Step-by-step OpenLDAP Installation and Configuration

Step-by-step OpenLDAP Installation and Configuration
http://www.howtoforge.com/linux_openldap_setup_server_client
(also check: http://www.openldap.org/doc/admin24/quickstart.html
http://blog.domb.net/?p=74

This tutorial describes how to install and configure an OpenLDAP server and also an OpenLDAP client.

Step by Step Installation and Configuration OpenLDAP Server

Software:  OS-Cent OS 4.4, openldap 2.2.13-6.4E
System name:   ldap.adminmart.com
Domain name:   adminmart.com
System IP:     192.168.1.212

Note: Use your domain name and IP instead of adminmart.

Easy steps for adding users:
    1. Create unix user
    2. Create unix user's ldap passwd file
    3. Convert passwd.file to ldif file
    4. Add ldap file to LDAP Directory using ldapadd



Step #1. Requirements

    compat-openldap.i386 0:2.1.30-6.4E
    openldap-clients.i386 0:2.2.13-6.4E
    openldap-devel.i386 0:2.2.13-6.4E
    openldap-servers.i386 0:2.2.13-6.4E
    openldap-servers-sql.i386 0:2.2.13-6.4E

You can install them using the command:

yum install *openldap* -y


Step #2. Start the service

[root@ldap ~]# chkconfig --levels 235 ldap on
[root@ldap ~]# service ldap start

Step #3. Create LDAP root user password

[root@ldap ~]# slappasswd
    New password:
    Re-enter new password:
    {SSHA}cWB1VzxDXZLf6F4pwvyNvApBQ8G/DltW
[root@ldap ~]#



Step #4. Update /etc/openldap/slapd.conf for the root password

[root@ldap ~]# vi /etc/openldap/slapd.conf

    #68 database        bdb
    #69 suffix          "dc=adminmart,dc=com"
    #70 rootdn          "cn=Manager,dc=adminmart,dc=com"
    #71 rootpw          {SSHA}cWB1VzxDXZLf6F4pwvyNvApBQ8G/DltW

Step #5. Apply Changes

[root@ldap ~]# service ldap restart


Step #6. Create test users

[root@ldap ~]# useradd test1
[root@ldap ~]# passwd test1
    Changing password for user test1.
    New UNIX password:
    Retype new UNIX password:
    passwd: all authentication tokens updated successfully.
[root@ldap ~]# useradd test2
[root@ldap ~]# passwd test2
    Changing password for user test2.
    New UNIX password:
    Retype new UNIX password:
    passwd: all authentication tokens updated successfully.
[root@ldap ~]#


Note: Repeat the same for the rest of users

Step #7. Migrate local users to LDAP

[root@ldap ~]# grep root /etc/passwd > /etc/openldap/passwd.root
[root@ldap ~]# grep test1 /etc/passwd > /etc/openldap/passwd.test1
[root@ldap ~]# grep test2 /etc/passwd > /etc/openldap/passwd.test2

Note: Repeat the same for the rest of users
Step #8. Update default settings on file /usr/share/openldap/migration/migrate_common.ph

    #71 $DEFAULT_MAIL_DOMAIN = "adminmart.com";
    #74 $DEFAULT_BASE = "dc=adminmart,dc=com";

Step #9. Convert passwd.file to ldif (LDAP Data Interchange Format) file

[root@ldap ~]# /usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.root /etc/openldap/root.ldif
[root@ldap ~]# /usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.test1 /etc/openldap/test1.ldif
[root@ldap ~]# /usr/share/openldap/migration/migrate_passwd.pl /etc/openldap/passwd.test2 /etc/openldap/test2.ldif


Note: Repeat the same for the rest of users
Step #10. Update root.ldif file for the "Manager" of LDAP Server

[root@ldap ~]# vi /etc/openldap/root.ldif

    #1 dn: uid=root,ou=People,dc=adminmart,dc=com
    #2 uid: root
    #3 cn: Manager
    #4 objectClass: account


Step #11. Create a domain ldif file (/etc/openldap/adminmart.com.ldif)

