GOAL: Setup OpenLDAP for use as a Global Address Book by Microsoft
Outlook and SquirrelMail webmail clients.
ENVIRONMENT:
Red Hat Linux Advanced Server release 2.1AS (Pensacola)
INSTRUCTIONS:
1. Install Berkeley DB software.
> cd /usr/local/archive
> wget http://www.sleepycat.com/update/snapshot/db-4.2.52.tar.gz
> tar -xvzf db-4.2.52.tar.gz
> cd db-4.2.52
> cd build_unix/
> ../dist/configure
> make
> make install
2. Install OpenLDAP software.
> cd /usr/local/archive
> wget ftp://ftp.openldap.org/pub/OpenLDAP/openldap-release/openldap-2.2.4.tgz
> tar -xvzf openldap-2.2.4.tgz
Next create a build.sh script with the following:
#!/bin/bash
env CPPFLAGS="-I/usr/local/BerkeleyDB.4.2/include" \
LDFLAGS="-L/usr/local/BerkeleyDB.4.2/lib" ./configure \
--prefix /usr/local/openldap-2.2.4
Make the script executable and run it:
> chmod 755 build.sh
> ./build.sh
Now finish the build:
> make depend
> make
> make install
3. Install Webmin.
See webmin.txt
4. Install perl modules.
> wget http://theoryx5.uwinnipeg.ca/cpan/authors/id/P/PE/PETDANCE/Test-Harness-2.40.tar.gz
> tar -xvzf Test-Harness-2.40.tar.gz
> cd Test-Harness-2.40
> perl Makefile.PL
> make
> make test
> make install
> wget http://theoryx5.uwinnipeg.ca/cpan/authors/id/M/MS/MSCHWERN/Test-Simple-0.47.tar.gz
> tar -xvzf Test-Simple-0.47.tar.gz
> cd Test-Simple-0.47
> perl Makefile.PL
> make
> make test
> make install
> wget http://theoryx5.uwinnipeg.ca/cpan/authors/id/G/GB/GBARR/Convert-ASN1-0.18.tar.gz
> tar -xvzf Convert-ASN1-0.18.tar.gz
> cd Convert-ASN1-0.18
> perl Makefile.PL
> make
> make test
> make install
5. Install OpenLdap2 module for Webmin:
a. Download the module:
> cd /usr/local/archive
> wget http://gaia.anet.fr/webmin/openldap/releases/openldap2-0_1.wbm
b. Login to Webmin.
c. Select Webmin icon from top menu bar.
d. Select Webmin Configuration icon.
e. Select Webin Modules icon.
f. In the Install Module form select "From local file" and enter the path:
/usr/local/archive/openldap2-0_1.wbm
g. Press the Install Module From File button to install the module.
6. Configure OpenLDAP Webmin module.
a. Login to Webmin.
b. Select the Servers icon from the top menu bar.
c. Select the "OpenLDAP Server 2" icon. The following error message will be
displayed:
"It was not possible to read your configuration file for slapd.
Please check int the module configuration that the path for this file is correct."
d. Select the Module Config tab.
e. Enter the following config options into the form:
Path to slapd.conf file: /usr/local/openldap-2.2.4/etc/openldap/slapd.conf
Command to apply changes: service slapd restart
Command to start slapd: service slapd start
Command to stop slapd: service slapd stop
Port number daemon slapd is listening to: 389
Path to slapd daemon: /usr/local/openldap-2.2.4/libexec/slapd
LDAP Properties for all new users:
objectClass: inetorgperson
objectClass: top
Email domain for mail attribute: acme.com
f. Press the Save button. You will be returned to the main OpenLDAP config screen.
7. Apply BDB support patch to OpenLdap2 Webmin module.
> cd /usr/local/archive
> wget http://www.reliablepenguin.com/projects/ldap/openldap2_webmin_bdb.patch
> cd /usr/libexec/webmin/openldap2
> patch -Np5 < /usr/local/archive/openldap2_webmin_bdb.patch
8. Setup slapd service:
> cd /usr/local/archive
> wget http://www.reliablepenguin.com/clients/misc/slapd.service
> cp slapd.service /etc/init.d/slapd
> chkconfig --add slapd
> chkconfig --level 35 slapd on
9. Generate directory administrator's password:
> /usr/local/openldap-2.2.4/sbin/slappasswd -h {MD5}
You will be prompted to enter a password and then the crypted version
of the password will be displayed:
New password:
Re-enter new password:
{MD5}risfylFZSeXVT7IrjtlVdQ==
The crypted password is "{MD5}risfylFZSeXVT7IrjtlVdQ==". Save this string
for use in the next step.
