Configuring authentication with openLDAP server
Configuring authentication with openLDAP server
LDAP server configuration
User accounts
First user accounts or groups should be created on ldap server. A sample ldif file that can be used create a user is:
dn: uid=saurabh,ou=people,dc=sbarjatiya,dc=com objectClass: top objectClass: account objectClass: posixAccount objectClass: shadowAccount cn: Saurabh Barjatiya uid: saurabh uidNumber: 3000 gidNumber: 3000 homeDirectory: /home/saurabh loginShell: /bin/bash gecos: OFQ F2, IIIT Hyderabad userPassword: iiit123 shadowLastChange: 0 shadowMax: 0 shadowWarning: 0
Group accounts
To create a group account sample ldif file is:
dn: cn=group1,ou=groups,dc=sbarjatiya,dc=com objectClass: top objectClass: posixGroup cn: group1 userPassword: iiit123 gidNumber: 3000 memberuid: saurabh
To add member to group sample ldif file is:
dn: cn=group1,ou=groups,dc=sbarjatiya,dc=com changetype: modify add: memberuid memberuid: saurabh.barjatiya
To delete member from group sample ldif file is:
dn: cn=group1,ou=groups,dc=sbarjatiya,dc=com changetype: modify delete: memberuid memberuid: saurabh.barjatiya
Linux host authentication
To configure a linux host to authenticate from ldap server use following steps:
- yum install openldap-clients openldap nss-pam-ldapd
- Check if sssd package is installed using 'rpm -qa | grep sssd'. If it is installed remove it using 'yum remove sssd'. If some ipa-* packages also need to be removed then it is fine.
- Start setup program and use following steps:
- Choose 'Authentication configuration'
- Select 'Use ldap'
- Select 'Use ldap authentication'
- Go to next screen with next button
- Do not check Use TLS
- Enter server name, for example ldap://ldap.virtual-labs.ac.in/
- Enter server basedn, for example, dc=virtual-labs,dc=ac,dc=in
- Complete configuration with ok button
- Close setup program with quit button
- Edit '/etc/hosts' file and add static entry for ldap server, for example '12.4.12.152 ldap.virtual-labs.ac.in'
- Edit '/etc/pam_ldap.conf' and replace lines at end that start with uri with following:
- uri ldaps://ldap.virtual-labs.ac.in/
- ssl on
- tls_cacertfile /etc/openldap/certs/ca.crt
- pam_password md5
- Go to '/etc/openldap/certs' and put CA certificate in the directory with name ca.crt
- Edit '/etc/nslcd.conf' and replace lines at end that start with uri with following:
- uri ldaps://ldap.virtual-labs.ac.in/
- base dc=virtual-labs,dc=ac,dc=in
- ssl on
- timelimit 10
- idle_timelimit 30
- reconnect_sleeptime 30
- reconnect_retrytime 90
- tls_reqcert hard
- tls_cacertfile /etc/openldap/certs/ca.crt
- Edit '/etc/pam.d/sshd' and add following line after last 'session required' line
- session required pam_mkhomedir.so skel=/etc/skel/ umask=0077
- Edit '/etc/nsswitch.conf' and for 'hosts' choose value 'files ldap dns'
- Note that you should not see sss anywhere in this file. If you see sss instead of ldap then you have forgotten to remove sssd as mentioned earlier in these steps
- Use 'service nscld restart'
- Do 'chkconfig nslcd on'
Verifying setup
To verify whether authentication setup is working or not try commands:
getent hosts getent passwd getent group getent shadow
One can also read '/var/log/messages' and '/var/log/secure' while trying to login from a ldap user, if configuration does not seem to succeed.
Restricting logins to specific users and posixGroups
To restrict logins on a machine to specific users or posixGroups use:
- Edit file '/etc/pam.d/sshd' and add following line
- auth required pam_access.so
- Edit file '/etc/security/access.conf' and add line similar to:
- - : ALL EXCEPT root (admin) : ALL
An access.conf configuration line has three parameters separated by :
- First '+' or '-' to indicate whether to allow or deny
- Second list of users and groups. Group names can be enclosed in round brackets () to be more explicit that given name is of group. We can also use word ALL to indicate ALL. We can also use word EXCEPT to create exceptions from ALL for specific users and groups.
- Third is the location from where when user logins should this rule apply.
Read the comments in file '/etc/security/access.conf' to understand use of access.conf in better way.
Password change
If user tries to ssh or login using credentials then he/she would be forced to change password on first login. During password change user would be asked for existing ldap password again through which user has logged in. Then user would have option of entering new password twice. After password is set user would be logged off automatically. Then user can login again by using ssh and entering new password.
Mediawiki Authentication
Mediawiki supports LDAP based authentication with extension 'LdapAuthentication'. To configure mediawiki authentication using ldap use:
- yum -y install php-ldap
- service httpd restart
- Download latest LdapAuthentication plugin for installed media-wiki version from http://www.mediawiki.org/wiki/Special:ExtensionDistributor/LdapAuthentication
- Extract the downloaded file in extensions folder
- Add following lines to 'LocalSettings.php' file
- require_once("$IP/extensions/LdapAuthentication/LdapAuthentication.php");
- $wgAuth = new LdapAuthenticationPlugin();
- $wgLDAPDomainNames = array('ldap.virtual-labs.ac.in');
- $wgLDAPServerNames = array('ldap.virtual-labs.ac.in' => 'ldap.virtual-labs.ac.in');
- //Allows root or WikiSysOp login for deleting pages, etc.
- $wgLDAPUseLocal = true;
- $wgLDAPEncryptionType = array('ldap.virtual-labs.ac.in' => 'clear');
- $wgLDAPSearchAttributes = array( 'ldap.virtual-labs.ac.in' => 'uid');
- // Base DNs. Group and User base DNs will be used if available; if they are not defined, the search
- // will default to $wgLDAPBaseDNs
- $wgLDAPBaseDNs = array('ldap.virtual-labs.ac.in' => 'dc=virtual-labs,dc=ac,dc=in');
- $wgLDAPGroupBaseDNs = array('ldap.virtual-labs.ac.in' => 'cn=admin,ou=groups,dc=virtual-labs,dc=ac,dc=in');
Refer http://www.mediawiki.org/wiki/Extension:LDAP_Authentication/Configuration_Options for more details
Back to OpenLDAP server configuration
