• Services
• LDAP

Installation

polar@backus ~ % sudo aptitude install slapd ldap-utils migrationtools

Answer the questions. Seemingly, dpkg needs to be asked to ask us more questions.

polar@backus ~ % sudo dpkg-reconfigure slapd

Omit OpenLDAP server configuration? No
DNS domain name: warwickcompsoc.co.uk
Admin Password: ***
Confirm Password: ***
Do you want your database to be removed when slapd is purged? No
Move old database? Yes
Allow LDAPv2 Protocol? No

/etc/ldap/ldap.conf :

BASE dc=warwickcompsoc, dc=co, dc=uk
URI ldap://backus.warwickcompsoc.co.uk

Check if it's working with something like

ldapsearch -x dc=foo

ldap_bind: Can't contact LDAP server (-1)

probably means the server isn't running, in which case

/etc/init.d/slapd start

Migration

Edit /etc/migrationtools/migrate_common.ph

$DEFAULT_MAIL_DOMAIN = "warwickcompsoc.co.uk";
$DEFAULT_BASE = "dc=warwickcompsoc,dc=co,dc=uk";

We used migrationtools to import data from /etc/passwd and /etc/groups

Create people_group.ldif (for People and Group nodes) with

dn: ou=People, dc=warwickcompsoc, dc=co, dc=uk
ou: People
objectclass: organizationalUnit

dn: ou=Group, dc=warwickcompsoc, dc=co, dc=uk
ou: Group
objectclass: organizationalUnit

Export

polar@backus ~ % sudo /usr/share/migrationtools/migrate_group.pl /etc/group group.ldif
polar@backus ~ % sudo /usr/share/migrationtools/migrate_passwd.pl /etc/passwd passwd.ldif

If you get a message complaining about something to do with h2ph, run:

oddbloke@backus:/usr/share/migrationtools$ sudo h2ph -d /usr/share/perl/5.8.8/ /usr/share/migrationtools/migrate_common.ph

Import

polar@backus ~ % sudo ldapadd -v -x -W -D "cn=admin,dc=warwickcompsoc,dc=co,dc=uk" -f people_group.ldif
polar@backus ~ % sudo ldapadd -c -v -x -W -D "cn=admin,dc=warwickcompsoc,dc=co,dc=uk" -f passwd.ldif
polar@backus ~ % sudo ldapadd -c -v -x -W -D "cn=admin,dc=warwickcompsoc,dc=co,dc=uk" -f group.ldif

Client Password Setup

oddbloke@backus ~ % sudo aptitude install libpam-ldap libnss-ldap ldap-utils

For all of the /etc/pam.d/common-<foo> files, the following line needs to be added above the existing line:

${foo}  sufficient  pam_ldap.so

For example, /etc/pam.d/common-account looks like:

#
# /etc/pam.d/common-account - authorization settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authorization modules that define
# the central access policy for use on the system.  The default is to
# only deny service to users whose accounts are expired in /etc/shadow.
#
account sufficient      pam_ldap.so
account required        pam_unix.so

The following line should be added to /etc/ldap/ldap.conf:

pam_password exop

The passwd, group and shadow lines in /etc/nsswitch.conf currently look like:

passwd:         compat

These should be amended to have files ldap like so:

passwd:         files ldap
group:          files ldap
shadow:         files ldap

MoinMoin

In order to enable LDAP, the following has been added to the Wiki configuration (/etc/moin/compsocwiki.py):

   1 import ldap
   2 from MoinMoin.auth import ldap_login, moin_cookie
   3 
   4 auth = [ldap_login, moin_cookie]      # LDAP should be used,
   5                                       # MoinMoin should create cookies
   6 ldap_uri = 'ldap://backus.uwcs.co.uk' # Our server
   7 ldap_coding = 'utf-8'
   8 ldap_verbose = True                   # More informative error messages, this may want
   9                                       # to go
  10 
  11 ldap_binddn = '' # We currently have our LDAP server set up for anonymous bind, so that is
  12 ldap_bindpw = '' # what is used
  13 
  14 ldap_email_attribute = '' # If email addresses are ever stored in LDAP, this should be
  15                           # set to point to them
  16 
  17 ldap_base = 'ou=People,dc=warwickcompsoc,dc=co,dc=uk' # base DN we use for searching
  18 ldap_scope = ldap.SCOPE_SUBTREE # scope of the search we do
  19 ldap_name_attribute = 'uid'
  20 ldap_timeout = 10 # how long we wait for the ldap server [s]
  21 cookie_lifetime = 1 # 1 hour after last access ldap login is required again
  22 user_autocreate = True  # If a user doesn't exist, create them

ejabberd

{auth_method, ldap}.
{ldap_servers, ["localhost"]}.    % List of LDAP servers
{ldap_uidattr, "uid"}.            % LDAP attribute that holds user ID
{ldap_base, "ou=People,dc=warwickcompsoc,dc=co,dc=uk"}. % Search base of LDAP directory