LDAP authentication howto

admin — Sun, 03 Jan 2010 20:35:41 +0000

In our previous article we have configured our systems to authenticate from an NIS server. Now we are using LDAP which is more effective and easy to manage. Software installation isn’t within the scope of this documentation but pure configuration. Our tests systems are Redhat 5.4 but you can use this in other redhat based systems. Lets start;

Here are the details about our setup once:

LDAP Server: rh54srv1.iptables.gen.tr
Linux client: rh54-2.iptables.gen.tr

[LDAP configuration]

Adjust the following lines in your /etc/openldap/slapd.conf

database        bdb
suffix          “dc=iptables,dc=gen,dc=tr”
rootdn          “cn=Manager,dc=iptables,dc=gen,dc=tr”
rootpw          iptables123

Start LDAP server:

[root@rh54srv1]# /etc/init.d/ldap start

Send a sample query to our fresh LDAP server to test the queries. Be careful command should be in single line and shouldn’t be wrapped, if so, use backslash.

[root@rh54srv1 /]# ldapsearch -h rh54srv1.iptables.gen.tr -x -D “cn=Manager,dc=iptables,dc=gen,dc=tr” -b \ “dc=iptables,dc=gen,dc=tr” -w iptables123
# extended LDIF
#
# LDAPv3
# base with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# search result
search: 2
result: 32 No such object

# numResponses: 1

This is a good answer:) though we haven’t received any records as we don’t have any.

Now we will migrate our current password and group files into LDAP. Get the following scripts for this purpose:

[root@rh54srv1 /]# cd /usr/local
[root@rh54srv1 local]# wget http://www.padl.com/download/MigrationTools.tgz
[root@rh54srv1 local]# tar -zxf MigrationTools.tgz

Edit the file MigrationTools-47/migrate_common.ph under /usr/local folder and adjust the DEFAULT_BASE variable according to your configuration.

# Default base
$DEFAULT_BASE = “dc=iptables,dc=gen,dc=tr”;

We have the migration tools. Now we can migrate the files into LDAP database:

[root@rh54srv1 local]# cd MigrationTools-47/
[root@rh54srv1 MigrationTools-47]# ./migrate_base.pl > base.ldif
[root@rh54srv1 MigrationTools-47]# ./migrate_hosts.pl /etc/hosts > hosts.ldif
[root@rh54srv1 MigrationTools-47]# ./migrate_passwd.pl /etc/passwd > passwd.ldif
[root@rh54srv1 MigrationTools-47]# ./migrate_group.pl /etc/group > group.ldif

NOTICE: Before going further, I need to raise one point. Migration tool generated my base as “dc=gen,dc=tr” instead of “dc=iptables,dc=gen,dc=tr” and created the file base.ldif as such. That is why I needed to remove the heading line below from my base.ldif file in order to add it into LDAP.

The following heading lines were removed from the file.

dn: dc=gen,dc=tr
dc: gen
objectClass: top
objectClass: domain

Time to add ldif files into LDAP database:

[root@rh54srv1 MigrationTools-47]# ldapadd -h rh54srv1.iptables.gen.tr -x -D “cn=Manager,dc=iptables,dc=gen,dc=tr” -w iptables123 -f base.ldif

[root@rh54srv1 MigrationTools-47]# ldapadd -h rh54srv1.iptables.gen.tr -x -D “cn=Manager,dc=iptables,dc=gen,dc=tr” -w iptables123 -f hosts.ldif

[root@rh54srv1 MigrationTools-47]# ldapadd -h rh54srv1.iptables.gen.tr -x -D “cn=Manager,dc=iptables,dc=gen,dc=tr” -w iptables123 -f passwd.ldif

[root@rh54srv1 MigrationTools-47]# ldapadd -h rh54srv1.iptables.gen.tr -x -D “cn=Manager,dc=iptables,dc=gen,dc=tr” -w iptables123 -f group.ldif

After these commands, all your user information is transferred into LDAP server database.

[CLIENT CONFIGURATION]

As we have finished server side configuration, now we will setup our client so that all user authentication requests will be sent to our LDAP server. Again our handy tool authconfig does most of the dirty part for us. One command enables ldap authentication.

[root@rh54-2 ~]# authconfig –enableldap –enableldapauth –ldapserver 192.168.200.1 –ldapbasedn “dc=iptables,dc=gen,dc=tr” –update

From this moment on, if you ssh into this client machine (rh54-2), you will be authenticated from LDAP server on rh54srv1 instead of /etc/passwd. All your passwords in /etc/passwd file now are in LDAP. One more thing to do is to add a new username into LDAP to test authentication.

Create an LDIF file adduser.ldif with the following content:

dn: uid=ldapuser1,ou=People,dc=iptables,dc=gen,dc=tr
uid: ldapuser1
cn: ldapuser1
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}myB.IL9LzBxE6
shadowLastChange: 14612
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 2000
gidNumber: 2000
homeDirectory: /home/ldapuser1

I have already coloured the sections in this sample which needs to be changed. Password can be created with any crypt utility. For example, I have created this crypted password with the following perl command;

#perl -e “print crypt(“testpass“,”mysalt”)” ; echo
myB.IL9LzBxE6

Now you can add this new entry into ldap ;

[root@rh54srv1 ~]# ldapadd -h rh54srv1.iptables.gen.tr -x -D “cn=Manager,dc=iptables,dc=gen,dc=tr” -w iptables123 -f adduser.ldif

Best test is by trying to login to client via SSH

[root@rh54srv1 ~]# ssh ldapuser1@192.168.200.81
ldapuser1@192.168.200.81’s password:
Last login: Sun Jan 3 08:56:43 2010 from rh54srv1.iptables.gen.tr
-bash-3.2$

As you can see authentication is successful. (Note: You may have a different output “like home directory not found”. It is because there is no /home/ldapuser1 folder in the client system.

If you want to test ldap manually in the client machine (rh54-2) run the following. The output will be all the password entries in the LDAP server.

[root@rh54-2 ~]# getent passwd

Now your authentication should be working. I would like to mention about a few points before finishing this article;

You should also run authconfig command you run in client in the server. Otherwise authentication utilities will not be aware of LDAP configuration.
As your users are now centrally managed, your home directories should be central as well. In order to configure automatically mounted user home directories, you can have a look at my previous article about autofs with NIS authentication.
Always create backup and be careful as authconfig may cause your system inaccessible if not properly managed.

Please share your opinions or if you see any mistake in the document let me know.

iptables and more on Linux » authentication

LDAP authentication howto