LDAP

For use with Spacenet we've installed OpenLDAP on NURDServer. On the new Nurdserver v2 we're going serious with LDAP.

Working implementations on Nurdserver v1 (nurdserver)

• Samba on NURDServer
• vsFTPd on NURDServer

Working implementations on Nurdserver v2 (nurdservices)

• NFS export for homedirs
• Spacenet

Connected workstations

• Sinterklaas
• Vjdeb
• PrinterPC
• Nurdservices

Status

FusionDirectory is running on NURDServices on the Proxmox2. Most users are migrated.

It can be accessed on [1].

On Sinterklaas, Vjdeb and the PrinterPC I've got it to work as I think it should be for the local users that existed:

• Homedirs moved to nfs mount from NURDServices (soon to be migrated to Proxmox1)
• Local homedirs and users deleted (except user 'printer' on PrinterPC)
• /home/ is mounted over nfs on boot
• LDAP users can log in and see their homedirs as if nothing has changed
• Users in the LDAP 'sudo' group can sudo on connected workstations.
• Homedir is created on NFS-export when adding a user to LDAP (like this)

Setting up other workstations in this way

To get this to work you need to:

• create all local users in LDAP (if they don't exist already)
• move homedirs to nurdservices (fix ownership because LDAP-users have a different UID)
• delete local users (optional)
• delete local homedirs
• install libnss-ldapd and libpam-ldap
• config the binddn (read-user) in nslcd.conf (this is needed to look up the cn based on the UID the user inputs)
• mount /home from nurdservices over nfs
• restart nslcd and nscd
• if sudo doesn't work until you type 'id': lower the minimum_uid to 100 instead of the original 1000 in /etc/pam.d/common-* (why this works is kind of a mystery)

Also useful: http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian#NSS_configuration

To do

• Read http://www.openldap.org/doc/admin24/slapdconf2.html
• FTPd nevermind
• Samba nevermind
• Cert installed for ldap.nurdspace.nl. Allow access only over TLS as soon as this works (ldapsearch -v -H ldaps://ldap.nurdspace.nl/ -D uid=fwd,ou=people,dc=nurdspace,dc=lan -W -b dc=nurdspace,dc=lan) => basically this works, except I don't know what to set for olcTLSCipherSuite.
• Fix "nurdservices slapd[32524]: <= bdb_equality_candidates: (uid) not indexed" errors in /var/log/syslog
• Connect machines to LDAP over ldaps instead of ldap.
• Exclude weak ciphers from olcTLSCipherSuite in cn=config
• Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
• Migrate all local users on Infra machines to LDAP
• Migrate all homedirs to NURDServices (moving to Proxmox1
• Migrate wiki users and merge them with other users
• Use LDAP as userdb back-end for wiki (like so)
• Add all relevant fields of Wiki users to LDAP profiles
• Maintain Members page from LDAP (Like so, but this has limitations. Maybe only members details pages?)
• Maintain sudo'ers only through the LDAP and disable local root accounts (backdoor in case of emergency?)
• Disable all relevant services on Nurdserver v1