ldap-client cheatsheet

Two main online resources for LDAP are:

1. ldap.com
2. ldapwiki.com
3. openldap.org
4. itzgeek (from lab7 installation notes)
5. openldap admin guide

Arther DeJong on ldapd on LDAP authentication with nss-pam-ldapd (CentOS 7)

access.redhat.com Chptr 1 Authselect on CentOS8

access.redhat.com Chpt2 SSSD on CentOS8

The authconfig utility, used in previous Red Hat Enterprise Linux versions, created and modified many different configuration files, making troubleshooting a difficult task.

Authselect makes testing and troubleshooting easy) because it only modifies files in these directories:

• /etc/nsswitch.conf
• /etc/pam.d/* files
• /etc/dconf/db/distro.d/* files

is a system of modules that handle the authentication tasks of applications (services) on the system. The nature of the authentication is dynamically configurable. The sys\admin can choose how individual service-providing applications will authenticate users. this dynamic configuration is set by the contents of the configuration files in etc/pam.d which list the PAMS that will do the authentication tasks required by this service, and the appropriate behaviour of the PAM-API in the event that individual PAMS fail.

Once the authselect profile is selected for a given host, the profile will be applied to every user logging into the host.

System admins can select a profile for the authselect utility for a specific host. The profile will be applied to every user logging into that host.

/etc/authselect/user-nsswitch.conf

A sys admin can modify one of the default profiles, the ssd, winbind, or the nis profile as needed. You can modify any of the items in the /etc/authselect/user-nsswitch.conf file with the exception of:

• passwd
• group
• netgroup
• automount
• services

Running authselect select profile_name afterwards will result in permissible changes to the profile being transferred from /etc/authselect/user-nsswitch.conf to the /etc/nsswitch.conf file, with bad changes being overwritten by the default profile config.

DO NOT modify the /etc/nsswitch.conf file directly.

A sysadmin can create and deploy a custom profile by customizing one of the default profiles, the sssd, winbind, or the nis profile. This is particularly useful if a ready-made authselect profile” is not enough for your needs. When you deploy a custom profile, the profile is applied to every user logging into the given host.

Examples: authconfig --enableldap --enableldapauth --enablefaillock --updateall becomes authselect select sssd with-faillock

authconfig –enablesssd –enablesssdauth –enablesmartcard –smartcardmodule=sssd –updateall becomes authselect select sssd with-smartcard

authconfig --enableecryptfs --enablepamaccess --updateall becomes authselect select sssd with-ecryptfs with-pamaccess

authconfig –enablewinbind –enablewinbindauth –winbindjoin=Administrator –updateall

becomes realm join -U Administrator --client-software=winbind WINBINDDOMAIN

Users and groups that are defined in an LDAP server can log in to your system. Whether a user is known to the system, is managed through an NSS module and the authentication is done with a PAM module.

On CentOS8 or RHEL:

• The RHEL system uses an OpenLDAP server as the user account database.
• The RHEL system uses the System Security Services Daemon (SSSD) as the service responsible for retrieving the user data.
• The RHEL system uses a TLS certificate to encrypt the connection with the OpenLDAP server. (optionally?)
• The host you want to become a client of the OpenLDAP server needs to configure /etc/sssd/sssd.conf to specify ldap as the autofs_provider and the id_provider.

** Disable LDAP authentication –deprecated (authselect replaces authconfig) To disable LDAP authentication, use the following command: sudo /usr/bin/authconfig –disableldap –disableldapauth –ldapserver=ldap://your-ldap-server-name:port –ldapbasedn="dc=your-ldap-dc,dc=your-ldap-dc" –update

dnf install libsss_{nssidmap.x8664}

See man nslcd.conf(5) for list of all the available options

Minimally you need to tell nss where your ldap server resides: uri ldap://vm4.zintis.ops/

The base from which to search LDAP database base dc=andrew,dc=ops

The credentials for searching the LDAP database binddn cn=ldaproot,dc=andrew,dc=ops

The credentials with which to bind bindpw seneca99ldap

The dn to perform password modifications by root (root password modifier dn) rootpwmoddn cn=ldaproot,dc=andrew,dc=ops

Set the uid and gid optiosn to the crearted user and group uid nslcd gid ldap # examples in arthurjong.org had gid nslcd

Have to add ldap to the passwd, group and shadow maps. Maps seem to be telling auth where to look for users. For example, if you have the follwing in /etc/nsswitch.conf:

passwd: files ldap group: files ldap shaddow: files ldap

Then the authentication process will first look for user defined in passwd (through useradd) and if not found, will defer to ldap.

