centos:ldap_c7:data

Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

Link zu dieser Vergleichsansicht

Beide Seiten der vorigen Revision Vorhergehende Überarbeitung
Nächste Überarbeitung		 Vorhergehende Überarbeitung
centos:ldap_c7:data [16.07.2015 15:38. ] – [cosine] djangocentos:ldap_c7:data [22.07.2019 15:03. ] (aktuell) – Externe Bearbeitung 127.0.0.1
Zeile 4: Zeile 4:
 Nachdem wir die [[centos:ldap_c7:install|Grundinstallation des OpenLDAP Servers]] und die [[centos:ldap_c7:ldaps|TLS-Absicherung des OpenLDAP-Servers ]] erfolgreich abgeschlossen haben, werden wir im nächsten Schritt unsere Berkely-Datenbank mit Inhalt befüllen und weiter konfigurieren. Nachdem wir die [[centos:ldap_c7:install|Grundinstallation des OpenLDAP Servers]] und die [[centos:ldap_c7:ldaps|TLS-Absicherung des OpenLDAP-Servers ]] erfolgreich abgeschlossen haben, werden wir im nächsten Schritt unsere Berkely-Datenbank mit Inhalt befüllen und weiter konfigurieren.
  
-Wir werden im ersten Schritt unseren OpenLDAP-Verzeichnisdienst mit Schemen befüllen, die wir im späteren Betrieb benötigen werden. Für die Befüllung mit Nutzdaten, die aus Distinguished Names (DN) und einem eindeutigen Objektnamen bestehen, müssen hierzu in den **Directory Information Tree** (**DIT**), einer hierarchischen Baumstruktur eingefügt werden.+Wir werden im ersten Schritt unseren OpenLDAP-Verzeichnisdienst mit Schemen befüllen, die wir im späteren Betrieb benötigen werden. Für die Befüllung mit Nutzdaten, die aus **Distinguished Names** (**DN**) und einem eindeutigen Objektnamen bestehen, müssen hierzu in den **Directory Information Tree** (**DIT**), einer hierarchischen Baumstruktur eingefügt werden.
  
 ===== Sche­ma­ta ===== ===== Sche­ma­ta =====
Zeile 43: Zeile 43:
   * **cosine.schema** Cosine and Internet X.500 ([[https://tools.ietf.org/html/rfc1274|RFC 1274]])   * **cosine.schema** Cosine and Internet X.500 ([[https://tools.ietf.org/html/rfc1274|RFC 1274]])
   * **inetorgperson.schema** InetOrgPerson ([[https://tools.ietf.org/html/rfc2798|RFC 2798]])   * **inetorgperson.schema** InetOrgPerson ([[https://tools.ietf.org/html/rfc2798|RFC 2798]])
-  * **nis.schema** Network Information Services+  * **nis.schema** Network Information Services ([[https://tools.ietf.org/html/rfc2307| RFC 2307]])
  
 ==== cosine ==== ==== cosine ====
Zeile 2802: Zeile 2802:
  
 ==== nis ==== ==== nis ====
 +Als letztes importieren wir nun noch das Schema //**nis**//.  Die Beschreibung des Schemas findet sich in der gleichnamigen Datei //**/etc/openldap/schema/nis.schema**//.
 +   # less /etc/openldap/schema/nis.schema
  
 +<file ldif /etc/openldap/schema/nis.schema># $OpenLDAP$                                                 
 +## This work is part of OpenLDAP Software <http://www.openldap.org/>.
 +##                                                                   
 +## Copyright 1998-2014 The OpenLDAP Foundation.                      
 +## All rights reserved.                                              
 +##                                                                   
 +## Redistribution and use in source and binary forms, with or without
 +## modification, are permitted only as authorized by the OpenLDAP    
 +## Public License.                                                   
 +##                                                                   
 +## A copy of this license is available in the file LICENSE in the    
 +## top-level directory of the distribution or, alternatively, at     
 +## <http://www.OpenLDAP.org/license.html>.                           
 +
 +# Definitions from RFC2307 (Experimental)
 +#       An Approach for Using LDAP as a Network Information Service
 +
 +# Depends upon core.schema and cosine.schema
 +
 +# Note: The definitions in RFC2307 are given in syntaxes closely related
 +# to those in RFC2252, however, some liberties are taken that are not   
 +# supported by RFC2252.  This file has been written following RFC2252   
 +# strictly.                                                             
 +
 +# OID Base is iso(1) org(3) dod(6) internet(1) directory(1) nisSchema(1).
 +# i.e. nisSchema in RFC2307 is 1.3.6.1.1.1                               
 +#                                                                        
 +# Syntaxes are under 1.3.6.1.1.1.0 (two new syntaxes are defined)        
 +#       validaters for these syntaxes are incomplete, they only          
 +#       implement printable string validation (which is good as the      
 +#       common use of these syntaxes violates the specification).        
 +# Attribute types are under 1.3.6.1.1.1.1                                
 +# Object classes are under 1.3.6.1.1.1.2                                 
 +
 +# Attribute Type Definitions
 +
 +# builtin
 +#attributetype ( 1.3.6.1.1.1.1.0 NAME 'uidNumber'
 +#       DESC 'An integer uniquely identifying a user in an administrative domain'
 +#       EQUALITY integerMatch                                                    
 +#       SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )                      
 +
 +# builtin
 +#attributetype ( 1.3.6.1.1.1.1.1 NAME 'gidNumber'
 +#       DESC 'An integer uniquely identifying a group in an administrative domain'
 +#       EQUALITY integerMatch                                                     
 +#       SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )                       
 +
 +attributetype ( 1.3.6.1.1.1.1.2 NAME 'gecos'
 +        DESC 'The GECOS field; the common name'
 +        EQUALITY caseIgnoreIA5Match            
 +        SUBSTR caseIgnoreIA5SubstringsMatch    
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
 +
 +attributetype ( 1.3.6.1.1.1.1.3 NAME 'homeDirectory'
 +        DESC 'The absolute path to the home directory'
 +        EQUALITY caseExactIA5Match                    
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
 +
 +attributetype ( 1.3.6.1.1.1.1.4 NAME 'loginShell'
 +        DESC 'The path to the login shell'       
 +        EQUALITY caseExactIA5Match               
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
 +
 +attributetype ( 1.3.6.1.1.1.1.5 NAME 'shadowLastChange'
 +        EQUALITY integerMatch                          
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
 +
 +attributetype ( 1.3.6.1.1.1.1.6 NAME 'shadowMin'
 +        EQUALITY integerMatch                   
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
 +
 +attributetype ( 1.3.6.1.1.1.1.7 NAME 'shadowMax'
 +        EQUALITY integerMatch                   
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
 +
 +attributetype ( 1.3.6.1.1.1.1.8 NAME 'shadowWarning'
 +        EQUALITY integerMatch                       
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
 +
 +attributetype ( 1.3.6.1.1.1.1.9 NAME 'shadowInactive'
 +        EQUALITY integerMatch                        
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
 +
 +attributetype ( 1.3.6.1.1.1.1.10 NAME 'shadowExpire'
 +        EQUALITY integerMatch                       
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
 +
 +attributetype ( 1.3.6.1.1.1.1.11 NAME 'shadowFlag'
 +        EQUALITY integerMatch                     
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
 +
 +attributetype ( 1.3.6.1.1.1.1.12 NAME 'memberUid'
 +        EQUALITY caseExactIA5Match               
 +        SUBSTR caseExactIA5SubstringsMatch       
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )   
 +
 +attributetype ( 1.3.6.1.1.1.1.13 NAME 'memberNisNetgroup'
 +        EQUALITY caseExactIA5Match                       
 +        SUBSTR caseExactIA5SubstringsMatch               
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )           
