Zentrale Benutzerverwaltung mit OpenLDAP und SSS: Unterschied zwischen den Versionen

Aus Xinux Wiki
Zur Navigation springen Zur Suche springen
 
(48 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt)
Zeile 2: Zeile 2:
 
;passwort nach wahl festlegen
 
;passwort nach wahl festlegen
 
* apt update
 
* apt update
−
* apt install slapd ldap-utils
+
* DEBIAN_FRONTEND=noninteractive apt install -y slapd ldap-utils
−
 
 
−
;slapd: OpenLDAP Standalone Server
 
−
;ldap-utils: Utilities zum Zugriff auf den LDAP Server
 
  
 
= Grundkonfiguration =
 
= Grundkonfiguration =
−
*dpkg-reconfigure slapd
+
* dpkg-reconfigure slapd
−
 
 
−
Die folgende Tabelle führt die exakten englischen Abfragen auf, sowie die empfohlenen Eingaben für die it213.int Umgebung.
 
  
 
{| class="wikitable"
 
{| class="wikitable"
−
! Debconf Question !! Description !! Recommended Input / Choice
+
! Debconf Question !! Recommended Input
−
|-
 
−
| '''Omit OpenLDAP server configuration?''' || Determines if the installer should skip creating a database. || '''No'''
 
 
|-
 
|-
−
| '''DNS domain name:''' || Used to construct the base DN of the LDAP directory. || '''it213.int'''
+
| Omit OpenLDAP server configuration? || No
 
|-
 
|-
−
| '''Organization name:''' || The name of the organization to use in the base DN. || '''it213'''
+
| DNS domain name: || it213.int
 
|-
 
|-
−
| '''Administrator password:''' || The password for the admin entry (cn=admin). || '''123Start$'''
+
| Organization name: || it213.int
 
|-
 
|-
−
| '''Confirm password:''' || Re-enter the password for verification. || '''123Start$'''
+
| Administrator password: || 123Start$
 
|-
 
|-
−
| '''Database backend to use:''' || The storage engine for the LDAP database. || '''MDB'''
+
| Database backend to use: || MDB
 
|-
 
|-
−
| '''Do you want the database to be removed when slapd is purged?''' || Whether to delete the data if the package is completely removed. || '''No'''
+
| Remove database when slapd is purged? || No
 
|-
 
|-
−
| '''Move old database?''' || If a database already exists, should it be moved aside? || '''Yes'''
+
| Move old database? || Yes
 
|-
 
|-
−
| '''Allow LDAPv2 protocol?''' || Support for the obsolete LDAP version 2. || '''No'''
+
| Allow LDAPv2 protocol? || No
 
|}
 
|}
  
−
= OpenLDAP Manuelle Einrichtung (OLC) =
+
= Port checken =
−
[[OpenLDAP Manuelle Einrichtung (OLC)]]
+
*ss -4lntp | grep slapd
 +
LISTEN 0      2048        0.0.0.0:389      0.0.0.0:*    users:(("slapd",pid=1365,fd=7))
  
−
= Server Vorbereitung =
+
= ldap.conf setzen =
−
== Grundstruktur ==
+
* vim /etc/ldap/ldap.conf
−
{{#drawio:it213-ldap}}
+
<pre>
 +
BASE    dc=it213,dc=int
 +
URI    ldap://ldap.it213.int
 +
ldap_version    3
 +
</pre>
  
−
=== Erstellen ===
+
= Kontrolle =
 +
* ldapsearch -x -LLL
 +
 
 +
= Grundstruktur =
 +
== Erstellen ==
 
* cat <<EOF > /root/struktur.ldif
 
* cat <<EOF > /root/struktur.ldif
 
<pre>
 
<pre>
Zeile 62: Zeile 64:
 
EOF
 
EOF
  
−
=== Anlegen ===
+
== Anlegen ==
 
* ldapadd -xD cn=admin,dc=it213,dc=int -w 123Start$ -f /root/struktur.ldif
 
* ldapadd -xD cn=admin,dc=it213,dc=int -w 123Start$ -f /root/struktur.ldif
 +
= Kontrolle =
 +
* ldapsearch -x -LLL
  
