Revision as of 22:47, 28 April 2013

For use with Spacenet we've installed OpenLDAP on NURDServer. On the new NURDServices we're going serious with LDAP.

Connected workstations

Status

FusionDirectory is running on NURDServices.

It can be accessed on [1].

On Sinterklaas, Vjdeb and the PrinterPC I've got it to work as I think it should be for the local users that existed:

Homedirs moved to NFS mount from Proxmox1
Local homedirs and users deleted (except user 'printer' on PrinterPC)
/home/ is mounted over NFS on boot
LDAP users can log in and see their homedirs as if nothing has changed
Users in the LDAP 'sudo' group can sudo on connected workstations.
Homedir is created on NFS-export when adding a user to LDAP (like this)
Port 636 (ldaps) is forwarded to NURDServices for future use by the Wiki

Setting up other workstations in this way

To get this to work you need to:

create all local users in LDAP (if they don't exist already)
delete local users (optional)
move homedirs to nurdservices (fix ownership because LDAP-users have a different UID)
delete local homedirs
mount /home from proxmox1:/mnt/md0/homedirs over nfs (put it in /etc/fstab)
install libnss-ldapd and libpam-ldap (URI ldaps://ldap.nurdspace.nl/)
put https://www.sslcertificaten.nl/files/PositiveSSLCA2.crt in /etc/ssl/certs/ with permissions 644
in nslcd.conf set the following:

uri ldaps://ldap.nurdspace.nl/
base dc=nurdspace,dc=lan
binddn cn=read-user,ou=systems,dc=nurdspace,dc=lan
bindpw (obtain from other machine)
ssl on
tls_reqcert demand
tls_cacertfile /etc/ssl/certs/PositiveSSLCA2.crt

restart nslcd
this information should also be used for pam_ldap.conf
sudo might not work until you type 'id' which is kind of a mystery

Also useful: http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian#NSS_configuration

In certain cases sudo can break. This can be fixed with a patch while it's not fixed properly.

To do

~~Read http://www.openldap.org/doc/admin24/slapdconf2.html~~
~~FTPd~~ nevermind
~~Samba~~ nevermind
~~Cert installed for ldap.nurdspace.nl. Allow access only over TLS as soon as this works (ldapsearch -v -H ldaps://ldap.nurdspace.nl/ -D uid=fwd,ou=people,dc=nurdspace,dc=lan -W -b dc=nurdspace,dc=lan)~~
~~Fix "nurdservices slapd[32524]: <= bdb_equality_candidates: (uid) not indexed" errors in /var/log/syslog~~
~~Connect machines to LDAP over ldaps instead of ldap.~~
~~Disable non-SSL ldap~~
~~Migrate all local users on Infra machines to LDAP~~
~~Migrate all homedirs to Proxmox1~~
~~Maintain sudo'ers only through the LDAP and~~ disable local root accounts (backdoor in case of emergency?)
~~Disable all relevant services on Nurdserver v1~~
Exclude weak ciphers from olcTLSCipherSuite in cn=config
Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
Migrate wiki users and merge them with other users
Use LDAP as userdb back-end for wiki (like so)
Add all relevant fields of Wiki users to LDAP profiles
Maintain Members page from LDAP (Like so, but this has limitations. Maybe only members details pages?)

