2.0: Configuring LDAP: Difference between revisions
Line 234: | Line 234: | ||
# accesslog ACL |
# accesslog ACL |
||
access to dn.base="cn=accesslog" |
#access to dn.base="cn=accesslog" |
||
# by self write |
|||
access to dn.subtree="cn=accesslog" |
#access to dn.subtree="cn=accesslog" |
||
# by self write |
|||
# Samba database |
# Samba database |
Revision as of 11:12, 26 January 2007
Replicated Failover Domain Controller and file server using LDAP
3.0. Initialization LDAP Database
5.0. Heartbeat HA Configuration
2.0. Configuring LDAP
It is necessary to use LDAP as our backend to Samba which provides replication to the Backup Domain Controllers.
Please read the official OpenLDAP documentation for detailed explanations of the material covered here. [???]
There are two methods for providing replication, using openldap’s “slurpd” to provide Master / Slave operation, the database is pushed to slaves which is defined in slapd.conf on the master LDAP server; here is an example of the original way defined in 2.1: slapd.conf Master.
replica host=192.168.0.3:389 suffix="dc=differentialdesign,dc=org" binddn="cn=syncuser,dc=differentialdesign,dc=org" bindmethod=simple credentials=SyncUser
To bind to the database the slave replicas will need to use “syncusers’s” password defined above as “credentials=SyncUser“. Initially you will need to manually populate the slave database as defined in section 3.4 Database Replication.
The main restriction with using this original design is the ldap database needs to be restarted on both the master and the slave when adding additional replicas.
LDAP Replication Configuration
Master
Slave(s)
A master LDAP database that is replicated real time to the backup domain controller.
A slave LDAP database that provides load balance authentication, and can be used as a failover if the master becomes unavailable.
LDAP Replication Configuration
Provider
Consumers(s)
A provider LDAP database that has the most updated version of the database.
A consumer requests an update at a set interval, and provides load balancing.
The ulternative is to use syncrepl which is included in the ldap daemon. This means we no longer need to run slurpd daemon which is to replicate the database.
There are 2 main types of syncrepl operation: “refeshOnly” operation where the consumer requests an update from the provider at set time interval defined as “interval=00:00:10:00” which would pull the provider every 10 minutes. The more desirable way is to use “refrshAndPersist” which provides a consistent connection. Instead of using a time interval to poll the provider we have the parameter “retry="30 10 300 +" which means it will retry 10 times every 30 seconds, then every 300 seconds “+” indicates indefinite number of retries.
In version Openldap 2.3 delta-syncrepl was invented because the original syncrepl method used too much network bandwidth. Developers recommend you use the latest version of Openldap as version 2.2 was decommisioned over one year ago.
Additionally the ldap daemon does not need to be restarted on the provider; the consumer will request and retrieve the database by polling the provider at a set interval or on initial connect.
2.1. slapd.conf Master
This is the original method for replicating the database to slave ldap servers. We are using the slurpd which has been around for a long time and proven itself to be stable.
This configuration file should work on any version of Openldap.
# /etc/openldap/slapd.conf # using slurpd # LDAP Master include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args database bdb suffix "dc=differentialdesign,dc=org" rootdn "cn=Manager,dc=differentialdesign,dc=org" rootpw Manager directory /var/lib/ldap replica host=node2.differentialdesign.org:389 suffix="dc=differentialdesign,dc=org" binddn="cn=syncuser,dc=differentialdesign,dc=org" bindmethod=simple credentials=SyncUser replogfile /var/lib/ldap/replogfile access to attrs=userPassword by self write by dn="cn=sambaadmin,dc=differentialdesign,dc=org" write by dn="cn=syncuser,dc=differentialdesign,dc=org" read by * auth access to attrs=sambaLMPassword,sambaNTPassword by dn="cn=sambaadmin,dc=differentialdesign,dc=org" write by dn="cn=syncuser,dc=differentialdesign,dc=org" read access to * by dn="cn=sambaadmin,dc=differentialdesign,dc=org" write by dn="cn=syncuser,dc=differentialdesign,dc=org" read by * read # Indices to maintain index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uidNumber eq index gidNumber eq index memberUID eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub
2.1.1. slapd.conf Master syncrepl Openldap2.2
This is the slapd.conf master ldap file; we are using syncrepl instead of slurpd which is the traditional method.
This configuration file is specifically designed for openldap 2.2 and supports syncrepl refreshOnly mode.
