Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Beide Seiten der vorigen Revision Vorhergehende Überarbeitung Nächste Überarbeitung | Vorhergehende Überarbeitung Nächste ÜberarbeitungBeide Seiten der Revision | ||
| centos:ldap_c7:clientauth [20.07.2015 14:50. ] – [lokale Benutzer] django | centos:ldap_c7:clientauth [21.07.2015 16:31. ] – [Apache Webserver] django | ||
|---|---|---|---|
| Zeile 76: | Zeile 76: | ||
| ==== Installation ==== | ==== Installation ==== | ||
| + | Als erstes installieren wir uns die benötigten Pakete, sofern diese nicht schon bei der initialen Installation unseres **CentOS 7**-Clients erfolgt ist. | ||
| + | # yum install nscd nss-pam-ldapd authconfig -y | ||
| - | /* | ||
| - | | ||
| - | [1] Install OpenLDAP Client. | ||
| - | [root@www ~]# yum -y install openldap-clients nss-pam-ldapd | ||
| - | # ldapserver=(LDAP server' | ||
| - | # ldapbasedn="dc=(your own domain name)" | + | ==== Paketinhalte ==== |
| + | Welche Pfade angelegt und welche Dateien bei der Installation der RPM-Pakete ins System kopiert wurden, sehen wir uns bei Bedarf und Interesse mit Hilfe des Befehls **rpm** und der passenden Option **// | ||
| - | [root@www ~]# authconfig --enableldap \ | + | === nscd === |
| - | --enableldapauth \ | + | # rpm -qil nscd |
| - | --ldapserver=dlp.server.world \ | + | < |
| - | --ldapbasedn=" | + | Version |
| - | --enablemkhomedir \ | + | Release |
| - | --update | + | Architecture: |
| + | Install Date: Mo 20 Jul 2015 16:30:11 CEST | ||
| + | Group : System Environment/ | ||
| + | Size : 183104 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : glibc-2.17-78.el7.src.rpm | ||
| + | Build Date : Do 05 Mär 2015 22:50:19 CET | ||
| + | Build Host : worker1.bsys.centos.org | ||
| + | Relocations : (not relocatable) | ||
| + | Packager | ||
| + | Vendor | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | Nscd caches name service lookups and can dramatically improve | ||
| + | performance with NIS+, and may help with DNS as well. | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| - | getsebool: SELinux is disabled | + | === nss-pam-ldapd === |
| - | [root@www ~]# exit | + | |
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Architecture: | ||
| + | Install Date: Mo 20 Jul 2015 16:30:14 CEST | ||
| + | Group : System Environment/ | ||
| + | Size : 416576 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : nss-pam-ldapd-0.8.13-8.el7.src.rpm | ||
| + | Build Date : Di 10 Jun 2014 08:03:46 CEST | ||
| + | Build Host : worker1.bsys.centos.org | ||
| + | Relocations : (not relocatable) | ||
| + | Packager | ||
| + | Vendor | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | The nss-pam-ldapd daemon, nslcd, uses a directory server to look up name | ||
| + | service information (users, groups, etc.) on behalf of a lightweight | ||
| + | nsswitch module. | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| - | logout | + | === authconfig === |
| - | CentOS Linux 7 (Core) | + | # rpm -qil authconfig |
| - | Kernel 3.10.0-123.20.1.el7.x86_64 on an x86_64 | + | < |
| - | www login: redhat | + | Version |
| - | # LDAP user | + | Release |
| + | Architecture: | ||
| + | Install Date: Do 30 Apr 2015 22:33:35 CEST | ||
| + | Group : System Environment/ | ||
| + | Size : 2215055 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : authconfig-6.2.8-9.el7.src.rpm | ||
| + | Build Date : Do 05 Mär 2015 23:01:30 CET | ||
| + | Build Host : worker1.bsys.centos.org | ||
| + | Relocations : (not relocatable) | ||
| + | Packager | ||
| + | Vendor | ||
| + | URL : https:// | ||
| + | Summary | ||
| + | Description : | ||
| + | Authconfig is a command line utility which can configure a workstation | ||