 +
 +attributetype ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple'
 +        DESC 'Netgroup triple'                           
 +        SYNTAX 1.3.6.1.1.1.0.0 )                         
 +
 +attributetype ( 1.3.6.1.1.1.1.15 NAME 'ipServicePort'
 +        EQUALITY integerMatch                        
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
 +
 +attributetype ( 1.3.6.1.1.1.1.16 NAME 'ipServiceProtocol'
 +        SUP name )                                       
 +
 +attributetype ( 1.3.6.1.1.1.1.17 NAME 'ipProtocolNumber'
 +        EQUALITY integerMatch                           
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
 +
 +attributetype ( 1.3.6.1.1.1.1.18 NAME 'oncRpcNumber'
 +        EQUALITY integerMatch                       
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
 +
 +attributetype ( 1.3.6.1.1.1.1.19 NAME 'ipHostNumber'
 +        DESC 'IP address'                           
 +        EQUALITY caseIgnoreIA5Match                 
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) 
 +
 +attributetype ( 1.3.6.1.1.1.1.20 NAME 'ipNetworkNumber'
 +        DESC 'IP network'                              
 +        EQUALITY caseIgnoreIA5Match                    
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} SINGLE-VALUE )
 +
 +attributetype ( 1.3.6.1.1.1.1.21 NAME 'ipNetmaskNumber'
 +        DESC 'IP netmask'                              
 +        EQUALITY caseIgnoreIA5Match                    
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} SINGLE-VALUE )
 +
 +attributetype ( 1.3.6.1.1.1.1.22 NAME 'macAddress'
 +        DESC 'MAC address'                        
 +        EQUALITY caseIgnoreIA5Match               
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} )
 +
 +attributetype ( 1.3.6.1.1.1.1.23 NAME 'bootParameter'
 +        DESC 'rpc.bootparamd parameter'              
 +        SYNTAX 1.3.6.1.1.1.0.1 )                     
 +
 +attributetype ( 1.3.6.1.1.1.1.24 NAME 'bootFile'
 +        DESC 'Boot image name'                  
 +        EQUALITY caseExactIA5Match              
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )  
 +
 +attributetype ( 1.3.6.1.1.1.1.26 NAME 'nisMapName'
 +        SUP name )                                
 +
 +attributetype ( 1.3.6.1.1.1.1.27 NAME 'nisMapEntry'
 +        EQUALITY caseExactIA5Match                 
 +        SUBSTR caseExactIA5SubstringsMatch         
 +        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{1024} SINGLE-VALUE )
 +
 +# Object Class Definitions
 +
 +objectclass ( 1.3.6.1.1.1.2.0 NAME 'posixAccount'
 +        DESC 'Abstraction of an account with POSIX attributes'
 +        SUP top AUXILIARY                                     
 +        MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory )
 +        MAY ( userPassword $ loginShell $ gecos $ description ) )
 +
 +objectclass ( 1.3.6.1.1.1.2.1 NAME 'shadowAccount'
 +        DESC 'Additional attributes for shadow passwords'
 +        SUP top AUXILIARY                                
 +        MUST uid                                         
 +        MAY ( userPassword $ shadowLastChange $ shadowMin $
 +              shadowMax $ shadowWarning $ shadowInactive $ 
 +              shadowExpire $ shadowFlag $ description ) )  
 +
 +objectclass ( 1.3.6.1.1.1.2.2 NAME 'posixGroup'
 +        DESC 'Abstraction of a group of accounts'
 +        SUP top STRUCTURAL                       
 +        MUST ( cn $ gidNumber )                  
 +        MAY ( userPassword $ memberUid $ description ) )
 +
 +objectclass ( 1.3.6.1.1.1.2.3 NAME 'ipService'
 +        DESC 'Abstraction an Internet Protocol service'
 +        SUP top STRUCTURAL
 +        MUST ( cn $ ipServicePort $ ipServiceProtocol )
 +        MAY ( description ) )
 +
 +objectclass ( 1.3.6.1.1.1.2.4 NAME 'ipProtocol'
 +        DESC 'Abstraction of an IP protocol'
 +        SUP top STRUCTURAL
 +        MUST ( cn $ ipProtocolNumber $ description )
 +        MAY description )
 +
 +objectclass ( 1.3.6.1.1.1.2.5 NAME 'oncRpc'
 +        DESC 'Abstraction of an ONC/RPC binding'
 +        SUP top STRUCTURAL
 +        MUST ( cn $ oncRpcNumber $ description )
 +        MAY description )
 +
 +objectclass ( 1.3.6.1.1.1.2.6 NAME 'ipHost'
 +        DESC 'Abstraction of a host, an IP device'
 +        SUP top AUXILIARY
 +        MUST ( cn $ ipHostNumber )
 +        MAY ( l $ description $ manager ) )
 +
 +objectclass ( 1.3.6.1.1.1.2.7 NAME 'ipNetwork'
 +        DESC 'Abstraction of an IP network'
 +        SUP top STRUCTURAL
 +        MUST ( cn $ ipNetworkNumber )
 +        MAY ( ipNetmaskNumber $ l $ description $ manager ) )
 +
 +objectclass ( 1.3.6.1.1.1.2.8 NAME 'nisNetgroup'
 +        DESC 'Abstraction of a netgroup'
 +        SUP top STRUCTURAL
 +        MUST cn
 +        MAY ( nisNetgroupTriple $ memberNisNetgroup $ description ) )
 +
 +objectclass ( 1.3.6.1.1.1.2.9 NAME 'nisMap'
 +        DESC 'A generic abstraction of a NIS map'
 +        SUP top STRUCTURAL
 +        MUST nisMapName
 +        MAY description )
 +
 +objectclass ( 1.3.6.1.1.1.2.10 NAME 'nisObject'
 +        DESC 'An entry in a NIS map'
 +        SUP top STRUCTURAL
 +        MUST ( cn $ nisMapEntry $ nisMapName )
 +        MAY description )
 +
 +objectclass ( 1.3.6.1.1.1.2.11 NAME 'ieee802Device'
 +        DESC 'A device with a MAC address'
 +        SUP top AUXILIARY
 +        MAY macAddress )
 +
 +objectclass ( 1.3.6.1.1.1.2.12 NAME 'bootableDevice'
 +        DESC 'A device with boot parameters'
 +        SUP top AUXILIARY
 +        MAY ( bootFile $ bootParameter ) )
 +</file>
 +
 +
 +Auch hier erfolgt natürlich der Import des Schemas mit Hilfe des Befehls **ldapadd**.
 +   # ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f /etc/openldap/schema/nis.ldif
 +
 +  SASL/EXTERNAL authentication started
 +  SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
 +  SASL SSF: 0
 +  adding new entry "cn=nis,cn=schema,cn=config"
 +
 +==== Konfigurationscheck ====
 +Nachdem wir die benötigten Schematas alle importiert haben, können wir nun abschließend überprüfen, ob die neuen Schematas auch im Verzeichnisbaum zu finden sind.
 +   #  ldapsearch -W -x -D cn=config -b cn=config | grep cn=schema,cn=config
 +
 +  Enter LDAP Password:
 +
 +<html><pre class="code">
 +<font style="color: rgb(0, 0, 0)">dn: </font><font style="color: rgb(255, 84, 84)"><b>cn=schema,cn=config</b></font>
 +<font style="color: rgb(0, 0, 0)">dn: cn={0}core,</font><font style="color: rgb(255, 84, 84)"><b>cn=schema,cn=config</b></font>
 +<font style="color: rgb(0, 0, 0)">dn: cn={1}cosine,</font><font style="color: rgb(255, 84, 84)"><b>cn=schema,cn=config</b></font>
 +<font style="color: rgb(0, 0, 0)">dn: cn={2}inetorgperson,</font><font style="color: rgb(255, 84, 84)"><b>cn=schema,cn=config</b></font>
 +<font style="color: rgb(0, 0, 0)">dn: cn={3}nis,</font><font style="color: rgb(255, 84, 84)"><b>cn=schema,cn=config</b></font>
 +</pre></html>
 +
 +
 +===== Directory Information Tree =====
 +Zur Speicherung der Daten, die aus einem **DN**((**D**istinguished **N**ame)) und einem eindeutigen Objektnamen bestehen, werden im **DIT**((**D**irectory **I**nformation **T**ree)), erfolgt bei unserem OpenLDAP_Verzeichnisdienmst in einer hierarchischen Baumstruktur. Die Wurzel (root bzw. suffix) ist das oberste Datenobjekt unter dem sich dann die höheren Datenstrukturen verzweigen. 
 +
 +
 +Zur Übernahme bereits bestehender Nutzer aus den beiden Tabellen **/etc/passwd** und **/etc/group** unseres Servers werden wir nun zunächst einen passenden **DIT** anlegen. Hierzu legen wir uns nun eine passende **LDIF**-Datei für unsere verwendete Domäne //**nausch.org**// an, und speichern diese im Verzeichnis //**/etc/openldap/ldif/**//.
