Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen angezeigt.
| Nächste Überarbeitung | Vorhergehende Überarbeitung | ||
| centos:ldap_c7:clientauth [19.07.2015 20:51. ] – angelegt django | centos:ldap_c7:clientauth [22.07.2019 15:03. ] (aktuell) – Externe Bearbeitung 127.0.0.1 | ||
|---|---|---|---|
| Zeile 1: | Zeile 1: | ||
| - | ====== Authentification auf Userebene und Webseiten unter CentOS 7.x ====== | + | ====== Authentification auf Userebene und Webseiten |
| {{: | {{: | ||
| Natürlich wollen wir bei der Authentifikation unserer Cleints auf unseren zentralen OpenLDAP-Verzeichnisdienst zurückgreifen. Nachfolgend werden wir auf einige Beispiele eingehen. | Natürlich wollen wir bei der Authentifikation unserer Cleints auf unseren zentralen OpenLDAP-Verzeichnisdienst zurückgreifen. Nachfolgend werden wir auf einige Beispiele eingehen. | ||
| Zeile 6: | Zeile 6: | ||
| ===== lokale Benutzer ===== | ===== lokale Benutzer ===== | ||
| + | ==== Vertrauensmodelle in Public-Key-Infrastrukturen ==== | ||
| + | {{page> | ||
| + | |||
| + | Wir haben nun in der Datei // | ||
| + | # vim / | ||
| + | <file bash / | ||
| + | # LDAP Defaults | ||
| + | # | ||
| + | |||
| + | # See ldap.conf(5) for details | ||
| + | # This file should be world readable but not world writable. | ||
| + | |||
| + | #BASE | ||
| + | #URI ldap:// | ||
| + | |||
| + | # Django: 2015-07-17 | ||
| + | # defaul: unset | ||
| + | # | ||
| + | # | ||
| + | BASE dc=nausch, dc=org | ||
| + | |||
| + | # | ||
| + | URI | ||
| + | |||
| + | |||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Django : 2015-07-17 | ||
| + | # default: | ||
| + | |||
| + | # Django : 2015-07-16 | ||
| + | # Pfad und Datei mit den vertrauenswürdigen Root-Zertifikaten | ||
| + | # default: unset | ||
| + | TLS_CACERT | ||
| + | |||
| + | # Turning this off breaks GSSAPI used with krb5 when rdns = false | ||
| + | SASL_NOCANON | ||
| + | </ | ||
| + | |||
| + | Zum Testen richten wir erneut eine Anfrage an unseren OpenLDP-Server. | ||
| + | # ldapsearch -W -x -b " | ||
| + | -D " | ||
| + | -H ldaps:// | ||
| + | |||
| + | Enter LDAP Password: | ||
| + | < | ||
| + | uid: django | ||
| + | cn: django | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | shadowLastChange: | ||
| + | shadowMin: 0 | ||
| + | shadowMax: 99999 | ||
| + | shadowWarning: | ||
| + | loginShell: /bin/bash | ||
| + | uidNumber: 1000 | ||
| + | gidNumber: 1000 | ||
| + | homeDirectory: | ||
| + | gecos: django | ||
| + | userPassword:: | ||
| + | |||
| + | </ | ||
| + | |||
| + | |||
| + | ==== Installation ==== | ||
| + | Als erstes installieren wir uns die benötigten Pakete, sofern diese nicht schon bei der initialen Installation unseres **CentOS 7**-Clients erfolgt ist. | ||
| + | # yum install nscd nss-pam-ldapd authconfig -y | ||
| + | |||
| + | |||
| + | ==== Paketinhalte ==== | ||
| + | Welche Pfade angelegt und welche Dateien bei der Installation der RPM-Pakete ins System kopiert wurden, sehen wir uns bei Bedarf und Interesse mit Hilfe des Befehls **rpm** und der passenden Option **// | ||
| + | |||
| + | === nscd === | ||
| + | # rpm -qil nscd | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Architecture: | ||
| + | Install Date: Mo 20 Jul 2015 16:30:11 CEST | ||
| + | Group : System Environment/ | ||
| + | Size : 183104 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : glibc-2.17-78.el7.src.rpm | ||
| + | Build Date : Do 05 Mär 2015 22:50:19 CET | ||
| + | Build Host : worker1.bsys.centos.org | ||
| + | Relocations : (not relocatable) | ||
| + | Packager | ||
| + | Vendor | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | Nscd caches name service lookups and can dramatically improve | ||
| + | performance with NIS+, and may help with DNS as well. | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | |||
| + | === nss-pam-ldapd === | ||
| + | # rpm -qil nss-pam-ldapd | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Architecture: | ||
| + | Install Date: Mo 20 Jul 2015 16:30:14 CEST | ||
| + | Group : System Environment/ | ||
| + | Size : 416576 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : nss-pam-ldapd-0.8.13-8.el7.src.rpm | ||
| + | Build Date : Di 10 Jun 2014 08:03:46 CEST | ||
| + | Build Host : worker1.bsys.centos.org | ||
| + | Relocations : (not relocatable) | ||
| + | Packager | ||
