LDAP – @Work

Sudoers in LDAP

28 June 2017 by drfugazi

In addition to the standard sudoers file, sudo may be configured via LDAP. This can be especially useful for synchronizing sudoers in a large, distributed environment. You need to have LDAP server and client configured, if you do not have already, see my previous posts. LDAP schema extension for sudo is also required on LDAP … Read more

Linux LDAP autofs client configuration

10 May 2017 by drfugazi

There is a plenty of Linux distributions, so there is not my point to describe how to configure autofs in every one of them. This description is based on RedHat/CentOS, but it can be applied to other distributions with very small changes. If you have local users and their directories located in /home you may … Read more

Solaris LDAP autofs client configuration

15 December 2016 by drfugazi

Last time I wrote about autofs configuration on LDAP server, now it is time to configure autofs client in Solaris. I assume that in DUAConfigProfile, objectClasses and attributes are already defined. You can check this with simply commands: If you have similar output, you can proceed with configuration in system files. In principle, it would … Read more

Autofs in LDAP configuration – for Linux and Solaris

25 November 2016 by drfugazi

If you have LDAP server as user repository it is also good to have NFS server to store their home directories. To avoid autofs map configuration on every host, you can use LDAP service to store maps. I assume that NFS server (NFSHOME) is already installed, LDAP server and client are configured (see previous posts). … Read more

Linux LDAP client configuration

6 October 2016 by drfugazi

The simplest way to configure LDAP client in Linux is to use some kind of tool delivered with system. SuSE has yast (yast2), RedHat family has authconfig (authconfig-tui). This should install required packages like: nss-pam-ldapd, nscd, pam_ldap, ldapclient etc. Unfortunatelly I don’t remember list of packages for particular distributions, because I configured it on SuSE, … Read more

Solaris LDAP client configuration

21 June 2016 by drfugazi

Oracle Solaris has native LDAP support built in OS, so there is no need to install third-party software to configure Solaris to use LDAP as users/groups and other repository. You can use different ways to do this, and I will describe few of them.

If secure communication is required, and we have Self Signed certificates, we need to install CA certificate on each client.
This can be achieved by import CA certificate to local store with certutil (/usr/sfw/bin/certutil in Solaris 10). First create NSS DB (Don’t enter password. Just hit return)

certutil -N -d /var/ldap
chmod 444 /var/ldap/*

LDAP server for Solaris and Linux clients

2 June 2016 by drfugazi

Few months ago I received a task to set up LDAP authentication for Solaris 10, Solaris 11 and Linux machines in Customer’s infrastructure. As LDAP server was chosen OpenLDAP 2.4.x in Master-Slave configuration with SSL/TLS support. Servers was installed on Virtual Machines with CentOS 6.7.
I will not describe LDAP installation, because on modern Linuxes it’s simple like:

$ sudo yum install openldap-servers

Mail system implementation

5 September 202616 August 2012 by drfugazi

My experience, which I gained during implementation of different systems shows, that implementation should be done in stages. Then, at each stage you can see if it works, if there are some fields to improve and then go to the next stage of implementation. Mail system implementation is not exception. We can divide this into following stages:

Stage I

Basic configuration of sending and receiving mail for system users

Building mail system

5 September 202613 August 2012 by drfugazi

This description is based on my experience, which I gained during mail system implementation on University of Silesia (Katowice/Poland). In the first stage there was about 3 000 of users, now the system is handling about 40 k of mail users. Whole system (exluding Sophos AV) is based on Open Source software. Their main components are:

OpenDJ – online schema modification

19 June 2012 by drfugazi

I wrote before about schema conversion to LDIF format and how to add schemas offline by uploading them to config/schema directory in OpenDJ. Now I will describe how to extend schema online, without restart LDAP server. Most if not all LDAP servers now have possibility to modify configuration and schemas due LDIF files and ldapmodify tool. Let’s prepare our LDIF file, attributes first:

# cat us-newattrs.ldif