FreeSource - AltLinux/��/OpenLDAP

2008-03-22 15:38:31

�� /Alt Linux / �� / Open LDAP �� 2008-03-22 15:38:31 � 2008-03-22 17:11:48

��:

�� altlinux.org. �� freesource.info ��.

Andrey Chesnokov (aacchhee@gmail.com)
�� branch4.0 LDAP �� loopback-�� SSL. �� /etc/sysconfig/ldap:
� branch4.0 �� ldap �� tty12. �� , �� /etc/syslog.conf ��:
[root@huygens ]# cat /etc/syslog.conf | grep ldap
local4.* -/var/log/ldap/slapd.log
� �� syslogd.

��:

�� ALTLinux LDAP �� loopback-�� ssl. �� /etc/sysconfig/ldap:

2007-04-10 21:24:13

�� /Alt Linux / �� / Open LDAP �� 2007-04-10 21:24:13 � 2008-03-22 15:38:31

��:

�� LDAP c �� , �� , �� LDAP �� public interface:
[root@huygens sysconfig]# netstat -al | grep LISTEN
tcp 0 0 *:ldap *:* LISTEN
�� ALTLinux LDAP �� loopback-�� ssl. �� /etc/sysconfig/ldap:
SLAPDURLLIST="'ldap://localhost/ ldaps:///'"
#SLAPDURLLIST="'ldap:/// ldaps:///'"
�� SSL.

2006-09-05 12:01:54

�� /Alt Linux / �� / Open LDAP �� 2006-09-05 12:01:54 � 2007-04-10 21:24:13

��:

�� Postfix (not implemented)

��:

�� Postifx (not implemented)

2006-08-12 12:55:02

�� /Alt Linux / �� / Open LDAP �� 2006-08-12 12:55:02 � 2006-09-05 12:01:54

��:

�� /etc/openldap/ldap.conf �� . ��, �� (� �� , �� LDAP �� ) – �� +��, � �� (��) �� /etc/openldap/ldap.conf � CA-��.
�� . �� :

��:

�� /etc/openldap/ldap.conf �� . ��, �� (� �� , �� LDAP �� ) – �� +��, � �� (��) �� /etc/openlsap/ldap.conf � CA-��.
�� . �� :

2006-08-12 12:01:59

�� /Alt Linux / �� / Open LDAP �� 2006-08-12 12:01:59 � 2006-08-12 12:55:02

��:

�� OpenLDAP � ��

�� Open LDAP? �� , �� :
# �� ,

# print PASSWD_FILE "# LDAP users\n";

print PASSWD_FILE "$var\n";
print TCB_FILE $shadow{$key}."\n";

sambaHomePath : \\ring.local\anton
sambaProfilePath : \\ring.local\profiles\anton

��:

<u style="display: none;">... no changes ... no changes ... no changes ... no changes ... no changes ... no changes ... no changes ... no changes ... no changes ... no changes ... no changes ... <a href='http://www.ringtones-rate.com'>mp3 ringtones</a> : [http://www.ringtones-rate.com real ringtones] – [HTTP://www.ringtones-rate.com real ringtones] : [motorola ringtones|http://www.ringtones-rate.com] – [motorola ringtones|HTTP://www.ringtones-rate.com] : http://www.ringtones-rate.com/tones/ : tracfone ringtones : qwest ringtones : “nextel ringtones” http://www.ringtones-rate.com : [http://www.ringtones-rate.com|funny ringtones] </u>== �� OpenLDAP � �� ==
�� Open LDAP? �� , ��
2000
��:
# ��
4000
� � ��,

# print PASSWD_FILE "# LDAP users

“;

print PASSWD_FILE "$var

print TCB_FILE $shadow{$key}."

