i1U9A

OPENLDAP LAB
============

On VirtualBox use either NatNetwork (gentle way, not always work) or Bridged network (..he is the One :) (Matrix, 1999)).

  Server machine: Debian 9 no GUI (zeroStretch on this site)
  Client machine: Debian 9 LXDE (miniPi on this site)

Issues
------

  https://github.com/QubesOS/qubes-issues/issues/2621

Another option is to disable unattended-upgrades using apt.conf.d.

See:

  https://github.com/Whonix/pkg-manager-no-autoupdate/blob/master
    /etc/apt/apt.conf.d/90nounattended

Disabling:

  vi /etc/apt/apt.conf.d/50unattended-upgrades

Added to the end of file:

  // That changes take effect can be verified using:
  // apt-config dump

  APT::Periodic::Update-Package-Lists "0";
  APT::Periodic::Download-Upgradeable-Packages "0";
  APT::Periodic::AutocleanInterval "0";
  APT::Periodic::Unattended-Upgrade "0";
  APT::Periodic::Enable "0";

openLDAP Server (based on
-------------------------

  https://www.itzgeek.com/how-tos/linux/debian
    /install-and-configure-openldap-on-ubuntu-16-04-debian-8.html
)

1. Make an entry for each machine in /etc/hosts for name resolution.

  $ cat /etc/hosts

    10.0.2.4 ufo.mars.net

2. Install LDAP:

  $ sudo apt-get update
  $ sudo apt-get -y install slapd ldap-utils

Reconfigure the LDAP:

  $ sudo dpkg-reconfigure slapd

  DNS: ufo.mars.nat
  Organization: ufo
  Administrator password: virtu
  Database backend to use: HDB
  Do you want the database to be removed when slapd is purged?: No
  Move old database: Yes <- We already created it during apt install..

If 'No':

  There are leftover files in /var/lib/ldap. This will probably break
  creating the initial directory. If that's the case please move away
  stuff in there and retry the configuration.

If everything is OK:

  Backing up /etc/ldap/slapd.d in
    /var/backups/slapd-2.4.44+dfsg-5+deb9u1... done.
  Creating initial configuration... done.
  Creating LDAP directory... done.

Append this*:

  $ cat /etc/ldap/ldap.conf | tail -n 2
  nss_default_attribute_value  shadowLastChange 20000

------
*) Same on ubuntu 16.04. Workaround - I added the line to /etc/ldap.conf.
   https://superuser.com/questions/1124857
    /shadowlastchange-attribute-doesnt-work
------

Verify the LDAP (netstat is in net-tools package)

  $ sudo netstat -antup | grep -i 389
  tcp    0   0 0.0.0.0:389    0.0.0.0:*   LISTEN    1453/slapd
  tcp6   0   0 :::389         :::*        LISTEN    1453/slapd

Generate base.ldif file for your domain.

  $ cat base.ldif

dn: ou=People,dc=ufo,dc=mars,dc=nat
objectClass: organizationalUnit
ou: People

dn: cn=Survivors,ou=People,dc=ufo,dc=mars,dc=nat
gidNumber: 501
cn: Survivors
objectClass: posixGroup
objectClass: top

ldapsearch -x cn=madslave -b dc=ufo,dc=mars,dc=nat

Build the directory structure.

  $ ldapadd -x -W -D "cn=admin,dc=ufo,dc=mars,dc=nat" -f base.ldif

Create user:

  $ cat ldapuser.ldif

dn: uid=madslave,cn=Survivors,ou=People,dc=ufo,dc=mars,dc=nat
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: madslave
uid: madslave
uidNumber: 9999
gidNumber: 501
homeDirectory: /home/madslave
loginShell: /bin/bash
gecos: madslave
userPassword: {crypt}x
shadowLastChange: 20000
shadowMin: 0
shadowMax: 99999
shadowWarning: 7

What is what:

  gecos: user name in GUI login dropdown list
  gidNumber: 100 belong to 'users' group, check /etc/group
  uidNumber: 9999 possibly available number, check /etc/passwd

Now:

  $ ldapadd -x -W -D "cn=admin,dc=ufo,dc=mars,dc=nat" -f ldapuser.ldif

Assign a password to the user:

  $ ldappasswd -s madslave -W -D "cn=admin,dc=ufo,dc=mars,dc=nat" -x
"uid=madslave,cn=Survivors,ou=People,dc=ufo,dc=mars,dc=nat"

Verify LDAP entries.

  $ ldapsearch -x cn=madslave -b dc=ufo,dc=mars,dc=nat

output

  # extended LDIF
  #
  # LDAPv3
  # base <dc=ufo,dc=mars,dc=nat> with scope subtree
  # filter: cn=madslave
  # requesting: ALL

  # madslave, People, ufo.mars.nat
  dn: uid=madslave,ou=People,dc=ufo,dc=mars,dc=nat
  objectClass: top
  objectClass: account
  objectClass: posixAccount
  objectClass: shadowAccount
  cn: madslave
  uid: madslave
  uidNumber: 9999
  gidNumber: 501
  homeDirectory: /home/madslave
  loginShell: /bin/bash
  gecos: madslave
* shadowLastChange: 20000
  shadowMin: 0
  shadowMax: 99999
  shadowWarning: 7

  # search result
  search: 2
  result: 0 Success

------
*) 20000 days from 1970/01/01
  #include <stdio.h>
  #include <time.h>
  int main(void) {
      time_t now; struct tm  ts; char buf[80];
      now=20000*24*3600; ts = *localtime(&now); // time(&now);
      strftime(buf, sizeof(buf), "%a %Y-%m-%d %H:%M:%S %Z", &ts);
      printf("Unix time: %lld epoch: %s\n", now, buf);
      return 0;
  }
  Unix time: 1728000000 epoch: Fri 2024-10-04 03:00:00 FLE Daylight Time
------

To delete an entry from LDAP (Optional).

  $ ldapdelete -W -D "cn=admin,dc=ufo,dc=mars,dc=nat" "uid=madslave,ou=People,dc=ufo,dc=mars,dc=nat"

Enable LDAP logging:

Send a LDAP events to a log file /var/log/ldap.log.

  $ cat /etc/rsyslog.d/50-default.conf
  local4.* /var/log/ldap.log
  $ sudo service rsyslog restart

Configure LDAP clients
----------------------

Once after you create a user in the LDAP directory, you can now proceed to configure clients to allow users of LDAP directory to login.

READ: Configure LDAP Client on Ubuntu 16.04 / Debian 8

  https://www.itzgeek.com/how-tos/linux
    /ubuntu-how-tos/configure-ldap-client-on-ubuntu-16-04-debian-8.html

Install LDAP client

  sudo apt-get -y install libnss-ldap libpam-ldap ldap-utils nscd

  LDAP server URI: ldap://10.0.2.4
  Distinguished name of the search base: dc=ufo,dc=mars,dc=nat
  LDAP version to use: 3
  LDAP account for root: cn=admin,dc=ufo,dc=mars,dc=nat
  LDAP root account password: virtu

Allow LDAP admin account to behave like local root?: No

Does the LDAP database require login?: No

Configure /etc/nsswitch.conf

  $ cat /etc/nsswitch.conf
  ...
  passwd:         compat ldap
  group:          compat ldap
  shadow:         compat ldap
  ...

Autocreate home directory:

  $ cat /etc/pam.d/common-session | tail -n 2
  session required        pam_mkhomedir.so skel=/etc/skel umask=077
  # end of pam-auth-update config
  $ sudo service nscd restart

Allow login via gui on client*:

  $ cat /etc/pam.d/common-auth | grep "^auth\s\+required"
  auth    required    pam_permit.so
  auth    required    pam_access.so

  $ cat /etc/security/access.conf | tail -n 2
  -:ALL EXCEPT root (admin):ALL EXCEPT LOCAL

--------
*) Read this: ..Too late answer but might help others as i got through this..
      https://stackoverflow.com/questions/14983807
        /ldap-login-works-via-terminal-but-doesnt-work-via-gui
--------

Install phpLDAPAdmin:

  https://www.itzgeek.com/how-tos/linux/centos-how-tos
    /install-configure-phpldapadmin-centos-7-ubuntu-16-04.html

On Debian 9:

  https://unix.stackexchange.com/questions/321271
  /apt-get-doesnt-find-phpldapadmin-in-debian-9-stretch

Please follow article shown above, below are only quick notes for Debian 9 Stretch:

The safest solution is to download it manually*,

  https://packages.debian.org/sid/all/phpldapadmin/download

and install it with dpkg -i, followed by apt-get -f install to install the missing dependencies (or install it using gdebi which will take care of all that for you).

  apt-get install php7.0-xml

with /etc/phpldapadmin/config.php

  change all cn=admin,dc=example,dc=com to cn=admin,dc=ufo,dc=mars,dc=nat

  # service apache2 restart

Another article on phpldapadmin

  https://www.linuxsecrets.com
  /1550-complete-guide-installing-openldap-and-phpldapadmin

Note: copy file over secure connection

  scp filetocopy user@ip:/path

or download with firefox and copy download link to wget, download on server.

  wget -c http://downloaded/from

Note: download link is active for a short time.

Example:

  scp phpldapadmin_1.2.2-6.1_all.deb virtu@10.0.2.4:/home/virtu

Create new user in phpldapadmin:

  firefox http://10.0.2.4/phpldapadmin/
  login DN: cn=admin,dc=ufo,dc=mars,dc=nat
  password: virtu

  [+] dc=ufo,dc=mars,dc=nat
   |   ..
   Create new entry here: Generic organisational unit (IT)

   ou=IT --> Create a child entry: Generic Posix Group.
             Group: Students --> Commit

   cn=Students --> Create a child entry: Generic User Account

   common name:    "someone"
   first name:
   GID number:     Students
   home directory: /home/someone
   last name:      someone
   login shell:    /bin/sh
   password:       *****
   ---||---        *****
   uid number:     1001
   user_ID:        someone ( login with user_ID/password)

Result for someone

    gecos:  someone
    whoami: someone

See also

  http://www.openldap.org/software//man.cgi?
  query=LDIF&sektion=5&apropos=0&manpath=OpenLDAP+2.4-Release

for the details.
