ldap-client cheatsheet

Two main online resources for LDAP are:

1. ldap.com
2. ldapwiki.com
3. openldap.org
4. itzgeek (from lab7 installation notes)
5. openldap admin guide

Arthur DeJong about ldapd on LDAP authentication with nss-pam-ldapd (CentOS 7)

access.redhat.com Chptr 1 Authselect on CentOS8

access.redhat.com Chpt2 SSSD on CentOS8

he authconfig utility, used in previous Red Hat Enterprise Linux versions, created and modified many different configuration files, making troubleshooting a difficult task.

Authselect makes testing and troubleshooting easy) because it only modifies files in these directories:

• /etc/nsswitch.conf
• /etc/pam.d/* files
• /etc/dconf/db/distro.d/* files

is a system of modules that handle the authentication tasks of applications (services) on the system. The nature of the authentication is dynamically configurable. The sys\admin can choose how individual service-providing applications will authenticate users. this dynamic configuration is set by the contents of the configuration files in etc/pam.d which list the PAMS that will do the authentication tasks required by this service, and the appropriate behaviour of the PAM-API in the event that individual PAMS fail.

Once the authselect profile is selected for a given host, the profile will be applied to every user logging into the host.

System admins can select a profile for the authselect utility for a specific host. The profile will be applied to every user logging into that host.

A sys admin can modify one of the default profiles, the ssd, winbind, or the nis profile as needed. You can modify any of the items in the /etc/authselect/user-nsswitch.conf file with the exception of:

• passwd
• group
• netgroup
• automount
• services

Running authselect select profile_name afterwards will result in permissible changes to the profile being transferred from /etc/authselect/user-nsswitch.conf to the /etc/nsswitch.conf file, with bad changes being overwritten by the default profile config.

DO NOT modify the /etc/nsswitch.conf file directly.

A sysadmin can create and deploy a custom profile by customizing one of the default profiles, the sssd, winbind, or the nis profile. This is particularly useful if a ready-made authselect profile” is not enough for your needs. When you deploy a custom profile, the profile is applied to every user logging into the given host.

Examples: authconfig --enableldap --enableldapauth --enablefaillock --updateall becomes authselect select sssd with-faillock

authconfig –enablesssd –enablesssdauth –enablesmartcard –smartcardmodule=sssd –updateall becomes authselect select sssd with-smartcard

authconfig --enableecryptfs --enablepamaccess --updateall becomes authselect select sssd with-ecryptfs with-pamaccess

authconfig –enablewinbind –enablewinbindauth –winbindjoin=Administrator –updateall

becomes realm join -U Administrator --client-software=winbind WINBINDDOMAIN

** Disable LDAP authentication –deprecated (authselect replaces authconfig) To disable LDAP authentication, use the following command: sudo /usr/bin/authconfig –disableldap –disableldapauth –ldapserver=ldap://your-ldap-server-name:port –ldapbasedn="dc=your-ldap-dc,dc=your-ldap-dc" –update

dnf install libsss_{nssidmap.x8664}

See man nslcd.conf(5) for list of all the available options

Minimally you need to tell nss where your ldap server resides: uri ldap://vm4.zintis.ops/

The base from which to search LDAP database base dc=andrew,dc=ops

The credentials for searching the LDAP database binddn cn=ldaproot,dc=andrew,dc=ops

The credentials with which to bind bindpw seneca99ldap

The dn to perform password modifications by root (root password modifier dn) rootpwmoddn cn=ldaproot,dc=andrew,dc=ops

Set the uid and gid optiosn to the crearted user and group uid nslcd gid ldap # examples in arthurjong.org had gid nslcd

Have to add ldap to the passwd, group and shadow maps. Maps seem to be telling auth where to look for users. For example, if you have the follwing in /etc/nsswitch.conf:

passwd: files ldap group: files ldap shaddow: files ldap

Then the authentication process will first look for user defined in passwd (through useradd) and if not found, will defer to ldap.

You will need to config these in order enable logins using BOTH LDAP and local users. You have to edit files in /etc/pam.d directory.

Everywhere that pam_unix is called you should also call pam_ldap.

Select the system identity and authentication sources.

From the man page:AUTHSELECT(8) It is a configuration tool, by selecting a specific profile. A profile is a set of files that describes how the resulting system configuration will look like. When a profile is selected, authselect will create nsswitch.conf(5) and PAM(8) stack to use identity and authentication sources.