| + | to use shadow (more secure) passwords. | ||
| + | system to be a client for certain networked | ||
| + | authentication schemes. | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| - | Password: | ||
| - | # password | ||
| - | Creating directory '/ | + | ==== Dokumentation ==== |
| - | [redhat@www ~]$ | + | Bei der nachfolgenden Konfiguration der Authentifikationsmechanismen greifen wir vor allem auf den Befehl **authconfig** zurück. Ein Blick in dessen Man-Page sollte hier also von großer Hilfe sein. |
| - | # logined normally | + | |
| - | [redhat@www ~]$ passwd | + | |
| - | # try to change the LDAP password | + | |
| - | Changing password for user redhat. | + | < |
| - | Enter login(LDAP) password: | + | |
| - | # current password | + | |
| - | New password: | + | NAME |
| - | # new password | + | authconfig, |
| + | | ||
| - | Retype | + | SYNOPSIS |
| - | LDAP password | + | |
| - | passwd: | + | [options] |
| + | backup < | ||
| + | |||
| + | DESCRIPTION | ||
| + | | ||
| + | NIS, as well as /etc/passwd and / | ||
| + | | ||
| + | |||
| + | If --test action is specified, the authconfig just reads the current settings from the | ||
| + | | ||
| + | | ||
| + | are saved. Only the files affected by the configuration changes are overwritten. | ||
| + | | ||
| + | | ||
| + | | ||
| + | rent host, print its guesses if it finds them, to standard output, and exit. | ||
| + | |||
| + | The --restorebackup, | ||
| + | | ||
| + | fies. Authconfig also saves an automatic backup of configuration | ||
| + | | ||
| + | | ||
| + | |||
| + | If --nostart is specified (which is what the install program does), | ||
| + | | ||
| + | only enabled to start or stop at boot time. | ||
| + | |||
| + | The --enablenis, | ||
| + | | ||
| + | used to configure naming services caching, and the --enableshadow, | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | The algorithm used for storing | ||
| + | | ||
| + | bigcrypt, md5, sha256, and sha512. | ||
| + | |||
| + | The --enablelocauthorize option allows to bypass checking network authentication | ||
| + | | ||
| + | | ||
| + | |||
| + | When the configuration settings allow use of SSSD for user information | ||
| + | | ||
| + | SSSD configuration will be set up so there is a default domain populated with the set‐ | ||
| + | | ||
| + | force adding SSSD to / | ||
| + | | ||
| + | set up manually. The allowed configuration of services for SSSD are: | ||
| + | information | ||
| + | | ||
| + | |||
| + | In case SSSD does not support some feature of the legacy services | ||
| + | | ||
| + | | ||
| + | |||
| + | The list of options mentioned here in the manual page is not exhaustive, please | ||
| + | to authconfig --help for the complete list of the options. | ||
| + | |||
| + | | ||
| + | | ||
| + | | ||
| + | fied, no interactive screens will be seen. The values the program | ||
| + | those specified by the other options (--passalgo, | ||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | NOTES | ||
| + | The authconfig-tui is deprecated. No new configuration settings will be supported | ||
| + | | ||
| + | mand line options instead. | ||
| + | |||
| + | The / | ||
| + | | ||
| + | | ||
| + | |||
| + | The SSSD service is enabled and possibly started by authconfig when at least two of | ||
| + | the following three conditions are met: | ||
| + | 1) / | ||
| + | 2) SSSD authentication is enabled (pam_sss.so is used in PAM configuration) | ||
| + | 3) SSSD is enabled for user identity (nsswitch.conf contains sss) | ||
| + | |||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | RETURN CODES | ||
| + | | ||
| + | | ||
| + | | ||
| + | of CA certificate fails, 5 if writing configuration files fails on --updateall action, | ||
