JSDS 6.2 and Solaris 10 UNIX Accounts (simple,proxy)

Question

Hi,
I just got my Solaris10 server-client setup working. Here's some items that may be useful to you: All I'm using LDAP for at this point is user authentication to include home directory management from the server ( NFS share and auto_fs setup in LDAP and on the client )
My server is JSDS 6.2 ( at least, that's what Sun's Download Center id'd it as. Here's output of DBVERSION file:
cat /var/opt/SUNWdsee/dsins1/db/DBVERSION
Sun-ldbm/6.0(64-bit) SunOS 5.10 sparc
ASSUMPTIONS:  You have the LDAP server installed and running and you are ready to run /usr/lib/ldap/idsconfig
Both systems patched to latest Recommended cluster and patches shown at JSDS download site. Also, make sure CRYPT is selected during idsconfig.
myserver: UE450
(myserver-root: /:225)-> showrev
Hostname: myserver
Hostid: 1234567890
Release: 5.10
Kernel architecture: sun4u
Application architecture: sparc
Hardware provider: Sun_Microsystems
Domain: example.com
Kernel version: SunOS 5.10 Generic_127111-01
myclient: SF V445
(myclient-root: /:130)-> showrev
Hostname: myclient
Hostid: 1234567890
Release: 5.10
Kernel architecture: sun4u
Application architecture: sparc
Hardware provider: Sun_Microsystems
Domain: example.com
Kernel version: SunOS 5.10 Generic_127111-01
ON CLIENT:
ldapclient -v init -a proxyDN=cn=proxyagent,ou=profile,dc=example,dc=com
-a profileName=myprofile my.svr.ip.addr:port (port if not 389)
I was not fully qualifying proxyDN and this caused authentication failures. ( do not run ldapclient init until the following are done first )
ON CLIENT: I edited stock pam.conf and made sure only atries active were those id'd in Sun's doc. Also, I made sure I followed same order in each section as compared to Sun's doc.
pam.conf ( from Sun's JSDS Admin guide ) on LDAP client:
(*ldap-client*-root: /var/tmp:213)-> cat /etc/pam.conf
#ident "@(#)pam.conf 1.28 04/04/21 SMI"
# Copyright 2004 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
# PAM configuration
# Unless explicitly defined, all services use the modules
# defined in the "other" section.
# Modules are defined with relative pathnames, i.e., they are
# relative to /usr/lib/security/$ISA. Absolute path names, as
# present in this file in previous releases are still acceptable.
# Authentication management
# login service (explicit because of pam_dial_auth)
login auth requisite pam_authtok_get.so.1
login auth required pam_dhkeys.so.1
login auth required pam_unix_cred.so.1
#login auth required pam_unix_auth.so.1
login auth required pam_dial_auth.so.1
login auth binding pam_unix_auth.so.1 server_policy
login auth required pam_ldap.so.1
# rlogin service (explicit because of pam_rhost_auth)
rlogin auth sufficient pam_rhosts_auth.so.1
rlogin auth requisite pam_authtok_get.so.1
rlogin auth required pam_dhkeys.so.1
rlogin auth required pam_unix_cred.so.1
#rlogin auth required pam_unix_auth.so.1
rlogin auth binding pam_unix_auth.so.1 server_policy
rlogin auth required pam_ldap.so.1
# Kerberized rlogin service
krlogin auth required pam_unix_cred.so.1
krlogin auth binding pam_krb5.so.1
krlogin auth required pam_unix_auth.so.1
# rsh service (explicit because of pam_rhost_auth,
# and pam_unix_auth for meaningful pam_setcred)
rsh auth sufficient pam_rhosts_auth.so.1
rsh auth required pam_unix_cred.so.1
rsh auth binding pam_unix_auth.so.1 server_policy
rsh auth required pam_ldap.so.1
# Kerberized rsh service
krsh auth required pam_unix_cred.so.1
krsh auth binding pam_krb5.so.1
krsh auth required pam_unix_auth.so.1
# Kerberized telnet service
ktelnet auth required pam_unix_cred.so.1
ktelnet auth binding pam_krb5.so.1
ktelnet auth required pam_unix_auth.so.1
# PPP service (explicit because of pam_dial_auth)
ppp auth requisite pam_authtok_get.so.1
ppp auth required pam_dhkeys.so.1
#ppp auth required pam_unix_cred.so.1
#ppp auth required pam_unix_auth.so.1
