fluxcoil wiki

Deploy an openldap server rhel7, used for ldap authentication/authorization. We have now 2 ways to configure openldap:

• via slapd.conf
• via configtree

The latter allows configuration onthefly, but the first way is more convinient. Many instructions are also only provided in slapd.conf syntax, so I focus on deploying an initial slapd.conf, and then convert it to configtree syntax after changes.

• admin guide: https://www.openldap.org/doc/admin24/

yum -y install openldap-servers openldap-clients

# deploy a simple slapd.conf file
cat >/etc/openldap/slapd.conf<<EOT
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#

include         /etc/openldap/schema/corba.schema
include         /etc/openldap/schema/core.schema
include         /etc/openldap/schema/cosine.schema
include         /etc/openldap/schema/duaconf.schema
include         /etc/openldap/schema/dyngroup.schema
include         /etc/openldap/schema/inetorgperson.schema
include         /etc/openldap/schema/java.schema
include         /etc/openldap/schema/misc.schema
include         /etc/openldap/schema/nis.schema
include         /etc/openldap/schema/openldap.schema
include         /etc/openldap/schema/ppolicy.schema
include         /etc/openldap/schema/collective.schema

# Allow LDAPv2 client connections.  This is NOT the default.
allow bind_v2

# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral       ldap://root.openldap.org

pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args

# Load dynamic backend modules
# - modulepath is architecture dependent value (32/64-bit system)
# - back_sql.la overlay requires openldap-server-sql package
# - dyngroup.la and dynlist.la cannot be used at the same time

# modulepath /usr/lib/openldap
# modulepath /usr/lib64/openldap

# moduleload accesslog.la
# moduleload auditlog.la
# moduleload back_sql.la
# moduleload chain.la
# moduleload collect.la
# moduleload constraint.la
# moduleload dds.la
# moduleload deref.la
# moduleload dyngroup.la
# moduleload dynlist.la
# moduleload memberof.la
# moduleload pbind.la
# moduleload pcache.la
# moduleload ppolicy.la
# moduleload refint.la
# moduleload retcode.la
# moduleload rwm.la
# moduleload seqmod.la
# moduleload smbk5pwd.la
# moduleload sssvlv.la
# moduleload syncprov.la
# moduleload translucent.la
# moduleload unique.la
# moduleload valsort.la

# The next three lines allow use of TLS for encrypting connections using a
# dummy test certificate which you can generate by running
# /usr/libexec/openldap/generate-server-cert.sh. Your client software may balk
# at self-signed certificates, however.
# TLSCACertificatePath /etc/openldap/certs
# TLSCertificateFile "\"OpenLDAP Server\""
# TLSCertificateKeyFile /etc/openldap/certs/password

# Sample security restrictions
#       Require integrity protection (prevent hijacking)
#       Require 112-bit (3DES or better) encryption for updates
#       Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64

# Sample access control policy:
#       Root DSE: allow anyone to read it
#       Subschema (sub)entry DSE: allow anyone to read it
#       Other DSEs:
#               Allow self write access
#               Allow authenticated users read access
#               Allow anonymous users to authenticate
#       Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#       by self write
#       by users read
#       by anonymous auth
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn.  (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!

# enable on-the-fly configuration (cn=config)
database config
access to *
        by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
        by * none

# enable server status monitoring (cn=monitor)
database monitor
access to *
        by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
        by dn.exact="cn=Manager,dc=my-domain,dc=com" read
        by * none


######################################################################
# database definitions
######################################################################

database        bdb
suffix          "dc=fluxcoil,dc=net"
checkpoint      1024 15
rootdn          "cn=Manager,dc=fluxcoil,dc=net"
# Cleartext passwords, especially for the rootdn, should
# be avoided.  See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw          secret
# rootpw                {crypt}ijFYNcSNctBYg

#access to *
#        by dn.exact="cn=Manager,dc=fluxcoil,dc=net" read
#        by * none

# The database directory MUST exist prior to running slapd AND 
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory       /var/lib/ldap

