LTSP5 - openLDAP

Tämä ohje on tarkoitettu Ubuntu 8.04.1-versiolla. Ohje perustuu asennukseen, joka tehtiin Valamossa LTSP5-työpajassa tammikuussa 2009. Asennuksen teki Mikael Lammentausta.

@ Mikael: teen vielä tämän päivän (22.1) näitä siirroksia asetustiedostoista, lisäksi käytän kummankin koneen bash_history-tiedostoja, joista yritän nähdä mitä kulloinkin teit, sieltä saan myös komentorivikäskyjä, joita käytit. Laita huomenna (23.1) omat kommenttisi ja korjauksesi tänne sekaan. Kun saamme tämän jotenkin kasaan, niin yritän tämän pohjalta tehdä vielä puhtaan openLDAP-asennusken LTSP5:n jatkoksi. Kiitos, Asmo.

Tämä ohje ei ole leikkaa-liimaa-tyyppinen, vaan pikemminkin mahdollisimman tarkka kuvaus yhdestä toimivasta LTSP5-openLDAP-palvelinyhdistelmästä.
Toivomme, että lähtien liikkeelle tästä peruskuvauksesta saamme luoduksi monipuolisen ohjeen koskien openLDAP-käyttöä LTSP5-ympäristössä.

Tässä ohjeessa edellytetään, että käytössä on kaksi palvelinkonetta, jossa ensimmäiseen on ensin asennettu täysin toimiva LTSP5-ympäristö. Toiseen koneeseen riittää pelkkä Ubuntu 8.04.1-asennus. Näissä kahdessa palvelinkoneessa on yksi verkkokortti kummassakin. Perusasennuksen jälkeen tässä ohjeessa on käytössä seuraavanlaista lähiverkkoa. LTSP5-perusasennuksesta, tosin kahdella verkkokortilla, löytyy oma ohjeensa: http://wiki.ubuntu-fi.org/LTSP5_Perusasennus.

http://www.arkki.info/howto/Wiki/LTSP5-openLDAP/LTSP5-openLDAP.gif

ADSL-modeemi jakaa LAN-reitittimelle/kytkimelle ip-osoitteen (192.168.0.100). Lähiverkkoon päin LAN-reititin/kytkin näkyy ip-osoitteessa 192.168.1.1. Tämä LAN-reititin/kytkin tarjoaa myös nimipalvelut.

Palvelin, jossa on LTSP5-ympäristö, on 192.168.1.101.

Palvelin, jossa on openLDAP, on 192.168.1.102.

Pääte, jolle on annettu kiinteä ip-osoite MAC-osoitteen perusteella, on 192.168.1.200. Pääte myös kirjautuu automaattisesti.

Lähiverkon perusasetukset

Tässä ohjeessa on käytetty seuraavanlaisia asetustiedostoja.

LTSP5-palvelin, verkkoasetukset - 192.168.1.101

root@ubuntu:~# cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
        address 192.168.1.101
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.1
        # dns-* options are implemented by the resolvconf package, if installed
        dns-nameservers 192.168.1.1
root@ubuntu:~#

root@ubuntu:~# cat /etc/ltsp/dhcpd.conf
#
# Default LTSP dhcpd.conf config file.
#

authoritative;

subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.150 192.168.1.200;
    option domain-name "ubuntu";
    option domain-name-servers 192.168.1.1;
    option broadcast-address 192.168.1.255;
    option routers 192.168.1.1;
#    next-server 192.168.0.1;
#    get-lease-hostnames true;
    option subnet-mask 255.255.255.0;
    option root-path "/opt/ltsp/i386";
    if substring( option vendor-class-identifier, 0, 9 ) = "PXEClient" {
        filename "/ltsp/i386/pxelinux.0";
    } else {
        filename "/ltsp/i386/nbi.img";
    }

host ltsp001 {
        hardware ethernet 00:22:15:15:4B:4C;
        fixed-address 192.168.1.200;
        }
}
root@ubuntu:~#

root@ubuntu:~# cat /var/lib/tftpboot/ltsp/i386/lts.conf
[00:22:15:15:4B:4C]
X_CONF = /etc/X11/asus-eee-xorg.conf
X_COLOR_DEPTH=16
LDM_DIRECX=True
LDM_AUTOLOGIN=True
LDM_USERNAME=ltsp001
LDM_PASSWORD=edubuntu
root@ubuntu:~#

root@ubuntu:~# cat /etc/ldap/ldap.conf
###############
# LDAP Defaults
#

# See ldap.conf(5) for details
# This file should be world readable but not world writable.

BASE    dc=ubuntu,dc=fi
URI     ldap://192.168.1.102

root@ubuntu:~#

root@ubuntu:~# cat /etc/ldap.conf
###DEBCONF###
##
## Configuration of this file will be managed by debconf as long as the
## first line of the file says '###DEBCONF###'
##
## You should use dpkg-reconfigure to configure this file via debconf
##

# The distinguished name of the search base.
base dc=ubuntu,dc=fi

# Another way to specify your LDAP server is to provide an
uri ldap://192.168.1.102

# The LDAP version to use (defaults to 3
# if supported by client library)
ldap_version 3

# The distinguished name to bind to the server with
# if the effective user ID is root. Password is
# stored in /etc/ldap.secret (mode 600)
rootbinddn cn=manager,dc=ubuntu,dc=fi

# Do not hash the password at all; presume
# the directory server will do it, if
# necessary. This is the default.
pam_password md5

nss_initgroups_ignoreusers avahi,avahi-autoipd,backup,bin,daemon,dhcp,dhcpd,games,gdm,gnats,haldaemon,hplip,irc,klog,libuuid,list,lp,mail,man,messagebus,nbd,news,ntp,nx,polkituser,proxy,pulse,root,sshd,statd,sync,sys,syslog,uucp,www-data

root@ubuntu:/etc#

root@ubuntu:/etc# cat ldap.secret
TP2009ltsp
root@ubuntu:/etc#

root@ubuntu:~# cat /etc/nsswitch.conf
####################
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat ldap
group:          compat ldap
shadow:         compat ldap

hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis
root@ubuntu:~#

root@ubuntu:~# getent passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
dhcp:x:101:102::/nonexistent:/bin/false
syslog:x:102:103::/home/syslog:/bin/false
klog:x:103:104::/home/klog:/bin/false
hplip:x:104:7:HPLIP system user,,,:/var/run/hplip:/bin/false
avahi-autoipd:x:105:113:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/bin/false
gdm:x:106:114:Gnome Display Manager:/var/lib/gdm:/bin/false
pulse:x:107:116:PulseAudio daemon,,,:/var/run/pulse:/bin/false
messagebus:x:108:119::/var/run/dbus:/bin/false
avahi:x:109:120:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false
polkituser:x:110:122:PolicyKit,,,:/var/run/PolicyKit:/bin/false
haldaemon:x:111:123:Hardware abstraction layer,,,:/var/run/hald:/bin/false
dhcpd:x:112:124::/nonexistent:/bin/false
nbd:x:113:125::/etc/nbd-server:/bin/false
sshd:x:114:65534::/var/run/sshd:/usr/sbin/nologin
admin-ubuntu:x:1000:1000:Administrator Ubuntu,,,:/root/admin-ubuntu:/bin/bash
nx:x:115:127:FreeNX Server,,,:/var/lib/nxserver/home/:/usr/bin/nxserver
ntp:x:116:128::/home/ntp:/bin/false
statd:x:117:65534::/var/lib/nfs:/bin/false
ltsp001:x:1001:10000:LTSP 001:/home/ltsp001:/bin/bash
ltsp002:x:1002:10000:LTSP 002:/home/ltsp002:/bin/bash
ltsp003:x:1003:10000:LTSP 003:/home/ltsp003:/bin/bash
ltsp004:x:1004:10000:LTSP 004:/home/ltsp004:/bin/bash
ltsp005:x:1005:10000:LTSP 005:/home/ltsp005:/bin/bash
ltsp006:x:1006:10000:LTSP 006:/home/ltsp006:/bin/bash
ltsp007:x:1007:10000:LTSP 007:/home/ltsp007:/bin/bash
ltsp008:x:1008:10000:LTSP 008:/home/ltsp008:/bin/bash
ltsp009:x:1009:10000:LTSP 009:/home/ltsp009:/bin/bash
ltsp010:x:1010:10000:LTSP 010:/home/ltsp010:/bin/bash
ltsp011:x:1011:10000:LTSP 011:/home/ltsp011:/bin/bash
ltsp012:x:1012:10000:LTSP 012:/home/ltsp012:/bin/bash
ltsp013:x:1013:10000:LTSP 013:/home/ltsp013:/bin/bash
ltsp014:x:1014:10000:LTSP 014:/home/ltsp014:/bin/bash
ltsp015:x:1015:10000:LTSP 015:/home/ltsp015:/bin/bash
ltsp016:x:1016:10000:LTSP 016:/home/ltsp016:/bin/bash
ltsp017:x:1017:10000:LTSP 017:/home/ltsp017:/bin/bash
ltsp018:x:1018:10000:LTSP 018:/home/ltsp018:/bin/bash
ltsp019:x:1019:10000:LTSP 019:/home/ltsp019:/bin/bash
ltsp020:x:1020:10000:LTSP 020:/home/ltsp020:/bin/bash
ltsp021:x:1021:10000:LTSP 021:/home/ltsp021:/bin/bash
ltsp022:x:1022:10000:LTSP 022:/home/ltsp022:/bin/bash
ltsp023:x:1023:10000:LTSP 023:/home/ltsp023:/bin/bash
ltsp024:x:1024:10000:LTSP 024:/home/ltsp024:/bin/bash
ltsp025:x:1025:10000:LTSP 025:/home/ltsp025:/bin/bash
ltsp026:x:1026:10000:LTSP 026:/home/ltsp026:/bin/bash
ltsp027:x:1027:10000:LTSP 027:/home/ltsp027:/bin/bash
ltsp028:x:1028:10000:LTSP 028:/home/ltsp028:/bin/bash
ltsp029:x:1029:10000:LTSP 029:/home/ltsp029:/bin/bash
root@ubuntu:~#

LTSP5-palvelin - PAM

root@ubuntu:/etc/pam.d# cat common-auth
#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
#auth   requisite       pam_unix.so nullok_secure
#auth   optional        pam_smbpass.so migrate missingok

