Configuring LDAP Auth for Linux

As a central source of user information, the EmpowerID Virtual Directory Server (VDS) can be leveraged as an authentication or identity provider for Linux servers. By making a few configuration changes, organizations can give users single sign-on capabilities to one or more Linux machines without requiring those users have accounts on those machines. In this way, organizations can simplify the processes for managing Linux users as the need for creating and maintaining accounts across multiple systems is negated. With the EmpowerID VDS, this information can be fully managed from one location—the EmpowerID Identity Warehouse.

Configuring LDAP authentication for Linux involves making a few configuration changes on each Linux machine for which you want to enable the feature. These changes include the following:

• Installing the System Security Services Daemon (SSSD)

• Configuring NSS services for SSSD

• Editing the LDAP configuration file for your LDAP domain

• Modifying PAM files

• Creating a working SSSD configuration file

• Starting the SSSD service

To configure LDAP Auth for Linux

1. Log into the target Linux server as an administrative user and install SSSD for your particular Linux distribution.

   
   

   Debian/Ubuntu

   sudo apt-get install sssd sssd-tools
   
   

   CentOS/RedHat

   sudo yum install sssd sssd-tools

2. Next, open the nsswitch.conf file and verify SSSD. Change the file as needed so that you see the following values:

   
   

   Debian/Ubuntu

   sudo vi /etc/nsswitch.conf
       passwd: compat sss
       group:  compat sss
       shadow: compat sss
       ...
       services:  db files sss
   
   

   CentOS/RedHat

   sudo vi /etc/nsswitch.conf
       passwd: files sss
       group:  files sss
       shadow: files sss
       ...
       services: files sss
       ...

3. Open the ldap.conf file and add the following to the end of the file to instruct SSSD to use the specified LDAP directory as the auth provider. This information consists of the mechanism for TLS, the URI and port for your LDAP server, as well as the search base.
   
   

   Be sure to replace serverFQDN:port with the FQDN and port of your EmopowerID LDAP server.

   
   

   Debian/Ubuntu

   sudo vi /etc/ldap/ldap.conf
       TLS_CACERT /etc/ssl/certs/ca-certificates.crt
       URI ldaps://serverFQDN:port/
       BASE o=empowerid
   
   

   CentOS/RedHat

   sudo vi /etc/openldap/ldap.conf
       TLS_CACERT /etc/ssl/certs/ca-certificates.crt
       URI ldaps://serverFQDN:port/
       BASE o=empowerid

   
   
   

4. Next, configure PAM files for SSSD. In Debian/Ubuntu, this involves multiple files, whereas in CentOS/RedHat, you edit a single PAM file.
   
   

   The following examples include instructional comments. You can exclude these when altering your files.

   
   

   Debian/Ubuntu

   sudo vi /etc/pam.d/common-account
   # Add the following to the end of the file
   account [default-bad success=ok user_unknow=ignore]  pam_sss.so
       
   sudo vi /etc/pam.d/common-auth
   # Add the following after pam_unix
   auth  [success=1 default=ignore]  pam_sss.so use_first_pass
       
   sudo vi /etc/pam.d/common-password
   # Add the following to the beginning of the Session section
   session  required  pam_mkhomedir.so umask=0022 skel=/etc/skel/
       
   # Add the following after pam_unix.so
   session  optional  pam_sss.so
   
   

   CentOS/RedHat

   cp /etc/pam.d/system-auth-ac /etc/pam.d/system-auth-ac.orig && cp /etc/pam.d/password-auth-ac /etc/pam.d/password-auth-ac.orig
       
   sudo vi /etc/pam.d/system-auth-ac
   # In the auth section, after pam_succedd_if add the following:
   auth  sufficient  pam_sss.so forward_pass
       
   # In the account section, after pam_succeed_if add the following:
   account  [default=bad success=ok user_unknown=ignore]  pam_sss.so
       
   # In the password section, after pam_unix add the following:
   password  sufficient  pam_sss.so use_authtok
       
   # At the beginning of the session section, ensure the following is present:
   session  required  pam_mkhomedir.so umask=0022 skel=/etc/skel/
       
   # In the session section, after pam_unix add the following:
   session  optional  pam_sss.so
       
   cp -f /etc/pam.d/system-auth-ac /etc/pam.d/password-auth-ac

   
   
   

5. Create an sssd.config file and give the sudo user read and write permissions to it. The procedure is the same for each distribution discussed in this topic.

   
   
   

6. Open the sssd.conf file and add the following content to it. When doing so, replace serverFQDN:port with the FQDN and port of your EmpowerID LDAP server.

   
   
   

7. Turn off SELinux on CentOS and RedHat.

   
   
   

8. Start the SSSD service.