Novell Home

PAM/LDAP/start_tls Authentication via eDirectory for Linux Mandrake and EduLinux

Novell Cool Solutions: Feature
By Michel Bluteau

Digg This - Slashdot This

Posted: 17 Sep 2004
 

This document is a quick setup guide for leveraging eDirectory as a central LDAP authentication directory for Linux as a complement to:
Configure Linux to Authenticate to eDirectory via LDAP

This document applies specifically to Mandrake Linux and derivatives like EduLinux, which are not covered by the above article, where only SUSE and Red Hat are covered.

I have used start_tls in this example, since it is easier to set up than traditional SSL or TLS which requires playing with certificates.

Hopefully this document can be helpful to you. You can send feedback or comments to mbluteauTAKETHISOUT@novell.com (remove the TAKETHISOUT part which is just a dumb trick to confuse spambots and avoid spamming).

The first step is to extend the eDirectory schema for UNIX/Linux posixAccount and posixGroup classes. The above-mentioned CoolSolutions article explains the steps for eDirectory on Linux/UNIX, but an alternative way to extend the schema that works on all platforms is to use iManager:


Figure 1: Import Convert Export Wizard for extending the schema.


Figure 2: ICE Wizard using a Schema File.


Figure 3: ICE Wizard using a LDIF file.


Figure 4: Authentication page for extending the Schema.

After the Schema is extended, the next step is to create a proxy user for LDAP that has no password, and assign this user as a trustee of root.


Figure 5: Setting up the proxy user for the LDAP Group, and Require TLS for Simple Binds with Password.


Figure 6: Modifying Trustees for the root object.


Figure 7: Creating a Trustee assignment for the LDAP proxy user.


Figure 8: Attributes and Entry Rights for the LDAP proxy user.


Figure 9: Adding the posixAccount auxiliary class for an existing user. Required for UNIX/Linux accounts.


Figure 10: Adding the posixAccount auxiliary class for an existing user.


Figure 11: Using Plug-in Studio to create a custom form for managing posixAccount.


Figure 12: Using Plug-in Studio to create a custom form for managing posixAccount.


Figure 13: Using Plug-in Studio form for managing posixaccount.

After the eDirectory has been setup and users with the posixaccount auxiliary class have been created, we are ready to configure Mandrake or EduLinux desktops for PAM/LDAP authentication. The first step is to execute the drakauth utility to configure LDAP authentication.


Figure 14: drakauth utility on Mandrake or EduLinux.

Once the drakauth utility has been executed, some modifications are required in these files:
/etc/nsswitch.conf, /etc/ldap.conf, and /etc/pam.d/system-auth.

Modifications for nsswitch.conf:
No modifications should be required, but make sure the file includes the following lines:

passwd:     files ldap nisplus nis
shadow: files ldap nisplus nis
group: files ldap nisplus nis

automount:   files ldap nisplus

Modifications for system-auth file:


#%PAM-1.0

auth required /lib/security/pam_env.so
auth sufficient /lib/security/pam_unix.so likeauth nullok
auth sufficient /lib/security/pam_ldap.so use_first_pass
auth required /lib/security/pam_deny.so
 
account sufficient pam_unix.so
account sufficient pam_ldap.so use_first_pass
account required pam_deny.so
 
password required pam_cracklib.so retry=3 minlen=2 dcredit=0 ucredit=0
password sufficient pam_unix.so nullok use_authtok md5 shadow
password sufficient pam_ldap.so use_authtok
password required pam_deny.so
 
session required /lib/security/pam_mkhomedir.so skel=/etc/skel umask=0022
session required pam_limits.so
session optional /lib/security/pam_ldap.so

The line calling the pam_mkhomedir.so library results in the automatic creation of a home directory the first time a user authenticates to the Linux desktop, and takes care of rights assignments. This is the only file that needs to be modified for homedir creation for both text login and X graphical login.

Modifications for ldap.conf:

Make sure that the :LDAP server address and port are correctly specified:
# Your LDAP server. Must be resolvable without using LDAP.
host 192.168.1.19:390

Use the cleartext port for initiating a connection. start_tls will then switch the connection to a secure connection.
# The port.
# Optional: default is 389
#port 636
port 390

Verify that you have NDS password support enabled:
# Remove old password first, then update in
# cleartext. Necessary for use with Novell
# Directory Services (NDS)
pam_password nds

Verify LDAP contexts:
# You can omit the suffix eg:
nss_base_passwd ou=eduLinux,o=novl,c=ca
# to append the default base DN but this
# may incur a small performance impact.
nss_base_shadow ou=eduLinux,o=novl,c=ca
nss_base_group ou=Groups,ou=eduLinux,o=novl,c=ca

Change SSL mode to start_tls in order to leverage START_TLS for connections.
# Netscape SDK LDAPS
#ssl on
ssl start_tls

Below is the complete /etc/ldap.conf file:

# @(#)$Id: ldap.conf,v 2.28 2001/08/28 12:17:29 lukeh Exp $
#
# This is the configuration file for the LDAP nameservice
# switch library and the LDAP PAM module.
#
# PADL Software
# http://www.padl.com
#

# Your LDAP server. Must be resolvable without using LDAP.
host 192.168.1.19:390

# The distinguished name of the search base.
base ou=eduLinux,o=novl,c=ca

# Another way to specify your LDAP server is to provide an
# uri with the server name. This allows to use
# Unix Domain Sockets to connect to a local LDAP Server.
#uri ldap://127.0.0.1/
#uri ldaps://127.0.0.1/   
#uri ldapi://%2fvar%2frun%2fldapi_sock/
# Note: %2f encodes the '/' used as directory separator

# The LDAP version to use (defaults to 3
# if supported by client library)
ldap_version 3

# The distinguished name to bind to the server with.
# Optional: default is to bind anonymously.
#binddn cn=proxyuser,dc=example,dc=com

# The credentials to bind with. 
# Optional: default is no credential.
#bindpw secret

# The distinguished name to bind to the server with
# if the effective user ID is root. Password is
# stored in /etc/ldap.secret (mode 600)
#rootbinddn cn=manager,dc=example,dc=com

# The port.
# Optional: default is 389.
#port 636
port 390

# The search scope.
#scope sub
scope one
#scope base

# Search timelimit
#timelimit 30

# Bind timelimit
#bind_timelimit 30

# Idle timelimit; client will close connections
# (nss_ldap only) if the server has not been contacted
# for the number of seconds specified below.
#idle_timelimit 3600

# Filter to AND with uid=%s
pam_filter objectclass=posixaccount

# The user ID attribute (defaults to uid)
pam_login_attribute uid

# Search the root DSE for the password policy (works
# with Netscape Directory Server)
#pam_lookup_policy yes

# Group to enforce membership of
#pam_groupdn cn=PAM,ou=Groups,dc=example,dc=com

# Group member attribute
pam_member_attribute gid

# Template login attribute, default template user
# (can be overriden by value of former attribute
# in user's entry)
#pam_login_attribute userPrincipalName
#pam_template_login_attribute uid
#pam_template_login nobody

# HEADS UP: the pam_crypt, pam_nds_passwd,
# and pam_ad_passwd options are no
# longer supported.

# Do not hash the password at all; presume
# the directory server will do it, if
# necessary. This is the default.
#pam_password clear

# Hash password locally; required for University of
# Michigan LDAP server, and works with Netscape
# Directory Server if you're using the UNIX-Crypt
# hash mechanism and not using the NT Synchronization
# service. 
#pam_password crypt

# Remove old password first, then update in
# cleartext. Necessary for use with Novell
# Directory Services (NDS)
pam_password nds

# Update Active Directory password, by
# creating Unicode password and updating
# unicodePwd attribute.
#pam_password ad

# Use the OpenLDAP password change
# extended operation to update the password.
#pam_password exop

pam_password crypt

# RFC2307bis naming contexts
# Syntax:
# nss_base_XXX		base?scope?filter
# where scope is {base,one,sub}
# and filter is a filter to be &'d with the
# default filter.
# You can omit the suffix eg:
nss_base_passwd ou=eduLinux,o=novl,c=ca
# to append the default base DN but this
# may incur a small performance impact.
nss_base_shadow ou=eduLinux,o=novl,c=ca
nss_base_group ou=Groups,ou=eduLinux,o=novl,c=ca
#nss_base_hosts		ou=Hosts,dc=example,dc=com?one
#nss_base_services		ou=Services,dc=example,dc=com?one
#nss_base_networks		ou=Networks,dc=example,dc=com?one
#nss_base_protocols	ou=Protocols,dc=example,dc=com?one
#nss_base_rpc		ou=Rpc,dc=example,dc=com?one
#nss_base_ethers		ou=Ethers,dc=example,dc=com?one
#nss_base_netmasks		ou=Networks,dc=example,dc=com?ne
#nss_base_bootparams	ou=Ethers,dc=example,dc=com?one
#nss_base_aliases		ou=Aliases,dc=example,dc=com?one
#nss_base_netgroup		ou=Netgroup,dc=example,dc=com?one