You will need to config these in order enable logins using BOTH LDAP and local users. You have to edit files in /etc/pam.d directory.

Everywhere that pam_unix is called you should also call pam_ldap.

Select the system identity and authentication sources.

From the man page:AUTHSELECT(8) It is a configuration tool, by selecting a specific profile. A profile is a set of files that describes how the resulting system configuration will look like. When a profile is selected, authselect will create nsswitch.conf(5) and PAM(8) stack to use identity and authentication sources.

If the provided profile set is not sufficient, the admin may create a custom profile by putting it in a special profile directory /etc/authselect/custom By doing so the profile is immediately usable by authselect.

authselect - lists all available commands authselect select –help - explains the command COMMAND authselect select –force authselect select -b backup system files before activating the selected profile authselect select –backup=NAME, stored in /var/lib/authselect/backups/NAME

authselect apply-changes re-apply currently selected profile. Will work if the existing configuration is a valid authselect configuration. Otherwise an error is returned. authselect apply-changes -b backup system files before applying changes authselect apply-changes –backup=NAME ditto as in select

authselect list list available profiles authselect list-features list available profiles

authselect show profile_id print info about profile authselect requirements profile_id # info about profile requirements authselect current # print info about currrently selected profile authselect check # is current profile valid? authselect test profile_id # print contents of files generated by authselect without actually making any changes.

-a all files -n print nsswitch.conf content -s print system-auth content -p print password-auth content -c print smartcard-auth content -o print postlogin content -d print dconf database content -l print dconf lock content

authselect create-profile NAME # a new custom profile is created. (see man)

2.1. An OpenLDAP client using SSSD to retrieve data from LDAP in an encrypted way. The System Security Services Daemon (SSSD) is a daemon that manages identity data retrieval and authentication on a RHEL 8 host. A system administrator can configure the SSSD on the host to use a standalone LDAP server database as the user account database. Examples of an LDAP server include the OpenLDAP server and the Red Hat 389 Directory Server. In this chapter, the scenario also includes the requirement that the connection with the LDAP server must be encrypted with a TLS certificate.

The authentication method of the LDAP objects can be either a Kerberos password or an LDAP password. Note that the questions of authentication and authorization of the LDAP objects are not addressed in this chapter.

Configure the LDAP client by using sssd. The sssd configuration is located at /etc/sssd/sssd.conf. Examples of sssd.conf: [sssd] config_fileversion = 2 services = nss, pam domains = default

[nss] filter_users = root,ldap,named,avahi,haldaemon,dbus,radiusd,news,nscd

[pam]

[domain/default] auth_provider = ldap id_provider = ldap ldap_schema = rfc2307 ldap_searchbase = ou=im,dc=example,dc=com ldap_groupmember = memberuid ldap_tlsreqcert = never ldap_{idusestarttls} = False chpass_provider = ldap ldap_uri = ldap://ldap.example.com:389/ ldap_tlscacertdir = /etc/openldap/cacerts entry_cachetimeout = 600 ldap_{networktimeout} = 3 #ldap_accessfilter = (&(object)(object)) ldap_{defaultbinddn} = cn=Manager,ou=im,dc=example,dc=com ldap_{defaultauthtoktype} = password ldap_{defaultauthtok} = YOUR_PASSWORD cache_credentials = True enumerate=true

OpenLDAP provides not only a server, but also a client, openldap-clients This package includes the following command line utilities

