$ORIGIN dev.local. _ldap._tcp IN SRV 10 0 389 ldapk1 _ldap._tcp IN SRV 20 0 389 ldapk2The client configuration can now look like this (file /etc/ldap/ldap.conf):
# BASE dc=dev,dc=local # URI ldap://ldapk1/Let test it:
host -t SRV _ldap._tcp
Saturday, February 5, 2011
How to setup LDAP DNS Discovery
LDAP DNS discovery can simplify the client hosts setup. The following need to be added to zone file.
Troubleshooting: dbus-daemon nss_ldap failed to bind to LDAP server
While installing Debian OpenLDAP client with Kerberos (see here) on Gnome desktop you might experience the following errors in auth.log.
dbus-daemon: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Credentials cache file '/tmp/krb5cc_101' not found) dbus-daemon: nss_ldap: failed to bind to LDAP server ldap://ldapk1.dev.local/: Local error dbus-daemon: nss_ldap: could not search LDAP server - Server is unavailableAt the same time you will might see a number of errors reported by slapd:
slapd: conn=2806 op=0 UNBIND slapd: conn=2806 fd=27 closed slapd: conn=2807 fd=27 ACCEPT from IP=192.168.XX.XXX:XXXXX (IP=0.0.0.0:XXX)The problem is related to parallel boot of your system. By default dbus and nscd are started in parallel, the problem appears when dbus is launched before nscd daemon. In order to fix that you need to change boot sequence. Make sure you have the following in /etc/init.d/dbus (notice line Should-Start):
# Provides: dbus # Should-Start: nscd # Required-Start: $remote_fs $syslogOnce above is done simple re-enable dbus service so it updates everything necessary:
rcconf --off dbus ; rcconf --on dbusNotice changes in /etc/rc2.d:
# ls /etc/rc2.d/ S17nscd ... S18dbusYou need restart your computer (or at least restart dbus daemon) in order changes take place.
Debian OpenLDAP client with Kerberos
Before we proceed with client setup (let assume our client machine name is deby01.dev.local) you need to setup the following:
- Kerberos Client (look here).
- We need install few packages:
apt-get -y install ldap-utils libpam-ldap \ libsasl2-modules-gssapi-mit nscd libnss-ldap kstart
During installation you will be prompted for few questions:- libnss-ldap
LDAP server URI: ldap://ldapk1.dev.local/ Distinguished name of the search base: dc=dev,dc=local LDAP version to use: 3 cn=admin,ou=people,dc=dev,dc=local LDAP account for root: cn=admin,ou=people,dc=dev,dc=local LDAP root account password: <just hit enter>
- libpam-ldap
Allow LDAP admin account to behave like local root? No Does the LDAP database require login? No
- libnss-ldap
- Reconfigure libpam-runtime and disable LDAP Authentication:
dpkg-reconfigure libpam-runtime
- Configure kstart, add the following to /etc/inittab (It will check every 10 minutes of the Kerberos ticket needs to be renewed and set the ticket lifetime to 24 hours:
KS:2345:respawn:/usr/bin/k5start -U -f /etc/krb5.keytab -K 10 -l 24h
Force init to reload configuration:kill -HUP 1
Ensure /tmp/krb5cc_0 file is created:ls -lh /tmp/krb5cc_0
- Kerberise libnss-ldap (file /etc/libnss-ldap.conf), ensure the following:
base dc=dev,dc=local uri ldap://ldapk1.dev.local/ ldap_version 3 rootbinddn cn=admin,ou=people,dc=dev,dc=local # Use SASL and GSSAPI and where to find the # Kerberos ticket cache. use_sasl on sasl_mech gssapi krb5_ccname FILE:/tmp/krb5cc_0
- Set defaults for LDAP clients (file /etc/ldap/ldap.conf). Note client configuration changes if ldap is configured via SSL (see here).
BASE dc=dev,dc=local URI ldap://ldapk1.dev.local/ SASL_MECH GSSAPI
- Add LDAP support for login process by nscd (file /etc/nsswitch.conf):
passwd: compat ldap group: compat ldap shadow: compat ldap
- Restart Name Service Cache daemon:
/etc/init.d/nscd restart
- Configure PAM to automatically create a user home directory (file /etc/pam.d/common-session):
session required pam_mkhomedir.so
Troubleshooting
- You might experience the following error while initializing kerberos ticket in Debian Gnome desktop:
Cannot resolve network address for KDC in realm DEV.LOCAL
This somehow conflicts with avahi-daemon, you will need disable it:rcconf --off avahi-daemon
- If you are using Debian Gnome desktop, have a look at Troubleshooting: dbus-daemon nss_ldap failed to bind to LDAP server, that you can find here.