−
= Ldapscripts =
+
= Benutzer und Gruppen =
−
== Installation ==
+
* apt install -y ldapscripts
−
* apt install ldapscripts
 
  
 
== Konfiguration ==
 
== Konfiguration ==
−
=== Hauptkonfiguration ===
+
* vim /etc/ldapscripts/ldapscripts.conf
−
* cat /etc/ldapscripts/ldapscripts.conf
+
<pre>
−
SERVER="ldap://ldap.it213.int"
+
SERVER="ldap://ldap.it213.int"
−
SUFFIX="dc=it213,dc=int"
+
SUFFIX="dc=it213,dc=int"
−
GSUFFIX="ou=groups"
+
GSUFFIX="ou=groups"
−
USUFFIX="ou=users"
+
USUFFIX="ou=users"
−
MSUFFIX="ou=hosts"
+
MSUFFIX="ou=hosts"
−
BINDDN="cn=admin,dc=it213,dc=int"
+
BINDDN="cn=admin,dc=it213,dc=int"
−
BINDPWDFILE="/etc/ldapscripts/ldapscripts.passwd"
+
USHELL="/bin/bash"
−
GIDSTART="10000"
+
UHOMES="/home/%u"
−
UIDSTART="10000"
+
CREATEHOMES="yes"
 +
HOMESKEL="/etc/skel"
 +
BINDPWDFILE="/etc/ldapscripts/ldapscripts.passwd"
 +
GIDSTART="10000" # Group ID
 +
UIDSTART="10000" # User ID
 +
MIDSTART="20000" # Machine ID
 +
GCLASS="posixGroup"  # Leave "posixGroup" here if not sure !
 +
PASSWORDGEN="pwgen"
 +
RECORDPASSWORDS="no"
 +
PASSWORDFILE="/var/log/ldapscripts_passwd.log"
 +
LOGTOFILE="yes"
 +
LOGFILE="/var/log/ldapscripts.log"
 +
LOGTOSYSLOG="no"
 +
SYSLOGFACILITY="local4"
 +
SYSLOGLEVEL="info"
 +
LDAPSEARCHBIN="/usr/bin/ldapsearch"
 +
LDAPADDBIN="/usr/bin/ldapadd"
 +
LDAPDELETEBIN="/usr/bin/ldapdelete"
 +
LDAPMODIFYBIN="/usr/bin/ldapmodify"
 +
LDAPMODRDNBIN="/usr/bin/ldapmodrdn"
 +
LDAPPASSWDBIN="/usr/bin/ldappasswd"
 +
LDAPSEARCHOPTS="-o ldif-wrap=no"
 +
GETENTPWCMD=""
 +
GETENTGRCMD=""
 +
GTEMPLATE=""
 +
UTEMPLATE=""
 +
MTEMPLATE=""
 +
</pre>
  
−
=== Password Datei ===
 
 
* echo -n "123Start$" > /etc/ldapscripts/ldapscripts.passwd
 
* echo -n "123Start$" > /etc/ldapscripts/ldapscripts.passwd
 +
* chmod 600 /etc/ldapscripts/ldapscripts.passwd
  
−
== Management ==
+
== Gruppen ==
−
=== Struktur ===
+
* ldapaddgroup it
−
{{#drawio:it213-2}}
+
* ldapaddgroup sudo
  
−
=== Gruppen und Benutzer ===
+
== Benutzer ==
−
* ldapaddgroup it
 
 
* ldapadduser thomas it
 
* ldapadduser thomas it
 
* ldapadduser tina it
 
* ldapadduser tina it
 +
== Kontrolle ==
 +
* ldapsearch -x
 +
 +
== Passwort ==
 
* ldapsetpasswd thomas
 
* ldapsetpasswd thomas
 
* ldapsetpasswd tina
 
* ldapsetpasswd tina
  
−
= Client Anbindung via SSSD =
+
== Gruppe zuweisen ==
−
Da sudo-ldap veraltet ist, nutzen wir SSSD für NSS, PAM und Sudo.
+
* ldapaddusertogroup thomas sudo
 +
* ldapaddusertogroup tina sudo
 +
== Check ==
 +
*ldapsearch -xLLL  cn=sudo
 +
dn: cn=sudo,ou=groups,dc=it213,dc=int
 +
objectClass: posixGroup
 +
cn: sudo
 +
gidNumber: 10001
 +
description: Group account
 +
memberUid: thomas
 +
memberUid: tina
  
