Ldap system administration

About the instructor Ali abdo Current positions Technical support manager (Gawab.com). Technical consultant (anhri.net, hoqook.com, ujcenter.net). CTO & founder (egadah-it.com).

About the instructor Certifications RHCE certified. • IBM certified system Administrator. • IBM certified Data base Administrator. • Certified JAVA developer. • Dale Carnegie certified. Master information technology (in progress).

Course head lines Part I : LDAP Basics The first part of the book helps you gain practical experience with your own directory using the community-developed and freely available OpenLDAP server. We focuses on getting acquainted with LDAP and with the OpenLDAP server. In this part, I answer questions such as: - What is lightweight about LDAP? , - What security mechanisms does LDAP support for preventing unauthorized access to data? ,” - How can I build a fault-tolerant directory service?

Course head lines Part I : LDAP Basics Chapter 1: “Now where did I put that...?”, or “What is a directory?” Is a high-level overview of directory services and LDAP in particular. Chapter 2: LDAPv3 Overview Digs into the details of the Lightweight Directory Access Protocol Chapter 3: OpenLDAP Uses the free server distribution from OpenLDAP.org as an example to present practical experience with an LDAP directory.

Course head lines Part I : LDAP Basics Chapter 4: OpenLDAP Building Building a Company White Pages, provides some hands-on experience adding, modifying, and deleting information from a working directory service. Chapter 5: Replication, Referrals, Searching, and SASL Explained Wraps up the loose ends of some of the more advanced LDAPv3 and OpenLDAP features.

Course head lines Part II : Application Integration This part about implementation. we will talk about different applications Integration together in such a a way that information common to one or more clients can be shared via the directory. You will see how to use LDAP as a practical data store for items such as user and group accounts, host information, general contact information, and application configurations. also discuss integration with other directory services such as Microsoft’s Active Directory. how to develop your own Perl scripts to manage your directory service.

Course head lines Part II : Application Integration Chapter 6: Replacing NIS explains how an LDAP directory can be used to replace Sun’s Network Information Service (NIS) as the means to distribute user and group accounts, host information, automount maps, and other system files. Chapter 7: Email and LDAP presents information related to both mail clients (Eudora, Mozilla, Outlook, and Pine) and servers (Sendmail, Postfix, and Exim). Chapter 8: Standard Unix Services and LDAP explains how to use an LDAP direc-tory to share information among essential network services such as FTP, HTTP, LPD, RADIUS, DNS, and Samba.

Course head lines Part II : Application Integration Chapter 9: LDAP Interoperability examines what to do when your LDAP directory must coexist with other directory technologies. Chapter 10: Net::LDAP and Perl provides the information necessary to roll your own LDAP management tools using Perl and the Net::LDAP module.

Course head lines Part III: Appendixes The appendixes provide a quick reference for LDAP standards, common schema items used in this book, and the command-line syntax for OpenLDAP client tools.

PART I LDAP Basics CHAPTER 1 “ Now where did I put that...?”or “What is a directory?” Old days

PART I LDAP Basics CHAPTER 1 Directory service:- -Directory service is highly optimized for reads. DNS servers cache the entire zone information in memory. Adding, modifying, or deleting an entry -Directory service implements a distributed model for storing information. DNS is managed by thousands of local administrators and is connected by root name servers managed by the InterNIC.

PART I LDAP Basics CHAPTER 1 Directory service can extend the types of information it stores. have extended the types of DNS records to include such things as server resource records (Rrs). - Directory service has advanced search capabilities. DNS supports searches by any implemented record type (e.g., NS, MX, A, etc.). - Directory service has loosely consistent replication among directory servers All popular DNS software packages support secondary DNS servers

PART I LDAP Basics CHAPTER 1 Pluggable authentication modules ( PAM ) is a mechanism to integrate multiple low-level authentication schemes into a high-level application programming interface (API). It allows programs that rely on authentication to be written independent of the underlying authentication scheme

PART I LDAP Basics CHAPTER 1 The Lightweight Directory Access Protocol ( LDAP )

PART I LDAP Basics CHAPTER 1 What Is LDAP? The Lightweight Directory Access Protocol, or LDAP , is an application protocol for querying and modifying data using directory services running over TCP/IP.

PART I LDAP Basics CHAPTER 1 Lightweight - Why is LDAP considered lightweight? - X .500 (is a series of computer networking standards covering electronic directory services. The X.500 series was developed by ITU-T, formerly known as CCITT.) - X.500 “heavyweight.” It required the client and server to communicate using the Open Systems Interface (OSI) protocol stack.

