Merupakan sebuah informasi yang saya dapatkan setelah melakukan pencarian di google. Akhirnya dapat juga cara membuat LDAP di ubuntu. berikut tutorialnya [Bahasa Inggris] :
Ubuntu OpenLDAP client authentication
This guide is for authenticating Ubuntu Gutsy (7.10) or later releases of Ubuntu Hardy, Intrepid, Jaunty ..etc against an OpenLDAP directory server in a linux network
Install the ldap required packages
aptitude install auth-client-config libpam-ldap libnss-ldap
A configuration screen will appear:
Should use debconf -> YES
URI -> ldapi:///LDAP_SERVER_IP ldapi:///192.168.1.4
DISTINGUISHED NAME -> dc=localdomain,dc=local dc=example,dc=com
LDAP VERS -> 3
LOCAL ROOT DB ADMIN -> YES
DOES DB REQ LOGIN -> NO
LDAP A/C -> cn=admin,dc=localdomain,dc=local cn=admin,=example,dc=com
LDAP root a/c password -> PASSWORD
My understanding is that this should configure the /etc/ldap.conf file which now acts as central control. However, it doesn’t work
anyway..
vi /etc/ldap.conf
change:
host 127.0.0.1
To for example:
host 192.168.1.2
Change:
base = padl….
To:
base = dc=localdomain,dc=dc=example,,dc=com
then Uncomment :-
#bind_policy=hard
and change it to:
bind_policy=soft
Now, because there is another ldap.conf in /etc/ldap/ldap.conf I duplicated it
cp /etc/ldap/ldap.conf /etc/ldap/ldap.conf.bak
cp /etc/ldap.conf /etc/ldap/ldap.conf
Create a new ldap profile:
vi /etc/auth-client-config/profile.d/open_ldap
and paste this into it:
[open_ldap]
nss_passwd=passwd: files ldap
nss_group=group: files ldap
nss_shadow=shadow: files ldap
nss_netgroup=netgroup: files ldap
pam_auth=auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
#the following line (containing pam_group.so) must be placed before pam_ldap.so
#for ldap users to be placed in local groups such as fuse, plugdev, scanner, etc ...
auth required pam_group.so use_first_pass
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so
pam_account=account sufficient pam_unix.so
account sufficient pam_ldap.so
account required pam_deny.so
pam_password=password sufficient pam_unix.so nullok md5 shadow
password sufficient pam_ldap.so use_first_pass
password required pam_deny.so
pam_session=session required pam_limits.so
session required pam_mkhomedir.so skel=/etc/skel/
session required pam_unix.so
session optional pam_ldap.so
This is an improvement on the default ldap setup because it will create a home directory if one doesn’t exist on login. I authenticate ldap before files because in order to access usb sticks the “on the fly” assignment method doesn’t work. To fix this, an ldap user in the plugdev group is used.
Then execute this to enable the above config:
auth-client-config -a -p open_ldap
Now for on the fly group assignment for all users on login paste:
auth optional pam_group.so
Into the top of both /etc/pam.d/gdm AND /etc/pam.d/login. it’s
important to place it first as these files are not parsed once a
sufficient / required is met.
referensi : http://www.twistedlogic.co.cc/2008/03/07/linux-ubuntu-openldap-client-authentication/
0 comments