Difference between revisions of "Debian LDAP Client Installation"
| Line 15: | Line 15: | ||
select 3 | select 3 | ||
5. Setting-up pam-utilities to change passwords | 5. Setting-up pam-utilities to change passwords | ||
| − | |||
Select Yes | Select Yes | ||
| − | |||
6. Database access | 6. Database access | ||
| − | |||
Select No | Select No | ||
| − | |||
7. Setting-up account with LDAP access priviledges Configurar la cuenta de acceso con privilegios a LDAP | 7. Setting-up account with LDAP access priviledges Configurar la cuenta de acceso con privilegios a LDAP | ||
| − | |||
cn=admin,dc=uis,dc=edu,dc=co | cn=admin,dc=uis,dc=edu,dc=co | ||
| − | |||
8. Entering the password for said account. | 8. Entering the password for said account. | ||
| Line 94: | Line 88: | ||
... | ... | ||
</nowiki></pre>}} | </nowiki></pre>}} | ||
| − | 7. | + | 7. Replace the following line in /etc/pamd.d/common-account |
| − | + | {{File|/etc/pamd.d/common-account|<pre><nowiki> | |
| − | + | ... | |
| − | + | account required pam_unix.so | |
| + | ... | ||
| + | </nowiki></pre>}} | ||
Por | Por | ||
| − | + | {{File|/etc/pamd.d/common-account|<pre><nowiki> | |
| − | + | ... | |
| − | + | account sufficient pam_unix.so | |
| − | + | account sufficient pam_ldap.so | |
| − | + | account required pam_deny.so | |
| − | 8. | + | ... |
| + | </nowiki></pre>}} | ||
| + | 8. Edit /etc/pam_ldap.conf and add the following lines | ||
{{File|/etc/pam_ldap.conf|<pre><nowiki> | {{File|/etc/pam_ldap.conf|<pre><nowiki> | ||
... | ... | ||
| Line 113: | Line 111: | ||
pam_password crypt | pam_password crypt | ||
</nowiki></pre>}} | </nowiki></pre>}} | ||
| − | 9. | + | 9. Start the nscd daemon |
{{Command|<nowiki>/etc/init.d/nscd start</nowiki>}} | {{Command|<nowiki>/etc/init.d/nscd start</nowiki>}} | ||
10. Test the setup | 10. Test the setup | ||
{{Command|<nowiki>getent passwd</nowiki>}} | {{Command|<nowiki>getent passwd</nowiki>}} | ||
| + | |||
| + | {{Note|<nowiki> | ||
| + | If the client is already set-up and you only need to modify some parameters, the procedure is as follows: | ||
| + | </nowiki>}} | ||
Revision as of 16:28, 3 September 2014
Back to LDAP
This procedure shows how to create a ldap client installation from packages.
1. First install the required packages:
An interface is shown at the end of the installation of the packages; In that interface is were the configuration parameters must be entered. 2. Server setup
ldap://192.168.66.120
3. Entering the base
dc=uis,dc=edu,dc=co
4. Setting-up the protocol version
select 3
5. Setting-up pam-utilities to change passwords
Select Yes
6. Database access
Select No
7. Setting-up account with LDAP access priviledges Configurar la cuenta de acceso con privilegios a LDAP
cn=admin,dc=uis,dc=edu,dc=co
8. Entering the password for said account.
Now to configure LDAP-PAM integration:
1. Install the required packages:
2. Edit the file /etc/libnss-ldap.conf like this:
... base dc=local,dc=net uri ldaps://ldap.local.net ldap_version 3 binddn cn=nss,ou=Admin,dc=local,dc=net bindpw COLOQUE_AQUI_LA_CLAVE scope one pam_filter objectclass=posixAccount pam_login_attribute uid pam_password crypt nss_base_passwd ou=People,dc=local,dc=net?one nss_base_shadow ou=People,dc=local,dc=net?one nss_base_group ou=Group,dc=local,dc=net?one ssl on tls_checkpeer no ...
3. Set-up the file /etc/nsswitch.conf
... passwd: files ldap shadow: files ldap group: files ldap ...
4. Add the following option to /etc/openldap/ldap.conf
... TLS_REQCERT never ...
5. Replace the following line in /etc/pamd.d/common-password
... password required pam_unix.so nullok obscure md5 ...
for
... password required pam_passwdqc.so min=disabled,16,12,8,6 max=256 password sufficient pam_unix.so use_authtok md5 password sufficient pam_ldap.so use_first_pass use_authtok md5 password required pam_deny.so ...
6) Replace the following line in /etc/pamd.d/common-auth
... auth required pam_unix.so nullok_secure ...
for
... auth sufficient pam_unix.so auth sufficient pam_ldap.so use_first_pass auth required pam_deny.so ...
7. Replace the following line in /etc/pamd.d/common-account
... account required pam_unix.so ...
Por
... account sufficient pam_unix.so account sufficient pam_ldap.so account required pam_deny.so ...
8. Edit /etc/pam_ldap.conf and add the following lines
... # lines to be added base dc=platino,dc=gov,dc=ve uri ldaps://ldap.platino.gov.ve ldap_version 3 pam_password crypt
9. Start the nscd daemon
10. Test the setup
