HOWTO : OpenLDAP 2.4 NFSv4 Automount Map Repository on CentOS 6.2

We continue our OpenLDAP 2.4 series with goal number 6.

1. Install OpenLDAP 2.4.
2. Configure Transport Layer Security (TLS).
3. Manage users and groups in OpenLDAP.
4. Configure pam_ldap to authenticate users via OpenLDAP.
5. Use OpenLDAP as sudo's configuration repository.
6. Use OpenLDAP as automount map repository for autofs.
7. Use OpenLDAP as NFS netgroup repository again for autofs.
8. Use OpenLDAP as the Kerberos principal repository.
9. Setup OpenLDAP backup and recovery.
10. Setup OpenLDAP replication.

In this document, we will learn how to setup an NFS server along with an NFS client which runs autofs(5) version 5. This daemon will fetch his automount maps from our OpenLDAP 2.4 server. The client will then be configured to mount users home directories from the NFS server. All OpenLDAP users DN will be modified to reflect this change. We will also create a central NFS software repository.

Server NFS Configuration

Install the required packges.

sudo yum -y install nfs-utils nfs4-acl-tools openldap-clients nss-pam-ldapd

Create a directory in which user's homes will reside (/export/home) and the central software repository (/export/install)

sudo mkdir -p /export/home /export/install

Keep in mind that we need to create a home directory for each users. Since our users are stored in OpenLDAP, we must make sure that the NFS server is also an LDAP client. That means editing the LDAP client file.

sudo vi /etc/openldap/ldap.conf

Then making sure the nslcd(8) is properly configured and starts at boot time.

sudo chkconfig nslcd on

sudo vi /etc/nslcd.conf

Start the daemon.

sudo /etc/init.d/nslcd start

Edit the name service switch configuration file to enable LDAP lookups.

sudo vi /etc/nsswitch.conf

Test to see if the test user is part of the local /etc/passwd file? It should not be.

grep ^test.user /etc/passwd

Now test to see if we can fetch it's data from the LDAP server?

getent passwd test.user

test.user:x:1101:1101:Test User:/nfs/home/test.user:/bin/bash

getent group test.group

test.group:*:1101:

sudo getent shadow test.user

test.user:{SSHA}RsAMqOI3647qgZF3x2BKBnp0sEVfa:15140:0:99999:7:::0

As we can see, one must be UID zero if we are to get any shadow data. That is the expected behavior. We can now create a test case. Fortunately, we have our test.user!

sudo mkdir /export/home/test.user

sudo cp /etc/skel/.* /export/home/test.user

sudo chown -R test.user:test.group /export/home/test.user

If we don't remember your test.user's password, now is the update it.

ldappasswd -xZWD cn=admin,dc=company,dc=com -S cn=test.user,ou=users,dc=company,dc=com

Configure the /etc/exports file to enable NFS exports.

sudo vi /etc/exports

Configure the NFS daemons.

sudo vi /etc/sysconfig/nfs

Enable the NFS daemons.

sudo chkconfig rpcbind on

sudo /etc/init.d/rpcbind start

sudo chkconfig nfs on

sudo /etc/init.d/nfs start

sudo chkconfig nfslock on

sudo /etc/init.d/nfslock start

Check to see if the filesystems are exported?

showmount -e

Export list for alice.company.com:

/export/install *.company.com

/export/home    *.company.com

LDAP Server Configuration

Now that our NFS server is configured, we need to add the automount schema to our LDAP server. The easiest way to get the schema is to install the autofs package.

sudo yum -y install autofs

This package comes with the required schema.

rpm -ql autofs | grep schema

/usr/share/doc/autofs-5.0.5/autofs.schema

Which means to add the autofs schema, we just need to do the same thing we did with sudo in one of my previous blog post. Start by creating a temporary configuration file. Notice that we need the core.schema in this temporary configuration file. Otherwise we get an error saying : « objectclass: AttributeType not found: "ou" » because the autofs.schema file depends on the "ou" objectClass.

echo "include /etc/openldap/schema/core.schema" > ~/ldap/autofs.conf

rpm -ql autofs | grep -i schema | sed 's/^/include /g' >> ~/ldap/autofs.conf

Next, use slapcat(8C) to generate the new autofs schema in LDIF format.

