H31A5

          I lie to myself all the time. But I never believe me.
          S.E. Hinton, The Outsiders 

Ubuntu OpeLDAP
--------------

[1]. Server: https://www.digitalocean.com/community/tutorials
/how-to-install-and-configure-a-basic-ldap-server-on-an-ubuntu-12-04-vps

[2]. Client: https://www.digitalocean.com/community/tutorials
/how-to-authenticate-client-computers-using-ldap-on-an-ubuntu-12-04-vps

[3]. PAM: The Linux-PAM System Administrators' Guide
http://www.linux-pam.org/Linux-PAM-html/Linux-PAM_SAG.html

NOTES

  Take ISO from
  
    http://archive.ubuntu.com/ubuntu/dists/zesty/main
    /installer-amd64/current/images/netboot/mini.iso
    
Host: OpenLDAP.

    Software to install: none but OpenSSH server.

10 min: Putty login

  root@OpenLDAP:~# dpkg -l | wc -l
  301

10 min: Backing up: OpenLDAP-H31a.exe

  3/01/2017  11:19     237,782,837  OpenLDAP-H31a.exe
  3/01/2017  11:19              53  OpenLDAP-H31a.exe.md5sum
  3/01/2017  11:15   1,378,200,064  OpenLDAP.vhd

Installing LDAP server [1]
..........................

  # apt-get install slapd ldap-utils
  
sldap password: ldap

  # dpkg-reconfigure slapd
  domain a307.tpt.org ( test.com in [1])
  organization school ( example in [1])
  database backend to use? HDB

  # apt-get install phpldapadmin
  # vi /etc/phpldapadmin/config.php
  286 $servers->setValue('server','name','10.0.2.100');
  300 $servers->setValue('server','base',array('dc=a307,dc=tpt,dc=org'));
  326 $servers->setValue('login','bind_id','cn=admin,dc=a307,dc=tpt,dc=org');

Edit /etc/network/interfaces as follows, we'll use nat network next:

  # This file describes the network interfaces available on your system
  # and how to activate them. For more information, see interfaces(5).

  source /etc/network/interfaces.d/*

  # The loopback network interface
  auto lo
  iface lo inet loopback

  # The primary network interface
  # auto enp0s3
  # iface enp0s3 inet dhcp

  auto enp0s3
  iface enp0s3 inet static
  address 10.0.2.100
  netmask 255.255.255.0
  gateway 10.0.2.2
  dns-nameservers 8.8.8.8
  
Edit /etc/sudoers as follows:

  # Members of the admin group may gain root privileges
  %admin  ALL=(ALL) NOPASSWD:ALL
  # Allow members of group sudo to execute any command
  %sudo   ALL=(ALL) NOPASSWD:ALL

  # shutdown now

Switch to NAT Network if not already there..

On client (Zesty64, NatNetwork, DHCP)

  virtu@Zesty:~$ sudo cat /etc/hosts
  10.0.2.100      a307.tpt.org
  127.0.0.1       localhost
  ..

Now 

  firefox http://a307.tpt.org/phpldapadmin/
  
to Add Users to a groups

  ou=groups
    cn=admin <- Click
    
      cn
        admin
        (add value)
        (rename)
      gidNumber
        500
      memberUid
        opilane
        (add value)
        (modify group members)  <-- You can then add more 
                                    members by clicking.. [1]
  
  Add new attribute: description
                     memberUid  <--  In the main pane, select 
                     Password        "Add new attribute": [1]
                     
On client machine
-----------------

  # apt-get update
  # apt-get install libpam-ldap nscd

During install

  LDAP server Uniform Resource Identifier: ldap://10.0.2.100
  Distinguished name of the search base: 'dc=a307,dc=tpt,dc=org'
  ..3 ..yes ..no
  LDAP account for root: 'cn=admin,dc=a307,dc=tpt,dc=org'
  LDAP root account password: ldap
  
Edit /etc/nsswitch.conf
  ..
  passwd:         ldap compat
  group:          ldap compat
  shadow:         ldap compat
  ..
  
  append to /etc/pam.d/common-session line
  session required    pam_mkhomedir.so skel=/etc/skel umask=0022

follow [2], do not forget 

  sudo /etc/init.d/nscd restart
  
before logout. Now login as opilane. Check 

  $ pwd
  
"You should see that the home directory you selected for your user on the LDAP server is being used on this machine. It has been created on-demand to serve the LDAP user."[2]

  /home/users/opilane

----------------------------------------

Scripting
---------

  https://github.com/rilindo/OpenLDAP-User-Automation-Scripts
  http://www.linuxquestions.org/questions/programming-9
       /script-to-create-new-user-in-ldap-928335/

Cook from parts:

I. Password in variable:

  $ read -p "???: "
  ??? blahblah
  $ echo $REPLY
  blahblah
  
II. stty

  # stty - change and print terminal line settings
  stty -echo # do not show input
  stty echo  # revert
  stty sane  # full reset
  stty -g    # --save
  
Examples

  $ stty -g
  2502:5:bf:8a3b:3:1c:7f:15:4:0:1:0:11:13:1a:0:12:f:17:16:
  0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0
  $ stty -a
  speed 38400 baud; rows 23; columns 71; line = 0;
  intr = ^C; quit = ^\; erase = ^?; kill = ^U; eof = ^D; eol = <undef>;
  eol2 = <undef>; swtch = <undef>; start = ^Q; stop = ^S; susp = ^Z;
  rprnt = ^R; werase = ^W; lnext = ^V; discard = ^O; min = 1; time = 0;
  -parenb -parodd -cmspar cs8 -hupcl -cstopb cread -clocal -crtscts
  -ignbrk brkint -ignpar -parmrk -inpck -istrip -inlcr -igncr icrnl ixon
  -ixoff -iuclc -ixany imaxbel -iutf8
  opost -olcuc -ocrnl onlcr -onocr -onlret -ofill -ofdel nl0 cr0 tab0
  bs0 vt0 ff0
  isig icanon iexten echo echoe echok -echonl -noflsh -xcase -tostop
  -echoprt echoctl echoke -flusho -extproc

III. Generate a ID between 1000 and 65535.

  echo $[ 1000 + $[ RANDOM % 65535 ]]

or suppress blanks

  echo $[1000+$[RANDOM%65535]]
  
IV. What is slappasswd?

  # find / -name slappasswd
  /usr/sbin/slappasswd
  
  # apt-get update
  # apt-get install man-db man-pages
  man slappasswd
  -h "scheme" {CRYPT} uses the crypt(3)
  -s The secret to hash.
  
So, the text is:

  stty_orig=`stty -g`
  echo -n "Enter Password: "
  stty -echo
  read USERPASS
  stty $stty_orig

  SLAPPASSWORD="/usr/sbin/slappasswd"
  PASSWORD=`$SLAPPASSWORD -h "{crypt}" -s $USERPASS`
  
V. BASH HereDOC

  # cat << HereComesTheSun
  > 12345
  > zayats
  > HereComesTheSun
  12345
  zayats
  
VI. BASH complete the list of commands:

  $ (
    cat <<add-user 
    Text to create. Variables evaluated:
    output the value of the variable.
    add-user
    ) > $TMP/adduser.ldif

Example:

  # (
  > x=123
  > echo $x
  > )
  123

VII. What is ldapadd?

LDAP add entry tool

  -x          Use simple authentication instead of SASL.
  -w passwd   Use passwd as the password for simple authentication.
  -D binddn   Use the Distinguished Name binddn to bind 
              to the LDAP directory.
  -f file     Read the entry modification information from file 
              instead of from standard input.

  LDAPADDCMD="/usr/bin/ldapadd"
  $LDAPADDCMD -x -w $LDAPPASS -D "cn=root,dc=$DOMAIN,dc=$ORG" -f $TMP/adduser.ldif

