forked from martymac/ldapscripts
-
Notifications
You must be signed in to change notification settings - Fork 0
/
README
145 lines (108 loc) · 5.26 KB
/
README
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
Ldapscripts - README file
*************************
Description :
*************
The ldapscripts are originally designed to be used within Samba 3.x's
smb.conf file. They allow to manipulate POSIX entries for users, groups
and machines in an LDAP directory. They are written in shell and need ldap
client commands to work correctly (ldapadd, ldapdelete, ldapmodify,
ldapsearch). Other scripts also are provided as simple tools to (manually)
query your LDAP directory : ldapfinger, ldapid, lsldap (...).
They are designed to be used under GNU/Linux or FreeBSD (any other
recent UNIX-like should also work) and require several binaries that should
come with your OS (uuencode, getent/pw, date, grep, sed, cut...).
Latest version available on http://contribs.martymac.org
Installing and configuring the ldapscripts :
********************************************
To install the scripts, just type in :
# make install
or, to define a special installation directory :
# make PREFIX=/target/directory install
Use 'make help' for more options.
All the scripts will be copied (by default) to /usr/local/sbin and
ldapscripts.conf will be copied to /usr/local/etc/ldapscripts.
Keep in mind that the scripts are installed with quite restrictive rights.
You may have to play with group rights or ACLs (if they are enabled
on your system) to make the things work...
Once installed, edit /usr/local/etc/ldapscripts/ldapscripts.conf to
configure the ldapscripts.
Then, just type in - e.g. :
# ldapadduser foo foogroup
See ldapscripts(5) for more details.
Configuring your OpenLDAP server :
**********************************
Be sure to include these schemas in your slapd.conf :
- core.schema
- cosine.schema (for the account objectClass)
- nis.schema (for the posixAccount objectClass) or a modified
RFC 2307bis compliant version of this file if you plan to use
AUXILIARY posixGroup objectClasses together with groupOfNames
or groupOfUniqueNames objectClasses (see GCLASS parameter in
the ldapscripts.conf file).
Using the ldapscripts with Samba 3.x :
**************************************
To use the ldapscripts with Samba 3.x (e.g. for a Windows -> Samba migration),
just add the following to your smb.conf file :
# [...]
add machine script = /usr/local/sbin/ldapaddmachine '%u' sambamachines
add user script = /usr/local/sbin/ldapadduser '%u' sambausers
add group script = /usr/local/sbin/ldapaddgroup '%g'
add user to group script = /usr/local/sbin/ldapaddusertogroup '%u' '%g'
delete user script = /usr/local/sbin/ldapdeleteuser '%u'
delete group script = /usr/local/sbin/ldapdeletegroup '%g'
delete user from group script = /usr/local/sbin/ldapdeleteuserfromgroup '%u' '%g'
set primary group script = /usr/local/sbin/ldapsetprimarygroup '%u' '%g'
rename user script = /usr/local/sbin/ldaprenameuser '%uold' '%unew'
# [...]
and make sure sambamachines and sambausers exist before attempting to
do a "net rpc vampire"...
Files :
*******
* Various files :
README : this file !
COPYING : the GPLv2 (or later) license
CHANGELOG : the changelog file, of course
VERSION : the current version of the ldapscripts
TODO : ideas, remaining work
Makefile : installation Makefile
* Man pages :
man/* : man pages
* Configuration files :
etc/ldapscripts.conf : configuration file
etc/ldapadduser.template.sample : user LDIF template file
etc/ldapaddgroup.template.sample : group LDIF template file
etc/ldapaddmachine.template.sample : machine LDIF template file
* 'Library' files
lib/runtime : runtime file used by the scripts (contains functions, etc...)
* Scripts that can be used in Samba configuration file (smb.conf) :
sbin/ldapaddgroup : adds a POSIX group to LDAP
sbin/ldapadduser : adds a POSIX user to LDAP
sbin/ldapdeletegroup : deletes a POSIX group from LDAP
sbin/ldapdeleteuserfromgroup : deletes a member from a group
sbin/ldapsetprimarygroup : sets gidNumber of a POSIX user or machine account
sbin/ldapaddmachine : adds a POSIX machine (user$) to LDAP
sbin/ldapaddusertogroup : adds a member to a group
sbin/ldapdeleteuser : deletes a POSIX user from LDAP
sbin/ldaprenameuser : renames a POSIX user account in LDAP
* Additional (useful) scripts not useable by Samba :
sbin/ldapdeletemachine : deletes a POSIX machine account in LDAP
sbin/ldapinit : initializes the LDAP tree with a minimal tree
sbin/lsldap : performs a *big* recursive query on the LDAP server from the root dn
sbin/ldapmodifyuser : modifies a POSIX user account in LDAP interactively
sbin/ldapmodifymachine : modifies a POSIX machine account in LDAP interactively
sbin/ldapmodifygroup : modifies a POSIX group account in LDAP interactively
sbin/ldaprenamemachine : renames a POSIX machine account in LDAP
sbin/ldaprenamegroup : renames a POSIX group in LDAP
sbin/ldapsetpasswd : modifies a POSIX user account's password in LDAP
sbin/ldapfinger : displays a user/machine/group POSIX account's details
sbin/ldapid : displays a user's list of IDs
sbin/ldapgid : displays a group's list of IDs
Environment :
*************
You can set the LDAPSCRIPTS_CONF environment variable to override default
configuration file's location.
Author / Licence :
******************
These scripts have been written by Ganaël LAPLANCHE ([email protected])
and are available within the GPL license (see COPYING for details).
Thanks for using the ldapscripts... Any feedback welcome :)