PART I LDAP Basics CHAPTER 1 X.500 over OSI versus LDAP over TCP/IP

PART I LDAP Basics CHAPTER 1 Directory services VS database

PART I LDAP Basics CHAPTER 1 Access Protocol All of this talk of directory services makes it is easy to forget that LDAP is a protocol.

PART I LDAP Basics CHAPTER 1 LDAP Models LDAP models represent the services provided by a server Information model The information model provides the structures and data types necessary for building an LDAP directory tree. Naming model The naming model defines how entries and data in the DIT are uniquely referenced. Each entry has an attribute that is unique among all siblings of a single parent.

PART I LDAP Basics CHAPTER 1 Functional model The functional model is the LDAP protocol itself. Security model The security model provides a mechanism for clients to prove their identity (authentication) and for the server to control an authenticated client’s access to data

PART I LDAP Basics CHAPTER 1 At this high level, LDAP is relatively simple. It is a protocol for building highly distributed directories. In the next chapters, we will examine certain LDAP concepts such as schemas, referrals, and replication in much more depth.

PART I LDAP Basics CHAPTER 1 End of chapter 1

PART I LDAP Basics CHAPTER 1 Relax, it is Ok Let us watch this video

PART I LDAPv3 Overview CHAPTER 2 Distinguished name ( dn ) Domain container ( dc ) common name ( cn ) organizational unit ( ou ) DN administrator ( RootDN ) LDAP Interchange Format ( LDIF ) Relative Distinguished Names ( RDN ) Object Identifiers ( OIDs ) Surname ( sn ) data definition for your directory ( schema )

PART I LDAPv3 Overview CHAPTER 2 LDIF LDAP Interchange Format Standard text file format for storing LDAP configuration information and directory contents. In its most basic form LDIF file is: • A collection of entries separated from each other by blank lines • A mapping of attribute names to values • A collection of directives that instruct the parser how to process the information LDIF files are often used to import new data into your directory or make changes to existing data.

PART I LDAPv3 Overview CHAPTER 2 LDIF syntax • Comments in an LDIF file begin with a pound character (#) at position one and continue to the end of the current line. • Attributes are listed on the left-hand side of the colon (:), and values are presented on the right-hand side. The colon character is separated from the value by a space. • The dn attribute uniquely identifies the DN of the entry.

PART I LDAPv3 Overview CHAPTER 2 Distinguished Names and Relative Distinguished Names DN is like the absolute path between the root of a filesystem Relative distinguished name ( RDN ) is like a filename

PART I LDAPv3 Overview CHAPTER 2 What Is an Attribute? Attributes are used to hold values.

PART I LDAPv3 Overview CHAPTER 2 Attribute Syntax Can include: • a–z • A–Z • 0–9 • Various characters such as commas, periods, hyphens, colons, question marks, and spaces

PART I LDAPv3 Overview CHAPTER 2 What Does the Value of the objectClass Attribute Mean? All entries in an LDAP directory must have an objectClass attribute, and this attribute must have at least one value. Each objectClass value acts as a template for the data to be stored in an entry.

PART I LDAPv3 Overview CHAPTER 2 Object Class Types Structural object classes Represent a real-world object, such as a person or an organizationalUnit. Each entry within an LDAP directory must have exactly one structural object class listed in the objectClass attribute. Auxiliary object classes Add certain characteristics to a structural class. These classes cannot be used on their own, but only to supplement an existing structural object. Abstract object classes Act the same as their counterparts in object-oriented programming. These classes cannot be used directly, but only as ancestors of derived classes

PART I LDAPv3 Overview CHAPTER 2 What Is the dc Attribute? # LDIF listing for the entry dn: dc=plainjoe,dc=org dn: dc=plainjoe,dc=org objectclass: domain dc: plainjoe

PART I LDAPv3 Overview CHAPTER 2 Where Is dc=org? dc=plainjoe,dc=org is the directory’s naming context. If the directory’s root entry was dc=org, with a child entry of dc=plainjoe,dc=org, then the naming context would have been dc=org. Our server would then unnecessarily respond to queries for any entry whose DN ended with dc=org, even though it only has knowledge of entries underneath dc=plainjoe,dc=org. Designing an LDAP namespace is similar to designing a DNS hierarchy. Domain name servers for plainjoe.org have no need to service requests for the .org

PART I LDAPv3 Overview CHAPTER 2 Schema References There is no single source of information describing all possible LDAPv3 attribute types and object classes handful of online sites that can be consulted to cover the most common schema items: -RFC 3377 and related LDAPv3 standards (http://www.rfc-editor.org/) -LDAP Schema Viewer (http://ldap.akbkhome.com/) -Object Identifiers Registry (http://www.alvestrand.no/objectid/) -Sun Microsystems Product Documentation (http://docs.sun.com)

PART I LDAPv3 Overview CHAPTER 2 Authentication Remember that LDAP is a connection-oriented, message-based protocol. The authentication process is used to establish the client’s privileges for each session. All searches, queries, etc. are controlled by the authorization level of the authenticated user.

