Hi gang!
I'm looking for some guidance in what is most probably a very common objective. Which is to manage all authentication to network hosts from slapd. To begin, my goal is to have:
1. one machine (generically-configured LDAP client) running sshd (10.153.107.100) 2. multiple LDAP users 3. specify, from slapd, that only one user (tony) can log in over ssh to the machine
Surprisingly, I have not found much documentation on this stuff beyond the slapo-nssov man page. Anyway, I have some LDIF entries ready to go but I'm feeling very uneasy about dumping them in and hoping for the best. I would rather learn more about how this all works together and hopefully get some pointers/gotchas from others who have done this before. That's why I'm writing this email. In particular, at this point I only want the bare necessities to achieve my simple goad specified above.
My slapd server has the nis and ldapns schemas configured and the client machine has libnss-ldapd (applied to group and passwd services) and libpam-ldapd. All systems are running Ubuntu 11.10. I have manually disabled nslcd on the Ubuntu client machine (sudo update-rc.d nslcd disable).
These are the entries I have so far:
for slapd-config:
# NSSOV dn: olcOverlay=nssov,ocDatabase={1}hdb,cn=config objectClass: olcOverlayConfig objectClass: olcNssOvConfig olcOverlay: nssov olcNssSsd: passwd ldap:///ou=People,dc=example,dc=com??one olcNssSsd: group ldap:///ou=People,dc=example,dc=com??one olcNssSsd: hosts ldap:///ou=People,dc=example,dc=com??one olcNssPam: hostservice uid2dn olcNssPamSession: sshd
# ACL dn: olcDatabase={1}hdb,cn=config olcAccess: to attrs=userPassword by anonymous auth by self write by * none olcAccess: to attrs=shadowLastChange by self write by * none olcAccess: to * by self write by * read olcAccess: to dn.exact=cn=host1.example.com,ou=Hosts,dc=example,dc=com attrs=authorizedservice by dn.exact=cn=ssh,ou=host1,ou=server_access,ou=Groups,dc=example,dc=com compare by * read
==================
The sshd host, user & group entries from my regular hdb-based DIT:
# NSSOV HOST and USER dn: cn=host1.example.com,ou=Hosts,dc=example,dc=com objectClass: device objectClass: top objectClass: ipHost objectClass: authorizedServiceObject cn=host1.example.com ipHostNumber: 10.153.107.100 authorizedService: sshd
dn: cn=ssh,ou=host1,ou=server_access,ou=Groups,dc=example,dc=com objectClass: posixGroup cn: ssh-host1-server_access gidNumber: 6000
dn: uid=tony,ou=People,dc=example,dc=com objectClass: inetOrgPerson objectClass: posixAccount objectClass: shadowAccount uid: tony cn: Tony Doe uidNumber: 11000 gidNumber: 6000 userPassword: tonyldap loginShell: /bin/bash homeDirectory: /home/tony
===================
Anyone?
Thanks in advance,
Peter