| + | Vendor | ||
| + | URL : http:// | ||
| + | Summary | ||
| + | Description : | ||
| + | The nss-pam-ldapd daemon, nslcd, uses a directory server to look up name | ||
| + | service information (users, groups, etc.) on behalf of a lightweight | ||
| + | nsswitch module. | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | |||
| + | === authconfig === | ||
| + | # rpm -qil authconfig | ||
| + | < | ||
| + | Version | ||
| + | Release | ||
| + | Architecture: | ||
| + | Install Date: Do 30 Apr 2015 22:33:35 CEST | ||
| + | Group : System Environment/ | ||
| + | Size : 2215055 | ||
| + | License | ||
| + | Signature | ||
| + | Source RPM : authconfig-6.2.8-9.el7.src.rpm | ||
| + | Build Date : Do 05 Mär 2015 23:01:30 CET | ||
| + | Build Host : worker1.bsys.centos.org | ||
| + | Relocations : (not relocatable) | ||
| + | Packager | ||
| + | Vendor | ||
| + | URL : https:// | ||
| + | Summary | ||
| + | Description : | ||
| + | Authconfig is a command line utility which can configure a workstation | ||
| + | to use shadow (more secure) passwords. | ||
| + | system to be a client for certain networked user information and | ||
| + | authentication schemes. | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | |||
| + | |||
| + | ==== Dokumentation ==== | ||
| + | Bei der nachfolgenden Konfiguration der Authentifikationsmechanismen greifen wir vor allem auf den Befehl **authconfig** zurück. Ein Blick in dessen Man-Page sollte hier also von großer Hilfe sein. | ||
| + | # man authconfig | ||
| + | |||
| + | < | ||
| + | |||
| + | NAME | ||
| + | | ||
| + | | ||
| + | |||
| + | SYNOPSIS | ||
| + | | ||
| + | [options] | ||
| + | backup < | ||
| + | |||
| + | DESCRIPTION | ||
| + | | ||
| + | NIS, as well as /etc/passwd and / | ||
| + | | ||
| + | |||
| + | If --test action is specified, the authconfig just reads the current settings from the | ||
| + | | ||
| + | | ||
| + | are saved. Only the files affected by the configuration changes are overwritten. | ||
| + | | ||
| + | | ||
| + | | ||
| + | rent host, print its guesses if it finds them, to standard output, and exit. | ||
| + | |||
| + | The --restorebackup, | ||
| + | | ||
| + | fies. Authconfig also saves an automatic backup of configuration | ||
| + | | ||
| + | | ||
| + | |||
| + | If --nostart is specified (which is what the install program does), | ||
| + | | ||
| + | only enabled to start or stop at boot time. | ||
| + | |||
| + | The --enablenis, | ||
| + | | ||
| + | used to configure naming services caching, and the --enableshadow, | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | The algorithm used for storing new password hashes can be specified by the --passalgo | ||
| + | | ||
| + | | ||
| + | |||
| + | The --enablelocauthorize option allows to bypass checking network authentication | ||
| + | | ||
| + | | ||
| + | |||
| + | When the configuration settings allow use of SSSD for user information | ||
| + | | ||
| + | SSSD configuration will be set up so there is a default domain populated with the set‐ | ||
| + | | ||
| + | force adding SSSD to / | ||
| + | | ||
| + | set up manually. The allowed configuration of services for SSSD are: LDAP for user | ||
| + | | ||
| + | | ||
| + | |||
| + | In case SSSD does not support some feature of the legacy services | ||
| + | | ||
| + | | ||
| + | |||
| + | The list of options mentioned here in the manual page is not exhaustive, please | ||
| + | to authconfig --help for the complete list of the options. | ||
| + | |||
| + | | ||
| + | | ||
| + | | ||
| + | fied, no interactive screens will be seen. The values the program | ||
| + | those specified by the other options (--passalgo, | ||
| + | |||
| + | | ||
| + | | ||
| + | |||
| + | NOTES | ||
| + | The authconfig-tui is deprecated. No new configuration settings will be supported | ||
| + | | ||
| + | mand line options instead. | ||
| + | |||
| + | The / | ||
| + | | ||
| + | | ||
| + | |||
| + | The SSSD service is enabled and possibly started by authconfig when at least two of | ||
| + | the following three conditions are met: | ||
| + | 1) / | ||
| + | 2) SSSD authentication is enabled (pam_sss.so is used in PAM configuration) | ||
| + | 3) SSSD is enabled for user identity (nsswitch.conf contains sss) | ||
| + | |||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | | ||
| + | |||
