Chapter 4 User Authentication

Default Configuration for the LDAP Module for System Authentication

Internet Express configures the security matrix in the/etc/sia/matrix.conf file to use the LDAP Module for System Authentication. The security matrix consists of a list of security-related system calls and the library to be used for each call. As shown in Example 4-1, the siad_ses_authent and siad_ses_estab calls are configured to use the libsialdap.so library first. If that library is not available, or if the requested information is not found in the LDAP server's directory, then the libc.so library is used.

See the siacfg(8) and matrix.conf(4) reference pages for more information about configuring security methods.

Example 4-1 Security Matrix Enabled for LDAP

⋮ . . . siad_getgrgid=(BSD,libc.so) (LDAP,/usr/shlib/libsialdap.so) siad_setpwent=(BSD,libc.so) (LDAP,/usr/shlib/libsialdap.so) . . .

When you install the LDAP Module for System Authentication, the installation procedure checks the validity of the configuration information you supplied, and tries to connect to the LDAP server you specified during the installation, then enables the LDAP Module for System Authentication. If the connection fails, or if the required schema attributes are not found, the LDAP Module for System Authentication is not enabled and you must use the LDAP Module for System Authentication Administration menu to enable it (after correcting the problems) or use the /usr/internet/ldap_tools/ldap_enable utility. Check the attribute values in the Distinguished Name, Password, System Name, Port Number, and the Search Base fields (see Section ).

The LDAP Module for System Authentication gets its information from the LDAP server by way of the ldapcd caching daemon (see Figure 4-1). This daemon runs at all times and is started by the following entry in the /etc/inittab file:

ldapcd:34:respawn:/usr/sbin/ldapcd -D > /dev/console 2>&1

Figure 4-1 LDAP Caching Daemon

Configuration information, used by the LDAP caching daemon and the provided tools, use a the configuration file, /etc/ldapcd.conf. This file provides information on how to connect to the LDAP directory server, the attribute mappings for the password and group entries, and caching parameters. This file must contain a clear text password that allows the utilities to connect to the directory server, and should always be read-only by root. The configuration file is shown in Example 4-2. HP recommends that you use the Administration utility to modify the /etc/ldapcd.conf file. To validate the configuration file, use the /usr/internet/ldap_tools/ldap_check utility.

Example 4-2 LDAP Caching Daemon Configuration File

# # directory server and port, active ldap connections cached # by the daemon, max worker threads started # directory: host.xyz.com 1 searchbase: "o=XYZCompany" 2 port: 389 3 connections: 6 4 max_threads: 64 5 # # max entries in cache, and number of seconds before entries # expire in the cache # pw_cachesize: 2000 6 pw_expirecache: 120 gr_cachesize: 100 gr_expirecache: 600 ⋮machine_dn: "cn=Directory Manager" 7 machine_pass: "password" # ⋮ # the objectClass name of a password entry pw_oclass: posixAccount 8 # name mappings for password attribute fields pw_username: uid 9 pw_password: userPassword 10 pw_uid: uidNumber pw_gid: gidNumber pw_quota: pw_comment: description pw_gecos: gecos pw_homedir: homedirectory pw_shell: loginshell # the objectClass name of a group entry gr_oclass: posixGroup 11 # name mappings for group attribute fields gr_oclass: unixGroup 12 gr_name: cn gr_password: userPassword gr_gid: gidNumber gr_members: MemberUID

	Note: HP recommends you use the Administration utility to modify the ldapcd.conf file.

Creating Branches

By creating branches, you can organize an LDAP directory tree into meaningful categories of information, each with its own search base. The use of branches can improve the performance of an LDAP server by allowing queries to be confined to the branch that contains the information of interest. For example, you might create a separate branch to contain user information. To create a user information branch on the directory server, follow these steps:

	Note: After you add a default user or group branch to the /etc/ldapcd.conf file, the Administration utility and the LDAP utilities in /usr/internet/ldap_tools use this branch by default. As a result, other entries that were created before you added the group or user branch might be masked.

