Rocky Linux 9でLDAPサーバ構築

本記事ではRocky Linux 9でLDAPサーバを構築したので、その備忘録として作成したものです。

# 構築準備
### openldap-serversを入手するためにリポジトリを有効化
```
# yum config-manager --set-enabled plus
```

### パッケージのインストール
```
# yum -y install openldap-servers openldap-clients
```

### サービスの起動と確認
```
# systemctl enable --now slapd
# systemctl status slapd
```

### LDAPで利用するポートを開放(389,636)
```
# firewall-cmd --add-service={ldap,ldaps} --permanent
# firewall-cmd --reload
# firewall-cmd --list-all
```

# LDAPサーバ設定
### LDAPの管理者パスワードを生成
```
# slappasswd
New password:
Re-enter new password:
{SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

### 管理者パスワード設定用ファイル作成
```
# vim changerootpass.ldif
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

### 管理者パスワードを反映
```
# ldapadd -Y EXTERNAL -H ldapi:/// -f changerootpass.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={0}config,cn=config"
```

### 基本的なスキーマの読み込み
```
# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/cosine.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=cosine,cn=schema,cn=config"

# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/nis.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=nis,cn=schema,cn=config"

# ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/inetorgperson.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
adding new entry "cn=inetorgperson,cn=schema,cn=config"
```

### サービスを再起動
```
# systemctl restart slapd
```

### ドメイン設定ファイルを作成
今回は以下のドメインを例として作成する。
**dc=jitaku,dc=local**
```
# vim setdomain.ldif
dn: olcDatabase={1}monitor,cn=config
changetype: modify
replace: olcAccess
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth"
  read by dn.base="cn=Manager,dc=jitaku,dc=local" read by * none

dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc=jitaku,dc=local

dn: olcDatabase={2}mdb,cn=config
changetype: modify
replace: olcRootDN
olcRootDN: cn=Manager,dc=jitaku,dc=local

dn: olcDatabase={2}mdb,cn=config
changetype: modify
add: olcRootPW
olcRootPW: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

dn: olcDatabase={2}mdb,cn=config
changetype: modify
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by
  dn="cn=Manager,dc=jitaku,dc=local" write by anonymous auth by self write by * none
olcAccess: {1}to dn.base="" by * read
olcAccess: {2}to * by dn="cn=Manager,dc=jitaku,dc=local" write by * read
```

### ドメイン設定を反映
```
# ldapmodify -Y EXTERNAL -H ldapi:/// -f setdomain.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "olcDatabase={1}monitor,cn=config"

modifying entry "olcDatabase={2}mdb,cn=config"

modifying entry "olcDatabase={2}mdb,cn=config"

modifying entry "olcDatabase={2}mdb,cn=config"

modifying entry "olcDatabase={2}mdb,cn=config"
```

### ドメインが設定されたか確認
```
# ldapsearch -H ldap:// -x -s base -b "" -LLL "namingContexts"
dn:
namingContexts: dc=jitaku,dc=local
```

### ディレクトリ構成設定ファイル作成
```
# vim basedomain.ldif
dn: dc=jitaku,dc=local
objectClass: top
objectClass: dcObject
objectclass: organization
o: My hwdomain Organisation
dc: jitaku

dn: cn=Manager,dc=jitaku,dc=local
objectClass: organizationalRole
cn: Manager
description: OpenLDAP Manager

dn: ou=People,dc=jitaku,dc=local
objectClass: organizationalUnit
ou: People

dn: ou=Group,dc=jitaku,dc=local
objectClass: organizationalUnit
ou: Group
```

### ディレクトリ構成設定反映
```
# ldapadd -x -D cn=Manager,dc=jitaku,dc=local -W -f basedomain.ldif
Enter LDAP Password:
adding new entry "dc=jitaku,dc=local"

adding new entry "cn=Manager,dc=jitaku,dc=local"

adding new entry "ou=People,dc=jitaku,dc=local"

adding new entry "ou=Group,dc=jitaku,dc=local"
```

## ユーザ追加
### ユーザが利用するパスワードを生成
```
# slappasswd
New password:
Re-enter new password:
{SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```
### ユーザ定義ファイル作成
以下のユーザとグループを作成し、ユーザをグループに所属させます。
**People=kenichi**
**Group=family**
```
# vim adduser.ldif
dn: cn=family,ou=Group,dc=jitaku,dc=local
objectClass: posixGroup
cn: family
gidNumber: 1000
memberUid: family

dn: uid=kenichi,ou=People,dc=jitaku,dc=local
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: shadowAccount
cn: kenichi
sn: kenichi
userPassword: {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
loginShell: /bin/bash
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/family/kenichi
shadowLastChange: 0
shadowMax: 0
shadowWarning: 0
```

### ユーザ定義反映
```
# ldapadd -x -D cn=Manager,dc=jitaku,dc=local -W -f adduser.ldif
Enter LDAP Password:
adding new entry "cn=family,ou=Group,dc=jitaku,dc=local"

adding new entry "uid=kenichi,ou=People,dc=jitaku,dc=local"
```
## 証明書設定
### 自己証明書作成
```
# cd /etc/pki/tls/certs
# openssl genrsa -aes128 2048 > server.key
Enter PEM pass phrase:

# openssl rsa -in server.key -out server.key
Enter pass phrase for server.key:
writing RSA key

# openssl req -utf8 -new -key server.key -out server.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:JP
State or Province Name (full name) []:
Locality Name (eg, city) [Default City]:
Organization Name (eg, company) [Default Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:ldap
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

# openssl x509 -in server.csr -out server.crt -req -signkey server.key -days 3650
Signature ok
subject=C = JP, L = Default City, O = Default Company Ltd, CN = ldap
Getting Private key
```
### 作成した証明書のオーナを変更
```
# chown ldap:ldap /etc/pki/tls/certs/{server.crt,server.key}
```

### 証明書設定用ファイル作成
```
# vim mod_ssl.ldif
dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/pki/tls/certs/ca-bundle.crt
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/pki/tls/certs/server.crt
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/pki/tls/certs/server.key
```

### 証明書設定を反映
```
# ldapadd -Y EXTERNAL -H ldapi:/// -f mod_ssl.ldif
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
modifying entry "cn=config"
```

## ログ設定
### ログ設定用ldif作成
```
# vim logging.ldif
dn: cn=config
changetype: modify
replace: olcLogLevel
olcLogLevel: stats
```
### 設定を反映
```
# ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f logging.ldif
```

### /etc/rsyslog.confに以下を追記
```
# vim /etc/rsyslog.conf
local4.*  /var/log/ldap.log
```

### rsyslogサービスを再起動
```
systemctl restart rsyslog
systemctl status rsyslog
```

### ログローテ設定
```
# vim /etc/logrotate.d/ldap
/var/log/ldap.log {
  rotate 30
  weekly
  missingok
  compress
  notifempty
}
```

# クライント側設定
### パッケージのインストール
```
# yum -y install openldap-clients sssd sssd-ldap oddjob-mkhomedir
```

### 認証プロバイダをsssdに切り替え
```
# authselect select sssd with-mkhomedir --force
Backup stored at /var/lib/authselect/backups/2024-11-14-10-54-32.PA4CCD
Profile "sssd" was selected.
The following nsswitch maps are overwritten by the profile:
- passwd
- group
- netgroup
- automount
- services

Make sure that SSSD service is configured and enabled. See SSSD documentation for more information.

- with-mkhomedir is selected, make sure pam_oddjob_mkhomedir module
  is present and oddjobd service is enabled and active
  - systemctl enable --now oddjobd.service
```

### sssd設定
```
# vim /etc/sssd/sssd.conf
[domain/default]
id_provider = ldap
autofs_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldaps://192.168.11.10/
ldap_search_base = dc=jitaku,dc=local
ldap_id_use_start_tls = True
ldap_tls_cacertdir = /etc/pki/tls/certs
cache_credentials = True
ldap_tls_reqcert = allow

[sssd]
services = nss, pam, autofs
domains = default

[nss]
homedir_substring = /home
```

### パーミッションを変更
```
# chmod 600 /etc/sssd/sssd.conf
```

### サービス起動
```
# systemctl restart sssd oddjobd
# systemctl enable sssd oddjobd
Created symlink /etc/systemd/system/multi-user.target.wants/oddjobd.service → /usr/lib/systemd/system/oddjobd.service.
```

### ログを確認
```
# less /var/log/messages
Nov 16 09:20:19 ldap-clients slapd[1264]: conn=1144 fd=20 ACCEPT from IP=192.168.11.13:53806 (IP=0.0.0.0:636)
Nov 16 09:20:43 ldap-clients slapd[1264]: conn=1144 fd=20 TLS established tls_ssf=256 ssf=256
```

# ログイン確認
### クライント設定したサーバにLDAPユーザでログイン
```
login as:
kenichi@192.168.11.13's password:
Last login: Sat Nov 16 09:28:19 2024 from 192.168.11.43
[kenichi@ldap-clients ~]$ pwd
/home/family/kenichi
```

# ユーザとグループの削除
### ユーザの削除
```
# ldapdelete -x -W -D "cn=Manager,dc=jitaku,dc=local" 'uid=kenichi,ou=People,dc=jitaku,dc=local'
```

### グループの削除
```
ldapdelete -x -W -D "cn=Manager,dc=jitaku,dc=local" 'cn=family,ou=Group,dc=jitaku,dc=local'
```