PDC Debian 6.0 squeeze 2/4 - Servidor LDAP

root@pdc:~# apt-get install slapd ldap-utils

Administrator password:
morsamorsa

Confirm password:
morsamorsa

root@pdc:~# ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b cn=config dn

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
dn: cn=config

dn: cn=module{0},cn=config

dn: cn=schema,cn=config

dn: cn={0}core,cn=schema,cn=config

dn: cn={1}cosine,cn=schema,cn=config

dn: cn={2}nis,cn=schema,cn=config

dn: cn={3}inetorgperson,cn=schema,cn=config

dn: olcBackend={0}hdb,cn=config

dn: olcDatabase={-1}frontend,cn=config

dn: olcDatabase={0}config,cn=config

dn: olcDatabase={1}hdb,cn=config

root@pdc:~# slappasswd

New password: morsamorsa
Re-enter new password: morsamorsa
{SSHA}N6ZE0PfgwfV9kYlT0zKiI9kpG8sx3rVI

root@pdc:~# ldapmodify -Y EXTERNAL -H ldapi:///

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
dn: olcDatabase={0}config,cn=config
add: olcRootPW
olcRootPW: {SSHA}N6ZE0PfgwfV9kYlT0zKiI9kpG8sx3rVI
Ctrl+D
modifying entry "olcDatabase={0}config,cn=config"

Creamos el .ldif para importarlo luego:

root@pdc:~# vim config.ldif

dn: olcDatabase={1}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=mi-dominio,dc=com
-
replace: olcRootDN
olcRootDN: cn=admin,dc=mi-dominio,dc=com
-
replace: olcAccess
olcAccess: to attrs=userPassword by dn="cn=admin,dc=mi-dominio,dc=com" write by anonymous auth by self write by * none
olcAccess: to attrs=shadowLastChange by self write by * read
olcAccess: to dn.base="" by * read
olcAccess: to * by dn="cn=admin,dc=mi-dominio,dc=com" write by * read
-

Importamos la config del ldif creado anteriormente:

root@pdc:~# ldapmodify -Y EXTERNAL -H ldapi:/// -f config.ldif

SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={1}hdb,cn=config"

root@pdc:~# ldapsearch -xLLL -b cn=config -D cn=admin,cn=config -W olcDatabase={1}hdb

Enter LDAP Password: morsamorsa
dn: olcDatabase={1}hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {1}hdb
olcDbDirectory: /var/lib/ldap
olcLastMod: TRUE
olcRootPW: {SSHA}iBRORXu81Urzz26uD3LbPY919jigTO9Q
olcDbCheckpoint: 512 30
olcDbConfig: {0}set_cachesize 0 2097152 0
olcDbConfig: {1}set_lk_max_objects 1500
olcDbConfig: {2}set_lk_max_locks 1500
olcDbConfig: {3}set_lk_max_lockers 1500
olcDbIndex: objectClass eq
olcSuffix: dc=mi-dominio,dc=com
olcRootDN: cn=admin,dc=mi-dominio,dc=com
olcAccess: {0}to attrs=userPassword by dn="cn=admin,dc=mi-dominio,dc=com" writ
e by anonymous auth by self write by * none
olcAccess: {1}to attrs=shadowLastChange by self write by * read
olcAccess: {2}to dn.base="" by * read
olcAccess: {3}to * by dn="cn=admin,dc=mi-dominio,dc=com" write by * read

root@pdc:~# vim base.ldif

dn: dc=mi-dominio,dc=com
objectClass: top
objectClass: dcObject
objectclass: organization
o: mi-dominio com
dc: Mi-Dominio
description: LDAP Server

dn: ou=people,dc=mi-dominio,dc=com
objectClass: organizationalUnit
ou: people

dn: ou=groups,dc=mi-dominio,dc=com
objectClass: organizationalUnit
ou: groups

root@pdc:~# ldapadd -x -D cn=admin,dc=mi-dominio,dc=com -W -f base.ldif

Enter LDAP Password:
adding new entry "dc=mi-dominio,dc=com"
ldap_add: Already exists (68)

root@pdc:~# apt-get install phpldapadmin

http://172.16.72.72/phpldapadmin
Login: cn=admin,dc=mi-dominio,dc=com
Pass: morsamorsa