";
Organ
5708
izational Unit Name (eg, section) []:Sys Admin
sambaHomePath : \ring.localnton
sambaProfilePath : \ring.localprofilesnton

2006-08-04 14:33:50

�� /Alt Linux / �� / Open LDAP �� 2006-08-04 14:33:50 � 2006-08-12 12:01:59

��:

# print PASSWD_FILE "# LDAP users

“;

print PASSWD_FILE "$var

print TCB_FILE $shadow{$key}."

";
Organ
5708
izational Unit Name (eg, section) []:Sys Admin
sambaHomePath : \ring.localnton
sambaProfilePath : \ring.localprofilesnton

��:

�� OpenLDAP � ��

�� Open LDAP? �� , �� :
# �� ,

# print PASSWD_FILE "# LDAP users\n";

print PASSWD_FILE "$var\n";
print TCB_FILE $shadow{$key}."\n";

sambaHomePath : \\ring.local\anton
sambaProfilePath : \\ring.local\profiles\anton

2006-07-25 08:05:45

�� /Alt Linux / �� / Open LDAP �� 2006-07-25 08:05:45 � 2006-08-04 14:33:50

��:

Squid+LDAP+TLS

�� -�� squid �� openldap-�� . �� ..�� -��
cat /etc/squid/squid.conf |grep ldap
auth_param basic program /usr/lib/squid/squid_ldap_auth -P -b dc=nirvana,dc=home -f (uid=%s) -H "ldaps://ring.local" -v 3 -p 636
external_acl_type ldap_group %LOGIN /usr/lib/squid/squid_ldap_group -P -b dc=nirvana,dc=home -f (&(memberUid=%v)(cn=%a)) -H "ldaps://ring.local" -v 3 -p 636
acl users external ldap_group squiduser
....
#myACL
acl users external ldap_group squiduser
http_access allow users
�� squiduser � LDAP:
dn:cn=squiduser,ou=Groups,dc=nirvana,dc=home
objectClass: posixGroup
cn: squiduser
gidNumber: 10007
memberUid: proxyuser
memberUid: proxyuser2
...

2006-07-22 10:24:20

�� /Alt Linux / �� / Open LDAP �� 2006-07-22 10:24:20 � 2006-07-25 08:05:45

��:

{{TableOfContents page="" title="" numerate=""}}
�� : «�� », �� -�� :)
suffix «dc=<youhostname>,dc=<youdomainname>"
suffix «dc=nirvana,dc=home»

�� rootdn – �� «�� » �� . �� dn, �� . �� rootpw, �� (�� sasl + krb5), �� , �� pwgen.
�� directory �� «��» ldap:

directory /var/lib/ldap/bases/<�� >
objectClass �� , � �� «��» � �� “o:» �� “home”.
�� «��» � ldap.
# ldapadd -x -f newentry.ldif -h '�� slapd' -D <�� rootdn> -w <�� rootpw>
adding new entry «dc=nirvana, dc=home»
adding new entry «ou=People,dc=nirvana,dc=home»
# ./migrate_passwd.pl /etc/passwd > /accounts.ldif
# ldapadd -f /accounts.ldif -h '�� slapd' -p 389 -x -D <�� rootdn> -w <�� rootpw>
ldapserver# slapadd -b <�� suffix> -l /accounts.ldif
�� , �� «��» � ldap.
base <suffix>
# �� , �� <protocol>://<hostname>/
uri <uri to ldapserver>
# �� , �� «��» �� (bind)
binddn <DN to bind with>
# (�� passwd <username> ��-�� root
rootbinddn <dn to bind as root>
port <port number>
scope <scope for search>
pam_filter <filter>
pam_login_attribute <login attribute>
#pam_groupdn cn=<groupname>,ou=Groups,dc=nirvana,dc=home
pam_min_uid <number>
pam_max_uid <number>
pam_password <�� >
nss_base_passwd ou=People,<suffix>
nss_base_shadow ou=People,<suffix>
nss_base_group ou=Group,<suffix>
�� pam �� pam_ldap �� – �� , �� '>' � �� /etc/pam.d/system-auth

