And look at this, our first demonstration,
a demonstration where we, yes we,
because you know you have to follow through to really start learning,
are going to be installing OpenLDAP.
We're going to be working on our Ubuntu system,
and we're going to install the OpenLDAP server and its associated utilities.
We can then go through and investigate some of the default configuration,
look at it listening on port 389,
and looking at the different ways that we can connect
through to our directory server.
So come on, let's get our keyboards warmed up.
Now one of the first things that we need to do is to allow the
installation of OpenLDAP to do a lot of the hard work for us.
On Debian‑based systems,
the really nice thing is that it can base the LDAP domain,
the top‑level infrastructure, around our fully qualified domain name,
so we need to make sure we've got this set.
So I'm going to go through and do sudo and then hostnamectl,
and I'm just going to set my hostname to something nice and simple,
and we're going to have then ubuntu.example.com.
Now I'm keeping with the hostname of ubuntu.
Remember,
that was the name that I had previously issued to the
certificate that we're using with our web server.
I can use the same certificate with my LDAP server when I'm
configuring then secure communication to LDAP.
Having said that,
we can go through and view the information even as a standard user,
so our hostnamectl command, and then just hit Enter,
and we can see now that we've set it to ubuntu.example.com.
So all of this is good,
but we're going to need to go through and make our change to our host file,
so sudo and vim /etc/hosts.
And I'm just going to add in my IP address.
So as I go through, my IP address for my Ubuntu system is 192.168.33.13.
Obviously, you need to add in the IP address for your system.
In the hosts file,
the first entry after the IP address is the fully qualified domain name,
so ubuntu.example.com, and then any aliases,
so I'm going to add in my alias of ubuntu.
Remember, it's that alias that I can use,
the hostname ubuntu, that is then related to the certificate that I've issued.
I'm going to hit Escape and then : and x, so that's all saved now.
And if I go through now and ping ubuntu,
then we know then that it's coming back.
And we can see it has resolved from our hosts file,
as it resolves then to ubuntu.example.com,
so that's good, I can just do a Ctrl+C on that.
Clearing my screen with Ctrl+L,
I can then go through and do a sudo apt update to make sure that we've
got the up‑to‑date metadata for our packaging database.
So once this has been done,
then I know I can go ahead and do my sudo and apt install,
‑y so it doesn't prompt me, and then we've got our main LDAP server,
so that's slapd, and ldap‑utils, they're the tools that I need to manage LDAP.
As we go through and take a look at this, we can allow this to chunk through.
And we're going to be prompted now for the administrator of the LDAP directory.
It's created a directory for example.com.
This is the administrator password.
We're creating this account, so obviously it doesn't exist at the moment,
so it's a brand‑new password that we're entering.
I'm making sure that we can type it correctly by prompting for it twice.
We do know that on Ubuntu‑based systems,
the service will have started by default.
So we can go through and verify that we are listening on our LDAP port,
and there we see port 389.
The LDAP port is open both on IP version 4 and IP version 6,
so that's a good sign,
but we could also go through and start checking the myriad of little
utilities that we've got to manage the system.
One of the tools that we can use is ldapwhoami.
When we run the command ldapwhoami, and we only put in then ‑x,
we haven't specified the LDAP user we are connecting as,
we're using simple authentication, and as we take a look,
it then is just anonymous,
so we've connected as an anonymous user to our directory service.
Everything else is at the default,
so it's the default LDAP location on the localhost.
So this is good, we know that this is working,
but we can also go through and specify with a little bit more options.
We can go through and use the Q to specify that we don't need any
additional information being displayed back.
Continuing through,
we can add in the option ‑Y so we can go through and specify
that we're using external authentication.
So we're now connecting as the user that we are in Linux.
Using the option ‑H, we're specifying the URI to connect to,
and here we can see that we're using ldapi,
so we're connecting through to a socket.
We are specifying then the three forward slashes, so it's the local system.
And as we see then, we've got my user ID and group ID being referred back.
This is often used for authentication as root,
as it's the root user who is the main directory administrator,
the infrastructure administrator,
rather than individual directory administrators
like the admin user we saw before.
Now the last simple check to run is an ldapsearch.
We can then go through and make sure that we've got
the correct top‑level domain.
Remember,
I'm saying the top‑level domain by default is going to be
based around your fully qualified domain.
So if I use ldapsearch ‑x, we're connecting as the anonymous user,
but I can go through and specify to search the base dn of dc,
for domain containment, equals example, dc=com,
and it's a comma‑separated fully qualified domain name.
If we specify space and cn, we're only going to display the common name,
so we get less information coming back,
but you see we've got a top‑level container,
example.com, and then our admin user.
Now if you're getting Object not found,
then obviously example com is not being found within your directory,
and that's probably to do with the fact that you hadn't correctly set up
your domain name or you're using a different domain name.
If we want to stick with using example.com or you
want to find out what you have got, we can run through a full wizard.
So to see this, we can clear the screen,
and then run our sudo dpkg, our Debian package,
‑reconfigure, and then the same package,
slapd.
Now we can see then that we could skip the configuration so it doesn't do an
initial configuration we don't want. We want to make sure,
so choose No, we want to run through the initial configuration.
So next up we then get to see our DNS domain name
and then our Organization name, so we can see that it's pulling up example.com,
and we can make sure then that we know the top level
that is going to be connected.
Again, we're creating the admin user.
Now we can then go through and say do we want the database
to be removed when slap daemon is purged?
We can say Yes.
Do we want to move the old database?
I'm going to say, No, keep it in place.
Because I kept the database in place, then it's saying,
well, okay you've already got it there so it doesn't overwrite it,
but that is fine.
But I can still go through and double‑check that we have got our entries there.
So, again, going back and running that search,
we should be able to list then dc=example,
dc=com, and we're only looking at the common names, and we're seeing then our container and the admin user that we've created.