J3KHA

                    Your journey is over, Niska.
                    But I am no longer Odi.
                    Then who are you?
                    My name is Vi.

                    Humans s3e8, 2018, 00:02

OPENLDAP LAB
============

Notes on 2019.03.20: 

1. This LAB doesn't work perfectly year later, so it was Revised and fixed.

2. To prevent access restriction with 'ldap_bind: Invalid credentials (49)' do not import initial database while dpkg-reconfigure slapd:

  Do you want the database to be removed when slapd is purged?: Yes
  Move old database: No
  
3. To prevent 'Result: No such object (32)' error while ldappasswd or 
# ldapdelete you have to understand the command syntax: 

  ldapdelete 
  -W <= prompt for bind password
  -D <= binddn  bind DN
  "cn=admin,dc=ufo,dc=mars,dc=nat"   <= WHO HAVE CREDENTIALS?
  "uid=madslave,cn=Survivors,ou=People,dc=ufo,dc=mars,dc=nat" <= EXACT RECORD TO DELETE / MODIFY

4. base.ldif and ldapuser.ldif files needed only to populate ldap database with ldapadd, so location of these files have no importance.

On VirtualBox use either NatNetwork (gentle way, not always work) or Bridged network (..he is the One :) (Matrix, 1999)).

  Server machine: Debian 9 no GUI (zeroStretch on this site)
  Client machine: Debian 9 LXDE (miniPi on this site)

Issues
------

  https://github.com/QubesOS/qubes-issues/issues/2621

Another option is to disable unattended-upgrades using apt.conf.d.

See:

  https://github.com/Whonix/pkg-manager-no-autoupdate/blob/master
    /etc/apt/apt.conf.d/90nounattended

Disabling:

  vi /etc/apt/apt.conf.d/50unattended-upgrades

Added to the end of file:

  // That changes take effect can be verified using:
  // apt-config dump

  APT::Periodic::Update-Package-Lists "0";
  APT::Periodic::Download-Upgradeable-Packages "0";
  APT::Periodic::AutocleanInterval "0";
  APT::Periodic::Unattended-Upgrade "0";
  APT::Periodic::Enable "0";

openLDAP Server (based on
-------------------------

  https://www.itzgeek.com/how-tos/linux/debian
    /install-and-configure-openldap-on-ubuntu-16-04-debian-8.html
)

1. Make an entry for each machine in /etc/hosts for name resolution.

  $ cat /etc/hosts

    10.0.2.15 ufo.mars.nat

2. Install LDAP:

  $ sudo apt-get update
  $ sudo apt-get -y install slapd ldap-utils

Reconfigure the LDAP:

  $ sudo dpkg-reconfigure slapd

  DNS: ufo.mars.nat
  Organization: ufo
  Administrator password: virtu
  Database backend to use: HDB
  Do you want the database to be removed when slapd is purged?: Yes
  Move old database: No

If everything is OK:

  Backing up /etc/ldap/slapd.d in
    /var/backups/slapd-2.4.44+dfsg-5+deb9u2... done.
  Moving old database directory to /var/backups:
  There are leftover files in /var/lib/ldap. This will probably break
  creating the initial directory. If that's the case please move away
  stuff in there and retry the configuration.
  Creating initial configuration... done.
  Creating LDAP directory... done.

Append this*:

  $ cat /etc/ldap/ldap.conf | tail -n 2
  nss_default_attribute_value  shadowLastChange 20000

------
*) Same on ubuntu 16.04. Workaround - I added the line to /etc/ldap.conf.
   https://superuser.com/questions/1124857
    /shadowlastchange-attribute-doesnt-work
------

Verify the LDAP (netstat is in net-tools package)

  $ sudo netstat -antup | grep -i 389
  tcp    0   0 0.0.0.0:389    0.0.0.0:*   LISTEN    1453/slapd
  tcp6   0   0 :::389         :::*        LISTEN    1453/slapd

Generate base.ldif file for your domain.

  $ cat base.ldif

dn: ou=People,dc=ufo,dc=mars,dc=nat
objectClass: organizationalUnit
ou: People

dn: cn=Survivors,ou=People,dc=ufo,dc=mars,dc=nat
gidNumber: 501
cn: Survivors
objectClass: posixGroup
objectClass: top

ldapsearch -x cn=madslave -b dc=ufo,dc=mars,dc=nat

Build the directory structure.

