SWL Network (II): Ubuntu 12.04 and ClearOS. LDAP authentication

Hello friends!. It is about making a network with several desktops with Ubuntu 12.04 Precise Pangolin, and the versatile server clearOS. In other words, a network with exclusively Free Software.

It is essential to read before:

• Introduction to a Network with Free Software (I): Presentation of ClearOS

We will see:

• Example network
• We prepare our Ubuntu
• We configure the LDAP client

Example network

• Domain Controller, DNS, DHCP: ClearOS Enterprise 5.2sp1.
• Controller Name: centos
• Domain Name: friends.cu
• Controller IP: 10.10.10.60
• ---------------
• Ubuntu version: Ubuntu Desktop 12.04.2 Precise.
• Name of the team: need
• IP adress: Using DHCP
  

We prepare our Ubuntu

We modify the file /etc/lightdm/lightdm.conf to accept manual login, and we leave you with the following content:

[SeatDefaults] greeter-session = unity-greeter user-session = ubuntu greeter-show-manual-login = true greeter-hide-users = true allow-guest = false

After saving the changes, we restart the lightdm in a console invoked by Ctrl+Alt+F1 and in it we execute, after logging in, sudo service lightdm restart.

We configure the LDAP client

We must have the OpenLDAP server data at hand, which we obtain from the administration web interface in «Directory »->« Domain and LDAP«:

LDAP Base DN: dc = friends, dc = cu LDAP Bind DN: cn = manager, cn = internal, dc = friends, dc = cu LDAP Bind Password: kLGD + Mj + ZTWzkD8W

We install necessary packages:

sudo apt-get install ldap-auth-client finger

During the installation process they will ask us several questions, which we must answer correctly. The answers would be in the case of this example:

LDAP server Uniform Resource Identifier: ldap: //10.10.10.60 Distinguished name of the search base: dc = friends, dc = cu LDAP version to use: 3 Make local root Database admin: Yes Does the LDAP database require login? No LDAP account for root: cn = manager, cn = internal, dc = friends, dc = cu LDAP root account password: kLGD + Mj + ZTWzkD8W

If we are wrong in the previous answers, we execute:

dpkg-reconfigure ldap-auth-config

## Replies
LDAP server Uniform Resource Identifier: ldap: //10.10.10.60 Distinguished name of the search base: dc = friends, dc = cu LDAP version to use: 3 Make local root Database admin: Yes Does the LDAP database require login? No LDAP account for root: cn = manager, cn = internal, dc = friends, dc = cu LDAP root account password: kLGD + Mj + ZTWzkD8W Local crypt to use when changing passwords: md5

We modify the file /etc/nsswitch.conf, and we leave it with the following content:

# /etc/nsswitch.conf # # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference 'and` info' packages installed, try: # `info libc" Name Service Switch "'for information about this file. passwd:         compat ldap
group:          compat ldap
shadow:         compat

hosts: files mdns4_minimal [NOTFOUND = return] dns mdns4 networks: files protocols: db files services: db files ethers: db files rpc: db files netgroup: nis

We modify the file /etc/pam.d/common-session so that it automatically creates the user folders when logging in, in case they don't exist:

[----]
session required pam_mkhomedir.so skel = / etc / skel / umask = 0022

### The above line must be included BEFORE
# here are the per-package modules (the "Primary" block) [----]

We run on a console, Just to Check, pam-auth-update:

We do checks:

: ~ $ finger strides
Login: strides Name: Strides El Rey Directory: / home / strides Shell: / bin / bash Never logged in. No mail. No Plan. : ~ $ sudo getent passwd strides
Strides: x: 1006: 63000: Strides El Rey: / home / strides: / bin / bash: ~ $ sudo getent passwd legolas
legolas: x: 1004: 63000: Legolas The Elf: / home / legolas: / bin / bash

We restart our Ubuntu because the changes made are essential:

sudo reboot

After rebooting, we can log in with any user registered in ClearOS OpenLDAP. It may take time to log out when we end it for the first time.

We recommend that then the following is done:

• Make external users a member of the same groups that the local user created during the installation of our Ubuntu belongs to.
• Using the command visudo, executed as root, give the necessary execution permissions to external users.
• Create a bookmark with the address https://centos.amigos.cu:81/?user in Firefox, to have access to the personal page in ClearOS, and to be able, in addition to changing our password, modify or add data to our user profile.
• Install the OpenSSH-Server to be able to access our Ubuntu from another computer.

A few final questions to Ubuntu users:

• Why is it installed by default with the root user without password?
• Why in your Server version, by default, I can use aptitude or apt-get, while by default in your Desktop version, I can only use apt-get, and if I want to use aptitude should I install it?
• Why is AppArmor installed on by default? Red Hat and derivatives allow you to select Selinux enabled or not.
• Why don't you use the / etc / inittab file that is widely accepted by other GNU / Linux distributions and very comfortable when we need to implement a Remote Access Server?

And the activity is over for today, Friends !!!