doc:appunti:linux:sa:sldap_2_5
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionLast revisionBoth sides next revision | ||
doc:appunti:linux:sa:sldap_2_5 [2023/12/02 11:09] – [Adding a second (new) database] niccolo | doc:appunti:linux:sa:sldap_2_5 [2023/12/02 12:29] – [Enable SSL] niccolo | ||
---|---|---|---|
Line 15: | Line 15: | ||
FIXME La **[[https:// | FIXME La **[[https:// | ||
- | ===== Restore from the backup file ===== | + | Per ripristinare il servizio si sono eseguite ex-nove tutte le operazoni necessarie, in particolare: |
- | The upgrade process created a backup of the existing LDAP database into the **/ | + | |
+ | | ||
+ | * Creata la organizationalUnit **Addressbook**. | ||
+ | * Creata la inetOrgPerson **cn=guest**. | ||
+ | * Caricate tutte le entry objectClass **mozillaAbPersonAlpha**. | ||
- | Beware that the restore will be not a perfect copy of the previous database. Several items must be purged | + | ===== (Re)installation |
- | | + | By installing the **slapd** package from scratch, an empty LDAP database is created using the **dn** (// |
- | | + | |
- | | + | |
- | | + | |
- | | + | |
- | | + | |
- | | + | |
- | Once a snippet of the file is ready, you can feed it to the slapd service | + | The LDAP database |
< | < | ||
- | ldapadd | + | slapcat |
</ | </ | ||
- | ==== Create | + | If you run **dpkg-reconfigure slapd** it is possibile to generate |
- | < | + | Actually a special database numbered **#0** named **cn=config** is created too. Here you can view the configuration options of the database #1, the (hashed) password of the admin user, etc. You can view that special database using: |
- | dn: ou=Addressbook,dc=rigacci,dc=org | + | |
- | objectClass: | + | |
- | objectClass: | + | |
- | ou: Addressbook | + | |
- | </ | + | |
- | ==== Create the Addressbook guest person ==== | + | < |
+ | slapcat -n0 | ||
+ | </ | ||
- | < | + | Reading the dump of database #0, you can see that the **cn=config** database has the **olcRootDN: cn=admin,cn=config**, but it does not have an **olcRootPW**, so you cannot modify the config database connecting with a login/ |
- | dn: cn=guest,ou=Addressbook,dc=rigacci,dc=org | + | |
- | objectclass: | + | |
- | objectclass: | + | |
- | objectclass: | + | |
- | objectclass: | + | |
- | sn: guest | + | |
- | cn: guest | + | |
- | userPassword: | + | |
- | </ | + | |
+ | ===== Enable SSL ===== | ||
- | ==== Load all the mozillaAbPersonAlpha entries ==== | + | Create a self signed certificate or get it from some provider, like **[[https:// |
- | Each mozillaAbPersonAlpha item is somethink like this, after removing | + | Create |
< | < | ||
- | dn: cn=Niccolo Rigacci, | + | dn: cn=config |
- | objectClass: top | + | changetype: modify |
- | objectClass: person | + | replace: olcTLSCertificateFile |
- | objectClass: organizationalPerson | + | olcTLSCertificateFile: / |
- | objectClass: | + | - |
- | objectClass: mozillaAbPersonAlpha | + | replace: olcTLSCertificateKeyFile |
- | cn: Niccolo Rigacci | + | olcTLSCertificateKeyFile: / |
- | givenName: Niccolo | + | - |
- | sn: Rigacci | + | replace: olcTLSCACertificatePath |
- | mail: niccolo@rigacci.org | + | olcTLSCACertificatePath: /etc/ssl/cert |
- | telephoneNumber: | + | |
- | mobile: 327-5556667 | + | |
- | facsimileTelephoneNumber: | + | |
- | homePhone: 055-8979395 | + | |
- | mozillaWorkUrl: | + | |
</ | </ | ||
- | ===== (Re)installation from scratch ===== | + | and load it into the slapd 2.5 configuration: |
- | + | ||
- | By installing | + | |
- | + | ||
- | The LDAP database is numbered as **#1**; initially it contains only the root objext **objectClass: organization**. You can view it with the command | + | |
< | < | ||
- | slapcat | + | ldapmodify |
</ | </ | ||
- | |||
- | If you run **dpkg-reconfigure slapd** it is possibile to generate the LDAP database again; you can change the distinguished name, assign a different organization name and the admin password. | ||
- | |||
- | Actually a special database numbered **#0** named **cn=config** is created too. Here you can view the configuration options of the database #1, the (hashed) password of the admin user, etc. You can view that special database using: | ||
- | |||
- | < | ||
- | slapcat -n0 | ||
- | </ | ||
- | |||
- | Reading the dump of database #0, you can see that the **cn=config** database has the **olcRootDN: | ||
===== Adding a second (new) database ===== | ===== Adding a second (new) database ===== | ||
Line 108: | Line 76: | ||
Using '' | Using '' | ||
- | Here it is the example of an LDIF file to create a new DIT database, supposed to contain an addressbook. We will use the MDB backend and the ''/ | + | Here it is the example of an LDIF file to create a new DIT database, supposed to contain an addressbook. We will use the MDB backend and the ''/ |
The file was named **abook-db.ldif**: | The file was named **abook-db.ldif**: | ||
Line 130: | Line 98: | ||
</ | </ | ||
- | Notice we will grant read-only privileges to an item **cn=guest** in the same LDAP tree. Before creating the database we create the destination directory and assign the required permissions: | + | Notice we will grant read-only privileges to an item **cn=guest** in the same LDAP tree; that item will be added into the database later. Before creating the database we create the destination directory and assign the required permissions: |
< | < | ||
Line 216: | Line 184: | ||
</ | </ | ||
+ | ===== Restore from the backup file ===== | ||
+ | |||
+ | The upgrade process created a backup of the existing LDAP database into the **/ | ||
+ | |||
+ | Beware that the restore will be not a perfect copy of the previous database. Several tags must be purged from the backup file before feeding it back to the LDAP server because they are not allowed to be set directly. They are: | ||
+ | |||
+ | * structuralObjectClass | ||
+ | * entryUUID | ||
+ | * creatorsName | ||
+ | * createTimestamp | ||
+ | * entryCSN | ||
+ | * modifiersName | ||
+ | * modifyTimestamp | ||
+ | |||
+ | Once a snippet of the file is ready, you can feed it to the slapd service with the following command: | ||
+ | |||
+ | < | ||
+ | ldapadd -x -W -D " | ||
+ | </ | ||
+ | |||
+ | In the following three paragraphs we will see what is needed for a full restore. | ||
+ | |||
+ | |||
+ | ==== Create the Addressbook organizationalUnit ==== | ||
+ | |||
+ | < | ||
+ | dn: ou=Addressbook, | ||
+ | objectClass: | ||
+ | objectClass: | ||
+ | ou: Addressbook | ||
+ | </ | ||
+ | |||
+ | ==== Create the Addressbook guest person ==== | ||
+ | |||
+ | < | ||
+ | dn: cn=guest, | ||
+ | objectclass: | ||
+ | objectclass: | ||
+ | objectclass: | ||
+ | objectclass: | ||
+ | sn: guest | ||
+ | cn: guest | ||
+ | userPassword: | ||
+ | </ | ||
+ | |||
+ | ==== Load all the mozillaAbPersonAlpha entries ==== | ||
+ | |||
+ | Each mozillaAbPersonAlpha item is somethink like this, after removing the unallowed tags: | ||
+ | |||
+ | < | ||
+ | dn: cn=Niccolo Rigacci, | ||
+ | objectClass: | ||
+ | objectClass: | ||
+ | objectClass: | ||
+ | objectClass: | ||
+ | objectClass: | ||
+ | cn: Niccolo Rigacci | ||
+ | givenName: Niccolo | ||
+ | sn: Rigacci | ||
+ | mail: niccolo@rigacci.org | ||
+ | telephoneNumber: | ||
+ | mobile: 327-5556667 | ||
+ | facsimileTelephoneNumber: | ||
+ | homePhone: 055-8979395 | ||
+ | mozillaWorkUrl: | ||
+ | </ | ||
+ | |||
+ | ==== Testing an ldapsearch ==== | ||
+ | |||
+ | Finally you can test if the LDAP database is working doing a full search with **ldapsearch**: | ||
+ | |||
+ | <code bash> | ||
+ | ldapsearch -W \ | ||
+ | -H ldap:// | ||
+ | -D " | ||
+ | -b ' | ||
+ | </ | ||
+ | |||
+ | The **ldap** protocol is on port **389/ | ||
===== Web References ===== | ===== Web References ===== | ||
doc/appunti/linux/sa/sldap_2_5.txt · Last modified: 2023/12/02 12:31 by niccolo