Extended LDAP Schema for UNIX Account Information

Internet Express depends on the existence of certain object classes and attributes being present in the directory server. These items are defined by RFC 2307 and are present when you use a directory server installed by Internet Express.

If you are planning on using a directory server not installed by Internet Express, you will need to verify that required schema elements are present. The required schema elements are documented in RFC 2307. This RFC can be found at:

http://www.faqs.org

If you want to use schema objects other than those defined in RFC 2307, and are planning on using the Internet Express LDAP authentication module, you will have to change the default configuration to recognize your custom objects and attributes. The needed changes can be made using the Internet Express system administration user interface (see Section : Default Configuration for the LDAP Module for System Authentication).

The Internet Express kit includes LDAP utilities that work with the RFC 2307 schema objects supplied by Internet Express. See Section : Utilities for Maintaining User Information in the LDAP Directory Server for information on these utilities. Note that these LDAP tools are sensitive to the directory servers schema and so will not be able to support a schema that differs greatly from the RFC 2307 definition. A provided tool, /usr/internet/ldap_tools/ldap_check, can be used to verify the schema once the configuration changes have been made.

The LDAP utilities require the userPassword attribute that can store and return unchanged the supplied value which is in the form:

{crypt}crypted-string

where {crypt} is a keyword or phrase used to indicate the type of password encryption for the passwd file and crypted-string is the encrypted password.

Directory servers provided by Internet Express properly handle this feature. Other directory servers, such as Oracle's Internet Directory will interpret the supplied string as a password to be encrypted and will return a value that is not compatible with the standard BSD crypt mechanism. When using such a directory server, it is necessary to create a schema object similar to the RFC 2307 unixAccount object, except with another attribute substituted for the standard attribute userPassword. This substitute attribute should be of the type case exact string. Be sure to use the substituted attribute name in the LDAP Caching Daemon Configuration File.

Example 4-3 shows sample user and group object class definitions.

Example 4-3 Sample RFC 2307 User and Group Object Class Definitions

# # Partial RFC 2307 schema. # # The OIDs are derived from iso(1) org(3) dod(6) # internet(1) directory(1) nisSchema(1). # # Attribute types from RFC 2307 # attribute uidNumber 1.3.6.1.1.1.1.0 int single attribute gidNumber 1.3.6.1.1.1.1.1 int single attribute gecos 1.3.6.1.1.1.1.2 cis single attribute homeDirectory 1.3.6.1.1.1.1.3 ces single attribute loginShell 1.3.6.1.1.1.1.4 ces single attribute memberUid 1.3.6.1.1.1.1.12 ces # # ojectclass from rfc2307 # # posixAccount is an auxiliary class. You may use account as a structural # class. objectclass posixAccount oid 1.3.6.1.1.1.2.0 requires objectClass, cn, uid, uidNumber, gidNumber, homeDirectory allows userPassword, loginShell, gecos, description objectclass posixGroup oid 1.3.6.1.1.1.2.2 superior top requires objectClass, cn, gidNumber allows userPassword, memberUid, description

Indexing Attributes for the Directory Servers

Directory servers use indexes to aid in searching the directory. Directory server indexes greatly improve the performance of searches in the directory databases, but they do so at the cost of potentially slower database modification and entry creation operations. Indexes will also cost more in terms of system resources, especially in disk-space use.

The directory server maintains five distinct types of indexes, as described in Table 4-1.

Adding Indices for OpenLDAP

To index attributes for your directory server using OpenLDAP, follow these steps:

1. Shut down slapd using the following command:

   # /sbin/init.d/openldap stop

2. Edit the /usr/internet/etc/slapd.conf file and add new indices.

3. Restart slapd using the following command:

   # /sbin/init.d/openldap start

For more information about adding indexing with OpenLDAP, see:

http://www.openldap.org

Modifying the LDAP Module Configuration

You can use the Administration utility to configure the following attributes of the LDAP Module for System Authentication:

The default configuration parameters for the Group attributes are correct for most LDAP servers. Do not modify these fields unless you are very familiar with LDAP schemas and the schemas used by your server. The Internet Express installation and configuration utilities correctly configure the Internet Express-supplied LDAP servers to work with ldapcd. HP strongly recommends that you do not change these values.

