Installing A Virtual LDAP/Samba Server Part 2

Part 2: Preparing the Server and Setting Up LDAP

Ok, following on from Part 1 now we've got our virtual machine all set up and running we're going to prepare it and set up the LDAP server.

In order to be able to SSH into the machine, rather than using the console provided by the vSphere client, I always start by changing the IP address. To do this type:

sudo vi /etc/network/interfaces

And hit return.

You will be prompted for the sudo password, which is the password you set up for the user created in part 1.

This is what the file will look like. You need to start by changing the 'dhcp' to 'static. 

Then you can add the fields for the address, netmask, network, broadcast, gateway, dns-search and dns-nameservers. You will need to put in your own IP address, etc, here.

Now you will need to restart the network. To do this type:

sudo /etc/init.d/networking restart

And hit return. You will now be able to SSH into the server using the IP address. 

Now you will want to enable the root user, as it is easier than using the sudo command.

To do this type:

sudo passwd root

And hit enter. First you will need to enter the sudo password, which is the password for the user you created in part one. You will then be prompted to enter and verify the root password.

Once you've done this you'll be able to su to the root user.

To do this type su and enter the root password that you just set.

As this is a new machine there may be updates that need to be installed.

To this type:

apt-get update

apt-get upgrade

And hit return. When prompted about whether you would like to proceed with the upgrade, type 'y' and hit return.

When the updates have run, you may need to update the system. To do this simply type:

reboot

And hit return. If you are using a client such as Putty to SSH into the server you will be temporarily kicked out and will need to restart your session.

To simplify administration of your server and it's features you may want to install Webmin.

To do this type:

apt-get install perl libnet-ssleay-perl libauthen-pam-perl libpam-runtime libio-pty-perl libnet-ldap-perl apt-show-versions python

wget http://prdownloads.sourceforge.net/webadmin/webmin_1.690_all.deb  

**Webmin 1.690 was the current webmin version at the time of writing. This may have changed**

dpkg -i webmin_1.690_all.deb

Once you have installed this you will be able to access Webmin by opening your web browser and typing "https://<ipaddress/hostname>:1000" in the address bar. Now you will be able to upload and download files, and maintain your server using a web GUI

Before installing the LDAP server you need to edit the hosts file:

vi /etc/hosts

You need to change the second line (starting 127.0.1.1) so that it is <hostname>.<domain> and then tab across and put the hostname in again.

euro.pec is our domain name, in order to get your server running you need to ensure that you replace this with your own domain name.

Now edit the hostname file, and ensure that it matches the hostname of your machine. 

vi /etc/hostname

Now you can install the LDAP server. 

apt-get install slapd ldap-utils

You will be prompted to choose an administrator password.

Once the installation  is finished you can check everything installed properly by running two searches one to check the DIT and one to check your own data (dc=euro,dc=pec), first:

ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config dn

 

The result should look like:

dn: cn=config

dn: cn=module{0},cn=config

dn: cn=schema,cn=config

dn: cn={0}core,cn=schema,cn=config

dn: cn={1}cosine,cn=schema,cn=config

dn: cn={2}nis,cn=schema,cn=config

dn: cn={3}inetorgperson,cn=schema,cn=config

dn: olcBackend={0}hdb,cn=config

dn: olcDatabase={-1}frontend,cn=config

dn: olcDatabase={0}config,cn=config

dn: olcDatabase={1}hdb,cn=config

Then run:

ldapsearch  -x -LLL -H ldap:/// -b dc=euro,dc=pec dn

The result should look like: 

dn: dc=euro,dc=pec

dn: cn=admin,dc=euro,dc=pec

In order to get this second search to run properly you need to have the correct domain name set in the /etc/hosts file.

The next step to getting your LDAP server up and running is to introduce content to the database.