[root@ldap ~]# cat /etc/openldap/adminmart.com.ldif

    dn: dc=adminmart,dc=com
    dc: adminmart
    description: LDAP Admin
    objectClass: dcObject
    objectClass: organizationalUnit
    ou: rootobject
    dn: ou=People, dc=adminmart,dc=com
    ou: People
    description: Users of adminmart
    objectClass: organizationalUnit


Step #12. Import all users in to the LDAP

Add the Domain ldif file

[root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f  /etc/openldap/adminmart.com.ldif
    Enter LDAP Password:
    adding new entry "dc=adminmart,dc=com"
    adding new entry "ou=People, dc=adminmart,dc=com"
[root@ldap ~]#

Add the users:

[root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f  /etc/openldap/root.ldif
    Enter LDAP Password:
    adding new entry "uid=root,ou=People,dc=adminmart,dc=com"
    adding new entry "uid=operator,ou=People,dc=adminmart,dc=com"
[root@ldap ~]#

[root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f  /etc/openldap/test1.ldif
    Enter LDAP Password:
    adding new entry "uid=test1,ou=People,dc=adminmart,dc=com"
[root@ldap ~]#

[root@ldap ~]# ldapadd -x -D "cn=Manager,dc=adminmart,dc=com" -W -f  /etc/openldap/test2.ldif
    Enter LDAP Password:
    adding new entry "uid=test2,ou=People,dc=adminmart,dc=com"
 [root@ldap ~]#


Note: Repeat the same for the rest of users
Step #13. Apply Changes

[root@ldap ~]# service ldap restart
Step #14. Test LDAP Server

It prints all the user information:

[root@ldap ~]# ldapsearch -x -b 'dc=adminmart,dc=com' '(objectclass=*)'



Step-by-step OpenLDAP Installation and Configuration of Client System


LDAP Client Configuration
Step #1. Installation

[root@ldapclient ~]#  yum install authconfig
Step #2. Run the command

[root@ldapclient ~]# authconfig
Step #3. Settings

         [*] Use LDAP     [*] Use LDAP Authentication

    [Both should be checked]


Click "Next".

        [ ] Use TLS  
        Server: ldap.adminmart.com
        Base DN: dc=adminmart,dc=com

        Click "Ok" to confirm.

Note: Use your domain name instead of adminmart.

How to transfer file on remove host using tar, rsync over SSH?

How to transfer file on remove host using tar, rsync over SSH?


a. Copying files from remote machine to your local machine

$ ssh user@remote_server "tar -czpf - /files/to_copy" | tar -xzpf - -C /files_to_extract
$ ssh filetran@goyouk "tar -czpf - /opt/datafile" | tar xzpf - -C /opt/importfile

b. Copying files from your machine to your remove machine.

$ tar -cXpf - /Files/To_transfer | ssh user@what_machine_to_transfer "tar -xpf - -C /where?to_transfer
$ tar -cXpf - /opt/datafile | ssh filetran@baypak "tar -xpf - -C /opt/exportfile

Without compression,
$tar -cf - /opt/datafile | ssh remote_host tar -xf - -C /destination

with compression,
$ tar -czf - /opt/datafile | ssh remote_host tar -xzf - -C /destination

if you have ssh key set up, you can use,
$ tar -czf - /opt/datafile | ssh remote_hostname tar -xzf - -C /some/destination

To copy locally within the server,

$ tar cf - /opt/datafile | (cd /export/data/tab; tar xf -)

--------------------------------------

Using rsync

rsync -e ssh [-avz] /some/file [ more ... ] host.name:/destination/file
rsync -e ssh /opt/dd_data remove_host:/opt/dd_data

-or-

rsync -ave ssh source_server:/path/to/source /destination/dir

SSH security hardening

The configuration file for ssh server security hardening is located at /etc/ssh/sshd_config
There are couple of entries you would like to pay little attention. Please go through each entries and try to understand what they do. Based on the requirement of your organization, you add/remove/modify the values.

1. Link a banner file.
Banner /etc/issue
Note: issue file contains the banner entry. it can be /etc/ssh-banner or something..