| + | 6 if writing fails on --update action, 7 if Winbind or IPA domain join fails. | ||
| + | |||
| + | | ||
| + | gram (by using either the Cancel or Back button). It can also return the same codes as | ||
| + | | ||
| + | |||
| + | FILES | ||
| + | / | ||
| + | Used to track whether or not particular | ||
| + | enabled. | ||
| + | BEROS, USELDAPAUTH, | ||
| + | USENIS, USELDAP, and others. | ||
| + | / | ||
| + | / | ||
| + | Used for shadow password support. | ||
| + | / | ||
| + | Configuration file for NIS support. | ||
| + | / | ||
| + | Another configuration file for NIS support. | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | Used to configure nss_ldap, pam_ldap, nslcd, and the OpenLDAP library. | ||
| + | Only the files already existing on the system are modified. | ||
| + | / | ||
| + | Used to configure Kerberos 5. | ||
| + | / | ||
| + | Used to configure Hesiod. | ||
| + | / | ||
| + | Used to configure winbind authentication. | ||
| + | / | ||
| + | Used to configure user information services. | ||
| + | / | ||
| + | Used to configure parameters of user accounts (minimum UID of a regular | ||
| + | user, password hashing algorithm). | ||
| + | / | ||
| + | Common | ||
| + | include directive. It is created as symlink | ||
| + | points to another file. | ||
| + | / | ||
| + | Contains | ||
| + | default target of the / | ||
| + | uration | ||
| + | file can be included there. | ||
| + | |||
| + | SEE ALSO | ||
| + | | ||
| + | | ||
| + | |||
| + | AUTHORS | ||
| + | Nalin Dahyabhai <nalin@redhat.com>, Preston Brown < | ||
| + | Matt Wilson < | ||
| + | |||
| + | Red Hat, Inc. 22 July 2011 | ||
| + | |||
| + | Mindestens genau so interessant, | ||
| + | # authconfig --help | ||
| + | |||
| + | < | ||
| + | |||
| + | Options: | ||
| + | -h, --help | ||
| + | --enableshadow, | ||
| + | Shadow-Passwörter standardmäßig aktivieren | ||
| + | --disableshadow | ||
| + | --enablemd5, | ||
| + | MD5-Passwörter standardmäßig aktivieren | ||
| + | --disablemd5 | ||
| + | --passalgo=< | ||
| + | hash/ | ||
| + | --enablenis | ||
| + | --disablenis | ||
| + | --nisdomain=< | ||
| + | --nisserver=< | ||
| + | --enableldap | ||
| + | --disableldap | ||
| + | --enableldapauth | ||
| + | --disableldapauth | ||
| + | --ldapserver=< | ||
| + | Standard LDAP-Server-Hostnamen oder URI | ||
| + | --ldapbasedn=< | ||
| + | --enableldaptls, | ||
| + | Verwendung von TLS mit LDAP (RFC-2830) aktivieren | ||
| + | --disableldaptls, | ||
| + | Verwendung von TLS mit LDAP (RFC-2830) deaktivieren | ||
| + | --enablerfc2307bis | ||
| + | --disablerfc2307bis | ||
| + | --ldaploadcacert=< | ||
| + | CA-Zertifikat von URL laden | ||
| + | --enablesmartcard | ||
| + | --disablesmartcard | ||
| + | --enablerequiresmartcard | ||
| + | Smartcard-Authentifizierung standardmäßig voraussetzen | ||
| + | --disablerequiresmartcard | ||
| + | Smartcard-Authentifizierung nicht standardmäßig voraussetzen | ||
| + | --smartcardmodule=< | ||
| + | Standardmäßig zu verwendendes Smartcard-Modul | ||
| + | --smartcardaction=< | ||
| + | Beim Entfernen einer Smartcard folgende Aktion ausführen | ||
| + | --enablefingerprint | ||
| + | --disablefingerprint | ||
| + | --enableecryptfs | ||
| + | --disableecryptfs | ||
| + | --enablekrb5 | ||
| + | --disablekrb5 | ||
| + | --krb5kdc=< | ||
| + | --krb5adminserver=< | ||
| + | Standard-Kerberos-Admin-Server | ||
| + | --krb5realm=< | ||
| + | Standard-Kerberos-Bereich | ||
| + | --enablekrb5kdcdns | ||
| + | --disablekrb5kdcdns | ||
| + | --enablekrb5realmdns | ||
| + | --disablekrb5realmdns | ||
| + | Verwendung von DNS für die Ermittlung von Kerberos-Bereichen deaktivieren | ||
| + | --enablewinbind | ||
| + | --disablewinbind | ||
| + | --enablewinbindauth | ||
