\n
sudo apt-get install ldapscripts<\/pre>\n<\/div>\n<\/div>\nNow we need to edit the config file \/etc\/ldapscripts\/ldapscripts.conf uncommenting and changing the following to match your environment:<\/p>\n
\n
\n
# Copyright (C) 2005 Ganal LAPLANCHE - Linagora\r\n#\r\n# This program is free software; you can redistribute it and\/or\r\n# modify it under the terms of the GNU General Public License\r\n# as published by the Free Software Foundation; either version 2\r\n# of the License, or (at your option) any later version.\r\n#\r\n# This program is distributed in the hope that it will be useful,\r\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\r\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\r\n# GNU General Public License for more details.\r\n#\r\n# You should have received a copy of the GNU General Public License\r\n# along with this program; if not, write to the Free Software\r\n# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307,\r\n# USA.\r\n\r\n# Note for Debian users:\r\n# On Debian system ldapscripts will try to parse and use some system config.\r\n# Look on commented variables and description lines started with DEBIAN.\r\n# But you could override it's values here.\r\n\r\n# LDAP Configuration\r\n# DEBIAN: values from \/etc\/pam_ldap.conf are used.\r\nSERVER=\"ldap:\/\/localhost\"\r\nBINDDN=\"cn=admin,dc=danbishop,dc=org\"\r\n\r\n# The following file contains the raw password of the binddn\r\n# Create it with something like : echo -n 'secret' > $BINDPWDFILE\r\n# WARNING !!!! Be careful not to make this file world-readable\r\n# DEBIAN: \/etc\/pam_ldap.secret or \/etc\/ldap.secret are used.\r\n#BINDPWDFILE=\"\/etc\/ldapscripts\/ldapscripts.passwd\"\r\n# For older versions of OpenLDAP, it is still possible to use\r\n# unsecure command-line passwords by defining the following option\r\n# AND commenting the previous one (BINDPWDFILE takes precedence)\r\n#BINDPWD=\"secret\"\r\n\r\n# DEBIAN: values from \/etc\/pam_ldap.conf are used.\r\nSUFFIX=\"dc=danbishop,dc=org\" # Global suffix\r\nGSUFFIX=\"ou=Groups\" # Groups ou (just under $SUFFIX)\r\nUSUFFIX=\"ou=Users\" # Users ou (just under $SUFFIX)\r\nMSUFFIX=\"ou=Machines\" # Machines ou (just under $SUFFIX)\r\n\r\n# Start with these IDs *if no entry found in LDAP*\r\nGIDSTART=\"10000\" # Group ID\r\nUIDSTART=\"10000\" # User ID\r\nMIDSTART=\"20000\" # Machine ID\r\n\r\n# User properties\r\n# DEBIAN: values from \/etc\/adduser.conf are used.\r\n#USHELL=\"\/bin\/sh\"\r\n#UHOMES=\"\/home\/%u\" # You may use %u for username here\r\nCREATEHOMES=\"yes\" # Create home directories and set rights ?\r\n#HOMESKEL=\"\/etc\/skel\" # Directory where the skeleton files are located. Ignored if undefined or nonexistant.\r\n#HOMEPERMS=\"755\" # Default permissions for home directories\r\n\r\n# User passwords generation\r\n# Command-line used to generate a password for added users (you may use %u for username here)\r\n# WARNING !!!! This is evaluated, everything specified here will be run !\r\n# Special value \"<ask>\" will ask for a password interactively\r\n#PASSWORDGEN=\"cat \/dev\/random | LC_ALL=C tr -dc 'a-zA-Z0-9' | head -c8\"\r\n#PASSWORDGEN=\"head -c8 \/dev\/random | uuencode -m - | sed -n '2s|=*$||;2p' | sed -e 's|+||g' -e 's|\/||g'\"\r\nPASSWORDGEN=\"pwgen -s\"\r\n#PASSWORDGEN=\"echo changeme\"\r\n#PASSWORDGEN=\"echo %u\"\r\n#PASSWORDGEN=\"<ask>\"\r\n\r\n# User passwords recording\r\n# you can keep trace of generated passwords setting PASSWORDFILE and RECORDPASSWORDS\r\n# (useful when performing a massive creation \/ net rpc vampire)\r\n# WARNING !!!! DO NOT FORGET TO DELETE THE GENERATED FILE WHEN DONE !\r\n# WARNING !!!! DO NOT FORGET TO TURN OFF RECORDING WHEN DONE !\r\nRECORDPASSWORDS=\"no\"\r\nPASSWORDFILE=\"\/var\/log\/ldapscripts_passwd.log\"\r\n\r\n# Where to log\r\nLOGFILE=\"\/var\/log\/ldapscripts.log\"\r\n\r\n# Temporary folder\r\nTMPDIR=\"\/tmp\"\r\n\r\n# Various binaries used within the scripts\r\n# Warning : they also use uuencode, date, grep, sed, cut, expr, which...\r\n# Please check they are installed before using these scripts\r\n# Note that many of them should come with your OS\r\n\r\n# OpenLDAP client commands\r\nLDAPSEARCHBIN=\"\/usr\/bin\/ldapsearch\"\r\nLDAPADDBIN=\"\/usr\/bin\/ldapadd\"\r\nLDAPDELETEBIN=\"\/usr\/bin\/ldapdelete\"\r\nLDAPMODIFYBIN=\"\/usr\/bin\/ldapmodify\"\r\nLDAPMODRDNBIN=\"\/usr\/bin\/ldapmodrdn\"\r\nLDAPPASSWDBIN=\"\/usr\/bin\/ldappasswd\"\r\n\r\n# Character set conversion : $ICONVCHAR <-> UTF-8\r\n# Comment ICONVBIN to disable UTF-8 conversion\r\n#ICONVBIN=\"\/usr\/bin\/iconv\"\r\n#ICONVCHAR=\"ISO-8859-15\"\r\n\r\n# Base64 decoding\r\n# Comment UUDECODEBIN to disable Base64 decoding\r\n#UUDECODEBIN=\"\/usr\/bin\/uudecode\"\r\n\r\n# Getent command to use - choose the ones used\r\n# on your system. Leave blank or comment for auto-guess.