Translations by Stéphane V

For the latest news and information about <application>bzr</application> see the <ulink url="http://bazaar-vcs.org/">bzr</ulink> web site.

For more information on <application>screen</application> see the <ulink url="http://www.gnu.org/software/screen/">screen web site</ulink>.

Also, see the <application>screen-profiles</application><ulink url="https://launchpad.net/screen-profiles">project page</ulink> for more information.

Most Ethernet configuration is centralized in a single file, <filename>/etc/network/interfaces</filename>. If you have no Ethernet devices, only the loopback interface will appear in this file, and it will look something like this:

If you have only one Ethernet device, eth0, and it gets its configuration from a DHCP server, and it should come up automatically at boot, only two additional lines are required:

To configure your Ethernet device with a static IP address and custom configuration, some more information will be required. Suppose you want to assign the IP address 192.168.0.2 to the device eth1, with the typical netmask of 255.255.255.0. Your default gateway's IP address is 192.168.0.1. You would enter something like this into <filename>/etc/network/interfaces</filename>:

To manage DNS entries, you can add, edit, or remove DNS names from the <filename>/etc/resolv.conf</filename> file. A sample file is given below:

Bridging

Bridging multiple interfaces is a more advanced configuration, but is very useful in multiple scenarios. One scenario is setting up a bridge with multiple network interfaces, then using a firewall to filter traffic between two network segments. Another scenario is using bridge on a system with one interface to allow virtual machines direct access to the outside network. The following example covers the latter scenario.

Before configuring a bridge you will need to install the <application>bridge-utils</application> package. To install the package, in a terminal enter:

sudo apt-get install bridge-utils

Next, configure the bridge by editing <filename>/etc/network/interfaces</filename>:

Now restart networking to enable the bridge interface:

The new bridge interface should now be up and running. The <application>brctl</application> provides useful information about the state of the bridge, controls which interfaces are part of the bridge, etc. See <command>man brctl</command> for more information.

The <ulink url="http://manpages.ubuntu.com/manpages/jaunty/en/man5/interfaces.5.html">interafaces man page</ulink> has details on more options for <filename>/etc/network/interfaces</filename>.

For more information on DNS client configuration see the <ulink url="http://manpages.ubuntu.com/manpages/jaunty/en/man5/resolver.5.html">resolver man page</ulink>. Also, Chapter 6 of O'Reilly's <ulink url="http://oreilly.com/catalog/linag2/book/ch06.html">Linux Network Administrator's Guide</ulink> is a good source of resolver and name service configuration information.

For more information on <emphasis>bridging</emphasis> see the <ulink url="http://manpages.ubuntu.com/manpages/jaunty/en/man8/brctl.8.html">brctl man page</ulink> and the Linux Foundation's <ulink url="http://www.linuxfoundation.org/en/Net:Bridge">Net:Bridge</ulink> page.

include /etc/ldap/schema/core.schema include /etc/ldap/schema/collective.schema include /etc/ldap/schema/corba.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/duaconf.schema include /etc/ldap/schema/dyngroup.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/java.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/ppolicy.schema

Next, create a temporary directory to hold the output:

mkdir /tmp/ldif_output

Now using <application>slaptest</application> convert the schema files to LDIF:

slaptest -f schema_convert.conf -F /tmp/ldif_output

Adjust the configuration file name and temporary directory names if yours are different. Also, it may be worthwhile to keep the <filename>ldif_output</filename> directory around in case you want to add additional schemas in the future.

Edit the <filename>/tmp/ldif_output/cn=config/cn=schema/cn={8}misc.ldif</filename> file, changing the following attributes:

dn: cn=misc,cn=schema,cn=config ... cn: misc

And remove the following lines from the bottom of the file:

structuralObjectClass: olcSchemaConfig entryUUID: 10dae0ea-0760-102d-80d3-f9366b7f7757 creatorsName: cn=config createTimestamp: 20080826021140Z entryCSN: 20080826021140.791425Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20080826021140Z

The attribute values will vary, just be sure the attributes are removed.

