Ubuntu Security :: Ldap Authentication And Auto-homedirs For Desktop Machines?
Aug 12, 2010
Set up a lab full of Lucid boxes that authenticate against the main university Sun ldap server and create local, limited, homedirs if they don't already exist.
The ldap server is freely accessible on our network and does not require authentication to do a query. Users will not be able to make changes on the ldap server from these workstations. I cannot set up homedirs of users manually - any one of 15,000 people could walk in and use one of these machines.
What I've got working so far: Authentication works, but when I log in through GDM, after a few errors, I get nothing but a blank desktop (with wallpaper and cursor). If I log in as a local user and su to an ldapuser I get assigned a home directory at /, which explains the errors; this kind of user can't write to /. I've seen posts on this but nothing that works for me.
The problem, as I've identified it: I'm using pam_mkhomedir to create home directories on first login, but I don't seem to have any way of telling pam_mkhomedir *where* to create the home directories. I've tried to use the nss_map_attribute in /etc/ldap.conf (like this: nss_map_attribute homeDirectory "/home/users/"uid), but my syntax is all guesswork - I can't seem to find anyone else trying to mangle a homedir this way.
Most either don't deal with the homedir thing at all, or if they do, they only cover nfs/smb shares.
View 3 Replies
ADVERTISEMENT
Dec 10, 2009
I wish to setup a network that works like windows but for with lunix of course!. It will need to be able to handle security/DNS/DHCP & Document store from one location. I've been doing some reading and have found that I think I need to be using one of the following:
LDAP
NIS
Kerberos
I have looked at a few Linux based OS's. I did notice that when you install fedora live desktop it gives you the option to connect to one of the above. So I am looking for a complete solution.
1. How to setup fedora to act as server for my needs (or other Linux build)
2. Add fedora/linux mint machines to server to use new security settings. (or other linux build)
View 3 Replies
View Related
Jun 10, 2010
By fiat I must distribute my homedirs across multiple physical disks/partitions. Unfortunately this is not open to discussion so obvious solutions like a lvm home partition are not available to me. The issue: Users created with homedirs on the main home partition (the one created as home during the f13 install) behave as expected, but if I create them on a different partition (home9 for the sake of this example) the users are not able to login (dropped back to login screen), nor run x-apps if su -'d to in a konsole.
If I 'su - <user-on-home9>' in a konsole, I get delivered to the /home9/<user-on-home9> as expected, but x-apps fail with the error: 'cannot open display: :0'. This can be temporarily fixed with the command 'xhost +SI:localhost:<user-on-home9>', but I would rather fix it permanently at the source.
This appears to be an selinux problem from the following.The contexts of the the two rootdirs are the same
% ls -Zd /home /home9
drwxr-xr-x. root root system_u:object_r:home_root_t:s0 /home
drwxr-xr-x. root root system_u:object_r:home_root_t:s0 /home9
but when I create the users (using useradd or the gui) their respective contexts differ:
% ls -Zd /home/user5 /home9/user6
[Code]...
So, my questions for you selinux experts are 1) is it possible to have homedirs spread across multiple partitions with selinux, and if so, how, 2) Why, even when I manually set the dir/file contexts to match a properly functioning user5 from /home, do users from /home9 still not work (as far as login and x-apps).
View 8 Replies
View Related
Apr 5, 2010
i have successful secure ldap replication but i could not make ldap client to direct its authentication to slave ldap
here is my config file on ldap client (i am not sure if it is the right place though)
ip : 192.168.1.183 is master ldap
ip : 192.168.1.185 is slave ldap
pico /etc/ldap/ldap.conf
#
# LDAP Defaults
code....
View 11 Replies
View Related
May 25, 2011
I am using RackMonkey to map out my lab. Unfortunately, due to RM limitations, every user who accesses the site has write access UNLESS they are logged in as a user named "guest". I currently have Apache allowing only the users (sysadmins) in an LDAP group access to RM, but I would like to allow read-only access for other users as well.I found mod_authn_anon, but I am having trouble combining the two authentication methods. I am using Apache 2.2.18 (compiled myself) on SLES 11.1.