For this you will need to create an ldif file , you can call it whatever you want, the file I'm using is called load.ldif  

There are two ways you can create this file: you can use a text editor such as Notepad, and then upload it to the server using webmin, or you  can create it on the server using the 'vi' command, i.e 'vi load.ldif'

The test data I'm using is:

dn: ou=Users,dc=euro,dc=pec
objectClass: organizationalUnit
ou: Users

dn: ou=Groups,dc=euro,dc=pec
objectClass: organizationalUnit
ou: Groups

dn: cn=IS,ou=Groups,dc=euro,dc=pec
objectClass: posixGroup
cn: miners
gidNumber: 5000

dn: uid=jade,ou=Users,dc=euro,dc=pec
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
uid: Jade
sn: Whelan
givenName: Jade
cn: Jade Whelan
displayName: Jade Whelan
uidNumber: 10000
gidNumber: 5000
userPassword: passw0rd
gecos: Jade Whelan
loginShell: /bin/bash
homeDirectory: /home/jade

In order to create this file I am using 'vi load.ldif' and copying the data in.

To load this data into the database, the command is:

ldapadd -x -D cn=admin,dc=euro,dc=pec -W -f load.ldif

Remember to make you have the right domain name and filename, and then press enter
You should see:

adding new entry "ou=Users,dc=euro,dc=pec"

adding new entry "ou=Groups,dc=euro,dc=pec"

adding new entry "cn=IS,ou=Groups,dc=euro,dc=pec"

adding new entry "uid=jade,ou=Users,dc=euro,dc=pec"

Now to ensure the data has been input properly you can run the following search:

ldapsearch -x -LLL -b dc=euro,dc=pec 'uid=jade' cn gidNumber

The result should be:

dn: uid=jade,dc=euro,dc=pec

cn: Jade Whelan

gidNumber: 5000

There are a number of different switches used when querying and modifying LDAP

• ·         -x - a 'simple' binding, meaning the default SASL method will not be used.
• ·         -LLL - disable printing unnecessary information
• ·         uid=jade - a filter to locate the user with 'uid=jade'. This is handy if you only need to find/delete/modify one user entry
• ·         cn gidNumber - requests a certain attribute to be shown, without this all attributes will be shown.

Something that is really useful with LDAP is enabling logging. It's not enabled by default so you have to turn it on after you've installed the LDAP software. We are going to be using the 'stats' level of logging. To enable logging, you first need to create an ldif file. I'm using the filename logging.ldif and the 'vi' method.

The information that needs to be in the file is:

dn: cn=config
changetype: modify
add: olcLogLevel
olcLogLevel: stats

Once you have created the file, in order to enable logging you need to run:

ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f logging.ldif

This will produce a large amount of logs Once your system is up and running you'll be able to throttle back the logging to a less verbose level.
Now you need to restart the logging daemon:

service rsyslog restart

When we installed slapd package various ACL's (Access Control Lists) were automatically set up. It is always useful to query these in order to get the effective ACL for an LDAP query.
First run:

ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config '(olcDatabase={1}hdb)' olcAccess

The result should look like:

o attrs=userPassword
    by self write
    by anonymous auth
    by dn="cn=admin,dc=euro,dc=pec" write
    by * none

to attrs=shadowLastChange
    by self write
    by anonymous auth
    by dn="cn=admin,dc=euro,dc=pec" write
    by * none

When you run this search in the command line the result will be set out all on one line rather than broken up, I have just set it out like this to make it easier to read.
The next search will display the ACLs of the slapd-config database:

ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config '(olcDatabase={0}config)' olcAccess

The result should look like:

dn: olcDatabase={0}config,cn=config
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,
             cn=external,cn=auth manage by * break

Once you have your LDAP server up and running you will need to install libraries on the client that know how and when to contact it. On Ubuntu this is usually accomplished using the libnss-ldap package. This package will also bring in other useful tools. To install this package run:

apt-get install libnss-ldap

You will be prompted to enter the URI (Uniform Resource Identifier) of your LDAP server, this can either be the hostname:port number or the ipaddress:port number. The default port number LDAP is 389. It's best to use the IP address rather than the hostname, in case of DNS failures.

You will then need to add the distinguished name of your server, this is usually your domain name.

You will then need to select the version of LDAP you will be using, the default selection is the newest versions, (at the moment it's 3) but you can also roll back to the previous version if you wish.

You will also be asked if you want to make the local user the database admin, the default selection is yes., you will then be asked if the LDAP database requires a login, the default option for this is no. 

Now you need to configure the LDAP user for the root account, we are using admin.euro.pec, but you can also use Manager, Administrator or whatever you fancy, with your domain name as the suffix. 

You can then set the account password.