If the provided profile set is not sufficient, the admin may create a custom profile by putting it in a special profile directory /etc/authselect/custom By doing so the profile is immediately usable by authselect.

authselect - lists all available commands authselect select –help - explains the command COMMAND authselect select –force authselect select -b backup system files before activating the selected profile authselect select –backup=NAME, stored in /var/lib/authselect/backups/NAME

authselect apply-changes re-apply currently selected profile. Will work if the existing configuration is a valid authselect configuration. Otherwise an error is returned. authselect apply-changes -b backup system files before applying changes authselect apply-changes –backup=NAME ditto as in select

authselect list list available profiles authselect show profile_id print info about profile authselect requirements profile_id # info about profile requirements authselect current # print info about currrently selected profile authselect check # is current profile valid? authselect test profile_id # print contents of files generated by authselect without actually making any changes.

-a all files -n print nsswitch.conf content -s print system-auth content -p print password-auth content -c print smartcard-auth content -o print postlogin content -d print dconf database content -l print dconf lock content

authselect create-profile NAME # a new custom profile is created. (see man)

2.1. An OpenLDAP client using SSSD to retrieve data from LDAP in an encrypted way. The System Security Services Daemon (SSSD) is a daemon that manages identity data retrieval and authentication on a RHEL 8 host. A system administrator can configure the SSSD on the host to use a standalone LDAP server database as the user account database. Examples of an LDAP server include the OpenLDAP server and the Red Hat 389 Directory Server. In this chapter, the scenario also includes the requirement that the connection with the LDAP server must be encrypted with a TLS certificate.

The authentication method of the LDAP objects can be either a Kerberos password or an LDAP password. Note that the questions of authentication and authorization of the LDAP objects are not addressed in this chapter.

Configure the LDAP client by using sssd. The sssd configuration is located at /etc/sssd/sssd.conf. Examples of sssd.conf: [sssd] config_fileversion = 2 services = nss, pam domains = default

[nss] filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd

[pam]

[domain/default] auth_provider = ldap id_provider = ldap ldap_schema = rfc2307 ldap_searchbase = ou=im,dc=example,dc=com ldap_groupmember = memberuid ldap_tlsreqcert = never ldap_{idusestarttls} = False chpass_provider = ldap ldap_uri = ldap://ldap.example.com:389/ ldap_tlscacertdir = /etc/openldap/cacerts entry_cachetimeout = 600 ldap_{networktimeout} = 3 #ldap_accessfilter = (&(object)(object)) ldap_{defaultbinddn} = cn=Manager,ou=im,dc=example,dc=com ldap_{defaultauthtoktype} = password ldap_{defaultauthtok} = YOUR_PASSWORD cache_credentials = True enumerate=true

OpenLDAP provides not only a server, but also a client, openldap-clients This package includes the following command line utilities

• ldapadd: Adds entries to an LDAP directory either from a file or from standard input.
• ldapmodify: Modifies entries in an LDAP directory [ ldapmodify -a is identical to ldapadd. ]
• ldapcompare: Compares a given attribute with an LDAP directory entry
• ldapdelete: Deletes entries from an LDAP directory
• ldapexop: Performs extended LDAP operations
• ldapmodrdn: Modifies the RDN value of an LDAP directory entry
• ldappasswd: Is a password utility for an LDAP user
• ldapsearch: Is an LDAP directory search tool
• ldapurl: Is an LDAP URL formatting tool
• ldapwhoami: Performs a whoami operation on an LDAP server

There are also several GUI LDAP clients. Use at your own risk.

dn: uid=zintis,ou=People,dc=andrew,dc=ops
uid: zintis
cn: zintis
sn: zintis
mail: zintis@zintis.ops
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: {crypt}$6$mjRyTHR5$ARM0BM7g1dPc422iHK3BGVHqcXVty0FETrE6yj/N47sudpjivy0ExxSNpvzW.
shadowLastChange: 18348
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
loginShell: /bin/bash
uidNumber: 10000
gidNumber: 10000
homeDirectory: /home/zintis

slapcat
5e80f53b The first database does not allow slapcat; using the first available one (2)
dn: dc=andrew,dc=ops
dc: andrew
objectClass: top
objectClass: domain
structuralObjectClass: domain
entryUUID: 0192e632-da18-1038-83ca-ef40d5fa4d01
creatorsName: cn=ldaproot,dc=andrew,dc=ops
createTimestamp: 20190313201201Z
entryCSN: 20190313201201.126862Z#000000#000#000000
modifiersName: cn=ldaproot,dc=andrew,dc=ops
modifyTimestamp: 20190313201201Z