# attribute/objectclass mapping
# Syntax:
#nss_map_attribute       rfc2307attribute	mapped_attribute
#nss_map_objectclass     rfc2307objectclass	mapped_objectclass

# configure --enable-nds is no longer supported.
# For NDS now do:
nss_map_attribute uniqueMember member

# configure --enable-mssfu-schema is no longer supported.
# For MSSFU now do:
#nss_map_objectclass posixAccount User
#nss_map_attribute uid msSFUName
#nss_map_attribute uniqueMember posixMember
#nss_map_attribute userPassword msSFUPassword
#nss_map_attribute homeDirectory msSFUHomeDirectory
#nss_map_objectclass posixGroup Group
#nss_map_attribute cn msSFUName
#pam_login_attribute msSFUName
#pam_filter objectclass=User
#pam_password ad

# configure --enable-authpassword is no longer supported
# For authPassword support, now do:
#nss_map_attribute userPassword authPassword
pam_password nds

# For IBM AIX SecureWay support, do:
#nss_map_objectclass posixAccount aixAccount
#nss_map_attribute uid userName
#nss_map_attribute gidNumber gid
#nss_map_attribute uidNumber uid
#nss_map_attribute userPassword passwordChar
#nss_map_objectclass posixGroup aixAccessGroup
#nss_map_attribute cn groupName
#nss_map_attribute uniqueMember member
#pam_login_attribute userName
#pam_filter objectclass=aixAccount
#pam_password clear

# Netscape SDK LDAPS
#ssl on
ssl start_tls

# Netscape SDK SSL options
#sslpath /etc/ssl/certs/cert7.db

# OpenLDAP SSL mechanism
# start_tls mechanism uses the normal LDAP port, LDAPS typically 636

# OpenLDAP SSL options
# Require and verify server certificate (yes/no)
# Default is "no"
#tls_checkpeer yes

# CA certificates for server certificate verification
# At least one of these are required if tls_checkpeer is "yes"
#tls_cacertfile /etc/ssl/openldap/ca.cert
#tls_cacertdir /etc/ssl/certs

# SSL cipher suite
# See man ciphers for syntax
#tls_ciphers TLSv1

# Client sertificate and key
# Use these, if your server requires client authentication.
#tls_cert
#tls_key

Additional Helps

Note 1- Port 390 is used in the example, which is not the default port 389 for LDAP. A non-default port can be used if more than one LDAP listeners are running simultaneously on the same server, or just for a security measure. Replace 390 with the port you wish to use.

Note 2- Be very careful about the system-auth file, especially if you use drakauth, which can incorrectly mix up options for of the lines, especially these two:

auth        sufficient    /lib/security/pam_unix.so likeauth nullok 
 
auth        sufficient    /lib/security/pam_ldap.so use_first_pass 

Note 3- Instead of leveraging a proxy user for LDAP, which can be perceived as a security hole by some, it may be preferable to use a bind dn associated with a special user that has the required Attributes/Entry rights(same as the ones for the proxy user) but with a scope limited to OUs where user accounts and groups are located(instead of the root of the tree). In this scenario, the proxy user is not required anymore and can be removed from the LDAP Group object associated with the LDAP server(eDirectory). The following two lines can be used(uncommented and customized) in LDAP.CONF to specify the username/password:

# The distinguished name to bind to the server with. 
 
# Optional: default is to bind anonymously. 
 
binddn cn=proxyuser,dc=example,dc=com 
 
 
# The credentials to bind with. 
 
# Optional: default is no credential. 
 
bindpw secret 

The following files which have been discussed in this article are available here:

If you have any questions you may contact Michael mbluteauTAKETHISOUT@novell.com, after removing TAKETHISOUT from the address.


Novell Cool Solutions (corporate web communities) are produced by WebWise Solutions. www.webwiseone.com

© 2014 Novell