| + | RETURN CODES | ||
| + | | ||
| + | | ||
| + | | ||
| + | of CA certificate fails, 5 if writing configuration files fails on --updateall action, | ||
| + | 6 if writing fails on --update action, 7 if Winbind or IPA domain join fails. | ||
| + | |||
| + | | ||
| + | gram (by using either the Cancel or Back button). It can also return the same codes as | ||
| + | | ||
| + | |||
| + | FILES | ||
| + | / | ||
| + | Used to track whether or not particular | ||
| + | enabled. | ||
| + | BEROS, USELDAPAUTH, | ||
| + | USENIS, USELDAP, and others. | ||
| + | / | ||
| + | / | ||
| + | Used for shadow password support. | ||
| + | / | ||
| + | Configuration file for NIS support. | ||
| + | / | ||
| + | Another configuration file for NIS support. | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | / | ||
| + | Used to configure nss_ldap, pam_ldap, nslcd, and the OpenLDAP library. | ||
| + | Only the files already existing on the system are modified. | ||
| + | / | ||
| + | Used to configure Kerberos 5. | ||
| + | / | ||
| + | Used to configure Hesiod. | ||
| + | / | ||
| + | Used to configure winbind authentication. | ||
| + | / | ||
| + | Used to configure user information services. | ||
| + | / | ||
| + | Used to configure parameters of user accounts (minimum UID of a regular | ||
| + | user, password hashing algorithm). | ||
| + | / | ||
| + | Common | ||
| + | include directive. It is created as symlink | ||
| + | points to another file. | ||
| + | / | ||
| + | Contains | ||
| + | default target of the / | ||
| + | uration | ||
| + | file can be included there. | ||
| + | |||
| + | SEE ALSO | ||
| + | | ||
| + | | ||
| + | |||
| + | AUTHORS | ||
| + | Nalin Dahyabhai < | ||
| + | Matt Wilson < | ||
| + | |||
| + | Red Hat, Inc. 22 July 2011 | ||
| + | |||
| + | Mindestens genau so interessant, | ||
| + | # authconfig --help | ||
| + | |||
| + | < | ||
| + | |||
| + | Options: | ||
| + | -h, --help | ||
| + | --enableshadow, | ||
| + | Shadow-Passwörter standardmäßig aktivieren | ||
| + | --disableshadow | ||
| + | --enablemd5, | ||
| + | MD5-Passwörter standardmäßig aktivieren | ||
| + | --disablemd5 | ||
| + | --passalgo=< | ||
| + | hash/ | ||
| + | --enablenis | ||
| + | --disablenis | ||
| + | --nisdomain=< | ||
| + | --nisserver=< | ||
| + | --enableldap | ||
| + | --disableldap | ||
| + | --enableldapauth | ||
| + | --disableldapauth | ||
| + | --ldapserver=< | ||
| + | Standard LDAP-Server-Hostnamen oder URI | ||
| + | --ldapbasedn=< | ||
| + | --enableldaptls, | ||
| + | Verwendung von TLS mit LDAP (RFC-2830) aktivieren | ||
| + | --disableldaptls, | ||
| + | Verwendung von TLS mit LDAP (RFC-2830) deaktivieren | ||
| + | --enablerfc2307bis | ||
| + | --disablerfc2307bis | ||
| + | --ldaploadcacert=< | ||
| + | CA-Zertifikat von URL laden | ||
| + | --enablesmartcard | ||
| + | --disablesmartcard | ||
| + | --enablerequiresmartcard | ||
| + | Smartcard-Authentifizierung standardmäßig voraussetzen | ||
| + | --disablerequiresmartcard | ||
| + | Smartcard-Authentifizierung nicht standardmäßig voraussetzen | ||
| + | --smartcardmodule=< | ||
| + | Standardmäßig zu verwendendes Smartcard-Modul | ||
| + | --smartcardaction=< | ||
| + | Beim Entfernen einer Smartcard folgende Aktion ausführen | ||
| + | --enablefingerprint | ||
| + | --disablefingerprint | ||
| + | --enableecryptfs | ||
| + | --disableecryptfs | ||
| + | --enablekrb5 | ||
| + | --disablekrb5 | ||
| + | --krb5kdc=< | ||
| + | --krb5adminserver=< | ||
| + | Standard-Kerberos-Admin-Server | ||
| + | --krb5realm=< | ||
| + | Standard-Kerberos-Bereich | ||
| + | --enablekrb5kdcdns | ||
| + | --disablekrb5kdcdns | ||
| + | --enablekrb5realmdns | ||
| + | --disablekrb5realmdns | ||
| + | Verwendung von DNS für die Ermittlung von Kerberos-Bereichen deaktivieren | ||
| + | --enablewinbind | ||
| + | --disablewinbind | ||
| + | --enablewinbindauth | ||
| + | --disablewinbindauth | ||
| + | --smbsecurity=< | ||
| + | Von Samba und Winbind zu verwendender Sicherheitsmodus | ||
| + | --smbrealm=< | ||
| + | --smbservers=< | ||
| + | Namen der Server, gegen die authentifiziert wird | ||
| + | --smbworkgroup=< | ||
| + | Arbeitsgruppen-Authentifizierungsserver sind in | ||
| + | --smbidmaprange=< | ||
| + | uid-Bereich, | ||
| + | --winbindseparator=< | ||