−
== Installation ==
+
= SSSD Anbindung =
 
* apt install sssd libnss-sss libpam-sss libsss-sudo
 
* apt install sssd libnss-sss libpam-sss libsss-sudo
  
Zeile 106: Zeile 149:
 
<pre>
 
<pre>
 
[sssd]
 
[sssd]
 +
config_file_version = 2
 
services = nss, pam, sudo
 
services = nss, pam, sudo
 
domains = it213.int
 
domains = it213.int
Zeile 112: Zeile 156:
 
id_provider = ldap
 
id_provider = ldap
 
auth_provider = ldap
 
auth_provider = ldap
 +
access_provider = permit
 
sudo_provider = ldap
 
sudo_provider = ldap
−
 
 
ldap_uri = ldap://ldap.it213.int
 
ldap_uri = ldap://ldap.it213.int
 
ldap_search_base = dc=it213,dc=int
 
ldap_search_base = dc=it213,dc=int
 
ldap_sudo_search_base = ou=sudo,dc=it213,dc=int
 
ldap_sudo_search_base = ou=sudo,dc=it213,dc=int
 
ldap_id_use_start_tls = false
 
ldap_id_use_start_tls = false
−
 
+
ldap_auth_disable_tls_never_use_in_production = true
−
cache_credentials = True
+
ldap_tls_reqcert = never
−
ldap_tls_reqcert = allow
 
 
</pre>
 
</pre>
 +
;[[Erklärungen sssd-1]]
  
 
* chmod 600 /etc/sssd/sssd.conf
 
* chmod 600 /etc/sssd/sssd.conf
 
* systemctl restart sssd
 
* systemctl restart sssd
  
−
== System Integration ==
+
== NSS ==
−
=== nsswitch.conf ===
+
;Nur Kontrolle
−
* vim /etc/nsswitch.conf
+
*cat /etc/nsswitch.conf  
−
passwd:        files sss
 
−
group:          files sss
 
−
shadow:        files sss
 
−
sudoers:        files sss
 
  
−
=== PAM mkhomedir ===
+
passwd:        files systemd '''sss'''
−
* pam-auth-update --enable mkhomedir
+
group:         files systemd '''sss'''
−
 
+
shadow:         files systemd '''sss'''
−
= Sudo im LDAP =
+
gshadow:       files systemd
−
== Sudo-Regeln anlegen ==
+
−
Damit SSSD Sudo-Regeln findet, müssen diese als Objekte im LDAP existieren.
+
hosts:         files dns
−
* cat <<EOF > /root/sudo_rules.ldif
+
networks:       files
−
<pre>
+
−
dn: cn=defaults,ou=sudo,dc=it213,dc=int
+
protocols:     db files
−
objectClass: sudoRole
+
services:       db files '''sss'''
−
cn: defaults
+
ethers:         db files
−
sudoOption: env_reset
+
rpc:           db files
−
sudoOption: mail_badpass
+
−
sudoOption: secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+
netgroup:       nis sss
−
 
+
sudoers: files  sss
−
dn: cn=%sudo,ou=sudo,dc=it213,dc=int
+
automount: sss
−
objectClass: sudoRole
 