| + | --disablewinbindauth | ||
| + | --smbsecurity=< | ||
| + | Von Samba und Winbind zu verwendender Sicherheitsmodus | ||
| + | --smbrealm=< | ||
| + | --smbservers=< | ||
| + | Namen der Server, gegen die authentifiziert wird | ||
| + | --smbworkgroup=< | ||
| + | Arbeitsgruppen-Authentifizierungsserver sind in | ||
| + | --smbidmaprange=< | ||
| + | uid-Bereich, | ||
| + | --winbindseparator=< | ||
| + | Das Zeichen, das zur Trennung von Domain und Benutzer in von Winbind erzeugten Benutzernamen verwendet wird, sofern winbindusedefaultdomain nicht aktiviert ist | ||
| + | --winbindtemplatehomedir=</ | ||
| + | Der Ordner, den von Winbind erzeugte Benutzer als persönlichen Ordner haben | ||
| + | --winbindtemplateprimarygroup=< | ||
| + | Die Gruppe, die von Winbind erzeugte Benutzer als primäre Gruppe haben | ||
| + | --winbindtemplateshell=</ | ||
| + | Die Shell, die von Winbind erzeugte Benutzer als Login-Shell haben | ||
| + | --enablewinbindusedefaultdomain | ||
| + | Winbind soll annehmen, dass Benutzer ohne Domain im Benutzernamen Domain-Benutzer sind | ||
| + | --disablewinbindusedefaultdomain | ||
| + | Winbind soll annehmen, dass Benutzer, ohne Domain im Benutzernamen keine Domain-Benutzer sind | ||
| + | --enablewinbindoffline | ||
| + | Konfiguriert Winbind, um Offline-Anmeldung zu ermöglichen | ||
| + | --disablewinbindoffline | ||
| + | Konfiguriert Winbind, um Offline-Anmeldung zu verhindern | ||
| + | --enablewinbindkrb5 | ||
| + | --disablewinbindkrb5 | ||
| + | --winbindjoin=< | ||
| + | Jetzt der Winbind-Domäne oder dem ADS-Bereich mit diesem Administrator beitreten | ||
| + | --enableipav2 | ||
| + | --disableipav2 | ||
| + | --ipav2domain=< | ||
| + | Die IPAv2 Domäne, bei der das System enthalten sein soll | ||
| + | --ipav2realm=< | ||
| + | Der Bereich für die IPAv2-Domäne | ||
| + | --ipav2server=< | ||
| + | Server der IPAv2 Domäne | ||
| + | --enableipav2nontp | ||
| + | --disableipav2nontp | ||
| + | --ipav2join=< | ||
| + | Mit diesem Konto der IPAv2-Domäne beitreten | ||
| + | --enablewins | ||
| + | --disablewins | ||
| + | --enablepreferdns | ||
| + | --disablepreferdns | ||
| + | --enablehesiod | ||
| + | --disablehesiod | ||
| + | --hesiodlhs=< | ||
| + | --hesiodrhs=< | ||
| + | --enablesssd | ||
| + | --disablesssd | ||
| + | --enablesssdauth | ||
| + | --disablesssdauth | ||
| + | --enableforcelegacy | ||
| + | --disableforcelegacy | ||
| + | --enablecachecreds | ||
| + | --disablecachecreds | ||
| + | --enablecache | ||
| + | --disablecache | ||
| + | --enablelocauthorize | ||
| + | --disablelocauthorize | ||
| + | Lokale Benutzer auch über Fernzugriff autorisieren | ||
| + | --enablepamaccess | ||
| + | --disablepamaccess | ||
| + | --enablesysnetauth | ||
| + | --disablesysnetauth | ||
| + | --enablemkhomedir | ||
| + | --disablemkhomedir | ||
| + | --passminlen=< | ||
| + | Minimale Passwortlänge | ||
| + | --passminclass=< | ||
| + | Mindestanzahl von Charakter-Klassen in einem Kennwort | ||
| + | --passmaxrepeat=< | ||
| + | Maximalanzahl gleicher Zeichen in einem Passwort | ||
| + | --passmaxclassrepeat=< | ||
| + | Maximale Anzahl von aufeinanderfolgenden Zeichen derselben Klasse in einem Kennwort | ||
| + | --enablereqlower | ||
| + | --disablereqlower | ||
| + | --enablerequpper | ||
| + | --disablerequpper | ||
| + | --enablereqdigit | ||
| + | --disablereqdigit | ||
| + | --enablereqother | ||
| + | --disablereqother | ||
| + | --nostart | ||
| + | --test | ||
| + | --update, --kickstart | ||
| + | Im Gegensatz zu --test die Konfigurationsdateien mit geänderten Einstellungen aktualisieren | ||
| + | --updateall | ||
| + | --probe | ||
| + | --savebackup=< | ||
| + | --restorebackup=< | ||
