Aktuelle Version vom 24. April 2026, 08:32 Uhr

Installation

passwort nach wahl festlegen

apt update
DEBIAN_FRONTEND=noninteractive apt install -y slapd ldap-utils

Grundkonfiguration

dpkg-reconfigure slapd

Debconf Question	Recommended Input
Omit OpenLDAP server configuration?	No
DNS domain name:	it213.int
Organization name:	it213.int
Administrator password:	123Start$
Database backend to use:	MDB
Remove database when slapd is purged?	No
Move old database?	Yes
Allow LDAPv2 protocol?	No

Port checken

ss -4lntp | grep slapd

LISTEN 0      2048         0.0.0.0:389       0.0.0.0:*    users:(("slapd",pid=1365,fd=7))

ldap.conf setzen

vim /etc/ldap/ldap.conf

BASE    dc=it213,dc=int
URI     ldap://ldap.it213.int
ldap_version    3

Kontrolle

ldapsearch -x -LLL

Grundstruktur

Erstellen

cat <<EOF > /root/struktur.ldif

dn: ou=users,dc=it213,dc=int
objectClass: organizationalUnit
ou: users

dn: ou=groups,dc=it213,dc=int
objectClass: organizationalUnit
ou: groups

dn: ou=hosts,dc=it213,dc=int
objectClass: organizationalUnit
ou: hosts

dn: ou=sudo,dc=it213,dc=int
objectClass: organizationalUnit
ou: sudo

EOF

Anlegen

ldapadd -xD cn=admin,dc=it213,dc=int -w 123Start$ -f /root/struktur.ldif

Kontrolle

ldapsearch -x -LLL

Benutzer und Gruppen

apt install -y ldapscripts

Konfiguration

vim /etc/ldapscripts/ldapscripts.conf

SERVER="ldap://ldap.it213.int"
SUFFIX="dc=it213,dc=int"
GSUFFIX="ou=groups"
USUFFIX="ou=users"
MSUFFIX="ou=hosts"
BINDDN="cn=admin,dc=it213,dc=int"
USHELL="/bin/bash"
UHOMES="/home/%u"
CREATEHOMES="yes"
HOMESKEL="/etc/skel"
BINDPWDFILE="/etc/ldapscripts/ldapscripts.passwd"
GIDSTART="10000" # Group ID
UIDSTART="10000" # User ID
MIDSTART="20000" # Machine ID
GCLASS="posixGroup"   # Leave "posixGroup" here if not sure !
PASSWORDGEN="pwgen"
RECORDPASSWORDS="no"
PASSWORDFILE="/var/log/ldapscripts_passwd.log"
LOGTOFILE="yes"
LOGFILE="/var/log/ldapscripts.log"
LOGTOSYSLOG="no"
SYSLOGFACILITY="local4"
SYSLOGLEVEL="info"
LDAPSEARCHBIN="/usr/bin/ldapsearch"
LDAPADDBIN="/usr/bin/ldapadd"
LDAPDELETEBIN="/usr/bin/ldapdelete"
LDAPMODIFYBIN="/usr/bin/ldapmodify"
LDAPMODRDNBIN="/usr/bin/ldapmodrdn"
LDAPPASSWDBIN="/usr/bin/ldappasswd"
LDAPSEARCHOPTS="-o ldif-wrap=no"
GETENTPWCMD=""
GETENTGRCMD=""
GTEMPLATE=""
UTEMPLATE=""
MTEMPLATE=""

echo -n "123Start$" > /etc/ldapscripts/ldapscripts.passwd
chmod 600 /etc/ldapscripts/ldapscripts.passwd

Gruppen

ldapaddgroup it
ldapaddgroup sudo

Benutzer

ldapadduser thomas it
ldapadduser tina it

Kontrolle

ldapsearch -x

Passwort

ldapsetpasswd thomas
ldapsetpasswd tina

Gruppe zuweisen

ldapaddusertogroup thomas sudo
ldapaddusertogroup tina sudo

Check

ldapsearch -xLLL cn=sudo

dn: cn=sudo,ou=groups,dc=it213,dc=int
objectClass: posixGroup
cn: sudo
gidNumber: 10001
description: Group account
memberUid: thomas
memberUid: tina

