other:ldap
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
other:ldap [2021/04/03 20:21] nanodano [OpenLDAP] |
other:ldap [2021/04/03 22:04] (current) nanodano [web2ldap] |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ===== LDAP ===== | + | ====== LDAP ====== |
| [[https:// | [[https:// | ||
| Line 35: | Line 35: | ||
| Here are instructions on setup OpenLDAP on Debian with LetsEncrypt SSL certificates. | Here are instructions on setup OpenLDAP on Debian with LetsEncrypt SSL certificates. | ||
| + | Also refer to the Debian wiki page: [[https:// | ||
| + | For a list of all man pages that comes with slapd, refer to [[https:// | ||
| <code bash> | <code bash> | ||
| Line 86: | Line 88: | ||
| </ | </ | ||
| - | TODO: Setup certbot auto renew, | + | If you want to setup certbot |
| + | |||
| + | < | ||
| + | crontab -e # As root | ||
| + | |||
| + | # And add the following line to renew at 4:24am on 3rd day of month | ||
| + | 24 4 3 * * certbot renew --post-hook " | ||
| + | </ | ||
| At this point you can use StartTLS on the ldap:// port. | At this point you can use StartTLS on the ldap:// port. | ||
| Line 99: | Line 108: | ||
| - | Now you connect using no encryption, StartTLS, or LDAPS. | + | Now you connect using no encryption, StartTLS, or LDAPS and you can add new organizational units and users with the admin user. |
| - | Then you can add new organizational units and users. | ||
| - | |||
| - | Add a new user with Apache Directory Studio, add an org unit first, with rdn: ou=hackers. Here are the raw ldif codes it generates. | ||
| - | |||
| - | <code ldif | add_ou.ldif> | ||
| - | dn: ou=hackers, | ||
| - | changetype: add | ||
| - | ou: hackers | ||
| - | objectClass: | ||
| - | objectClass: | ||
| - | </ | ||
| - | |||
| - | Then create a new entry with simpleSecurityObject (for password and cn) and organizationalRole for the structural | ||
| - | |||
| - | <code ldif | add_user.ldif> | ||
| - | dn: cn=nanodano, | ||
| - | changetype: add | ||
| - | cn: nanodano | ||
| - | objectClass: | ||
| - | objectClass: | ||
| - | objectClass: | ||
| - | userPassword:: | ||
| - | = | ||
| - | </ | ||
| - | |||
| - | If you need a hashed password to provide to the '' | ||
| - | |||
| - | <code bash> | ||
| - | slappasswd | ||
| - | </ | ||
| ===== Tools ===== | ===== Tools ===== | ||
| Line 168: | Line 147: | ||
| </ | </ | ||
| - | You can also use '' | + | You can also use '' |
| <code bash> | <code bash> | ||
| - | # | ||
| ldapmodify -H ldapi:/// -Y EXTERNAL -f change.ldif | ldapmodify -H ldapi:/// -Y EXTERNAL -f change.ldif | ||
| + | # or | ||
| + | ldapmodify -H ldapi:/// -f change.ldif -D cn=admin, | ||
| </ | </ | ||
| Line 182: | Line 162: | ||
| ==== Apache Directory Studio ==== | ==== Apache Directory Studio ==== | ||
| - | [[https:// | + | [[https:// |
| + | |||
| + | To add a new server connection, go to '' | ||
| + | Use Simple Authentication, | ||
| + | |||
| + | To add a user, right click on the top level object and add New Entry (Create from Scratch). | ||
| + | Give it two object classes: '' | ||
| + | Give it RDN of '' | ||
| + | |||
| ==== JXplorer ==== | ==== JXplorer ==== | ||
| + | |||
| + | [[http:// | ||
| ==== web2ldap ==== | ==== web2ldap ==== | ||
| - | Libraries | + | [[https:// |
| + | |||
| + | To install it in Debian, | ||
| + | |||
| + | <code bash> | ||
| + | sudo apt install python3-venv rustc python3-dev libsasl2-dev libldap2-dev libssl-dev | ||
| + | python3 -m pip install web2ldap | ||
| + | </ | ||
| + | |||
| + | To run, it, simply invoke the script provided by the pip package: | ||
| + | |||
| + | <code bash> | ||
| + | web2ldap | ||
| + | </ | ||
| + | |||
| + | Then connect to it in a browser, using the address it outputs. For example. [[http:// | ||
| + | |||
| + | Click connect to a server, then click on ' | ||
| + | |||
