This action might not be possible to undo. Are you sure you want to continue?
\
Part I: Using OpenLDAP on Debian Woody to serve Linux and Samba Users
Note on Debian Sarge: Please check out Part II: OpenLDAP on Debian Pre-Sarge below for some information on LDAP with a pre-release version of Debian 3.1, aka "Debian Sarge".
Table of Contents
For Debian 3.0 aka Debian Woody: Introduction PDF version, Document History, Security Advisory, Licensing, Disclaimer, Original Author, Hosted By External Resources What Is LDAP? Install OpenLDAP Configure OpenLDAP Database Population Start OpenLDAP NSS: Name Service Switch NSS: Introduction NSS: Installation PAM: Pluggable Authentication Module PAM: Introduction PAM: Clients vs. Server Configuration PAM: Installation PAM: Passwords: Facts PAM: Passwords: How To Change Them PAM: The user "root" and other system UIDs Host Specific Access Introduction Approach 1: pam_check_host_attr Approach 2: Filters SSL Encryption Activate SSL Encryption for the Clients’ Queries OpenLDAP Startup Script So Far So Good, Part 1 Migrate Your Linux Users
Migrate Linux: Prerequisites Migrate Linux: The Scripts Samba 2.2.x and LDAP Samba: Introduction Samba: Installation and Setup Samba: Test your Setup Samba: Add (Windows) Users Samba: Migration Summary Samba: Join Windows-Workstations to our Samba-PDC Domain Samba: Join Samba-Workstations to our Samba-PDC Domain Samba: Miscellaneous So Far So Good, Part 2 ToDo: LDAP-Client-Interfaces Directory Administrator GQ ToDo: phpLDAPadmin ToDo: Miscellaneous Miscellaneous For Debian 3.1 aka Debian Sarge pre-release version: Part II: Using OpenLDAP on Debian Sarge to serve Linux Users User Comments: User Comments
Introduction
LDAP is one hell of a tool: it can be used to store any kind of information, starting with your network’s users (which is what we’ll do) and not even ending with your favorite cooking recipes. As LDAP is one hell of a tool, it is all a pain in the you-know-what-I-mean to get to know it and to get it up and running. I spent lots of time with basics just to understand it. One problem for me was, that I didn’t find any good documentation on this topic for a long time. Anyway, here is first of all a small list of IMHO good documentation on this topic as well as my stuff to get it working: OpenLDAP (the software written to host the database and do some other stuff) implements one part of the whole LDAP-specification, AFAICT. We’ll use it to do the major work: host the database. This "LDAP-server" (ldap.subnet.at) will serve to Linux and Windows workstations hosting the local users and corresponding information. Later on, it shall also serve the upcoming new Linux-based mailserver. As Debian GNU/Linux is our distribution of choice, I’ll focus on the description for Debian Woody. Nevertheless, lot’s of stuff is generic material and you should be able to use it on other distributions too.
I’d like to thank all people I know and those I don’t know which made this LDAP solution possible - just to mention a few groups: Debian, OpenLDAP, Samba, #ldap (irc.debian.org), the authors of all these Howto’s and other documentations, package maintainers, etc. etc. etc. Thanks! This document was created during my work as network admin at subnet - platform for media art and experimental technologies. This document’s home is.
PDF version of this document
As Postscript- or PDF-versions of this document have been requested several times: I created this file’s HTML/PHP code directly using vim -- which makes it a bit harder to create a proper PDF document that’s up to date. (If only I knew that this document became this large -- I’d really spent the time to learn DocBook first, or had used LyX -- or whatever.) Still, Andreas Heinzen pointed out to me, how to easily create a PDF version of this document (the latest version is as of June 11, 2005). Many thanks again to Andreas for his work and feedback on this! (Just to let you know - in case you want to do this yourself: Use html2ps and ps2pdf to create the document. Beforehand, the feedback-form and the counter should be removed from the source code.)
Document History
05-09-18: Added comment for correct handling of command-line parameter in tcsh shell. 05-06-11: Added notes on work with Sarge-Pre-Release packages in Part II of this document. Updated the PDF version accordingly. 05-05-08: Uploaded Andreas Heinzen’s PDF version of this document. 04-12-22: Changed the style-sheet to reflect a more common design. Mentioned that Samba packages version 2.2.3a-13 are vulnerable. 04-11-05: Added the section "NSCD and /etc/libnss-ldap.conf" describing some possible security-improvements. 04-10-22: Added a comment about the format of ldap.secret. Use dpkg-buildpackage to compile the Deb-packages (instead of debian/rules directly). 04-09-19: Added a link to Gerald Carter’s LDAP book to the resources section as well as some links in the miscellaneous section. 04-09-02: Eventually, re-compiled and added security-fixed Samba-packages based on version 2.2.3a-13. 04-07-15:
Added and updated some links to LDAP client programs and user-interfaces. 04-03-25: Mention Samba security update (see DSA-463). 04-02-18: Dual-licensed the document under GPL and GFDL. 04-02-09: I’m considering to dual-license the document, adding the GPL as another choice (as Debian considers the GFDL to be a non-free license). Mind: According to the "draft" of the Debian Documentation Policy () the GFDL as is applied here should be considered "free" even for Debian. 03-10-10: Added section "What Is LDAP?". 03-08-29: Added two links to the resources section. 03-08-18: Releasing a security advisory. According changes to the available packages and their descriptions. Minor changes to clear things up. 03-08-13: Add information on how to have Samba automatically create a machine account. (Change script "create-machine-account.sh" for this too.) 03-08-12: Minor changes to clarify things up. Release the document under the GNU Free Documentation License. Add information on the MigrationTools. Add chapter "Miscellaneous". Further minor changes. 03-08-11: "Version 1.0"! Finally, the first official release with only minor ToDo’s left.
Security Advisory
I wouldn’t have thought it to be necessary with a HOWTO, but it is: This section is for security issues coming up.
03-08-18
Overview: The self-compiled Samba packages (DSA-280-1 samba -- buffer overflow) as well as the self-compiled LDAP packages (DSA-227-1 openldap2 -- buffer overflows and other bugs) used in previous versions of this HOWTO unfortunately are based on vulnerable versions of those packages. If you’ve simply downloaded and used the packages from this site, you are strongly encouraged to either recompile them yourself or use the new upgraded packages provided here.
Description: For some reason I did not include "deb-src woody/updates main contrib non-free" in my /etc/apt/sources.list file when initially downloading and compiling the source packages, this means I used Woody’s original packages which meanwhile turned out to be vulnerable here and there.) Mind: As to my knowledge, packages can now be considered "secure" currently. Nevertheless, Today’s security advisory does not mean I necessarily put possibly needed packages up here in the future as well. Don’t rely on this howto, keep track of security issues yourself!
04-03-25
There is a local root exploit in Samba 2.2.3a-12 that is fixed in Woody’s 2.2.3a-13 packages (check out DSA-463). 04-09-02: Recompiled packages based on the fixed version 2.2.3a-13 are provided below now.
04-12-22
Samba 2.2.3a-13 is vulnerable, see DSA-600. I removed the compiled packages, please follow the instructions below to build them yourself.
Licensing
This document is published under the licenses GPL and GFDL (see notes below for details). You may choose, which license to apply.
GNU Free Documentation.
GNU General Public License (GPL)
This document may be.
Norbert Klasen wrote his master thesis "Directory Services for Linux in comparison with Novell NDS and Microsoft Active Directory" about LDAP and similar setups.platform for media art and experimental technologies External Resources If you want to get to know what LDAP is and how its data is organized. Use this at your own risk! Original Author Markus Amersdorfer (markus. While I haven’t read it: Gerald Carter’s LDAP System Administration (ISBN: 1-56592-491-6).x and Implementing Disconnected Authentication and .Part I (Basics). Exim)! Getting LDAP up and running: Torsten Landschoff’s Using LDAP for name resolution is a compressed article that describes LDAP on Debian for NIS-like users (using Debian’s default LDAP packages without recompilations). Learning about LDAP: A really great and short introduction to LDAP by A.at) Hosted by subnet . nor does it necessarily hold correct information..on Debian made simple! by "mawi" does exactly what it says it does :). Exploring LDAP -. Some good articles are over at www. Lot’s of good ideas and fine-tuning. It also links to the author’s more complete 3-part series: Exploring LDAP -. including how to design an LDAP-Tree. 2003.Permission is granted to copy and distribute translations of this document into another language. Here’s a great step-by-step guidance on how to get LDAP up and running on Debian Woody. Postfix. under the above conditions for modified versions. please check out the docs in the following subsection "Learning about LDAP".x is Using OpenLDAP for Authentication.) A step-by-step guidance for Mandrake 9.. Samba & LDAP . Further articles ’round Mandrake and LDAP: Implementing a Samba LDAP Primary Domain Controller Setup on Mandrake 9. Disclaimer This document comes without any warranty and does not claim to be complete. The author(s) can not be held reliable for any loss of data or corrupted hardware or any other miscomfort due to information of this document. Frisch. Great! (Thanks to "mawi".amersdorfer <at> subnet.org. comment from Aug 26.Part III (Advanced Topics). except that this permission notice may be included in translations approved by the Free Software Foundation instead of in the original English.Part II (Directories) and LDAP -. Lots of basic as well as detailed information there. The sample chapter is about "Email and LDAP" and covers both configuration of MUAs and MTAs (Sendmail.ldapman.
which is work in progress currently. Also see LDAP-Client-Interfaces and Miscellaneous below. author of the third Mandrake-LDAP-HOWTO mentioned here. user data. pointed me to a different server for his document.) Building a LAMP Server w/ LDAP Authentication. see section External Resources.a GINA for Windows 2000/XP. What Is LDAP? I will not go into details.2) PDC LDAP v. Lots of my description (above all to get this "LDAP-thing" do something close to what I wanted) is based on this doc and thus my howto cuts off some details which can be found at aphroland. passwords. OpenLDAP uses the Sleepycat Berkeley DB.c=country" for the LDAP tree. pgina. (Thanks to "unkown". comment from Aug 14.x is dealt with in the according Samba (v. Samba 3.org.com/ .3) PDC LDAP howto. There are resources out there which can and do explain this. www. I’d like to cite from the article Building an LDAP Server on Linux.net" seems to be down currently (03-08-11) as the server is moved (AFAIK).3 howto.org.xpasystems. I’d like to notice one difference in advance: while aphroland’s description uses a base structure like "o=domain. The homepage of Christof Meerwald with some notes on LDAP and the patched Debian package libpam-ldap.) Here’s a SAMBA (v 2. I’m OK with calling the whole works a database and being done with it. "mandrakesecure." Install OpenLDAP First thing to do is to install the OpenLDAP-server. Part 1 by Carla Schroder as she points out some IMHO crucial thing concerning the LDAP-world: "Let’s get like all pedantic for a moment (please put on your geek beard and pocket protector for this). RFC 2254 describes "The String Representation of LDAP Search Filters" and concludes with a few examples on how to use the filters. it might be slightly out-of-date. This doc helped me a lot by describing the installation from a Debian user’s point of view. I’d like to thank the author of the LDAP HOWTO over at howto. Nevertheless. It accesses a special kind of database that is optimized for fast reads.dc=country". but you should be able find these document in Google’s cache. customer data. Tools and stuff: The LDAP Schema Viewer (in case this one’s down.de. I’ll use the more common "dc=domain. I’m not the pedant police. not a database.PDC/BDC Relationships Using Samba and OpenLDAP. what LDAP really is and how to best design an LDAP tree . this actually depends on your taste (among other things) .at least not for now. Miscellaneous: The IRC channel "#ldap" on irc. Use it for relatively static information.debian. Having said all that. and security keys. 2003.aphroland.ldapguru. Nevertheless. such as company directories. (According to him.de a lot. Buchan Milne. you may also try this link). LDAP--Lightweight Directory Access Protocol--is a protocol.
and is just kind of a naming-convention.deb libldap2_2. While this works. With LDAP it is possible to reproduce the available database to other servers on the network too.deb-packages in ~/slapd_woody-source/.d/slapd stop .0.0.23-6_i386. (If for some reason the file debian/rules should not be executable. We want our server (as well as the clients later on) to support SSL.0. (As described at aphroland. which you’d use "slurpd" for (which we won’t do). the somewhat more official way seems to me to be using dpkg-buildpackage instead. which you should install blindly accepting the default-values presented by Debconf.23-6_i386.de.deb libldap2-dev_2. (BTW: Run date -R to get the correct date string for the changelog. run chmod +x debian/rules.deb ldap-utils_2.0.) cd ~/slapd_woody-source/ dpkg -i slapd_2.23 vi debian/rules --> and replace --without-tls with --with-tls [ vi debian/changelog ] Compile the packages: dpkg-buildpackage -b -us -uc FYI: "slapd" is the part of OpenLDAP which "is the server". Mind: The packages provided on this page have an edited debian/changelog as well to hold information about what was changed: Additionally to mentioning the addition of SSL support here. we’ll wipe out the default-stuff and start from scratch on ourselves. so we’ll have to recompile and install our own Debian packages: Get the source: cd ~ mkdir slapd_woody-source cd slapd_woody-source apt-get source slapd apt-get build-dep slapd apt-get install libssl-dev Activate SSL: cd openldap2-2.0.deb [ Get subnet’s self-compiled slapd packages ] /etc/init.23-6_i386.23-6_i386. the package names are changed to contain the suffix "subnet".) Note: In previous versions of this document I stated to run ./debian/rules binary to compile the Deb packages.) Invoking dpkg-buildpackage -b -us -uc creates the .
