OpenLDAP automatisch installieren und einrichten

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185

#!/bin/bash
 
# globals
LDAPDB="mdb"
PASSWORD="test1234"
HOSTNAME=`hostname`
DOMAIN=`echo  $HOSTNAME | awk -v FS="." '{print $1}'`
TLD=`echo  $HOSTNAME | awk -v FS="." '{print $2}'`
PPOLICY_FILE="/etc/ldap/schema/ppolicy.ldif"
LOGFILE="debug.txt"
 
# basesetup()
# Installs slapd (openLDAP) unattended
# using debconf
 
basesetup() {
 
	PASS=$1
        HOST=$2
	DBTYPE=$3
 
	echo "Building LDAP-Roottree ...\n"
 
	export DEBIAN_FRONTEND=noninteractive
	echo -e " \
		slapd    slapd/internal/generated_adminpw    password   $PASS
		slapd    slapd/password2    password    $PASS
		slapd    slapd/internal/adminpw    password   $PASS
		slapd    slapd/password1    password    $PASS
		slapd	 slapd/backend: string	$DBTYPE
		slapd	 slapd/domain	string	$HOST
	" | debconf-set-selections
 
	apt-get install -y slapd ldap-utils
 
}
 
make_index() {
 
	echo "Adding index ...\n"
 
        echo -e " \
dn: olcDatabase={1}$LDAPDB,cn=config
changetype: modify
add: olcDbIndex
olcDbIndex: mail,givenName eq,subinitial
        " | ldapmodify -Y EXTERNAL -H ldapi:///
 
}
 
# configure_policy()
# installs: 	ppolicy-scheme
# 		ppolicy-module
# 		overlay
# 		ppolicycontext
# 		defaultpolicy
 
configure_policy() {
 
        echo "Setting temporary ACLs ..."
 
        echo -e " \
dn: olcDatabase={1}$LDAPDB,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write by * none
        " | ldapmodify -Y EXTERNAL -H ldapi:///
 
	echo "Adding ppolicy-scheme ..."
 
	ldapadd -Q -Y EXTERNAL -H ldapi:/// -f $PPOLICY_FILE
 
        echo "Activating ppolicy-module ..."
 
        echo -e " \
dn: cn=module{0},cn=config
changetype: modify
add: olcModuleLoad
olcModuleLoad: ppolicy.la
        " | ldapmodify -Y EXTERNAL -H ldapi:///
 
	/etc/init.d/slapd restart
 
        echo "Generating ppolicy-context ..."
 
        echo -e " \
dn: ou=policies,dc=$DOMAIN,dc=$TLD
objectClass: organizationalUnit
objectClass: top
ou: policies
        " | ldapadd -Q -Y EXTERNAL -H ldapi:///
 
        echo "Setting default policy ..."
 
        echo -e " \
dn: cn=default,ou=policies,dc=$DOMAIN,dc=$TLD
objectClass: top
objectClass: person
objectClass: pwdPolicy
cn: default
sn: default
pwdAllowUserChange: TRUE
# this don't work though documentation says it should
# pwdAttribute: userPassword
# So we use OID for workaround
pwdAttribute: 2.5.4.35
pwdInhistory: 3
pwdLockout: TRUE
pwdLockoutDuration: 1800
pwdMaxAge: 0
pwdMaxFailure: 3
pwdMinLength: 6
pwdMustChange: TRUE
pwdSafeModify: TRUE
# comment for syntax reason (trailing TAB here leads to syntax error when importing)
        " | ldapadd -Q -Y EXTERNAL -H ldapi:///
 
        echo "Generating overlay ..."
 
        echo -e " \
dn: olcOverlay=ppolicy,olcDatabase={1}$LDAPDB,cn=config
objectClass: olcOverlayConfig
objectClass: olcPPolicyConfig
olcOverlay: ppolicy
olcPPolicyDefault: cn=default,ou=policies,dc=$DOMAIN,dc=$TLD
olcPPolicyHashCleartext: FALSE
olcPPolicyUseLockout: FALSE
olcPPolicyForwardUpdates: FALSE
# comment for syntax reason (trailing TAB here leads to syntax error when importing)
        " | ldapadd -Q -Y EXTERNAL -H ldapi:///
 
}
 
# configure_tls()
# does:
#	generating of cert-authority
#	generating of certs for slapd
#	configuring of slapd for using tls
 
configure_tls() {
 
	echo
 
}
 
# toggle_acl()
# sets ACL back to save values after install
 
toggle_acl() {
 
	echo
 
}
 
# debug_output()
# dumps to file:
#	debconf values for slapd
#	complete Root-DN
#	complete cn=config
 
debug_output() {
 
	debconf-show slapd > $LOGFILE
	slapcat >> $LOGFILE
	ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config >> $LOGFILE
 
}
 
 
# cleanldap()
# Removes all of openLDAP
 
cleanldap() {
 
	apt-get remove -y slapd ldap-utils --purge
 
}
 
# main
 
basesetup $PASSWORD $HOSTNAME $LDAPDB
make_index
configure_policy
debug_output
cleanldap

