Step 1: Install the following packages:
# yum install -y openldap openldap-clients openldap-servers migrationtools
Step 2: Generate a LDAP encrypted password for Manager user (here redhat):
# slappasswd -s redhat -n > /etc/openldap/secret-passwd
Step 3: Configure OpenLDAP Server:
#vim /etc/openldap/slapd.d/"cn=config"/"olcDatabase={2}bdb.ldif"
#do the following changes
olcSuffix: dc=example,dc=com
olcRootDN: cn=Manager,dc=example,dc=com
olcRootPW: PASTE YOUR ENCRYPTED PASSWORD HERE from /etc/openldap/secret-passwd
olcTLSCertificateFile: /etc/pki/CA/cacert.pem
olcTLSCertificateKeyFile: /etc/pki/CA/private/cakey.pem
:wq (save abd exit)
Step 4: Configure Monitoring Database Configuration file:
#vim /etc/openldap/slapd.d/"cn=config"/"olcDatabase={1}monitor.ldif"
#do the following change
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=example,dc=com" read by * none
:wq (save and exit)
Step 5: Generate a X509 self sign certificate which is valid for 365 days:
# openssl req -new -x509 -nodes -out /etc/pki/CA/cacert.pem -keyout /etc/pki/CA/private/cakey.pem -days 365
Country Name (2 letter code) [XX]: IN
State or Province Name (full name) []: Delhi
Locality Name (eg, city) [Default City]: New Delhi
Organization Name (eg, company) [Default Company Ltd]: Example, Inc.
Organizational Unit Name (eg, section) []: Training
Common Name (eg, your name or your server's hostname) []:server1.example.com
Email Address []: root@server1.example.com
Step 6: Secure the content of the /etc/pki/CA/ directory:
# cd /etc/pki/CA/
# chown ldap:ldap cacert.pem
# cd /etc/pki/CA/private/
# chown ldap:ldap cakey.pem
# chmod 600 cakey.pem
Step 7: Prepare the LDAP database:
# cp -rvf /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
# chown -R ldap:ldap /var/lib/ldap/
Step 8: Enable LDAPS:
#vim /etc/sysconfig/slapd
#Do the following changes
SLAPD_URLS="ldapi:/// ldap:/// ldaps:///"
:wq (save and exit)
Step 9: Test the configuration:
# slaptest -u
Step 10: Start and enable the slapd service at boot:
# systemctl start slapd
# systemctl enable slapd
Step 11: Check the LDAP activity:
# netstat -lt | grep ldap
#netstat -tunlp | egrep "389|636"
Step 12: To start the configuration of the LDAP server, add the follwing LDAP schemas:
# cd /etc/openldap/schema
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f cosine.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f nis.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f collective.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f corba.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f core.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f duaconf.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f dyngroup.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f inetorgperson.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f java.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f misc.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f openldap.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f pmi.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f ppolicy.ldif
##################################################
# NOTE-: You can add schema files according to your need: #
##################################################
Step 13: Now use Migration Tools to create LDAP DIT:
# cd /usr/share/migrationtools
# vim migrate_common.ph
#do the following chnages
on the Line Number 61, change "ou=Groups"
$NAMINGCONTEXT{'group'} = "ou=Groups";
on the Line Number 71, change your domain name
$DEFAULT_MAIL_DOMAIN = "example.com";
on the line number 74, change your base name
$DEFAULT_BASE = "dc=example,dc=com";
on the line number 90, change schema value
$EXTENDED_SCHEMA = 1;
:wq (save and exit)
Step 14: Generate a base.ldif file for your Domain DIT:
#./migrate_base.pl > /root/base.ldif
Step 15: Load "base.ldif" into LDAP Database:
#ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f /root/base.ldif
Step 16: Now Create some users and Groups and migrate it from local database to LDAP database:
#mkdir /home/guests
#useradd -d /home/guests/ldapuser1 ldapuser1
#useradd -d /home/guests/ldapuser2 ldapuser2
#useradd -d /home/guests/ldapuser3 ldapuser3
#useradd -d /home/guests/ldapuser4 ldapuser4
#useradd -d /home/guests/ldapuser5 ldapuser5
#echo 'password' | passwd --stdin ldapuser1
#echo 'password' | passwd --stdin ldapuser2
#echo 'password' | passwd --stdin ldapuser3
#echo 'password' | passwd --stdin ldapuser4
#echo 'password' | passwd --stdin ldapuser5
Step 17: Now filter out these Users and Groups and it password from /etc/shadow to different file:
#getent passwd | tail -n 5 > /root/users
#getent shadow | tail -n 5 > /root/shadow
# getent group | tail -n 5 > /root/groups
Step 18: Now you can delete these users from local database:
#userdel ldapuser1
#userdel ldapuser2
#userdel ldapuser3
#userdel ldapuser4
#userdel ldapuser5
Step 19: Now you need to create ldif file for these users using migrationtools:
# cd /usr/share/migrationtools/
# vim migrate_passwd.pl
#search /etc/shadow and replace it into /root/shadow on Line Number 188.
