|
|
| (62 intermediate revisions by 6 users not shown) |
| Line 1: |
Line 1: |
| {{Project | | {{Project |
| |ProjectSkills=Linux, OpenLDAP, reading documentation, asking Wilco for help | | |Name=LDAP |
| |ProjectStatus=Active | | |Skills=Linux, FreeIPA |
| |ProjectNiche=Software | | |Status=Implemented |
| |ProjectPurpose=Infrastructure | | |Niche=Software |
| | |Purpose=Infrastructure |
| | |Tool=Yes |
| }} | | }} |
| | = Status = |
|
| |
|
| For use with [[Spacenet]] we've installed OpenLDAP on [[NURDServer]]. On the new [[NURDServices]] we're going serious with LDAP.
| | We are currently running on [[Network/Roadmap/LDAPAuthentication|FreeIPA]]. |
|
| |
|
| = Status = | | = Connected machines and services = |
| Slapd and [http://fusiondirectory.org FusionDirectory] are running on [[NURDServices]]. FusionDirectory can be accessed on https://ldap.nurdspace.nl.
| |
|
| |
|
| = Connected machines and services = | | == Virtual Machines == |
| * [[Hp_dc5800_sinterklaas|Sinterklaas]]
| |
| * [[Dell_Optiplex_GX270|Vjdeb]]
| |
| * [[PrinterPC]]
| |
| * [[NURDServices]] (only users in group "admins" can log in)
| |
| * [[Proxmox1]] (for fixing homedir ownership, only users in group "admins" can actually log in)
| |
| * [[Tankstation]]
| |
| * [[Sun_Ultra_1|plankton]]
| |
| * [[Spacenet]]
| |
| * [[Wiki]]
| |
|
| |
|
| == Workstations ==
| | You can use the following systems by logging into them using your LDAP account. These systems are only available when you are connected to the space network, or you have a working VPN tunnel to the space. Note that you need to be part of the BOFH group to gain root access. If you need root, ask someone from the BOFH team to see whats possible. |
| The workstations listed above are set up as follows:
| |
| * Homedirs mounted over NFS from [[Proxmox1]] (except user 'printer' on [[PrinterPC]])
| |
| * Users in the LDAP 'sudo' group can sudo.
| |
| * Homedirs are created on the NFS-export when adding a user to LDAP ([http://documentation.fusiondirectory.org/en/documentation_faq/command_after like this])
| |
|
| |
|
| === Setting up other workstations in this way ===
| | * services-1.lan.nurd.space |
| To get this to work you need to:
| | * services-2.lan.nurd.space |
| * create all local users in LDAP (if they don't exist already) | | * gitlab.vm.nurd.space |
| * delete local users (optional) | | * minio.vm.nurd.space |
| * move homedirs to nurdservices (fix ownership because LDAP-users have a different UID)
| | * navi.vm.nurd.space |
| * delete local homedirs | | * gh-runner-almalinux.vm.nurd.space |
| * mount /home from proxmox1:/mnt/md0/homedirs over nfs (put it in /etc/fstab) | | * gh-runner-debian.vm.nurd.space |
| * put https://www.sslcertificaten.nl/files/PositiveSSLCA2.crt in /etc/ssl/certs/ with permissions 644
| |
| * install [http://wiki.debian.org/LDAP/NSS#NSS_Setup_with_libnss-ldapd libnss-ldapd] and libpam-ldap (URI ldaps://ldap.nurdspace.nl/) | |
| * the installation of libnss-ldap and libpam-ldap don't offer all required settings, so fix nslcd.conf and pam_ldap.conf to mention at least the following: | |
| uri ldaps://ldap.nurdspace.nl/
| |
| base dc=nurdspace,dc=lan
| |
| binddn cn=read-user,ou=systems,dc=nurdspace,dc=lan
| |
| bindpw (obtain from other machine)
| |
| ssl on
| |
| tls_reqcert demand
| |
| tls_cacertfile /etc/ssl/certs/PositiveSSLCA2.crt
| |
| * restart nslcd
| |
| * sudo might not work until you type 'id' which is [http://wiki.debian.org/LDAP/PAM kind of a mystery]
| |
|
| |
|
| Useful reading: http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian
| | All machines are deployed using a combination of OpenTOFU, cloud-init and Ansible via an CI/CD pipeline running on Gitlab. Configuration is done via GIT. If you need a machine for any purpose, ask the BOFH team. |
|
| |
|
| In certain cases sudo can break. This can be fixed with [http://osdir.com/ml/general/2013-01/msg44182.html a patch] while it's not fixed properly.
