17. LDAP

Size: px

Start display at page:

Download "17. LDAP"

익 모
5 years ago
Views:

1 17. LDAP logue

2 Contents LDAP? Installation Configuration Managing Practice

3 LDAP? Lightweight Directory Access Protocol TCP/IP 위에서디렉터리를조회하고수정하는응용프로토콜 Directory??

4 LDAP? Directory An organized set of records Ex. Telephone directory Person or organiztion Person or organiztion Person or organiztion Person or organiztion Alphabetical list Address Address Address Address Phone number Phone number Phone number Phone number

5 LDAP? Directory service 컴퓨터네트워크의사용자와네트워크자원에대한정보를저장하고조직하는응용소프트웨어

6 LDAP? X.500 젂자디렉토리서비스를위한네트워크표준 1988년에처음등장

7 LDAP? X.500 DAP(Directory Access Protocol) DSP(Directory System Protocol) DISP(Directory Information Shadowing Protocol) DOP(Directory Operational Bindings Management Protocol)

8 LDAP?

9 LDAP? Directory Information Tree A directory is a tree of directory entries. An entry consists of a set of attributes. An attribute has a name and one or more values. The attributes are defined in a schema. Each entry has a unique identifier: its Distinguished Name(DN). RDN

10 LDAP? Directory Information Tree

11 LDAP? Entry dn: cn=do-guk Kim, ou=people, dc=sparcs, dc=org cn: Do-Guk Kim gidnumber: 200 homedirectory: /home/logue loginshell: /bin/bash objectclass: account objectclass: posixaccount objectclass: top objectclass: shadowaccount uidnumber: 4002 User Name: logue

12 LDAP? Available backend types Data Storage backends bdb : BerkeleyDB ldif : built on plain text LDIF files Proxy backends ldap : simple proxy to other LDAP servers passwd : uses a passwd and group data Dynamic backends shell : invokes shell scripts for LDAP requests

13 LDAP? Common usage of LDAP Centralization of user and group information Authenticate users locally Authenticate users in a web application Create a shared address directory for mail agents

14 Installation $ sudo apt-get install slapd ldap-utils By default slapd is configured with minimal options needed to run the slapd daemon.

15 Configuration The cn=config DIT is used to dynamically configure the slapd daemon. $ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/cosine.ldif $ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/nis.ldif $ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif

16 Configuration backend.sparcs.org.ldif # Load dynamic backend modules dn: cn=module,cn=config objectclass: olcmodulelist cn: module olcmodulepath: /usr/lib/ldap olcmoduleload: back_hdb # Database settings dn: olcdatabase=hdb,cn=config objectclass: olcdatabaseconfig objectclass: olchdbconfig olcdatabase: {1}hdb olcsuffix: dc=sparcs,dc=org olcdbdirectory: /var/lib/ldap olcrootdn: cn=admin,dc=example,dc=com

17 Configuration backend.sparcs.org.ldif slappasswd New password: Re-enter new password: {SSHA}otkHcuPvZDGTKFt0EVZV4gNgzSboNY+S

18 Configuration backend.sparcs.org.ldif olcrootdn: cn=admin,dc=example,dc=com olcrootpw: olcrootpw: {SSHA}otkHcuPvZDGTKFt0EVZV4gNgzSboNY+S secret olcdbconfig: olcdbconfig: set_cachesize set_cachesize olcdbconfig: olcdbconfig: set_lk_max_objects set_lk_max_objects olcdbconfig: olcdbconfig: set_lk_max_locks set_lk_max_locks olcdbconfig: olcdbconfig: set_lk_max_lockers set_lk_max_lockers olcdbindex: olcdbindex: objectclass objectclass eq eq olclastmod: olclastmod: TRUE TRUE olcdbcheckpoint: olcdbcheckpoint: olcaccess: olcaccess: to to attrs=userpassword attrs=userpassword by by dn="cn=admin,dc=sparcs,dc=org" dn="cn=admin,dc=example,dc=com" write by anonymous auth by self write write by * by none anonymous auth by self write olcaccess: by * none to attrs=shadowlastchange by self write by * read olcaccess: olcaccess: to to attrs=shadowlastchange dn.base="" by * read by self write by * read olcaccess: olcaccess: to to * dn.base="" by dn="cn=admin,dc=sparcs,dc=org" by * read write by * read olcaccess: to * by dn="cn=admin,dc=example,dc=com" write by * read

19 Configuration ACL(Access Control List)

20 Configuration ACL(Access Control List) olcaccess: to <Entry> <Attribute> by <DN><PERM> [by <DN><PERM> ] olcaccess: to * by self write by anonymous auth by * read

21 Configuration ACL(Access Control List) 동일한액세스항목을중복설정할수없다. 넓은범위에관한 ACL을뒤에놓아야한다. Comma(,) 앞뒤로공백이없어야한다. ACL이복잡할수록검색속도가느려짂다.