Testing the LDAP Module Configuration

When you choose Test Configuration from the LDAP Module for System Authentication Module Administration menu, the Administration utility performs the following tasks:

Enabling and Disabling the LDAP Module

You can enable or disable the LDAP Module for System Authentication as follows:

	Note: Whenever you enable or disable the LDAP Module for System Authentication, you must reboot the system. Otherwise, some applications (such as cron and Advanced Server for UNIX) will not detect the change in authentication method.

Importing Users into the Directory Server

To import users from the /etc/passwd file and store them in the LDAP database, follow these steps:

Importing Users from NIS

To import users from NIS, follow these steps:

Exporting Users from the Directory Server

To export users from the directory server, follow these steps:

Adding an LDAP User in a C2 Environment

There is an additional step required when you have C2 security enabled. For each system into which you wish the user to be able to login, you must add an edauth entry. The entry should be of the form:

echo "<username>:u_name=<username>:u_id#<uid>:u_oldcrypt#3:u_lock@:chkent:"\
 | /usr/tcb/bin/eduath -s

Access Control

By default, users defined in the LDAP database are able to log into every system which uses that database in conjunction with the LDAP Module for System Authentication. If you want to limit user access to specific systems, use the access control files /etc/ldapusers.deny and /etc/ldapusers.allow.

A default /etc/ldapusers.deny file is provided at installation time. Included are all of the standard system users: root, bin, daemon, and so on. If you want to deny access to a user, add that user's name to the /etc/ldapusers.deny file.

If you want to disallow access to all but a few users, use the /etc/ldapusers.allow file. If the /etc/ldapusers.allow file exists on a system, only users listed in that file are allowed to log in using LDAP authentication. Note that this is true even if /etc/ldapusers.allow is empty — its very existence invokes the stricter access control rules.

Checking the LDAP Server Configuration

The ldap_check utility validates the contents of the ./ldapcd.conf or /etc/ldapcd.conf file as follows:

If a problem is encountered during either of these checks, the ldap_check utility returns an exit code greater than 0.

Extracting Users from the /etc/passwd File

Use the passwd_extract utility to extract users from the specified input file (/etc/passwd is the default) and store the extracted records in the specified output file (with the -f option). Optionally, you can use the -r option (with the -f option) to extract entries that do not match the selection criteria to a remainder file. The records in the output file and remainder file (if any) are formatted as passwd(4) entries.

You can extract users based on:

To extract records from a file other than /etc/passwd, specify the input file name with the -i option. For example:

# passwd_extract larry curly moe -i myusers -f stooges 

The records in the input file must be formatted as passwd entries.

Adding a User Entry

The ldap_add_user utility adds one or more user entries to the LDAP database. To use this utility on the command line, provide the following arguments:

ldap_add_user logname passwd uid gid gecos homedir shell

The ldap_add_user utility adds users to the first directory server specified in the ldapcd.conf file. If multiple servers are listed, only the first is used, even if it is not operational. The distinguished name (DN) is constructed as follows:

logname_attribute=logname,branch

The logname_attribute is replaced by the attribute name specified by the pw_username entry in the ldapcd.conf file. The logname is the user's login name. The branch is one of three possible values, taken in this order:

If a problem is encountered when adding a user to the LDAP database, the ldap_add_user utility returns an exit code greater than 0.

For a description of the options you can use with this utility, see Table 4-2.

To add one or more users from a file:

ldap_add_user -f input-file

To add one or more users from stdin:

cat filename | ldap_add_user -f -

	Note: The input must be in passwd(4) format.

Deleting a User Entry

The ldap_del_user utility works in a similar fashion to ldap_add_user, except that users are removed, rather than added, to the directory server.