SSSD Anbindung

apt install sssd libnss-sss libpam-sss libsss-sudo

Konfiguration

vim /etc/sssd/sssd.conf

[sssd]
config_file_version = 2
services = nss, pam, sudo
domains = it213.int

[domain/it213.int]
id_provider = ldap
auth_provider = ldap
access_provider = permit
sudo_provider = ldap
ldap_uri = ldap://ldap.it213.int
ldap_search_base = dc=it213,dc=int
ldap_sudo_search_base = ou=sudo,dc=it213,dc=int
ldap_id_use_start_tls = false
ldap_auth_disable_tls_never_use_in_production = true
ldap_tls_reqcert = never

Erklärungen sssd-1

chmod 600 /etc/sssd/sssd.conf
systemctl restart sssd

NSS

Nur Kontrolle

cat /etc/nsswitch.conf

passwd:         files systemd sss
group:          files systemd sss
shadow:         files systemd sss
gshadow:        files systemd

hosts:          files dns
networks:       files

protocols:      db files
services:       db files sss
ethers:         db files
rpc:            db files

netgroup:       nis sss
sudoers: files  sss
automount:  sss

PAM

grep "^[^#]" /etc/pam.d/common-auth

auth	[success=2 default=ignore]	pam_unix.so nullok
auth	[success=1 default=ignore]	pam_sss.so use_first_pass
auth	requisite			pam_deny.so
auth	required			pam_permit.so

PAM

pam-auth-update --enable sss mkhomedir

Tests

Funktioniert nsswitch?

getent passwd thomas

thomas:*:10000:10000:thomas:/home/thomas:/bin/bash

getent passwd tina

tina:*:10001:10000:tina:/home/tina:/bin/bash

getent group it

it:*:10000:

Kann ich mit su - einen Identitätswechel vornehmen?

su - thomas

thomas@ldap:~$ exit

su - tina

tina@ldap:~$ exit

Zentrale Benutzerverwaltung mit OpenLDAP und SSS: Unterschied zwischen den Versionen