| + | When you CLICK into an OU or group, your whole context changes. When you click "new Entry", | ||
| + | |||
| + | To move a user, go to Tree, view user, and click Rename on right side. Change superior DN to include the new OU info. | ||
| ==== Python Library ==== | ==== Python Library ==== | ||
| + | |||
| + | The [[https:// | ||
| + | |||
| + | To install it: | ||
| <code bash> | <code bash> | ||
| Line 198: | Line 215: | ||
| </ | </ | ||
| + | To use it: | ||
| - | <code python | + | <code python ldap_test.py> |
| # `apt install python3-ldap` or `pip install python-ldap` | # `apt install python3-ldap` or `pip install python-ldap` | ||
| from getpass import getpass | from getpass import getpass | ||
| Line 236: | Line 254: | ||
| ==== Java Library ==== | ==== Java Library ==== | ||
| - | https:// | + | There is a Java library provided by the Apache Directory project: [[https:// |
| ===== LDIF examples ===== | ===== LDIF examples ===== | ||
| - | LDIF files are used to make changes to the LDAP server. They seem pretty gnarly at first, but you get used to them and they actually becomes a nice convenient way of documenting changes via code. | + | LDIF files are used to make changes to the LDAP server. They seem pretty gnarly at first, but you get used to them and they actually becomes a nice convenient way of documenting changes via code. You can use a tool like Apache Directory Studio to make changes via a GUI rather than using LDIF files. Apache Directory Studio will also generate the LDIF in the console so you can save the change as an LDIF file if you wanted to. |
| You can pass LDIF files directly as a heredoc or as a separate file: | You can pass LDIF files directly as a heredoc or as a separate file: | ||
| <code bash> | <code bash> | ||
| - | # Pass a file | + | # Pass a file with `-f`. Use `-Y EXTERNAL` for server configs. |
| ldapmodify -H ldapi:/// -Y EXTERNAL -f change.ldif | ldapmodify -H ldapi:/// -Y EXTERNAL -f change.ldif | ||
| + | # Or bind using an admin account with `-W -D <dn>` | ||
| + | ldapmodify -H ldapi:/// -f change.ldif -D cn=admin, | ||
| # Pass the ldif directly | # Pass the ldif directly | ||
| Line 261: | Line 281: | ||
| EOF | EOF | ||
| </ | </ | ||
| + | |||
| + | ==== Add an OU ==== | ||
| + | |||
| + | <code ldif add_ou.ldif> | ||
| + | dn: ou=hackers, | ||
| + | changetype: add | ||
| + | ou: hackers | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | </ | ||
| + | |||
| + | ==== Add a user ==== | ||
| + | |||
| + | To add a user, create a new entry with simpleSecurityObject (for password and cn) and organizationalRole for the structural | ||
| + | |||
| + | <code ldif add_user.ldif> | ||
| + | dn: cn=nanodano, | ||
| + | changetype: add | ||
| + | cn: nanodano | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | objectClass: | ||
| + | # Salted SHA password provided by `slappasswd` | ||
| + | userPassword: | ||
| + | </ | ||
| + | |||
| + | |||
| + | |||
| + | |||
| + | ==== Delete an OU ==== | ||
| + | |||
| + | <code ldif delete_ou.ldif> | ||
| + | dn: ou=admins, | ||
| + | changetype: delete | ||
| + | </ | ||
| + | |||
| + | ==== Delete a user ==== | ||
| + | |||
| + | <code ldif delete_user.ldif> | ||
| + | dn: cn=nanodano, | ||
| + | changetype: delete | ||
| + | </ | ||
| + | |||
| + | ==== Update TLS certificates ==== | ||
| + | |||
| + | When updating the certificates, | ||
| + | |||
| + | <code ldif update_certs.ldif> | ||
| + | # If using `ldapmodify`, | ||
| + | # instead of `-W -D cn=admin, | ||
| + | # since it affects the server config directly | ||
| + | dn: cn=config | ||
| + | changetype: modify | ||
| + | replace: olcTLSCertificateFile | ||
| + | olcTLSCertificateFile: | ||
| + | - | ||
| + | replace: olcTLSCertificateKeyFile | ||
| + | olcTLSCertificateKeyFile: | ||
| + | </ | ||
| + | |||
| + | |||
other/ldap.1617481290.txt.gz · Last modified: 2021/04/03 20:21 by nanodano