PART I LDAPv3 Overview CHAPTER 2 LDAPv3 specifications define several mechanisms for authenticating clients: • Anonymous Authentication • Simple Authentication • Simple Authentication over SSL/TLS • Simple Authentication and Security Layer (SASL) Some common encoding types are: CRYPT, MD5, SHA, SSHA

PART I LDAPv3 Overview CHAPTER 2 Anonymous Authentication Anonymous Authentication is the process of binding to the directory using an empty DN and password. This form of authentication is very common; it’s frequently used by client applications (for example, email clients searching an address book).

PART I LDAPv3 Overview CHAPTER 2 Simple Authentication For Simple Authentication, the login name in the form of a DN is sent with a password in clear text to the LDAP server. The server then attempts to match this password with the userPassword value, or with some other predefined attribute that is contained in the entry for the specified DN. If the password is stored in a hashed format, the server must generate the hash of the transmitted password and compare it to the stored version. the original password has been transmitted over the network in the clear.

PART I LDAPv3 Overview CHAPTER 2 Simple Authentication Over SSL/TLS LDAP can negotiate an encrypted transport layer prior to performing any bind operations. Thus, all user information is kept secure (as well as anything else transmitted during the session). There are two means of using SSL/TLS with LDAPv3: - LDAP over SSL (LDAPS - tcp/ 636 ) is well supported by many LDAP servers, both commercial and open source. Although frequently used. - LDAPv3 extended operation for negotiating TLS over the standard tcp/ 389 port. This operation, which is known as StartTLS, allows a server to support both encrypted and nonencrypted sessions on the same port, depending on the clients’ requests.

PART I LDAPv3 Overview CHAPTER 2 Simple Authentication and Security Layer (SASL) SASL is an extensible security scheme defined in RFC 2222 that can be used to add additional authentication mechanisms to connection-oriented protocols such as IMAP and LDAP, SASL supports a pluggable authentication scheme by allowing a client and server to negotiate the authentication mechanism prior to the transmission of any user credentials.

PART I LDAPv3 Overview CHAPTER 2 Distributed Directories There are many reasons for distributing the directory tree across multiple hosts. These can include, but are not limited to: Performance Perhaps one section of the directory tree is heavily used. Geographic location Are all the clients that access a particular branch of the directory in one location? Administrative boundaries It is sometimes easier to delegate administrative control of a directory branch by placing the branch on a server controlled by the group responsible for the information in that branch.

PART I LDAPv3 Overview CHAPTER 3 OpenLDAP

PART I LDAPv3 Overview CHAPTER 3 why are we using the OpenLDAP* server • The OpenLDAP source code is available for download from http://www.openldap.org/ under the OpenLDAP Public License. • OpenLDAP 2 is compliant with the core LDAPv3 specifications. • OpenLDAP is available for multiple platforms

PART I LDAPv3 Overview CHAPTER 3 Obtaining the OpenLDAP Distribution we’ll discuss how to compile the OpenLDAP source code distribution; you’ll need to build OpenLDAP to stay up to date, and studying the build process gives you a chance to learn more about the LDAP protocol. The latest version of OpenLDAP can be obtained from http://www.OpenLDAP.org/software/download/.

PART I LDAPv3 Overview CHAPTER 3 What is the difference between "release" and "stable" versions? The term " release " refers to the lastest version of the OpenLDAP Software available for "general use". The term " stable " refers to the last "general use" release that has demonstrated itself as being reliable in real world environments. Each new version which is published is referred to as the "release" version until a subsequent version is published. Likewise, "stable" always refers to the release which is considered the most reliable.