:wq (save and exit)
# ./migrate_passwd.pl /root/users > /root/users.ldif
# ./migrate_group.pl /root/groups > /root/groups.ldif
Step 20: Upload these users and groups ldif file into LDAP Database:
# ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f /root/users.ldif
# ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f /root/groups.ldif
Step 21: Now search LDAP DIT for all records:
# ldapsearch -x -b "dc=example,dc=com" -H ldap://server1.example.com
Step 22: Now share ldapusers home directories via NFS:
#vim /etc/exports
#Add the folloiwng line:
/home/guests 192.168.48.0/255.255.255.0(rw,sync)
:wq (save and exit)
#systemctl start nfs
#systemctl enable nfs
Step 23: Share your CA Certificate to clients via FTP/HTTP:
#yum install vsftpd httpd -y
# cp -rvf /etc/pki/CA/cacert.pem /var/ftp/pub/
# ln -s /var/ftp/pub/ /var/www/html/
#systemctl start vsftpd
#systemctl enable vsftpd
#systemctl start httpd
#systemctl enable httpd
Step 24: Now Go to the client machine and install the following packages:
#yum install openldap-clients sssd pam_ldap authconfig-gtk -y
Step 25: Run the "authconfig-gtk" command to configure as a LDAP Client:
# authconfig-gtk
Click on "Identity & Authentication" Tab
Click on drop down menu in "User Account Database" and Select "LDAP"
in LDAP Search Base DN: dc=example,dc=com
in LDAP Server: ldap://server1.example.com
Select the check Box of "Use TLS to encrypt connections"
Click "Download CA Certificate"
In Certificate URL: type http://server1.example.com/pub/cacert.pem
Authentication Protocol: LDAP Password
Click "OK"
# getent passwd ldapuser1
Step 26: Now Configure your client machine to access ldapusers home directory from
"server1.example.com"
#yum install autofs -y
#vim /etc/auto.master
#add the following line
/home/guests /etc/auto.guests
:wq (save and exit)
#vim /etc/auto.guests
#add the following line
* -rw server1.example.com:/home/guests/&
:wq (save and exit)
Step 27: Now start and enable autofs service at boot:
#systemctl restart autofs
#systemctl enable autofs
Step 28: Now try to login as ldapuseer on client machine:
#ssh ldapuser1@client.example.com
Password: password
[ldapuser1@client.exmaple.com ~]$
You may have some issue with Firewall/iptables, So add Ports/Services into firewall or disable it.
############Congratulations, You have configured LDAP server and client##############
# yum install -y openldap openldap-clients openldap-servers migrationtools
Step 2: Generate a LDAP encrypted password for Manager user (here redhat):
# slappasswd -s redhat -n > /etc/openldap/secret-passwd
Step 3: Configure OpenLDAP Server:
#vim /etc/openldap/slapd.d/"cn=config"/"olcDatabase={2}bdb.ldif"
#do the following changes
olcSuffix: dc=example,dc=com
olcRootDN: cn=Manager,dc=example,dc=com
olcRootPW: PASTE YOUR ENCRYPTED PASSWORD HERE from /etc/openldap/secret-passwd
olcTLSCertificateFile: /etc/pki/CA/cacert.pem
olcTLSCertificateKeyFile: /etc/pki/CA/private/cakey.pem
:wq (save abd exit)
Step 4: Configure Monitoring Database Configuration file:
#vim /etc/openldap/slapd.d/"cn=config"/"olcDatabase={1}monitor.ldif"
#do the following change
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=example,dc=com" read by * none
:wq (save and exit)
Step 5: Generate a X509 self sign certificate which is valid for 365 days:
# openssl req -new -x509 -nodes -out /etc/pki/CA/cacert.pem -keyout /etc/pki/CA/private/cakey.pem -days 365
Country Name (2 letter code) [XX]: IN
State or Province Name (full name) []: Delhi
Locality Name (eg, city) [Default City]: New Delhi
Organization Name (eg, company) [Default Company Ltd]: Example, Inc.
