Pam And Ldap; Migrating Old Authentication Information To Ldap Format - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

Install the Necessary LDAP Packages.
First, make sure that the appropriate packages are installed on both the LDAP server and the LDAP
client machines. The LDAP server needs the openldap-servers package.
The openldap, openldap-clients, and nss_ldap packages need to be installed on all LDAP
client machines.
Edit the Configuration Files.
• On the server, edit the /etc/openldap/slapd.conf file on the LDAP server to make sure it
matches the specifics of the organization. Refer to
for instructions about editing slapd.conf.
slapd.conf"
• On the client machines, both /etc/ldap.conf and /etc/openldap/ldap.conf need to
contain the proper server and search base information for the organization.
To do this, run the graphical Authentication Configuration Tool (system-config-
authentication) and select Enable LDAP Support under the User Information tab.
It is also possible to edit these files by hand.
• On the client machines, the /etc/nsswitch.conf must be edited to use LDAP.
To do this, run the Authentication Configuration Tool (system-config-authentication) and
select Enable LDAP Support under the User Information tab.
If editing /etc/nsswitch.conf by hand, add ldap to the appropriate lines.
For example:
passwd: files ldap
shadow: files ldap
group: files ldap

25.7.1. PAM and LDAP

To have standard PAM-enabled applications use LDAP for authentication, run the Authentication
Configuration Tool (system-config-authentication) and select Enable LDAP Support
under the the Authentication tab. For more about configuring PAM, refer to
Authentication Modules (PAM)"

25.7.2. Migrating Old Authentication Information to LDAP Format

The /usr/share/openldap/migration/ directory contains a set of shell and Perl scripts for
migrating authentication information into an LDAP format.
Note
Perl must be installed on the system to use these scripts.
Section 25.6.1, "Editing /etc/openldap/
and the PAM man pages.
PAM and LDAP
Section 43.4, "Pluggable
411