22 Configuration $ sudo ldapadd -Y EXTERNAL -H ldapi:/// -f backend.sparcs.org.ldif

23 Configuration frontend.sparcs.org.ldif # Create top-level object in domain dn: dc=sparcs,dc=org objectclass: top objectclass: dcobject objectclass: organization o: SPARCS dc: sparcs description: Wheel Seminar LDAP Example # Admin user. dn: cn=admin,dc=sparcs,dc=org objectclass: simplesecurityobject objectclass: organizationalrole cn: admin description: LDAP administrator userpassword: {SSHA}otkHcuPvZDGTKFt0EVZV4gNgzSboNY+S

24 Configuration $ sudo ldapadd -x -D cn=admin,dc=sparcs,dc=org -W -f frontend.sparcs.org.ldif

25 Managing ldap-utils $ <command> -D <DN of the entry> -W f <ldif file path>

26 Managing ldapadd $ ldapadd D cn=admin,dc=sparcs,dc=org W f test.ldif <test.ldif> dn: cn=test,dc=sparcs,dc=org objectclass: inetorgperson cn: test sn: Kim

27 Managing ldapsearch $ ldapsearch -b base [options] filter [attributes] Some Useful Options! -s: scope of the search. [base one sub] -x: use simple authentication instead of SASL

28 Managing ldapsearch

29 Managing ldapsearch Filter Equality : uid=logue Substring: uid=*gue Approximate: uid~=log Less than, greater then: uid>=noname And: &(uid=logue)(gidnumber=200) Or:, Not:!,

30 Managing ldapsearch Ex) Return all entries

31 Managing ldapsearch Ex) Find specific entry

32 Managing ldapmodify $ ldapmodify D cn=admin,dc=sparcs,dc=org W f testmod.ldif <testmod.ldif> dn: cn=test,dc=sparcs,dc=org Changetype: modify Replace: sn sn: Lee

33 Managing ldapdelete $ ldapdelete -D "cn=admin,dc=sparcs,dc=org" -W "cn=test,dc=sparcs,dc=org"

34 Managing ldapmodrdn $ ldapmodrdn -D "cn=admin,dc=sparcs,dc=org" -W (-r) "cn=test,dc=sparcs,dc=org cn=temp dn: cn=temp,dc=sparcs,dc=org objectclass: inetorgperson cn: test cn: temp sn: Lee

35 Managing LDIF(LDAP Data Interchange Format) 디렉토리엔트리표현형식 dn: cn=do-guk Kim, ou=people, dc=sparcs, dc=org cn: Do-Guk Kim gidnumber: 200 homedirectory: /home/logue loginshell: /bin/bash objectclass: account objectclass: posixaccount objectclass: top objectclass: shadowaccount uidnumber: 4002 User Name: logue

<DN of the entry> changetype: [modify add delete] (if changetype is

36 Managing LDIF(LDAP Data Interchange Format) 데이터변경형식 dn: cn=do-guk Kim, ou=people, dc=sparcs, dc=org changetype: modify replace: cn cn: Bakwi Jang <DN of the entry> changetype: [modify add delete] (if changetype is modify)[replace add delete]: <attribute> Then enter the value of the attribute if necessary.

37 Managing Schema LDAP 에서의 schema 파일은 objectclass 를정의한다. 용도에따라최적화한 LDAP 서비스를위해서는 schema 작성에대해서도알아야하지만흔히쓰이는 Linux 에서의사용자인증목적에서는새로운 schema 작성이필요없으므로넘어가도록하겠다.

38 Practice LDAP Authentication 지금까지의내용들로 LDAP 서버를구축할수있다. 클라이언트는여러가지종류가있다. 예를들자면 Linux 에서인증용으로사용할수도있고 trac 에도 LDAP 플러그인이있다. 여기서는 LDAP 서버구축및 LDAP 을통한 Linux 로그인을실습해본다.

