HOWTO: LDAP Client on 10.04 Lucid Lynx

This is essentially the same as my previous Hardy Heron LDAP howto but with some steps removed. Rather than edit the old article I thought I'd just reproduce it with the appropriate parts omitted. This howto is also relevant to Jaunty and Karmic. The LDAP Server howto can be found here.

PLATFORMS TESTED: Ubuntu 10.04 LTS (Lucid), Ubuntu 11.04 LTS (Natty)

PREREQUISITES:
* A vanilla Ubuntu 10.04 (or later) desktop or server install.
* You have shared your user home directories from an NFS server
* You have successfully installed a working LDAP server

Network overview;
* domain name: tuxnetworks.com
* Servername/IP: ldap.tuxnetworks.com 10.1.1.5
* The user "brettg" is a valid LDAP user on your server.

We are going to set up a Lucid client connected to an LDAP server. We should aready have our home directories mounted via NFS.

~$ sudo apt-get install libpam-ldap libnss-ldap nss-updatedb libnss-db nscd ldap-utils

You will again be asked a bunch of questions;

LDAP server Uniform Resource Identifier: ldap://ldap.tuxnetworks.com
Distinguished name of the search base: dc=tuxnetworks,dc=com
ldap://ldap.tuxnetworks.com 3
Make local root Database admin: Yes
Does the LDAP database require login? No
LDAP account for root: cn=admin,dc=tuxnetworks,dc=com
LDAP root password: (The server LDAP root password)


Now we need to edit the following files;

~$ sudo vi /etc/ldap.conf

and edit these lines to look like this;

bind_policy soft

pam_password crypt

Find the line that begins with uri ldapi:// . . .

Comment the line out and replace it with a line like so;

uri ldap://ldap.tuxnetworks.com/

Edit this file;

~$ sudo vi /etc/ldap/ldap.conf

Edit it to look like this;

BASE    dc=tuxnetworks,dc=com
URI     ldap://ldap.tuxnetworks.com 

SIZELIMIT       0
TIMELIMIT       0
DEREF           never

Edit nsswitch.conf

~$ sudo vi /etc/nsswitch.conf

Enter the following lines;

passwd:         files ldap
group:          files ldap
shadow:         files ldap

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

Now update nss to use ldap.

~$ sudo nss_updatedb ldap
passwd... done.
group... done.


Note:

If you get an error . . .
Failed to enumerate nameservice: No such file or directory

. . . then check that your uri line in /etc/ldap.conf is correct and the address is pingable.

You should now be able to check the server with;

~$ ldapsearch -x

That command should output a tonne of stuff from the server LDAP directory.

getent passwd

You should now be able to login to the client via ssh using the user "brettg"s credentials

brettg@jupiter:~$ ssh brettg@galileo
Welcome to Ubuntu 11.04 (GNU/Linux 2.6.38-8-generic x86_64)

 * Documentation:  https://help.ubuntu.com/

Last login: Fri Jun 24 14:13:05 2011 from 10.1.1.80
brettg@galileo:~$ 

Take a look at your passwd file to make double sure you are not logging in using local auth;

grep brettg /etc/passwd

If that returns a line then you are probably logged in using a local user. Remove that line from /etc/passwd and try again.

For Gnome Desktop users.

Assigning users to the correct groups at login, create a new file called group.conf and place the following line in it;

vi /etc/security/group.conf

gdm;*;*;Al0000-9000;floppy,audio,cdrom,video,plugdev,scanner

We also need to tell pam to use the group.conf settings;

vi /etc/pam.d/gdm 

Add this line;

auth optional pam_group.so

Reboot your PC and you should be able to login to gnome using ldap!

LDAP Client Howto (8.04 LTS)

This is where we configure our client to authenticate with our LDAP server.

PLATFORM: Ubuntu 8.04 LTS (Hardy)

We are going to set up a Hardy client on a server machine, which involves using NFS for mounting the user homes)

apt-get install libpam-ldap libnss-ldap nss-updatedb libnss-db nfs-common nscd ldap-utils

You will again be asked a bunch of questions, the answers are the same;

LDAP server Uniform Resource Identifier: ldap://ldap.example.com
Distinguished name of the search base: dc=example,dc=com
ldap://ldap.example.com 3
Make local root Database admin: Yes
Does the LDAP database require login? No
LDAP account for root: cn=admin,dc=example,dc=com
LDAP root password: password

Now we need to edit the following files;

vi /etc/ldap.conf and add this line;

bind_policy soft

vi /etc/ldap/ldap.conf

BASE    dc=example,dc=com
URI     ldap://ldap.example.com 

SIZELIMIT       0
TIMELIMIT       0
DEREF           never

vi /etc/pam.d/common-account

account    sufficient   pam_ldap.so
account    required     pam_unix.so

vi /etc/pam.d/common-auth

auth       sufficient   pam_ldap.so
auth       required     pam_unix.so nullok_secure use_first_pass

vi /etc/pam.d/common-password

password   sufficient   pam_ldap.so
password   required     pam_unix.so nullok obscure min=4 max=8 crypt

vi /etc/pam.d/common-session

session    required     pam_unix.so
session    required     pam_mkhomedir.so skel=/etc/skel/
session    optional     pam_ldap.so

vi /etc/nsswitch.conf

passwd: files ldap
group: files ldap
shadow: files ldap

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

Now update nss to use ldap.

nss_updatedb ldap

If you get an error;
Failed to enumerate nameservice: No such file or directory

Check that your uri line in /etc/ldap.conf is correct.