dn: cn=ldaproot,dc=andrew,dc=ops
objectClass: organizationalRole
cn: ldaproot
description: LDAP Manager
structuralObjectClass: organizationalRole
entryUUID: 019a13f8-da18-1038-83cb-ef40d5fa4d01
creatorsName: cn=ldaproot,dc=andrew,dc=ops
createTimestamp: 20190313201201Z
entryCSN: 20190313201201.174170Z#000000#000#000000
modifiersName: cn=ldaproot,dc=andrew,dc=ops
modifyTimestamp: 20190313201201Z

dn: ou=People,dc=andrew,dc=ops
objectClass: organizationalUnit
ou: People
structuralObjectClass: organizationalUnit
entryUUID: 01a1a870-da18-1038-83cc-ef40d5fa4d01
creatorsName: cn=ldaproot,dc=andrew,dc=ops
createTimestamp: 20190313201201Z
entryCSN: 20190313201201.223848Z#000000#000#000000
modifiersName: cn=ldaproot,dc=andrew,dc=ops
modifyTimestamp: 20190313201201Z

dn: ou=Group,dc=andrew,dc=ops
objectClass: organizationalUnit
ou: Group
structuralObjectClass: organizationalUnit
entryUUID: 01ac22f0-da18-1038-83cd-ef40d5fa4d01
creatorsName: cn=ldaproot,dc=andrew,dc=ops
createTimestamp: 20190313201201Z
entryCSN: 20190313201201.292521Z#000000#000#000000
modifiersName: cn=ldaproot,dc=andrew,dc=ops
modifyTimestamp: 20190313201201Z

dn: uid=john,ou=People,dc=andrew,dc=ops
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: john
uid: john
uidNumber: 9999
gidNumber: 100
homeDirectory: /home/john
loginShell: /bin/bash
gecos: John Someone
shadowLastChange: 17058
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
structuralObjectClass: account
entryUUID: bfa78756-da1b-1038-83d1-ef40d5fa4d01
creatorsName: cn=ldaproot,dc=andrew,dc=ops
createTimestamp: 20190313203848Z
userPassword:: e1NTSEF9a0ljTGtXdVkxNXBQL0labDN3TklBaE5MSm94cWU4ZVQ=
entryCSN: 20190709215232.858989Z#000000#000#000000
modifiersName: cn=ldaproot,dc=andrew,dc=ops
modifyTimestamp: 20190709215232Z

This ldapusers.ldif file had and error that shows up with error: "no global superior knowledge"

root@vm4~[604]$ 
ldapadd -v -f ldapusers.ldif -D cn="ldaproot,dc=zintis,dc=ops" -W 
ldap_initialize( <DEFAULT> )
Enter LDAP Password: seneca99ldap
add uid:
     zintis
add cn:
     zintis
add sn:
     zintis
add mail:
     zintis@zintis.ops
add objectClass:
     person
     organizationalPerson
     inetOrgPerson
     posixAccount
     top
     shadowAccount
add userPassword:
     {crypt}$6$mjRyTHR5$ARM0hiRWKGdBM7g1dPc422i4Ut9TQ7HKty0FETrE6yj/NxudpjitlrhkNpvzW.
add shadowLastChange:
     18348
add shadowMin:
     0
add shadowMax:
     99999
add shadowWarning:
     7
add loginShell:
     /bin/bash
add uidNumber:
     10000
add gidNumber:
     10000
add homeDirectory:
     /home/zintis
adding new entry "uid=zintis,ou=People,dc=zintis,dc=op"s
ldap_add: Server is unwilling to perform (53)
     additional info: no global superior knowledge

root@vm4~[604]$ 

The error above occurs because we were trying to add entries specified for the zintis.ops tree, where the tree was actually andrew.ops.

Fix was to correct the config file in : /usr/share/migrationtools/migrate-passwd.pl so that the migrate_passwd step would generate ldif data correctly (i.e. dc=andrew,dc=ops)

This specific error means that slapd doesn't know where to put the new entry. This typically means that you have not defined an appropriate database, or you have made a typo in the higher in the tree. With newer systems (ones using cn=config instead of slapd.conf), you would typically first add a new database or modify an existing database entry using ldapadd or ldapmodify.

