Openldap-linux-pam-nss: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
(→Sudo) |
|||
| (10 dazwischenliegende Versionen von 2 Benutzern werden nicht angezeigt) | |||
| Zeile 73: | Zeile 73: | ||
=Ldapscripts= | =Ldapscripts= | ||
==Installation== | ==Installation== | ||
| − | *apt install ldapscripts | + | *apt install ldapscripts libnss-ldapd libpam-ldapd nslcd |
| + | |||
==Konfiguration== | ==Konfiguration== | ||
===Hauptkonfiguration=== | ===Hauptkonfiguration=== | ||
*cat /etc/ldapscripts/ldapscripts.conf | *cat /etc/ldapscripts/ldapscripts.conf | ||
<pre> | <pre> | ||
| + | SERVER="ldap://ldap.it21.int" | ||
SUFFIX="dc=it21,dc=int" | SUFFIX="dc=it21,dc=int" | ||
GSUFFIX="ou=groups" | GSUFFIX="ou=groups" | ||
| Zeile 113: | Zeile 115: | ||
MTEMPLATE="" | MTEMPLATE="" | ||
</pre> | </pre> | ||
| + | |||
===Password Datei=== | ===Password Datei=== | ||
*echo -n "123Start$" > /etc/ldapscripts/ldapscripts.passwd | *echo -n "123Start$" > /etc/ldapscripts/ldapscripts.passwd | ||
| Zeile 131: | Zeile 134: | ||
*[[Zusammenspiel von PAM und NSS]] | *[[Zusammenspiel von PAM und NSS]] | ||
==Installation== | ==Installation== | ||
| − | *env DEBIAN_FRONTEND=noninteractive apt install -yqq libnss-ldap libpam-ldap | + | *env DEBIAN_FRONTEND=noninteractive apt install -yqq libnss-ldap libpam-ldap nslcd |
| − | ;Wir konfigurieren von Hand | + | ;Wir konfigurieren von Hand |
| + | |||
| + | ==ldap.conf== | ||
| + | *cat /etc/ldap/ldap.conf | ||
| + | base dc=it21, dc=int | ||
| + | uri ldap://server.it21.int | ||
| + | ldap_version 3 | ||
| + | rootbinddn cn=admin, dc=it21, dc=int | ||
| + | pam_password md5 | ||
| + | ==Passwort für den Adminzugang eintragen== | ||
| + | *echo 123Start$ > /etc/ldap.secret | ||
==Wir benutzen nur eine Konfigurationdatei== | ==Wir benutzen nur eine Konfigurationdatei== | ||
*ln -fs /etc/ldap/ldap.conf /etc/libnss-ldap.conf | *ln -fs /etc/ldap/ldap.conf /etc/libnss-ldap.conf | ||
*ln -fs /etc/ldap/ldap.conf /etc/pam_ldap.conf | *ln -fs /etc/ldap/ldap.conf /etc/pam_ldap.conf | ||
| + | ==nslcd.conf== | ||
| + | <pre> | ||
| + | kit@dhcp:~$ sudo cat /etc/nslcd.conf | ||
| + | # /etc/nslcd.conf | ||
| + | # nslcd configuration file. See nslcd.conf(5) | ||
| + | # for details. | ||
| + | |||
| + | # The user and group nslcd should run as. | ||
| + | uid nslcd | ||
| + | gid nslcd | ||
| + | |||
| + | # The location at which the LDAP server(s) should be reachable. | ||
| + | uri ldap://ldap.it1XX.int | ||
| + | |||
| + | # The search base that will be used for all queries. | ||
| + | base dc=it1XX,dc=int | ||
| + | </pre> | ||
| + | |||
==Nsswitch anpassen== | ==Nsswitch anpassen== | ||
*cat /etc/nsswitch.conf | *cat /etc/nsswitch.conf | ||
passwd: files ldap | passwd: files ldap | ||
group: files ldap | group: files ldap | ||
| + | shadow: files ldap | ||