This is the common part:
Code:
AuthType Basic
AuthBasicProvider ldap anon
Order allow,deny
Allow from all
This part by itself works for the LDAP authentication:
Code:
AuthName "System Admins"
AuthLDAPURL "ldaps://example.com/ou=ldap,o=example.com?mail" SSL
Require ldap-group cn=SysAdmins,ou=memberlist,ou=groups,o=example.com
This part works by itself for guest access:
Code:
Anonymous guest
Anonymous_VerifyEmail Off
Anonymous_MustGiveEmail Off
Anonymous_LogEmail on
Require valid-user
But if I have both of the previous blocks enabled at once, then guest access does not work. If I throw in a "Satisfy any", then I am not prompted for a username at all. How can I allow access to this LDAP group and to a user named "guest", but not allow all valid LDAP users to log in?
View 1 Replies
View Related
Oct 14, 2010
I have a home LAN server with Ubuntu Desktop edition 10.10 and I'm having a problem with remote desktop application. For now I have a monitor on that machine, but in the future it's gonna be only the box, without any periferal devices. When I try to log in via UltraVNC from Windows XP, on Ubuntu server a little window pops up, asking me to allow or refuse this "invader", so I click Allow and I really have full control on that machine. However, when I dont have any devices I wouldnt be able to click this Allow button, but will have to have full control. So, my question is how to autoclick this Allow button? Or when I try to log in the ubuntu machine, it would automatically give me full control?
View 5 Replies
View Related
Jan 10, 2010
I want to configure SSH key-based authentication and SSH password Authentication in same machine for different user .
View 1 Replies
View Related
Oct 18, 2010
Im an IT manager for a small company with a small ammount of users. We already use linux for our data server and I would like to implement a domain controller. All of our user machines are WIndows XP pro.
Ive been reading up on using OpenLDAP as an alternative to active directory.
What I want is just a simple active directory like server, with a GUI if possible.
What do I need to look at and how would I go about setting this up? Im fairly proficient with Ubuntu already, I just need to be pointed in the right direction.
Is it even possible to have my windows users be able to log in to their machines using an ubuntu domain controller?
View 1 Replies
View Related
Jun 23, 2010
I am trying to allow my freshly installed ubuntu 10.04 to authenticate with ldap. I did follow the doc https://help.ubuntu.com/community/LD...Authentication and some other hints with no success.My needs is just to use an ldap existing server (active directory in my site, but i wish to use it via ldap, not via samba/ winbind) to validate users on services using pam modules.After the package installation the command getent passwd retrieve just local users and I don't understand if my ubuntu client is not querying the server or the server reply with some message.
View 2 Replies
View Related
Sep 16, 2010
One I cant figure out is a problem of authentication. I'm using open ldap server and try to authenticate a groupware (simple groupware) against it. As it fails, I tested with a ldap client to understand things better. Using GQ ldap client, I 'm able to browse my ldap tree successfully and to search some args from the base DN i specified. but when entering the exact uid as a search string iI got no answer whereas searching the cn returns the correct entry (and display its related entry including the uid I can't find ..) Here is the only thing I can trace in logs (syslog) when trying to seach firstname.lastname (= uid)
[Code]....
View 1 Replies
View Related
Jan 17, 2011
I need to make a choice on what authentication protocol I want to use for Authentication and Authorization. I was looking at Radius and then literature suggested that Diameter was a better protocol. Keep in mind I need this on a hetrogeneous setup ( linux & windows together). Diameter seemed like a good fit until I discovered that the open source code no longer seems to be maintained ( C/C++).
I was also looking at Kerberos as an option though there is alot overhead with the server. SSL/TLS or EAP? I am looking for simple but secure and am new at the security protocols.
View 2 Replies
View Related
Jun 18, 2010
I've just installed Ubuntu Server for the first time with the goal as setting it up as a proxy server for our Apple computers here since I can get neither ISA of OS X Server's firewall to play properly. So far I have the machine authenticating against our OS X OpenLDAP server and multiple NIC's setup ready to be connected to the outside world. My question is does anyone have a preference on what proxy I should be using? So far my search efforts seem to of turned up Squid Proxy as a favorite among Ubuntu users but I can't seem to work out how to get it authenticating against my OpenLDAP server.
View 5 Replies
View Related
Mar 16, 2011
i am taking another stab at this. The last time i attempted it, it seemed like everyone had a different way to do it, but nobody could give me an answer on how to do it...