−
cn: %sudo
 
−
sudoUser: %sudo
 
−
sudoHost: ALL
 
−
sudoRunAsUser: ALL
 
−
sudoRunAsGroup: ALL
 
−
sudoCommand: ALL
 
 
</pre>
 
</pre>
−
EOF
 
−
 
−
* ldapadd -xD cn=admin,dc=it213,dc=int -w 123Start$ -f /root/sudo_rules.ldif
 
−
 
−
== Gruppenzuweisung ==
 
−
* ldapaddgroup sudo
 
−
* ldapaddusertogroup thomas sudo
 
−
* ldapaddusertogroup tina sudo
 
−
 
−
= Tests und Kontrolle =
 
−
== Identität ==
 
−
* getent group it
 
−
* getent passwd thomas
 
−
* id tina
 
  
−
== Sudo Check ==
+
== PAM ==
−
* su - thomas
+
*grep "^[^#]" /etc/pam.d/common-auth
−
* sudo -l
+
auth [success=2 default=ignore] pam_unix.so nullok
−
* sudo whoami
+
'''auth [success=1 default=ignore] pam_sss.so use_first_pass'''
 +
auth requisite pam_deny.so
 +
auth required pam_permit.so
  
−
== Dienstverwaltung ==
+
== PAM ==
−
* systemctl status slapd
+
* pam-auth-update --enable sss mkhomedir
−
* systemctl status sssd
+
=Tests=
−
* netstat -lntp | grep slapd
+
;Funktioniert nsswitch?
 +
*getent passwd thomas
 +
thomas:*:10000:10000:thomas:/home/thomas:/bin/bash
 +
*getent passwd tina
 +
tina:*:10001:10000:tina:/home/tina:/bin/bash
 +
*getent group it
 +
it:*:10000:
 +
;Kann ich mit su - einen Identitätswechel vornehmen?
 +
*su - thomas
 +
thomas@ldap:~$ exit
 +
*su - tina
 +
tina@ldap:~$ exit

Aktuelle Version vom 24. April 2026, 06:32 Uhr

Installation

passwort nach wahl festlegen
  • apt update
  • DEBIAN_FRONTEND=noninteractive apt install -y slapd ldap-utils

Grundkonfiguration

  • dpkg-reconfigure slapd
Debconf Question Recommended Input
Omit OpenLDAP server configuration? No
DNS domain name: it213.int
Organization name: it213.int
Administrator password: 123Start$
Database backend to use: MDB
Remove database when slapd is purged? No
Move old database? Yes
Allow LDAPv2 protocol? No

Port checken

  • ss -4lntp | grep slapd
LISTEN 0      2048         0.0.0.0:389       0.0.0.0:*    users:(("slapd",pid=1365,fd=7))

ldap.conf setzen

  • vim /etc/ldap/ldap.conf
BASE    dc=it213,dc=int
URI     ldap://ldap.it213.int
ldap_version    3

Kontrolle

  • ldapsearch -x -LLL

Grundstruktur

Erstellen

  • cat <<EOF > /root/struktur.ldif
dn: ou=users,dc=it213,dc=int
objectClass: organizationalUnit
ou: users

