Differences between revisions 19 and 20
Revision 19 as of 2005-04-25 06:50:52
Size: 1624
Editor: anonymous
Comment:
Revision 20 as of 2005-04-25 06:53:25
Size: 1626
Editor: anonymous
Comment:
Deletions are marked like this. Additions are marked like this.
Line 11: Line 11:
 BASE dc=<yourhost>,dc=<your>,dc=<domain>  BASE dc=<your>,dc=<domain>
Line 18: Line 18:
       by dn="cn=admin,dc=FOO,dc=BAR" write        by dn="cn=admin,dc=<your>,dc=<domain>" write
Line 24: Line 24:
       by dn="cn=admin,dc=FOO,dc=BAR" write        by dn="cn=admin,dc=<your>,dc=<domain>" write

Configuring LDAP Authentication for Debian

OpenLDAPSetup

1. Install the ["OpenLDAP"] package [http://packages.debian.org/cgi-bin/search_packages.pl?searchon=names&keywords=slapd slapd]

Do 'apt-get install slapd', answering prompts as required and generaly picking defaults except where they are obviously examples.

2. Edit the LDAP configuration file

To make using LDAP utilities like 'ldapsearch' a little less painful, edit /etc/ldap/ldap.conf (installed by the 'libldap2' package on the stable (a.k.a. 'woody') distribution) to set:

 BASE dc=<your>,dc=<domain>
 URI ldap://localhost

3. To get 'chsh' and 'chfn' to work for updating LDAP, edit /etc/ldap/slapd.conf to allow access for users to update their loginShell and gecos entries by adding:

  access to attrs=loginShell
       by dn="cn=admin,dc=<your>,dc=<domain>" write
       by self write
       by * read

  access to attrs=gecos
       by dn="cn=admin,dc=<your>,dc=<domain>" write
       by self write
       by * read

3. Tune your LDAP server performance

To improve LDAP performance, edit /etc/ldap/slapd.conf to set more indexes than the stable (a.k.a. 'woody') default of just objectClass (taken from the Mandrake documentation):

  index objectClass,uid,uidNumber,gidNumber eq
  index cn,mail,surname,givenName           eq,subinitial

4. Update the LDAP indexes

Make sure the indexes are updated by doing (as root):

  # /etc/init.d/slapd stop
  # slapindex
  # /etc/init.d/slapd start


  • ["LDAPAuthentication"]