OpenLDAP - Revision history

Leo at 07:28, 7 March 2022

2022-03-07T07:28:21Z

← Older revision		Revision as of 07:28, 7 March 2022
Line 291:		Line 291:
	*https://7thzero.com/blog/configure-centos-7-samba-server-use-secure-ldap-authentication		*https://7thzero.com/blog/configure-centos-7-samba-server-use-secure-ldap-authentication
	*https://clark-technet.com/linux-guides/samba-and-ldap-setup		*https://clark-technet.com/linux-guides/samba-and-ldap-setup
			*https://www.informit.com/articles/article.aspx?p=422302&seqNum=4 - technical Info on ldap and samba integration backend

Leo: /* Samba integration */

2022-03-07T07:14:27Z

Samba integration

← Older revision		Revision as of 07:14, 7 March 2022
Line 192:		Line 192:

	===Samba integration===		===Samba integration===
	Samba ~~integration with~~ LDAP ~~simply means that the~~ samba credentials ~~and user properties are stored in the user's account~~ rather than ~~the~~ SAM database on the ~~local server~~. ~~The steps below will go over how~~ to ~~set~~ this up.		You can have Samba use LDAP as a password backend, allowing you to store samba account credentials on LDAP rather than a local SAM database. This can be useful if you have accounts with the same password across multiple Samba servers.
			{{Info
	~~Note: Your~~ LDAP server ~~should have~~ the ~~samba~~ schemas. If you are using the osixia ~~OpenLDAP~~ container, this ~~should~~ already be bundled.		\| title = Alternatively, use Kerberos
			\| message = An alternative to this approach would be to have Samba use Kerberos, but (correct me if I'm wrong) this doesn't allow users the ability to use authentication as the user's machine authenticates using an existing kerberos ticket.
			}}
			Before you begin, ensure that your LDAP server has the Samba schemas installed. If you are using the [https://github.com/osixia/docker-openldap osixia/openldap container image], this is already be bundled.

	Edit <code>smb.conf</code>. Add the following lines under <code>[global]</code>:		Edit <code>smb.conf</code>. Add the following lines under <code>[global]</code>:
	{{Highlight		{{Highlight
	\| code = [global]		\| code = [global]
	workgroup = MYGROUP		workgroup = MYGROUP # Change me to your workgroup name
	passdb backend = ldapsam:ldap://10.1.1.9		passdb backend = ldapsam:ldap://10.1.1.9 # Change me to your LDAP server
	ldap suffix = dc=home,dc=steamr,dc=com		ldap suffix = dc=home,dc=steamr,dc=com
	ldap admin dn = cn=admin,dc=home,dc=steamr,dc=com		ldap admin dn = cn=admin,dc=home,dc=steamr,dc=com
Line 212:		Line 215:
	Change the workgroup name and LDAP server and base DN as required. For this example, I will not be using TLS.		Change the workgroup name and LDAP server and base DN as required. For this example, I will not be using TLS.

	Restart samba. If samba fails to start, check the samba logs. ~~I ran into some issues getting~~ samba ~~to start at~~ this ~~step which I documented in the troubleshooting below~~.		Save your admin DN credentials to the secrets database by running <code>smbpasswd -w <admin-dn password></code>.

			Restart samba. If samba fails to start, check the samba logs. If you didn't set the correct bind DN, the restart would fail. Check the samba logs for more details if this happens.

	Get the local SID:		Get the local SID:
Line 249:		Line 254:

	====Troubleshooting Samba====		====Troubleshooting Samba====
	NT_STATUS_NO_MEMORY:
			===== NT_STATUS_NO_MEMORY: =====
	{{Highlight		{{Highlight
	\| code = [2021/07/17 23:22:03.698217, 0] ../../source3/passdb/secrets.c:364(fetch_ldap_pw)		\| code = [2021/07/17 23:22:03.698217, 0] ../../source3/passdb/secrets.c:364(fetch_ldap_pw)
Line 259:		Line 265:
	\| lang = text		\| lang = text
	}}		}}
	This was caused by bad LDAP bind credentials.		This was caused by bad LDAP bind credentials. You need to set the bind credentials by setting the <code>ldap admin dn</code> setting in <code>smb.conf</code> and then running:

			{{Highlight
			\| code = # smbpasswd -w password
			Setting stored password for "uid=admin,cn=users,cn=accounts,dc=home,dc=steamr,dc=com" in secrets.tdb
			\| lang = terminal
			}}

	NT_STATUS_CANT_ACCESS_DOMAIN_INFO:		===== NT_STATUS_CANT_ACCESS_DOMAIN_INFO: =====
	{{Highlight		{{Highlight
	\| code = [2021/07/17 23:53:29.901142, 0] ../../source3/lib/smbldap.c:628(smbldap_start_tls)		\| code = [2021/07/17 23:53:29.901142, 0] ../../source3/lib/smbldap.c:628(smbldap_start_tls)
Line 278:		Line 290:
	*https://access.redhat.com/articles/17303		*https://access.redhat.com/articles/17303
	*https://7thzero.com/blog/configure-centos-7-samba-server-use-secure-ldap-authentication		*https://7thzero.com/blog/configure-centos-7-samba-server-use-secure-ldap-authentication
			*https://clark-technet.com/linux-guides/samba-and-ldap-setup

Leo: Added categories and navbox

2021-12-30T01:16:25Z

Added categories and navbox

← Older revision		Revision as of 01:16, 30 December 2021
Line 279:		Line 279:
	*https://7thzero.com/blog/configure-centos-7-samba-server-use-secure-ldap-authentication		*https://7thzero.com/blog/configure-centos-7-samba-server-use-secure-ldap-authentication

	~~<br />~~
			{{Navbox Linux}}
			[[Category:Linux]]
			[[Category:LinuxUtilities]]

Leo: cheat sheet

2021-07-19T03:17:14Z

cheat sheet

@@ Line 1: / Line 1: @@
-==How to create a small OpenLDAP server in a container==
+===How to create a small OpenLDAP server in a container===
 In some cases where you need to spin up a small LDAP server for testing or 'temporary production' environments, the following docker-compose stack should fit the bill. This stack will utilize a <code>bootstrap.ldif</code> file to populate the LDAP directory. You may choose to keep this LDAP server without any state (useful for testing) by simply not mounting the data volumes. In such cases, a restart of the container will re-create all users and groups based on the <code>bootstrap.ldif</code>.
@@ Line 57: / Line 110: @@
 Keep in mind of the following environment variables and their effects:
 {| class="wikitable"
-! width="20%" | Variable
+! width="20%" |Variable
 !Description
 |-
@@ Line 118: / Line 171: @@
 | lang = terminal
 }}With the OpenLDAP server running, you can make a Linux system authenticate against it using SSSD. Follow the instructions on the [[System Security Services Daemon (SSSD)#LDAP only authentication|System Security Services Daemon]] page.<br />
-===Troubleshooting===
+====Troubleshooting====
-==== Bootstrap ldif file is not taking effect ====
+=====Bootstrap ldif file is not taking effect=====
 If your <code>bootstrap.ldif</code> file isn't taking effect, it most likely has some issues that's preventing it from being loaded. In such circumstance, it is best to enter the container and manually try loading the ldif file.
 {{Highlight
@@ Line 128: / Line 181: @@
 }}
-==== TLS connections to the server are failing ====
+=====TLS connections to the server are failing=====
 Symptoms include the following error from the OpenLDAP server:
 {{Highlight
@@ Line 138: / Line 191: @@
 Try making the TLS connection use 'try' instead of the default 'hard'. Do so by specifying the  <code>LDAP_TLS_VERIFY_CLIENT=try</code> environment variable. The client (sssd) should also have a copy of the TLS certificate<br />
-==Samba integration==
+===Samba integration===
 Samba integration with LDAP simply means that the samba credentials and user properties are stored in the user's account rather than the SAM database on the local server. The steps below will go over how to set this up.
@@ Line 195: / Line 248: @@
 When successful, you should see a bunch of new attributes for the user in the LDAP server.
-===Troubleshooting===
+====Troubleshooting Samba====
 NT_STATUS_NO_MEMORY:
 {{Highlight
@@ Line 220: / Line 273: @@
 This was fixed after setting no ssl.
 ===See also:===