Aktuelle Version vom 24. April 2026, 08:32 Uhr

Inhaltsverzeichnis

Installation

Grundkonfiguration

Port checken

ldap.conf setzen

Kontrolle

Grundstruktur

Erstellen

Anlegen

Kontrolle

Benutzer und Gruppen

Konfiguration

Gruppen

Benutzer

Kontrolle

Passwort

Gruppe zuweisen

Check

SSSD Anbindung

Konfiguration

NSS

PAM

PAM

Tests

Navigationsmenü

@@ Zeile 3: / Zeile 3: @@
 * apt update
 * DEBIAN_FRONTEND=noninteractive apt install -y slapd ldap-utils
-;slapd: OpenLDAP Standalone Server
-;ldap-utils: Utilities zum Zugriff auf den LDAP Server
 = Grundkonfiguration =
 * dpkg-reconfigure slapd
-Die folgende Tabelle führt die exakten englischen Abfragen auf, sowie die empfohlenen Eingaben für die it213.int Umgebung.
 {| class="wikitable"
-! Debconf Question !! Description !! Recommended Input / Choice
+! Debconf Question !! Recommended Input
-|-
-| '''Omit OpenLDAP server configuration?''' || Determines if the installer should skip creating a database. || '''No'''
 |-
-| '''DNS domain name:''' || Used to construct the base DN of the LDAP directory. || '''it213.int'''
+| Omit OpenLDAP server configuration? || No
 |-
-| '''Organization name:''' || The name of the organization to use in the base DN. || '''it213'''
+| DNS domain name: || it213.int
 |-
-| '''Administrator password:''' || The password for the admin entry (cn=admin). || '''123Start$'''
+| Organization name: || it213.int
 |-
-| '''Confirm password:''' || Re-enter the password for verification. || '''123Start$'''
+| Administrator password: || 123Start$
 |-
-| '''Database backend to use:''' || The storage engine for the LDAP database. || '''MDB'''
+| Database backend to use: || MDB
 |-
-| '''Do you want the database to be removed when slapd is purged?''' || Whether to delete the data if the package is completely removed. || '''No'''
+| Remove database when slapd is purged? || No
 |-
-| '''Move old database?''' || If a database already exists, should it be moved aside? || '''Yes'''
+| Move old database? || Yes
 |-
-| '''Allow LDAPv2 protocol?''' || Support for the obsolete LDAP version 2. || '''No'''
+| Allow LDAPv2 protocol? || No
 |}
-= OpenLDAP Manuelle Einrichtung (OLC)=
+= Port checken =
-[[OpenLDAP Manuelle Einrichtung (OLC)]]
+*ss -4lntp | grep slapd
+ LISTEN 0      2048         0.0.0.0:389       0.0.0.0:*    users:(("slapd",pid=1365,fd=7))
-= Konfiguration des Clients =
+= ldap.conf setzen =
-== ldap.conf ==
+* vim /etc/ldap/ldap.conf
-* cat /etc/ldap/ldap.conf
+<pre>
- base            dc=it213, dc=int
+BASE    dc=it213,dc=int
- uri             ldap://ldap.it213.int
+URI     ldap://ldap.it213.int
- ldap_version    3
+ldap_version    3
- rootbinddn      cn=admin, dc=it213, dc=int
+</pre>
- pam_password    md5
-== Passwort für den Adminzugang eintragen ==
-* echo 123Start$ > /etc/ldap.secret
 = Kontrolle =
-== Stimmt der base dn ==
 * ldapsearch -x -LLL
- dn: dc=it213,dc=int
- objectClass: top
- objectClass: dcObject
- objectClass: organization
- o: it213
- dc: it213
 = Grundstruktur =
-{{#drawio:it21-ldap}}
+== Erstellen ==
+* cat <<EOF > /root/struktur.ldif
+<pre>
+dn: ou=users,dc=it213,dc=int
+objectClass: organizationalUnit
+ou: users
+dn: ou=groups,dc=it213,dc=int
+objectClass: organizationalUnit
+ou: groups
+dn: ou=hosts,dc=it213,dc=int
+objectClass: organizationalUnit
+ou: hosts
-== Erstellen ==
+dn: ou=sudo,dc=it213,dc=int
-* cat /root/struktur.ldif
+objectClass: organizationalUnit
- dn: ou=users,dc=it213,dc=int
+ou: sudo
- objectClass: organizationalUnit
+</pre>