  $ ldapadd -x -W -D "cn=admin,dc=ufo,dc=mars,dc=nat" -f base.ldif

Create user:

  $ cat ldapuser.ldif

dn: uid=madslave,cn=Survivors,ou=People,dc=ufo,dc=mars,dc=nat
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: madslave
uid: madslave
uidNumber: 9999
gidNumber: 501
homeDirectory: /home/madslave
loginShell: /bin/bash
gecos: madslave
userPassword: {crypt}x
shadowLastChange: 20000
shadowMin: 0
shadowMax: 99999
shadowWarning: 7

What is what:

  gecos: user name in GUI login dropdown list
  gidNumber: 100 belong to 'users' group, check /etc/group
  uidNumber: 9999 possibly available number, check /etc/passwd

Now:

  $ ldapadd -x -W -D "cn=admin,dc=ufo,dc=mars,dc=nat" -f ldapuser.ldif

Assign a password to the user:

  # ldappasswd -s madslave -W -D "cn=admin,dc=ufo,dc=mars,dc=nat" -x "uid=madslave,cn=Survivors,ou=People,dc=ufo,dc=mars,dc=nat"

It is also possible to remove user record with (don't do that):

  # ldapdelete -W -D "cn=admin,dc=ufo,dc=mars,dc=nat" "uid=madslave,cn=Survivors,ou=People,dc=ufo,dc=mars,dc=nat"
  
Verify LDAP entries.

  $ ldapsearch -x cn=madslave -b dc=ufo,dc=mars,dc=nat

output

  # extended LDIF
  #
  # LDAPv3
  # base <dc=ufo,dc=mars,dc=nat> with scope subtree
  # filter: cn=madslave
  # requesting: ALL

  # madslave, People, ufo.mars.nat
  dn: uid=madslave,ou=People,dc=ufo,dc=mars,dc=nat
  objectClass: top
  objectClass: account
  objectClass: posixAccount
  objectClass: shadowAccount
  cn: madslave
  uid: madslave
  uidNumber: 9999
  gidNumber: 501
  homeDirectory: /home/madslave
  loginShell: /bin/bash
  gecos: madslave
* shadowLastChange: 20000
  shadowMin: 0
  shadowMax: 99999
  shadowWarning: 7

  # search result
  search: 2
  result: 0 Success

------
*) 20000 days from 1970/01/01
  #include <stdio.h>
  #include <time.h>
  int main(void) {
      time_t now; struct tm  ts; char buf[80];
      now=20000*24*3600; ts = *localtime(&now); // time(&now);
      strftime(buf, sizeof(buf), "%a %Y-%m-%d %H:%M:%S %Z", &ts);
      printf("Unix time: %lld epoch: %s\n", now, buf);
      return 0;
  }
  Unix time: 1728000000 epoch: Fri 2024-10-04 03:00:00 FLE Daylight Time
------

To delete an entry from LDAP (Optional).

  $ ldapdelete -W -D "cn=admin,dc=ufo,dc=mars,dc=nat" "uid=madslave,ou=People,dc=ufo,dc=mars,dc=nat"

Enable LDAP logging:

Send a LDAP events to a log file /var/log/ldap.log.

  $ cat /etc/rsyslog.d/50-default.conf
  local4.* /var/log/ldap.log
  $ sudo service rsyslog restart

Configure LDAP clients
----------------------

Once after you create a user in the LDAP directory, you can now proceed to configure clients to allow users of LDAP directory to login.

READ: Configure LDAP Client on Ubuntu 16.04 / Debian 8

  https://www.itzgeek.com/how-tos/linux
    /ubuntu-how-tos/configure-ldap-client-on-ubuntu-16-04-debian-8.html

Install LDAP client

  sudo apt-get -y install libnss-ldap libpam-ldap ldap-utils nscd

  LDAP server URI: ldap://10.0.2.4
  Distinguished name of the search base: dc=ufo,dc=mars,dc=nat
  LDAP version to use: 3
  LDAP account for root: cn=admin,dc=ufo,dc=mars,dc=nat
  LDAP root account password: virtu

Allow LDAP admin account to behave like local root?: No

Does the LDAP database require login?: No

Configure /etc/nsswitch.conf

  $ cat /etc/nsswitch.conf
  ...
  passwd:         compat ldap
  group:          compat ldap
  shadow:         compat ldap
  ...

