LDAPの構築

sudo apt update
sudo apt install slapd ldap-utils

$ cd /etc/ldap
$ sudo cp ldap.conf ldap.conf.org
$ diff ldap.conf ldap.conf.org
8,9c8,9
< BASE	dc=a910,dc=tak-cslab,dc=org
< URI	ldap://ldap.a910.tak-cslab.org ldap://ldap-master.a910.tak-cslab.org:666
---
> #BASE	dc=example,dc=com
> #URI	ldap://ldap.example.com ldap://ldap-master.example.com:666

$ sudo slapcat
dn: dc=a910,dc=tak-cslab,dc=org
objectClass: top
objectClass: dcObject
objectClass: organization
o: a910.tak-cslab.org
dc: a910
structuralObjectClass: organization
entryUUID: c94f4c60-8850-1039-8ded-b306a16f182d
creatorsName: cn=admin,dc=a910,dc=tak-cslab,dc=org
createTimestamp: 20191021131650Z
entryCSN: 20191021131650.368566Z#000000#000#000000
modifiersName: cn=admin,dc=a910,dc=tak-cslab,dc=org
modifyTimestamp: 20191021131650Z

dn: cn=admin,dc=a910,dc=tak-cslab,dc=org
objectClass: simpleSecurityObject
objectClass: organizationalRole
cn: admin
description: LDAP administrator
userPassword:: e1NTSEF9ME0wRC9wUGRlZ0plelpNQmp4ZmpOKzBVMm5kb0NGQ0s=
structuralObjectClass: organizationalRole
entryUUID: c94f5638-8850-1039-8dee-b306a16f182d
creatorsName: cn=admin,dc=a910,dc=tak-cslab,dc=org
createTimestamp: 20191021131650Z
entryCSN: 20191021131650.368842Z#000000#000#000000
modifiersName: cn=admin,dc=a910,dc=tak-cslab,dc=org
modifyTimestamp: 20191021131650Z

sudo ufw allow ldap

sudo docker run -p 6443:443 \
--env PHPLDAPADMIN_LDAP_HOSTS=auth-primary.a910.tak-cslab.org \
--detach osixia/phpldapadmin:0.9.0

/*
 * Autogenerated servers variables will come here
 */
$servers->newServer('ldap_pla');
$servers->setValue('server','name','auth-primary.a910.tak-cslab.org');
$servers->setValue('server','host','auth-primary.a910.tak-cslab.org');

// 以下が追記
$servers->setValue('auto_number', 'min', array('uidNumber'=>2000,'gidNumber'=>500));
$servers->setValue('appearance', 'pla_password_hash', 'sha512crypt');

$ sudo apt-get install phpldapadmin
$ sudo vim /etc/phpldapadmin/config.php

/*********************************************
 * Define your LDAP servers in this section  *
 *********************************************/

$servers = new Datastore();

/* $servers->NewServer('ldap_pla') must be called before each new LDAP server
   declaration. */
$servers->newServer('ldap_pla');

/* A convenient name that will appear in the tree viewer and throughout
   phpLDAPadmin to identify this LDAP server to users. */
// $servers->setValue('server','name','My LDAP Server');
$servers->setValue('server','name','CDSL LDAP Server');

/* Examples:
   'ldap.example.com',
   'ldaps://ldap.example.com/',
   'ldapi://%2fusr%local%2fvar%2frun%2fldapi'
           (Unix socket at /usr/local/var/run/ldap) */
$servers->setValue('server','host','127.0.0.1');

/* The port your LDAP server listens on (no quotes). 389 is standard. */
// $servers->setValue('server','port',389);

/* Array of base DNs of your LDAP server. Leave this blank to have phpLDAPadmin
   auto-detect it for you. */
// $servers->setValue('server','base',array('dc=example,dc=com'));
$servers->setValue('server','base',array('dc=a910,dc=tak-cslab,dc=org'));

/* Hide the warnings for invalid objectClasses/attributes in templates. */
// $config->custom->appearance['hide_template_warning'] = false;
$config->custom->appearance['hide_template_warning'] = false;

DN:  cn=admin,dc=a910,dc=tak-cslab,dc=org
PW:  xxxx

sudo apt-get update
sudo apt-get -y install libnss-ldap libpam-ldap ldap-utils nscd

passwd:         compat systemd
group:          compat systemd
shadow:         compat

passwd:         compat systemd ldap
group:          compat systemd ldap
shadow:         compat

sudo sh -c 'echo "session required        pam_mkhomedir.so skel=/etc/skel umask=077" >> /etc/pam.d/common-session'
sudo systemctl restart nscd

password      [success=1 user_unknown=ignore default=die]     pam_ldap.so use_authtok try_first_pass

password        [success=1 user_unknown=ignore default=die]     pam_ldap.so try_first_pass

$ wget https://www.osstech.co.jp/~hamano/posts/centos7-openldap-ssh/openssh-lpk-openldap.ldif
$ ldapadd -Y EXTERNAL -H ldapi:/// -f openssh-lpk-openldap.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=1000+uidNumber=1000,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=openssh-lpk-openldap,cn=schema,cn=config"
ldap_add: Insufficient access (50)

olcRootDN: cn=config
olcRootPW: {SSHA}TgR7I0OCdRwSNoCvx9zGELeh6PkoPCqA

$ ldapadd -D CN=config -W -H ldapi:/// -f openssh-lpk-openldap.ldif
Enter LDAP Password:
adding new entry "cn=openssh-lpk-openldap,cn=schema,cn=config"

$ ldapadd -D CN=config -W -H ldapi:/// -f /etc/ldap/schema/cosine.ldif
$ ldapadd -D CN=config -W -H ldapi:/// -f /etc/ldap/schema/inetorgperson.ldif
$ ldapadd -D CN=config -W -H ldapi:/// -f /etc/ldap/schema/nis.ldif

##!/bin/bash                                                                                                                                                   
user="${1}"
host="ldap://auth-primary.a910.tak-cslab.org"
base="dc=a910,dc=tak-cslab,dc=org"
filter1="(& (objectClass=posixAccount) (uid=${user}))"
filter2="sshPublicKey"

id "$user" >/dev/null 2>&1

RESULT=$(ldapsearch -x -LLL -H "$host" -b "$base" "$filter1" "$filter2" \
         | sed -z 's/\n\s\?//g;s/.*sshPublicKey::\? //g;s/.*/&\n/g' )
DECODE=$(echo $RESULT | base64 -d &> /dev/null; echo $?)

if [ $DECODE == "0" ]
then
  echo $RESULT | base64 -d
  echo
else
  echo $RESULT
fi

sudo chmod 500 /etc/ssh/get-ldap-keys.sh

AuthorizedKeysCommand /etc/ssh/get-ldap-keys.sh
AuthorizedKeysCommandUser root

sudo apt install samba
sudo cp /usr/share/doc/samba/examples/LDAP/samba.ldif.gz ~
sudo apt purge samba
sudo apt autoremove

gunzip samba.ldif.gz
sudo cp samba.ldif /etc/ldap/schema/
ldapadd -D CN=config -W -H ldapi:/// -f /etc/ldap/schema/samba.ldif