Portál AbcLinuxu, 6. června 2025 17:17
dn: cn=config
objectClass: olcGlobal
cn: config
olcArgsFile: /var/run/slapd/slapd.args
olcLogLevel: 256
olcPidFile: /var/run/slapd/slapd.pid
olcServerID: 1 ldap://first.domain.tld
olcServerID: 2 ldap://second.domain.tld
olcServerID: 3 ldap://thirst.domain.tld
olcTLSCACertificateFile: /etc/ldap/server.pem
olcTLSCertificateFile: /etc/ldap/server.pem
olcTLSCertificateKeyFile: /etc/ldap/server.pem
olcToolThreads: 1
dn: cn=module{0},cn=config
objectClass: olcModuleList
cn: module{0}
olcModuleLoad: {0}back_hdb
olcModuleLoad: {1}refint
olcModuleLoad: {2}syncprov
olcModuleLoad: {3}memberof
olcModulePath: /usr/lib/ldap
dn: olcBackend={0}hdb,cn=config
objectClass: olcBackendConfig
olcBackend: {0}hdb
dn: olcDatabase={-1}frontend,cn=config
objectClass: olcDatabaseConfig
objectClass: olcFrontendConfig
olcDatabase: {-1}frontend
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break
olcAccess: {1}to dn.exact="" by * read
olcAccess: {2}to dn.base="cn=Subschema" by * read
olcSizeLimit: 500
dn: olcDatabase={0}config,cn=config
objectClass: olcDatabaseConfig
olcDatabase: {0}config
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break
olcMirrorMode: TRUE
olcRootDN: cn=admin,cn=config
olcRootPW: {SSHA}asdfasdfasdfasdf
olcSyncrepl: {0}rid=1 provider=ldap://first.domain.tld binddn="cn=admin,cn=config" bindmethod=simple credentials=password searchbase="cn=config" type=refreshAndPersist retry=
"5 5 300 5" timeout=1
olcSyncrepl: {1}rid=2 provider=ldap://second.domain.tld binddn="cn=admin,cn=config" bindmethod=simple credentials=password searchbase="cn=config" type=refreshAndPersist retry
="5 5 300 5" timeout=1
olcSyncrepl: {2}rid=3 provider=ldap://thirst.domain.tld binddn="cn=admin,cn=config" bindmethod=simple credentials=password searchbase="cn=config" type=refreshAndPersist retry
="5 5 300 5" timeout=1
dn: olcOverlay={0}syncprov,olcDatabase={0}config,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: {0}syncprov
dn: olcDatabase={1}hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {1}hdb
olcDbDirectory: /var/lib/ldap
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=domain2,dc=tld" write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by self write by dn="cn=admin,dc=domain2,dc=tld" write by users read by * auth
olcDbCheckpoint: 512 30
olcDbConfig: {0}set_cachesize 0 2097152 0
olcDbConfig: {1}set_lk_max_objects 1500
olcDbConfig: {2}set_lk_max_locks 1500
olcDbConfig: {3}set_lk_max_lockers 1500
olcDbIndex: objectClass eq
olcDbIndex: entryUUID eq
olcDbIndex: entryCSN eq
olcDbIndex: memberOf eq
olcDbIndex: uid eq
olcLastMod: TRUE
olcMirrorMode: TRUE
olcRootDN: cn=admin,dc=domain2,dc=tld
olcRootPW: {SSHA}sdfasdfasdfasdfasdf
olcSuffix: dc=domain2,dc=tld
olcSyncrepl: {0}rid=1 provider=ldap://first.domain.tld binddn="cn=admin,dc=domain2,dc=tld" bindmethod=simple credentials=password searchbase="dc=domain2,dc=tld" type=refresh
Only interval=00:00:00:10 retry="5 5 300 5" timeout=1
olcSyncrepl: {1}rid=2 provider=ldap://second.domain.tld binddn="cn=admin,dc=domain2,dc=tld" bindmethod=simple credentials=password searchbase=" dc=domain2,dc=tld" type=refres
hOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1
olcSyncrepl: {2}rid=3 provider=ldap://thirst.domain.tld binddn="cn=admin,dc=domain2,dc=tld" bindmethod=simple credentials=password searchbase="dc=domain2,dc=tld" type=refres
hOnly interval=00:00:00:10 retry="5 5 300 5" timeout=1
dn: olcOverlay={0}refint,olcDatabase={1}hdb,cn=config
