Zentrale Benutzerverwaltung mit OpenLDAP und SSS: Unterschied zwischen den Versionen

Aus Xinux Wiki
Zur Navigation springen Zur Suche springen
 
(20 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt)
Zeile 31: Zeile 31:
 
<pre>
 
<pre>
 
BASE    dc=it213,dc=int
 
BASE    dc=it213,dc=int
−
URI    ldap://localhost
+
URI    ldap://ldap.it213.int
 
ldap_version    3
 
ldap_version    3
 
</pre>
 
</pre>
Zeile 64: Zeile 64:
  
 
= Benutzer und Gruppen =
 
= Benutzer und Gruppen =
−
* apt install ldapscripts
+
* apt install -y ldapscripts
  
 
== Konfiguration ==
 
== Konfiguration ==
Zeile 73: Zeile 73:
 
GSUFFIX="ou=groups"
 
GSUFFIX="ou=groups"
 
USUFFIX="ou=users"
 
USUFFIX="ou=users"
 +
MSUFFIX="ou=hosts"
 
BINDDN="cn=admin,dc=it213,dc=int"
 
BINDDN="cn=admin,dc=it213,dc=int"
 +
USHELL="/bin/bash"
 +
UHOMES="/home/%u"
 +
CREATEHOMES="yes"
 +
HOMESKEL="/etc/skel"
 
BINDPWDFILE="/etc/ldapscripts/ldapscripts.passwd"
 
BINDPWDFILE="/etc/ldapscripts/ldapscripts.passwd"
−
UIDSTART="10000"
+
GIDSTART="10000" # Group ID
−
GIDSTART="10000"
+
UIDSTART="10000" # User ID
 +
MIDSTART="20000" # Machine ID
 +
GCLASS="posixGroup"  # Leave "posixGroup" here if not sure !
 +
PASSWORDGEN="pwgen"
 +
RECORDPASSWORDS="no"
 +
PASSWORDFILE="/var/log/ldapscripts_passwd.log"
 +
LOGTOFILE="yes"
 +
LOGFILE="/var/log/ldapscripts.log"
 +
LOGTOSYSLOG="no"
 +
SYSLOGFACILITY="local4"
 +
SYSLOGLEVEL="info"
 +
LDAPSEARCHBIN="/usr/bin/ldapsearch"
 +
LDAPADDBIN="/usr/bin/ldapadd"
 +
LDAPDELETEBIN="/usr/bin/ldapdelete"
 +
LDAPMODIFYBIN="/usr/bin/ldapmodify"
 +
LDAPMODRDNBIN="/usr/bin/ldapmodrdn"
 +
LDAPPASSWDBIN="/usr/bin/ldappasswd"
 +
LDAPSEARCHOPTS="-o ldif-wrap=no"
 +
GETENTPWCMD=""
 +
GETENTGRCMD=""
 +
GTEMPLATE=""
 +
UTEMPLATE=""
 +
MTEMPLATE=""
 
</pre>
 
</pre>
  
Zeile 105: Zeile 132:
 
<pre>
 
<pre>
 
[sssd]
 
[sssd]
 +
config_file_version = 2
 
services = nss, pam, sudo
 
services = nss, pam, sudo
 
domains = it213.int
 
domains = it213.int
Zeile 112: Zeile 140:
 
auth_provider = ldap
 
auth_provider = ldap
 
access_provider = permit
 
access_provider = permit
−
 
 
sudo_provider = ldap
 
sudo_provider = ldap
−
 
 
ldap_uri = ldap://ldap.it213.int
 
ldap_uri = ldap://ldap.it213.int
 
ldap_search_base = dc=it213,dc=int
 
ldap_search_base = dc=it213,dc=int
 
ldap_sudo_search_base = ou=sudo,dc=it213,dc=int
 
ldap_sudo_search_base = ou=sudo,dc=it213,dc=int
−
 
−
cache_credentials = True
 
 
ldap_id_use_start_tls = false
 
ldap_id_use_start_tls = false
 +
ldap_auth_disable_tls_never_use_in_production = true
 
ldap_tls_reqcert = never
 
ldap_tls_reqcert = never
 
</pre>
 
</pre>
 +
;[[Erklärungen sssd-1]]
  