| + | Eine Sicherung der Konfigurationsdateien wiederherstellen | ||
| + | --restorelastbackup | ||
| + | |||
| + | ==== Konfiguration ==== | ||
| + | === authconfig === | ||
| + | |||
| + | Die Konfiguration unseres Clients nehmen wir am einfachsten mit Hilfe des Programmes **// | ||
| + | |||
| + | |||
| + | * **disablesssd** SSSD für Benutzerinformationen als Vorgabe deaktivieren | ||
| + | * **disablesssdauth** SSD für Authentifizierung als Vorgabe deaktivieren | ||
| + | * **disablemd5** MD5 Passworter abschalten | ||
| + | * **passalgo** Definition des Passworthash-Algoritmuses | ||
| + | * **enablemkhomedir** Homedirectory beim ersten Login eines neuen Users automatisch anlegen | ||
| + | * **enableldap** LDAP User Informationen aktivieren | ||
| + | * **enableldapauth** LDAP Authentifizierung aktivieren | ||
| + | * **ldapserver** LDAP Servername oder URI Definition | ||
| + | * **ldapbasedn** LDAP Basde DN Definition | ||
| + | * **enableldaptls** Verwendung von TLS mit LDAP (RFC-2830) über Port 636 verwenden | ||
| + | * **enableldapstarttls** Verwendung von StartTLS mit LDAP über Port 389 verwenden | ||
| + | * **update** Update der Konfigurationsdateien mit den gesetzten Werten. | ||
| + | |||
| + | Wir Konfigurieren nun also unsere LDAP-Client-Authentifizierung wie folgt. | ||
| + | # authconfig --disablesssd \ | ||
| + | --disablesssdauth \ | ||
| + | --disablemd5 \ | ||
| + | --passalgo=sha256 \ | ||
| + | --enablemkhomedir \ | ||
| + | --enableldap \ | ||
| + | --enableldapauth \ | ||
| + | --ldapserver=" | ||
| + | --ldapbasedn=" | ||
| + | --enableldaptls \ | ||
| + | --enableldapstarttls \ | ||
| + | --update | ||
| + | |||
| + | Die einzelnen Konfigurationsdateien, | ||
| + | |||
| + | Zur Dokumentation und ggf. spätere weitere Dokumentationsschritte versehen wir am Besten optional alle Änderungen mit einem Kommentar, ala: ''# | ||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | === nslcd.conf === | ||
| + | Die erste Datei, die wir uns nun genauer ansehen, ist die Konfigurationsdatei // | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | # switch library' | ||
| + | # between NSS names (see / | ||
| + | # information in the directory. | ||
| + | # See the manual page nslcd.conf(5) for more information. | ||
| + | |||
| + | # The user and group nslcd should run as. | ||
| + | uid nslcd | ||
| + | gid ldap | ||
| + | |||
| + | # The uri pointing to the LDAP server to use for name lookups. | ||
| + | # Multiple entries may be specified. The address that is used | ||
| + | # here should be resolvable without using LDAP (obviously). | ||
| + | #uri ldap:// | ||
| + | #uri ldaps:// | ||
| + | #uri ldapi:// | ||
| + | # Note: %2f encodes the '/' | ||
| + | # Django : 2015-07-20 | ||
| + | # default: uri ldap:// | ||
| + | uri ldap:// | ||
| + | |||
| + | # The LDAP version to use (defaults to 3 | ||
| + | # if supported by client library) | ||
| + | # | ||
| + | |||
| + | # The distinguished name of the search base. | ||
| + | # Django : 2015-07-20 | ||
| + | # default: base dc=example, | ||
| + | base dc=nausch, | ||
| + | |||
| + | # The distinguished name to bind to the server with. | ||
| + | # Optional: default is to bind anonymously. | ||
| + | #binddn cn=proxyuser, | ||
| + | # Django : 2015-07-20 | ||
| + | # default: unset | ||
| + | binddn cn=Technischeruser, | ||
| + | |||
| + | # The credentials to bind with. | ||
| + | # Optional: default is no credentials. | ||
| + | # Note that if you set a bindpw you should check the permissions of this file. | ||
| + | #bindpw secret | ||
| + | # Django : 2015-07-20 | ||
| + | # default: unset | ||
| + | bindpw YpKKoS1lV1AdAX1StGe1lTembvZW4XagnkLdWZ2Y4Xkw | ||
| + | |||
