Installer FusionDirectory sur CentOS 6
Cette page est en cours de rédaction, les notes peuvent être incomplètes ou erronées
Dans ce how-to, nous allons mettre en place FusionDirectory pour gérer dans un annuaire LDAP
- Les groupes et utilisateurs
- Samba
- DHCP
- DNS
- les utilisateurs LDAP système (branche DSA)
Deux serveurs seront mis en place:
- Le premier exécutera OpenLDAP
- Le second hébergera l'interface de FusionDirectory
Prérequis
Deux serveurs (possible de tout déployer sur un seul également) sous CentOS 6.4 x86_64. Le dépôt EPEL est configuré et activé
Configuration des dépôts
Il faut ajouter le dépôt FusionFirectory
cat <<'EOF' > /etc/yum.repos.d/fusiondirectory.repo [fusiondirectory] name=Fusiondirectory Packages for RHEL / CentOS 6 baseurl=http://repos.fusiondirectory.org/rhel/6/noarch enabled=1 gpgcheck=1 gpgkey=http://download.fusiondirectory.org/gpg/fusiondirectory_public.key EOF
Préparer l'environnement
mkdir /etc/install chmod 700 /etc/install echo 'p@ssw0rd' > /etc/install/ldap.pw echo 'Firewall Services' > /etc/install/ldap.org echo 'dc=firewall-services,dc=com' > /etc/install/ldap.base echo 'firewall-services' > /etc/install/ldap.topdc echo 'files' > /etc/install/samba.netbios echo 'FIREWALL.LOCAL' > /etc/install/samba.domain echo 'firewall-services.com' > /etc/install/dnsdomain openssl rand -base64 33 | perl -pe 's/\//\./g' > /etc/install/samba.pw openssl rand -base64 33 | perl -pe 's/\//\./g' > /etc/install/dhcp.pw openssl rand -base64 33 | perl -pe 's/\//\./g' > /etc/install/unix.pw openssl rand -base64 33 | perl -pe 's/\//\./g' > /etc/install/dns.pw openssl rand -base64 33 | perl -pe 's/\//\./g' > /etc/install/ssh.pw
Installer OpenLDAP
Sur le serveur LDAP
- installer OpenLDAP:
yum install openldap-servers openldap-clients
- Installer les schemas
yum install fusiondirectory-schema
- Schema supplémentaires:
- Mise en place de la conf slapd
cat <<'EOF' > /etc/openldap/slapd.conf
sed -i -e "s/dc=firewall-services,dc=com/$(cat /etc/install/ldap.base)/g" \ -e "s/__SECRET__/$(cat /etc/install/ldap.pw)/g" /etc/openldap/slapd.conf
mkdir -p /var/lib/ldap/db_log chown ldap:ldap /var/lib/ldap/db_log chown 770 /var/lib/ldap/db_log cat <<'EOF' > /var/lib/ldap/DB_CONFIG # # Set the database in memory cache size. # set_cachesize 0 2097152 0 # # Set log values. # set_lg_regionmax 1048576 set_lg_max 10485760 set_lg_bsize 2097152 set_lg_dir /var/lib/ldap/db_log EOF
- init.ldif
dn: dc=firewall-services,dc=com dc: firewall-services o: Firewall Services ou: firewall-services description: firewall-services objectClass: top objectClass: organization objectClass: dcObject objectClass: gosaDepartment
sed -i -e "s/dc=firewall-services,dc=com/$(cat /etc/install/ldap.base)/g" \ -e "s/firewall-services/$(cat /etc/install/ldap.topdc)/g" ./init.ldif
slapadd -f init.ldif chown -R ldap:ldap /var/lib/ldap/*
En vrac
- named.conf
options { listen-on port 53 { 127.0.0.1; }; directory "/var/named"; dump-file "/var/named/data/cache_dump.db"; statistics-file "/var/named/data/named_stats.txt"; memstatistics-file "/var/named/data/named_mem_stats.txt"; allow-query { localhost;}; recursion no; dnssec-enable no; dnssec-validation no; dnssec-lookaside auto; /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic"; }; logging { channel default_debug { file "data/named.run"; severity dynamic; }; }; zone "firewall-services.com" IN { type master; database "ldap ldap://localhost/ou=servers,ou=systems,dc=firewall-services,dc=com????!bindname=cn=dns%2cou=DSA%2cdc=firewall-services%2cdc=com,!x-bindpw=__DNS_SECRET__ 172800"; }; zone "10.10.in-addr.arpa" IN { type master; database "ldap ldap://localhost/ou=servers,ou=systems,dc=firewall-services,dc=com????!bindname=cn=dns%2cou=DSA%2cdc=firewall-services%2cdc=com,!x-bindpw=__DNS_SECRET__ 172800"; };
- unbound.conf
server: verbosity: 1 statistics-interval: 0 statistics-cumulative: no extended-statistics: yes num-threads: 2 interface: 10.10.4.10 interface-automatic: no do-ip6: no access-control: 127.0.0.1 allow access-control: 10.10.0.0/16 allow chroot: "" username: "unbound" directory: "/etc/unbound" log-time-ascii: yes pidfile: "/var/run/unbound/unbound.pid" hide-identity: yes hide-version: yes harden-glue: yes harden-dnssec-stripped: yes harden-below-nxdomain: yes harden-referral-path: yes use-caps-for-id: no unwanted-reply-threshold: 10000000 do-not-query-localhost: no prefetch: yes prefetch-key: yes dlv-anchor-file: "/etc/unbound/dlv.isc.org.key" trusted-keys-file: /etc/unbound/keys.d/*.key auto-trust-anchor-file: "/etc/unbound/root.anchor" val-clean-additional: yes val-permissive-mode: no val-log-level: 1 include: /etc/unbound/local.d/*.conf remote-control: control-enable: no stub-zone: name: "firewall-services.com" stub-addr: 127.0.0.1 forward-zone: name: "." forward-addr: 88.191.254.60 forward-addr: 88.191.254.70
