OpenLDAP Server Configuration on RHEL 7 / CentOS 7

Step 1: Install the following packages:

# yum install -y openldap openldap-clients openldap-servers migrationtools

Step 2: Generate a LDAP encrypted password for Manager user  (here redhat):

# slappasswd -s redhat -n > /etc/openldap/secret-passwd

Step 3: Configure OpenLDAP Server: 

#vim /etc/openldap/slapd.d/"cn=config"/"olcDatabase={2}bdb.ldif"

#do the following changes

olcSuffix: dc=example,dc=com

olcRootDN: cn=Manager,dc=example,dc=com

olcRootPW: PASTE YOUR ENCRYPTED PASSWORD HERE from /etc/openldap/secret-passwd

olcTLSCertificateFile: /etc/pki/CA/cacert.pem

olcTLSCertificateKeyFile: /etc/pki/CA/private/cakey.pem

:wq (save abd exit)

Step 4: Configure Monitoring Database Configuration file: 

#vim /etc/openldap/slapd.d/"cn=config"/"olcDatabase={1}monitor.ldif"

#do the following change

olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=example,dc=com" read by * none


:wq (save and exit)

Step 5: Generate a X509 self sign certificate which is valid for 365 days:

# openssl req -new -x509 -nodes -out /etc/pki/CA/cacert.pem -keyout /etc/pki/CA/private/cakey.pem -days 365

Country Name (2 letter code) [XX]: IN

State or Province Name (full name) []: Delhi

Locality Name (eg, city) [Default City]: New Delhi

Organization Name (eg, company) [Default Company Ltd]: Example, Inc.

Organizational Unit Name (eg, section) []: Training

Common Name (eg, your name or your server's hostname) []:server1.example.com

Email Address []: root@server1.example.com

Step 6: Secure the content of the /etc/pki/CA/ directory:

# cd /etc/pki/CA/

# chown ldap:ldap cacert.pem

 # cd /etc/pki/CA/private/

# chown ldap:ldap cakey.pem

# chmod 600 cakey.pem

Step 7: Prepare the LDAP database:


# cp -rvf /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

# chown -R ldap:ldap /var/lib/ldap/

Step 8: Enable LDAPS: 

#vim /etc/sysconfig/slapd

 #Do the following changes

SLAPD_URLS="ldapi:///   ldap:///   ldaps:///"

:wq (save and exit)


Step 9: Test the configuration:

# slaptest -u

Step 10: Start and enable the slapd service at boot: 

# systemctl start slapd

# systemctl enable slapd

Step 11: Check the LDAP activity:

# netstat -lt | grep ldap

#netstat -tunlp | egrep "389|636"


Step 12: To start the configuration of the LDAP server, add the follwing LDAP schemas:

# cd /etc/openldap/schema

# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f cosine.ldif

# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f nis.ldif

# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f collective.ldif

# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f corba.ldif

# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f core.ldif

# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f duaconf.ldif

# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f dyngroup.ldif

# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f inetorgperson.ldif

# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f java.ldif

# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f misc.ldif

# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f openldap.ldif

# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f pmi.ldif

# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f ppolicy.ldif

                        ##################################################
                        # NOTE-: You can add schema files according to your need: #
                        ##################################################

Step 13: Now use Migration Tools to create LDAP DIT: 

# cd /usr/share/migrationtools

# vim migrate_common.ph

#do the following chnages

on the Line Number 61, change "ou=Groups"
 $NAMINGCONTEXT{'group'}             = "ou=Groups";

on the Line Number 71, change your domain name
$DEFAULT_MAIL_DOMAIN = "example.com";

on the line number 74, change your base name
         $DEFAULT_BASE = "dc=example,dc=com";

on the line number 90, change schema value
$EXTENDED_SCHEMA = 1;


:wq (save and exit)

Step 14: Generate a base.ldif file for your Domain DIT: 

#./migrate_base.pl > /root/base.ldif

Step 15: Load "base.ldif" into LDAP Database: 

#ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f /root/base.ldif

Step 16: Now Create some users and Groups and migrate it from local database to LDAP database: 

#mkdir /home/guests
#useradd -d /home/guests/ldapuser1 ldapuser1
#useradd -d /home/guests/ldapuser2 ldapuser2
#useradd -d /home/guests/ldapuser3 ldapuser3
#useradd -d /home/guests/ldapuser4 ldapuser4
#useradd -d /home/guests/ldapuser5 ldapuser5

#echo 'password' | passwd --stdin ldapuser1
#echo 'password' | passwd --stdin ldapuser2
#echo 'password' | passwd --stdin ldapuser3
#echo 'password' | passwd --stdin ldapuser4
#echo 'password' | passwd --stdin ldapuser5

Step 17: Now filter out these Users and Groups and it password from /etc/shadow to different file: 

#getent passwd | tail -n 5 > /root/users

#getent shadow | tail -n 5 > /root/shadow

# getent group | tail -n 5 > /root/groups

Step 18: Now you can delete these users from local database: 

#userdel ldapuser1
#userdel ldapuser2
#userdel ldapuser3
#userdel ldapuser4
#userdel ldapuser5

Step 19: Now you need to create ldif file for these users using migrationtools: 

# cd /usr/share/migrationtools/

# vim migrate_passwd.pl

#search /etc/shadow and replace it into /root/shadow on Line Number 188.