You should now be able to check the server with;

ldapsearch -x

getent passwd

Mount a directory for users homes using NFS.

Create a mountpoint

mkdir /home/users

Add the following to /etc/fstab

servername:/home/users       /home/users   nfs defaults 0 0

You should now be able to login via ssh using the user "fred"s credentials

For Gnome Desktop users.

Assigning users to the correct groups at login

vi /etc/security/group.conf

gdm;*;*;Al0000-9000;floppy,audio,cdrom,video,plugdev,scanner

We need to override HALs behaviourl

vi /etc/dbus-1/system.d/hal.conf

Find and remove the following lines;

<deny send_interface="org.freedesktop.Hal.Device.Volume"/>
<deny send_interface="org.freedesktop.Hal.Device.Volume.Crypto"/>

We also need to tell pam to use the group.conf settings;

vi /etc/pam.d/gdm

Add this line;

auth optional pam_group.so

Reboot your PC and you should be able to login to gnome using ldap!

HOWTO: LDAP Server on 8.04 Hardy Heron

So, I've been playing around with LDAP and I have finally got it working. There are lots of howto's out there but none of them worked for me.

NOTE: For an up to date howto for 10.04 Lucid Lynx see this article

So, here we go!

PLATFORM:
* Ubuntu Server 8.04 LTS (Hardy)

PREREQUISITES:
* Working DNS with fqdn.
* An NFS server exporting the users home directorys

Network overview;
* domain name: example.com
* ldap-server ldap.example.com

Install The Packages

apt-get install slapd ldap-utils migrationtools

For some reason the install process doesn't ask you all of the necessary questions so when it is done we must reconfigure slapd.

dpkg-reconfigure slapd

It will ask you a bunch of questions

Omit OpenLDAP server configuration? No
DNS domain name: example.com
Name of your organization: Example Corp
Admin Password: password
Confirm Password: password
Database Type: HDB
Do you want your database to be removed when slapd is purged? ... No
Move old database? ... Yes
Allow LDAPv2 Protocol? ... No

Note: During this process, I will use "password" for simplicities sake. This is fine for setting up a test network for educational purposes but if you intend to use this in production then you should obviously choose a more appropriate password.

Oh, also, make sure you DONT FORGET IT! You will need it later.

You can now check if you can access your ldap server by typing:

ldapsearch -x -b dc=example,dc=com

Installing phpldapadmin

apt-get install phpldapadmin
ln -s /usr/share/phpldapadmin/ /var/www/phpldapadmin

Increase php memory limit

vi /etc/php5/apache2/php.ini

Find this line and change the memory limit to 64M;

memory_limit = 64M ; Maximum amount of memory a script may consume (16MB)

Restart apache;

/etc/init.d/apache2 restart

You can then browse to http://ldap.example.com/phpldapadmin

and login using admin:password

Once you have logged in, expand the tree & you should see something like this;

+--> dc=example,dc=com (1)
---> cn=admin
---> Create new entry here

Lets add some users and groups;

cd /usr/share/migrationtools/

We need to create the default migrationtools' config file "migrate_common.ph"

vi migrate_common.ph

and add the following parameters:

$DEFAULT_MAIL_DOMAIN = "example.com";
$DEFAULT_BASE = "dc=example,dc=com";

Create an ldif file with the details for our ou entries

vi ~/usergroup.ldif

dn: ou=users, dc=example, dc=com
ou: users
objectclass: organizationalUnit

dn: ou=groups, dc=example, dc=com
ou: groups
objectclass: organizationalUnit

Note: If you cut and paste from this guide, ensure that there are no whitespace chars at the end of the file.

Now that the user and group info is saved in your file, we can add it to the ldap server

ldapadd -x -W -D "cn=admin,dc=example,dc=com" -f ~/usergroup.ldif

Possible errors;
ldap_add: Invalid syntax (21)
additional info: objectclass: value #0 invalid per syntax

Probable cause;
If you copy/pasted the above then check for whitespace at the end of the users_group.ldif file. You will also need to remove the first entry (ou=users stanza) if it has already gone through before or you will get "already exists" and the script will halt before reaching the second entry

ldap_add: Server is unwilling to perform (53)
additional info: no global superior knowledge

Probable cause;
You have used incorrect domain details. Make sure the uri setting in /etc/ldap.conf is correct and that the server is pingable.

Now, if you hit "refresh" in the phpldapadmin gui, you should see your Users and Groups ou's are there.

Of course you could have added those ou's using the clickety-clickety gui as well but I just wanted to show how stuff can be added via command line. Yes, yes, I know, I'm a cruel bastard.

So now we want to add a new test user to the ldap tree using the phpldapadmin gui, but first we need to create a group called "users" in the Groups ou.

Click on the Groups ou and click "Create a child entry". Select "Posix Group".

Call the group "users" with Group ID 100. Click "Save Changes" when done.

Next, create a user in the Users ou with the following details;

User: fred
Group: users
Password: password
Encryption: crypt

Note: When I do this, the drop down box does not list /bin/bash as an option for loginShell. If you click "Save" you get a second screen where it is possible to alter the loginShell parameter to use /bin/bash. This is less of an issue if your users just use GDM. I use crypt instead of md5. You can use md5 if you prefer but remember to change the encryption type when setting up client hosts to match.

Well, assuming everything is working up to this point, the server is ready to authenticate your users.

Let's go on and set up a client on Hardy or Lucid