If you make a mistake, or want to go back and change you can run:

dpkg-reconfigure ldap-auth-config

Now you can configure the LDAP profile NSS:

auth-client-config -t nss -p lac_ldap

Then you need to configure the server to use LDAP for authentication:

pam-auth-update

Ensure that all the boxes are marked with stars. You need Winbind to be running in order to get Samba automatically syncing users LDAP users. 

Ok, now for the last leg of this part. 

We now need to install some LDAP tools that will help us to create, modify and delete users and groups. This can be done using ldap-utils, but the long string of options needed can make this hard to use. The ldapscripts package contains wrapper scripts that are a lot easier to use.

apt-get install ldapscripts

Once this is installed you will need to edit the /etc/ldapscripts/ldapscripts.conf file. These screenshots will be shown in pairs, the first should be changed to match the second. 

Now you need to create the ldapscripts.passwd file to allow the rootDN access to the database:

sh -c "echo -n 'password' > /etc/ldapscripts/ldapscripts.passwd"

You need to replace the word 'password' with the password for you databases root user.

Now you need to modify the permissions of the file:

chmod 400 /etc/ldapscripts/ldapscripts.passwd

Now the file will be locked down so no one can access the password.

The scripts are now set up to help you manage your directory. There are a number of ways you can use them, such as:

ldapaddgroup Avengers - This will add a new group  called Avengers to your database,

ldapadduser SteveRogers Avengers - This will create a user with the uid SteveRogers, and put him in the Avengers group. 

ldapsetpasswd SteveRogers - This will allow you to set/change the users password. When you set up the user it doesn't prompt you to enter the password, so it's best to run this after ldapadduser. 

There are many other things you can do with ldapscripts, you can also use ldapmodify to change user attributes such as gecos, cn or displayName.

One extra thing that might be handy is to set up the pam_mkhomedir module. Even though the makehomes option in the ldapscripts.conf file is set to yes, I choose not to rely solely on that. The module is really easy to set up.

vi /usr/share/pam-configs/my_mkhomedir

Then you need this information in the file:

Name: activate mkhomedir
Default: yes
Priority: 900
Session-Type: Additional
Session:
required pam_mkhomedir.so umask=0022 skel=/etc/skel

Then finally you activate it by running:

pam-auth-update

and making sure the box is marked with a star:

And now you have your LDAP server up and running!

You'll be able to add users and groups with your LDAP scripts and all of their home directories will also be created.

If you are adding users in bulk I recommend using a file like we did when adding the first user. It's a lot easier than retyping "ldapadduser user group" over and over again, and you can also set the password in the file so you wouldn't need to run the ldapsetpasswd command.

Next I'll be taking you through getting Samba working with LDAP.

If there is anything you guys feel I have missed, anything you wanna add or anything you would like to know, drop it in the comments section!

On to part 3
<3

Comic Con Preparations!

So, Comic Con is this weekend and to be honest I'm trying desperately not to get myself in a tizz. Me, Corey and James all have our costumes, tickets are booked, train tickets are booked, budgeting has been done so that I don't spend a fortune, and we're working on a batmobile for James's pram.
This will be mine and James's first Comic Con (it won't be the last, I've got costume plans for 2 more Comic Cons after this one) so I'm getting very, very excited. We're going as a little Arkham City family, although I think if the Joker and Harley Quinn had Batman as a baby, Gotham would be a very different place!

Corey trying out his Joker costume!


My lickle suphero


Preparing the batmobile step 1. Paint some cardboard black. This is all the progress that has been made so far. Asses need to be put in gear!


Me rocking my Harley Quinn costume.

Me and James will be getting the train to Leicester in the morning, since poor Corey will be at work, so he'll have to join us later on. It's going to be a very, very interesting train journey, totally prepared for all the weird looks we will undoubtedly get!
Its going to be such an awesome day, and there will be loads of pictures to follow, I'm excited to see some amazing cosplays!
If you're there, and you see us, feel free to come say hi! Will be awesome to meet some new nerdy people!


<3

Installing A Virtual LDAP/Samba Server Part 1

Part 1: Installing the Virtual Machine.

I am going to show you how to install a virtual samba/LDAP server from scratch. When everything is up and running we'll back it up to a secondary server.