Finally, using the <application>ldapadd</application> utility, add the new schema to the directory:

ldapadd -x -D cn=admin,cn=config -W -f /tmp/ldif_output/cn\=config/cn\=schema/cn\=\{8\}misc.ldif

There should now be a <emphasis>dn: cn={4}misc,cn=schema,cn=config</emphasis> entry in the cn=config tree.

LDAP directories can be populated with LDIF (LDAP Directory Interchange Format) files. Copy the following example LDIF file, naming it <filename>example.com.ldif</filename>, somewhere on your system:

To add the entries to the LDAP directory use the <application>ldapadd</application> utility:

ldapadd -x -D cn=admin,dc=example,dc=com -W -f example.com.ldif

LDAP often quickly becomes a highly critical service to the network. Multiple systems will come to depend on LDAP for authentication, authorization, configuration, etc. It is a good idea to setup a redundant system through replication.

The following is an example of a <emphasis>Multi-Master</emphasis> configuration. In this configuration each OpenLDAP server is configured for both <emphasis>push</emphasis> and <emphasis>pull</emphasis> replication.

First, configure the server to sync the <emphasis>cn=config</emphasis> database. Copy the following to a file named <filename>syncrepl_cn-config.ldif</filename>:

dn: cn=module{0},cn=config changetype: modify add: olcModuleLoad olcModuleLoad: syncprov dn: cn=config changetype: modify replace: olcServerID olcServerID: 1 ldap://ldap01.example.com olcServerID: 2 ldap://ldap02.example.com dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config changetype: add objectClass: olcOverlayConfig objectClass: olcSyncProvConfig olcOverlay: syncprov dn: olcDatabase={0}config,cn=config changetype: modify add: olcSyncRepl olcSyncRepl: rid=001 provider=ldap://ldap01.example.com binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 olcSyncRepl: rid=002 provider=ldap://ldap02.example.com binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 - add: olcMirrorMode olcMirrorMode: TRUE

ldapmodify -x -D cn=admin,cn=config -W -f syncrepl_backend.ldif

Because the servers' configuration is already synced there is no need to copy this LDIF file to the other servers.

The configuration and backend databases should now sycnc to the other servers. You can add additional servers using the <application>ldapmodify</application> utility as the need arises. See <xref linkend="openldap-configuration"/> for details.

127.0.0.1 ldap01.example.com ldap01

The <application>slapd</application> daemon will send log information to <filename>/var/log/syslog</filename> by default. So if all does <emphasis>not</emphasis> go well check there for errors and other troubleshooting information. Also, be sure that each server knows it's Fully Qualified Domain Name (FQDN). This is configured in <filename>/etc/hosts</filename> with a line similar to: <placeholder-1/>.

Authentication requires access to the password field, that should be not accessible by default. Also, in order for users to change their own password, using <command>passwd</command> or other utilities, <emphasis>shadowLastChange</emphasis> needs to be accessible once a user has authenticated.

To view the Access Control List (ACL), use the <application>ldapsearch</application> utility:

ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase=hdb olcAccess

Enter LDAP Password: dn: olcDatabase={1}hdb,cn=config olcAccess: {0}to attrs=userPassword,shadowLastChange by dn="cn=admin,dc=exampl e,dc=com" write by anonymous auth by self write by * none olcAccess: {1}to dn.base="" by * read olcAccess: {2}to * by dn="cn=admin,dc=example,dc=com" write by * read

TLS and SSL

Once <emphasis>TLS</emphasis> has been setup on each server, modify the <emphasis>cn=config</emphasis> replication by entering the following in a terminal:

dn: olcDatabase={0}config,cn=config replace: olcSyncrepl olcSyncrepl: {0}rid=001 provider=ldap://ldap01.example.com binddn="cn=admin,cn =config" bindmethod=simple credentials=secret searchbase="cn=config" type=refre shAndPersist retry="5 5 300 5" timeout=1 starttls=yes olcSyncrepl: {1}rid=002 provider=ldap://ldap02.example.com binddn="cn=admin,cn =config" bindmethod=simple credentials=secret searchbase="cn=config" type=refre shAndPersist retry="5 5 300 5" timeout=1 starttls=yes