.In order to prevent the packages to be replaced by the ones from the Debian-repository.slapd /var/lib/ldap chmod 750 /var/lib/ldap rm /var/lib/ldap/* chown -R slapd. /etc/ldap/slapd. find /etc/ldap -type d -exec chmod 770 {} \.) But be aware to keep track of possible security-updates for these packages on your own from now on! (Upgrading to the possibly new packages then should be easily possible by running "dpkg -i .args {CRYPT} /var/lib/ldap/replog 256 ldbm suffix "dc=subnet.schema /etc/ldap/schema/nis..conf: ######################### /etc/ldap/slapd.schema on /home_local/slapd/slapd.conf slapd. set them to HOLD.at/~max/ldap/ # # Basic slapd. Here’s the first basic version of our main configuration file.schema /etc/ldap/schema/misc. chown -R slapd.dc=at" # use "/usr/sbin/slappasswd -h {CRYPT}" to create a rootpw-string below . (Use dselect or a command like "echo "slapd hold" | dpkg --set-selections" for this.) Configure OpenLDAP Wiping out Debian’s default configuration and setting up our own one works as follows: adduser slapd chown -R slapd.schema /etc/ldap/schema/inetorgperson.slapd /var/spool/slurpd rm /var/spool/slurpd/* cd /etc/ldap/ mv slapd.schema /etc/ldap/schema/cosine.subnet.conf include include include include include schemacheck pidfile argsfile password-hash replogfile loglevel database /etc/ldap/schema/core. Make sure to have backups of your configuration before as well as to set the packages to HOLD afterwards again.conf_DEB-orig This way.slapd /etc/ldap chmod 770 /etc/ldap find /etc/ldap -type f -exec chmod 440 {} \." again.pid /home_local/slapd/slapd. the user "slapd" (which we’ll use to run the LDAP-server later-on) is the only one who can read the LDAP configuration as well as the database.conf ######################### #.
# (note: if you use the tcsh shell. besides editing the rootpw-line in your slapd. run some more file-system stuff: # chown slapd. we need to populate it.dc=at objectClass: organization o: subnet dn: cn=manager.slapd slapd.dc=at objectClass: organizationalRole objectClass: simpleSecurityObject cn: admin description: LDAP administrator userPassword: {CRYPT}xxxxxxxxxx dn: cn=nss. you should already know that this file is in "LDIF"-format: dn: dc=subnet.conf # chmod 440 slapd. you will have to use single quotes # to surround the {CRYPT}.conf_DEB-orig Database Population As our database is currently less than empty.: /usr/sbin/slappasswd -h ’{CRYPT}’) rootpw {CRYPT}xxxxxxxxxx directory "/var/lib/ldap" index objectClass eq lastmod on access to attribute=userPassword by dn="cn=manager. i.dc=at" write by dn="cn=nss.dc=at" write by anonymous auth by * none access to * by dn="cn=manager. dc=subnet.dc=subnet. use a file like the following which holds the basic data to be added.conf. As you’ve already checked out some general documents on LDAP (haven’t you?).e.conf # ll total 12 drwxrwx---r--r-----r--r----- 2 slapd 1 slapd 1 slapd slapd slapd slapd 4096 Jun 864 Jun 1928 Jun 3 14:38 schema 3 14:41 slapd.) Next. dc=subnet.dc=subnet.conf 3 14:38 slapd. To be able to test the setup. (See below for details.dc=at" read by * auth ####################################################################### Differences to aphroland’s description include using {CRYPT}-hashes instead of {MD5}-ones as well as starting the server as root and have it drop his privileges in order to become the user "slapd" as soon as it has bound to the ports 389 and 636.dc=at objectClass: organizationalRole objectClass: simpleSecurityObject .dc=subnet.
To work around this.dc=at objectClass: posixGroup objectClass: top cn: maxldap gidNumber: 12345 Don’t forget to run the "/usr/sbin/slappasswd -h {CRYPT}"-command to create password-hashes for the users with {CRYPT}-entries listed in the .email.ldif-file.dc=subnet.dc=at objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: organizationalPerson objectClass: inetLocalMailRecipient uid: maxldap cn: Markus LDAP Test User Amersdorfer sn: Amersdorfer givenname: Markus LDAP Test User title: Admin departmentNumber: IT mobile: 012-345-6789 postalAddress: AddressLine1$AddressLine2$AddressLine3 telephoneNumber: 1234-567890 facsimileTelephoneNumber: 012-345-6789 userpassword: {CRYPT}xxxxxxxxxx labeleduri:. if you use the tcsh shell.subnet. dc=subnet. run the following command instead: "/usr/sbin/slappasswd -h ’{CRYPT}’".account@mail. dc=subnet.email.com mailRoutingAddress: my.com loginShell: /bin/bash uidNumber: 12345 gidNumber: 12345 homeDirectory: /home_local/maxldap/ gecos: maxldap_gecos-field description: Not Available localityName: Bellevue dn: cn=maxldap. Also see this OpenLDAP mailing-list article on this issue.dc=at objectClass: organizationalUnit ou: People dn: ou=Group. this might produce an error stating something like "Password generation failed for scheme CRYPT: scheme not recognized". .com mail: my. surround the parameter with single quotes.e.address@example.cn: nss description: LDAP NSS user for user-lookups userPassword: {CRYPT}xxxxxxxxxx dn: ou=People.ou=Group.address@example.email.alternate. i.server.at/~max/ mail: my. (Again. ou=People.example.dc=subnet.dc=at objectclass: top objectclass: organizationalUnit ou: Group dn: uid=maxldap.
I’ll describe the latter scenario.0." or the other way round).ou=.. Start OpenLDAP You can now .slapd $ /usr/sbin/slapadd -l /etc/ldap/basics-subnet.0/ -d 255 This starts the OpenLDAP server "slapd" initially as root. While it basically boils down to a matter of taste on the one hand (whether you prefer "uid=maxldap.g.x and LDAP below) use this pattern.dc=at"). Nevertheless. The special user cn=nss: With our current ACLs. or to use this cn=nss user so that NSS can lookup the users. . You can and should add the data above to the (currently not running) OpenLDAP database by executing: # su . Smith for pointing this out!) The normal user uid=maxldap: Mind the naming pattern used here for the normal user "maxldap": its distinguished name "dn:" (which is unique within the global LDAP namespace) is constructed by using the user’s "uid=maxldap" attribute (which equals to the Linux user’s login name.dc=at".2.at" ("dc=subnet. It depends on your situation to either set read-rights for everyone to ou=People. The simple reason is that both the MigrationTools (see section Migrate Your Linux Users below) and Samba (see section Samba 2. we can deal with the client-side now.0. the corresponding Linux user’s UID can be found as LDAP’s attribute "uidNumber") prefixing the tree "ou=People.ou=People.. This can be useful for debugging processes. You’ll save yourself a lot of time if you stick with "uid=.dc=.start the OpenLDAP server (without having it disappear into daemon-mode): # /usr/sbin/slapd -u slapd -h ldap://0. to be able to become a user (e. at least to the Name Switch Service (NSS) (see section NSS: Name Service Switch below).) Having the OpenLDAP server up and running..ldif Using "slapcat" you get the database’s current contents without having to perform "ldapsearch" or similar.Many thanks to Martin B... nobody except cn=manager and cn=nss can perform standard read functionality on our LDAP tree.dc=subnet. This places the user in the organizational unit "ou=People" of "subnet. (Hint: Browse through this stuff to get a feeling for OpenLDAPs debugging information and error messages. the tree must be readable." over "cn=Markus Amersdorfer.. binds to the corresponding port (TCP/389) on all local interfaces..ou=People. using "su user") or to get information about the user ("finger user"). drops root privileges by becoming the user "slapd" and presents you with ’live’ debugging information on your screen.being root .dc=". on the other hand it’s definitely better to use "uid=" here. Some sites use the users’ common names ("cn:") instead of the uid’s to differentiate between single LDAP entries (users)..
accomplish some other (stackable and thus highly configurable) tasks and finally decide for example whether the user may login or not). we again need to compile the packages ourselves to support SSL.e. This description goes for both your network-clients as well as the LDAP-server itself (as we want the server’s Linux-system too to know the users and other information stored using OpenLDAP)! NSS: Installation (with SSL capable packages) In order to have any traffic between the clients and server be encrypted. see below) is used to accomplish a user’s authentication (i. But be aware to keep track of possible security-updates for these packages on your own from now on! (Upgrading to the possibly new packages then should be easily possible by running "dpkg -i . While the PAM system (Pluggable Authentication Module.) cd ~ mkdir libnss-ldap_woody-source cd libnss-ldap_woody-source apt-get source libnss-ldap cd libnss-ldap-186 vi debian/rules --> and replace --disable-ssl with --enable-ssl [ vi debian/changelog ] dpkg-buildpackage -b -us -uc dpkg -i libnss-ldap_186-1_i386.. The first task now is to set up the NSS correctly to query the OpenLDAP server additionally to the local passwd-files (and/or the already used NIS). files. Make sure to have backups of your configuration before as well as to set the packages to HOLD afterwards again. listing. To get your local machine’s or network’s listing.conf /etc/libnss-ldap. Nowadays." again.o.) . checking if provided login and password are correct.deb [ Get subnet’s self-compiled libnss-ldap package ] echo "libnss-ldap hold" | dpkg --set-selections mv /etc/libnss-ldap. accessing the users-database is not just looking up the passwd/shadow/a.s.s.conf_DEB-orig The final two commands install the new libnss-ldap-package and set it to HOLD status.NSS: Name Service Switch NSS: Introduction On Linux (and some other UNIX-flavours).o. most applications use library calls to get user information or accomplish user authentication. the Name Service Switch is a service which provides you with a user/group/a. This is done by installing the package "libnss-ldap" and configuring the nss-processes to use it. just run "getent passwd".. (The actual configuration of encrypted communication can be found later in the document.
conf: passwd: group: shadow: ldap compat ldap compat ldap compat This way. In order to be able to browse through the capabilites later (and perhaps activate some of them).subnet.dc=at ####################################################################### The bindpw-entry is the password for the NSS-user (cn=nss. Once the package is installed.dc=subnet. do not use the {CRYPT}-hash.subnet. See section PAM: The user "root" and other system UIDs below for details.dc=at) you created above when populating the LDAP database.dc=subnet. lookups for passwd.conf does not specify all of the module’s options.conf file to configure the new functionality correctly: ######################### /etc/libnss-ldap.conf-file.at/ ldap_version 3 binddn cn=nss.dc=subnet. The password has to be stated as plaintext here. we made a backup of Debian’s original and (throughout the file itself) well-documented libnss-ldap. This feature is used in the setup described here to have the user "root" both be served from LDAP and . group and shadow try LDAP first ("ldap") and NIS and the local files next ("compat"). include the LDAP NSS module in the system lookups by editing /etc/nsswitch.at No mail.subnet.) It should be possible to lookup the LDAP-user "maxldap" using finger or getent now: # finger maxldap Login: maxldap Name: maxldap_gecos-field Directory: /home_local/maxldap/ Shell: /bin/bash Last login Mon Jun 2 16:53 (CEST) on pts/1 from some-client. use the following /etc/libnss-ldap.at base ou=People.at/~max/ldap/ host ldap.subnet.dc=at uri ldap://ldap. Now.dc=at bindpw the_one_you_set_above_in_the_ldif-file__as-plaintext nss_base_passwd ou=People.dc=subnet.have it stored locally.conf ######################## #. .Mind: The manual page for libnss-ldap.as a fallback in case of LDAP wasn’t reachable . it will also show up twice in the output.dc=subnet. (If a user is listed both locally and in LDAP. No Plan.dc=at nss_base_group ou=Group.