 +   # vim /etc/openldap/ldif/cn\=config_DIT_nausch.org.ldif
 +
 +<file ldif /etc/openldap/ldif/cn=config_DIT_nausch.org.ldif># Django : 2015-07-16
 +# Erstellung des Directory Information Tree für die Domäne nausch.org
 +# https://dokuwiki.nausch.org/doku.php/centos:ldap_c7:data?&#dit
 +
 +## Build the root node : nausch.org
 +dn: dc=nausch,dc=org
 +dc: Nausch
 +objectClass: top
 +objectClass: dcObject
 +objectClass: organizationalUnit
 +ou: nausch Dot org
 +
 +## Build the ou People, nausch.org
 +dn: ou=People,dc=nausch,dc=org
 +objectClass: top
 +objectClass: organizationalUnit
 +ou: People
 +
 +## Build the ou Group, nausch.org
 +dn: ou=Group,dc=nausch,dc=org
 +objectClass: top
 +objectClass: organizationalUnit
 +ou: Group
 +</file>
 +
 +Zum Importieren unseres **DITs** verwenden wir nun folgenden Aufruf. Das Passwort nach dem wir hier gefragt werden, haben wir im Kapitel **[[centos:ldap_c7:install#manager-passwort|Manager-Passwort]]** bei der **[[centos:ldap_c7:install|Installation unseres OpenLDAP Server unter CentOS 7.x]]** angelegt.
 +   # ldapadd -W -x -D cn=Manager,dc=nausch,dc=org -f /etc/openldap/ldif/cn\=config_DIT_nausch.org.ldif
 +
 +  Enter LDAP Password: 
 +
 +  adding new entry "dc=nausch,dc=org"
 +  
 +  adding new entry "ou=People,dc=nausch,dc=org"
 +  
 +  adding new entry "ou=Group,dc=nausch,dc=org"
 +  
 +Anschließend überprüfen wir, ob unser **DIT** im OpenLDAP-Verzeichnisdienst richtig angelegt wurde.
 +   # ldapsearch -W -x -D cn=config -b "dc=nausch,dc=org" "(objectclass=*)" -LLL -H ldaps://openldap.dmz.nausch.org
 +
 +  Enter LDAP Password: 
 +<code>dn: dc=nausch,dc=org
 +dc: Nausch
 +objectClass: top
 +objectClass: dcObject
 +objectClass: organizationalUnit
 +ou: nausch Dot org
 +
 +dn: ou=People,dc=nausch,dc=org
 +objectClass: top
 +objectClass: organizationalUnit
 +ou: People
 +
 +dn: ou=Group,dc=nausch,dc=org
 +objectClass: top
 +objectClass: organizationalUnit
 +ou: Group
 +</code>
 +
 +Im Logfile des slapd-Daemon wird unsere erfolgreiche Abfrage entsprechend protokolliert.
 +   # less /var/log/ldap.log
 +
 +<code>Jul 16 22:05:25 vml000037 slapd[14264]: conn=1008 fd=13 ACCEPT from IP=10.0.0.37:50876 (IP=0.0.0.0:636)
 +Jul 16 22:05:26 vml000037 slapd[14264]: conn=1008 fd=13 TLS established tls_ssf=128 ssf=128
 +Jul 16 22:05:26 vml000037 slapd[14264]: conn=1008 op=0 BIND dn="cn=config" method=128
 +Jul 16 22:05:26 vml000037 slapd[14264]: conn=1008 op=0 BIND dn="cn=config" mech=SIMPLE ssf=0
 +Jul 16 22:05:26 vml000037 slapd[14264]: conn=1008 op=0 RESULT tag=97 err=0 text=
 +Jul 16 22:05:26 vml000037 slapd[14264]: conn=1008 op=1 SRCH base="dc=nausch,dc=org" scope=2 deref=0 filter="(objectClass=*)"
 +Jul 16 22:05:26 vml000037 slapd[14264]: conn=1008 op=1 SEARCH RESULT tag=101 err=0 nentries=3 text=
 +Jul 16 22:05:26 vml000037 slapd[14264]: conn=1008 op=2 UNBIND
 +Jul 16 22:05:26 vml000037 slapd[14264]: conn=1008 fd=13 closed</code>
 +
 +
 +===== Benutzermigration mit Hilfe der migrationstools =====
 +In den seltensten Fällen haben wir eine Installation ohne jegliche Benutzer; in der Regel befinden sich auf unserem LINUX-System bereits angelegte Nutzer mit Ihren Konten. Diesen Nutzer wird immer eine UserID (**uid**) ab **1000** zugewiesen. Somit ist eine Unterscheidung zwischen realen Nutzern und technischen Nutzeraccounts relativ leicht möglich.
 +Die hierzu erforderlichen Daten bekommen wir aus den beiden Dateien //**/etc/group**// und //**/etc/passwd**//.
 +
 +==== Installation ====
 +Zur leichteren Übernahme der Nutzerdaten bedienen wir uns der Hilfsprogramme aus dem RPM-Paket **migrationtools** aus dem Base-Repository, welches wir nun zuerst installieren wollen. 
 +   # yum install migrationtools -y
 +
 +Was uns dieses RPM-Paket alles an Hilfsmittel mitbringt zeigt uns ein Blick in das Paket selbst. 
 +   # rpm -qil migrationtools
 +
 +<code>Name        : migrationtools
 +Version     : 47
 +Release     : 15.el7
 +Architecture: noarch
 +Install Date: Thu 16 Jul 2015 10:21:55 PM CEST
 +Group       : System Environment/Daemons
 +Size        : 108216
 +License     : BSD
 +Signature   : RSA/SHA256, Fri 04 Jul 2014 05:47:45 AM CEST, Key ID 24c6a8a7f4a80eb5
 +Source RPM  : migrationtools-47-15.el7.src.rpm
 +Build Date  : Tue 10 Jun 2014 05:32:33 AM CEST
 +Build Host  : worker1.bsys.centos.org
 +Relocations : (not relocatable)
 +Packager    : CentOS BuildSystem <http://bugs.centos.org>
 +Vendor      : CentOS
 +URL         : http://www.padl.com/OSS/MigrationTools.html
 +Summary     : Migration scripts for LDAP
 +Description :
 +The MigrationTools are a set of Perl scripts for migrating users, groups,
 +aliases, hosts, netgroups, networks, protocols, RPCs, and services from
 +existing nameservices (flat files, NIS, and NetInfo) to LDAP.
 +/usr/share/doc/migrationtools-47
 +/usr/share/doc/migrationtools-47/README
 +/usr/share/doc/migrationtools-47/migration-tools.txt
 +/usr/share/migrationtools
 +/usr/share/migrationtools/migrate_aliases.pl
 +/usr/share/migrationtools/migrate_all_netinfo_offline.sh
 +/usr/share/migrationtools/migrate_all_netinfo_online.sh
 +/usr/share/migrationtools/migrate_all_nis_offline.sh
 +/usr/share/migrationtools/migrate_all_nis_online.sh
 +/usr/share/migrationtools/migrate_all_nisplus_offline.sh
 +/usr/share/migrationtools/migrate_all_nisplus_online.sh
 +/usr/share/migrationtools/migrate_all_offline.sh
 +/usr/share/migrationtools/migrate_all_online.sh
 +/usr/share/migrationtools/migrate_automount.pl
 +/usr/share/migrationtools/migrate_base.pl
 +/usr/share/migrationtools/migrate_common.ph
 +/usr/share/migrationtools/migrate_fstab.pl
 +/usr/share/migrationtools/migrate_group.pl
 +/usr/share/migrationtools/migrate_hosts.pl
 +/usr/share/migrationtools/migrate_netgroup.pl
 +/usr/share/migrationtools/migrate_netgroup_byhost.pl
 +/usr/share/migrationtools/migrate_netgroup_byuser.pl
 +/usr/share/migrationtools/migrate_networks.pl
 +/usr/share/migrationtools/migrate_passwd.pl
 +/usr/share/migrationtools/migrate_profile.pl
 +/usr/share/migrationtools/migrate_protocols.pl
 +/usr/share/migrationtools/migrate_rpc.pl
 +/usr/share/migrationtools/migrate_services.pl
 +/usr/share/migrationtools/migrate_slapd_conf.pl</code>
 +
 +==== Konfiguration ====
 +Vor der Migration unserer Daten ist es noch notwendig, das mitgelieferte Hilfsprogramm **migrate_common.ph** unserer Produktivumgebung anzupassen. Hierzu passen wir die beiden folgenden Parameter unserer Organisation an:
 +  * $DEFAULT_MAIL_DOMAIN = "nausch.org";
 +  * $DEFAULT_BASE = "dc=nausch,dc=org";
 +
 +   # vim /usr/share/migrationtools/migrate_common.ph
 +<file perl vim /usr/share/migrationtools/migrate_common.ph>#
 +# $Id: migrate_common.ph,v 1.22 2003/04/15 03:09:33 lukeh Exp $
 +#
 +# Copyright (c) 1997-2003 Luke Howard.