2. Set Maximum number of retries for authentication
MaxAuthTriesLog 3

3. Are logins to accounts with empty passwords allowed?
PermitEmptyPasswords no

4. Are root logins permitted using sshd ?
PermitRootLogin no

packet filtering and configure network address translation using iptable

Use iptables to implement packet filtering and configure network address translation (NAT)

Install and use "system-config-network-tui" to create the basic "/etc/sysconfig/iptables" file, then edit the file with vi.

Filtering:

man iptables

iptables -I INPUT -s 192.168.1.3 -p tcp --dport 22 -j ACCEPT

-I insert (Can include a rule number, for example "-I 4" which means "insert as 4th rule")
-A append
-D delete (include rule number)
-m Specify a module to use (ex: Use "-m multiport" to specify multiple ports)
-s source
-d destination
--dport destination port
--sport source port
-j jump to target (ACCEPT, DENY, DROP)


The last rule should be (to reject all others):

iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited


Block a host:
iptables -I INPUT -p tcp --dport 80 -s 10.168.20.225 -j REJECT

Block a subnet:
iptables -I INPUT -p tcp -s 10.168.20.0/24 -j REJECT

Accept reply packets:
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Accept anything on the loopback interface:
iptables -i lo -j ACCEPT

NAT:

Allow the gateway to forward IP packets by modifying /etc/sysctl.conf

Change
net.ipv4.ip_forward = 0
To
net.ipv4.ip_forward = 1

Then execute: sysctl -p

Examples:
iptables -t nat -I POSTROUTING -o eth1 -j MASQUERADE

iptables -I FORWARD -i eth1 -o eth1 -j ACCEPT -m comment --comment "accept everything on the way out"

iptables -I FORWARD -o eth1 -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT -m comment --comment "accept related or established on the way back"

DNAT:

Forward all incomming tcp traffic on port 8800 to 192.168.1.3 port 80:

iptables -t nat -I PREROUTING -p tcp --dport 8800 -j DNAT -to 192.168.1.3:80

From the web, sorry forgot the source ...

Create, lock, and unlock user account on Redhat

User account activities on Redhat

1. Lock the user password
# usermod -L username

2. Force password change upon initial login.
# chage -d 0 username

3. Unlock the account
There are two common approaches to this step.
The administrator can assign an initial password or assign a null password.

Note: passwd disables the immediate password expiration just configured.

a. Assign a null password instead of an initial password.
# usermod -p "" username

b. Using Python interpreter with the python command and usermod.
# python
at the prompt, type the following commands. Replace with the password to encrypt and with a random combination of at least 2 of the following: any alphanumeric character, the slash (/) character or a dot (.).

# import crypt; print crypt.crypt("","")

The output is the encrypted password, similar to '12CsGd8FRcMSM'.
Press Ctrl-D to exit the Python interpreter.

At the shell, enter the following command (replacing with the encrypted output of the Python interpreter):

# usermod -p ""

4. Adding a new user account
# useradd myuser
# passwd myuser

source:redhat

Delegation of task: shutdown the system by non-root user

Delegation of task: shutdown the system by non-root user.

When you have to give access to the folks from help desk to only shutdown the system, you can do so by following the procedure below.

1. Create a group/users for that particular group list. [ group=shutgroup, user=nocuser
# groupadd shutgroup
# adduser -G shutgroup nocuser

3. Allow the user and group to execute the shutdown permission by editing the sudoers file.
# vi /etc/sudoers #

adn add the following Line.
%shutgroup ALL=NOPASSWD:/sbin/shutdown

Now, any member of the group shutgroup will be able to shutdown the server.

To execute the command use as follows,
# sudo shutdown -h now

How to set up web site on Redhat

Deploy Web Service on Redhat (httpd service)

1. Install httpd package
# yum install httpd* -y

2. Edit the configuration file and look for the ServeName and DocumentRoot

# vi /etc/httpd/conf/httpd.conf

ServerName sama.bhusal.com
DocumentRoot /var/www/html

3. create index file on doc root directory.
# cd /var/www/html
# echo "Welcome to my First web page on this web server" > index.htm

4. start the httpd service
# service httpd start

5. make httpd service persistent
# chkconfig httpd on

6. check web service

go to sama.bhusal.com