objectClass: olcConfig
objectClass: olcOverlayConfig
objectClass: olcRefintConfig
olcOverlay: {0}refint
olcRefintAttribute: member
olcRefintAttribute: memberOf
olcRefintModifiersName: cn=admin,dc=domain2,dc=tld
olcRefintNothing: cn=admin,dc=domain2,dc=tld
dn: olcOverlay={1}syncprov,olcDatabase={1}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: {1}syncprov
dn: olcOverlay={2}memberof,olcDatabase={1}hdb,cn=config
objectClass: olcOverlayConfig
objectClass: olcConfig
objectClass: top
olcOverlay: {2}memberof
A jeste varovani na zaver. Pokud uz se ti to podari copypastovat a oeditovat tak, aby to odpovidalo tvym predstavam, tak si dej pozor a nestav na tom zadne reseni do doby, nez tomu budes rozumnet. LDAP je infrastrukturalni zalezitost na ktere stoji obvykle rada dalsich sluzeb. Jeji neznalosti si zadelavas na problemy. Pokud uz chces LDAP provozovat a nerozumnet mu, tak doporucuju pouzit treba Red Hat Directory Server (resp. CentOS), ktery ma klikatko a je to easy. Podobne treba 389 z Fedory.
Enjoy!
Pripadne co tam je jeste spatne.
include /etc/openldap/schema/core.schema
include /etc/openldap/schema/cosine.schema
include /etc/openldap/schema/inetorgperson.schema
include /etc/openldap/schema/nis.schema
include /etc/openldap/schema/ppolicy.schema
include /etc/openldap/schema/isl.schema
# Define global ACLs to disable default read access.
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org
pidfile /var/run/slapd/slapd.pid
argsfile /var/run/slapd/slapd.args
modulepath /usr/lib/openldap/modules
access to *
by dn.exact="uid=mumla,ou=people,dc=stb,dc=acr" write
by * read
access to dn.base=""
by * read
access to dn.base="cn=Subschema"
by * read
access to attrs=userPassword,userPKCS12
by self write
by * auth
access to attrs=shadowLastChange
by self write
by * read
access to *
by self write
by * read
loglevel sync stats
TLSCertificateFile /etc/ssl/servercerts/servercert.pem
TLSCACertificatePath /etc/ssl/certs/
TLSCertificateKeyFile /etc/ssl/servercerts/serverkey.pem
database config
rootdn cn=config
rootpw "{ssha}password"
database monitor
rootdn cn=monitor
rootpw "{ssha}password"
database bdb
suffix "dc=stb,dc=acr"
rootdn "cn=Administrator,dc=stb,dc=acr"
rootpw "{ssha}password"
directory /var/lib/ldap/stb
checkpoint 256 5
cachesize 10000
overlay ppolicy
ppolicy_default "cn=default,ou=Policies,dc=stb,dc=acr"
ppolicy_hash_cleartext
ppolicy_use_lockout
ServerID 1 ldap://cz-250-35
ServerID 2 ldap://cz-250-36
syncrepl rid=001
provider=ldap://cz-250-35
uri=ldap://cz-250-35
binddn="uid=mumla,ou=people,dc=stb,dc=acr"
bindmethod=simple
credentials=password
searchbase="dc=stb,dc=acr"
type=refreshAndPersist
starttls=yes
tls_reqcert=never
retry="5 5 300 5"
timeout=1
syncrepl rid=002
provider=ldap://cz-250-36
uri=ldap://cz-250-36
binddn="uid=mumla,ou=people,dc=stb,dc=acr"
bindmethod=simple
credentials=password
searchbase="dc=stb,dc=acr"
type=refreshAndPersist
starttls=yes
tls_reqcert=never
retry="5 5 300 5"
timeout=1
mirrormode TRUE
overlay syncprov
syncprov-checkpoint 100 10
syncprov-sessionlog 100
limits dn.exact="uid=mumla,ou=people,dc=stb,dc=acr"
size=unlimited time=unlimited
index objectClass,uidNumber,gidNumber eq
index uid eq,subinitial
index member,cn,memberUid eq
index entryCSN,entryUUID eq
access to * by dn.exact="uid=mumla,ou=people,dc=stb,dc=acr" write by self write by * read A tohle zakomentoval #access to * # by self write # by * read
Predokladam, ze ACL od kolegy nahore jsou lepsi ?
Access to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=domain2,dc=tld" write by * none Access to dn.base="" by * read Access to * by self write by dn="cn=admin,dc=domain2,dc=tld" write by users read by * auth
man slapd.access, roznych ukazkovych ACL az po OpenLDAP Software 2.4 Administrator's Guide zo stranok projektu openldap).
Neberu to jako poucovani, jsem rad za kazdou radu.
Jen jsem myslel, ze existuje nejaky obecny nastaveni. Standartne (zjednodusene) se LDAP pouziva k jednotne sprave hesel, kdyz mam treba 5 serveru. Pak bych ocekaval nejaky default bezpecny nastaveni ACL. Je to jako kdyz nainstaluju cisty OS, tak mam pristup taky *celkem* bezpecny a neresim hned napriklad prenastaveni PAM atd.
Ale chapu, ze nastudovani je vdzy lepsi, aspon clovek chape souvislosti
Tak isto ako vy povazaujete za standardne pouzivanie LDAPu ako autentifikacneho adresara, tak ho moze niekto pouzivat ako adresar kontaktov, mailovych aliasov (pre postovy server), DNS resp DHCP zaznamov, alebo adresar pre objekty v ramci nejakeho programovacieho jazyka. Druhou podstatnou vecou pri pisani pravidiel je zvolena struktura adresara v zmysle jeho pouzitia. Podla toho musite vychadzat pri pisani pravidiel. Mozno sa vam zda na prvy pohlad pouzivanie LDAPu ako priehladne v zmysle toho, na co sa asi najcastejsie pouziva, opak je vsak pravdou (vidim to nielen na mojom pouziti, ale aj na pouzivani v inych prostrediach) a to su vsetko dovody, pre ktore tie pravidla standardne neexistuju ziadne v uvodnej konfiguracii.. preto ked si pozrete defaultny slapd.conf subor, vidite tam zakomentovane moznosti aspon tych najzakladnejsich pravidiel, ktore mozte pouzit, ale automaticky pouzivane (teda...okrem tych uplne najzakladnejsich).
Nieco podobne je aj vo firewallingu dajme tomu na smerovaci, kde neexistuju pravidla ziadne, lebo nik nevie ako to smerovanie a jeho bezpecnost chcete implementovat. Su sice skripty alebo nadstavby nad iptables, ale tie sa hodia len pre najbeznejsie pouzitie (neviem si predstavit wizardom nakonfigurovat smerovac s 5timi sietovymi interfejsmi). Pokial chcete spravit cokolvek nestandardne/netypicke/trocha komplikovanejsie, nemate sancu to jednoducho naklikat, treba si take pravidla napisat sam.
Toto su vsetko veci, cez ktore sa musite preluskat sam. Samozrejme nieje problem poradit v konkretnych veciach. To je nieco podobne ako ked sa tu na abclinuxu vymienaju konfiguraky samby (lebo niekto chcel vidiet nieco funkcne, rychlejsie, bezpecnejsie a pod) a aj tak je to vacsinou o nicom a vzdy to zavisi na konkretnom prostredi a nasadeni.
Jeste bych mel jeden konkretni dotaz.
V me konfiguraci budou klienti pristupovat po public siti, ale replikace pujde po interni siti. Je toto nastaveni spravne ?
# slapd bezi s timto /usr/lib/openldap/slapd -h ldap://public-network ldap://interni-network # konfigurace slapd.conf ServerID 1 ldap://server1-interni-network ServerID 2 ldap://server2-interni-network syncrepl rid=001 provider=ldap://server1-interni-network uri=ldap://server1-interni-network ... syncrepl rid=002 provider=ldap://server2-interni-network uri=ldap://server2-interni-network ...
public-network a interni-network myslite konkretne IP adresy servera, ktore ma na svojich rozhraniach tak ano. ono kedykolvek si mozte overit ci na tych IP adresar slapd naozaj pocuva cez netstat.
Tiskni
Sdílej:
ISSN 1214-1267, (c) 1999-2007 Stickfish s.r.o.