Scribd
Upload
53 views

Oleh: Idris Winarno

This document provides instructions for configuring LDAP on a server. It describes how to install and configure the LDAP server software slapd, configure the LDAP client libraries libnss-ldap and libpam-ldap, migrate existing user and group data into the LDAP database, secure the LDAP server with SSL/TLS encryption, and integrate LDAP with Apache web server authentication. The key steps include installing LDAP packages, configuring slapd.conf, migrating user data using migration tools, adding SSL certificates, and modifying Apache configuration to use LDAP authentication.

Uploaded by

and1delc
Copyright
© Attribution Non-Commercial (BY-NC)
Available Formats
Download as PDF, TXT or read online on Scribd
53 views

Oleh: Idris Winarno

This document provides instructions for configuring LDAP on a server. It describes how to install and configure the LDAP server software slapd, configure the LDAP client libraries libnss-ldap and libpam-ldap, migrate existing user and group data into the LDAP database, secure the LDAP server with SSL/TLS encryption, and integrate LDAP with Apache web server authentication. The key steps include installing LDAP packages, configuring slapd.conf, migrating user data using migration tools, adding SSL certificates, and modifying Apache configuration to use LDAP authentication.

Uploaded by

and1delc
Copyright
© Attribution Non-Commercial (BY-NC)
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 21

LDAP

Oleh:
Idris Winarno
persiapan dan installasi paket
z apt-get remove --purge slapd ldap-utils libnss-ldap
libpam-ldap nscd migrationtools phpldapadmin
openssl
z rm -r /var/db
z apt-get install slapd ldap-utils libnss-ldap libpam-
ldap nscd migrationtools phpldapadmin openssl
Configurasi slapd
z masukkan password admin untuk slapd (harus di
ingat passwordnya!!!!!)
configurasi libnss-ldap
z URI untuk libnss-ldap: ldapi:///
configurasi libnss-ldap
z base domain: eepis-its.edu --> dc=eepis-its,dc=edu
configurasi libnss-ldap
z LDAP v3
configurasi libnss-ldap
z LDAP account for root: cn=admin,dc=eepis-
its,dc=edu
configurasi libpam-ldap
z Password for libpam-ldap root (harus di ingat
passwordnya !!!)
configurasi libpam-ldap
z LDAP account for root (libpam-ldap):
cn=admin,dc=eepis-its,dc=edu
configurasi libnss-ldap
z Password root untuk LDAP (harus di ingat
passwordnya !!!!)
configurasi libpam-ldap
z Make local root database: Yes
configurasi libpam-ldap
z Does the LDAP database require login: No
configurasi slapd.conf
z Edit /etc/ldap/slapd.conf
z Uncomment rootnd
z tambahkan rootpw (password) dibawah rootdn
Migrasi
z cd /usr/share/migrationtools
z Edit migrate_common.ph
$DEFAULT_MAIL_DOMAIN = "eepis-its.edu";
$DEFAULT_BASE = "dc=eepis-its,dc=edu";
z ./migrate_base.pl > /tmp/base.ldif
z ./migrate_passwd.pl /etc/passwd /tmp/passwd.ldif
z ./migrate_group.pl /etc/group /tmp/group.ldif
z /etc/init.d/slapd restart
menambahkan database ldap
z buka file /tmp/base.ldif dan hapus 4 baris pertama
z ldapadd -x -W -D ‘cn=admin,dc=eepis-its,dc=edu’ < /tmp/base.ldif
z ldapadd -x -W -D ‘cn=admin,dc=eepis-its,dc=edu’ < /tmp/passwd.ldif
z ldapadd -x -W -D ‘cn=admin,dc=eepis-its,dc=edu’ < /tmp/group.ldif
z cp -p /usr/share/doc/libpam-ldap/examples/pam.d/* /etc/pam.d
z apt-get install libpam-cracklib
z ln -s /lib/security/pam_unix.so /lib/security/pam_pwdb.so
Catatan: bisa juga menggunakan fasilitas import pada phpldapadmin
konfigurasi ldap client
z echo > /etc/pam_ldap.conf
z vim /etc/pam_ldap.conf
base dc=eepis-its,dc=edu
uri ldap://127.0.0.1/
ldap_version 3
rootbinddn cn=admin,dc=eepis-its,dc=edu
port 389
pam_password crypt
z cp /etc/pam_ldap.conf /etc/libnss-ldap.conf
z /etc/init.d/slapd restart
z /etc/init.d/nscd restart
Testing
z su – username
Debugging
z /etc/init.d/slapd stop
z slapd -u openldap -g openldap -d 999
LDAP + openSSL
z mkdir /etc/ldap/ssl
z cd /etc/ldap/ssl
z openssl req -new -x509 -nodes -out ldap.pem -
keyout ldap.pem -days 3650
z chmod 640 /etc/ldap/ssl/ldap.pem
z chmod 750 /etc/ldap/ssl
z chown -R root:openldap /etc/ldap/ssl
LDAP + openSSL
z Tambahkan konfigurasi berikut bagian paling atas
dari /etc/ldap/slapd.conf

TLSCACertificateFile /etc/ldap/ssl/ldap.pem
TLSCertificateFile /etc/ldap/ssl/ldap.pem
TLSCertificateKeyFile /etc/ldap/ssl/ldap.pem
TLSCipherSuite HIGH:+MEDIUM:!LOW
SSLVerifyClient none
LDAP + openSSL
z Edit file /etc/ldap/slapd.conf sehingga menjadi
access to attrs=userPassword,shadowLastChange
by tls_ssf=128 ssf=128 dn=”cn=admin,dc=example,dc=net” write
by tls_ssf=128 ssf=128 anonymous auth
by tls_ssf=128 ssf=128 self write
by * none

dan juga

access to *
by tls_ssf=128 ssf=128 dn=”cn=admin,dc=example,dc=net” write
by * read
Restart service slapd
Tugas
z Integrasikan LDAP dengan apache2

You might also like