  $ sudo service nscd restart

Autocreate home directory:

  $ cat /etc/pam.d/common-session | tail -n 2
  session required        pam_mkhomedir.so skel=/etc/skel umask=077
  # end of pam-auth-update config
  $ sudo service nscd restart

Allow login via gui on client*:

  $ cat /etc/pam.d/common-auth | grep "^auth\s\+required"
  auth    required    pam_permit.so
  auth    required    pam_access.so

  $ cat /etc/security/access.conf | tail -n 2
  -:ALL EXCEPT root (admin):ALL EXCEPT LOCAL

--------
*) Read this: ..Too late answer but might help others as i got through this..
      https://stackoverflow.com/questions/14983807
        /ldap-login-works-via-terminal-but-doesnt-work-via-gui
--------

Install phpLDAPAdmin:

  https://www.itzgeek.com/how-tos/linux/centos-how-tos
    /install-configure-phpldapadmin-centos-7-ubuntu-16-04.html

On Debian 9:

  https://unix.stackexchange.com/questions/321271
  /apt-get-doesnt-find-phpldapadmin-in-debian-9-stretch

Please follow article shown above, below are only quick notes for Debian 9 Stretch:

The safest solution is to download it manually*,

  https://packages.debian.org/sid/all/phpldapadmin/download

and install it with dpkg -i, followed by apt-get -f install to install the missing dependencies (or install it using gdebi which will take care of all that for you).

  apt-get install php7.0-xml

with /etc/phpldapadmin/config.php

  change all cn=admin,dc=example,dc=com to cn=admin,dc=ufo,dc=mars,dc=nat

  # service apache2 restart

Another article on phpldapadmin

  https://www.linuxsecrets.com
  /1550-complete-guide-installing-openldap-and-phpldapadmin

Note: copy file over secure connection

  scp filetocopy user@ip:/path

or download with firefox and copy download link to wget, download on server.

  wget -c http://downloaded/from

Note: download link is active for a short time.

Example:

  scp phpldapadmin_1.2.2-6.1_all.deb virtu@10.0.2.4:/home/virtu

Create new user in phpldapadmin:

  firefox http://10.0.2.4/phpldapadmin/
  login DN: cn=admin,dc=ufo,dc=mars,dc=nat
  password: virtu

  [+] dc=ufo,dc=mars,dc=nat
   |   ..
   Create new entry here: Generic organisational unit (IT)

   ou=IT --> Create a child entry: Generic Posix Group.
             Group: Students --> Commit

   cn=Students --> Create a child entry: Generic User Account

   common name:    "someone"
   first name:
   GID number:     Students
   home directory: /home/someone
   last name:      someone
   login shell:    /bin/sh
   password:       *****
   ---||---        *****
   uid number:     1001
   user_ID:        someone ( login with user_ID/password)

Result for someone

    gecos:  someone
    whoami: someone

See also

  http://www.openldap.org/software//man.cgi?
  query=LDIF&sektion=5&apropos=0&manpath=OpenLDAP+2.4-Release

for the details.

