|
|
| (74 intermediate revisions by 6 users not shown) |
| Line 1: |
Line 1: |
| {{Project | | {{Project |
| |ProjectSkills=Linux, OpenLDAP, reading documentation, asking Wilco for help | | |Name=LDAP |
| |ProjectStatus=Active | | |Skills=Linux, FreeIPA |
| |ProjectNiche=Software | | |Status=Implemented |
| |ProjectPurpose=Infrastructure | | |Niche=Software |
| | |Purpose=Infrastructure |
| | |Tool=Yes |
| }} | | }} |
| | = Status = |
|
| |
|
| For use with [[Spacenet]] we've installed OpenLDAP on [[NURDServer]]. On the new [[NURDServices]] we're going serious with LDAP.
| | We are currently running on [[Network/Roadmap/LDAPAuthentication|FreeIPA]]. |
|
| |
|
| = Connected machines = | | = Connected machines and services = |
| * [[Hp_dc5800_sinterklaas|Sinterklaas]]
| |
| * [[Dell_Optiplex_GX270|Vjdeb]]
| |
| * [[PrinterPC]]
| |
| * [[NURDServices]]
| |
| * [[Proxmox1]] (for fixing homedir ownership, only users in group "admins" can actually log in)
| |
| * [[Tankstation]]
| |
|
| |
|
| = Status = | | == Virtual Machines == |
| [http://fusiondirectory.org FusionDirectory] is running on [[NURDServices]].
| | |
| | You can use the following systems by logging into them using your LDAP account. These systems are only available when you are connected to the space network, or you have a working VPN tunnel to the space. Note that you need to be part of the BOFH group to gain root access. If you need root, ask someone from the BOFH team to see whats possible. |
| | |
| | * services-1.lan.nurd.space |
| | * services-2.lan.nurd.space |
| | * gitlab.vm.nurd.space |
| | * minio.vm.nurd.space |
| | * navi.vm.nurd.space |
| | * gh-runner-almalinux.vm.nurd.space |
| | * gh-runner-debian.vm.nurd.space |
| | |
| | All machines are deployed using a combination of OpenTOFU, cloud-init and Ansible via an CI/CD pipeline running on Gitlab. Configuration is done via GIT. If you need a machine for any purpose, ask the BOFH team. |
|
| |
|
| It can be accessed on https://ldap.nurdspace.nl.
| | TODO: Make this available for members without BOFH being involved. |
|
| |
|
| On [[Hp_dc5800_sinterklaas|Sinterklaas]], [[Dell_Optiplex_GX270|Vjdeb]] and the [[PrinterPC]] it's working for the local users that existed:
| | == Wiki == |
| * Homedirs moved to NFS mount from [[Proxmox1]]
| | Authentication on this wiki is done via SAML using a combination of SimpleSAML and Keycloak. Keycloak uses LDAP as an identity source. |
| * Local homedirs and users deleted (except user 'printer' on [[PrinterPC]])
| |
| * /home/ is mounted over NFS on boot
| |
| * LDAP users can log in and see their homedirs as if nothing has changed
| |
| * Users in the LDAP 'sudo' group can sudo on connected workstations.
| |
| * Homedir is created on NFS-export when adding a user to LDAP ([http://documentation.fusiondirectory.org/en/documentation_faq/command_after like this])
| |
| * Port 636 (ldaps) is [[Cisco800series#Port_forwarding_howto|forwarded]] to [[NURDServices]] for future use by the [[Wiki]]
| |
|
| |
|
| = Setting up other workstations in this way = | | == Gitlab == |
| To get this to work you need to:
| | See [[Network/Roadmap/MigrateToGitlab|our Gitlab instance]] |
| * create all local users in LDAP (if they don't exist already)
| |
| * delete local users (optional)
| |
| * move homedirs to nurdservices (fix ownership because LDAP-users have a different UID)
| |
| * delete local homedirs
| |
| * mount /home from proxmox1:/mnt/md0/homedirs over nfs (put it in /etc/fstab)
| |
| * install [http://wiki.debian.org/LDAP/NSS#NSS_Setup_with_libnss-ldapd libnss-ldapd] and libpam-ldap (URI ldaps://ldap.nurdspace.nl/)
| |
| * put https://www.sslcertificaten.nl/files/PositiveSSLCA2.crt in /etc/ssl/certs/ with permissions 644
| |
| * in nslcd.conf set the following:
| |
| uri ldaps://ldap.nurdspace.nl/
| |
| base dc=nurdspace,dc=lan
| |
| binddn cn=read-user,ou=systems,dc=nurdspace,dc=lan
| |
| bindpw (obtain from other machine)
| |
| ssl on
| |
| tls_reqcert demand
| |
| tls_cacertfile /etc/ssl/certs/PositiveSSLCA2.crt
| |
| * restart nslcd
| |
| * this information should also be used for pam_ldap.conf
| |
| * sudo might not work until you type 'id' which is [http://wiki.debian.org/LDAP/PAM kind of a mystery]
| |
|
| |
|
| Also useful: http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian#NSS_configuration
| | == Wifi (Spacenet) == |
| | TODO: Is broken as of now |
|
| |
|
| In certain cases sudo can break. This can be fixed with [http://osdir.com/ml/general/2013-01/msg44182.html a patch] while it's not fixed properly.
