Cliente LDAP - ldapclient Unix Solaris 10

1) Backup del nsswitch.conf porque lo modifica:

# cp -pf /etc/nsswitch.conf /etc/nsswitch.conf.17-06-2013
# diff /etc/nsswitch.conf /etc/nsswitch.conf.17-06-2013

2) Ver si algún servicio está caído:

# svcs -xv
#

3) Ver servicio del ldap client:

# svcs -l /network/ldap/client:default
fmri         svc:/network/ldap/client:default
name         LDAP client
enabled      true
state        online
next_state   none
state_time   Fri Apr 05 09:46:28 2013
logfile      /var/svc/log/network-ldap-client:default.log
restarter    svc:/system/svc/restarter:default
contract_id  36
dependency   require_all/none svc:/system/filesystem/minimal (online)
dependency   require_all/none svc:/network/initial (online)
#

4) Ver la config y las estadiscitas del ldap_cachemgr:

# /usr/lib/ldap/ldap_cachemgr -g
cachemgr configuration:
server debug level          0
server log file "/var/ldap/cachemgr.log"
number of calls to ldapcachemgr       1560
cachemgr cache data statistics:
Configuration refresh information:
  Configured to NO REFRESH.
Server information:
  Previous refresh time: 2013/06/17 06:10:46
  Next refresh time:     2013/06/17 17:33:26
  server: 192.168.0.1, status: UP
Cache data information:
  Maximum cache entries:          256
  Number of cache entries:          0
#

5) Vemos la config del cliente de ldap, no debemos modificar el archivo, ya que se reescribirá si se modifica:

# cat /var/ldap/ldap_client_file
#
# Do not edit this file manually; your changes will be lost.Please use ldapclient (1M) instead.
#
NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_SERVERS= 172.16.72.1
NS_LDAP_SEARCH_BASEDN= dc=redes-seguridad,dc=com,dc=ar
NS_LDAP_CACHETTL= 0
NS_LDAP_CREDENTIAL_LEVEL= anonymous
NS_LDAP_SERVICE_SEARCH_DESC= passwd:ou=Users,dc=redes-seguridad,dc=com,dc=ar?one
NS_LDAP_SERVICE_SEARCH_DESC= shadow:ou=Users,dc=redes-seguridad,dc=com,dc=ar?one
NS_LDAP_SERVICE_SEARCH_DESC= group:ou=Groups,dc=redes-seguridad,dc=com,dc=ar?one
NS_LDAP_ATTRIBUTEMAP= shadow:userpassword=userPassword
NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:tls:simple

6) Modificamos el cliente con el ldapclient:

Con el man vemos los parametros que son necesarios:

# man ldapclient

Ejemplo:

example# ldapclient manual \
       -a credentialLevel=proxy \
       -a authenticationMethod=sasl/CRAM-MD5 \
       -a proxyPassword=secret \
       -a proxyDN=cn=proxyagent,ou=profile,dc=xyz,dc=mycompany,dc=com \
       -a defaultSearchBase=dc=xyz,dc=mycompany,dc=com \
       -a domainName=xyz.mycompany.com \
       -a followReferrals=false \
       -a defaultServerList=172.16.100.1:386

7) Yo para mi red utilicé los siguientes, tener en cuenta que este comando modifica el /etc/nsswitch.conf:

/# ldapclient manual \
-a defaultServerList=10.11.12.13 \
-a defaultSearchBase=dc=redes-seguridad,dc=com,dc=ar \
-a credentialLevel=anonymous \
-a serviceSearchDescriptor=passwd:ou=Users,dc=redes-seguridad,dc=com,dc=ar?one \
-a serviceSearchDescriptor=shadow:ou=Users,dc=redes-seguridad,dc=com,dc=ar?one \
-a serviceSearchDescriptor=group:ou=Groups,dc=redes-seguridad,dc=com,dc=ar?one \
-a attributeMap=shadow:userpassword=userPassword \
-a serviceAuthenticationMethod=pam_ldap:tls:simple
System successfully configured

8) Vemos que se modificó el /etc/nsswitch.conf:

# diff /etc/nsswitch.conf /etc/nsswitch.conf.17-06-2013
24c24
< hosts:      ldap [NOTFOUND=return] files
---
> hosts:      files dns ldap [NOTFOUND=return]
28c28
< ipnodes:    ldap [NOTFOUND=return] files
---
> ipnodes:    files dns ldap [NOTFOUND=return]
30,36c30,36
< networks:   ldap [NOTFOUND=return] files
< protocols:  ldap [NOTFOUND=return] files
< rpc:        ldap [NOTFOUND=return] files
< ethers:     ldap [NOTFOUND=return] files
< netmasks:   ldap [NOTFOUND=return] files
< bootparams: ldap [NOTFOUND=return] files
< publickey:  ldap [NOTFOUND=return] files
---
> networks:   files ldap [NOTFOUND=return]
> protocols:  files ldap [NOTFOUND=return]
> rpc:        files ldap [NOTFOUND=return]
> ethers:     files ldap [NOTFOUND=return]
> netmasks:   files ldap [NOTFOUND=return]
> bootparams: files ldap [NOTFOUND=return]
> publickey:  files ldap [NOTFOUND=return]
38c38
< netgroup:   ldap
---
> netgroup:   files ldap

9) Volvemos a restaurar el que habíamos backupeado previamente:

# cp -pf /etc/nsswitch.conf.17-06-2013 /etc/nsswitch.conf 

10) Reiniciamos el server porque queda algo cacheado y el ping no resuelve correctamente:

# reboot

12) Testeamos que el ldapclient tenga la config de la nueva ip:

# ldapclient list
NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_SERVERS= 10.11.12.13
NS_LDAP_SEARCH_BASEDN= dc=redes-seguridad,dc=com,dc=ar
NS_LDAP_CACHETTL= 0
NS_LDAP_CREDENTIAL_LEVEL= anonymous
NS_LDAP_SERVICE_SEARCH_DESC= passwd:ou=Users,dc=redes-seguridad,dc=com,dc=ar?one
NS_LDAP_SERVICE_SEARCH_DESC= shadow:ou=Users,dc=redes-seguridad,dc=com,dc=ar?one
NS_LDAP_SERVICE_SEARCH_DESC= group:ou=Groups,dc=redes-seguridad,dc=com,dc=ar?one
NS_LDAP_ATTRIBUTEMAP= shadow:userpassword=userPassword
NS_LDAP_SERVICE_AUTH_METHOD= pam_ldap:tls:simple

13) Si queremos ver el log:

# tail -f /var/svc/log/network-ldap-client:default.log