Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am currenty working on to setup a centralized authenticaion with OpenLDAP for Red Hat Linux .

Objective - Setup a Centralized OpenLDAP authentication for Red Hat Linux Servers where client can connect with ssh , user administration can be done from one server.

Please I am not looking for rpm or yum installation no cn=config. I want to configure with slapd.conf and ldap.conf

tar -xvf db-4.7.25.NC.tar.gz

   ls -ltr

   cp patch.4.7.25.1 patch.4.7.25.2 patch.4.7.25.3 patch.4.7.25.4 db-4.7.25.NC

   cd db-4.7.25.NC

   patch -p0 patch.4.7.25.1

   patch -p0 < patch.4.7.25.1

   patch -p0 < patch.4.7.25.2

   patch -p0 < patch.4.7.25.3

   patch -p0 < patch.4.7.25.4

   cd build_unix/

   ./dist/configure

    make

    make install

   export CPPFLAGS="-I/usr/local/BerkeleyDB.4.7/include"

   export LDFLAGS="-L/usr/local/BerkeleyDB.4.7/lib"

   export LD_LIBRARY_PATH=/opt/db-4.7.25.NC/build_unix/.libs

   vi /etc/profile

   source /etc/profile

   cd /opt/

   tar -xvzf openldap-2.4.23.tgz

   openldap-2.4.23

./configure  --with-tls --enable-accesslog --enable-auditlog --enable-dyngroup --enable-dynlist --enable-ppolicy --enable-bdb --enable-syslog --with-cyrus-sasl --with-threads --enable-crypt=yes --enable-ldap=yes --enable-proxycache=yes   

 make depend

make

make test

make install

   vi /usr/local/etc/openldap/slapd.conf

 slappasswd

my slapd.conf ---------------

database     bdb

suffix       "dc=exa,dc=com"

rootdn       "cn=Manager,dc=exa,dc=com"

rootpw {SSHA}PxEhMMYJvFRqT3L4fYYCmevrt22zYeDS

directory     /usr/local/var/openldap-data

======================================================

root objects for the LDAP database

cat exa.ldif

dn: dc=exa,dc=sea

dc: exa

description: Root LDAP entry for exa.sea

objectClass: dcObject

objectClass: organizationalUnit


dn: ou=People,dc=exa,dc=com

ou: People

description: All people in organisation

objectClass: organizationalUnit

I have added the entries successfully and can search the database but when I am trying to change password it is giving error message (Result: No such object (32) )

**cn: uid=naveen,ou=People,dc=exa,dc=com

uid: naveen

cn: naveen

objectClass: account

objectClass: posixAccount

objectClass: top

objectClass: shadowAccount

userPassword: {crypt}$1$SBo8cFfd$Nqc9yqobHxwiom/0BLPnf.

shadowLastChange: 12502

shadowMax: 99999

shadowWarning: 7

loginShell: /bin/bash

uidNumber: 2000

gidNumber: 2000

homeDirectory: /home/naveen**


===============================================
[root@localhost bob]# ldappasswd -vx -D "cn=Manager,dc=exa,dc=com" -W -
S "uid=naveen,ou=People,dc=exa,dc=com"

New password:

Re-enter new password:

ldap_initialize( <DEFAULT> )

Enter LDAP Password:

Result: No such object (32)

Could anyone suggest me a better way to do OpenLDAP Authenticaiton for Red Hat Linux with slapd.conf and client configuration.

client configuration -

authconfig-tui

ldap.conf slapd.conf

=======================================================================================

I solved the ldappasswd issue.

[root@localhost opt]# ldappasswd -vx -D "cn=Manager,dc=exa,dc=com" -W -S "cn=John Smith,ou=People,dc=exa,dc=com" 
New password: 
Re-enter new password: ldap_initialize( ) 
Enter LDAP Password: 
Result: Success (0) 
[root@localhost opt]#

Please advise me better way to authenticate Clients using OpenLDAP thanks.

Thanks in advance Naveen

share|improve this question
add comment

3 Answers

You should configure pam and nss-pam-ldapd on the client, to allow the LDAP directory servers to be used as a primary source of name service information for users, hosts, groups, and other.

Now all depends wich client you have, for fedora and rhel the "Deployment Guide" is a good resource.

Anyway you can configure them with system-config-authentication or authconfig authconfig-tui.

this command works to configure my fedora 19 machine against my openLdap directory:

authconfig --updateall --passalgo=md5 --enableldap --enableldapauth --ldapserver=myserver.mydomain --ldapbasedn=dc=mycompany --enableldaptls --enableldapstarttls --ldaploadcacert=http://myserver.mydomain/server.pem

For other distros you must googling a bit.

share|improve this answer
add comment

Your question is pretty badly formed, Naveen. It seems like you know what you want to do, but you haven't really thought through (or researched) how to accomplish it.

The general outline for setting up LDAP-based authentication is:

  1. Decide on a directory structure
    You need to figure out what your LDAP directory will look like.
    Think like an AD deployment (much as it pains me to say such things).
  2. Install an LDAP server
    You should use Yum/Apt/whatever your OS standard way of installing stuff is for this part.
    There's no sense in making work for yourself by building it from source unless you have to.
  3. Add the RFC 2307 schema, and anything else you need
    RFC 2307 is the minimum. You probably also want to add the sudo schema if you use sudo, and the OpenSSH LDAP Public Keys schema if you use SSH.
  4. Configure your OS
    Enable the OpenSSH-LPK (LDAP Public Keys) patch if you intend to use it.
    Install pam_ldap/nss_ldap (or pam_ldapd) and add LDAP to your nsswitch.conf file.
  5. Populate your LDAP Directory
    Add a couple of users and groups.
  6. Test and Profit.

There are a number of tutorials which will help you out if you google around.
There are also some words from RedHat on the subject, though I can't vouch for their accuracy as I don't run RedHat in my environment.

share|improve this answer
    
Thanks a lot for the suggestions. –  Naveen Aug 12 '12 at 16:08
add comment

This should help you -- http://www.gentoo.org/doc/en/ldap-howto.xml

share|improve this answer
1  
Welcome to Server Fault! We really do prefer that answers contain content not pointers to content. Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Iain Aug 10 '12 at 15:59
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.