diff --git a/docs/docs/account-mgmt.md b/docs/docs/account-mgmt.md index d2dddfd3c6113d392b73e51f6ea1189aef5012a7..4b8c637884c71f4ef2898f41971019e5510b1033 100644 --- a/docs/docs/account-mgmt.md +++ b/docs/docs/account-mgmt.md @@ -2,14 +2,14 @@ # Advanced user account management using LDAP

How to configure LDAP to access user account information

-There are different ways to configure user accounts on SLC and CC machines at CERN. +There are different ways to configure user accounts at CERN. If you only need to create a few AFS accounts, you should simply use the useraddcern command.

If you need to give access to larger groups of accounts, that are centrally managed in FIM / Active Directory, read on...

-This document describes how to configure a client CC or SLC machine to use +This document describes how to configure a client machine to use the central LDAP service xldap.cern.ch to give access to AFS user groups. Examples:

Enable sssd

+# ## FOR CC7 ONLY ##
 # authconfig --enablesssd --enablesssdauth --update
+# ## FOR CS8 AND NEWER ##
+# authselect select sssd with-silent-lastlog --force
The /etc/nsswitch.conf configuration file describes the order in -which password-file lookups are performed. It should have these entries -configured by the previous command : +which password-file lookups are performed. This file should not need to be ever changed, and should always contain content such as: 
 passwd:     files sss
-shadow:     files sss
 group:      files sss
@@ -189,370 +199,6 @@ authorized CERN user : 
 # getent passwd login
-

Scientific Linux CERN

- -

Configuring /etc/nsswitch.conf

- -The /etc/nsswitch.conf configuration file describes the order in -which password-file lookups are performed. To make sure that local accounts -take precedence over LDAP accounts, it should have these entries: -
-passwd:     files ldap
-shadow:     files
-group:      files ldap
-
-

-Run man nsswitch.conf for more information. - -

[SLC5] Configuring /etc/ldap.conf

- -The /etc/ldap.conf configuration file is used to set system-wide -defaults to be applied when running ldap clients. This mechanism is available -on SLC5 and SLC4, the SLC6-specific mechanism is described below. -

-This section describes the options that are relevant to configure account -lookups in the xldap.cern.ch LDAP service. An example configure -file containing the options described below is can be found -here. Please edit it to suit your needs - in -particular the nss_base_passwd option! -

-Please make sure that the nss_ldap RPM is installed on your client -machine. Run yum install nss_ldap if this RPM is not installed. -

-For more information, run man ldap.conf and/or man nss_ldap. -

-Please note the recipes below have not been extensively tested on SLC4. - -

General options

- -This section describes the main options to be configured in /etc/ldap.conf. - - - -

Filtering the results

- -With the general options above, your machine now has allows access from -all accounts in the LDAP service. That is probable not what you want... -This section gives some examples of filters that you can set to restrict -the results to some useful sets of accounts. - - -

-Note that filters can be combined! For example: to allow all CMS users with enabled accounts: -

-nss_base_passwd OU=Users,OU=Organic Units,DC=cern,DC=ch?one?&(gidNumber=1399)(!(userAccountControl:1.2.840.113556.1.4.803:=2))
-
- -

Overriding attribute values

- -nss_ldap allows to override certain attribute values, like the login shell or the -use home directory. This may be useful on certain server machines. Examples: - -
-# Set the user homedirectory to /dev/null
-nss_override_attribute_value unixHomeDirectory /dev/null
-# Set the login shell to /sbin/nologin
-nss_override_attribute_value loginShell /sbin/nologin
-
- -Note that these values are applied on all results of the LDAP filtering. - - - -

[SLC6] Configuring /etc/nslcd.conf

- -The /etc/nslcd.conf configuration file is used to set system-wide -defaults to be applied when running ldap clients. This mechanism is available -on SLC6, the SLC5- and SLC4-specific mechanism is described above. -

-This section describes the options that are relevant to configure account -lookups in the xldap.cern.ch LDAP service. An example configure -file containing the options described below is can be found -here. Please edit it to suit your needs - in -particular the filter passwd entry! -

-Please make sure that the nss-pam-ldapd RPM is installed on your client -machine. Run yum install nss-pam-ldapd if this RPM is not installed. -

-Then, make sure that the nslcd runs, and gets started at boot time: -

-/sbin/service nslcd restart
-/sbin/chkconfig --level 345 nslcd on
-
-Note: the nslcd service must be restarted after changes to the /etc/nslcd.conf -have been made! -

-For more information, run man nslcd.conf and/or man nslcd. -

-

NOTE: Due to a bug, please add a line to /etc/sysconfig/network

-
-NETWORKWAIT=1
-
-

General options

-This section describes the main options to be configured in /etc/nslcd.conf. - - - -

Filtering the results

- -With the general options above, your machine now has allows access from -all accounts in the LDAP service. That is probable not what you want... -This section gives some examples of filters that you can set to restrict -the results to some useful sets of accounts. - - -

-Note that filters can be combined! For example: to allow all CMS users with enabled accounts: -

-filter passwd (&(objectClass=user)(uidNumber=*)(unixHomeDirectory=*)(&(gidNumber=1399)(!(userAccountControl:1.2.840.113556.1.4.803:=2))))
-
- -

Overriding attribute values

- -nslcd.conf allows to override certain attribute values, like the login shell or the -use home directory. This may be useful on certain server machines. Examples: - -
-# Set the user homedirectory to /home/$USER
-map    passwd homeDirectory    "/home/$sAMAccountName"
-# Set the login shell to /sbin/nologin
-map    passwd loginShell       "/sbin/nologin"
-
- -Note that these values are applied on all results of the LDAP filtering. - -

References

@@ -565,8 +211,3 @@ NSCD Please send feedback and comments on this document to Linux support. - - - - - diff --git a/docs/docs/index.md b/docs/docs/index.md index f39a854ecb4983dc8ff9a0bc41039b2e8f441817..6520749d8cc8464631503995c1733e343cd0136f 100644 --- a/docs/docs/index.md +++ b/docs/docs/index.md @@ -36,21 +36,16 @@
  • Printing from Linux clients at CERN
    • -
  • - Advanced user account management using LDAP
  • - +Advanced user account management using LDAP
  • -Red Hat support - site +Red Hat support site
    • -
  • Red Hat Linux Support Knowledgebase
    • -

    Deprecated / historical documentation