10. Configure OpenLDAP via Webmin.
a. Login to Webmin.
b. Select the Servers icon from top menu bar.
c. Select the "OpenLdap Server 2" icon.
d. Delete the default backend definition by selecting the
predefined backend named "dc=my-domain,dc=com". Press the delete
button at the bottom of the screen and when prompted confirm the deletion.
e. Define a new backend by selecting the "Add backend" link. The "Add Backend"
form will be displayed. Enter the suffix:
c=US
Set the backend type to "bdb".
Press the "Create backend" button at the bottom of the form.
Next a form for setting backend options will be displayed. Set the following
fields under "General Backend Options" :
Directory : /usr/local/openldap-2.2.4/var/openldap-us-data
Press the "Save" button at the bottom of the form to save changes and return
to the "Global Options" screen.
f. Define a new backend by selecting the "Add backend" link. The "Add Backend"
form will be displayed. Enter a suffix like:
dc=my-domain,dc=com
Each component of your domain should be repesented by a domain component (dc)
element. For example if your domain is "acme.com" then use:
dc=acme,dc=com
Or if your domain is "accounting.acme.com" then use:
dc=accounting,dc=acme,dc=com
Set the backend type to "bdb".
Press the "Create backend" button at the bottom of the form.
Next a form for setting backend options will be displayed. Set the following
fields under "General Backend Options" :
Administrator DN : cn=Administrator,dc=acme,dc=com
Administrator Password : {paste in crypted password from previous step}
Read Only : No
Schema Check : Yes
Default Access : None
Last Modifiers : Yes
Size Limit : 500
Time Limit : 120
Set the following fields under "BDB backend specific options" :
Directory : /usr/local/openldap-2.2.4/var/openldap-data
Cache Size : 1000
Max Search Stack Depth : 16
Files Protection Mode : 0600
Checkpoint Every : 100 10
DB No Sync : No
Allow Dirty Reads : No
IDL Cache Size : 0
SHM Key : leave blank
Session Log Store : leave blank
Deadlock Handling : Default
Press the "Save" button at the bottom of the form to save changes and return
to the "Global Options" screen.
g. Select the "Include Files" icon at the bottom of the screen.
Enter:
/usr/local/openldap-2.2.4/etc/openldap/schema/cosine.schema
into the "Create a new include file" field and press the "Create" button.
Repeat this process to create include files for:
/usr/local/openldap-2.2.4/etc/openldap/schema/nis.schema
/usr/local/openldap-2.2.4/etc/openldap/schema/inetorgperson.schema
h. Now start the slapd server:
> service slapd start
and run the following test query:
> ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts
You should get results similar to:
version: 2
#
# filter: (objectclass=*)
# requesting: namingContexts
#
#
dn:
namingContexts: dc=acme,dc=com
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
Now test the c=US referral is working:
> ldapsearch -x -b "c=US"
You should see results similar to:
version: 2
#
# filter: (objectclass=*)
# requesting: ALL
#
# search result
search: 2
result: 10 Referral
matchedDN: c=US
ref: ldap://mail.acme.com/dc=acme,dc=com??sub
# numResponses: 1
11. Initialize the LDAP database.
a. Create a file in /usr/local/openldap-2.2.4/etc/openldap named top.ldif with
the following contents:
dn: dc=acme,dc=com
objectClass: top
objectClass: dcObject
objectClass: organization
dc: acme
o: Acme, Inc.
description: Acme, Inc.
dn: cn=Administrator,dc=acme,dc=com
objectClass: organizationalRole
cn: Administrator
description: Directory Manager
dn: ou=People,dc=acme,dc=com
objectClass: top
objectClass: organizationalUnit
ou: People
description: Container for people objects.
dn: ou=Groups,dc=acme,dc=com
objectClass: top
objectClass: organizationalUnit
ou: Groups
description: Container for group objects.