39 Practice LDAP Authentication 먼저 Installation 과 Configuration 파트에서설명한대로 LDAP 서버기초설정을완료한다.

40 Practice LDAP Authentication $ sudo apt-get install migrationtools $ mv /usr/share/perl5/migrate_common.ph /usr/share/migrationtools/

41 Practice LDAP Authentication <migrate_common.ph> $DEFAULT_MAIL_DOMAIN = sparcs.org ; $DEFAULT_BASE = dc=sparcs,dc=org ; # cd /usr/share/migrationtools/ #./migrate_group.pl /etc/group ~/group.ldif #./migrate_passwd.pl /etc/passwd ~/passwd.ldif

42 Practice LDAP Authentication # vi ~/people_group.ldif dn: ou=people, dc=sparcs, dc=org ou: People objectclass: organizationalunit dn: ou=group, dc=sparcs dc=org ou: Group objectclass: organizationalunit

43 Practice LDAP Authentication # cd # ldapadd -D cn=admin,dc=sparcs,dc=org -W -f ~/people_group.ldif # ldapadd D cn=admin,dc=sparcs,dc=org -W -f ~/group.ldif # ldapadd D cn=admin,dc=sparcs,dc=org -W -f ~/passwd.ldif

44 Practice LDAP Authentication $ apt-get install libnss-ldap libpam-ldap nss-updatedb nscd ldap-auth-client Should debconf manage LDAP configuration? Yes LDAP server Uniform Resource Identifier: ldapi:/// Distinguished name of the search base: dc=sparcs,dc=org LDAP Version to use: 3 Make local root Database admin: Yes Does the LDAP database require login? No LDAP account for root: cn=admin,dc=sparcs,dc=org LDAP root account password: <LDAP 비밀번호 >

45 Practice LDAP Authentication </etc/ldap.conf> host nss_base_passwd ou=people,dc=sparcs,dc=org nss_base_shadow ou=people,dc=sparcs,dc=org nss_base_group ou=group,dc=sparcs,dc=org

46 Practice LDAP Authentication </etc/auth-client-config/profile.d/ ldap-auth-config> # command auth-client-config a p lac_ldap

47 Practice LDAP Authentication 이제설정이끝났다. 서버와클라이언트가연동되었고인증또한잘될것이다. 현재서버의 passwd 정보와 LDAP 의정보가같아확인이어려우니한번 passwd 로비밀번호를바꿔보자. 비밀번호를바꾼후 LDAP password information changed 구문이뜨는것을보면 LDAP 으로인증을하고있다는사실을알수있다.

49 은훼이크 ;;;

50 Practice LDAP Authentication LDAP 을사용한인증을할경우 adduser 로사용자를추가할경우자동으로추가되지않기때문에추가적으로사용자정보를디렉토리에추가해줘야제대로작동한다.

51 Practice LDAP Authentication # adduser < 아이디 > adduser 를한후로그인을시도해보자. 분명서버의 passwd 파일에는사용자가추가되었겠지만 LDAP 에는추가가되지않았으므로접속이안될것이다. migrate_passwd.pl 을이용해새로추가된사용자의정보만을담은 ldif 파일을생성한후 ldapadd 를해주면된다.

52 Practice LDAP Authentication 사용자가비밀번호를바꾸었을때도 LDAP 에갱싞을해줘야새비밀번호로다른곳에서도접속할수가있다. <test.ldif> # ldapmodify W D cn=admin,dc=sparcs,dc=org f ~/test.ldif

54 수고하셨습니다

55 Reference SPARCS Wheel Wiki sses/nfs%2bldap Ubuntu Server Guide e/c/serverguide.pdf

56 Reference OpenLDAP Software 2.4 Guide Reference about ldapsearch tml

57 Reference Wikipedia OpenLDAP LDAP 에대한모든것 ( 워드문서 ) 년휠세미나 LDAP by harry

OpenLDAP, LDAP 서버 설치 및 관리

OpenLDAP, LDAP 서버 설치 및 관리 LDAP 서버설치및관리 (OpenLDAP, PAM auth) 2014 SPARCS WHEEL SEMINAR CHOCHO 조현성 LDAP 이란? Lightweight Directory Access Protocol TCP/IP 위에서디렉터리서비스를조회하고수정하는응용프로토콜 경량 DAP! DAP 는 OSI 프로토콜스택에서작동 + 컴퓨팅자원을많이사용하는무거운프로토콜