+ dc=mi-dominio,dc=com
Default
Delete this entry

root@pdc:~# ldapadd -x -D cn=admin,dc=mi-dominio,dc=com -W -f base.ldif

Enter LDAP Password: morsamorsa
adding new entry "dc=mi-dominio,dc=com"

adding new entry "ou=people,dc=mi-dominio,dc=com"

adding new entry "ou=groups,dc=mi-dominio,dc=com"

root@pdc:~# vim ldapuser.sh

#!/bin/bash

SUFFIX='dc=mi-dominio,dc=com'
LDIF='ldapuser.ldif'

for line in `grep "x:[1-9][0-9][0-9][0-9]:" /etc/passwd | sed -e "s/ /%/"`
do
UID1=`echo $line | cut -d: -f1`
NAME=`echo $line | cut -d: -f5 | cut -d, -f1`
if [ ! "$NAME" ]
then
NAME=$UID1
else
NAME=`echo $NAME | sed -e "s/%/ /"`
fi
SN=`echo $NAME | awk '{print $2}'`
if [ ! "$SN" ]
then
SN=$NAME
fi
GIVEN=`echo $NAME | awk '{print $1}'`
UID2=`echo $line | cut -d: -f3`
GID=`echo $line | cut -d: -f4`
PASS=`grep $UID1 /etc/shadow | cut -d: -f2`
SHELL=`echo $line | cut -d: -f7`
HOME=`echo $line | cut -d: -f6`
EXPIRE=`passwd -S $UID1 | awk '{print $7}'`
FLAG=`grep $UID1 /etc/shadow | cut -d: -f9`
if [ ! "$FLAG" ]
then
FLAG="0"
fi
WARN=`passwd -S $UID1 | awk '{print $6}'`
MIN=`passwd -S $UID1 | awk '{print $4}'`
MAX=`passwd -S $UID1 | awk '{print $5}'`
LAST=`grep $UID1 /etc/shadow | cut -d: -f3`

echo "dn: uid=$UID1,ou=people,$SUFFIX" >> $LDIF
echo "objectClass: inetOrgPerson" >> $LDIF
echo "objectClass: posixAccount" >> $LDIF
echo "objectClass: shadowAccount" >> $LDIF
echo "uid: $UID1" >> $LDIF
echo "sn: $SN" >> $LDIF
echo "givenName: $GIVEN" >> $LDIF
echo "cn: $NAME" >> $LDIF
echo "displayName: $NAME" >> $LDIF
echo "uidNumber: $UID2" >> $LDIF
echo "gidNumber: $GID" >> $LDIF
echo "userPassword: {crypt}$PASS" >> $LDIF
echo "gecos: $NAME" >> $LDIF
echo "loginShell: $SHELL" >> $LDIF
echo "homeDirectory: $HOME" >> $LDIF
echo "shadowExpire: $EXPIRE" >> $LDIF
echo "shadowFlag: $FLAG" >> $LDIF
echo "shadowWarning: $WARN" >> $LDIF
echo "shadowMin: $MIN" >> $LDIF
echo "shadowMax: $MAX" >> $LDIF
echo "shadowLastChange: $LAST" >> $LDIF
echo >> $LDIF
done

root@pdc:~# sh ldapuser.sh

root@pdc:~# ldapadd -x -D cn=admin,dc=mi-dominio,dc=com -W -f ldapuser.ldif

Enter LDAP Password: morsamorsa
adding new entry "uid=htirado,ou=people,dc=mi-dominio,dc=com"

root@pdc:~# vim ldapgroup.sh

#!/bin/bash

SUFFIX='dc=mi-dominio,dc=com'
LDIF='ldapgroup.ldif'

for line in `grep "x:[1-9][0-9][0-9][0-9]:" /etc/group`
do
CN=`echo $line | cut -d: -f1`
GID=`echo $line | cut -d: -f3`
echo "dn: cn=$CN,ou=groups,$SUFFIX" >> $LDIF
echo "objectClass: posixGroup" >> $LDIF
echo "cn: $CN" >> $LDIF
echo "gidNumber: $GID" >> $LDIF
echo >> $LDIF
done

root@pdc:~# sh ldapgroup.sh

root@pdc:~# ldapadd -x -D cn=admin,dc=mi-dominio,dc=com -W -f ldapgroup.ldif

Enter LDAP Password: morsamorsa
adding new entry "cn=htirado,ou=groups,dc=server,dc=world"


Si quiero borrar el usuario:

root@pdc:~# ldapdelete -x -W -D 'cn=admin,dc=server,dc=world'

"uid=htirado,ou=people,dc=server,dc=world"
Enter LDAP Password: morsamorsa

Si quiero borrar un grupo:

root@master:~# ldapdelete -x -W -D 'cn=admin,dc=server,dc=world'

"cn=debian,ou=groups,dc=server,dc=world"
Enter LDAP Password: morsamorsa


FUENTES:

www.server-world.info
groups.google.com
lists.debian.org
www.esdebian.org