------------------------------------------------------------------------

ANNEX A. OPENLDAP SERVER SESSION ON 2019.03.20 / TPT-B316

login as: virtu
virtu@127.0.0.1's password:
Linux DEBI 4.9.0-8-amd64 #1 SMP Debian 4.9.144-3.1 (2019-02-19) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Mar 20 16:32:37 2019
virtu@DEBI:~$ service
-bash: service: command not found
virtu@DEBI:~$ su
Password:
root@DEBI:/home/virtu# apt update
Ign:1 http://ftp.ee.debian.org/debian stretch InRelease
Get:2 http://security.debian.org/debian-security stretch/updates InRelease [94.3 kB]
Get:3 http://ftp.ee.debian.org/debian stretch-updates InRelease [91.0 kB]
Hit:4 http://ftp.ee.debian.org/debian stretch Release
Get:5 https://deb.nodesource.com/node_10.x stretch InRelease [4,585 B]
Get:7 http://security.debian.org/debian-security stretch/updates/main Sources [196 kB]
Get:8 https://deb.nodesource.com/node_10.x stretch/main amd64 Packages [767 B]
Get:9 http://security.debian.org/debian-security stretch/updates/main amd64 Packages [478 kB]
Get:10 http://security.debian.org/debian-security stretch/updates/main Translation-en [212 kB]
Fetched 1,077 kB in 1s (827 kB/s)
Reading package lists... Done
Building dependency tree
Reading state information... Done
5 packages can be upgraded. Run 'apt list --upgradable' to see them.
root@DEBI:/home/virtu# apt upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
  libssl1.0.2 nodejs openssh-client openssh-server openssh-sftp-server
5 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 17.5 MB of archives.
After this operation, 84.0 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 http://security.debian.org/debian-security stretch/updates/main amd64 libssl1.0.2 amd64 1.0.2r-1~deb9u1 [1,302 kB]
Get:2 https://deb.nodesource.com/node_10.x stretch/main amd64 nodejs amd64 10.15.3-1nodesource1 [15.0 MB]
Get:3 http://security.debian.org/debian-security stretch/updates/main amd64 openssh-sftp-server amd64 1:7.4p1-10+deb9u6 [39.7 kB]
Get:4 http://security.debian.org/debian-security stretch/updates/main amd64 openssh-server amd64 1:7.4p1-10+deb9u6 [332 kB]
Get:5 http://security.debian.org/debian-security stretch/updates/main amd64 openssh-client amd64 1:7.4p1-10+deb9u6 [781 kB]
Fetched 17.5 MB in 14s (1,216 kB/s)
Preconfiguring packages ...
(Reading database ... 25557 files and directories currently installed.)
Preparing to unpack .../libssl1.0.2_1.0.2r-1~deb9u1_amd64.deb ...
Unpacking libssl1.0.2:amd64 (1.0.2r-1~deb9u1) over (1.0.2q-1~deb9u1) ...
Preparing to unpack .../openssh-sftp-server_1%3a7.4p1-10+deb9u6_amd64.deb ...
Unpacking openssh-sftp-server (1:7.4p1-10+deb9u6) over (1:7.4p1-10+deb9u5) ...
Preparing to unpack .../openssh-server_1%3a7.4p1-10+deb9u6_amd64.deb ...
Unpacking openssh-server (1:7.4p1-10+deb9u6) over (1:7.4p1-10+deb9u5) ...
Preparing to unpack .../openssh-client_1%3a7.4p1-10+deb9u6_amd64.deb ...
Unpacking openssh-client (1:7.4p1-10+deb9u6) over (1:7.4p1-10+deb9u5) ...
Preparing to unpack .../nodejs_10.15.3-1nodesource1_amd64.deb ...
Detected old npm client, removing...
Unpacking nodejs (10.15.3-1nodesource1) over (10.15.1-1nodesource1) ...
Setting up nodejs (10.15.3-1nodesource1) ...
Setting up libssl1.0.2:amd64 (1.0.2r-1~deb9u1) ...
Processing triggers for libc-bin (2.24-11+deb9u4) ...
Processing triggers for systemd (232-25+deb9u9) ...
Setting up openssh-client (1:7.4p1-10+deb9u6) ...
Setting up openssh-sftp-server (1:7.4p1-10+deb9u6) ...
Setting up openssh-server (1:7.4p1-10+deb9u6) ...
root@DEBI:/home/virtu# apt install sudo
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  sudo
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 1,055 kB of archives.
After this operation, 3,108 kB of additional disk space will be used.
Get:1 http://ftp.ee.debian.org/debian stretch/main amd64 sudo amd64 1.8.19p1-2.1 [1,055 kB]
Fetched 1,055 kB in 1s (978 kB/s)
Selecting previously unselected package sudo.