# slapd.conf Master syncrepl Openldap2.2 # Provider include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args database bdb suffix "dc=differentialdesign,dc=org" rootdn "cn=Manager,dc=differentialdesign,dc=org" rootpw Manager directory /var/lib/ldap access to attrs=userPassword by self write by dn="cn=sambaadmin,dc=differentialdesign,dc=org" write by dn="cn=syncuser,dc=differentialdesign,dc=org" read by * auth access to attrs=sambaLMPassword,sambaNTPassword by dn="cn=sambaadmin,dc=differentialdesign,dc=org" write by dn="cn=syncuser,dc=differentialdesign,dc=org" read access to * by dn="cn=sambaadmin,dc=differentialdesign,dc=org" write by dn="cn=syncuser,dc=differentialdesign,dc=org" read by * read # Indices to maintain index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uidNumber eq index gidNumber eq index memberUID eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub
2.1.2. slapd.conf Master delta-syncrepl Openldap2.3
This configuration file is designed to support Openldap’s newest features. We will be using delta-syncrepl which supports refreshAndPersist with performance similar to that of slurpd.
The below slapd.conf will only run on Openldap 2.3.
Take note of the “modulepath /usr/lib/openldap2.3” in the below file, you will need to change this to where you have syncprov.la located.
#slapd.conf Master delta syncrepl Openldap2.3 #provider include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema #If your slapd was configured with dynamic module support, and your backends and overlays are not statically compiled, you will need these module statements. modulepath /usr/lib/openldap2.3 moduleload syncprov.la moduleload accesslog.la pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args # Accesslog database definitions database bdb suffix cn=accesslog directory /var/lib/ldap/accesslog rootdn cn=accesslog index default eq index entryCSN,objectClass,reqEnd,reqResult,reqStart overlay syncprov syncprov-nopresent TRUE syncprov-reloadhint TRUE # Let the replica DN have limitless searches limits dn.exact="cn=syncuser,dc=differentialdesign,dc=org" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited # accesslog ACL #access to dn.base="cn=accesslog" # by self write #access to dn.subtree="cn=accesslog" # by self write # Samba database database bdb suffix "dc=differentialdesign,dc=org" directory /var/lib/ldap rootdn "cn=Manager,dc=differentialdesign,dc=org" rootpw Manager index entryCSN eq index entryUUID eq overlay syncprov syncprov-checkpoint 1000 60 # accesslog overlay definitions for primary db overlay accesslog logdb cn=accesslog logops writes logsuccess TRUE # scan the accesslog DB every day, and purge entries older than 7 days logpurge 07+00:00 01+00:00 #Let the replica DN have limitless searches limits dn.exact="cn=syncuser,dc=differentialdesign,dc=org" time.soft=unlimited time.hard=unlimited size.soft=unlimited size.hard=unlimited access to attrs=userPassword by self write by dn="cn=sambaadmin,dc=differentialdesign,dc=org" write by dn="cn=syncuser,dc=differentialdesign,dc=org" read by * auth access to attrs=sambaLMPassword,sambaNTPassword by dn="cn=sambaadmin,dc=differentialdesign,dc=org" write by dn="cn=syncuser,dc=differentialdesign,dc=org" read access to * by dn="cn=sambaadmin,dc=differentialdesign,dc=org" write by dn="cn=syncuser,dc=differentialdesign,dc=org" read # Indices to maintain index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uidNumber eq index gidNumber eq index memberUID eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub
2.2. slapd.conf Slave
This is the original method for replicating the database to slave ldap servers. We are using the slurpd which has been around for a long time and proven itself to be stable.
This configuration file should work on any version of openldap.
# /etc/openldap/slapd.conf # using slurpd # LDAP Slave include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args database bdb suffix "dc=differentialdesign,dc=org" rootdn "cn=Manager,dc=differentialdesign,dc=org" rootpw Manager access to attrs=userPassword by dn="cn=sambaadmin,dc=differentialdesign,dc=org" read by dn="cn=syncuser,dc=differentialdesign,dc=org" write by * auth access to attrs=sambaLMPassword,sambaNTPassword by dn="cn=sambaadmin,dc=differentialdesign,dc=org" read by dn="cn=syncuser,dc=differentialdesign,dc=org" write access to * by dn="cn=syncuser,dc=differentialdesign,dc=org" write by * read updatedn cn=syncuser,dc=differentialdesign,dc=org updateref ldap://node1.differentialdesign.org directory /var/lib/ldap # Indices to maintain index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uidNumber eq index gidNumber eq index memberUID eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub
2.2.1. slapd.conf Slave syncrepl Openldap2.2
This is the configuration file for openldap version 2.2 using the syncrepl method refreshOnly.
# slapd.conf Slave syncrepl Openldap2.2 # LDAP Consumer include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args database bdb suffix "dc=differentialdesign,dc=org" rootdn "cn=Manager,dc=differentialdesign,dc=org" rootpw Manager directory /var/lib/ldap syncrepl rid=0 provider=ldap://node1.differentialdesign.org:389 binddn="cn=syncuser,dc=differentialdesign,dc=org" bindmethod=simple credentials=SyncUser searchbase="dc=differentialdesign,dc=org" filter="(objectClass=*)" attrs="*" schemachecking=off scope=sub type=refreshOnly interval=00:06:00:00 access to attrs=userPassword by dn="cn=sambaadmin,dc=differentialdesign,dc=org" read by dn="cn=syncuser,dc=differentialdesign,dc=org" write by * auth access to attrs=sambaLMPassword,sambaNTPassword by dn="cn=sambaadmin,dc=differentialdesign,dc=org" read by dn="cn=syncuser,dc=differentialdesign,dc=org" write access to * by dn="cn=syncuser,dc=differentialdesign,dc=org" write by * read # Indices to maintain index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uidNumber eq index gidNumber eq index memberUID eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub
2.2.2. slapd.conf Slave delta-syncrepl Openldap2.3
# slapd.conf delta synrepl Openldap2.3 # LDAP Consumer include /etc/openldap/schema/core.schema include /etc/openldap/schema/cosine.schema include /etc/openldap/schema/inetorgperson.schema include /etc/openldap/schema/nis.schema include /etc/openldap/schema/samba.schema pidfile /var/run/slapd/slapd.pid argsfile /var/run/slapd/slapd.args database bdb suffix "dc=differentialdesign,dc=org" directory /var/lib/ldap rootdn "cn=Manager,dc=differentialdesign,dc=org" rootpw Manager # syncrepl directives syncrepl rid=0 provider=ldap://node1.differentialdesign.org:389 bindmethod=simple binddn="cn=syncuser,dc=differentialdesign,dc=org" credentials=SyncUser searchbase="dc=differentialdesign,dc=org" logbase="cn=accesslog" logfilter="(&(objectClass=auditWriteObject)(reqResult=0))" schemachecking=on type=refreshAndPersist retry="60 +" syncdata=accesslog access to attrs=userPassword by dn="cn=sambaadmin,dc=differentialdesign,dc=org" read by dn="cn=syncuser,dc=differentialdesign,dc=org" write by * auth access to attrs=sambaLMPassword,sambaNTPassword by dn="cn=sambaadmin,dc=differentialdesign,dc=org" read by dn="cn=syncuser,dc=differentialdesign,dc=org" write access to * by dn="cn=syncuser,dc=differentialdesign,dc=org" write updateref ldap://node1.differentialdesign.org # Indices to maintain index objectClass eq index cn pres,sub,eq index sn pres,sub,eq index uid pres,sub,eq index displayName pres,sub,eq index uidNumber eq index gidNumber eq index memberUID eq index sambaSID eq index sambaPrimaryGroupSID eq index sambaDomainName eq index default sub
2.3. ldap.conf Master
You will notice below in the host options that we use both IP addresses of the Primary and Secondary LDAP database servers. This serves as a failover option if the local LDAP database is inaccessible. The same applies for the Slave LDAP configuration; 2.4: ldap.conf Slave
#/etc/ldap.conf # LDAP Master host node1.differentialdesign.org node2.differentialdesign.org base dc=differentialdesign,dc=org binddn cn=Manager,dc=differentialdesign,dc=org bindpw Manager pam_password exop nss_base_passwd ou=People,ou=Users,dc=differentialdesign,dc=org?one nss_base_shadow ou=People,ou=Users,dc=differentialdesign,dc=org?one nss_base_passwd ou=Computers,ou=Users,dc=differentialdesign,dc=org?one nss_base_shadow ou=Computers,ou=Users,dc=differentialdesign,dc=org?one nss_base_group ou=Groups,dc=differentialdesign,dc=org?one ssl no
2.4. ldap.conf Slave
#/etc/ldap.conf # LDAP Slave host node2.differentialdesign.org node1.differentialdesign.org base dc=differentialdesign,dc=org binddn cn=Manager,dc=differentialdesign,dc=org bindpw Manager pam_password exop nss_base_passwd ou=People,ou=Users,dc=differentialdesign,dc=org?one nss_base_shadow ou=People,ou=Users,dc=differentialdesign,dc=org?one nss_base_passwd ou=Computers,ou=Users,dc=differentialdesign,dc=org?one nss_base_shadow ou=Computers,ou=Users,dc=differentialdesign,dc=org?one nss_base_group ou=Groups,dc=differentialdesign,dc=org?one ssl no