slapcat -f ~/ldap/autofs.conf -F ~/ldap -n 0

The new LDIF schema file is dumped in ~/ldap/cn\=config/cn\=schema/cn\=\{1\}autofs.ldif. As was the case with the sudo schema, we first need to sanitize this new file before we can add it to our OpenLDAP server. A few quick sed(1) commands should do the trick.

sed -re "/^(structuralObjectClass|entry[C|U]|creat[e|o]|modif[i|y])/d" ~/ldap/cn\=config/cn\=schema/cn\=\{1\}autofs.ldif > ~/ldap/autofs.schema.ldif

sed -i.bak -e "s/{1}autofs/autofs/g" ~/ldap/autofs.schema.ldif

sed -i.bak -e "s/cn=autofs/cn=autofs,cn=schema,cn=config/g" ~/ldap/autofs.schema.ldif

The resulting LDIF file is quite small.

cat ~/ldap/autofs.schema.ldif

We can now add this to our OpenLDAP server.

sudo ldapmodify -aH ldapi:/// -f ~/ldap/autofs.schema.ldif

If we take a look to our server log file, we will see that our new schema has been included.

slapd[10783]: conn=1067 op=2 ADD dn="cn=autofs,cn=schema,cn=config"

We can double check that of course.

sudo ldapsearch -LLLY EXTERNAL -H ldapi:/// -b cn=schema,cn=config dn | grep auto

dn: cn={14}autofs,cn=schema,cn=config

Good! Now let's add the autofs container and some configuration values. Edit yet another LDIF file.

vi ~/ldap/autofs.ldif

Check to see if our changes are now part of the OpenLDAP server?

sudo ldapsearch -LLLY EXTERNAL -H ldapi:/// -b ou=autofs,ou=services,dc=company,dc=com dn

Excellent! We're now ready to configure a client machine.

Client Configuration

Here we assume that the client is already an LDAP client of our OpenLDAP server. If not, then read my previous blog posts on the subject.

As always, make sure the required packages are installed.

sudo yum -y install rpcbind nfs-utils nfs4-acl-tools nss-pam-ldapd openldap-clients autofs

Configure idmapd(8).

sudo vi /etc/idmapd.conf

Make sure various daemons are started at boot and start them manually. NOTE : I had a problem where idmapd required a complete client AND server reboot for it to work. If it doesn't work for you, try it.

sudo chkconfig rpcbind on

sudo /etc/init.d/rpcbind start

sudo chkconfig nfslock on

sudo /etc/init.d/nfslock start

sudo chkconfig rpcidmapd on

sudo /etc/init.d/rpcidmapd start

Configure the name service switch file so that the automount: keyword uses the ldap directory.

sudo vi /etc/nsswitch.conf

automount: ldap

Configure the automount(8) daemon.

sudo vi /etc/sysconfig/autofs

Configure LDAP authentication for the autmount(8) daemon.

sudo vi /etc/autofs_ldap_auth.conf

Fix permissions on the file. Otherwise we get this error which is pretty clear :)

automount[4570]: parse_ldap_config: lookup(ldap): Configuration file /etc/autofs_ldap_auth.conf exists, but is not usable. Please make sure that it is owned by root, group is root, and the mode is 0600.

Make sure the automount daemon starts when the client machine boots and start the daemon.

sudo chkconfig autofs on

sudo /etc/init.d/autofs start

Check the server and the client log files. If all is good, then test your configuration.

cd /nfs/install

df -h .

Filesystem            Size  Used Avail Use% Mounted on

alice.company.com:/export/install

                      770G   17G  714G   3% /nfs/install

Voilà! Goal number 6 is done!

1. Install OpenLDAP 2.4.
2. Configure Transport Layer Security (TLS).
3. Manage users and groups in OpenLDAP.
4. Configure pam_ldap to authenticate users via OpenLDAP.
5. Use OpenLDAP as sudo's configuration repository.
6. Use OpenLDAP as automount map repository for autofs.
7. Use OpenLDAP as NFS netgroup repository again for autofs.
8. Use OpenLDAP as the Kerberos principal repository.
9. Setup OpenLDAP backup and recovery.
10. Setup OpenLDAP replication.

In future blog posts, I will show how to use a Kerberos principal and SASL GSSAPI to authenticate the autofs daemon.

Stay tuned!

DA+