| + | Das Zeichen, das zur Trennung von Domain und Benutzer in von Winbind erzeugten Benutzernamen verwendet wird, sofern winbindusedefaultdomain nicht aktiviert ist | ||
| + | --winbindtemplatehomedir=</ | ||
| + | Der Ordner, den von Winbind erzeugte Benutzer als persönlichen Ordner haben | ||
| + | --winbindtemplateprimarygroup=< | ||
| + | Die Gruppe, die von Winbind erzeugte Benutzer als primäre Gruppe haben | ||
| + | --winbindtemplateshell=</ | ||
| + | Die Shell, die von Winbind erzeugte Benutzer als Login-Shell haben | ||
| + | --enablewinbindusedefaultdomain | ||
| + | Winbind soll annehmen, dass Benutzer ohne Domain im Benutzernamen Domain-Benutzer sind | ||
| + | --disablewinbindusedefaultdomain | ||
| + | Winbind soll annehmen, dass Benutzer, ohne Domain im Benutzernamen keine Domain-Benutzer sind | ||
| + | --enablewinbindoffline | ||
| + | Konfiguriert Winbind, um Offline-Anmeldung zu ermöglichen | ||
| + | --disablewinbindoffline | ||
| + | Konfiguriert Winbind, um Offline-Anmeldung zu verhindern | ||
| + | --enablewinbindkrb5 | ||
| + | --disablewinbindkrb5 | ||
| + | --winbindjoin=< | ||
| + | Jetzt der Winbind-Domäne oder dem ADS-Bereich mit diesem Administrator beitreten | ||
| + | --enableipav2 | ||
| + | --disableipav2 | ||
| + | --ipav2domain=< | ||
| + | Die IPAv2 Domäne, bei der das System enthalten sein soll | ||
| + | --ipav2realm=< | ||
| + | Der Bereich für die IPAv2-Domäne | ||
| + | --ipav2server=< | ||
| + | Server der IPAv2 Domäne | ||
| + | --enableipav2nontp | ||
| + | --disableipav2nontp | ||
| + | --ipav2join=< | ||
| + | Mit diesem Konto der IPAv2-Domäne beitreten | ||
| + | --enablewins | ||
| + | --disablewins | ||
| + | --enablepreferdns | ||
| + | --disablepreferdns | ||
| + | --enablehesiod | ||
| + | --disablehesiod | ||
| + | --hesiodlhs=< | ||
| + | --hesiodrhs=< | ||
| + | --enablesssd | ||
| + | --disablesssd | ||
| + | --enablesssdauth | ||
| + | --disablesssdauth | ||
| + | --enableforcelegacy | ||
| + | --disableforcelegacy | ||
| + | --enablecachecreds | ||
| + | --disablecachecreds | ||
| + | --enablecache | ||
| + | --disablecache | ||
| + | --enablelocauthorize | ||
| + | --disablelocauthorize | ||
| + | Lokale Benutzer auch über Fernzugriff autorisieren | ||
| + | --enablepamaccess | ||
| + | --disablepamaccess | ||
| + | --enablesysnetauth | ||
| + | --disablesysnetauth | ||
| + | --enablemkhomedir | ||
| + | --disablemkhomedir | ||
| + | --passminlen=< | ||
| + | Minimale Passwortlänge | ||
| + | --passminclass=< | ||
| + | Mindestanzahl von Charakter-Klassen in einem Kennwort | ||
| + | --passmaxrepeat=< | ||
| + | Maximalanzahl gleicher Zeichen in einem Passwort | ||
| + | --passmaxclassrepeat=< | ||
| + | Maximale Anzahl von aufeinanderfolgenden Zeichen derselben Klasse in einem Kennwort | ||
| + | --enablereqlower | ||
| + | --disablereqlower | ||
| + | --enablerequpper | ||
| + | --disablerequpper | ||
| + | --enablereqdigit | ||
| + | --disablereqdigit | ||
| + | --enablereqother | ||
| + | --disablereqother | ||
| + | --nostart | ||
| + | --test | ||
| + | --update, --kickstart | ||
| + | Im Gegensatz zu --test die Konfigurationsdateien mit geänderten Einstellungen aktualisieren | ||
| + | --updateall | ||
| + | --probe | ||
| + | --savebackup=< | ||
| + | --restorebackup=< | ||
| + | Eine Sicherung der Konfigurationsdateien wiederherstellen | ||
| + | --restorelastbackup | ||
| + | |||
| + | ==== Konfiguration ==== | ||
| + | === authconfig === | ||
| + | |||
| + | Die Konfiguration unseres Clients nehmen wir am einfachsten mit Hilfe des Programmes **// | ||
| + | |||
| + | |||
| + | * **disablesssd** SSSD für Benutzerinformationen als Vorgabe deaktivieren | ||
| + | * **disablesssdauth** SSD für Authentifizierung als Vorgabe deaktivieren | ||
| + | * **disablemd5** MD5 Passworter abschalten | ||
| + | * **passalgo** Definition des Passworthash-Algoritmuses | ||
| + | * **enablemkhomedir** Homedirectory beim ersten Login eines neuen Users automatisch anlegen | ||
| + | * **enableldap** LDAP User Informationen aktivieren | ||
| + | * **enableldapauth** LDAP Authentifizierung aktivieren | ||
| + | * **ldapserver** LDAP Servername oder URI Definition | ||
| + | * **ldapbasedn** LDAP Basde DN Definition | ||
| + | * **enableldaptls** Verwendung von TLS mit LDAP (RFC-2830) über Port 636 verwenden | ||
