Difference between revisions of "OpenLDAP Server in container"

From OpenVZ Virtuozzo Containers Wiki
Jump to: navigation, search
(fix formatting/wording)
(html -> wiki formatting, lots of formatting fixes)
Line 1: Line 1:
<h3>Step by Step Installation and Configuration OpenLDAP Server</h3>
+
Step by Step Installation and Configuration OpenLDAP Server
<b>By Ganesh (ganesh35@gmail.com)</b>
 
  
 
Software: OS-Cent OS 4.4, openldap 2.2.13-6.4E<br>
 
Software: OS-Cent OS 4.4, openldap 2.2.13-6.4E<br>
Line 6: Line 5:
 
Domain name: adminmart.com<br>
 
Domain name: adminmart.com<br>
 
System IP: 192.168.1.212<br>
 
System IP: 192.168.1.212<br>
<br>
 
<b>Note:</b> Use your domain name and IP instead of adminmart<br>
 
<br>
 
  
=== Create container with OpenLDAP ===
+
'''Note:''' Use your domain name and IP instead of adminmart
 +
 
 +
== Create container with OpenLDAP ==
 
Create a container with the following settings:
 
Create a container with the following settings:
 
* ctid: 212
 
* ctid: 212
Line 29: Line 27:
 
     vzyum 212 install *openldap* -y
 
     vzyum 212 install *openldap* -y
  
<h3>Configuration of OpenLDAP Server</h3>
+
== Configuration of OpenLDAP Server ==
<b>Easy steps for adding users:</b>
+
Easy steps for adding users:
1. Create unix user<br>
+
# Create unix user
2. Create unix user's ldap passwd file<br>
+
# Create unix user's ldap passwd file
3. Convert passwd.file to ldif file<br>
+
# Convert passwd.file to ldif file
4. Add ldap file to LDAP Directory using ldapadd<br>
+
# Add ldap file to LDAP Directory using ldapadd
<h4>Step #1. Requirements</h4>
+
 
compat-openldap.i386 0:2.1.30-6.4E<br>
+
=== Requirements ===
openldap-clients.i386 0:2.2.13-6.4E<br>
+
compat-openldap.i386 0:2.1.30-6.4E
openldap-devel.i386 0:2.2.13-6.4E<br>
+
openldap-clients.i386 0:2.2.13-6.4E
openldap-servers.i386 0:2.2.13-6.4E<br>
+
openldap-devel.i386 0:2.2.13-6.4E
openldap-servers-sql.i386 0:2.2.13-6.4E<br>
+
openldap-servers.i386 0:2.2.13-6.4E
<br>
+
openldap-servers-sql.i386 0:2.2.13-6.4E
<br>
+
 
You can install them using the command:<br>
+
You can install them using the command:
<br>
+
 
     yum install *openldap* -y <br>
+
     yum install *openldap* -y
  
<h4>Step #2. Start the service</h4>
+
=== Start the service ===
<code>
+
 
     [root@ldap ~]# chkconfig --levels 235 ldap on<br>
+
     [root@ldap ~]# chkconfig --levels 235 ldap on
 
     [root@ldap ~]# service ldap start <br>
 
     [root@ldap ~]# service ldap start <br>
</code>
+
 
<h4>Step #3. Create LDAP root user password</h4>
+
=== Create LDAP root user password ===
<code>
+
 
     [root@ldap ~]# slappasswd<br>
+
     [root@ldap ~]# slappasswd
     New password:<br>
+
     New password:
     Re-enter new password:<br>
+
     Re-enter new password:
     {SSHA}cWB1VzxDXZLf6F4pwvyNvApBQ8G/DltW<br>
+
     {SSHA}cWB1VzxDXZLf6F4pwvyNvApBQ8G/DltW
 
     [root@ldap ~]#
 
     [root@ldap ~]#
</code>
 
   
 
<h4>Step #4. Update /etc/openldap/slapd.conf for the root password</h4>
 
<code>
 
    [root@ldap ~]# vi /etc/openldap/slapd.conf<br>
 
    #68 database bdb<br>
 
    #69 suffix "dc=adminmart,dc=com"<br>
 
    #70 rootdn "cn=Manager,dc=adminmart,dc=com"<br>
 
    #71 rootpw {SSHA}cWB1VzxDXZLf6F4pwvyNvApBQ8G/DltW</code>
 
  
<h4>Step #5. Apply Changes</h4>
+
=== Update /etc/openldap/slapd.conf for the root password ===
<code>
+
 