Debian OpenLDAP with Kerberos Authentication
Before we proceed with ldap kerberization (let assume our server name is ldapk1.dev.local) you need to setup the following:
Once the basic installation of the above is complete, here we go:
Remove Authentication from LDAP
- Since we are going to authenticate users with Kerberos we need to prohibit users access to password stored in ldap. Add the following to file access-passwd.ldif:
dn: olcDatabase={1}hdb,cn=config changetype: modify # # Delete default user access to password delete: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=dev,dc=local" write by * none - # Prohibit access to password add: olcAccess olcAccess: {0}to attrs=userPassword,shadowLastChange by * none - # Only authenticated users have read access # Anonymous users have no access. add: olcAccess olcAccess: {1}to * by users read by * noneand apply changes:ldapmodify -QY EXTERNAL -H ldapi:/// -f access-passwd.ldif
- Delete admin account:
ldapdelete -cxWD cn=admin,dc=dev,dc=local cn=admin,dc=dev,dc=local
and it access rights in the directory (file access-noadmin.ldif):dn: olcDatabase={1}hdb,cn=config changetype: modify # # Revoke admin write rights to the directory delete: olcAccess olcAccess: {3}to * by self write by dn="cn=admin,dc=dev,dc=local" write by * read - # Move admin account to people unit replace: olcRootDN olcRootDN: uid=admin,ou=people,dc=dev,dc=local - # Remove admin password delete: olcRootPWand apply changes:ldapmodify -QY EXTERNAL -H ldapi:/// -f access-noadmin.ldif
Setup GSSAPI mapping between OpenLDAP and Kerberos
- Install SASL module for Kerberos:
apt-get install libsasl2-modules-gssapi-mit
- Add ldap principal:
kadmin -p admin -q "addprinc -randkey ldap/ldapk1.dev.local" kadmin -p admin -q "ktadd ldap/ldapk1.dev.local"
- Allow openldap group (slapd service is running under openldap account) access kerberos information:
chgrp openldap /etc/krb5.keytab chmod g+r,o= /etc/krb5.keytab ls -lh /etc/krb5.keytab
- Specify authentication mode (file /etc/ldap/ldap.conf):
SASL_MECH GSSAPI
- Setup SASL mapping between Kerberos and LDAP accounts (file auth-kerberos.ldif):
dn: cn=config changetype: modify # # Regular expression that match a simple user name # provided by SASL and map it to ldap entry add: olcAuthzRegexp olcAuthzRegexp: uid=([^,]+),cn=dev.local,cn=gssapi,cn=auth uid=$1,ou=people,dc=dev,dc=local - # Specify SASL Kerberos realm add: olcSaslRealm olcSaslRealm: DEV.LOCAL
and apply changes:ldapmodify -QY EXTERNAL -H ldapi:/// -f auth-kerberos.ldif
- Restart OpenLDAP service:
/etc/init.d/slapd restart
Verify settings
Verify above changes by querying config:ldapsearch -LLLQY EXTERNAL -H ldapi:/// -b \
cn=config "(|(cn=config)(olcDatabase={1}hdb))"
Here it is:
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/slapd/slapd.args
olcLogLevel: stats
olcPidFile: /var/run/slapd/slapd.pid
olcToolThreads: 1
olcAuthzRegexp: {0}uid=([^,]+),cn=dev.local,cn=gssapi,cn=auth uid=$1,ou=people
,dc=dev,dc=local
olcSaslRealm: DEV.LOCAL
dn: olcDatabase={1}hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {1}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=dev,dc=local
olcAccess: {0}to attrs=userPassword,shadowLastChange by * none
olcAccess: {1}to dn.base="" by * read
olcLastMod: TRUE
olcDbCheckpoint: 512 30
olcDbConfig: {0}set_cachesize 0 2097152 0
olcDbConfig: {1}set_lk_max_objects 1500
olcDbConfig: {2}set_lk_max_locks 1500
olcDbConfig: {3}set_lk_max_lockers 1500
olcDbIndex: objectClass eq
olcDbIndex: uid eq
olcDbIndex: cn eq
olcDbIndex: ou eq
olcDbIndex: dc eq
olcRootDN: uid=admin,ou=people,dc=dev,dc=local
Kerberos Authentication Test
- Let ensure anonymous has no access
ldapk1:~/ldap# ldapsearch -xLLL No such object (32)
- Authenticate to Kerberos:
kinit -p admin
- Let make the search as authenticated user (you should be able to see organization units people and groups):
ldapsearch -LLL
Troubleshooting
- Cannot create replay cache: No such file or directory
ldap1:~# ldapsearch -LLL SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) additional info: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Cannot create replay cache: No such file or directory)
The only way recover from this error:- Restart slapd daemon
- Consider add cron job on reboot that restarts slapd (file /etc/cron.d/slapd)
@reboot root /etc/init.d/slapd restart
Subscribe to:
Posts
(
Atom
)
Posts