| + | * **enableldapstarttls** Verwendung von StartTLS mit LDAP über Port 389 verwenden | ||
| + | * **update** Update der Konfigurationsdateien mit den gesetzten Werten. | ||
| + | |||
| + | Wir Konfigurieren nun also unsere LDAP-Client-Authentifizierung wie folgt. | ||
| + | # authconfig --disablesssd \ | ||
| + | --disablesssdauth \ | ||
| + | --disablemd5 \ | ||
| + | --passalgo=sha256 \ | ||
| + | --enablemkhomedir \ | ||
| + | --enableldap \ | ||
| + | --enableldapauth \ | ||
| + | --ldapserver=" | ||
| + | --ldapbasedn=" | ||
| + | --enableldaptls \ | ||
| + | --enableldapstarttls \ | ||
| + | --update | ||
| + | |||
| + | Die einzelnen Konfigurationsdateien, | ||
| + | |||
| + | Zur Dokumentation und ggf. spätere weitere Dokumentationsschritte versehen wir am Besten optional alle Änderungen mit einem Kommentar, ala: ''# | ||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | === nslcd.conf === | ||
| + | Die erste Datei, die wir uns nun genauer ansehen, ist die Konfigurationsdatei // | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | # switch library' | ||
| + | # between NSS names (see / | ||
| + | # information in the directory. | ||
| + | # See the manual page nslcd.conf(5) for more information. | ||
| + | |||
| + | # The user and group nslcd should run as. | ||
| + | uid nslcd | ||
| + | gid ldap | ||
| + | |||
| + | # The uri pointing to the LDAP server to use for name lookups. | ||
| + | # Multiple entries may be specified. The address that is used | ||
| + | # here should be resolvable without using LDAP (obviously). | ||
| + | #uri ldap:// | ||
| + | #uri ldaps:// | ||
| + | #uri ldapi:// | ||
| + | # Note: %2f encodes the '/' | ||
| + | # Django : 2015-07-20 | ||
| + | # default: uri ldap:// | ||
| + | uri ldap:// | ||
| + | |||
| + | # The LDAP version to use (defaults to 3 | ||
| + | # if supported by client library) | ||
| + | # | ||
| + | |||
| + | # The distinguished name of the search base. | ||
| + | # Django : 2015-07-20 | ||
| + | # default: base dc=example, | ||
| + | base dc=nausch, | ||
| + | |||
| + | # The distinguished name to bind to the server with. | ||
| + | # Optional: default is to bind anonymously. | ||
| + | #binddn cn=proxyuser, | ||
| + | # Django : 2015-07-20 | ||
| + | # default: unset | ||
| + | binddn cn=Technischeruser, | ||
| + | |||
| + | # The credentials to bind with. | ||
| + | # Optional: default is no credentials. | ||
| + | # Note that if you set a bindpw you should check the permissions of this file. | ||
| + | #bindpw secret | ||
| + | # Django : 2015-07-20 | ||
| + | # default: unset | ||
| + | bindpw YpKKoS1lV1AdAX1StGe1lTembvZW4XagnkLdWZ2Y4Xkw | ||
| + | |||
| + | # The distinguished name to perform password modifications by root by. | ||
| + | # | ||
| + | |||
| + | # The default search scope. | ||
| + | #scope sub | ||
| + | #scope one | ||
| + | #scope base | ||
| + | |||
| + | # Customize certain database lookups. | ||
| + | #base | ||
| + | #base | ||
| + | #base | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Bind/ | ||
| + | # | ||
| + | |||
| + | # Search timelimit. | ||
| + | #timelimit 30 | ||
| + | |||
| + | # Idle timelimit. nslcd will close connections if the | ||
| + | # server has not been contacted for the number of seconds. | ||
| + | # | ||
| + | |||
| + | # Use StartTLS with verifying the server certificate. | ||
| + | # Django : 2015-07-20 | ||
| + | ssl start_tls | ||
| + | tls_cacertfile / | ||
| + | |||
| + | # Use StartTLS without verifying the server certificate. | ||
| + | #ssl start_tls | ||
| + | # | ||
| + | |||
| + | # CA certificates for server certificate verification | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Seed the PRNG if / | ||
| + | # | ||
| + | |||
| + | # SSL cipher suite | ||
| + | # See man ciphers for syntax | ||
| + | # | ||
| + | |||
| + | # Client certificate and key | ||
| + | # Use these, if your server requires client authentication. | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Mappings for Services for UNIX 3.5 | ||
| + | #filter passwd (objectClass=User) | ||
| + | #map passwd uid msSFU30Name | ||
| + | #map passwd userPassword | ||
| + | #map passwd homeDirectory | ||
| + | #map passwd homeDirectory | ||
| + | #filter shadow (objectClass=User) | ||
| + | #map shadow uid msSFU30Name | ||
| + | #map shadow userPassword | ||
| + | #filter group (objectClass=Group) | ||
