ubuntu使用LDAP做用户管理

ubuntu 14.04 LDAP configure summary

-v0.1 2014.1.4 *** draft, not finish backup part, not include samba part,

not include add_content.ldif, not migrate /etc/group information

LDAP is one way to implement centralized authentication in linux system. This

not talks about how to make related configurations to implement centralized

authentication in ubuntu 14.04.

The basic view about centralized authentication using LDAP are as below:

1. We need a server(A) to install LDAP server which has the accounts'

information and deals with authentication requests.

2. We need to install LDAP client in another server(B) which you want to login.

3. You can login server B after adding relative account in LDAP server. Or if

you already have some accounts information, you can login from another

server using LDAP server.

Configure LDAP server

------------------------------

1. sudo apt-get install slapd ldap-utils

During the install process, it needs to fill in some basic configurations.

You can also use command below to change them.

2. sudo dpkg-reconfigure slapd

Refer to [1] to see how to configure.

3. Add groups, users.

You can use ldif file to do this, another way is to use ldapscripts.

(1) ldif way

a. Edit ldif file as below: vi add_content.ldif

...

b. Add users, groups, users' directory and groups' directory as below;

ldapadd -x -D cn=admin, dc=company, dc=com -W -f add_content.ldif

it will appear:

Enter LDAP Password:

adding new entry "ou=User,dc=company,dc=com"

...

NOTE: if failed there, mostly you should check basic slapd configure.

c. ldapdelete -x -D "cn=admin,dc=company,dc=com" -W "uid=test,ou=User,dc=company"

Using above command to delete one entry.

ldapsearch -x -LLL -b dc=company,dc=com

Using above command to search information of all entries.

(2) ldapscripts way

a. sudo apt-get install ldapscripts

b. Configure /etc/ldapscripts/ldapscripts.conf:

SERVER=localhost

SUFFIX="dc=company,dc=com"

GSUFFIX="ou=Groups"

USUFFIX="ou=Users"

BINDDN="cn=admin,dc=company,dc=com"

BINDPWDFILE="/etc/ldapscripts/ldapscripts.passwd"

c. echo -n "your_root_passwd_for_ldap" > /etc/ldapscripts/ldapscripts.passwd

d. User relative command to add group, user: ldapadduser, ldapaddgroup

NOTE: We can add an account by ldapadduser account_name group_name.

e.g. ldapadduser test User

Use c step above to write password to ldapscripts.passwd. This

will *NOT* write "\n" at the end of password line.

Configure LDAP client[2]

---------------------------------

1. sudo apt-get install libpam-ldap nscd

When installing libpam-ldap, it will ask you to configure LDAP client during

the install process. You can also change the configuration as below.

2. sudo apt-get install ldap-auth-config

sudo dpkg-reconfigure ldap-auth-config[2]

3. Modify /etc/nsswitch.conf to choose how to make authentication:

passwd: files ldap

group: files ldap

shadow: files ldap

NOTE: You'd better put "filles" befort "ldap"

4. Build home directory automatically in LDAP client[3]

add line: session required pam_mkhomedir.so skel=/etc/skel/ umask=0022

to /etc/pam.d/common-account

Migrate accounts information

--------------------------------------

If you already have users information in /etc/passwd, /etc/group, /etc/shadow,

and you want to use LDAP manage users information, you can do as below:

1. sudo apt-get install migrationtools

2. Modify /etc/migrationtools/migrate_common.ph:

$DEFAULT_BASE = "dc=company,dc=com";

3. /usr/share/migrationtools/migrate_passwd.pl /etc/passwd add_people.ldif

4. Modify add_people.ldif:

Change the information about group for every user.

Copy the encrypted pass word in /etc/shadow to replace "x" in "userPassword: {crypt}x"

attribution in add_people.ldif

FIXME...

5. ldapadd -x -D cn=admin,dc=company,dc=com -W -f add_people.ldif

NOTE: I just need the password information here. If you want login using LDAP,

you should also consider to migrate group information in /etc/group

Backup existed LDAP date

-----------------------------------

...

Reference:

[1] https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-a-basic-ldap-server-on-an-ubuntu-12-04-vps
[2] https://www.digitalocean.com/community/tutorials/how-to-authenticate-client-computers-using-ldap-on-an-ubuntu-12-04-vps
[3] http://www.debian-administration.org/article/403/Giving_users_a_home_directory_automatically