Please note that all\u00a0 double quote characters in this example are plain ASCII ” characters not\u00a0 typographical ones!<\/p>\n
Step 1: first we need to install the required packages:<\/p>\n
#yum install openldap-servers migrationtools<\/p>\n
Step2: As the configuration for LDAP is stored inside the LDAP server itself the configuration has to be done by editing LDIF files under the \/etc\/<\/em>openldap\/slapd.d\/<\/em> directory.<\/p>\n Now create the ldap password:<\/p>\n #slappasswd<\/p>\n you’ll get something like this ”{SSHA}r2or9f2vYlvieCu0LP6wTnSdYfrddsuV” as a result. This is the string we will have to add to the bdb.ldif config file.<\/p>\n # vim \/<\/strong>etc\/<\/strong>openldap\/<\/strong>slapd.d\/<\/strong>cn=config\/<\/strong>olcDatabase={1}bdb.ldif<\/p>\n substitute my-domain.com with yourdomain.com<\/p>\n :%s\/<\/strong>dc=my-domain,dc=com\/<\/strong>dc=yourdmain<\/strong>,dc=com\/<\/strong>g<\/p>\n Step 3: We now\u00a0 set the admin password and specify the location of our encryption certificate and key.<\/p>\n add these 3 lines at the end of the file bdb.ldif file:<\/p>\n olcRootPW: {SSHA}r2or9f2vYlvieCu0LP6wTnSdYfrddsuV Step 4: Now we have to specify the monitoring privileges<\/p>\n #vim \/<\/strong>etc\/<\/strong>openldap\/<\/strong>slapd.d\/<\/strong>cn=config\/<\/strong>olcDatabase={2}monitor.ldif<\/p>\n again, we have to replace the default domain name with our domain name<\/p>\n :%s\/<\/strong>cn=manager,dc=my-domain,dc=com\/<\/strong>cn=Manager,dc=yourdomain,dc=com\/<\/strong>g<\/p>\n Step 5: Now its time for the Database Cache<\/p>\n #updatedb<\/p>\n #<\/strong>cp \/<\/strong>usr\/<\/strong>share\/<\/strong>doc\/<\/strong>openldap-servers-2.4.19\/ <\/strong>DB_CONFIG.example \/<\/strong>var\/<\/strong>lib\/<\/strong>ldap\/<\/strong>DB_CONFIG<\/p>\n #<\/strong>chown -Rf ldap:ldap \/<\/strong>var\/<\/strong>lib\/<\/strong>ldap\/<\/strong><\/p>\n Step 6: Now we will need to set up a certificate for TLS. First we need to edit \/etc\/sysconfig\/ldap and change SLAPD_LDAPS from no to yes.<\/strong><\/p>\n #vi \/etc\/sysconfig\/ldap Now we can create the certificate<\/p>\n #openssl req -new -x509 -nodes -out \/etc\/pki\/tls\/certs\/slapdcert.pem -keyout \/etc\/pki\/tls\/certs\/slapdkey.pem -days 365<\/p>\n This will create the two required keys in the \/etc\/pki\/tls\/certs\/ directory. We need to make them readable for the ldap user.<\/p>\n # chown -Rf root:ldap \/etc\/pki\/tls\/certs\/$cert.pem Step 7:<\/strong> Time to test our configuration<\/p>\n # slaptest -u Step 8:\u00a0 Start the ldap server<\/p>\n #service sladp start<\/p>\n lets check if our ldap server really works:<\/p>\n #ldapsearch -x\u00a0 -b ”dc=yourdomain,dc=com”<\/p>\n if you get a search: 2 then your on track!<\/p>\n Step 9: Configure the base domain<\/p>\n #vi base.ldif<\/p>\n dn: dc=yourdomain,dc=net dn: ou=People,dc=yourdomain,dc=net dn: ou=Group,dc=yourdomain,dc=net now we import our base information to the ldap directory:<\/p>\n #ldapadd -x -W -D ”cn=Manager,dc=yourdomain,dc=com” -f base.ldif<\/p>\n Step 10: lets migrate the users<\/p>\n Go to the directory \/usr\/share\/migrationtools. Edit the file<\/p>\n # vim \/usr\/share\/migrationtools\/migrate_common.ph<\/p>\n Set: #grep ”:5[0-9][0-9]” \/etc\/passwd > passwd Step 11: Testing the ldap server. We check if user mani exists<\/p>\n #ldapsearch -x ”cn=mani”\u00a0 -b ”dc=mycompany,dc=com”<\/p>\n If the test is successful your done \ud83d\ude42<\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" Please note that all\u00a0 double quote characters in this example are plain ASCII ” characters not\u00a0 typographical ones! Step 1: first we need to install the required packages: #yum install openldap-servers migrationtools Step2: As the configuration for LDAP is stored inside the LDAP server itself the configuration has to be done by editing LDIF files…<\/p>\n","protected":false},"author":2,"featured_media":162,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[3],"tags":[],"class_list":["post-74","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/74","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=74"}],"version-history":[{"count":2,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/74\/revisions"}],"predecessor-version":[{"id":504,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/posts\/74\/revisions\/504"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=\/wp\/v2\/media\/162"}],"wp:attachment":[{"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=74"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=74"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.domb.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=74"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nolcTLSCertificateFile: \/etc\/pki\/tls\/certs\/slapdcert.pem
\nolcTLSCertificateKeyFile: \/etc\/pki\/tls\/certs\/slapdkey.pem<\/p>\n
\nSLAPD_LDAPS=yes<\/p>\n
\n# chmod -Rf 750 \/etc\/pki\/tls\/certs\/$key.pem<\/p>\n
\nconfig file testing succeeded<\/p>\n
\ndc: yourdomain
\nobjectClass: top
\nobjectClass: domain<\/p>\n
\nou: People
\nobjectClass: top
\nobjectClass: organizationalUnit<\/p>\n
\nou: Group
\nobjectClass: top
\nobjectClass: organizationalUnit<\/p>\n
\n# Default DNS domain
\n$DEFAULT_MAIL_DOMAIN = ”yourdomain.com”;
\n# Default base
\n$DEFAULT_BASE = ”dc=yourdomain,dc=com”;<\/p>\n
\n#grep ”:5[0-9][0-9]” \/etc\/group > group
\n#.\/migrate_passwd.pl passwd > users.ldif
\n#.\/migrate_group.pl group > group.ldif
\n#sed -e ”s\/ou=Group\/ou=Groups\/g” group.ldif > groups.ldif
\nldapadd -x -W -D ”cn=Manager,dc=yourdomain,dc=com” -f users.ldif
\nldapadd -x -W -D ”cn=Manager,dc=yourdomain,dc=com” -f groups.ldif<\/p>\n