OpenSiteSolutions

Apache

BSD LDAP configuration

1. Install Packages
2. BSD 5.x System Settings
3. System Authenticaton
4. BSD PAM modules
5. Automounting Home Directories.
6. Changing your password.

1. Install Packages
-----------------------------
packages to install
	a. openldap-client-x.xx Open source LDAP client implementation .
	b. nss_ldap-x.xxx      RFC 2307 NSS module
		cd /usr/ports/net/nss_ldap
	c. pam_ldap-x.x.x      A pam module for authenticating with LDAP
		cd /usr/ports/security/pam_ldap/
		make install clean ( if you build this port first, the following ports will also be installed
			- gettext-0.16.1_3    GNU gettext package
			- gmake-3.81_2        GNU version of 'make' utility
			- libiconv-1.11_1     A character set conversion library
			- libtool-1.5.24      Generic shared library support script
			- openldap-client-2.3.40 Open source LDAP client implementation 
			- pam_ldap-1.8.4      A pam module for authenticating with LDAP

2. BSD 5.x System Settings
--------------------------------------------------
BSD system uses /etc/ldap.conf
pam_ldap uses /usr/local/etc/ldap.conf
nss_ldap usees /usr/local/etc/nss_ldap.conf

+Create a symlink for /etc/ldap.conf pointing to /usr/local/etc/ldap.conf
ln -s /usr/local/etc/ldap.conf /etc/ldap.conf


6.x Systems Settings
----------------------------------
1. cd  /usr/locatl/etc 
	- create config file
		cp nss_ldap.conf.sample nss_ldap.conf
	- created ldap config file
		cp ldap.conf.dist

Configuration parametets (Minimal) /usr/local/etc/nss_ldap.con and /usr/local/etc/ldap.conf
1. host  
2. Distinguished name base 

Openldap cleint uses /usr/local/etc/openldap/ldap.conf as it's configuration file 
change the BASE and URI value to reflect your domain. commands that use this conf file are
ldapsearch  

3. System Authentication
--------------------------------------
edit /etc/nsswitch.conf to look the settings below. - (File can be downloaded from current directory)

passwd:	files ldap
group:	files ldap
shells: 	files ldap	

authenticate first from local system settings and then from LDAP directory

4. BSD PAM modules
---------------------------------
PAM modules are located in /etc/pam.d directory 
add the following line before each "auth required section" in the files mentioned below.
	------ 	auth	sufficient	/usr/local/lib/pam_ldap.so	no_warn try_first_pass	---------
Files
-sshd 
username password sent to Ldap directory.

-system file
allows users to su to another login name as well as becoming root(users must exist in the wheel group)

-login
allows your ldap account to login from the console

Adding the line above will enable LDAP authentication for that application

5. Automounting Directory
---------------------------------------
1. As root create		 /.amd_mnt
2. start mountd manually 	 mountd -r
3. Turn on rpcbind
4.. start amd manually enter the following command -  amd -a /.amd_mnt -l syslog /host /etc/amd.map /net/ /etc/amd.map
5. To have these feautures start up automatically enter the follwoing settings in /etc/rc.conf
	rpcbind_enable="YES"
	mountd_flags="-r"
	amd_enable="YES"