SPARCS 10 이대근 (harry)

Contents  Directory Service  What is LDAP?  Installation  Configuration  ldap-utils  User authentication with LDAP

Question  How can an organization keep one centralized up-to-date phone book that everybody has access to?  How can SPARCS share login information among all servers?

Directory  A directory is a map of the differences between names and values  More than directories of file system

Directory: examples WordDefinition Dictionary NamePhone number Telephone directory Domain nameIP address DNS

Directory service  The software system that stores, organizes and provides access to information in a directory

Directory service vs RDBMS Directory serviceRelational DBMS  Be read more often  Data may be redundant if it helps performance  Must  May  Namespace  Be written more often  Data must be unique (in most case)  Not null  Nullable

X.500  A series of computer networking standards covering electronic directory services  Protocols DAP: Directory Access Protocol DSP: Directory System Protocol DISP: Directory Information Shadowing Protocol DOP: Directory Operational Bindings Management Protocol

X.500 Directory service

LDAP  Lightweight Directory Access Protocol i.e., Lightweight DAP  A protocol to access directory service through TCP/IP  Designed at the University of Michigan

Directory structure File system

Directory structure LDAP

Available backend types TypeDescription bdbBerkeley DB transactional backend dnssrvDNS SRV backend ldbmLightweight DBM backend ldapLDAP (Proxy) backend metaMeta Directory backend monitorMonitor backend passwdProvides read-only access to passwd(5) perlPerl programmable backend shellShell (external program) backend sqlSQL programmable backend

Installation  Server apt-get install slapd  Client apt-get install ldap-utils

/etc/ldap/ldap.conf include /etc/ldap/schema/core.schema schemacheck on pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd.args loglevel 0 database bdb suffix "dc=sparcs,dc=net" rootdn "cn=DsnManager,dc=sparcs,dc=net" rootpw {SSHA}8DihK78pIOVntXZftMugdq4rxhYat03R

slappasswd  Nice tool to generate hashed password  Sample output: {SSHA}8DihK78pIOVntXZftMugdq4rxhYat03R  You just need to copy&paste the output to configuration file

Access Control List  access to by [ by … ]

Access Control List: Example defaultaccess none access to * by self write by dn=“.+” read by dn=“^$$” read by * none #No permission by default #Granting permission for all entries #A user entry can modify itself #An authenticated user can read #An anonymous user can read #Else granting no permission

Access Control List: Example access to dn=“.*,dc=(.*),dc=(.*),dc=net” attrs=children,entry,uid by dn=“cn=Administrator,dc=$1,dc=$2” write

Caution  No blank around separator(,) dn=“dc=example,dc=com”(O) dn=“dc=example, dc=com”(X)  ACL is not overridden Details should precede the general configs  The more complicated ACL, the slower search results

ldap-utils  Common usage –D –W –f

ldapadd  Define which schema is used objectclass: dcobject  Describe all ‘Must’ attributes dn: dc=mydomain,dc=com dc: database

ldapadd: example objectclass: dcobject dn: dc=mydomain,dc=com dc: database

ldapsearch: scope

ldapsearch: filters  (cn=harry)  (cn=h*)  (cn~=pipe)  (cn>=harry)  (&(cn=h*)(cn=*y))  (|(cn=h*)(cn=*y))  (!(cn=harry))

ldapsearch: example sn=Daniels givenname=Charlene

ldapmodify  Declare which entry you want to modify dn: cn=harry,dc=sparcs,dc=org  State what kind of change will occur changetype: modify / add / delete  (if changetype: modify) State what kind of modification will occur replace: cn add: sn delete: sn  Enter the value of the attribute if necessary cn: hodduc

ldapmodify: example dn: cn=harry,dc=sparcs,dc=org changetype: modify replace: cn cn: hodduc

ldapmodrdn  Declare which entry you want to modify  Enter new RDN

ldapmodrdn: example cn=harry,dc=sparcs,dc=org cn=noname

Client  apt-get install libnss-ldap libpam-ldap nss-updatedb nscd ldap-auth-client  Configuration files /etc/ldap.conf /etc/auth-client-config/profile.d/ldap-auth- config /etc/pam.d/ /etc/nssswitch.conf

Server  Automatic migration tools apt-get install migrationtools

Web sites & Documentations  Nice KOREAN document explaining how to configure for LDAP authentication  Also nice Korean document explaining general usage of LDAP

I’m very sleepy