through the LDAP, so creating a user on the Wiki is no longer possible. It could be enabled, but that would require adding a user with write-access in the LDAP. That seems a little scary for now. It would however offer the possibility of changing your LDAP password through the Wiki.
 
== Wifi (Spacenet) ==
The LDAP serves as a userdb for [[Spacenet]], which is connected via FreeRADIUS. For full details see the [[Spacenet]]-page. Only users in group "spacenet" can log in.
 
== DHCP ==
See the [[Network|network page]].
 
= Future plans =
The most important machines and services are now hooked up to the LDAP. However, there's always room for more.
 
== More groups for different purposes ==
We should create more groups for specific purposes, such as:
* Workstation users (now only sudo'ers are treated separately)
* Separate group per workstation? Or some sort of hierarchy of groups, so members need only be in 1 group?
* <s>Spacenet users</s> done
 
== (Un)locking the front door ==
See [[Spacelock]].
 
== Member registration ==
Currently the users in group "members" are maintained by hand. A little more automation would be appropriate. Hooking it up to actual money transactions might be far-fetched, but maybe something else is possible.
 
== E-mail and contacts services ==
We could install Zimbra or Zarafa, or maybe some smaller services to provide e-mail accounts, mailinglist functionality and maybe a CardDAV services for members.
 
== Make use of more of FusionDirectory's features ==
FusionDirectory has [http://documentation.fusiondirectory.org/en/documentation/available_plugins features/plugins] for applications, mime-types, workstations, object groups, public key authentication. Maybe some of these could be useful?
* Systems plugin installed and working, so we can now list all systems (workstations, servers) in the LDAP
* Wake-on-lan not working yet, probably due to a bug in Argonaut. The server- and client-services see eachother but wake-on-lan commands don't come through and you get an error in the web interface:
Communication failure with the infrastructure service:
Error: Request error: No client module can handle action Deployment.wake for target 00:0d:56:06:b6:26
* Maybe maintain the internal DNS with [http://documentation.fusiondirectory.org/en/documentation/plugin/dns_plugin/how_to_setup_dns_plugin_1.0.5 this plugin]?
* The DHCP feature sucks, so it's been rolled back.
 
== Wiki ==
* Members page filled based on LDAP group 'members'.
 
== Misc ==
* Investigate possibility of moving to a different database back-end ([http://www.openldap.org/faq/data/cache/978.html back-sql])
* Exclude weak ciphers from olcTLSCipherSuite in cn=config
* Exclude weak ciphers from olcTLSCipherSuite in cn=config
* Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
* Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
* Check out what happens to the history when usernames from the wiki no longer exist in the LDAP -> Easier to merge them all into 1 user "history". What happens when you do this:
* Upgrade FusionDirectory from 1.0.5 to [http://fusiondirectory.org/basic/press#fd-1.0.6 1.0.6]
Adding edit count of (8 and 70)
Updating archive table (8 to 70)
Updating revision table (8 to 70)
Updating filearchive table (8 to 70)
Updating image table (8 to 70)
Updating oldimage table (8 to 70)
Updating recentchanges table (8 to 70)
Updating logging table (8 to 70)
Updating ipblocks table (8 to 70)
Updating ipblocks table (8 to 70)
Updating watchlist table (8 to 70)
Updating archive table (Aldert Hazenberg to History)
Updating revision table (Aldert Hazenberg to History)
Updating filearchive table (Aldert Hazenberg to History)
Updating image table (Aldert Hazenberg to History)
Updating oldimage table (Aldert Hazenberg to History)
Updating recentchanges table (Aldert Hazenberg to History)
Updating ipblocks table (Aldert Hazenberg to History)
Updating ipblocks table (Aldert Hazenberg to History)
* Migrate [[wiki]] users and merge them with other users
* Use LDAP as userdb back-end for [[wiki]] ([http://ryandlane.com/wprdl/2009/03/23/using-the-ldap-authentication-plugin-for-mediawiki-the-basics-part-1/ like so])
* <s>Add all relevant fields of Wiki users to LDAP profiles (this will require [http://www.openldap.org/doc/admin24/schema.html#Extending Schema extending the schema])</s> we shouldn't want this
* Maintain [http://nurdspace.nl/Category:Members Members] page from LDAP ([http://www.mediawiki.org/wiki/Extension:External_Data#.23get_ldap_data_-_retrieve_data_from_LDAP_directory Like so], but this only displays 1 entry. Could be fixed [http://www.mediawiki.org/wiki/Extension_talk:External_Data/Archive_2012#.23for_external_table_support_for_.23get_ldap_data like so].)
* Maintain [http://nurdspace.nl/Category:Members Members] page from LDAP ([http://www.mediawiki.org/wiki/Extension:External_Data#.23get_ldap_data_-_retrieve_data_from_LDAP_directory Like so], but this only displays 1 entry. Could be fixed [http://www.mediawiki.org/wiki/Extension_talk:External_Data/Archive_2012#.23for_external_table_support_for_.23get_ldap_data like so].)
* Check if the passwordmailer on FusionDirectory works
* Check out [http://www.lichteblau.com/ldapvi/manual/ ldapvi]

Latest revision as of 13:56, 1 February 2020

Outdated IMPORTANT: The content of this section is outdated. Please update this section if you can. If you have checked or updated this section and found the content to be suitable, please remove this notice.
LDAP
NoPicture.png
Participants Fwd
Skills Linux, OpenLDAP, FreeRadius
Status Finished
Niche Software
Purpose Infrastructure
Tool Yes
Location
Cost
Tool category

LDAP Property "Tool Image" (as page type) with input value "File:{{{Picture}}}" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process. {{{Picture}}} {{#if:Yes | [[Tool Owner::{{{ProjectParticipants}}} | }} {{#if:Yes | [[Tool Cost::{{{Cost}}} | }}

Status

Adding a new member

There's a guide here explaining the steps for adding a new member to the LDAP.