 +
    [root@ldap ~]# vi /etc/openldap/slapd.conf
 +
    #68 database bdb
 +
    #69 suffix "dc=adminmart,dc=com"
 +
    #70 rootdn "cn=Manager,dc=adminmart,dc=com"
 +
    #71 rootpw {SSHA}cWB1VzxDXZLf6F4pwvyNvApBQ8G/DltW
 +
 
 +
=== Apply Changes ===
 +
 
 
     [root@ldap ~]# service ldap restart
 
     [root@ldap ~]# service ldap restart
</code>
 
  
<h4>Step #6. Create test users</h4>
+
=== Create test users ===
<code>
 
    [root@ldap ~]# useradd test1<br>
 
    [root@ldap ~]# passwd test1<br>
 
    Changing password for user test1.<br>
 
    New UNIX password:<br>
 
    Retype new UNIX password:<br>
 
    passwd: all authentication tokens updated successfully.<br>
 
    [root@ldap ~]# useradd test2<br>
 
    [root@ldap ~]# passwd test2<br>
 
    Changing password for user test2.<br>
 
    New UNIX password:<br>
 
    Retype new UNIX password:<br>
 
    passwd: all authentication tokens updated successfully.<br>
 
    [root@ldap ~]#<br>
 
    </code><br>
 
<b>Note:</b> Repeat the same for the rest of users <br>
 
  
<h4>Step #7. Migrate local users to LDAP</h4>
+
    [root@ldap ~]# useradd test1
<code>
+
     [root@ldap ~]# passwd test1
     [root@ldap ~]# grep root /etc/passwd > /etc/openldap/passwd.root<br>
+
    Changing password for user test1.
     [root@ldap ~]# grep test1 /etc/passwd > /etc/openldap/passwd.test1<br>
+
    New UNIX password:
     [root@ldap ~]# grep test2 /etc/passwd > /etc/openldap/passwd.test2<br>
+
    Retype new UNIX password:
</code><br>
+
    passwd: all authentication tokens updated successfully.
<b>Note:</b> Repeat the same for the rest of users<br>
+
     [root@ldap ~]# useradd test2
 +
     [root@ldap ~]# passwd test2
 +
    Changing password for user test2.
 +
    New UNIX password:
 +
    Retype new UNIX password:
 +
    passwd: all authentication tokens updated successfully.
 +
    [root@ldap ~]#
  
<h4>Step #8. Update default settings on file /usr/share/openldap/migration/migrate_common.ph</h4>
+
'''Note:''' Repeat the same for the rest of users.
    #71 $DEFAULT_MAIL_DOMAIN = "adminmart.com";<br>
 
    #74 $DEFAULT_BASE = "dc=adminmart,dc=com";<br>
 
  
<h4>Step #9. Convert passwd.file to ldif (LDAP Data Interchange Format) file </h4>
+
=== Migrate local users to LDAP ===
<code>
 
    [root@ldap ~]# /usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.root /etc/openldap/root.ldif<br>
 
    [root@ldap ~]# /usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.test1 /etc/openldap/test1.ldif<br>
 
    [root@ldap ~]# /usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.test2 /etc/openldap/test2.ldif<br>
 
</code><br>
 
<b>Note:</b> Repeat the same for the rest of users<br>
 
  
<h4>Step #10. Update root.ldif file for the "Manager" of LDAP Server </h4>
+
     [root@ldap ~]# grep root /etc/passwd > /etc/openldap/passwd.root
<code>
+
     [root@ldap ~]# grep test1 /etc/passwd > /etc/openldap/passwd.test1
     [root@ldap ~]# vi /etc/openldap/root.ldif<br>
+
     [root@ldap ~]# grep test2 /etc/passwd > /etc/openldap/passwd.test2
    #1 dn: uid=root,ou=People,dc=adminmart,dc=com<br>
 