For example, let's say you are trying to add "uid=zintis,ou=People,dc=zintis,dc=ops" But you are in a tree with dc=zint,dc=ops slapd cannot find the root tree dc=zint,dc=ops so it says "No superior knowledge".

useradd zintis -u 10000
useradd -c "Jane Greystoke" jane -u 10001
useradd -c "Andrew's Guests" guest -u 10002

if user jane already exists, delete her with userdel jane
also chown her mailbox with chown jane /var/spool/mail/jane
And delete /var/spool/mail/andrew

grep -w zintis /etc/passwd > /root/zintis.entry
grep -w Jane /etc/passwd > /root/jane.entry
grep -w Andrew /etc/passwd > /root/guest.entry

/usr/share/migrationtools/migrate_passwd.pl /root/zintis.entry /root/zintis.ldif
/usr/share/migrationtools/migrate_passwd.pl /root/jane.entry /root/jane.ldif
/usr/share/migrationtools/migrate_passwd.pl /root/guest.entry /root/guest.ldif

ldapadd -v -f ldapusers.ldif -D cn="ldaproot,dc=andrew,dc=ops" -W 
ldapadd -v -f jane.ldif -D cn="ldaproot,dc=andrew,dc=ops" -W 
ldapadd -v -f guest.ldif -D cn="ldaproot,dc=andrew,dc=ops" -W 

slapcat shows user John as:

dn: uid=john,ou=People,dc=andrew,dc=ops
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: john
uid: john
uidNumber: 9999
gidNumber: 100
homeDirectory: /home/john
loginShell: /bin/bash
gecos: John Someone
shadowLastChange: 17058
shadowMin: 0
shadowMax: 99999
shadowWarning: 7
structuralObjectClass: account
entryUUID: bfa78756-da1b-1038-83d1-ef40d5fa4d01
creatorsName: cn=ldaproot,dc=andrew,dc=ops
createTimestamp: 20190313203848Z
userPassword:: e1NTSEF9a0ljTGtXdVkxNXBQL0labDN3TklBaE5MSm94cWU4ZVQ=
entryCSN: 20190709215232.858989Z#000000#000#000000
modifiersName: cn=ldaproot,dc=andrew,dc=ops
modifyTimestamp: 20190709215232Z

This is PAM the "Pluggable Authentication Module" and NSS the "Name Service Switch"

yum install -y openldap-clients nss-pam-ldapd Since CentOS8 does not see nss-pam-ldap I did the following:

First: dnf provides nss-pam-ldapd Then, based on the above this: dnf install -y nss-pam-ldapd-0.9.9-3.el8.x86₆₄

From arthurdejong.org: This is nss-pam-ldapd which provides a Name Service Switch (NSS, nsswitch) module that allows your LDAP server to provide user account, group, host name, alias, netgroup, and basically any other information that you would normally get from /etc flat files or NIS. It also provides a Pluggable Authentication Module (PAM) to do identity and authentication management with an LDAP server on unix systems.

This is implemented using thin NSS and PAM modules which delegate to a dedicated service (nslcd) that queries the LDAP server with persistent connections, authentication, attribute translation, etc.

The NSS module was originally a fork of nss_ldap with some structural design improvements. The most important features of nss-pam-ldapd are:

• light and simple NSS and PAM libraries
• avoid loading LDAP and SSL libraries in all programs
• separation between NSS, PAM and LDAP code
• fewer connections to the LDAP server
• better debugging possibilities
• better performance
• See the documentation section for more detai

Configure the client VM to use LDAP To add the client machine to LDAP server for single sign-on. Replace “192.168.1.10” with your LDAP server’s IP address or hostname.

authconfig –enableldap –enableldapauth –ldapserver=192.168.1.10 –ldapbasedn="dc=itzgeek,dc=local" –enablemkhomedir –update

Restart the LDAP client service. O.K, so this will make this VM defer logins to the LDAP server rather than looking in its own /etc/passwd file ??? That would mean that the users defined in the ldap server would require a local prescence on this VM, including home directory, and entry in /etc/passwds. I guess this is just centralizing the passwords themselves I guess?? Confirm this!

systemctl restart nslcd To verify LDAP Login, use the getent command to get the LDAP entries from the LDAP server.

getent passwd raj Output:

raj:x:9999:100:Raj [Admin (at) ITzGeek]:/home/raj:/bin/bash Screenshot:

OpenLDAP Server Configuration on CentOS 7 - Verify LDAP Login OpenLDAP Server Configuration on CentOS 7 – Verify LDAP Login

To verify the LDAP, log in using the LDAP user “raj” on the client machine. Like this: