Maintenance

  • Home
  • Log in
  • « Moving dev projects from Lettuce to Pear
  • Rebuild basically complete »

LDAP authentication - final

Posted by gregster on 21 Sep 2010 in R & D, Documentation

I've completed a bash script that will take a fresh install of Lucid or Maverick and set it up to authenticate against the UVic LDAP server. Here's the short version to set things up:

1) Install these packages: libnss-ldapd, libpam-ldapd, nscd, nslcd
NOTE: Configuring them using the provided debconf script is pointless as it misses a number of essential configurations. So, just go through the motions when it asks you for configs.

2) Edit the /etc/nslcd.conf file so it looks like this
#####################################################
uid nslcd
gid nslcd
uri ldaps://ldap1r.uvic.ca/
base ou=People,dc=uvic,dc=ca
tls_reqcert demand
tls_cacertfile /etc/ssl/certs/Thawte_Premium_Server_CA.pem
map passwd homeDirectory "/home/netlink/\$uid"
map passwd gidNumber "1001"
#####################################################

3) Edit the /etc/nsswitch.conf file so that it looks like this:
#####################################################
passwd: files ldap
group: files ldap
shadow: files ldap
hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis
#####################################################

4) Edit the /etc/pam.d/common-session file so that it looks like this:
#####################################################
session required pam_mkhomedir.so skel=/etc/skel umask=022
session [default=1] pam_permit.so
session requisite pam_deny.so
session required pam_permit.so
session required pam_unix.so
session optional pam_ldap.so
session optional pam_ck_connector.so nox11
#####################################################

5) Edit the /etc/pam.d/gnome-screensaver so that it looks like this:
#####################################################
@include common-auth
@include common-session
auth optional pam_gnome_keyring.so
#####################################################

6) Edit the /etc/security/group.conf file so that it looks like this:
#####################################################
*;*;*;Al0000-2400;adm dialout fax cdrom floppy tape dip video plugdev fuse netlink
#####################################################

7) Add a netlink group to the machine - groupadd netlink

8) Reboot so configs take effect.

9) You should be able to log in with your netlink ID and get a home directory at /home/netlink/$netlinkID

The uploaded script has more detail/rationalization for the choices made, but this should get the ball rolling.

This entry was posted by Greg and filed under R & D, Documentation.

Maintenance

This blog is the location for all work involving software and hardware maintenance, updates, installs, etc., both routine and urgent.
  • Home
  • Recently
  • Archives
  • Categories

Search

Categories

  • All
  • Announcements
  • Hit by a bus
  • Labs
    • Activity log
    • Documentation
  • Notes
  • R & D
    • Activity log
    • Documentation
  • Servers
    • Activity log
    • Documentation
  • Tasks

All blogs

  • Academic
  • AdaptiveDB
  • Admin
  • Announcements
  • CanMys
  • Cascade
  • CGWP
  • ColDesp
  • Depts
  • DVPP
  • Endings
  • HCMC Blogs
  • Landscapes
  • LEMDO
  • Linguistics
  • Maint
  • LondonMap
  • Mariage
  • MoM
  • Moses
  • Pro-D
  • Projects
  • ScanCan
  • HumsSites
  • Wendat

This collection ©2026 by admin • Help • Community CMS