| | TODO: Make this available for members without BOFH being involved. |
|
| |
|
| == Wiki == | | == Wiki == |
| * Port 636 (ldaps) is [[Cisco800series#Port_forwarding_howto|forwarded]] to [[NURDServices]] for usage by the [[Wiki]].
| | Authentication on this wiki is done via SAML using a combination of SimpleSAML and Keycloak. Keycloak uses LDAP as an identity source. |
| * [http://www.mediawiki.org/wiki/Extension:LDAP_Authentication] is installed on the Wiki
| |
| * Users in the group 'wikiusers' can log in. Admins, bureaucrats and sysops are locally managed.
| |
| * Full addition to LocalSettings.php:
| |
| #LDAP Auth
| |
| require_once( "$IP/extensions/LdapAuthentication/LdapAuthentication.php" );
| |
| $wgAuth = new LdapAuthenticationPlugin();
| |
| $wgLDAPDebug = 9;
| |
| $wgDebugLogGroups['ldap'] = '/tmp/debug.log';
| |
|
| |
| $wgLDAPDomainNames = array( 'nurdspace.lan', );
| |
| $wgLDAPServerNames = array( 'nurdspace.lan' => 'ldap.nurdspace.nl', );
| |
| $wgLDAPUseLocal = false;
| |
| $wgLDAPEncryptionType = array( 'nurdspace.lan' => 'ssl', );
| |
| $wgLDAPSearchStrings = array( 'nurdspace.lan' => 'uid=USER-NAME,ou=people,dc=nurdspace,dc=lan', );
| |
| $wgLDAPLowerCaseUsername = array( 'nurdspace.lan' => true );
| |
| $wgLDAPRequiredGroups = array( 'nurdspace.lan' => array( 'cn=wikiusers,ou=groups,dc=nurdspace,dc=lan', ) );
| |
| $wgLDAPGroupUseFullDN = array( "nurdspace.lan"=>false );
| |
| $wgLDAPGroupObjectclass = array( "nurdspace.lan"=>"posixGroup" );
| |
| $wgLDAPGroupAttribute = array( "nurdspace.lan"=>"memberUid" );
| |
| $wgLDAPGroupSearchNestedGroups = array( "nurdspace.lan"=>false );
| |
| $wgLDAPGroupNameAttribute = array( "nurdspace.lan"=>"cn" );
| |
| $wgLDAPBaseDNs = array( "nurdspace.lan"=>"dc=nurdspace,dc=lan" );
| |
| $wgLDAPUseLDAPGroups = array( "nurdspace.lan"=>true );
| |
| $wgGroupPermissions['wikiusers']['edit'] = true;
| |
| $wgGroupPermissions['admins'] = $wgGroupPermissions['sysop'];
| |
|
| |
| # This hook is called by the LdapAuthentication plugin. It is a configuration hook. Here we
| |
| # are specifying what attibute we want to use for a username in the wiki.
| |
| # Note that this hook is NOT called on a straight bind.
| |
| # The hook calls the function defined below.
| |
| $wgHooks['SetUsernameAttributeFromLDAP'][] = 'SetUsernameAttribute';
| |
|
| |
|
| Some settings might not be necessary, such as the wgGroupPermissions and wgHooks. I'll do some experimenting to see if it can be cleaned up.
| | == Gitlab == |
| | See [[Network/Roadmap/MigrateToGitlab|our Gitlab instance]] |
|
| |
|
| === Limitations === | | == Wifi (Spacenet) == |
| * The mediawiki login system converts the first character of usernames to uppercase due to [http://en.wikipedia.org/wiki/Wikipedia:Naming_conventions_(technical_restrictions)#Restrictions_on_usernames restrictions on usernames]. To get around this we've enabled [http://www.mediawiki.org/wiki/Extension:LDAP_Authentication/Changelog#v2.0a $wgLDAPLowercaseUsernameScheme]. This requires usernames to be all lowercase in the LDAP.
| | TODO: Is broken as of now |
|
| |
|
| == Wifi == | | == DHCP == |
| The LDAP serves as a userdb for [[Spacenet]], which is connected via FreeRADIUS. For full details see the [[Spacenet]]-page.
| | See the [[Network|network page]]. |
|
| |
|
| = To do= | | == (Un)locking the front door == |
| * <s>Read http://www.openldap.org/doc/admin24/slapdconf2.html</s>
| | See the [[Network/Services/DoorLock|Door lock page]]. |
| * <s>FTPd</s> nevermind
| |
| * <s>Samba</s> nevermind
| |
| * <s>Cert installed for ldap.nurdspace.nl. Allow access only over TLS as soon as this works (ldapsearch -v -H ldaps://ldap.nurdspace.nl/ -D uid=fwd,ou=people,dc=nurdspace,dc=lan -W -b dc=nurdspace,dc=lan)</s>
| |
| * <s>Fix "nurdservices slapd[32524]: <= bdb_equality_candidates: (uid) not indexed" errors in /var/log/syslog</s>
| |
| * <s>Connect machines to LDAP over ldap<b>s</b> instead of ldap.</s>
| |
| * <s>Disable non-SSL ldap</s>
| |
| * <s>Migrate all local users on [[Infra]] machines to LDAP</s>
| |
| * <s>Migrate all homedirs to [[Proxmox1]]</s>
| |
| * <s>Maintain sudo'ers only through the LDAP and</s> disable local root accounts (backdoor in case of emergency?)
| |
| * <s>Disable all relevant services on Nurdserver v1</s>
| |
| * <s>Upgrade FusionDirectory from [http://documentation.fusiondirectory.org/en/documentation/admin_installation_migration_1.0.5 1.0.4 to 1.0.5]</s>
| |
| * <s>Add all relevant fields of Wiki users to LDAP profiles (this will require [http://www.openldap.org/doc/admin24/schema.html#Extending Schema extending the schema])</s> we shouldn't want this
| |
| * Exclude weak ciphers from olcTLSCipherSuite in cn=config
| |
| * Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
| |
| * <s>Create group 'wikiusers' in LDAP</s>
| |
| * <s>Add already existing LDAP users to 'wikiusers' group</s>
| |
| * Upgrade FusionDirectory from 1.0.5 to [http://fusiondirectory.org/basic/press#fd-1.0.6 1.0.6]
| |
| * <s>Set up VM to test the intended set-up (done on 192.168.1.223)</s> -> [[Wiki_test_VM]]
| |
| * <s>Merge all unwanted users to user 'history'</s> (running into [https://bugzilla.wikimedia.org/show_bug.cgi?id=35239 a bug] with some users)
| |
| * <s>Inform wiki users that will be renamed</s>
| |
| * <s>Migrate/merge [[wiki]] users to LDAP</s>
| |
| * <s>Create necessary wiki groups (bureaucrats, admins, other?)</s> -> authorization is done in the wiki
| |
| * <s>Use LDAP as userdb back-end for [[wiki]] ([http://ryandlane.com/wprdl/2009/03/23/using-the-ldap-authentication-plugin-for-mediawiki-the-basics-part-1/ like so])</s>
| |
| * Maintain [http://nurdspace.nl/Category:Members Members] page from LDAP ([http://www.mediawiki.org/wiki/Extension:External_Data#.23get_ldap_data_-_retrieve_data_from_LDAP_directory Like so], but this only displays 1 entry. Could be fixed [http://www.mediawiki.org/wiki/Extension_talk:External_Data/Archive_2012#.23for_external_table_support_for_.23get_ldap_data like so].)
| |