- slapd.conf
include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/openldap.schema include /etc/openldap/schema/misc.schema include /etc/openldap/schema/fusiondirectory/rfc2307bis.schema include /etc/openldap/schema/fusiondirectory/samba.schema include /etc/openldap/schema/fusiondirectory/samba-fd-conf.schema include /etc/openldap/schema/fusiondirectory/core-fd-conf.schema include /etc/openldap/schema/fusiondirectory/core-fd.schema include /etc/openldap/schema/fusiondirectory/ldapns.schema include /etc/openldap/schema/fusiondirectory/recovery-fd.schema include /etc/openldap/schema/fusiondirectory/dnszone.schema include /etc/openldap/schema/fusiondirectory/dhcp-fd.schema include /etc/openldap/schema/fusiondirectory/dsa-fd-conf.schema include /etc/openldap/schema/fusiondirectory/mime-fd.schema include /etc/openldap/schema/fusiondirectory/service-fd.schema include /etc/openldap/schema/fusiondirectory/systems-fd-conf.schema include /etc/openldap/schema/fusiondirectory/openssh-lpk.schema include /etc/openldap/schema/fusiondirectory/systems-fd.schema include /etc/openldap/schema/fusiondirectory/mail-fd.schema include /etc/openldap/schema/fusiondirectory/mail-fd-conf.schema include /etc/openldap/schema/fusiondirectory/alias-fd-conf.schema include /etc/openldap/schema/fusiondirectory/alias-fd.schema password-hash {SSHA} pidfile /var/run/openldap/slapd.pid loglevel 256 modulepath /usr/lib64/openldap moduleload back_hdb moduleload memberof database monitor database hdb mode 0600 suffix dc=firewall-services,dc=com rootdn cn=admin,dc=firewall-services,dc=com rootpw __LDAP_SECRET__ directory /var/lib/ldap cachesize 10000 checkpoint 128 15 index uid,mail eq,sub index cn,sn,givenName,ou pres,eq,sub index objectClass pres,eq index uidNumber,gidNumber,memberuid,member eq index gosaSubtreeACL,gosaObject,gosaUser pres,eq index sambaSID eq,sub index sambaPrimaryGroupSID eq index sambaDomainName eq index sambaGroupType eq index sambaSIDList eq index zoneName eq index relativeDomainName eq index dhcpHWAddress eq index dhcpClassData eq index dhcpPrimaryDN eq index dhcpSecondaryDN eq index dhcpServerDN eq index dhcpFailOverPeerDN eq access to attrs=userPassword,sambaLmPassword,sambaNtPassword by dn=cn=samba,ou=DSA,dc=firewall-services,dc=com write by anonymous auth by self write by * none access to attrs=sambaAcctFlags,sambaBadPasswordCount,sambaBadPasswordTime,sambaKickoffTime,sambaLogoffTime,sambaLogonHours,sambaPasswordHistory,sambaSID,sambaPrimaryGroupSID,sambaPwdCanChange,sambaPwdLastSet,sambaPwdMustChange,sambaUserWorkstations,sambaSIDList,sambaGroupType,sambaMungedDial,sambaLogonHours,sambaLogonTime,sambaDomainName,sambaHomePath,sambaHomeDrive by dn=cn=samba,ou=DSA,dc=firewall-services,dc=com write by group.exact="cn=admins,ou=Groups,dc=firewall-services,dc=com" write by self read by * none access to filter=(objectClass=sambaDomain) by dn=cn=samba,ou=DSA,dc=firewall-services,dc=com write by group.exact="cn=admins,ou=Groups,dc=firewall-services,dc=com" write by * none access to dn.subtree=ou=Computers,ou=systems,dc=firewall-services,dc=com by dn=cn=samba,ou=DSA,dc=firewall-services,dc=com write by group.exact="cn=admins,ou=Groups,dc=firewall-services,dc=com" write by * none access to attrs=loginShell,gidNumber,homeDirectory,uidNumber,shadowExpire,shadowFlag,shadowInactive,shadowLastChange,shadowMax,shadowMin,shadowWarning by dn=cn=samba,ou=DSA,dc=firewall-services,dc=com write by self read by dn="cn=unix,ou=DSA,dc=firewall-services,dc=com" read access to dn.subtree=ou=DSA,dc=firewall-services,dc=com by group.exact="cn=admins,ou=Groups,dc=firewall-services,dc=com" write by * none access to dn.base=dc=firewall-services,dc=com by * read access to dn.subtree=ou=systems,dc=firewall-services,dc=com filter=(objectClass=dNSZone) by group.exact="cn=admins,ou=Groups,dc=firewall-services,dc=com" write by dn="cn=dns,ou=DSA,dc=firewall-services,dc=com" read by * none access to dn.regex="^.*,ou=(People|Groups),dc=firewall-services,dc=org" by * read access to * by users read by anonymous auth