| + | #map group member | ||
| + | |||
| + | # Mappings for Services for UNIX 2.0 | ||
| + | #filter passwd (objectClass=User) | ||
| + | #map passwd uid msSFUName | ||
| + | #map passwd userPassword | ||
| + | #map passwd homeDirectory | ||
| + | #map passwd gecos msSFUName | ||
| + | #filter shadow (objectClass=User) | ||
| + | #map shadow uid msSFUName | ||
| + | #map shadow userPassword | ||
| + | #map shadow shadowLastChange pwdLastSet | ||
| + | #filter group (objectClass=Group) | ||
| + | #map group member | ||
| + | |||
| + | # Mappings for Active Directory | ||
| + | #pagesize 1000 | ||
| + | #referrals off | ||
| + | # | ||
| + | #filter passwd (& | ||
| + | #map passwd uid sAMAccountName | ||
| + | #map passwd homeDirectory | ||
| + | #map passwd gecos displayName | ||
| + | #filter shadow (& | ||
| + | #map shadow uid sAMAccountName | ||
| + | #map shadow shadowLastChange pwdLastSet | ||
| + | #filter group (objectClass=group) | ||
| + | |||
| + | # Alternative mappings for Active Directory | ||
| + | # (replace the SIDs in the objectSid mappings with the value for your domain) | ||
| + | #pagesize 1000 | ||
| + | #referrals off | ||
| + | # | ||
| + | #filter passwd (& | ||
| + | #map passwd uid cn | ||
| + | #map passwd uidNumber | ||
| + | #map passwd gidNumber | ||
| + | #map passwd homeDirectory "/ | ||
| + | #map passwd gecos | ||
| + | #map passwd loginShell | ||
| + | #filter group (|(objectClass=group)(objectClass=person)) | ||
| + | #map group gidNumber | ||
| + | |||
| + | # Mappings for AIX SecureWay | ||
| + | #filter passwd (objectClass=aixAccount) | ||
| + | #map passwd uid userName | ||
| + | #map passwd userPassword | ||
| + | #map passwd uidNumber | ||
| + | #map passwd gidNumber | ||
| + | #filter group (objectClass=aixAccessGroup) | ||
| + | #map group cn | ||
| + | #map group gidNumber | ||
| + | # This comment prevents repeated auto-migration of settings. | ||
| + | </ | ||
| + | |||
| + | Anschließend passen wir noch die Dateiberechtigungen an, so wie es bei der Option **bindpw** angeraten wurde. | ||
| + | # chown nslcd:ldap / | ||
| + | |||
| + | === nsswitch.conf === | ||
| + | In der Konfigurationsdatei // | ||
| + | * **passwd: | ||
| + | * **shadow: | ||
| + | * **group: | ||
| + | |||
| + | * **netgroup: | ||
| + | |||
| + | * **automount: | ||
| + | |||
| + | |||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | # / | ||
| + | # | ||
| + | # An example Name Service Switch config file. This file should be | ||
| + | # sorted with the most-used services at the beginning. | ||
| + | # | ||
| + | # The entry ' | ||
| + | # entry should stop if the search in the previous entry turned | ||
| + | # up nothing. Note that if the search failed due to some other reason | ||
| + | # (like no NIS server responding) then the search continues with the | ||
| + | # next entry. | ||
| + | # | ||
| + | # Valid entries include: | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # To use db, put the " | ||
| + | # looked up first in the databases | ||
| + | # | ||
| + | # Example: | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | |||
| + | # Django : 2015-07-21 LDAP Client Authentication | ||
| + | # default: passwd: | ||
| + | # shadow: | ||
| + | # group: | ||
| + | passwd: | ||
| + | shadow: | ||
| + | group: | ||
| + | # | ||
| + | |||
| + | # | ||
| + | hosts: | ||
| + | |||
| + | # Example - obey only what nisplus tells us... | ||
| + | # | ||
| + | # | ||
| + | # | ||
| + | #rpc: nisplus [NOTFOUND=return] files | ||
| + | # | ||
| + | # | ||
| + | |||
| + | bootparams: nisplus [NOTFOUND=return] files | ||
| + | |||
| + | ethers: | ||
| + | netmasks: | ||
| + | networks: | ||
| + | protocols: | ||
| + | rpc: files | ||
| + | services: | ||
| + | |||
| + | # Django : 2015-07-21 LDAP Client Authentication | ||
| + | # default: netgroup: | ||
| + | netgroup: | ||
| + | |||
| + | publickey: | ||
| + | |||
| + | # Django : 2015-07-21 LDAP Client Authentication | ||
| + | # default: automount: | ||
| + | automount: | ||
| + | aliases: | ||
| + | </ | ||
| + | |||
| + | === password-auth-ac === | ||
| + | Damit sich unsere Nutzer auch anmelden können, ist es notwendig in der Konfigurationsdatei // | ||
| + | # vim / | ||
| + | |||
| + | <file bash / | ||
| + | # This file is auto-generated. | ||
