Dans ce how-to, nous allons mettre en place FusionDirectory pour gérer dans un annuaire LDAP
Deux serveurs seront mis en place:
Deux serveurs (possible de tout déployer sur un seul également) sous CentOS 6.4 x86_64. Le dépôt EPEL est configuré et activé
Il faut ajouter le dépôt FusionFirectory
cat <<'EOF' > /etc/yum.repos.d/fusiondirectory.repo [fusiondirectory] name=Fusiondirectory Packages for RHEL / CentOS 6 baseurl=http://repos.fusiondirectory.org/rhel/6/noarch enabled=1 gpgcheck=1 gpgkey=http://download.fusiondirectory.org/gpg/fusiondirectory_public.key EOF
mkdir /etc/install chmod 700 /etc/install echo 'p@ssw0rd' > /etc/install/ldap.pw echo 'Firewall Services' > /etc/install/ldap.org echo 'dc=firewall-services,dc=com' > /etc/install/ldap.base echo 'firewall-services' > /etc/install/ldap.topdc echo 'files' > /etc/install/samba.netbios echo 'FIREWALL.LOCAL' > /etc/install/samba.domain echo 'firewall-services.com' > /etc/install/dnsdomain openssl rand -base64 33 | perl -pe 's/\//\./g' > /etc/install/samba.pw openssl rand -base64 33 | perl -pe 's/\//\./g' > /etc/install/dhcp.pw openssl rand -base64 33 | perl -pe 's/\//\./g' > /etc/install/unix.pw openssl rand -base64 33 | perl -pe 's/\//\./g' > /etc/install/dns.pw openssl rand -base64 33 | perl -pe 's/\//\./g' > /etc/install/ssh.pw
Sur le serveur LDAP
yum install openldap-servers openldap-clients
yum install fusiondirectory-schema
cat <<'EOF' > /etc/openldap/slapd.conf
sed -i -e "s/dc=firewall-services,dc=com/$(cat /etc/install/ldap.base)/g" \ -e "s/__SECRET__/$(cat /etc/install/ldap.pw)/g" /etc/openldap/slapd.conf
mkdir -p /var/lib/ldap/db_log chown ldap:ldap /var/lib/ldap/db_log chown 770 /var/lib/ldap/db_log cat <<'EOF' > /var/lib/ldap/DB_CONFIG # # Set the database in memory cache size. # set_cachesize 0 2097152 0 # # Set log values. # set_lg_regionmax 1048576 set_lg_max 10485760 set_lg_bsize 2097152 set_lg_dir /var/lib/ldap/db_log EOF
dn: dc=firewall-services,dc=com dc: firewall-services o: Firewall Services ou: firewall-services description: firewall-services objectClass: top objectClass: organization objectClass: dcObject objectClass: gosaDepartment
sed -i -e "s/dc=firewall-services,dc=com/$(cat /etc/install/ldap.base)/g" \ -e "s/firewall-services/$(cat /etc/install/ldap.topdc)/g" ./init.ldif
slapadd -f init.ldif chown -R ldap:ldap /var/lib/ldap/*
options { listen-on port 53 { 127.0.0.1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-query { localhost;}; recursion no; dnssec-enable no; dnssec-validation no; dnssec-lookaside auto; /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "firewall-services.com" IN { type master; database "ldap ldap://localhost/ou=servers,ou=systems,dc=firewall-services,dc=com????!bindname=cn=dns%2cou=DSA%2cdc=firewall-services%2cdc=com,!x-bindpw=__DNS_SECRET__ 172800"; }; zone "10.10.in-addr.arpa" IN { type master; database "ldap ldap://localhost/ou=servers,ou=systems,dc=firewall-services,dc=com????!bindname=cn=dns%2cou=DSA%2cdc=firewall-services%2cdc=com,!x-bindpw=__DNS_SECRET__ 172800"; };
server:
verbosity: 1
statistics-interval: 0
statistics-cumulative: no
extended-statistics: yes
num-threads: 2
interface: 10.10.4.10
interface-automatic: no
do-ip6: no
access-control: 127.0.0.1 allow
access-control: 10.10.0.0/16 allow
chroot: ""
username: "unbound"
directory: "/etc/unbound"
log-time-ascii: yes
pidfile: "/var/run/unbound/unbound.pid"
hide-identity: yes
hide-version: yes
harden-glue: yes
harden-dnssec-stripped: yes
harden-below-nxdomain: yes
harden-referral-path: yes
use-caps-for-id: no
unwanted-reply-threshold: 10000000
do-not-query-localhost: no
prefetch: yes
prefetch-key: yes
dlv-anchor-file: "/etc/unbound/dlv.isc.org.key"
trusted-keys-file: /etc/unbound/keys.d/*.key
auto-trust-anchor-file: "/etc/unbound/root.anchor"
val-clean-additional: yes
val-permissive-mode: no
val-log-level: 1
include: /etc/unbound/local.d/*.conf
remote-control:
control-enable: no
stub-zone:
name: "firewall-services.com"
stub-addr: 127.0.0.1
forward-zone:
name: "."
