removed doc-files because of license problems and space
This commit is contained in:
Roland Gruber
parent
801697f010
commit
3002cf265e
File diff suppressed because it is too large
Load Diff
|
|
@ -1,280 +0,0 @@
|
||||||
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
|
|
||||||
<html>
|
|
||||||
<head>
|
|
||||||
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
|
|
||||||
<title>LDAP Authentication for Linux</title>
|
|
||||||
<link rel="stylesheet" type="text/css" href="index.css">
|
|
||||||
</head>
|
|
||||||
<body>
|
|
||||||
<div class="title">LDAP Authentication for Linux</div>© 2002 by
|
|
||||||
<a href="http://www.metaconsultancy.com">metaconsultancy</a><br>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
LDAP is a directory server technology that allows information such
|
|
||||||
as usernames and passwords for an entire site to be stored on a central
|
|
||||||
server.
|
|
||||||
This whitepapers describes how to set up a Linux workstation
|
|
||||||
to use an LDAP server for user information and authentication.
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
Before proceeding, you will need a working LDAP server which can
|
|
||||||
provide you with user information. If you need to set one up,
|
|
||||||
consult our <a href="ldap.htm">OpenLDAP whitepaper</a> for
|
|
||||||
instructions.
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
User information consists of such data as mappings between user id numbers
|
|
||||||
and user names (used, for example, by <span class="in">ls -l</span>), or home directory
|
|
||||||
locations (used, for example, by <span class="in">cd ~</span>). Lookups of such information
|
|
||||||
are handled by the name service subsystem, configured in the file
|
|
||||||
<span class="path">/etc/nsswitch.conf</span>.
|
|
||||||
|
|
||||||
Authentication (password checking), on the other hand, is handled by the
|
|
||||||
PAM (plugable authentication module) subsystem, configured in the
|
|
||||||
<span class="path">/etc/pam.d/</span> directory.
|
|
||||||
|
|
||||||
While these two subsystems can (in fact must) be configured seperately,
|
|
||||||
you will likely want both to use LDAP.
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<div class="section">
|
|
||||||
<span class="section">nss-ldap</span>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
Begin by installing the shared library code necessary for the
|
|
||||||
name service to use ldap.
|
|
||||||
|
|
||||||
<div class="script"><pre class="code">
|
|
||||||
# <span class="in">apt-get install libnss-ldap</span>
|
|
||||||
</pre></div>
|
|
||||||
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
Next, open the <span class="path">/etc/nsswitch.conf</span> file, and tell the
|
|
||||||
name service subsystem to use LDAP to obtain user information.
|
|
||||||
|
|
||||||
<div class="script">
|
|
||||||
<div class="codetitle">nsswitch.conf</div>
|
|
||||||
<pre class="code">
|
|
||||||
passwd: files ldap
|
|
||||||
group: files ldap
|
|
||||||
shadow: files ldap
|
|
||||||
</pre>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
Note that we do not eliminate the use of flat files, since some
|
|
||||||
users and groups (e.g. root) will remain local. If your machines do not
|
|
||||||
use flat files at all and your LDAP server goes down, not even
|
|
||||||
root will be able to log in.
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
Finally, you need to tell then name service subsystem how to talk
|
|
||||||
to your LDAP server. This is done in the file
|
|
||||||
<span class="path">/etc/libnss-ldap.conf</span>.
|
|
||||||
|
|
||||||
<div class="script">
|
|
||||||
<div class="codetitle">libnss-ldap.conf</div>
|
|
||||||
<pre class="code">
|
|
||||||
uri ldap://ldap.example.com/ ldap://ldap-backup.example.com/
|
|
||||||
base dc=example, dc=org
|
|
||||||
</pre>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
The uri directive specifies the domain name (or IP address) of your LDAP
|
|
||||||
server. As our example illustrates, you can specify multiple LDAP servers,
|
|
||||||
in which case they will be employed in failover fashion.
|
|
||||||
|
|
||||||
The base directive specifies the root DN at which searches should start.
|
|
||||||
|
|
||||||
For additional information on these and other configuration directives,
|
|
||||||
<span class="in">man libnss-ldap.conf</span>.
|
|
||||||
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
nss-ldap expects accounts to be objects with the following attributes: uid,
|
|
||||||
uidNumber, gidNumber, homeDirectory, and loginShell. These attributes are
|
|
||||||
allowed by the objectClass posixAccount.
