LDAP: Difference between revisions

From NURDspace
 
(92 intermediate revisions by 6 users not shown)
Line 1: Line 1:
For use with [[Spacenet]] we've installed OpenLDAP on [[NURDServer]]. On the new [[NURDserver_v2|Nurdserver v2]] we're going serious with LDAP.
{{Project
|Name=LDAP
|Skills=Linux, FreeIPA
|Status=Implemented
|Niche=Software
|Purpose=Infrastructure
|Tool=Yes
}}
= Status =
 
We are currently running on [[Network/Roadmap/LDAPAuthentication|FreeIPA]].
 
= Connected machines and services =


= Working implementations on Nurdserver v1 (nurdserver) =
== Virtual Machines ==
* Samba on [[NURDServer]]
* vsFTPd on [[NURDServer]]


= Working implementations on Nurdserver v2 (nurdservices) =
You can use the following systems by logging into them using your LDAP account. These systems are only available when you are connected to the space network, or you have a working VPN tunnel to the space. Note that you need to be part of the BOFH group to gain root access. If you need root, ask someone from the BOFH team to see whats possible.
* NFS export for homedirs
* [[Spacenet]]


= Connected workstations =
* services-1.lan.nurd.space
* [[Hp_dc5800_sinterklaas|Sinterklaas]]
* services-2.lan.nurd.space
* [[Dell_Optiplex_GX270|Vjdeb]]
* gitlab.vm.nurd.space
* [[PrinterPC]]
* minio.vm.nurd.space
* [[NURDserver_v2#nurdservices|Nurdservices]]
* navi.vm.nurd.space
* gh-runner-almalinux.vm.nurd.space
* gh-runner-debian.vm.nurd.space


= Status =
All machines are deployed using a combination of OpenTOFU, cloud-init and Ansible via an CI/CD pipeline running on Gitlab. Configuration is done via GIT. If you need a machine for any purpose, ask the BOFH team.
[http://fusiondirectory.org FusionDirectory] is running on [[NURDServices]] on the [[Proxmox2]]. Most users are migrated.


It can be accessed on [https://ldap.nurdspace.nl].
TODO: Make this available for members without BOFH being involved.


On [[Hp_dc5800_sinterklaas|Sinterklaas]], [[Dell_Optiplex_GX270|Vjdeb]] and the [[PrinterPC]] I've got it to work as I think it should be for the local users that existed:
== Wiki ==
* Homedirs moved to nfs mount from [[NURDServices]] (soon to be migrated to [[Proxmox1]])
Authentication on this wiki is done via SAML using a combination of SimpleSAML and Keycloak. Keycloak uses LDAP as an identity source.
* Local homedirs and users deleted (except user 'printer' on [[PrinterPC]])
* /home/ is mounted over nfs on boot
* LDAP users can log in and see their homedirs as if nothing has changed
* Users in the LDAP 'sudo' group can sudo on connected workstations.
* Homedir is created on NFS-export when adding a user to LDAP ([http://documentation.fusiondirectory.org/en/documentation_faq/command_after like this])


= Setting up other workstations in this way =
== Gitlab ==
To get this to work you need to:
See [[Network/Roadmap/MigrateToGitlab|our Gitlab instance]]
* create all local users in LDAP (if they don't exist already)
* delete local users (optional)
* move homedirs to nurdservices (fix ownership because LDAP-users have a different UID)
* delete local homedirs
* mount /home from nurdservices over nfs
* install [http://wiki.debian.org/LDAP/NSS#NSS_Setup_with_libnss-ldapd libnss-ldapd] and libpam-ldap (ldaps://ldap.nurdspace.nl/)
* put https://www.sslcertificaten.nl/files/PositiveSSLCA2.crt in /etc/ssl/certs/ with permissions 644
* in nslcd.conf set the following:
uri ldaps://ldap.nurdspace.nl/
base dc=nurdspace,dc=lan
binddn cn=read-user,ou=systems,dc=nurdspace,dc=lan
bindpw (obtain from other machine)
tls_reqcert demand
tls_cacertfile /etc/ssl/certs/PositiveSSLCA2.crt
* restart nslcd
* sudo might not work until you type 'id' which is [http://wiki.debian.org/LDAP/PAM kind of a mystery]


Also useful: http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian#NSS_configuration
== Wifi (Spacenet) ==
TODO: Is broken as of now


In certain cases sudo can break. This can be fixed with [http://osdir.com/ml/general/2013-01/msg44182.html a patch] as long as it's not fixed properly.
== DHCP ==
See the [[Network|network page]].