(Reading database ... 25557 files and directories currently installed.)
Preparing to unpack .../sudo_1.8.19p1-2.1_amd64.deb ...
Unpacking sudo (1.8.19p1-2.1) ...
Setting up sudo (1.8.19p1-2.1) ...
Processing triggers for systemd (232-25+deb9u9) ...
root@DEBI:/home/virtu# nano /etc/sudoers
root@DEBI:/home/virtu# service
Usage: service < option > | --status-all | [ service_name [ command | --full-restart ] ]
root@DEBI:/home/virtu# service --status-all
 [ - ]  console-setup.sh
 [ + ]  cron
 [ + ]  dbus
 [ + ]  dnsmasq
 [ - ]  hwclock.sh
 [ - ]  keyboard-setup.sh
 [ + ]  kmod
 [ + ]  networking
 [ + ]  procps
 [ + ]  rsyslog
 [ + ]  ssh
 [ - ]  sudo
 [ + ]  udev
root@DEBI:/home/virtu# systemctl stop dnsmasq
root@DEBI:/home/virtu# systemctl disable dnsmasq
Synchronizing state of dnsmasq.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install disable dnsmasq
root@DEBI:/home/virtu# nano /etc/hosts
root@DEBI:/home/virtu# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 08:00:27:9b:25:6b brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.15/24 brd 10.0.2.255 scope global enp0s3
       valid_lft forever preferred_lft forever
    inet6 fe80::a00:27ff:fe9b:256b/64 scope link
       valid_lft forever preferred_lft forever
root@DEBI:/home/virtu# apt-get -y install slapd ldap-utils
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following additional packages will be installed:
  libltdl7 libodbc1 libperl5.24 perl perl-modules-5.24 psmisc rename
Suggested packages:
  libsasl2-modules-gssapi-mit | libsasl2-modules-gssapi-heimdal libmyodbc
  odbc-postgresql tdsodbc unixodbc-bin perl-doc libterm-readline-gnu-perl
  | libterm-readline-perl-perl make
The following NEW packages will be installed:
  ldap-utils libltdl7 libodbc1 libperl5.24 perl perl-modules-5.24 psmisc
  rename slapd
0 upgraded, 9 newly installed, 0 to remove and 0 not upgraded.
Need to get 8,802 kB of archives.
After this operation, 58.3 MB of additional disk space will be used.
Get:1 http://ftp.ee.debian.org/debian stretch/main amd64 perl-modules-5.24 all 5.24.1-3+deb9u5 [2,722 kB]
Get:2 http://ftp.ee.debian.org/debian stretch/main amd64 libperl5.24 amd64 5.24.1-3+deb9u5 [3,501 kB]
Get:3 http://ftp.ee.debian.org/debian stretch/main amd64 perl amd64 5.24.1-3+deb9u5 [219 kB]
Get:4 http://ftp.ee.debian.org/debian stretch/main amd64 libltdl7 amd64 2.4.6-2 [389 kB]
Get:5 http://ftp.ee.debian.org/debian stretch/main amd64 libodbc1 amd64 2.3.4-1 [214 kB]
Get:6 http://ftp.ee.debian.org/debian stretch/main amd64 psmisc amd64 22.21-2.1+b2 [123 kB]
Get:7 http://ftp.ee.debian.org/debian stretch/main amd64 slapd amd64 2.4.44+dfsg-5+deb9u2 [1,430 kB]
Get:8 http://ftp.ee.debian.org/debian stretch/main amd64 ldap-utils amd64 2.4.44+dfsg-5+deb9u2 [192 kB]
Get:9 http://ftp.ee.debian.org/debian stretch/main amd64 rename all 0.20-4 [12.5 kB]
Fetched 8,802 kB in 7s (1,114 kB/s)
Preconfiguring packages ...
Selecting previously unselected package perl-modules-5.24.
(Reading database ... 25668 files and directories currently installed.)
Preparing to unpack .../0-perl-modules-5.24_5.24.1-3+deb9u5_all.deb ...
Unpacking perl-modules-5.24 (5.24.1-3+deb9u5) ...
Selecting previously unselected package libperl5.24:amd64.
Preparing to unpack .../1-libperl5.24_5.24.1-3+deb9u5_amd64.deb ...
Unpacking libperl5.24:amd64 (5.24.1-3+deb9u5) ...
Selecting previously unselected package perl.
Preparing to unpack .../2-perl_5.24.1-3+deb9u5_amd64.deb ...
Unpacking perl (5.24.1-3+deb9u5) ...
Selecting previously unselected package libltdl7:amd64.
Preparing to unpack .../3-libltdl7_2.4.6-2_amd64.deb ...
Unpacking libltdl7:amd64 (2.4.6-2) ...
Selecting previously unselected package libodbc1:amd64.
Preparing to unpack .../4-libodbc1_2.3.4-1_amd64.deb ...
Unpacking libodbc1:amd64 (2.3.4-1) ...
Selecting previously unselected package psmisc.
Preparing to unpack .../5-psmisc_22.21-2.1+b2_amd64.deb ...
Unpacking psmisc (22.21-2.1+b2) ...
Selecting previously unselected package slapd.
Preparing to unpack .../6-slapd_2.4.44+dfsg-5+deb9u2_amd64.deb ...
Unpacking slapd (2.4.44+dfsg-5+deb9u2) ...
Selecting previously unselected package ldap-utils.
Preparing to unpack .../7-ldap-utils_2.4.44+dfsg-5+deb9u2_amd64.deb ...
Unpacking ldap-utils (2.4.44+dfsg-5+deb9u2) ...
Selecting previously unselected package rename.
Preparing to unpack .../8-rename_0.20-4_all.deb ...
Unpacking rename (0.20-4) ...
Setting up perl-modules-5.24 (5.24.1-3+deb9u5) ...
Setting up libperl5.24:amd64 (5.24.1-3+deb9u5) ...
Setting up psmisc (22.21-2.1+b2) ...
Setting up perl (5.24.1-3+deb9u5) ...
update-alternatives: using /usr/bin/prename to provide /usr/bin/rename (rename) in auto mode
Setting up ldap-utils (2.4.44+dfsg-5+deb9u2) ...
Processing triggers for libc-bin (2.24-11+deb9u4) ...
Processing triggers for systemd (232-25+deb9u9) ...
Setting up libltdl7:amd64 (2.4.6-2) ...
Setting up libodbc1:amd64 (2.3.4-1) ...
Setting up rename (0.20-4) ...
update-alternatives: using /usr/bin/file-rename to provide /usr/bin/rename (rename) in auto mode
Setting up slapd (2.4.44+dfsg-5+deb9u2) ...
  Creating new user openldap... done.
  Creating initial configuration... done.
  Creating LDAP directory... done.
Processing triggers for libc-bin (2.24-11+deb9u4) ...
Processing triggers for systemd (232-25+deb9u9) ...
root@DEBI:/home/virtu# dpkg-reconfigure slapd
  Backing up /etc/ldap/slapd.d in /var/backups/slapd-2.4.44+dfsg-5+deb9u2... done.
  Moving old database directory to /var/backups:
  There are leftover files in /var/lib/ldap. This will probably break
  creating the initial directory. If that's the case please move away
  stuff in there and retry the configuration.
  Creating initial configuration... done.
  Creating LDAP directory... done.
root@DEBI:/home/virtu# cd /etc/ldap
root@DEBI:/etc/ldap# nano /etc/ldap/ldap.conf
root@DEBI:/etc/ldap# netstat -antup | grep -i 389
bash: netstat: command not found
root@DEBI:/etc/ldap# apt install net-tools
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  net-tools
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 248 kB of archives.
After this operation, 963 kB of additional disk space will be used.
Get:1 http://ftp.ee.debian.org/debian stretch/main amd64 net-tools amd64 1.60+git20161116.90da8a0-1 [248 kB]
Fetched 248 kB in 0s (713 kB/s)
Selecting previously unselected package net-tools.
(Reading database ... 27859 files and directories currently installed.)
Preparing to unpack .../net-tools_1.60+git20161116.90da8a0-1_amd64.deb ...
Unpacking net-tools (1.60+git20161116.90da8a0-1) ...
Setting up net-tools (1.60+git20161116.90da8a0-1) ...
root@DEBI:/etc/ldap# netstat -antup | grep -i 389
bash: netstat: command not found
root@DEBI:/etc/ldap# apt install net-tools
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  net-tools
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 248 kB of archives.
After this operation, 963 kB of additional disk space will be used.
Get:1 http://ftp.ee.debian.org/debian stretch/main amd64 net-tools amd64 1.60+git20161116.90da8a0-1 [248 kB]
Fetched 248 kB in 0s (713 kB/s)
Selecting previously unselected package net-tools.
(Reading database ... 27859 files and directories currently installed.)
Preparing to unpack .../net-tools_1.60+git20161116.90da8a0-1_amd64.deb ...
Unpacking net-tools (1.60+git20161116.90da8a0-1) ...
Setting up net-tools (1.60+git20161116.90da8a0-1) ...
root@DEBI:/etc/ldap# netstat -antup | grep -i 389
tcp        0      0 0.0.0.0:389             0.0.0.0:*               LISTEN      1743/slapd
tcp6       0      0 :::389                  :::*                    LISTEN      1743/slapd
root@DEBI:/etc/ldap# nano base.ldif
root@DEBI:/etc/ldap# ldapsearch -x cn=madslave -b dc=ufo,dc=mars,dc=nat
# extended LDIF
#
# LDAPv3
# base <dc=ufo,dc=mars,dc=nat> with scope subtree
# filter: cn=madslave
# requesting: ALL
#