compiled ourselves to support SSL. it also might lead to the situation where it might take some time for an update of user-data to reach all clients.conf file holds some clear-text information necessary to be able to perform NSS-lookups. While this makes NSS-lookups faster.this file has to be world-readable. Server Configuration As with NSS. installing "nscd" might definitely be a good idea from the security point of view: The above mentioned /etc/libnss-ldap. it’s the same process here for the package "libpam-ldap" as it was with libnss-ldap above: recompilation with SSL enabled and installation of the new package. user lookups are seperated from user authentication on Linux systems. this filter patch has a bug. we want the LDAP-server itself too to be able to use the LDAP-based users for authentication. the same configuration applies to the server as it does to the client machines (= Linux/Unix stations not running the LDAP server but just querying it for user lookups and authentication. at least). which means we’ll need to install a patched version of libpam-ldap. In this setup. NSCD can help you solve this issue: Just install it and set the file-access-rights for /etc/libnss-ldap. Nevertheless. We’ll use this feature to be able to allow users to login to some specific workstations and block access on the network’s other workstations (see below for details). PAM: Pluggable Authentication Module PAM: Introduction As mentioned above. which in turn runs with root-privileges (I guess.resulting in funny situations such as the prompt saying "i have no name!" instead of the actual user’s login-name . the Debian Woody package has a special patch applied to be able to use filters when checking whether a user is allowed to login or not. Thus. the second is usually dealt with using PAM nowadays. basically. and thus can read the credentials from the config-file and perform the corresponding DB-lookup. the corresponding library-request executed with the user’s rights should be handled by NSCD. Basically. this means that everybody knows about the credentials of the "cn=nss" user and can do everything this special user can (which depends on the access-lists of the LDAP server). group and host lookups for running programs and caches the results for the next query".) . (Or is there some "pushing".or any other mechanism that solves this?) Anyway. Though I haven’t tried it yet.conf NSCD is "a daemon which handles passwd. While the first is covered by NSS. But then. This patched version is available from Christof Meerwalds Debian section. PAM: Clients vs. In order to prevent the users from not knowing who they are . Unfortunately.NSCD and /etc/libnss-ldap.conf to "600" (owned by root).
no matter which configuration you chose. (This is not totally correct: root can change a user’s password. . but it has to know the user’s old password to able to set a new one.Nevertheless. root can not add users . I’ll describe a setup here where root can change any user’s password. Reasons are that I want root to be able to change the passwords by simply running "passwd $user" (without having to know the user’s old password).org/files/debian woody libpam-ldap Run: cd ~ mkdir libpam-ldap_cmeerw-source cd libpam-ldap_cmeerw-source apt-get update apt-get source libpam-ldap vi debian/rules --> and replace --disable-ssl with --enable-ssl [ vi debian/changelog ] dpkg-buildpackage -b -us -uc cd .conf" using the option "rootbinddn" on the server and "binddn" on all other machines. This is the same behaviour as if the users theirselves would change their passwords. This can be bad (additional "overhead". the server needs the file "/etc/ldap. You can configure a machine so that there is no almighty root anymore concerning the users. but only on the machine running the OpenLDAP server. This doesn’t seem to be easy to administer (especially in the case where the manager’s password changes) on the one hand. If not stated otherwise.list: # Patched libpam-ldap for Woody (.. depending on your needs and wishes.) 2.root can’t even change the users’ passwords. 1.dc=" to be stored on such a machine locally in a file. It’s all about the user "root" and about changing user passwords. this ability includes the need for the password for "cn=manager.dc=. this can/must be done by someone else) . additionally it has to be in plaintext. Furthermore. you have several options here now. The only difference lies in the file "/etc/pam_ldap. PAM: Installation (with SSL capable packages) Add to /etc/apt/sources. necessary change of habits) or good (the system administrator "root" is not responsible/able to change the users’ passwords. it’s the same for both possible setups.depending on your needs. If you do so. Most of the steps following are the same for all machines. You can keep the system-administrator (responsible for a machine’s uptime) seperated from the users administration.secret" which holds the manager-user’s password in plaintext (with access rights "600".org/debian/) deb-src. and it doesn’t seem to be very secure either for obvious reasons on the other hand. Nevertheless. owned by "root"). You can configure a machine to behave as if users were "installed" locally (in passwd|shadow) so that root can change them and their passwords.
conf ######################### #. we set its status to HOLD. first.at/~max/ldap/ # # pam_ldap.conf_DEB-orig Again after installing the package.deb [ Get subnet’s self-compiled libpam-ldap package ] echo "libpam-ldap hold" | dpkg --set-selections mv /etc/pam_ldap.conf: ########################## /etc/pam_ldap.. Make sure to have backups of your configuration before as well as to set the packages to HOLD afterwards again.subnet.at/~max/ldap/ # # pam_ldap.dc=subnet.at base dc=subnet. using the patched package and recompiling it with our modifications we’re ready for these things to come later on.dc=at bindpw the_one_you_set_above_in_the_ldif-file__as-plaintext pam_password crypt ####################################################################### On the server (or on all machines where you want root to be able to change the users’ passwords).conf: ########################## /etc/pam_ldap.conf does not specify all of the module’s options." again.conf for the server (where root can change user passwords) host ldap.at/ ldap_version 3 binddn cn=nss. Next.at base dc=subnet..at/ ldap_version 3 rootbinddn cn=manager.conf ######################### #. configure the new PAM module using this /etc/pam_ldap.dc=at . on all the clients (where root is not able to change the users’ passwords).conf for all client machines host ldap.conf /etc/pam_ldap.dc=at uri ldap://ldap. Mind: The manual page for pam_ldap.subnet.dpkg -i libpam-ldap_140-1cmeerw_i386.subnet. use this /etc/pam_ldap.subnet. In order to be able to browse through the capabilites later (and perhaps activate some of them). we made a backup of Debian’s original and (throughout the file itself) well-documented pam_ldap. But be aware to keep track of possible security-updates for these packages on your own from now on! (Upgrading to the possibly new packages then should be easily possible by running "dpkg -i .dc=at uri ldap://ldap.) Though we’ll use a setup without SSL and without host-specific access controls for the moment.conf-file.subnet.dc=subnet.
#auth required pam_nologin.so pam_unix. Most PAM-aware applications have their own PAM-stack they use. we need to include it into the PAM process: We’ll check out the modifications to be able to log in using ssh and su. if I’m correct.so password required pam_unix.so pam_ldap.subnet. only root can read the file) which holds the plaintext-password for LDAP’s "cn=manager..secret with access rights "600" and owned by "root" (i. Debian stores these configuration-files in /etc/pam. as we want to be able to fall back to the (local) pam_unix in case pam_ldap does not authenticate successfully. ("sufficient" can not be replaced with "required" here.so account account session session session session session session sufficient required sufficient required optional optional optional required pam_ldap.) (The "session" section might have to be re-ordered too.. # so there’s no need for pam_nologin in /etc/pam.so auth required pam_unix.so standard noenv # [1] pam_limits. This is necessary as once pam_ldap authenticates successfully. of course. one has to place them before pam_ldap.so # [1] pam_motd. there has to be a blank second line in this file.e.d/. no other "auth"-lines are used due to pam_ldap’s "sufficient" attribute. In order to have pam_env and similar be used..d/ssh.so # Woody’s SSHD checks for /etc/nologin automatically.d/ssh ############################ #.".so"-lines.d/ssh: ########################### /etc/pam.so auth sufficient pam_ldap. Re-ordering the "auth"-lines.so password sufficient pam_ldap.so # [1] pam_mail. I didn’t have such in my setup originally: according to Setting up LDAP for use with Samba. (While. Here is /etc/pam.) Now that we have the PAM module configured.at/~max/ldap/ auth required pam_env.secret pam_password crypt ####################################################################### and second don’t forget to create the file /etc/ldap.# don’t forget /etc/ldap.) .so pam_unix. This might be the case if for example the LDAP server could not be contacted for some reason.so ####################################################################### The changes to the original file are: The addition of the "pam_ldap.so pam_lastlog.
"use_first_pass" is not needed in pam. The option "use_first_pass" is passed to pam_unix. or this module can’t authenticate the users anymore.at maxldap@ldap..subnet. Best thing is to restart it everytime to be sure changes are activated.) Things to take care of: Do not forget to edit the files /etc/pam. More up to date systems often use "md5" somewhere in the process of hashing the password. do not use "use_first_pass" on the first password-querying auth-module of your service-configuration.Here is /etc/pam. Otherwise.. I haven’t figure out yet when it is necessary to restart e.d/su ############################# #. SSH after changing its PAM-stack file.so required pam_unix.d/login similarly.subnet.d/ssh above.so required pam_unix.so module.subnet.] pam_ldap". (For some reason. you would not be able to login to any of your machines . the latter is used if somebody logs in locally (not via SSH or something like that). The first is used if some application without a specific service-file in /etc/pam.so use_first_pass sufficient pam_ldap... This way the pam_unix-module uses the password which was provided to "auth [.at/~max/ldap/ auth auth auth account account sufficient pam_rootok.so"-lines were added. MD5: The good old shadow file typically stores passwords as hashes using the "crypt" algorithm.so session sufficient pam_ldap.so ####################################################################### The changes to the original file are: Again. (These . one would have to enter the password twice for users not in LDAP. Logging in via SSH or su’ing to the LDAP-user "maxldap" should work now: $ ssh maxldap@ldap. Even if all your users (including "root") are stored in the LDAP database.d/ uses PAM-calls. In case your LDAP server wouldn’t be reachable for whatever reason. it would not be a good idea to remove the pam_unix.so sufficient pam_ldap.g. Should you re-order your PAM stack.d/other and /etc/pam.so. the "pam_ldap.at’s password: Last login: Tue Jun 3 15:11:30 2003 from some-client maxldap@ldap:~$ PAM: Passwords: Facts CRYPT vs.so session required pam_unix.not even as root (and that’s exactly what you might need to do in this case to debug or administer your network).d/su as another example: ########################### /etc/pam.
) The Mandrake-based document on mandrakesecure. just treat it as a system account and do not migrate it. Only the "LDAP Manager" is allowed to see the hash. haven’t you? PAM: The user "root" and other system UIDs (You actually don’t have to worry about that just yet. BTW: One reason for even me thinking that "crypt" really is secure enough is that the password is never sent in any way in plaintext over the network. just bare in mind you will have to decide later (when actually doing all the migration stuff in section Migrate Your Linux Users below) what to do with all the system accounts and with "root". this is the only one I found where both root and the users themselves (both LDAP-based users and local-only ones in passwd|shadow) can change their passwords. I couldn’t use these hashes. This would have been nice!) Oh.d/passwd. either Debian doesn’t support it or I simply couldn’t get this thing to work.d/passwd ########################### #. I think the general knowledge about it belongs to PAM and thus here. as every traffic between clients and server is secured using SSL (see below). migrate "root" to LDAP. (Especially. but you’ve already read it anyway.so. and of course. Otherwise. (It seems I managed to have passwords being created using MD5 and have them stored in the LDAP database this way. Unfortunately. Anyway.) I definitly recommend to keep your system UIDs (Debian currently treats the UIDs 1-999 as such) only locally on every machine. I really would have liked the MD5-thing as it creates longer password hashes and uses passwords with more than just 8 characters..conf concerning root’s non/ability to change users’ passwords explained in section PAM Clients vs.).so or using use_first_pass with pam_unix. Nevertheless. as it’s about user accounts.at/~max/ldap/ password sufficient pam_ldap. but unfortunately.so password required pam_unix. ########################### /etc/pam. Unfortunately."md5"-passwords can be distinguished from the "crypt"-only ones by starting with "$1$".) Being well known for my paranoia . good old CRYPT will (have to) suffice. If you prefer to have one root account for all machines (as I do).net (see section External Resources) describes a way to use exactly the newer MD5-based approach with your LDAP database. the users can change their passwords on their own from the command-line by simply executing passwd. . Server Configuration above.so nullok obscure min=4 max=8 ######################################################################### I tried several versions here. I never got a user to authenticate successfully.subnet. Even a local "root" user can’t see the password-hash by executing "getent shadow". Using it. The only (really bad) thing you should remember is: "Crypt"-passwords have a maximum length of 8 characters! PAM: Passwords: How To Change Them Here is my /etc/pam. don’t forget the setup of /etc/pam_ldap. I could not get the stuff working using pam_cracklib.. do not migrate them into LDAP! It’s up to you what you do with "root".
this also depends on section PAM Clients vs.) ToDo . you will upgrade your machines from Woody to Sarge. the user "mysql" should only be available on a machine hosting a MySQL server).conf. it also needs to know its old password. logging in as "root" will use the LDAP-account by default. as the user "root" should not be able to simply change those LDAP values. It can (and probably will) happen that according to a new policy some system accounts changed their UID. Debian offers several ways to achieve our goal.verify this again: Oh.. With the setup explained here. what about the second? (Well. and before I forget and because it differs from standard Linux behaviour: if "root" tries to change its LDAP-account password using "passwd". if a user shall has access to one host. But be sure to also have "root" locally in /etc/(passwd|shadow|group). specifying that this user is allowed to login to the listed host(s).. If for some reason your LDAP server was not reachable. described in section NSS: Installation (with SSL capable packages). but that’s probably what you will do anyway. if you want to serve your users to client machines which do not run Debian Woody and thus use a different system accounts scheme. ok. Host Specific Access Introduction Up to now. they actually have access to all hosts on the network.) And of course (above all).g. Only if the LDAP server is not accessible. Even if it worked properly for one server. UID 0: "root" If you want to migrate the user "root" into LDAP (like I did). you will automatically fall back to the local user/password from the flat files..) Additionally. won’t you? :) . from "simple" to "advanced": . actually. Server Configuration. As described in the Mandrake based LDAP-article already mentioned in the resources section. you’ll need to change it directly in the LDAP database.The system UIDs If you need reasons for not migrating them to LDAP: Different services on different servers/machines will need different system users to be present (e. Try this yourself to make sure your machines behave properly... you’ll have problems on your hands. just as any other user does! (If you can’t remember the password anymore. but IMHO you really don’t want it this way :) . everything might turn out to work somehow. One day. (Mind the order "ldap compat" in /etc/nsswitch.. you still can log in to your (LDAP)-client machines using the local "root" account. one can define one or more "host"-attributes (host is part of "objectClass: account") in the user’s LDAP-entry. Upgrading just only one server will not work in this context. simply migrate it as described below in section Migrate Your Linux Users.
simply add "host: *" to the LDAP entry. they are allowed to login. that in the /etc/pam.conf indicates.conf [.. If the user is allowed to login to all hosts. .mydomain. you can add the following there: /etc/pam_ldap.conf"." the user will be granted access to the host.net".. This means..so". The "pam_check_host_attr" option can be found in "/etc/pam_ldap.so filter=|(host=this-host. you’ll have to replace "account sufficient pam_ldap. you already know that Debian uses the split-up approach.conf" and "pam_ldap. As we’ve installed the corrected version from cmeerw.d/.conf" file. (Otherwise.so" with "account required pam_ldap.so auth sufficient pam_ldap. As already mentioned in section PAM: Pluggable Authentication Module. despite the message "Access denied.d/<service> files.org. add an attribute similar to "host: allowed-host.g. While Mandrake seems to have merged "libnss-ldap.d/ssh): #auth sufficient pam_ldap.net" or "host: *". or by editing /etc/pam_ldap..) Approach 2: Filters The more powerful way is the following one: Debian’s package libpam-ldap has a "filtering" patch applied.net)(host=\*) Only if the user’s LDAP entry contains "host: this-host.net)(host=\*) For all services at once (/etc/pam_ldap.conf" to on single "ldap.conf): pam_filter |(host=this-host. add an attribute similar to "host: allowed-host.mydomain.mydomain. /etc/pam. This way it is possible to accompany the LDAP PAM module with some filtering-rules which must match in order for the module to return successfully and allow the authentication-process to proceed. So here’s how to do it: For every host that the user shall be able to login. the standard Woody package’s filter patch has a bug which needs to be fixed. you’ll need pam_ldap.net".so to be "configured for account management (authorization)".] pam_check_host_attr yes But be careful: As the comment in Debian’s original pam_ldap.mydomain.Approach 1: pam_check_host_attr For every host the user shall be able to login. we already have a working version.mydomain. Next thing is to adapt the PAM stack: This can either be done by editing one (or more) specific service’s config file in /etc/pam.conf (which has influence on all services at once): For single services only (e.
g.0. loglevel xxx ] TLSCipherSuite HIGH:MEDIUM:+SSLv2 TLSCertificateFile /etc/ldap/server. any traffic between the server and the clients was unencrypted.. let’s move on and make everything safer: Up to now.dc=subnet.0.dc=subnet.dc=at" \ -H "ldaps://ldap..at/" -W -x "(uid=maxldap)" Both commands.subnet..dc=at" -LLL -D "cn=manager.Things to take care of: Mind the backslash "\" in the filter "host=\*".0.cert TLSCertificateKeyFile /etc/ldap/server. you’ll allow access to every user who has at least one "host"-attribute (with any content)! Be sure to add "host: *" for user "root" (if it is served via LDAP) if you want it to be able to login via SSH! Add-On: Of course this setup can be extended for example by using self-defined attributes representing groups of hosts (e.dc=at" -LLL -D "cn=manager. It’s all up to you.dc=at" \ -H "ldap://ldap. With a little imagination it could perhaps also be possible to assign a user different shells on different hosts!? I don’t know yet.0/ ldaps://0...dc=subnet.at/" -W -x "(uid=maxldap)" ldapsearch -b "ou=People.. Let’s activate the SSL-encryption our packages already are capable of (as we recompiled them ourselves). with and without SSL encryption.dc=subnet.key TLSCACertificateFile /etc/ldap/ca. .cert TLSVerifyClient 0 [ . If you miss it (ending up with "host=*"). You can find a description of how to create an SSL certificate here: HOWTO Create an SSL Certificate.subnet. database ldbm ] Start the LDAP server with the following command: # /usr/sbin/slapd -u slapd -h ’ldap://0. "my-hosts: workstations") and adapting the PAM module’s filters.0/’ -d 1 You can test the server’s SSL capabilities (of course the client you are executing the second command needs the "ldap-utils"-package with SSL-support compiled into it!): ldapsearch -b "ou=People.conf: [ . should return the entry for the user "maxldap". :) SSL Encryption Now that we have a running LDAP-server which provides user-information and also have clients authenticating using these LDAP-users. you need to configure your OpenLDAP server to use it: Add to your /etc/ldap/slapd.0. Once you have your signed certificate.
-u slapd \ -h ’ldap://0. for example /etc/pam. on the client side (this means every machine querying OpenLDAP.conf. Add-On: To test if your clients really are communicating with the server using an encrypted connection.0. Next. All you have to set up on each "client" is: Install our self-compiled libnss-ldap package. . Edit /etc/nsswitch.all we have to do is to change one line: # start-stop-daemon --start --quiet --pidfile "$pf" --exec /usr/sbin/slapd start-stop-daemon --start --quiet --pidfile "$pf" --exec /usr/sbin/slapd -.subnet. this is as easy as changing "uri ldap://ldap.conf and /etc/lib_pam. this most probably also includes the "server" where OpenLDAP is running on) we have configured the Linux clients to use it. lot’s of stuff.conf and /etc/pam_ldap. we should look at the changes necessary to /etc/init. While using ldap:// you should be able to find some cleartext in the data garbage. make user-queries and logins with both settings ldap:// and ldaps:// and a concurrently running "tcpdump -X host ldapserver".conf (clients) respectively /etc/lib_pam. Install our self-compiled libpam-ldap package based on cmeerw. "slapd" now logs to /var/log/debug.d/..0. well.0.at/"> in both /etc/libnss-ldap. /etc/libnss-ldap. Edit the corresponding service files in /etc/pam.d/ssh. we have the process’ user changed to "slapd" as well as the server listen for ldap-traffic on port 389 and ldaps-traffic on port 636.at/" to "uri ldaps://ldap.0/ ldaps://0. OpenLDAP Startup Script Now that we have everything set up correctly concerning the connections (including SSL-support).org.conf.subnet.Activate SSL Encryption for the Clients’ Queries Next step is to adapt the clients’ setup: Having already installed our re-compiled library-packages. on the server side we have accomplished to set up and populate the OpenLDAP server.conf (server) and /etc/ldap. after switching to ldaps:// you should only see . Communication between the clients and the server is secured using SSL encryption.secret (server).d/slapd to have the OpenLDAP server started correctly every time the machine boots .0/’ This way. So Far So Good..0. they can look up the users and use those to log into machines. Part 1 So far. but no plaintext information. This tcpdump-command shows you in ASCII the transmitted data.
so no need for this here. The newer version of Debian Sarge (currently version 44-6) definitely works better." 03-08-12: As Buchan Milne pointed out in a mail on the Samba mailing-list and his Howto Implementing disconnected authentication and PDC/BDC relationships using Samba and OpenLDAP. "givenname" an "sn".Migrate Your Linux Users Migrate Linux: Prerequisites Of course you want to migrate your current Linux users from passwd/shadow to the new OpenLDAP server. but also still produces junk values for the attributes "cn". Debian offers help here by providing the MigrationTools from padl. $DEFAULT_MAIL_HOST = "mail. $EXTENDED_SCHEMA = 1. The default base is "dc=subnet.g. edit /usr/local/MigrationTools-44/migrate_common.at". as already mentioned above in section PAM: The user "root" and other system UIDs.com as the Debian package migrationtools.dc=at". Unfortunately.subnet.pl" produced junk values for the attributes "cn". the latter also uses different letter cases in a newer version than Woody’s one does (e. ("hosts" would be good to migrate too. I used version 44.conf. "givenName" instead of "givenname").pl" forgot an "s" with "dc: subnet". in my case this was our NIS server (which was a different machine than the upcoming LDAP server). After exploding the tar-ball.dc=at" which should be identical to the suffix defined in slapd. but we have a local DNS server running. the package in Debian Woody (version 40-1) is rather buggy: "migrate_base.pl" didn’t produce any output and "migrate_passwd. It’s possible to migrate nearly all data to LDAP (including /etc/(hosts|protocols|services) etc. $DEFAULT_BASE = "dc=subnet. which works fine for me. Furthermore.at".) Furthermore.ph is not necessary: Setting and exporting according environment variables (for example export LDAP_DEFAULT_MAIL_DOMAIN="subnet.at". nevertheless.). In either case. in this case "mail. In order to get a working package you should download the original version of the MigrationTools from padl.at" which will assign all users a default email address of "user@subnet. Here we set the default mail domain. the only things we’ll use LDAP for are users and groups. The default mail host is the SMTP server used to send mail.com. The extended schema is set to 1 to support more general object classes. you’ll have to execute the scripts on the machine which currently holds your users already. in this case "subnet. so install the migration-package there.at") works too and would survive an eventual upgrade (though of course migrating users will probably be performed only once).at". Citing the initial Mandrake-LDAP document on this one (with "localisation"): "This sets some defaults for the migrated data.subnet. you’ll have to exclude your system accounts (Debian Woody uses the UIDs 1-999 for this) and decide on what to . changing those values in migrate_common. so you could apt-get install this package. "migrate_group.ph and adapt the following variables: $DEFAULT_MAIL_DOMAIN = "subnet.
at (Here is the original base. the only things we’ll migrate are users and groups.ldif: dn: dc=subnet. we basically do have this base structure already.pl cd /usr/share/migrationtools/ ./migrate_base.ldif file with all the additional entries. As I’ve already mentioned.dc=at ou: People objectClass: top objectClass: organizationalUnit objectClass: domainRelatedObject associatedDomain: subnet.ldif The only entries which are or might become interesting for us are the following base. Especially keep in mind when migrating both groups and users to delete all system accounts from the .ldif-file created by the migration scripts! ToDo: It should be possible to do this using some /sed/awk/grep/etc/ scripts.dc=subnet.do with "root" (UID 0). So we won’t do anything here at the moment. and of course we’ll check out the base structure.dc=at dc: subnet objectClass: top objectClass: domain objectClass: domainRelatedObject associatedDomain: subnet. Migrate Linux: The Scripts The migration scripts are located in /usr/local/MigrationTools-44/ (or wherever you saved them to): migrate_base.) Well.dc=at ou: Group objectClass: top objectClass: organizationalUnit objectClass: domainRelatedObject associatedDomain: subnet. .at dn: ou=Group.pl creates the LDAP tree’s base structure.at dn: ou=People. The migrate_all_* migrate everything by simply calling the single perl scripts.pl > base. so let’s start with this one: migrate_base.dc=subnet. The only difference is that we are missing "objectClass: domainRelatedObject" and its associated attribute.
which most probably holds your passwords.ldif # Restrict access as this file holds all passwords: chmod 600 passwd./migrate_passwd. An entry in /etc/group like "somegrp:x:12345:userone.pl /etc/passwd passwd. so we have to remove the corresponding objectClass.dc=subnet. You can simply adapt all the entries by executing "sed" like the following: . we didn’t include the Kerberos schema in our slapd.subnet.dc=at" -x -W -f $FILE BTW: The main purpose of a group is to hold several users :).usertwo" can be accomplished by adding a "memberUid" attribute for each user to the group’s LDAP entry: "memberUid: userone" and "memberUid: usertwo". migrate_passwd.dc=at objectClass: posixGroup objectClass: top cn: users userPassword: {crypt}x gidNumber: 100 dn: cn=nogroup. it is called "inetLocalMailRecipient".at/ -D "cn=manager. Additionally.pl /etc/passwd passwd.dc=at objectClass: posixGroup objectClass: top cn: max userPassword: {crypt}x gidNumber: 1000 dn: cn=users. This should ensure that the script find the /etc/shadow file./migrate_group.pl Here is the minimized output from .dc=subnet.migrate_group.ldif: dn: cn=max. Instead.conf.ou=Group.ou=Group. Debian Woody’s schema files do not provide the objectClass "mailRecipient"./migrate_passwd.dc=subnet.ou=Group. try the command with an explicit environment variable set: ETC_SHADOW=/etc/shadow .ldif.pl /etc/group group.ldif If you don’t have any user passwords in your ldif file.pl .dc=at objectClass: posixGroup objectClass: top cn: nogroup userPassword: {crypt}x gidNumber: 65534 This information can now be added to the LDAP server by executing something like the following: ldapadd -H ldap://ldap.dc=subnet.
.sed s/mailRecipient/inetLocalMailRecipient/g passwd.at/ -D "cn=manager. . As no flavour of Windows (AFAIK) can access the LDAP database directly.dc=subnet.at mailRoutingAddress: THEUSERNAME@mail. Thus.ldif_corrected Enter LDAP Password: adding new entry "uid=max. the corrected objectClass and other values): dn: uid=max. the Windows machines will allow access based on what the (Samba) PDC says which again makes its decisions on what the users in the LDAP database look like.dc=at" -x -W -f passwd. it would be useful to have the network’s Windows machines use this database too.dc=subnet.dc=at" Samba 2. This information can again be added to the LDAP server by executing something like the following: ldapadd -H ldap://ldap.ldif | \ sed ’/^objectClass: kerberosSecurityObject$/d’ | sed ’/^krbName: /d’ \ > passwd. 2003.subnet. of course.ldif_corrected Here is the corresponding passwd.ou=People..ou=People.subnet.ldif_corrected chmod 600 passwd.ldif file (again with one user only.x and LDAP Samba: Introduction Now that we have a working LDAP server to hold all our Linux-users. The Samba-PDC queries LDAP for entries which are "objectClass: sambaAccount".2. (This means. all Windows/Samba clients query the Samba-PDC.) 03-08-15: See user comment from Aug 14.at mailHost: mail. the Windows machines (both servers and clients) will have to be part of a domain which is controlled by a Samba PDC.subnet.at objectClass: inetLocalMailRecipient objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson objectClass: account objectClass: posixAccount objectClass: top objectClass: shadowAccount userPassword: {crypt}$1$_my-password-hash-from-/etc/shadow shadowLastChange: 12174 shadowMax: 99999 shadowWarning: 7 loginShell: /bin/bash uidNumber: 1000 gidNumber: 1000 homeDirectory: /data/home/max gecos: Markus Amersdorfer.dc=subnet.dc=at uid: max cn: Markus Amersdorfer givenname: Markus sn: Amersdorfer mail: THEUSERNAME@subnet.
Oh.x are as welcome and will be included here as any other feedback!) Another add-on: You only have to install this "special LDAP-Samba version" on the machine which performs as your network’s PDC.2. ] Mind: In order for Samba to support ACLs. Conclusion: Recompilation is necessary.3a-13subnet_i386.deb [ Currently now packages available.deb samba-doc_2.2..3a" currently. The default behaviour is to use the flat smbpasswd file. so "Samba" refers to "Samba 2.deb samba_2. Again.deb smbfs_2. apt-get install the mentioned packages and run "dpkg-buildpackage" again in this case. "dpkg-buildpackage" might not compile the packages at the first time you run it due to some missing build-dependencies.) Samba: Installation and Setup Samba itself (if it’s not configured to query some other server for user-authentication) can either use the smbpasswd file to hold its users or use an LDAP server to accomplish this.3a vi debian/rules --> add "--with-ldapsam \" just before "--with-msdfs" [ vi debian/changelog ] dpkg-buildpackage -b -us -uc [ Due to missing build-dependencies: apt-get install libreadline4-dev libcupsys2-dev [with extra-packages "libcupsys2 libjpeg62 libtiff3g"] dpkg-buildpackage -b -us -uc ] cd .2.2.3a-13subnet_i386. and by the way. please build them yourself . dpkg -i samba-common_2.deb smbclient_2.2. All other Samba machines should be configured to use this one Samba PDC as their "oracle" for user authentication. (Infos on Samba 3.cache the value "ac_cv_header_sys_acl_h=${ac_cv_header_sys_acl_h=no}" to "ac_cv_header_sys_acl_h=${ac_cv_header_sys_acl_h=yes}". (You’ll use options like "security = DOMAIN" and "password server = MYPDC" to accomplish this.3a-13subnet_i386.. Debian Woody’s Samba packages of course defaults to the default in this case. set the packages to HOLD using dselect or something like "echo "samba-common .2.. you have to decide at compile time. It’s not possible to do both at the same time.3a-13subnet_i386.2. remember that this HOWTO-document uses Debian Woody as the underlying distribution. cd ~ mkdir samba-source cd samba-source apt-get source samba cd samba-2. Again. I also added "--with-acl-support" and changed in debian/config.3a-13subnet_all.
.. of course the Samba server needs to be able to query the LDAP server for users.hold" | dpkg --set-selections"..at ldap suffix = ou=People.g.gz chown slapd.slapd samba. This leads us to the next (and one of the last) steps to do: configure smb.dc=subnet.dc=subnet." again.gz /etc/ldap/schema/ cd /etc/ldap/schema/ gunzip samba.lmPassword.*..conf: include /etc/ldap/schema/samba. Samba has to know about this user and it’s password. Make sure to have backups of your configuration before as well as to set the packages to HOLD afterwards again. Of course.g..dc=subnet. I tried to think of a setup which would not use "cn=manager.] Restart OpenLDAP: /etc/init.schema.schema chmod 440 samba.d/samba restart .schema Add to /etc/ldap/slapd.dc=at # Plus these options for SSL support: #ldap port = 636 #ldap ssl = on Restart Samba: /etc/init.d/slapd restart Now that you have an "LDAP capable" Samba installed and now that your OpenLDAP knows about the new attributes..dc=subnet.dc=at" attribute=userPassword. using "smbpasswd") and above all edit or even add LDAP entries (e. teach your LDAP server the possibilities of Samba by adding the Samba schema file and restrict the access to the users’ Samba passwords using the Access Control Lists: Run: cp /usr/share/doc/samba-doc/examples/examples/LDAP/samba." for this.dc=at" attribute=userPassword access to dn=".ntPassword [.. Here are the additions to be added to the [global] section of your Samba PDC: /etc/samba/smb. The main reasons are that Samba (in some way) must be able to change the passwords (e.conf. machine accounts for new SMB-clients joining the domain).schema.dc=at ldap server = ldap.conf: # access to dn=". add to [global]: # Without SSL: ldap admin dn = cn=manager.) Next.*.conf (and thus Samba and its tools) correctly to use the LDAP server properly. But be aware to keep track of possible security-updates for these packages on your own from now on! (Upgrading to the possibly new packages then should be easily possible by running "dpkg -i .subnet.schema Change the already exiting password ACL rule in /etc/ldap/slapd. but I just couldn’t figure one out.
BTW: As Implementing a Samba LDAP Primary Domain Controller Setup on Mandrake 9.business as usual. change its password using "smbpasswd $user". The "only" difference is that now the LDAP server is used to hold the information which is usually stored in smbpasswd: . If you don’t want to do this. Added user maxsmb.conf’s option "ldap admin dn" in the file /var/lib/samba/secrets.tdb. etc. you set an environment variable to the corresponding password and use it in the next command to tell Samba about it.g.dc=subnet. .dc=at" -LLL -D "cn=manager. you might want to test if the new setup works properly.Here is a sample smb.dc=subnet. Samba: Test your Setup Before messing around too much with your (already existing?) LDAP users. (That’s a very neat trick I saw at B. Not saving it in LDAP at this time yet helps keeping things seperated.conf file. Milne’s "Implementing Disconnected Authentication and PDC/BDC Relationships Using Samba and OpenLDAP" to keep the password from your shell’s history file and similar. we simply add one to the local flat files (passwd|shadow|group). just go on and proceed with the next section Samba: Add (Windows) Users. password: 12345] Add the "Samba user" (to LDAP): # smbpasswd -a maxsmb --> output: New SMB password: abcde Retype new SMB password: abcde LDAP search "(&(uid=maxsmb)(objectclass=sambaAccount))" returned 0 entries. it stores a password hash for the user of smb. simple and "a way which is already known".dc=subnet. ’cause that’s what we want actually. It will not show up anywhere :).of course .) "smbpasswd -w $LDAP_BINDPW" is the actual command of interest.dc=at" -W -x "(uid=maxsmb)" One can now access the Samba server using this user.be stored in the LDAP database. we have to tell Samba the corresponding password: # read -s -p "Enter LDAP Root DN Password: " LDAP_BINDPW # smbpasswd -w $LDAP_BINDPW --> output: Setting stored password for "cn=manager. the corresponding Samba user to be added will . we probably don’t need (and thus don’t want) the overhead of encryption on the very same system where both OpenLDAP and Samba are running on. Add the "Linux user" (to local flat files): # adduser --no-create-home maxsmb [e.dc=at" in secrets.x states. Nevertheless. Check yourself: # getent passwd | grep maxsmb # ldapsearch -b "ou=People. Last but not least.tdb This way. Basically. you can add the two options "ldap port" and "ldap ssl" accordingly. As Samba needs a "Linux user" for/below every "Samba user". (If the two services run on different machines.
2.255.170. If you just have a few of them.141.170.ou=People.119 bcast=193.2.3a-12 for Debian] smb: \> Now that everything is proven to work properly. . LDAP-Test)) ADMIN$ Disk IPC Service (yellow server (Samba 2.2. it simply updates the password-hashes (no matter whether it’s invoked as "smbpasswd $user" or "smbpasswd -a $user").128 Password: Anonymous login successful Domain=[SUBLDAP] OS=[Unix] Server=[Samba 2.141. there’s nothing easier than to simply add them: # smbpasswd -a $user This command seems to perform an LDAP search for an already existing entry matching "(&(uid=maxsmb)(objectclass=sambaAccount))".dc=subnet.127 nmask=255. If it finds an entry matching its query (which means the user already exists as a Samba-user).255.3a-12.170.3a-12 for Debian] smb: \> client$ smbclient //ldap/maxsmb added interface ip=193.2.141.141.2.3a-12 for Debian] tree connect failed: NT_STATUS_WRONG_PASSWORD client$ smbclient //ldap/maxsmb -U maxsmb added interface ip=193.255.170. or it uses an already existing normal Unix-user and adds the corresponding Samba attributes. don’t forget to remove this section’s test user "maxsmb": # ldapdelete -D "cn=manager. If none is found.dc=subnet.3a-12.141.127 nmask=255.255.dc=at" -W -x "uid=maxsmb.119 bcast=193.141.dc=at" # deluser --remove-home maxsmb Samba: Add (Windows) Users In order for Samba to allow access to shares for certain users (and don’t allow for others).170.128 Password: Anonymous login successful Domain=[SUBLDAP] OS=[Unix] Server=[Samba 2.119 bcast=193.128 Password: abcde Domain=[SUBLDAP] OS=[Unix] Server=[Samba 2.client$ smbclient -L //ldap Password: Anonymous login successful Domain=[SUBLDAP] OS=[Unix] Server=[Samba 2. But before doing that.2. you can extend your LDAP users to become Samba capable.170.255.3a-12 for Debian] Sharename Type Comment -----------------tmp Disk maxsmb Disk IPC$ IPC IPC Service (yellow server (Samba 2.127 nmask=255. LDAP-Test)) client$ smbclient //ldap/tmp added interface ip=193. it needs to know these users. it either creates the entire user (as is the case in the example in section Samba: Test your Setup).255.
