Oracle Linux/OpenLDAP
From r00tedvw.com wiki
OpenLDAP
Contents |
Overview
Installed on CentOS 7
Installation
~$ sudo yum install -y openldap-clients openldap-servers ~$ sudo systemctl start slapd ~$ sudo systemctl enable slapd
Configuration
LDAP User Account
Setup new user account for ldap admin
~$ sudo useradd ldapadmin -d /home/ldapadmin/ -G wheel ~$ sudo passwd ldapadmin
Setup LDAP Admin password
Create a SHA hash of the desired password for the ldap admin and add it to the ldap config. The parameter may not exist in the config file, you may need to add it.
~$ slappasswd -h {SSHA} -s ldappassword
Configure LDAP Server
create db.ldif and update:
- SSHA password
- olcRootDN
~$ vim db.ldif ... dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcSuffix olcSuffix: dc=itzgeek,dc=local dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootDN olcRootDN: cn=ldapadm,dc=itzgeek,dc=local dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcRootPW olcRootPW: {SSHA}d/thexcQUuSfe3rx3gRaEhHpNJ52N8D3
Send the configuration to the server.
~$ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f db.ldif
restrict the monitor access only to ldap root. Update:
- dn.base
~$ vim monitor.ldif ... dn: olcDatabase={1}monitor,cn=config changetype: modify replace: olcAccess olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external, cn=auth" read by dn.base="cn=ldapadm,dc=itzgeek,dc=local" read by * none
update the server.
~$ sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f monitor.ldif
Setup Database
~$ sudo cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG ~$ sudo chown -R ldap:ldap /var/lib/ldap ~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif ~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif ~$ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
Setup the domain information. Update:
- dn (x4)
~$ vim base.ldif ... dn: dc=itzgeek,dc=local dc: itzgeek objectClass: top objectClass: domain dn: cn=ldapadm ,dc=itzgeek,dc=local objectClass: organizationalRole cn: ldapadm description: LDAP Manager dn: ou=People,dc=itzgeek,dc=local objectClass: organizationalUnit ou: People dn: ou=Group,dc=itzgeek,dc=local objectClass: organizationalUnit ou: Group
Build the directory structure
~$ sudo ldapadd -x -W -D "cn=ldapadm,dc=itzgeek,dc=local" -f base.ldif
PHPLDAPAdmin
Installation
~$ sudo yum install -y epel-release ~$ sudo yum install -y phpldapadmin
Edit Configuration
~$ sudo vim /etc/phpldapadmin/config.php ... around line 300, update the domain info $servers->setValue('server','base',array('dc=itzgeek,dc=local')); around line 326, update the admin and domain info $servers->setValue('login','bind_id','cn=ldapadm,dc=itzgeek,dc=local'); around line 397/398, uncomment and comment the following lines $servers->setValue(‘login’,’attr’,’dn’); // $servers->setValue(‘login’,’attr’,’uid’);
Update HTTPD
next, update the virtual host configuration to allow connections
sudo vim /etc/httpd/conf.d/phpldapadmin.conf ... Alias /phpldapadmin /usr/share/phpldapadmin/htdocs Alias /ldapadmin /usr/share/phpldapadmin/htdocs <Directory /usr/share/phpldapadmin/htdocs> <IfModule mod_authz_core.c> # Apache 2.4 Require all granted </IfModule> <IfModule !mod_authz_core.c> # Apache 2.2 Order Deny,Allow Deny from all Allow from 127.0.0.1 Allow from ::1 </IfModule> </Directory>
restart
~$ sudo systemctl restart httpd.service
Update firewalld
~$ sudo firewall-cmd --permanent --add-service=http ~$ sudo firewall-cmd --reload
Connect
http://<ip address/hostname>/phpldapadmin