Official Red Hat Linux Administrators Guide

The suite of OpenLDAP libraries and tools is spread out over the following packages:

• openldap — Contains the libraries necessary to run the openldap server and client applications.

• openldap-clients — Contains command-line tools for viewing and modifying directories on an LDAP server.

• openldap-server — Contains the servers and other utilities necessary to configure and run an LDAP server.

There are two servers contained in the openldap-servers package: the Standalone LDAP Daemon (/usr/sbin/slapd) and the Standalone LDAP Update Replication Daemon (/usr/sbin/slurpd). The slapd daemon is the actual LDAP server, whereas the slurpd daemon is used to synchronize changes from one LDAP server to other LDAP servers on the network. The slurpd daemon is necessary only when dealing with multiple LDAP servers. To perform administrative tasks, the openldap-server package installs the following utilities into the /usr/sbin/ directory:

• slapadd — Adds entries from an LDIF file to an LDAP directory. For example, /usr/sbin/slapadd -l ldif-input will read in the LDIF file, ldif-input, containing the new entries.

• slapcat — Pulls entries out of an LDAP directory in the default format — Berkeley DB — and saves them in an LDIF file. For example, the command /usr/sbin/slapcat -l ldif-output will output an LDIF file called ldif-output containing the entries from the LDAP directory.

• slapindex — Re-indexes the slapd directory based on the current content.

• slappasswd — Generates an encrypted user password value for use with ldapmodify or the rootpw value in the slapd configuration file, /etc/openldap/slapd.conf. Execute /usr/sbin/slappasswd to create the password.

  Warning

  Be sure to stop slapd by issuing /usr/sbin/service slapd stop before using slapadd, slapcat, or slapindex. Otherwise, the consistency of the LDAP directory will be at risk.

See the man pages for each of these utilities for more information about how to use them.

The openldap-clients package installs tools used to add, modify, and delete entries in an LDAP directory into /usr/bin/. These tools include the following:

• ldapmodify — Modifies entries in an LDAP directory, accepting input via a file or standard input.

• ldapadd — Adds entries to your directory by accepting input via a file or standard input; ldapadd is actually a hard link to ldapmodify -a.

• ldapsearch — Searches for entries in the LDAP directory using a shell prompt.

• ldapdelete — Deletes entries from an LDAP directory by accepting input via user input at the terminal or via a file.

With the exception of ldapsearch, each of these utilities is more easily used by referencing a file containing the changes to be made rather than by typing a command for each entry you wish to change in an LDAP directory. The format of such a file is outlined in each application’s man page.

NSS, PAM, and LDAP

In addition to the OpenLDAP packages, Red Hat Linux includes a package called nss_ldap that enhances LDAP’s ability to integrate into both Linux and other UNIX environments. The nss_ldap package provides the following modules:

• /lib/libnss_ldap- glibc-version.so

• /lib/security/pam_ldap.so

The libnss_ldap- glibc-version.so module allows applications to look up users, groups, hosts, and other information using an LDAP directory via glibc’s Nameservice Switch (NSS) interface. NSS allows applications to authenticate using LDAP in conjunction with Network Information Service (NIS) name service and flat authentication files.

The pam_ldap module allows PAM-aware applications to authenticate users using information stored in an LDAP directory. PAM-aware applications include console login, POP and IMAP mail servers, and Samba. By deploying an LDAP server on your network, all of these login situations can authenticate against one user ID and password combination, greatly simplifying administration.

PHP4, the Apache HTTP Server, and LDAP

Red Hat Linux includes a package containing LDAP modules for the PHP server-side scripting language. The php-ldap package adds LDAP support to the PHP4 HTML-embedded scripting language via the /usr/lib/php4/ldap.so module. This module allows PHP4 scripts to access information stored in an LDAP directory.

LDAP Client Applications

Other graphical LDAP clients that support creating and modifying directories are available, but they do not ship with Red Hat Linux 8.0. One such application is LDAP Browser/Editor — a Java-based tool available at http://www.iit.edu/~gawojar/ldap. Most other LDAP clients access directories as read-only, using them to reference, but not alter, organization-wide information. Some examples of such applications are Mozilla-based Web browsers, Sendmail Balsa, Pine, Evolution, and Gnome Meeting.