| + | # The distinguished name to perform password modifications by root by. | ||
| + | # | ||
| + | |||
| + | # The default search scope. | ||
| + | #scope sub | ||
| + | #scope one | ||
| + | #scope base | ||
| + | |||
| + | # Customize certain database lookups. | ||
| + | #base | ||
| + | #base passwd | ||
| + | #base | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Bind/ | ||
| + | # | ||
| + | |||
| + | # Search timelimit. | ||
| + | #timelimit 30 | ||
| + | |||
| + | # Idle timelimit. nslcd will close connections if the | ||
| + | # server has not been contacted for the number of seconds. | ||
| + | # | ||
| + | |||
| + | # Use StartTLS with verifying the server certificate. | ||
| + | # Django | ||
| + | ssl start_tls | ||
| + | tls_cacertfile / | ||
| + | |||
| + | # Use StartTLS without verifying the server certificate. | ||
| + | #ssl start_tls | ||
| + | # | ||
| + | |||
| + | # CA certificates for server certificate verification | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Seed the PRNG if / | ||
| + | # | ||
| + | |||
| + | # SSL cipher suite | ||
| + | # See man ciphers for syntax | ||
| + | # | ||
| + | |||
| + | # Client certificate and key | ||
| + | # Use these, if your server requires client | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Mappings for Services for UNIX 3.5 | ||
| + | #filter passwd (objectClass=User) | ||
| + | #map passwd uid msSFU30Name | ||
| + | #map passwd userPassword | ||
| + | #map passwd homeDirectory | ||
| + | #map passwd homeDirectory | ||
| + | #filter shadow (objectClass=User) | ||
| + | #map shadow uid msSFU30Name | ||
| + | #map shadow userPassword | ||
| + | #filter group (objectClass=Group) | ||
| + | #map group member | ||
| + | |||
| + | # Mappings for Services for UNIX 2.0 | ||
| + | #filter passwd (objectClass=User) | ||
| + | #map passwd uid msSFUName | ||
| + | #map passwd userPassword | ||
| + | #map passwd homeDirectory | ||
| + | #map passwd gecos msSFUName | ||
| + | #filter shadow (objectClass=User) | ||
| + | #map shadow uid msSFUName | ||
| + | #map shadow userPassword | ||
| + | #map shadow shadowLastChange pwdLastSet | ||
| + | #filter group (objectClass=Group) | ||
| + | #map group member | ||
| + | |||
| + | # Mappings for Active Directory | ||
| + | #pagesize 1000 | ||
| + | #referrals off | ||
| + | # | ||
| + | #filter passwd (& | ||
| + | #map passwd uid sAMAccountName | ||
| + | #map passwd homeDirectory | ||
| + | #map passwd gecos displayName | ||
| + | #filter shadow (& | ||
| + | #map shadow uid sAMAccountName | ||
| + | #map shadow shadowLastChange pwdLastSet | ||
| + | #filter group (objectClass=group) | ||
| + | |||
| + | # Alternative mappings for Active Directory | ||
| + | # (replace the SIDs in the objectSid mappings with the value for your domain) | ||
| + | #pagesize 1000 | ||
| + | #referrals off | ||
| + | # | ||
| + | #filter passwd (& | ||
| + | #map passwd uid cn | ||
| + | #map passwd uidNumber | ||
| + | #map passwd gidNumber | ||
| + | #map passwd homeDirectory "/ | ||
| + | #map passwd gecos | ||
| + | #map passwd loginShell | ||
| + | #filter group (|(objectClass=group)(objectClass=person)) | ||
| + | #map group gidNumber | ||
| + | |||
| + | # Mappings for AIX SecureWay | ||
| + | #filter passwd (objectClass=aixAccount) | ||
| + | #map passwd uid userName | ||
| + | #map passwd userPassword | ||
| + | #map passwd uidNumber | ||
| + | #map passwd gidNumber | ||
| + | #filter group (objectClass=aixAccessGroup) | ||
| + | #map group cn | ||
| + | #map group gidNumber | ||
| + | # This comment prevents repeated auto-migration of settings. | ||
| + | </ | ||
| + | |||
| + | Anschließend passen wir noch die Dateiberechtigungen an, so wie es bei der Option **bindpw** angeraten wurde. | ||
