Differences between revisions 16 and 17
⇤ ← Revision 16 as of 2009-01-21 19:24:00 →
Size: 4337
Editor: AsmoKoskinen
Comment:
← Revision 17 as of 2009-01-21 19:38:20 → ⇥
Size: 7667
Editor: AsmoKoskinen
Comment:
Deletions are marked like this. Additions are marked like this.
Line 120: Line 120:

Näistä tiedostoista on poistettu osa kommenttiriveistä, #-merkillä alkavat, luettavuuden parantamiseksi.

{{{
root@ubuntu:~# cat /etc/ldap/slapd.conf
#######################################################################
# Global Directives:

# Schema and objectClass definitions
include /etc/ldap/schema/core.schema
include /etc/ldap/schema/cosine.schema
include /etc/ldap/schema/nis.schema
include /etc/ldap/schema/inetorgperson.schema

pidfile /var/run/slapd/slapd.pid

argsfile /var/run/slapd/slapd.args

loglevel none

modulepath /usr/lib/ldap
moduleload back_hdb

sizelimit 500

tool-threads 1

#######################################################################
# Specific Backend Directives for hdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend hdb

#######################################################################
# Specific Directives for database #1, of type hdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database hdb

# The base of your directory in database #1
suffix "dc=ubuntu,dc=fi"

# rootdn directive for specifying a superuser on the database. This is needed
# for syncrepl.
rootdn "cn=manager,dc=ubuntu,dc=fi"

# Where the database file are physically stored for database #1
directory "/var/lib/ldap"

password-hash {crypt}
rootpw {MD5}gonsh+ULQWhKd6JXdMo4kQ==

# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM
dbconfig set_cachesize 0 2097152 0

# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500

# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500

# Number of lockers
dbconfig set_lk_max_lockers 1500

# Indexing options for database #1
index objectClass eq

# Save the time that the entry gets modified, for database #1
lastmod on

# Checkpoint the BerkeleyDB database periodically in case of system
# failure and to speed slapd shutdown.
checkpoint 512 30

# Where to store the replica logs for database #1
# replogfile /var/lib/ldap/replog

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword,shadowLastChange
        by dn="cn=manager,dc=ubuntu,dc=fi" write
        by anonymous auth
        by self write
        by * none

# Ensure read access to the base for things like
# supportedSASLMechanisms. Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work
# happily.
access to dn.base="" by * read

# The admin dn has full write access, everyone else
# can read everything.
access to *
        by dn="cn=manager,dc=ubuntu,dc=fi" write
        by * read

root@ubuntu:~#
}}}

SisällysluetteloBRTableOfContents(3)

LTSP5 - openLDAP

Tämä ohje on tarkoitettu Ubuntu 8.04.1-versiolla. Ohje perustuu asennukseen, joka tehtiin Valamossa LTSP5-työpajassa tammikuussa 2009. Asennuksen teki Mikael Lammentausta.

  • Tämä ohje ei ole leikkaa-liimaa-tyyppinen, vaan pikemminkin mahdollisimman tarkka kuvaus yhdestä toimivasta LTSP5-openLDAP-palvelinyhdistelmästä.

    Toivomme, että lähtien liikkeelle tästä peruskuvauksesta saamme luoduksi monipuolisen ohjeen koskien openLDAP-käyttöä LTSP5-ympäristössä.

Tässä ohjeessa edellytetään, että käytössä on kaksi palvelinkonetta, jossa ensimmäiseen on ensin asennettu täysin toimiva LTSP5-ympäristö. Toiseen koneeseen riittää pelkkä Ubuntu 8.04.1-asennus. Näissä kahdessa palvelinkoneessa on yksi verkkokortti kummassakin. Perusasennuksen jälkeen tässä ohjeessa on käytössä seuraavanlaista lähiverkkoa. LTSP5-perusasennuksesta, tosin kahdella verkkokortilla, löytyy oma ohjeensa: http://wiki.ubuntu-fi.org/LTSP5_Perusasennus.

http://www.arkki.info/howto/Wiki/LTSP5-openLDAP/LTSP5-openLDAP.gif

ADSL-modeemi jakaa LAN-reitittimelle/kytkimelle ip-osoitteen (192.168.0.100). Lähiverkkoon päin LAN-reititin/kytkin näkyy ip-osoitteessa 192.168.1.1. Tämä LAN-reititin/kytkin tarjoaa myös nimipalvelut.

