Openldap - Revision history

Martin: /* pam.d */

2011-11-23T15:15:04Z

pam.d

← Older revision		Revision as of 15:15, 23 November 2011
Line 108:		Line 108:
	In de laatste regel van deze snippet zorgt het systeem ervoor dat de directory /home aanwezig is.		In de laatste regel van deze snippet zorgt het systeem ervoor dat de directory /home aanwezig is.
	<pre>		<pre>
	session [default=1] pam_permit.so		session [default=1] pam_permit.so
	session requisite pam_deny.so		session requisite pam_deny.so
	session required pam_permit.so		session required pam_permit.so

Martin: /* pam.d */

2011-11-23T15:14:28Z

pam.d

← Older revision		Revision as of 15:14, 23 November 2011
Line 86:		Line 86:
	common-account		common-account
	<pre>		<pre>
	account ~~sufficient~~ pam_unix.so		account [success=2 new_authtok_reqd=done default=ignore] pam_unix.so
	account ~~sufficient~~ pam_ldap.so		account [success=1 default=ignore] pam_ldap.so
	account ~~required~~ pam_deny.so		account requisite pam_deny.so
		⚫	account required pam_permit.so
	</pre>		</pre>
	common-auth		common-auth
	<pre>		<pre>
			auth [success=2 default=ignore] pam_unix.so nullok_secure try_first_pass
	auth sufficient pam_ldap.so
	auth ~~sufficient~~ ~~pam_unix~~.so ~~shadow~~ use_first_pass		auth [success=1 default=ignore] pam_ldap.so use_first_pass
	auth ~~required~~ pam_deny.so		auth requisite pam_deny.so
		⚫	auth required pam_permit.so
	</pre>		</pre>
	common-password		common-password
	<pre>		<pre>
			password [success=2 default=ignore] pam_unix.so obscure ssha # sha512
	password requisite pam_passwdqc.so min=12,10,10,8,6 random=25 retry=3 passphrase=2
	password ~~sufficient~~ ~~pam_ldap.so~~ ~~type=network~~ use_authtok ~~first_pass~~		password [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass ssha
		⚫	password requisite pam_deny.so
	password sufficient pam_unix.so type=machine use_authtok md5
	password required ~~pam_deny~~.so		password required pam_permit.so
	</pre>		</pre>
	common-session		common-session<br/>
			In de laatste regel van deze snippet zorgt het systeem ervoor dat de directory /home aanwezig is.
	<pre>		<pre>
		⚫	session [default=1] pam_permit.so
	session sufficient pam_ldap.so
	session ~~required~~ ~~pam_unix~~.so		session requisite pam_deny.so
			session required pam_permit.so
		⚫	session required pam_unix.so
			session optional pam_ldap.so

			session required pam_mkhomedir.so skel=/etc/skel umask=0022
	</pre>		</pre>
	common-session-noninteractive		common-session-noninteractive
	<pre>		<pre>
			session [default=1] pam_permit.so
	#
			session requisite pam_deny.so
	# /etc/pam.d/common-session-noninteractive - session-related modules
			session required pam_permit.so
	# common to all non-interactive services
			session required pam_unix.so
	#
			session optional pam_ldap.so
	# This file is included from other service-specific PAM config files,
	# and should contain a list of modules that define tasks to be performed
	# at the start and end of all non-interactive sessions.
	#
	# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
	# To take advantage of this, it is recommended that you configure any
	# local modules either before or after the default block, and use
	# pam-auth-update to manage selection of other modules. See
	# pam-auth-update(8) for details.

	# here are the per-package modules (the "Primary" block)
⚫	~~session~~ ~~[default=1]~~ pam_permit.so
	# here's the fallback if no module succeeds
⚫	~~session~~ requisite pam_deny.so
	# prime the stack with a positive return value if there isn't one already;
	# this avoids us returning an error just because nothing sets a success code
	# since the modules above will each just jump around
⚫	~~session~~ required pam_permit.so
	# and here are more per-package modules (the "Additional" block)
⚫	session required pam_unix.so
⚫	session ~~optional~~ ~~pam_ldap~~.so
	# end of pam-auth-update config		# end of pam-auth-update config
	</pre>		</pre>