### PAIKALLISET HAKEMISTOT
#auth       required     pam_env.so
#auth       sufficient   pam_unix.so likeauth nullok try_first_pass
#auth       sufficient   pam_ldap.so use_first_pass
#auth       required     pam_deny.so


### NFS-HAKEMISTOT
auth       required     pam_mount.so
auth       required     pam_env.so
auth       sufficient   pam_unix.so likeauth nullok use_first_pass
auth       sufficient   pam_ldap.so try_first_pass
auth       required     pam_deny.so


root@ubuntu:/etc/pam.d#

root@ubuntu:/etc/pam.d# cat common-account
#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
#account        required        pam_unix.so

account    sufficient   pam_unix.so
account    sufficient   pam_ldap.so

root@ubuntu:/etc/pam.d#

root@ubuntu:/etc/pam.d# cat common-account
#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
#account        required        pam_unix.so

account    sufficient   pam_unix.so
account    sufficient   pam_ldap.so

root@ubuntu:/etc/pam.d#

root@ubuntu:/etc/pam.d# cat common-session
#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).  The default is pam_unix.
#
#session        required        pam_unix.so

### PAIKALLISET HAKEMISTOT
#session    required     pam_limits.so
#session    required     pam_unix.so
##Creates the home directories if they do not exist
#session    required     pam_mkhomedir.so skel=/etc/skel/ umask=0022
#session    optional     pam_ldap.so


### NFS
session    required     pam_limits.so
session    required     pam_unix.so
session    optional     pam_mount.so shadow md5 use_authtok
session    optional     pam_ldap.so


root@ubuntu:/etc/pam.d#

openLDAP-palvelin, verkkoasetukset - 192.168.1.102

root@ubuntu:~# cat /etc/network/interfaces
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
        address 192.168.1.102
        netmask 255.255.255.0
        network 192.168.1.0
        broadcast 192.168.1.255
        gateway 192.168.1.1
        # dns-* options are implemented by the resolvconf package, if installed
        dns-nameservers 192.168.1.1
root@ubuntu:~#

openLDAP-asetustiedostot

openLDAP-puurakenne

 dc=fi
 |
 dc=ubuntu----|
 |            |
 ou=Users     ou=Groups
 |            |          
 |            cn=Users
 |
 cn=ltsp001 ...

Näistä tiedostoista on poistettu osa kommenttiriveistä, #-merkillä alkavat, luettavuuden parantamiseksi.

LTSP5-palvelimen pääkäyttäjän tunnus on itse palvelimella eli passwd-tiedostossa.

root@ubuntu:~# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
[--]
admin-ubuntu:x:1000:1000:Administrator Ubuntu,,,:/root/admin-ubuntu:/bin/bash
[--]
root@ubuntu:~#

/etc/ldap/slapd.conf

Tämä konfiguraatiotiedosto määrittää LDAP-palvelimen asetukset. Konfiguraatio mm. sisältää LDAPin hallinnoijan tunnuksen (rootdn) sekä salasanan kryptatussa muodossa.

root@ubuntu:~# cat /etc/ldap/slapd.conf
####################
# Global Directives:

# Schema and objectClass definitions
include         /etc/ldap/schema/core.schema
include         /etc/ldap/schema/cosine.schema
include         /etc/ldap/schema/nis.schema
include         /etc/ldap/schema/inetorgperson.schema

pidfile         /var/run/slapd/slapd.pid

argsfile        /var/run/slapd/slapd.args

loglevel        none

modulepath      /usr/lib/ldap
moduleload      back_hdb

sizelimit 500

tool-threads 1

######################################
# Specific Backend Directives for hdb:
# Backend specific directives apply to this backend until another
# 'backend' directive occurs
backend         hdb

###################################################
# Specific Directives for database #1, of type hdb:
# Database specific directives apply to this databasse until another
# 'database' directive occurs
database        hdb

# The base of your directory in database #1
suffix          "dc=ubuntu,dc=fi"

# rootdn directive for specifying a superuser on the database. This is needed
# for syncrepl.
rootdn          "cn=manager,dc=ubuntu,dc=fi"

# Where the database file are physically stored for database #1
directory       "/var/lib/ldap"

password-hash   {crypt}
rootpw {MD5}gonsh+ULQWhKd6JXdMo4kQ==

# For the Debian package we use 2MB as default but be sure to update this
# value if you have plenty of RAM
dbconfig set_cachesize 0 2097152 0

# Number of objects that can be locked at the same time.
dbconfig set_lk_max_objects 1500

# Number of locks (both requested and granted)
dbconfig set_lk_max_locks 1500

# Number of lockers
dbconfig set_lk_max_lockers 1500

# Indexing options for database #1
index           objectClass eq

# Save the time that the entry gets modified, for database #1
lastmod         on

# Checkpoint the BerkeleyDB database periodically in case of system
# failure and to speed slapd shutdown.
checkpoint      512 30

# Where to store the replica logs for database #1
# replogfile    /var/lib/ldap/replog

# The userPassword by default can be changed
# by the entry owning it if they are authenticated.
# Others should not be able to see it, except the
# admin entry below
# These access lines apply to database #1 only
access to attrs=userPassword,shadowLastChange
        by dn="cn=manager,dc=ubuntu,dc=fi" write
        by anonymous auth
        by self write
        by * none