I currently have a Domain Controller Running sme server and a domain controller, using ldap as a backend. I have two file servers runing ubuntu 10.04. My overall goal is to have it so when i create a username on the domain controller, it is then automatically copied over to the fileservers. This way everyone will have their own username and password to access the fileservers and ill be able to track what people do on the fileservers.
The next necessity is for me to be able to apply permissions to the folders on the fileserver based on the users that are created on the domain controller.
View 2 Replies
View Related
Aug 26, 2011
LDAP Authentication for Web Access I am trying to build a LDAP server to allow access to the wireless network in conjunction with Meraki wireless access points. I am using Ubuntu 10.10 and trying to install OpenLDAP from their documentation but I keep running into the error "configure: error: MozNSS not found - please specify the location to the NSPR and NSS header files in CPPFLAGS and the location to the NSPR and NSS libraries in LDFLAGS (if not in the system location)" I have OpenSSL installed but I also got these when I ran ./configure
checking openssl/ssl.h usability... no
checking openssl/ssl.h presence... no
checking for openssl/ssl.h... no
checking gnutls/gnutls.h usability... no
[code]....
View 1 Replies
View Related
Jan 24, 2011
I have created a CA on my server then created a server certificate under that then exported it as a common server certificate.I have then gone to my LDAP server and enabled TLS and told it to use the common server certificate.Now on my client I have enabled LDAP TLS/SSL and it's asking me to download a certificate ... from where ? Do I export the certificate to a file and put it on a web server.If so what format as the export offers loads.
View 1 Replies
View Related
Jun 29, 2010
I'm trying to get LDAP working with 389 Directory Server on Fedora 13. I have the server all ready to go, and I can query it with the 389 console. But when I tried to move on to the next step, user authentication trough LDAP, it just won't work I followed the PAM Howto, but the given authconfig command doesn't work. If I manually add a user with the 389 console, I can't login with it.Since I had X11 forwarding working over SSH, I tried authconfig-gtk. I setup a SSL LDAP connection for this to work, but it still didn't work. I did have this working on my (now crashed ) Fedora 12 VM.
View 11 Replies
View Related
Dec 9, 2010
I installed Nconf software on a Debian server.I am trying to configure Nconf Authentication with LDAP.I edited nconf's authentication.php file accordingly and I installed php5-ldap package.When i enter user-name and password in Nconf's login screen.
View 1 Replies
View Related
Feb 9, 2011
I want to ask how many applications can we use with LDAP authentication
View 1 Replies
View Related
Dec 28, 2009
I've added a new machine (desktop used by many users) to a network that uses LDAP (pam_ldap) for authentication. Can anyone post relevant configs to limit users by a groupOfNames? I've googled extensively and have found some partial comments, but no complete config examples or howto's.
The issue is as follows:
All users have one primary GID in their posixAccount entries, which is used to control access to the existing machines. So it's not really possible to change this. Now, I need to limit access to this new machine to a specific subset of users, all members of a specific groupOfNames. I can't seem to get pam_ldap to use a groupOfNames instead of a posixGroup.
View 1 Replies
View Related
Jan 20, 2010
We have an LDAP server (OpenDirectory on Snow Leopard Server--OpenLDAP essentially) and I am trying to configure our slackware hosts to use that LDAP server as the authentication mechanism instead of NIS/YP as they currently do.How do I change it, and is it just as simple as changing /etc/nsswitch.conf?
View 11 Replies
View Related
Apr 14, 2010
I would like to know whether ldap can be used to authenticate wireless clients with my server.server and clients are connected to a wireless router and i am able to get wireless adapter work in my ubuntu. Is there any anything extra which is required or the openldap server will work for wireless clients?
View 1 Replies
View Related
Jul 18, 2010
I have tomcat installed with port forwarding to http port 80. I configure ldap authentication for apache2(/var/www). But I could not configure tomcat for ldap authentication.
View 1 Replies
View Related
Jul 22, 2010
Can any one tell me how to configure Tomcat ldap URL authentication perfectly?
I've tomcat installed with port forwarding to http(80).
I could able to confiure apache ldap authentication. For this i modified the file '/etc/apache2/sites-enabled/000-defaults' with the DocumentRoot /var/www.
But for tomcat '/usr/share/tomcat/webapps' I could not able to configure 'server.xml' file perfectly.
View 1 Replies
View Related
Aug 9, 2010
so I got bugzilla up and running (finally) on an ubuntu server...
but in order to use the ldap integration, you need:
Mozilla::LDAP (aka PerLDAP) Perl module
Mozilla/Netscape LDAP SDK
neither of which exist in the repositories, or anywhere on the internet. the best I could find was a request to build a package from over a year ago...
I did find source that I can build... the Perl module builds and starts to begin the setup process -- but I get stuck at the point where it requires the SDK... which I cannot find anywhere in a plain downloadable form. the one I found seems incomplete:
[URL]
View 1 Replies
View Related
Jan 6, 2011
I recently installed 32bit maverick and wanted to make it login automatically. I tried enabling auto login from Admin > Login but that didnt work and I was still prompted for my password. Then I went to Users & Groups and changed the password option to Do Not ask for password at login now after I reboot, the user list is shown (only 1 user) and it doesnt ask for password after I click on my username.
However, then it gives a few errors (as i vaguely recall):
1. cannot load .ICE directory in my home directory
2. some error 256 about a gconf-sanity-2 file
3. nautilus cannot load my home directory etc
and then it gets stuck without loading anything (blank wallpaper). i ve tried navigating to my home directory using Alt F2, gksudo nautilus and my home dir contents are encrypted by the ecryptfs (there is a readme.txt file and a shortcut). i have tried to decrypt but it doesnt work... i ve also tried to start/stop gdm, and startx but nothing works. if i stop gdm, then the prompt doesnt recognize my password and keeps on rejecting the commands i enter... I think this has something to do with the home dir not being decrypted due to the dont ask for paswd option... how can i disable the dont ask for pwd without the gui (i can access my / by booting through an external usb).
View 4 Replies
View Related
May 7, 2011
On this moment i configure a testenvironment with 1 Microsoft active directory server and 1 Opensuse 11 samba filesharing server. But i have a issue. The samba server is add to the domain and the servers can communicate with eachother. I can login to the domain on the samba server and the LDAP settings tab on yast2 samba configuration tool tell me that samba and the MS LDAP server can communicate with eachother. I can see the shares on the samba server but i can't autenticate myself. When i whant to logon than see i always "domain: domainname.local" and "access denied". My question is now how can i give the MS administrator account rights to view the shares and configure the rights for the other users.Samba config file
PHP Code:
[global]
workgroup = WIN-FVJBNQIJE9O@WOENSDRECHT.LOCAL
[code]....
View 1 Replies
View Related
Mar 4, 2010
I have installed openldap version 2.4.21 and configured with the help of the site [URL] and the LDAP address book is working fine. But I need to create an LDAP directory such that it will contain the user name and passwords for the users and when user is logging to any application he is authenticated from LDAP directory
e.g Users who need to browse the internet need to authenticate with username and password for access from the firewall (Juniper Netscreen) and similarly other applications like oracle ERP such that they will have only 1 username and password stored in LDAP directory and all other applications will search for the user name and password for authentication.
View 5 Replies
View Related
Jun 3, 2011
I Configured LDAP Server on ubuntu Server 10.04 ,(using url ldap) and Client also it's working fine. After that I changed to ssl encryption and create certificate in server side. Now it's not authenticating from server it's shows Incorrect Password, but I can login though terminal if I am root user ,then it not ask any password it's logon to ldap user. After I changed to ldap server to ssl encryption and made one changes in client side uri ldaps://ip-address/ (/etc/ldap.conf).
View 3 Replies
View Related
May 15, 2011
I have more than 150 Linux desktop computer in my office IT setup.
I want to configure LDAP centralize network authentication for all the desktop computer.
My requirement is below mentioned.
The LDAP server will only authenticate the desktop computer at the log-in time when the user start computer.
The home directory of all the user should be create in their desktop local computer not in the LDAP server.
And flexibility of user log-in for every desktop. (any user can log-in any computer with his/her username and password)and the home directory will create automatically in the local desktop computer automatically the moment any user will log-in to any computer in the network and the LDAP server will authenticate for desktop-network log-in in to the computer.
View 1 Replies
View Related
Nov 12, 2010
I have Centos ( and Postfix+ldap+dovecot ) TLS works with Postfix and LDAP. When I open evolution mail client I can browse ldap tree and search for users, send-receive mails ...all fine
View 3 Replies
View Related