> auth sufficient /lib/security/pam_ldap.so

> account sufficient /lib/security/pam_ldap.so

> password sufficient /lib/security/pam_ldap.so use_authtok

> session optional /lib/security/pam_ldap.so

> account required /lib/security/pam_mkhomedir.so skel=/etc/skel.ru_RU.KOI8-R/ umask=0077

�� sshd (��-�� pam_userpass) � xscreensaver (��-�� <PAMROOT>/system-auth-user_first_pass)

> auth sufficient pam_ldap.so use_first_pass

> auth sufficient /lib/security/pam_ldap.so use_first_pass

> password sufficient /lib/security/pam_ldap.so use_first_pass

0. $ ldapsearch -x -h 'ldap://<hostname>/' -d -1
7. # su – <user not in ldap>

PAM_LDAP -> PAM_TCB

��, �� ldap �� «��», � �� – � �� pam_tcb (�� pam)
$TCB_ROOT = "$ENV{HOME}/etc/tcb" if $TCB_ROOT eq ;
$PASSWD = "$ENV{HOME}/etc/passwd" if $PASSWD eq ;
$BASEDN = «dc=nirvana,dc=home» if $BASEDN eq ;
$BINDDN = "cn=tcb,$BASEDN" if $BINDDN eq ;
$URI = "ldap://ldap.server/" if $URI eq ;
$VERIFY = "never" if $VERIFY eq ;
$CAFILE = «/etc/openldap/ssl/cacert.pem» if $CAFILE eq ;
$MIN_UID_NUMBER = 500 if $MIN_UID_NUMBER eq ;
$MAX_UID_NUMBER = 65535 if $MAX_UID_NUMBER eq ;
$pe = join(':', $e->get_value('uid'), 'x', $e->get_value('uidNumber'),
$e->get_value('gidNumber'), $e->get_value('gecos'),
$e->get_value('homeDirectory'), $e->get_value('loginshell'));
$uid = $e->get_value('uid');
$passwd = $e->get_value('userPassword');
$e->get_value('shadowLastChange')., $e->get_value('shadowMin').,
$e->get_value('shadowMax')., $e->get_value('shadowWarning').,
$e->get_value('shadowInactive').,

$e->get_value('shadowExpire').,
$e->get_value('shadowFlag').);

open(PASSWD_TEMPLATE,"<$PASSWD")

or die “Cannot open system users file”;

while(<PASSWD_TEMPLATE>)

if( $entry[2] < $MIN_UID_NUMBER or $entry[2] > $MAX_UID_NUMBER )