forward-addr: 88.191.254.60
forward-addr: 88.191.254.70
include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/fusiondirectory/rfc2307bis.schema include /etc/openldap/schema/fusiondirectory/samba.schema include /etc/openldap/schema/fusiondirectory/samba-fd-conf.schema include /etc/openldap/schema/fusiondirectory/core-fd-conf.schema include /etc/openldap/schema/fusiondirectory/core-fd.schema include /etc/openldap/schema/fusiondirectory/ldapns.schema include /etc/openldap/schema/fusiondirectory/recovery-fd.schema include /etc/openldap/schema/fusiondirectory/dnszone.schema include /etc/openldap/schema/fusiondirectory/dhcp-fd.schema include /etc/openldap/schema/fusiondirectory/dsa-fd-conf.schema include /etc/openldap/schema/fusiondirectory/mime-fd.schema include /etc/openldap/schema/fusiondirectory/service-fd.schema include /etc/openldap/schema/fusiondirectory/systems-fd-conf.schema include /etc/openldap/schema/fusiondirectory/openssh-lpk.schema include /etc/openldap/schema/fusiondirectory/systems-fd.schema include /etc/openldap/schema/fusiondirectory/mail-fd.schema include /etc/openldap/schema/fusiondirectory/mail-fd-conf.schema include /etc/openldap/schema/fusiondirectory/alias-fd-conf.schema include /etc/openldap/schema/fusiondirectory/alias-fd.schema password-hash {SSHA} pidfile /var/run/openldap/slapd.pid loglevel 256 modulepath /usr/lib64/openldap moduleload back_hdb moduleload memberof database monitor database hdb mode 0600 suffix dc=firewall-services,dc=com rootdn cn=admin,dc=firewall-services,dc=com rootpw __LDAP_SECRET__ directory /var/lib/ldap cachesize 10000 checkpoint 128 15 index uid,mail eq,sub index cn,sn,givenName,ou pres,eq,sub index objectClass pres,eq index uidNumber,gidNumber,memberuid,member eq index gosaSubtreeACL,gosaObject,gosaUser pres,eq index sambaSID eq,sub index sambaPrimaryGroupSID eq index sambaDomainName eq index sambaGroupType eq index sambaSIDList eq index zoneName eq index relativeDomainName eq index dhcpHWAddress eq index dhcpClassData eq index dhcpPrimaryDN eq index dhcpSecondaryDN eq index dhcpServerDN eq index dhcpFailOverPeerDN eq access to attrs=userPassword,sambaLmPassword,sambaNtPassword by dn=cn=samba,ou=DSA,dc=firewall-services,dc=com write by anonymous auth by self write by * none access to attrs=sambaAcctFlags,sambaBadPasswordCount,sambaBadPasswordTime,sambaKickoffTime,sambaLogoffTime,sambaLogonHours,sambaPasswordHistory,sambaSID,sambaPrimaryGroupSID,sambaPwdCanChange,sambaPwdLastSet,sambaPwdMustChange,sambaUserWorkstations,sambaSIDList,sambaGroupType,sambaMungedDial,sambaLogonHours,sambaLogonTime,sambaDomainName,sambaHomePath,sambaHomeDrive by dn=cn=samba,ou=DSA,dc=firewall-services,dc=com write by group.exact="cn=admins,ou=Groups,dc=firewall-services,dc=com" write by self read by * none access to filter=(objectClass=sambaDomain) by dn=cn=samba,ou=DSA,dc=firewall-services,dc=com write by group.exact="cn=admins,ou=Groups,dc=firewall-services,dc=com" write by * none access to dn.subtree=ou=Computers,ou=systems,dc=firewall-services,dc=com by dn=cn=samba,ou=DSA,dc=firewall-services,dc=com write by group.exact="cn=admins,ou=Groups,dc=firewall-services,dc=com" write by * none access to attrs=loginShell,gidNumber,homeDirectory,uidNumber,shadowExpire,shadowFlag,shadowInactive,shadowLastChange,shadowMax,shadowMin,shadowWarning by dn=cn=samba,ou=DSA,dc=firewall-services,dc=com write by self read by dn="cn=unix,ou=DSA,dc=firewall-services,dc=com" read access to dn.subtree=ou=DSA,dc=firewall-services,dc=com by group.exact="cn=admins,ou=Groups,dc=firewall-services,dc=com" write by * none access to dn.base=dc=firewall-services,dc=com by * read access to dn.subtree=ou=systems,dc=firewall-services,dc=com filter=(objectClass=dNSZone) by group.exact="cn=admins,ou=Groups,dc=firewall-services,dc=com" write by dn="cn=dns,ou=DSA,dc=firewall-services,dc=com" read by * none access to dn.regex="^.*,ou=(People|Groups),dc=firewall-services,dc=org" by * read access to * by users read by anonymous auth