|
|
| (17 intermediate revisions by 5 users not shown) |
| Line 1: |
Line 1: |
| {{Project | | {{Project |
| |Name=LDAP | | |Name=LDAP |
| |ProjectSkills=Linux, OpenLDAP, reading documentation, asking Wilco for help | | |Skills=Linux, FreeIPA |
| |Status=Active | | |Status=Implemented |
| |ProjectNiche=Software | | |Niche=Software |
| |ProjectPurpose=Infrastructure | | |Purpose=Infrastructure |
| | |Tool=Yes |
| }} | | }} |
| = Status = | | = Status = |
|
| |
|
| = Adding a new member =
| | We are currently running on [[Network/Roadmap/LDAPAuthentication|FreeIPA]]. |
| There's a guide [[Adding_a_new_member_to_the_ldap|here]] explaining the steps for adding a new member to the LDAP.
| | |
| = Connected machines and services = | | = Connected machines and services = |
|
| |
|
| == Workstations == | | == Virtual Machines == |
| * [[Hp_dc5800_sinterklaas|Sinterklaas]]
| |
| * [[Dell_Optiplex_GX270|Vjdeb]]
| |
| * [[PrinterPC]]
| |
| * [[Sun_Ultra_1|plankton]]
| |
| * [[BPM_Studio_Jukebox|BPM_Studio_Jukebox (all-in-one hark)]]
| |
|
| |
|
| The workstations listed above are set up as follows:
| | You can use the following systems by logging into them using your LDAP account. These systems are only available when you are connected to the space network, or you have a working VPN tunnel to the space. Note that you need to be part of the BOFH group to gain root access. If you need root, ask someone from the BOFH team to see whats possible. |
| * Homedirs mounted over NFS from [[dumpster-a]] (except user 'printer' on [[PrinterPC]])
| |
| * Users in the LDAP 'sudo' group can sudo.
| |
| * Homedirs are created on the NFS-export when adding a user to LDAP ([http://documentation.fusiondirectory.org/en/documentation_faq/command_after like this])
| |
|
| |
|
| === Setting up other workstations in this way ===
| | * services-1.lan.nurd.space |
| To get this to work you need to:
| | * services-2.lan.nurd.space |
| * create all local users in LDAP and then delete local users (else UIDs/GIDs get confusing) | | * gitlab.vm.nurd.space |
| * move homedirs to nurdservices (fix ownership because LDAP-users have a different UID) then delete local homedirs | | * minio.vm.nurd.space |
| * put https://www.sslcertificaten.nl/files/PositiveSSLCA2.crt in /etc/ssl/certs/ with permissions 644 | | * navi.vm.nurd.space |
| *insert into /etc/fstab: | | * gh-runner-almalinux.vm.nurd.space |
| dumpster-a:/vol/home /home nfs rw,auto,exec,vers=3 0 0
| | * gh-runner-debian.vm.nurd.space |
| * install [http://wiki.debian.org/LDAP/NSS#NSS_Setup_with_libnss-ldapd libnss-ldapd] (see below for settings asked during installation, in the selection list check passwd, group and shadow) | |
| * install nslcd and libpam-ldapd (see below for settings asked during installation) | |
| * /etc/nslcd.conf should mention at least the following:
| |
| uri ldaps://ldap.nurdspace.nl/
| |
| base dc=nurdspace,dc=lan
| |
| binddn cn=read-user,ou=systems,dc=nurdspace,dc=lan
| |
| bindpw (obtain from other machine)
| |
| ssl on
| |
| tls_reqcert demand
| |
| tls_cacertfile /etc/ssl/certs/PositiveSSLCA2.crt
| |
| * configure /etc/nsswitch.conf:
| |
| passwd: files ldap
| |
| group: files ldap
| |
| shadow: files ldap
| |
| * restart nslcd
| |
| * restart nscd
| |
|
| |
|
| | All machines are deployed using a combination of OpenTOFU, cloud-init and Ansible via an CI/CD pipeline running on Gitlab. Configuration is done via GIT. If you need a machine for any purpose, ask the BOFH team. |
|
| |
|
| * check if ldap users are listed when you run "getent passwd"
| | TODO: Make this available for members without BOFH being involved. |
| * sudo might not work until you type 'id' which is [http://wiki.debian.org/LDAP/PAM kind of a mystery]
| |
| | |
| Useful reading: http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian
| |
| | |
| In certain cases sudo can break. This can be fixed with [http://osdir.com/ml/general/2013-01/msg44182.html a patch] while it's not fixed properly.
