edin.no-ip.com

NOTE! This is just my personal research progress log. Don't use it as production. If you are asking for some other update details, please refer to LDAP + Samba PDC + PAM/NSS on Debian Lenny HOWTO

Prepare Debian

slapd
LDAP admin password: CHANGE

samba
domain: EXAMPLE
WINS settings from DHCP: NO

libnss-ldap
LDAP server Uniform Resource Identifier: ldap://127.0.0.1
Distinguished name of the search base: dc=example,dc=com
LDAP version to use: 3
LDAP account for root: cn=admin,dc=example,dc=com
LDAP password: CHANGE

libpam-ldap:
Make local root Database admin: yes
Does the LDAP database require login?: no
LDAP account for root: cn=admin,dc=example,dc=com
LDAP root account password: CHANGE

vi /etc/php5/apache2/php.ini
memory_limit = 128M;
post_max_size = 32M
upload_max_filesize = 32M
date.timezone = "Asis/Hong_Kong"
display_errors = Off
/etc/init.d/apache2 restart

pear install Auth_SASL
pear install XML_Feed_Parser
/etc/init.d/apache2 restart

vi /etc/apache2/sites-enabled/000-default

/etc/init.d/apache2 restart

mysql:
mysqladmin -uroot password CHANGE
mysql -uroot -p

Download Package

Download egroupware 1.6
http://www.egroupware.org/download

files:
eGroupware-1.6.001.tar.gz
eGroupware-egw-pear-1.6.001.tar.gz
eGroupware-gallery-1.6.001.tar.gz
eGroupware-icalsrv-1.6.001.tar.gz
eGroupware-mydms-1.6.001.tar.gz

mv eGroupware-* /var/www/
cd /var/www
find . -name 'eGroupware-*' -exec tar zxvf {} \;
mv egroupware eGroupware-1.6.001
ln -s eGroupware-1.6.001 egroupware
chown -Rf www-data:www-data /var/www/

Download smbldap-qmail-tools:
http://smbldap-addons.sourceforge.net/
wget http://smbldap-addons.sourceforge.net/smbldap-qmail-tools/qmail.schema
download smbldap-qmail-tools-0.3-2.tar.gz
tar zxvf smbldap-qmail-tools-0.3-2.tar.gz
chown -Rf root:root smbldap-qmail-tools-0.3-2
cp -rfp smbldap-qmail-tools-0.3-2/smbldap* /usr/local/sbin

Download phpldapadmin:
http://phpldapadmin.sourceforge.net/wiki/index.php/Download
tar zxvf phpldapadmin-1.1.0.6.tar.gz
mv phpldapadmin-1.1.0.6 /var/www/
cd /var/www
ln -s phpldapadmin-1.1.0.6 phpldapadmin
cd /var/www/phpldapadmin/config/
cp config.php.example config.php
vi config.php
$ldapservers->SetValue($i,'server','host','127.0.0.1');

Download phpmyadmin:
http://www.phpmyadmin.net/home_page/downloads.php
mv phpMyAdmin-3.1.2-all-languages.tar.gz /var/www
cd /var/www
tar zxvf phpMyAdmin-3.1.2-all-languages.tar.gz
ln -s phpMyAdmin-3.1.2-all-languages phpmyadmin
cd /var/www/phpmyadmin
mkdir config
cp config.sample.inc.php config/config.inc.php
chmod -Rf 777 config

http://localhost/phpmyadmin/setup/
overview -> new server -> save
features ->
Upload directory: /tmp
Save directory: /tmp
Allow character set conversion: yes
Default character set: utf-8
overview: -> Configuration file -> save

mv /var/www/phpmyadmin/config/config.inc.php /var/www/phpmyadmin
rm -rf /var/www/phpmyadmin/config
chmod 644 /var/www/phpmyadmin/config.inc.php

http://localhost/phpmyadmin/

Prepare slapd

/etc/init.d/nscd stop
/etc/init.d/slapd stop

slapcat > ~/my.ldif

find /var/www/egroupware/ -name '*.schema' -exec cp {} /etc/ldap/schema/ \;

smbldap-tools is not function with rfc2307bis.schema, use nis.schema instead

zcat /usr/share/doc/samba-doc/examples/LDAP/samba.schema.gz > \
/etc/ldap/schema/samba.schema

cp /usr/local/src/qmail.schema /etc/ldap/schema/

slappasswd -h {MD5}
{MD5}Qhz9FD5FDD9YFKBJVAngcw==

vi /etc/ldap/slapd.conf

/etc/init.d/slapd stop
rm -rf /var/lib/ldap/*
slapadd -l ~/my.ldif
slapindex
chown -Rf openldap:openldap /var/lib/ldap
/etc/init.d/slapd start

