ldap:setup

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
ldap:setup [2023/10/22 14:24] – AntranigVartanianldap:setup [2023/10/22 20:25] (current) – Copyedit and proofread pass, by request. PauAmma
Line 1: Line 1:
 To setup a basic LDAP server with Unix user management, we will need the following To setup a basic LDAP server with Unix user management, we will need the following
  
-  * %%OpenLDAP%% as a LDAP Server+  * %%OpenLDAP%% as an LDAP Server
   * [[https://www.freshports.org/net/ldapscripts/|ldapscripts]] to manage Unix users in LDAP   * [[https://www.freshports.org/net/ldapscripts/|ldapscripts]] to manage Unix users in LDAP
  
Line 15: Line 15:
 </code> </code>
  
-Please keep in mind that the version might change in the future, i.e. ''%%openldap27-server%%''. You can run ''%%pkg search openldap%%'' to find the latest version.+Please keep in mind that the version may change in the future, e.g. ''%%openldap27-server%%''. You can run ''%%pkg search openldap%%'' to find the latest version.
  
 ===== Configuring LDAP ===== ===== Configuring LDAP =====
  
-We start by modifying ''%%/usr/local/etc/openldap/ldap.conf%%'', and use the following inside.+Start by modifying ''%%/usr/local/etc/openldap/ldap.conf%%'', and use the following inside:
  
 <code> <code>
Line 26: Line 26:
 </code> </code>
  
-Next, we edit ''%%/usr/local/etc/openldap/slapd.conf%%'' and we modify/set the following:+Next, edit ''%%/usr/local/etc/openldap/slapd.conf%%'' and modify/set the following:
  
-  * Append the following after ''%%core.schema%%''+  * Append the following after ''%%core.schema%%'':
  
 <code> <code>
Line 36: Line 36:
  
   * Uncomment ''%%moduleload      back_ldap%%''   * Uncomment ''%%moduleload      back_ldap%%''
-  * Set a root password for the ''%%config%%'' database+  * Set a root password for the ''%%config%%'' database:
  
 <code> <code>
-rootpw VerySecretAutoGeneratePassword+rootpw VerySecretAutoGeneratedPassword
 </code> </code>
  
-  * Set the ''%%suffix%%'' and ''%%rootdn%%'' at ''%%mdb%%'' database+  * Set the ''%%suffix%%'' and ''%%rootdn%%'' for the ''%%mdb%%'' database:
  
 <code> <code>
Line 49: Line 49:
 </code> </code>
  
-  * Set the root password for the ''%%mdb%%'' database using ''%%slappasswd%%'' utility+  * Set the root password for the ''%%mdb%%'' database using ''%%slappasswd%%'' utility:
  
 <code> <code>
Line 55: Line 55:
 </code> </code>
  
-Finally, we edit ''%%/usr/local/etc/openldap/slapd.ldif%%'' and modify the following inside+Finally, edit ''%%/usr/local/etc/openldap/slapd.ldif%%'' and modify the following inside:
  
-  * Set ''%%olcSuffix%%'' and ''%%olcRootDN%%''+  * Set ''%%olcSuffix%%'' and ''%%olcRootDN%%'':
  
 <code> <code>
Line 64: Line 64:
 </code> </code>
  
-  * Set ''%%olcRootPW%%''+  * Set ''%%olcRootPW%%'':
  
 <code> <code>
Line 72: Line 72:
 ===== Installing LDAPScripts ===== ===== Installing LDAPScripts =====
  
-LDAPScripts is a collection of scripts to manage posix accounts in an %%OpenLDAP%% directory+LDAPScripts is a collection of scripts to manage POSIX accounts in an %%OpenLDAP%% directory.
  
 <code> <code>
Line 80: Line 80:
 ===== Configuring LDAPScripts ===== ===== Configuring LDAPScripts =====
  
-We edit the following file ''%%/usr/local/etc/ldapscripts/ldapscripts.conf%%'' and modify the following:+Edit file ''%%/usr/local/etc/ldapscripts/ldapscripts.conf%%'' and modify the following:
  
-  * Set the ''%%SERVER%%''+  * Set ''%%SERVER%%'':
  
 <code> <code>
Line 88: Line 88:
 </code> </code>
  
-  * Set the Suffixes+  * Set ''%%SUFFIX%%'':
  
 <code> <code>
Line 94: Line 94:
 </code> </code>
  
-  * Set ''%%BINDDN%%''+  * Set ''%%BINDDN%%'':
  
 <code> <code>
Line 100: Line 100:
 </code> </code>
  
-  * (Personal Preference) Start the UID from 10000, GID from 15000, MID from 20000+  * (Personal Preference) Start the UID from 10000, GID from 15000, MID from 20000:
  
 <code> <code>
Line 108: Line 108:
 </code> </code>
  
-  * Set the home directory and default shell. If you're planning on using [[/NFSHome|NFSHome]], then make sure that you modify ''%%UHOMES%%'' as needed+  * Set the home directory and default shell. If you're planning on using [[/NFSHome|NFSHome]], then make sure that you modify ''%%UHOMES%%'' as needed.
  
-  * Fix ''%%PASSWORDGEN%%'', as some %%FreeBSD%% versions don't run properly without ''%%env%%''+  * Fix ''%%PASSWORDGEN%%'', as some %%FreeBSD%% versions don't run properly without ''%%env%%'':
  
 <code> <code>
Line 116: Line 116:
 </code> </code>
  
-  * Set the correct path of ''%%iconv%%'' and charset+  * Set the correct path of ''%%iconv%%'' and charset:
  
 <code> <code>
Line 134: Line 134:
 **pingable?** **pingable?**
  
-Make sure that ''%%ldap.awesome.com%%'' is reachable via ICMP. You can check by running ''%%ping -t4 ldap.awesome.com%%''. If you haven't configured [[/DNS|DNS]] yet, you may want to modify ''%%/etc/hosts%%''+Make sure that ''%%ldap.awesome.com%%'' is reachable via ICMP. You can check by running ''%%ping -t4 ldap.awesome.com%%''. If you haven't configured [[/DNS|DNS]] yet, you may want to modify ''%%/etc/hosts%%''.
  
 </callout> </callout>
Line 140: Line 140:
 ===== Using LDAPScripts ===== ===== Using LDAPScripts =====
  
-Say we want to have a group named ''%%admins%%'' for administrators. A user named ''%%john%%'', that should be member of administrators.+Say we want to have a group named ''%%admins%%'' for administrators and a user named ''%%john%%'', that should be a member of administrators.
  
 <code> <code>
Line 149: Line 149:
 </code> </code>
  
-And we can check by using ''%%ldapid%%''+And we can check by using ''%%ldapid%%'':
  
 <code> <code>
Line 155: Line 155:
 uid=10000(john) gid=10000(john) groups=10000(john),15000(admins) uid=10000(john) gid=10000(john) groups=10000(john),15000(admins)
 </code> </code>
 +
 +===== Next Steps =====
 +
 +Next, you might want to:
 +  * Configure LDAP client using [[/SSSD|SSSD]]
 +  * Use [[/AutoFS|AutoFS]] with [[/NFS]] shares and [[/SSSD|SSSD]] for authentication
  
 ---- ----
Line 160: Line 166:
 ===== TODO ===== ===== TODO =====
  
-* Add SSL/TLS Encryption+* Add SSL/TLS Encryption.
  
  • ldap/setup.1697984697.txt.gz
  • Last modified: 2023/10/22 14:24
  • by AntranigVartanian