by .txt. done sed s/^/"smbpasswd -a "/ users-with-samba-passwords.dc=subnet./make-them-samba-users. You can easily tell your users about their passwords as they are stored in users-with-samba-passwords.) Samba: Migration Summary If you need to migrate lot’s of users from a Windows-PDC (such as Windows NT).g. "smbpasswd" does all the work for us. (This seems to me to be easier than to create an . perfect!) Samba: Join Windows-Workstations to our Samba-PDC Domain 03-08-13: In contrast to the initial release of this howto. Both possible ways.’ and not ".txt chmod 700 make-them-samba-users.If you have lots of users already existing in the LDAP tree (e.0 will allow to migrate a complete NT-securitydatabase to a Samba-PDC by calling "net rpc vampire"..".txt for user in ‘cat linux-and-not-samba-users. check out /usr/share/doc/samba-doc/examples/.dc=at" \ -W -x ’(&(objectClass=posixAccount)(!(objectClass=sambaAccount)))’ | grep "uid: " \ | awk ’{print $2}’ > linux-and-not-samba-users.sh This takes all Linux-users which are not Samba-users already. Samba 3.txt > make-them-samba-users.g.. ToDo: Some parts of the script should be rewritten to clear things up and make the script simpler (e. create the posixAccount-users (e. due to migrating them as described above).dc=at" -LLL -D "cn=manager. but I didn’t try it in large scale: ldapsearch -b "ou=People.sh .. or if you have lots of "Windows-users" to add.. you might check out smbldap-tools. adding the account manually or have Samba add it automatically (if it doesn’t exist already). by migrating them as described above) and afterwards run the commands mentioned in section Samba: Add (Windows) Users to "smbpasswd -a" all posixAccounts and hereby make them sambaAccounts too. (Somehow the BASH messes something up when using double-quotes. If you need to create an LDAP user database with lot’s of users which are to become Samba-users.) Also.dc=subnet.. you’ll need a script to do the work: # Warning: This should work. I meanwhile figured out how to have a machine account automatically be added to the LDAP-tree.ldif-file holding posixAccounts and sambaAccounts in the first place and add this . Scott Phelps migrated a Windows-PDC to a Samba-PDC without the clients noticing a change: He used pwdump2 to keep the user passwords and rpcclient and smbpasswd to have the Samba-PDC use the old Windows-PDC’s SID for the domain. makes them Samba-users and assigns them a random password (creating the random passwords using makepasswd might take a while!).sh. If you need to migrate lot’s of users from an already existing Samba-PDC with the users being stored in a flat smbpasswd file. (ToDo: Insert link to the Howto once available..txt.. do echo $user ‘makepasswd‘ \ >> users-with-samba-passwords.txt‘.ldif-file to the LDAP server. even when escaping & and ! using \. Mind that the filter is included in ’.sh chmod 600 users-with-samba-passwords. use this script I wrote: create-machine-account..g.
To add the machine manually. searching for MachineAccounts is easy here too: just "ldapsearch" for "(gecos=MachineAccount)". add the following option to your smb. Afterwards. Milne’s document it should be possible to have all "Domain Administrators" join a machine to the domain. Nevertheless.dc=.) In this setup. Usage: # . In "non-interactive" mode (i. all the script’s status messages are logged using /usr/bin/logger. machines use a uidNumber-range which is seperated from the normal Linux users. If everything went fine until here..sh NewMachineName$ I". This group will be the group of all machines. According to B. To have Samba add the account automatically while the machine joins the domain. it creates the Linux-account.conf and ldap. run ". (But be careful: You’ll need the user "root" as mentioned in step 2. it creates the group "machines" (gidNumber $GIDNUMBER. default 20000). Seperation is done by simply using uidNumbers above $DEFAULTUID. . sorry!) You can now log on to this machine using all valid LDAP sambaAccount entries. it exits. If necessary. (In this setup. I didn’t try this yet.sh %u What create-machine-account. it makes this new entry a full Samba-Machine-Account using smbpasswd -a -m.dc=" for machine accounts.conf’s [global] section: add user script = /usr/local/sbin/create-machine-account. adding at least the "objectClass: sambaAccount" part to LDAP "is left to the reader as an exercise".secret for this./create-machine-account. Joining the domain on the Windows machine works as usual./create-machine-account. 1. Just perform steps 1 and 3 of this mini-Howto describing exactly that: Howto join a Windows client to a domain. I now. you probably hate this phrase as much as I do. but it works. BTW: Using "ou=People" is different from the smbldap-tools (smbldap-tools work-log) which use "ou=Computers. 2.) Next. Option "I" activates the interactive mode (printing status messages to stdout and possibly querying you for the rootbinddn-password). If it doesn’t already exist.e. Mind: At the beginning of the script are three options which can be changed. machine-accounts can be distinguished from others as they are posixAccounts with "gecos=MachineAccount". It checks if the machine-account already exists. If so. defaults to 20000. but are consistent with our setup here by default.. it finds the highest uidNumber of any already existing machine-account.sh NewMachineName$ <I> (WITH the machine account’s trailing "$").sh does basically boils down to: Get the necessary data to be able to connect to the LDAP-server. This indicates it’s best run on the LDAP-server/PDC itself. (The script uses settings in pam_ldap.using functions to print the status messages). It’s a little mess currently. without option "I").
g.com: We created ldif files for the base structure. The most important options are "workgroup = SUBLDAP".conf of a joining workstation. So Far So Good.conf-option "domain admin group = @staff @winadmins".sh".SID or similar stuff.conf.SID on the joining Samba machine. Mind the very useful smb. since both systems behave the same and talk the same protocol. and just to make sure: I performed this stuff with /etc/samba/ containing only smb. Joined domain SUBLDAP. after creating the machine account (for both Linux and Samba) using our script "create-machine-account.d/samba start Here is the according sample smb. join the client to the domain by running the following commands on the new workstation: client:~# /etc/init. Part 1). On the Server: Create the Linux-User account "MachineName$" 2. we migrated the current Linux-users of the network (which a NIS-server might have provided to the clients) using the official MigrationTools package from padl. On the Server: Make it a Samba-machine-account 3. Samba: Miscellaneous Here’s a document describing my experiences with the smbldap-tools: my smbldap-tools work-log. to exclude system users) prior to adding this . This results in in the same steps as described above in section Samba: Join Windows-Workstations to our Samba-PDC Domain: 1. Oh. On the Client: Join the domain So. of course. the groups and the users (including shadow-passwords) and edited them (e. client:~# /etc/init. That makes sense. Part 2 After successfully setting up the server and the (Linux-) clients (see So Far So Good. "security = DOMAIN". Just for your information: Joining the domain creates the file /etc/samba/MACHINE. and no other files such as MACHINE. (Thus it’s possible to re-use machine-accounts in case a machine left the domain without having to delete the machine-account first.Add-on: Joining a Windows machine to the domain if the machine-account already exists works just fine too.d/samba stop client:~# smbpasswd -j SUBLDAP -r YELLOW 2003/08/08 20:24:31 : change_trust_account_password: Changed password for domain SUBLDAP.) Samba: Join Samba-Workstations to our Samba-PDC Domain Joining a Samba-Workstation to our Samba-PDC controlled domain involves the same steps on the server-side as does joining a Windows-Workstations. "password server = YELLOW" and "local master = No".
GQ GQ is a GTK-based LDAP client. and copy objects. assigning random passwords to the users. we added sambaAccount’s to our posixAccount’s users. Debian packages for a current version backported to Woody can be found in Christof Meerwald’s Debian section. Besides the Gnome. ToDo: phpLDAPadmin Citing the homepage: phpLDAPadmin is a web-based LDAP application for managing all aspects of your LDAP server. You can browse your LDAP tree.and web-based tools mentioned here. Check out this list of Graphical LDAP tools over at the LDAP Linux HOWTO. Using some commands. this Samba-server will become the domain’s PDC with all Windows. Directory Administrator makes adding/editing/deleting users/groups really easy! If it wasn’t for all our wish to understand what’s behind all those GUI tools. ToDo: LDAP-Client-Interfaces As the header indicates. As basically goes for the total HOWTO: I’ll add things as soon as they are ready. Next. corrections as soon as bugs are found. one would probably use this one from the beginning already. create. there are also KDE tools. Furthermore.and Samba-clients querying this PDC.information to the LDAP-Server. of course.") . We taught the OpenLDAP-server to use the new Samba-attributes. this section is currently still marked "ToDo". Directory Administrator Directory Administrator is a GTK-based LDAP client. we discussed joining SMB-clients (both Windows and Samba) to the domain using a custom script to set up the corresponding machine accounts. perform searches. Citing from its description: "DaveDAP is a web-based LDAP admin tool written in PHP. Debian packages for a current version backported to Woody can be found in Christof Meerwald’s Debian section. You can even copy objects between two LDAP servers and recursively delete or copy entire trees." (phpLDAPadmin was formerly known as "DaveDAP". Easy access to all available attributes etc. In our network. delete. we set up LDAP-capable Samba-packages on the server only. edit. GQ is great to browse your overall LDAP tree and get a good feeling of what’s where. and view your server’s schema.
and Part 3.Console based LDAP user management tool.de/ (Found on. Part 2...ebenfalls deutschsprachig. LDAP Explorer Tool... II: The Differences to the Woody Documentation Above II: Feedback!? II: The Work-Log II: Basic Installation and Configuration II: LDAP Clients II: Database Population II: Configuring NSS II: Configuring PAM II: Have the Server Processes Run as Non-root II: Miscellaneous ToDos include .ToDo: Miscellaneous. Part II: Using OpenLDAP on Debian Sarge to serve Linux Users Table of Contents (Part II: Sarge) II: Introduction II: On the Versions . Some links about LDAP I found in a posting by Georg Wallner on the LUG-TS-Mailing-List: Lots of links to and info ’bout LDAP.8a (or later) if you want to get a Samba-BDC working fine. Kerberos and LDAP slides. Deutsches LDAP-HOWTO zu Debian Potato.html). libapache-mod-ldap .Apache authentication via LDAP directory.pro-linux.iit. . HOWTO: LDAP Programming in Python Only book Understanding LDAP featured by IBM.2. Milne points out in a mail on the Samba mailing-list. Part 1.gonicus. it might be good to use Samba 2.edu/~gawojar/ldap/ cpu -. Verschiedenes zu LDAP . Carla Schroder’s Building an LDAP Server on Linux. Miscellaneous As B.sourceforge.de/news/2002/4491.net/.
Done The following NEW packages will be installed: db4. Sorry ’bout that ... please treat it as such: A work-log.xx.Sarge: Feedback!? Comments and corrections are welcome indeed.Sarge: On the Versions . After unpacking 4026kB of additional disk space will be used.Part II .30-3) as well as the dependencies and recommendations: # dselect Reading Package Lists. 0 to remove and 0 not upgraded.) Still.1. If you’re running Debian Sarge. and I do not have access to e. (This state of information is also reflected in the state of structuring: It’s more a "bunch of" than a "list of". while the final Debian Sarge ships LDAP packages of versions 2.. For more information on some issues. The default configuration is not removed anymore.) Part II .. for example.2-util ldap-utils libiodbc2 libltdl3 libsasl2-modules slapd 0 upgraded.g.30-3) and "ldap-utils" (2. 6 newly installed. Done Building Dependency Tree. Do you want to continue? [Y/n] . the following work-log is currently not based on the final version of Sarge. Note though that my notes below are based on LDAP packages of versions 2. I’ll gladly do so. (I moved to the UK. the necessary hardware resources here anymore.. Need to get 1559kB of archives. give the descriptions below a chance.... As much as I would have liked to re-work this document for Debian 3. as always! Part II . Recompilation of the packages is also not necessary .2.1..Sarge: The Work-Log Part II . (The general LDAP principles are still the same.1 ("Debian Sarge").1.Sarge: Introduction Part II . I would like to share my experiences with a preliminary version of Debian Sarge. should I get the time and resources again to work on this any further.xx.Sarge: Basic Installation and Configuration Install the packages "slapd" (2.Sarge: The Differences to the Woody Documentation Above With the Sarge version. please check the Woody documentation above. of course!) Part II . I tried to stick more to the Debian default packages as they are. Since. thus. dated back about half a year ago to January 2005.. I unfortunately neither have the time nor the resources to do so.
conf file is to add (near the beginning of the file) the "misc.dc=com" \ -H "ldap://yourserver.Concerning the configuration of these packages: enter your DNS domain: example.example. For some reason....] Don’t forget to restart the LDAP server afterwards: # /etc/init.dc=com" -LLL -D "cn=admin..com" -W -x If you want a graphical client.example. ("allow bind_v2" would have been added to slapd.com</ldaphost> <ldapport>389</ldapport> <basedn>dc=example.conf ######################### # Note: We need this to be able to have entries with attributes such as # "mailRoutingAddress" (which we need as we’ll use the LDAP-server # to host the mail-users and -domains for the Postfix SMTP server). The solution is to fire up your editor and add the following section to your (already existing as you should start once and stop GQ first) ~/.Sarge: LDAP Clients In order to connect to the server from an Ubuntu Linux client (which is what I use on my client machine).gq file: <ldapserver> <name>peach</name> <ldaphost>yourserver.dc=com" If you want to connect as the LDAP-admin from anywhere on the network.dc=com</binddn> <pw-encoding>Base64</pw-encoding> <search-attribute>cn</search-attribute> </ldapserver> .) The only thing to change in the /etc/ldap/slapd.dc=example.schema # [.com Name or your organization: example.dc=com</basedn> <binddn>cn=admin.dc=example.0beta1-1.] include /etc/ldap/schema/misc.conf in case we allowed v2. install e. simply install the "ldap-utils" package and run something like: $ ldapserach -x -b "dc=example.schema" to be used: ######################### /etc/ldap/slapd.com Admin password: adminpassword Allow (old) LDAPv2? No. Ubuntu 4. use something like this $ ldapsearch -b "dc=example. the package "gq". # # [. I could not add a new server to its config using the graphical menu.d/slapd restart Part II .10 (aka "Warty") comes with version 1.g.