Palvelin, jossa on LTSP5-ympäristö, on 192.168.1.101.

Palvelin, jossa on openLDAP, on 192.168.1.102.

Pääte, jolle on annettu kiinteä ip-osoite MAC-osoitteen perusteella, on 192.168.1.200. Pääte myös kirjautuu automaattisesti.

Lähiverkon perusasetukset

Tässä ohjeessa on käytetty seuraavanlaisia asetustiedostoja.

LTSP5-palvelin, verkkoasetukset - 192.168.1.101

root@ubuntu:~# cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
        address 192.168.1.101
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.1
        # dns-* options are implemented by the resolvconf package, if installed
        dns-nameservers 192.168.1.1
root@ubuntu:~#

root@ubuntu:~# cat /etc/ltsp/dhcpd.conf
#
# Default LTSP dhcpd.conf config file.
#

authoritative;

subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.150 192.168.1.200;
    option domain-name "ubuntu";
    option domain-name-servers 192.168.1.1;
    option broadcast-address 192.168.1.255;
    option routers 192.168.1.1;
#    next-server 192.168.0.1;
#    get-lease-hostnames true;
    option subnet-mask 255.255.255.0;
    option root-path "/opt/ltsp/i386";
    if substring( option vendor-class-identifier, 0, 9 ) = "PXEClient" {
        filename "/ltsp/i386/pxelinux.0";
    } else {
        filename "/ltsp/i386/nbi.img";
    }

host ltsp001 {
        hardware ethernet 00:22:15:15:4B:4C;
        fixed-address 192.168.1.200;
        }
}
root@ubuntu:~#

root@ubuntu:~# cat /var/lib/tftpboot/ltsp/i386/lts.conf
[00:22:15:15:4B:4C]
X_CONF = /etc/X11/asus-eee-xorg.conf
X_COLOR_DEPTH=16
LDM_DIRECX=True
LDM_AUTOLOGIN=True
LDM_USERNAME=ltsp001
LDM_PASSWORD=edubuntu
root@ubuntu:~#

openLDAP-palvelin, verkkoasetukset - 192.168.1.102

root@ubuntu:~# cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
        address 192.168.1.102
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.1
        # dns-* options are implemented by the resolvconf package, if installed
        dns-nameservers 192.168.1.1
root@ubuntu:~#

openLDAP-asetustiedostot

Näistä tiedostoista on poistettu osa kommenttiriveistä, #-merkillä alkavat, luettavuuden parantamiseksi. 

root@ubuntu:~# cat /etc/ldap/slapd.conf
#######################################################################
# Global Directives:

# Schema and objectClass definitions
include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema

pidfile         /var/run/slapd/slapd.pid

argsfile        /var/run/slapd/slapd.args

loglevel        none

modulepath      /usr/lib/ldap
moduleload      back_hdb

sizelimit 500

tool-threads 1

#######################################################################
# Specific Backend Directives for hdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend         hdb

#######################################################################
# Specific Directives for database #1, of type hdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database        hdb

# The base of your directory in database #1
suffix          "dc=ubuntu,dc=fi"

# rootdn directive for specifying a superuser on the database. This is needed
# for syncrepl.
rootdn          "cn=manager,dc=ubuntu,dc=fi"

# Where the database file are physically stored for database #1
directory       "/var/lib/ldap"

password-hash   {crypt}
rootpw {MD5}gonsh+ULQWhKd6JXdMo4kQ==

# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM
dbconfig set_cachesize 0 2097152 0

# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500

# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500

# Number of lockers
dbconfig set_lk_max_lockers 1500

# Indexing options for database #1
index           objectClass eq

# Save the time that the entry gets modified, for database #1
lastmod         on

# Checkpoint the BerkeleyDB database periodically in case of system
# failure and to speed slapd shutdown.
checkpoint      512 30

# Where to store the replica logs for database #1
# replogfile    /var/lib/ldap/replog

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword,shadowLastChange
        by dn="cn=manager,dc=ubuntu,dc=fi" write
        by anonymous auth
        by self write
        by * none

# Ensure read access to the base for things like
# supportedSASLMechanisms.  Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work 
# happily.
access to dn.base="" by * read

# The admin dn has full write access, everyone else
# can read everything.
access to *
        by dn="cn=manager,dc=ubuntu,dc=fi" write
        by * read

root@ubuntu:~#