dn: ou=groups,dc=it213,dc=int
objectClass: organizationalUnit
ou: groups

dn: ou=hosts,dc=it213,dc=int
objectClass: organizationalUnit
ou: hosts

dn: ou=sudo,dc=it213,dc=int
objectClass: organizationalUnit
ou: sudo

EOF

Anlegen

  • ldapadd -xD cn=admin,dc=it213,dc=int -w 123Start$ -f /root/struktur.ldif

Kontrolle

  • ldapsearch -x -LLL

Benutzer und Gruppen

  • apt install -y ldapscripts

Konfiguration

  • vim /etc/ldapscripts/ldapscripts.conf
SERVER="ldap://ldap.it213.int"
SUFFIX="dc=it213,dc=int"
GSUFFIX="ou=groups"
USUFFIX="ou=users"
MSUFFIX="ou=hosts"
BINDDN="cn=admin,dc=it213,dc=int"
USHELL="/bin/bash"
UHOMES="/home/%u"
CREATEHOMES="yes"
HOMESKEL="/etc/skel"
BINDPWDFILE="/etc/ldapscripts/ldapscripts.passwd"
GIDSTART="10000" # Group ID
UIDSTART="10000" # User ID
MIDSTART="20000" # Machine ID
GCLASS="posixGroup"   # Leave "posixGroup" here if not sure !
PASSWORDGEN="pwgen"
RECORDPASSWORDS="no"
PASSWORDFILE="/var/log/ldapscripts_passwd.log"
LOGTOFILE="yes"
LOGFILE="/var/log/ldapscripts.log"
LOGTOSYSLOG="no"
SYSLOGFACILITY="local4"
SYSLOGLEVEL="info"
LDAPSEARCHBIN="/usr/bin/ldapsearch"
LDAPADDBIN="/usr/bin/ldapadd"
LDAPDELETEBIN="/usr/bin/ldapdelete"
LDAPMODIFYBIN="/usr/bin/ldapmodify"
LDAPMODRDNBIN="/usr/bin/ldapmodrdn"
LDAPPASSWDBIN="/usr/bin/ldappasswd"
LDAPSEARCHOPTS="-o ldif-wrap=no"
GETENTPWCMD=""
GETENTGRCMD=""
GTEMPLATE=""
UTEMPLATE=""
MTEMPLATE=""
  • echo -n "123Start$" > /etc/ldapscripts/ldapscripts.passwd
  • chmod 600 /etc/ldapscripts/ldapscripts.passwd

Gruppen

  • ldapaddgroup it
  • ldapaddgroup sudo

Benutzer

  • ldapadduser thomas it
  • ldapadduser tina it

Kontrolle

  • ldapsearch -x

Passwort

  • ldapsetpasswd thomas
  • ldapsetpasswd tina

Gruppe zuweisen

  • ldapaddusertogroup thomas sudo
  • ldapaddusertogroup tina sudo

Check

  • ldapsearch -xLLL cn=sudo
dn: cn=sudo,ou=groups,dc=it213,dc=int
objectClass: posixGroup
cn: sudo
gidNumber: 10001
description: Group account
memberUid: thomas
memberUid: tina

SSSD Anbindung

  • apt install sssd libnss-sss libpam-sss libsss-sudo

Konfiguration

  • vim /etc/sssd/sssd.conf
[sssd]
config_file_version = 2
services = nss, pam, sudo
domains = it213.int

[domain/it213.int]
id_provider = ldap
auth_provider = ldap
access_provider = permit
sudo_provider = ldap
ldap_uri = ldap://ldap.it213.int
ldap_search_base = dc=it213,dc=int
ldap_sudo_search_base = ou=sudo,dc=it213,dc=int
ldap_id_use_start_tls = false
ldap_auth_disable_tls_never_use_in_production = true
ldap_tls_reqcert = never
Erklärungen sssd-1
  • chmod 600 /etc/sssd/sssd.conf
  • systemctl restart sssd

NSS

Nur Kontrolle
  • cat /etc/nsswitch.conf
passwd:         files systemd sss
group:          files systemd sss
shadow:         files systemd sss
gshadow:        files systemd

hosts:          files dns
networks:       files

protocols:      db files
services:       db files sss
ethers:         db files
rpc:            db files

netgroup:       nis sss
sudoers: files  sss
automount:  sss

PAM

  • grep "^[^#]" /etc/pam.d/common-auth
auth	[success=2 default=ignore]	pam_unix.so nullok
auth	[success=1 default=ignore]	pam_sss.so use_first_pass
auth	requisite			pam_deny.so
auth	required			pam_permit.so

PAM

  • pam-auth-update --enable sss mkhomedir

Tests

Funktioniert nsswitch?
  • getent passwd thomas
thomas:*:10000:10000:thomas:/home/thomas:/bin/bash
  • getent passwd tina
tina:*:10001:10000:tina:/home/tina:/bin/bash
  • getent group it
it:*:10000:
Kann ich mit su - einen Identitätswechel vornehmen?
  • su - thomas
thomas@ldap:~$ exit
  • su - tina
tina@ldap:~$ exit
Abgerufen von „http://www.xinux.net/index.php?title=Zentrale_Benutzerverwaltung_mit_OpenLDAP_und_SSS&oldid=68983“