com mail: my.account@mail.example.dc=example.email.dc=com objectClass: posixGroup objectClass: top cn: maxldap gidNumber: 12345 .dc=example.dc=example.address@example. using the following file "basic-test-user.ldif": dn: ou=People.com loginShell: /bin/bash uidNumber: 12345 gidNumber: 12345 homeDirectory: /home_local/maxldap/ gecos: maxldap_gecos-field description: Not Available localityName: I dont know dn: cn=maxldap.dc=com objectClass: organizationalUnit ou: People dn: ou=Group. but with the above config. you should already be able to connect to the server as "admin".com mailRoutingAddress: my.email.email.ou=People.dc=example.You can now modify the server settings.server.ou=Group.dc=com objectclass: top objectclass: organizationalUnit ou: Group dn: uid=maxldap.Sarge: Database Population Next.alternate.at/~max/ mail: my.address@example.dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: top objectClass: shadowAccount objectClass: organizationalPerson objectClass: inetLocalMailRecipient uid: maxldap cn: Markus Peach LDAP User Amersdorfer sn: Amersdorfer givenname: Markus Peach LDAP User title: Dipl. Note though that all your data (including the password) is transferred in cleartext! Part II .-Ing. departmentNumber: IT mobile: 012-345-6789 postalAddress: AddressLine1$AddressLine2$AddressLine3 telephoneNumber: 1234-567890 facsimileTelephoneNumber: 012-345-6789 userpassword: {CRYPT}SOME-CHARACTERS-OF-YOUR-PASSWORD-HERE labeleduri:. add some test-data to your LDAP database.
dc=subnet. which is all more than interesting and could be necessary if you use a non-Debian-default setup..dc=subnet.ldif": dn: uid=maxldap.) (From one of those Debconf-dialogs: "Note: As a sanity check.ou=People. use the following file "basic-remove..To add this to the running slapd-LDAP-server’s database.dc=at" adding new entry "ou=Group.dc=example. you’ll notice that some additional attributes such as "creatorsName" and "modifyTimestamp" were added automatically.ou=Group.ou=Group. it might really be a good idea to use .dc=at" deleting entry "cn=maxldap.dc=example.dc=com" Running "slapcat" as root on your LDAP-server.dc=example. we use the defaults.ou=People.ldif -D "cn=admin.dc=example.dc=com changetype: delete dn: ou=People.dc=at" deleting entry "ou=Group.ldif -D "cn=admin.dc=com" adding new entry "cn=maxldap.dc=example.dc=com changetype: delete dn: cn=maxldap.dc=example." Thus. Note: AFAIK.dc=com changetype: delete dn: ou=Group.dc=example.dc=at" -x -W Enter LDAP Password: deleting entry "uid=maxldap.ou=Group.ou=People.dc=example.Sarge: Configuring NSS # apt-get install libnss-ldap You are asked questions such as "is a login needed to retrieve data from the LDAP db?" and "should the libnss-ldap configuration file be readable and writable only by the file owner?". (This might be used to harden the installation later.dc=subnet. but at the moment.dc=com" -W -x Enter LDAP Password: adding new entry "ou=People.dc=subnet. run the following: $ ldapadd -f basic-test-user.dc=at" Part II .dc=com" adding new entry "uid=maxldap. you should use the "slapcat" and "slapadd" commands only when the slapd-process is stopped! If you wanted to remove these entries again.dc=com changetype: delete and run the following command: $ ldapmodify -f basic-remove.dc=example.dc=subnet.dc=at" deleting entry "ou=People. libnss-ldap will check if you have nscd installed and will only set the mode to 0600 if nscd is present.
.. Nevertheless..] You should now be able to see the user via the NSS library calls: # finger maxldap Login: maxldap Directory: /home_local/maxldap/ Never logged in.conf /etc/nsswitch.conf_05-01-05 # $EDIT /etc/nsswitch. this sounds like it would be a good idea.) I adapted common-account. No Plan.conf a little bit .Sarge: Configuring PAM In order to be able to authenticate against the LDAP server using the user’s password. common-auth and common-password -. section "NSCD and /etc/libnss-ldap.php#nss-install.subnet.."nscd"! See making a backup of it: # cp /etc/nsswitch. but we’ll stick with "crypt" for the moment though.so account required pam_unix..d/common-account .slightly different changes each: # /etc/pam.conf" for more details!) The example-file /usr/share/doc/libnss-ldap/examples/nsswitch. (Note: You could choose to use "MD5" password hashes here!? Again.org/~torsten/ldapnss.conf.05-01-05: # To activate LDAP support. Name: maxldap_gecos-field Shell: /bin/bash # getent passwd|grep maxldap maxldap:x:12345:12345:maxldap_gecos-field:/home_local/maxldap/:/bin/bash Great.so try_first_pass . we’ll stick with the basics at the moment and just change the existing /etc/nsswitch..at/~max/ldap/index.authorization settings common to all services # markus -.html. we need to adapt the PAM service: # apt-get install libpam-ldap I basically used the same choices are as mentioned in holds really good information for decent configuration of our /etc/nsswitch. as described as follows. Part II . No mail.so account sufficient pam_ldap.debian. comment the default and add the LDAP config #account required pam_unix.conf [.] passwd: ldap compat group: ldap compat shadow: ldap compat [.
as well as a "ldap"-user with the GID of the just mentioned group. reject) as well as the maxldap-LDAP-user!! :) "su" and "ssh" work too! (Note: For "ssh" to work properly.so nullok_secure auth sufficient pam_ldap. you have to restart the ssh-service first!) Part II . common-session goes unchanged. section "9. There should be a group called "ldap". create the group and user as follows: # addgroup --system ldap # adduser --system --no-create-home --group ldap Check /etc/passwd and /etc/group.05-01-05 # To activate LDAP support. At the moment I do not know why? Shouldn’t we make the ldap-changes there too?) It is now possible to log in on the command-line using NIS-users (correct password: accept.txt.2. Both IDs should be between 100-999.05-01-05 # To activate LDAP support. change the ownership of the files under /var/: [<0> root@peach ldap]# ll /var/lib/ldap/ -d drwxr-xr-x 2 root root 4096 Jan 3 15:04 /var/lib/ldap/ [<0> root@peach ldap]# ll /var/lib/ldap/ -a total 540 drwxr-xr-x 2 root root 4096 Jan 3 15:04 . comment the default and add the LDAP config #auth required pam_unix.Sarge: Have the Server Processes Run as Non-root In order to get the "slapd" process to run as a different user and group than root.d/common-password .so nullok obscure min=4 max=8 md5 use_first_pass (Note: As mentioned in Torsten’s Howto. .) You need to enable "ldap" to read the config-file: # chown ldap /etc/ldap/slapd. the system-UIDs 100-999 can be assigned for system-purposes on a dynamical basis. After adding "ldap" to SLAPD_USER and SLAPD_GROUP in /etc/default/slapd. UID and GID classes".so nullok obscure min=4 max=8 md5 password sufficient pam_ldap.2.so password required pam_unix.so nullok_secure use_first_pass # /etc/pam.so auth required pam_unix.. trying to restart the slapd-process will result in error.d/common-auth .password-related modules common to all services # markus -..conf Next. (Check /var/log/syslog for more information.authentication settings common to all services # markus -. Only 0-99 must not be used on a per-machine-basis! Thus. comment the default and add the LDAP config #password required pam_unix.gz (package "debian-policy"). wrong password. check out "/etc/default/slapd" first of all. According to /usr/share/doc/debian-policy/policy.# /etc/pam.
which was fixed with 2.drwxr-xr-x 16 root root 4096 Jan 3 15:04 . .bdb -rw------1 root root 32768 Jan 7 16:31 id2entry.. SSL ..1 release versions . SSL: There was a SSL-Bugs in slapd..bdb -rw------1 root root 97140 Jan 7 16:31 log. -rw-r--r-1 root root 0 Jan 3 15:04 suffix_change [<0> root@peach ldap]# ll /var/run/slapd/ -d drwxr-xr-x 2 root root 4096 Jan 7 16:31 /var/run/slapd/ [<0> root@peach ldap]# ll /var/run/slapd/ -a total 8 drwxr-xr-x 2 root root 4096 Jan 7 16:31 .5 32916 4480 ? [.005 -rw------1 root root 8192 Jan 7 16:31 dn2id.23-1.Sarge: Miscellaneous ToDos include . have Postfix use the LDAP server for its SMTP services.d/slapd start)..004 -rw------1 root root 16384 Jan 3 15:04 __db. Apart from updating these notes to the actual Debian 3. and it should run as "ldap"-user now instead of "root": # ps aux|grep slapd ldap 2039 0.question: Do libnss-ldap and libpam-ldap support SSL properly? SSL: /etc/default/slapd: Activate "SSL"-startup-option there (and NOT in /etc/init.23-8 being in the final Sarge release (see bug 205452).001 -rw------1 root root 270336 Jan 3 15:04 __db.0000000001 -rw------1 root root 12288 Jan 7 16:31 objectClass.. .bdb [<0> root@peach ldap]# ll /var/lib/slapd/ -d drwxr-xr-x 2 root root 4096 Jan 3 15:04 /var/lib/slapd/ [<0> root@peach ldap]# ll /var/lib/slapd/ -a total 8 drwxr-xr-x 2 root root 4096 Jan 3 15:04 .. if necessary.2. # chown ldap /var/run/ldap/ -R # chown ldap /var/lib/slapd/ -R # chown ldap /var/run/slapd/ -R Starting slapd again should work now (# /etc/init. -rw------1 root root 8192 Jan 3 15:04 __db.0 0.002 -rw------1 root root 98304 Jan 3 15:04 __db.2..003 -rw------1 root root 368640 Jan 3 15:04 __db. with 2..d/slapd itself)! As a larger part of the project..] Ss 16:39 0:00 /usr/sbin/slapd -g ldap -u ldap Part II . drwxr-xr-x 6 root root 4096 Jan 7 16:31 .. drwxr-xr-x 16 root root 4096 Jan 3 15:04 . the following steps are some of those that needed to be performed next: Get the "hosts"-attribute and the according filtering to work. Include further Mail-services to use the LDAP users..
12 Dec 2003 06:59:59 +0100 I would implement it if you could get md5 to work. admin at cs . Project homepage:. 14 Aug 2003 22:57:35 +0200 Section: Samba 2. Fri.com Fri.html Soon done with the main thing .xpasystems.com/ (new) pGina LDAPAuth: Comments I would be glad to hear about your opinion. 24 Nov 2003 14:58:00 +0100 A great document.sourceforge.x and LDAP SubSection: Samba: Introduction Paragraph: 1 There is a replacement GINA for Windows 2000/XP that allows several other methods of authentication. But the background color and the text color make it a bit difficult to read. Tue. 12 Aug 2003 12:17:23 +0200 Great document! Thank you very much for taking the time to write it. it will save me much time. I was more than happy to find such a practical howto on this topic thx really :) Mon. Thu. I will spread the word. (The form is at the end of this file.com/plugins/ldapauth. 16 Sep 2003 12:00:09 +0200 hi. I will spread the word. any corrections or additions. thank you very much. Congratulations! Kablan BOGNINI.xpasystems. montana . your howto is very good. bognini@hotmail.great doc! I put my own notes (based on this to a large extent) into doc format here:.) Tue. tough i let out most of the encryption stuff as this is just a private plaything.org/sambaldap/Samba_and_LDAP_on_Debian. edu .a \"quick cheat sheet\".html Tue. Check it out! //mawi Tue.net/ (old). thanks to your howto.2. 26 Aug 2003 16:00:55 +0200 As I mailed you before . 12 Aug 2003 09:20:25 +0200 Great document! Thank you very much for taking the time to write it. Amersdorfer. 7 Nov 2003 17:29:03 +0100 just got into ldap.
