Différences

Ci-dessous, les différences entre deux révisions de la page.

--- client_ldap [2018/05/15 17:07] – maxime
+++ client_ldap [2018/06/16 20:23] – maxime
@@ Ligne 3: / Ligne 3: @@
 ==== Client sous Ubuntu 16.04 ====
-  * ''apt-get install ldap-utils autofs-ldap ldap-auth-client nscd libnss-ldapd libpam-ldapd libpam-mount''
+<note important>Avant de suivre l'installation suivante, s'il y a des comptes locaux sur la machine cliente, il faut les déplacer si on souhaite les utiliser plus tard.
-  * ''/etc/ldap/ldap.conf''
+Pour cela, on utilise la commande : ''usermod -d NEWHOME -m USER''
+Il ne faut pas crée le nouveau home, il est créé automatiquement.</note>
+  * Installation des paquets suivant : ''ldap-utils'' ''autofs-ldap'' ''ldap-auth-client'' ''nscd'' ''libnss-ldapd'' ''libpam-ldapd'' ''libpam-mount''
+  * Modification du fichier ''/etc/ldap/ldap.conf''
 <Code>
 #
@@ Ligne 43: / Ligne 48: @@
 </Code>
-  * ''/etc/ldap.conf''
+  * Modification du fichier ''/etc/default/autofs''
-<Code>
-###DEBCONF###
-##
-## Configuration of this file will be managed by debconf as long as the
-## first line of the file says '###DEBCONF###'
-##
-## You should use dpkg-reconfigure to configure this file via debconf
-##
-# The distinguished name of the search base.
-base dc=i2m,dc=univ-amu,dc=fr
-# Another way to specify your LDAP server is to provide an
-uri ldap://ldap.i2m.univ-amu.fr
-# The LDAP version to use (defaults to 3
-# if supported by client library)
-ldap_version 3
-# The port.
-# Optional: default is 389.
-#port 389
-# Do not hash the password at all; presume
-# the directory server will do it, if
-# necessary. This is the default.
-pam_password md5
-# Netscape SDK LDAPS
-#ssl on
-# OpenLDAP SSL mechanism
-# start_tls mechanism uses the normal LDAP port, LDAPS typically 636
-#ssl start_tls
-#ssl on
-# OpenLDAP SSL options
-# Require and verify server certificate (yes/no)
-# Default is to use libldap's default behavior, which can be configured in
-# /etc/openldap/ldap.conf using the TLS_REQCERT setting.  The default for
-# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".
-#tls_checkpeer yes
-# CA certificates for server certificate verification
-# At least one of these are required if tls_checkpeer is "yes"
-#tls_cacertfile /etc/ssl/ca.cert
-#tls_cacertdir /etc/ssl/certs
-# Client certificate and key
-# Use these, if your server requires client authentication.
-#tls_cert
-#tls_key
-# Disable SASL security layers. This is needed for AD.
-#sasl_secprops maxssf=0
-# Override the default Kerberos ticket cache location.
-#krb5_ccname FILE:/etc/.ldapcache
-# SASL mechanism for PAM authentication - use is experimental
-# at present and does not support password policy control
-#pam_sasl_mech DIGEST-MD5
-</Code>
-  * ''/etc/default/autofs''
 <Code>
 #
@@ Ligne 143: / Ligne 83: @@
 </Code>
-  * ''/etc/auto.master''
+  * Modification du fichier ''/etc/auto.master''
 <Code>
 #
@@ Ligne 176: / Ligne 116: @@
 </Code>
-  * ''/etc/autofs_ldap_auth.conf''
+  * Modification du fichier ''/etc/autofs_ldap_auth.conf''
 <Code>
 <?xml version="1.0" ?>
@@ Ligne 191: / Ligne 131: @@
 </Code>
-  * ''/etc/nsswitch.conf''
+  * Modification du fichier ''/etc/nsswitch.conf''
 <Code>
  /etc/nsswitch.conf
@@ Ligne 221: / Ligne 161: @@
 </Code>
-  * ''auth-client-config -t nss -p lac_ldap''
+  * On exécute la commande ''auth-client-config -t nss -p lac_ldap''
-  * ''/etc/nslcd.conf''
+  * Modification du fichier ''/etc/nslcd.conf''
 <Code>
 # /etc/nslcd.conf
@@ Ligne 258: / Ligne 198: @@
 </Code>
-  * ''service nslcd restart''
+  * On redémarre les services nslcd et nscd : ''service nslcd restart'' & ''service nscd restart''
-  * ''service nscd restart''
+  * On lance la commande ''pam-auth-update''
-  * ''pam-auth-update''
-  * ''/etc/pam.d/common-session''
+  * On modifie le fichier ''/etc/pam.d/common-session''
 <Code>
 #
@@ Ligne 299: / Ligne 238: @@
 </Code>
-  * ''cp /home/support-i2m/certs/* /etc/ssl/certs/'' (on récupère les certificats de protis)
+  * On récupère les certificats de protis et on les place dans le répertoire ''/etc/ssl/certs/''
-  * ''mkdir -p /etc/ssl/openldap''
+  * On crée le répertoire : ''mkdir -p /etc/ssl/openldap''
   * Copie du certificat de protis ''/etc/ssl/openldap/ca-certs'' sur la machine cliente (au même emplacement)
-  * ''service autofs restart''
+  * On redémarre autofs : ''service autofs restart''
+  * Le fichier ''/etc/ldap.conf'' devrait ressembler à ça :
+<Code>
+###DEBCONF###
+##
+## Configuration of this file will be managed by debconf as long as the
+## first line of the file says '###DEBCONF###'
+##
+## You should use dpkg-reconfigure to configure this file via debconf
+##
+# The distinguished name of the search base.
+base dc=i2m,dc=univ-amu,dc=fr
+# Another way to specify your LDAP server is to provide an
+uri ldap://ldap.i2m.univ-amu.fr
+# The LDAP version to use (defaults to 3
+# if supported by client library)
+ldap_version 3
+# The port.
+# Optional: default is 389.
+#port 389
+# Do not hash the password at all; presume
+# the directory server will do it, if
+# necessary. This is the default.
+pam_password md5
+# Netscape SDK LDAPS
+#ssl on
+# OpenLDAP SSL mechanism
+# start_tls mechanism uses the normal LDAP port, LDAPS typically 636
+#ssl start_tls
+#ssl on
+# OpenLDAP SSL options
+# Require and verify server certificate (yes/no)
+# Default is to use libldap's default behavior, which can be configured in
+# /etc/openldap/ldap.conf using the TLS_REQCERT setting.  The default for
+# OpenLDAP 2.0 and earlier is "no", for 2.1 and later is "yes".
+#tls_checkpeer yes
+# CA certificates for server certificate verification
+# At least one of these are required if tls_checkpeer is "yes"
+#tls_cacertfile /etc/ssl/ca.cert
+#tls_cacertdir /etc/ssl/certs
+# Client certificate and key
+# Use these, if your server requires client authentication.
+#tls_cert
+#tls_key
+# Disable SASL security layers. This is needed for AD.
+#sasl_secprops maxssf=0
+# Override the default Kerberos ticket cache location.
+#krb5_ccname FILE:/etc/.ldapcache
+# SASL mechanism for PAM authentication - use is experimental
+# at present and does not support password policy control
+#pam_sasl_mech DIGEST-MD5
+</Code>