- ou: users
+EOF
- dn: ou=groups,dc=it213,dc=int
- objectClass: organizationalUnit
- ou: groups
- dn: ou=hosts,dc=it213,dc=int
- objectClass: organizationalUnit
- ou: hosts
 == Anlegen ==
-* ldapadd -xD cn=admin,dc=it213,dc=int -w 123Start$ -f struktur.ldif
+* ldapadd -xD cn=admin,dc=it213,dc=int -w 123Start$ -f /root/struktur.ldif
- adding new entry "ou=users,dc=it213,dc=int"
+= Kontrolle =
- adding new entry "ou=groups,dc=it213,dc=int"
+* ldapsearch -x -LLL
- adding new entry "ou=hosts,dc=it213,dc=int"
-= Ldapscripts =
+= Benutzer und Gruppen =
-== Installation ==
+* apt install -y ldapscripts
-* apt install ldapscripts
 == Konfiguration ==
-=== Hauptkonfiguration ===
+* vim /etc/ldapscripts/ldapscripts.conf
-* cat /etc/ldapscripts/ldapscripts.conf
+<pre>
- SERVER="ldap://ldap.it213.int"
+SERVER="ldap://ldap.it213.int"
- SUFFIX="dc=it213,dc=int"
+SUFFIX="dc=it213,dc=int"
- GSUFFIX="ou=groups"
+GSUFFIX="ou=groups"
- USUFFIX="ou=users"
+USUFFIX="ou=users"
- MSUFFIX="ou=hosts"
+MSUFFIX="ou=hosts"
- BINDDN="cn=admin,dc=it213,dc=int"
+BINDDN="cn=admin,dc=it213,dc=int"
- USHELL="/bin/bash"
+USHELL="/bin/bash"
- UHOMES="/home/%u"
+UHOMES="/home/%u"
- CREATEHOMES="yes"
+CREATEHOMES="yes"
- HOMESKEL="/etc/skel"
+HOMESKEL="/etc/skel"
- BINDPWDFILE="/etc/ldapscripts/ldapscripts.passwd"
+BINDPWDFILE="/etc/ldapscripts/ldapscripts.passwd"
- GIDSTART="10000"
+GIDSTART="10000" # Group ID
- UIDSTART="10000"
+UIDSTART="10000" # User ID
- MIDSTART="20000"
+MIDSTART="20000" # Machine ID
- GCLASS="posixGroup"
+GCLASS="posixGroup"   # Leave "posixGroup" here if not sure !
- PASSWORDGEN="pwgen"
+PASSWORDGEN="pwgen"
- RECORDPASSWORDS="no"
+RECORDPASSWORDS="no"
- PASSWORDFILE="/var/log/ldapscripts_passwd.log"
+PASSWORDFILE="/var/log/ldapscripts_passwd.log"
- LOGTOFILE="yes"
+LOGTOFILE="yes"
- LOGFILE="/var/log/ldapscripts.log"
+LOGFILE="/var/log/ldapscripts.log"
- LOGTOSYSLOG="no"
+LOGTOSYSLOG="no"
- SYSLOGFACILITY="local4"
+SYSLOGFACILITY="local4"
- SYSLOGLEVEL="info"
+SYSLOGLEVEL="info"
- LDAPSEARCHBIN="/usr/bin/ldapsearch"
+LDAPSEARCHBIN="/usr/bin/ldapsearch"
- LDAPADDBIN="/usr/bin/ldapadd"
+LDAPADDBIN="/usr/bin/ldapadd"
- LDAPDELETEBIN="/usr/bin/ldapdelete"
+LDAPDELETEBIN="/usr/bin/ldapdelete"
- LDAPMODIFYBIN="/usr/bin/ldapmodify"
+LDAPMODIFYBIN="/usr/bin/ldapmodify"
- LDAPMODRDNBIN="/usr/bin/ldapmodrdn"
+LDAPMODRDNBIN="/usr/bin/ldapmodrdn"
- LDAPPASSWDBIN="/usr/bin/ldappasswd"
+LDAPPASSWDBIN="/usr/bin/ldappasswd"
- LDAPSEARCHOPTS="-o ldif-wrap=no"
+LDAPSEARCHOPTS="-o ldif-wrap=no"
+GETENTPWCMD=""
+GETENTGRCMD=""
+GTEMPLATE=""
+UTEMPLATE=""
+MTEMPLATE=""
+</pre>
-=== Password Datei ===
 * echo -n "123Start$" > /etc/ldapscripts/ldapscripts.passwd
+* chmod 600 /etc/ldapscripts/ldapscripts.passwd
-== Managment ==
+== Gruppen ==
-=== Struktur ===
-{{#drawio:it21-2}}
-=== Gruppen anlegen ===
 * ldapaddgroup it
+* ldapaddgroup sudo
-=== Benutzer anlegen ===
+== Benutzer ==
 * ldapadduser thomas it
 * ldapadduser tina it
+== Kontrolle ==
+* ldapsearch -x
-=== Passwörter setzen ===
+== Passwort ==
 * ldapsetpasswd thomas
 * ldapsetpasswd tina
-= nsswitch und pam anbinden via SSSD =
+== Gruppe zuweisen ==
-Da sudo-ldap und nslcd veraltet sind, erfolgt die Anbindung über SSSD.
+* ldapaddusertogroup thomas sudo
+* ldapaddusertogroup tina sudo
+== Check ==
+*ldapsearch -xLLL  cn=sudo
+ dn: cn=sudo,ou=groups,dc=it213,dc=int
+ objectClass: posixGroup
+ cn: sudo
+ gidNumber: 10001
+ description: Group account
+ memberUid: thomas
+ memberUid: tina
-== Installation ==
+= SSSD Anbindung =