#!/bin/bash # glo­bals LDAPDB=„mdb“ PASSWORD=„test1234“ HOSTNAME=‚hostname‚ DOMAIN=‚echo $HOSTNAME | awk ‑v FS=“.“ ‚{print $1}‚‚ TLD=‚echo $HOSTNAME | awk ‑v FS=“.“ ‚{print $2}‚‚ PPOLICY_FILE=“/etc/ldap/schema/ppolicy.ldif“ LOGFILE=„debug.txt“ # base­set­up() # Installs slapd (openLDAP) unat­ten­ded # using debconf base­set­up() { PASS=$1 HOST=$2 DBTYPE=$3 echo „Buil­ding LDAP-Root­tree …\n“ export DEBIAN_FRONTEND=noninteractive echo ‑e “ \ slapd slapd/internal/generated_adminpw pass­word $PASS slapd slapd/password2 pass­word $PASS slapd slapd/internal/adminpw pass­word $PASS slapd slapd/password1 pass­word $PASS slapd slapd/backend: string $DBTYPE slapd slapd/domain string $HOST “ | debconf-set-sel­ec­tions apt-get install ‑y slapd ldap-utils } make_index() { echo „Adding index …\n“ echo ‑e “ \ dn: olcDatabase={1}$LDAPDB,cn=config chan­ge­ty­pe: modi­fy add: olcDb­In­dex olcDb­In­dex: mail,givenName eq,subinitial “ | ldap­mo­di­fy ‑Y EXTERNAL ‑H ldapi:/// } # configure_policy() # installs: ppo­li­cy-sche­me # ppo­li­cy-modu­le # over­lay # ppo­li­cy­con­text # default­po­li­cy configure_policy() { echo „Set­ting tem­po­ra­ry ACLs …“ echo ‑e “ \ dn: olcDatabase={1}$LDAPDB,cn=config chan­ge­ty­pe: modi­fy replace: olc­Ac­cess olc­Ac­cess: {0}to * by dn.base=„gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth“ wri­te by * none “ | ldap­mo­di­fy ‑Y EXTERNAL ‑H ldapi:/// echo „Adding ppo­li­cy-sche­me …“ lda­padd ‑Q ‑Y EXTERNAL ‑H ldapi:/// ‑f $PPOLICY_FILE echo „Acti­vat­ing ppo­li­cy-modu­le …“ echo ‑e “ \ dn: cn=module{0},cn=config chan­ge­ty­pe: modi­fy add: olc­Mo­du­leL­oad olc­Mo­du­leL­oad: ppolicy.la “ | ldap­mo­di­fy ‑Y EXTERNAL ‑H ldapi:/// /etc/init.d/slapd restart echo „Gene­ra­ting ppo­li­cy-con­text …“ echo ‑e “ \ dn: ou=policies,dc=$DOMAIN,dc=$TLD object­Class: orga­niza­tio­nal­U­nit object­Class: top ou: poli­ci­es “ | lda­padd ‑Q ‑Y EXTERNAL ‑H ldapi:/// echo „Set­ting default poli­cy …“ echo ‑e “ \ dn: cn=default,ou=policies,dc=$DOMAIN,dc=$TLD object­Class: top object­Class: per­son object­Class: pwd­Po­li­cy cn: default sn: default pwdAl­lo­wU­ser­Ch­an­ge: TRUE # this don’t work though docu­men­ta­ti­on says it should # pwdAt­tri­bu­te: user­Pass­word # So we use OID for work­around pwdAt­tri­bu­te: 2.5.4.35 pwd­In­histo­ry: 3 pwd­Lock­out: TRUE pwd­Lock­out­Du­ra­ti­on: 1800 pwd­Ma­xA­ge: 0 pwd­Max­Fail­ure: 3 pwd­Min­Length: 6 pwd­Must­Ch­an­ge: TRUE pwd­Sa­fe­Mo­di­fy: TRUE # com­ment for syn­tax reason (trai­ling TAB here leads to syn­tax error when import­ing) “ | lda­padd ‑Q ‑Y EXTERNAL ‑H ldapi:/// echo „Gene­ra­ting over­lay …“ echo ‑e “ \ dn: olcOverlay=ppolicy,olcDatabase={1}$LDAPDB,cn=config object­Class: olcO­ver­lay­Con­fig object­Class: olcP­Po­li­cy­Con­fig olcO­ver­lay: ppo­li­cy olcP­Po­li­cy­De­fault: cn=default,ou=policies,dc=$DOMAIN,dc=$TLD olcP­Po­li­cy­Hash­Cle­ar­text: FALSE olcP­Po­li­cy­U­se­Lock­out: FALSE olcP­Po­li­cy­For­war­d­Up­dates: FALSE # com­ment for syn­tax reason (trai­ling TAB here leads to syn­tax error when import­ing) “ | lda­padd ‑Q ‑Y EXTERNAL ‑H ldapi:/// } # configure_tls() # does: # gene­ra­ting of cert-aut­ho­ri­ty # gene­ra­ting of certs for slapd # con­fi­gu­ring of slapd for using tls configure_tls() { echo } # toggle_acl() # sets ACL back to save values after install toggle_acl() { echo } # debug_output() # dumps to file: # debconf values for slapd # com­ple­te Root-DN # com­ple­te cn=config debug_output() { debconf-show slapd > $LOGFILE slap­cat >> $LOGFILE ldap­se­arch ‑Y EXTERNAL ‑H ldapi:/// ‑b cn=config >> $LOGFILE } # cle­anldap() # Remo­ves all of openLDAP cle­anldap() { apt-get remo­ve ‑y slapd ldap-utils –pur­ge } # main base­set­up $PASSWORD $HOSTNAME $LDAPDB make_index configure_policy debug_output cleanldap