Connected machines and services

Workstations

The workstations listed above are set up as follows:

  • Homedirs mounted over NFS from dumpster-a (except user 'printer' on PrinterPC)
  • Users in the LDAP 'sudo' group can sudo.
  • Homedirs are created on the NFS-export when adding a user to LDAP (like this)

Setting up other workstations in this way

To get this to work you need to:

  • create all local users in LDAP and then delete local users (else UIDs/GIDs get confusing)
  • move homedirs to nurdservices (fix ownership because LDAP-users have a different UID) then delete local homedirs
  • put https://www.sslcertificaten.nl/files/PositiveSSLCA2.crt in /etc/ssl/certs/ with permissions 644
  • insert into /etc/fstab:

dumpster-a.nurdspace.lan:/vol/home /home nfs rw,auto,exec,vers=3 0 0

  • install nfs client stuff:

apt-get install rpcbind nfs-common

  • install libnss-ldapd (see below for settings asked during installation, in the selection list check passwd, group and shadow)
  • install nslcd and libpam-ldapd (see below for settings asked during installation)
  • /etc/nslcd.conf should mention at least the following:
uri ldaps://ldap.nurdspace.nl/
base dc=nurdspace,dc=lan
binddn cn=read-user,ou=systems,dc=nurdspace,dc=lan
bindpw (obtain from other machine)
ssl on
tls_reqcert demand
tls_cacertfile /etc/ssl/certs/ca-certificates.crt
  • configure /etc/nsswitch.conf:
passwd:    files ldap
group:    files ldap
shadow:    files ldap
  • restart nslcd
  • restart nscd


  • check if ldap users are listed when you run "getent passwd"
  • sudo might not work until you type 'id' which is kind of a mystery

Useful reading: http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian

In certain cases sudo can break. This can be fixed with a patch while it's not fixed properly.

VM's

  • NURDServices (only users in group "admins" can log in)
  • Egg (a VM for all members to irssi or other processes)

ldap.nurdspace.nl

Slapd and FusionDirectory are running on NURDServices. FusionDirectory's web interface can be accessed on https://ldap.nurdspace.nl.

Wiki

Authentication on this wiki is done via SAML. Zarya needs to document this.

Limitations

  • The mediawiki login system converts the first character of usernames to uppercase due to restrictions on usernames. To get around this we've enabled $wgLDAPLowercaseUsernameScheme. This requires usernames to be all lowercase in the LDAP.
  • Users are maintained through the LDAP, so creating a user on the Wiki is no longer possible. It could be enabled, but that would require adding a user with write-access in the LDAP. That seems a little scary for now. It would however offer the possibility of changing your LDAP password through the Wiki.

Wifi (Spacenet)

The LDAP serves as a userdb for Spacenet, which is connected via FreeRADIUS. For full details see the Spacenet-page. Only users in group "spacenet" can log in.

DHCP

See the network page.

Future plans

The most important machines and services are now hooked up to the LDAP. However, there's always room for more.

More groups for different purposes

We should create more groups for specific purposes, such as:

  • Workstation users (now only sudo'ers are treated separately)
  • Separate group per workstation? Or some sort of hierarchy of groups, so members need only be in 1 group?
  • Spacenet users done

(Un)locking the front door

See Spacelock.

Member registration

Currently the users in group "members" are maintained by hand. A little more automation would be appropriate. Hooking it up to actual money transactions might be far-fetched, but maybe something else is possible.

E-mail and contacts services

We could install Zimbra or Zarafa, or maybe some smaller services to provide e-mail accounts, mailinglist functionality and maybe a CardDAV services for members.

Make use of more of FusionDirectory's features

FusionDirectory has features/plugins for applications, mime-types, workstations, object groups, public key authentication. Maybe some of these could be useful?

  • Systems plugin installed and working, so we can now list all systems (workstations, servers) in the LDAP
  • Wake-on-lan not working yet, probably due to a bug in Argonaut. The server- and client-services see eachother but wake-on-lan commands don't come through and you get an error in the web interface:
Communication failure with the infrastructure service: 
Error: Request error: No client module can handle action Deployment.wake for target 00:0d:56:06:b6:26 
  • Maybe maintain the internal DNS with this plugin?
  • The DHCP feature sucks, so it's been rolled back.

Wiki

  • Members page filled based on LDAP group 'members'.

Misc

  • Investigate possibility of moving to a different database back-end (back-sql)
  • Exclude weak ciphers from olcTLSCipherSuite in cn=config
  • Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
  • Upgrade FusionDirectory from 1.0.5 to 1.0.6
  • Maintain Members page from LDAP (Like so, but this only displays 1 entry. Could be fixed like so.)
  • Check if the passwordmailer on FusionDirectory works
  • Check out ldapvi