 +# All rights reserved.
 +#
 +# Redistribution and use in source and binary forms, with or without
 +# modification, are permitted provided that the following conditions
 +# are met:
 +# 1. Redistributions of source code must retain the above copyright
 +#    notice, this list of conditions and the following disclaimer.
 +# 2. Redistributions in binary form must reproduce the above copyright
 +#    notice, this list of conditions and the following disclaimer in the
 +#    documentation and/or other materials provided with the distribution.
 +# 3. All advertising materials mentioning features or use of this software
 +#    must display the following acknowledgement:
 +#        This product includes software developed by Luke Howard.
 +# 4. The name of the other may not be used to endorse or promote products
 +#    derived from this software without specific prior written permission.
 +#
 +# THIS SOFTWARE IS PROVIDED BY THE LUKE HOWARD ``AS IS'' AND
 +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 +# ARE DISCLAIMED.  IN NO EVENT SHALL LUKE HOWARD BE LIABLE
 +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 +# SUCH DAMAGE.
 +#
 +
 +#
 +# Common defines for MigrationTools
 +#
 +
 +# Naming contexts. Key is $PROGRAM with migrate_ and .pl 
 +# stripped off. 
 +$NETINFOBRIDGE = (-x "/usr/sbin/mkslapdconf");
 +
 +if ($NETINFOBRIDGE) {
 +        $NAMINGCONTEXT{'aliases'}           = "cn=aliases";
 +        $NAMINGCONTEXT{'fstab'}             = "cn=mounts";
 +        $NAMINGCONTEXT{'passwd'}            = "cn=users";
 +        $NAMINGCONTEXT{'netgroup_byuser'}   = "cn=netgroup.byuser";
 +        $NAMINGCONTEXT{'netgroup_byhost'}   = "cn=netgroup.byhost";
 +        $NAMINGCONTEXT{'group'}             = "cn=groups";
 +        $NAMINGCONTEXT{'netgroup'}          = "cn=netgroup";
 +        $NAMINGCONTEXT{'hosts'}             = "cn=machines";
 +        $NAMINGCONTEXT{'networks'}          = "cn=networks";
 +        $NAMINGCONTEXT{'protocols'}         = "cn=protocols";
 +        $NAMINGCONTEXT{'rpc'}               = "cn=rpcs";
 +        $NAMINGCONTEXT{'services'}          = "cn=services";
 +} else {
 +        $NAMINGCONTEXT{'aliases'}           = "ou=Aliases";
 +        $NAMINGCONTEXT{'fstab'}             = "ou=Mounts";
 +        $NAMINGCONTEXT{'passwd'}            = "ou=People";
 +        $NAMINGCONTEXT{'netgroup_byuser'}   = "nisMapName=netgroup.byuser";
 +        $NAMINGCONTEXT{'netgroup_byhost'}   = "nisMapName=netgroup.byhost";
 +        $NAMINGCONTEXT{'group'}             = "ou=Group";
 +        $NAMINGCONTEXT{'netgroup'}          = "ou=Netgroup";
 +        $NAMINGCONTEXT{'hosts'}             = "ou=Hosts";
 +        $NAMINGCONTEXT{'networks'}          = "ou=Networks";
 +        $NAMINGCONTEXT{'protocols'}         = "ou=Protocols";
 +        $NAMINGCONTEXT{'rpc'}               = "ou=Rpc";
 +        $NAMINGCONTEXT{'services'}          = "ou=Services";
 +}
 +
 +# Default DNS domain
 +# Django : 2015-07-16
 +# default: $DEFAULT_MAIL_DOMAIN = "padl.com";
 +$DEFAULT_MAIL_DOMAIN = "nausch.org";
 +
 +# Default base 
 +# Django : 2015-07-16
 +# default: $DEFAULT_BASE = "dc=padl,dc=com";
 +$DEFAULT_BASE = "dc=nausch,dc=org";
 +
 +# Turn this on for inetLocalMailReceipient
 +# sendmail support; add the following to 
 +# sendmail.mc (thanks to Petr@Kristof.CZ):
 +##### CUT HERE #####
 +#define(`confLDAP_DEFAULT_SPEC',`-h "ldap.padl.com"')dnl
 +#LDAPROUTE_DOMAIN_FILE(`/etc/mail/ldapdomains')dnl
 +#FEATURE(ldap_routing)dnl
 +##### CUT HERE #####
 +# where /etc/mail/ldapdomains contains names of ldap_routed
 +# domains (similiar to MASQUERADE_DOMAIN_FILE).
 +# $DEFAULT_MAIL_HOST = "mail.padl.com";
 +
 +# turn this on to support more general object clases
 +# such as person.
 +$EXTENDED_SCHEMA = 0;
 +
 +#
 +# allow environment variables to override predefines
 +#
 +if (defined($ENV{'LDAP_BASEDN'})) {
 +        $DEFAULT_BASE = $ENV{'LDAP_BASEDN'};
 +}
 +
 +if (defined($ENV{'LDAP_DEFAULT_MAIL_DOMAIN'})) {
 +        $DEFAULT_MAIL_DOMAIN = $ENV{'LDAP_DEFAULT_MAIL_DOMAIN'};
 +}
 +
 +if (defined($ENV{'LDAP_DEFAULT_MAIL_HOST'})) {
 +        $DEFAULT_MAIL_HOST = $ENV{'LDAP_DEFAULT_MAIL_HOST'};
 +}
 +
 +# binddn used for alias owner (otherwise uid=root,...)
 +if (defined($ENV{'LDAP_BINDDN'})) {
 +        $DEFAULT_OWNER = $ENV{'LDAP_BINDDN'};
 +}
 +
 +if (defined($ENV{'LDAP_EXTENDED_SCHEMA'})) {
 +        $EXTENDED_SCHEMA = $ENV{'LDAP_EXTENDED_SCHEMA'};
 +}
 +
 +# If we haven't set the default base, guess it automagically.
