User Tools

Site Tools


ldap

This is an old revision of the document!


LDAP

This page is a reference for Hacklab's server admins.

Client Configuration

Quick reference for Debian LDAP client setup:

  • apt-get install sssd libpam-mkhomedir
  • edit /etc/ldap/ldap.conf
BASE    dc=edinburghhacklab,dc=com
URI     ldaps://ldap.ehlab.uk ldaps://ldap.edinburghhacklab.com
TLS_CACERT      /etc/ssl/certs/ca-certificates.crt
TLS_REQCERT     demand
  • edit /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
domains = hacklab

[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3

[pam]
reconnection_retries = 3

[domain/hacklab]
id_provider = ldap
auth_provider = ldap
ldap_schema = rfc2307
ldap_uri = ldaps://ldap.ehlab.uk,ldaps://ldap.edinburghhacklab.com
ldap_search_base = dc=edinburghhacklab,dc=com
ldap_id_use_start_tls = true
cache_credentials = true
ldap_tls_reqcert = demand
ldap_tls_cacert = /etc/ssl/certs/ca-certificates.crt
  • edit /etc/pam.d/common-session
# here are the per-package modules (the "Primary" block)
session [default=1]                     pam_permit.so
# here's the fallback if no module succeeds
session requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
session required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
session required        pam_unix.so 
session optional                                        pam_sss.so 
session optional        pam_mkhomedir.so skel=/etc/skel umask=0022
# end of pam-auth-update config
  • edit /etc/nsswitch.conf
passwd:         compat sss
group:          compat sss
shadow:         compat sss

hosts:          files dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis sss
ldap.1498223163.txt.gz · Last modified: 2017-06-23 13:06 by tim

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki