LDAP

TODO

Check: https://www.digitalocean.com/community/tutorials/how-to-authenticate-client-computers-using-ldap-on-an-ubuntu-12-04-vps
ADD: TO_WIKI

https://wiki.debian.org/LDAP

LDAP: Lightweight Directory Access Protocol

Server setup

sudo apt-get install sldap
sudo apt-get install ldap-utils
sudo apt-get install phpldapadmin
sudo nano /etc/ldap/ldap.conf
# Set BASE and URI
browse http://serverip/phpldapadmin
# if it gives a low memory error:
nano /etc/php5/apache2/php.ini
# set: memory_limit = 32M
# restart apache

https://www.youtube.com/watch?v=DM_UQVVVtoY

Client setup (PAM: Pluggable Authentication Modules

sudo apt-get install libpam-ldap
sudo apt-get install nscd
nano /etc/nsswitch.conf
# add ldap to passwd, group and shadow:
passwd:    ldap compat
group:     ldap compat
shadow:    ldap compat

edit: /etc/pam.d/common-auth

# commment: auth optional
# add:
auth    required    pam_ldap.so use_first_pass
auth    required    pam_permit.so
# modify: auth    requisite    pam_unix.so nullok_secure
# to:
auth    sufficient    pam_unix.so nullok_secure

edit: /etc/pam.d/common-account

# add:
account    required    pam_ldap.so
# modify: account required pam_unix.so
# to:
account    sufficient    pam_unix.so

edit: /etc/pam.d/common-session

# add (if home directory does not exist create it) :
session    required    pam_mkhomedir.so    skel=/etc/skel/ umask=0022

edit: /etc/pam.d/common-password

# add:
password    required    pam_ldap.so
# modify: password    requisite    pam_unix.so nullok obscure md5
# to:
password    sufficient   pam_unix.so nullok obscure md5

#restart daemon:
/etc/init.d/nscd restart

/etc/ldap.secret

echo -n ldapsearchpassword > ldap.secret
sudo mv ldap.secret /etc/ldap.secret
chmod 600 /etc/ldap.secret

/etc/ldap.conf

###DEBCONF###
##
## Configuration of this file will be managed by debconf as long as the
## first line of the file says '###DEBCONF###'
##
## You should use dpkg-reconfigure to configure this file via debconf
##

#
# @(#)$Id: ldap.conf,v 1.38 2006/05/15 08:13:31 lukeh Exp $
#
# This is the configuration file for the LDAP nameservice
# switch library and the LDAP PAM module.
#
# PADL Software
# http://www.padl.com
#

# Your LDAP server. Must be resolvable without using LDAP.
# Multiple hosts may be specified, each separated by a
# space. How long nss_ldap takes to failover depends on
# whether your LDAP client library supports configurable
# network or connect timeouts (see bind_timelimit).

# Uno de los 2 sobra
host rtldap01.rra.lan
uri ldaps://rtldap01.rra.lan

# The distinguished name of the search base.
base dc=rtLDAP01,dc=igrupobbva
ldap_version 3

# The distinguished name to bind to the server with
# if the effective user ID is root. Password is
# stored in /etc/ldap.secret (mode 600)
rootbinddn cn=admin,dc=rtLDAP01,dc=igrupobbva

# The port.
# Optional: default is 389.
#port 389
port 636

# Reconnect policy: hard (default) will retry connecting to
# the software with exponential backoff, soft will fail
# immediately.
bind_policy soft

# Do not hash the password at all; presume
# the directory server will do it, if
# necessary. This is the default.
pam_password md5

# Netscape SDK LDAPS
ssl on

# Netscape SDK SSL options
#sslpath /etc/ssl/certs

# OpenLDAP SSL mechanism
# start_tls mechanism uses the normal LDAP port, LDAPS typically 636
#ssl start_tls
#ssl on

# OpenLDAP SSL options
# Require and verify server certificate (yes/no)
# Default is to use libldap's default behavior, which can be configured in
# /etc/openldap/ldap.conf using the TLS_REQCERT setting. The default for
# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".
#tls_checkpeer yes
#tls_checkpeer no

# CA certificates for server certificate verification
# At least one of these are required if tls_checkpeer is "yes"
#tls_cacertfile /etc/ssl/ca.cert
#tls_cacertfile /etc/ldap/ca_server.pem
#tls_cacertdir /etc/ssl/certs

# Seed the PRNG if /dev/urandom is not provided
#tls_randfile /var/run/egd-pool

# SSL cipher suite
# See man ciphers for syntax
#tls_ciphers TLSv1

# Client certificate and key
# Use these, if your server requires client authentication.
#tls_cert
#tls_key

# Disable SASL security layers. This is needed for AD.
#sasl_secprops maxssf=0

# Override the default Kerberos ticket cache location.
#krb5_ccname FILE:/etc/.ldapcache

# SASL mechanism for PAM authentication - use is experimental
# at present and does not support password policy control
#pam_sasl_mech DIGEST-MD5
nss_initgroups_ignoreusers _apt,backup,bin,daemon,games,gnats,irc,list,lp,mail,man,messagebus,mysql,news,proxy,root,sshd,sync,sys,syslog,systemd-bus-proxy,systemd-network,systemd-resolve,systemd-timesync,uucp,uuidd,vboxadd,www-data,rra

/etc/ldap/ldap.conf

#
 # LDAP Defaults
 #
 
 # See ldap.conf(5) for details
 # This file should be world readable but not world writable.
 
 BASE	cn=admin,dc=rtLDAP01,dc=igrupobbva
 URI	ldaps://rtldap01.rra.lan
 
 #SIZELIMIT	12
 #TIMELIMIT	15
 #DEREF		never
 
 # TLS certificates (needed for GnuTLS)
 TLS_CACERT	/etc/ldap/ca_server.pem
 TLS_REQCERT never

/etc/ldap/ca_server.pem

More Info

https://www.youtube.com/watch?v=LVY3WbakcOE&list=PL8B125D10F99838F7
http://www.server-world.info/en/note?os=Debian_8&p=openldap&f=4

TLS1.2

TODO: Desarrollar Examples olcTLSCipherSuite (cn=config??)
olcTLSCipherSuite: HIGH:+TLSv1.2:-TLSv1.1:-TLSv1.0:+SSLv3:-SSLv2
olcTLSCipherSuite: HIGH:+TLSv1.2:-TLSv1.1:-TLSv1.0:-SSLv3:-SSLv2

Troubleshooting

ldapsearch -x -d 1 -ZZ
ldapsearch -x -LLL uid=xe50582
ldapsearch -h rtLDAP01.igrupobbva -b dc=rtLDAP01,dc=igrupobbva -x uid=xe50582

ldapsearch -x -h freeipa.rra.lan -b dc=rra,dc=lan "(&(objectclass=posixaccount)(objectClass=person)(uid=xe50582))"
getent passwd
getent group

LDAP SSH Keys

Modify LDAP to enable SSH keys storage (google)
/etc/ssh/sshd_config --> AuthorizedKeysCommand /bin/ldapkeyfile
/etc/ssh/sshd_config --> AuthorizedKeysCommandUser nobody

/bin/ldapkeyfile

#!/usr/bin/env bash
ldapsearch -h rtLDAP01.igrupobbva -b dc=rtLDAP01,dc=igrupobbva -x '(&(objectClass=posixAccount)(uid='"$1"'))' 'sshPublicKey' | sed -n '/^ /{H;d};/sshPublicKey:/x;$g;s/\n *//g;s/sshPublicKey: //gp'