Ubuntu/openldap - Revision history

R00t at 05:08, 3 September 2015

2015-09-03T05:08:56Z

R00t: /* /etc/phpldapadmin/config.php */

2015-08-19T04:05:09Z

‎/etc/phpldapadmin/config.php

R00t: /* FAQ */

2015-08-19T03:47:36Z

‎FAQ

R00t: /* /etc/phpldapadmin/config.php */

2015-08-19T03:47:00Z

‎/etc/phpldapadmin/config.php

R00t: /* /etc/phpldapadmin/config.php */

2015-08-19T03:36:08Z

‎/etc/phpldapadmin/config.php

R00t at 03:25, 19 August 2015

2015-08-19T03:25:49Z

R00t: /* Modifying setup of phpLDAPadmin */

2015-08-19T02:59:47Z

‎Modifying setup of phpLDAPadmin

R00t: /* create new site conf */

2015-08-19T02:52:28Z

‎create new site conf

R00t at 02:51, 19 August 2015

2015-08-19T02:51:49Z

R00t at 02:34, 19 August 2015

2015-08-19T02:34:23Z

← Older revision		Revision as of 05:08, 3 September 2015
Line 60:		Line 60:
	Originally I tried to set the Server base and Login Bind IDs to dc=ldap,dc=domain,dc=com. Unfortunately the admin account was already created and was listed as dc=domain,dc=com, so when i logged in without dc=ldap (wouldnt authenticate without it), I got a nice error about "This base cannot be created with PLA" in phpLDAPadmin and it refused to show me the LDAP tree. Changed the config.php file and removed both instances of dc=ldap and I could authenticate successfully with everything showing as it should.<br>		Originally I tried to set the Server base and Login Bind IDs to dc=ldap,dc=domain,dc=com. Unfortunately the admin account was already created and was listed as dc=domain,dc=com, so when i logged in without dc=ldap (wouldnt authenticate without it), I got a nice error about "This base cannot be created with PLA" in phpLDAPadmin and it refused to show me the LDAP tree. Changed the config.php file and removed both instances of dc=ldap and I could authenticate successfully with everything showing as it should.<br>
	Did not bother to look into how to change the admin account, no one will ever really see this as its just supplementing applications which can work with openLDAP on the local host.		Did not bother to look into how to change the admin account, no one will ever really see this as its just supplementing applications which can work with openLDAP on the local host.
		+
		+	===Authentication===
		+	To setup authentication on LDAP so you can use it for other applications, do the following
		+	<nowiki>~$ sudo apt-get update && sudo apt-get install -y libpam-ldap nscd</nowiki>

@@ Line 52: / Line 52: @@
 search for hide_template_warning
 $config->custom->appearance['hide_template_warning'] = true;</nowiki>
 =====FAQ=====
 Originally I tried to set the Server base and Login Bind IDs to dc=ldap,dc=domain,dc=com.  Unfortunately the admin account was already created and was listed as dc=domain,dc=com, so when i logged in without dc=ldap (wouldnt authenticate without it), I got a nice error about "This base cannot be created with PLA" in phpLDAPadmin and it refused to show me the LDAP tree.  Changed the config.php file and removed both instances of dc=ldap and I could authenticate successfully with everything showing as it should.<br>
 Did not bother to look into how to change the admin account, no one will ever really see this as its just supplementing applications which can work with openLDAP on the local host.

@@ Line 53: / Line 53: @@
 $config->custom->appearance['hide_template_warning'] = true;</nowiki>
 =====FAQ=====
-Originally I tried to set the Server base and Login Bind IDs to dc=ldap,dc=domain,dc=com.  Unfortunately the admin account was already created and was listed as dc=domain,dc=com, so when i logged in without dc=ldap (wouldnt authenticate without it), I got a nice error about "This base cannot be created with PLA" in phpLDAPadmin and it refused to show me the LDAP tree.  Changed the config.php file and removed both instances of dc=ldap and I could authenticate successfully.<br>
+Originally I tried to set the Server base and Login Bind IDs to dc=ldap,dc=domain,dc=com.  Unfortunately the admin account was already created and was listed as dc=domain,dc=com, so when i logged in without dc=ldap (wouldnt authenticate without it), I got a nice error about "This base cannot be created with PLA" in phpLDAPadmin and it refused to show me the LDAP tree.  Changed the config.php file and removed both instances of dc=ldap and I could authenticate successfully with everything showing as it should.<br>
 Did not bother to look into how to change the admin account, no one will ever really see this as its just supplementing applications which can work with openLDAP on the local host.