# Indices to maintain for this database
index objectClass                       eq,pres
index ou,cn,mail,surname,givenname      eq,pres,sub
index uidNumber,gidNumber,loginShell    eq,pres
index uid,memberUid                     eq,pres,sub
index nisMapName,nisMapEntry            eq,pres,sub

# Replicas of this database
#replogfile /var/lib/ldap/openldap-master-replog
#replica host=ldap-1.example.com:389 starttls=critical
#     bindmethod=sasl saslmech=GSSAPI
#     authcId=host/ldap-master.example.com@EXAMPLE.COM
EOT

cd /etc/openldap
rm -rf /etc/openldap/slapd.d/*
slaptest -f slapd.conf -F slapd.d/
cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
chown -R ldap:ldap /etc/openldap/slapd.d/ /var/lib/ldap

systemctl start slapd
systemctl status slapd
systemctl enable slapd

ldapsearch -x -h 127.0.0.1 -b dc=fluxcoil,dc=net \
  -D cn=manager,dc=fluxcoil,dc=net -w secret

• see the ldap_auth_server_populate page

# add initial OUs, users, groups
ldapadd -x -h 127.0.0.1 -D cn=manager,dc=fluxcoil,dc=net \
  -w secret -f initial.ldif

# verify they are available
ldapsearch -x -h 127.0.0.1 -b dc=fluxcoil,dc=net \
  -D cn=manager,dc=fluxcoil,dc=net -w secret

cp /etc/openldap/cacert.pem /etc/openldap/cacerts/
echo 'TLS_CACERT /etc/openldap/cacerts/cacert.pem' >>/etc/openldap/ldap.conf
ldapsearch -x -b dc=fluxcoil,dc=net -H ldap://rhel6b.site
ldapsearch -x -b dc=fluxcoil,dc=net -H ldap://rhel6b.site -ZZZ

[root@rhel7u2a cn=schema]# ldapadd -c -Y EXTERNAL -H ldapi:/// -f cn\=\{1\}cosine.ldif 
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn={1}cosine"
ldap_add: Server is unwilling to perform (53)
        additional info: no global superior knowledge

[root@rhel7u2a cn=schema]# 

When this error occurs, the first part of the schema ldif file needs to be modified. For example, change as follows for the inetorgperson schema file:

      dn: cn={11}inetorgperson
      objectClass: olcSchemaConfig
      cn: {11}inetorgperson
    into
      dn: cn={11}inetorgperson,cn=schema,cn=config
      objectClass: olcSchemaConfig
      cn: {11}inetorgperson

[root@rhel7u2a cn=schema]#  ldapadd -c -Y EXTERNAL -H ldapi:/// -f *misc*
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn={8}misc,cn=schema,cn=config"
ldap_add: Constraint violation (19)
        additional info: structuralObjectClass: no user modification allowed

[root@rhel7u2a cn=schema]# 

When this error occurs, remove the last part of the ldif file:

structuralObjectClass: olcSchemaConfig
entryUUID: 286b0120-e418-1035-834b-c51fc6ee8bf2
creatorsName: cn=config
createTimestamp: 20160722052324Z
entryCSN: 20160722052324.908916Z#000000#000#000000
modifiersName: cn=config
modifyTimestamp: 20160722052324Z

58ec6f1e bdb_db_open: database "dc=fluxcoil2,dc=net": recovery skipped in read-only mode. Run manual recovery if errors are encountered.
58ec6f1e bdb_db_open: database "dc=fluxcoil2,dc=net": db_open(/var/lib/ldap2/id2entry.bdb) failed: No such file or directory (2).
58ec6f1e backend_startup_one (type=bdb, suffix="dc=fluxcoil2,dc=net"): bi_db_open failed! (2)
slap_startup failed (test would succeed using the -u switch)

Here berkley-db files are missing, start slapd directly with the slapd.conf file to get them created:

[root@rhel7u2a openldap]# slapd -f slapd.conf
[root@rhel7u2a openldap]# 
[root@rhel7u2a openldap]# pgrep slapd
14296
[root@rhel7u2a openldap]# kill 14296
[root@rhel7u2a openldap]#