SystemAdministration/LDAPManagementForDummies - Revision history

Xlefay: /* Accessing the LDAP database */

2014-03-24T19:02:51Z

Accessing the LDAP database

← Older revision		Revision as of 19:02, 24 March 2014
Line 5:		Line 5:
	All nodes have read-only access to the database. Read/Write requires connecting as admin, which is stored as an ldap.secret on the master nodes. In other words, you need to a sysop, access the LDAP server directly, then sudo to root. You also want to do some local port forwarding to access phpLDAPAdmin		All nodes have read-only access to the database. Read/Write requires connecting as admin, which is stored as an ldap.secret on the master nodes. In other words, you need to a sysop, access the LDAP server directly, then sudo to root. You also want to do some local port forwarding to access phpLDAPAdmin

	<pre>mcasadevall@tranquility:~$ ssh -L 8080:localhost:80 mcasadevall@ldap-server.~~li684~~-22		<pre>mcasadevall@tranquility:~$ ssh -L 8080:localhost:80 mcasadevall@ldap-server.li694-22
	-snip-		-snip-
	Last login: Sat Mar 22 16:43:25 2014 from REDACTED		Last login: Sat Mar 22 16:43:25 2014 from REDACTED

Xlefay: /* Accessing phpLDAPadmin */

2014-03-24T05:34:00Z

Accessing phpLDAPadmin

← Older revision		Revision as of 05:34, 24 March 2014
Line 107:		Line 107:
	== Accessing phpLDAPadmin ==		== Accessing phpLDAPadmin ==

	For some things, having a GUI is a good thing. Fortunately, we have one, though its a little rough around the edges. If you started your SSH session as above, SSH is tunnelling port 8080 to 80 on your local host. You can access phpLDAPadmin by simply opening up Firefox (or another browser of choice), pointing it to 127.0.0.1:8080. Once you're in, you're presented with this rather bland looking login window		For some things, having a GUI is a good thing. Fortunately, we have one, though its a little rough around the edges. If you started your SSH session as above, SSH is tunnelling port 8080 to 80 on your local host. You can access phpLDAPadmin by simply opening up Firefox (or another browser of choice), pointing it to http://127.0.0.1:8080/phpldapadmin. Once you're in, you're presented with this rather bland looking login window

	[[File:Login_screen.png\| \| phpLDAPadmin login screen]]		[[File:Login_screen.png\| \| phpLDAPadmin login screen]]

NCommander at 20:19, 22 March 2014

2014-03-22T20:19:56Z

← Older revision		Revision as of 20:19, 22 March 2014
Line 152:		Line 152:

	Scroll to the bottom, and click Update Object. You'll get a confimration screen (scroll right to find the OK box), and then you're done. Woo, that it. OpenSSH will get keys automatically from LDAP when someone tries to sign in.		Scroll to the bottom, and click Update Object. You'll get a confimration screen (scroll right to find the OK box), and then you're done. Woo, that it. OpenSSH will get keys automatically from LDAP when someone tries to sign in.

			=== Hosts Management ===
			So, unfortunately, phpLDAPAdmin doesn't have a nice interface for generating hosts, and I couldn't successfully make a new template to make this work. Fortunately, this is pretty simple. Take a look at the existing entries, then Copy an existing one to make a new one

			The Common Name (cn) is the hostname of a machine, it should be in the form of name.li694-22

			You can have multiple IP addresses as well

	== LDAP Server Notes ==		== LDAP Server Notes ==

NCommander at 19:47, 22 March 2014

2014-03-22T19:47:01Z

@@ Line 107: / Line 107: @@
 == Accessing phpLDAPadmin ==
-For some things, having a GUI is a *good* thing. Fortunately, we have one, though its a little rough around the edges. If you started your SSH session as above, SSH is tunnelling port 8080 to 80 on your local host. You can access phpLDAPadmin by simply opening up Firefox (or another browser of choice), pointing it to 127.0.0.1:8080, and logged int
+For some things, having a GUI is a *good* thing. Fortunately, we have one, though its a little rough around the edges. If you started your SSH session as above, SSH is tunnelling port 8080 to 80 on your local host. You can access phpLDAPadmin by simply opening up Firefox (or another browser of choice), pointing it to 127.0.0.1:8080. Once you're in, you're presented with this rather bland looking login window
 == LDAP Server Notes ==