| + | # User changes will be destroyed the next time authconfig is run. | ||
| + | auth required | ||
| + | auth sufficient | ||
| + | auth requisite | ||
| + | # Django : 2015-07-21 | ||
| + | # default: auth sufficient | ||
| + | auth sufficient | ||
| + | auth required | ||
| + | |||
| + | account | ||
| + | account | ||
| + | account | ||
| + | # Django : 2015-07-21 | ||
| + | # default: account | ||
| + | account | ||
| + | account | ||
| + | |||
| + | password | ||
| + | password | ||
| + | # Django : 2015-07-21 | ||
| + | # default: password | ||
| + | password | ||
| + | password | ||
| + | |||
| + | session | ||
| + | session | ||
| + | -session | ||
| + | session | ||
| + | session | ||
| + | session | ||
| + | # Django : 2015-07-21 | ||
| + | # default: session | ||
| + | session | ||
| + | |||
| + | ==== Start des Naming services LDAP client daemon ==== | ||
| + | Nun ist es an der Zeit, den **NSLCD**((**N**aming **S**ervices **L**DAP **C**lient **D**aemon)) zu starten. | ||
| + | # systemctl restart nslcd.service | ||
| + | |||
| + | Den erfolgreichen Start des Daemon fragen wir wie folgt ab. | ||
| + | # systemctl status nslcd.service -l | ||
| + | |||
| + | < | ||
| + | <font style=" | ||
| + | | ||
| + | | ||
| + | Process: 8771 ExecStart=/ | ||
| + | Main PID: 8774 (nslcd) | ||
| + | | ||
| + | | ||
| + | |||
| + | Jul 20 17:06:44 vml010052.intra.nausch.org systemd[1]: Starting Naming services LDAP client daemon.... | ||
| + | Jul 20 17:06:44 vml010052.intra.nausch.org systemd[1]: PID file / | ||
| + | Jul 20 17:06:44 vml010052.intra.nausch.org nslcd[8774]: | ||
| + | Jul 20 17:06:44 vml010052.intra.nausch.org systemd[1]: Started Naming services LDAP client daemon.. | ||
| + | Jul 20 17:06:44 vml010052.intra.nausch.org nslcd[8774]: | ||
| + | </ | ||
| + | |||
| + | Damit der Daemin automatisch gestartet wird, wenn der Clientrechner hochfährt, aktivieren wir den NSLCD entsprechend. | ||
| + | # systemctl enable nslcd.service | ||
| + | |||
| + | ln -s '/ | ||
| + | |||
| + | Wollen wir abfragen, ob der Daemon automatisch beim Systemstart gestartet wird benutzen wir nachfolgenden Befehl/ | ||
| + | # systemctl is-enabled nslcd.service | ||
| + | |||
| + | enabled | ||
| + | |||
| + | Ein **enabled** signalisiert, | ||
| + | |||
| + | ===== Tests ===== | ||
| + | ==== LDAP Abfrage ==== | ||
| + | |||
| + | Zur Abfrage eines LDAP-Users können wir folgenden Aufruf verwenden: | ||
| + | $ ldapsearch -x -LLL -H ldaps:// | ||
| + | Enter LDAP Password: | ||
| + | < | ||
| + | uid: django | ||
| + | cn: django | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | shadowLastChange: | ||
| + | shadowMin: 0 | ||
| + | shadowMax: 99999 | ||
| + | shadowWarning: | ||
| + | loginShell: /bin/bash | ||
| + | uidNumber: 1000 | ||
| + | gidNumber: 1000 | ||
| + | homeDirectory: | ||
| + | gecos: django | ||
| + | userPassword:: | ||
| + | |||
| + | Das nächste Beispiel zeigt eine LDAP-Abfrage mit dem User django aber mit __falschem__ Passwort: | ||
| + | $ ldapsearch -x -LLL -H ldaps:// | ||
| + | |||
| + | Enter LDAP Password: | ||
| + | |||
| + | ldap_bind: Invalid credentials (49) | ||
| + | |||
| + | Hingegen eine Abfrage mit einer richtigen Kombination von Benutzer und Passwort, sieht entsprechend wie folgt aus: | ||
| + | $ ldapsearch -x -LLL -H ldaps:// | ||
| + | |||
| + | Enter LDAP Password: | ||
| + | < | ||
| + | uid: inge | ||
| + | cn: inge | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | loginShell: /bin/bash | ||
| + | uidNumber: 1002 | ||
| + | gidNumber: 1002 | ||
| + | homeDirectory: | ||
| + | gecos: inge | ||
| + | userPassword:: | ||
| + | |||
| + | ==== Client-Abfragen ==== | ||
| + | Die erfolgreiche Konfiguration unseres Rechners überprüfen wir so: | ||
| + | - Mit **getent** lassen wir uns die Informationen eines Users anzeigen, der sowohl in der /etc/shadow wie auch im zentralen LDAP-Verzeichnisdienst hinterlegt ist. Wenn alles gut gelaufen ist, werden uns zwei Einträge präsentiert. \\ \\ < | ||
| + | django: | ||
| + | - Als nächstes wählen wir einen Nutzer der nur im LDAP-Verzeichnisdienst einen Account hat, nicht aber auf der lokalen Maschine. \\ \\ < | ||
| + | - Dann melden wir uns nun an unserem Client als ein Benutzer an, der lokal auf der Maschine nicht existiert, werden wir beim Login nach dem Passwort gefragt, welches gegen den zentralen OpenLDAP-Server verifiziert wird. Ist das Passwort richtig wird auch gleich das zugehörige Nutzer-Homeverzeichnis angelegt. \\ \\ < | ||