LDAP stands for Lightweight Directory Access Protocol, and is basically a way of searching through and modifying x.500-based directory services running over TCP/IP. An LDAP directory is a tree of data entries. which is hierarchical in nature and is called a Directory Information Tree, or DIT. Entries consist of attributes, which have types and values.
LDAP can be used for anything that requires lots of access requests to a mostly read, attribute based backend, such as address books, lists of email addresses and mail server configurations.

I've found that virtual machines are best for this kind of project, because they can be easily deleted and reinstalled, which is something I've had to do a lot over the past month while I've been working on this. If I'd been using a physical computer having to reinstall the operating system every time the server gave up on me I probably would have given up on this whole project a long time ago! I really struggled to find a walk through that took me from setting up the LDAP server all the way to backing it up and installing Samba, and I found no matter what I did I couldn't make replication work using the guide on the Ubuntu website. So I came up with my own solution. But we'll get to that later on.

This will be split into four sections, installing the virtual machine, preparing and setting up LDAP, setting up Samba, and backing up the servers.
This section covers installing the virtual machine itself. I am doing this using the vSphere Web Client, but it can also be done in the same way using the desktop client.

Start by naming your virtual machine and choosing the location that it will be stored in.

Next choose where the virtual machine will be stored. This will be where your machine gets it memory and RAM from so make sure you choose a host with plenty of space.


Then choose which ESXi version you want to use. Its always best to accept the default for this one as it will be the newest version.


Now choose your operating system. We are using Ubuntu 12.04


Now you need to decide how much RAM and disk space you are going to give your client machine, and how many CPU cores you want it to have. We are giving our machine 4GB of RAM and 150GB of disk space, and a single core.
Here we are also selecting to mount an ISO file in the virtual machine's disk drive in order to be able to install the operating system. This can also be done using the disk drive of the host machine, if one is available. When you have selected your disk drive, tick the box that says connect.


Finally, check over the selections you've made. If there is anything you want to change you can click the back button and find what you want to change, otherwise click the finish button.


Now select to power on the machine and launch the console.


When you open the console, you will be prompted for the language you would like to use, and then with an installation options screen. Select to install Ubuntu.



You will be asked for the regions language again, and the keyboard layout (English UK, English US etc.) You will be able to choose whether you want the operating system to detect the language, or select it from a list. We are choosing to select from a list




Then you will be prompted to enter the host name again.


Now you will be prompted for user information. Enter the users name, and then pick a username for the account, by default Ubuntu will want to use the users name as the user name for logging into the account. Then you need to set a password.





You will be asked whether or not you want your home directory to be encrypted. The default selection for this is no.

Then you need to confirm your time zone.


Next you will need to select how you would like your disks to be formatted. We are accepting the default option of using the entire disk for LVM. Then you need to select which disk you want to partition, and how much disk space you would like to use for the partition. You will then need to write the current partition to disk.




You will then need to decide how much disk space will be used for the partition. The default option is all of the space.


You will then be asked to write all of these changes disk.


The operating system will now continue with the installation.

You will then be prompted about your HTTP proxy. This is left empty by default.


The operating system will now continue with the installation.

You will be asked to configure automatic updates. The default selection is no automatic updates.


Next you will be asked what additional feature you would like to install. Select the features you would like your server to have. You will need to install OpenSSH in order to SSH into the machine, Samba in order for users to have Samba access (which is vital to the server we are building) and LAMP in order to have MySQL, Perl, Python, PHP and the Linux kernel on your system. You can select any additional features you feel you may need.


You will prompted for the MySQL user password if you have selected to install the LAMP server.


Next select whether you would like to install the GRUB boot loader.


Congratulations! You have now installed your virtual machine! You now need to reboot the machine.


If there is anything you guys feel I have missed, anything you wanna add or anything you would like to know, drop it in the comments section!

Now onto Part 2!


<3

Happy Monday! A Quick Introduction to Virtual Machines.

I've decdided this week is a good week to start blogging my work, I have to choose my optional modules for college next week and I think I might even find myself blogging some of that. Purely because I have no doubt it will help me out in the future, and it might even help someone else out, so big smiles all round!
I've decided I'm going to start with something simple, and quite possibly my favourite part of what I do.
This will lead in to a quick tutorial on how to set up a virtual machine, but for now I'm going to stick with a basic overview of what I know, and if any of you guys can think of anything to add, maybe something you find helps you with VMs then that would be seriously cool!