NCommander: /* Accessing the LDAP database */

2014-03-22T18:41:43Z

Accessing the LDAP database

← Older revision		Revision as of 18:41, 22 March 2014
Line 8:		Line 8:
	-snip-		-snip-
	Last login: Sat Mar 22 16:43:25 2014 from REDACTED		Last login: Sat Mar 22 16:43:25 2014 from REDACTED
	mcasadevall@soylent-db:~$ sudo -s		mcasadevall@soylent-db:~$ sudo -i
	root@soylent-db:~#		root@soylent-db:~#
	</pre>		</pre>

NCommander: /* Managing Actual Users/Groups */

2014-03-22T18:40:57Z

Managing Actual Users/Groups

← Older revision		Revision as of 18:40, 22 March 2014
Line 59:		Line 59:

	Easy, right?		Easy, right?

			==== SSH Keys ====
			Adding SSH Keys is somewhat more difficult, as we don't have a handy script to do it. You need to use phpLDAPadmin, or rip your hair out with ldapmodify. Go to the phpLDAPadmin section to see how to do this.

	=== Creating A Group ===		=== Creating A Group ===
Line 91:		Line 94:

	Repeat for each group.		Repeat for each group.

	~~=== SSH Keys ===~~
	Adding SSH Keys is somewhat more difficult, as we don't have a handy script to do it. You need to use phpLDAPadmin, or rip your hair out with ldapmodify. Go to the phpLDAPadmin section to see how to do this.

	=== Removing Users, Groups, and Machines ===		=== Removing Users, Groups, and Machines ===

NCommander: Created page with "So after much much pain, I managed to wrestle slapd into working, and get single-signon working across all nodes. As a side effect, none of the flat files are used for things ..."

2014-03-22T18:32:13Z

Created page with "So after much much pain, I managed to wrestle slapd into working, and get single-signon working across all nodes. As a side effect, none of the flat files are used for things ..."

New page

So after much much pain, I managed to wrestle slapd into working, and get single-signon working across all nodes. As a side effect, none of the flat files are used for things like group permissions and such. slapd has incredibly poor documentation, so this is the quick reference cheatsheet to handle user management, hosts management, etc.

== Accessing the LDAP database ==

All nodes have read-only access to the database. Read/Write requires connecting as admin, which is stored as an ldap.secret on the master nodes. In other words, you need to a sysop, access the LDAP server directly, then sudo to root. You also want to do some local port forwarding to access phpLDAPAdmin

<pre>mcasadevall@tranquility:~$ ssh -L 8080:localhost:80 mcasadevall@ldap-server.li684-22
-snip-
Last login: Sat Mar 22 16:43:25 2014 from REDACTED
mcasadevall@soylent-db:~$ sudo -s
root@soylent-db:~#
</pre>

All future instructions assume you're root on a LDAP master unless specified otherwise. All permissions are handled by POSIX groups

{{:SystemAdministration/GroupPermissions}}

== uid/gid numbers ==

uid/gid numbers have to be global across the network, so here's basic cheat sheat. As we're using Ubuntu, we inhert the Debian UID Policy, which defines what UIDs are availabale for what: https://www.debian.org/doc/debian-policy/ch-opersys.html

As such, we need to work within that policy. Here's the relevelant information you need to know.

* 1000-2499 - reserved for local users we create. No account should be accessible or have a password (use passwd -l *username* to strip it)
* 2500-59999 - LDAP user/groups

For local groups, try and keep UIDs consistent across systems in case we do things like NFS mounting in the future. It will save us a load of pain in the future.