 
* chmod 600 /etc/sssd/sssd.conf
 
* chmod 600 /etc/sssd/sssd.conf
Zeile 128: Zeile 154:
  
 
== NSS ==
 
== NSS ==
−
* sed -i 's/^sudoers:.*/sudoers: files sss/' /etc/nsswitch.conf
+
;Nur Kontrolle
 +
*cat /etc/nsswitch.conf  
 +
<pre>
  
−
== PAM ==
+
passwd:        files systemd sss
−
* pam-auth-update --enable sss mkhomedir
+
group:          files systemd sss
 +
shadow:        files systemd sss
 +
gshadow:        files systemd
  
−
= Sudo (LDAP) =
+
hosts:          files dns
 +
networks:      files
  
−
== Schema erweitern ==
+
protocols:     db files
−
; falls sudoRole noch nicht existiert
+
services:       db files sss
−
* cat <<EOF > /root/sudo-schema-fix.ldif
+
ethers:         db files
−
<pre>
+
rpc:           db files
−
dn: cn={4}sudo,cn=schema,cn=config
 
−
changetype: modify
 
−
add: olcAttributeTypes
 
−
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.1 NAME 'sudoUser' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
 
−
-
 
−
add: olcAttributeTypes
 
−
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.2 NAME 'sudoHost' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
 
−
-
 
−
add: olcAttributeTypes
 
−
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.3 NAME 'sudoCommand' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
 
−
-
 
−
add: olcAttributeTypes
 
−
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.4 NAME 'sudoRunAsUser' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
 
−
-
 
−
add: olcAttributeTypes
 
−
olcAttributeTypes: ( 1.3.6.1.4.1.15953.9.1.5 NAME 'sudoRunAsGroup' EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
 
−
-
 
−
add: olcObjectClasses
 
−
olcObjectClasses: ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL MUST cn MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAsUser $ sudoRunAsGroup ) )
 
−
</pre>
 
−
EOF
 
  
−
* ldapmodify -Y EXTERNAL -H ldapi:/// -f /root/sudo-schema-fix.ldif
+
netgroup:       nis sss
−
 
+
sudoers: files  sss
−
== Sudo Regel ==
+
automount: sss
−
* cat <<EOF > /root/sudo.ldif
 
−
<pre>
 
−
dn: cn=sudo,ou=sudo,dc=it213,dc=int
 
−
objectClass: top
 
−
objectClass: sudoRole
 
−
cn: sudo
 
−
sudoUser: %sudo
 
−
sudoHost: ALL
 
−
sudoRunAsUser: ALL
 
−
sudoRunAsGroup: ALL
 
−
sudoCommand: ALL
 
 
</pre>
 
</pre>
−
EOF
 
  
−
* ldapadd -xD cn=admin,dc=it213,dc=int -w 123Start$ -f /root/sudo.ldif
+
== PAM ==
−
 
+
* pam-auth-update --enable sss mkhomedir
−
== Cache leeren ==
 
−
* sss_cache -E
 
−
* systemctl restart sssd
 
−
 
 
−
== Test ==
 
−
* su - thomas
 
−
* sudo -l
 
−
* sudo whoami
 

Aktuelle Version vom 2. April 2026, 10:55 Uhr

Installation

passwort nach wahl festlegen
  • apt update
  • DEBIAN_FRONTEND=noninteractive apt install -y slapd ldap-utils

Grundkonfiguration

  • dpkg-reconfigure slapd
Debconf Question Recommended Input
Omit OpenLDAP server configuration? No
DNS domain name: it213.int
Organization name: it213
Administrator password: 123Start$
Database backend to use: MDB
Remove database when slapd is purged? No
Move old database? Yes
Allow LDAPv2 protocol? No

ldap.conf setzen

  • vim /etc/ldap/ldap.conf
BASE    dc=it213,dc=int
URI     ldap://ldap.it213.int
ldap_version    3