# Ensure read access to the base for things like
# supportedSASLMechanisms.  Without this you may
# have problems with SASL not knowing what
# mechanisms are available and the like.
# Note that this is covered by the 'access to *'
# ACL below too but if you change that as people
# are wont to do you'll still need this if you
# want SASL (and possible other things) to work 
# happily.
access to dn.base="" by * read

# The admin dn has full write access, everyone else
# can read everything.
access to *
        by dn="cn=manager,dc=ubuntu,dc=fi" write
        by * read

root@ubuntu:~#

/root/base.ldif

Tämä tiedosto sisältää juurirakenteen (sekä yhden testikäyttäjän). Missä komento jolla se ladataan? Voiko latauksen tai rakenteen määrityksen tehdä webminillä?

root@ubuntu:~# cat /root/base.ldif
dn: dc=ubuntu,dc=fi
objectclass: organization
objectclass: dcObject
o: LTSP-paja
dc: ubuntu
description: LTSP-tyopajan oma domain

dn: ou=Hosts,dc=ubuntu,dc=fi
ou: Hosts
objectClass: top
objectClass: organizationalUnit
objectClass: domainRelatedObject
associatedDomain: paja

dn: ou=People,dc=ubuntu,dc=fi
ou: People
objectClass: top
objectClass: organizationalUnit
objectClass: domainRelatedObject
associatedDomain: paja

dn: ou=Groups,dc=ubuntu,dc=fi
ou: Groups
objectClass: top
objectClass: organizationalUnit
objectClass: domainRelatedObject
associatedDomain: paja

dn: uid=ltsp001,ou=People,dc=ubuntu,dc=fi
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: ltsp001
sn: Doe
givenName: John
cn: John Doe
displayName: John Doe
uidNumber: 1000
gidNumber: 10000
userPassword: edubuntu
gecos: John Doe
loginShell: /bin/bash
homeDirectory: /home/ltsp001
shadowExpire: -1
shadowFlag: 0
shadowWarning: 7
shadowMin: 8
shadowMax: 999999
shadowLastChange: 10877
mail: john.doe@example.com
postalCode: 31000
l: Valamo
o: LTSP-paja
mobile: +33 (0)6 xx xx xx xx
homePhone: +33 (0)5 xx xx xx xx
title: Teppo Testaaja
postalAddress: 
initials: JD

dn: cn=users,ou=Groups,dc=ubuntu,dc=fi
objectClass: posixGroup
cn: users
gidNumber: 10000

root@ubuntu:~#

Webmin - webmin-openldap-users.txt

Uusia käyttäjiä voi ladata Webminillä.

create:ltsp001:edubuntu:1001:10000:LTSP 001:/home/ltsp001:/bin/bash:::::
create:ltsp002:edubuntu:1002:10000:LTSP 002:/home/ltsp002:/bin/bash:::::
create:ltsp003:edubuntu:1003:10000:LTSP 003:/home/ltsp003:/bin/bash:::::
create:ltsp004:edubuntu:1004:10000:LTSP 004:/home/ltsp004:/bin/bash:::::
create:ltsp005:edubuntu:1005:10000:LTSP 005:/home/ltsp005:/bin/bash:::::
create:ltsp006:edubuntu:1006:10000:LTSP 006:/home/ltsp006:/bin/bash:::::
create:ltsp007:edubuntu:1007:10000:LTSP 007:/home/ltsp007:/bin/bash:::::
create:ltsp008:edubuntu:1008:10000:LTSP 008:/home/ltsp008:/bin/bash:::::
create:ltsp009:edubuntu:1009:10000:LTSP 009:/home/ltsp009:/bin/bash:::::
create:ltsp010:edubuntu:1010:10000:LTSP 010:/home/ltsp010:/bin/bash:::::
create:ltsp011:edubuntu:1011:10000:LTSP 011:/home/ltsp011:/bin/bash:::::
create:ltsp012:edubuntu:1012:10000:LTSP 012:/home/ltsp012:/bin/bash:::::
create:ltsp013:edubuntu:1013:10000:LTSP 013:/home/ltsp013:/bin/bash:::::
create:ltsp014:edubuntu:1014:10000:LTSP 014:/home/ltsp014:/bin/bash:::::
create:ltsp015:edubuntu:1015:10000:LTSP 015:/home/ltsp015:/bin/bash:::::
create:ltsp016:edubuntu:1016:10000:LTSP 016:/home/ltsp016:/bin/bash:::::
create:ltsp017:edubuntu:1017:10000:LTSP 017:/home/ltsp017:/bin/bash:::::
create:ltsp018:edubuntu:1018:10000:LTSP 018:/home/ltsp018:/bin/bash:::::
create:ltsp019:edubuntu:1019:10000:LTSP 019:/home/ltsp019:/bin/bash:::::
create:ltsp020:edubuntu:1020:10000:LTSP 020:/home/ltsp020:/bin/bash:::::
create:ltsp021:edubuntu:1021:10000:LTSP 021:/home/ltsp021:/bin/bash:::::
create:ltsp022:edubuntu:1022:10000:LTSP 022:/home/ltsp022:/bin/bash:::::
create:ltsp023:edubuntu:1023:10000:LTSP 023:/home/ltsp023:/bin/bash:::::
create:ltsp024:edubuntu:1024:10000:LTSP 024:/home/ltsp024:/bin/bash:::::
create:ltsp025:edubuntu:1025:10000:LTSP 025:/home/ltsp025:/bin/bash:::::
create:ltsp026:edubuntu:1026:10000:LTSP 026:/home/ltsp026:/bin/bash:::::
create:ltsp027:edubuntu:1027:10000:LTSP 027:/home/ltsp027:/bin/bash:::::
create:ltsp028:edubuntu:1028:10000:LTSP 028:/home/ltsp028:/bin/bash:::::
create:ltsp029:edubuntu:1029:10000:LTSP 029:/home/ltsp029:/bin/bash:::::