Leo: /* How to create a small OpenLDAP server in a container */

2021-07-19T01:06:06Z

How to create a small OpenLDAP server in a container

← Older revision		Revision as of 01:06, 19 July 2021
Line 57:		Line 57:
	Keep in mind of the following environment variables and their effects:		Keep in mind of the following environment variables and their effects:
	{\| class="wikitable"		{\| class="wikitable"
	!Variable		! width="20%" \| Variable
	!Description		!Description
	\|-		\|-

Leo: /* Troubleshooting */

2021-07-19T01:00:40Z

Troubleshooting

← Older revision		Revision as of 01:00, 19 July 2021
Line 119:		Line 119:
	}}With the OpenLDAP server running, you can make a Linux system authenticate against it using SSSD. Follow the instructions on the [[System Security Services Daemon (SSSD)#LDAP only authentication\|System Security Services Daemon]] page.<br />		}}With the OpenLDAP server running, you can make a Linux system authenticate against it using SSSD. Follow the instructions on the [[System Security Services Daemon (SSSD)#LDAP only authentication\|System Security Services Daemon]] page.<br />
	===Troubleshooting===		===Troubleshooting===

			==== Bootstrap ldif file is not taking effect ====
	If your <code>bootstrap.ldif</code> file isn't taking effect, it most likely has some issues that's preventing it from being loaded. In such circumstance, it is best to enter the container and manually try loading the ldif file.		If your <code>bootstrap.ldif</code> file isn't taking effect, it most likely has some issues that's preventing it from being loaded. In such circumstance, it is best to enter the container and manually try loading the ldif file.
	{{Highlight		{{Highlight
Line 125:		Line 127:
	\| lang = terminal		\| lang = terminal
	}}		}}
	<br />
			==== TLS connections to the server are failing ====
			Symptoms include the following error from the OpenLDAP server:
			{{Highlight
			\| code = 60f4b878 conn=1149 fd=13 closed (TLS negotiation failure)
			60f4b87a conn=1150 fd=13 ACCEPT from IP=10.1.3.169:42016 (IP=0.0.0.0:636)
			TLS: can't accept: An unexpected TLS packet was received..
			\| lang = text
			}}
			Try making the TLS connection use 'try' instead of the default 'hard'. Do so by specifying the <code>LDAP_TLS_VERIFY_CLIENT=try</code> environment variable. The client (sssd) should also have a copy of the TLS certificate<br />

	==Samba integration==		==Samba integration==

Leo at 00:57, 19 July 2021

2021-07-19T00:57:16Z

← Older revision		Revision as of 00:57, 19 July 2021
Line 67:		Line 67:
	\|-		\|-
	\|<code>LDAP_ADMIN_PASSWORD</code>		\|<code>LDAP_ADMIN_PASSWORD</code>
	\|Sets the admin account password. The admin account is placed at the root of the directory. Eg. <code>cn=admin,dc=example,dc=com</code>		\|Sets the admin account password. The admin account is placed at the root of the directory. Eg. <code>cn=admin,dc=example,dc=com</code>
	\|}		\|}
	Next, create your <code>bootstrap.ldif</code> file. This file contains all the users and groups that should be set up when the container starts up. It does not take effect if there are existing data in the <code>/var/lib/ldap</code> location. The admin account can be left out from this file since it will be set up by the container entrypoint script based on the environment variables.		Next, create your <code>bootstrap.ldif</code> file. This file contains all the users and groups that should be set up when the container starts up. It does not take effect if there are existing data in the <code>/var/lib/ldap</code> location. The admin account can be left out from this file since it will be set up by the container entrypoint script based on the environment variables.
Line 117:		Line 117:
	# docker exec -ti <container-id> cat /container/run/service/slapd/assets/certs/ldap.crt		# docker exec -ti <container-id> cat /container/run/service/slapd/assets/certs/ldap.crt
	\| lang = terminal		\| lang = terminal
	}}<br />		}}With the OpenLDAP server running, you can make a Linux system authenticate against it using SSSD. Follow the instructions on the [[System Security Services Daemon (SSSD)#LDAP only authentication\|System Security Services Daemon]] page.<br />
	===Troubleshooting===		===Troubleshooting===
	If your <code>bootstrap.ldif</code> file isn't taking effect, it most likely has some issues that's preventing it from being loaded. In such circumstance, it is best to enter the container and manually try loading the ldif file.		If your <code>bootstrap.ldif</code> file isn't taking effect, it most likely has some issues that's preventing it from being loaded. In such circumstance, it is best to enter the container and manually try loading the ldif file.

