Projekt SSO - Revision history

Joachim: /* Join a Machine */

2014-04-15T15:57:39Z

Join a Machine

← Older revision		Revision as of 15:57, 15 April 2014
Line 189:		Line 189:
	After that, I tried to add the VM to the domain, but it tried to connect to an AD.		After that, I tried to add the VM to the domain, but it tried to connect to an AD.
	Then I set the WINS server in the VM network card settings. Now it failed with "could not reach the domain".		Then I set the WINS server in the VM network card settings. Now it failed with "could not reach the domain".

			This worked, but what is the effect?

			job2 $ sudo net -I 192.168.1.9 rpc join bdc -U root%thepassword
			Joined domain JOB.

Joachim: /* Make Domain JOB */

2014-04-15T14:46:49Z

Make Domain JOB

← Older revision		Revision as of 14:46, 15 April 2014
Line 172:		Line 172:
	ldap ssl = off		ldap ssl = off
	passdb backend = ldapsam:ldap://127.0.0.1		passdb backend = ldapsam:ldap://127.0.0.1

			==== Join a Machine ====

			This has never worked so far, but what I tried is this:

			Create a machine account with yast. Important is, it is created as ldap user with $ at the end. I.e. for vm job8 I tried job8$ and JOB8$. Shell can be /bin/false and home an empty directory

			Once this user existed, I could do this on the DC (it fails if the ldap user is not present).

			/mnt/ext/opt/samba/bin/net smbpasswd -a -m job8

			or uppercased

			/mnt/ext/opt/samba/bin/net smbpasswd -a -m JOB8

			After that, I tried to add the VM to the domain, but it tried to connect to an AD.
			Then I set the WINS server in the VM network card settings. Now it failed with "could not reach the domain".

Joachim: /* Samba */

2014-04-15T14:39:29Z

Samba

← Older revision		Revision as of 14:39, 15 April 2014
Line 150:		Line 150:
	This PDC of course must use the ldap backend for user management.		This PDC of course must use the ldap backend for user management.

	~~Let's see~~...		==== Make Domain JOB ====

			Not sure, but I think that makes the server a DC

			/etc/smb.conf

			[global]
			workgroup = job
			security = domain
			preferred master = yes
			domain master = yes
			local master = yes
			wins support = yes

			And this is for the ldap integration

			ldap admin dn = cn=admin,dc=job,dc=de
			ldap suffix = dc=job,dc=de
			ldap user suffix = ou=people
			ldap group suffix = ou=group
			ldap ssl = off
			passdb backend = ldapsam:ldap://127.0.0.1

Joachim: /* DNS */

2014-04-08T16:36:49Z

DNS

← Older revision		Revision as of 16:36, 8 April 2014
Line 141:		Line 141:

	How will the dhcp/dns handshake work?		How will the dhcp/dns handshake work?

			Since I currently not use samba 4 AD but samba 3 PDC/BDC I wont ned a dns for now.

			=== Samba ===

			Qnap 4.1 will include samba 4 with AD. But although it is already overdue, time to release could be long.
			Since domain config on qnap never quite worked for me, I'll try to setup a domain PDC manually now.
			This PDC of course must use the ldap backend for user management.

			Let's see...

Joachim: /* Useful commands */

2014-04-08T16:16:03Z

Useful commands

← Older revision		Revision as of 16:16, 8 April 2014
Line 104:		Line 104:
	show publicly accessible ldap database content without using ssl		show publicly accessible ldap database content without using ssl

	# configure /etc/openldap/ldap.conf		* configure /etc/openldap/ldap.conf
	uri ldap://qnap.job.de		uri ldap://qnap.job.de
	base dc=job,dc=de		base dc=job,dc=de
	TLS_CACERT /etc/ssl/certs/jba-pki-v2-ca.crt		TLS_CACERT /etc/ssl/certs/jba-pki-v2-ca.crt
	# execute search		* execute search
	ldapsearch -x		ldapsearch -x

Line 114:		Line 114:

	ldapsearch -ZZ -D "cn=admin,dc=job,dc=de" -W		ldapsearch -ZZ -D "cn=admin,dc=job,dc=de" -W

			if this does not work, try debug switch -d1 (<-- digit one)

	show base dn of ldap database		show base dn of ldap database

	ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts		ldapsearch -x -b ' ' -s base '(objectclass=*)' namingContexts

	add a key value pair to an ldap object (here homeDirectory)		add a key value pair to an ldap object (here homeDirectory)

