LDAP – @Work

Sudoers in LDAP

28 June 2017 by drfugazi

In addition to the standard sudoers file, sudo may be configured via LDAP. This can be especially useful for synchronizing sudoers in a large, distributed environment. You need to have LDAP server and client configured, if you do not have already, see my previous posts. LDAP schema extension for sudo is also required on LDAP … Read more

Linux LDAP autofs client configuration

10 May 2017 by drfugazi

There is a plenty of Linux distributions, so there is not my point to describe how to configure autofs in every one of them. This description is based on RedHat/CentOS, but it can be applied to other distributions with very small changes. If you have local users and their directories located in /home you may … Read more

Solaris LDAP autofs client configuration

15 December 2016 by drfugazi

Last time I wrote about autofs configuration on LDAP server, now it is time to configure autofs client in Solaris. I assume that in DUAConfigProfile, objectClasses and attributes are already defined. You can check this with simply commands: If you have similar output, you can proceed with configuration in system files. In principle, it would … Read more

Autofs in LDAP configuration – for Linux and Solaris

25 November 2016 by drfugazi

If you have LDAP server as user repository it is also good to have NFS server to store their home directories. To avoid autofs map configuration on every host, you can use LDAP service to store maps. I assume that NFS server (NFSHOME) is already installed, LDAP server and client are configured (see previous posts). … Read more

Linux LDAP client configuration

6 October 2016 by drfugazi

The simplest way to configure LDAP client in Linux is to use some kind of tool delivered with system. SuSE has yast (yast2), RedHat family has authconfig (authconfig-tui). This should install required packages like: nss-pam-ldapd, nscd, pam_ldap, ldapclient etc. Unfortunatelly I don’t remember list of packages for particular distributions, because I configured it on SuSE, … Read more

Solaris LDAP client configuration

21 June 2016 by drfugazi

Oracle Solaris has native LDAP support built in OS, so there is no need to install third-party software to configure Solaris to use LDAP as users/groups and other repository. You can use different ways to do this, and I will describe few of them.

If secure communication is required, and we have Self Signed certificates, we need to install CA certificate on each client.
This can be achieved by import CA certificate to local store with certutil (/usr/sfw/bin/certutil in Solaris 10). First create NSS DB (Don’t enter password. Just hit return)

certutil -N -d /var/ldap
chmod 444 /var/ldap/*

LDAP server for Solaris and Linux clients

2 June 2016 by drfugazi

Few months ago I received a task to set up LDAP authentication for Solaris 10, Solaris 11 and Linux machines in Customer’s infrastructure. As LDAP server was chosen OpenLDAP 2.4.x in Master-Slave configuration with SSL/TLS support. Servers was installed on Virtual Machines with CentOS 6.7.
I will not describe LDAP installation, because on modern Linuxes it’s simple like:

$ sudo yum install openldap-servers

OpenDJ – online schema modification

19 June 2012 by drfugazi

I wrote before about schema conversion to LDIF format and how to add schemas offline by uploading them to config/schema directory in OpenDJ. Now I will describe how to extend schema online, without restart LDAP server. Most if not all LDAP servers now have possibility to modify configuration and schemas due LDIF files and ldapmodify tool. Let’s prepare our LDIF file, attributes first:

# cat us-newattrs.ldif

LDAP meta directory

4 August 2011 by drfugazi

Sometimes you need to combine two or more LDAP directories with same suffixes to one directory or you just need to have a proxy. My first attempts to combine two OpenLDAP directories was to make replication from two different sources. This solution however has some disadvantages. First of all: to have syncprov replication your environment must be uniform, this means all source servers and proxy needs to be OpenLDAP. Second: I observed that this is not so stable, because of mentioned earlier issues with OpenLDAP replication.

Unique attributes in OpenDJ

25 July 2011 by drfugazi

Sometimes you need to set some attributes as unique, for example: if LDAP contains system users, then uid attribute shouldn’t repeat in whole system.
OpenDJ is equipped with proper plugin, but it’s not enabled by default. In case of mail system, attribute mail should be unique. Here we don’t have ready to use plugin, but we can easily create it basing on UID Unique Attribute and this description and this one.

But I didn’t make this post to send you to other pages. I would like to show you how to add Plugin with dsconfig and how to copy it to replica with LDIF export/import.