 +if (!defined($DEFAULT_BASE)) {
 +        $DEFAULT_BASE = &domain_expand($DEFAULT_MAIL_DOMAIN);
 +        $DEFAULT_BASE =~ s/,$//o;
 +}
 +
 +# Default Kerberos realm
 +#if ($EXTENDED_SCHEMA) {
 +#       $DEFAULT_REALM = $DEFAULT_MAIL_DOMAIN;
 +#       $DEFAULT_REALM =~ tr/a-z/A-Z/;
 +#}
 +
 +if (-x "/usr/sbin/revnetgroup") {
 +        $REVNETGROUP = "/usr/sbin/revnetgroup";
 +} elsif (-x "/usr/lib/yp/revnetgroup") {
 +        $REVNETGROUP = "/usr/lib/yp/revnetgroup";
 +}
 +
 +$classmap{'o'} = 'organization';
 +$classmap{'dc'} = 'domain';
 +$classmap{'l'} = 'locality';
 +$classmap{'ou'} = 'organizationalUnit';
 +$classmap{'c'} = 'country';
 +$classmap{'nismapname'} = 'nisMap';
 +$classmap{'cn'} = 'container';
 +
 +sub parse_args
 +{
 +        if ($#ARGV < 0) {
 +                print STDERR "Usage: $PROGRAM infile [outfile]\n";
 +                exit 1;
 +        }
 +
 +        $INFILE = $ARGV[0];
 +
 +        if ($#ARGV > 0) {
 +                $OUTFILE = $ARGV[1];
 +        }
 +}
 +
 +sub open_files
 +{
 +        open(INFILE);
 +        if ($OUTFILE) {
 +                open(OUTFILE,">$OUTFILE");
 +                $use_stdout = 0;
 +        } else {
 +                $use_stdout = 1;
 +        }
 +}
 +
 +# moved from migrate_hosts.pl
 +# lukeh 10/30/97
 +sub domain_expand
 +{
 +        local($first) = 1;
 +        local($dn);
 +        local(@namecomponents) = split(/\./, $_[0]);
 +        foreach $_ (@namecomponents) {
 +                $first = 0;
 +                $dn .= "dc=$_,";
 +        }
 +        $dn .= $DEFAULT_BASE;
 +        return $dn;
 +}
 +
 +# case insensitive unique
 +sub uniq
 +{
 +        local($name) = shift(@_);
 +        local(@vec) = sort {uc($a) cmp uc($b)} @_;
 +        local(@ret);
 +        local($next, $last);
 +        foreach $next (@vec) {
 +                if ((uc($next) ne uc($last)) &&
 +                        (uc($next) ne uc($name))) {
 +                        push (@ret, $next);
 +                }
 +                $last = $next;
 +        }
 +        return @ret;
 +}
 +
 +# concatenate naming context and 
 +# organizational base
 +sub getsuffix
 +{
 +        local($program) = shift(@_);
 +        local($nc);
 +        $program =~ s/^migrate_(.*)\.pl$/$1/;
 +        $nc = $NAMINGCONTEXT{$program};
 +        if ($nc eq "") {
 +                return $DEFAULT_BASE;
 +        } else {
 +                return $nc . ',' . $DEFAULT_BASE;
 +        }
 +}
 +
 +sub ldif_entry
 +{
 +# remove leading, trailing whitespace
 +        local ($HANDLE, $lhs, $rhs) = @_;
 +        local ($type, $val) = split(/\=/, $lhs);
 +        local ($dn);
 +
 +        if ($rhs ne "") {
 +                $dn = $lhs . ',' . $rhs;
 +        } else {
 +                $dn = $lhs;
 +        }
 +
 +        $type =~ s/\s*$//o;
 +        $type =~ s/^\s*//o;
 +        $type =~ tr/A-Z/a-z/;
 +        $val =~ s/\s*$//o;
 +        $val =~ s/^\s*//o;
 +
 +        print $HANDLE "dn: $dn\n";
 +        print $HANDLE "$type: $val\n";
 +        print $HANDLE "objectClass: top\n";
 +        print $HANDLE "objectClass: $classmap{$type}\n";
 +        if ($EXTENDED_SCHEMA) {
 +                if ($DEFAULT_MAIL_DOMAIN) {
 +                        print $HANDLE "objectClass: domainRelatedObject\n";
 +                        print $HANDLE "associatedDomain: $DEFAULT_MAIL_DOMAIN\n";
 +                }
 +        }
 +
 +        print $HANDLE "\n";
 +}
 +
 +# Added Thu Jun 20 16:40:28 CDT 2002 by Bob Apthorpe
 +# <apthorpe@cynistar.net> to solve problems with embedded plusses in
 +# protocols and mail aliases.
 +sub escape_metacharacters
 +{
 +        local($name) = @_;
 +
 +        # From Table 3.1 "Characters Requiring Quoting When Contained
 +        # in Distinguished Names", p87 "Understanding and Deploying LDAP
 +        # Directory Services", Howes, Smith, & Good.
 +
 +        # 1) Quote backslash
 +        # Note: none of these are very elegant or robust and may cause
 +        # more trouble than they're worth. That's why they're disabled.
 +        # 1.a) naive (escape all backslashes)
 +        # $name =~ s#\\#\\\\#og;
 +        #
 +        # 1.b) mostly naive (escape all backslashes not followed by
 +        # a backslash)
 +        # $name =~ s#\\(?!\\)#\\\\#og;
 +        #
 +        # 1.c) less naive and utterly gruesome (replace solitary
 +        # backslashes)
 +        # $name =~ s{           # Replace
 +        #               (?<!\\) # negative lookbehind (no preceding backslash)
 +        #               \\      # a single backslash
 +        #               (?!\\)  # negative lookahead (no following backslash)
 +        #       }
 +        #       {               # With
 +        #               \\\\    # a pair of backslashes
 +        #       }gx;
 +        # Ugh. Note that s#(?:[^\\])\\(?:[^\\])#////#g fails if $name
 +        # starts or ends with a backslash. This expression won't work
 +        # under perl4 because the /x flag and negative lookahead and
 +        # lookbehind operations aren't supported. Sorry. Also note that
 +        # s#(?:[^\\]*)\\(?:[^\\]*)#////#g won't work either.  Of course,
 +        # this is all broken if $name is already escaped before we get
 +        # to it. Best to throw a warning and make the user import these
 +        # records by hand.
 +
 +        # 2) Quote leading and trailing spaces
 +        local($leader, $body, $trailer) = ();
 +        if (($leader, $body, $trailer) = ($name =~ m#^( *)(.*\S)( *)$#o)) {
 +                $leader =~ s# #\\ #og;
 +                $trailer =~ s# #\\ #og;
 +                $name = $leader . $body . $trailer;
 +        }
 +
 +        # 3) Quote leading octothorpe (#)
 +        $name =~ s/^#/\\#/o;
 +
 +        # 4) Quote comma, plus, double-quote, less-than, greater-than,
 +        # and semicolon
 +        $name =~ s#([,+"<>;])#\\$1#g;
 +
 +        return $name;
 +}
 +
 +1;
 +
 +</file>
 +
 +=== Datenselektion ===
 +Da wir nicht alle Nutzer, sondern nur die realen Benutzer in den DIT übernehmen wollen, extrahieren wir alle Nutzer aus der //**/etc/group**// und //**/etc/passwd**// deren **UID** größer oder gleich **1000** ist und legen diesen in zwei eigenen Dateien ab.
 +   # grep ":1[0-9][0-9][0-9]" /etc/group > /etc/openldap/ldif/group
 +
 +Es wird folgende Datei erstellt.
 +   # cat /etc/openldap/ldif/group
 +
 +  django:x:1000:django
 +  michael:x:1001:michael
 +  inge:x:1002:inge
 +  rebekka:x:1003:rebekka
 +  jakob:x:1004:jakob
 +  ruben:x:1005:ruben
 +  leah:x:1006:leah
 +  markus:x:1007:markus
 +  gertraud:x:1008:gertraud
 +  johann:x:1009:johann
 +
 +   # grep ":1[0-9][0-9][0-9]" /etc/passwd > /etc/openldap/ldif/passwd
 +
 +Es wird folgende Datei erstellt.
 +   # cat /etc/openldap/ldif/passwd 
 +
 +  django:x:1000:1000:django:/home/django:/bin/bash
 +  michael:x:1001:1001:michael:/home/michael:/bin/bash
 +  inge:x:1002:1002:inge:/home/inge:/bin/bash
 +  rebekka:x:1003:1003:rebekka:/home/rebekka:/bin/bash
 +  jakob:x:1004:1004:jakob:/home/jakob:/bin/bash
 +  ruben:x:1005:1005:ruben:/home/ruben:/bin/bash
 +  leah:x:1006:1006:leah:/home/leah:/bin/bash
 +  markus:x:1007:1007:markus:/home/markus:/bin/bash
 +  gertraud:x:1008:1008:gertraud:/home/gertraud:/bin/bash
 +  johann:x:1009:1009:johann:/home/johann:/bin/bash
 +
 +=== Datenmigration ===
 +Nun ist es an der Zeit unsere Nutzerdaten aus den zuvor angelegten temporären Dateien in entsprechende .ldif Dateien zu konvertieren. Hierzu nutzen wir die Hilfsprogramme aus dem zuvor installiertem RPM Paket **migrationtools**:
 +  * **migrate_passwd.pl**
 +  * **migrate_group.pl**
 +
 +Wir erstellen also nun die beiden .ldif-Dateien.