• ldapadd: Adds entries to an LDAP directory either from a file or from standard input.
• ldapmodify: Modifies entries in an LDAP directory [ ldapmodify -a is identical to ldapadd. ]
• ldapcompare: Compares a given attribute with an LDAP directory entry
• ldapdelete: Deletes entries from an LDAP directory
• ldapexop: Performs extended LDAP operations
• ldapmodrdn: Modifies the RDN value of an LDAP directory entry
• ldappasswd: Is a password utility for an LDAP user
• ldapsearch: Is an LDAP directory search tool
• ldapurl: Is an LDAP URL formatting tool
• ldapwhoami: Performs a whoami operation on an LDAP server

There are also several GUI LDAP clients. Use at your own risk.

dn: cn=ldaproot,dc=andrew,dc=ops

useradd zintis -u 10000
useradd -c "Jane Greystoke" jane -u 10001
useradd -c "Andrew's Guests" guest -u 10002

if user jane already exists, delete her with userdel jane
also chown her mailbox with chown jane /var/spool/mail/jane
And delete /var/spool/mail/andrew

grep -w zintis /etc/passwd > /root/zintis.entry
grep -w Jane /etc/passwd > /root/jane.entry
grep -w Andrew /etc/passwd > /root/guest.entry

/usr/share/migrationtools/migrate_passwd.pl /root/zintis.entry /root/zintis.ldif
/usr/share/migrationtools/migrate_passwd.pl /root/jane.entry /root/jane.ldif
/usr/share/migrationtools/migrate_passwd.pl /root/guest.entry /root/guest.ldif

ldapadd -v -f ldapusers.ldif -D cn="ldaproot,dc=andrew,dc=ops" -W 
ldapadd -v -f jane.ldif -D cn="ldaproot,dc=andrew,dc=ops" -W 
ldapadd -v -f guest.ldif -D cn="ldaproot,dc=andrew,dc=ops" -W 

This is PAM the "Pluggable Authentication Module" and NSS the "Name Service Switch"

yum install -y openldap-clients nss-pam-ldapd Since CentOS8 does not see nss-pam-ldap I did the following:

First: dnf provides nss-pam-ldapd Then, based on the above this: dnf install -y nss-pam-ldapd-0.9.9-3.el8.x86₆₄

From arthurdejong.org: This is nss-pam-ldapd which provides a Name Service Switch (NSS, nsswitch) module that allows your LDAP server to provide user account, group, host name, alias, netgroup, and basically any other information that you would normally get from /etc flat files or NIS. It also provides a Pluggable Authentication Module (PAM) to do identity and authentication management with an LDAP server on unix systems.

This is implemented using thin NSS and PAM modules which delegate to a dedicated service (nslcd) that queries the LDAP server with persistent connections, authentication, attribute translation, etc.

The NSS module was originally a fork of nss_ldap with some structural design improvements. The most important features of nss-pam-ldapd are:

• light and simple NSS and PAM libraries
• avoid loading LDAP and SSL libraries in all programs
• separation between NSS, PAM and LDAP code
• fewer connections to the LDAP server
• better debugging possibilities
• better performance
• See the documentation section for more detai

Configure the client VM to use LDAP To add the client machine to LDAP server for single sign-on. Replace “192.168.1.10” with your LDAP server’s IP address or hostname.

authconfig –enableldap –enableldapauth –ldapserver=192.168.1.10 –ldapbasedn="dc=itzgeek,dc=local" –enablemkhomedir –update

Restart the LDAP client service. O.K, so this will make this VM defer logins to the LDAP server rather than looking in its own /etc/passwd file ??? That would mean that the users defined in the ldap server would require a local prescence on this VM, including home directory, and entry in /etc/passwds. I guess this is just centralizing the passwords themselves I guess?? Confirm this!

systemctl restart nslcd To verify LDAP Login, use the getent command to get the LDAP entries from the LDAP server.

getent passwd raj Output:

raj:x:9999:100:Raj [Admin (at) ITzGeek]:/home/raj:/bin/bash Screenshot:

OpenLDAP Server Configuration on CentOS 7 - Verify LDAP Login OpenLDAP Server Configuration on CentOS 7 – Verify LDAP Login

To verify the LDAP, log in using the LDAP user “raj” on the client machine. Like this: