Professional Documents
Culture Documents
05 - Directories
05 - Directories
System Administration
Directories
Topics
1. Directories
2. LDAP Structure
3. LDIF
4. Distinguished Names
5. Replication
6. OpenLDAP Configuration
What is a Directory?
Directory: A collection of
information that is primarily
searched and read, rarely modified.
1
Directories vs. Databases
Directories are optimized for reading.
– Databases balanced for read and write.
Directories are tree-structured.
– Databases typically have relational structure.
Directories are usually replicated.
– Databases can be replicated too.
Both are extensible data storage systems.
Both have advanced search capabilities.
Advantages of Directories
Make administration easier.
– Change data only once: people,
accounts, hosts.
Unify access to network resources.
– Single sign on.
– Single place for users to search
(address book)
Improve data management
– Improve consistency (one location vs
many)
– Secure data through only one server.
CIT 470: Advanced Network and System Administration Slide #6
2
NIS: Network Information Service
Originally called Sun Yellow Pages
– Clients run ypbind.
– Servers run ypserv.
– Data stored under /var/yp on server.
Server shares NIS maps with clients
– Each UNIX file may provide multiple NIS maps.
– NIS maps map keys like UID, username to data.
– passwd: passwd.byname, passwd.byuid
Slave servers replicate master server content.
Easy to use, but insecure, difficult to extend.
LDAP
Lightweight Directory Access Protocol
– Lightweight compared to X.500 directories.
– Directory, not a database, service.
– Access Protocol, not a directory itself.
3
LDAP Structure
An LDAP directory is made of entries.
– Entries may be employee records, hosts, etc.
Each entries consists of attributes.
– Attributes can be names, phone numbers, etc.
– objectClass attribute identifies entry type.
Each attribute is a type / value pair.
– Type is a label for the information stored (name)
– Value is value for the attribute in this entry.
– Attributes can be multi-valued.
LDAP Schemas
Schemas specify allowed objectClasses and attributes.
4
LDIF
LDAP Interchange Format.
– Standard text format for storing LDAP configuration
data and directory contents.
LDIF Files
– Collection of entries separated by blank lines.
– Mapping of attribute names to values.
Uses
– Import new data into directory.
– Export directory to LDIF files for backups.
5
Distinguished Names
Distinguished Names (DNs)
– Uniquely identify an LDAP entry.
– Provides path from LDAP root to the named entry.
– Similar to an absolute pathname.
– dn:cn=Jeff Foo,ou=Sales,dc=plainjoe,dc=org
Relative DNs (RDNs)
– Any unique attribute pair in directory’s container.
– ex: cn=Jeff Foo OR username=fooj
– Similar to a relative pathname.
– Except may have multiple components.
– cn=Jane Smith+ou=Sales
– cn=Jane Smith+ou=Engineering
(R)DN Example #1
(R)DN Example #2
6
ldapsearch
Options
-LLL removes comments and LDAP version info.
-b base supplies base DN (uses ldap.conf if no -b.)
-x uses simple authentication instead of SASL.
-H ldap://your.server.edu accesses that server.
If -H not specified, uses ldap.conf to find server.
Search for all elements
ldapsearch -LLL -x -b "dc=gkar,dc=nku,dc=edu"
"(objectclass=*)"
7
Multiple Record Matches
> ldapsearch -LLL -x "(loginShell=/bin/bash)"
dn: uid=fooj,ou=People,dc=gkar,dc=nku,dc=edu
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
uid: fooj
uidNumber: 10101
cn: fooj
homeDirectory: /home/b/fooj
loginShell: /bin/bash
...
Size limit exceeded (4)
CIT 470: Advanced Network and System Administration Slide #22
Wildcard Matches
> ldapsearch -LLL -x "(uid=smith*)"
dn: uid=smitha,ou=People,dc=gkar,dc=nku,dc=edu
uid: smitha
uidNumber: 10221
cn: smitha
homeDirectory: /home/f/smitha
loginShell: /bin/bash
...
dn:
uid: smithj
uidNumber: 12302
cn: smithj
homeDirectory: /home/g/smithj
CIT 470: Advanced Network and System Administration Slide #23
8
LDAP Operations
Client Session Operations
– Bind, unbind, and abandon
Query and Retrieval Operations
– Search and compare
Modification Operations
– Add, modify, modifyRDN, and delete
Authentication
Anonymous Authentication
Binds with empty DN and password.
Simple Authentication
Binds with DN and password. Cleartext.
Simple Authentication over SSL/TLS
Use SSL to encrypt simple authentication.
Simple Authentication and Security Layer
SASL is an extensible security scheme.
SASL mechanisms: Kerberos, GSSAPI, SKEY
Distributed Directories
Use multiple LDAP servers.
Provider: master server provides LDIF to
Consumers: provide LDAP access to clients.
Why distribute?
Throughput
More servers can reduce load on any single server.
Latency
Have local server serve local data to LAN.
Only use WAN for non-local data on other servers.
Administrative Boundaries
Let each side administrate their own directory.
9
Open source LDAPv3 server.
– LDAP server: slapd
– Client commands: ldapadd, ldapsearch
– Backend storage: BerkeleyDB
– Backend commands: slapadd, slapcat
– Schemas: /etc/openldap/schema
– Data: /var/lib/ldap
Configuration files
– Client: /etc/openldap/ldap.conf
– Server: /etc/openldap/slapd.conf
CIT 470: Advanced Network and System Administration Slide #28
slapd.conf (Server)
File Locations (usually accept defaults)
Schema files
Configuration files
Database directory
Database
suffix = DN of topmost node in directory
rootdn = DN of LDAP administrative user
rootpw = Password of LDAP administrator
Access Control
CIT 470: Advanced Network and System Administration Slide #30
10
ldap.conf (Client)
#
# LDAP Defaults
#
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
CIT 470: Advanced Network and System Administration Slide #31
References
1. Brian Arkills, LDAP Directories Explained: An Introduction and
Analysis, Addison-Wesley, 2003.
2. Gerald Carter, LDAP System Administration, O’Reilly, 2003.
3. LDAP Howtos, Links, and Whitepapers, http://www.bind9.net/ldap/,
2005.
4. http://www.ldapman.org/, 2005.
5. LDAP for Rocket Scientists, http://www.zytrax.com/books/ldap/,
2009.
6. Thomas Limoncelli, Christine Hogan, Strata Chalup, The Practice of
System and Network Administration, 2nd ed, Limoncelli and Hogan,
Addison-Wesley, 2007.
7. Luiz Malere, “Linux LDAP HOWTO,”
http://www.tldp.org/HOWTO/LDAP-HOWTO/, 2004.
8. Evi Nemeth et al, UNIX System Administration Handbook, 3rd
edition, Prentice Hall, 2001.
9. OpenLDAP, OpenLDAP Administrator’s Guide,
http://www.openldap.org/devel/admin/, 2005.
11