Solved

Using Openldap to authenticate Linux / NT users

Posted on 2001-06-20
3
594 Views
Last Modified: 2013-12-06
Ok, here's the deal.  I have a network consisting of 13 Linux boxes (RH and Debian), and 4 NT Servers.  I run Sendmail for e-mail, BIND for DNS, CVS, and NT / SAMBA for filesharing.  I would like to setup an LDAP server to handle (primarily) authentication to all network resources, and (secondary) as a company-wide address book, central location for  DNS Configs, and anything else that I could use it for.  I've been working on this for about 2 weeks now, and have been able to get teh OS installed (no prob), and I've been able to get slapd running.  The problem that I am having is that when I try to use RPM's (since I'm using RH, I usually try it their way first), I get a bunch of dependancy errors (liblber.so.1 and libldap.so.1), and the only source that I can find is openldap-2.0.11, which will require the new version of openssl and openssh across the board (a move I'm not ready to make yet).  At any rate, the basic question (for the 200 points) is how do I configure openldap and 1 RH Linux 7.0 client so that users can authenticate to both boxes off of the LDAP database without having an account (in /etc/passwd) on either box.  I may not have asked the question properly, and would be more than glad to offer any details that I could for some assistance on this.  Below are the packages (RPMS) that I have to work with currently, and the source that I have to work with currently.  I would prefer to either use all source, or all RPM's (except on the Debian boxes) if possible, and can download additional packages / source if necessary:

--RPMS--
openldap-1.2.11-15.rpm (I had to install this first to satisfy a dependancy)
openldap-2.07.rpm (this is the version that I can use with my current openssl / openssh config)
openldap-servers-1.2.11.rpm
openldap-clients-1.2.11.rpm
nss_ldap-85-2.rpm
auth_ldap-1.4.0-3.rpm
auth_ldap-1.4.3-2.rpm

--Source--

openldap-2.0.7.tgz
openldap-2.0.11.tgz (requires updated openssl / openssh)
pam_ldap.tgz (the version available currently from padl.com)
nss_ldap.tgz (the version available currently from padl.com)

I also have one of the Linux boxes setup as a domain controller in the NT domain, if that helps.
0
Comment
Question by:nunderwood
  • 2
3 Comments
 

Accepted Solution

by:
grepster earned 200 total points
ID: 6232244
Hiya

We have done just that here at work and what you will need to do is install :
Kerberos5 protocol
Cyrus-SASL

get that authenticating etc etc.  There are plents of modules out there for other great things like to import
0
 

Author Comment

by:nunderwood
ID: 6232355
I still seem to be missing something.  I have the following installed via rpm (I believe this is all that I need):

openldap-clients-2.0.7-14
openldap-2.0.7-14
openldap-servers-2.0.7-14
nss_ldap-85-2
pam_krb5-1.31-1
krb5-devel-1.2.2-7
krb5-workstation-1.2.2-7
krbafs-1.0.5-1
krb5-libs-1.2.2-7
krb5-server-1.2.2-7

The test that I'm using is the following:

Created a user in the ldap tree:

uid=test,ou=employees,dc=<domain>,dc=com
(user doesn't exist in /etc/passwd)

Edited /etc/nsswitch.conf:
     passwd:     ldap files
     shadow:     ldap files
     group:      ldap files

Tried to login via SecureCRT using test & password - failed
Tried to login at terminal using test & password - failed

I'm monitoring /var/log/messages, /var/log/ldap, and /var/log/secure while I'm making these attempts.  The only log that generates an entry is /var/log/secure.  The contents are below:

Jun 27 12:58:06 ldap sshd[32118]: PAM pam_set_item: NULL pam handle passed
Jun 27 12:58:16 ldap sshd[32118]: PAM pam_set_item: NULL pam handle passed
Jun 27 12:58:16 ldap sshd[32118]: Failed password for illegal user test from 192.168.1.230 port 3317
Jun 27 12:58:25 ldap sshd[32118]: Unknown message during authentication: type 4
Jun 27 12:58:25 ldap sshd[32118]: Failed bad-auth-msg-4 for illegal user test from 192.168.1.230 port 3317
0
 

Author Comment

by:nunderwood
ID: 6235021
First off, I apologize for not figuring my mistake out sooner, once I updated the Cyrus-SASL and Kerberos packages,( and edited the /etc/nsswitch.conf on the client machine) I was able to authenticate from a remote machine, to the LDAP server.  With this in mind, I'm going to close this question, but I'll probably be opening another one soon, once I start building the LDAP directory to better suit my organizations (questions will include, how to say uid=x can log onto this server, but not that server, like on the mail server [users do not have a shell, or home directory on the mail server]).  In case anyone else is trying to figure this out, maybe the information below will lead you in the right direction:

RPMs Installed:
  (I installed all of these, with the exception of openldap-servers, on the machines that would participate in LDAP)
    openldap-2.0.7-14
    openldap-servers-2.0.7-14
    openldap-clients-2.0.7-14
    nss_ldap-149-1
    openldap-devel-2.0.7-14
    pam_krb5-1.31-1
    krb5-server-1.2.2-7
    krb5-workstation-1.2.2-7
    krb5-libs-1.2.2-7
    krb5-devel-1.2.2-7


I edited the /etc/ldap.conf, and added the BASE and HOST of my LDAP server
I edited the /etc/openldap/ldap.conf to reflect the same
I edited /etc/nsswitch.conf, and added ldap to passwd, shadow, and group
I edited the files in /etc/pam.d, and added LDAP support for the services that I will be using LDAP for
Since it's Red Hat, and becasue I was curious, I ran authconfig just to make sure that everything showed up

Hope this helps, and grepster, thanks for pointing out the two that I missed.  I hope that I can call on you if I get in another pinch trying to get the directory setup.
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

Linux users are sometimes dumbfounded by the severe lack of documentation on a topic. Sometimes, the documentation is copious, but other times, you end up with some obscure "it varies depending on your distribution" over and over when searching for …
If you don't know how to downgrade, my instructions below should be helpful.
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now