/etc/ldap/ldap.conf

Tämä konfiguraatio on openLDAP-asiakasta varten (ldapsearch).

root@ubuntu:~# cat /etc/ldap/ldap.conf
###############
# LDAP Defaults
# See ldap.conf(5) for details
# This file should be world readable but not world writable.

BASE    dc=ubuntu,dc=fi
URI     ldap://192.168.1.102

root@ubuntu:~#

/usr/bin/ldapsearch

Testataan saadaanko tietoja palvelimelta.

root@ubuntu:~# ldapsearch -x -D "cn=manager,dc=ubuntu,dc=fi" -W > ldapsearch.txt

# extended LDIF
#
# LDAPv3
# base <dc=ubuntu,dc=fi> (default) with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# ubuntu.fi
dn: dc=ubuntu,dc=fi
objectClass: organization
objectClass: dcObject
o: LTSP-paja
dc: ubuntu
description: LTSP-tyopajan oma domain

# Hosts, ubuntu.fi
dn: ou=Hosts,dc=ubuntu,dc=fi
ou: Hosts
objectClass: top
objectClass: organizationalUnit
objectClass: domainRelatedObject
associatedDomain: paja

# People, ubuntu.fi
dn: ou=People,dc=ubuntu,dc=fi
ou: People
objectClass: top
objectClass: organizationalUnit
objectClass: domainRelatedObject
associatedDomain: paja

# Groups, ubuntu.fi
dn: ou=Groups,dc=ubuntu,dc=fi
ou: Groups
objectClass: top
objectClass: organizationalUnit
objectClass: domainRelatedObject
associatedDomain: paja

# users, Groups, ubuntu.fi
dn: cn=users,ou=Groups,dc=ubuntu,dc=fi
objectClass: posixGroup
cn: users
gidNumber: 10000

# ltsp001, People, ubuntu.fi
dn: uid=ltsp001,ou=People,dc=ubuntu,dc=fi
cn: LTSP 001
uid: ltsp001
uidNumber: 1001
loginShell: /bin/bash
homeDirectory: /home/ltsp001
gidNumber: 10000
userPassword:: e2NyeXB0fVNNWEZodUZEeWh2M1k=
shadowLastChange: 14252
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
objectClass: person
sn: LTSP 001

# ltsp002, People, ubuntu.fi
dn: uid=ltsp002,ou=People,dc=ubuntu,dc=fi
cn: LTSP 002
uid: ltsp002
uidNumber: 1002
loginShell: /bin/bash
homeDirectory: /home/ltsp002
gidNumber: 10000
userPassword:: e2NyeXB0fUhRbUpjWkxBSFNMNW8=
shadowLastChange: 14252
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
objectClass: person
sn: LTSP 002

[--]

# ltsp029, People, ubuntu.fi
dn: uid=ltsp029,ou=People,dc=ubuntu,dc=fi
cn: LTSP 029
uid: ltsp029
uidNumber: 1029
loginShell: /bin/bash
homeDirectory: /home/ltsp029
gidNumber: 10000
userPassword:: e2NyeXB0fVdHbFhRRDZrVmFrTlE=
shadowLastChange: 14252
objectClass: posixAccount
objectClass: shadowAccount
objectClass: inetOrgPerson
objectClass: person
sn: LTSP 029

# search result
search: 2
result: 0 Success

# numResponses: 35
# numEntries: 34

-  ⇤ ← Revision 27 as of 2009-01-22 08:21:47 → 
  Size: 24576
  Editor: AsmoKoskinen
  Comment:
+   ← Revision 34 as of 2009-01-22 08:53:32 → ⇥
  Size: 23967
  Editor: AsmoKoskinen
  Comment:
-Deletions are marked like this.
+Additions are marked like this.
 Line 6:
+----
@ Mikael: teen vielä tämän päivän (22.1) näitä siirroksia asetustiedostoista, lisäksi käytän kummankin koneen bash_history-tiedostoja, joista yritän nähdä mitä kulloinkin teit, sieltä saan myös komentorivikäskyjä, joita käytit. Laita huomenna (23.1) omat kommenttisi ja korjauksesi tänne sekaan. Kun saamme tämän jotenkin kasaan, niin yritän tämän pohjalta tehdä vielä puhtaan openLDAP-asennusken LTSP5:n jatkoksi. Kiitos, Asmo.
----
-Line 111:
+Line 115:
-root@ubuntu:/etc# cat ldap.conf
+root@ubuntu:~# cat /etc/ldap.conf
-Line 120:
+Line 124:
-#
# @(#)$Id: ldap.conf,v 1.38 2006/05/15 08:13:31 lukeh Exp $
#
# This is the configuration file for the LDAP nameservice
# switch library and the LDAP PAM module.
#
# PADL Software
# http://www.padl.com
#

# Your LDAP server. Must be resolvable without using LDAP.
# Multiple hosts may be specified, each separated by a 
# space. How long nss_ldap takes to failover depends on
# whether your LDAP client library supports configurable
# network or connect timeouts (see bind_timelimit).
#host 127.0.0.1
-Line 142:
+Line 129:
-# Unix Domain Sockets to connect to a local LDAP Server.
#uri ldap://127.0.0.1/
#uri ldaps://127.0.0.1/   
#uri ldapi://%2fvar%2frun%2fldapi_sock/
# Note: %2f encodes the '/' used as directory separator
-Line 151:
+Line 133:
-# The distinguished name to bind to the server with.
# Optional: default is to bind anonymously.
#binddn cn=proxyuser,dc=padl,dc=com

# The credentials to bind with. 
# Optional: default is no credential.
#bindpw secret
-Line 165:
+Line 139:
-# The port.
# Optional: default is 389.
#port 389

# The search scope.
#scope sub
#scope one
#scope base

# Search timelimit
#timelimit 30

# Bind/connect timelimit
#bind_timelimit 30

# Reconnect policy: hard (default) will retry connecting to
# the software with exponential backoff, soft will fail
# immediately.
#bind_policy hard

# Idle timelimit; client will close connections
# (nss_ldap only) if the server has not been contacted
# for the number of seconds specified below.
#idle_timelimit 3600

# Filter to AND with uid=%s
#pam_filter objectclass=account

# The user ID attribute (defaults to uid)
#pam_login_attribute uid

# Search the root DSE for the password policy (works
# with Netscape Directory Server)
#pam_lookup_policy yes

# Check the 'host' attribute for access control
# Default is no; if set to yes, and user has no
# value for the host attribute, and pam_ldap is
# configured for account management (authorization)
# then the user will not be allowed to login.
#pam_check_host_attr yes

# Check the 'authorizedService' attribute for access
# control
# Default is no; if set to yes, and the user has no
# value for the authorizedService attribute, and
# pam_ldap is configured for account management
# (authorization) then the user will not be allowed
# to login.
#pam_check_service_attr yes

# Group to enforce membership of
#pam_groupdn cn=PAM,ou=Groups,dc=padl,dc=com

# Group member attribute
#pam_member_attribute uniquemember

# Specify a minium or maximum UID number allowed
#pam_min_uid 0
#pam_max_uid 0

# Template login attribute, default template user
# (can be overriden by value of former attribute
# in user's entry)
#pam_login_attribute userPrincipalName
#pam_template_login_attribute uid
#pam_template_login nobody

# HEADS UP: the pam_crypt, pam_nds_passwd,
# and pam_ad_passwd options are no
# longer supported.
#
-Line 242:
+Line 144:
-# Hash password locally; required for University of
# Michigan LDAP server, and works with Netscape
# Directory Server if you're using the UNIX-Crypt
# hash mechanism and not using the NT Synchronization
# service. 
#pam_password crypt

# Remove old password first, then update in
# cleartext. Necessary for use with Novell
# Directory Services (NDS)
#pam_password clear_remove_old
#pam_password nds

# RACF is an alias for the above. For use with
# IBM RACF
#pam_password racf

# Update Active Directory password, by
# creating Unicode password and updating
# unicodePwd attribute.
#pam_password ad

# Use the OpenLDAP password change
# extended operation to update the password.
#pam_password exop

# Redirect users to a URL or somesuch on password
# changes.
#pam_password_prohibit_message Please visit http://internal to change your password.

# RFC2307bis naming contexts
# Syntax:
# nss_base_XXX		base?scope?filter
# where scope is {base,one,sub}
# and filter is a filter to be &'d with the
# default filter.
# You can omit the suffix eg:
# nss_base_passwd	ou=People,
# to append the default base DN but this
# may incur a small performance impact.
#nss_base_passwd	ou=People,dc=padl,dc=com?one
#nss_base_shadow	ou=People,dc=padl,dc=com?one
#nss_base_group		ou=Group,dc=padl,dc=com?one
#nss_base_hosts		ou=Hosts,dc=padl,dc=com?one
#nss_base_services	ou=Services,dc=padl,dc=com?one
#nss_base_networks	ou=Networks,dc=padl,dc=com?one
#nss_base_protocols	ou=Protocols,dc=padl,dc=com?one
#nss_base_rpc		ou=Rpc,dc=padl,dc=com?one
#nss_base_ethers	ou=Ethers,dc=padl,dc=com?one
#nss_base_netmasks	ou=Networks,dc=padl,dc=com?ne
#nss_base_bootparams	ou=Ethers,dc=padl,dc=com?one
#nss_base_aliases	ou=Aliases,dc=padl,dc=com?one
#nss_base_netgroup	ou=Netgroup,dc=padl,dc=com?one

# attribute/objectclass mapping
# Syntax:
#nss_map_attribute	rfc2307attribute	mapped_attribute
#nss_map_objectclass	rfc2307objectclass	mapped_objectclass

