OpenLDAP (NO TLS/SSL security)

Now, we will have to install the OpenLDAP software which enables us to build the “LDAP Active Directory Service”:

1. Installation (1):

   • Openldap (slapd)

   • Tools to manage the LDAP database

2. Configuration:

   • Administration user for LDAP directory (default): cn=admin(2)

   • Password (default): ldap

   • Database engine (default): MDB

   • LDAPv3 support only

   • Domain name: localdomain

   • Root distinguished name (DN): dc=localdomain

3. Post-configuration; Once installed and pre-configured initially, configure it to verify the following features:

   • LDAP Directory:

     • Add a new “index” entry for the “displayName” field (attribute). That enables to us to speed up the searches.

     • Index to add: eq

   • LDAP Service:

     • Initially, your LDAP service must run without secure SSL connections (ldap). This means that service will use only the 389 TCP port and server-01.localdomain as hostname.

     • What does the ldapi:/// instance mean and what is it for? (3)

4. Checking:

   • Make sure that the LDAP service is running and “listening to” LDAP client requests on the right TCP port.

   • Check the base LDAP structure using the installed LDAP client tools. What can you see?

5. Creating the LDAP active directory tree:

   • Make a backup of the LDAP database in a ldif file using openLDAP server tools.

   • Once this is done, create the base organizational tree for the LDAP database (dc=localdomain), using .ldif files and according to the following structure:

   dc=localdomain
     dn: ou=people,dc=localdomain
     dn: ou=groups,dc=localdomain
     dn: ou=machines,dc=localdomain
     dn: ou=services,dc=localdomain

6. Loading data:

   • Now, you should populate the LDAP database, using the corresponding data. We aims new LDAP entries, users and groups especially, have the same user attributes (structure) than UNIS/Linux users and groups.

     • User groups:

       1. cn: group1

          • gidNumber: 2000

       2. cn: group2

          • gidNumber: 2001

     • User entries:

       1. uid: user1

          • uidNumber: 20001

          • gidNumber: 2000

          • password: <strong password>

          • gecos: USUARIO 1, DGSI, UNICAN

       2. uid: user2

          • uidNumber: 20011

          • gidNumber: 2001

          • password: <strong password>

          • gecos: USUARIO 2, DGSI, UNICAN

     • Host entries:

       1. cn=frontend (IP 10.128.0.100)

       2. cn=server-01 (IP 10.128.0.11)

       3. cn=server-02 (IP 10.128.0.12)

       4. cn=server-03 (IP 10.128.0.13)

       5. cn=server-04 (IP 10.128.0.14)

       6. cn=server-05 (IP 10.128.0.15)

          Note: Define the host “distingue name” for LDAP using the FQDN Full host name, including the domain name:

          • frontend.localdomain

   • Check the new entries have been correctly added, using the LDAP server tools.\

More details in reference [4][5][7]

(1) Use the official debían software repositories. (2) It is not necessary to indicate explicitly. Use default.

(3) Advise: Use it!