Organizational Unit Name (eg, section) []: Training
Common Name (eg, your name or your server's hostname) []:server1.example.com
Email Address []: root@server1.example.com
Step 6: Secure the content of the /etc/pki/CA/ directory:
# cd /etc/pki/CA/
# chown ldap:ldap cacert.pem
# cd /etc/pki/CA/private/
# chown ldap:ldap cakey.pem
# chmod 600 cakey.pem
Step 7: Prepare the LDAP database:
# cp -rvf /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
# chown -R ldap:ldap /var/lib/ldap/
Step 8: Enable LDAPS:
#vim /etc/sysconfig/slapd
#Do the following changes
SLAPD_URLS="ldapi:/// ldap:/// ldaps:///"
:wq (save and exit)
Step 9: Test the configuration:
# slaptest -u
Step 10: Start and enable the slapd service at boot:
# systemctl start slapd
# systemctl enable slapd
Step 11: Check the LDAP activity:
# netstat -lt | grep ldap
#netstat -tunlp | egrep "389|636"
Step 12: To start the configuration of the LDAP server, add the follwing LDAP schemas:
# cd /etc/openldap/schema
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f cosine.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f nis.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f collective.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f corba.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f core.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f duaconf.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f dyngroup.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f inetorgperson.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f java.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f misc.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f openldap.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f pmi.ldif
# ldapadd -Y EXTERNAL -H ldapi:/// -D "cn=config" -f ppolicy.ldif
##################################################
# NOTE-: You can add schema files according to your need: #
##################################################
Step 13: Now use Migration Tools to create LDAP DIT:
# cd /usr/share/migrationtools
# vim migrate_common.ph
#do the following chnages
on the Line Number 61, change "ou=Groups"
$NAMINGCONTEXT{'group'} = "ou=Groups";
on the Line Number 71, change your domain name
$DEFAULT_MAIL_DOMAIN = "example.com";
on the line number 74, change your base name
$DEFAULT_BASE = "dc=example,dc=com";
on the line number 90, change schema value
$EXTENDED_SCHEMA = 1;
:wq (save and exit)
Step 14: Generate a base.ldif file for your Domain DIT:
#./migrate_base.pl > /root/base.ldif
Step 15: Load "base.ldif" into LDAP Database:
#ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f /root/base.ldif
Step 16: Now Create some users and Groups and migrate it from local database to LDAP database:
#mkdir /home/guests
#useradd -d /home/guests/ldapuser1 ldapuser1
#useradd -d /home/guests/ldapuser2 ldapuser2
#useradd -d /home/guests/ldapuser3 ldapuser3
#useradd -d /home/guests/ldapuser4 ldapuser4
#useradd -d /home/guests/ldapuser5 ldapuser5
#echo 'password' | passwd --stdin ldapuser1
#echo 'password' | passwd --stdin ldapuser2
#echo 'password' | passwd --stdin ldapuser3
#echo 'password' | passwd --stdin ldapuser4
#echo 'password' | passwd --stdin ldapuser5
Step 17: Now filter out these Users and Groups and it password from /etc/shadow to different file:
#getent passwd | tail -n 5 > /root/users
#getent shadow | tail -n 5 > /root/shadow
# getent group | tail -n 5 > /root/groups
Step 18: Now you can delete these users from local database:
#userdel ldapuser1
#userdel ldapuser2
#userdel ldapuser3
#userdel ldapuser4
#userdel ldapuser5
Step 19: Now you need to create ldif file for these users using migrationtools:
# cd /usr/share/migrationtools/
# vim migrate_passwd.pl
#search /etc/shadow and replace it into /root/shadow on Line Number 188.
:wq (save and exit)
# ./migrate_passwd.pl /root/users > /root/users.ldif
# ./migrate_group.pl /root/groups > /root/groups.ldif
Step 20: Upload these users and groups ldif file into LDAP Database:
# ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f /root/users.ldif
# ldapadd -x -W -D "cn=Manager,dc=example,dc=com" -f /root/groups.ldif
Step 21: Now search LDAP DIT for all records:
# ldapsearch -x -b "dc=example,dc=com" -H ldap://server1.example.com
Step 22: Now share ldapusers home directories via NFS:
#vim /etc/exports
#Add the folloiwng line:
/home/guests 192.168.48.0/255.255.255.0(rw,sync)
:wq (save and exit)
#systemctl start nfs
#systemctl enable nfs
Step 23: Share your CA Certificate to clients via FTP/HTTP:
#yum install vsftpd httpd -y
# cp -rvf /etc/pki/CA/cacert.pem /var/ftp/pub/
# ln -s /var/ftp/pub/ /var/www/html/
#systemctl start vsftpd
#systemctl enable vsftpd
#systemctl start httpd
#systemctl enable httpd
Step 24: Now Go to the client machine and install the following packages:
#yum install openldap-clients sssd pam_ldap authconfig-gtk -y
Step 25: Run the "authconfig-gtk" command to configure as a LDAP Client:
# authconfig-gtk
Click on "Identity & Authentication" Tab
Click on drop down menu in "User Account Database" and Select "LDAP"
in LDAP Search Base DN: dc=example,dc=com
in LDAP Server: ldap://server1.example.com
Select the check Box of "Use TLS to encrypt connections"
Click "Download CA Certificate"
In Certificate URL: type http://server1.example.com/pub/cacert.pem
Authentication Protocol: LDAP Password
Click "OK"
# getent passwd ldapuser1
Step 26: Now Configure your client machine to access ldapusers home directory from
"server1.example.com"
#yum install autofs -y
#vim /etc/auto.master
#add the following line
/home/guests /etc/auto.guests
:wq (save and exit)
#vim /etc/auto.guests
#add the following line
* -rw server1.example.com:/home/guests/&
:wq (save and exit)
Step 27: Now start and enable autofs service at boot:
#systemctl restart autofs
#systemctl enable autofs
Step 28: Now try to login as ldapuseer on client machine:
#ssh ldapuser1@client.example.com
Password: password
[ldapuser1@client.exmaple.com ~]$
You may have some issue with Firewall/iptables, So add Ports/Services into firewall or disable it.
############Congratulations, You have configured LDAP server and client##############
