Ubuntu 18.04
Sponsored Link

OpenLDAP : LDAPクライアントの設定2018/06/05

 
LDAP サーバーのユーザーアカウント情報を共有できるように LDAP クライアントとしての設定をします。
[1] LDAP クライアントの設定です。
root@www:~#
apt -y install libnss-ldap libpam-ldap ldap-utils
(1) LDAPサーバーのURIを指定

 +---------------------| Configuring ldap-auth-config |----------------------+
 | Please enter the URI of the LDAP server to use. This is a string in the   |
 | form of ldap://<hostname or IP>:<port>/. ldaps:// or ldapi:// can also    |
 | be used. The port number is optional.                                     |
 |                                                                           |
 | Note: It is usually a good idea to use an IP address because it reduces   |
 | risks of failure in the event name service problems.                      |
 |                                                                           |
 | LDAP server Uniform Resource Identifier:                                  |
 |                                                                           |
 | ldap://dlp.srv.world/_________________________________________________    |
 |                                                                           |
 |                                  <Ok>                                     |
 |                                                                           |
 +---------------------------------------------------------------------------+

(2) 識別名を指定

 +---------------------| Configuring ldap-auth-config |----------------------+
 | Please enter the distinguished name of the LDAP search base. Many sites   |
 | use the components of their domain names for this purpose. For example,   |
 | the domain "example.net" would use "dc=example,dc=net" as the             |
 | distinguished name of the search base.                                    |
 |                                                                           |
 | Distinguished name of the search base:                                    |
 |                                                                           |
 | dc=srv,dc=world_______________________________________________________    |
 |                                                                           |
 |                                  <Ok>                                     |
 |                                                                           |
 +---------------------------------------------------------------------------+

(3) LDAPバージョンを指定 (通常は [3] で OK)

  +---------------------| Configuring ldap-auth-config |---------------------+
  | Please enter which version of the LDAP protocol should be used by        |
  | ldapns. It is usually a good idea to set this to the highest available   |
  | version.                                                                 |
  |                                                                          |
  | LDAP version to use:                                                     |
  |                                                                          |
  |                                    3                                     |
  |                                    2                                     |
  |                                                                          |
  |                                                                          |
  |                                  <Ok>                                    |
  |                                                                          |
  +--------------------------------------------------------------------------+

(4) 説明にあるように /etc を NFSマウントしている等であれば [No] だが通常は [Yes] で OK

 +---------------------| Configuring ldap-auth-config |----------------------+
 |                                                                           |
 | This option will allow you to make password utilities that use pam to     |
 | behave like you would be changing local passwords.                        |
 |                                                                           |
 | The password will be stored in a separate file which will be made         |
 | readable to root only.                                                    |
 |                                                                           |
 | If you are using NFS mounted /etc or any other custom setup, you should   |
 | disable this.                                                             |
 |                                                                           |
 | Make local root Database admin:                                           |
 |                                                                           |
 |                    <Yes>                       <No>                       |
 |                                                                           |
 +---------------------------------------------------------------------------+

(5) 説明にあるように 通常は [No] で OK

    +-------------------| Configuring ldap-auth-config |-------------------+
    |                                                                      |
    | Choose this option if you are required to login to the database to   |
    | retrieve entries.                                                    |
    |                                                                      |
    | Note: Under a normal setup, this is not needed.                      |
    |                                                                      |
    | Does the LDAP database require login?                                |
    |                                                                      |
    |                   <Yes>                      <No>                    |
    |                                                                      |
    +----------------------------------------------------------------------+

(6) LDAP管理者アカウントの識別名を指定

          +-------------| Configuring ldap-auth-config |-------------+
          | This account will be used when root changes a password.  |
          |                                                          |
          | Note: This account has to be a privileged account.       |
          |                                                          |
          | LDAP account for root:                                   |
          |                                                          |
          | cn=admin,dc=srv,dc=world_____________________________    |
          |                                                          |
          |                          <Ok>                            |
          |                                                          |
          +----------------------------------------------------------+

(7) LDAP管理者アカウントのパスワードを指定

 +---------------------| Configuring ldap-auth-config |----------------------+
 | Please enter the password to use when ldap-auth-config tries to login to  |
 | the LDAP directory using the LDAP account for root.                       |
 |                                                                           |
 | The password will be stored in a separate file /etc/ldap.secret which     |
 | will be made readable to root only.                                       |
 |                                                                           |
 | Entering an empty password will re-use the old password.                  |
 |                                                                           |
 | LDAP root account password:                                               |
 |                                                                           |
 | _________________________________________________________________________ |
 |                                                                           |
 |                                  <Ok>                                     |
 |                                                                           |
 +---------------------------------------------------------------------------+

root@www:~#
vi /etc/nsswitch.conf
# 7行目:追記

passwd:         compat systemd ldap
group:          compat systemd ldap
shadow:         compat

root@www:~#
vi /etc/pam.d/common-password
# 26行目:変更 ( [use_authtok] を削除 )

password        [success=1 user_unknown=ignore default=die]     pam_ldap.so try_first_pass

root@www:~#
vi /etc/pam.d/common-session
# 必要があれば、最終行に追記 (ログイン時にホームディレクトリを自動作成)

session optional        pam_mkhomedir.so skel=/etc/skel umask=077
root@www:~#
Ubuntu 18.04 LTS www.srv.world ttyS0

www login: ubuntu     # LDAP登録ユーザー
Password:
Welcome to Ubuntu 18.04 LTS (GNU/Linux 4.15.0-20-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Tue Jun  5 11:12:53 JST 2018

  System load:  0.07              Processes:           92
  Usage of /:   6.3% of 28.45GB   Users logged in:     0
  Memory usage: 3%                IP address for ens3: 10.0.0.31
  Swap usage:   0%

 * Meltdown, Spectre and Ubuntu: What are the attack vectors,
   how the fixes work, and everything else you need to know
   - https://ubu.one/u2Know

16 packages can be updated.
8 updates are security updates.

Creating directory '/home/ubuntu'.
ubuntu@www:~$      # ログインできた

# パスワード変更は通常通り

ubuntu@www:~$
Enter login(LDAP) password:     # 現在のパスワード
New password:                   # 新しいパスワード
Re-enter new password:
LDAP password information changed for ubuntu
passwd: password updated successfully
ubuntu@www:~$                   # 変更された
関連コンテンツ