	# create file test.ldap		* create file test.ldap
	dn: cn=jo,dc=job,dc=de		dn: cn=jo,dc=job,dc=de
	changetype: modify		changetype: modify
	add: homeDirectory		add: homeDirectory
	homeDirectory: /home/jo		homeDirectory: /home/jo
	# execute modify		* execute modify
	ldapmodify -ZZ -D "cn=admin,dc=job,dc=de" -W -f test.ldap		ldapmodify -ZZ -D "cn=admin,dc=job,dc=de" -W -f test.ldap

Joachim: /* Open LDAP */

2014-04-08T16:11:16Z

Open LDAP

@@ Line 29: / Line 29: @@
 For secure communication between LDAP server and client, an SSL connection can be used. This means we also need a key/certificate management. The same can be used for other services that use SSL, like HTTPS for webservers, remote mysql connections or openvpn.
-OpenLDAP can be run on the same host as samba or on a different host. I want to use the QNAP NAS since I expect it to have more uptime and I want to run the samba AD there too as soon as it is available. OpenLDAP is available as a QPKG on the NAS. But as a first step it is running on job4 now.
+OpenLDAP can be run on the same host as samba or on a different host. I want to use the QNAP NAS since I expect it to have more uptime and I want to run the samba AD there too as soon as it is available. OpenLDAP is available as a QPKG on the NAS. Suse usermanagement did not work with that. I had to copy the schemas from opensuse ldap to qnap and configure ldap to use them.
-Configuration with yast ldap client was easy once I discovered I had to use enumerate option in /etc/sssd/sssd.conf to enable getent for ldap users
+Configuration with yast ldap client then was easy once I discovered I had to use enumerate option in /etc/sssd/sssd.conf to enable getent for ldap users. The uri domain name needs to be the cn or an alternate subject of the openldap certificate on the qnap device.
 ==== /etc/sssd/sssd.conf ====
@@ Line 42: / Line 46: @@
   [nss]
   filter_groups = root
   filter_users = root
   [pam]
   [domain/default]
-  ldap_uri = ldap://ldap.banzhaf.chickenkiller.com
+  ldap_uri = ldap://qnap.job.de
-  ldap_search_base = dc=job2
+  ldap_search_base = dc=job,dc=de
   ldap_schema = rfc2307bis
   id_provider = ldap
@@ Line 56: / Line 61: @@
   enumerate = True
   cache_credentials = True
   chpass_provider = ldap
   auth_provider = ldap
 ==== /etc/nsswitch.conf ====
@@ Line 67: / Line 84: @@
   group:   compat sss
   ...
 ==== phpLdapAdmin ====
@@ Line 87: / Line 99: @@
   smbclient -c ls -W job -U ldaptest //qnap/Download
 The homedirectory is not created this way. Try yast?
 === Certificate Management (PKI) ===

Joachim: /* phpLdapAdmin */

2014-04-05T23:53:27Z

phpLdapAdmin

← Older revision		Revision as of 23:53, 5 April 2014
Line 75:		Line 75:
	==== phpLdapAdmin ====		==== phpLdapAdmin ====

	Config in /share/MD0_DATA/.qpkg/OpenLDAP/phpldapadmin/config/config.php		Config in
			/share/MD0_DATA/.qpkg/OpenLDAP/phpldapadmin/config/config.php
	Can create samba user with samba3 schema.		Can create samba user with samba3 schema.
	The user needs to change pwd ~~beforee~~ use: job4:~ # smbpasswd -r qnap -U ldaptest		The user needs to change pwd before use:
			job4:~ # smbpasswd -r qnap -U ldaptest
	It may be required to add the user to share sections in /etc/smb.conf. @"everyone" only includes local users, not ldap		It may be required to add the user to share sections in /etc/smb.conf. @"everyone" only includes local users, not ldap
	read list = @"everyone"		read list = @"everyone"
Line 84:		Line 86:
	Then this works		Then this works
	smbclient -c ls -W job -U ldaptest //qnap/Download		smbclient -c ls -W job -U ldaptest //qnap/Download
	The homedirectory is not created ~~(try useradd@job4)~~.		The homedirectory is not created this way. Try yast?

