Skip to Content
0 Votes

Changes for page KerberosAndLDAP

Last modified by Sirius Rayner-Karlsson on 2024/05/09 10:54
From version 24.1
edited by Sirius Rayner-Karlsson
on 2024/05/06 02:55
Change comment: There is no comment for this version
To version 25.1
edited by Sirius Rayner-Karlsson
on 2024/05/06 03:06
Change comment: There is no comment for this version

Summary

Details

Page properties
Content
... ... @@ -12,7 +12,7 @@
12 12  ===== Install the packages containing the LDAP-enabled Kerberos servers: =====
13 13  
14 14  (% class="wikigeneratedid" %)
15 -The packages you need are [[krb5-kdc-ldap>>url:https://packages.debian.org/krb5-kdc-ldap]], [[krb5-admin-server>>url:https://packages.debian.org/krb5-admin-server]] and [[schema2ldif>>url:https://packages.debian.org/schema2ldif]] .
15 +The packages you need are [[krb5-kdc-ldap>>url:https://packages.debian.org/krb5-kdc-ldap]], [[krb5-admin-server>>url:https://packages.debian.org/krb5-admin-server]] for the actual KDC and [[schema2ldif>>url:https://packages.debian.org/schema2ldif]]  plus [[slapd>>https://packages.debian.org/search?keywords=slapd]] for adding the schema and ~#~#slappasswd~#~#.
16 16  
17 17  (% style="color:#400" %)
18 18  ##{{{$ sudo apt install krb5-kdc-ldap krb5-admin-server schema2ldif}}}##
... ... @@ -42,23 +42,18 @@
42 42  ##{{{$}}}##
43 43  
44 44  
45 -===== Create the two principals ~#~#kadmin~#~# and ~#~#kdc~#~#: =====
45 +===== Create the two principals kadmin and kdc: =====
46 46  
47 -Next, you need to create and configure two entries which will be used by the Kerberos servers to connect to OpenLDAP. As you will not run the Kerberos KDC and Admin Server on the same host as OpenLDAP, these steps are required. In order to keep things nicely separated, everything will be created under a separate ##organizationalUnit##.
47 +Next, you create and configure two entries which will be used by the Kerberos servers to connect to OpenLDAP. As you will not run the Kerberos KDC and Admin Server on the same host as OpenLDAP, these steps are required. In order to keep things nicely separated, everything will be created under a separate ##organizationalUnit##. I diverge from the official Debian guide here as I do not agree with the DN they use. I also had to make changes to the DNs of ~#~#kdc~#~# and ~#~#kadmin~#~# due to ~#~#pwdPolicy~#~# applied by Synology to their LDAP server. The official guide will have you use placeholder passwords and that does not work with the Synology LDAP server. You need to generate them upfront with ~#~#slappasswd~#~#.
48 48  
49 49  (% style="color:#400" %)
50 -##{{{$ ldapadd -H ldap://nas.fqdn/ -D uid=root,cn=users,dc=example,dc=com -W <<EOF}}}##
51 -##{{{dn: ou=Services,dc=example,dc=com}}}##
50 +##{{{$ ldapadd -H ldap://nas.example.com/ -D uid=root,cn=users,dc=example,dc=com -W <<EOF}}}##
51 +##{{{dn: ou=kerberos,dc=example,dc=com}}}##
52 52  ##{{{objectClass: organizationalUnit}}}##
53 53  ##{{{objectClass: top}}}##
54 -##{{{ou: Services}}}##
55 -## ##
56 -##{{{dn: ou=kerberos,ou=Services,dc=example,dc=com}}}##
57 -##{{{objectClass: organizationalUnit}}}##
58 -##{{{objectClass: top}}}##
59 59  ##{{{ou: kerberos}}}##
60 60  ## ##
61 -##{{{dn: uid=kdc,ou=kerberos,ou=Services,dc=example,dc=com}}}##
56 +##{{{dn: uid=kdc,ou=kerberos,dc=example,dc=com}}}##
62 62  ##{{{uid: kdc}}}##
63 63  ##{{{objectClass: account}}}##
64 64  ##{{{objectClass: simpleSecurityObject}}}##
... ... @@ -65,7 +65,7 @@
65 65  ##{{{userPassword: {CRYPT}x}}}##
66 66  ##{{{description: Kerberos KDC Account}}}##
67 67  ## ##
68 -##{{{dn: uid=kadmin,ou=kerberos,ou=Services,dc=example,dc=com}}}##
63 +##{{{dn: uid=kadmin,ou=kerberos,dc=example,dc=com}}}##
69 69  ##{{{uid: kadmin}}}##
70 70  ##{{{objectClass: account}}}##
71 71  ##{{{objectClass: simpleSecurityObject}}}##
... ... @@ -74,13 +74,11 @@
74 74  ##{{{EOF}}}##
75 75  ##{{{Enter LDAP Password:}}}##
76 76  ## ##
77 -##{{{adding new entry "ou=Services,dc=example,dc=com"}}}##
72 +##{{{adding new entry "ou=kerberos,dc=example,dc=com"}}}##
78 78  ## ##
79 -##{{{adding new entry "ou=kerberos,ou=Services,dc=example,dc=com"}}}##
74 +##{{{adding new entry "uid=kdc,ou=kerberos,dc=example,dc=com"}}}##
80 80  ## ##
81 -##{{{adding new entry "uid=kdc,ou=kerberos,ou=Services,dc=example,dc=com"}}}##
82 -## ##
83 -##{{{adding new entry "uid=kadmin,ou=kerberos,ou=Services,dc=example,dc=com"}}}##
76 +##{{{adding new entry "uid=kadmin,ou=kerberos,dc=example,dc=com"}}}##
84 84  
85 85  
86 86  Now, it was at this point that I had a problem, because the LDAP server on the Synology did not like adding users with placeholder passwords, because Synology puts in place password policies. I ended up working around it using a different construct: