LDAP. Lightweight Directory Access Protocol

Transcription

1 LDAP Lightweight Directory Access Protocol

2 Outline What is LDAP? Introduction Purpose NIS (Network Information Service) How does it look like? Structure Install & Setup Server & Client nss_ldap & pam_ldap Start service & Test Something useful Security Reference 2

3 Introduction LDAP abbr. of Lightweight Directory Access Protocol is an application protocol for querying and modifying directory services running over TCP/IP 3

4 Introduction (cont d) Directory is like a dictionary it allows one to look up a name and retrieve items of information associated with that name 4

5 Purpose To provide account information such as username, password, shell or home directory for authentication over the network 5

6 NIS abbr. of Network Information Service developed by Sun Microsystems, originally called Yellow Pages or YP has been substituted by degrees because of security issues and is less flexible DoSattack is easily accessed by someone who doesn't belong on your network 6

7 7

8 Structure Desktop PCs all without HDD and support PXE boot function DHCP & TFTP Server can be either split into two or just all built in one 8

9 Structure (cont d) In an entry, we have: DN distinguished name RDN relative distinguished name DC domain component OU organization unit CN common name We consider having entries like these: uid= ,ou=people,dc=csu,dc=csie,dc=ncu uid= ,ou=people,dc=csg,dc=csie,dc=ncu 9

10 Installation openldap server # cd /usr/ports/net/openldap24-server # make install # cd /usr/ports/net/nss_ldap # make install openldap client # cd /usr/ports/net/openldap24-client # make install # cd /usr/ports/net/nss_ldap # make install # cd /usr/ports/security/pam_ldap # make install 10

11 Setup Server side /usr/local/etc/openldap/slapd.conf include /usr/local/etc/openldap/schema/core.schema include /usr/local/etc/openldap/schema/cosine.schema include /usr/local/etc/openldap/schema/nis.schema include /usr/local/etc/openldap/schema/inetorgperson.schema database bdb suffix "dc=csie,dc=ncu" rootdn "cn=manager,dc=csie,dc=ncu" rootpw {SSHA}FnBUVAF8zpS1Hr+hEdjMtJdGb6FeAmc7 (generate using slappasswd) directory /var/db/openldap-data index objectclass eq index uid eq index uidnumber eq access to * attrs=userpassword by self write by * auth access to * by * read 11

12 Setup Server side (cont d) /usr/local/etc/openldap/ldap.conf BASE dc=csie, dc=ncu URI ldap:// nss_base_passwd dc=csie,dc=ncu nss_base_group dc=csie,dc=ncu pam_password md5 bind_timelimit 5 bind_policy soft rootbinddn cn=manager,dc=csie,dc=ncu /etc/rc.conf slapd_enable= YES # cp /usr/local/etc/openldap/db_config.example /var/db/openldap-data/db_config 12

13 Prepare ldif /root/base.ldif dn: dc=csie,dc=ncu objectclass: top objectclass: organization objectclass: dcobject o: csie dc: csie dn: ou=group,dc=csie,dc=ncu objectclass: top objectclass: organizationalunit ou: Group dn: dc=csu,dc=csie,dc=ncu objectclass: top objectclass: organization objectclass: dcobject o: csu dc: csu dn: dc=csg,dc=csie,dc=ncu objectclass: top objectclass: organization objectclass: dcobject o: csg dc: csg dn: ou=people,dc=csu,dc=csie,dc=ncu objectclass: top objectclass: organizationalunit ou: People dn: ou=people,dc=csg,dc=csie,dc=ncu objectclass: top objectclass: organizationalunit ou: People 13

14 Prepare ldif (cont d) /root/group.ldif dn: cn=csu,ou=group,dc=csie,dc=ncu objectclass: top objectclass: posixgroup cn: csu gidnumber: 206 dn: cn=csg,ou=group,dc=csie,dc=ncu objectclass: top objectclass: posixgroup cn: csg gidnumber:

15 Prepare ldif (cont d) /root/user.ldif dn: uid= ,ou=people,dc=csu,dc=csie,dc=ncu objectclass: top objectclass: person objectclass: organizationalperson objectclass: inetorgperson objectclass: posixaccount objectclass: shadowaccount objectclass: sambasamaccount cn: sn: givenname: uid: uidnumber: 1950 gidnumber: 206 loginshell: /bin/tcsh gecos: System User homedirectory: /USER/csie/cs93/ userpassword: e1xtsrf9bjkjmwrxnmlkunbhvkx3dnfzazjmbjqhymnc5f 15

16 Import user info # slapadd -v -l base.ldif # slapadd -v -l group.ldif # slapadd -v -l user.ldif 16

17 Start it Server # /usr/local/etc/rc.d/slapd start # sockstat grep slapd ldap slapd tcp4 *:389 *:* 17

18 Setup Client side /usr/local/etc/openldap/ldap.conf [see slide#12] 18

19 Setup Client side (cont d) # ln s /usr/local/etc/openldap/ldap.conf /usr/local/etc/ldap.conf # ln s /usr/local/etc/openldap/ldap.conf /usr/local/etc/nss_ldap.conf 19

20 Setup Client side (cont d) /etc/nsswitch.conf group: files ldap hosts: files dns passwd: files ldap networks: files shells: files services: files protocols: files rpc: files 20

21 Setup Client side (cont d) To make sshd to accept ldap account for login /etc/pam.d/sshd auth required pam_nologin.so no_warn auth sufficient pam_opie.so no_warn no_fake_prompts auth requisite pam_opieaccess.so no_warn allow_local auth sufficient pam_ldap.so no_warn use_first_pass auth required pam_unix.so no_warn try_first_pass sshd pam_ldap nss_ldap OpenLDAP lib OpenLDAP server bdb 21

22 Something useful Search: # ldapsearch -x -b "dc=csie,dc=ncu" uid= Modify: # ldapmodifiy -D "cn=manager,dc=csie,dc=ncu" -W -x -f modify.ldif Add: # ldapadd -D "cn=manager,dc=csie,dc=ncu" -W -x -f file.ldif Generate passwd: # slappasswd -h hash [password] Dump: # slapcat gzip f9 > backup.gz 22

23 Something useful (cont d) The format of modify.ldif: dn: uid= ,ou=people,dc=csie,dc=ncu changetype: modify userpassword: [my new password] 23

24 Something useful (cont d) The format of modify.ldif: dn: uid= ,ou=people,dc=csie,dc=ncu changetype: modify add: mail mail: 24

25 Something useful (cont d) The format of modify.ldif: dn: uid= ,ou=people,dc=csie,dc=ncu changetype: delete 25

26 Security Using firewall (pf, ipfw, tcpwrapper, ) to prevent attempting connections to LDAP server (port 389) by attacker tcpwrapper (/etc/hosts.allow): slapd : / : allow slapd : / : allow slapd : ALL : deny pf (/etc/pf.conf): #table <slapd> { , } block in on $ext_if proto tcp from any to $ext_if port 389 pass in on $ext_if proto tcp from <slapd> to $ext_if port 389 ipfw (/etc/firewall.rules): ipfw add deny tcp from any to me 389 ipfw add allow tcp from to me 389 ipfw add allow tcp from to me

27 Reference OpenLDAP Software 2.4 Administrator's Guide Steven's Linux Note Study-Area huihui OpenLDAP index OpenLDAP mirror mode manpages 27

28 Questions? <( )> 28