ppp auth required pam_dial_auth.so.1
ppp auth binding pam_unix_auth.so.1 server_policy
ppp auth required pam_ldap.so.1
# Default definitions for Authentication management
# Used when service name is not explicitly mentioned for authentication
other auth requisite pam_authtok_get.so.1
other auth required pam_dhkeys.so.1
other auth required pam_unix_cred.so.1
#other auth required pam_unix_auth.so.1
other auth binding pam_unix_auth.so.1 server_policy
other auth required pam_ldap.so.1
# passwd command (explicit because of a different authentication module)
#passwd auth required pam_passwd_auth.so.1
passwd auth binding pam_passwd_auth.so.1 server_policy
passwd auth required pam_ldap.so.1
# cron service (explicit because of non-usage of pam_roles.so.1)
cron account required pam_unix_account.so.1
# Default definition for Account management
# Used when service name is not explicitly mentioned for account management
other account requisite pam_roles.so.1
#other account required pam_unix_account.so.1
other account binding pam_unix_account.so.1 server_policy
other account required pam_ldap.so.1
# Default definition for Session management
# Used when service name is not explicitly mentioned for session management
other session required pam_unix_session.so.1
# Default definition for Password management
# Used when service name is not explicitly mentioned for password management
other password required pam_dhkeys.so.1
other password requisite pam_authtok_get.so.1
other password requisite pam_authtok_check.so.1
#other password required pam_authtok_store.so.1
other password required pam_authtok_store.so.1 server_policy
# Support for Kerberos V5 authentication and example configurations can
# be found in the pam_krb5(5) man page under the "EXAMPLES" section.
ON CLIENT: Sun's nsswitch.ldap files that get's activated after running lapclient init has LDAP take over everything. I use a trimmed-down nsswitch.conf with very few ldap entries.
nsswitch.conf on LDAP client
(*ldap-client*-root: /var/tmp:215)-> cat /etc/nsswitch.conf
# Copyright 2006 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
# ident "@(#)nsswitch.ldap 1.10 06/05/03 SMI"
# /etc/nsswitch.ldap:
# An example file that could be copied over to /etc/nsswitch.conf; it
# uses LDAP in conjunction with files.
# "hosts:" and "services:" in this file are used only if the
# /etc/netconfig file has a "-" for nametoaddr_libs of "inet" transports.
# LDAP service requires that svc:/network/ldap/client:default be enabled
# and online.
# the following two lines obviate the "+" entry in /etc/passwd and /etc/group.
passwd: files ldap
group: files ldap
# consult /etc "files" only if ldap is down.not using LDAP for hosts
hosts: files dns
# Note that IPv4 addresses are searched for in all of the ipnodes databases
# before searching the hosts databases.
ipnodes: files
networks: files
protocols: files
rpc: files
ethers: files
netmasks: files
bootparams: files
publickey: files
netgroup: files
automount: files ldap
aliases: files
# for efficient getservbyname() avoid ldap
services: files
printers: user files
auth_attr: files
prof_attr: files
project: files
tnrhtp: files
tnrhdb: files
ON CLIENT:
contents of /var/ldap files on client: notice fully qualified NS_LDAP_BINDDN - it me quite some time to understand that this had to be fully qualified or I would continue to get those "Error: Unable to update from profile" in /var/ldap/cachemgr.log and "openConnection: simple bind failed - No such object" in /var/adm/messages error messages.
(*ldap-client*-root: /var/ldap:218)-> cat ldap*
# Do not edit this file manually; your changes will be lost.Please use ldapclien
t (1M) instead.
NS_LDAP_BINDDN= cn=proxyagent,ou=profile,dc=pacmh,dc=us,dc=eds,dc=com
NS_LDAP_BINDPASSWD= (removed)
# Do not edit this file manually; your changes will be lost.Please use ldapclien
t (1M) instead.
