Home / server / Questions / 6642
Accepted
Dave Cheney
Asked: 2009-05-10 07:12:34 +0800 CST

Automated configuration of ldap authentication for RHEL5 servers

  • 772

I use puppet for managing our production servers. Under rhel5 the standard way of enabling ldap is to use the authconfig tool. Which works successfully, but isn't really capable with the puppet way of doing things. If I were to have puppet make the relevant edits to the authentication config files, which ones should I change ? Off the top of my head the files I know that need editing to enable ldap authentication are

/etc/ldap.conf
/etc/nsswitch.conf

But there may also be pam config files which I am not suer about

redhat ldap

7 Answers

  1. Best Answer

    I typically edit:

    /etc/ldap.conf
/etc/nsswitch.conf
/etc/openldap/ldap.conf (check for certs if necessary)
/etc/pam.d/system-auth

    I think that covers the necessary evils. Might need /etc/sudoers as well.

    • 3

  2. My preference is to manage /etc/sysconfig/authconfig (which contains a list of vars) then use authconfig --updateall, this lets me drop 1 file that controls everything.

    • 3

  3. I'm not sure about any RedHat specific configurations, but take a look at this LDAP configuration guide.

    Basically, besides the files you mention, you should also configure PAM like so:

    auth       required     pam_env.so
auth       sufficient   pam_unix.so likeauth nullok
auth       sufficient   pam_ldap.so use_first_pass
auth       required     pam_deny.so

account    sufficient   pam_unix.so
account    sufficient   pam_ldap.so
account    required     pam_ldap.so

password   required     pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3    
password   sufficient   pam_unix.so nullok md5 shadow use_authtok
password   sufficient   pam_ldap.so use_first_pass
password   required     pam_deny.so
    • 1

  4. Our script to set up ldap auth (which invokes authconfig) modifies these files:

    /etc/rc.d/init.d/iptables (rearrange the chkconfig priority)
/etc/gshadow
/etc/ssh/sshd_config
/etc/ldap.conf
/etc/pam.d/login
/etc/pam.d/sshd
/etc/group
    • 1

  5. Slightly off-topic, but something that can be helpful when setting up PAM for ldap auth is to automatically create user home directories when they log into a server for the first time.

    If you are setting up ldap in system-auth file, then add the following to "session":

    session          required        pam_mkhomedir.so skel=/etc/skel umask=0077

    On a RHEL5 server, I have this after "session require pam_limits.so" (3rd "session" config param).

    as per tucker's suggestion above, puppet is a great tool for managing configs across multiple servers.

    • 1
    • 0

  7. Use authconfig-tui on one client to create the necessary files (ldap.conf, krb5.conf, pam.d/system-auth-ac etc), then copy those files into your puppet install and use puppet to push the files to all new and existing servers.

    If you have a significant number of servers and you're not using puppet, you should consider it.

    • 0