System Administration Guide: Naming and Directory Services (DNS, NIS, and LDAP)

Chapter 16 Client Setup (Task)

This chapter describes how to set up a Solaris LDAP naming service client.

This chapter covers the following topics.

Prerequisites

In order for a Solaris client to use LDAP as a naming service the following needs to be in place.

The ldapclient utility is the key to setting up an LDAP client, as it performs all of the above steps, except for starting the server. The rest of this chapter will show examples of how to use the ldapclient utility to setup a LDAP client and use the various other LDAP utilities to get information about, and check the status of an LDAP client.

Initializing a Client

ldapclient(1M) is an utility used to setup LDAP clients in a Solaris operating environment. ldapclient assumes the server has already been configured with the appropriate client profiles. You must install and configure the server with the appropriate profiles before you can set up any clients.

There are two ways to set up a client using ldapclient.


Note –

Though you can manually configure clients, it is not recommended. Using the configuration profiles decreases the complexity and cost of managing clients.


Using Profiles to Initialize a Client

How to Initialize a Client Using Profiles
  1. Become superuser.

  2. Run ldapclient with init.

    # ldapclient init -a profileName=new -a \

    domainName=west.example.com 192.168.0.0


    System successfully configured

Using Proxy Credentials

How to Initialize a Client using Proxy Credentials
  1. Become superuser.

  2. Run ldapclient (defining proxy values).

    # ldapclient init -a proxyDn=cn=proxyagent,ou=profile,dc=west,dc=example,dc=com -a domainname=west.example.com -a profilename=pit1 -a proxypassword=test1234 192.168.0.0


    System successfully configured

The -a proxyDn and -a proxypassword are required if the profile to be used is setup for proxy. As the credentials are not stored in the profile saved on the server, you need to supply the information when you initialize the client. This method is more secure than the older method of storing the proxy credentials on the server.

The proxy info will be used to create the /var/ldap/ldap_client_cred and the rest of the information will be put in /var/ldap/ldap_client_file.


Note –

DO NOT edit either the client configuration files directly. Use ldapclient to create or modify the content of these files.


Initializing a Client Manually

Superusers can perform manual client configurations. However, many of the checks are bypassed during the process, so it is relatively easy to mis-configure your system. In addition, you must change settings on every machine, instead of in one central place, as is done when using profiles.

How to initialize a client manually.
  1. Become superuser.

  2. Use ldapclient manual.

    # ldapclient manual —a domainName=dc=west.example.com \

    —a credentialLevel=proxy —a defaultSearchBase=dc=west, dc=example, dc=com \

    —a proxyDN=cn=proxyagent,ou=profile,dc=west,dc=example,dc=com \

    —a proxyPassword=testtest 192.168.0.0

  3. Use ldapclient list to verify.


    NS_LDAP_FILE_VERSION= 2.0
    NS_LDAP_BINDDN= cn=proxyagent,ou=profile,dc=west,dc=example,dc=com
    NS_LDAP_BINDPASSWD= {NS1}4a3788e8c053424f
    NS_LDAP_SERVERS= 192.168.0.0
    NS_LDAP_SEARCH_BASEDN= dc=west,dc=example,dc=com
    NS_LDAP_CREDENTIAL_LEVEL= proxy

Modifying a Manual Client Configuration

How to modify a manual configuration
  1. Become superuser

  2. Use the ldapclient mod to change the authentication method to simple.

    # ldapclient mod -a authenticationMethod=simple

  3. Use ldapclient list to verify the change was made.

    # ldapclient list


    NS_LDAP_FILE_VERSION= 2.0
    NS_LDAP_BINDDN= cn=proxyagent,ou=profile,dc=west,dc=example,dc=com
    NS_LDAP_BINDPASSWD= {NS1}4a3788e8c053424f
    NS_LDAP_SERVERS= 192.168.0.0
    NS_LDAP_SEARCH_BASEDN= dc=west,dc=example,dc=com
    NS_LDAP_AUTH= simple
    NS_LDAP_CREDENTIAL_LEVEL= proxy

Un-initializing a Client

How to un-initialize a client
  1. Become superuser.

  2. Use ldapclient uninit.

    # ldapclient uninit


    System successfully recovered

ldapclient uninit restores the client name service to what it was prior to the most recent init, modify, or manual operation. In other words, it performs an “undo” on the last step taken. For example, if the client was configured to use profile1 and was then changed to use profile2, using ldapclient uninit would revert the client back to using profile1.