     #2 uid: root<br>
 
    #3 cn: Manager<br>
 
    #4 objectClass: account<br>
 
</code>
 
<h4>Step #11. Create a domain ldif file (/etc/openldap/adminmart.com.ldif)</h4>
 
<code>
 
     [root@ldap ~]# cat /etc/openldap/adminmart.com.ldif<br>
 
    dn: dc=adminmart,dc=com<br>
 
    dc: adminmart<br>
 
    description: LDAP Admin<br>
 
    objectClass: dcObject<br>
 
    objectClass: organizationalUnit<br>
 
    ou: rootobject<br>
 
    <br>
 
    dn: ou=People, dc=adminmart,dc=com<br>
 
    ou: People<br>
 
    description: Users of adminmart<br>
 
    objectClass: organizationalUnit<br>
 
</code>   
 
<h4>Step #12. Import all users in to the LDAP</h4>
 
<b>Add the Domain ldif file </b><br>
 
<br>
 
<code>
 
  
    [root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f /etc/openldap/adminmart.com.ldif<br>
+
'''Note:''' Repeat the same for the rest of users.
    Enter LDAP Password:<br>
 
    adding new entry "dc=adminmart,dc=com"<br>
 
    adding new entry "ou=People, dc=adminmart,dc=com"<br>
 
    [root@ldap ~]#<br>
 
</code><br>
 
<br>
 
<b>Add the Users</b><br>
 
<br>
 
<code>
 
    [root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f /etc/openldap/root.ldif<br>
 
    Enter LDAP Password:<br>
 
    adding new entry "uid=root,ou=People,dc=adminmart,dc=com"<br>
 
    adding new entry "uid=operator,ou=People,dc=adminmart,dc=com"<br>
 
    [root@ldap ~]#<br>
 
    <br>
 
    [root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f /etc/openldap/test1.ldif<br>
 
    Enter LDAP Password:<br>
 
    adding new entry "uid=test1,ou=People,dc=adminmart,dc=com"<br>
 
    [root@ldap ~]#<br>
 
    <br>
 
    [root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f /etc/openldap/test2.ldif<br>
 
    Enter LDAP Password:<br>
 
    adding new entry "uid=test2,ou=People,dc=adminmart,dc=com"<br>
 
    [root@ldap ~]#<br>
 
</code><br>
 
<b>Note:</b> Repeat the same for the rest of users<br>
 
  
<h4>Step #13. Apply Changes </h4>
+
=== Update default settings on file /usr/share/openldap/migration/migrate_common.ph ===
<code>
+
 
     [root@ldap ~]# service ldap restart</code> <br>
+
    #71 $DEFAULT_MAIL_DOMAIN = "adminmart.com";
 +
    #74 $DEFAULT_BASE = "dc=adminmart,dc=com";
 +
 
 +
=== Convert passwd.file to ldif (LDAP Data Interchange Format) file ===
 +
 
 +
    [root@ldap ~]# /usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.root /etc/openldap/root.ldif
 +
    [root@ldap ~]# /usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.test1 /etc/openldap/test1.ldif
 +
    [root@ldap ~]# /usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.test2 /etc/openldap/test2.ldif
 +
 
 +
'''Note:''' Repeat the same for the rest of users.
 +
 
 +
=== Update root.ldif file for the "Manager" of LDAP Server ===
 +
 
 +
    [root@ldap ~]# vi /etc/openldap/root.ldif
 +
    #1 dn: uid=root,ou=People,dc=adminmart,dc=com
 +
    #2 uid: root
 +
    #3 cn: Manager
 +
    #4 objectClass: account
 +
 
 +
=== Create a domain ldif file (/etc/openldap/adminmart.com.ldif) ===
 +
 
 +
    [root@ldap ~]# cat /etc/openldap/adminmart.com.ldif
 +
    dn: dc=adminmart,dc=com
 +
    dc: adminmart
 +
    description: LDAP Admin
 +
    objectClass: dcObject
 +
    objectClass: organizationalUnit
 +
    ou: rootobject
 +
 
 +
    dn: ou=People, dc=adminmart,dc=com
 +
    ou: People
 +
    description: Users of adminmart
 +
    objectClass: organizationalUnit
 +
 
 +
=== Import all users in to the LDAP ===
 +
 
 +
Add the Domain ldif file:
 +
 
 +
    [root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f /etc/openldap/adminmart.com.ldif
 +
    Enter LDAP Password:
 +
    adding new entry "dc=adminmart,dc=com"
 +
    adding new entry "ou=People, dc=adminmart,dc=com"
 +
    [root@ldap ~]#
 +
 