| |
| | |
| == VM's ==
| |
| * [[NURDServices]] (only users in group "admins" can log in)
| |
| * [[Proxmox1]] (for fixing homedir ownership, only users in group "admins" can actually log in)
| |
| * [[Tankstation]] (a VM for all members to irssi or other processes)
| |
| | |
| == ldap.nurdspace.nl ==
| |
| Slapd and [http://fusiondirectory.org FusionDirectory] are running on [[NURDServices]]. FusionDirectory's web interface can be accessed on https://ldap.nurdspace.nl.
| |
|
| |
|
| == Wiki == | | == Wiki == |
| * Port 636 (ldaps) is [[Cisco800series#Port_forwarding_howto|forwarded]] to [[NURDServices]] for usage by the [[Wiki]].
| | Authentication on this wiki is done via SAML using a combination of SimpleSAML and Keycloak. Keycloak uses LDAP as an identity source. |
| * [http://www.mediawiki.org/wiki/Extension:LDAP_Authentication Extension:LDAP_Authentication] is installed on the Wiki
| |
| * Users in the group 'wikiusers' can log in. Admins, bureaucrats and sysops are locally managed.
| |
| * Full addition to LocalSettings.php:
| |
|
| |
|
| require_once( "$IP/extensions/LdapAuthentication/LdapAuthentication.php" );
| | == Gitlab == |
| $wgAuth = new LdapAuthenticationPlugin();
| | See [[Network/Roadmap/MigrateToGitlab|our Gitlab instance]] |
|
| |
| $wgLDAPDomainNames = array( 'nurdspace.lan', );
| |
| $wgLDAPServerNames = array( 'nurdspace.lan' => 'ldap.nurdspace.nl', );
| |
| $wgLDAPUseLocal = false;
| |
| $wgLDAPEncryptionType = array( 'nurdspace.lan' => 'ssl', );
| |
| $wgLDAPSearchStrings = array( 'nurdspace.lan' => 'uid=USER-NAME,ou=people,dc=nurdspace,dc=lan', );
| |
| $wgLDAPLowerCaseUsername = array( 'nurdspace.lan' => true );
| |
| $wgLDAPRequiredGroups = array( 'nurdspace.lan' => array( 'cn=wikiusers,ou=groups,dc=nurdspace,dc=lan', ) );
| |
| $wgLDAPGroupUseFullDN = array( "nurdspace.lan"=>false );
| |
| $wgLDAPGroupObjectclass = array( "nurdspace.lan"=>"posixGroup" );
| |
| $wgLDAPGroupAttribute = array( "nurdspace.lan"=>"memberUid" );
| |
| $wgLDAPGroupSearchNestedGroups = array( "nurdspace.lan"=>false );
| |
| $wgLDAPGroupNameAttribute = array( "nurdspace.lan"=>"cn" );
| |
| $wgLDAPBaseDNs = array( "nurdspace.lan"=>"dc=nurdspace,dc=lan" );
| |
| $wgLDAPUseLDAPGroups = array( "nurdspace.lan"=>true );
| |
| $wgGroupPermissions['wikiusers']['edit'] = true;
| |
| $wgGroupPermissions['admins'] = $wgGroupPermissions['sysop'];
| |
|
| |
| # This hook is called by the LdapAuthentication plugin. It is a configuration hook. Here we
| |
| # are specifying what attibute we want to use for a username in the wiki.
| |
| # Note that this hook is NOT called on a straight bind.
| |
| # The hook calls the function defined below.
| |
| $wgHooks['SetUsernameAttributeFromLDAP'][] = 'SetUsernameAttribute';
| |
| | |
| Some settings might not be necessary, such as the wgGroupPermissions and wgHooks. I'll do some experimenting to see if it can be cleaned up.
| |
| | |
| === Limitations ===
| |
| * The mediawiki login system converts the first character of usernames to uppercase due to [http://en.wikipedia.org/wiki/Wikipedia:Naming_conventions_(technical_restrictions)#Restrictions_on_usernames restrictions on usernames]. To get around this we've enabled [http://www.mediawiki.org/wiki/Extension:LDAP_Authentication/Changelog#v2.0a $wgLDAPLowercaseUsernameScheme]. This requires usernames to be all lowercase in the LDAP.