b. Import top.ldif into OpenLDAP using the slapadd command:
> /usr/local/openldap-2.2.4/sbin/slapadd -v \
-f /usr/local/openldap-2.2.4/etc/openldap/slapd.conf \
-l /usr/local/openldap-2.2.4/etc/openldap/top.ldif
c. Create directory for c=US database:
> mkdir /usr/local/openldap-2.2.4/var/openldap-us-data
c. Create a file in /usr/local/openldap-2.2.4/etc/openldap named top2.ldif with
the following contents:
dn: c=US
objectClass: top
objectClass: referral
objectClass: extensibleObject
c: US
description: placeholder
ref: ldap://mail.acme.com/dc=acme,dc=com
b. Import top2.ldif into OpenLDAP using the slapadd command:
> /usr/local/openldap-2.2.4/sbin/slapadd -v \
-f /usr/local/openldap-2.2.4/etc/openldap/slapd.conf \
-l /usr/local/openldap-2.2.4/etc/openldap/top2.ldif
12. Verify that required rpm packages are installed:
> rpm -q openldap
openldap-2.0.21-1
> rpm -q openldap-clients
openldap-clients-2.0.21-1
> rpm -q auth_ldap
auth_ldap-1.4.8-3
> rpm -q nss_ldap.
nss_ldap-172-3
13. Configure nss_ldap and pam_ldap module.
Edit /etc/ldap.conf
a. Set host to the local machine.
host 127.0.0.1
b. Set base to the same as used in the openldap config.
base dc=acme,dc=com
c. Set port to 389.
port 389
d. Set the bind DN for root:
rootbinddn cn=Administrator,dc=acme,dc=com
e. Set scope to one level:
scope one
f. Set pam_filter:
pam_filter objectclass=posixaccount
g. Set pam_login_attribute:
pam_login_attribute uid
h. Set pam_member_attribute:
pam_member_attribute uid
i. Set pam_password:
pam_password md5
j. Set object bases:
nss_base_passwd ou=People,dc=acme,dc=com?one
nss_base_shadow ou=People,dc=acme,dc=com?one
nss_base_group ou=Groups,dc=acme,dc=com?one
14. Create a file at /etc named ldap.secret.
Place in this file on a single line the password for the Administrator.
Set the permissions on this file:
> chmod 600 /etc/ldap.secret
15. Modify NSS config file.
Change the passwd, shadow and group lines to read as follows:
passwd: files ldap
shadow: files ldap
group: files ldap
16. Setup access controls.
a. Login to Webmin.
b. Select the Servers icon from the top menu bar.
c. Select the "OpenLDAP 2 Server" icon.
d.
defaultaccess none
access to dn.subtree="dc=acme,dc=com" attr=userPassword
by dn="cn=root,dc=acme,dc=com" write
by self write
by * auth
access to dn.subtree="ou=People,dc=acme,dc=com"
by * read
access to dn.subtree="dc=acme,dc=com"
by * read
access to dn.subtree="c=US"
by * read
16. Login to webmin. Select System icon. Select LDAP Users and Groups.
A message saying that Perl-LDAP is not installed will be displayed. Select
the link to install this module.
Import Users
============
cat import.ldif | ldapadd -h localhost \
-w adminpass -D "cn=Administrator,dc=acme,dc=net" -x
CLIENT CONFIGURATION
====================
Outlook Express 6
1. Start Microsoft Outlook.
2. From the menu bar select Tools and then select Address Book. The Address
Book window will be displayed.
3. Select Tools from the menu bar and then select Accounts. The Internet
Accounts dialog will be displayed.
4. Press the Add button to create a new directory service definition. The
"Internet Connection Wizard" will be displayed. The first screen of the
wizard is titled "Internet Directory Serer Name".
5. In the "Internet directory (LDAP) server" field type the IP address or
DNS domain name of the directory server. For this example we'll
use "mail.acme.com". Do not check the "My LDAP server requires me to log on"
checkbox. Press the Next button.
6. The next wizard screen will be titled "Check E-mail Addresses". Answer
"No" to the question "Do you want to check email addresses using this
directory service?". Press the Next button.
7. The final wizard screen titled "Congratulations" will be displayed. Press
the Finish button.