https://www.chepkov.com/w/index.php?action=history&feed=atom&title=LDAP_Authentication
LDAP Authentication - Revision history
2026-04-28T17:21:43Z
Revision history for this page on the wiki
MediaWiki 1.43.6
https://www.chepkov.com/w/index.php?title=LDAP_Authentication&diff=374&oldid=prev
Vvc at 01:17, 9 December 2009
2009-12-09T01:17:34Z
<p></p>
<p><b>New page</b></p><div>* Install required packages<br />
yum install openldap-servers openldap-clients nss_ldap<br />
* generate admin user password<br />
<pre><br />
[root@centos64 ~]# slappasswd <br />
New password: <br />
Re-enter new password: <br />
{SSHA}KaqRGp1hT8E8s6pqdtyAamWxXxVRODZ9<br />
</pre><br />
* update '''/etc/openldap/slapd.conf'''<br />
<pre><br />
database bdb<br />
suffix "dc=chepkov,dc=lan"<br />
rootdn "cn=root,dc=chepkov,dc=lan"<br />
rootpw {SSHA}KaqRGp1hT8E8s6pqdtyAamWxXxVRODZ9<br />
<br />
access to attrs="userPassword"<br />
by anonymous auth<br />
by self write<br />
by * none<br />
<br />
access to *<br />
by users read<br />
by * none<br />
<br />
</pre><br />
<br />
* copy DB_CONFIG in place<br />
<pre><br />
cp /etc/openldap/DB_CONFIG.example /var/lib/ldap/DB_CONFIG<br />
chown ldap:ldap /var/lib/ldap/DB_CONFIG<br />
</pre><br />
<br />
* start ldap server<br />
chkconfig ldap on<br />
service ldap start<br />
<br />
* edit '''/usr/share/openldap/migration/migrate_common.ph'''<br />
<pre><br />
$DEFAULT_MAIL_DOMAIN = "chepkov.lan";<br />
$DEFAULT_BASE = "dc=chepkov,dc=lan";<br />
</pre><br />
<br />
* populate basic entries<br />
/usr/share/openldap/migration/migrate_base.pl |ldapadd -x -D "cn=root,dc=chepkov,dc=lan" -W<br />
<br />
* create a user template from root user<br />
grep ^root /etc/passwd | /usr/share/openldap/migration/migrate_passwd.pl - > /tmp/testuser.ldiff<br />
<br />
* edit '''/tmp/testuser.ldiff''':<br />
<pre><br />
dn: uid=testuser,ou=People,dc=chepkov,dc=lan<br />
uid: testuser<br />
cn: testuser<br />
objectClass: account<br />
objectClass: posixAccount<br />
objectClass: top<br />
objectClass: shadowAccount<br />
userPassword: {crypt}$1$33w5rgPO$bd.N.h6yMRiiCPvRLAJPV.<br />
shadowLastChange: 14481<br />
shadowMax: 99999<br />
shadowWarning: 7<br />
loginShell: /bin/bash<br />
uidNumber: 1000<br />
gidNumber: 100<br />
homeDirectory: /home/testuser<br />
gecos: Test User<br />
<br />
</pre><br />
<br />
* Add testuser<br />
ldapadd -x -D "cn=root,dc=chepkov,dc=lan" -W -f /tmp/testuser.ldiff<br />
<br />
* enable pam_ldap<br />
authconfig --update --enableldap --enableldapauth --ldapserver="centos64.chepkov.lan" \<br />
--ldapbasedn="dc=chepkov,dc=lan" --enablelocauthorize --enablemkhomedir<br />
<br />
* update /etc/ldap.conf<br />
<pre><br />
# The distinguished name to bind to the server with<br />
# if the effective user ID is root. Password is<br />
# stored in /etc/ldap.secret (mode 600)<br />
rootbinddn cn=root,dc=chepkov,dc=lan<br />
</pre><br />
<br />
* Now you can change testuser password using regular passwd utility<br />
passwd testuser<br />
<br />
* and login as testuser<br />
<pre><br />
[root@centos64 migration]# ssh testuser@localhost<br />
testuser@localhost's password: <br />
Creating directory '/home/testuser'.<br />
[testuser@centos64 ~]$ id<br />
uid=1000(testuser) gid=100(users) groups=100(users)<br />
</pre><br />
<br />
* Enjoy</div>
Vvc