Configure LDAP Client2016/06/23

	Configure LDAP Client in order to share users' accounts in your local networks.
[1]	Install OpenLDAP Client.

[root@www ~]#

dnf -y install openldap-clients nss-pam-ldapd

# ldapserver=(LDAP server's hostname or IP address)

# ldapbasedn="dc=(your own domain name)"

[root@www ~]#

authconfig --enableldap \
--enableldapauth \
--ldapserver=dlp.srv.world \
--ldapbasedn="dc=srv,dc=world" \
--enablemkhomedir \
--update

[root@www ~]#

vi /etc/sssd/sssd.conf

# add follows into [domain/default] section

ldap_tls_reqcert = allow

[root@www ~]#

systemctl restart sssd

[root@www ~]#

exit

logout

Fedora 24 (Server Edition)
Kernel 4.5.5-300.fc24.x86_64 on an x86_64 (ttyS0)

Admin Console: https://10.0.0.31:9090/ or https://[fe80::5054:ff:fe24:6f38]:9090/

www login:

redhat

# LDAP user

Password:

# LDAP password

[redhat@www ~]$

# just logined

[redhat@www ~]$

passwd

# try to change the LDAP password

Changing password for user redhat.
Enter login(LDAP) password:

# current password

New password:

# new password

Retype new password:
LDAP password information changed for redhat
passwd: all authentication tokens updated successfully.

[2]	If SELinux is enabled, it needs to add a rule to allow creating home directories automatically by mkhomedir.

[root@www ~]#

dnf -y install checkpolicy policycoreutils-python-utils

[root@www ~]#

vi mkhomedir.te

# create new

module mkhomedir 1.0;

require {
        type unconfined_t;
        type oddjob_mkhomedir_exec_t;
        class file entrypoint;
}

#============= unconfined_t ==============
allow unconfined_t oddjob_mkhomedir_exec_t:file entrypoint;

[root@www ~]#

checkmodule -m -M -o mkhomedir.mod mkhomedir.te

checkmodule: loading policy configuration from mkhomedir.te
checkmodule: policy configuration loaded
checkmodule: writing binary representation (version 17) to mkhomedir.mod
[root@www ~]#

semodule_package --outfile mkhomedir.pp --module mkhomedir.mod

[root@www ~]#

semodule -i mkhomedir.pp

Matched Content