Martin: /* pam.d */

2011-11-23T15:09:14Z

pam.d

@@ Line 84: / Line 84: @@
 </pre>
 == pam.d ==
 <pre>
 </pre>
 == nfs ==
 * http://damstux.free.fr/wiki/index.php?title=Autofs%2C_LDAP_et_NFS

Martin at 15:05, 23 November 2011

2011-11-23T15:05:45Z

@@ Line 18: / Line 18: @@
 * libnss-ldap.conf passwd staat in ldap.secret
 * pam_ldap.conf passwd staat in ldap.secret
 === Tooling ===
@@ Line 78: / Line 58: @@
 == Replicatie tussen provider en consumer ==
 = Server (slapd) configuratie =
 gnutls-cli -s uwork-p.uwork.nl -p 636
 gnutls-cli -s uwork-p.uwork.nl -p 636
@@ Line 107: / Line 83: @@
 ln -s /etc/ldap/ldap.conf /etc/pam_ldap.conf
 </pre>
 = synrepl =

Martin: /* Server (slapd) configuratie */

2011-11-23T15:03:39Z

Server (slapd) configuratie

@@ Line 78: / Line 78: @@
 == Replicatie tussen provider en consumer ==
 = Server (slapd) configuratie =
 = Client (ldap) configuratie =

Martin: /* Client (ldap) configuratie */

2011-11-23T09:10:39Z

Client (ldap) configuratie

@@ Line 83: / Line 83: @@
 = Client (ldap) configuratie =
-Stapsgewijs beschikbaar maken van de LDAP directory voor meerdere doeleinden en op meerdere plaatsen.
+Stapsgewijs beschikbaar maken van de LDAP directory voor meerdere doeleinden en op meerdere plaatsen. Een aardig inzicht in de opzet geeft:
 = synrepl =
 * http://www.openldap.org/doc/admin24/replication.html#Delta-syncrepl

Martin: /* nfs */

2011-11-16T20:53:17Z

nfs

← Older revision		Revision as of 20:53, 16 November 2011
Line 20:		Line 20:

	=== nfs ===		=== nfs ===
			* http://damstux.free.fr/wiki/index.php?title=Autofs%2C_LDAP_et_NFS
	<pre>		<pre>
	dn: cn={6}autofs		dn: cn={6}autofs
Line 37:		Line 38:
	MUST ( ou ) )		MUST ( ou ) )
	</pre>		</pre>

	=== Tooling ===		=== Tooling ===
	Phpldapadmin is een eenvoudig webbased ldap tool.</br>		Phpldapadmin is een eenvoudig webbased ldap tool.</br>

Martin: /* Tooling */

2011-11-16T20:52:36Z

Tooling

@@ Line 19: / Line 19: @@
 * pam_ldap.conf passwd staat in ldap.secret
 === Tooling ===
 Phpldapadmin is een eenvoudig webbased ldap tool.</br>

Martin: /* Secrets */

2011-10-15T19:56:41Z

Secrets

← Older revision		Revision as of 19:56, 15 October 2011
Line 15:		Line 15:
	=== Secrets ===		=== Secrets ===
	Raar maar waar uit de documentatie blijkt:		Raar maar waar uit de documentatie blijkt:
	- ldap.conf passd staat in libnss-ldap.secret		* ldap.conf passd staat in libnss-ldap.secret
	- libnss-ldap.conf passwd staat in ldap.secret		* libnss-ldap.conf passwd staat in ldap.secret
	- pam_ldap.conf passwd staat in ldap.secret		* pam_ldap.conf passwd staat in ldap.secret

	=== Tooling ===		=== Tooling ===

Martin: /* Testen van de configuratie */

2011-10-15T19:56:18Z

Testen van de configuratie

← Older revision		Revision as of 19:56, 15 October 2011
Line 13:		Line 13:
	ldapsearch remote op IP adres		ldapsearch remote op IP adres
	</pre>		</pre>
			=== Secrets ===
			Raar maar waar uit de documentatie blijkt:
			- ldap.conf passd staat in libnss-ldap.secret
			- libnss-ldap.conf passwd staat in ldap.secret
			- pam_ldap.conf passwd staat in ldap.secret

	=== Tooling ===		=== Tooling ===
	Phpldapadmin is een eenvoudig webbased ldap tool.</br>		Phpldapadmin is een eenvoudig webbased ldap tool.</br>