<author title="Editor">

<author title="Author">

  <mail link="swift@gentoo.org">Sven Vermeulen</mail>

  <mail link="swift"/>

<version>5</version>

<version>6</version>

<date>2011-04-17</date>

<date>2011-08-13</date>

New password: my-password

New password: <i>my-password</i>

Re-enter new password: my-password

Re-enter new password: <i>my-password</i>

Now edit the LDAP Server config at <path>/etc/openldap/slapd.conf</path>:

Now edit the LDAP Server config at <path>/etc/openldap/slapd.conf</path>. Below

we'll give a sample configuration file to get things started. For a more

detailed analysis of the configuration file, we suggest that you work through

the OpenLDAP Administrator's Guide.

<comment># Include the needed data schemes below core.schema</comment>

include	/etc/openldap/schema/core.schema

include         /etc/openldap/schema/cosine.schema

include /etc/openldap/schema/cosine.schema

include         /etc/openldap/schema/inetorgperson.schema

include /etc/openldap/schema/inetorgperson.schema

include         /etc/openldap/schema/nis.schema

include /etc/openldap/schema/nis.schema

include	/etc/openldap/schema/misc.schema

<comment>Uncomment modulepath and hdb module</comment>

# Load dynamic backend modules:

pidfile /var/run/openldap/slapd.pid

modulepath    /usr/lib/openldap/openldap

argsfile /var/run/openldap/slapd.args

# moduleload    back_shell.so

# moduleload    back_relay.so

serverID 0 <comment>Used in case of replication</comment>

# moduleload    back_perl.so

loglevel 0

# moduleload    back_passwd.so

# moduleload    back_null.so

# moduleload    back_monitor.so

# moduleload    back_meta.so

moduleload    back_hdb.so

# moduleload    back_dnssrv.so

<comment># Uncomment sample access restrictions (Note: maintain indentation!)</comment>

<comment>## Access Controls</comment>

   by self write

  by self write

   by users read

  by users read

   by anonymous auth

  by anonymous read

<comment># BDB Database definition</comment>

index entryCSN eq

index entryUUID eq

database        hdb

mirrormode TRUE

suffix          "dc=genfic,dc=com"

checkpoint      32      30 # <kbyte> <min>

overlay syncprov

rootdn          "cn=Manager,dc=genfic,dc=com"

syncprov-checkpoint 100 10

rootpw          <i>{SSHA}EzP6I82DZRnW+ou6lyiXHGxSpSOw2XO4</i>

directory       /var/lib/openldap-ldbm

index           objectClass     eq

URI          ldap://auth.genfic.com:389/

URI          ldap://ldap.genfic.com:389/ ldap://ldap1.genfic.com:389/ ldap://ldap2.genfic.com:389/

Now edit <path>/etc/conf.d/slapd</path> and uncomment the following OPTS line:

Now edit <path>/etc/conf.d/slapd</path> and set the following OPTS line:

<comment># Note: we don't use cn=config here, so stay with this line:</comment>

OPTS="-h 'ldaps:// ldap:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock'"

OPTS="-F /etc/openldap/slapd.d -h 'ldaps:// ldap:// ldapi://%2fvar%2frun%2fopenldap%2fslapd.sock'"

</pre>

<p>

Finally, create the <path>/var/lib/openldap-ldbm</path> structure:

</p>

<pre caption="Preparing the openldap-ldbm location">

~# <i>mkdir -p /var/lib/openldap-ldbm</i>

~# <i>chown ldap:ldap /var/lib/openldap-ldbm</i>

~# <i>chmod 700 /var/lib/openldap-ldbm</i>

and fetch the scripts there. Configuration is stated on the page. We don't ship

and fetch the scripts there. You'll need the migration tools and the

this anymore because the scripts are a potential security hole if you leave

<c>make_master.sh</c> script.

them on the system after porting. When you've finished migrating your data,

</p>

continue to the next section.

<p>

Next, extract the tools and copy the <c>make_master.sh</c> script inside the

extracted location:

</p>

<pre caption="Extracting the MigrationTools">

~# <i>mktemp -d</i>

/tmp/tmp.zchomocO3Q

~# <i>cd /tmp/tmp.zchomocO3Q</i>

~# <i>tar xvzf /path/to/MigrationTools.tgz</i>

~# <i>mv /path/to/make_master.sh MigrationTools-47</i>

~# <i>cd MigrationTools-47</i>

</pre>

<p>

The next step now is to migrate the information of your system to OpenLDAP. The

<c>make_master.sh</c> script will do this for you, after you have provided it

with the information regarding your LDAP structure and environment.

</p>

<p>

At the time of writing, the tools require the following input:

</p>

<table>

<tr>

  <th>Input</th>

  <th>Description</th>

  <th>Example</th>

</tr>

<tr>

  <ti>LDAP BaseDN</ti>

  <ti>The base location (root) of your tree</ti>

  <ti>dc=genfic,dc=com</ti>

</tr>

<tr>

  <ti>Mail domain</ti>

  <ti>Domain used in e-mail addresses</ti>

  <ti>genfic.com</ti>

</tr>

<tr>

  <ti>Mail host</ti>

  <ti>FQDN of your mail server infrastructure</ti>

  <ti>smtp.genfic.com</ti>

</tr>

<tr>

  <ti>LDAP Root DN</ti>

  <ti>Administrative account information for your LDAP structure</ti>

  <ti>cn=Manager,dc=genfic,dc=com</ti>

</tr>

<tr>

  <ti>LDAP Root Password</ti>

  <ti>

    Password for the administrative account, cfr earlier <c>slappasswd</c>

    command

  </ti>

  <ti></ti>

</tr>

</table>

<p>

The tool will also ask you which accounts and settings you want to migrate.

auth       sufficient   pam_unix.so try_first_pass likeauth nullok

auth       <i>sufficient</i>   pam_unix.so try_first_pass likeauth nullok

password   sufficient   pam_unix.so try_first_pass use_authtok nullok md5 shadow

password   <i>sufficient</i>   pam_unix.so try_first_pass use_authtok nullok md5 shadow

bind_policy soft

uri ldap://auth.genfic.com/

bind_timelimit 2

pam_password exop

nss_base_passwd ou=People,dc=genfic,dc=com

pam_password exop

nss_base_shadow ou=People,dc=genfic,dc=com

nss_base_group  ou=Group,dc=genfic,dc=com

nss_base_hosts  ou=Hosts,dc=genfic,dc=com

<brite>DANGEROUS</brite> and should be chmoded to 600. What I do is keep that

<brite>DANGEROUS</brite> and should be chmoded to 600. What you might want to

file blank and when I need to change someones password thats both in the ldap

do is keep that file blank and when you need to change someones password thats

and <path>/etc/passwd</path> I put the pass in there for 10 seconds while I

both in the ldap and <path>/etc/passwd</path>, put the pass in there for 10

change it and remove it when I'm done.

seconds while changing the users password and remove it when done.