 * apt install sssd libnss-sss libpam-sss libsss-sudo
-== SSSD Konfiguration ==
+== Konfiguration ==
 * vim /etc/sssd/sssd.conf
 <pre>
 [sssd]
+config_file_version = 2
 services = nss, pam, sudo
 domains = it213.int
@@ Zeile 154: / Zeile 156: @@
 id_provider = ldap
 auth_provider = ldap
+access_provider = permit
 sudo_provider = ldap
 ldap_uri = ldap://ldap.it213.int
@@ Zeile 159: / Zeile 162: @@
 ldap_sudo_search_base = ou=sudo,dc=it213,dc=int
 ldap_id_use_start_tls = false
-cache_credentials = True
+ldap_auth_disable_tls_never_use_in_production = true
-ldap_tls_reqcert = allow
+ldap_tls_reqcert = never
 </pre>
+;[[Erklärungen sssd-1]]
 * chmod 600 /etc/sssd/sssd.conf
 * systemctl restart sssd
-== Nsswitch anpassen ==
+== NSS ==
-* cat /etc/nsswitch.conf
+;Nur Kontrolle
- passwd:         files sss
+*cat /etc/nsswitch.conf
- group:          files sss
- shadow:         files sss
- sudoers:        files sss
-== PAM anpassen ==
+  passwd:         files systemd '''sss'''
-* pam-auth-update --enable mkhomedir
+  group:          files systemd '''sss'''
+  shadow:         files systemd '''sss'''
-= Tests =
+  gshadow:        files systemd
-* getent group it
-  it:*:10000:
+ hosts:          files dns
-* getent passwd thomas
+ networks:       files
-  thomas:*:10000:10000:thomas:/home/thomas:/bin/bash
-* su - tina
+ protocols:      db files
-  tina@server:~$
+ services:       db files '''sss'''
+ ethers:         db files
-== Dienstverwaltung ==
+ rpc:            db files
-* systemctl start slapd
-* systemctl restart sssd
+ netgroup:       nis sss
+ sudoers: files  sss
-== Portprüfung ==
+ automount:  sss
-* netstat -lntp | grep slapd
-  tcp        0      0 0.0.0.0:389             0.0.0.0:* LISTEN     499/slapd
-= Sudo =
-== Sudo-Struktur im LDAP ==
-Wir legen die benötigten Sudo-Regeln direkt im LDAP an:
-* cat /root/sudo_rules.ldif
-<pre>
-dn: ou=sudo,dc=it213,dc=int
-objectClass: organizationalUnit
-ou: sudo
-dn: cn=%sudo,ou=sudo,dc=it213,dc=int
-objectClass: sudoRole
-cn: %sudo
-sudoUser: %sudo
-sudoHost: ALL
-sudoRunAsUser: ALL
-sudoRunAsGroup: ALL
-sudoCommand: ALL
 </pre>
-* ldapadd -xD cn=admin,dc=it213,dc=int -w 123Start$ -f /root/sudo_rules.ldif
-== Gruppenverwaltung ==
-* ldapaddgroup sudo
-* ldapaddusertogroup thomas sudo
-* ldapaddusertogroup tina sudo
-== Lokale Berechtigung (Fallback) ==
+== PAM ==
-* visudo -f /etc/sudoers.d/ldap-sudoers
+*grep "^[^#]" /etc/pam.d/common-auth
-  %sudo ALL=(ALL:ALL) ALL
+  auth	[success=2 default=ignore]	pam_unix.so nullok
+ '''auth	[success=1 default=ignore]	pam_sss.so use_first_pass'''
+ auth	requisite			pam_deny.so
+ auth	required			pam_permit.so
-== Testen ==
+== PAM ==
-* su - thomas
+* pam-auth-update --enable sss mkhomedir
-* sudo -l
+=Tests=
-* sudo whoami
+;Funktioniert nsswitch?
+*getent passwd thomas
+ thomas:*:10000:10000:thomas:/home/thomas:/bin/bash
+*getent passwd tina
+ tina:*:10001:10000:tina:/home/tina:/bin/bash
+*getent group it
+ it:*:10000:
+;Kann ich mit su - einen Identitätswechel vornehmen?
+*su - thomas
+ thomas@ldap:~$ exit
+*su - tina
+ tina@ldap:~$ exit

Zentrale Benutzerverwaltung mit OpenLDAP und SSS: Unterschied zwischen den Versionen

Aktuelle Version vom 24. April 2026, 08:32 Uhr

Installation

Grundkonfiguration

Port checken

ldap.conf setzen

Kontrolle

Grundstruktur

Erstellen

Anlegen

Kontrolle

Benutzer und Gruppen

Konfiguration

Gruppen

Benutzer

Kontrolle

Passwort

Gruppe zuweisen

Check

SSSD Anbindung

Konfiguration

NSS

PAM

PAM

Tests

Navigationsmenü

Suche