LDAP: Difference between revisions

From NURDspace
No edit summary
Line 1: Line 1:
For use with [[SpaceNet]] we've installed OpenLDAP on [[nurdserver]]. We can use this LDAP for many more purposes. This page can serve as documentation for both working implementations and future plans.
For use with [[SpaceNet]] we've installed OpenLDAP on [[nurdserver]]. On the new [[NURDserver_v2|Nurdserver v2]] we're going serious with LDAP.


= Working implementations =
= Working implementations on Nurdserver v1 (nurdserver) =
* [[Spacenet]]
* [[Spacenet]]
* Samba on [[NURDServer]]
* Samba on [[NURDServer]]
* vsFTPd on [[NURDServer]]
* vsFTPd on [[NURDServer]]


= Future plans =
= Working implementations on Nurdserver v2 (nurdservices) =
* [[wiki]] logins
* NFS export
* NFS for homedirs and other dirs (MP3 etc) on [[NURDServer]]
* System users for all [[infra]]-machines
* Maintain sudo'ers through the LDAP and remove all local root accounts


= Status of future plans =
= To do=
* [[Spacenet]]
* FTPd
* Samba?
* Get a certificate, allow access only over TLS
* Create homedir on NFS-exported home when adding a user to LDAP
* Migrate all local users on [[Infra]] machines to LDAP
* Migrate all homedirs to [[NURDserver_v2|Nurdservices]]
* Fix storage on [[NURDserver_v2|Nurdservices]] (current VM is 32GB)
* Migrate [[wiki]] users and merge them with other users
* Use LDAP as userdb back-end for [[wiki]]
* Add all relevant fields of Wiki users to LDAP profiles
* Maintain [[Category:Members|Members]] page from LDAP
* Maintain sudo'ers through the LDAP and disable local root accounts (backdoor in case of emergency?)
* Disable all relevant services on Nurdserver v1
 
= Status =
I've installed [http://fusiondirectory.org FusionDirectory] on a new VM called nurdservices on the proxmox system of [[NURDserver_v2|Nurdserver v2]]. I've also added a couple of users to it.
I've installed [http://fusiondirectory.org FusionDirectory] on a new VM called nurdservices on the proxmox system of [[NURDserver_v2|Nurdserver v2]]. I've also added a couple of users to it.


It can be accessed on http://nurdservices/fusiondirectory from within the network.
It can be accessed on http://nurdservices/fusiondirectory from within the network.


On [[Hp_dc5800_sinterklaas|Sinterklaas]] I've got it to work as I think it should be:
On [[Hp_dc5800_sinterklaas|Sinterklaas]] I've got it to work as I think it should be for the local users that existed:
* Homedirs moved to an nfs mount from [[NURDserver_v2|Nurdservices]]
* Homedirs moved to an nfs mount from [[NURDserver_v2|Nurdservices]]
* Local homedirs and users deleted
* Local homedirs and users deleted
Line 23: Line 36:
* LDAP users can log in and see their homedirs as if nothing has changed
* LDAP users can log in and see their homedirs as if nothing has changed


= Logging in to workstations with LDAP users =
= Setting up other workstations in this way =
To get this to work you need to install libnss-ldapd, configure the ldap in nss and pam (no ssl, so ldap://nurdservices/), and add a line to /etc/pam.d/common-account:
To get this to work you need to:
* create all local users in LDAP (if they don't exist already)
* move homedirs to nurdservices (fix ownership if needed)
* delete local users
* delete local homedirs
* install libnss-ldapd
* mount /home from nurdservices over nfs
* configure the ldap in nss and pam (no ssl, so ldap://nurdservices/)
* and add a line to /etc/pam.d/common-account:


<code>
<code>
session    required  pam_mkhomedir.so skel=/etc/skel/ umask=0022
session    required  pam_mkhomedir.so skel=/etc/skel/ umask=0022
</code>
</code>
This step will no longer be needed once homedirs are created when you add a user to the LDAP.

Revision as of 03:36, 30 March 2013

For use with SpaceNet we've installed OpenLDAP on nurdserver. On the new Nurdserver v2 we're going serious with LDAP.

Working implementations on Nurdserver v1 (nurdserver)

Working implementations on Nurdserver v2 (nurdservices)

  • NFS export

To do

  • Spacenet
  • FTPd
  • Samba?
  • Get a certificate, allow access only over TLS
  • Create homedir on NFS-exported home when adding a user to LDAP
  • Migrate all local users on Infra machines to LDAP
  • Migrate all homedirs to Nurdservices
  • Fix storage on Nurdservices (current VM is 32GB)
  • Migrate wiki users and merge them with other users
  • Use LDAP as userdb back-end for wiki
  • Add all relevant fields of Wiki users to LDAP profiles
  • Maintain page from LDAP
  • Maintain sudo'ers through the LDAP and disable local root accounts (backdoor in case of emergency?)
  • Disable all relevant services on Nurdserver v1

Status

I've installed FusionDirectory on a new VM called nurdservices on the proxmox system of Nurdserver v2. I've also added a couple of users to it.

It can be accessed on http://nurdservices/fusiondirectory from within the network.

On Sinterklaas I've got it to work as I think it should be for the local users that existed:

  • Homedirs moved to an nfs mount from Nurdservices
  • Local homedirs and users deleted
  • /home/ is mounted on boot over nfs
  • LDAP users can log in and see their homedirs as if nothing has changed

Setting up other workstations in this way

To get this to work you need to:

  • create all local users in LDAP (if they don't exist already)
  • move homedirs to nurdservices (fix ownership if needed)
  • delete local users
  • delete local homedirs
  • install libnss-ldapd
  • mount /home from nurdservices over nfs
  • configure the ldap in nss and pam (no ssl, so ldap://nurdservices/)
  • and add a line to /etc/pam.d/common-account:

session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

This step will no longer be needed once homedirs are created when you add a user to the LDAP.

Retrieved from "https://nurdspace.nl/index.php?title=LDAP&oldid=2196"
Last modified
This page was last edited on 30 March 2013, at 03:36.