\r\n# GNU\/Linux\r\n#GETENTPWCMD=\"getent passwd\"\r\n#GETENTGRCMD=\"getent group\"\r\n# FreeBSD\r\n#GETENTPWCMD=\"pw usershow\"\r\n#GETENTGRCMD=\"pw groupshow\"\r\n# Auto\r\nGETENTPWCMD=\"\"\r\nGETENTGRCMD=\"\"\r\n\r\n# You can specify custom LDIF templates here\r\n# Leave empty to use default templates\r\n# See *.template.sample for default templates\r\n#GTEMPLATE=\"\/path\/to\/ldapaddgroup.template\"\r\n#UTEMPLATE=\"\/path\/to\/ldapadduser.template\"\r\n#MTEMPLATE=\"\/path\/to\/ldapaddmachine.template\"\r\nGTEMPLATE=\"\"\r\nUTEMPLATE=\"\"\r\nMTEMPLATE=\"\"<\/pre>\n<\/div>\n<\/div>\nThe changes from the default file are highlighted below:<\/p>\n
\n
\n
# Provides LDAP server's address and the admin username\r\nSERVER=\"ldap:\/\/localhost\"\r\nBINDDN=\"cn=admin,dc=danbishop,dc=org\"\r\n\r\n# These have all been uncommented, Users changed to People\r\n# and the correct suffix set for our domain\r\nSUFFIX=\"dc=danbishop,dc=org\" # Global suffix\r\nGSUFFIX=\"ou=Groups\" # Groups ou (just under $SUFFIX)\r\nUSUFFIX=\"ou=Users\" # Users ou (just under $SUFFIX)\r\nMSUFFIX=\"ou=Machines\" # Machines ou (just under $SUFFIX)\r\n\r\n# This creates home directories when we create users\r\nCREATEHOMES=\"yes\"<\/pre>\n<\/div>\n<\/div>\nIf you\u2019ve read through the default comments in \/etc\/ldapscripts\/ldapscripts.conf you\u2019ll see that it finds the LDAP admin password from a \/etc\/ldap.secret file. So the following two commands create that file, write our admin password to it (change PASSWORD to your admin password) and then set it to be non-world-readable. This prevents users discovering your LDAP password, but allows root, or processes running as root, to read the file and find the password.<\/p>\n
\n
\n
sudo sh -c \"echo -n 'PASSWORD' > \/etc\/ldap.secret\"\r\nsudo chmod 400 \/etc\/ldap.secret<\/pre>\n<\/div>\n<\/div>\nYou might also have noticed that \/etc\/adduser.conf is used to determine home directory defaults. Ubuntu allows users to view the contents of other user\u2019s home directories by default. In some environments, particularly home environments, this is fine, but you might want to change that by editing DIR_MODE=0755 to be DIR_MODE=0700.<\/p>\n
Managing Users<\/h2>\n
Now the LDAP scripts are configured we can start creating users. We\u2019re going to use the group name \u201cadmin\u201d for administrators as this is the default for Ubuntu and will enable us to give admin rights to users on every machine on the network without any further configuration. However, as this group already exists as a local group, we need to be very careful that we don\u2019t lock ourselves out of the server here\u2026<\/p>\n
The first thing to do is create a password for our first admin user. As we are using Kerberos for authentication, the administrator needs a principal creating. This is done like so:<\/p>\n
\n
\n
sudo kadmin.local -q \"addprinc dan\"<\/pre>\n<\/div>\n<\/div>\nNow we need some groups to hold our users. The first two groups we will create will be \u201cadmin\u201d and \u201cuser\u201d:<\/p>\n
\n
\n
sudo ldapaddgroup admin\r\nsudo ldapaddgroup user<\/pre>\n<\/div>\n<\/div>\nNext we will create a user and assign him to a group:<\/p>\n
\n
\n
sudo ldapadduser dan 10001<\/pre>\n<\/div>\n<\/div>\nNote the use of group 10001 rather than simply \u201cadmin\u201d. This is to avoid any confusion with the local admin group on the server. In some instances, I\u2019ve seen this cause issues. Group 10001 will be the first ldap group you created, you can see the GIDs for all groups by using the command \u201cgetent group\u201d.<\/p>\n
And finally add the user to the user group:<\/p>\n
\n
\n
sudo ldapaddusertogroup dan 10002<\/pre>\n<\/div>\n<\/div>\nYou can now login to the server (and later client machines) as this user. The \u201clocaladmin\u201d account on the server will no longer be able to use sudo as it doesn\u2019t belong to the ldap \u201cadmin\u201d group, only the local one. For subsequent users, you may create the Kerberos principal after creating the LDAP user if you prefer.<\/p>\n
References<\/h2>\n
http:\/\/www.opinsys.fi\/en\/setting-up-openldap-on-ubuntu-10-04-alpha2<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"This is part of a guide to setting up Ubuntu Server Edition 11.04 for a small\/medium business. The server will provide DHCP, […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-613","post","type-post","status-publish","format-standard","hentry","category-info-on-tech"],"_links":{"self":[{"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=613"}],"version-history":[{"count":0,"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/613\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}