Our admin is trying to install an openLDAP system for some network machines.
I'm listing all the steps here so that someone may point out the breaking mistake.
Objective
Setup a centralized authentication system with Ubuntu server and lubuntu clients.
The users should have their personal directories kept on the server and accessible on every client they login.
Errors
After the steps below the openLDAP user
test1
is able to login through terminal, but the desktop login keeps looping and returning.Any new user 'test2' ( without creating folder on client machine ) created on server throws an error on client:
Could not chdir to home directory /home/users/test2: No such file or director
Setup
Using a Ubuntu Server 13.04 and Lubuntu 13.10 client
Server IP : 192.168.0.55
Client IP : 192.168.0.100
- The Lubuntu clients were installed through PXE booting over the network and installation files cached through
apt-cacher-ng
. A preseed file provided some of the openLDAP details to the client
ldap-auth-config ldap-auth-config/ldapns/ldap-server string ldap://192.168.0.55 ldap-auth-config ldap-auth-config/ldapns/base-dn string dc=organization,dc=lin ldap-auth-config ldap-auth-config/ldapns/ldap_version select 3 ldap-auth-config ldap-auth-config/dbrootlogin boolean yes ldap-auth-config ldap-auth-config/dblogin boolean false ldap-auth-config ldap-auth-config/rootbinddn string cn=admin,dc=organization,dc=lin
Both server and clients are normal virtualbox VM's and no fancy hardware is involved. Already checked
ls -lah
. The output is :total 8.0K drwxr-xr-x 2 root root 4.0K Jul 21 09:20 . drwxr-xr-x 3 root root 4.0K Jul 21 09:20 ..
Server Steps
Installed openLDAP on the server
sudo apt-get install slapd ldap-utils
and specified administrator passwordEdited configuration file to reflect new domain
sudo nano /etc/ldap/ldap.conf
:BASE dc=organization,dc=lin URI ldap://192.168.0.55
Ran the configuration assistant
sudo dpkg-reconfigure slapd
? Omit Server Configuration - No ? DNS Domain Name - organization.lin ? Organization Name - Organization Name ? Admin Password - <adminPassword> and re-enter ? Back-end Database - HDB ? Remove Database - Yes ? Move Old Database - Yes ? Allow LDAPv2 - No
Tested LDAP Server
sudo ldapsearch -x
and verified the settingsInstalled phpLDAPAdmin
sudo apt-get install phpldapadmin
Created symbolic link
sudo ln -s /usr/share/phpldapadmin/ /var/www/phpldapadmin
Edited phpLDAP configuration
sudo nano /etc/phpldapadmin/config.php
and set the following$servers->setValue('server','name','Organization LDAP Server'); $servers->setValue('server','host','192.168.0.55'); $servers->setValue('server','base',array('dc=organization,dc=lin')); $servers->setValue('login','bind_id','cn=admin,dc=organization,dc=lin');
Restarted the Apache service 'sudo /etc/init.d/apache2 restart'
Opened ports 'sudo ufw allow 80' and 'sudo ufw allow 389'
Tried logging into phpLDAP Admin
http://192.168.0.55/phpldapadmin/
Login DN : cn=admin,dc=organization,dc=lin Password : <adminPassword>
Now tested phpLDAPAdmin
Created a POSIX group - Employees Created a POSIX Account below it - test1 / password1
The home directory for the user is
/home/users/test1
Client Steps
Installed
sudo apt-get install libnss-ldap libpam-ldap ldap-utils ldap-auth-client nscd
on clientEdited
sudo nano /etc/ldap.conf
and entered following information :base dc=organization,dc=lin uri ldap://192.168.0.55/ ldap_version 3 rootbinddn cn=admin,dc=organization,dc=lin pam_password md5
Edited
sudo nano /etc/ldap.secret
and entered following information :<adminPassword>
Secured File
sudo chmod 600 /etc/ldap.secret
Ran `sudo auth-client-config -t nss -p lac_ldap'
Edited
sudo nano /etc/pam.d/common-password
Set line 26 as
password [success=1 user_unknown=ignore default=die] pam_ldap.so use_authtok try_first_pass
Created directory
sudo mkdir /home/users
Installed NFS-Common
sudo apt-get install nfs-common
Edited
sudo nano /etc/fstab
and entered the following:192.168.0.55:/home/users/ /home/users/ nfs rsize=8192,wsize=8192, timeo=14,intr
References
http://www.unixmen.com/openldap-installation-configuration-ubuntu-12-1013-0413-10-debian-67-2/
http://www.unixmen.com/configure-linux-clients-authenticate-using-openldap/
http://www.unixmen.com/openldap-installation-configuration-ubuntu-12-1013-0413-10-debian-67/
https://help.ubuntu.com/lts/serverguide/openldap-server.html