NS_LDAP_FILE_VERSION= 2.0
NS_LDAP_SERVERS= my.svr.ip.addr:port (port if not 389)
NS_LDAP_SEARCH_BASEDN= dc=example,dc=com
NS_LDAP_AUTH= simple
NS_LDAP_SEARCH_REF= FALSE
NS_LDAP_SEARCH_SCOPE= one
NS_LDAP_SEARCH_TIME= 30
NS_LDAP_SERVER_PREF= my.svr.ip.addr:port (port if not 389)NS_LDAP_CACHETTL= 3600
NS_LDAP_PROFILE= myprofile
NS_LDAP_CREDENTIAL_LEVEL= proxy
NS_LDAP_BIND_TIME= 15
ON SERVER
After running /usr/lib/ldap/idsconfig, I had to create VLV indexes with this command ( after idsconfig runs, it says to use directoryserver command, which does not exist in JSDS 6.2)
/opt/SUNWdsee/ds6/bin/dsconf create-index -h myserver -p nnnn ( port if not 389 ) dc=example,dc=com getgrent gethostent [....]
enter space-separated list of all VLV indexes idsconfig said to add after you ran idsconfig
ON CLIENT:
If you need to clear client init: ldapclient uninit ( if you get errors, check if ldap_cachemgr is running; if it is, kill -9 it, clear /var/ldap directory, make sure nsswitch.conf is not pointing to ldap stuff -- cp /etc/nsswitch.files /etc/nsswitch.conf
Initialize ldapclient:
ldapclient -v init -a proxyDN=cn=proxyagent,ou=profile,dc=example,dc=com
-a profileName=myprofile my.svr.ip.addr:port (port if not 389)
If this still does not work, clean up client again as before and reboot it. I had some issues w/Sun's nsswitch.conf file for LDAP taking over my client machine and rendering it useless until I rebooted it with files-settings in nsswitch.conf, making my own nsswitch.ldap file it /etc so Sun's LDAP-happy nsswitch file would not be used, and then running ldapclient init.
ON CLIENT
cp /etc/passwd /var/tmp/passwd.ldif ( same for group, shadow, auto_home, auto_master )
Edit each ldif file and remove all entries other than regular user accounts and nobody/noaccess accounts
passwd.ldif should look something like this:
johndoe:x:146:14:John Doe:/home/johndoe:/bin/ksh
janedoe:x:145:14:Jane Doe:/home/janedoe:/bin/ksh
nobody:x:60001:60001:NFS Anonymous Access User:/:
noaccess:x:60002:60002:No Access User:/:
nobody4:x:65534:65534:SunOS 4.x NFS Anonymous Access User:/:
For auto_home, make sure each entry starts w/home-dir server's ip-addr: it'll look something like this:
janedoe 10.10.20.50:/export/home/janedoe
johndoe 10.10.20.50:/export/home/johndoe
ldapaddent -D "cn=Directory Manager" -w <password> -f /var/tmp/passwd.ldif passwd
.... group.ldif group NOTE order is important: passwd,
.... shadow.ldif shadow group, shadow
.... auto_home.ldif auto_home
.... auto_master.ldif auto_master
ON CLIENT
/etc/auto_master
+auto_master
/etc/auto_home
+auto_home
enable these NFS daemons: ( ie. svcadm enable network/nfs/status )
online 9:06:26 svc:/network/nfs/status:default
online 9:06:27 svc:/network/nfs/nlockmgr:default
online 13:09:41 svc:/network/nfs/cbd:default
online 13:09:41 svc:/network/nfs/mapid:default
online 13:09:41 svc:/network/nfs/client:default
enable auto_fs
online 13:37:42 svc:/system/filesystem/autofs:default
ON SERVER
enable these NFS daemons:
online 16:36:16 svc:/network/nfs/cbd:default
online 16:36:16 svc:/network/nfs/status:default
online 16:36:17 svc:/network/nfs/mapid:default
online 16:36:17 svc:/network/nfs/nlockmgr:default
online 16:36:22 svc:/network/nfs/rquota:default
online 16:36:22 svc:/network/nfs/client:default
online 16:36:23 svc:/network/nfs/server:default
ON HOME DIRECTORY SERVER
export home dirs
(home-dir-svr-root: /var/tmp:221)-> cat /etc/dfs/dfstab
# Place share(1M) commands here for automatic execution
# on entering init state 3.
# Issue the command 'svcadm enable network/nfs/server' to
# run the NFS daemon processes and the share commands, after adding
# the very first entry to this file.
# share [-F fstype] [ -o options] [-d "<text>"] <pathname> [resource]
# .e.g,
share -F nfs -o rw -d "home dirs" /export/home
shareall
enable auto_fs
online 13:37:42 svc:/system/filesystem/autofs:default
ON LDAP SERVER via the GUI ( not sure how to do this via command-line and since I have a JAVA GUI, I'm not going to knock myself out on the command-line trying to do something it'l take 15 seconds to do from the GUI -- command-line purists, feel free to contribute command to do this:
From GUI, go into your DS instance: --> entry Management --> automountMapName=auto_home --> automountinformation: 144.10.199.220:/export/home/janedoe
Verify home-dir-svr IP and home dir info are correct.
log on as user from ldap-client
NOTE: I did not alter any UNIX system files ( nsswitch.conf, pam.conf, passwd, auto_home, and the like) on LDAP server.
Not sure if I missed anything, but hope this helps.
John
Edited by: No_Windoze on Nov 14, 2007 4:16 PM

Answer 1

Just remembered something that is very subtle during idsconfig:
At one point durint idsconfig, there's a questions about storing passwords in unix CRYPT format. You must answer yes to that question or none of this will work. The default answer is no.
John
Hi munnik,
I had the same errors initially. I didn't write down what I did to clear them (oops!) but I think what I did to 'fix' this was I restarted/rebooted (can't remember which) the directory server to clear the error and then, from the client and in this order - passwd, group, shadow - I readded ldifs.
If you're still having issues with DS, make sure the VLV index step discussed above was done, nothing missed, no errors - redo if necessary: uninit client(s), reinit client(s) with new profile created as a result of running idsconfig to recreate VLV indexes - it'll skip any VLV indexes that are in the server and display a message to that effect. It's a reather brute-force method of doing things, but I couldn't locate much in the way of troubleshooting user account creation issues.
When I add a new user, here's what I do: add user to server where home dirs are and create a set of passwd, shadow, and auto_home ldif files with just the new user info and run ldapaddent. Then I add them to group (if necessary) with direct edit on ldap server.
HTH
John
(aka NoWindoze)
indexes and VLV Indexes 'created' when I ran idsconfig:
uidNumber (eq,pres) skipped already exists
ipNetworkNumber (eq,pres) skipped already exists
gidnumber (eq,pres) skipped already exists
oncrpcnumber (eq,pres) skipped already exists
automountKey (eq,pres) skipped already exists
VLV-indexes:
getgrent vlv_index skipped already exists
gethostent vlv_index skipped already exists
getnetent vlv_index skipped already exists
getpwent vlv_index skipped already exists
getrpcent vlv_index skipped already exists
getspent vlv_index skipped already exists
getauhoent vlv_index skipped already exists
getsoluent vlv_index skipped already exists
getauduent vlv_index skipped already exists
getauthent vlv_index skipped already exists
getexecent vlv_index skipped already exists
getprofent vlv_index skipped already exists
getmailent vlv_index skipped already exists
getbootent vlv_index skipped already exists
getethent vlv_index skipped already exists
getngrpent vlv_index skipped already exists
getipnent vlv_index skipped already exists
getmaskent vlv_index skipped already exists
getprent vlv_index skipped already exists
getip4ent vlv_index skipped already exists
getip6ent vlv_index skipped already exists
You can see indexes defined in your server with this command:
dsconf list-indexes -h ldap.server.host.name-or.ip -p 389
Edited by: SolarisSAinPA on Nov 30, 2007 1:05 PM
Edited by: SolarisSAinPA on Nov 30, 2007 1:40 PM