04-01-16: Added a few words to make it clearer.nice work.. I\’ll try to improve the relevant packages so that all the rebuilding steps can be left out.Mon. 9 Feb 2004 12:31:18 +0100 Nice document..ldif. [ Max. thanks! ] . 04-01-16: This was due to a copy’n’paste-error.org> Tue.ldif\’ containts lot\’s of spaces here. Wed. I\’ve been running LDAP for a while now.. thanks! . Mon. 11 Feb 2004 19:10:32 +0100 Thank you for your felpfool Page. Robert Fri.at/~max/ldap/basics_subnet. Added a link from my small tutorial on getting it running without all the bells and whistles you added.. It\’s just I\’m looking for :) Serz Tue.. Removing the emtry \’spaced\’ line by a linefeed solved that.subnet. 15 Dec 2003 02:57:09 +0100 Excellent article.. As a Debian developer I wanted to show what you can do without recompiling and all that of course. I found out that my system was not compiled with SSL.. The file \’. 17 Feb 2004 23:08:00 +0100 Interesting.. The file \’.. 10 Feb 2004 20:59:49 +0100 This is the good stuff. Torsten Landschoff <torsten@debian. Fixed.with slapadd -v -l populate. :) .ldif\’ containts lot\’s of spaces here. ] .at/~max/ldap/basics_subnet. Possible the \’Activate SSL:\’ step must be done right over the \’apt-get source slapd\’ step. But I got it working now!!! yeaaaaaa Mon. Thanks. 29 Dec 2003 15:34:46 +0100 A very helpfull page. I tried to start is as my slapd user but that didn\’t work out.. this gave me problems using . [ Max. 9 Jan 2004 21:49:29 +0100 Good document.subnet..I believe that the slapd package should be set on hold to. I wish I found this page a year a go.After the \’Start openLDAP\’ you can add that you have to be root again (using exit). I received the message \’attribute \’gidNumber\’ cannot have multiple values.I believe but not sure that the installing directions in the \’Install OpenLDAP\’ section is wrong. and I learned a couple things .
.idealx. wenns in deiner Vatersprache zu lesen gewesen wäre. ] Wed.org/index. debhelper package is required in order to build libnss-ldap and libpam-ldap. 23 Feb 2004 17:05:54 +0100. 04-03-24: I checked again. it runs as "slapd" here. die einem beim Umstellen auf LDAP blüht. ] Fri.Das beste. The GPL is the \"General Public License\". not tested on woody yet): one: tell the server to use md5 (add password-hash {MD5} to the configuration) two: tell pam to crypt locally: (pam_password md5 and pam_md5 local) You might want to check this though. I was looking for something like this." before "-u slapd" to identify the rest of the line as command-line arguments to "slapd" (instead of "start-stop-daemon")? ] Wed. lord knows whatever else I changed while messing around :-) [ Max.. about the database poopulation: anyone have experience with populating the database with users/groups/aliases/. 20 Feb 2004 01:19:17 +0100 Great tutorial but just a few hangups on the way. [ Max. Mon. I\’ve recently come to the conclusion that I\’m looking after too many machines.. One question though. encore cent fois . [ Max.\" The problem is that you chose to rebuid slapd --with-tls. noted and changed accordingly. even htough it does if run \"by hand\". 18 Feb 2004 14:50:26 +0100 Thanks. 24 Mar 2004 02:03:41 +0100 Slapd seems not to drop root when started from /etc/init. s\’ il te plait . there\’s no such thing. Merci bien et. Also for libpam-ldap libpam-dev is required. 28 Apr 2004 01:33:58 +0200 Please leave a comment (but mind the netiquette). 18 Feb 2004 23:47:15 +0100 Please note that the GPL is not the \"GNU Public License\". 20 Mar 2004 18:57:39 +0100 I got md5 working as follows (on sarge. Nicht auszudenken.d/slapd with -u slapd. wie sichs gelesen hätte.) ] Fri. 04-03-25: "apt-get build-dep" is very helpful here.en. for multiple domains (sometimes distinct organisations)? Wed. das ich bisher über die Odyssee.Wed.html Sat. Thanks for the hint :).. Perhaps your script misses the " -. (Debian woody stable) [ Max. (I’ll have to integrate information about it in the HOWTO eventually. lesen und auch verwenden hab können. see its man-page. 04-02-19: Ooops. 20 Feb 2004 15:51:58 +0100 \"Unfortunately. 04-03-23: Removed multiple postings. spread out over the internet to not use LDAP. either Debian doesn\’t support it or I simply couldn\’t get this (MD5 crypt) thing to work. Without the use of ssl you can use md5 without problems. The problem seems to be in the linking of openssl (woody version) function crypt() before the usual libc crypt().
04-07-15: Added this link. I’d suggest to run ‘lynx -dump. 6 Oct 2004 17:48:45 +0200 Great article. confirms by ldap set up is reasonable. 15 Oct 2004 00:46:47 +0200 Thanks. ] Fri. 04-10-22: Sorry. May I suggest that you make it downloadable in PDF (or ASCII) format? [ Max. . thanks for the hint.. 1 Oct 2004 01:38:42 +0200 Thanks for this! It\’s really cleared a few things up for me! Wed. 2 Sep 2004 17:39:13 +0200 Excellent document. like that. how about using LDAP Explorer Tool? It\’s a GPL win32/linux ported client to work with ldap. For PDF. thanks for the hint. works great. schade das nicht einmal auf Kerberos hingewiesen wird. man stolpert zwangsweise darüber wenn man es ldap länger einsetzt und es wäre schöner gewesen alles auf einmal zu migrieren Wed. 19 Jun 2004 22:53:47 +0200 Schönes HowTo. thank you ! Fri.at/~max/ > LDAP-Howto. 04-04-29: Removed multiple postings. 24 Jun 2004 17:52:58 +0200 realy great info. this is a very good document. 31 Aug 2004 03:54:06 +0200 Great document! Thanks Max I\’m Thanks for that you taking the time to write it.txt‘. I did get root\’s passwd usage fixed because of this document though. 25 Jun 2004 05:21:47 +0200 for ldap clients. as (unfortunately!) I didn’t use DocBook or sth.net are broken. 23 Jun 2004 11:38:12 +0200 Your link to LDAP Schema Viewer is broken: the target page does not exist. Fri.subnet. Thu. I don’t have any other version than this HTML/PHP. For ASCII. 04-07-15: Added a working link to this resource.. ] Thu. ] Thu. I’d suggest to "Print to file" and convert the PS to PDF. FYI: all links to mandrakesecure. 22 Jul 2004 11:20:15 +0200 Thanks Max for your nice doc. ] Sat.net/ [ Max.sourceforge. they seemed to have re-arranged their site and dropped all docs. do you have an experiance with samba 3 + ldap + squid + qmail . May I suggest phpldapadmin instead? It is in debian unstable: apt-get install phpldapadmin [ Max. single sing-on system Tue.[ Max.
Just with a normal NIS-solution. its too exhausting to read this. DO NOT follow this howto blindly if you are running testing/unstable..Debian for slapd (Sarge) and it seems unclear if the problems with ldap and GNUTLS/OpenSSL-TLS have been resolved in the current version.. but can\’t do anything to tell the system what uidnumber. The crucial point i met is that pam_ldap is OK to verify the user password.Thu. I don’t know anything about Sarge yet.. 18 Nov 2004 06:32:25 +0100 what do you mean by this --> add "--with-ldapsam \" just before "--with-msdfs" yasanthau@pabnk. 04-12-08: Since this seems to be an issue: I’ll change the style-sheet as soon as I’ve got some time for "eye-candy" again :) . guess u don´t have to :-) Tue. you define that Samba is to be compiled with the capability to host its users-database using the LDAP-server. Thanks a lot Thu.. uhm. shell and home dir to use. 05-01-03: Apart from slapd having support for GNUTLS included (see /usr/share/doc/slapd/README. hope this helps . Are there known problems with slapd’s SSL-support? Thu. 16 Dec 2004 21:20:55 +0100 Update to my last comment Things have signifcantly changed with LDAP under Debian Sarge./configure’ etc. 25 Nov 2004 16:33:20 +0100 due to colour layout I decided to NOT read this page.. In . its too exhausting to >> read this. 4 Nov 2004 03:23:06 +0100 just great. [ Max. more common . In particular.). 14 Dec 2004 17:49:35 +0100 Thank you for your great writeup! I was reading through the changelog. etc. NSS on the other hand is responsible to perform the "lookups" for login-name/uidnumber.lk [ Max. 04-12-08: Removed multiple postings.. you can’t have one working properly without the other. Do you know what the current (Dec/04) state is? Thanks again for this document! David.org [ Max.). and it works now. gidnumber.harmel@afpamp. ] Thu.] [ Max. ] Thu. 04-12-08: By adding the line "--with-ldapsam \" in the rules file. newspapers have dark letters on light paper. etc. Am i misleding? (Is it possible to have it working with pam_ldap AND WITHOUT nss_ldap?) p. you add such options to the configure-script to state which functionality is to be included (and which is not). 25 Nov 2004 17:37:29 +0100 >> due to colour layout I decided to NOT read this page.Debian. thats the wayit should be [ Max. 22 Nov 2004 17:11:06 +0100 I tried to have login working with LDAP. do not delete the default directories and files. As to my knowledge. ] Mon. you will need both: PAM on the one hand is responsible for "authentication" (meaning to check whether a user is allowed to login using the given password. If you compiled Samba manually (using ’. 04-12-22: I changed the style-sheet to something. Your LDAP install will just not work and you will have to apt-get remove --purge and reinstall. shell. the system settings.
but they were piecely done. This is still a very intersting write up and the suggestions on how to NOT run ldap as root are very valuable . Keep up the effort! syzygy. I have met some terrible documentations assuming that i knew everything and i had every tool.conf the database line must be the full path to /var/lib/ldap/.. 29 Apr 2005 00:44:55 +0200 I have look briefly at alot of documentations on this subject. ] [ Max. 1 Apr 2005 06:31:26 +0200 Amazing. and the module you want to use.. partly because I knew I\’d need to refer to some parts of it later. You explained things clearly. 25 Dec 2004 12:55:56 +0100 Hey. 04-12-22: Thanks for your information! I’m going to install a Sarge-based LDAP-server soon and am already wondering what it will be like . I\’d bookmarked this. 1 Apr 2005 07:44:13 +0200 Hey. Layout (look and feel) counts! Great job and thank you. the basics worked. I\’m not new to LDAP. and was exhausted! Almost didn\’t recognise the site when I re-visited. however. 26 Dec 2004 14:44:56 +0100 Very informative. I wish Linux documentations had this in general. Your doc is JUST GREAT. being the follower kind of person that I am. [ Max. 16 Feb 2005 23:17:37 +0100 Great documentation thank you very much. I can send you some of my experiences.but as the title at top says. and I tried to stick with the default packages and configurations . although a welcome change to the colour scheme! It\’s great to see you\’re maintaining this HOWTO. gchelmis@aueb.] Sat. and I see you\’re maintaining it. this is for WOODY. and I just followed it. .. but this page provides a lot of information. partly because the colour scheme was difficult to read (which I noticed you\’ve changed). Greetings. Your guide may not be up to date on latest Samba 3. what am I doing here? Some guy posted a link. After trying multiple times.gr Fri. using diffrent HOWTO\’s yours is the only one that worked and was up to date. Not Sarge. Thanks! Fri. Yeah I figured I\’d type something here as to be useful.. Though I didn’t complete the full process.. serving files via FTP and Samba to a bunch of clients (not as a Domain Controller).to the point and concise. Maybe. but anyways. 05-06-25 -.Update: As you can see. Fri. Thanks! If you appreciate. I\’m planning to get a Debian Sarge fileserver running in the next few weeks.slapd.. I added some notes on pre-release version of Sarge I worked with.. Hans van Kranenburg (The Netherlands) Sun. Because I want all the login/user stuff in LDAP I\’m looking around for information. it was easy to read interms of the fonts/layout/and style .au Wed.
] Thu.com/jxplorer/) is a LDAP browser deluxe. 23 Jun 2005 12:54:13 +0200 Thanks for a great document! Just set up ldap on sarge (stable). the libnss-ldap and libpam-ldap seem to support ssl without a hitch. It seemed to be a lot of work until I read this document. 21 Jun 2005 15:53:48 +0200 I would like to thank you for this great guide. Tank you.sh? thanks [ Max.csr\" I would like to ask what is .sh new. 05-06-25: This script is used to sign the "certificate signing request" to have a signed certificate be created. Here’s a copy of sign. 18 May 2005 09:14:02 +0200 JXplorer (. Peter Hopfgartner Tue. Tanks a lot for this doc! I\’ve been looking for a tutorial like this. had everything up & running in about an hour (samba with ldap authentication) Great job! Thanks! Thu.sh./sign. 24 May 2005 20:08:29 +0200 Max. Kalle Happonen . Also.Wed. Claudio Lobo (from Brazil) Tue. 23 Jun 2005 10:22:37 +0200 According to \". It really helped me out after a recent sarge install./sigh. It\’s really works.
This action might not be possible to undo. Are you sure you want to continue?
We've moved you to where you read on your other device.
Get the full title to continue reading from where you left off, or restart the preview.