@@ Line 46: / Line 46: @@
 $servers->setValue('server','name','ldap.domain.com');
 $servers->setValue('server','host','ldap.domain.com');
-$servers->setValue('server','base',array('dc=ldap,dc=domain,dc=com'));
+$servers->setValue('server','base',array('dc=domain,dc=com'));
-$servers->setValue('login','bind_id','cn=admin,dc=ldap,dc=domain,dc=com');</nowiki>
+$servers->setValue('login','bind_id','cn=admin,dc=domain,dc=com');</nowiki>
 Uncomment the following to prevent annoying warning messages about template files that have no impact on functionality
   <nowiki>~$ sudo vi /etc/phpldapadmin/config.php
 search for hide_template_warning
 $config->custom->appearance['hide_template_warning'] = true;</nowiki>

@@ Line 51: / Line 51: @@
   <nowiki>~$ sudo vi /etc/phpldapadmin/config.php
 search for hide_template_warning
-$config->custom->appearance['hide_template_warning'] = false;</nowiki>
+$config->custom->appearance['hide_template_warning'] = true;</nowiki>

← Older revision		Revision as of 03:25, 19 August 2015
Line 39:		Line 39:
	*enable the new apache site		*enable the new apache site
	*restart apache (or reload)		*restart apache (or reload)
		+
		+	===Configure phpLDAPadmin===
		+	====/etc/phpldapadmin/config.php====
		+	Adjust the following lines
		+	<nowiki>~$ sudo vi /etc/phpldapadmin/config.php
		+	$servers->setValue('server','name','ldap.domain.com');
		+	$servers->setValue('server','host','ldap.domain.com');
		+	$servers->setValue('server','base',array('dc=ldap,dc=domain,dc=com'));
		+	$servers->setValue('login','bind_id','cn=admin,dc=ldap,dc=domain,dc=com');</nowiki>
		+	Uncomment the following to prevent annoying warning messages about template files that have no impact on functionality
		+	<nowiki>~$ sudo vi /etc/phpldapadmin/config.php
		+	search for hide_template_warning
		+	$config->custom->appearance['hide_template_warning'] = false;</nowiki>

@@ Line 35: / Line 35: @@
 </VirtualHost></nowiki>
 ====finishing touches====
-Now use iptables to restrict access to port 8080 to only the ip addresses you'll use to manage it.
+*Now use iptables to restrict access to port 8080 to only the ip addresses you'll use to manage it.

← Older revision		Revision as of 02:51, 19 August 2015
Line 18:		Line 18:
	Very useful web interface for administration		Very useful web interface for administration
	<nowiki>~$ sudo apt-get update && sudo apt-get install phpldapadmin -y</nowiki>		<nowiki>~$ sudo apt-get update && sudo apt-get install phpldapadmin -y</nowiki>
		+
		+	===Modifying setup of phpLDAPadmin===
		+	By default phpLDAPadmin creates a conf configuration file under /etc/apache2/conf-available and enables it with some mod-rewrite magic so that when someone goes to domain.com/phpldapadmin it pulls the page from this conf's document root. While this way probably works for most, tweaking this to restrict access can be complicated, so I'd rather have it run on a non-standard port which i can use iptables to restrict access to.
		+	====disable conf====
		+	<nowiki>~$ sudo a2disconf phpldapadmin.conf</nowiki>
		+	====create new site conf====
		+	Instead of a conf under ~/conf-enabled I personally prefer virtual hosts to be placed under ~/sites-available.<br>
		+	Create a new .conf such as ldap.domain.com.conf. In this example i'm setting it as a subdomain and making apache listen on port 8080 for this virtualhost.
		+	<nowiki>~$ sudo vi /etc/apache2/sites-available/ldap.domain.com.conf
		+	<VirtualHost *:8080>
		+	ServerName ldap.domain.com
		+	ServerAdmin admin@domain.com
		+	DocumentRoot /usr/share/phpldapadmin
		+	ErrorLog /var/log/apache2/ldap.domain.com-error.log
		+	CustomLog /var/log/apache2/ldap.domain.com-access.log common
		+	</VirtualHost>
		+	====finishing touches====
		+	Now use iptables to restrict access to port 8080 to only the ip addresses you'll use to manage it.

@@ Line 1: / Line 1: @@
 Performed on Ubuntu 14.04 LTS
 ===Installing===
-  <nowiki>~$ sudo apt-get update && sudo apt-get install slapd ldap-utils</nowiki>
+  <nowiki>~$ sudo apt-get update && sudo apt-get install slapd ldap-utils -y</nowiki>
 It should ask for you to setup an administrator password.
 ===Configuring===
@@ Line 14: / Line 14: @@
 *Move old database? '''Yes'''
 *Allow LDAPv2 protocol? '''No'''