Translations by Stéphane V

Enter LDAP Password: <placeholder-1/> modifying entry "olcDatabase={0}config,cn=config"

Now adjust the <emphasis>backend</emphasis> database replication:

dn: olcDatabase={1}hdb,cn=config replace: olcSyncrepl olcSyncrepl: {0}rid=003 provider=ldap://ldap01.example.com binddn="cn=admin,dc=example,dc= com" bindmethod=simple credentials=secret searchbase="dc=example,dc=com" type=r efreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes olcSyncrepl: {1}rid=004 provider=ldap://ldap02.example.com binddn="cn=admin,dc=example,dc= com" bindmethod=simple credentials=secret searchbase="dc=example,dc=com" type=r efreshOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=yes

Enter LDAP Password: <placeholder-1/> modifying entry "olcDatabase={1}hdb,cn=config"

If the LDAP server hostname does not match the Fully Qualified Domain Name (FQDN) in the certificate, you may have to edit <filename>/etc/ldap/ldap.conf</filename> and add the following TLS options:

TLS_CERT /etc/ssl/certs/server.crt TLS_KEY /etc/ssl/private/server.key TLS_CACERT /etc/ssl/certs/cacert.pem

Finally, restart <application>slapd</application> on each of the servers:

LDAP Authentication

Once you have a working LDAP server, the <application>auth-client-config</application> and <application>libnss-ldap</application> packages take the pain out of configuring an Ubuntu client to authenticate using LDAP. To install the packages from, a terminal prompt enter:

sudo apt-get install libnss-ldap

During the install a menu dialog will ask you connection details about your LDAP server.

If you make a mistake when entering your information you can execute the dialog again using:

sudo dpkg-reconfigure ldap-auth-config

The results of the dialog can be seen in <filename>/etc/ldap.conf</filename>. If your server requires options not covered in the menu edit this file accordingly.

Now that <application>libnss-ldap</application> is configured enable the <application>auth-client-config</application> LDAP profile by entering:

sudo auth-client-config -t nss -p lac_ldap

<emphasis>-t:</emphasis> only modifies <filename>/etc/nsswitch.conf</filename>.

<emphasis>-p:</emphasis> name of the profile to enable, disable, etc.

<emphasis>lac_ldap:</emphasis> the <application>auth-client-config</application> profile that is part of the <application>ldap-auth-config</application> package.

Using the <application>pam-auth-update</application> utility, configure the system to use LDAP for authentication:

sudo pam-auth-update

From the <application>pam-auth-update</application> menu, choose LDAP and any other authentication mechanisms you need.

You should now be able to login using user credentials stored in the LDAP directory.

If you are going to use LDAP to store Samba users you will need to configure the server to authenticate using LDAP. See <xref linkend="samba-ldap"/> for details.

User and Group Management

The <application>ldap-utils</application> package comes with multiple utilities to manage the directory, but the long string of options needed, can make them a burden to use. The <application>ldapscripts</application> package contains configurable scripts to easily manage LDAP users and groups.

To install the package, from a terminal enter:

sudo apt-get install ldapscripts

Next, edit the config file <filename>/etc/ldapscripts/ldapscripts.conf</filename> uncommenting and changing the following to match your environment:

SERVER=localhost BINDDN='cn=admin,dc=example,dc=com' BINDPWDFILE="/etc/ldapscripts/ldapscripts.passwd" SUFFIX='dc=example,dc=com' GSUFFIX='ou=Groups' USUFFIX='ou=People' MSUFFIX='ou=Computers' GIDSTART=10000 UIDSTART=10000 MIDSTART=10000

Now, create the <filename>ldapscripts.passwd</filename> file to allow authenticated access to the directory:

sudo sh -c "echo -n 'secret' &gt; /etc/ldapscripts/ldapscripts.passwd"

sudo chmod 400 /etc/ldapscripts/ldapscripts.passwd

Replace <quote>secret</quote> with the actual password for your LDAP admin user.

The <application>ldapscripts</application> are now ready to help manage your directory. The following are some examples of how to use the scripts:

Create a new user:

sudo ldapadduser george example

This will create a user with uid <emphasis role="italic">george</emphasis> and set the user's primary group (gid) to <emphasis role="italic">example</emphasis>

<application>Kerberos</application> is a network authentication system based on the principal of a trusted third party. The other two parties being the user and the service the user wishes to authenticate to. Not all services and applications can use Kerberos, but for those that can, it brings the network environment one step closer to being Single Sign On (SSO).

This section covers installation and configuration of a Kerberos server, and some example client configurations.

If you are new to Kerberos there are a few terms that are good to understand before setting up a Kerberos server. Most of the terms will relate to things you may be familiar with in other environments:

<emphasis>Principal:</emphasis> any users, computers, and services provided by servers need to be defined as Kerberos Principals.

sudo /etc/init.d/krb5-admin-server restart

The new user principal can be tested using the <application>kinit utility</application>:

kinit steve/admin

steve/admin@EXAMPLE.COM's Password:

After entering the password, use the <application>klist</application> utility to view information about the Ticket Granting Ticket (TGT):

klist

You may need to add an entry into the <filename>/etc/hosts</filename> for the KDC. For example:

192.168.0.1 kdc01.example.com kdc01