Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have Openldap configured here and users are able to use ldap for login to client machines. But any way to check the users currently logged into machines using LDAP ? I would like to find which user has logged into which machine using LDAP ?

share|improve this question
add comment

8 Answers

up vote 14 down vote accepted

AFAIK LDAP does not implement session management - it just provides a directory service - and its data can be cached heavily elsewhere. Also it can provide information other than authentication. So there's no such thing as "logged into LDAP" and no way to practically measure it.

Presumably you maintain your LDAP implementation so that your users can access applications - you'd need to look at these applications to determine who currently has an open session (assuming the applications are stateful - HTTP is not).

share|improve this answer
    
Can any LDAP monitors accomplish it ? –  nitins Sep 14 '10 at 12:39
    
+1. Each application is responsible for their own session management. When (if) sessions expire, they revalidate against the LDAP server. –  gWaldo Sep 14 '10 at 12:53
    
@nitins I believe so, I think that's what a Barracuda Web Filter does, see my answer below. –  JamesBarnett May 23 '11 at 9:51
add comment

Quoting symcbean, "there is no such thing as logged into ldap". But there is such a thing as users who authenticate through ldap.

More specifically, when you configure your host to use an authentication backend like ldap, the Name Service Switch (nsswitch) could (and arguably should) cache your user information to allow you to log into your system. Actually, from my point of view, it does not matter if data is being cached, it is still information comming from that backend.

Users whether they belong to NIS, Unix or ldap backend have an UID. In a proper configured system, UID from one backend should not match those in another backend (usually unix and ldap backends live together).

To finally make my point, you have a /etc/passwd, and the output of getent passwd, which should not match (ldap extends unix backend), therefore you know which users exists solely on ldap. Last, you have last :D which will tell you who logged in when from where, besides the syslog facility auth to double check. You could make a simple script that could tell you which ldap users logged in with this information on a per host basis.

NOTE: if you have duplicated users in unix and ldap, with same IDs then you'r on your own :)

share|improve this answer
add comment

I largely agree woth symcbean's answer (http://serverfault.com/questions/180918/find-users-currently-logged-in-using-ldap/180931#180931), but...

You could try parsing the DC's security logs, but that will return a lot of data. Depending on what you want to do with the data long-term, it may be worth sending into a database.

===

I'm not sure about OpenLDAP, but on AD, you can set Group Policy and/or a login script to run (in Windows Batch):

echo logon %username% %computername% %date% %time% >> \\shared\path\FILE_LOCATION.txt

Either parse out the username or computername from FILE_LOCATION.txt, or: Save by computername by:

echo logon %username% %computername% %date% %time% >> \\shared\path\%computername%.txt

Likewise, save by username with:

echo logon %username% %computername% %date% %time% >> \\shared\path\%username%.txt
share|improve this answer
    
Except that the tags are for Linux and OpenLDAP. Yours is a good answer for AD domains (and i've done similar stuff) but not really applicable for the question. It also doesn't tell you who's currently logged in (which is what the question is really asking), just where they last logged in. –  mfinni Nov 2 '10 at 17:22
    
@mfinni - I acknowledged that I wasn't sure if it was possible in OpenLDAP, but the scripts say who logged in where last. LDAP does not maintain state (so you could poll that info directly), but using the information provided by this method (yes, it'd have to be ported to a *nix shell) you could check that machine for logged in users... I admit it's not a complete solution, but it does give an idea that would get you most of the way there. (And further than the asker is now... –  gWaldo Nov 2 '10 at 20:31
2  
True enough. It probably depends more on what the asker has in his whole environment. LDAP is just LDAP - it's the client side mechanism that determines if anything is done other than "user is authenticated? yes/no". With AD, this is integrated between LDAP, Kerberos, and the GINA at the client side. The questioner hasn't told us what's on his client side, and I don't know if there is a standard LDAP plugin on most Linux distros. PAM, maybe? –  mfinni Nov 2 '10 at 20:44
    
Yea, I'm trying to not project my own environment and preferences on the question... –  gWaldo Nov 3 '10 at 1:34
add comment

Generally you cannot. You could try and implement it, so that some LDAP attribute is updated every time a user logs in and out an application, but this is overkill. From the question I am assuming that OpenLDAP is used as a central directory and users with credentials stored in it login to a number of linux machines in your network. If that is the case, then you need to install something like finger and then "finger" every machine in the network to see who is logged in.

share|improve this answer
    
Yes, OpenLDAP is used as a central directory with credentials stored in it login to client machines –  nitins Nov 3 '10 at 7:38
add comment

Perhaps the client machines should authenticate via RADIUS instead — it does accounting in addition to authentication.

share|improve this answer
add comment

You could achieve it using LDAP+kerberos, but not every application that can logon to LDAP can use kerberos for authentication.

You can use FreeIPA to get it in a easy-to-use package.

share|improve this answer
add comment

Personally I like where gWaldo is going but like mfinni said, we might be talking about linux machines.

This may be overkill but... a Barracuda Web Filter can do that, IIRC.

I think you can do something like this with a barracuda web filter that uses LDAP authentication. IIRC the barracuda maintains a list of everyone currently authenticated to it. I used it in an AD environment but it should work with all flavors of LDAP.

share|improve this answer
add comment

For us, the command:

users

did the trick.

It lists local, LDAP and SSH user logins. So far as I can tell it only fails to report if root is logged in. We have Ubuntu 12.04 on the clients and server.

We have OpenLDAP backing up our authentication via PAM and NSSwitch with NFS mounted home dirs. It is probably important to get your /etc/idmapd.conf sorted out with a domain declaration is important. (prior to our organization doing so, ls -l would return file owner and group as nobody:nobody on clients but at that time)

Sorry to answer such an old question, but I had the same issue and wound up here for an answer before I sorted it out on my own. Please don't down vote my answer if this does not work for you.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.