Configure Samba with swat

http://localhost:901/
wizard:
-> Server Type: Domain Controller
-> Configure WINS As: Server for client use
-> Commit
-> Rewrite smb.conf file
global (advanced):
-> copy & paste the following setup:

mkdir -p /var/lib/samba/profiles /var/lib/samba/netlogon
chmod 777 /var/lib/samba/profiles
chmod 755 /var/lib/samba/netlogon

smbpasswd -w CHANGE
/etc/init.d/samba restart

Configure smbldap-tools

zcat /usr/share/doc/smbldap-tools/examples/smbldap.conf.gz > \
/etc/smbldap-tools/smbldap.conf
cp /usr/share/doc/smbldap-tools/examples/smbldap_bind.conf \
/etc/smbldap-tools/smbldap_bind.conf

net getlocalsid

vi /etc/smbldap-tools/smbldap.conf

vi /etc/smbldap-tools/smbldap_bind.conf

chmod 0644 /etc/smbldap-tools/smbldap.conf
chmod 0600 /etc/smbldap-tools/smbldap_bind.conf

smbldap-populate

configure libpam-ldap and libnss-ldap

vi /etc/nsswitch.conf
passwd: files ldap
group: files ldap
shadow: files ldap
hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4 ldap

vi /etc/libnss-ldap.conf
nss_base_passwd ou=Users,dc=example,dc=com?one
nss_base_passwd ou=Computers,dc=example,dc=com?one
nss_base_shadow ou=Users,dc=example,dc=com?one
nss_base_group ou=Groups,dc=example,dc=com?one

vi /etc/libnss-ldap.secret
CHANGE

vi /etc/pam_ldap.conf
nss_base_passwd ou=Users,dc=example,dc=com?one
nss_base_passwd ou=Computers,dc=example,dc=com?one
nss_base_shadow ou=Users,dc=example,dc=com?one
nss_base_group ou=Groups,dc=example,dc=com?one

vi /etc/pam_ldap.secret
CHANGE

vi common-account
account sufficient pam_ldap.so
account required pam_unix.so

vi common-auth
# Check local authentication first, so root can still login
# while LDAP is down.
auth [success=1 default=ignore] pam_unix.so
auth required pam_ldap.so use_first_pass
auth required pam_permit.so

vi common-password
password sufficient pam_ldap.so use_authtok
password required pam_unix.so nullok obscure md5

vi common-session
session optional pam_ldap.so
session required pam_unix.so

fix boot error:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=412989
addgroup --system nvram
addgroup --system rdma
addgroup --system fuse
addgroup --system kvm
adduser --system --group --shell /usr/sbin/nologin --home /var/lib/tpm tss

add demo user:
smbldap-useradd -a -m postmaster
smbldap-passwd postmaster

join windows into domain
login with domain user

Configure Exim4

This is not the main topic.
No additional setup is required.
No LDAP user lookup, just PAM -> integrate qmail.schema and vexim logic -> next step

dpkg-reconfigure exim4-config
configure connection, domain, etc as usual

monitor with geximon
echo "my test" | mail -s "test message" root
echo "my test" | mail -s "test message" postmaster

Install egroupware

phpmyadmin:
privileges -> add a new user
User name: egroupware
Host: localhost
Password: CHANGE
Database for user: Grant all privileges on wildcard name (username\_%)
Database -> Create new database
name: egroupware_example_com
code page: utf8_general_ci

mkdir -p /var/lib/egroupware/example.com/files var/lib/egroupware/example.com/backup
chown -Rf www-data:www-data /var/lib/egroupware

http://localhost/egroupware/setup/
Server Root: /var/www/egroupware
Header Username: root
Header Password: CHANGE
Enable MCrypt: Yes
Database instance (eGW domain): default
DB Type: MySQL
DB Host: localhost
DB Port: 3306
DB Name: egroupware_example_com
DB User: egroupware
DB Password: CHANGE
Configuration User: root
Configuration Password: CHANGE
write ->

vi /var/www/egroupware/header.inc.php
$GLOBALS['egw_domain']['example.com'] = array(
http://localhost/egroupware/setup/
Setup/Config Admin Login
Step 1 - Simple Application Management: utf-8
Step 2 - Configuration ->
POP/IMAP mail server hostname or IP address: localhost
Mail server protocol: IMAP
Mail server login type: standard
Mail domain (for Virtual mail manager): example.com
SMTP server hostname or IP address: localhost
SMTP server port: 25
Select which type of authentication you are using: LDAP
Usernames are casesensitive: No
Auto create account records for authenticated users: Yes, with lowercase usernames
Auto-created user accounts expire: never
LDAP host: localhost
LDAP accounts context: ou=Users,dc=example,dc=com
LDAP groups context: ou=Groups,dc=example,dc=com
LDAP encryption type: MD5
Do you want to manage homedirectory and loginshell attributes?: Yes
LDAP Default homedirectory prefix: /home
LDAP Default shell: /bin/bash
Step 3 - Admin Account ->
root, root@example.com, CHANGE
http://192.168.93.125/egroupware/