Latest revision as of 21:48, 6 September 2024

LDAP

Participants	Fwd
Skills	Linux, FreeIPA
Status	Implemented
Niche	Software
Purpose	Infrastructure
Tool	Yes
Location
Cost
Tool category

LDAP Property "Tool Image" (as page type) with input value "File:{{{Picture}}}" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process. {{{Picture}}} {{#if:Yes | [[Tool Owner::{{{ProjectParticipants}}} | }} {{#if:Yes | [[Tool Cost::{{{Cost}}} | }}

Status

We are currently running on FreeIPA.

Connected machines and services

Virtual Machines

You can use the following systems by logging into them using your LDAP account. These systems are only available when you are connected to the space network, or you have a working VPN tunnel to the space. Note that you need to be part of the BOFH group to gain root access. If you need root, ask someone from the BOFH team to see whats possible.

services-1.lan.nurd.space
services-2.lan.nurd.space
gitlab.vm.nurd.space
minio.vm.nurd.space
navi.vm.nurd.space
gh-runner-almalinux.vm.nurd.space
gh-runner-debian.vm.nurd.space

All machines are deployed using a combination of OpenTOFU, cloud-init and Ansible via an CI/CD pipeline running on Gitlab. Configuration is done via GIT. If you need a machine for any purpose, ask the BOFH team.

TODO: Make this available for members without BOFH being involved.

Wiki

Authentication on this wiki is done via SAML using a combination of SimpleSAML and Keycloak. Keycloak uses LDAP as an identity source.

Gitlab

See our Gitlab instance

Wifi (Spacenet)

TODO: Is broken as of now

DHCP

See the network page.

(Un)locking the front door

See the Door lock page.

@@ Line 1: / Line 1: @@
-For use with [[SpaceNet]] we've installed OpenLDAP on [[nurdserver]]. On the new [[NURDserver_v2|Nurdserver v2]] we're going serious with LDAP.
+{{Project
+|Name=LDAP
+|Skills=Linux, FreeIPA
+|Status=Implemented
+|Niche=Software
+|Purpose=Infrastructure
+|Tool=Yes
+}}
+= Status =
-= Working implementations on Nurdserver v1 (nurdserver) =
+We are currently running on [[Network/Roadmap/LDAPAuthentication|FreeIPA]].
-* [[Spacenet]]
-* Samba on [[NURDServer]]
-* vsFTPd on [[NURDServer]]
-= Working implementations on Nurdserver v2 (nurdservices) =
+= Connected machines and services =
-* NFS export
-= To do=
+== Virtual Machines ==
-* [[Spacenet]]
-* FTPd
-* Samba?
-* Get a certificate, allow access only over TLS
-* Create homedir on NFS-export when adding a user to LDAP (maybe [http://documentation.fusiondirectory.org/en/documentation_faq/command_after like this]?)
-* Change password on first login doesn't work in FusionDirectory
-* Migrate all local users on [[Infra]] machines to LDAP
-* Migrate all homedirs to [[NURDserver_v2|Nurdservices]]
-* Fix storage on [[NURDserver_v2|Nurdservices]] (current VM is 32GB)
-* Migrate [[wiki]] users and merge them with other users
-* Use LDAP as userdb back-end for [[wiki]]
-* Add all relevant fields of Wiki users to LDAP profiles
-* Maintain [[Category:Members|Members]] page from LDAP
-* Maintain sudo'ers through the LDAP and disable local root accounts (backdoor in case of emergency?)
-* Disable all relevant services on Nurdserver v1
-= Status =
+You can use the following systems by logging into them using your LDAP account. These systems are only available when you are connected to the space network, or you have a working VPN tunnel to the space. Note that you need to be part of the BOFH group to gain root access. If you need root, ask someone from the BOFH team to see whats possible.
-I've installed [http://fusiondirectory.org FusionDirectory] on a new VM called nurdservices on the proxmox system of [[NURDserver_v2|Nurdserver v2]]. I've also added a couple of users to it.
+* services-1.lan.nurd.space
+* services-2.lan.nurd.space
+* gitlab.vm.nurd.space
+* minio.vm.nurd.space
+* navi.vm.nurd.space
+* gh-runner-almalinux.vm.nurd.space
+* gh-runner-debian.vm.nurd.space
+All machines are deployed using a combination of OpenTOFU, cloud-init and Ansible via an CI/CD pipeline running on Gitlab. Configuration is done via GIT. If you need a machine for any purpose, ask the BOFH team.
+TODO: Make this available for members without BOFH being involved.
-It can be accessed on http://nurdservices/fusiondirectory from within the network.
+== Wiki ==
+Authentication on this wiki is done via SAML using a combination of SimpleSAML and Keycloak. Keycloak uses LDAP as an identity source.
-On [[Hp_dc5800_sinterklaas|Sinterklaas]] I've got it to work as I think it should be for the local users that existed:
+== Gitlab ==
-* Homedirs moved to an nfs mount from [[NURDserver_v2|Nurdservices]]
+See [[Network/Roadmap/MigrateToGitlab|our Gitlab instance]]
-* Local homedirs and users deleted
-* /home/ is mounted on boot over nfs
-* LDAP users can log in and see their homedirs as if nothing has changed
-= Setting up other workstations in this way =
+== Wifi (Spacenet) ==
-To get this to work you need to:
+TODO: Is broken as of now
-* create all local users in LDAP (if they don't exist already)
-* move homedirs to nurdservices (fix ownership if needed)
-* delete local users
-* delete local homedirs
-* install [http://wiki.debian.org/LDAP/NSS#NSS_Setup_with_libnss-ldapd libnss-ldapd]
-* config the binddn (read-user) in pam_ldap.conf and nslcd.conf
-* mount /home from nurdservices over nfs
-* configure the ldap in nss and pam (no ssl, so ldap://nurdservices/)
-* and add a line to /etc/pam.d/common-account:
-<code>
+== DHCP ==
-session    required   pam_mkhomedir.so skel=/etc/skel/ umask=0022
+See the [[Network|network page]].
-</code>
-This step will no longer be needed once homedirs are created when you add a user to the LDAP.
+== (Un)locking the front door ==
+See the [[Network/Services/DoorLock|Door lock page]].