----- "Per Kristiansen"<perk(a)funcom.com> wrote: > Hello, I've been working on implementing a LDAP solution for the last > 8 > months (in-between task, you know how it is :D ) Time flies! > I now have a working LDAP directory, have all my users imported, > things > actually work! :D..(jinx!) Excellent work, well done! > But now I wanna get fancy.. > > I've been googeling for some sort of clear description on how I can > set > up a system using groups of hosts and user groups to create a > selective > ACL for ssh'ing to a set of servers based on group membership. > It sounds to me like you are almost here and just need help creating the LDAP groups, ACLs and LDAP search/filters for use with nss_ldap on RHEL 4/5 and Centos?

Sorry to jump in the middle of this thread, but the nssov overlay sounds

Thanks, John > -----Original Message----- > From: openldap-technical- > bounces+john.kane=prodeasystems.com(a)OpenLDAP.org [mailto:openldap- > technical-bounces+john.kane=prodeasystems.com(a)OpenLDAP.org] On Behalf > Of Howard Chu > Sent: Tuesday, May 19, 2009 8:19 PM > To: Gavin Henry > Cc: Per Kristiansen; openldap-technical(a)openldap.org > Subject: Re: Host based authentication using OpenLDAP > > Gavin Henry wrote: >> >> ----- "Per Kristiansen"<perk(a)funcom.com> wrote: >> >>> Hello, I've been working on implementing a LDAP solution for the > last >>> 8 >>> months (in-between task, you know how it is :D ) >> >> Time flies! >> >>> I now have a working LDAP directory, have all my users imported, >>> things >>> actually work! :D..(jinx!) >> >> Excellent work, well done! >> >>> But now I wanna get fancy.. >>> >>> I've been googeling for some sort of clear description on how I can >>> set >>> up a system using groups of hosts and user groups to create a >>> selective >>> ACL for ssh'ing to a set of servers based on group membership. >>> >> >> It sounds to me like you are almost here and just need help creating > the LDAP groups, ACLs >> and LDAP search/filters for use with nss_ldap on RHEL 4/5 and Centos? > > ACLs for nss_ldap is not the way to handle this. It needs to be done in > the > PAM account management handlers, and pam_ldap's support for that is > pretty > weak. In particular, it doesn't support centrally configuring access to > services on groups of hosts. The PAM support in nssov is a lot better > in this > area and can do what the original poster wants; I just haven't written > an > example ACL for this feature in the docs yet. > > -- > -- Howard Chu > CTO, Symas Corp. http://www.symas.com > Director, Highland Sun http://highlandsun.com/hyc/ > Chief Architect, OpenLDAP http://www.openldap.org/project/ This message is confidential to Prodea Systems, Inc unless otherwise indicated or apparent from its nature. This message is directed to the intended recipient only, who may be readily determined by the sender of this message and its contents. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient:(a)any dissemination or copying of this message is strictly prohibited; and(b)immediately notify the sender by return message and destroy any copies of this message in any form(electronic, paper or otherwise) that you have.The delivery of this message and its information is neither intended to be nor constitutes a disclosure or waiver of any trade secrets, intellectual property, attorney work product, or attorney-client communications. The authority of the individual sending this message to legally bind Prodea Systems is neither apparent nor implied,and must be independently verified.

Howard Chu wrote: > John Kane wrote: >> Sorry to jump in the middle of this thread, but the nssov overlay sounds > very useful, something I would like to take advantage of, but I cannot seem to > find any documentation on it. How long has this been available (what release), > and where might I find more info? > > It has not been released yet. Just to clarify: the nssov overlay was first released in OpenLDAP 2.4.11, but it only had NSS support. The PAM support is currently only in CVS. > You can check out the current code from CVS in > contrib/slapd-modules/nssov. You can browse it online here: > > http://www.openldap.org/devel/cvsweb.cgi/contrib/slapd-modules/nssov/ > > The README and slapo-nssov.5 manpage will give you a better idea of what it does.

Hi I follow your conversation because I have to do the same thing, so I would like to add hosts in my openldap but I don't succeed My add.ldif dn: cn=hostlab,ou=hosts,dc=netplus,dc=fr objectClass: top objectClass: authorizedServiceObject objectClass: ipHost cn: hostlab ipHostNumber: 192.168.45.69 authorizedService: sshd authorizedService: ftp my command # ldapadd -x -D "cn=manager,dc=netplus,dc=fr" -w **** -f add.ldif adding new entry "cn=hostlab,ou=hosts,dc=netplus,dc=fr" ldapadd: Object class violation (65) additional info: no structural object class provided What is the problem ? in my phpldapadmin I have this message: Importation au format LDIF Impossible d'ajouter un objet : cn=hostlab,ou=hosts,dc=netplus,dc=fr LDAP dit :: LDAP_OBJECT_CLASS_VIOLATION You tried to perform an operation that would cause an undefined attribute to exist or that would remove a required attribute, given the current list of ObjectClasses. This can also occur if you do not specify a structural objectClass when creating an entry, or if you specify more than one structural objectClass. Maybe I had to post in a new message, sorry if I'm wrong. Regards, François

Hi I follow your conversation because I have to do the same thing, so I would like to add hosts in my openldap but I don't succeed My add.ldif dn: cn=hostlab,ou=hosts,dc=netplus,dc=fr objectClass: top objectClass: authorizedServiceObject objectClass: ipHost cn: hostlab ipHostNumber: 192.168.45.69 authorizedService: sshd authorizedService: ftp

my command # ldapadd -x -D "cn=manager,dc=netplus,dc=fr" -w **** -f add.ldif adding new entry "cn=hostlab,ou=hosts,dc=netplus,dc=fr" ldapadd: Object class violation (65) additional info: no structural object class provided What is the problem ? in my phpldapadmin I have this message:

Importation au format LDIF Impossible d'ajouter un objet : cn=hostlab,ou=hosts,dc=netplus,dc=fr LDAP dit :: LDAP_OBJECT_CLASS_VIOLATION You tried to perform an operation that would cause an undefined attribute to exist or that would remove a required attribute, given the current list of ObjectClasses. This can also occur if you do not specify a structural objectClass when creating an entry, or if you specify more than one structural objectClass. Maybe I had to post in a new message, sorry if I'm wrong. Regards, François -----Message d'origine----- De : openldap-technical-bounces+francois.mehault=netplus.fr(a)OpenLDAP.org [mailto:openldap-technical-bounces+francois.mehault=netplus.fr@OpenLDAP.org] De la part de Howard Chu Envoyé : vendredi 22 mai 2009 15:49 À : John Kane Cc : openldap-technical(a)openldap.org Objet : Re: Host based authentication using OpenLDAP Howard Chu wrote: > Howard Chu wrote: >> John Kane wrote: >>> Sorry to jump in the middle of this thread, but the nssov overlay sounds >> very useful, something I would like to take advantage of, but I cannot seem to >> find any documentation on it. How long has this been available (what release), >> and where might I find more info? >> >> It has not been released yet. > > Just to clarify: the nssov overlay was first released in OpenLDAP 2.4.11, but > it only had NSS support. The PAM support is currently only in CVS. > >> You can check out the current code from CVS in >> contrib/slapd-modules/nssov. You can browse it online here: >> >> http://www.openldap.org/devel/cvsweb.cgi/contrib/slapd-modules/nssov/ >> >> The README and slapo-nssov.5 manpage will give you a better idea of what it does. > And fyi, here's an example... For a given host: dn: cn=hostX,ou=hosts,dc=example,dc=com objectClass: ipHost objectClass: authorizedServiceObject cn: hostX ipHostNumber: 192.168.1.127 authorizedService: sshd authorizedService: ftp you use the authorizedService attribute to list the PAM services that are available. Then you set ACLs to control who can access each service, like so: access to dn.subtree=ou=hosts,dc=example,dc=com attrs=authorizedService val.exact=sshd by group.exact="cn=admins,ou=groups,dc=example,dc=com" write by peername.ip=192.168.2.0%255.255.255.0 read by * search The overlay performs a Compare operation to check for the required service, so if you deny Compare access to a particular service, then users aren't allowed to use that service.

OK. My line of thinking was to create dynamic service and host groups and create simple group ACLs for that. These groups would go in the nss config on specific hosts using something like puppet to manage the 60-80 hosts. I've not looked at nssov so couldn't comment, other than doing the start of man page for you Howard. Thanks.