 +
Add the Users:
 +
 
 +
    [root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f /etc/openldap/root.ldif
 +
    Enter LDAP Password:
 +
    adding new entry "uid=root,ou=People,dc=adminmart,dc=com"
 +
    adding new entry "uid=operator,ou=People,dc=adminmart,dc=com"
 +
    [root@ldap ~]#
 +
 
 +
    [root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f /etc/openldap/test1.ldif
 +
    Enter LDAP Password:
 +
    adding new entry "uid=test1,ou=People,dc=adminmart,dc=com"
 +
    [root@ldap ~]#
 +
 
 +
    [root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f /etc/openldap/test2.ldif
 +
    Enter LDAP Password:
 +
    adding new entry "uid=test2,ou=People,dc=adminmart,dc=com"
 +
    [root@ldap ~]#
 +
 
 +
'''Note:''' Repeat the same for the rest of users.
 +
 
 +
=== Apply Changes ===
 +
 
 +
     [root@ldap ~]# service ldap restart
 +
 
 +
=== Test LDAP Server ===
  
<h4>Step #14. Test LDAP Server</h4>
 
 
It prints all the user information<br>
 
It prints all the user information<br>
<br>
+
     [root@ldap ~]# ldapsearch -x -b 'dc=adminmart,dc=com' '(objectclass=*)'
<code>
+
 
     [root@ldap ~]# ldapsearch -x -b 'dc=adminmart,dc=com' '(objectclass=*)'</code> <br>
+
== LDAP Client Configuration ==
<br>
+
 
<br>
+
     [root@ldapclient ~]# authconfig
<h3>LDAP Client Configuration</h3>
+
 
<code>
+
:: [*] Use LDAP [*] Use LDAP Authentication
     [root@ldapclient ~]# authconfig </code><br>
+
[Both should be checked
<b> [*] Use LDAP [*] Use LDAP Authentication </b><br>
+
 
<br>
+
:: [ ] Use TLS    <br>
[Both should be checked]<br>
+
:: Server: ldap.adminmart.com<br>
<br>
+
:: Base DN: dc=adminmart,dc=com
<b> [ ] Use TLS    <br>
+
 
Server: ldap.adminmart.com<br>
 
Base DN: dc=adminmart,dc=com<br>
 
</b><br>
 
<br>
 
 
[[Category:HOWTO]]
 
[[Category:HOWTO]]

Revision as of 09:03, 9 April 2008

Step by Step Installation and Configuration OpenLDAP Server

Software: OS-Cent OS 4.4, openldap 2.2.13-6.4E
System name: ldap.adminmart.com
Domain name: adminmart.com
System IP: 192.168.1.212

Note: Use your domain name and IP instead of adminmart

Create container with OpenLDAP

Create a container with the following settings:

  • ctid: 212
  • IP address: 192.168.1.212
  • name: ldap
  • hostname: ldap

Run these commands on the hardware node:

   vzctl create 212 --ostemplate centos-4-i386-minimal
   vzctl set 212 --ipadd 192.168.1.212 --save
   vzctl set 212 --nameserver 202.88.156.6 --save
   vzctl set 212 --onboot yes --save
   vzctl set 212 --userpasswd root:changeme --save
   vzctl set 212 --name ldap --save
   vzctl set 212 --hostname ldap --save
   vzctl start 212
   vzyum 212 install *openldap* -y

Configuration of OpenLDAP Server

Easy steps for adding users:

  1. Create unix user
  2. Create unix user's ldap passwd file
  3. Convert passwd.file to ldif file
  4. Add ldap file to LDAP Directory using ldapadd

Requirements

compat-openldap.i386 0:2.1.30-6.4E
openldap-clients.i386 0:2.2.13-6.4E
openldap-devel.i386 0:2.2.13-6.4E
openldap-servers.i386 0:2.2.13-6.4E
openldap-servers-sql.i386 0:2.2.13-6.4E

You can install them using the command:

   yum install *openldap* -y

Start the service

   [root@ldap ~]# chkconfig --levels 235 ldap on
   [root@ldap ~]# service ldap start 