PART I LDAPv3 Overview CHAPTER 3 There are several advantages of LDAPv3 over the previous version, such as: • The ability to refer clients to other LDAP servers for information. • The ability to publish the server’s schema via LDAP operations, which makes it easier for clients to learn the server’s schema before performing searches. • Internationalization support through the use of UTF-8 characters in strings • Improved security and flexibility for authentication credentials and data via SASL and SSL/TLS. • Support for protocol extensions as a mechanism to enhance existing operations

PART I LDAPv3 Overview CHAPTER 3 Software Requirements Our OpenLDAP server will require several external software packages: • Support for POSIX threads, either by the operating system or an external library. (Portable Operating System Interface for Unix) If your server’s operating system supports threads, OpenLDAP 2 can take advantage of this feature. This support works fine out of the box on most current Linux systems, Solaris, and several other platforms. It is possible to disable thread support in the OpenLDAP server, slapd, by specifying the --disable-threads option

PART I LDAPv3 Overview CHAPTER 3 • SSL/TLS libraries (such as the OpenSSL package, the latest version of the OpenSSL libraries. These can be downloaded from the OpenSSL Project at http://www.openssl.org/ . # ./config shared --openssldir=/usr/local # make # make install

PART I LDAPv3 Overview CHAPTER 3 • A database manager library that supports DBM type storage facilities. The current library of choice is the Berkeley DB 4.1 package from Sleepycat Software ( http://www.sleepycat.com/ download.html). #./configure –prefix=/usr/local/ # make # make install Once the process is completed, verify that the file libdb-4.1.so exists in the lib/ directory below the installation root (e.g., /usr/local/lib/).

PART I LDAPv3 Overview CHAPTER 3 • Release 2.1 of the SASL libraries from Carnegie Mellon University ( http://asg.web.cmu.edu/sasl/sasl-library.html ). You don’t need to install the SASL libraries if you plan to support only simple (clear-text) binds and simple binds over SSL/TLS. The most common reasons for requiring SASL integration with LDAP are Kerberos authentication and integration with other SASL-enabled applications, such as Sendmail or Cyrus IMAPD server. ftp://ftp.andrew.cmu.edu/pub/cyrus-mail/ #gzip -dc cyrus-sasl-2.1.9.tar.gz | tar xf - #cd cyrus-sasl-2.1.9 #./configure #Make && make install #ln -s /usr/local/lib/sasl2 /usr/lib/sasl2

PART I LDAPv3 Overview CHAPTER 3 Compiling OpenLDAP 2 Once the necessary software libraries have been installed and correctly configured,compiling and installing OpenLDAP becomes a matter defining the appropriate options for the configure script and executing the make command You should also beaware of the --enable-wrappers option, which uses the tcp_wrappers libraries for restricting access via the standard /etc/hosts.allow and /etc/hosts.deny

PART I LDAPv3 Overview CHAPTER 3 #gzip -dc openldap-2.1.8.tar.gz | tar xvf - # cd openldap-2.1.8/ # ./configure –enable-wrappers #make depend #make #make test #/bin/su -c "make install"

PART I LDAPv3 Overview CHAPTER 3 OpenLDAP Clients and Servers The OpenLDAP package includes clients,servers and development libraries. overview of the utilities that come with the package. All pathnames are relative to the installation location, which defaults to /usr/local. Installed components included with OpenLDAP page 37

PART I LDAPv3 Overview CHAPTER 3 The slapd.conf Configuration File The slapd.conf file is the central source of configuration information for theOpenLDAP standalone server (slapd), the replication helper daemon (slurpd), and related tools, such as slapcat and slapadd. In the tradition of Unix configuration files, slapd.conf is an ASCII file with the following rules: • Blank lines and lines beginning with a pound sign (#) are ignored. • Parameters and associated values are separated by whitespace characters (space or tab). • A line with a blank space in the first column is considered to be a continuation of the previous one. There is no need for a line continuation character such as a backslash (\).

PART I LDAPv3 Overview CHAPTER 3 the slapd.conf file used by OpenLDAP 2 can be broken into two sections. The first section contains parameters that affect the overall behavior of the OpenLDAP servers (for example, the level of information sent to log files). The second section is composed of parameters that relate to a particular database backend used by the slapd daemon. # Database #1 - Berkeley DB database bdb

PART I LDAPv3 Overview CHAPTER 3 Schema Files The first step in configuring your LDAP server is to decide which schema the directory should support.