Leo at 00:09, 19 July 2021

2021-07-19T00:09:28Z

← Older revision		Revision as of 00:09, 19 July 2021
Line 22:		Line 22:
	- LDAP_DOMAIN=home.steamr.com		- LDAP_DOMAIN=home.steamr.com
	- LDAP_ADMIN_PASSWORD=super-secret-password		- LDAP_ADMIN_PASSWORD=super-secret-password
	- ~~LDAP_TLS~~=~~"false"~~		- LDAP_READONLY_USER=true
	- ~~LDAP_RFC2307BIS_SCHEMA~~=~~"true"~~		- LDAP_TLS_VERIFY_CLIENT=try
	expose:		expose:
	- "389"		- "389"
Line 55:		Line 55:
	}}		}}

			Keep in mind of the following environment variables and their effects:
			{\| class="wikitable"
			!Variable
			!Description
			\|-
			\|<code>LDAP_TLS_VERIFY_CLIENT</code>
			\|Sets the <code>TLS_REQCERT</code> option in <code>ldap.conf</code>. For TLS using self signed certificates, you need to set this to try in order for authentication to work.
			\|-
			\|<code>LDAP_READONLY_USER</code>
			\|Enables or disables the creation of a read-only user during the bootstrap stage. This is useful for services that need to bind and do a search because anonymous binding is disabled. The account is called <code>cn=readonly</code> with <code>readonly</code> as the password. This can be overridden with <code>LDAP_READONLY_USER_USERNAME</code> and <code>LDAP_READONLY_USER_PASSWORD</code>.
			\|-
			\|<code>LDAP_ADMIN_PASSWORD</code>
			\|Sets the admin account password. The admin account is placed at the root of the directory. Eg. <code>cn=admin,dc=example,dc=com</code>
			\|}
	Next, create your <code>bootstrap.ldif</code> file. This file contains all the users and groups that should be set up when the container starts up. It does not take effect if there are existing data in the <code>/var/lib/ldap</code> location. The admin account can be left out from this file since it will be set up by the container entrypoint script based on the environment variables.		Next, create your <code>bootstrap.ldif</code> file. This file contains all the users and groups that should be set up when the container starts up. It does not take effect if there are existing data in the <code>/var/lib/ldap</code> location. The admin account can be left out from this file since it will be set up by the container entrypoint script based on the environment variables.

Line 96:		Line 110:
	Bring everything up with <code>docker-compose up -d</code>.		Bring everything up with <code>docker-compose up -d</code>.

	The container will ~~set up an admin account directly in the root of the directory. Once everything is running,~~ you can ~~login to PHPLdapAdmin as <code>cn=admin,dc=example,dc=com</code> using the password set~~ by ~~the <code>LDAP_ADMIN_PASSWORD</code> environment variable.~~		The container will generate self signed certificates which you can get by running:

	~~Anonymous binds are not enabled by default, but you can create a readonly account using the <code>LDAP_READONLY_USER</code> environment variable, which will create a <code>cn=readonly</code> account.~~

