dotlinux guide

Configuring LDAP on Linux: A System Administrator's Guide

In today’s enterprise environments, managing user accounts, groups, and access permissions across multiple systems can be a daunting task. Centralized directory services simplify this by providing a single source of truth for identity and access management. Lightweight Directory Access Protocol (LDAP) is a widely adopted standard for such directory services, enabling administrators to centrally manage users, groups, and resources across Linux, Windows, and network devices. This guide is designed for system administrators seeking to implement and configure LDAP on Linux. We will cover fundamental concepts, step-by-step installation and configuration procedures, common practices, and best practices to ensure a secure and efficient LDAP deployment. By the end, you will be able to set up an LDAP server, populate it with user/group data, configure Linux clients to authenticate against it, and maintain the directory service effectively.

Table of Contents

  1. Understanding LDAP Basics
  2. Prerequisites
  3. Installing OpenLDAP Server
  4. Configuring OpenLDAP Server
  5. Populating the LDAP Directory
  6. Configuring Linux Clients for LDAP Authentication
  7. Testing the LDAP Setup
  8. Common Practices
  9. Best Practices
  10. Troubleshooting
  11. Conclusion
  12. References

Understanding LDAP Basics

Before diving into configuration, let’s clarify key LDAP concepts:

Key Terminology

  • Directory Information Tree (DIT): The hierarchical structure of entries in an LDAP directory, similar to a filesystem. It starts with a root node (e.g., dc=example,dc=com).
  • Entry: A record in the DIT, identified by a unique Distinguished Name (DN) (e.g., uid=john,ou=users,dc=example,dc=com).
  • Attributes: Key-value pairs describing an entry (e.g., cn=John Doe, uid=john, [email protected]).
  • Object Classes: Define the type of an entry and the attributes it must/can contain (e.g., inetOrgPerson for user accounts, posixGroup for Unix groups).
  • LDIF (LDAP Data Interchange Format): A plaintext format for importing/exporting LDAP data (used for configuration and population).

Common LDAP Use Cases

  • Centralized user authentication (e.g., SSH, sudo, desktop logins).
  • Group-based access control (e.g., restricting file access to specific groups).
  • Integration with enterprise tools (e.g., Samba, Jenkins, or Kubernetes).

Prerequisites

To follow this guide, ensure you have:

  • A Linux server (Ubuntu 22.04/Debian 12 or RHEL 9/CentOS Stream 9) with:
    • Static IP address (e.g., 192.168.1.100).
    • Root or sudo access.
    • Hostname configured (e.g., ldap.example.com).
  • A client machine (same distro family) to test LDAP authentication.
  • Firewall rules allowing LDAP (TCP/389) and LDAPS (TCP/636) traffic.
  • Basic familiarity with Linux command-line and networking.

Installing OpenLDAP Server

OpenLDAP (slapd) is the most popular LDAP server implementation for Linux. We’ll install and initialize it below.

Ubuntu/Debian

# Update packages and install OpenLDAP
sudo apt update && sudo apt install -y slapd ldap-utils

# Reconfigure slapd to set base DN and admin password (run if not prompted during install)
sudo dpkg-reconfigure slapd

During dpkg-reconfigure, set:

  • DNS domain: example.com (used to form the base DN: dc=example,dc=com).
  • Organization name: Example Corp.
  • Administrator password: A strong password (store this securely!).

RHEL/CentOS

# Install OpenLDAP and utilities
sudo dnf install -y openldap-servers openldap-clients

# Start and enable slapd (OpenLDAP service)
sudo systemctl enable --now slapd

# Verify slapd is running
sudo systemctl status slapd

Initialize the OpenLDAP configuration database (RHEL-only):

# Copy the default DB configuration template
sudo cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

# Set ownership
sudo chown -R ldap:ldap /var/lib/ldap/

# Add default schemas (core, cosine, inetorgperson, nis)
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/core.ldif
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif

Configuring OpenLDAP Server

OpenLDAP uses a dynamic configuration system stored in the DIT under cn=config. We’ll modify this to set up the directory structure, admin credentials, and schemas.

Step 1: Set Base DN and Admin Credentials

Create an LDIF file (e.g., configure_base.ldif) to define the root of your DIT and admin user:

dn: cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=example,dc=com

dn: cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=admin,dc=example,dc=com

dn: cn=config
changetype: modify
replace: olcRootPW
olcRootPW: {SSHA}hashed_password  # Replace with output from `slappasswd`

Generate a hashed password using slappasswd:

slappasswd -s "your_strong_password"  # Outputs {SSHA}abc123...

Apply the configuration:

sudo ldapmodify -Y EXTERNAL -H ldapi:/// -f configure_base.ldif

Step 2: Verify Schema Loads

Ensure critical schemas (e.g., inetorgperson) are enabled:

ldapsearch -Y EXTERNAL -H ldapi:/// -b "cn=schema,cn=config" "(objectClass=olcSchemaConfig)"

If missing, add schemas using ldapadd (e.g., for inetorgperson on Ubuntu):

sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif

Populating the LDAP Directory

Now, we’ll add structure (organizational units, users, groups) to the DIT using LDIF files.

Step 1: Create Base Structure (OUs)

Create base_structure.ldif:

dn: dc=example,dc=com
objectClass: top
objectClass: domain
dc: example

dn: ou=users,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: users

dn: ou=groups,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: groups

Import it:

ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f base_structure.ldif
  • -x: Simple authentication.
  • -D: Bind DN (admin user).
  • -W: Prompt for the admin password.