 +   # /usr/share/migrationtools/migrate_group.pl /etc/openldap/ldif/group > cn\=config_GroupDN.ldif
 +
 +   # /usr/share/migrationtools/migrate_passwd.pl /etc/openldap/ldif/passwd > cn\=config_PeopleDN.ldif
 +
 +Aus der Datei //**/etc/openldap/ldif/group**// mit dem Inhalt <code>django:x:1000:django
 +michael:x:1001:michael
 +inge:x:1002:inge
 +rebekka:x:1003:rebekka
 +jakob:x:1004:jakob
 +ruben:x:1005:ruben
 +leah:x:1006:leah
 +markus:x:1007:markus
 +gertraud:x:1008:gertraud
 +johann:x:1009:johann</code> wurde also die Datei //**/etc/openldap/ldif/cn\=config_GroupDN.ldif**// mit dem Inhalt <code>dn: cn=django,ou=Group,dc=nausch,dc=org
 +objectClass: posixGroup
 +objectClass: top
 +cn: django
 +userPassword: {crypt}x
 +gidNumber: 1000
 +memberUid: 1000
 +
 +dn: cn=michael,ou=Group,dc=nausch,dc=org
 +objectClass: posixGroup
 +objectClass: top
 +cn: michael
 +userPassword: {crypt}x
 +gidNumber: 1001
 +memberUid: 1001
 +
 +dn: cn=inge,ou=Group,dc=nausch,dc=org
 +objectClass: posixGroup
 +objectClass: top
 +cn: inge
 +userPassword: {crypt}x
 +gidNumber: 1002
 +memberUid: 1002
 +
 +dn: cn=rebekka,ou=Group,dc=nausch,dc=org
 +objectClass: posixGroup
 +objectClass: top
 +cn: rebekka
 +userPassword: {crypt}x
 +gidNumber: 1003
 +memberUid: 1003
 +
 +dn: cn=jakob,ou=Group,dc=nausch,dc=org
 +objectClass: posixGroup
 +objectClass: top
 +cn: jakob
 +userPassword: {crypt}x
 +gidNumber: 1004
 +memberUid: 1004
 +
 +dn: cn=ruben,ou=Group,dc=nausch,dc=org
 +objectClass: posixGroup
 +objectClass: top
 +cn: ruben
 +userPassword: {crypt}x
 +gidNumber: 1005
 +memberUid: 1005
 +
 +dn: cn=leah,ou=Group,dc=nausch,dc=org
 +objectClass: posixGroup
 +objectClass: top
 +cn: leah
 +userPassword: {crypt}x
 +gidNumber: 1006
 +memberUid: 1006
 +
 +dn: cn=markus,ou=Group,dc=nausch,dc=org
 +objectClass: posixGroup
 +objectClass: top
 +cn: markus
 +userPassword: {crypt}x
 +gidNumber: 1007
 +memberUid: 1007
 +
 +dn: cn=gertraud,ou=Group,dc=nausch,dc=org
 +objectClass: posixGroup
 +objectClass: top
 +cn: gertraud
 +userPassword: {crypt}x
 +gidNumber: 1008
 +memberUid: 1008
 +
 +dn: cn=johann,ou=Group,dc=nausch,dc=org
 +objectClass: posixGroup
 +objectClass: top
 +cn: johann
 +userPassword: {crypt}x
 +gidNumber: 1009
 +memberUid: 1009</code>  generiert.
 +
 +Aus der Datei //**/etc/openldap/ldif/passwd**// mit dem Inhalt <code>django:x:1000:1000:django:/home/django:/bin/bash
 +michael:x:1001:1001:michael:/home/michael:/bin/bash
 +inge:x:1002:1002:inge:/home/inge:/bin/bash
 +rebekka:x:1003:1003:rebekka:/home/rebekka:/bin/bash
 +jakob:x:1004:1004:jakob:/home/jakob:/bin/bash
 +ruben:x:1005:1005:ruben:/home/ruben:/bin/bash
 +leah:x:1006:1006:leah:/home/leah:/bin/bash
 +markus:x:1007:1007:markus:/home/markus:/bin/bash
 +gertraud:x:1008:1008:gertraud:/home/gertraud:/bin/bash
 +johann:x:1009:1009:johann:/home/johann:/bin/bash</code> wurde also die Datei //**/etc/openldap/ldif/cn\=config_PeopleDN.ldif**// mit dem Inhalt <code>dn: uid=django,ou=People,dc=nausch,dc=org
 +uid: django
 +cn: django
 +objectClass: account
 +objectClass: posixAccount
 +objectClass: top
 +objectClass: shadowAccount
 +userPassword: {crypt}$6$34os/lDDY2cAEfyW$fqe3PP3Qo5FDAtC724a7plCieqgeYCWONkaKgYnQKm5iDx/3WtCq8Tv0VA2MLkYAhW9/IySlhFIJZIU0UyiOv/
 +shadowLastChange: 16617
 +shadowMin: 0
 +shadowMax: 99999
 +shadowWarning: 7
 +loginShell: /bin/bash
 +uidNumber: 1000
 +gidNumber: 1000
 +homeDirectory: /home/django
 +gecos: django
 +
 +dn: uid=michael,ou=People,dc=nausch,dc=org
 +uid: michael
 +cn: michael
 +objectClass: account
 +objectClass: posixAccount
 +objectClass: top
 +userPassword: {crypt}$6$34os/lDDY2cAEfyW$fqe3PP3Qo5FDAtC724a7plCieqgeYCWONkaKgYnQKm5iDx/3WtCq8Tv0VA2MLkYAhW9
 +loginShell: /bin/bash
 +uidNumber: 1001
 +gidNumber: 1001
 +homeDirectory: /home/michael
 +gecos: michael
 +
 +dn: uid=inge,ou=People,dc=nausch,dc=org
 +uid: inge
 +cn: inge
 +objectClass: account
 +objectClass: posixAccount
 +objectClass: top
 +userPassword: {crypt}$6$34os/lDf98723jyX$fqe24a7plCDY2cAEfyW5FDAtwdfC$f3PP3gYnosHSenpncs5FDAtC724a7Tv0VA2MLk
 +loginShell: /bin/bash
 +uidNumber: 1002
 +gidNumber: 1002
 +homeDirectory: /home/inge
 +gecos: inge
 +
 +dn: uid=rebekka,ou=People,dc=nausch,dc=org
 +uid: rebekka
 +cn: rebekka
 +objectClass: account
 +objectClass: posixAccount
 +objectClass: top
 +userPassword: {crypt}$6$34os/lDDY2cAEfy$Afqe3PP3Qo5FDAtC7o5FDAtC724a7po5FDAtC7lCieo5FDAtC7qgeYCWONkaKgYnQKm5
 +loginShell: /bin/bash
 +uidNumber: 1003
 +gidNumber: 1003
 +homeDirectory: /home/rebekka
 +gecos: rebekka
 +
 +dn: uid=jakob,ou=People,dc=nausch,dc=org
 +uid: jakob
 +cn: jakob
 +objectClass: account
 +objectClass: posixAccount
 +objectClass: top
 +userPassword: {crypt}$6$34os/lCDY5cmEffqe3PP3QfyW$fqe2cAEfy$Afqe3PP3Q4a7plCDtC724a7Y2cAEfyW5FDAtCtC724a7$f3P
 +loginShell: /bin/bash
 +uidNumber: 1004
 +gidNumber: 1004
 +homeDirectory: /home/jakob
 +gecos: jakob
 +
 +dn: uid=ruben,ou=People,dc=nausch,dc=org
 +uid: ruben
 +cn: ruben
 +objectClass: account
 +objectClass: posixAccount
 +objectClass: top
 +userPassword: {crypt}$6$34os/o5FDAtC724a7plCieqlDDY2cAEfyW$plCieqlfqe3PP3Qo5FDAtYCWOC72C724a7pYnQKm5ilCieqge
 +loginShell: /bin/bash
 +uidNumber: 1005
 +gidNumber: 1005
 +homeDirectory: /home/ruben
 +gecos: ruben
 +
 +dn: uid=leah,ou=People,dc=nausch,dc=org
 +uid: leah
 +cn: leah
 +objectClass: account
 +objectClass: posixAccount
 +objectClass: top
 +userPassword: {crypt}$6$34os/e3PP3Qo5FDAtC724a7plfy$Afqe3PCieqgeYCWOC724a7po5FDAtNkaKgYnQKm5iDx/3WtCMLkYAhW9
 +loginShell: /bin/bash
 +uidNumber: 1006
 +gidNumber: 1006
 +homeDirectory: /home/leah
 +gecos: leah
 +
 +dn: uid=markus,ou=People,dc=nausch,dc=org
 +uid: markus
 +cn: markus
 +objectClass: account
 +objectClass: posixAccount
 +objectClass: top
 +userPassword: {crypt}$6$34os/AEfy$AfqelDfyW$fqe24a7plCDY2cApllDDEfyW5FDAtC$lCieqgeEfyWw140867f3PP3gYno5FDA3P
 +loginShell: /bin/bash
 +uidNumber: 1007
 +gidNumber: 1007
 +homeDirectory: /home/markus
 +gecos: markus
 +
 +dn: uid=gertraud,ou=People,dc=nausch,dc=org
 +uid: gertraud
 +cn: gertraud
 +objectClass: account
 +objectClass: posixAccount
 +objectClass: top
 +userPassword: {crypt}$6$34os/3PP3Qo5FDAtC724a7pllDDY2cAEfyW$fqe3PP3Qo5FDAta7pllDDYC724a7plCieqgeEfyWw140867d
 +loginShell: /bin/bash
 +uidNumber: 1008
 +gidNumber: 1008
 +homeDirectory: /home/gertraud
 +gecos: gertraud
 +
 +dn: uid=johann,ou=People,dc=nausch,dc=org
 +uid: johann
 +cn: johann
 +objectClass: account
 +objectClass: posixAccount
 +objectClass: top
 +userPassword: {crypt}$6$34os/a7plCDY2cAEfyW5FlDfyW$fqe24fyW5Fa7plCDY2cAEfyW5FDAtC$f3fyW5FPP3gYno5FDAtC724a7p
 +loginShell: /bin/bash
 +uidNumber: 1009
 +gidNumber: 1009
 +homeDirectory: /home/johann
 +gecos: johann
 +</code>  generiert.
