Configuring A System To Authenticate Using Openldap - Red Hat ENTERPRISE LINUX 3 Reference Manual

Chapter 13. Lightweight Directory Access Protocol (LDAP)
When populating an LDAP directory over a network, change the
value with an encrypted password string. To create an encrypted password string, type the following
command:
slappasswd
When prompted, type and then re-type a password. The program prints the resulting encrypted pass-
word to the shell prompt.
Next, copy the newly created encrypted password into the
the lines and remove the hash mark (
rootpw
When finished, the line should look similar to the following example:
rootpw {SSHA}vv2y+i6V6esazrIv70xSSnNAJE18bb2u
Warning
LDAP passwords, including the
over the network unencrypted , unless TLS encryption is enabled.
To enable TLS encryption, review the comments in
page for
slapd.conf
For added security, the
tory by preceding it with a hash mark (
When using the
/usr/sbin/slapadd
use of the directive is not necessary.
rootpw
Important
Only the root user can use
Therefore the directory server is unable to modify any files created by
after using
slapadd
chown -R ldap /var/lib/ldap
13.7. Configuring a System to Authenticate Using OpenLDAP
This section provides a brief overview of how to configure OpenLDAP user authentication. Unless
you are an OpenLDAP expert, more documentation than is provided here is necessary. Refer to the
references provided in Section 13.9 Additional Resources for more information.
Install the Necessary LDAP Package
First, make sure that the appropriate packages are installed on both the LDAP server and the
LDAP client machines. The LDAP server needs the
The ,
openldap
client machines.
rootpw
.
directive should be commented out after populating the LDAP direc-
rootpw
).
#
command line tool locally to populate the LDAP directory,
/usr/sbin/slapadd
, type the following command:
openldap-clients
/etc/openldap/slapd.conf
).
#
directive specified in
/etc/openldap/slapd.conf
/etc/openldap/slapd.conf
. However, the directory server runs as the
openldap-servers
, and packages need to be installed on all LDAP
nss_ldap
line — replacing the default
rootpw
and refer the man
. To correct this issue,
slapadd
package.
207
on one of
, are sent
user.
ldap