== Getting An Overview of User/Groups/Hosts ==

As everything passes through NSS, we use the "getent" command to get an idea of what the node can see, who's in what groups, etc. getent takes one argument, which can be any NSS database. For most people, the useful options are "passwd", "group", "hosts"

<pre>
root@soylent-db:~# getent group
root:x:0:
daemon:x:1:
-snip a LOT of stock groups-
firefighters:*:2500:mcasadevall
sysops:*:2501:mcasadevall
db:*:2502:mcasadevall
</pre>

This is also a good way to SAN check to make sure what user accounts are local, and which are global (in LDAP). This command can be run from any node.

== Managing Actual Users/Groups ==

Fortunately, we live in a modern age where its not necessary to muck with ldif files directly to manage users or groups. ldapscripts are setup on the LDAP masters, and can be used to edit the database in a relatively sane way.

=== Creating A User ===
For the sake of an example, I'm going to make mechaniacjay's user account. ldapadduser is used for this

<pre>
root@soylent-db:~# ldapadduser mechanicjay firefighters
Successfully added user mechanicjay to LDAP
Successfully set password for user mechanicjay
root@soylent-db:~# id mechanicjay
uid=2502(mechanicjay) gid=2500(firefighters) groups=2500(firefighters)
</pre>

Easy, right?

=== Creating A Group ===
Basically the same thing, except we use ldapaddgroup

<pre>
root@soylent-db:~# ldapaddgroup dev_team
Successfully added group dev_team to LDAP
root@soylent-db:~# ldapfinger dev_team
dn: cn=dev_team,ou=groups,dc=li694-22
objectClass: posixGroup
cn: dev_team
gidNumber: 2503
description: Group account

root@soylent-db:~#
</pre>

=== Adding Users To Groups ===

Right now, mechanicjay has just the basic firefighting group, but is a sysop, so we need to add him to that group. That can be done with the ldapaddusertogroup command.

<pre>
root@soylent-db:~# ldapaddusertogroup mechanicjay sysops
Successfully added user mechanicjay to group sysops
root@soylent-db:~# id mechanicjay
uid=2502(mechanicjay) gid=2500(firefighters) groups=2500(firefighters),2501(sysops)
root@soylent-db:~#
</pre>

Group authetication is checked by PAM and SSH on login, so just by adding him to the group, he's gotten access to all nodes across the system (as defined by the sysops group).

Repeat for each group.

=== SSH Keys ===
Adding SSH Keys is somewhat more difficult, as we don't have a handy script to do it. You need to use phpLDAPadmin, or rip your hair out with ldapmodify. Go to the phpLDAPadmin section to see how to do this.

=== Removing Users, Groups, and Machines ===

Sometimes staff resign, or otherwise unavailable. There are couple of commands that do it

* ldapdeleteuser
* ldapdeleteusertogroup
* ldapdeletegroup

Usage is basically identical to above. Please do not repeat UID numbers however, in case of restoring files from backups so we have a chance of IDing who it was who owned what.

== Accessing phpLDAPadmin ==

For some things, having a GUI is a *good* thing. Fortunately, we have one, though its a little rough around the edges. If you started your SSH session as above, SSH is tunnelling port 8080 to 80 on your local host. You can access phpLDAPadmin by simply opening up Firefox (or another browser of choice), pointing it to 127.0.0.1:8080, and logged int

== LDAP Server Notes ==

=== TLS ===
OpenLDAP has perhaps one of the most pendatic TLS systems I've ever worked with. It either enforces a good cert, or ignores the cert, there's no middle ground. Because of this, you need to have a valid hostname in the cert of make TLS to. The certificate has ldap-server.li694-22 as its common name, and every node needs this set in the actual hosts file to make LDAP work. When we get replication up and running, we'll have to do the same things there.

TLS is enforced for all connections.

=== Replication ===
To Be Done

Important Safety Note: We've got a schema change to allow the SSH keys to be stored in LDAP, that will have to be put on each slurp system or *interesting* breakage will occur. You have been warned.
[[Category:System administration]]