LDAP
Jump to navigation
Jump to search
For use with Spacenet we've installed OpenLDAP on NURDServer. On the new Nurdserver v2 we're going serious with LDAP.
Working implementations on Nurdserver v1 (nurdserver)
- Samba on NURDServer
- vsFTPd on NURDServer
Working implementations on Nurdserver v2 (nurdservices)
- NFS export for homedirs
- Spacenet
Connected workstations
Status
FusionDirectory is running on NURDServices on the Proxmox2. Most users are migrated.
It can be accessed on [1].
On Sinterklaas, Vjdeb and the PrinterPC I've got it to work as I think it should be for the local users that existed:
- Homedirs moved to nfs mount from NURDServices (soon to be migrated to Proxmox1)
- Local homedirs and users deleted (except user 'printer' on PrinterPC)
- /home/ is mounted over nfs on boot
- LDAP users can log in and see their homedirs as if nothing has changed
- Users in the LDAP 'sudo' group can sudo on connected workstations.
- Homedir is created on NFS-export when adding a user to LDAP (like this)
Setting up other workstations in this way
To get this to work you need to:
- create all local users in LDAP (if they don't exist already)
- delete local users (optional)
- move homedirs to nurdservices (fix ownership because LDAP-users have a different UID)
- delete local homedirs
- mount /home from nurdservices over nfs
- install libnss-ldapd and libpam-ldap (ldaps://ldap.nurdspace.nl/)
- put https://www.sslcertificaten.nl/files/PositiveSSLCA2.crt in /etc/ssl/certs/ with permissions 644
- in nslcd.conf set the following:
uri ldaps://ldap.nurdspace.nl/ base dc=nurdspace,dc=lan binddn cn=read-user,ou=systems,dc=nurdspace,dc=lan bindpw (obtain from other machine) ssl on tls_reqcert demand tls_cacertfile /etc/ssl/certs/PositiveSSLCA2.crt
- restart nslcd
- this information should also be used for pam_ldap.conf
- sudo might not work until you type 'id' which is kind of a mystery
Also useful: http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian#NSS_configuration
In certain cases sudo can break. This can be fixed with a patch as long as it's not fixed properly.
To do
- Read http://www.openldap.org/doc/admin24/slapdconf2.html
FTPdnevermindSambanevermindCert installed for ldap.nurdspace.nl. Allow access only over TLS as soon as this works (ldapsearch -v -H ldaps://ldap.nurdspace.nl/ -D uid=fwd,ou=people,dc=nurdspace,dc=lan -W -b dc=nurdspace,dc=lan) => basically this works, except I don't know what to set for olcTLSCipherSuite.Fix "nurdservices slapd[32524]: <= bdb_equality_candidates: (uid) not indexed" errors in /var/log/syslog- Connect machines to LDAP over ldaps instead of ldap.
- Exclude weak ciphers from olcTLSCipherSuite in cn=config
- Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
Migrate all local users on Infra machines to LDAP- Migrate all homedirs to NURDServices (moving to Proxmox1
- Migrate wiki users and merge them with other users
- Use LDAP as userdb back-end for wiki (like so)
- Add all relevant fields of Wiki users to LDAP profiles
- Maintain Members page from LDAP (Like so, but this has limitations. Maybe only members details pages?)
- Maintain sudo'ers only through the LDAP and disable local root accounts (backdoor in case of emergency?)
- Disable all relevant services on Nurdserver v1