@passwd = (@passwd, , @ldappasswd);
system("cp $PASSWD $PASSWD-");
open(PASSWD_FILE,">$PASSWD");
# print PASSWD_FILE "# LDAP users\n";
print PASSWD_FILE "$var\n";
if ( $< == 0 )
chown getuid("root"), getgid("root"), $PASSWD;
mkdir "$TCB_ROOT" if ( ! -d "$TCB_ROOT" );
if ( $< == 0 )
chown getuid("root"), getgid("shadow"), $TCB_ROOT;
mkdir "$TCB_ROOT/$key" if ( ! -d "$TCB_ROOT/$key" );
open(TCB_FILE, ">$TCB_ROOT/$key/shadow");
print TCB_FILE $shadow{$key}."\n";
if ( $< == 0 )
chown getuid($key), getgid("auth"), "$TCB_ROOT/$key";
chown getuid($key), getgid("auth"), "$TCB_ROOT/$key/shadow";
chmod 02710, "$TCB_ROOT/$key";
chmod 0640, "$TCB_ROOT/$key/shadow";
my $ldap = Net::LDAP->new( $URI,
verify => $VERIFY,
cafile => $CAFILE
) or die "$@";
my $mesg = $ldap->bind( $BINDDN, password => $PASSWORD ) ;
$mesg = $ldap->search( # perform a search
base => "$BASEDN",
filter => "(&(objectClass=posixAccount)$FILTER)",
scope => 'sub'
$mesg->code && die $mesg->error;
#foreach $entry ($mesg->all_entries) { $entry->dump; }
foreach my $entry ( $mesg->entries) {
my $uid = $entry->get_value('uidNumber' );
if( $uid >= $MIN_UID_NUMBER &&
$uid <= $MAX_UID_NUMBER)
$mesg = $ldap->unbind; # take down session
�� <YOUR ADMIN DN> �� DN � �� (� �� uid=davinchi,ou=People,dc=vnet1)
by dn="^<YOUR ADMIN DN>$" write
by dn="^<YOUR ADMIN DN>$" write
by dn="^<YOUR ADMIN DN>$" write
by dn="^<YOUR ADMIN DN>$" write
�� , � �� LDAP'� �� (�� ) -�� LDAP'� "��", �� (�� ) �� (�� LDAP)
�� ldap-��. � �� ##Common Name## �� "ring.local" � �� ldap-�� . �� IP 192.168.1.111 � �� . �� ring.local.
�� "CN �� ", �� SASL/KRB5.
Enter PEM pass phrase:<sobakazlaya:)>
Verifying - Enter PEM pass phrase:<sobakazlaya>
A challenge password []:<�� enter>
Enter pass phrase for ./demoCA/private/cakey.pem:<�� , �� >
<�� >
<� �� >
�� /etc/sysconfig � �� "ldap"
SLAPDURLLIST="ldap://localhost/"
#SLAPDURLLIST="ldap://localhost/ ldaps:///"
#SLAPDURLLIST="ldap:/// ldaps:///"
SLAPD_OPTIONS=

#SLAPDURLLIST="ldap://localhost/"
SLAPDURLLIST='"ldap://localhost/ ldaps:///"'
#SLAPDURLLIST='"ldap://localhost/ ldap:///"'
#SLAPDURLLIST="ldap:/// ldaps:///"
SLAPD_OPTIONS=""
SLAPDURLLIST='"ldap://localhost/ ldaps:///"' — �� ' (�� ) +" (��)ldap://localhost/ ldaps:///" (��)+' (�� )
<��>
<��>
<� �� >
(��: ��, rpm -qf /etc/openldap/ldap.conf => openldap-clients)
�� — �� cacert, �� nss_ldap �� «�� ».
ldap admin dn = «cn=admin,dc=Myvery COO Lwork?"
ldap admin dn = «cn=admin,dc=Myvery COO Lwork?"
sambaHomePath : \\ring.local\anton
sambaProfilePath : \\ring.local\profiles\anton

��:

{{TableOfContents page= title= numerate=}}
�� : "�� ", �� -�� :)
suffix "dc=<youhostname>,dc=<youdomainname>"
suffix "dc=nirvana,dc=home"

�� rootdn – �� "�� " �� . �� dn, �� . �� rootpw, �� (�� sasl + krb5), �� , �� pwgen.
�� directory �� "��" ldap:

directory /var/lib/ldap/bases/<�� >
objectClass �� , � �� "��" � �� "o:" �� "home".
�� "��" � ldap.
# ldapadd -x -f newentry.ldif -h '�� slapd' -D <�� rootdn> -w <�� rootpw>
adding new entry "dc=nirvana, dc=home"
adding new entry "ou=People,dc=nirvana,dc=home"
# ./migrate_passwd.pl /etc/passwd > /accounts.ldif
# ldapadd -f /accounts.ldif -h '�� slapd' -p 389 -x -D <�� rootdn> -w <�� rootpw>
ldapserver# slapadd -b <�� suffix> -l /accounts.ldif
�� , �� "��" � ldap.
base <suffix>
# �� , �� <protocol>://<hostname>/
uri <uri to ldapserver>
# �� , �� "��" �� (bind)
binddn <DN to bind with>
# (�� passwd <username> ��-�� root
rootbinddn <dn to bind as root>
port <port number>
scope <scope for search>
pam_filter <filter>
pam_login_attribute <login attribute>
#pam_groupdn cn=<groupname>,ou=Groups,dc=nirvana,dc=home
pam_min_uid <number>
pam_max_uid <number>
pam_password <�� >
nss_base_passwd ou=People,<suffix>
nss_base_shadow ou=People,<suffix>
nss_base_group ou=Group,<suffix>
�� pam �� pam_ldap �� – �� , �� '>' � �� /etc/pam.d/system-auth
> auth sufficient /lib/security/pam_ldap.so
> account sufficient /lib/security/pam_ldap.so
> password sufficient /lib/security/pam_ldap.so use_authtok
> session optional /lib/security/pam_ldap.so
> account required /lib/security/pam_mkhomedir.so skel=/etc/skel.ru_RU.KOI8-R/ umask=0077
�� sshd (��-�� pam_userpass) � xscreensaver (��-�� <PAMROOT>/system-auth-user_first_pass)
> auth sufficient pam_ldap.so use_first_pass
> auth sufficient /lib/security/pam_ldap.so use_first_pass
> password sufficient /lib/security/pam_ldap.so use_first_pass
0. $ ldapsearch -x -h 'ldap://<hostname>/' -d -1
7. # su – <user not in ldap>

PAM_LDAP -> PAM_TCB

��, �� ldap �� "��", � �� – � �� pam_tcb (�� pam)
$TCB_ROOT = "$ENV{HOME}/etc/tcb" if $TCB_ROOT eq ;
$PASSWD = "$ENV{HOME}/etc/passwd" if $PASSWD eq ;
$BASEDN = "dc=nirvana,dc=home" if $BASEDN eq ;
$BINDDN = "cn=tcb,$BASEDN" if $BINDDN eq ;
$URI = "ldap://ldap.server/" if $URI eq ;
$VERIFY = "never" if $VERIFY eq ;
$CAFILE = "/etc/openldap/ssl/cacert.pem" if $CAFILE eq ;
$MIN_UID_NUMBER = 500 if $MIN_UID_NUMBER eq ;
$MAX_UID_NUMBER = 65535 if $MAX_UID_NUMBER eq ;

$pe = join(':', $e->get_value('uid'), 'x', $e->get_value('uidNumber'),

$e->get_value('gidNumber'), $e->get_value('gecos'),
$e->get_value('homeDirectory'), $e->get_value('loginshell'));

$uid = $e->get_value('uid');
$passwd = $e->get_value('userPassword');

$e->get_value('shadowLastChange')., $e->get_value('shadowMin').,
$e->get_value('shadowMax')., $e->get_value('shadowWarning').,
$e->get_value('shadowInactive').,
$e->get_value('shadowExpire').,
$e->get_value('shadowFlag').);

open(PASSWD_TEMPLATE,"<$PASSWD")

or die "Cannot open system users file";

while(<PASSWD_TEMPLATE>)

if( $entry[2] < $MIN_UID_NUMBER or $entry[2] > $MAX_UID_NUMBER )

@passwd = (@passwd,, @ldappasswd);
system("cp $PASSWD $PASSWD-");
open(PASSWD_FILE,">$PASSWD");
# print PASSWD_FILE "# LDAP users

print PASSWD_FILE "$var

if ( $< == 0 )

chown getuid("root"), getgid("root"), $PASSWD;

mkdir "$TCB_ROOT" if ( ! -d "$TCB_ROOT" );
if ( $< == 0 )

chown getuid("root"), getgid("shadow"), $TCB_ROOT;
mkdir "$TCB_ROOT/$key" if ( ! -d "$TCB_ROOT/$key" );
open(TCB_FILE, ">$TCB_ROOT/$key/shadow");
print TCB_FILE $shadow{$key}."

