Oracle Linux/OpenLDAP
From r00tedvw.com wiki
(Difference between revisions)
Line 78: | Line 78: | ||
Build the directory structure | Build the directory structure | ||
<nowiki>~$ sudo ldapadd -x -W -D "cn=ldapadm,dc=itzgeek,dc=local" -f base.ldif</nowiki> | <nowiki>~$ sudo ldapadd -x -W -D "cn=ldapadm,dc=itzgeek,dc=local" -f base.ldif</nowiki> | ||
+ | |||
+ | =PHPLDAPAdmin= | ||
+ | ==Installation= | ||
+ | <nowiki>~$ sudo yum install -y epel-release | ||
+ | sudo yum install -y phpldapadmin</nowiki> | ||
+ | ==Edit Configuration== | ||
+ | <nowiki>~$ sudo vim /etc/phpldapadmin/config.php | ||
+ | ... | ||
+ | around line 300, update the domain info | ||
+ | $servers->setValue('server','base',array('dc=itzgeek,dc=local')); | ||
+ | |||
+ | around line 326, update the admin and domain info | ||
+ | $servers->setValue('login','bind_id','cn=ldapadm,dc=itzgeek,dc=local'); | ||
+ | |||
+ | around line 397/398, uncomment and comment the following lines | ||
+ | $servers->setValue(‘login’,’attr’,’dn’); | ||
+ | // $servers->setValue(‘login’,’attr’,’uid’);</nowiki> | ||
+ | |||
+ | ==Update HTTPD== | ||
+ | next, update the virtual host configuration to allow connections | ||
+ | <nowiki>sudo vim /etc/httpd/conf.d/phpldapadmin.conf | ||
+ | ... | ||
+ | Alias /phpldapadmin /usr/share/phpldapadmin/htdocs | ||
+ | Alias /ldapadmin /usr/share/phpldapadmin/htdocs | ||
+ | |||
+ | usr/share/phpldapadmin/htdocs> | ||
+ | <IfModule mod_authz_core.c> | ||
+ | # Apache 2.4 | ||
+ | # Require local | ||
+ | Require all granted | ||
+ | IfModule> | ||
+ | <IfModule !mod_authz_core.c> | ||
+ | # Apache 2.2 | ||
+ | Order Deny,Allow | ||
+ | Deny from all | ||
+ | Allow from 127.0.0.1 | ||
+ | Allow from ::1 | ||
+ | </IfModule> | ||
+ | </Directory></nowiki> | ||
+ | restart | ||
+ | <nowiki>~$ sudo systemctl restart httpd.service</nowiki> | ||
+ | |||
+ | ==Update firewalld== | ||
+ | <nowiki>~$ sudo firewall-cmd --permanent --add-service=http | ||
+ | ~$ sudo firewall-cmd --reload</nowiki> |
Revision as of 01:01, 29 July 2020
OpenLDAP
Contents |
Overview
Installed on CentOS 7
Installation
~$ sudo yum install -y openldap-clients openldap-servers ~$ systemctl start slapd ~$ systemctl enable slapd
Configuration
LDAP User Account
Setup new user account for ldap admin
~$ sudo useradd ldapadmin -d /home/ldapadmin/ -G wheel ~$ sudo passwd ldapadmin
Setup LDAP Admin password
Create a SHA hash of the desired password for the ldap admin and add it to the ldap config. The parameter may not exist in the config file, you may need to add it.
~$ slappasswd -h {SSHA} -s ldappassword ==Configure LDAP Server== create db.ldif and update: *SSHA password *olcRootDN <nowiki>~$ vim db.ldif ... dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=itzgeek,dc=local dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=ldapadm,dc=itzgeek,dc=local dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootPW olcRootPW: {SSHA}d/thexcQUuSfe3rx3gRaEhHpNJ52N8D3
Send the configuration to the server.
~$ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f db.ldif
restrict the monitor access only to ldap root. Update:
- dn.base
~$ vim monitor.ldif ... dn: olcDatabase={1}monitor,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external, cn=auth" read by dn.base="cn=ldapadm,dc=itzgeek,dc=local" read by * none
update the server.
~$ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f monitor.ldif
Setup Database
~$ sudo cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG ~$ sudo chown -R ldap:ldap /var/lib/ldap ~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif ~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif ~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
Setup the domain information. Update:
- dn (x4)
~$ vim base.ldif ... dn: dc=itzgeek,dc=local dc: itzgeek objectClass: top objectClass: domain dn: cn=ldapadm ,dc=itzgeek,dc=local objectClass: organizationalRole cn: ldapadm description: LDAP Manager dn: ou=People,dc=itzgeek,dc=local objectClass: organizationalUnit ou: People dn: ou=Group,dc=itzgeek,dc=local objectClass: organizationalUnit ou: Group
Build the directory structure
~$ sudo ldapadd -x -W -D "cn=ldapadm,dc=itzgeek,dc=local" -f base.ldif
PHPLDAPAdmin
=Installation
~$ sudo yum install -y epel-release sudo yum install -y phpldapadmin
Edit Configuration
~$ sudo vim /etc/phpldapadmin/config.php ... around line 300, update the domain info $servers->setValue('server','base',array('dc=itzgeek,dc=local')); around line 326, update the admin and domain info $servers->setValue('login','bind_id','cn=ldapadm,dc=itzgeek,dc=local'); around line 397/398, uncomment and comment the following lines $servers->setValue(‘login’,’attr’,’dn’); // $servers->setValue(‘login’,’attr’,’uid’);
Update HTTPD
next, update the virtual host configuration to allow connections
sudo vim /etc/httpd/conf.d/phpldapadmin.conf ... Alias /phpldapadmin /usr/share/phpldapadmin/htdocs Alias /ldapadmin /usr/share/phpldapadmin/htdocs usr/share/phpldapadmin/htdocs> <IfModule mod_authz_core.c> # Apache 2.4 # Require local Require all granted IfModule> <IfModule !mod_authz_core.c> # Apache 2.2 Order Deny,Allow Deny from all Allow from 127.0.0.1 Allow from ::1 </IfModule> </Directory>
restart
~$ sudo systemctl restart httpd.service
Update firewalld
~$ sudo firewall-cmd --permanent --add-service=http ~$ sudo firewall-cmd --reload