PART I LDAPv3 Overview CHAPTER 3 OpenLDAP includes several popular schema files to be used at the administrator’s. The needs of the applications that will use the directory determine which schema you use. All the attribute Type and objectClass definitions required for a bare-bones server are included in the file core.schema. Some of these attributeTypes and objectClasses are: • Attributes for storing the timestamp of the last update on an entry • Attributes for representing name, locations, etc. • Objects to represent an organization or person • Objects to represent DNS domain names • And so on... this file is located in the directory /usr/local/etc/openldap/schema/ several schema files included with OpenLDAP installation page 40

core.schema OpenLDAP’s required core schema. Corba http://en.wikipedia.org/wiki/Common_Object_Request_Broker_Architecture inetorgperson.schema schema that defines the inetOrgPerson object class This object is frequently used to store contact information for people. java.schema A schema for storing a Java serialized object, a Java marshalled object, a remote Java object, or a JNDI reference in an LDAP directory. misc.schema A schema that defines a small group of miscellaneous objects and attributes. Currently, this file contains the schema necessary to implement LDAP-based mail routing in Sendmail 8.10+. nis.schema A schema that defines attributes and objects necessary for using LDAP with the Network Information Service (NIS) openldap.schema Miscellaneous objects used by the OpenLDAP project. Provided for information purposes only.

PART I LDAPv3 Overview CHAPTER 3 Logging The next group of parameters that you frequently find in the global section of slapd.conf control where slapd logs information during execution ## Added logging parameters loglevel 296 pidfile /usr/local/var/slapd.pid argsfile /usr/local/var/slapd.args the logging level is set to 296, which equals 8+ 32 + 256=296

PART I LDAPv3 Overview CHAPTER 3 Level Information recorded – 1 All logging information 0 No Logging information 1 Trace function calls 2 Packet-handling debugging information 4 Heavy trace debugging 8 Connection management 16 Packets sent and received 32 Search filter processing 64 Configuration file processing 128 Access control list processing 256 Statistics for connection, operations, and results 512 Statistics for results returned to clients 1024 Communication with shell backends 2048 Print entry parsing debug information

PART I LDAPv3 Overview CHAPTER 3 pidfile filename This parameter specifies the absolute location of a file that will contain the process ID of the currently running master slapd process. argsfile filename This parameter specifies the absolute path to a file containing the command-line parameters used by the currently running master slapd. This parameter is processed only if slapd is started without the debug command-line argument.

PART I LDAPv3 Overview CHAPTER 3 SASL Options is not needed if only simple binds will be used to access the directory. However, it’s often useful to allow a combination of simple binds and SASL mechanisms for user connections. For example, we might want to allow most users (who are only allowed to look up data) to authenticate via a simple bind, while requiring administrators (who are allowed to change data) to authenticate via SASL.

PART I LDAPv3 Overview CHAPTER 3 SSL/TLS Options LSCipherSuite cipher-suite-specification TLSCipherSuite parameter allows you to specify which ciphers the server will accept. TLSCertificateFile filename TLSCertificateKeyFile filename Inform slapd of the location of the server’s certificate and the associated private key.

PART I LDAPv3 Overview CHAPTER 3 Generating the server’s certificate The CA.pl Perl script, installed in /usr/local/misc/ as part of the OpenSSL installation, provides a nice wrapper around the openssl tool and its command-line arguments. # /usr/local/misc/CA.pl -newcert Enter PEM pass phrase:test Verifying password - Enter PEM pass phrase:test Notice that the CA.pl script places a private key in the same file as the public certificate. You must remove the password for the private key

PART I LDAPv3 Overview CHAPTER 3 The following command removes the password from the private key and places the modified version of the key in a separate file: openssl rsa -in newreq.pem -out newkey.pem read RSA key Enter PEM pass phrase:test writing RSA key

PART I LDAPv3 Overview CHAPTER 3 More Security-Related Parameters There are also five other security-related global options to be covered prior to continuing on to the database section. These are: security require allow disallow password-hash security parameter allows us to specify general security strength factors The security parameter allows us to specify general security strength factors.

PART I LDAPv3 Overview CHAPTER 3 Serving Up Data will be one or more database sections, each defining a directory partition. A database section begins with the database directive and continues until the next occurrence of the database directive or the end of the file

PART I LDAPv3 Overview CHAPTER 3 This parameter has several possible values: bdb This backend has been specifically written to take advantage of the Berkley DB 4 database manager. This backend makes extensive use of indexing and caching to speed up performance; it is the recommended backend used on an OpenLDAP server. ldbm An ldbm database is implemented via either the GNU Database Manager or the Sleepycat Berkeley DB software package. This backend is the older implementation of the bdb backend.