Ok, so lets start with what a virtual machine is. Simply put, its a software representation of a physical PC. It takes on the characteristics of the host machine that it is stored on, for example it shares RAM, disk space and CPU cores with the host, as well as optical drives and peripheral devices.
The handy thing about having a virtual machine installed on a personal computer is that it allows you a second operating system, and although physically its on the same machine, it will act seperate from the host. Kind of like using remote desktop to access another computer. This is handy for testing purposes, or if, like me, you like to switch things round a bit. I have a laptop running windows 8.1, which I actually really like, but every now and again I'll need it to do something and it just laughs at me (not literally, obviously). For this reason I have a virtual machine running Ubuntu Deskop.
I like Ubuntu.its open source so it's free. it looks good and its easy to use. The only problem with it is trying to install Flash Player. That is an absolute ball ache.
I find it useful having two OS's runninng at once on my laptop. Dual boot mode means I can only run one of the OS's at a time and if I want to run the other one I have to reboot my computer, with a virtual machine I just open up VMPlayer (which you can download for free from the VMWare website), and off I go.

I use virtual machines at work because I have a habit of getting frustrated. deleting the machine and starting again. and believe me that's a lot easier than reinstalling the OS of a physical computer. I've spent the last month trying to set up a working LDAP/Samba server and only got it working at the end of last week. I deleted and reinstalled a lot of machines in that time, but truth be told I enjoy the process.

There are so many options when it comes to virtualisation. You could easily (probably in the workplace rather than at home) dump all of the big hulking towers on everyone's desks, and replace them with thin or zero clients, then pick up a couple of relatively cheaps servers with lots of cores and disk space, and set everyone up with a virtual machine. When people log into their computers in the morning they'd actually be logging into a server so they could have tiny form factor computers on their desks. updates would be easily deployed from one place, everything would be stored on the server rather than on the machine, so clients would only need small hard drives. You'd obviously need a secondary server for back up, and it would take a lot of planning, but the opportunity is there!

A little bit later on I'm going to start uploading my guide to creating a Samba/LDAP server starting with setting up a virtual machine.  Watch this space!

Mr Wayne, We've Been Expecting You

It would appear that I have somewhat neglected my blog over the last few months.
Alas, I am back now, like Batman out of self-imposed exile. Although I don't much feel like picking a fight with Bane!
A lot of (probably not so) exciting things have happened since I last posted.
I sat a couple of exams as part of my IT apprenticeship. I passed (naturally), and I am now a CompTIA A+ Certified Professional. Cool, huh? I get a card and everything! I'm probably more proud of that than I am of passing the exam!
James is growing, unfairly quick. He's saying new words every day, at the moment his favourite word is "purple" and I can't help but giggle every damn time he says it! He's gradually learning the dances to his favourite show, Jake and The Neverland Pirates, which I have to admit, I'm quite a fan of!
And he's been on his first holiday.
The first week of May was spent in Skegness, staying in a lovely little caravan. James loved it, he got to chase ducks, go on a donkey ride, see seals, crocodiles and snakes at the Seal Sanctuary, and see some dinosaurs at the Lost World theme park.
It was a very wonderful week, so good in fact that we're going again in August!
We'd been home just under a month when I booked the second week!




We've also booked ourself some tickets to go to Comic Con in Leicester on June 21st (EEEEEEEK!!!). Naturally we're cosplaying, James will be Batman, I will be Harley Quinn, and the other half will be The Joker (he got very little choice in this matter), quite frankly the train journey to Leicester, and the meal at Nandos afterwards are going to be interesting! Harley Quinn, the Joker and Batman walk into Nandos... I'm still working on the punchline...
Me and James also had a little photoshoot done with Venture Photography in Northampton. Despite the fact they're a little on the expensive side, (I'm in the process of paying £600 for a USB stick with all the photos on it) we had a really great day and the pictures look amazing!
They will definitely be blogged as soon as I get them!
I also have a couple of posts lined up walking you through something I've been working on the last few weeks. I've decided to burden you all with this as while I was working on it I struggled to find a helpful walk through, and had to take all of my information from different sources, so I thought I'd put it all in one place and then it might help someone else who needs it!
Keep your eyes peeled readers, I won't be neglecting my blog again!

<3