# configure --enable-nds is no longer supported.
# NDS mappings
#nss_map_attribute uniqueMember member

# Services for UNIX 3.5 mappings
#nss_map_objectclass posixAccount User
#nss_map_objectclass shadowAccount User
#nss_map_attribute uid msSFU30Name
#nss_map_attribute uniqueMember msSFU30PosixMember
#nss_map_attribute userPassword msSFU30Password
#nss_map_attribute homeDirectory msSFU30HomeDirectory
#nss_map_attribute homeDirectory msSFUHomeDirectory
#nss_map_objectclass posixGroup Group
#pam_login_attribute msSFU30Name
#pam_filter objectclass=User
#pam_password ad

# configure --enable-mssfu-schema is no longer supported.
# Services for UNIX 2.0 mappings
#nss_map_objectclass posixAccount User
#nss_map_objectclass shadowAccount user
#nss_map_attribute uid msSFUName
#nss_map_attribute uniqueMember posixMember
#nss_map_attribute userPassword msSFUPassword
#nss_map_attribute homeDirectory msSFUHomeDirectory
#nss_map_attribute shadowLastChange pwdLastSet
#nss_map_objectclass posixGroup Group
#nss_map_attribute cn msSFUName
#pam_login_attribute msSFUName
#pam_filter objectclass=User
#pam_password ad

# RFC 2307 (AD) mappings
#nss_map_objectclass posixAccount user
#nss_map_objectclass shadowAccount user
#nss_map_attribute uid sAMAccountName
#nss_map_attribute homeDirectory unixHomeDirectory
#nss_map_attribute shadowLastChange pwdLastSet
#nss_map_objectclass posixGroup group
#nss_map_attribute uniqueMember member
#pam_login_attribute sAMAccountName
#pam_filter objectclass=User
#pam_password ad

# configure --enable-authpassword is no longer supported
# AuthPassword mappings
#nss_map_attribute userPassword authPassword

# AIX SecureWay mappings
#nss_map_objectclass posixAccount aixAccount
#nss_base_passwd ou=aixaccount,?one
#nss_map_attribute uid userName
#nss_map_attribute gidNumber gid
#nss_map_attribute uidNumber uid
#nss_map_attribute userPassword passwordChar
#nss_map_objectclass posixGroup aixAccessGroup
#nss_base_group ou=aixgroup,?one
#nss_map_attribute cn groupName
#nss_map_attribute uniqueMember member
#pam_login_attribute userName
#pam_filter objectclass=aixAccount
#pam_password clear

# Netscape SDK LDAPS
#ssl on

# Netscape SDK SSL options
#sslpath /etc/ssl/certs

# OpenLDAP SSL mechanism
# start_tls mechanism uses the normal LDAP port, LDAPS typically 636
#ssl start_tls
#ssl on

# OpenLDAP SSL options
# Require and verify server certificate (yes/no)
# Default is to use libldap's default behavior, which can be configured in
# /etc/openldap/ldap.conf using the TLS_REQCERT setting.  The default for
# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".
#tls_checkpeer yes

# CA certificates for server certificate verification
# At least one of these are required if tls_checkpeer is "yes"
#tls_cacertfile /etc/ssl/ca.cert
#tls_cacertdir /etc/ssl/certs

# Seed the PRNG if /dev/urandom is not provided
#tls_randfile /var/run/egd-pool

# SSL cipher suite
# See man ciphers for syntax
#tls_ciphers TLSv1

# Client certificate and key
# Use these, if your server requires client authentication.
#tls_cert
#tls_key

# Disable SASL security layers. This is needed for AD.
#sasl_secprops maxssf=0

# Override the default Kerberos ticket cache location.
#krb5_ccname FILE:/etc/.ldapcache

# SASL mechanism for PAM authentication - use is experimental
# at present and does not support password policy control
#pam_sasl_mech DIGEST-MD5
-Line 409:
+Line 145:
-Line 416:
+Line 153:
+}}}

{{{
root@ubuntu:~# cat /etc/nsswitch.conf
####################
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat ldap
group:          compat ldap
shadow:         compat ldap

hosts:          files mdns4_minimal [NOTFOUND=return] dns mdns4
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis
root@ubuntu:~#
}}}