PART I LDAPv3 Overview CHAPTER 3 passwd The passwd backend is a quick and dirty means of providing a directory interface to the system passwd(5) file. It has only one configuration parameter: the file directive, which defines the location of the password file (if different from /etc/ passwd) used to respond to directory queries. shell The shell backend directive allows the use of alternative (and external) databases. This directive lets you specify external programs that are called for each of the LDAPv3 core operations. The first step in writing a database section is defining the type of backend. almost exclusively used the bdb database

PART I LDAPv3 Overview CHAPTER 3 bdb backend-specific parameters The directory and mode parameters define the physical location and filesystem permissions of the created database files. These parameters are necessary because, when using an ldbm backend, slapd manages the data store itself. In the following configuration file, the directory and mode parameters tell slapd and the other LDAP tools how to locate and store the database files for this partition. The files are stored in the directory /var/ldap/plainjoe.org/ and created with read/write permission (0600) for the owner only (the account under which the slapd daemon runs).

PART I LDAPv3 Overview CHAPTER 3 The index parameter The index parameter specifies the attributes on which slapd should maintain indexes. These indexes are used to optimize searches, similar to the indexes used by a relational database management system. slapd supports four types of indexes.

approx (approximate) Indexes the information for an approximate, or phonetic, match of an attribute’s value. eq (equality) Indexes the information necessary to perform an exact match of an attributevalue. The match may be case-sensitive or whitespace sensitive, depending on the matching rules defined in the attribute’s syntax. pres (presence) Indexes the information necessary to determine if an attribute has any value at all. If an attribute does not possess a value, then the attribute is not present in the directory entry. sub (substring) Indexes the information necessary to perform a simple substring match on attribute values

PART I LDAPv3 Overview CHAPTER 3 Access Control Lists (ACLs) The Directory ACLs provided by OpenLDAP are simple in their syntax, yet very flexible and powerful in their implementation. The basic idea is to define Who has Access to What? “ Who” include: * Matches any connected user, including anonymous connection Self The DN of the currently connected user, assuming he has been successfully authenticated by a previous bind request Anonymous Nonauthenticated user connections Users Authenticated user connections Regular expression Matches a DN or an SASL identity

Access level Permission granted write Access to update attribute values (e.g., Change this telephoneNumber to 555-2345). read Access to read search results (e.g., Show me all the entries with a telephoneNumber of 555*). search Access to apply search filters (e.g., Are there any entries with a telephoneNumber of 555*). compare Access to compare attributes (e.g., Is your telephoneNumber 555-1234?). auth Access to bind (authenticate). This requires that the client send a username in the form of a DN and some type none No access See Page 56

OpenLDAP: Building a Company White Pages CHAPTER 4 The previous chapter discussed how to install OpenLDAP and provided an overview of the slapd configuration file, slapd.conf. However, we have yet to launch the server, let alone add any data to the directory. Using the slapd.conf from Chapter 3 as a starting point, this chapter shows you how to create a company directory for storing employee contact information, including postal addresses, email addresses, and phone numbers.

OpenLDAP: Building a Company White Pages CHAPTER 4 A Starting Point the slapd configuration file See page 60

OpenLDAP: Building a Company White Pages CHAPTER 4 Defining the Schema The first step in implementing a directory is determining what information to store in the directory. Page 61

OpenLDAP: Building a Company White Pages CHAPTER 4 Once the schema has been selected, the next step is to modify slapd.conf to support the selected attribute types and object classes See page 64

OpenLDAP: Building a Company White Pages CHAPTER 4 Starting slapd Once the final tweaks have been added to the configuration file, the next step is to start the slapd daemon by executing the following command as root: root# /usr/local/libexec/slapd See page 65

OpenLDAP: Building a Company White Pages CHAPTER 4 Adding the Initial Directory Entries A directory without data isn’t of much use. There are two ways to add information to your directory; which method to use depends on the directory’s state. First, slapadd and the other slap* commands were presented in Chapter 3 See page 66

OpenLDAP: Building a Company White Pages CHAPTER 4 Verifying the Directory’s Contents Next, you will bring the directory online so that you can use it in conjunction with ldapsearch, ldapmodify, and the other tools for working on a live directory See page 68

OpenLDAP: Building a Company White Pages CHAPTER 4 Updating What Is Already There Eventually, the information stored in a directory will need to be updated or deleted. While a directory isn’t designed to be updated as frequently as a database, there are very few applications in which the data never changes. This section covers how to update the data in the directory using ldapmodify. See page 72