| + | # chown nslcd:ldap / | ||
| + | |||
| + | === nsswitch.conf === | ||
| + | In der Konfigurationsdatei // | ||
| + | * **passwd: | ||
| + | * **shadow: | ||
| + | * **group: | ||
| + | |||
| + | * **netgroup: | ||
| + | |||
| + | * **automount: | ||
| + | |||
| + | |||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | # / | ||
| + | # | ||
| + | # An example Name Service Switch config file. This file should be | ||
| + | # sorted with the most-used services at the beginning. | ||
| + | # | ||
| + | # The entry ' | ||
| + | # entry should stop if the search in the previous entry turned | ||
| + | # up nothing. Note that if the search failed due to some other reason | ||
| + | # (like no NIS server responding) then the search continues with the | ||
| + | # next entry. | ||
| + | # | ||
| + | # Valid entries include: | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # To use db, put the " | ||
| + | # looked up first in the databases | ||
| + | # | ||
| + | # Example: | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Django : 2015-07-21 LDAP Client Authentication | ||
| + | # default: passwd: | ||
| + | # shadow: | ||
| + | # group: | ||
| + | passwd: | ||
| + | shadow: | ||
| + | group: | ||
| + | # | ||
| + | |||
| + | # | ||
| + | hosts: | ||
| + | |||
| + | # Example - obey only what nisplus tells us... | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #rpc: nisplus [NOTFOUND=return] files | ||
| + | # | ||
| + | # | ||
| + | |||
| + | bootparams: nisplus [NOTFOUND=return] files | ||
| + | |||
| + | ethers: | ||
| + | netmasks: | ||
| + | networks: | ||
| + | protocols: | ||
| + | rpc: files | ||
| + | services: | ||
| + | |||
| + | # Django : 2015-07-21 LDAP Client Authentication | ||
| + | # default: netgroup: | ||
| + | netgroup: | ||
| + | |||
| + | publickey: | ||
| + | |||
| + | # Django : 2015-07-21 LDAP Client Authentication | ||
| + | # default: automount: | ||
| + | automount: | ||
| + | aliases: | ||
| + | </ | ||
| + | |||
| + | === password-auth-ac === | ||
| + | Damit sich unsere Nutzer auch anmelden können, ist es notwendig in der Konfigurationsdatei // | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | # This file is auto-generated. | ||
| + | # User changes will be destroyed the next time authconfig is run. | ||
| + | auth required | ||
| + | auth sufficient | ||
| + | auth requisite | ||
| + | # Django : 2015-07-21 | ||
| + | # default: auth sufficient | ||
| + | auth sufficient | ||
| + | auth required | ||
| + | |||
| + | account | ||
| + | account | ||
| + | account | ||
| + | # Django : 2015-07-21 | ||
| + | # default: account | ||
| + | account | ||
| + | account | ||
| + | |||
| + | password | ||
| + | password | ||
| + | # Django : 2015-07-21 | ||
| + | # default: password | ||
| + | password | ||
| + | password | ||
| + | |||
| + | session | ||
| + | session | ||
| + | -session | ||
| + | session | ||
| + | session | ||
| + | session | ||
| + | # Django : 2015-07-21 | ||
| + | # default: session | ||
| + | session | ||
| + | |||
| + | ==== Start des Naming services LDAP client daemon ==== | ||
| + | Nun ist es an der Zeit, den **NSLCD**((**N**aming **S**ervices **L**DAP **C**lient **D**aemon)) zu starten. | ||
| + | # systemctl restart nslcd.service | ||
| + | |||
| + | Den erfolgreichen Start des Daemon fragen wir wie folgt ab. | ||
| + | # systemctl status nslcd.service -l | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | | ||
| + | | ||
| + | Process: 8771 ExecStart=/ | ||
| + | Main PID: 8774 (nslcd) | ||
| + | | ||
| + | | ||
| + | |||
| + | Jul 20 17:06:44 vml010052.intra.nausch.org systemd[1]: Starting Naming services LDAP client daemon.... | ||
