LDAP authentication - final
I've completed a bash script that will take a fresh install of Lucid or Maverick and set it up to authenticate against the UVic LDAP server. Here's the short version to set things up:
1) Install these packages: libnss-ldapd, libpam-ldapd, nscd, nslcd
NOTE: Configuring them using the provided debconf script is pointless as it misses a number of essential configurations. So, just go through the motions when it asks you for configs.
2) Edit the /etc/nslcd.conf file so it looks like this
#####################################################
uid nslcd
gid nslcd
uri ldaps://ldap1r.uvic.ca/
base ou=People,dc=uvic,dc=ca
tls_reqcert demand
tls_cacertfile /etc/ssl/certs/Thawte_Premium_Server_CA.pem
map passwd homeDirectory "/home/netlink/\$uid"
map passwd gidNumber "1001"
#####################################################
3) Edit the /etc/nsswitch.conf file so that it looks like this:
#####################################################
passwd: files ldap
group: files ldap
shadow: files ldap
hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
#####################################################
4) Edit the /etc/pam.d/common-session file so that it looks like this:
#####################################################
session required pam_mkhomedir.so skel=/etc/skel umask=022
session [default=1] pam_permit.so
session requisite pam_deny.so
session required pam_permit.so
session required pam_unix.so
session optional pam_ldap.so
session optional pam_ck_connector.so nox11
#####################################################
5) Edit the /etc/pam.d/gnome-screensaver so that it looks like this:
#####################################################
@include common-auth
@include common-session
auth optional pam_gnome_keyring.so
#####################################################
6) Edit the /etc/security/group.conf file so that it looks like this:
#####################################################
*;*;*;Al0000-2400;adm dialout fax cdrom floppy tape dip video plugdev fuse netlink
#####################################################
7) Add a netlink group to the machine - groupadd netlink
8) Reboot so configs take effect.
9) You should be able to log in with your netlink ID and get a home directory at /home/netlink/$netlinkID
The uploaded script has more detail/rationalization for the choices made, but this should get the ball rolling.