OpenLDAP: Building a Company White Pages CHAPTER 4 Graphical Editors Working with command-line tools and LDIF files is constructive, but certainly not convenient. There are a number of graphical editors and browsers for LDAP that make it easier to see what you’re doing. Phpldapadmin http://yala.sourceforge.net/ See page 77

Replication, Referrals, Searching, and SASL Explained CHAPTER5 The previous chapters have prepared the foundation for understanding and building an LDAP-based directory server. This chapter presents some of the more advanced features provided by LDAP and shows how to use these features in your directory service. As such, this chapter ties up a lot of loose ends that have been left hanging by the previous discussions

Replication, Referrals, Searching, and SASL Explained CHAPTER5 More Than One Copy Is “a Good Thing” We begin by exploring directory replication. This feature hasn’t been standardized yet; our example focuses on the OpenLDAP project. The concepts and principles that I will present are applicable to all LDAP directories, but the examples them- selves are specific to OpenLDAP. See page 79

Replication, Referrals, Searching, and SASL Explained CHAPTER5 Building slurpd When you built the OpenLDAP package in Chapter 3, you didn’t build the slurpd binary. To build slurpd, you must pass the command-line option --enable-slurpd to the configure script. Note that thread support is required for slurpd; there is no non- threaded version.

Replication, Referrals, Searching, and SASL Explained CHAPTER5 Replication in a Nutshell Before implementing replication in a directory, you must have a working LDAP master server. The directory server built in previous chapters will be used as a starting point. Page 81 Configuring the Master Server Before implementing replication in a directory, you must have a working LDAP master server. Page 81 Configuring the Replica Server The first step in creating a replica is to initialize its database with a current copy of the directory from the master server. Page 88

Replication, Referrals, Searching, and SASL Explained CHAPTER5 Distributing the Directory The scenarios presented thus far have all assumed that the entire directory consists of a single partition on one server. In the real world, this may not always suffice. There are many reasons (which I touched on in Chapter 2) for splitting a directory into two or more partitions, which may reside on multiple servers. Page 88

Replication, Referrals, Searching, and SASL Explained CHAPTER5 Advanced Searching Options Chapter 4 presented LDAP searches as a means of verifying the correctness of your directory. That’s obviously a very limited use of the search capability: a directory isn’t much use if you can’t search it. Given our limited goals in the previous chapter, we didn’t do justice to the topic of search filters. Page 91

Replication, Referrals, Searching, and SASL Explained CHAPTER5 Following Referrals with ldapsearch By default, the ldapsearch tool shipped with OpenLDAP 2 prints information about referral objects but does not automatically follow them. Page 92 Limiting Your Searches A production directory can easily grow to thousands or millions of entries Page 92

Replication, Referrals, Searching, and SASL Explained CHAPTER5 Determining a Server’s Capabilities Chapter 2 alluded to two new LDAPv3 features: the subschemaSubentry and the rootDSE objects. Both of these objects allow clients to find out information about a previously unknown directory server. Page 93

Replication, Referrals, Searching, and SASL Explained CHAPTER5 Creating Custom Schema Files for slapd There are times when the standard schema files distributed with your LDAP server don’t meet the needs of your application. Creating a custom schema file for OpenLDAP is a simple process: • Assign a unique OID for all new attribute types and object classes. • Create the schema file and include it in slapd.conf. Page 95

Replication, Referrals, Searching, and SASL Explained CHAPTER5 SASL and OpenLDAP The final section of this chapter explores how to replace the simple authentication used in your current directory server with SASL mechanisms. Page 97

Application Integration PART II

Replacing NIS CHAPTER 6 One of LDAP’s chief advantages is its ability to consolidate multiple directory services into one. This chapter examines the pros and cons of using LDAP as a replacement for Sun’s Network Information Service (NIS). NIS is used primarily by Unix clients to centralize management of user information and passwords, hostnames and IP addresses, automount maps (files that control the mounting of remote file systems), and other administrative information.

Replacing NIS CHAPTER 6 More About NIS Before discussing these strategies for replacing NIS with LDAP, it’s worth understanding something about the beast we’re trying to replace.NIS is most commonly used to distribute system password and account maps It can also distribute a number of files that control the automatic mounting of remote file systems; and with the appropriate wizardry in sed and awk or Perl, it can be coerced into distributing almost any kind of data that can be represented in a text file.