{{{
root@ubuntu:~# getent passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
dhcp:x:101:102::/nonexistent:/bin/false
syslog:x:102:103::/home/syslog:/bin/false
klog:x:103:104::/home/klog:/bin/false
hplip:x:104:7:HPLIP system user,,,:/var/run/hplip:/bin/false
avahi-autoipd:x:105:113:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/bin/false
gdm:x:106:114:Gnome Display Manager:/var/lib/gdm:/bin/false
pulse:x:107:116:PulseAudio daemon,,,:/var/run/pulse:/bin/false
messagebus:x:108:119::/var/run/dbus:/bin/false
avahi:x:109:120:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/bin/false
polkituser:x:110:122:PolicyKit,,,:/var/run/PolicyKit:/bin/false
haldaemon:x:111:123:Hardware abstraction layer,,,:/var/run/hald:/bin/false
dhcpd:x:112:124::/nonexistent:/bin/false
nbd:x:113:125::/etc/nbd-server:/bin/false
sshd:x:114:65534::/var/run/sshd:/usr/sbin/nologin
admin-ubuntu:x:1000:1000:Administrator Ubuntu,,,:/root/admin-ubuntu:/bin/bash
nx:x:115:127:FreeNX Server,,,:/var/lib/nxserver/home/:/usr/bin/nxserver
ntp:x:116:128::/home/ntp:/bin/false
statd:x:117:65534::/var/lib/nfs:/bin/false
ltsp001:x:1001:10000:LTSP 001:/home/ltsp001:/bin/bash
ltsp002:x:1002:10000:LTSP 002:/home/ltsp002:/bin/bash
ltsp003:x:1003:10000:LTSP 003:/home/ltsp003:/bin/bash
ltsp004:x:1004:10000:LTSP 004:/home/ltsp004:/bin/bash
ltsp005:x:1005:10000:LTSP 005:/home/ltsp005:/bin/bash
ltsp006:x:1006:10000:LTSP 006:/home/ltsp006:/bin/bash
ltsp007:x:1007:10000:LTSP 007:/home/ltsp007:/bin/bash
ltsp008:x:1008:10000:LTSP 008:/home/ltsp008:/bin/bash
ltsp009:x:1009:10000:LTSP 009:/home/ltsp009:/bin/bash
ltsp010:x:1010:10000:LTSP 010:/home/ltsp010:/bin/bash
ltsp011:x:1011:10000:LTSP 011:/home/ltsp011:/bin/bash
ltsp012:x:1012:10000:LTSP 012:/home/ltsp012:/bin/bash
ltsp013:x:1013:10000:LTSP 013:/home/ltsp013:/bin/bash
ltsp014:x:1014:10000:LTSP 014:/home/ltsp014:/bin/bash
ltsp015:x:1015:10000:LTSP 015:/home/ltsp015:/bin/bash
ltsp016:x:1016:10000:LTSP 016:/home/ltsp016:/bin/bash
ltsp017:x:1017:10000:LTSP 017:/home/ltsp017:/bin/bash
ltsp018:x:1018:10000:LTSP 018:/home/ltsp018:/bin/bash
ltsp019:x:1019:10000:LTSP 019:/home/ltsp019:/bin/bash
ltsp020:x:1020:10000:LTSP 020:/home/ltsp020:/bin/bash
ltsp021:x:1021:10000:LTSP 021:/home/ltsp021:/bin/bash
ltsp022:x:1022:10000:LTSP 022:/home/ltsp022:/bin/bash
ltsp023:x:1023:10000:LTSP 023:/home/ltsp023:/bin/bash
ltsp024:x:1024:10000:LTSP 024:/home/ltsp024:/bin/bash
ltsp025:x:1025:10000:LTSP 025:/home/ltsp025:/bin/bash
ltsp026:x:1026:10000:LTSP 026:/home/ltsp026:/bin/bash
ltsp027:x:1027:10000:LTSP 027:/home/ltsp027:/bin/bash
ltsp028:x:1028:10000:LTSP 028:/home/ltsp028:/bin/bash
ltsp029:x:1029:10000:LTSP 029:/home/ltsp029:/bin/bash
root@ubuntu:~#
}}}

== LTSP5-palvelin - PAM ==

{{{
root@ubuntu:/etc/pam.d# cat common-auth
#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
#
#auth   requisite       pam_unix.so nullok_secure
#auth   optional        pam_smbpass.so migrate missingok

### PAIKALLISET HAKEMISTOT
#auth       required     pam_env.so
#auth       sufficient   pam_unix.so likeauth nullok try_first_pass
#auth       sufficient   pam_ldap.so use_first_pass
#auth       required     pam_deny.so


### NFS-HAKEMISTOT
auth       required     pam_mount.so
auth       required     pam_env.so
auth       sufficient   pam_unix.so likeauth nullok use_first_pass
auth       sufficient   pam_ldap.so try_first_pass
auth       required     pam_deny.so


root@ubuntu:/etc/pam.d#
}}}

{{{
root@ubuntu:/etc/pam.d# cat common-account
#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
#account        required        pam_unix.so

account    sufficient   pam_unix.so
account    sufficient   pam_ldap.so

root@ubuntu:/etc/pam.d#
}}}

{{{
root@ubuntu:/etc/pam.d# cat common-account
#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
#account        required        pam_unix.so

account    sufficient   pam_unix.so
account    sufficient   pam_ldap.so

root@ubuntu:/etc/pam.d#
}}}

{{{
root@ubuntu:/etc/pam.d# cat common-session
#
# /etc/pam.d/common-session - session-related modules common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of modules that define tasks to be performed
# at the start and end of sessions of *any* kind (both interactive and
# non-interactive).  The default is pam_unix.
#
#session        required        pam_unix.so

### PAIKALLISET HAKEMISTOT
#session    required     pam_limits.so
#session    required     pam_unix.so
##Creates the home directories if they do not exist
#session    required     pam_mkhomedir.so skel=/etc/skel/ umask=0022
#session    optional     pam_ldap.so


### NFS
session    required     pam_limits.so
session    required     pam_unix.so
session    optional     pam_mount.so shadow md5 use_authtok
session    optional     pam_ldap.so


root@ubuntu:/etc/pam.d#
-Line 453:
+Line 386:
- |            cn=users
+ |            cn=Users