:wq (save and exit)

# ./migrate_passwd.pl /root/users > /root/users.ldif

# ./migrate_group.pl /root/groups > /root/groups.ldif

Step 20: Upload these users and groups ldif file into LDAP Database: 

# ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f /root/users.ldif

# ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f /root/groups.ldif

Step 21: Now search LDAP DIT for all records: 

# ldapsearch -x -b "dc=example,dc=com" -H ldap://server1.example.com

Step 22: Now share ldapusers home directories via NFS: 

#vim /etc/exports

#Add the folloiwng line:

/home/guests    192.168.48.0/255.255.255.0(rw,sync)


:wq (save and exit)

#systemctl start nfs

#systemctl enable nfs

Step 23: Share your CA Certificate to clients via FTP/HTTP: 

#yum install vsftpd httpd -y

# cp -rvf /etc/pki/CA/cacert.pem /var/ftp/pub/

# ln -s /var/ftp/pub/ /var/www/html/

#systemctl start vsftpd

#systemctl enable vsftpd

#systemctl start httpd

#systemctl enable httpd

Step 24: Now Go to the client machine and install the following packages: 

#yum install openldap-clients sssd pam_ldap authconfig-gtk -y

Step 25: Run the "authconfig-gtk" command to configure as a LDAP Client: 

# authconfig-gtk

Click on "Identity & Authentication" Tab

Click on drop down menu in "User Account Database" and Select "LDAP"

in LDAP Search Base DN: dc=example,dc=com

in LDAP Server: ldap://server1.example.com

Select the check Box of "Use TLS to encrypt connections"

Click "Download CA Certificate"

In Certificate URL: type http://server1.example.com/pub/cacert.pem

Authentication Protocol: LDAP Password

Click "OK"


# getent passwd ldapuser1

Step 26: Now Configure your client machine to access ldapusers  home directory from    
                "server1.example.com" 

#yum install autofs -y

#vim /etc/auto.master

#add the following line

/home/guests /etc/auto.guests

:wq (save and exit)

#vim /etc/auto.guests

#add the following line

* -rw server1.example.com:/home/guests/&

:wq (save and exit)

Step 27: Now start and enable autofs service at boot: 

#systemctl restart autofs

#systemctl enable autofs

Step 28: Now try to login as ldapuseer on client machine: 

#ssh ldapuser1@client.example.com

Password: password

[ldapuser1@client.exmaple.com ~]$
 You may have some issue with Firewall/iptables, So add Ports/Services into firewall or disable it. 

 ############Congratulations, You have configured LDAP server and client##############

Comments

Post a Comment

Popular posts from this blog

RHEL 7

RHEL 7 ..... ************************RHCSA Version 7 **************** Initial configuration.txt: *you have been provided a virtual box named as serverX.example.com (hint:where X is your domain number) * password for both virtual machine should be "Postroll" *serverX.example.com provided with ip=172.25.X.10/255.255.255.0 *serverX.example.com are provided with gateway 172.25.254.254 & example.com dns domain with the IP: 172.25.254.254 gateway 172.25.0.1 netmask 255.255.255.0 nameserver 172.25.254.250 1) configure your systems that should be running Enforcing 2) create a new 100MB Physical partition mounted under /Gluster (Note because partition sizes are seldom exactly what is specified when they are created, any thing within the range of 70MB to 120MB is acceptable) 3) create a new 150MB swap partition f/s. (Note because partition sizes are seldom exactly what is specified when they are created, any thing within the range of 13
Read more

Configure TLS SSL 389 Directory Server CentOS

Image
389 Directory server is an amazing MultiMaster LDAP solution. Out of the box 389 is not configured to use TLS/SSL, so we are going to walk through the setup process. Please note, that we are using this as a test, so we are using a self-signed certificate, but the directions should work for both scenarios. login, and su to root Generate the Self-Signed Certificate: change to the necessary directory, and setup a few files for the CA now generate the key/certificate setup your certificate as appropriate set permissions on the cert key now we need to make sure certificate matching is disabled (unless you are using a full cert) modify lines 85-88 as follows: Generate and Self-Sign Certificate launch the 389-console open the directory server you were just working on, and click "Manage Certificates" Servername –> Directory Server –> Manage Certificates set, and REMEMBER
Read more

How to configure apache server in linux

Image
Apache is the most popular, secure, robust, reliable and powerful web server. Apache is used by more websites than all other web servers combined. RHEL6 includes Apache version 2.2 RHCE6 Exam objectives covered in this article HTTP/HTTPS Configure a virtual host. Configure private directories. Deploy a basic CGI application. Configure group-managed content. In this tutorial I will use three systems Server, linuxclient and windowclient from our LAB environment. I will configure Apache Web Server on Server system and test from inuxclient and windowclient system. If you want to check the network topology used in this article please check following article. Lab set up for RHCE 6 practice Installation of Apache Two packages are required for Apache server httpd mod_ssl elinks httpd package install Apache web server. mod_ssl is the additional package which required to create secure websites elinks is the additional package for text based we
Read more