Kontrolle

  • ldapsearch -x -LLL

Grundstruktur

Erstellen

  • cat <<EOF > /root/struktur.ldif
dn: ou=users,dc=it213,dc=int
objectClass: organizationalUnit
ou: users

dn: ou=groups,dc=it213,dc=int
objectClass: organizationalUnit
ou: groups

dn: ou=hosts,dc=it213,dc=int
objectClass: organizationalUnit
ou: hosts

dn: ou=sudo,dc=it213,dc=int
objectClass: organizationalUnit
ou: sudo

EOF

Anlegen

  • ldapadd -xD cn=admin,dc=it213,dc=int -w 123Start$ -f /root/struktur.ldif

Benutzer und Gruppen

  • apt install -y ldapscripts

Konfiguration

  • vim /etc/ldapscripts/ldapscripts.conf
SERVER="ldap://ldap.it213.int"
SUFFIX="dc=it213,dc=int"
GSUFFIX="ou=groups"
USUFFIX="ou=users"
MSUFFIX="ou=hosts"
BINDDN="cn=admin,dc=it213,dc=int"
USHELL="/bin/bash"
UHOMES="/home/%u"
CREATEHOMES="yes"
HOMESKEL="/etc/skel"
BINDPWDFILE="/etc/ldapscripts/ldapscripts.passwd"
GIDSTART="10000" # Group ID
UIDSTART="10000" # User ID
MIDSTART="20000" # Machine ID
GCLASS="posixGroup"   # Leave "posixGroup" here if not sure !
PASSWORDGEN="pwgen"
RECORDPASSWORDS="no"
PASSWORDFILE="/var/log/ldapscripts_passwd.log"
LOGTOFILE="yes"
LOGFILE="/var/log/ldapscripts.log"
LOGTOSYSLOG="no"
SYSLOGFACILITY="local4"
SYSLOGLEVEL="info"
LDAPSEARCHBIN="/usr/bin/ldapsearch"
LDAPADDBIN="/usr/bin/ldapadd"
LDAPDELETEBIN="/usr/bin/ldapdelete"
LDAPMODIFYBIN="/usr/bin/ldapmodify"
LDAPMODRDNBIN="/usr/bin/ldapmodrdn"
LDAPPASSWDBIN="/usr/bin/ldappasswd"
LDAPSEARCHOPTS="-o ldif-wrap=no"
GETENTPWCMD=""
GETENTGRCMD=""
GTEMPLATE=""
UTEMPLATE=""
MTEMPLATE=""
  • echo -n "123Start$" > /etc/ldapscripts/ldapscripts.passwd
  • chmod 600 /etc/ldapscripts/ldapscripts.passwd

Gruppen

  • ldapaddgroup it
  • ldapaddgroup sudo

Benutzer

  • ldapadduser thomas it
  • ldapadduser tina it

Passwort

  • ldapsetpasswd thomas
  • ldapsetpasswd tina

Gruppe zuweisen

  • ldapaddusertogroup thomas sudo
  • ldapaddusertogroup tina sudo

SSSD Anbindung

  • apt install sssd libnss-sss libpam-sss libsss-sudo

Konfiguration

  • vim /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
services = nss, pam, sudo
domains = it213.int

[domain/it213.int]
id_provider = ldap
auth_provider = ldap
access_provider = permit
sudo_provider = ldap
ldap_uri = ldap://ldap.it213.int
ldap_search_base = dc=it213,dc=int
ldap_sudo_search_base = ou=sudo,dc=it213,dc=int
ldap_id_use_start_tls = false
ldap_auth_disable_tls_never_use_in_production = true
ldap_tls_reqcert = never
Erklärungen sssd-1
  • chmod 600 /etc/sssd/sssd.conf
  • systemctl restart sssd

NSS

Nur Kontrolle
  • cat /etc/nsswitch.conf

passwd:         files systemd sss
group:          files systemd sss
shadow:         files systemd sss
gshadow:        files systemd

hosts:          files dns
networks:       files

protocols:      db files
services:       db files sss
ethers:         db files
rpc:            db files

netgroup:       nis sss
sudoers: files  sss
automount:  sss

PAM

  • pam-auth-update --enable sss mkhomedir
Abgerufen von „http://wiki.ixheim.de/index.php?title=Zentrale_Benutzerverwaltung_mit_OpenLDAP_und_SSS&oldid=68348“