| + | |||
| + | {{ : | ||
| ===== remote Benutzer bei Web-Servern ===== | ===== remote Benutzer bei Web-Servern ===== | ||
| - | ==== Apache Webserver ==== | + | Nachdem sich unsere Nutzer an ihren Arbeitsplatzrechner erfolgreich anmelden können, wollen sie mit unter auch von unterwegs aus auf Ihre eMail oder andere WEB-Dienste zugreifen. Auch dort sollen sich unsere User mit deren Anmeldedaten anmelden können. |
| + | Im folgenden gehen wir auf Konfigurationslösungen bei den beiden Webservern **[[http:// | ||
| + | |||
| + | ==== Apache Webserver ==== | ||
| + | {{page> | ||
| ==== NGiNX Webserver ==== | ==== NGiNX Webserver ==== | ||
| + | {{page> | ||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | /* | ||
| + | SSH Public Keys from LDAP | ||
| + | |||
| + | LDAPpubkeyOpenSSH is the free version of the SSH suite of tools. Contrary to telnet or rlogin, ssh allows a user to safely connect to a remote system because all traffic (specially a user's credentials) are encrypted. SSH(Secure Shell) also supports public-key authentication which allows you to connect to a remote server without sending your password over the Internet. | ||
| + | |||
| + | Public-key authentication uses two keys, a private key that only you have, and the public key, which is placed on the server you wish to gain access to, usually by yourself, adding your public key to the ~/ | ||
| + | |||
| + | That is all very well when you only have a couple of machines you want to log in to, but what happens when you have dozens or more? You have to maintain your public keys on all those systems, ensuring they are kept up to date. God forbid that you loose your private key, or that it becomes compromised: | ||
| + | |||
| + | Eric Auge has made a patch to OpenSSH which allows the SSH server (sshd) to read the public keys from an LDAP directory. I've tested it with OpenLDAP and the patch works like a charm. | ||
| + | |||
| + | After patching the source of portable OpenSSH (I used version 4.1p1) with Eric's OpenSSH LDAP Public Key Patch corresponding to the OpenSSH version you downloaded, it is a matter of following the good instructions in README.lpk, adjusting your ./configure invocation according to the flavor of the day. After building, installing and restarting the patched OpenSSH, ensure you can still log on to your system. | ||
| + | |||
| + | Now add the LDAP options to your sshd_config file, adjusting the settings to suit your LDAP directory information tree, and restart sshd. | ||
| + | |||
| + | Add the schema file openldap-lpk.schema to your slapd.conf and restart your directory server. Add an object of class ldapPublicKey to your LDAP user entry, ensuring that you also have a posixAccount (sshd constructs the LDAP search filter by and-ing both object classes and the userid of the person logging on), and add one or more sshPublicKey attribute types. | ||
| + | |||
| + | My LDIF now looks like this: | ||
| + | |||
| + | dn: uid=jpm, | ||
| + | sn: Mens | ||
| + | cn: Jan-Piet Mens | ||
| + | gecos: JP Mens | ||
| + | uidNumber: 400 | ||
| + | gidNumber: 400 | ||
| + | uid: jpm | ||
| + | homeDirectory: | ||
| + | loginShell: /bin/bash | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | sshPublicKey: | ||
| + | sshPublicKey: | ||
| + | |||
| + | I can now connect to all machines which have an sshd appropriately set up, without needing to distribute my public keys. (In case you are wondering about the environment option in the second public-key: that is for ldp, my LDAP distributed shell profile; have a look at that too!) | ||
| + | |||
| + | Isn't that insecure? Well, not if you are careful. sshd will only allow you to connect if you already a a " | ||
| + | |||
| + | So before letting the OpenSSH LDAP Public Key Patch fly on your publicly accessible machines, do ensure you are careful during deployment. | ||
| + | |||
| + | Oh, and before you ask: if the LDAP directory server is unavailable, | ||
| + | Flattr this | ||
| + | |||
| + | */ | ||
| + | |||
| + | ====== Links ====== | ||
| + | * **⇐ [[centos: | ||
| + | * **[[centos: | ||
| + | * **[[wiki: | ||
| + | * **[[http:// | ||
| + | |||
| - | FIXME | ||
django