 +
 +=== Datenübernahme in den DIT ===
 +Nachdem wir die Nutzerdaten aus dem/einem System migriert haben, werden wir nun mit dem Befehl **ldapadd** die gerade generierten LDIF-Dateien in den DIT importieren.
 +
 +Als erstes importieren wir den **DN**((**D**istinguished **N**ame)) Group.
 +   # ldapadd -W -x -D cn=Manager,dc=nausch,dc=org -f /etc/openldap/ldif/cn\=config_GroupDN.ldif 
 +
 +  Enter LDAP Password: 
 +<code>adding new entry "cn=django,ou=Group,dc=nausch,dc=org"
 +
 +adding new entry "cn=michael,ou=Group,dc=nausch,dc=org"
 +
 +adding new entry "cn=inge,ou=Group,dc=nausch,dc=org"
 +
 +adding new entry "cn=rebekka,ou=Group,dc=nausch,dc=org"
 +
 +adding new entry "cn=jakob,ou=Group,dc=nausch,dc=org"
 +
 +adding new entry "cn=ruben,ou=Group,dc=nausch,dc=org"
 +
 +adding new entry "cn=leah,ou=Group,dc=nausch,dc=org"
 +
 +adding new entry "cn=markus,ou=Group,dc=nausch,dc=org"
 +
 +adding new entry "cn=gertraud,ou=Group,dc=nausch,dc=org"
 +
 +adding new entry "cn=johann,ou=Group,dc=nausch,dc=org"
 + 
 +</code>
 +
 +Anschließend importieren wir den **DN** People.
 +   # ldapadd -W -x -D cn=Manager,dc=nausch,dc=org -f /etc/openldap/ldif/cn\=config_PeopleDN.ldif 
 +
 +  Enter LDAP Password: 
 +<code>adding new entry "uid=django,ou=People,dc=nausch,dc=org"
 +
 +adding new entry "uid=michael,ou=People,dc=nausch,dc=org"
 +
 +adding new entry "uid=inge,ou=People,dc=nausch,dc=org"
 +
 +adding new entry "uid=rebekka,ou=People,dc=nausch,dc=org"
 +
 +adding new entry "uid=jakob,ou=People,dc=nausch,dc=org"
 +
 +adding new entry "uid=ruben,ou=People,dc=nausch,dc=org"
 +
 +adding new entry "uid=leah,ou=People,dc=nausch,dc=org"
 +
 +adding new entry "uid=markus,ou=People,dc=nausch,dc=org"
 +
 +adding new entry "uid=gertraud,ou=People,dc=nausch,dc=org"
 +
 +adding new entry "uid=johann,ou=People,dc=nausch,dc=org"
 + 
 +</code>
 +
 +==== abschließender Test ====
 +Für den abschliessenden Test, ob die Datenmigration aus den filebasierenden Dateien in den DIT unseres OpenLADP-Servers geklappt hat, befragen wir unseren LDAP-Server nach den Daten zum **User** //**django**//. 
 +   # ldapsearch -W -x -D cn=config -b "uid=django,ou=People,dc=nausch,dc=org" -LLL -H ldaps://openldap.dmz.nausch.org
 +
 +  Enter LDAP Password: 
 +<code>dn: uid=django,ou=People,dc=nausch,dc=org
 +uid: django
 +cn: django
 +objectClass: account
 +objectClass: posixAccount
 +objectClass: top
 +objectClass: shadowAccount
 +userPassword:: e2NyeXB1lu0fSQ2JDM0b3MvbERE8zVWTJjQUVmeVckZnFlM1BQM1FXRDNzI0YTd
 + wbEuUUttNpZXFnZVlDV09Oa2FLZ1luUUttNWlEeC8zV3RDcThUdjBWQTJNTGtZM0b3QWhXOS9e2pJ
 + VTWlEeC8di8=
 +shadowLastChange: 16617
 +shadowMin: 0
 +shadowMax: 99999
 +shadowWarning: 7
 +loginShell: /bin/bash
 +uidNumber: 1000
 +gidNumber: 1000
 +homeDirectory: /home/django
 +gecos: django</code>
 +
 +Unsere erfolgreiche Abfrage erzeugt einen entsprechendnen Eintrag im Logfile des slapd-Daemon. 
 +   # less /var/log/ldap.log
 +
 +<code>Jul 16 23:26:21 vml000037 slapd[14264]: conn=1020 fd=13 ACCEPT from IP=10.0.0.37:52275 (IP=0.0.0.0:636)
 +Jul 16 23:26:21 vml000037 slapd[14264]: conn=1020 fd=13 TLS established tls_ssf=128 ssf=128
 +Jul 16 23:26:21 vml000037 slapd[14264]: conn=1020 op=0 BIND dn="cn=config" method=128
 +Jul 16 23:26:21 vml000037 slapd[14264]: conn=1020 op=0 BIND dn="cn=config" mech=SIMPLE ssf=0
 +Jul 16 23:26:21 vml000037 slapd[14264]: conn=1020 op=0 RESULT tag=97 err=0 text=
 +Jul 16 23:26:21 vml000037 slapd[14264]: conn=1020 op=1 SRCH base="uid=django,ou=People,dc=nausch,dc=org" scope=2 deref=0 filter="(objectClass=*)"
 +Jul 16 23:26:21 vml000037 slapd[14264]: conn=1020 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
 +Jul 16 23:26:21 vml000037 slapd[14264]: conn=1020 op=2 UNBIND
 +Jul 16 23:26:21 vml000037 slapd[14264]: conn=1020 fd=13 closed
 +</code>
 +
 +Zu guter letzt befragen wir nun noch unseren LDAP-Server nach den Daten der **Gruppe** //**django**//. 
 +   # ldapsearch -x -b "cn=django,ou=Group,dc=nausch,dc=org" "(objectclass=*)"
 +
 +<code># extended LDIF
 +#
 +# LDAPv3
 +# base <cn=django,ou=Group,dc=nausch,dc=org> with scope subtree
 +# filter: (objectclass=*)
 +# requesting: ALL
 +#
 +
 +# django, Group, nausch.org
 +dn: cn=django,ou=Group,dc=nausch,dc=org
 +objectClass: posixGroup
 +objectClass: top
 +cn: django
 +userPassword:: e2NyeXB0fXg=
 +gidNumber: 1000
 +memberUid: 1000
 +
 +# search result
 +search: 2
 +result: 0 Success
 +
 +# numResponses: 2
 +# numEntries: 1</code>
 +
 +Natürlich wurde auch hier unsere Abfrage im LDAP-Log dokumentiert.