| | == DHCP == |
| | See the [[Network|network page]]. |
|
| |
|
| = To do= | | == (Un)locking the front door == |
| * <s>Read http://www.openldap.org/doc/admin24/slapdconf2.html</s>
| | See the [[Network/Services/DoorLock|Door lock page]]. |
| * <s>FTPd</s> nevermind
| |
| * <s>Samba</s> nevermind
| |
| * <s>Cert installed for ldap.nurdspace.nl. Allow access only over TLS as soon as this works (ldapsearch -v -H ldaps://ldap.nurdspace.nl/ -D uid=fwd,ou=people,dc=nurdspace,dc=lan -W -b dc=nurdspace,dc=lan)</s>
| |
| * <s>Fix "nurdservices slapd[32524]: <= bdb_equality_candidates: (uid) not indexed" errors in /var/log/syslog</s>
| |
| * <s>Connect machines to LDAP over ldap<b>s</b> instead of ldap.</s>
| |
| * <s>Disable non-SSL ldap</s>
| |
| * <s>Migrate all local users on [[Infra]] machines to LDAP</s>
| |
| * <s>Migrate all homedirs to [[Proxmox1]]</s>
| |
| * <s>Maintain sudo'ers only through the LDAP and</s> disable local root accounts (backdoor in case of emergency?)
| |
| * <s>Disable all relevant services on Nurdserver v1</s>
| |
| * <s>Upgrade FusionDirectory from [http://documentation.fusiondirectory.org/en/documentation/admin_installation_migration_1.0.5 1.0.4 to 1.0.5]</s>
| |
| * Exclude weak ciphers from olcTLSCipherSuite in cn=config
| |
| * Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
| |
| * Check out what happens to the history when usernames from the wiki no longer exist in the LDAP -> Easier to merge them all into 1 user "history". What happens when you do this:
| |
| Adding edit count of (8 and 70)
| |
| Updating archive table (8 to 70)
| |
| Updating revision table (8 to 70)
| |
| Updating filearchive table (8 to 70)
| |
| Updating image table (8 to 70)
| |
| Updating oldimage table (8 to 70)
| |
| Updating recentchanges table (8 to 70)
| |
| Updating logging table (8 to 70)
| |
| Updating ipblocks table (8 to 70)
| |
| Updating ipblocks table (8 to 70)
| |
| Updating watchlist table (8 to 70)
| |
| Updating archive table (Aldert Hazenberg to History)
| |
| Updating revision table (Aldert Hazenberg to History)
| |
| Updating filearchive table (Aldert Hazenberg to History)
| |
| Updating image table (Aldert Hazenberg to History)
| |
| Updating oldimage table (Aldert Hazenberg to History)
| |
| Updating recentchanges table (Aldert Hazenberg to History)
| |
| Updating ipblocks table (Aldert Hazenberg to History)
| |
| Updating ipblocks table (Aldert Hazenberg to History)
| |
| * Migrate [[wiki]] users and merge them with other users
| |
| * Use LDAP as userdb back-end for [[wiki]] ([http://ryandlane.com/wprdl/2009/03/23/using-the-ldap-authentication-plugin-for-mediawiki-the-basics-part-1/ like so])
| |
| * <s>Add all relevant fields of Wiki users to LDAP profiles (this will require [http://www.openldap.org/doc/admin24/schema.html#Extending Schema extending the schema])</s> we shouldn't want this
| |
| * Maintain [http://nurdspace.nl/Category:Members Members] page from LDAP ([http://www.mediawiki.org/wiki/Extension:External_Data#.23get_ldap_data_-_retrieve_data_from_LDAP_directory Like so], but this only displays 1 entry. Could be fixed [http://www.mediawiki.org/wiki/Extension_talk:External_Data/Archive_2012#.23for_external_table_support_for_.23get_ldap_data like so].)
| |
