OpenLDAP Installation & Configuration June 2010 Penguins Unbound By Loren Cahlander 1 Copyright 2010 Syntactica

Agenda Installing OpenLDAP –Ubuntu Server Initial configuration of OpenLDAP Installing a web-based administration tool Configuring Apache2 to use LDAP for authentication Copyright 2010 Syntactica 2

Installing OpenLDAP Copyright 2010 Syntactica 3 Apt-get command sudo apt-get install slapd ldap-utils ldap-account-manager To clear an existing database sudo dpkg-reconfigure slapd

Initial Configuration Now add a few schemata (only core.schema is provided by default): Copyright 2010 Syntactica 4 ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif

Database Setup (db.ldif) Copyright 2010 Syntactica 5 # Load modules for database type dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb # Load modules for database type dn: cn=module{0},cn=config objectClass: olcModuleList cn: module{0} olcModulePath: /usr/lib/ldap olcModuleLoad: {0}back_hdb

Create Directory Database Copyright 2010 Syntactica 6 # Create directory database dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=exist-db,dc=org olcRootDN: cn=admin,dc=exist-db,dc=org olcRootPW: 1234 olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=exist-db,dc=org" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=exist-db,dc=org" write by * read olcLastMod: TRUE olcDbCheckpoint: olcDbConfig: {0}set_cachesize olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: uid pres,eq olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq # Create directory database dn: olcDatabase={1}hdb,cn=config objectClass: olcDatabaseConfig objectClass: olcHdbConfig olcDatabase: {1}hdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=exist-db,dc=org olcRootDN: cn=admin,dc=exist-db,dc=org olcRootPW: 1234 olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=exist-db,dc=org" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=exist-db,dc=org" write by * read olcLastMod: TRUE olcDbCheckpoint: olcDbConfig: {0}set_cachesize olcDbConfig: {1}set_lk_max_objects 1500 olcDbConfig: {2}set_lk_max_locks 1500 olcDbConfig: {3}set_lk_max_lockers 1500 olcDbIndex: uid pres,eq olcDbIndex: cn,sn,mail pres,eq,approx,sub olcDbIndex: objectClass eq

Defaults Modifications Copyright 2010 Syntactica 7 ########################################################### # DEFAULTS MODIFICATION ########################################################### # Some of the defaults need to be modified in order to allow # remote access to the LDAP config. Otherwise only root # will have administrative access. dn: cn=config changetype: modify delete: olcAuthzRegexp dn: olcDatabase={-1}frontend,cn=config changetype: modify delete: olcAccess dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {CRYPT}7hzU8RaZxaGi2 dn: olcDatabase={0}config,cn=config changetype: modify delete: olcAccess ########################################################### # DEFAULTS MODIFICATION ########################################################### # Some of the defaults need to be modified in order to allow # remote access to the LDAP config. Otherwise only root # will have administrative access. dn: cn=config changetype: modify delete: olcAuthzRegexp dn: olcDatabase={-1}frontend,cn=config changetype: modify delete: olcAccess dn: olcDatabase={0}config,cn=config changetype: modify add: olcRootPW olcRootPW: {CRYPT}7hzU8RaZxaGi2 dn: olcDatabase={0}config,cn=config changetype: modify delete: olcAccess

Loading the database setup Copyright 2010 Syntactica 8 sudo ldapadd -Y EXTERNAL -H ldapi:/// -f db.ldif

Creating the Initial Directory Tree Copyright 2010 Syntactica 9 dn: dc=exist-db,dc=org objectClass: dcObject objectClass: organization o: exist-db.org dc: exist-db description: Tree root dn: dc=exist-db,dc=org objectClass: dcObject objectClass: organization o: exist-db.org dc: exist-db description: Tree root

Load the Initial Database Copyright 2010 Syntactica 10 You can now load this configuration file into the LDAP database with the ldapadd command.: sudo ldapadd -x -D cn=admin,dc=exist-db,dc=org -W -f /home/exist/base.ldif When prompted for the password, use "1234" unless you changed the value in db.ldif.

configure the ldap-account-manager Copyright 2010 Syntactica 11 sudo vi /etc/apache2/sites-available/default-ssl Add the following to default-ssl. It creates the alias of to the PHP pages that administer the groups and users within the LDAP server. Alias /lam/ "/usr/share/ldap-account-manager/" Options Indexes MultiViews FollowSymLinks AllowOverride None Order deny,allow Deny from all Allow from all Alias /lam/ "/usr/share/ldap-account-manager/" Options Indexes MultiViews FollowSymLinks AllowOverride None Order deny,allow Deny from all Allow from all

Enable the LDAP module within Apache Copyright 2010 Syntactica 12 sudo a2enmod ldap sudo a2enmod authnz_ldap sudo /etc/init.d/apache2 reload sudo a2enmod ldap sudo a2enmod authnz_ldap sudo /etc/init.d/apache2 reload The LDAP module is now enabled.

Copyright 2010 Syntactica 13

Copyright 2010 Syntactica 14

Copyright 2010 Syntactica 15 Password is lam

Copyright 2010 Syntactica 16 Replace the values to match your database

Copyright 2010 Syntactica 17 Replace the values to match your database Remove Hosts and Samba

Copyright 2010 Syntactica 18 Remove the Shadow and Samba modules

Copyright 2010 Syntactica 19 Check the fields that you do not want in the create user page

Copyright 2010 Syntactica 20

Copyright 2010 Syntactica 21 Password is 1234

Copyright 2010 Syntactica 22

Questions? Loren Cahlander Syntactica 7400 Metro Boulevard Suite 350 Edina, MN Copyright 2010 Syntactica 23