LDAP: Difference between revisions

From NURDspace
 
(132 intermediate revisions by 6 users not shown)
Line 1: Line 1:
For use with [[SpaceNet]] we've installed OpenLDAP on [[nurdserver]]. We can use this LDAP for many more purposes. This page can serve as documentation for both working implementations and future plans.
{{Project
|Name=LDAP
|Skills=Linux, FreeIPA
|Status=Implemented
|Niche=Software
|Purpose=Infrastructure
|Tool=Yes
}}
= Status =


= Working implementations =
We are currently running on [[Network/Roadmap/LDAPAuthentication|FreeIPA]].
* [[Spacenet]]
* Samba on [[NURDServer]]
* vsFTPd on [[NURDServer]]


= Future plans =
= Connected machines and services =
* [[wiki]] logins
* NFS for homedirs and other dirs (MP3 etc) on [[NURDServer]]
* System users for all [[infra]]-machines
* Maintain sudo'ers through the LDAP and remove all local root accounts


= Status of future plans =
== Virtual Machines ==
I've installed [http://fusiondirectory.org FusionDirectory] on a new VM called nurdservices on the proxmox system of [[NURDserver_v2|Nurdserver v2]]. I've also added a couple of users to it.


It can be accessed on http://nurdservices/fusiondirectory from within the network.
You can use the following systems by logging into them using your LDAP account. These systems are only available when you are connected to the space network, or you have a working VPN tunnel to the space. Note that you need to be part of the BOFH group to gain root access. If you need root, ask someone from the BOFH team to see whats possible.


On [[Hp_dc5800_sinterklaas|Sinterklaas]] I've got it to work as I think it should be:
* services-1.lan.nurd.space
* Homedirs moved to an nfs mount from [[NURDserver_v2|Nurdservices]]
* services-2.lan.nurd.space
* Local homedirs and users deleted
* gitlab.vm.nurd.space
* /home/ is mounted on boot over nfs
* minio.vm.nurd.space
* LDAP users can log in and see their homedirs as if nothing has changed
* navi.vm.nurd.space
* gh-runner-almalinux.vm.nurd.space
* gh-runner-debian.vm.nurd.space


= Logging in to workstations with LDAP users =
All machines are deployed using a combination of OpenTOFU, cloud-init and Ansible via an CI/CD pipeline running on Gitlab. Configuration is done via GIT. If you need a machine for any purpose, ask the BOFH team.
To get this to work you need to install libnss-ldapd, configure the ldap in nss and pam (no ssl, so ldap://nurdservices/), and add a line to /etc/pam.d/common-account:


<code>
TODO: Make this available for members without BOFH being involved.
session    required  pam_mkhomedir.so skel=/etc/skel/ umask=0022
 
</code>
== Wiki ==
Authentication on this wiki is done via SAML using a combination of SimpleSAML and Keycloak. Keycloak uses LDAP as an identity source.
 
== Gitlab ==
See [[Network/Roadmap/MigrateToGitlab|our Gitlab instance]]
 
== Wifi (Spacenet) ==
TODO: Is broken as of now
 
== DHCP ==
See the [[Network|network page]].
 
== (Un)locking the front door ==
See the [[Network/Services/DoorLock|Door lock page]].

Latest revision as of 22:48, 6 September 2024

LDAP
NoPicture.png
Participants Fwd
Skills Linux, FreeIPA
Status Implemented
Niche Software
Purpose Infrastructure
Tool Yes
Location
Cost
Tool category

LDAP Property "Tool Image" (as page type) with input value "File:{{{Picture}}}" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process. {{{Picture}}} {{#if:Yes | [[Tool Owner::{{{ProjectParticipants}}} | }} {{#if:Yes | [[Tool Cost::{{{Cost}}} | }}

Status

We are currently running on FreeIPA.

Connected machines and services

Virtual Machines

You can use the following systems by logging into them using your LDAP account. These systems are only available when you are connected to the space network, or you have a working VPN tunnel to the space. Note that you need to be part of the BOFH group to gain root access. If you need root, ask someone from the BOFH team to see whats possible.

  • services-1.lan.nurd.space
  • services-2.lan.nurd.space
  • gitlab.vm.nurd.space
  • minio.vm.nurd.space
  • navi.vm.nurd.space
  • gh-runner-almalinux.vm.nurd.space
  • gh-runner-debian.vm.nurd.space

All machines are deployed using a combination of OpenTOFU, cloud-init and Ansible via an CI/CD pipeline running on Gitlab. Configuration is done via GIT. If you need a machine for any purpose, ask the BOFH team.

TODO: Make this available for members without BOFH being involved.

Wiki

Authentication on this wiki is done via SAML using a combination of SimpleSAML and Keycloak. Keycloak uses LDAP as an identity source.

Gitlab

See our Gitlab instance

Wifi (Spacenet)

TODO: Is broken as of now

DHCP

See the network page.

(Un)locking the front door

See the Door lock page.