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
There is a simple way to verify that your name service subsystem is using
|
|
||||||
your LDAP server as instructed. Assign a file to be owned by a user that
|
|
||||||
exists only in the LDAP database, not in <span class="path">/etc/passwd</span>. If
|
|
||||||
an <span class="path">ls -l</span> correctly shows the username, then the name service
|
|
||||||
subsystem is consulting the LDAP database; if it just shows the user number,
|
|
||||||
something is wrong.
|
|
||||||
|
|
||||||
For example, if the user john, with user number 1001, exists only in
|
|
||||||
LDAP, we can try
|
|
||||||
|
|
||||||
<div class="script"><pre class="code">
|
|
||||||
# <span class="in">touch /tmp/test</span>
|
|
||||||
# <span class="in">chown 1001 /tmp/test</span>
|
|
||||||
# <span class="in">ls -l /tmp/test</span>
|
|
||||||
-rw-r----- 1 john users 0 Jan 1 12:00 test
|
|
||||||
</pre></div>
|
|
||||||
|
|
||||||
to determine whether the the name service is using LDAP.
|
|
||||||
</p>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
<div class="section">
|
|
||||||
<span class="section">pam-ldap</span>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
Next we configure the PAM subsystem to use LDAP for passwords. Begin by
|
|
||||||
installing the necessary PAM module.
|
|
||||||
|
|
||||||
<div class="script"><pre class="code">
|
|
||||||
# <span class="in">apt-get install libpam-ldap</span>
|
|
||||||
</pre></div>
|
|
||||||
|
|
||||||
The configuration file for the <span class="path">pam_ldap.so</span> module is
|
|
||||||
<span class="path">/etc/pam_ldap.conf</span>.
|
|
||||||
|
|
||||||
<div class="script">
|
|
||||||
<div class="codetitle">pam_ldap.conf</div>
|
|
||||||
<pre class="code">
|
|
||||||
uri ldaps://ldap.example.com/
|
|
||||||
base dc=example,dc=com
|
|
||||||
pam_password exop
|
|
||||||
</pre>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
The uri and base directives work the same way they do for
|
|
||||||
<span class="path">/etc/libnss_ldap.conf</span> and <span class="path">/etc/ldap/ldap.conf</span>.
|
|
||||||
Notice that we have used ldaps to ensure that connections over which
|
|
||||||
passwords are exchanged are encrypted.
|
|
||||||
The directive "pam_password exop" tells pam-ldap to change passwords in
|
|
||||||
a way that allows OpenLDAP to apply the hashing algorithm specified
|
|
||||||
in <span class="path">/etc/ldap/slapd.conf</span>, instead of attempting to hash
|
|
||||||
locally and write the result directly into the database.
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
pam-ldap assumes accounts to be ojbects with the following attributes:
|
|
||||||
uid and userPassword. The attributes are allowed by the objectClass
|
|
||||||
posixAccount.
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
We are now ready to configure individual services to use the LDAP server
|
|
||||||
for password checking. Each service that uses PAM for authentication has
|
|
||||||
its own configuration file <span class="path">/etc/pam.d/service</span>.
|
|
||||||
To configure a service to use LDAP for password-checking, you must modify
|
|
||||||
its PAM configuration file.