| |
| * Users are maintained through the LDAP, so creating a user on the Wiki is no longer possible. It could be enabled, but that would require adding a user with write-access in the LDAP. That seems a little scary for now. It would however offer the possibility of changing your LDAP password through the Wiki.
| |
|
| |
|
| == Wifi (Spacenet) == | | == Wifi (Spacenet) == |
| The LDAP serves as a userdb for [[Spacenet]], which is connected via FreeRADIUS. For full details see the [[Spacenet]]-page. Only users in group "spacenet" can log in.
| | TODO: Is broken as of now |
| | |
| == Partkeepr ==
| |
| [[Parts.nurdspace.lan|Partkeepr]] is an inventory system hosted in a separate VM. The OS isn't hooked up to the LDAP, but Apache uses mod_authnz-ldap so you can log in to partkeepr with your LDAP account.
| |
| | |
|
| |
|
| == DHCP == | | == DHCP == |
| See the [[Network|network page]]. | | See the [[Network|network page]]. |
|
| |
| = Future plans =
| |
| The most important machines and services are now hooked up to the LDAP. However, there's always room for more.
| |
|
| |
| == More groups for different purposes ==
| |
| We should create more groups for specific purposes, such as:
| |
| * Workstation users (now only sudo'ers are treated separately)
| |
| * Separate group per workstation? Or some sort of hierarchy of groups, so members need only be in 1 group?
| |
| * <s>Spacenet users</s> done
| |
|
| |
|
| == (Un)locking the front door == | | == (Un)locking the front door == |
| See [[Spacelock]]. | | See the [[Network/Services/DoorLock|Door lock page]]. |
| | |
| == Member registration ==
| |
| Currently the users in group "members" are maintained by hand. A little more automation would be appropriate. Hooking it up to actual money transactions might be far-fetched, but maybe something else is possible.
| |
| | |
| == E-mail and contacts services ==
| |
| We could install Zimbra or Zarafa, or maybe some smaller services to provide e-mail accounts, mailinglist functionality and maybe a CardDAV services for members.
| |
| | |
| == Make use of more of FusionDirectory's features ==
| |
| FusionDirectory has [http://documentation.fusiondirectory.org/en/documentation/available_plugins features/plugins] for applications, mime-types, workstations, object groups, public key authentication. Maybe some of these could be useful?
| |
| * Systems plugin installed and working, so we can now list all systems (workstations, servers) in the LDAP
| |
| * Wake-on-lan not working yet, probably due to a bug in Argonaut. The server- and client-services see eachother but wake-on-lan commands don't come through and you get an error in the web interface:
| |
| Communication failure with the infrastructure service:
| |
| Error: Request error: No client module can handle action Deployment.wake for target 00:0d:56:06:b6:26
| |
| * Maybe maintain the internal DNS with [http://documentation.fusiondirectory.org/en/documentation/plugin/dns_plugin/how_to_setup_dns_plugin_1.0.5 this plugin]?
| |
| * The DHCP feature sucks, so it's been rolled back.
| |
| | |
| == SAML ==
| |
| There's already a [https://spacefed.net/wiki/index.php/Spacesaml SpaceSAML] project, but until this is fully operational we can set up our own construction. This would require setting up an Identity Provider service (such as [http://shibboleth.net/products/identity-provider.html Shibboleth IdP]) and [http://www.mediawiki.org/wiki/Extension:SAMLAuth hooking up the Wiki] to that.
| |
| | |
| == Wiki ==
| |
| * Members page filled based on LDAP group 'members'.
| |
| | |
| == Misc ==
| |
| * Investigate possibility of moving to a different database back-end ([http://www.openldap.org/faq/data/cache/978.html back-sql])
| |
| * Exclude weak ciphers from olcTLSCipherSuite in cn=config
| |
| * Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
| |
| * Upgrade FusionDirectory from 1.0.5 to [http://fusiondirectory.org/basic/press#fd-1.0.6 1.0.6]
| |
| * Maintain [http://nurdspace.nl/Category:Members Members] page from LDAP ([http://www.mediawiki.org/wiki/Extension:External_Data#.23get_ldap_data_-_retrieve_data_from_LDAP_directory Like so], but this only displays 1 entry. Could be fixed [http://www.mediawiki.org/wiki/Extension_talk:External_Data/Archive_2012#.23for_external_table_support_for_.23get_ldap_data like so].)
| |
| * Check if the passwordmailer on FusionDirectory works
| |
| * Check out [http://www.lichteblau.com/ldapvi/manual/ ldapvi]
| |
