LDAP: Difference between revisions

From NURDspace
mNo edit summary
Line 8: Line 8:
For use with [[Spacenet]] we've installed OpenLDAP on [[NURDServer]]. On the new [[NURDServices]] we're going serious with LDAP.
For use with [[Spacenet]] we've installed OpenLDAP on [[NURDServer]]. On the new [[NURDServices]] we're going serious with LDAP.


= Connected machines =
= Status =
Slapd and [http://fusiondirectory.org FusionDirectory] are running on [[NURDServices]]. FusionDirectory can be accessed on https://ldap.nurdspace.nl.
 
= Connected machines and services =
* [[Hp_dc5800_sinterklaas|Sinterklaas]]
* [[Hp_dc5800_sinterklaas|Sinterklaas]]
* [[Dell_Optiplex_GX270|Vjdeb]]
* [[Dell_Optiplex_GX270|Vjdeb]]
* [[PrinterPC]]
* [[PrinterPC]]
* [[NURDServices]]
* [[NURDServices]] (only users in group "admins" can log in)
* [[Proxmox1]] (for fixing homedir ownership, only users in group "admins" can actually log in)
* [[Proxmox1]] (for fixing homedir ownership, only users in group "admins" can actually log in)
* [[Tankstation]]
* [[Tankstation]]
* [[Sun_Ultra_1|plankton]]
* [[Sun_Ultra_1|plankton]]
* [[Spacenet]]
* [[Wiki]]


= Status =
== Workstations ==
Slapd and [http://fusiondirectory.org FusionDirectory] are running on [[NURDServices]]. FusionDirectory can be accessed on https://ldap.nurdspace.nl.
 
The workstations listed above are set up as follows:
The workstations listed above are set up as follows:
* Homedirs mounted over NFS from [[Proxmox1]] (except user 'printer' on [[PrinterPC]])
* Homedirs mounted over NFS from [[Proxmox1]] (except user 'printer' on [[PrinterPC]])
Line 25: Line 28:
* Homedirs are created on the NFS-export when adding a user to LDAP ([http://documentation.fusiondirectory.org/en/documentation_faq/command_after like this])
* Homedirs are created on the NFS-export when adding a user to LDAP ([http://documentation.fusiondirectory.org/en/documentation_faq/command_after like this])


= Setting up other workstations in this way =
=== Setting up other workstations in this way ===
To get this to work you need to:
To get this to work you need to:
* create all local users in LDAP (if they don't exist already)
* create all local users in LDAP (if they don't exist already)
Line 32: Line 35:
* delete local homedirs
* delete local homedirs
* mount /home from proxmox1:/mnt/md0/homedirs over nfs (put it in /etc/fstab)
* mount /home from proxmox1:/mnt/md0/homedirs over nfs (put it in /etc/fstab)
* put https://www.sslcertificaten.nl/files/PositiveSSLCA2.crt in /etc/ssl/certs/ with permissions 644
* install [http://wiki.debian.org/LDAP/NSS#NSS_Setup_with_libnss-ldapd libnss-ldapd] and libpam-ldap (URI ldaps://ldap.nurdspace.nl/)
* install [http://wiki.debian.org/LDAP/NSS#NSS_Setup_with_libnss-ldapd libnss-ldapd] and libpam-ldap (URI ldaps://ldap.nurdspace.nl/)
* put https://www.sslcertificaten.nl/files/PositiveSSLCA2.crt in /etc/ssl/certs/ with permissions 644
* the installation of libnss-ldap and libpam-ldap don't offer all required settings, so fix nslcd.conf and pam_ldap.conf to mention at least the following:
* in nslcd.conf set the following:
  uri ldaps://ldap.nurdspace.nl/
  uri ldaps://ldap.nurdspace.nl/
  base dc=nurdspace,dc=lan
  base dc=nurdspace,dc=lan
Line 43: Line 46:
  tls_cacertfile /etc/ssl/certs/PositiveSSLCA2.crt
  tls_cacertfile /etc/ssl/certs/PositiveSSLCA2.crt
* restart nslcd
* restart nslcd
* this information should also be used for pam_ldap.conf
* sudo might not work until you type 'id' which is [http://wiki.debian.org/LDAP/PAM kind of a mystery]
* sudo might not work until you type 'id' which is [http://wiki.debian.org/LDAP/PAM kind of a mystery]


Also useful: http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian#NSS_configuration
Useful reading: http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian


In certain cases sudo can break. This can be fixed with [http://osdir.com/ml/general/2013-01/msg44182.html a patch] while it's not fixed properly.
In certain cases sudo can break. This can be fixed with [http://osdir.com/ml/general/2013-01/msg44182.html a patch] while it's not fixed properly.
== Wiki ==
* Port 636 (ldaps) is [[Cisco800series#Port_forwarding_howto|forwarded]] to [[NURDServices]] for usage by the [[Wiki]].
* [http://www.mediawiki.org/wiki/Extension:LDAP_Authentication] is installed on the Wiki
* Users in the group 'wikiusers' can log in. Admins, bureaucrats and sysops are locally managed.
* Full addition to LocalSettings.php:
#LDAP Auth
require_once( "$IP/extensions/LdapAuthentication/LdapAuthentication.php" );
$wgAuth = new LdapAuthenticationPlugin();
$wgLDAPDebug = 9;
$wgDebugLogGroups['ldap'] = '/tmp/debug.log';
$wgLDAPDomainNames = array( 'nurdspace.lan', );
$wgLDAPServerNames = array( 'nurdspace.lan' => 'ldap.nurdspace.nl', );
$wgLDAPUseLocal = false;
$wgLDAPEncryptionType = array( 'nurdspace.lan' => 'ssl', );
$wgLDAPSearchStrings = array( 'nurdspace.lan' => 'uid=USER-NAME,ou=people,dc=nurdspace,dc=lan', );
$wgLDAPLowerCaseUsername = array( 'nurdspace.lan' => true );
$wgLDAPRequiredGroups = array( 'nurdspace.lan' => array( 'cn=wikiusers,ou=groups,dc=nurdspace,dc=lan', ) );
$wgLDAPGroupUseFullDN = array( "nurdspace.lan"=>false );
$wgLDAPGroupObjectclass = array( "nurdspace.lan"=>"posixGroup" );
$wgLDAPGroupAttribute = array( "nurdspace.lan"=>"memberUid" );
$wgLDAPGroupSearchNestedGroups = array( "nurdspace.lan"=>false );
$wgLDAPGroupNameAttribute = array( "nurdspace.lan"=>"cn" );
$wgLDAPBaseDNs = array( "nurdspace.lan"=>"dc=nurdspace,dc=lan" );
$wgLDAPUseLDAPGroups = array( "nurdspace.lan"=>true );
$wgGroupPermissions['wikiusers']['edit'] = true;
$wgGroupPermissions['admins'] = $wgGroupPermissions['sysop'];
# This hook is called by the LdapAuthentication plugin. It is a configuration hook. Here we
# are specifying what attibute we want to use for a username in the wiki.
# Note that this hook is NOT called on a straight bind.
# The hook calls the function defined below.
$wgHooks['SetUsernameAttributeFromLDAP'][] = 'SetUsernameAttribute';
Some settings might not be necessary, such as the wgGroupPermissions and wgHooks. I'll do some experimenting to see if it can be cleaned up.
=== Limitations ===
* The mediawiki login system converts the first character of usernames to uppercase due to [http://en.wikipedia.org/wiki/Wikipedia:Naming_conventions_(technical_restrictions)#Restrictions_on_usernames restrictions on usernames]. To get around this we've enabled [http://www.mediawiki.org/wiki/Extension:LDAP_Authentication/Changelog#v2.0a $wgLDAPLowercaseUsernameScheme]. This requires usernames to be all lowercase in the LDAP.
== Wifi ==
The LDAP serves as a userdb for [[Spacenet]], which is connected via FreeRADIUS. For full details see the [[Spacenet]]-page.


= To do=
= To do=

Revision as of 00:14, 4 June 2013

NURDspace Project
link=File:{{{Name}}}.jpg
Participants Fwd
Skills
Status
Niche
Purpose
Tool
Location
Cost
Tool category

{{{Name}}}Property "Tool Name" (as page type) with input value "{{{Name}}}" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process. Property "Tool Image" (as page type) with input value "File:{{{Picture}}}" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process. {{{Picture}}} {{#if:{{{Tool}}} | [[Tool Owner::{{{ProjectParticipants}}} | }} {{#if:{{{Tool}}} | [[Tool Cost::{{{Cost}}} | }}


For use with Spacenet we've installed OpenLDAP on NURDServer. On the new NURDServices we're going serious with LDAP.

Status

Slapd and FusionDirectory are running on NURDServices. FusionDirectory can be accessed on https://ldap.nurdspace.nl.

Connected machines and services

Workstations

The workstations listed above are set up as follows:

  • Homedirs mounted over NFS from Proxmox1 (except user 'printer' on PrinterPC)
  • Users in the LDAP 'sudo' group can sudo.
  • Homedirs are created on the NFS-export when adding a user to LDAP (like this)

Setting up other workstations in this way

To get this to work you need to:

  • create all local users in LDAP (if they don't exist already)
  • delete local users (optional)
  • move homedirs to nurdservices (fix ownership because LDAP-users have a different UID)
  • delete local homedirs
  • mount /home from proxmox1:/mnt/md0/homedirs over nfs (put it in /etc/fstab)
  • put https://www.sslcertificaten.nl/files/PositiveSSLCA2.crt in /etc/ssl/certs/ with permissions 644
  • install libnss-ldapd and libpam-ldap (URI ldaps://ldap.nurdspace.nl/)
  • the installation of libnss-ldap and libpam-ldap don't offer all required settings, so fix nslcd.conf and pam_ldap.conf to mention at least the following:
uri ldaps://ldap.nurdspace.nl/
base dc=nurdspace,dc=lan
binddn cn=read-user,ou=systems,dc=nurdspace,dc=lan
bindpw (obtain from other machine)
ssl on
tls_reqcert demand
tls_cacertfile /etc/ssl/certs/PositiveSSLCA2.crt

Useful reading: http://www.debian-administration.org/article/OpenLDAP_installation_on_Debian

In certain cases sudo can break. This can be fixed with a patch while it's not fixed properly.

Wiki

  • Port 636 (ldaps) is forwarded to NURDServices for usage by the Wiki.
  • [1] is installed on the Wiki
  • Users in the group 'wikiusers' can log in. Admins, bureaucrats and sysops are locally managed.
  • Full addition to LocalSettings.php:
#LDAP Auth
require_once( "$IP/extensions/LdapAuthentication/LdapAuthentication.php" );
$wgAuth = new LdapAuthenticationPlugin();
$wgLDAPDebug = 9;
$wgDebugLogGroups['ldap'] = '/tmp/debug.log';

$wgLDAPDomainNames = array( 'nurdspace.lan', );
$wgLDAPServerNames = array( 'nurdspace.lan' => 'ldap.nurdspace.nl', );
$wgLDAPUseLocal = false;
$wgLDAPEncryptionType = array( 'nurdspace.lan' => 'ssl', );
$wgLDAPSearchStrings = array( 'nurdspace.lan' => 'uid=USER-NAME,ou=people,dc=nurdspace,dc=lan', );
$wgLDAPLowerCaseUsername = array( 'nurdspace.lan' => true );
$wgLDAPRequiredGroups = array( 'nurdspace.lan' => array( 'cn=wikiusers,ou=groups,dc=nurdspace,dc=lan', ) );
$wgLDAPGroupUseFullDN = array( "nurdspace.lan"=>false );
$wgLDAPGroupObjectclass = array( "nurdspace.lan"=>"posixGroup" );
$wgLDAPGroupAttribute = array( "nurdspace.lan"=>"memberUid" );
$wgLDAPGroupSearchNestedGroups = array( "nurdspace.lan"=>false );
$wgLDAPGroupNameAttribute = array( "nurdspace.lan"=>"cn" );
$wgLDAPBaseDNs = array( "nurdspace.lan"=>"dc=nurdspace,dc=lan" );
$wgLDAPUseLDAPGroups = array( "nurdspace.lan"=>true );
$wgGroupPermissions['wikiusers']['edit'] = true;
$wgGroupPermissions['admins'] = $wgGroupPermissions['sysop'];

# This hook is called by the LdapAuthentication plugin. It is a configuration hook. Here we
# are specifying what attibute we want to use for a username in the wiki.
# Note that this hook is NOT called on a straight bind.
# The hook calls the function defined below.
$wgHooks['SetUsernameAttributeFromLDAP'][] = 'SetUsernameAttribute';

Some settings might not be necessary, such as the wgGroupPermissions and wgHooks. I'll do some experimenting to see if it can be cleaned up.

Limitations

Wifi

The LDAP serves as a userdb for Spacenet, which is connected via FreeRADIUS. For full details see the Spacenet-page.

To do

  • Read http://www.openldap.org/doc/admin24/slapdconf2.html
  • FTPd nevermind
  • Samba nevermind
  • Cert installed for ldap.nurdspace.nl. Allow access only over TLS as soon as this works (ldapsearch -v -H ldaps://ldap.nurdspace.nl/ -D uid=fwd,ou=people,dc=nurdspace,dc=lan -W -b dc=nurdspace,dc=lan)
  • Fix "nurdservices slapd[32524]: <= bdb_equality_candidates: (uid) not indexed" errors in /var/log/syslog
  • Connect machines to LDAP over ldaps instead of ldap.
  • Disable non-SSL ldap
  • Migrate all local users on Infra machines to LDAP
  • Migrate all homedirs to Proxmox1
  • Maintain sudo'ers only through the LDAP and disable local root accounts (backdoor in case of emergency?)
  • Disable all relevant services on Nurdserver v1
  • Upgrade FusionDirectory from 1.0.4 to 1.0.5
  • Add all relevant fields of Wiki users to LDAP profiles (this will require Schema extending the schema) we shouldn't want this
  • Exclude weak ciphers from olcTLSCipherSuite in cn=config
  • Setting "change password on first login" in FusionDirectory doesn't get enforced through PAM
  • Create group 'wikiusers' in LDAP
  • Add already existing LDAP users to 'wikiusers' group
  • Upgrade FusionDirectory from 1.0.5 to 1.0.6
  • Set up VM to test the intended set-up (done on 192.168.1.223) -> Wiki_test_VM
  • Merge all unwanted users to user 'history' (running into a bug with some users)
  • Inform wiki users that will be renamed
  • Migrate/merge wiki users to LDAP
  • Create necessary wiki groups (bureaucrats, admins, other?) -> authorization is done in the wiki
  • Use LDAP as userdb back-end for wiki (like so)
  • Maintain Members page from LDAP (Like so, but this only displays 1 entry. Could be fixed like so.)