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
To avoid an in-depth explanation of PAM, we will
|
|
||||||
content ourselves with a few examples. Consider first the login program,
|
|
||||||
which handles logins from the text console. A typical PAM stack which
|
|
||||||
checks passwords both in <span class="path">/etc/passwd</span> and in the LDAP database
|
|
||||||
follows.
|
|
||||||
|
|
||||||
<div class="script">
|
|
||||||
<div class="codetitle">/etc/pam.d/login</div>
|
|
||||||
<pre class="code">
|
|
||||||
auth required pam_nologin.so
|
|
||||||
auth sufficient pam_ldap.so
|
|
||||||
auth sufficient pam_unix.so shadow use_first_pass
|
|
||||||
auth required pam_deny.so
|
|
||||||
</pre>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
After successful password authentication using the auth stack, login checks
|
|
||||||
for the existance of an account using the account stack, so it is necessary
|
|
||||||
to reference pam-ldap there, too.
|
|
||||||
|
|
||||||
<div class="script">
|
|
||||||
<div class="codetitle">/etc/pam.d/login</div>
|
|
||||||
<pre class="code">
|
|
||||||
account sufficient pam_unix.so
|
|
||||||
account sufficient pam_ldap.so
|
|
||||||
account required pam_deny.so
|
|
||||||
</pre>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
Other login-like programs include xdm and gdm (for graphical logins),
|
|
||||||
ssh (for remote logins), su (for switching programs), and
|
|
||||||
xlock and xscreensaver (for locked screens). Each has its own file
|
|
||||||
in <span class="path">/etc/pam.d/</span>.
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
Some applications not only authenticate passwords, but can also be used
|
|
||||||
to change them. The prototypical example is of course <span class="path">passwd</span>,
|
|
||||||
the standard password-changing utility. Such programs can be configured to
|
|
||||||
use LDAP by modifying their password stack.
|
|
||||||
|
|
||||||
<div class="script">
|
|
||||||
<div class="codetitle">/etc/pam.d/passwd</div>
|
|
||||||
<pre class="code">
|
|
||||||
password required pam_cracklib.so
|
|
||||||
password sufficient pam_ldap.so
|
|
||||||
password sufficient pam_unix.so
|
|
||||||
password required pam_deny.so
|
|
||||||
</pre>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
One convienient application of pam-ldap is to set up "black box" servers
|
|
||||||
that can authenticate users for a particular service without having an
|
|
||||||
account on the machine at all. Services such as netatalk, (Cyrus) imap,
|
|
||||||
and (Postfix) smtp use PAM. By configuring their PAM stacks to use LDAP,
|
|
||||||
while leaving LDAP out of the PAM stacks of services such as login and ssh,
|
|
||||||
you can easily create a "black box" server.
|
|
||||||
</p>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
<div class="section">
|
|
||||||
<span class="section">nscd</span>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
To keep your computers from pounding your LDAP server every time
|
|
||||||
a command such as <span class="in">ls -l /home</span> is issued on a computer in your
|
|
||||||
organization, it is a good idea to configure your workstations to
|
|
||||||
cache some user data. As long as the data in the cache is sufficiently
|
|
||||||
fresh, the workstations use in instead of asking your LDAP server again.
|
|
||||||
The name server caching daemon (nscd) accomplishes exactly
|
|
||||||
this task.
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
To install nscd on Debian, just
|
|
||||||
|
|
||||||
<div class="script"><pre class="code">
|
|
||||||
# <span class="in">apt-get install nscd</span>
|
|
||||||
</pre></div>
|
|
||||||
|
|
||||||
</p>
|
|
||||||
|
|
||||||
<p>
|
|
||||||
The configuration file for nscd is <span class="path">/etc/nscd.conf</span>.
|
|
||||||
|
|
||||||
<div class="script">
|
|
||||||
<div class="codetitle">nscd.conf</div>
|
|
||||||
<pre class="code">
|
|
||||||
enable-cache passwd yes
|
|
||||||
positive-time-to-live passwd 600
|
|
||||||
negative-time-to-live passwd 20
|
|
||||||
suggested-size passwd 211
|
|
||||||
check-files passwd yes
|
|
||||||
</pre>
|
|
||||||
</div>
|
|
||||||
|
|
||||||
</p>
|
|
||||||
|
|
||||||
</div>
|
|
||||||
|
|
||||||
</body>
|
|
||||||
</html>
|
|
||||||
Binary file not shown.
Loading…
Reference in New Issue