| + | |||
| + | ==PAM anpassen== | ||
| + | *Muss man eigentlich nicht | ||
| + | |||
==Reboot== | ==Reboot== | ||
!!!Reboot!!! | !!!Reboot!!! | ||
| Zeile 165: | Zeile 201: | ||
netstat -lntp | grep slapd | netstat -lntp | grep slapd | ||
tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 499/slapd | tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 499/slapd | ||
| + | |||
| + | ==Sudo== | ||
| + | |||
| + | Sudo Gruppe auf dem ldap Server anlegen: | ||
| + | ldapaddgroup sudo | ||
| + | |||
| + | ldapaddusertogroup thomas sudo | ||
| + | ldapaddusertogroup tina sudo | ||
| + | |||
| + | Packete installieren: | ||
| + | * apt install sudo-ldap | ||
| + | |||
| + | |||
| + | Packete konfigurieren: | ||
| + | * visudo -f /etc/sudoers.d/ldap-sudoers | ||
| + | # LDAP sudo group | ||
| + | %sudo ALL=(ALL:ALL) ALL | ||
| + | |||
| + | * vim /etc/sudo-ldap.conf | ||
| + | sudoers_base ou=sudo,dc=it21,dc=int | ||
| + | |||
| + | Testen: | ||
| + | su - thomas | ||
| + | sudo -l | ||
| + | sudo whoami | ||
Aktuelle Version vom 30. Juli 2025, 05:48 Uhr
Installation
- passwort nach wahl festlegen
- apt install slapd ldap-utils
- slapd
- OpenLDAP Standalone Server
- ldap-utils
- Utilities zum Zugriff auf den LDAP Server
Grundkonfiguration
Weitere Konfiguration
- dpkg-reconfigure -p low slapd
Konfiguration des Clients
ldap.conf
- cat /etc/ldap/ldap.conf
base dc=it21, dc=int uri ldap://server.it21.int ldap_version 3 rootbinddn cn=admin, dc=it21, dc=int pam_password md5
Passwort für den Adminzugang eintragen
- echo 123Start$ > /etc/ldap.secret
Kontrolle
Stimmt der base dn?
- ldapsearch -x -LLL
dn: dc=it21,dc=int objectClass: top objectClass: dcObject objectClass: organization o: int21 dc: it21
Grundstruktur
Erstellen
- cat /root/struktur.ldif
dn: ou=users,dc=it21,dc=int objectClass: organizationalUnit ou: users dn: ou=groups,dc=it21,dc=int objectClass: organizationalUnit ou: groups dn: ou=hosts,dc=it21,dc=int objectClass: organizationalUnit ou: hosts
Anlegen
ldapadd -xD cn=admin,dc=it21,dc=int -w 123Start$ -f struktur.ldif
adding new entry "ou=users,dc=it21,dc=int"
adding new entry "ou=groups,dc=it21,dc=int"
adding new entry "ou=hosts,dc=it21,dc=int"
Ldapscripts
Installation
- apt install ldapscripts libnss-ldapd libpam-ldapd nslcd
Konfiguration
Hauptkonfiguration
- cat /etc/ldapscripts/ldapscripts.conf
SERVER="ldap://ldap.it21.int" SUFFIX="dc=it21,dc=int" GSUFFIX="ou=groups" USUFFIX="ou=users" MSUFFIX="ou=hosts" BINDDN="cn=admin,dc=it21,dc=int" USHELL="/bin/bash" UHOMES="/home/%u" CREATEHOMES="yes" HOMESKEL="/etc/skel" BINDPWDFILE="/etc/ldapscripts/ldapscripts.passwd" GIDSTART="10000" # Group ID UIDSTART="10000" # User ID MIDSTART="20000" # Machine ID GCLASS="posixGroup" # Leave "posixGroup" here if not sure ! PASSWORDGEN="pwgen" RECORDPASSWORDS="no" PASSWORDFILE="/var/log/ldapscripts_passwd.log" LOGTOFILE="yes" LOGFILE="/var/log/ldapscripts.log" LOGTOSYSLOG="no" SYSLOGFACILITY="local4" SYSLOGLEVEL="info" LDAPSEARCHBIN="/usr/bin/ldapsearch" LDAPADDBIN="/usr/bin/ldapadd" LDAPDELETEBIN="/usr/bin/ldapdelete" LDAPMODIFYBIN="/usr/bin/ldapmodify" LDAPMODRDNBIN="/usr/bin/ldapmodrdn" LDAPPASSWDBIN="/usr/bin/ldappasswd" LDAPSEARCHOPTS="-o ldif-wrap=no" GETENTPWCMD="" GETENTGRCMD="" GTEMPLATE="" UTEMPLATE="" MTEMPLATE=""
Password Datei
- echo -n "123Start$" > /etc/ldapscripts/ldapscripts.passwd
Managment
Struktur
![Bearbeiten](javascript:editDrawio("294588060", "it21-ldap.drawio.png", "png", false, false, false, true, "https://embed.diagrams.net")){kind=link}
![Bearbeiten](javascript:editDrawio("1128666990", "it21-2.drawio.png", "png", false, false, false, true, "https://embed.diagrams.net")){kind=link}
Gruppen anlegen
- ldapaddgroup it
Benutzer anlegen
- ldapadduser thomas it
- ldapadduser tina it
Passwörter setzen
- ldapsetpasswd thomas
- ldapsetpasswd tina
nsswitch und pam anbinden
Installation
- env DEBIAN_FRONTEND=noninteractive apt install -yqq libnss-ldap libpam-ldap nslcd
- Wir konfigurieren von Hand
ldap.conf
- cat /etc/ldap/ldap.conf
base dc=it21, dc=int uri ldap://server.it21.int ldap_version 3 rootbinddn cn=admin, dc=it21, dc=int pam_password md5
Passwort für den Adminzugang eintragen
- echo 123Start$ > /etc/ldap.secret
Wir benutzen nur eine Konfigurationdatei
- ln -fs /etc/ldap/ldap.conf /etc/libnss-ldap.conf
- ln -fs /etc/ldap/ldap.conf /etc/pam_ldap.conf
nslcd.conf
kit@dhcp:~$ sudo cat /etc/nslcd.conf # /etc/nslcd.conf # nslcd configuration file. See nslcd.conf(5) # for details. # The user and group nslcd should run as. uid nslcd gid nslcd # The location at which the LDAP server(s) should be reachable. uri ldap://ldap.it1XX.int # The search base that will be used for all queries. base dc=it1XX,dc=int
Nsswitch anpassen
- cat /etc/nsswitch.conf
passwd: files ldap group: files ldap shadow: files ldap
PAM anpassen
- Muss man eigentlich nicht
Reboot
!!!Reboot!!!
Tests
- getent group it
it:*:10000:
- getent passwd thomas
thomas:*:10000:10000:thomas:/home/thomas:/bin/bash
- getent passwd tina
tina:*:10001:10000:tina:/home/tina:/bin/bash
- su - tina
tina@server:~$
Starten des slapd
systemctl start slapd
Stoppen des slapd
systemctl stop slapd
Neustarten des slapd
systemctl restart slapd
Auf welchem Port lauscht der slapd
netstat -lntp | grep slapd tcp 0 0 0.0.0.0:389 0.0.0.0:* LISTEN 499/slapd
Sudo
Sudo Gruppe auf dem ldap Server anlegen:
ldapaddgroup sudo
ldapaddusertogroup thomas sudo ldapaddusertogroup tina sudo
Packete installieren:
- apt install sudo-ldap
Packete konfigurieren:
- visudo -f /etc/sudoers.d/ldap-sudoers
# LDAP sudo group %sudo ALL=(ALL:ALL) ALL
- vim /etc/sudo-ldap.conf
sudoers_base ou=sudo,dc=it21,dc=int
Testen:
su - thomas sudo -l sudo whoami