			{{Highlight
			\| code = # docker exec -ti <container-id> cat /container/run/service/slapd/assets/certs/ca.crt
			# docker exec -ti <container-id> cat /container/run/service/slapd/assets/certs/ldap.key
			# docker exec -ti <container-id> cat /container/run/service/slapd/assets/certs/ldap.crt
			\| lang = terminal
			}}<br />
	===Troubleshooting===		===Troubleshooting===
	If your <code>bootstrap.ldif</code> file isn't taking effect, it most likely has some issues that's preventing it from being loaded. In such circumstance, it is best to enter the container and manually try loading the ldif file.		If your <code>bootstrap.ldif</code> file isn't taking effect, it most likely has some issues that's preventing it from being loaded. In such circumstance, it is best to enter the container and manually try loading the ldif file.
Line 191:		Line 209:
	This was fixed after setting no ssl.		This was fixed after setting no ssl.

	=== See also: ===		===See also:===

	* https://access.redhat.com/articles/17303		*https://access.redhat.com/articles/17303
	* https://7thzero.com/blog/configure-centos-7-samba-server-use-secure-ldap-authentication		*https://7thzero.com/blog/configure-centos-7-samba-server-use-secure-ldap-authentication

	<br />		<br />

Leo: /* Samba */

2021-07-18T06:28:05Z

Samba

← Older revision		Revision as of 06:28, 18 July 2021
Line 100:		Line 100:
	Anonymous binds are not enabled by default, but you can create a readonly account using the <code>LDAP_READONLY_USER</code> environment variable, which will create a <code>cn=readonly</code> account.		Anonymous binds are not enabled by default, but you can create a readonly account using the <code>LDAP_READONLY_USER</code> environment variable, which will create a <code>cn=readonly</code> account.

	=== Troubleshooting ===		===Troubleshooting===
	If your bootstrap.ldif file isn't taking effect, it most likely has some issues that's preventing it from being loaded. In such circumstance, it is best to enter the container and manually try loading the ldif file.		If your <code>bootstrap.ldif</code> file isn't taking effect, it most likely has some issues that's preventing it from being loaded. In such circumstance, it is best to enter the container and manually try loading the ldif file.
	{{Highlight		{{Highlight
	\| code = # docker exec -ti <docker container> bash		\| code = # docker exec -ti <docker container> bash
Line 109:		Line 109:
	<br />		<br />

	==Samba==		==Samba integration==
	~~See also: https://access.redhat.com/articles/17303~~

	Samba integration with LDAP simply means that the samba credentials and user properties are stored in the user's account rather than the SAM database on the local server. The steps below will go over how to set this up.		Samba integration with LDAP simply means that the samba credentials and user properties are stored in the user's account rather than the SAM database on the local server. The steps below will go over how to set this up.

Line 168:		Line 166:
	When successful, you should see a bunch of new attributes for the user in the LDAP server.		When successful, you should see a bunch of new attributes for the user in the LDAP server.

	=== Troubleshooting ===		===Troubleshooting===
	NT_STATUS_NO_MEMORY:		NT_STATUS_NO_MEMORY:
	{{Highlight		{{Highlight
Line 193:		Line 191:
	This was fixed after setting no ssl.		This was fixed after setting no ssl.

	~~##LDAP Settings~~		=== See also: ===

	~~ldap suffix = dc=domain,dc=tld~~		* https://access.redhat.com/articles/17303
	ldap ~~admin dn = cn=Manager,dc=domain,dc=tld~~		* https://7thzero.com/blog/configure-centos-7-samba-server-use-secure-ldap-authentication

	~~#ldap ssl = no~~		<br />

	~~passdb backend = ldapsam:ldaps:~~/~~/dit.domain.tld~~



	~~https://7thzero.com/blog/configure-centos-7-samba-server-use-secure-ldap-authentication~~

Leo at 06:26, 18 July 2021

2021-07-18T06:26:26Z

@@ Line 100: / Line 100: @@
 Anonymous binds are not enabled by default, but you can create a readonly account using the <code>LDAP_READONLY_USER</code> environment variable, which will create a <code>cn=readonly</code> account.
 <br />
 ==Samba==
-Edit smb.conf. Under [global], add
+See also: https://access.redhat.com/articles/17303
 ##LDAP Settings