Configuring OES 2 Linux servers for Linux User Management in a normal eDirectory tree is pretty much a no brainer. Configure your Unix Workstation object, enable your groups and users to be LUM enabled and that’s pretty much it. But, what about a SLES 10 server that is not running OES2? How can you provide a standard across all your SLES 10 servers to use the same eDirectory authentication for local access?
In this article, we will successfully configure LUM on a “non-OES2”, SLES 10 server to allow users in your eDirectory LUM enabled group, to authenticate to this server without having to create local accounts, using their eDirectory ID’s and passwords.
These are the steps we will use to accomplish this process:
- Installing Linux User Management Packages
- Pluggable Access Modules (PAM) Configuration
- Name Service Switch (nsswitch) Configuration
- Configure Novell Account Management (namconfig)
- Unix Workstation Object
The resources you will need to accomplish this, which isn’t that difficult or drawn out, are:
Admin equivalent rights, preferably, admin in the eDirectory tree you wish to base your authentication from.
Note: I say “admin” because this is stored in the Novell Account Management (nam) configuration and if you use your account and that account gets disabled, Heaven forbid, it could break this process.
The Open Enterprise Server 2 CD.
Root access to the SLES 10 server.
Installing Linux User Management Packages
I know this is a non-OES2 server, but there are a couple of packages we will need from the CD.
On the SLES 10 server, Run YaST and scroll down to the Software section. Choose Add-On CD.
Select CD, and place the CD in the drive when prompted. Once the CD is read, select “I Agree” and choose next.
Do not select any packages. Click Details and choose Search. In the field, type “lum” and click Go.
Select the following packages and click next:
Do not select YaST2-lum – That will require more eDirectory related packages and we will not be managing LUM through this server, that’s done on an OES2 server.
When the packages are done installing, exit YaST, remove your CD and open a command prompt or Terminal console.
Pluggable Access Modules (PAM) Configuration
Now that we have our Linux User Management packages installed and ready for activation, let’s configure the pam modules for LUM.
With your favorite VI editor, open and edit the file /etc/pam.d/login
Make the following changes and add the lines in Bold to this file:
#%PAM-1.0 auth required pam_securetty.so auth required pam_env.so # auth include common-auth auth required pam_nologin.so auth sufficient pam_nam.so auth required pam_unix2.so account include common-account account sufficient pam_nam.so password include common-password password sufficient pam_nam.so session include common-session session required pam_lastlog.so nowtmp session required pam_resmgr.so session optional pam_mail.so standard session optional pam_nam.so
Save the file and exit.
Make the same changes to the following files:
If you have other options available, like ftp, make these changes to these file also.
Name Service Switch (nsswitch) Configuration
Modify the file /etc/nsswitch.conf and make the following changes:
Scroll down to where you see the following lines.
Add nam to the end of each to where they appear as noted below:
passwd: compat nam
group: compat nam
Save the file and exit back to the bash shell.
Configure Novell Account Management (namconfig)
Now, we are ready to configure the nam. At the prompt, enter the following command, substituting your own parameters as noted. An example will be listed.
namconfig add -a [youradmin fdn] -r [yourbasedn] -w [CxyouwantyourUnixObject] -S [edirectoryldapserver]:389 -l 636
-a cn=admin,o=novell Fully Distinguished Admin account, in LDAP format
-r o=novell Your Base search container
-w o=novell Container you want the Unix Object created in
-S 192.168.10.2:389 Either the IP address, hostname, of your eDirectory server.
-l 636 Yes, that is a lowercase L
Using this, here’s how it will appear:
namconfig add -a cn=admin,o=novell -r o=novell -w o=novell -S 192.168.10.2:389 -l 636
You will be prompted for the password to this account.
Check the output for errors. Common errors are not sufficient rights, unable to modify schema and unable to retrieve certificate. To avoid them, ensure the eDirectory LDAP server has the following:
Time is synchronized
At least a Read / Write replica of the root of the tree
When successful, review the file /etc/nam.conf for the above parameters. Make corrections and re-run namconfig.
Unix Workstation Object
We have to assign a LUM enabled group to the newly created Unix Workstation Object for this SLES server.
Launch iManager and login, with an admin equivalent account, to the tree.
Scroll down, on the left side, to Linux User Management, click it to expand. Find Modify Unix Workstation Object.
Browse the tree and select the Unix Workstation Object that has the SLES 10 server Host Name appended to it.
Click Add and browse the tree and locate the LUM group for your tree. Select it and add it. Click Apply and then OK, once your changes have been applied.
Exit iManager and return to the command prompt or terminal console on the SLES 10 server.
Now let’s restart the namcd and test it.
At the prompt, type the following to restart namcd
If you get an error regarding certificates, type this command to refresh the certificates.
From another PC, you should be able to ssh to this SLES 10 server with your Novell eDirectory credentials. If not, restart the namcd and then check the /var/log/messages file using tail to see if there are any errors. Check your /etc/pam.d/* files to see if there are any stray characters or misspelled words.
Although most of our SLES 10 servers are OES2 and reside in our main eDirectory tree, there are servers, like ZENworks Linux Management and Novell Identity Management servers that are not and I would still like to have a way to administer them without trying to remember that many accounts and passwords. This solution satisfies this need.