| + | Jul 20 17:06:44 vml010052.intra.nausch.org systemd[1]: PID file / | ||
| + | Jul 20 17:06:44 vml010052.intra.nausch.org nslcd[8774]: | ||
| + | Jul 20 17:06:44 vml010052.intra.nausch.org systemd[1]: Started Naming services LDAP client daemon.. | ||
| + | Jul 20 17:06:44 vml010052.intra.nausch.org nslcd[8774]: | ||
| + | </ | ||
| + | |||
| + | Damit der Daemin automatisch gestartet wird, wenn der Clientrechner hochfährt, aktivieren wir den NSLCD entsprechend. | ||
| + | # systemctl enable nslcd.service | ||
| + | |||
| + | ln -s '/ | ||
| + | |||
| + | Wollen wir abfragen, ob der Daemon automatisch beim Systemstart gestartet wird benutzen wir nachfolgenden Befehl/ | ||
| + | # systemctl is-enabled nslcd.service | ||
| + | |||
| + | enabled | ||
| + | |||
| + | Ein **enabled** signalisiert, | ||
| + | |||
| + | ===== Tests ===== | ||
| + | ==== LDAP Abfrage ==== | ||
| + | |||
| + | Zur Abfrage eines LDAP-Users können wir folgenden Aufruf verwenden: | ||
| + | $ ldapsearch -x -LLL -H ldaps:// | ||
| + | Enter LDAP Password: | ||
| + | < | ||
| + | uid: django | ||
| + | cn: django | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | shadowLastChange: | ||
| + | shadowMin: 0 | ||
| + | shadowMax: 99999 | ||
| + | shadowWarning: | ||
| + | loginShell: /bin/bash | ||
| + | uidNumber: 1000 | ||
| + | gidNumber: 1000 | ||
| + | homeDirectory: | ||
| + | gecos: django | ||
| + | userPassword:: | ||
| + | |||
| + | Das nächste Beispiel zeigt eine LDAP-Abfrage mit dem User django aber mit __falschem__ Passwort: | ||
| + | $ ldapsearch -x -LLL -H ldaps:// | ||
| + | |||
| + | Enter LDAP Password: | ||
| + | |||
| + | ldap_bind: Invalid credentials (49) | ||
| + | |||
| + | Hingegen eine Abfrage mit einer richtigen Kombination von Benutzer und Passwort, sieht entsprechend wie folgt aus: | ||
| + | $ ldapsearch -x -LLL -H ldaps:// | ||
| + | |||
| + | Enter LDAP Password: | ||
| + | < | ||
| + | uid: inge | ||
| + | cn: inge | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | loginShell: /bin/bash | ||
| + | uidNumber: 1002 | ||
| + | gidNumber: 1002 | ||
| + | homeDirectory: | ||
| + | gecos: inge | ||
| + | userPassword:: | ||
| + | |||
| + | ==== Client-Abfragen ==== | ||
| + | Die erfolgreiche Konfiguration unseres Rechners überprüfen wir so: | ||
| + | - Mit **getent** lassen wir uns die Informationen eines Users anzeigen, der sowohl in der /etc/shadow wie auch im zentralen LDAP-Verzeichnisdienst hinterlegt ist. Wenn alles gut gelaufen ist, werden uns zwei Einträge präsentiert. \\ \\ < | ||
| + | django: | ||
| + | - Als nächstes wählen wir einen Nutzer der nur im LDAP-Verzeichnisdienst einen Account hat, nicht aber auf der lokalen Maschine. \\ \\ < | ||
| + | - Dann melden wir uns nun an unserem Client als ein Benutzer an, der lokal auf der Maschine nicht existiert, werden wir beim Login nach dem Passwort gefragt, welches gegen den zentralen OpenLDAP-Server verifiziert wird. Ist das Passwort richtig wird auch gleich das zugehörige Nutzer-Homeverzeichnis angelegt. \\ \\ < | ||
| + | |||
| + | {{ : | ||
| - | */ | ||
| ===== remote Benutzer bei Web-Servern ===== | ===== remote Benutzer bei Web-Servern ===== | ||
| - | ==== Apache Webserver ==== | + | Nachdem sich unsere Nutzer an ihren Arbeitsplatzrechner erfolgreich anmelden können, wollen sie mit unter auch von unterwegs aus auf Ihre eMail oder andere WEB-Dienste zugreifen. Auch dort sollen sich unsere User mit deren Anmeldedaten anmelden können. |
| + | Im folgenden gehen wir auf Konfigurationslösungen bei den beiden Webservern **[[http:// | ||
| + | ==== Apache Webserver ==== | ||
| + | {{page> | ||
| + | ==== NGiNX Webserver ==== | ||
| + | {{page> | ||
| ==== NGiNX Webserver ==== | ==== NGiNX Webserver ==== | ||
127.0.0.1