Editing Category:Installation/Openldap server Installation RHEL6

[[category:Installation]]


=== Openldap 2.4 for RHEL6 (This is different from earlier versions of OPENLDAP )===

This Document was prepared while migrating the MDI Qmail Server to RHEL 6 Platform 

 
=Basic Installation=

==Step 1- Yum install==

first we need to install the required packages

 yum install openldap-servers


==Step 2 - Basic Configuration==
As the configuration for LDAP is stored inside the LDAP server itself the configuration has to be done by editing LDIF files under the /etc/openldap/slapd.d/ directory.


==Step 3 - Create LDAP Password==

Create the ldap password:


 slappasswd some_password_text


you’ll get something like this ”{SSHA}4+B3B1p3LlDAApcill87VXFD80jbgX8U” as a result. This is the string we will have to add to the bdb.ldif config file.


 vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}bdb.ldif
 substitute my-domain.com with yourdomain.com 
 :%s/dc=my-domain,dc=com/dc=mdi,dc=ac,dc=in/g

==Step 4 -Setup Admin Password and Certificates==

We now  set the admin password and specify the location of our encryption certificate and key.

Add these 3 lines at the end of the file bdb.ldif file:

 olcRootPW: {SSHA}4+B3B1p3LlDAApcill87VXFD80jbgX8U
 olcTLSCertificateFile: /etc/pki/tls/certs/slapdcert.pem
 olcTLSCertificateKeyFile: /etc/pki/tls/certs/slapdkey.pem

==Step 5- Admin Privileges==


Now we have to specify the Admin privileges


 vim /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{2\}monitor.ldif

Again, we have to replace the default domain name with our domain name

 :%s/cn=manager,dc=my-domain,dc=com/cn=Manager,dc=mdi,dc=ac,dc=in/g


==Step 6 - Further Configuration==

Now copy data base configuration file 

 cp /usr/share/doc/openldap-servers-2.4.19/DB_CONFIG.example /var/lib/ldap/DB_CONFIG
 chown -Rf ldap:ldap /var/lib/ldap/


==Step 7 - Certificate creation ==

Now we will need to set up a certificate for TLS. First we need to edit /etc/sysconfig/ldap and change SLAPD_LDAPS from no to yes.

 vi /etc/sysconfig/ldap
 SLAPD_LDAPS=yes

Now we can create the Self Sign certificate 10 years 

 openssl req -new -x509 -nodes -out /etc/pki/tls/certs/slapdcert.pem -keyout /etc/pki/tls/certs/slapdkey.pem -days 3650


This will create the two required keys in the /etc/pki/tls/certs/ directory. We need to make them readable for the ldap user.

 chown -Rf root:ldap /etc/pki/tls/certs/$cert.pem
 chmod -Rf 750 /etc/pki/tls/certs/$key.pem

==Step 8 - Importing .schema Files ==

Copy qmail.schema (ldif) files to /etc/openldap/slapd.d/cn\=config/cn\=schema/

All ldif files are  sequential wise so copy with sequence

Edit ldif file according to the sequence number

 dn: cn={12}qmail
 objectClass: olcSchemaConfig
 cn: {12}qmail


Now restart ldap

 /etc/init.d/slapd start


(Error : inconsistent duplicate attribute type "mailHost")

'''Resolution :''' 

Edit file : /etc/openldap/slapd.d/cn=config/cn=schema/cn={*}misc.ldif

Remove this line

 olcAttributeTypes: {1}( 2.16.840.1.113730.3.1.18 NAME 'mailHost' DESC 'FQDN of
 the SMTP/MTA of this recipient' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} SINGLE-VALUE )

and remove “mailHost” entry from olcObjectClasses.
 
Again restart ldap

==Step 8 - Assigning Admin rights ==
 
Copy all Acl's to /etc/openldap/slapd.d/cn\=config/olcDatabase\=\{1\}bdb.ldif

 olcAccess: to *
            by * write
            by * read
 olcAccess: to attrs=userPassword,sambaLMPassword,sambaNTPassword
        by * write
        by * auth
 olcAccess: to *
               by dn="uid=admin,ou=mdi.ac.in,dc=mdi,dc=ac,dc=in" write
               by * read
 olcAccess: to dn="cn=(.*),ou=(.*),dc=mdi,dc=ac,dc=in" attrs=mailforwardingaddress attrs=deliveryMode
               by self write
               by * read
               by anonymous auth
 olcAccess: to * by dn="uid=admin,ou=mail,dc=mdi,dc=ac,dc=in" write
             by * read
 olcAccess: to attrs=userPassword
             by dn="uid=dovecot,ou=mail,dc=mdi,dc=ac,dc=in,dc=com" read
             by dn="uid=admin,ou=mail,dc=mdi,dc=ac,dc=in" write
             by anonymous auth


Again restart ldap

==Step 9 - LDAP Population of Users==

Add all users from existing ldif file from Live server 

 ldapadd -x -D"cn=Manager,dc=mdi,dc=ac,dc=in" -w secret -f newmdi.ldif

where newmdi.ldif is sample ldif file having users , In our case we have used the imported files from the old server (openldap-2.3.x)

=How to take backup of ldap users =

 ldapsearch -x -D”cn=Managerdc=mdi,dc=ac,dc=in” -w secret -LLL > newmdi.ldif

edit ldap.conf

vim /etc/openldap/ldap.conf

 HOST 127.0.0.1
 BASE dc=mdi,dc=ac,dc=in


=Testing ldap server =


1.ldapsearch -x |less

2.ldapsearch -x -D”cn=Manager,dc=mdi,dc=ac,dc=in” -w secret |less

3.Test with change password using ldapmodify

4.Also login on phpldapadmin with admin user and check password will change or not

5.Check on squirrelmail , user's are able to change own password or not