	=== Certificate Management (PKI) ===		=== Certificate Management (PKI) ===

Joachim: /* Samba 4 */

2014-04-05T23:35:33Z

Samba 4

← Older revision		Revision as of 23:35, 5 April 2014
Line 1:		Line 1:
	= ~~Samba 4~~ =		= SSO =

	Goal is to have single signon (SSO) with open source software for as much services as possible.		Goal is to have single signon (SSO) with open source software for as much services as possible.
	Since SSO for windows services needs a windows domain controller and Samba 4 provides one, this seems to be the only way to go.		Since SSO for windows services needs a windows domain controller and Samba provides one, this seems to be the only way to go.

	In the end, I want all services to be run on the low power QNAP NAS. This is not possible yet, because ~~samba 4~~ will only be available on the next QNAP OS 4.1.		In the end, I want all services to be run on the low power QNAP NAS.
	In the meantime I'll implement it on the opensuse server.		This is not possible yet, because QNAP as PDC will only be available on the next QNAP OS 4.1.
			In the meantime I'll implement this part on the opensuse server.

	== SSO Services ==		== SSO Services ==
Line 66:		Line 67:
	group: compat sss		group: compat sss
	...		...

			==== LDAP Schemas ====

			The qnap device and openSUSE need different (incompatible?) schemas.
			Since I could not manage users with yast with the qnap schemas, I copied the suse schemas over and used them.

			==== phpLdapAdmin ====

			Config in /share/MD0_DATA/.qpkg/OpenLDAP/phpldapadmin/config/config.php
			Can create samba user with samba3 schema.
			The user needs to change pwd beforee use: job4:~ # smbpasswd -r qnap -U ldaptest
			It may be required to add the user to share sections in /etc/smb.conf. @"everyone" only includes local users, not ldap
			read list = @"everyone"
			write list = "admin","joachim","julian","caro"
			valid users = "root",@"everyone","admin","joachim","julian","caro","ldaptest"
			Then this works
			smbclient -c ls -W job -U ldaptest //qnap/Download
			The homedirectory is not created (try useradd@job4).

	=== Certificate Management (PKI) ===		=== Certificate Management (PKI) ===
Line 73:		Line 92:
	=== DNS ===		=== DNS ===

	Samba needs a domain name service. I have no idea why, but it has an internal dns activated by default, so I'll use that.		Samba 4 needs a domain name service. I have no idea why, but it has an internal dns activated by default, so I'll use that.
	Implication: change used dns at least on the windows pc's from my router to the samba server. The samba server then forwards to the router, if necessary.		Implication: change used dns at least on the windows pc's from my router to the samba server. The samba server then forwards to the router, if necessary.

	How will the dhcp/dns handshake work?		How will the dhcp/dns handshake work?

Joachim: Joachim moved page Projekt Samba 4 to Projekt SSO without leaving a redirect: samba 4 not necessarily used

2014-04-05T23:19:50Z

Joachim moved page Projekt Samba 4 to Projekt SSO without leaving a redirect: samba 4 not necessarily used

← Older revision	Revision as of 23:19, 5 April 2014
(No difference)

Joachim: /* Open LDAP */

2014-04-01T17:27:45Z

Open LDAP

@@ Line 24: / Line 24: @@
 === Open LDAP ===
 Open ldap provides user management, but can also be used for many other things, like certificate store or address management.
 For secure communication between LDAP server and client, an SSL connection can be used. This means we also need a key/certificate management. The same can be used for other services that use SSL, like HTTPS for webservers, remote mysql connections or openvpn.
-OpenLDAP can be run on the same host as samba or on a different host. I want to use the QNAP NAS since I expect it to have more uptime and I want to run the samba AD there too as soon as it is available. OpenLDAP is available as a QPKG on the NAS.
+OpenLDAP can be run on the same host as samba or on a different host. I want to use the QNAP NAS since I expect it to have more uptime and I want to run the samba AD there too as soon as it is available. OpenLDAP is available as a QPKG on the NAS. But as a first step it is running on job4 now.
 === Certificate Management (PKI) ===