Create LDAP root user password

   [root@ldap ~]# slappasswd
   New password:
   Re-enter new password:
   {SSHA}cWB1VzxDXZLf6F4pwvyNvApBQ8G/DltW
   [root@ldap ~]#

Update /etc/openldap/slapd.conf for the root password

   [root@ldap ~]# vi /etc/openldap/slapd.conf
   #68 database bdb
   #69 suffix "dc=adminmart,dc=com"
   #70 rootdn "cn=Manager,dc=adminmart,dc=com"
   #71 rootpw {SSHA}cWB1VzxDXZLf6F4pwvyNvApBQ8G/DltW

Apply Changes

   [root@ldap ~]# service ldap restart

Create test users

   [root@ldap ~]# useradd test1
   [root@ldap ~]# passwd test1
   Changing password for user test1.
   New UNIX password:
   Retype new UNIX password:
   passwd: all authentication tokens updated successfully.
   [root@ldap ~]# useradd test2
   [root@ldap ~]# passwd test2
   Changing password for user test2.
   New UNIX password:
   Retype new UNIX password:
   passwd: all authentication tokens updated successfully.
   [root@ldap ~]#

Note: Repeat the same for the rest of users.

Migrate local users to LDAP

   [root@ldap ~]# grep root /etc/passwd > /etc/openldap/passwd.root
   [root@ldap ~]# grep test1 /etc/passwd > /etc/openldap/passwd.test1
   [root@ldap ~]# grep test2 /etc/passwd > /etc/openldap/passwd.test2

Note: Repeat the same for the rest of users.

Update default settings on file /usr/share/openldap/migration/migrate_common.ph

   #71 $DEFAULT_MAIL_DOMAIN = "adminmart.com";
   #74 $DEFAULT_BASE = "dc=adminmart,dc=com";

Convert passwd.file to ldif (LDAP Data Interchange Format) file

   [root@ldap ~]# /usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.root /etc/openldap/root.ldif
   [root@ldap ~]# /usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.test1 /etc/openldap/test1.ldif
   [root@ldap ~]# /usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.test2 /etc/openldap/test2.ldif

Note: Repeat the same for the rest of users.

Update root.ldif file for the "Manager" of LDAP Server

   [root@ldap ~]# vi /etc/openldap/root.ldif
   #1 dn: uid=root,ou=People,dc=adminmart,dc=com
   #2 uid: root
   #3 cn: Manager
   #4 objectClass: account

Create a domain ldif file (/etc/openldap/adminmart.com.ldif)

   [root@ldap ~]# cat /etc/openldap/adminmart.com.ldif
   dn: dc=adminmart,dc=com
   dc: adminmart
   description: LDAP Admin
   objectClass: dcObject
   objectClass: organizationalUnit
   ou: rootobject
   dn: ou=People, dc=adminmart,dc=com
   ou: People
   description: Users of adminmart
   objectClass: organizationalUnit

Import all users in to the LDAP

Add the Domain ldif file:

   [root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f /etc/openldap/adminmart.com.ldif
   Enter LDAP Password:
   adding new entry "dc=adminmart,dc=com"
   adding new entry "ou=People, dc=adminmart,dc=com"
   [root@ldap ~]#

Add the Users:

   [root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f /etc/openldap/root.ldif
   Enter LDAP Password:
   adding new entry "uid=root,ou=People,dc=adminmart,dc=com"
   adding new entry "uid=operator,ou=People,dc=adminmart,dc=com"
   [root@ldap ~]#
   [root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f /etc/openldap/test1.ldif
   Enter LDAP Password:
   adding new entry "uid=test1,ou=People,dc=adminmart,dc=com"
   [root@ldap ~]#
   [root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f /etc/openldap/test2.ldif
   Enter LDAP Password:
   adding new entry "uid=test2,ou=People,dc=adminmart,dc=com"
   [root@ldap ~]#

Note: Repeat the same for the rest of users.

Apply Changes

   [root@ldap ~]# service ldap restart

Test LDAP Server

It prints all the user information

   [root@ldap ~]# ldapsearch -x -b 'dc=adminmart,dc=com' '(objectclass=*)'

LDAP Client Configuration

   [root@ldapclient ~]# authconfig
[*] Use LDAP [*] Use LDAP Authentication

[Both should be checked

[ ] Use TLS
Server: ldap.adminmart.com
Base DN: dc=adminmart,dc=com