Brontekst bekijken van LDAP

The [https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol Lightweight Directory Access Protocol (LDAP)] is used in RevSpace in most places where authentication is required.

=Backend=

* Server: ldap2.space.revspace.nl
** IP: 10.42.42.9
** Port: 636 (TLS)
* Software: slapd (openldap)
** Config: /etc/ldap/slapd.conf
* Database: LDIF (for easy recovery/editing)
** Location: /var/lib/ldap/data
* ACL: yes

=Access=

* From ldap2 itself: <code># shelldap</code>
* From anywhere in the space network: <code>ldap2:636</code> (TLS)

=Layout=

<pre>
dc=space,dc=revspace,dc=nl
`-+- ou=groups         # groepen van entiteiten (optioneel posixGroup)
  |  `-+- cn=board        # groep van bestuursleden
  |    `- cn=sudo         # groep van sysadmins
  +- ou=people         # natuurlijke personen
  |  `- uid=...
  +- ou=services       # niet-natuurlijke personen
  |  `- cn=...
  `- cn=admin          # fallback admin account (emergency, console access, hardcoded in slapd.conf)
</pre>

=Services=

* [https://sshpubkey.revspace.nl sshpubkey]
* [https://forum.revspace.nl Forum]
* [[Spacenet|Spacenet RADIUS]]
* [[Shell-jessie|Shell server]]

=Configuration=

==OpenLDAP server==

See: [[LDAP/OpenLDAP_configuration]]

==Shell servers==

The Debian shell servers use [https://wiki.debian.org/LDAP/NSS libnss-ldapd], with a few caveats:
* <code>/etc/nslcd.conf</code> needs to be configured with a service DN and bind password specific to that shell server.
* To get auxiliary groups working (like <code>sudo</code>), <code>ldap</code> needs to be first in the <code>group</code> entry in <code>/etc/nsswitch.conf</code>.