TLS Security Setup


Caution – Caution –

The cert7.db and key3.db files must be readable by everyone. Be sure not to include any private keys in the key3.db file.


If using TLS, the necessary security databases must be installed. In particular, the files cert7.db and key3.db are needed. The cert7.db file contains the database of trusted certificates. The key3.db file contains the client's keys. Although the LDAP naming service client does not use client keys, this file must be present.

Before running ldapclient, you should set up and install the needed security database files described in this section.

See the section 'Configuring LDAP Clients to Use SSL' in the Managing SSL chapter of the iPlanet Directory Server 5.1 Administrator's Guide for information on how to create and manage these files. Once configured, these files must be stored in the location expected by the LDAP naming service client. The attribute certificatePath is used to determine this location. This is by default /var/ldap.

For example, after setting up the necessary cert7.db and key3.db files using Netscape Communicator, copy them to the default location.

# cp $HOME/.netscape/cert7.db /var/ldap

# cp $HOME/.netscape/key3.db /var/ldap

Next, give everyone read access.

# chmod 444 /var/ldap/cert7.db

# chmod 444 /var/ldap/key3.db


Note –

Netscape will manage the cert7.db and key3.db in the $HOME/.netscape directory. Copies of these security databases must be stored on a local file system if you are using them for the LDAP naming service client.


Configuring PAM

If you are using pam_ldap, follow the sample pam.conf file included in Example pam.conf File for pam_ldap and add the lines containing pam_ldap.so.1 to the client's /etc/pam.conf file. Not every line containing pam_ldap.so.1 is needed. Only the section for the command, login and password, for example, which requires pam_ldap, needs to be modified. For details, see pam.conf(4).

Retrieving Naming Service Information

Using ldaplist

ldaplist is an LDAP utility to list the naming information from the LDAP servers in LDIF format. It can be useful for troubleshooting. See ldaplist(1) for further information.

Listing All LDAP Containers

ldaplist displays its output with a blank line separating records, which is helpful for big multiline records.


Note –

The output of ldaplist depends upon the client configuration. For example, if the value of ns_ldap_search is sub rather than one, ldaplist lists all the entries under the current search baseDN.


The following is and example of ldaplist output.

# ldaplist


dn: ou=people,dc=west,dc=example,dc=com

dn: ou=group,dc=west,dc=example,dc=com

dn: ou=rpc,dc=west,dc=example,dc=com

dn: ou=protocols,dc=west,dc=example,dc=com

dn: ou=networks,dc=west,dc=example,dc=com

dn: ou=netgroup,dc=west,dc=example,dc=com

dn: ou=aliases,dc=west,dc=example,dc=com

dn: ou=hosts,dc=west,dc=example,dc=com

dn: ou=services,dc=west,dc=example,dc=com

dn: ou=ethers,dc=west,dc=example,dc=com

dn: ou=profile,dc=west,dc=example,dc=com

dn: automountmap=auto_home,dc=west,dc=example,dc=com

dn: automountmap=auto_direct,dc=west,dc=example,dc=com

dn: automountmap=auto_master,dc=west,dc=example,dc=com

dn: automountmap=auto_shared,dc=west,dc=example,dc=com

Listing All User Entry Attributes

To list specific information such as a user's passwd entry, use getent as follows.

# getent passwd user1


user1::30641:10:Joe Q. User:/home/user1:/bin/csh

If you want to list all attributes, use ldaplist with the -l option.

# ldaplist -l passwd user1


dn: uid=user1,ou=People,dc=west,dc=example,dc=com
        uid: user1
        cn: user1
        uidNumber: 30641
        gidNumber: 10
        gecos: Joe Q. User
        homeDirectory: /home/user1
        loginShell: /bin/csh
        objectClass: top
        objectClass: shadowAccount
        objectClass: account
        objectClass: posixAccount
        shadowLastChange: 6445
        userPassword: {crypt}J6vlYXRU.sW8c

Customizing the Client Environment

There are a couple of things you can tune in your client environment to make things work the way you want.

Modifying the nsswitch.conf File

You can modify your /etc/nsswitch.conf file to customize where each service gets its information. The default settings are stored in /etc/nsswitch.ldap and ldapclient uses this file to create your /etc/nsswitch.conf file when the client is initialized.

If you want to enable DNS by setting up a /etc/resolv.conf file, you will want to add DNS to your hosts lines as shown below.


hosts:      ldap dns [NOTFOUND=return] files

You can change any of the services, but be careful, because if the data is not populated on the server for the service specified things will stop working. In some cases files may not be setup by default as well.