Replacing NIS CHAPTER 6 Schemas for Information Services An Approach for Using LDAP as a Network Information Service,” which has recently been updated in an Internet-Draft by the LDAPbis working group, defines the attribute types and object classes needed to use an LDAP directory as a replacement for NIS ## cosine.schema is a prerequesite of nis.schema. Include /usr/local/etc/openldap/schema/cosine.schema ## rfc2307 attribute types and object classes Include /usr/local/etc/openldap/schema/nis.schema

Replacing NIS CHAPTER 6 Information Migration While some organizations may have the resources to re-enter the data held in the NIS maps to the LDAP store, there are other means available. In addition to the PAM and NSS LDAP reference modules available at PADL Software’s web site, you’ll also find a set of Perl scripts designed to convert the various /etc system files (e.g., /etc/passwd and /etc/hosts) into LDIF format. Once you’ve converted the system files to LDIF, you can import them into your LDAP store either online using the ldapadd command or by using an offline database creation utility such as the OpenLDAP slapadd tool. These LDAP migration scripts can be found at http://www.padl.com/OSS/MigrationTools.html

Replacing NIS CHAPTER 6 Configuring /etc/ldap.conf The pam_ldap module stores its configuration settings in a text file. This file is named ldap.conf by default and is normally stored in the /etc directory. The configuration parameters you can put in this file are summarized in page 109 http://wiki.lpi.org/wiki/LPIC-3_301_Objectives

Replacing NIS CHAPTER 7 Email and LDAP

Replacing NIS CHAPTER 7 One of the most important applications of a directory is storing email addresses and other contact information.

Replacing NIS CHAPTER 7 Email Clients and LDAP When planning a strategy for supporting an application with a directory, you always start by examining the application and determining what schema has the ability to support it. Using a standard schema is vastly preferable to building your own. Of course, with email you don’t have the ability to specify what client users will use: at your site, many different clients are probably in use Page 129

Replacing NIS CHAPTER 7 Mail Transfer Agents (MTAs) This section focuses on Postfix’s ability to integrate with an LDAP directory. Ensuring that the proper features are enabled when you compile Postfix. make tidy make makefiles CCARGS="-I/usr/local/include -DHAS_LDAP" \ AUXLIBS="-L/usr/local/lib -lldap -llber" postconf -m

Replacing NIS CHAPTER 7 Vim /etc/postfix/main.cf

Standard Unix Services and LDAP CHAPTER 8 This chapter takes LDAP integration a step further by exploring how other standard Unix services can make use of our directory. The applications we will explore are :- * Integrate SSH with LDAP (Done) * Integrate FTP with LDAP * Integrate HTTP with LDAP * Integrate print services with LDAP

Standard Unix Services and LDAP CHAPTER 8 An FTP/HTTP Combination ProFTPD $ ./configure --with-modules=mod_ldap $ make $ /bin/su -c "make install" proftpd -l

Standard Unix Services and LDAP CHAPTER 8 ProFTPD configuration file ## Limit users to their web directory. Use the default search filter. LDAPDoAuth on "ou=people,dc=plainjoe,dc=org" ## Define the LDAP server to contact. LDAPServer ldap.plainjoe.org ## Require that an incoming user can successfully bind to the LDAPServer. LDAPAuthBinds on ## Look up UIDs and GIDs in the directory. LDAPDoGIDLookups on "ou=group,dc=plainjoe,dc=org" LDAPDoUIDLookups on "ou=people,dc=plainjoe,dc=org"

Standard Unix Services and LDAP CHAPTER 8 Apache LoadModule ldap_userdir_module /usr/lib/apache/mod_ldap_userdir.so <IfModule mod_ldap_userdir.c> LDAPUserDirServer ldap.plainjoe.org LDAPUserDirSearchScope subtree LDAPUserDirBaseDN ou=people,dc=plainjoe,dc=org LDAPUserDir public_html </IfModule>

Standard Unix Services and LDAP CHAPTER 8 Configuring Samba ## LDAPsam-related passwords ldap admin dn = "cn=smbadmin,ou=people,dc=plainjoe,dc=org" ldap server = ldap.plainjoe.org ldap ssl = start_tls ldap port = 389 ldap suffix = "ou=people,dc=plainjoe,dc=org" ## The following is the default LDAP filter used if one is not explicitly defined. ldap filter = "(&(uid=%U)(objectclass=sambaAccount))"

Standard Unix Services and LDAP CHAPTER 8 Central Printer Management

LDAP Interoperability CHAPTER 9

Ldap system administration

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to Ldap system administration (20)

Recently uploaded (20)

Ldap system administration