@@ Line 1: / Line 1: @@
-For use with [[Spacenet]] we've installed OpenLDAP on [[NURDServer]]. On the new [[NURDserver_v2|Nurdserver v2]] we're going serious with LDAP.
+For use with [[Spacenet]] we've installed OpenLDAP on [[NURDServer]]. On the new [[NURDServices]] we're going serious with LDAP.
-= Working implementations on Nurdserver v1 (nurdserver) =
-* Samba on [[NURDServer]]
-* vsFTPd on [[NURDServer]]
-= Working implementations on Nurdserver v2 (nurdservices) =
-* NFS export for homedirs
-* [[Spacenet]]
 = Connected workstations =
@@ Line 16: / Line 8: @@
 = Status =
-[http://fusiondirectory.org FusionDirectory] is running on [[NURDServices]] on the [[Proxmox2]]. Most users are migrated.
+[http://fusiondirectory.org FusionDirectory] is running on [[NURDServices]].
 It can be accessed on [https://ldap.nurdspace.nl].
 On [[Hp_dc5800_sinterklaas|Sinterklaas]], [[Dell_Optiplex_GX270|Vjdeb]] and the [[PrinterPC]] I've got it to work as I think it should be for the local users that existed:
-* Homedirs moved to nfs mount from [[NURDServices]] (soon to be migrated to [[Proxmox1]])
+* Homedirs moved to NFS mount from [[Proxmox1]]
 * Local homedirs and users deleted (except user 'printer' on [[PrinterPC]])
-* /home/ is mounted over nfs on boot
+* /home/ is mounted over NFS on boot
 * LDAP users can log in and see their homedirs as if nothing has changed
 * Users in the LDAP 'sudo' group can sudo on connected workstations.
@@ Line 35: / Line 27: @@
 * move homedirs to nurdservices (fix ownership because LDAP-users have a different UID)
 * delete local homedirs
-* mount /home from nurdservices over nfs
+* mount /home from proxmox1:/mnt/md0/homedirs over nfs (put it in /etc/fstab)
-* install [http://wiki.debian.org/LDAP/NSS#NSS_Setup_with_libnss-ldapd libnss-ldapd] and libpam-ldap (ldaps://ldap.nurdspace.nl/)
+* install [http://wiki.debian.org/LDAP/NSS#NSS_Setup_with_libnss-ldapd libnss-ldapd] and libpam-ldap (URI ldaps://ldap.nurdspace.nl/)
 * put https://www.sslcertificaten.nl/files/PositiveSSLCA2.crt in /etc/ssl/certs/ with permissions 644
 * in nslcd.conf set the following:
@@ Line 55: / Line 47: @@
 = To do=
-* Read http://www.openldap.org/doc/admin24/slapdconf2.html
+* <s>Read http://www.openldap.org/doc/admin24/slapdconf2.html</s>
 * <s>FTPd</s> nevermind
 * <s>Samba</s> nevermind
-* <s>Cert installed for ldap.nurdspace.nl. Allow access only over TLS as soon as this works (ldapsearch -v -H ldaps://ldap.nurdspace.nl/ -D uid=fwd,ou=people,dc=nurdspace,dc=lan -W -b dc=nurdspace,dc=lan) => basically this works, except I don't know what to set for olcTLSCipherSuite.</s>
+* <s>Cert installed for ldap.nurdspace.nl. Allow access only over TLS as soon as this works (ldapsearch -v -H ldaps://ldap.nurdspace.nl/ -D uid=fwd,ou=people,dc=nurdspace,dc=lan -W -b dc=nurdspace,dc=lan)</s>
 * <s>Fix "nurdservices slapd[32524]: <= bdb_equality_candidates: (uid) not indexed" errors in /var/log/syslog</s>
-* <s>Connect machines to LDAP over ldap<b>s</b> instead of ldap.</s> done for tankstation, printer-desktop, vjdeb and sinterklaas
+* <s>Connect machines to LDAP over ldap<b>s</b> instead of ldap.</s>
+* <s>Disable non-SSL ldap</s>
+* <s>Migrate all local users on [[Infra]] machines to LDAP</s>
+* <s>Migrate all homedirs to [[Proxmox1]]</s>
+* <s>Maintain sudo'ers only through the LDAP and</s> disable local root accounts (backdoor in case of emergency?)
+* <s>Disable all relevant services on Nurdserver v1</s>
 * Exclude weak ciphers from olcTLSCipherSuite in cn=config
 * Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
-* <s>Migrate all local users on [[Infra]] machines to LDAP</s>
-* Migrate all homedirs to [[NURDServices]] (moving to [[Proxmox1]]
 * Migrate [[wiki]] users and merge them with other users
 * Use LDAP as userdb back-end for [[wiki]] ([http://ryandlane.com/wprdl/2009/03/23/using-the-ldap-authentication-plugin-for-mediawiki-the-basics-part-1/ like so])
 * Add all relevant fields of Wiki users to LDAP profiles
 * Maintain [http://nurdspace.nl/Category:Members Members] page from LDAP ([http://www.mediawiki.org/wiki/Extension:External_Data#.23get_ldap_data_-_retrieve_data_from_LDAP_directory Like so], but this has limitations. Maybe only members details pages?)
-* Maintain sudo'ers only through the LDAP and disable local root accounts (backdoor in case of emergency?)
-* Disable all relevant services on Nurdserver v1