You are here

Home ›

LDAP

NFSv4 + CacheFS with LDAP Single-Sign-On on Ubuntu 12.04 HOWTO

Submitted by hswong3i on Fri, 2013-01-18 16:03

Building LAMP cluster one of the key point is: how to synchronize file update among all servers for Apache? Here we have many choice, e.g. DRBD + OCFS2, iSCSI + OCFS2, CephFS, Rsync, etc; but one of the most simple solution is to use NFS for sharing master server's DocumentRoot, e.g. /home. For sure, we are not considering performance and bottleneck here.

This HOWTO will guide you though installation of NFSv4 server and client on Ubuntu 12.04. In order to make uid/gid mapping works, we will reference Single-Sign-On (SSO) setup with LDAP in previous HOWTO. We will also utilize CacheFS for improving the overall performance.

LDAP Single-Sign-On with Webmin on Ubuntu 12.04 HOWTO

Submitted by hswong3i on Tue, 2013-01-08 00:01

In order to setup a LAMP cluster we usually need a way to share the master server uid/gid with other else member servers, for whatever NFS shared home directory, or running Apache2 + PHP5 in suexec style. Using LDAP + Webmin can simplify this Single-Sign-On (SSO) need in a handy way.

This HOWTO will guide you though installation of Webmin and OpenLDAP server, then use it as SSO between 2 server with nss-pam-ldapd. First of all let's fouce on making it works, and then enhence it with better security.

Exim4-LDAP 0.0.7 released

Submitted by hswong3i on Wed, 2009-09-16 01:21
Exim4-LDAP 0.0.7 is a development release, which fix a lot of hidden bugs, more comprehensive clone of Qmail-LDAP individual account features, better documentation and coding syntax, and even more. I am confident that the code is stable enough for wider testing by the community, download now. Spotlight changes include:
  • Add support with Qmail-LDAP accountStatus attribute.
  • Add support with Qmail-LDAP deliveryProgramPath attribute.
  • Activate home_directory in transport with relative patch support.
  • Add LDAP_MAILROOT support if homeDirectory is not absolute.
  • Debug program pipe transport.
  • Add sample LDIF for demo user demo@example.com.
  • Document installation guideline in INSTALL.
Please refer to /usr/share/doc/exim4-ldap/changelog.gz for complete changelog. Changes since 0.0.5:

Exim4-LDAP 0.0.5 initial released

Submitted by hswong3i on Mon, 2009-08-17 12:35
Exim4-LDAP is my latest development progress. It is a Debian package that depends on exim4-heavy-daemon and slapd, which utilize Qmail-LDAP schema as backend database schema for seamless migration. Unlink Qmail-LDAP which required for manual source patching and compile, Exim4-LDAP just define additional authentication/router/transfer rules within configuration files. The ultimate goal of this research project is going to integrate with Samba-LDAP-PAM (for both Windows/Linux Single-Sign-On), RADIUS (for other services SSO) and even other services such as webmail. The project is now hosting in SourceForge.net with .deb available, download now. Here I will draft some simple installation guideline which not yet included in source package document. I am now testing this with a newly installed Debian Lenny sandbox.

Configurate OpenLDAP in mirror mode replication

Submitted by hswong3i on Thu, 2009-08-06 16:47
I am going to share some user account & directory with NFS among 2~3 servers. Traditionally we can use NFS+NIS solution, but I would like to try out NFS+LDAP+PAM/NSS plus OpenLDAP mirror mode replication.
For LDAP + PAM/NSS, please refer to my other article: LDAP + Samba PDC + PAM/NSS on Debian Lenny HOWTO

Add OpenLDAP mirror mode replication to existing server

Courier LDAP authentication with qmail.schema

Submitted by hswong3i on Sat, 2009-07-04 11:43

Need to include qmail.schema into your slapd.conf, and add object class qmailUser with mail attribute to user object. phpldapadmin can assist most of this setup.

For login from external MUA, e.g. Thunderbird:

  • username: postmaster (NOTE: not postmaster@example.com, we have no virtual domain support right now)
  • password: your_password

Some code snippet for Courier LDAP authentication with qmail.schema.
/etc/courier/authldaprc:

LDAP for Rocket Scientists

Submitted by hswong3i on Fri, 2009-07-03 16:56

Still reading...
http://www.zytrax.com/books/ldap/

P.S. Already able to authenticate Courier and Exim4 with LDAP, but now thinging about multiple virtual domain implementation. Need to consider both Samba, Exim4, Courier and eGroupWare (WOW!) requirement... E.g. Multiple DN is not allowed in Courier ldapauth... May be clone eGroupWare design? From egroupware/addressbook/doc/README:

Temperary Exim4 SASL AUTH solution with LDAP-Samba-PAM/NSS + Courier authpam module

Submitted by hswong3i on Sat, 2009-06-20 12:52

Recall to my previous Exim4 + Courier + SSL on Debian etch mini-HOWTO, Exim4 authentication should work fine without enable plain_courier_authdaemon and login_courier_authdaemon support. But case will become a bit more complicated when using LDAP-Samba-PAM/NSS setup: LDAP user will now not able to be authenticated. Why and what's up!?

eGroupWare + smbldap-tools integration with SQL hack

Submitted by hswong3i on Mon, 2009-02-23 04:08
By default, smbldap-populate will add groups 'Domain User' with gidnumber 513, and 'Administrators' with gidnumber 544. This can map with eGroupWare's default groups 'Default' and 'Admins'. On the other hand, smbldap-populate will add default administrator account 'root' with uidnumber 0, where it is invalid for eGroupWare (eGroupWare count account id with AUTO_INCREMENT, where starting from 1 and so 0 is invalid). We need some tricks in order to integrate them:

Main difference between nis.schema and rfc2307bis.schema

Submitted by hswong3i on Sat, 2009-02-21 02:55
I give some indeed study for eGroupWare + LDAP, compare its use between nis.schema and rfc2307bis.schema, slapcat and diff their result: @@ -65,13 +65,15 @@ modifyTimestamp: 20090220182044Z dn: cn=Default,ou=Group,dc=example,dc=com objectClass: top objectClass: posixGroup +objectClass: groupOfNames gidNumber: 1 cn: Default -structuralObjectClass: posixGroup +structuralObjectClass: groupOfNames entryUUID: f627d08e-93c6-102d-9537-29575a5ac953 creatorsName: cn=admin,dc=example,dc=com createTimestamp: 20090220182056Z memberUid: postmaster memberUid: tester

Pages

Subscribe to RSS - LDAP

Recent comments

Who's online

There are currently 0 users online.

DA-individual-120.png