PAM LDAP在RedHat Linux 5和Solaris 10系统上的用户认证
每个系统都需要对用户进行认证Authentication和鉴权Authorization，用户集中管理只需要一份用户信息，简化了管理。通过PAM能够对不同的认证系统进行动态配置，如Radius，LDAP。
PAM LDAP on Linux RedHat5
1 Configure OpenLDAP
OpenLDAP is installed at /usr/local/, the LDAP server configuration file is /usr/local/etc/openldap/slapd.conf, and including the following setting which will be modified according the specific context.
#access control
access to * by * read
atabase bdb
suffix "dc=cisco,dc=com"
rootdn "cn=root,dc=cisco,dc=com"
rootpw Crdc%123
#if log is needed, and add “local4.* /var/log/ldap/ldap.log” into /etc/syslog.conf
LDAP client configuration file is etc/openldap/ldap.conf.
Then start LDAP server:
# /usr/local/libexec/slapd
2 Import user accounts
Create the ldif file to include all the user accounts information. One binding user is required to send binding request to LDAP before authentication start.
users.ldif :
dn: uid=testbind,dc=cisco,dc=com
uid: testbind
cn: testbind
sn: testbind
userPassword: testbind
uidNumber: 1104
gidNumber: 1100
homeDirectory: /home/testbind
loginShell: /bin/bash
objectClass: inetOrgPerson
objectClass: posixAccount
dn: uid=test,dc=cisco,dc=com
uid: test
cn: test
sn: test
userPassword: test
uidNumber: 1105
gidNumber: 1100
homeDirectory: /home/test
loginShell: /bin/bash
objectClass: inetOrgPerson
objectClass: posixAccount
….
Use the following command to add and search the user accounts:
#ldapadd -x -D "cn=root,dc=cisco,dc=com" -W -f users.ldif
#ldapsearch -x -D "cn=root,dc=cisco,dc=com" -W -b "cn=test,dc=cisco,dc=com"
#ldapdelete -x -D "cn=root,dc=cisco,dc=com" -W "ou=people,dc=cisco,dc=com"
3 PAM setting
There are many different PAM modules which communicate with different AAA server, these PAM library files are located in /lib64/security(for Linux 64). Use /etc/pam.d/<yourservice-jpam > to relay the authentication to LDAP or other AAA, for instance Radius, modify the ppm-jpam with the following lines:
auth sufficient /lib64/security/pam_ldap.so config=/etc/ldap.conf
account sufficient /lib64/security/pam_ldap.so config=/etc/ldap.conf
PAM_LDAP service will use /etc/ldap.conf file to create the connection with LDAP server and verify the users.
# Your LDAP server.
host 10.74.125.39
# The distinguished name of the search base.
base dc=cisco,dc=com
ldap_version 3
# The distinguished name to bind to the server with.
# Optional: default is to bind anonymously.
binddn uid=testbind,dc=cisco,dc=com
# The credentials to bind with.
# Optional: default is no credential.
bindpw testbind
# The port.
# Optional: default is 389.
port 389
# The search scope.
scope sub
# The user ID attribute (defaults to uid)
pam_login_attribute uid
4 Verify
PAM LDAP on Solaris 10
1 Configure OpenLDAP
OpenLDAP is installed at /usr/local/, the LDAP server configuration file is /usr/local/etc/openldap/slapd.conf, and including the following setting which will be modified according the specific context.
#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include /usr/local/etc/openldap/schema/core.schema
include /usr/local/etc/openldap/schema/corba.schema
include /usr/local/etc/openldap/schema/cosine.schema
include /usr/local/etc/openldap/schema/inetorgperson.schema
include /usr/local/etc/openldap/schema/misc.schema
include /usr/local/etc/openldap/schema/openldap.schema
include /usr/local/etc/openldap/schema/nis.schema
include /usr/local/etc/openldap/schema/gehua.schema
include /usr/local/etc/openldap/schema/duaconf.schema
include /usr/local/etc/openldap/schema/solaris.schema
#include /usr/local/etc/openldap/schema/DUAConfigProfile.schema
# Define global ACLs to disable default read access.
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral ldap://root.openldap.org