if ( $< == 0 )
chown getuid($key), getgid("auth"), "$TCB_ROOT/$key";
chown getuid($key), getgid("auth"), "$TCB_ROOT/$key/shadow";
chmod 02710, "$TCB_ROOT/$key";
chmod 0640, "$TCB_ROOT/$key/shadow";

my $ldap = Net::LDAP->new( $URI,

verify => $VERIFY,
cafile => $CAFILE

) or die "$@";

my $mesg = $ldap->bind( $BINDDN, password => $PASSWORD ) ;
$mesg = $ldap->search( # perform a search

base => "$BASEDN",
filter => "(&(objectClass=posixAccount)$FILTER)",
scope => 'sub'

$mesg->code && die $mesg->error;
#foreach $entry ($mesg->all_entries) { $entry->dump; }
foreach my $entry ( $mesg->entries) {

my $uid = $entry->get_value('uidNumber' );
if( $uid >= $MIN_UID_NUMBER &&

$uid <= $MAX_UID_NUMBER)

$mesg = $ldap->unbind; # take down session
�� <YOUR ADMIN DN> �� DN � �� (� �� uid=davinchi,ou=People,dc=vnet1)

by dn="^<YOUR ADMIN DN>$" write
by dn="^<YOUR ADMIN DN>$" write
by dn="^<YOUR ADMIN DN>$" write
by dn="^<YOUR ADMIN DN>$" write

�� , � �� LDAP'� �� (�� ) -�� LDAP'� "��", �� (�� ) �� (�� LDAP)
�� ldap-��. � �� Common Name �� "ring.local" � �� ldap-�� . �� IP 192.168.1.111 � �� . �� ring.local.
�� "CN �� ", �� SASL/KRB5.
Enter PEM pass phrase:<sobakazlaya:)>
Verifying – Enter PEM pass phrase:<sobakazlaya>
A challenge password []:<�� enter>
Enter pass phrase for ./demoCA/private/cakey.pem:<�� , �� >

<�� >
<� �� >

�� /etc/sysconfig � �� "ldap"
SLAPDURLLIST="ldap://localhost/"
#SLAPDURLLIST="ldap://localhost/ ldaps:///"
#SLAPDURLLIST="ldap:/// ldaps:///"
SLAPD_OPTIONS=
#SLAPDURLLIST="ldap://localhost/"
SLAPDURLLIST='"ldap://localhost/ ldaps:///"'
#SLAPDURLLIST='"ldap://localhost/ ldap:///"'
#SLAPDURLLIST="ldap:/// ldaps:///"
SLAPD_OPTIONS=
SLAPDURLLIST='"ldap://localhost/ ldaps:///"' — �� ' (�� ) +" (��)ldap://localhost/ ldaps:///" (��)+' (�� )
<��>
<��>
<� �� >
(��: ��, rpm -qf /etc/openldap/ldap.conf => openldap-clients)
�� — �� cacert, �� nss_ldap �� "�� ".
ldap admin dn = "cn=admin,dc=Myvery COO Lwork?"
ldap admin dn = "cn=admin,dc=Myvery COO Lwork?"
sambaHomePath : \ring.localnton
sambaProfilePath : \ring.localprofilesnton

2006-07-22 10:24:10

�� /Alt Linux / �� / Open LDAP �� 2006-07-22 10:24:10 � 2006-07-22 10:24:20

��:

<div style="abc">123</div> <div style="bcd">456</div> [http://google.com SE Google] SE Yahoo

FreeSource - AltLinux/������������/OpenLDAP

2008-03-22 15:38:31

2007-04-10 21:24:13

2006-09-05 12:01:54

2006-08-12 12:55:02

2006-08-12 12:01:59

��������� OpenLDAP � ��� ��������

2006-08-04 14:33:50

��������� OpenLDAP � ��� ��������

2006-07-25 08:05:45

Squid+LDAP+TLS

2006-07-22 10:24:20

PAM_LDAP -> PAM_TCB

PAM_LDAP -> PAM_TCB

2006-07-22 10:24:10

FreeSource - AltLinux/��/OpenLDAP

�� OpenLDAP � ��

�� OpenLDAP � ��