# search result
search: 2
result: 0 Success

# numResponses: 1
root@DEBI:/etc/ldap# ldapadd -x -W -D "cn=admin,dc=ufo,dc=mars,dc=nat" -f base.ldif
Enter LDAP Password:
adding new entry "ou=People,dc=ufo,dc=mars,dc=nat"

adding new entry "cn=Survivors,ou=People,dc=ufo,dc=mars,dc=nat"

root@DEBI:/etc/ldap# nano ldapuser.ldif
root@DEBI:/etc/ldap# ldapadd -x -W -D "cn=admin,dc=ufo,dc=mars,dc=nat" -f ldapuser.ldif
Enter LDAP Password:
adding new entry "uid=madslave,cn=Survivors,ou=People,dc=ufo,dc=mars,dc=nat"

root@DEBI:/etc/ldap# ldapsearch -x cn=madslave -b dc=ufo,dc=mars,dc=nat
# extended LDIF
#
# LDAPv3
# base <dc=ufo,dc=mars,dc=nat> with scope subtree
# filter: cn=madslave
# requesting: ALL
#

# madslave, Survivors, People, ufo.mars.nat
dn: uid=madslave,cn=Survivors,ou=People,dc=ufo,dc=mars,dc=nat
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: madslave
uid: madslave
uidNumber: 9999
gidNumber: 501
homeDirectory: /home/madslave
loginShell: /bin/bash
gecos: madslave
shadowLastChange: 20000
shadowMin: 0
shadowMax: 99999
shadowWarning: 7

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1
root@DEBI:/etc/ldap# ldappasswd -s madslave -W -D "cn=admin,dc=ufo,dc=mars,dc=nat" -x "uid=madslave,cn=Survivors,ou=People,dc=ufo,dc=mars,dc=nat"
Enter LDAP Password:
root@DEBI:/etc/ldap# ldapsearch -x cn=madslave -b dc=ufo,dc=mars,dc=nat
# extended LDIF
#
# LDAPv3
# base <dc=ufo,dc=mars,dc=nat> with scope subtree
# filter: cn=madslave
# requesting: ALL
#

# madslave, Survivors, People, ufo.mars.nat
dn: uid=madslave,cn=Survivors,ou=People,dc=ufo,dc=mars,dc=nat
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: madslave
uid: madslave
uidNumber: 9999
gidNumber: 501
homeDirectory: /home/madslave
loginShell: /bin/bash
gecos: madslave
shadowLastChange: 20000
shadowMin: 0
shadowMax: 99999
shadowWarning: 7

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1
root@DEBI:/etc/ldap# ldapsearch -x cn=madslave -b dc=ufo,dc=mars,dc=nat
# extended LDIF
#
# LDAPv3
# base <dc=ufo,dc=mars,dc=nat> with scope subtree
# filter: cn=madslave
# requesting: ALL
#

# madslave, Survivors, People, ufo.mars.nat
dn: uid=madslave,cn=Survivors,ou=People,dc=ufo,dc=mars,dc=nat
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: madslave
uid: madslave
uidNumber: 9999
gidNumber: 501
homeDirectory: /home/madslave
loginShell: /bin/bash
gecos: madslave
shadowLastChange: 20000
shadowMin: 0
shadowMax: 99999
shadowWarning: 7

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1
root@DEBI:/etc/ldap# nano /etc/rsyslog.d/50-default.conf
root@DEBI:/etc/ldap# sudo service rsyslog restart
root@DEBI:/etc/ldap#

----------------------------------------------------------

ANNEX B. Client HISTORY

  188  sudo apt-get -y install libnss-ldap libpam-ldap ldap-utils nscd
  189  sudo nano /etc/nsswitch.conf 
  190  nano /etc/pam.d/common-session
  191  sudo nano /etc/pam.d/common-session
  192  sudo service nscd restart
  193  sudo nano /etc/pam.d/common-auth 
  194  sudo nano /etc/security/access.conf 