pidfile /usr/local/var/run/slapd.pid
argsfile /usr/local/var/run/slapd.args
# Load dynamic backend modules:
# modulepath /usr/local/libexec/openldap
# moduleload back_bdb.la
# moduleload back_hdb.la
# moduleload back_ldap.la
# Sample security restrictions
# Require integrity protection (prevent hijacking)
# Require 112-bit (3DES or better) encryption for updates
# Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
# Sample access control policy:
# Root DSE: allow anyone to read it
# Subschema (sub)entry DSE: allow anyone to read it
# Other DSEs:
# Allow self write access
# Allow authenticated users read access
# Allow anonymous users to authenticate
# Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
# by self write
# by users read
# by anonymous auth
access to * by * read
#
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
#
# rootdn can always read and write EVERYTHING!
#######################################################################
# BDB database definitions
#######################################################################
database bdb
suffix "dc=cisco,dc=com"
# suffix "DC=mbaruch, DC=local"
rootdn "cn=root,dc=cisco,dc=com"
# rootdn "CN=root,DC=mbaruch, DC=local"
# Cleartext passwords, especially for the rootdn, should
# be avoid. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
# rootpw secret
rootpw Crdc%123
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory /usr/local/var/openldap-data
# Indices to maintain
index objectClass eq
sizelimit 1000
loglevel any
#TLSCACertificateFile /etc/openldap/cacerts/cacert.pem
#TLSCertificateFile /etc/openldap/cacerts/server.cert
#TLSCertificateKeyFile /etc/openldap/cacerts/server.key
TLSCACertificateFile /usr/local/etc/openldap/ca/cacert.pem
TLSCertificateFile /usr/local/etc/openldap/ca/servercrt.pem
TLSCertificateKeyFile /usr/local/etc/openldap/ca/serverkey.pem
TLSVerifyClient never
#ssl start_tls
2 Import user accounts
Create the ldif file to include all the user accounts information. One binding user is required to send binding request to LDAP before authentication start.
Use the following command to import base.ldif, groups.ldif and passwd.ldif into LDAP server.
#ldapadd -x -D "cn=root,dc=cisco,dc=com" -W -f ***.ldif
base.ldif
dn: ou=People,dc=cisco,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit
dn: ou=Group,dc=cisco,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit
group.ldif
dn: cn=root,ou=Group,dc=cisco,dc=com
objectClass: posixGroup
objectClass: top
cn: root
gidNumber: 0
dn: cn=other,ou=Group,dc=cisco,dc=com
objectClass: posixGroup
objectClass: top
cn: other
gidNumber: 1
memberUid: root
passwd.ldif
dn: uid=testbind,dc=cisco,dc=com
uid: testbind
cn: testbind
sn: testbind
userPassword: testbind
uidNumber: 1104
gidNumber: 1100
homeDirectory: /home/testbind
loginShell: /bin/bash
objectClass: inetOrgPerson
objectClass: posixAccount
dn: uid=nmtgtest,ou=People,dc=cisco,dc=com
uid: nmtgtest
cn: nmtgtest
objectClass: account
objectClass: posixAccount
objectClass: top
objectClass: shadowAccount
userPassword: nmtgtest
shadowLastChange: 15064
loginShell: /bin/sh
uidNumber: 1315
gidNumber: 1
homeDirectory: /home/nmtg
3 PAM setting
There are many different PAM modules which communicate with different AAA server, Solaris has the native PAM LDAP library, use /etc/pam.conf to relay the authentication to LDAP or other AAA, for instance LDAP:
<serive name> auth required pam_ldap.so
<service name> account required pam_ldap.so
Run the following command to configure Solaris native LDAP:
ldapclient -v manual -a defaultSearchBase=dc=cisco,dc=com -a serviceSearchDescriptor=passwd:ou=People,dc=cisco,dc=com -a serviceSearchDescriptor=shadow:ou=People,dc=cisco,dc=com -a defaultServerList=10.74.125.39 -a domainName=cisco.com -a authenticationMethod=simple -a defaultSearchScope=sub -a credentialLevel=proxy -a proxyDN=uid=testbind,dc=cisco,dc=com -a proxyPassword=testbind
To verify if the LDAP client is working well, run the following command:
# getent passwd <username>
# ldaplist -l passwd <username>
To Verify the following to file with correct parameters:
/var/ldap/ldap_client_file
NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_SERVERS= 10.74.125.39
NS_LDAP_SEARCH_BASEDN= dc=cisco,dc=com
NS_LDAP_AUTH= simple
NS_LDAP_SEARCH_SCOPE= sub
NS_LDAP_CACHETTL= 0
NS_LDAP_CREDENTIAL_LEVEL= proxy
NS_LDAP_SERVICE_SEARCH_DESC= passwd:ou=People,dc=cisco,dc=com
NS_LDAP_SERVICE_SEARCH_DESC= shadow:ou=People,dc=cisco,dc=com
/var/ldap/ldap_client_cred
NS_LDAP_BINDDN= uid=testbind,dc=cisco,dc=com
NS_LDAP_BINDPASSWD= {NS1}4a3788e834634411
6 Verify