If a problem is encountered when deleting a user from the LDAP directory server, the ldap_del_user utility returns an exit code greater than 0.

For a description of the options you can use with this utility, see Table 4-2.

For example, to delete a user from the command line:

ldap_del_user logname [ logname ... ]

To delete one or more user or users listed in a file:

ldap_del_user -f input-file

To delete one or more users from stdin:

cat filename | ldap_del_user -f -

	Note: The input must be in passwd(4) format, but only the login name portion of each record is used. Anything beyond the first colon (:) in each input record is ignored. A list of names (one per line) is also acceptable as input.

Retrieving a User Entry

Use the ldap_get_user utility to retrieve passwd entries for specified users in the LDAP directory server. Unless otherwise specified, the ldap_get_user utility selects all users on the default user branch or search base. Use the -s option to select a subset of users (see Table 4-2).

If a problem is encountered when retrieving a user from the LDAP directory server, the ldap_get_user utility returns an exit code greater than 0.

For a description of the options you can use with this utility, see Table 4-2.

To retrieve all users:

ldap_get_user [ -b branch ] [ -f filename ]

	Note: In the following examples, the -b branch and -f output-file options (not shown) can also be used.

To use a search filter to find users:

ldap_get_user -s filter

To use a search filter with object class restrictions added to the search:

ldap_get_user -S filter

For example, a search filter might look like the following:

uid=bjensen
(&(uidNumber>=10)(uidNumber<=20))

	Note: You must quote the filter string according to your shell.

To retrieve a range of users (where start is the starting UID in the range and end is the optional ending UID in the range):

ldap_get_user -R start[-end]

If you do not specify end, the search retrieves all users from the starting UID through the highest UID in the LDAP directory server.

To retrieve specific users:

ldap_get_user user [ user ...]

Synchronizing with a Password File

Use the ldap_sync_user utility to synchronize the ldap directory entries for users with the contents of a passwd file. This utility adds, updates or deletes users as needed to ensure that the contents of the directory match the supplied entries. This utility is intended to provide easy synchronization of the directory server with an alternate source for login information (such as NIS), where the alternate source is considered the master source of the information.

If a problem is encountered , the ldap_sync_user utility returns an exit code greater than 0.

For a description of the options you can use with this utility, see Table 4-2.

To synchronize users:

ldap_sync_user [-b branch ] [ filename]

Adding a Group Entry

Use the ldap_add_group utility to retrieve group(4) entries from the LDAP directory server. (Use the ldap_mod_group utility to add users to groups. See Section  for more information.) The ldap_add_group utility adds groups to the first directory server specified in the ldapcd.conf file. If multiple servers are listed, only the first is used, even if it is not operational.

The ldap_add_group utility constructs the distinguished name (DN) as follows:

groupname_attribute=groupname,branch

The groupname_attribute is replaced by the attribute name specified by the gr_name entry in the ldapcd.conf file. The groupname is the group name. The branch is one of three possible values, taken in this order:

If a problem is encountered when creating a group in the LDAP directory server, the ldap_add_group utility returns an exit code greater than 0.

For a description of the options you can use with this utility, see Table 4-2.

To add one or more groups from a file:

ldap_add_group -f input-file

To add one or more groups from stdin:

cat filename | ldap_add_group -f -

	Note: The input must be in group(4) format.

Maintaining Group Membership

Use the ldap_mod_group utility to add or remove users from groups in the LDAP database. The ldap_mod_group utility adds the specified login names to the specified group as group members. Use the -r option to remove the specified login names from the group member list.

If a problem is encountered when modifying group membership in the LDAP database, the ldap_mod_group utility returns an exit code greater than 0.

For a description of the options you can use with this utility, see Table 4-2.

For example, to add one or more users to a group:

ldap_mod_group group logname [ logname ...]

To remove one or more users from a group:

ldap_mod_group -r group logname [ logname ...]

To remove a user from all groups:

ldap_mod_group -R logname