Configure LDAP Server
2011/05/02 |
Configure LDAP Server in order to share users' accounts among local networks. |
|
[1] | Install openldap |
root@master:~# aptitude -y install slapd ldap-utils # Input LDAP admin password during installation # check working root@master:~# slapcat dn: dc=srv,dc=world objectClass: top objectClass: dcObject objectClass: organization o: srv.world dc: srv structuralObjectClass: organization entryUUID: 0f4d7992-0927-1030-9161-7bbd7bc675e4 creatorsName: cn=admin,dc=srv,dc=world createTimestamp: 20110502164332Z entryCSN: 20110502164332.222124Z#000000#000#000000 modifiersName: cn=admin,dc=srv,dc=world modifyTimestamp: 20110502164332Z dn: cn=admin,dc=srv,dc=world objectClass: simpleSecurityObject objectClass: organizationalRole cn: admin description: LDAP administrator userPassword:: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx= structuralObjectClass: organizationalRole entryUUID: 0f5ed458-0927-1030-9162-7bbd7bc675e4 creatorsName: cn=admin,dc=srv,dc=world createTimestamp: 20110502164332Z entryCSN: 20110502164332.335892Z#000000#000#000000 modifiersName: cn=admin,dc=srv,dc=world modifyTimestamp: 20110502164332Z |
[2] | Add new directory |
root@master:~# vi base.ldif # create new # change to your own suffix for the field 'dc=srv,dc=world'
dn: ou=people,dc=srv,dc=world objectClass: organizationalUnit ou: people dn: ou=groups,dc=srv,dc=world objectClass: organizationalUnit ou: groups root@master:~# ldapadd -x -D cn=admin,dc=srv,dc=world -W -f base.ldif Enter LDAP Password: # LDAP admin password (set in installation of openldap) adding new entry "ou=people,dc=srv,dc=world" adding new entry "ou=groups,dc=srv,dc=world" |
[3] | Add existing local users to LDAP directory |
root@master:~# vi ldapuser.sh # extract local users who have 4-digit UID # an example
#!/bin/bash SUFFIX='dc=srv,dc=world' LDIF='ldapuser.ldif' echo -n > $LDIF for line in `grep "x:[1-9][0-9][0-9][0-9]:" /etc/passwd | sed -e "s/ /%/g"` do UID1=`echo $line | cut -d: -f1` NAME=`echo $line | cut -d: -f5 | cut -d, -f1` if [ ! "$NAME" ] then NAME=$UID1 else NAME=`echo $NAME | sed -e "s/%/ /g"` fi SN=`echo $NAME | awk '{print $2}'` if [ ! "$SN" ] then SN=$NAME fi GIVEN=`echo $NAME | awk '{print $1}'` UID2=`echo $line | cut -d: -f3` GID=`echo $line | cut -d: -f4` PASS=`grep $UID1: /etc/shadow | cut -d: -f2` SHELL=`echo $line | cut -d: -f7` HOME=`echo $line | cut -d: -f6` EXPIRE=`passwd -S $UID1 | awk '{print $7}'` FLAG=`grep $UID1: /etc/shadow | cut -d: -f9` if [ ! "$FLAG" ] then FLAG="0" fi WARN=`passwd -S $UID1 | awk '{print $6}'` MIN=`passwd -S $UID1 | awk '{print $4}'` MAX=`passwd -S $UID1 | awk '{print $5}'` LAST=`grep $UID1: /etc/shadow | cut -d: -f3` echo "dn: uid=$UID1,ou=people,$SUFFIX" >> $LDIF echo "objectClass: inetOrgPerson" >> $LDIF echo "objectClass: posixAccount" >> $LDIF echo "objectClass: shadowAccount" >> $LDIF echo "uid: $UID1" >> $LDIF echo "sn: $SN" >> $LDIF echo "givenName: $GIVEN" >> $LDIF echo "cn: $NAME" >> $LDIF echo "displayName: $NAME" >> $LDIF echo "uidNumber: $UID2" >> $LDIF echo "gidNumber: $GID" >> $LDIF echo "userPassword: {crypt}$PASS" >> $LDIF echo "gecos: $NAME" >> $LDIF echo "loginShell: $SHELL" >> $LDIF echo "homeDirectory: $HOME" >> $LDIF echo "shadowExpire: $EXPIRE" >> $LDIF echo "shadowFlag: $FLAG" >> $LDIF echo "shadowWarning: $WARN" >> $LDIF echo "shadowMin: $MIN" >> $LDIF echo "shadowMax: $MAX" >> $LDIF echo "shadowLastChange: $LAST" >> $LDIF echo >> $LDIF done root@master:~# sh ldapuser.sh root@master:~# ldapadd -x -D cn=admin,dc=srv,dc=world -W -f ldapuser.ldif Enter LDAP Password: # admin password adding new entry "uid=narwhal,ou=people,dc=srv,dc=world" adding new entry "uid=ubuntu,ou=people,dc=srv,dc=world" adding new entry "uid=fedora,ou=people,dc=srv,dc=world" |
[4] | Add existing local groups to LDAP directory |
root@master:~# vi ldapgroup.sh # extract local groups who have 4-digit UID # an example
#!/bin/bash SUFFIX='dc=srv,dc=world' LDIF='ldapgroup.ldif' echo -n > $LDIF for line in `grep "x:[1-9][0-9][0-9][0-9]:" /etc/group` do CN=`echo $line | cut -d: -f1` GID=`echo $line | cut -d: -f3` echo "dn: cn=$CN,ou=groups,$SUFFIX" >> $LDIF echo "objectClass: posixGroup" >> $LDIF echo "cn: $CN" >> $LDIF echo "gidNumber: $GID" >> $LDIF users=`echo $line | cut -d: -f4 | sed "s/,/ /g"` for user in ${users} ; do echo "memberUid: ${user}" >> $LDIF done echo >> $LDIF done root@master:~# sh ldapgroup.sh root@master:~# ldapadd -x -D cn=admin,dc=srv,dc=world -W -f ldapgroup.ldif Enter LDAP Password: # admin password adding new entry "cn=narwhal,ou=groups,dc=srv,dc=world" adding new entry "cn=ubuntu,ou=groups,dc=srv,dc=world" adding new entry "cn=fedora,ou=groups,dc=srv,dc=world" |
[5] | If you'd like to delete User or Group in LDAP, Do as below. |
root@master:~# ldapdelete -x -W -D 'cn=admin,dc=srv,dc=world' "uid=ubuntu,ou=people,dc=srv,dc=world" Enter LDAP Password: root@master:~# ldapdelete -x -W -D 'cn=admin,dc=srv,dc=world' "cn=ubuntu,ou=groups,dc=srv,dc=world" Enter LDAP Password: |