221 lines
4.2 KiB
Markdown
221 lines
4.2 KiB
Markdown
---
|
||
title: LDAP Client Setup
|
||
description:
|
||
published: true
|
||
date: 2026-01-21T13:24:54.016Z
|
||
tags:
|
||
editor: markdown
|
||
dateCreated: 2026-01-21T13:21:40.588Z
|
||
---
|
||
|
||
|
||
Your content here✅ LLDAP + SSSD Node Join Checklist (FINAL)
|
||
|
||
Assumptions
|
||
|
||
LLDAP server: docker4
|
||
|
||
LDAP URI: ldap://docker4:3890
|
||
|
||
Base DN: dc=netgrimoire,dc=com
|
||
|
||
Users/groups use lowercase attributes (uidnumber, gidnumber, homedirectory, unixshell, uniquemember)
|
||
|
||
No TLS (lab only)
|
||
|
||
Docker group GID = 1964 in LDAP
|
||
|
||
This node is Ubuntu/Debian-based
|
||
|
||
0️⃣ Safety first (do this every time)
|
||
|
||
Open two SSH sessions to the node
|
||
|
||
Confirm you can sudo
|
||
|
||
Do not edit nsswitch.conf until SSSD is confirmed working
|
||
|
||
1️⃣ Install required packages
|
||
sudo apt update
|
||
sudo apt install -y \
|
||
sssd sssd-ldap sssd-tools \
|
||
libpam-sss libnss-sss libsss-sudo \
|
||
ldap-utils oddjob oddjob-mkhomedir
|
||
|
||
Ensure legacy LDAP NSS is NOT installed
|
||
sudo apt purge -y libnss-ldap libpam-ldap nslcd libnss-ldapd libpam-ldapd || true
|
||
sudo apt autoremove -y
|
||
|
||
2️⃣ Verify LDAP connectivity (must pass)
|
||
getent hosts docker4
|
||
nc -vz docker4 3890
|
||
ldapwhoami -x -H ldap://docker4:3890 \
|
||
-D 'uid=admin,ou=people,dc=netgrimoire,dc=com' -w 'F@lcon13'
|
||
|
||
|
||
❌ If any fail → stop and fix networking/DNS/firewall.
|
||
|
||
3️⃣ Create /etc/sssd/sssd.conf (single file, no includes)
|
||
sudo vi /etc/sssd/sssd.conf
|
||
|
||
|
||
Paste exactly:
|
||
|
||
[sssd]
|
||
services = nss, pam, ssh
|
||
config_file_version = 2
|
||
domains = netgrimoire.com
|
||
|
||
[nss]
|
||
filter_users = root
|
||
filter_groups = root
|
||
|
||
[pam]
|
||
offline_failed_login_attempts = 3
|
||
offline_failed_login_delay = 5
|
||
|
||
[ssh]
|
||
|
||
[domain/netgrimoire.com]
|
||
id_provider = ldap
|
||
auth_provider = ldap
|
||
chpass_provider = ldap
|
||
access_provider = permit
|
||
|
||
enumerate = false
|
||
cache_credentials = true
|
||
|
||
ldap_uri = ldap://docker4:3890
|
||
ldap_schema = rfc2307bis
|
||
ldap_search_base = dc=netgrimoire,dc=com
|
||
|
||
ldap_auth_disable_tls_never_use_in_production = true
|
||
ldap_id_use_start_tls = false
|
||
ldap_tls_reqcert = never
|
||
|
||
ldap_default_bind_dn = uid=admin,ou=people,dc=netgrimoire,dc=com
|
||
ldap_default_authtok = F@lcon13
|
||
|
||
# USERS (lowercase attributes)
|
||
ldap_user_search_base = ou=people,dc=netgrimoire,dc=com
|
||
ldap_user_object_class = posixAccount
|
||
ldap_user_name = uid
|
||
ldap_user_gecos = cn
|
||
ldap_user_uid_number = uidnumber
|
||
ldap_user_gid_number = gidnumber
|
||
ldap_user_home_directory = homedirectory
|
||
ldap_user_shell = unixshell
|
||
|
||
# GROUPS (lowercase attributes)
|
||
ldap_group_search_base = ou=groups,dc=netgrimoire,dc=com
|
||
ldap_group_object_class = groupOfUniqueNames
|
||
ldap_group_name = cn
|
||
ldap_group_gid_number = gidnumber
|
||
ldap_group_member = uniquemember
|
||
|
||
4️⃣ Fix permissions (SSSD will NOT start without this)
|
||
sudo chown root:root /etc/sssd/sssd.conf
|
||
sudo chmod 600 /etc/sssd/sssd.conf
|
||
sudo chmod 700 /etc/sssd
|
||
|
||
|
||
Validate:
|
||
|
||
sudo sssctl config-check
|
||
|
||
5️⃣ Start SSSD cleanly
|
||
sudo systemctl enable sssd
|
||
sudo systemctl stop sssd
|
||
sudo rm -f /var/lib/sss/db/* /var/lib/sss/mc/*
|
||
sudo systemctl start sssd
|
||
|
||
|
||
Verify:
|
||
|
||
sudo systemctl status sssd --no-pager -l
|
||
sudo sssctl domain-status netgrimoire.com
|
||
|
||
|
||
Expected:
|
||
|
||
Online status: Online
|
||
LDAP: docker4
|
||
|
||
6️⃣ Enable NSS lookups via SSSD (LDAP-first)
|
||
|
||
Edit /etc/nsswitch.conf:
|
||
|
||
passwd: sss files systemd
|
||
group: sss files systemd
|
||
shadow: sss files
|
||
|
||
|
||
Test:
|
||
|
||
getent passwd graymutt
|
||
getent group docker
|
||
id graymutt
|
||
|
||
7️⃣ 🔑 RE-INITIALIZE PAM (THIS IS THE STEP YOU REMEMBERED)
|
||
|
||
This step is mandatory on Debian/Ubuntu.
|
||
|
||
sudo pam-auth-update
|
||
|
||
In the menu, ENABLE:
|
||
|
||
✅ Unix authentication
|
||
|
||
✅ SSSD
|
||
|
||
✅ Create home directory on login
|
||
|
||
DISABLE:
|
||
|
||
❌ LDAP Authentication (legacy)
|
||
|
||
❌ Kerberos (unless you explicitly use it)
|
||
|
||
Press OK.
|
||
|
||
8️⃣ Verify PAM wiring
|
||
grep pam_sss.so /etc/pam.d/common-*
|
||
grep pam_mkhomedir /etc/pam.d/common-session
|
||
|
||
|
||
You should see:
|
||
|
||
session required pam_mkhomedir.so skel=/etc/skel umask=0022
|
||
|
||
9️⃣ Final login test (definitive)
|
||
ssh graymutt@localhost
|
||
|
||
|
||
Expected:
|
||
|
||
Login succeeds
|
||
|
||
/home/graymutt is auto-created
|
||
|
||
Correct LDAP groups present
|
||
|
||
🔟 (Optional but recommended) Remove local docker group
|
||
|
||
If the node has a local docker group (gid 998):
|
||
|
||
sudo groupdel docker
|
||
|
||
|
||
Verify:
|
||
|
||
getent group docker
|
||
|
||
|
||
Expected:
|
||
|
||
docker:x:1964:graymutt,dockhand
|
||
|
||
🧪 Fast troubleshooting commands
|
||
sudo sssctl domain-status netgrimoire.com
|
||
sudo tail -n 200 /var/log/sssd/sssd_netgrimoire.com.log
|
||
sudo systemctl status sssd --no-pager -l
|