 +   # less /var/log/ldap.log
 +
 +<code>Jul 16 23:40:26 vml000037 slapd[14264]: conn=1038 fd=13 ACCEPT from IP=[::1]:44084 (IP=[::]:389)
 +Jul 16 23:40:26 vml000037 slapd[14264]: conn=1038 op=0 BIND dn="" method=128
 +Jul 16 23:40:26 vml000037 slapd[14264]: conn=1038 op=0 RESULT tag=97 err=0 text=
 +Jul 16 23:40:26 vml000037 slapd[14264]: conn=1038 op=1 SRCH base="cn=django,ou=Group,dc=nausch,dc=org" scope=2 deref=0 filter="(objectClass=*)"
 +Jul 16 23:40:26 vml000037 slapd[14264]: conn=1038 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
 +Jul 16 23:40:26 vml000037 slapd[14264]: conn=1038 op=2 UNBIND
 +Jul 16 23:40:26 vml000037 slapd[14264]: conn=1038 fd=13 closed</code>
 +
 +===== DIT Indizes =====
 +==== Abfrage der Indizes ====
 +Wollen wir später einzelne Index Felder im **DIT** anpassen, müssen wir natürlich wissen wie die derzeitigen Felder indiziert wurden. Hierzu lassen wir uns die existierende Indizierung der Felder anzeigen.
 +
 +Hierzu nutzen wir nun folgenden Befehlsaufruf.
 +   #  ldapsearch -W -x -D cn=config -b olcDatabase={2}hdb,cn=config
 +
 +  Enter LDAP Password:
 +<code># extended LDIF
 +#
 +# LDAPv3
 +# base <olcDatabase={2}hdb,cn=config> with scope subtree
 +# filter: (objectclass=*)
 +# requesting: ALL
 +#
 +
 +# {2}hdb, config
 +dn: olcDatabase={2}hdb,cn=config
 +objectClass: olcDatabaseConfig
 +objectClass: olcHdbConfig
 +olcDatabase: {2}hdb
 +olcDbDirectory: /var/lib/ldap
 +olcSuffix: dc=nausch,dc=org
 +olcRootDN: cn=Manager,dc=nausch,dc=org
 +olcRootPW: {SSHA}lfeku/uaD4x1i$7n3931Le54U111
 +olcDbIndex: objectClass eq,pres
 +olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
 +
 +# search result
 +search: 2
 +result: 0 Success
 +
 +# numResponses: 2
 +# numEntries: 1</code>
 +
 +Für die Felder **objectClass** und **ou,cn,mail,surname,givenname** besteht bereits ein Index. Folgende beiden Zeilen sind aus der obigen Ausgabe:
 +
 +  * **olcDbIndex: objectClass eq,pres**
 +  * **olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub**
 +
 +Dies entspricht nachfolgender Tabelle.
 +^ **Felder**       ^  **Attribute**                                        ||^ **Beschreibungen**                     ^
 +| :::              ^  //**eq**//     ^ \\ //**pres**//  ^ \\ \\ //**sub**//  ^ gleich \\ Anzeige \\ Teilzeichenkette  ^
 +| **objectClass**  |  :OK:           |  :OK:            |                    |                                        |
 +| **ou**           |  :OK:           |  :OK:            |  :OK:              | :::                                    |
 +| **cn**           |  :OK:           |  :OK:            |  :OK:              | :::                                    |
 +| **mail**         |  :OK:           |  :OK:            |  :OK:              | :::                                    |
 +| **surname**      |  :OK:           |  :OK:            |  :OK:              | :::                                    |
 +| **givenname**    |  :OK:           |  :OK:            |  :OK:              | :::                                    |
 +
 +
 +
 +
 +
 +Erfolgt ein Zugriff auf ein Fled im OpenLDAP-Verzeichnisbaum bei dem kein Index definiert wurde, wird dazu im LDAP-Log //**/var/log/ldap-log**// nachfolgender Hinweis zu finden sein.
 +   Jul 17 12:32:53 vml000037 slapd[14264]: <= bdb_equality_candidates: (uid) not indexed
 +
 +==== Setzen der Indizes (LDIF) ====
 +Für die Felder in der folgenden Tabelle wollen wir nun noch Indizes erstellen.
 +
 +^ **Felder**                          ^  **Attribute**                                        ||^ **Beschreibungen**                     ^
 +| :::                                 ^  //**eq**//     ^ \\ //**pres**//  ^ \\ \\ //**sub**//  ^ gleich \\ Anzeige \\ Teilzeichenkette  ^
 +| **uidNumber**                       |  :OK:           |  :OK:            |                    | :::                                       |
 +| **gidNumber**                       |  :OK:           |  :OK:            |                    |  :::                                      |
 +| **loginShell**                      |  :OK:           |  :OK:            |                    | :::                                       |
 +| **uid**                             |  :OK:           |  :OK:            |  :OK:              | :::                                    |
 +| **memberUid**                       |  :OK:           |  :OK:            |  :OK:              | :::                                    |
 +| **nisMapName**                      |  :OK:           |  :OK:            |  :OK:              | :::                                    |
 +| **nisMapEntry**                     |  :OK:           |  :OK:            |  :OK:              | :::                                    |
 +| **uniqueMember**                    |  :OK:           |  :OK:            |                    | :::                                    |
 +
 +Zu dieser Tabelle erstellen wir uns nun eine passende LDIF-Datei.
 +   # vim /etc/openldap/ldif/cn=\config_DbIndex.ldif
 +
 +<file ldif /etc/openldap/ldif/cn=config_DbIndex.ldif># Django : 2015-07-17
 +# Erstellen von zusätzlichen Indizes für Felder im DIT
 +# https://dokuwiki.nausch.org/doku.php/centos:ldap_c7:data?&#setzen_der_indizes_ldif
 +
 +dn: olcDatabase={2}hdb,cn=config
 +changetype: modify
 +add: olcDbIndex
 +olcDbIndex: uidNumber,gidNumber,loginShell eq,pres
 +olcDbIndex: uid,memberUid eq,pres,sub
 +olcDbIndex: nisMapName,nisMapEntry eq,pres,sub
 +olcDbIndex: uniqueMember eq,pres
 +</file>
 +
 +Anschließend importieren wir diese Daten in unseren **DIT**.
 +   # ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/openldap/ldif/cn=\config_DbIndex.ldif
 +
 +  SASL/EXTERNAL authentication started
 +  SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
 +  SASL SSF: 0
 +  modifying entry "olcDatabase={2}hdb,cn=config"
 +
 +
 +==== Überprüfen der gesetzten Indizes ====
 +Zu guter letzt lassen wir uns erneut anzeigen für welche Felder im **DIT** Indizies gesetzt sind. Dazu verwenden wir folgenden Befehl.
 +   #  ldapsearch -W -x -D cn=config -b olcDatabase={2}hdb,cn=config
 +
 +  Enter LDAP Password:
 +<code># extended LDIF
 +#
 +# LDAPv3
 +# base <olcDatabase={2}hdb,cn=config> with scope subtree
 +# filter: (objectclass=*)
 +# requesting: ALL
 +#
 +
 +# {2}hdb, config
 +dn: olcDatabase={2}hdb,cn=config
 +objectClass: olcDatabaseConfig
 +objectClass: olcHdbConfig
 +olcDatabase: {2}hdb
 +olcDbDirectory: /var/lib/ldap
 +olcSuffix: dc=nausch,dc=org
 +olcRootDN: cn=Manager,dc=nausch,dc=org
 +olcRootPW: {SSHA}lfeku/uaD4x1i$7n3931Le54U111
 +olcDbIndex: objectClass eq,pres
 +olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub
 +olcDbIndex: uidNumber,gidNumber,loginShell eq,pres
 +olcDbIndex: uid,memberUid eq,pres,sub
 +olcDbIndex: nisMapName,nisMapEntry eq,pres,sub
 +olcDbIndex: uniqueMember eq,pres
 +
 +# search result
 +search: 2
 +result: 0 Success
 +
 +# numResponses: 2
 +# numEntries: 1</code>
  
-==== foo baa ==== +====== Links ====== 
-FIXME+  * **⇐ [[centos:ldap_c7:ldaps|Zurück zum Kapitel "TLS-Absicherung des OpenLDAP-Servers - LDAPs-Konfiguration unter CentOS 7.x"]]** 
 +  * **⇒ [[centos:ldap_c7:tecbind|Weiter zum Kapitel "Authentification mit technischem User beim OpenLDAP Servers unter CentOS 7.x"]]** 
 +  * **[[centos:ldap_c7:start|Zurück zum Kapitel >>OpenLDAP Server unter CentOS 7.x<<]]** 
 +  * **[[wiki:start|Zurück zu >>Projekte und Themenkapitel<<]]** 
 +  * **[[http://dokuwiki.nausch.org/doku.php/|Zurück zur Startseite]]**
  
  
  • centos/ldap_c7/data.1437061121.txt.gz
  • Zuletzt geändert: 16.07.2015 15:38.
  • von django