LDAP authentication on Debian
This article tries to sum up what is needed to use LDAP to authenticate users in your network. (If you want to switch from NIS to LDAP then purge the 'nis' package before going on.) Although the principle is simple there are a number of caveats.
Server
You need a database that you can query through LDAP. Let's use OpenLDAP for it:
aptitude install openldap
Clients
Install at least 'libnss-ldap':
aptitude install libnss-ldap
'NSS' means name server switch
Only root will have access to shadow passwords via NSS. The ldap PAM module will only be used for passwd, chfn, and chsh updating of LDAP contents. All posix passwords shall use md5 hashing.
Sources
Since there was apparently no document in english describing this setup properly (although there are virtually dozens of web pages trying to deal with this issue) I had to copy together a few sources and play around until everything worked. These are some URLs I read:
Also kudos to http://www.padl.com/ who wrote and published PAM-LDAP and NSS-LDAP unter the GPL.
- SAMBA passwords can also be stored in LDAP, with a samba-ldap module being used to synchronise password updates via the "passwd" command. The unix passwords in LDAP should be updated by samba when passwords are changed via samba. I'm not sure what the best tools are for user management, but it would be nice to have replacements for the standard "adduser" "usermod" etc tools. It would also be nice to have a webmin management interface. I'll include seting up autofs to automount home directories off the server, and configuring samba to also share the same home directories.
- Tools
- getent will return the current nss view of passwd, shadow, group whatever. This is handy to check that nss is using ldap correctly. In particular, if getent shadow as root returns a shadow file with passwords, then the PAM unix module can do authentication without using libpam-ldap. If getent shadow as non-root returns passwords, you have a security hole:
$ getent <etcfile>
$ ldapsearch -x uid=<username>
OpenLdap Setup
- 1 Do apt-get install slapd, answering prompts as required and generaly picking defaults except where they are obviously examples. 2 To make using ldap utilities like ldapsearch a little less painful, edit /etc/ldap/ldap.conf (installed by libldap2 on woody) to set:
BASE dc=<yourhost>,dc=<your>,dc=<domain> URI ldap://localhost
- index objectClass,uid,uidNumber,gidNumber eq index cn,mail,surname,givenname eq,subinitial
- $ /etc/init.d/slapd stop $ slapindex $ /etc/init.d/slapd start
MigrationTools Importing Data
- 1 Do apt-get install migrationtools (for woody, though I wouldn't be surprised if this package gets renamed). 2 Edit /etc/migrationtools/migratecommon.ph, changing the following lines. Note the EXTENDED_SCHEMA is set to 1 in many other documents. I found that this caused problems for me as I don't know if Debian includes all the additional schema definitions in /etc/ldap/schema/:
- # Default DNS domain $DEFAULT_MAIL_DOMAIN = "yourhost.your.domain"; # Default base $DEFAULT_BASE = "dc=yourhost,dc=your,dc=domain"; # turn this on to support more general object clases # such as person. $EXTENDED_SCHEMA = 0; # Uncomment these to avoid Debian managed system users and groups $IGNORE_UID_BELOW = 1000; $IGNORE_GID_BELOW = 100;
- # cd /usr/share/migrationtools # LDAPADD="/usr/bin/ldapadd -c" ./migrate_all_online.sh
- 1 Do apt-get install slapd, answering prompts as required and generaly picking defaults except where they are obviously examples. 2 To make using ldap utilities like ldapsearch a little less painful, edit /etc/ldap/ldap.conf (installed by libldap2 on woody) to set:
NssLdap Setup
- 1 Do apt-get install nscd to install the libc caching daemon. This makes a performance difference but it will work without it. 2 Do apt-get install libnss-ldap ldap-utils to install the nss ldap package and ldapsearch utility. 3 Edit /etc/ldap/ldap.conf to make life easier when using ldap utilities to include:
BASE dc=<yourhost>,dc=<your>,dc=<domain> URI ldap://yourhost.your.domain
- # Your LDAP server. Must be resolvable without using LDAP. host yourhost.your.domain # The distinguished name of the search base. base dc=yourhost,dc=your,dc=domain # The LDAP version to use (defaults to 3 if supported by client library) ldap_version 3 # The distinguished name to bind to the server with if the effective user ID is root. # Password is stored in /etc/ldap.secret (mode 600) rootbinddn cn=admin,dc=yourhost,dc=your,dc=domain
- Note that yourhost.your.domain had better be in /etc/hosts, otherwise use the LDAP servers IP address. Only the rootbinddn setting is not automaticly configured in Debian.
- passwd: files ldap group: files ldap shadow: files ldap hosts: files dns ldap networks: files ldap protocols: db files services: db files ethers: db files rpc: db files netgroup: nis
PamLdap Setup
- libpam-ldap is not needed for authentication, as this can be done with pam_unix, which uses nsswitch. However it is needed for updating LDAP with passwd. Also it can be used to create home directories on the fly (on first login). Provided getent behaves as described under Tools above, only /etc/pam.d/passwd needs to be tweaked.
- 1 Do apt-get install libpam-ldap 2 Change /etc/pam.d/passwd to include the following:
- password required pam_ldap.so ignore_unknown_user md5 password optional pam_unix.so nullok obscure min=4 max=8 md5 try_first_pass
- 1 Do apt-get install libpam-ldap 2 Change /etc/pam.d/passwd to include the following:
PamSambaLdap Setup
- I'm sure I found a PAM module that would update samba passwords in LDAP for you. I believe the sambapass utility will do this too if samba has been configured to use LDAP. More on this when I get it sorted... This method is superior to the update encryped = yes method from sambas smb.conf as it allows the samba server using encrypted passwords during transistion time. In the mean time, here are some links
http://us4.samba.org/samba/ftp/docs/htmldocs/Samba-LDAP-HOWTO.html
http://us4.samba.org/samba/ftp/docs/htmldocs/Samba-PDC-HOWTO.html
AutoFs Setup NFServer Setup
AutoFs Client Setup
SamBa Setup
- 1 Do apt-get install nscd to install the libc caching daemon. This makes a performance difference but it will work without it. 2 Do apt-get install libnss-ldap ldap-utils to install the nss ldap package and ldapsearch utility. 3 Edit /etc/ldap/ldap.conf to make life easier when using ldap utilities to include:
- getent will return the current nss view of passwd, shadow, group whatever. This is handy to check that nss is using ldap correctly. In particular, if getent shadow as root returns a shadow file with passwords, then the PAM unix module can do authentication without using libpam-ldap. If getent shadow as non-root returns passwords, you have a security hole:
