Revision as of 03:38, 27 April 2013

For use with Spacenet we've installed OpenLDAP on NURDServer. On the new Nurdserver v2 we're going serious with LDAP.

Working implementations on Nurdserver v1 (nurdserver)

FusionDirectory is running on a new VM called NURDserver_v2#nurdservicesnurdservices on the proxmox system of Nurdserver v2. Most users are migrated.

It can be accessed on http://nurdservices/fusiondirectory from within the network.

On Sinterklaas, Vjdeb and the PrinterPC I've got it to work as I think it should be for the local users that existed:

To get this to work you need to:

create all local users in LDAP (if they don't exist already)
move homedirs to nurdservices (fix ownership if needed)
delete local users (optional)
delete local homedirs
install libnss-ldapd and libpam-ldap
config the binddn (read-user) in nslcd.conf (this is needed to look up the cn based on the UID the user inputs)
mount /home from nurdservices over nfs
restart nslcd and nscd
if sudo doesn't work until you type 'id': lower the minimum_uid to 100 instead of the original 1000 in /etc/pam.d/common-* (why this works is kind of a mystery)

Read http://www.openldap.org/doc/admin24/slapdconf2.html
~~FTPd~~ nevermind
~~Samba~~ nevermind
~~Get a certificate,~~Cert installed for ldap.nurdspace.nl. Allow access only over TLS as soon as this works (ldapsearch -v -H ldaps:/// -D uid=fwd,ou=people,dc=nurdspace,dc=lan -W -b dc=nurdspace,dc=lan)
Fix "nurdservices slapd[32524]: <= bdb_equality_candidates: (uid) not indexed" errors in /var/log/syslog
Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
Migrate all local users on Infra machines to LDAP
Migrate all homedirs to Nurdservices
Migrate wiki users and merge them with other users
Use LDAP as userdb back-end for wiki (like so)
Add all relevant fields of Wiki users to LDAP profiles
Maintain Members page from LDAP (Like so, but this has limitations. Maybe only members details pages?)
Maintain sudo'ers only through the LDAP and disable local root accounts (backdoor in case of emergency?)
Disable all relevant services on Nurdserver v1

@@ Line 35: / Line 35: @@
 * delete local homedirs
 * install [http://wiki.debian.org/LDAP/NSS#NSS_Setup_with_libnss-ldapd libnss-ldapd] and libpam-ldap
-* config the binddn (read-user) in pam_ldap.conf and nslcd.conf (this is needed to look up the cn based on the UID the user inputs)
+* config the binddn (read-user) in nslcd.conf (this is needed to look up the cn based on the UID the user inputs)
 * mount /home from nurdservices over nfs
-* configure the ldap in nss and pam (no ssl, so ldap://nurdservices/)
 * restart nslcd and nscd
 * if sudo doesn't work until you type 'id': lower the minimum_uid to 100 instead of the original 1000 in /etc/pam.d/common-* (why this works is [http://wiki.debian.org/LDAP/PAM kind of a mystery])