= To do=
== (Un)locking the front door ==
* Read http://www.openldap.org/doc/admin24/slapdconf2.html
See the [[Network/Services/DoorLock|Door lock page]].
* <s>FTPd</s> nevermind
* <s>Samba</s> nevermind
* <s>Cert installed for ldap.nurdspace.nl. Allow access only over TLS as soon as this works (ldapsearch -v -H ldaps://ldap.nurdspace.nl/ -D uid=fwd,ou=people,dc=nurdspace,dc=lan -W -b dc=nurdspace,dc=lan) => basically this works, except I don't know what to set for olcTLSCipherSuite.</s>
* <s>Fix "nurdservices slapd[32524]: <= bdb_equality_candidates: (uid) not indexed" errors in /var/log/syslog</s>
* Connect machines to LDAP over ldap<b>s</b> instead of ldap.
* Exclude weak ciphers from olcTLSCipherSuite in cn=config
* Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
* <s>Migrate all local users on [[Infra]] machines to LDAP</s>
* Migrate all homedirs to [[NURDServices]] (moving to [[Proxmox1]]
* Migrate [[wiki]] users and merge them with other users
* Use LDAP as userdb back-end for [[wiki]] ([http://ryandlane.com/wprdl/2009/03/23/using-the-ldap-authentication-plugin-for-mediawiki-the-basics-part-1/ like so])
* Add all relevant fields of Wiki users to LDAP profiles
* Maintain [http://nurdspace.nl/Category:Members Members] page from LDAP ([http://www.mediawiki.org/wiki/Extension:External_Data#.23get_ldap_data_-_retrieve_data_from_LDAP_directory Like so], but this has limitations. Maybe only members details pages?)
* Maintain sudo'ers only through the LDAP and disable local root accounts (backdoor in case of emergency?)
* Disable all relevant services on Nurdserver v1

Latest revision as of 21:48, 6 September 2024

LDAP
NoPicture.png
Participants Fwd
Skills Linux, FreeIPA
Status Implemented
Niche Software
Purpose Infrastructure
Tool Yes
Location
Cost
Tool category

LDAP Property "Tool Image" (as page type) with input value "File:{{{Picture}}}" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process. {{{Picture}}} {{#if:Yes | [[Tool Owner::{{{ProjectParticipants}}} | }} {{#if:Yes | [[Tool Cost::{{{Cost}}} | }}

Status

We are currently running on FreeIPA.

Connected machines and services

Virtual Machines

You can use the following systems by logging into them using your LDAP account. These systems are only available when you are connected to the space network, or you have a working VPN tunnel to the space. Note that you need to be part of the BOFH group to gain root access. If you need root, ask someone from the BOFH team to see whats possible.

  • services-1.lan.nurd.space
  • services-2.lan.nurd.space
  • gitlab.vm.nurd.space
  • minio.vm.nurd.space
  • navi.vm.nurd.space
  • gh-runner-almalinux.vm.nurd.space
  • gh-runner-debian.vm.nurd.space

All machines are deployed using a combination of OpenTOFU, cloud-init and Ansible via an CI/CD pipeline running on Gitlab. Configuration is done via GIT. If you need a machine for any purpose, ask the BOFH team.

TODO: Make this available for members without BOFH being involved.

Wiki

Authentication on this wiki is done via SAML using a combination of SimpleSAML and Keycloak. Keycloak uses LDAP as an identity source.

Gitlab

See our Gitlab instance

Wifi (Spacenet)

TODO: Is broken as of now

DHCP

See the network page.

(Un)locking the front door

See the Door lock page.

Retrieved from "https://nurdspace.nl/index.php?title=LDAP&oldid=14337"