Step 2: Add a Test User

Create user_john.ldif for a user john:

dn: uid=john,ou=users,dc=example,dc=com
objectClass: top
objectClass: person
objectClass: inetOrgPerson
objectClass: posixAccount
cn: John Doe
sn: Doe
uid: john
uidNumber: 10001
gidNumber: 10001  # Primary group ID (create group first if needed)
homeDirectory: /home/john
loginShell: /bin/bash
mail: [email protected]
userPassword: {SSHA}hashed_password  # Use `slappasswd` to generate

Step 3: Add a Group

Create group_devs.ldif for a devs group:

dn: cn=devs,ou=groups,dc=example,dc=com
objectClass: top
objectClass: posixGroup
cn: devs
gidNumber: 10001
memberUid: john  # Add john as a member

Import user and group:

ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f user_john.ldif
ldapadd -x -D "cn=admin,dc=example,dc=com" -W -f group_devs.ldif

Configuring Linux Clients for LDAP Authentication

Clients will use LDAP to fetch user/group data and authenticate. We’ll use nss-pam-ldapd (NSS/LDAP integration) and PAM (Pluggable Authentication Modules).

Ubuntu/Debian Client

# Install client packages
sudo apt install -y libnss-ldapd libpam-ldapd nslcd

# Configure LDAP settings
sudo dpkg-reconfigure nslcd

During configuration:

  • LDAP server URI: ldap://ldap.example.com/ (use ldaps:// for TLS).
  • LDAP base DN: dc=example,dc=com.
  • LDAP root DN: cn=admin,dc=example,dc=com (or leave empty for anonymous bind, not recommended).

Update NSSwitch to use LDAP for users/groups:

sudo tee /etc/nsswitch.conf <<EOF
passwd:         files systemd ldap
group:          files systemd ldap
shadow:         files ldap
EOF

RHEL/CentOS Client

# Install client packages
sudo dnf install -y nss-pam-ldapd openldap-clients

# Configure authselect (RHEL 8+)
sudo authselect select sssd with-ldap --force
sudo authselect enable-feature with-mkhomedir  # Auto-create home dirs

# Edit /etc/sssd/sssd.conf
sudo tee /etc/sssd/sssd.conf <<EOF
[sssd]
services = nss, pam
config_file_version = 2
domains = default

[domain/default]
id_provider = ldap
auth_provider = ldap
ldap_uri = ldap://ldap.example.com/
ldap_search_base = dc=example,dc=com
ldap_id_use_start_tls = False  # Set to True if using TLS
ldap_default_bind_dn = cn=admin,dc=example,dc=com
ldap_default_authtok = your_admin_password  # Securely store this!
cache_credentials = True
EOF

# Set permissions and restart SSSD
sudo chmod 600 /etc/sssd/sssd.conf
sudo systemctl enable --now sssd
sudo systemctl restart sssd

Testing the LDAP Setup

Verify Server Data with ldapsearch

# Search for all users
ldapsearch -x -D "cn=admin,dc=example,dc=com" -W -b "ou=users,dc=example,dc=com" "objectClass=inetOrgPerson"

# Search for the devs group
ldapsearch -x -D "cn=admin,dc=example,dc=com" -W -b "ou=groups,dc=example,dc=com" "cn=devs"

Verify Client Authentication

# Check if LDAP user is visible
getent passwd john  # Should return john's entry

# Test login (use SSH or switch user)
su - john  # Enter john's password when prompted

Common Practices

1. DIT Structure

  • Organize entries into OUs (e.g., ou=users, ou=groups, ou=servers).
  • Use consistent naming: uid=username for users, cn=groupname for groups.

2. Secure Passwords

Never store plaintext passwords. Use slappasswd to generate SSHA/BCRYPT hashes.

3. Enable LDAPS (TLS Encryption)

  • Generate TLS Certificates: Use Let’s Encrypt or a private CA.
  • Configure Server: Add TLS settings to cn=config via LDIF: 
    dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/ldap/certs/ca.crt

add: olcTLSCertificateFile
olcTLSCertificateFile: /etc/ldap/certs/server.crt

add: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/ldap/certs/server.key
  • Update Clients: Use ldaps://ldap.example.com:636 in URI.

Best Practices

1. Regular Backups

Export the DIT with slapcat:

sudo slapcat -l /backup/ldap_backup_$(date +%F).ldif

Restore with slapadd (stop slapd first).

2. Access Control Lists (ACLs)

Restrict access to sensitive data (e.g., shadow attributes) with ACLs:

dn: olcDatabase={1}mdb,cn=config
changetype: modify
add: olcAccess
olcAccess: to attrs=userPassword,shadowLastChange
  by dn="cn=admin,dc=example,dc=com" write
  by self write
  by * none

3. Monitoring and Logging

  • Monitor slapd logs (Ubuntu: /var/log/syslog, RHEL: /var/log/ldap.log).
  • Use tools like Prometheus + Grafana for metrics (via slapd-exporter).

4. Avoid Anonymous Binds

Disable anonymous access in cn=config:

dn: cn=config
changetype: modify
replace: olcDisallows
olcDisallows: bind_anon

Troubleshooting

  • Connection Refused: Check slapd status (systemctl status slapd) and firewall rules (sudo ufw allow 389/tcp).
  • Authentication Failures: Verify user uidNumber/gidNumber match group IDs, and password hashes are correct.
  • TLS Errors: Ensure certificates are valid and file paths in slapd config are correct. Use ldapsearch -Z to test STARTTLS.

Conclusion

LDAP is a powerful tool for centralized identity management, reducing administrative overhead and improving security. This guide covered the fundamentals: installing OpenLDAP, configuring the server, populating the directory, setting up clients, and best practices like encryption and backups.

To深化 your LDAP skills, explore advanced topics like replication (multi-master setups), integration with Samba for Windows clients, or storing SSH public keys in LDAP. With proper planning and maintenance, LDAP will become a cornerstone of your enterprise infrastructure.

References